* [PATCH 4.19 001/293] ext4: fix race writing to an inline_data file while its xattrs are changing
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 002/293] xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG Greg Kroah-Hartman
` (298 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, stable, syzbot+13146364637c7363a7de,
Theodore Tso
From: Theodore Ts'o <tytso@mit.edu>
commit a54c4613dac1500b40e4ab55199f7c51f028e848 upstream.
The location of the system.data extended attribute can change whenever
xattr_sem is not taken. So we need to recalculate the i_inline_off
field since it mgiht have changed between ext4_write_begin() and
ext4_write_end().
This means that caching i_inline_off is probably not helpful, so in
the long run we should probably get rid of it and shrink the in-memory
ext4 inode slightly, but let's fix the race the simple way for now.
Cc: stable@kernel.org
Fixes: f19d5870cbf72 ("ext4: add normal write support for inline data")
Reported-by: syzbot+13146364637c7363a7de@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/inline.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -750,6 +750,12 @@ int ext4_write_inline_data_end(struct in
ext4_write_lock_xattr(inode, &no_expand);
BUG_ON(!ext4_has_inline_data(inode));
+ /*
+ * ei->i_inline_off may have changed since ext4_write_begin()
+ * called ext4_try_to_write_inline_data()
+ */
+ (void) ext4_find_inline_data_nolock(inode);
+
kaddr = kmap_atomic(page);
ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
kunmap_atomic(kaddr);
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 002/293] xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 001/293] ext4: fix race writing to an inline_data file while its xattrs are changing Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 003/293] gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats Greg Kroah-Hartman
` (297 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Max Filippov,
Chris Zankel, linux-xtensa
From: Randy Dunlap <rdunlap@infradead.org>
commit ed5aacc81cd41efc4d561e14af408d1003f7b855 upstream.
XTENSA should only select HAVE_FUTEX_CMPXCHG when FUTEX is
set/enabled. This prevents a kconfig warning.
WARNING: unmet direct dependencies detected for HAVE_FUTEX_CMPXCHG
Depends on [n]: FUTEX [=n]
Selected by [y]:
- XTENSA [=y] && !MMU [=n]
Fixes: d951ba21b959 ("xtensa: nommu: select HAVE_FUTEX_CMPXCHG")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: Chris Zankel <chris@zankel.net>
Cc: linux-xtensa@linux-xtensa.org
Message-Id: <20210526070337.28130-1-rdunlap@infradead.org>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -25,7 +25,7 @@ config XTENSA
select HAVE_DMA_CONTIGUOUS
select HAVE_EXIT_THREAD
select HAVE_FUNCTION_TRACER
- select HAVE_FUTEX_CMPXCHG if !MMU
+ select HAVE_FUTEX_CMPXCHG if !MMU && FUTEX
select HAVE_HW_BREAKPOINT if PERF_EVENTS
select HAVE_IRQ_TIME_ACCOUNTING
select HAVE_MEMBLOCK
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 003/293] gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 001/293] ext4: fix race writing to an inline_data file while its xattrs are changing Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 002/293] xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 004/293] qed: Fix the VF msix vectors flow Greg Kroah-Hartman
` (296 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Halasa, Philipp Zabel,
Sasha Levin
From: Krzysztof Hałasa <khalasa@piap.pl>
[ Upstream commit 7cca7c8096e2c8a4149405438329b5035d0744f0 ]
Video captured in 1400x1050 resolution (bytesperline aka stride = 1408
bytes) is invalid. Fix it.
Signed-off-by: Krzysztof Halasa <khalasa@piap.pl>
Link: https://lore.kernel.org/r/m3y2bmq7a4.fsf@t19.piap.pl
[p.zabel@pengutronix.de: added "gpu: ipu-v3:" prefix to commit description]
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/ipu-v3/ipu-cpmem.c | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/ipu-v3/ipu-cpmem.c b/drivers/gpu/ipu-v3/ipu-cpmem.c
index a9d2501500a1..170371770dd4 100644
--- a/drivers/gpu/ipu-v3/ipu-cpmem.c
+++ b/drivers/gpu/ipu-v3/ipu-cpmem.c
@@ -545,21 +545,21 @@ static const struct ipu_rgb def_bgra_16 = {
.bits_per_pixel = 16,
};
-#define Y_OFFSET(pix, x, y) ((x) + pix->width * (y))
-#define U_OFFSET(pix, x, y) ((pix->width * pix->height) + \
- (pix->width * ((y) / 2) / 2) + (x) / 2)
-#define V_OFFSET(pix, x, y) ((pix->width * pix->height) + \
- (pix->width * pix->height / 4) + \
- (pix->width * ((y) / 2) / 2) + (x) / 2)
-#define U2_OFFSET(pix, x, y) ((pix->width * pix->height) + \
- (pix->width * (y) / 2) + (x) / 2)
-#define V2_OFFSET(pix, x, y) ((pix->width * pix->height) + \
- (pix->width * pix->height / 2) + \
- (pix->width * (y) / 2) + (x) / 2)
-#define UV_OFFSET(pix, x, y) ((pix->width * pix->height) + \
- (pix->width * ((y) / 2)) + (x))
-#define UV2_OFFSET(pix, x, y) ((pix->width * pix->height) + \
- (pix->width * y) + (x))
+#define Y_OFFSET(pix, x, y) ((x) + pix->bytesperline * (y))
+#define U_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
+ (pix->bytesperline * ((y) / 2) / 2) + (x) / 2)
+#define V_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
+ (pix->bytesperline * pix->height / 4) + \
+ (pix->bytesperline * ((y) / 2) / 2) + (x) / 2)
+#define U2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
+ (pix->bytesperline * (y) / 2) + (x) / 2)
+#define V2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
+ (pix->bytesperline * pix->height / 2) + \
+ (pix->bytesperline * (y) / 2) + (x) / 2)
+#define UV_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
+ (pix->bytesperline * ((y) / 2)) + (x))
+#define UV2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
+ (pix->bytesperline * y) + (x))
#define NUM_ALPHA_CHANNELS 7
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 004/293] qed: Fix the VF msix vectors flow
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 003/293] gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 005/293] net: macb: Add a NULL check on desc_ptp Greg Kroah-Hartman
` (295 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Prabhakar Kushwaha, Ariel Elior,
Shai Malin, David S. Miller, Sasha Levin
From: Shai Malin <smalin@marvell.com>
[ Upstream commit b0cd08537db8d2fbb227cdb2e5835209db295a24 ]
For VFs we should return with an error in case we didn't get the exact
number of msix vectors as we requested.
Not doing that will lead to a crash when starting queues for this VF.
Signed-off-by: Prabhakar Kushwaha <pkushwaha@marvell.com>
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: Shai Malin <smalin@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qed/qed_main.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 049a83b40e46..9d77f318d11e 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -439,7 +439,12 @@ static int qed_enable_msix(struct qed_dev *cdev,
rc = cnt;
}
- if (rc > 0) {
+ /* For VFs, we should return with an error in case we didn't get the
+ * exact number of msix vectors as we requested.
+ * Not doing that will lead to a crash when starting queues for
+ * this VF.
+ */
+ if ((IS_PF(cdev) && rc > 0) || (IS_VF(cdev) && rc == cnt)) {
/* MSI-x configuration was achieved */
int_params->out.int_mode = QED_INT_MODE_MSIX;
int_params->out.num_vectors = rc;
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 005/293] net: macb: Add a NULL check on desc_ptp
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 004/293] qed: Fix the VF msix vectors flow Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 006/293] qede: Fix memset corruption Greg Kroah-Hartman
` (294 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Harini Katakam, Radhey Shyam Pandey,
Michal Simek, David S. Miller, Sasha Levin
From: Harini Katakam <harini.katakam@xilinx.com>
[ Upstream commit 85520079afce885b80647fbd0d13d8f03d057167 ]
macb_ptp_desc will not return NULL under most circumstances with correct
Kconfig and IP design config register. But for the sake of the extreme
corner case, check for NULL when using the helper. In case of rx_tstamp,
no action is necessary except to return (similar to timestamp disabled)
and warn. In case of TX, return -EINVAL to let the skb be free. Perform
this check before marking skb in progress.
Fixes coverity warning:
(4) Event dereference:
Dereferencing a null pointer "desc_ptp"
Signed-off-by: Harini Katakam <harini.katakam@xilinx.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_ptp.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c
index 8f912de44def..ecb0fb1ddde7 100644
--- a/drivers/net/ethernet/cadence/macb_ptp.c
+++ b/drivers/net/ethernet/cadence/macb_ptp.c
@@ -286,6 +286,12 @@ void gem_ptp_rxstamp(struct macb *bp, struct sk_buff *skb,
if (GEM_BFEXT(DMA_RXVALID, desc->addr)) {
desc_ptp = macb_ptp_desc(bp, desc);
+ /* Unlikely but check */
+ if (!desc_ptp) {
+ dev_warn_ratelimited(&bp->pdev->dev,
+ "Timestamp not supported in BD\n");
+ return;
+ }
gem_hw_timestamp(bp, desc_ptp->ts_1, desc_ptp->ts_2, &ts);
memset(shhwtstamps, 0, sizeof(struct skb_shared_hwtstamps));
shhwtstamps->hwtstamp = ktime_set(ts.tv_sec, ts.tv_nsec);
@@ -318,8 +324,11 @@ int gem_ptp_txstamp(struct macb_queue *queue, struct sk_buff *skb,
if (CIRC_SPACE(head, tail, PTP_TS_BUFFER_SIZE) == 0)
return -ENOMEM;
- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
desc_ptp = macb_ptp_desc(queue->bp, desc);
+ /* Unlikely but check */
+ if (!desc_ptp)
+ return -EINVAL;
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
tx_timestamp = &queue->tx_timestamps[head];
tx_timestamp->skb = skb;
/* ensure ts_1/ts_2 is loaded after ctrl (TX_USED check) */
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 006/293] qede: Fix memset corruption
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 005/293] net: macb: Add a NULL check on desc_ptp Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 007/293] perf/x86/intel/pt: Fix mask of num_address_ranges Greg Kroah-Hartman
` (293 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Prabhakar Kushwaha, Ariel Elior,
Shai Malin, Kees Cook, David S. Miller, Sasha Levin
From: Shai Malin <smalin@marvell.com>
[ Upstream commit e543468869e2532f5d7926e8f417782b48eca3dc ]
Thanks to Kees Cook who detected the problem of memset that starting
from not the first member, but sized for the whole struct.
The better change will be to remove the redundant memset and to clear
only the msix_cnt member.
Signed-off-by: Prabhakar Kushwaha <pkushwaha@marvell.com>
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: Shai Malin <smalin@marvell.com>
Reported-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 1aabb2e7a38b..756c5943f5e0 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -1676,6 +1676,7 @@ static void qede_sync_free_irqs(struct qede_dev *edev)
}
edev->int_info.used_cnt = 0;
+ edev->int_info.msix_cnt = 0;
}
static int qede_req_msix_irqs(struct qede_dev *edev)
@@ -2193,7 +2194,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode,
goto out;
err4:
qede_sync_free_irqs(edev);
- memset(&edev->int_info.msix_cnt, 0, sizeof(struct qed_int_info));
err3:
qede_napi_disable_remove(edev);
err2:
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 007/293] perf/x86/intel/pt: Fix mask of num_address_ranges
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 006/293] qede: Fix memset corruption Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 008/293] perf/x86/amd/ibs: Work around erratum #1197 Greg Kroah-Hartman
` (292 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xiaoyao Li, Peter Zijlstra (Intel),
Alexander Shishkin, Sasha Levin
From: Xiaoyao Li <xiaoyao.li@intel.com>
[ Upstream commit c53c6b7409f4cd9e542991b53d597fbe2751d7db ]
Per SDM, bit 2:0 of CPUID(0x14,1).EAX[2:0] reports the number of
configurable address ranges for filtering, not bit 1:0.
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Link: https://lkml.kernel.org/r/20210824040622.4081502-1-xiaoyao.li@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/pt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index f03100bc5fd1..849f0ba53a9b 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -69,7 +69,7 @@ static struct pt_cap_desc {
PT_CAP(topa_multiple_entries, 0, CPUID_ECX, BIT(1)),
PT_CAP(single_range_output, 0, CPUID_ECX, BIT(2)),
PT_CAP(payloads_lip, 0, CPUID_ECX, BIT(31)),
- PT_CAP(num_address_ranges, 1, CPUID_EAX, 0x3),
+ PT_CAP(num_address_ranges, 1, CPUID_EAX, 0x7),
PT_CAP(mtc_periods, 1, CPUID_EAX, 0xffff0000),
PT_CAP(cycle_thresholds, 1, CPUID_EBX, 0xffff),
PT_CAP(psb_periods, 1, CPUID_EBX, 0xffff0000),
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 008/293] perf/x86/amd/ibs: Work around erratum #1197
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 007/293] perf/x86/intel/pt: Fix mask of num_address_ranges Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 009/293] cryptoloop: add a deprecation warning Greg Kroah-Hartman
` (291 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kim Phillips, Peter Zijlstra (Intel),
Ingo Molnar, Sasha Levin
From: Kim Phillips <kim.phillips@amd.com>
[ Upstream commit 26db2e0c51fe83e1dd852c1321407835b481806e ]
Erratum #1197 "IBS (Instruction Based Sampling) Register State May be
Incorrect After Restore From CC6" is published in a document:
"Revision Guide for AMD Family 19h Models 00h-0Fh Processors" 56683 Rev. 1.04 July 2021
https://bugzilla.kernel.org/show_bug.cgi?id=206537
Implement the erratum's suggested workaround and ignore IBS samples if
MSRC001_1031 == 0.
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20210817221048.88063-3-kim.phillips@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/amd/ibs.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
index 2410bd4bb48f..2d9e1372b070 100644
--- a/arch/x86/events/amd/ibs.c
+++ b/arch/x86/events/amd/ibs.c
@@ -90,6 +90,7 @@ struct perf_ibs {
unsigned long offset_mask[1];
int offset_max;
unsigned int fetch_count_reset_broken : 1;
+ unsigned int fetch_ignore_if_zero_rip : 1;
struct cpu_perf_ibs __percpu *pcpu;
struct attribute **format_attrs;
@@ -674,6 +675,10 @@ fail:
if (check_rip && (ibs_data.regs[2] & IBS_RIP_INVALID)) {
regs.flags &= ~PERF_EFLAGS_EXACT;
} else {
+ /* Workaround for erratum #1197 */
+ if (perf_ibs->fetch_ignore_if_zero_rip && !(ibs_data.regs[1]))
+ goto out;
+
set_linear_ip(®s, ibs_data.regs[1]);
regs.flags |= PERF_EFLAGS_EXACT;
}
@@ -767,6 +772,9 @@ static __init void perf_event_ibs_init(void)
if (boot_cpu_data.x86 >= 0x16 && boot_cpu_data.x86 <= 0x18)
perf_ibs_fetch.fetch_count_reset_broken = 1;
+ if (boot_cpu_data.x86 == 0x19 && boot_cpu_data.x86_model < 0x10)
+ perf_ibs_fetch.fetch_ignore_if_zero_rip = 1;
+
perf_ibs_pmu_init(&perf_ibs_fetch, "ibs_fetch");
if (ibs_caps & IBS_CAPS_OPCNT) {
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 009/293] cryptoloop: add a deprecation warning
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 008/293] perf/x86/amd/ibs: Work around erratum #1197 Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 010/293] ARM: 8918/2: only build return_address() if needed Greg Kroah-Hartman
` (290 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Jens Axboe,
Sasha Levin
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 222013f9ac30b9cec44301daa8dbd0aae38abffb ]
Support for cryptoloop has been officially marked broken and deprecated
in favor of dm-crypt (which supports the same broken algorithms if
needed) in Linux 2.6.4 (released in March 2004), and support for it has
been entirely removed from losetup in util-linux 2.23 (released in April
2013). Add a warning and a deprecation schedule.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20210827163250.255325-1-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/Kconfig | 4 ++--
drivers/block/cryptoloop.c | 2 ++
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index e101f286ac35..60662771bd46 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -242,7 +242,7 @@ config BLK_DEV_LOOP_MIN_COUNT
dynamically allocated with the /dev/loop-control interface.
config BLK_DEV_CRYPTOLOOP
- tristate "Cryptoloop Support"
+ tristate "Cryptoloop Support (DEPRECATED)"
select CRYPTO
select CRYPTO_CBC
depends on BLK_DEV_LOOP
@@ -254,7 +254,7 @@ config BLK_DEV_CRYPTOLOOP
WARNING: This device is not safe for journaled file systems like
ext3 or Reiserfs. Please use the Device Mapper crypto module
instead, which can be configured to be on-disk compatible with the
- cryptoloop device.
+ cryptoloop device. cryptoloop support will be removed in Linux 5.16.
source "drivers/block/drbd/Kconfig"
diff --git a/drivers/block/cryptoloop.c b/drivers/block/cryptoloop.c
index 7033a4beda66..1b84105dfe62 100644
--- a/drivers/block/cryptoloop.c
+++ b/drivers/block/cryptoloop.c
@@ -201,6 +201,8 @@ init_cryptoloop(void)
if (rc)
printk(KERN_ERR "cryptoloop: loop_register_transfer failed\n");
+ else
+ pr_warn("the cryptoloop driver has been deprecated and will be removed in in Linux 5.16\n");
return rc;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 010/293] ARM: 8918/2: only build return_address() if needed
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 009/293] cryptoloop: add a deprecation warning Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 011/293] ALSA: pcm: fix divide error in snd_pcm_lib_ioctl Greg Kroah-Hartman
` (289 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Dooks, Russell King
From: Ben Dooks <ben-linux@fluff.org>
commit fb033c95c94ca1ee3d16e04ebdb85d65fb55fff8 upstream.
The system currently warns if the config conditions for
building return_address in arch/arm/kernel/return_address.c
are not met, leaving just an EXPORT_SYMBOL_GPL(return_address)
of a function defined to be 'static linline'.
This is a result of aeea3592a13b ("ARM: 8158/1: LLVMLinux: use static inline in ARM ftrace.h").
Since we're not going to build anything other than an exported
symbol for something that is already being defined to be an
inline-able return of NULL, just avoid building the code to
remove the following warning:
Fixes: aeea3592a13b ("ARM: 8158/1: LLVMLinux: use static inline in ARM ftrace.h")
Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/Makefile | 6 +++++-
arch/arm/kernel/return_address.c | 4 ----
2 files changed, 5 insertions(+), 5 deletions(-)
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -17,10 +17,14 @@ CFLAGS_REMOVE_return_address.o = -pg
# Object file lists.
obj-y := elf.o entry-common.o irq.o opcodes.o \
- process.o ptrace.o reboot.o return_address.o \
+ process.o ptrace.o reboot.o \
setup.o signal.o sigreturn_codes.o \
stacktrace.o sys_arm.o time.o traps.o
+ifneq ($(CONFIG_ARM_UNWIND),y)
+obj-$(CONFIG_FRAME_POINTER) += return_address.o
+endif
+
obj-$(CONFIG_ATAGS) += atags_parse.o
obj-$(CONFIG_ATAGS_PROC) += atags_proc.o
obj-$(CONFIG_DEPRECATED_PARAM_STRUCT) += atags_compat.o
--- a/arch/arm/kernel/return_address.c
+++ b/arch/arm/kernel/return_address.c
@@ -10,8 +10,6 @@
*/
#include <linux/export.h>
#include <linux/ftrace.h>
-
-#if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND)
#include <linux/sched.h>
#include <asm/stacktrace.h>
@@ -56,6 +54,4 @@ void *return_address(unsigned int level)
return NULL;
}
-#endif /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) */
-
EXPORT_SYMBOL_GPL(return_address);
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 011/293] ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 010/293] ARM: 8918/2: only build return_address() if needed Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 012/293] clk: fix build warning for orphan_list Greg Kroah-Hartman
` (288 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zubin Mithra, Guenter Roeck,
Takashi Iwai
From: Zubin Mithra <zsm@chromium.org>
commit f3eef46f0518a2b32ca1244015820c35a22cfe4a upstream.
Syzkaller reported a divide error in snd_pcm_lib_ioctl. fifo_size
is of type snd_pcm_uframes_t(unsigned long). If frame_size
is 0x100000000, the error occurs.
Fixes: a9960e6a293e ("ALSA: pcm: fix fifo_size frame calculation")
Signed-off-by: Zubin Mithra <zsm@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210827153735.789452-1-zsm@chromium.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_lib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1751,7 +1751,7 @@ static int snd_pcm_lib_ioctl_fifo_size(s
channels = params_channels(params);
frame_size = snd_pcm_format_size(format, channels);
if (frame_size > 0)
- params->fifo_size /= (unsigned)frame_size;
+ params->fifo_size /= frame_size;
}
return 0;
}
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 012/293] clk: fix build warning for orphan_list
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 011/293] ALSA: pcm: fix divide error in snd_pcm_lib_ioctl Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 013/293] media: stkwebcam: fix memory leak in stk_camera_probe Greg Kroah-Hartman
` (287 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, kernelci.org bot
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In the backport of commit bdcf1dc25324 ("clk: Evict unregistered clks
from parent caches") to the 4.19.y and 4.14.y stable trees, the
orphan_list structure was placed in the wrong location, causing loads of
build warnings on systems that do not define CONFIG_DEBUG_FS.
Fix this up by moving the structure to the correct place in the file.
Reported-by: "kernelci.org bot" <bot@kernelci.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/clk.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -46,11 +46,6 @@ static struct hlist_head *all_lists[] =
NULL,
};
-static struct hlist_head *orphan_list[] = {
- &clk_orphan_list,
- NULL,
-};
-
/*** private data structures ***/
struct clk_core {
@@ -2629,6 +2624,11 @@ static int inited = 0;
static DEFINE_MUTEX(clk_debug_lock);
static HLIST_HEAD(clk_debug_list);
+static struct hlist_head *orphan_list[] = {
+ &clk_orphan_list,
+ NULL,
+};
+
static void clk_summary_show_one(struct seq_file *s, struct clk_core *c,
int level)
{
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 013/293] media: stkwebcam: fix memory leak in stk_camera_probe
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 012/293] clk: fix build warning for orphan_list Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 014/293] ARM: imx: add missing clk_disable_unprepare() Greg Kroah-Hartman
` (286 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Hans Verkuil,
Mauro Carvalho Chehab
From: Pavel Skripkin <paskripkin@gmail.com>
commit 514e97674400462cc09c459a1ddfb9bf39017223 upstream.
My local syzbot instance hit memory leak in usb_set_configuration().
The problem was in unputted usb interface. In case of errors after
usb_get_intf() the reference should be putted to correclty free memory
allocated for this interface.
Fixes: ec16dae5453e ("V4L/DVB (7019): V4L: add support for Syntek DC1125 webcams")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/stkwebcam/stk-webcam.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -1355,7 +1355,7 @@ static int stk_camera_probe(struct usb_i
if (!dev->isoc_ep) {
pr_err("Could not find isoc-in endpoint\n");
err = -ENODEV;
- goto error;
+ goto error_put;
}
dev->vsettings.palette = V4L2_PIX_FMT_RGB565;
dev->vsettings.mode = MODE_VGA;
@@ -1368,10 +1368,12 @@ static int stk_camera_probe(struct usb_i
err = stk_register_video_device(dev);
if (err)
- goto error;
+ goto error_put;
return 0;
+error_put:
+ usb_put_intf(interface);
error:
v4l2_ctrl_handler_free(hdl);
v4l2_device_unregister(&dev->v4l2_dev);
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 014/293] ARM: imx: add missing clk_disable_unprepare()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 013/293] media: stkwebcam: fix memory leak in stk_camera_probe Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 015/293] ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init Greg Kroah-Hartman
` (285 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
Dong Aisheng, Shawn Guo, Nobuhiro Iwamatsu (CIP)
From: Yang Yingliang <yangyingliang@huawei.com>
commit f07ec85365807b3939f32d0094a6dd5ce065d1b9 upstream.
clock source is prepared and enabled by clk_prepare_enable()
in probe function, but no disable or unprepare in remove and
error path.
Fixes: 9454a0caff6a ("ARM: imx: add mmdc ipg clock operation for mmdc")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-imx/mmdc.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/arch/arm/mach-imx/mmdc.c
+++ b/arch/arm/mach-imx/mmdc.c
@@ -109,6 +109,7 @@ struct mmdc_pmu {
struct perf_event *mmdc_events[MMDC_NUM_COUNTERS];
struct hlist_node node;
struct fsl_mmdc_devtype_data *devtype_data;
+ struct clk *mmdc_ipg_clk;
};
/*
@@ -474,11 +475,13 @@ static int imx_mmdc_remove(struct platfo
cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
perf_pmu_unregister(&pmu_mmdc->pmu);
iounmap(pmu_mmdc->mmdc_base);
+ clk_disable_unprepare(pmu_mmdc->mmdc_ipg_clk);
kfree(pmu_mmdc);
return 0;
}
-static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base)
+static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base,
+ struct clk *mmdc_ipg_clk)
{
struct mmdc_pmu *pmu_mmdc;
char *name;
@@ -506,6 +509,7 @@ static int imx_mmdc_perf_init(struct pla
}
mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
+ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
if (mmdc_num == 0)
name = "mmdc";
else
@@ -579,9 +583,11 @@ static int imx_mmdc_probe(struct platfor
val &= ~(1 << BP_MMDC_MAPSR_PSD);
writel_relaxed(val, reg);
- err = imx_mmdc_perf_init(pdev, mmdc_base);
- if (err)
+ err = imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk);
+ if (err) {
iounmap(mmdc_base);
+ clk_disable_unprepare(mmdc_ipg_clk);
+ }
return err;
}
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 015/293] ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 014/293] ARM: imx: add missing clk_disable_unprepare() Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 016/293] igmp: Add ip_mc_list lock in ip_check_mc_rcu Greg Kroah-Hartman
` (284 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Shawn Guo,
Nobuhiro Iwamatsu (CIP)
From: Colin Ian King <colin.king@canonical.com>
commit 20fb73911fec01f06592de1cdbca00b66602ebd7 upstream.
The function imx_mmdc_perf_init recently had a 3rd argument added to
it but the equivalent macro was not updated and is still the older
2 argument version. Fix this by adding in the missing 3rd argumement
mmdc_ipg_clk.
Fixes: f07ec8536580 ("ARM: imx: add missing clk_disable_unprepare()")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-imx/mmdc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mach-imx/mmdc.c
+++ b/arch/arm/mach-imx/mmdc.c
@@ -545,7 +545,7 @@ pmu_free:
#else
#define imx_mmdc_remove NULL
-#define imx_mmdc_perf_init(pdev, mmdc_base) 0
+#define imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk) 0
#endif
static int imx_mmdc_probe(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 016/293] igmp: Add ip_mc_list lock in ip_check_mc_rcu
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 015/293] ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 017/293] USB: serial: mos7720: improve OOM-handling in read_mos_reg() Greg Kroah-Hartman
` (283 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liu Jian, David S. Miller, Lee Jones
From: Liu Jian <liujian56@huawei.com>
commit 23d2b94043ca8835bd1e67749020e839f396a1c2 upstream.
I got below panic when doing fuzz test:
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 4056 Comm: syz-executor.3 Tainted: G B 5.14.0-rc1-00195-gcff5c4254439-dirty #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x7a/0x9b
panic+0x2cd/0x5af
end_report.cold+0x5a/0x5a
kasan_report+0xec/0x110
ip_check_mc_rcu+0x556/0x5d0
__mkroute_output+0x895/0x1740
ip_route_output_key_hash_rcu+0x2d0/0x1050
ip_route_output_key_hash+0x182/0x2e0
ip_route_output_flow+0x28/0x130
udp_sendmsg+0x165d/0x2280
udpv6_sendmsg+0x121e/0x24f0
inet6_sendmsg+0xf7/0x140
sock_sendmsg+0xe9/0x180
____sys_sendmsg+0x2b8/0x7a0
___sys_sendmsg+0xf0/0x160
__sys_sendmmsg+0x17e/0x3c0
__x64_sys_sendmmsg+0x9e/0x100
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x462eb9
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8
48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48>
3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3df5af1c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462eb9
RDX: 0000000000000312 RSI: 0000000020001700 RDI: 0000000000000007
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3df5af26bc
R13: 00000000004c372d R14: 0000000000700b10 R15: 00000000ffffffff
It is one use-after-free in ip_check_mc_rcu.
In ip_mc_del_src, the ip_sf_list of pmc has been freed under pmc->lock protection.
But access to ip_sf_list in ip_check_mc_rcu is not protected by the lock.
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/igmp.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2743,6 +2743,7 @@ int ip_check_mc_rcu(struct in_device *in
rv = 1;
} else if (im) {
if (src_addr) {
+ spin_lock_bh(&im->lock);
for (psf = im->sources; psf; psf = psf->sf_next) {
if (psf->sf_inaddr == src_addr)
break;
@@ -2753,6 +2754,7 @@ int ip_check_mc_rcu(struct in_device *in
im->sfcount[MCAST_EXCLUDE];
else
rv = im->sfcount[MCAST_EXCLUDE] != 0;
+ spin_unlock_bh(&im->lock);
} else
rv = 1; /* unspecified source; tentatively allow */
}
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 017/293] USB: serial: mos7720: improve OOM-handling in read_mos_reg()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 016/293] igmp: Add ip_mc_list lock in ip_check_mc_rcu Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 018/293] ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) Greg Kroah-Hartman
` (282 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tom Rix, Johan Hovold
From: Tom Rix <trix@redhat.com>
commit 161a582bd1d8681095f158d11bc679a58f1d026b upstream.
clang static analysis reports this problem
mos7720.c:352:2: warning: Undefined or garbage value returned to caller
return d;
^~~~~~~~
In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is
only set after the alloc block.
buf = kmalloc(1, GFP_KERNEL);
if (!buf)
return -ENOMEM;
Although the problem is reported in parport_most7715_read_data(),
none of the callee's of read_mos_reg() check the return status.
Make sure to clear the return-value buffer also on allocation failures.
Fixes: 0d130367abf5 ("USB: serial: mos7720: fix control-message error handling")
Signed-off-by: Tom Rix <trix@redhat.com>
Link: https://lore.kernel.org/r/20210111220904.1035957-1-trix@redhat.com
[ johan: only clear the buffer on errors, amend commit message ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/mos7720.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -226,8 +226,10 @@ static int read_mos_reg(struct usb_seria
int status;
buf = kmalloc(1, GFP_KERNEL);
- if (!buf)
+ if (!buf) {
+ *data = 0;
return -ENOMEM;
+ }
status = usb_control_msg(usbdev, pipe, request, requesttype, value,
index, buf, 1, MOS_WDR_TIMEOUT);
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 018/293] ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 017/293] USB: serial: mos7720: improve OOM-handling in read_mos_reg() Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 019/293] SUNRPC/nfs: Fix return value for nfs4_callback_compound() Greg Kroah-Hartman
` (281 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathieu Desnoyers, David Ahern,
Jakub Kicinski
From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
commit e1e84eb58eb494b77c8389fc6308b5042dcce791 upstream.
As per RFC792, ICMP errors should be sent to the source host.
However, in configurations with Virtual Routing and Forwarding tables,
looking up which routing table to use is currently done by using the
destination net_device.
commit 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to
determine L3 domain") changes the interface passed to
l3mdev_master_ifindex() and inet_addr_type_dev_table() from skb_in->dev
to skb_dst(skb_in)->dev. This effectively uses the destination device
rather than the source device for choosing which routing table should be
used to lookup where to send the ICMP error.
Therefore, if the source and destination interfaces are within separate
VRFs, or one in the global routing table and the other in a VRF, looking
up the source host in the destination interface's routing table will
fail if the destination interface's routing table contains no route to
the source host.
One observable effect of this issue is that traceroute does not work in
the following cases:
- Route leaking between global routing table and VRF
- Route leaking between VRFs
Preferably use the source device routing table when sending ICMP error
messages. If no source device is set, fall-back on the destination
device routing table. Else, use the main routing table (index 0).
[ It has been pointed out that a similar issue may exist with ICMP
errors triggered when forwarding between network namespaces. It would
be worthwhile to investigate, but is outside of the scope of this
investigation. ]
[ It has also been pointed out that a similar issue exists with
unreachable / fragmentation needed messages, which can be triggered by
changing the MTU of eth1 in r1 to 1400 and running:
ip netns exec h1 ping -s 1450 -Mdo -c1 172.16.2.2
Some investigation points to raw_icmp_error() and raw_err() as being
involved in this last scenario. The focus of this patch is TTL expired
ICMP messages, which go through icmp_route_lookup.
Investigation of failure modes related to raw_icmp_error() is beyond
this investigation's scope. ]
Fixes: 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to determine L3 domain")
Link: https://tools.ietf.org/html/rfc792
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/icmp.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -465,6 +465,23 @@ out_bh_enable:
local_bh_enable();
}
+/*
+ * The device used for looking up which routing table to use for sending an ICMP
+ * error is preferably the source whenever it is set, which should ensure the
+ * icmp error can be sent to the source host, else lookup using the routing
+ * table of the destination device, else use the main routing table (index 0).
+ */
+static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb)
+{
+ struct net_device *route_lookup_dev = NULL;
+
+ if (skb->dev)
+ route_lookup_dev = skb->dev;
+ else if (skb_dst(skb))
+ route_lookup_dev = skb_dst(skb)->dev;
+ return route_lookup_dev;
+}
+
static struct rtable *icmp_route_lookup(struct net *net,
struct flowi4 *fl4,
struct sk_buff *skb_in,
@@ -473,6 +490,7 @@ static struct rtable *icmp_route_lookup(
int type, int code,
struct icmp_bxm *param)
{
+ struct net_device *route_lookup_dev;
struct rtable *rt, *rt2;
struct flowi4 fl4_dec;
int err;
@@ -487,7 +505,8 @@ static struct rtable *icmp_route_lookup(
fl4->flowi4_proto = IPPROTO_ICMP;
fl4->fl4_icmp_type = type;
fl4->fl4_icmp_code = code;
- fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev);
+ route_lookup_dev = icmp_get_route_lookup_dev(skb_in);
+ fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev);
security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
rt = ip_route_output_key_hash(net, fl4, skb_in);
@@ -511,7 +530,7 @@ static struct rtable *icmp_route_lookup(
if (err)
goto relookup_failed;
- if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev,
+ if (inet_addr_type_dev_table(net, route_lookup_dev,
fl4_dec.saddr) == RTN_LOCAL) {
rt2 = __ip_route_output_key(net, &fl4_dec);
if (IS_ERR(rt2))
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 019/293] SUNRPC/nfs: Fix return value for nfs4_callback_compound()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 018/293] ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 020/293] crypto: talitos - reduce max key size for SEC1 Greg Kroah-Hartman
` (280 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, J. Bruce Fields
From: Trond Myklebust <trondmy@gmail.com>
commit 83dd59a0b9afc3b1a2642fb5c9b0585b1c08768f upstream.
RPC server procedures are normally expected to return a __be32 encoded
status value of type 'enum rpc_accept_stat', however at least one function
wants to return an authentication status of type 'enum rpc_auth_stat'
in the case where authentication fails.
This patch adds functionality to allow this.
Fixes: a4e187d83d88 ("NFS: Don't drop CB requests with invalid principals")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/callback_xdr.c | 2 +-
include/linux/sunrpc/svc.h | 2 ++
net/sunrpc/svc.c | 27 ++++++++++++++++++++++-----
3 files changed, 25 insertions(+), 6 deletions(-)
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -991,7 +991,7 @@ static __be32 nfs4_callback_compound(str
out_invalidcred:
pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
- return rpc_autherr_badcred;
+ return svc_return_autherr(rqstp, rpc_autherr_badcred);
}
/*
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -271,6 +271,7 @@ struct svc_rqst {
#define RQ_VICTIM (5) /* about to be shut down */
#define RQ_BUSY (6) /* request is busy */
#define RQ_DATA (7) /* request has data */
+#define RQ_AUTHERR (8) /* Request status is auth error */
unsigned long rq_flags; /* flags field */
ktime_t rq_qtime; /* enqueue time */
@@ -504,6 +505,7 @@ unsigned int svc_fill_write_vector(st
char *svc_fill_symlink_pathname(struct svc_rqst *rqstp,
struct kvec *first, void *p,
size_t total);
+__be32 svc_return_autherr(struct svc_rqst *rqstp, __be32 auth_err);
#define RPC_MAX_ADDRBUFLEN (63U)
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1146,6 +1146,22 @@ static __printf(2,3) void svc_printk(str
extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
+__be32
+svc_return_autherr(struct svc_rqst *rqstp, __be32 auth_err)
+{
+ set_bit(RQ_AUTHERR, &rqstp->rq_flags);
+ return auth_err;
+}
+EXPORT_SYMBOL_GPL(svc_return_autherr);
+
+static __be32
+svc_get_autherr(struct svc_rqst *rqstp, __be32 *statp)
+{
+ if (test_and_clear_bit(RQ_AUTHERR, &rqstp->rq_flags))
+ return *statp;
+ return rpc_auth_ok;
+}
+
/*
* Common routine for processing the RPC request.
*/
@@ -1296,11 +1312,9 @@ svc_process_common(struct svc_rqst *rqst
procp->pc_release(rqstp);
goto dropit;
}
- if (*statp == rpc_autherr_badcred) {
- if (procp->pc_release)
- procp->pc_release(rqstp);
- goto err_bad_auth;
- }
+ auth_stat = svc_get_autherr(rqstp, statp);
+ if (auth_stat != rpc_auth_ok)
+ goto err_release_bad_auth;
if (*statp == rpc_success && procp->pc_encode &&
!procp->pc_encode(rqstp, resv->iov_base + resv->iov_len)) {
dprintk("svc: failed to encode reply\n");
@@ -1359,6 +1373,9 @@ err_bad_rpc:
svc_putnl(resv, 2);
goto sendit;
+err_release_bad_auth:
+ if (procp->pc_release)
+ procp->pc_release(rqstp);
err_bad_auth:
dprintk("svc: authentication failed (%d)\n", ntohl(auth_stat));
serv->sv_stats->rpcbadauth++;
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 020/293] crypto: talitos - reduce max key size for SEC1
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 019/293] SUNRPC/nfs: Fix return value for nfs4_callback_compound() Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 021/293] powerpc/module64: Fix comment in R_PPC64_ENTRY handling Greg Kroah-Hartman
` (279 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu
From: Christophe Leroy <christophe.leroy@c-s.fr>
commit b8fbdc2bc4e71b62646031d5df5f08aafe15d5ad upstream.
SEC1 doesn't support SHA384/512, so it doesn't require
longer keys.
This patch reduces the max key size when the driver
is built for SEC1 only.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Fixes: 03d2c5114c95 ("crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -853,7 +853,11 @@ static void talitos_unregister_rng(struc
* HMAC_SNOOP_NO_AFEA (HSNA) instead of type IPSEC_ESP
*/
#define TALITOS_CRA_PRIORITY_AEAD_HSNA (TALITOS_CRA_PRIORITY - 1)
+#ifdef CONFIG_CRYPTO_DEV_TALITOS_SEC2
#define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA512_BLOCK_SIZE)
+#else
+#define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA256_BLOCK_SIZE)
+#endif
#define TALITOS_MAX_IV_LENGTH 16 /* max of AES_BLOCK_SIZE, DES3_EDE_BLOCK_SIZE */
struct talitos_ctx {
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 021/293] powerpc/module64: Fix comment in R_PPC64_ENTRY handling
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 020/293] crypto: talitos - reduce max key size for SEC1 Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 022/293] powerpc/boot: Delete unneeded .globl _zimage_start Greg Kroah-Hartman
` (278 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michael Ellerman
From: Michael Ellerman <mpe@ellerman.id.au>
commit 2fb0a2c989837c976b68233496bbaefb47cd3d6f upstream.
The comment here is wrong, the addi reads from r2 not r12. The code is
correct, 0x38420000 = addi r2,r2,0.
Fixes: a61674bdfc7c ("powerpc/module: Handle R_PPC64_ENTRY relocations")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/module_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -719,7 +719,7 @@ int apply_relocate_add(Elf64_Shdr *sechd
/*
* If found, replace it with:
* addis r2, r12, (.TOC.-func)@ha
- * addi r2, r12, (.TOC.-func)@l
+ * addi r2, r2, (.TOC.-func)@l
*/
((uint32_t *)location)[0] = 0x3c4c0000 + PPC_HA(value);
((uint32_t *)location)[1] = 0x38420000 + PPC_LO(value);
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 022/293] powerpc/boot: Delete unneeded .globl _zimage_start
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 021/293] powerpc/module64: Fix comment in R_PPC64_ENTRY handling Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 023/293] net: ll_temac: Remove left-over debug message Greg Kroah-Hartman
` (277 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fangrui Song, Michael Ellerman
From: Fangrui Song <maskray@google.com>
commit 968339fad422a58312f67718691b717dac45c399 upstream.
.globl sets the symbol binding to STB_GLOBAL while .weak sets the
binding to STB_WEAK. GNU as let .weak override .globl since
binutils-gdb 5ca547dc2399a0a5d9f20626d4bf5547c3ccfddd (1996). Clang
integrated assembler let the last win but it may error in the future.
Since it is a convention that only one binding directive is used, just
delete .globl.
Fixes: ee9d21b3b358 ("powerpc/boot: Ensure _zimage_start is a weak symbol")
Signed-off-by: Fangrui Song <maskray@google.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200325164257.170229-1-maskray@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/boot/crt0.S | 3 ---
1 file changed, 3 deletions(-)
--- a/arch/powerpc/boot/crt0.S
+++ b/arch/powerpc/boot/crt0.S
@@ -49,9 +49,6 @@ p_end: .long _end
p_pstack: .long _platform_stack_top
#endif
- .globl _zimage_start
- /* Clang appears to require the .weak directive to be after the symbol
- * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */
.weak _zimage_start
_zimage_start:
.globl _zimage_start_lib
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 023/293] net: ll_temac: Remove left-over debug message
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 022/293] powerpc/boot: Delete unneeded .globl _zimage_start Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 024/293] mm/page_alloc: speed up the iteration of max_order Greg Kroah-Hartman
` (276 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Esben Haabendal, David S. Miller
From: Esben Haabendal <esben@geanix.com>
commit ce03b94ba682a67e8233c9ee3066071656ded58f upstream.
Fixes: f63963411942 ("net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY")
Signed-off-by: Esben Haabendal <esben@geanix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/xilinx/ll_temac_main.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -736,10 +736,8 @@ temac_start_xmit(struct sk_buff *skb, st
/* Kick off the transfer */
lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */
- if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) {
- netdev_info(ndev, "%s -> netif_stop_queue\n", __func__);
+ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1))
netif_stop_queue(ndev);
- }
return NETDEV_TX_OK;
}
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 024/293] mm/page_alloc: speed up the iteration of max_order
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 023/293] net: ll_temac: Remove left-over debug message Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 025/293] Revert "btrfs: compression: dont try to compress if we dont have enough pages" Greg Kroah-Hartman
` (275 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Muchun Song, Vlastimil Babka,
Oscar Salvador, David Hildenbrand, Andrew Morton, Linus Torvalds
From: Muchun Song <songmuchun@bytedance.com>
commit 7ad69832f37e3cea8557db6df7c793905f1135e8 upstream.
When we free a page whose order is very close to MAX_ORDER and greater
than pageblock_order, it wastes some CPU cycles to increase max_order to
MAX_ORDER one by one and check the pageblock migratetype of that page
repeatedly especially when MAX_ORDER is much larger than pageblock_order.
We also should not be checking migratetype of buddy when "order ==
MAX_ORDER - 1" as the buddy pfn may be invalid, so adjust the condition.
With the new check, we don't need the max_order check anymore, so we
replace it.
Also adjust max_order initialization so that it's lower by one than
previously, which makes the code hopefully more clear.
Link: https://lkml.kernel.org/r/20201204155109.55451-1-songmuchun@bytedance.com
Fixes: d9dddbf55667 ("mm/page_alloc: prevent merging between isolated and other pageblocks")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -807,7 +807,7 @@ static inline void __free_one_page(struc
struct page *buddy;
unsigned int max_order;
- max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1);
+ max_order = min_t(unsigned int, MAX_ORDER - 1, pageblock_order);
VM_BUG_ON(!zone_is_initialized(zone));
VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page);
@@ -820,7 +820,7 @@ static inline void __free_one_page(struc
VM_BUG_ON_PAGE(bad_range(zone, page), page);
continue_merging:
- while (order < max_order - 1) {
+ while (order < max_order) {
buddy_pfn = __find_buddy_pfn(pfn, order);
buddy = page + (buddy_pfn - pfn);
@@ -844,7 +844,7 @@ continue_merging:
pfn = combined_pfn;
order++;
}
- if (max_order < MAX_ORDER) {
+ if (order < MAX_ORDER - 1) {
/* If we are here, it means order is >= pageblock_order.
* We want to prevent merge between freepages on isolate
* pageblock and normal pageblock. Without this, pageblock
@@ -865,7 +865,7 @@ continue_merging:
is_migrate_isolate(buddy_mt)))
goto done_merging;
}
- max_order++;
+ max_order = order + 1;
goto continue_merging;
}
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 025/293] Revert "btrfs: compression: dont try to compress if we dont have enough pages"
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 024/293] mm/page_alloc: speed up the iteration of max_order Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 026/293] ALSA: usb-audio: Add registration quirk for JBL Quantum 800 Greg Kroah-Hartman
` (274 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zygo Blaxell, Qu Wenruo, David Sterba
From: Qu Wenruo <wqu@suse.com>
commit 4e9655763b82a91e4c341835bb504a2b1590f984 upstream.
This reverts commit f2165627319ffd33a6217275e5690b1ab5c45763.
[BUG]
It's no longer possible to create compressed inline extent after commit
f2165627319f ("btrfs: compression: don't try to compress if we don't
have enough pages").
[CAUSE]
For compression code, there are several possible reasons we have a range
that needs to be compressed while it's no more than one page.
- Compressed inline write
The data is always smaller than one sector and the test lacks the
condition to properly recognize a non-inline extent.
- Compressed subpage write
For the incoming subpage compressed write support, we require page
alignment of the delalloc range.
And for 64K page size, we can compress just one page into smaller
sectors.
For those reasons, the requirement for the data to be more than one page
is not correct, and is already causing regression for compressed inline
data writeback. The idea of skipping one page to avoid wasting CPU time
could be revisited in the future.
[FIX]
Fix it by reverting the offending commit.
Reported-by: Zygo Blaxell <ce3g8jdj@umail.furryterror.org>
Link: https://lore.kernel.org/linux-btrfs/afa2742.c084f5d6.17b6b08dffc@tnonline.net
Fixes: f2165627319f ("btrfs: compression: don't try to compress if we don't have enough pages")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -530,7 +530,7 @@ again:
* inode has not been flagged as nocompress. This flag can
* change at any time if we discover bad compression ratios.
*/
- if (nr_pages > 1 && inode_need_compress(inode, start, end)) {
+ if (inode_need_compress(inode, start, end)) {
WARN_ON(pages);
pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
if (!pages) {
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 026/293] ALSA: usb-audio: Add registration quirk for JBL Quantum 800
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 025/293] Revert "btrfs: compression: dont try to compress if we dont have enough pages" Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 027/293] usb: host: xhci-rcar: Dont reload firmware after the completion Greg Kroah-Hartman
` (273 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Tsoy, Takashi Iwai
From: Alexander Tsoy <alexander@tsoy.me>
commit c8b177b6e3a005bd8fb0395a4bc5db3470301c28 upstream.
Add another device ID for JBL Quantum 800. It requires the same quirk as
other JBL Quantum devices.
Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210831002531.116957-1-alexander@tsoy.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/quirks.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1554,6 +1554,7 @@ static const struct registration_quirk r
REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */
REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */
REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 027/293] usb: host: xhci-rcar: Dont reload firmware after the completion
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 026/293] ALSA: usb-audio: Add registration quirk for JBL Quantum 800 Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 028/293] usb: mtu3: use @mult for HS isoc or intr Greg Kroah-Hartman
` (272 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yoshihiro Shimoda
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit 57f3ffdc11143f56f1314972fe86fe17a0dcde85 upstream.
According to the datasheet, "Upon the completion of FW Download,
there is no need to write or reload FW.". Otherwise, it's possible
to cause unexpected behaviors. So, adds such a condition.
Fixes: 4ac8918f3a73 ("usb: host: xhci-plat: add support for the R-Car H2 and M2 xHCI controllers")
Cc: stable@vger.kernel.org # v3.17+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20210827063227.81990-1-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-rcar.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -143,6 +143,13 @@ static int xhci_rcar_download_firmware(s
const struct soc_device_attribute *attr;
const char *firmware_name;
+ /*
+ * According to the datasheet, "Upon the completion of FW Download,
+ * there is no need to write or reload FW".
+ */
+ if (readl(regs + RCAR_USB3_DL_CTRL) & RCAR_USB3_DL_CTRL_FW_SUCCESS)
+ return 0;
+
attr = soc_device_match(rcar_quirks_match);
if (attr)
quirks = (uintptr_t)attr->data;
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 028/293] usb: mtu3: use @mult for HS isoc or intr
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 027/293] usb: host: xhci-rcar: Dont reload firmware after the completion Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 029/293] usb: mtu3: fix the wrong HS mult value Greg Kroah-Hartman
` (271 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chunfeng Yun
From: Chunfeng Yun <chunfeng.yun@mediatek.com>
commit fd7cb394ec7efccc3985feb0978cee4d352e1817 upstream.
For HS isoc or intr, should use @mult but not @burst
to save mult value.
Fixes: 4d79e042ed8b ("usb: mtu3: add support for usb3.1 IP")
Cc: stable@vger.kernel.org
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/1628836253-7432-2-git-send-email-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/mtu3/mtu3_gadget.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -97,7 +97,7 @@ static int mtu3_ep_enable(struct mtu3_ep
usb_endpoint_xfer_int(desc)) {
interval = desc->bInterval;
interval = clamp_val(interval, 1, 16) - 1;
- burst = (max_packet & GENMASK(12, 11)) >> 11;
+ mult = (max_packet & GENMASK(12, 11)) >> 11;
}
break;
default:
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 029/293] usb: mtu3: fix the wrong HS mult value
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 028/293] usb: mtu3: use @mult for HS isoc or intr Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 030/293] x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions Greg Kroah-Hartman
` (270 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chunfeng Yun
From: Chunfeng Yun <chunfeng.yun@mediatek.com>
commit 44e4439d8f9f8d0e9da767d1f31e7c211081feca upstream.
usb_endpoint_maxp() returns actual max packet size, @mult will
always be zero, fix it by using usb_endpoint_maxp_mult() instead
to get mult.
Fixes: 4d79e042ed8b ("usb: mtu3: add support for usb3.1 IP")
Cc: stable@vger.kernel.org
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/1628836253-7432-3-git-send-email-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/mtu3/mtu3_gadget.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -69,14 +69,12 @@ static int mtu3_ep_enable(struct mtu3_ep
u32 interval = 0;
u32 mult = 0;
u32 burst = 0;
- int max_packet;
int ret;
desc = mep->desc;
comp_desc = mep->comp_desc;
mep->type = usb_endpoint_type(desc);
- max_packet = usb_endpoint_maxp(desc);
- mep->maxp = max_packet & GENMASK(10, 0);
+ mep->maxp = usb_endpoint_maxp(desc);
switch (mtu->g.speed) {
case USB_SPEED_SUPER:
@@ -97,7 +95,7 @@ static int mtu3_ep_enable(struct mtu3_ep
usb_endpoint_xfer_int(desc)) {
interval = desc->bInterval;
interval = clamp_val(interval, 1, 16) - 1;
- mult = (max_packet & GENMASK(12, 11)) >> 11;
+ mult = usb_endpoint_maxp_mult(desc) - 1;
}
break;
default:
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 030/293] x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 029/293] usb: mtu3: fix the wrong HS mult value Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 031/293] PCI: Call Max Payload Size-related fixup quirks early Greg Kroah-Hartman
` (269 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Gortmaker, Thomas Gleixner
From: Paul Gortmaker <paul.gortmaker@windriver.com>
commit a729691b541f6e63043beae72e635635abe5dc09 upstream.
When this platform was relatively new in November 2011, with early BIOS
revisions, a reboot quirk was added in commit 6be30bb7d750 ("x86/reboot:
Blacklist Dell OptiPlex 990 known to require PCI reboot")
However, this quirk (and several others) are open-ended to all BIOS
versions and left no automatic expiry if/when the system BIOS fixed the
issue, meaning that nobody is likely to come along and re-test.
What is really problematic with using PCI reboot as this quirk does, is
that it causes this platform to do a full power down, wait one second,
and then power back on. This is less than ideal if one is using it for
boot testing and/or bisecting kernels when legacy rotating hard disks
are installed.
It was only by chance that the quirk was noticed in dmesg - and when
disabled it turned out that it wasn't required anymore (BIOS A24), and a
default reboot would work fine without the "harshness" of power cycling the
machine (and disks) down and up like the PCI reboot does.
Doing a bit more research, it seems that the "newest" BIOS for which the
issue was reported[1] was version A06, however Dell[2] seemed to suggest
only up to and including version A05, with the A06 having a large number of
fixes[3] listed.
As is typical with a new platform, the initial BIOS updates come frequently
and then taper off (and in this case, with a revival for CPU CVEs); a
search for O990-A<ver>.exe reveals the following dates:
A02 16 Mar 2011
A03 11 May 2011
A06 14 Sep 2011
A07 24 Oct 2011
A10 08 Dec 2011
A14 06 Sep 2012
A16 15 Oct 2012
A18 30 Sep 2013
A19 23 Sep 2015
A20 02 Jun 2017
A23 07 Mar 2018
A24 21 Aug 2018
While it's overkill to flash and test each of the above, it would seem
likely that the issue was contained within A0x BIOS versions, given the
dates above and the dates of issue reports[4] from distros. So rather than
just throw out the quirk entirely, limit the scope to just those early BIOS
versions, in case people are still running systems from 2011 with the
original as-shipped early A0x BIOS versions.
[1] https://lore.kernel.org/lkml/1320373471-3942-1-git-send-email-trenn@suse.de/
[2] https://www.dell.com/support/kbdoc/en-ca/000131908/linux-based-operating-systems-stall-upon-reboot-on-optiplex-390-790-990-systems
[3] https://www.dell.com/support/home/en-ca/drivers/driversdetails?driverid=85j10
[4] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/768039
Fixes: 6be30bb7d750 ("x86/reboot: Blacklist Dell OptiPlex 990 known to require PCI reboot")
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210530162447.996461-4-paul.gortmaker@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/reboot.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -388,10 +388,11 @@ static const struct dmi_system_id reboot
},
{ /* Handle problems with rebooting on the OptiPlex 990. */
.callback = set_pci_reboot,
- .ident = "Dell OptiPlex 990",
+ .ident = "Dell OptiPlex 990 BIOS A0x",
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
+ DMI_MATCH(DMI_BIOS_VERSION, "A0"),
},
},
{ /* Handle problems with rebooting on Dell 300's */
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 031/293] PCI: Call Max Payload Size-related fixup quirks early
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 030/293] x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 032/293] locking/mutex: Fix HANDOFF condition Greg Kroah-Hartman
` (268 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marek Behún, Bjorn Helgaas
From: Marek Behún <kabel@kernel.org>
commit b8da302e2955fe4d41eb9d48199242674d77dbe0 upstream.
pci_device_add() calls HEADER fixups after pci_configure_device(), which
configures Max Payload Size.
Convert MPS-related fixups to EARLY fixups so pci_configure_mps() takes
them into account.
Fixes: 27d868b5e6cfa ("PCI: Set MPS to match upstream bridge")
Link: https://lore.kernel.org/r/20210624171418.27194-1-kabel@kernel.org
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3152,12 +3152,12 @@ static void fixup_mpss_256(struct pci_de
{
dev->pcie_mpss = 1; /* 256 bytes */
}
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
- PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
+ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
+ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
+ PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256);
/*
* Intel 5000 and 5100 Memory controllers have an erratum with read completion
^ permalink raw reply [flat|nested] 301+ messages in thread* [PATCH 4.19 032/293] locking/mutex: Fix HANDOFF condition
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 031/293] PCI: Call Max Payload Size-related fixup quirks early Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 033/293] regmap: fix the offset of register error log Greg Kroah-Hartman
` (267 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yanfei Xu, Peter Zijlstra (Intel),
Waiman Long, Sasha Levin
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
Yanfei reported that setting HANDOFF should not depend on recomputing
@first, only on @first state. Which would then give:
if (ww_ctx || !first)
first = __mutex_waiter_is_first(lock, &waiter);
if (first)
__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
But because 'ww_ctx || !first' is basically 'always' and the test for
first is relatively cheap, omit that first branch entirely.
Reported-by: Yanfei Xu <yanfei.xu@windriver.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Waiman Long <longman@redhat.com>
Reviewed-by: Yanfei Xu <yanfei.xu@windriver.com>
Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/mutex.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index 354151fef06a..fbc62d360419 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -911,7 +911,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
{
struct mutex_waiter waiter;
- bool first = false;
struct ww_mutex *ww;
int ret;
@@ -986,6 +985,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
set_current_state(state);
for (;;) {
+ bool first;
+
/*
* Once we hold wait_lock, we're serialized against
* mutex_unlock() handing the lock off to us, do a trylock
@@ -1014,15 +1015,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
spin_unlock(&lock->wait_lock);
schedule_preempt_disabled();
- /*
- * ww_mutex needs to always recheck its position since its waiter
- * list is not FIFO ordered.
- */
- if (ww_ctx || !first) {
- first = __mutex_waiter_is_first(lock, &waiter);
- if (first)
- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
- }
+ first = __mutex_waiter_is_first(lock, &waiter);
+ if (first)
+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
set_current_state(state);
/*
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 033/293] regmap: fix the offset of register error log
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 032/293] locking/mutex: Fix HANDOFF condition Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 034/293] crypto: mxs-dcp - Check for DMA mapping errors Greg Kroah-Hartman
` (266 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeongtae Park, Mark Brown,
Sasha Levin
From: Jeongtae Park <jeongtae.park@gmail.com>
[ Upstream commit 1852f5ed358147095297a09cc3c6f160208a676d ]
This patch fixes the offset of register error log
by using regmap_get_offset().
Signed-off-by: Jeongtae Park <jeongtae.park@gmail.com>
Link: https://lore.kernel.org/r/20210701142630.44936-1-jeongtae.park@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/regmap/regmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index e8b3353c18eb..330ab9c85d1b 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1479,7 +1479,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
if (ret) {
dev_err(map->dev,
"Error in caching of register: %x ret: %d\n",
- reg + i, ret);
+ reg + regmap_get_offset(map, i), ret);
return ret;
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 034/293] crypto: mxs-dcp - Check for DMA mapping errors
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 033/293] regmap: fix the offset of register error log Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 035/293] sched/deadline: Fix reset_on_fork reporting of DL tasks Greg Kroah-Hartman
` (265 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sean Anderson, Richard Weinberger,
Herbert Xu, Sasha Levin
From: Sean Anderson <sean.anderson@seco.com>
[ Upstream commit df6313d707e575a679ada3313358289af24454c0 ]
After calling dma_map_single(), we must also call dma_mapping_error().
This fixes the following warning when compiling with CONFIG_DMA_API_DEBUG:
[ 311.241478] WARNING: CPU: 0 PID: 428 at kernel/dma/debug.c:1027 check_unmap+0x79c/0x96c
[ 311.249547] DMA-API: mxs-dcp 2280000.crypto: device driver failed to check map error[device address=0x00000000860cb080] [size=32 bytes] [mapped as single]
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/mxs-dcp.c | 45 +++++++++++++++++++++++++++++++---------
1 file changed, 35 insertions(+), 10 deletions(-)
diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
index b0c592073a4a..d220e6a3f836 100644
--- a/drivers/crypto/mxs-dcp.c
+++ b/drivers/crypto/mxs-dcp.c
@@ -167,15 +167,19 @@ static struct dcp *global_sdcp;
static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)
{
+ int dma_err;
struct dcp *sdcp = global_sdcp;
const int chan = actx->chan;
uint32_t stat;
unsigned long ret;
struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
-
dma_addr_t desc_phys = dma_map_single(sdcp->dev, desc, sizeof(*desc),
DMA_TO_DEVICE);
+ dma_err = dma_mapping_error(sdcp->dev, desc_phys);
+ if (dma_err)
+ return dma_err;
+
reinit_completion(&sdcp->completion[chan]);
/* Clear status register. */
@@ -213,18 +217,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)
static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
struct ablkcipher_request *req, int init)
{
+ dma_addr_t key_phys, src_phys, dst_phys;
struct dcp *sdcp = global_sdcp;
struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
struct dcp_aes_req_ctx *rctx = ablkcipher_request_ctx(req);
int ret;
- dma_addr_t key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key,
- 2 * AES_KEYSIZE_128,
- DMA_TO_DEVICE);
- dma_addr_t src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf,
- DCP_BUF_SZ, DMA_TO_DEVICE);
- dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
- DCP_BUF_SZ, DMA_FROM_DEVICE);
+ key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key,
+ 2 * AES_KEYSIZE_128, DMA_TO_DEVICE);
+ ret = dma_mapping_error(sdcp->dev, key_phys);
+ if (ret)
+ return ret;
+
+ src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf,
+ DCP_BUF_SZ, DMA_TO_DEVICE);
+ ret = dma_mapping_error(sdcp->dev, src_phys);
+ if (ret)
+ goto err_src;
+
+ dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
+ DCP_BUF_SZ, DMA_FROM_DEVICE);
+ ret = dma_mapping_error(sdcp->dev, dst_phys);
+ if (ret)
+ goto err_dst;
if (actx->fill % AES_BLOCK_SIZE) {
dev_err(sdcp->dev, "Invalid block size!\n");
@@ -262,10 +277,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
ret = mxs_dcp_start_dma(actx);
aes_done_run:
+ dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE);
+err_dst:
+ dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
+err_src:
dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128,
DMA_TO_DEVICE);
- dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
- dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE);
return ret;
}
@@ -565,6 +582,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
dma_addr_t buf_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_in_buf,
DCP_BUF_SZ, DMA_TO_DEVICE);
+ ret = dma_mapping_error(sdcp->dev, buf_phys);
+ if (ret)
+ return ret;
+
/* Fill in the DMA descriptor. */
desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE |
MXS_DCP_CONTROL0_INTERRUPT |
@@ -597,6 +618,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
if (rctx->fini) {
digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf,
DCP_SHA_PAY_SZ, DMA_FROM_DEVICE);
+ ret = dma_mapping_error(sdcp->dev, digest_phys);
+ if (ret)
+ goto done_run;
+
desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM;
desc->payload = digest_phys;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 035/293] sched/deadline: Fix reset_on_fork reporting of DL tasks
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 034/293] crypto: mxs-dcp - Check for DMA mapping errors Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 036/293] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Greg Kroah-Hartman
` (264 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quentin Perret,
Peter Zijlstra (Intel), Sasha Levin
From: Quentin Perret <qperret@google.com>
[ Upstream commit f95091536f78971b269ec321b057b8d630b0ad8a ]
It is possible for sched_getattr() to incorrectly report the state of
the reset_on_fork flag when called on a deadline task.
Indeed, if the flag was set on a deadline task using sched_setattr()
with flags (SCHED_FLAG_RESET_ON_FORK | SCHED_FLAG_KEEP_PARAMS), then
p->sched_reset_on_fork will be set, but __setscheduler() will bail out
early, which means that the dl_se->flags will not get updated by
__setscheduler_params()->__setparam_dl(). Consequently, if
sched_getattr() is then called on the task, __getparam_dl() will
override kattr.sched_flags with the now out-of-date copy in dl_se->flags
and report the stale value to userspace.
To fix this, make sure to only copy the flags that are relevant to
sched_deadline to and from the dl_se->flags field.
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20210727101103.2729607-2-qperret@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/deadline.c | 7 ++++---
kernel/sched/sched.h | 2 ++
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index aa592dc3cb40..9b2bb5f3ce09 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2615,7 +2615,7 @@ void __setparam_dl(struct task_struct *p, const struct sched_attr *attr)
dl_se->dl_runtime = attr->sched_runtime;
dl_se->dl_deadline = attr->sched_deadline;
dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline;
- dl_se->flags = attr->sched_flags;
+ dl_se->flags = attr->sched_flags & SCHED_DL_FLAGS;
dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
dl_se->dl_density = to_ratio(dl_se->dl_deadline, dl_se->dl_runtime);
}
@@ -2628,7 +2628,8 @@ void __getparam_dl(struct task_struct *p, struct sched_attr *attr)
attr->sched_runtime = dl_se->dl_runtime;
attr->sched_deadline = dl_se->dl_deadline;
attr->sched_period = dl_se->dl_period;
- attr->sched_flags = dl_se->flags;
+ attr->sched_flags &= ~SCHED_DL_FLAGS;
+ attr->sched_flags |= dl_se->flags;
}
/*
@@ -2703,7 +2704,7 @@ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr)
if (dl_se->dl_runtime != attr->sched_runtime ||
dl_se->dl_deadline != attr->sched_deadline ||
dl_se->dl_period != attr->sched_period ||
- dl_se->flags != attr->sched_flags)
+ dl_se->flags != (attr->sched_flags & SCHED_DL_FLAGS))
return true;
return false;
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 7b7ba91e319b..55e695080fc6 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -209,6 +209,8 @@ static inline int task_has_dl_policy(struct task_struct *p)
*/
#define SCHED_FLAG_SUGOV 0x10000000
+#define SCHED_DL_FLAGS (SCHED_FLAG_RECLAIM | SCHED_FLAG_DL_OVERRUN | SCHED_FLAG_SUGOV)
+
static inline bool dl_entity_is_special(struct sched_dl_entity *dl_se)
{
#ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 036/293] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 035/293] sched/deadline: Fix reset_on_fork reporting of DL tasks Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:39 ` [PATCH 4.19 037/293] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Greg Kroah-Hartman
` (263 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sebastian Reichel,
Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit caa534c3ba40c6e8352b42cbbbca9ba481814ac8 ]
When fuel_gauge_reg_readb()/_writeb() fails, report which register we
were trying to read / write when the error happened.
Also reword the message a bit:
- Drop the axp288 prefix, dev_err() already prints this
- Switch from telegram / abbreviated style to a normal sentence, aligning
the message with those from fuel_gauge_read_*bit_word()
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/axp288_fuel_gauge.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c
index 157cf5ec6b02..1641868c345c 100644
--- a/drivers/power/supply/axp288_fuel_gauge.c
+++ b/drivers/power/supply/axp288_fuel_gauge.c
@@ -158,7 +158,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg)
}
if (ret < 0) {
- dev_err(&info->pdev->dev, "axp288 reg read err:%d\n", ret);
+ dev_err(&info->pdev->dev, "Error reading reg 0x%02x err: %d\n", reg, ret);
return ret;
}
@@ -172,7 +172,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val)
ret = regmap_write(info->regmap, reg, (unsigned int)val);
if (ret < 0)
- dev_err(&info->pdev->dev, "axp288 reg write err:%d\n", ret);
+ dev_err(&info->pdev->dev, "Error writing reg 0x%02x err: %d\n", reg, ret);
return ret;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 037/293] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 036/293] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Greg Kroah-Hartman
@ 2021-09-20 16:39 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 038/293] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Greg Kroah-Hartman
` (262 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lokesh Vutla, Tero Kristo,
Tony Lindgren, Herbert Xu, Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit fe28140b3393b0ba1eb95cc109f974a7e58b26fd ]
We should not clear FLAGS_DMA_ACTIVE before omap_sham_update_dma_stop() is
done calling dma_unmap_sg(). We already clear FLAGS_DMA_ACTIVE at the
end of omap_sham_update_dma_stop().
The early clearing of FLAGS_DMA_ACTIVE is not causing issues as we do not
need to defer anything based on FLAGS_DMA_ACTIVE currently. So this can be
applied as clean-up.
Cc: Lokesh Vutla <lokeshvutla@ti.com>
Cc: Tero Kristo <kristo@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/omap-sham.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index 4d31ef472436..180f2f61b8fb 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -1739,7 +1739,7 @@ static void omap_sham_done_task(unsigned long data)
if (test_and_clear_bit(FLAGS_OUTPUT_READY, &dd->flags))
goto finish;
} else if (test_bit(FLAGS_DMA_READY, &dd->flags)) {
- if (test_and_clear_bit(FLAGS_DMA_ACTIVE, &dd->flags)) {
+ if (test_bit(FLAGS_DMA_ACTIVE, &dd->flags)) {
omap_sham_update_dma_stop(dd);
if (dd->err) {
err = dd->err;
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 038/293] sched/deadline: Fix missing clock update in migrate_task_rq_dl()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2021-09-20 16:39 ` [PATCH 4.19 037/293] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 039/293] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Greg Kroah-Hartman
` (261 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bruno Goncalves, Dietmar Eggemann,
Peter Zijlstra (Intel), Daniel Bristot de Oliveira, Juri Lelli,
Sasha Levin
From: Dietmar Eggemann <dietmar.eggemann@arm.com>
[ Upstream commit b4da13aa28d4fd0071247b7b41c579ee8a86c81a ]
A missing clock update is causing the following warning:
rq->clock_update_flags < RQCF_ACT_SKIP
WARNING: CPU: 112 PID: 2041 at kernel/sched/sched.h:1453
sub_running_bw.isra.0+0x190/0x1a0
...
CPU: 112 PID: 2041 Comm: sugov:112 Tainted: G W 5.14.0-rc1 #1
Hardware name: WIWYNN Mt.Jade Server System
B81.030Z1.0007/Mt.Jade Motherboard, BIOS 1.6.20210526 (SCP:
1.06.20210526) 2021/05/26
...
Call trace:
sub_running_bw.isra.0+0x190/0x1a0
migrate_task_rq_dl+0xf8/0x1e0
set_task_cpu+0xa8/0x1f0
try_to_wake_up+0x150/0x3d4
wake_up_q+0x64/0xc0
__up_write+0xd0/0x1c0
up_write+0x4c/0x2b0
cppc_set_perf+0x120/0x2d0
cppc_cpufreq_set_target+0xe0/0x1a4 [cppc_cpufreq]
__cpufreq_driver_target+0x74/0x140
sugov_work+0x64/0x80
kthread_worker_fn+0xe0/0x230
kthread+0x138/0x140
ret_from_fork+0x10/0x18
The task causing this is the `cppc_fie` DL task introduced by
commit 1eb5dde674f5 ("cpufreq: CPPC: Add support for frequency
invariance").
With CONFIG_ACPI_CPPC_CPUFREQ_FIE=y and schedutil cpufreq governor on
slow-switching system (like on this Ampere Altra WIWYNN Mt. Jade Arm
Server):
DL task `curr=sugov:112` lets `p=cppc_fie` migrate and since the latter
is in `non_contending` state, migrate_task_rq_dl() calls
sub_running_bw()->__sub_running_bw()->cpufreq_update_util()->
rq_clock()->assert_clock_updated()
on p.
Fix this by updating the clock for a non_contending task in
migrate_task_rq_dl() before calling sub_running_bw().
Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Link: https://lore.kernel.org/r/20210804135925.3734605-1-dietmar.eggemann@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/deadline.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 9b2bb5f3ce09..beec5081a55a 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1654,6 +1654,7 @@ static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused
*/
raw_spin_lock(&rq->lock);
if (p->dl.dl_non_contending) {
+ update_rq_clock(rq);
sub_running_bw(&p->dl, &rq->dl);
p->dl.dl_non_contending = 0;
/*
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 039/293] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 038/293] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 040/293] udf: Check LVID earlier Greg Kroah-Hartman
` (260 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lorenzo Colitti, Thomas Gleixner,
Sasha Levin
From: Thomas Gleixner <tglx@linutronix.de>
[ Upstream commit 627ef5ae2df8eeccb20d5af0e4cfa4df9e61ed28 ]
If __hrtimer_start_range_ns() is invoked with an already armed hrtimer then
the timer has to be canceled first and then added back. If the timer is the
first expiring timer then on removal the clockevent device is reprogrammed
to the next expiring timer to avoid that the pending expiry fires needlessly.
If the new expiry time ends up to be the first expiry again then the clock
event device has to reprogrammed again.
Avoid this by checking whether the timer is the first to expire and in that
case, keep the timer on the current CPU and delay the reprogramming up to
the point where the timer has been enqueued again.
Reported-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20210713135157.873137732@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/hrtimer.c | 60 ++++++++++++++++++++++++++++++++++++++-----
1 file changed, 53 insertions(+), 7 deletions(-)
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 0e04b24cec81..32ee24f5142a 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -1020,12 +1020,13 @@ static void __remove_hrtimer(struct hrtimer *timer,
* remove hrtimer, called with base lock held
*/
static inline int
-remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart)
+remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base,
+ bool restart, bool keep_local)
{
u8 state = timer->state;
if (state & HRTIMER_STATE_ENQUEUED) {
- int reprogram;
+ bool reprogram;
/*
* Remove the timer and force reprogramming when high
@@ -1038,8 +1039,16 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool rest
debug_deactivate(timer);
reprogram = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
+ /*
+ * If the timer is not restarted then reprogramming is
+ * required if the timer is local. If it is local and about
+ * to be restarted, avoid programming it twice (on removal
+ * and a moment later when it's requeued).
+ */
if (!restart)
state = HRTIMER_STATE_INACTIVE;
+ else
+ reprogram &= !keep_local;
__remove_hrtimer(timer, base, state, reprogram);
return 1;
@@ -1093,9 +1102,31 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
struct hrtimer_clock_base *base)
{
struct hrtimer_clock_base *new_base;
+ bool force_local, first;
- /* Remove an active timer from the queue: */
- remove_hrtimer(timer, base, true);
+ /*
+ * If the timer is on the local cpu base and is the first expiring
+ * timer then this might end up reprogramming the hardware twice
+ * (on removal and on enqueue). To avoid that by prevent the
+ * reprogram on removal, keep the timer local to the current CPU
+ * and enforce reprogramming after it is queued no matter whether
+ * it is the new first expiring timer again or not.
+ */
+ force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
+ force_local &= base->cpu_base->next_timer == timer;
+
+ /*
+ * Remove an active timer from the queue. In case it is not queued
+ * on the current CPU, make sure that remove_hrtimer() updates the
+ * remote data correctly.
+ *
+ * If it's on the current CPU and the first expiring timer, then
+ * skip reprogramming, keep the timer local and enforce
+ * reprogramming later if it was the first expiring timer. This
+ * avoids programming the underlying clock event twice (once at
+ * removal and once after enqueue).
+ */
+ remove_hrtimer(timer, base, true, force_local);
if (mode & HRTIMER_MODE_REL)
tim = ktime_add_safe(tim, base->get_time());
@@ -1105,9 +1136,24 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
hrtimer_set_expires_range_ns(timer, tim, delta_ns);
/* Switch the timer base, if necessary: */
- new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
+ if (!force_local) {
+ new_base = switch_hrtimer_base(timer, base,
+ mode & HRTIMER_MODE_PINNED);
+ } else {
+ new_base = base;
+ }
+
+ first = enqueue_hrtimer(timer, new_base, mode);
+ if (!force_local)
+ return first;
- return enqueue_hrtimer(timer, new_base, mode);
+ /*
+ * Timer was forced to stay on the current CPU to avoid
+ * reprogramming on removal and enqueue. Force reprogram the
+ * hardware by evaluating the new first expiring timer.
+ */
+ hrtimer_force_reprogram(new_base->cpu_base, 1);
+ return 0;
}
/**
@@ -1168,7 +1214,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer)
base = lock_hrtimer_base(timer, &flags);
if (!hrtimer_callback_running(timer))
- ret = remove_hrtimer(timer, base, false);
+ ret = remove_hrtimer(timer, base, false, false);
unlock_hrtimer_base(timer, &flags);
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 040/293] udf: Check LVID earlier
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 039/293] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 041/293] isofs: joliet: Fix iocharset=utf8 mount option Greg Kroah-Hartman
` (259 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+7fbfe5fed73ebb675748, Jan Kara,
Sasha Levin
From: Jan Kara <jack@suse.cz>
[ Upstream commit 781d2a9a2fc7d0be53a072794dc03ef6de770f3d ]
We were checking validity of LVID entries only when getting
implementation use information from LVID in udf_sb_lvidiu(). However if
the LVID is suitably corrupted, it can cause problems also to code such
as udf_count_free() which doesn't use udf_sb_lvidiu(). So check validity
of LVID already when loading it from the disk and just disable LVID
altogether when it is not valid.
Reported-by: syzbot+7fbfe5fed73ebb675748@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/super.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index c7f6243f318b..9c71246e6d60 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -112,16 +112,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)
return NULL;
lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data;
partnum = le32_to_cpu(lvid->numOfPartitions);
- if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) -
- offsetof(struct logicalVolIntegrityDesc, impUse)) /
- (2 * sizeof(uint32_t)) < partnum) {
- udf_err(sb, "Logical volume integrity descriptor corrupted "
- "(numOfPartitions = %u)!\n", partnum);
- return NULL;
- }
/* The offset is to skip freeSpaceTable and sizeTable arrays */
offset = partnum * 2 * sizeof(uint32_t);
- return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]);
+ return (struct logicalVolIntegrityDescImpUse *)
+ (((uint8_t *)(lvid + 1)) + offset);
}
/* UDF filesystem type */
@@ -1529,6 +1523,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
struct udf_sb_info *sbi = UDF_SB(sb);
struct logicalVolIntegrityDesc *lvid;
int indirections = 0;
+ u32 parts, impuselen;
while (++indirections <= UDF_MAX_LVID_NESTING) {
final_bh = NULL;
@@ -1555,15 +1550,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data;
if (lvid->nextIntegrityExt.extLength == 0)
- return;
+ goto check;
loc = leea_to_cpu(lvid->nextIntegrityExt);
}
udf_warn(sb, "Too many LVID indirections (max %u), ignoring.\n",
UDF_MAX_LVID_NESTING);
+out_err:
brelse(sbi->s_lvid_bh);
sbi->s_lvid_bh = NULL;
+ return;
+check:
+ parts = le32_to_cpu(lvid->numOfPartitions);
+ impuselen = le32_to_cpu(lvid->lengthOfImpUse);
+ if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize ||
+ sizeof(struct logicalVolIntegrityDesc) + impuselen +
+ 2 * parts * sizeof(u32) > sb->s_blocksize) {
+ udf_warn(sb, "Corrupted LVID (parts=%u, impuselen=%u), "
+ "ignoring.\n", parts, impuselen);
+ goto out_err;
+ }
}
/*
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 041/293] isofs: joliet: Fix iocharset=utf8 mount option
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 040/293] udf: Check LVID earlier Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 042/293] bcache: add proper error unwinding in bcache_device_init Greg Kroah-Hartman
` (258 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Jan Kara,
Sasha Levin
From: Pali Rohár <pali@kernel.org>
[ Upstream commit 28ce50f8d96ec9035f60c9348294ea26b94db944 ]
Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset,
it is required to use utf8 mount option.
Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount
option.
If UTF-8 as iocharset is used then s_nls_iocharset is set to NULL. So
simplify code around, remove s_utf8 field as to distinguish between UTF-8
and non-UTF-8 it is needed just to check if s_nls_iocharset is set to NULL
or not.
Link: https://lore.kernel.org/r/20210808162453.1653-5-pali@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/isofs/inode.c | 27 +++++++++++++--------------
fs/isofs/isofs.h | 1 -
fs/isofs/joliet.c | 4 +---
3 files changed, 14 insertions(+), 18 deletions(-)
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 488a9e7f8f66..2355ad62b81f 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -157,7 +157,6 @@ struct iso9660_options{
unsigned int overriderockperm:1;
unsigned int uid_set:1;
unsigned int gid_set:1;
- unsigned int utf8:1;
unsigned char map;
unsigned char check;
unsigned int blocksize;
@@ -357,7 +356,6 @@ static int parse_options(char *options, struct iso9660_options *popt)
popt->gid = GLOBAL_ROOT_GID;
popt->uid = GLOBAL_ROOT_UID;
popt->iocharset = NULL;
- popt->utf8 = 0;
popt->overriderockperm = 0;
popt->session=-1;
popt->sbsector=-1;
@@ -390,10 +388,13 @@ static int parse_options(char *options, struct iso9660_options *popt)
case Opt_cruft:
popt->cruft = 1;
break;
+#ifdef CONFIG_JOLIET
case Opt_utf8:
- popt->utf8 = 1;
+ kfree(popt->iocharset);
+ popt->iocharset = kstrdup("utf8", GFP_KERNEL);
+ if (!popt->iocharset)
+ return 0;
break;
-#ifdef CONFIG_JOLIET
case Opt_iocharset:
kfree(popt->iocharset);
popt->iocharset = match_strdup(&args[0]);
@@ -496,7 +497,6 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
if (sbi->s_nocompress) seq_puts(m, ",nocompress");
if (sbi->s_overriderockperm) seq_puts(m, ",overriderockperm");
if (sbi->s_showassoc) seq_puts(m, ",showassoc");
- if (sbi->s_utf8) seq_puts(m, ",utf8");
if (sbi->s_check) seq_printf(m, ",check=%c", sbi->s_check);
if (sbi->s_mapping) seq_printf(m, ",map=%c", sbi->s_mapping);
@@ -519,9 +519,10 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
seq_printf(m, ",fmode=%o", sbi->s_fmode);
#ifdef CONFIG_JOLIET
- if (sbi->s_nls_iocharset &&
- strcmp(sbi->s_nls_iocharset->charset, CONFIG_NLS_DEFAULT) != 0)
+ if (sbi->s_nls_iocharset)
seq_printf(m, ",iocharset=%s", sbi->s_nls_iocharset->charset);
+ else
+ seq_puts(m, ",iocharset=utf8");
#endif
return 0;
}
@@ -865,14 +866,13 @@ root_found:
sbi->s_nls_iocharset = NULL;
#ifdef CONFIG_JOLIET
- if (joliet_level && opt.utf8 == 0) {
+ if (joliet_level) {
char *p = opt.iocharset ? opt.iocharset : CONFIG_NLS_DEFAULT;
- sbi->s_nls_iocharset = load_nls(p);
- if (! sbi->s_nls_iocharset) {
- /* Fail only if explicit charset specified */
- if (opt.iocharset)
+ if (strcmp(p, "utf8") != 0) {
+ sbi->s_nls_iocharset = opt.iocharset ?
+ load_nls(opt.iocharset) : load_nls_default();
+ if (!sbi->s_nls_iocharset)
goto out_freesbi;
- sbi->s_nls_iocharset = load_nls_default();
}
}
#endif
@@ -888,7 +888,6 @@ root_found:
sbi->s_gid = opt.gid;
sbi->s_uid_set = opt.uid_set;
sbi->s_gid_set = opt.gid_set;
- sbi->s_utf8 = opt.utf8;
sbi->s_nocompress = opt.nocompress;
sbi->s_overriderockperm = opt.overriderockperm;
/*
diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
index 055ec6c586f7..dcdc191ed183 100644
--- a/fs/isofs/isofs.h
+++ b/fs/isofs/isofs.h
@@ -44,7 +44,6 @@ struct isofs_sb_info {
unsigned char s_session;
unsigned int s_high_sierra:1;
unsigned int s_rock:2;
- unsigned int s_utf8:1;
unsigned int s_cruft:1; /* Broken disks with high byte of length
* containing junk */
unsigned int s_nocompress:1;
diff --git a/fs/isofs/joliet.c b/fs/isofs/joliet.c
index be8b6a9d0b92..c0f04a1e7f69 100644
--- a/fs/isofs/joliet.c
+++ b/fs/isofs/joliet.c
@@ -41,14 +41,12 @@ uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls)
int
get_joliet_filename(struct iso_directory_record * de, unsigned char *outname, struct inode * inode)
{
- unsigned char utf8;
struct nls_table *nls;
unsigned char len = 0;
- utf8 = ISOFS_SB(inode->i_sb)->s_utf8;
nls = ISOFS_SB(inode->i_sb)->s_nls_iocharset;
- if (utf8) {
+ if (!nls) {
len = utf16s_to_utf8s((const wchar_t *) de->name,
de->name_len[0] >> 1, UTF16_BIG_ENDIAN,
outname, PAGE_SIZE);
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 042/293] bcache: add proper error unwinding in bcache_device_init
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 041/293] isofs: joliet: Fix iocharset=utf8 mount option Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 043/293] nvme-rdma: dont update queue count when failing to set io queues Greg Kroah-Hartman
` (257 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Coly Li,
Jens Axboe, Sasha Levin
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 224b0683228c5f332f9cee615d85e75e9a347170 ]
Except for the IDA none of the allocations in bcache_device_init is
unwound on error, fix that.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20210809064028.1198327-7-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/bcache/super.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 7787ec42f81e..2df75db52e91 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -824,20 +824,20 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
n = BITS_TO_LONGS(d->nr_stripes) * sizeof(unsigned long);
d->full_dirty_stripes = kvzalloc(n, GFP_KERNEL);
if (!d->full_dirty_stripes)
- return -ENOMEM;
+ goto out_free_stripe_sectors_dirty;
idx = ida_simple_get(&bcache_device_idx, 0,
BCACHE_DEVICE_IDX_MAX, GFP_KERNEL);
if (idx < 0)
- return idx;
+ goto out_free_full_dirty_stripes;
if (bioset_init(&d->bio_split, 4, offsetof(struct bbio, bio),
BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER))
- goto err;
+ goto out_ida_remove;
d->disk = alloc_disk(BCACHE_MINORS);
if (!d->disk)
- goto err;
+ goto out_bioset_exit;
set_capacity(d->disk, sectors);
snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", idx);
@@ -872,8 +872,14 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
return 0;
-err:
+out_bioset_exit:
+ bioset_exit(&d->bio_split);
+out_ida_remove:
ida_simple_remove(&bcache_device_idx, idx);
+out_free_full_dirty_stripes:
+ kvfree(d->full_dirty_stripes);
+out_free_stripe_sectors_dirty:
+ kvfree(d->stripe_sectors_dirty);
return -ENOMEM;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 043/293] nvme-rdma: dont update queue count when failing to set io queues
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 042/293] bcache: add proper error unwinding in bcache_device_init Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 044/293] power: supply: max17042_battery: fix typo in MAx17042_TOFF Greg Kroah-Hartman
` (256 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ruozhu Li, Sagi Grimberg,
Christoph Hellwig, Sasha Levin
From: Ruozhu Li <liruozhu@huawei.com>
[ Upstream commit 85032874f80ba17bf187de1d14d9603bf3f582b8 ]
We update ctrl->queue_count and schedule another reconnect when io queue
count is zero.But we will never try to create any io queue in next reco-
nnection, because ctrl->queue_count already set to zero.We will end up
having an admin-only session in Live state, which is exactly what we try
to avoid in the original patch.
Update ctrl->queue_count after queue_count zero checking to fix it.
Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/rdma.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 8798274dc3ba..ffd6a7204509 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -643,13 +643,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
if (ret)
return ret;
- ctrl->ctrl.queue_count = nr_io_queues + 1;
- if (ctrl->ctrl.queue_count < 2) {
+ if (nr_io_queues == 0) {
dev_err(ctrl->ctrl.device,
"unable to set any I/O queues\n");
return -ENOMEM;
}
+ ctrl->ctrl.queue_count = nr_io_queues + 1;
dev_info(ctrl->ctrl.device,
"creating %d I/O queues.\n", nr_io_queues);
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 044/293] power: supply: max17042_battery: fix typo in MAx17042_TOFF
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 043/293] nvme-rdma: dont update queue count when failing to set io queues Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 045/293] s390/cio: add dev_busid sysfs entry for each subchannel Greg Kroah-Hartman
` (255 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Krzyszkowiak,
Sebastian Reichel, Sasha Levin
From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
[ Upstream commit ed0d0a0506025f06061325cedae1bbebd081620a ]
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/max17042_battery.c | 2 +-
include/linux/power/max17042_battery.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
index 00a3a581e079..8618dbb72392 100644
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -740,7 +740,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip)
struct max17042_config_data *config = chip->pdata->config_data;
max17042_override_por(map, MAX17042_TGAIN, config->tgain);
- max17042_override_por(map, MAx17042_TOFF, config->toff);
+ max17042_override_por(map, MAX17042_TOFF, config->toff);
max17042_override_por(map, MAX17042_CGAIN, config->cgain);
max17042_override_por(map, MAX17042_COFF, config->coff);
diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h
index a7ed29baf44a..86e5ad8aeee4 100644
--- a/include/linux/power/max17042_battery.h
+++ b/include/linux/power/max17042_battery.h
@@ -82,7 +82,7 @@ enum max17042_register {
MAX17042_RelaxCFG = 0x2A,
MAX17042_MiscCFG = 0x2B,
MAX17042_TGAIN = 0x2C,
- MAx17042_TOFF = 0x2D,
+ MAX17042_TOFF = 0x2D,
MAX17042_CGAIN = 0x2E,
MAX17042_COFF = 0x2F,
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 045/293] s390/cio: add dev_busid sysfs entry for each subchannel
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 044/293] power: supply: max17042_battery: fix typo in MAx17042_TOFF Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 046/293] libata: fix ata_host_start() Greg Kroah-Hartman
` (254 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vineeth Vijayan, Peter Oberparleiter,
Vasily Gorbik, Sasha Levin
From: Vineeth Vijayan <vneethv@linux.ibm.com>
[ Upstream commit d3683c055212bf910d4e318f7944910ce10dbee6 ]
Introduce dev_busid, which exports the device-id associated with the
io-subchannel (and message-subchannel). The dev_busid indicates that of
the device which may be physically installed on the corrosponding
subchannel. The dev_busid value "none" indicates that the subchannel
is not valid, there is no I/O device currently associated with the
subchannel.
The dev_busid information would be helpful to write device-specific
udev-rules associated with the subchannel. The dev_busid interface would
be available even when the sch is not bound to any driver or if there is
no operational device connected on it. Hence this attribute can be used to
write udev-rules which are specific to the device associated with the
subchannel.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/cio/css.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 825a8f2703b4..6efe50d70c4b 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -364,9 +364,26 @@ static ssize_t pimpampom_show(struct device *dev,
}
static DEVICE_ATTR_RO(pimpampom);
+static ssize_t dev_busid_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+{
+ struct subchannel *sch = to_subchannel(dev);
+ struct pmcw *pmcw = &sch->schib.pmcw;
+
+ if ((pmcw->st == SUBCHANNEL_TYPE_IO ||
+ pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv)
+ return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid,
+ pmcw->dev);
+ else
+ return sysfs_emit(buf, "none\n");
+}
+static DEVICE_ATTR_RO(dev_busid);
+
static struct attribute *io_subchannel_type_attrs[] = {
&dev_attr_chpids.attr,
&dev_attr_pimpampom.attr,
+ &dev_attr_dev_busid.attr,
NULL,
};
ATTRIBUTE_GROUPS(io_subchannel_type);
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 046/293] libata: fix ata_host_start()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 045/293] s390/cio: add dev_busid sysfs entry for each subchannel Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 047/293] crypto: qat - do not ignore errors from enable_vf2pf_comms() Greg Kroah-Hartman
` (253 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Damien Le Moal,
Hannes Reinecke, Jens Axboe, Sasha Levin
From: Damien Le Moal <damien.lemoal@wdc.com>
[ Upstream commit 355a8031dc174450ccad2a61c513ad7222d87a97 ]
The loop on entry of ata_host_start() may not initialize host->ops to a
non NULL value. The test on the host_stop field of host->ops must then
be preceded by a check that host->ops is not NULL.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Link: https://lore.kernel.org/r/20210816014456.2191776-3-damien.lemoal@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index db1d86af21b4..d9b1c3e95592 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6412,7 +6412,7 @@ int ata_host_start(struct ata_host *host)
have_stop = 1;
}
- if (host->ops->host_stop)
+ if (host->ops && host->ops->host_stop)
have_stop = 1;
if (have_stop) {
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 047/293] crypto: qat - do not ignore errors from enable_vf2pf_comms()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 046/293] libata: fix ata_host_start() Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 048/293] crypto: qat - handle both source of interrupt in VF ISR Greg Kroah-Hartman
` (252 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
Fiona Trahe, Herbert Xu, Sasha Levin
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 5147f0906d50a9d26f2b8698cd06b5680e9867ff ]
The function adf_dev_init() ignores the error code reported by
enable_vf2pf_comms(). If the latter fails, e.g. the VF is not compatible
with the pf, then the load of the VF driver progresses.
This patch changes adf_dev_init() so that the error code from
enable_vf2pf_comms() is returned to the caller.
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_init.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c
index 26556c713049..7a7d43c47534 100644
--- a/drivers/crypto/qat/qat_common/adf_init.c
+++ b/drivers/crypto/qat/qat_common/adf_init.c
@@ -105,6 +105,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)
struct service_hndl *service;
struct list_head *list_itr;
struct adf_hw_device_data *hw_data = accel_dev->hw_device;
+ int ret;
if (!hw_data) {
dev_err(&GET_DEV(accel_dev),
@@ -171,9 +172,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)
}
hw_data->enable_error_correction(accel_dev);
- hw_data->enable_vf2pf_comms(accel_dev);
+ ret = hw_data->enable_vf2pf_comms(accel_dev);
- return 0;
+ return ret;
}
EXPORT_SYMBOL_GPL(adf_dev_init);
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 048/293] crypto: qat - handle both source of interrupt in VF ISR
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 047/293] crypto: qat - do not ignore errors from enable_vf2pf_comms() Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 049/293] crypto: qat - fix reuse of completion variable Greg Kroah-Hartman
` (251 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
Fiona Trahe, Herbert Xu, Sasha Levin
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 0a73c762e1eee33a5e5dc0e3488f1b7cd17249b3 ]
The top half of the VF drivers handled only a source at the time.
If an interrupt for PF2VF and bundle occurred at the same time, the ISR
scheduled only the bottom half for PF2VF.
This patch fixes the VF top half so that if both sources of interrupt
trigger at the same time, both bottom halves are scheduled.
This patch is based on earlier work done by Conor McLoughlin.
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
index df9a1f35b832..ef90902c8200 100644
--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
@@ -203,6 +203,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)
struct adf_bar *pmisc =
&GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
void __iomem *pmisc_bar_addr = pmisc->virt_addr;
+ bool handled = false;
u32 v_int;
/* Read VF INT source CSR to determine the source of VF interrupt */
@@ -215,7 +216,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)
/* Schedule tasklet to handle interrupt BH */
tasklet_hi_schedule(&accel_dev->vf.pf2vf_bh_tasklet);
- return IRQ_HANDLED;
+ handled = true;
}
/* Check bundle interrupt */
@@ -227,10 +228,10 @@ static irqreturn_t adf_isr(int irq, void *privdata)
WRITE_CSR_INT_FLAG_AND_COL(bank->csr_addr, bank->bank_number,
0);
tasklet_hi_schedule(&bank->resp_handler);
- return IRQ_HANDLED;
+ handled = true;
}
- return IRQ_NONE;
+ return handled ? IRQ_HANDLED : IRQ_NONE;
}
static int adf_request_msi_irq(struct adf_accel_dev *accel_dev)
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 049/293] crypto: qat - fix reuse of completion variable
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 048/293] crypto: qat - handle both source of interrupt in VF ISR Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 050/293] crypto: qat - fix naming for init/shutdown VF to PF notifications Greg Kroah-Hartman
` (250 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marco Chiappero, Giovanni Cabiddu,
Fiona Trahe, Herbert Xu, Sasha Levin
From: Marco Chiappero <marco.chiappero@intel.com>
[ Upstream commit 3d655732b0199562267a05c7ff69ecdd11632939 ]
Use reinit_completion() to set to a clean state a completion variable,
used to coordinate the VF to PF request-response flow, before every
new VF request.
Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Co-developed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index b3875fdf6cd7..9dab2cc11fdf 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -361,6 +361,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev)
msg |= ADF_PFVF_COMPATIBILITY_VERSION << ADF_VF2PF_COMPAT_VER_REQ_SHIFT;
BUILD_BUG_ON(ADF_PFVF_COMPATIBILITY_VERSION > 255);
+ reinit_completion(&accel_dev->vf.iov_msg_completion);
+
/* Send request from VF to PF */
ret = adf_iov_putmsg(accel_dev, msg, 0);
if (ret) {
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 050/293] crypto: qat - fix naming for init/shutdown VF to PF notifications
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 049/293] crypto: qat - fix reuse of completion variable Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 051/293] crypto: qat - do not export adf_iov_putmsg() Greg Kroah-Hartman
` (249 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marco Chiappero, Giovanni Cabiddu,
Fiona Trahe, Herbert Xu, Sasha Levin
From: Marco Chiappero <marco.chiappero@intel.com>
[ Upstream commit b90c1c4d3fa8cd90f4e8245b13564380fd0bfad1 ]
At start and shutdown, VFs notify the PF about their state. These
notifications are carried out through a message exchange using the PFVF
protocol.
Function names lead to believe they do perform init or shutdown logic.
This is to fix the naming to better reflect their purpose.
Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Co-developed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 ++--
drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 ++--
drivers/crypto/qat/qat_common/adf_common_drv.h | 8 ++++----
drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 ++++++------
.../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 ++--
5 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
index d2d0ae445fd8..7c7d49a8a403 100644
--- a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
+++ b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
@@ -123,10 +123,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data)
hw_data->enable_error_correction = adf_vf_void_noop;
hw_data->init_admin_comms = adf_vf_int_noop;
hw_data->exit_admin_comms = adf_vf_void_noop;
- hw_data->send_admin_init = adf_vf2pf_init;
+ hw_data->send_admin_init = adf_vf2pf_notify_init;
hw_data->init_arb = adf_vf_int_noop;
hw_data->exit_arb = adf_vf_void_noop;
- hw_data->disable_iov = adf_vf2pf_shutdown;
+ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
hw_data->get_accel_mask = get_accel_mask;
hw_data->get_ae_mask = get_ae_mask;
hw_data->get_num_accels = get_num_accels;
diff --git a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
index 38e4bc04f407..90e8a7564756 100644
--- a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
+++ b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
@@ -123,10 +123,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data)
hw_data->enable_error_correction = adf_vf_void_noop;
hw_data->init_admin_comms = adf_vf_int_noop;
hw_data->exit_admin_comms = adf_vf_void_noop;
- hw_data->send_admin_init = adf_vf2pf_init;
+ hw_data->send_admin_init = adf_vf2pf_notify_init;
hw_data->init_arb = adf_vf_int_noop;
hw_data->exit_arb = adf_vf_void_noop;
- hw_data->disable_iov = adf_vf2pf_shutdown;
+ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
hw_data->get_accel_mask = get_accel_mask;
hw_data->get_ae_mask = get_ae_mask;
hw_data->get_num_accels = get_num_accels;
diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h
index d78f8d5c89c3..289dd7e48d4a 100644
--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
+++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
@@ -239,8 +239,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev,
void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
-int adf_vf2pf_init(struct adf_accel_dev *accel_dev);
-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev);
+int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev);
+void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev);
int adf_init_pf_wq(void);
void adf_exit_pf_wq(void);
int adf_init_vf_wq(void);
@@ -263,12 +263,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev)
{
}
-static inline int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
+static inline int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev)
{
return 0;
}
-static inline void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
+static inline void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
{
}
diff --git a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
index cd5f37dffe8a..1830194567e8 100644
--- a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
@@ -49,14 +49,14 @@
#include "adf_pf2vf_msg.h"
/**
- * adf_vf2pf_init() - send init msg to PF
+ * adf_vf2pf_notify_init() - send init msg to PF
* @accel_dev: Pointer to acceleration VF device.
*
* Function sends an init messge from the VF to a PF
*
* Return: 0 on success, error code otherwise.
*/
-int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
+int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev)
{
u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM |
(ADF_VF2PF_MSGTYPE_INIT << ADF_VF2PF_MSGTYPE_SHIFT));
@@ -69,17 +69,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
return 0;
}
-EXPORT_SYMBOL_GPL(adf_vf2pf_init);
+EXPORT_SYMBOL_GPL(adf_vf2pf_notify_init);
/**
- * adf_vf2pf_shutdown() - send shutdown msg to PF
+ * adf_vf2pf_notify_shutdown() - send shutdown msg to PF
* @accel_dev: Pointer to acceleration VF device.
*
* Function sends a shutdown messge from the VF to a PF
*
* Return: void
*/
-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
+void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
{
u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM |
(ADF_VF2PF_MSGTYPE_SHUTDOWN << ADF_VF2PF_MSGTYPE_SHIFT));
@@ -89,4 +89,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
dev_err(&GET_DEV(accel_dev),
"Failed to send Shutdown event to PF\n");
}
-EXPORT_SYMBOL_GPL(adf_vf2pf_shutdown);
+EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown);
diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
index a3b4dd8099a7..3a8361c83f0b 100644
--- a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
+++ b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
@@ -123,10 +123,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data)
hw_data->enable_error_correction = adf_vf_void_noop;
hw_data->init_admin_comms = adf_vf_int_noop;
hw_data->exit_admin_comms = adf_vf_void_noop;
- hw_data->send_admin_init = adf_vf2pf_init;
+ hw_data->send_admin_init = adf_vf2pf_notify_init;
hw_data->init_arb = adf_vf_int_noop;
hw_data->exit_arb = adf_vf_void_noop;
- hw_data->disable_iov = adf_vf2pf_shutdown;
+ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
hw_data->get_accel_mask = get_accel_mask;
hw_data->get_ae_mask = get_ae_mask;
hw_data->get_num_accels = get_num_accels;
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 051/293] crypto: qat - do not export adf_iov_putmsg()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 050/293] crypto: qat - fix naming for init/shutdown VF to PF notifications Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 052/293] fcntl: fix potential deadlock for &fasync_struct.fa_lock Greg Kroah-Hartman
` (248 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Fiona Trahe,
Herbert Xu, Sasha Levin
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 645ae0af1840199086c33e4f841892ebee73f615 ]
The function adf_iov_putmsg() is only used inside the intel_qat module
therefore should not be exported.
Remove EXPORT_SYMBOL for the function adf_iov_putmsg().
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index 9dab2cc11fdf..c64481160b71 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -231,7 +231,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
return ret;
}
-EXPORT_SYMBOL_GPL(adf_iov_putmsg);
void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
{
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 052/293] fcntl: fix potential deadlock for &fasync_struct.fa_lock
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 051/293] crypto: qat - do not export adf_iov_putmsg() Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 053/293] udf_get_extendedattr() had no boundary checks Greg Kroah-Hartman
` (247 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Desmond Cheong Zhi Xi, Jeff Layton,
Sasha Levin
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ]
There is an existing lock hierarchy of
&dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock
from the following call chain:
input_inject_event():
spin_lock_irqsave(&dev->event_lock,...);
input_handle_event():
input_pass_values():
input_to_handler():
evdev_events():
evdev_pass_values():
spin_lock(&client->buffer_lock);
__pass_event():
kill_fasync():
kill_fasync_rcu():
read_lock(&fa->fa_lock);
send_sigio():
read_lock_irqsave(&fown->lock,...);
&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled
while grabbing &fasync_struct.fa_lock, otherwise we invert the lock
hierarchy. However, since kill_fasync which calls kill_fasync_rcu is
an exported symbol, it may not necessarily be called with interrupts
disabled.
As kill_fasync_rcu may be called with interrupts disabled (for
example, in the call chain above), we replace calls to
read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu
with read_lock_irqsave/read_unlock_irqrestore.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fcntl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index e039af1872ab..dffb5245ae72 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -993,13 +993,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
{
while (fa) {
struct fown_struct *fown;
+ unsigned long flags;
if (fa->magic != FASYNC_MAGIC) {
printk(KERN_ERR "kill_fasync: bad magic number in "
"fasync_struct!\n");
return;
}
- read_lock(&fa->fa_lock);
+ read_lock_irqsave(&fa->fa_lock, flags);
if (fa->fa_file) {
fown = &fa->fa_file->f_owner;
/* Don't send SIGURG to processes which have not set a
@@ -1008,7 +1009,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
if (!(sig == SIGURG && fown->signum == 0))
send_sigio(fown, fa->fa_fd, band);
}
- read_unlock(&fa->fa_lock);
+ read_unlock_irqrestore(&fa->fa_lock, flags);
fa = rcu_dereference(fa->fa_next);
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 053/293] udf_get_extendedattr() had no boundary checks.
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 052/293] fcntl: fix potential deadlock for &fasync_struct.fa_lock Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 054/293] m68k: emu: Fix invalid free in nfeth_cleanup() Greg Kroah-Hartman
` (246 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stian Skjelstad, Jan Kara,
Sasha Levin
From: Stian Skjelstad <stian.skjelstad@gmail.com>
[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]
When parsing the ExtendedAttr data, malicous or corrupt attribute length
could cause kernel hangs and buffer overruns in some special cases.
Link: https://lore.kernel.org/r/20210822093332.25234-1-stian.skjelstad@gmail.com
Signed-off-by: Stian Skjelstad <stian.skjelstad@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/misc.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index 401e64cde1be..853bcff51043 100644
--- a/fs/udf/misc.c
+++ b/fs/udf/misc.c
@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,
else
offset = le32_to_cpu(eahd->appAttrLocation);
- while (offset < iinfo->i_lenEAttr) {
+ while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) {
+ uint32_t attrLength;
+
gaf = (struct genericFormat *)&ea[offset];
+ attrLength = le32_to_cpu(gaf->attrLength);
+
+ /* Detect undersized elements and buffer overflows */
+ if ((attrLength < sizeof(*gaf)) ||
+ (attrLength > (iinfo->i_lenEAttr - offset)))
+ break;
+
if (le32_to_cpu(gaf->attrType) == type &&
gaf->attrSubtype == subtype)
return gaf;
else
- offset += le32_to_cpu(gaf->attrLength);
+ offset += attrLength;
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 054/293] m68k: emu: Fix invalid free in nfeth_cleanup()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 053/293] udf_get_extendedattr() had no boundary checks Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 055/293] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config Greg Kroah-Hartman
` (245 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Geert Uytterhoeven,
Sasha Levin
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 761608f5cf70e8876c2f0e39ca54b516bdcb7c12 ]
In the for loop all nfeth_dev array members should be freed, not only
the first one. Freeing only the first array member can cause
double-free bugs and memory leaks.
Fixes: 9cd7b148312f ("m68k/atari: ARAnyM - Add support for network access")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20210705204727.10743-1-paskripkin@gmail.com
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/emu/nfeth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/m68k/emu/nfeth.c b/arch/m68k/emu/nfeth.c
index e45ce4243aaa..76262dc40e79 100644
--- a/arch/m68k/emu/nfeth.c
+++ b/arch/m68k/emu/nfeth.c
@@ -258,8 +258,8 @@ static void __exit nfeth_cleanup(void)
for (i = 0; i < MAX_UNIT; i++) {
if (nfeth_dev[i]) {
- unregister_netdev(nfeth_dev[0]);
- free_netdev(nfeth_dev[0]);
+ unregister_netdev(nfeth_dev[i]);
+ free_netdev(nfeth_dev[i]);
}
}
free_irq(nfEtherIRQ, nfeth_interrupt);
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 055/293] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 054/293] m68k: emu: Fix invalid free in nfeth_cleanup() Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 056/293] spi: spi-pic32: " Greg Kroah-Hartman
` (244 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sanchayan Maity, Vladimir Oltean,
Peter Ujfalusi, Vinod Koul, Tony Lindgren, Mark Brown,
Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 209ab223ad5b18e437289235e3bde12593b94ac4 ]
Depending on the DMA driver being used, the struct dma_slave_config may
need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and
dst_port_window_size. If these are left uninitialized, it can cause DMA
failures.
For spi-fsl-dspi, this is probably not currently an issue but is still
good to fix though.
Fixes: 90ba37033cb9 ("spi: spi-fsl-dspi: Add DMA support for Vybrid")
Cc: Sanchayan Maity <maitysanchayan@gmail.com>
Cc: Vladimir Oltean <vladimir.oltean@nxp.com>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Acked-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/20210810081727.19491-1-tony@atomide.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-fsl-dspi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 25486ee8379b..cfbf1ffb61bf 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -430,6 +430,7 @@ static int dspi_request_dma(struct fsl_dspi *dspi, phys_addr_t phy_addr)
goto err_rx_dma_buf;
}
+ memset(&cfg, 0, sizeof(cfg));
cfg.src_addr = phy_addr + SPI_POPR;
cfg.dst_addr = phy_addr + SPI_PUSHR;
cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 056/293] spi: spi-pic32: Fix issue with uninitialized dma_slave_config
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 055/293] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 057/293] lib/mpi: use kcalloc in mpi_resize Greg Kroah-Hartman
` (243 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Purna Chandra Mandal, Peter Ujfalusi,
Vinod Koul, Tony Lindgren, Mark Brown, Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 976c1de1de147bb7f4e0d87482f375221c05aeaf ]
Depending on the DMA driver being used, the struct dma_slave_config may
need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and
dst_port_window_size. If these are left uninitialized, it can cause DMA
failures.
For spi-pic32, this is probably not currently an issue but is still good to
fix though.
Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210810081727.19491-2-tony@atomide.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-pic32.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
index 661a40c653e9..d8cdb13ce3e4 100644
--- a/drivers/spi/spi-pic32.c
+++ b/drivers/spi/spi-pic32.c
@@ -369,6 +369,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width)
struct dma_slave_config cfg;
int ret;
+ memset(&cfg, 0, sizeof(cfg));
cfg.device_fc = true;
cfg.src_addr = pic32s->dma_base + buf_offset;
cfg.dst_addr = pic32s->dma_base + buf_offset;
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 057/293] lib/mpi: use kcalloc in mpi_resize
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 056/293] spi: spi-pic32: " Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 058/293] clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel Greg Kroah-Hartman
` (242 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hongbo Li, Herbert Xu, Sasha Levin
From: Hongbo Li <herberthbli@tencent.com>
[ Upstream commit b6f756726e4dfe75be1883f6a0202dcecdc801ab ]
We should set the additional space to 0 in mpi_resize().
So use kcalloc() instead of kmalloc_array().
In lib/mpi/ec.c:
/****************
* Resize the array of A to NLIMBS. the additional space is cleared
* (set to 0) [done by m_realloc()]
*/
int mpi_resize(MPI a, unsigned nlimbs)
Like the comment of kernel's mpi_resize() said, the additional space
need to be set to 0, but when a->d is not NULL, it does not set.
The kernel's mpi lib is from libgcrypt, the mpi resize in libgcrypt
is _gcry_mpi_resize() which set the additional space to 0.
This bug may cause mpi api which use mpi_resize() get wrong result
under the condition of using the additional space without initiation.
If this condition is not met, the bug would not be triggered.
Currently in kernel, rsa, sm2 and dh use mpi lib, and they works well,
so the bug is not triggered in these cases.
add_points_edwards() use the additional space directly, so it will
get a wrong result.
Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)")
Signed-off-by: Hongbo Li <herberthbli@tencent.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/mpi/mpiutil.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c
index 20ed0f766787..00825028cc84 100644
--- a/lib/mpi/mpiutil.c
+++ b/lib/mpi/mpiutil.c
@@ -91,7 +91,7 @@ int mpi_resize(MPI a, unsigned nlimbs)
return 0; /* no need to do it */
if (a->d) {
- p = kmalloc_array(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
+ p = kcalloc(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
if (!p)
return -ENOMEM;
memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t));
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 058/293] clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 057/293] lib/mpi: use kcalloc in mpi_resize Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 059/293] crypto: qat - use proper type for vf_mask Greg Kroah-Hartman
` (241 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Phong Hoang, Niklas Söderlund,
Daniel Lezcano, Sasha Levin
From: Phong Hoang <phong.hoang.wz@renesas.com>
[ Upstream commit be83c3b6e7b8ff22f72827a613bf6f3aa5afadbb ]
If CMT instance has at least two channels, one channel will be used
as a clock source and another one used as a clock event device.
In that case, IRQ is not requested for clock source channel so
sh_cmt_clock_event_program_verify() might work incorrectly.
Besides, when a channel is only used for clock source, don't need to
re-set the next match_value since it should be maximum timeout as
it still is.
On the other hand, due to no IRQ, total_cycles is not counted up
when reaches compare match time (timer counter resets to zero),
so sh_cmt_clocksource_read() returns unexpected value.
Therefore, use 64-bit clocksoure's mask for 32-bit or 16-bit variants
will also lead to wrong delta calculation. Hence, this mask should
correspond to timer counter width, and above function just returns
the raw value of timer counter register.
Fixes: bfa76bb12f23 ("clocksource: sh_cmt: Request IRQ for clock event device only")
Fixes: 37e7742c55ba ("clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines")
Signed-off-by: Phong Hoang <phong.hoang.wz@renesas.com>
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210422123443.73334-1-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/sh_cmt.c | 30 ++++++++++++++++++------------
1 file changed, 18 insertions(+), 12 deletions(-)
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index cec90a4c79b3..7a6d4c4c0feb 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -576,7 +576,8 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag)
ch->flags |= flag;
/* setup timeout if no clockevent */
- if ((flag == FLAG_CLOCKSOURCE) && (!(ch->flags & FLAG_CLOCKEVENT)))
+ if (ch->cmt->num_channels == 1 &&
+ flag == FLAG_CLOCKSOURCE && (!(ch->flags & FLAG_CLOCKEVENT)))
__sh_cmt_set_next(ch, ch->max_match_value);
out:
raw_spin_unlock_irqrestore(&ch->lock, flags);
@@ -612,20 +613,25 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs)
static u64 sh_cmt_clocksource_read(struct clocksource *cs)
{
struct sh_cmt_channel *ch = cs_to_sh_cmt(cs);
- unsigned long flags;
u32 has_wrapped;
- u64 value;
- u32 raw;
- raw_spin_lock_irqsave(&ch->lock, flags);
- value = ch->total_cycles;
- raw = sh_cmt_get_counter(ch, &has_wrapped);
+ if (ch->cmt->num_channels == 1) {
+ unsigned long flags;
+ u64 value;
+ u32 raw;
- if (unlikely(has_wrapped))
- raw += ch->match_value + 1;
- raw_spin_unlock_irqrestore(&ch->lock, flags);
+ raw_spin_lock_irqsave(&ch->lock, flags);
+ value = ch->total_cycles;
+ raw = sh_cmt_get_counter(ch, &has_wrapped);
+
+ if (unlikely(has_wrapped))
+ raw += ch->match_value + 1;
+ raw_spin_unlock_irqrestore(&ch->lock, flags);
+
+ return value + raw;
+ }
- return value + raw;
+ return sh_cmt_get_counter(ch, &has_wrapped);
}
static int sh_cmt_clocksource_enable(struct clocksource *cs)
@@ -688,7 +694,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch,
cs->disable = sh_cmt_clocksource_disable;
cs->suspend = sh_cmt_clocksource_suspend;
cs->resume = sh_cmt_clocksource_resume;
- cs->mask = CLOCKSOURCE_MASK(sizeof(u64) * 8);
+ cs->mask = CLOCKSOURCE_MASK(ch->cmt->info->width);
cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n",
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 059/293] crypto: qat - use proper type for vf_mask
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 058/293] clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 060/293] certs: Trigger creation of RSA module signing key if its not an RSA key Greg Kroah-Hartman
` (240 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
Fiona Trahe, Herbert Xu, Sasha Levin
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 462354d986b6a89c6449b85f17aaacf44e455216 ]
Replace vf_mask type with unsigned long to avoid a stack-out-of-bound.
This is to fix the following warning reported by KASAN the first time
adf_msix_isr_ae() gets called.
[ 692.091987] BUG: KASAN: stack-out-of-bounds in find_first_bit+0x28/0x50
[ 692.092017] Read of size 8 at addr ffff88afdf789e60 by task swapper/32/0
[ 692.092076] Call Trace:
[ 692.092089] <IRQ>
[ 692.092101] dump_stack+0x9c/0xcf
[ 692.092132] print_address_description.constprop.0+0x18/0x130
[ 692.092164] ? find_first_bit+0x28/0x50
[ 692.092185] kasan_report.cold+0x7f/0x111
[ 692.092213] ? static_obj+0x10/0x80
[ 692.092234] ? find_first_bit+0x28/0x50
[ 692.092262] find_first_bit+0x28/0x50
[ 692.092288] adf_msix_isr_ae+0x16e/0x230 [intel_qat]
Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_isr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
index 4898ef41fd9f..7d319c5c071c 100644
--- a/drivers/crypto/qat/qat_common/adf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_isr.c
@@ -59,6 +59,8 @@
#include "adf_transport_access_macros.h"
#include "adf_transport_internal.h"
+#define ADF_MAX_NUM_VFS 32
+
static int adf_enable_msix(struct adf_accel_dev *accel_dev)
{
struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
@@ -111,7 +113,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
struct adf_bar *pmisc =
&GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
void __iomem *pmisc_bar_addr = pmisc->virt_addr;
- u32 vf_mask;
+ unsigned long vf_mask;
/* Get the interrupt sources triggered by VFs */
vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) &
@@ -132,8 +134,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
* unless the VF is malicious and is attempting to
* flood the host OS with VF2PF interrupts.
*/
- for_each_set_bit(i, (const unsigned long *)&vf_mask,
- (sizeof(vf_mask) * BITS_PER_BYTE)) {
+ for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) {
vf_info = accel_dev->pf.vf_info + i;
if (!__ratelimit(&vf_info->vf2pf_ratelimit)) {
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 060/293] certs: Trigger creation of RSA module signing key if its not an RSA key
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 059/293] crypto: qat - use proper type for vf_mask Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 061/293] spi: sprd: Fix the wrong WDG_LOAD_VAL Greg Kroah-Hartman
` (239 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Howells, David Woodhouse,
Stefan Berger, Jarkko Sakkinen, Sasha Levin
From: Stefan Berger <stefanb@linux.ibm.com>
[ Upstream commit ea35e0d5df6c92fa2e124bb1b91d09b2240715ba ]
Address a kbuild issue where a developer created an ECDSA key for signing
kernel modules and then builds an older version of the kernel, when bi-
secting the kernel for example, that does not support ECDSA keys.
If openssl is installed, trigger the creation of an RSA module signing
key if it is not an RSA key.
Fixes: cfc411e7fff3 ("Move certificate handling to its own directory")
Cc: David Howells <dhowells@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
certs/Makefile | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/certs/Makefile b/certs/Makefile
index 5d0999b9e21b..ca3c71e3a3d9 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -46,11 +46,19 @@ endif
redirect_openssl = 2>&1
quiet_redirect_openssl = 2>&1
silent_redirect_openssl = 2>/dev/null
+openssl_available = $(shell openssl help 2>/dev/null && echo yes)
# We do it this way rather than having a boolean option for enabling an
# external private key, because 'make randconfig' might enable such a
# boolean option and we unfortunately can't make it depend on !RANDCONFIG.
ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
+
+ifeq ($(openssl_available),yes)
+X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null)
+
+$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
+endif
+
$(obj)/signing_key.pem: $(obj)/x509.genkey
@$(kecho) "###"
@$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 061/293] spi: sprd: Fix the wrong WDG_LOAD_VAL
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 060/293] certs: Trigger creation of RSA module signing key if its not an RSA key Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 062/293] media: TDA1997x: enable EDID support Greg Kroah-Hartman
` (238 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chunyan Zhang, Mark Brown,
Sasha Levin
From: Chunyan Zhang <chunyan.zhang@unisoc.com>
[ Upstream commit 245ca2cc212bb2a078332ec99afbfbb202f44c2d ]
Use 50ms as default timeout value and the time clock is 32768HZ.
The original value of WDG_LOAD_VAL is not correct, so this patch
fixes it.
Fixes: ac1775012058 ("spi: sprd: Add the support of restarting the system")
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Link: https://lore.kernel.org/r/20210826091549.2138125-2-zhang.lyra@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sprd-adi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
index e41976010dc4..97f44458ee7b 100644
--- a/drivers/spi/spi-sprd-adi.c
+++ b/drivers/spi/spi-sprd-adi.c
@@ -99,7 +99,7 @@
#define HWRST_STATUS_SPRDISK 0xc0
/* Use default timeout 50 ms that converts to watchdog values */
-#define WDG_LOAD_VAL ((50 * 1000) / 32768)
+#define WDG_LOAD_VAL ((50 * 32768) / 1000)
#define WDG_LOAD_MASK GENMASK(15, 0)
#define WDG_UNLOCK_KEY 0xe551
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 062/293] media: TDA1997x: enable EDID support
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 061/293] spi: sprd: Fix the wrong WDG_LOAD_VAL Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 063/293] soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally Greg Kroah-Hartman
` (237 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Halasa, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Krzysztof Hałasa <khalasa@piap.pl>
[ Upstream commit ea3e1c36e38810427485f06c2becc1f29e54521d ]
Without this patch, the TDA19971 chip's EDID is inactive.
EDID never worked with this driver, it was all tested with HDMI signal
sources which don't need EDID support.
Signed-off-by: Krzysztof Halasa <khalasa@piap.pl>
Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/tda1997x.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index d114ac5243ec..dab441bbc9f0 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -2229,6 +2229,7 @@ static int tda1997x_core_init(struct v4l2_subdev *sd)
/* get initial HDMI status */
state->hdmi_status = io_read(sd, REG_HDMI_FLAGS);
+ io_write(sd, REG_EDID_ENABLE, EDID_ENABLE_A_EN | EDID_ENABLE_B_EN);
return 0;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 063/293] soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 062/293] media: TDA1997x: enable EDID support Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 064/293] media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init Greg Kroah-Hartman
` (236 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Heiko Stuebner,
Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 2a1c55d4762dd34a8b0f2e36fb01b7b16b60735b ]
Merely enabling CONFIG_COMPILE_TEST should not enable additional code.
To fix this, restrict the automatic enabling of ROCKCHIP_GRF to
ARCH_ROCKCHIP, and ask the user in case of compile-testing.
Fixes: 4c58063d4258f6be ("soc: rockchip: add driver handling grf setup")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20210208143855.418374-1-geert+renesas@glider.be
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/rockchip/Kconfig | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/rockchip/Kconfig b/drivers/soc/rockchip/Kconfig
index 20da55d9cbb1..d483b0e29b81 100644
--- a/drivers/soc/rockchip/Kconfig
+++ b/drivers/soc/rockchip/Kconfig
@@ -5,8 +5,8 @@ if ARCH_ROCKCHIP || COMPILE_TEST
#
config ROCKCHIP_GRF
- bool
- default y
+ bool "Rockchip General Register Files support" if COMPILE_TEST
+ default y if ARCH_ROCKCHIP
help
The General Register Files are a central component providing
special additional settings registers for a lot of soc-components.
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 064/293] media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 063/293] soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 065/293] media: dvb-usb: fix uninit-value in vp702x_read_mac_addr Greg Kroah-Hartman
` (235 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+e27b4fd589762b0b9329,
Dongliang Mu, Sean Young, Mauro Carvalho Chehab, Sasha Levin
From: Dongliang Mu <mudongliangabcd@gmail.com>
[ Upstream commit c5453769f77ce19a5b03f1f49946fd3f8a374009 ]
If dibusb_read_eeprom_byte fails, the mac address is not initialized.
And nova_t_read_mac_address does not handle this failure, which leads to
the uninit-value in dvb_usb_adapter_dvb_init.
Fix this by handling the failure of dibusb_read_eeprom_byte.
Reported-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com
Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c
index 43e0e0fd715b..705c2901a89e 100644
--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c
+++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c
@@ -133,7 +133,7 @@ ret:
static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
{
- int i;
+ int i, ret;
u8 b;
mac[0] = 0x00;
@@ -142,7 +142,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
/* this is a complete guess, but works for my box */
for (i = 136; i < 139; i++) {
- dibusb_read_eeprom_byte(d,i, &b);
+ ret = dibusb_read_eeprom_byte(d, i, &b);
+ if (ret)
+ return ret;
mac[5 - (i - 136)] = b;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 065/293] media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 064/293] media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 066/293] media: go7007: remove redundant initialization Greg Kroah-Hartman
` (234 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dongliang Mu, Sean Young,
Mauro Carvalho Chehab, Sasha Levin
From: Dongliang Mu <mudongliangabcd@gmail.com>
[ Upstream commit 797c061ad715a9a1480eb73f44b6939fbe3209ed ]
If vp702x_usb_in_op fails, the mac address is not initialized.
And vp702x_read_mac_addr does not handle this failure, which leads to
the uninit-value in dvb_usb_adapter_dvb_init.
Fix this by handling the failure of vp702x_usb_in_op.
Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/vp702x.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/media/usb/dvb-usb/vp702x.c b/drivers/media/usb/dvb-usb/vp702x.c
index c3529ea59da9..fcd66757b34d 100644
--- a/drivers/media/usb/dvb-usb/vp702x.c
+++ b/drivers/media/usb/dvb-usb/vp702x.c
@@ -294,16 +294,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
static int vp702x_read_mac_addr(struct dvb_usb_device *d,u8 mac[6])
{
u8 i, *buf;
+ int ret;
struct vp702x_device_state *st = d->priv;
mutex_lock(&st->buf_mutex);
buf = st->buf;
- for (i = 6; i < 12; i++)
- vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, &buf[i - 6], 1);
+ for (i = 6; i < 12; i++) {
+ ret = vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1,
+ &buf[i - 6], 1);
+ if (ret < 0)
+ goto err;
+ }
memcpy(mac, buf, 6);
+err:
mutex_unlock(&st->buf_mutex);
- return 0;
+ return ret;
}
static int vp702x_frontend_attach(struct dvb_usb_adapter *adap)
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 066/293] media: go7007: remove redundant initialization
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 065/293] media: dvb-usb: fix uninit-value in vp702x_read_mac_addr Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 067/293] Bluetooth: sco: prevent information leak in sco_conn_defer_accept() Greg Kroah-Hartman
` (233 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 6f5885a7750545973bf1a942d2f0f129aef0aa06 ]
In go7007_alloc() kzalloc() is used for struct go7007
allocation. It means that there is no need in zeroing
any members, because kzalloc will take care of it.
Removing these reduntant initialization steps increases
execution speed a lot:
Before:
+ 86.802 us | go7007_alloc();
After:
+ 29.595 us | go7007_alloc();
Fixes: 866b8695d67e8 ("Staging: add the go7007 video driver")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/go7007/go7007-driver.c | 26 ------------------------
1 file changed, 26 deletions(-)
diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
index 62aeebcdd7f7..c7b5a3321cd7 100644
--- a/drivers/media/usb/go7007/go7007-driver.c
+++ b/drivers/media/usb/go7007/go7007-driver.c
@@ -699,49 +699,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board,
struct device *dev)
{
struct go7007 *go;
- int i;
go = kzalloc(sizeof(struct go7007), GFP_KERNEL);
if (go == NULL)
return NULL;
go->dev = dev;
go->board_info = board;
- go->board_id = 0;
go->tuner_type = -1;
- go->channel_number = 0;
- go->name[0] = 0;
mutex_init(&go->hw_lock);
init_waitqueue_head(&go->frame_waitq);
spin_lock_init(&go->spinlock);
go->status = STATUS_INIT;
- memset(&go->i2c_adapter, 0, sizeof(go->i2c_adapter));
- go->i2c_adapter_online = 0;
- go->interrupt_available = 0;
init_waitqueue_head(&go->interrupt_waitq);
- go->input = 0;
go7007_update_board(go);
- go->encoder_h_halve = 0;
- go->encoder_v_halve = 0;
- go->encoder_subsample = 0;
go->format = V4L2_PIX_FMT_MJPEG;
go->bitrate = 1500000;
go->fps_scale = 1;
- go->pali = 0;
go->aspect_ratio = GO7007_RATIO_1_1;
- go->gop_size = 0;
- go->ipb = 0;
- go->closed_gop = 0;
- go->repeat_seqhead = 0;
- go->seq_header_enable = 0;
- go->gop_header_enable = 0;
- go->dvd_mode = 0;
- go->interlace_coding = 0;
- for (i = 0; i < 4; ++i)
- go->modet[i].enable = 0;
- for (i = 0; i < 1624; ++i)
- go->modet_map[i] = 0;
- go->audio_deliver = NULL;
- go->audio_enabled = 0;
return go;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 067/293] Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 066/293] media: go7007: remove redundant initialization Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 068/293] tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos Greg Kroah-Hartman
` (232 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Marcel Holtmann,
Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 59da0b38bc2ea570ede23a3332ecb3e7574ce6b2 ]
Smatch complains that some of these struct members are not initialized
leading to a stack information disclosure:
net/bluetooth/sco.c:778 sco_conn_defer_accept() warn:
check that 'cp.retrans_effort' doesn't leak information
This seems like a valid warning. I've added a default case to fix
this issue.
Fixes: 2f69a82acf6f ("Bluetooth: Use voice setting in deferred SCO connection request")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/sco.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index a4ca55df7390..2561e462400e 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -761,6 +761,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
cp.max_latency = cpu_to_le16(0xffff);
cp.retrans_effort = 0xff;
break;
+ default:
+ /* use CVSD settings as fallback */
+ cp.max_latency = cpu_to_le16(0xffff);
+ cp.retrans_effort = 0xff;
+ break;
}
hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 068/293] tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 067/293] Bluetooth: sco: prevent information leak in sco_conn_defer_accept() Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 069/293] net: cipso: fix warnings in netlbl_cipsov4_add_std Greg Kroah-Hartman
` (231 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin KaFai Lau, Andrii Nakryiko,
Eric Dumazet, Kuniyuki Iwashima, Yonghong Song, Sasha Levin
From: Martin KaFai Lau <kafai@fb.com>
[ Upstream commit 525e2f9fd0229eb10cb460a9e6d978257f24804e ]
st->bucket stores the current bucket number.
st->offset stores the offset within this bucket that is the sk to be
seq_show(). Thus, st->offset only makes sense within the same
st->bucket.
These two variables are an optimization for the common no-lseek case.
When resuming the seq_file iteration (i.e. seq_start()),
tcp_seek_last_pos() tries to continue from the st->offset
at bucket st->bucket.
However, it is possible that the bucket pointed by st->bucket
has changed and st->offset may end up skipping the whole st->bucket
without finding a sk. In this case, tcp_seek_last_pos() currently
continues to satisfy the offset condition in the next (and incorrect)
bucket. Instead, regardless of the offset value, the first sk of the
next bucket should be returned. Thus, "bucket == st->bucket" check is
added to tcp_seek_last_pos().
The chance of hitting this is small and the issue is a decade old,
so targeting for the next tree.
Fixes: a8b690f98baf ("tcp: Fix slowness in read /proc/net/tcp")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210701200541.1033917-1-kafai@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_ipv4.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 71236aa7388d..de4edfbc9e46 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2177,6 +2177,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
static void *tcp_seek_last_pos(struct seq_file *seq)
{
struct tcp_iter_state *st = seq->private;
+ int bucket = st->bucket;
int offset = st->offset;
int orig_num = st->num;
void *rc = NULL;
@@ -2187,7 +2188,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)
break;
st->state = TCP_SEQ_STATE_LISTENING;
rc = listening_get_next(seq, NULL);
- while (offset-- && rc)
+ while (offset-- && rc && bucket == st->bucket)
rc = listening_get_next(seq, rc);
if (rc)
break;
@@ -2198,7 +2199,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)
if (st->bucket > tcp_hashinfo.ehash_mask)
break;
rc = established_get_first(seq);
- while (offset-- && rc)
+ while (offset-- && rc && bucket == st->bucket)
rc = established_get_next(seq, rc);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 069/293] net: cipso: fix warnings in netlbl_cipsov4_add_std
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 068/293] tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 070/293] i2c: highlander: add IRQ check Greg Kroah-Hartman
` (230 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Moore, Pavel Skripkin,
David S. Miller, Sasha Levin, syzbot+cdd51ee2e6b0b2e18c0d
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 8ca34a13f7f9b3fa2c464160ffe8cc1a72088204 ]
Syzbot reported warning in netlbl_cipsov4_add(). The
problem was in too big doi_def->map.std->lvl.local_size
passed to kcalloc(). Since this value comes from userpace there is
no need to warn if value is not correct.
The same problem may occur with other kcalloc() calls in
this function, so, I've added __GFP_NOWARN flag to all
kcalloc() calls there.
Reported-and-tested-by: syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com
Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netlabel/netlabel_cipso_v4.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 3e3494c8d42f..0559d442ad80 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -198,14 +198,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
}
doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
sizeof(u32),
- GFP_KERNEL);
+ GFP_KERNEL | __GFP_NOWARN);
if (doi_def->map.std->lvl.local == NULL) {
ret_val = -ENOMEM;
goto add_std_failure;
}
doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
sizeof(u32),
- GFP_KERNEL);
+ GFP_KERNEL | __GFP_NOWARN);
if (doi_def->map.std->lvl.cipso == NULL) {
ret_val = -ENOMEM;
goto add_std_failure;
@@ -273,7 +273,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
doi_def->map.std->cat.local = kcalloc(
doi_def->map.std->cat.local_size,
sizeof(u32),
- GFP_KERNEL);
+ GFP_KERNEL | __GFP_NOWARN);
if (doi_def->map.std->cat.local == NULL) {
ret_val = -ENOMEM;
goto add_std_failure;
@@ -281,7 +281,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
doi_def->map.std->cat.cipso = kcalloc(
doi_def->map.std->cat.cipso_size,
sizeof(u32),
- GFP_KERNEL);
+ GFP_KERNEL | __GFP_NOWARN);
if (doi_def->map.std->cat.cipso == NULL) {
ret_val = -ENOMEM;
goto add_std_failure;
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 070/293] i2c: highlander: add IRQ check
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 069/293] net: cipso: fix warnings in netlbl_cipsov4_add_std Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 071/293] media: em28xx-input: fix refcount bug in em28xx_usb_disconnect Greg Kroah-Hartman
` (229 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Wolfram Sang,
Sasha Levin
From: Sergey Shtylyov <s.shtylyov@omp.ru>
[ Upstream commit f16a3bb69aa6baabf8f0aca982c8cf21e2a4f6bc ]
The driver is written as if platform_get_irq() returns 0 on errors (while
actually it returns a negative error code), blithely passing these error
codes to request_irq() (which takes *unsigned* IRQ #) -- which fails with
-EINVAL. Add the necessary error check to the pre-existing *if* statement
forcing the driver into the polling mode...
Fixes: 4ad48e6ab18c ("i2c: Renesas Highlander FPGA SMBus support")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-highlander.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-highlander.c b/drivers/i2c/busses/i2c-highlander.c
index ff340d7ae2e5..6a880c262380 100644
--- a/drivers/i2c/busses/i2c-highlander.c
+++ b/drivers/i2c/busses/i2c-highlander.c
@@ -379,7 +379,7 @@ static int highlander_i2c_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, dev);
dev->irq = platform_get_irq(pdev, 0);
- if (iic_force_poll)
+ if (dev->irq < 0 || iic_force_poll)
dev->irq = 0;
if (dev->irq) {
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 071/293] media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 070/293] i2c: highlander: add IRQ check Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 072/293] media: venus: venc: Fix potential null pointer dereference on pointer fmt Greg Kroah-Hartman
` (228 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dongliang Mu, Sean Young,
Mauro Carvalho Chehab, Sasha Levin
From: Dongliang Mu <mudongliangabcd@gmail.com>
[ Upstream commit 6fa54bc713c262e1cfbc5613377ef52280d7311f ]
If em28xx_ir_init fails, it would decrease the refcount of dev. However,
in the em28xx_ir_fini, when ir is NULL, it goes to ref_put and decrease
the refcount of dev. This will lead to a refcount bug.
Fix this bug by removing the kref_put in the error handling code
of em28xx_ir_init.
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28
Modules linked in:
CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.13.0 #3
Workqueue: usb_hub_wq hub_event
RIP: 0010:refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28
Call Trace:
kref_put.constprop.0+0x60/0x85 include/linux/kref.h:69
em28xx_usb_disconnect.cold+0xd7/0xdc drivers/media/usb/em28xx/em28xx-cards.c:4150
usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458
__device_release_driver drivers/base/dd.c:1201 [inline]
device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1232
bus_remove_device+0x108/0x160 drivers/base/bus.c:529
device_del+0x1fe/0x510 drivers/base/core.c:3540
usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419
usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2221
hub_port_connect drivers/usb/core/hub.c:5151 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
port_event drivers/usb/core/hub.c:5586 [inline]
hub_event+0xf81/0x1d40 drivers/usb/core/hub.c:5668
process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
process_scheduled_works kernel/workqueue.c:2338 [inline]
worker_thread+0x333/0x5b0 kernel/workqueue.c:2424
kthread+0x188/0x1d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Reported-by: Dongliang Mu <mudongliangabcd@gmail.com>
Fixes: ac5688637144 ("media: em28xx: Fix possible memory leak of em28xx struct")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-input.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
index 3612f0d730dd..92007a225d8e 100644
--- a/drivers/media/usb/em28xx/em28xx-input.c
+++ b/drivers/media/usb/em28xx/em28xx-input.c
@@ -865,7 +865,6 @@ error:
kfree(ir);
ref_put:
em28xx_shutdown_buttons(dev);
- kref_put(&dev->ref, em28xx_free_device);
return err;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 072/293] media: venus: venc: Fix potential null pointer dereference on pointer fmt
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 071/293] media: em28xx-input: fix refcount bug in em28xx_usb_disconnect Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 073/293] PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently Greg Kroah-Hartman
` (227 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Stanimir Varbanov,
Mauro Carvalho Chehab, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 09ea9719a423fc675d40dd05407165e161ea0c48 ]
Currently the call to find_format can potentially return a NULL to
fmt and the nullpointer is later dereferenced on the assignment of
pixmp->num_planes = fmt->num_planes. Fix this by adding a NULL pointer
check and returning NULL for the failure case.
Addresses-Coverity: ("Dereference null return")
Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/venc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
index 420897241248..4197b311cff4 100644
--- a/drivers/media/platform/qcom/venus/venc.c
+++ b/drivers/media/platform/qcom/venus/venc.c
@@ -316,6 +316,8 @@ venc_try_fmt_common(struct venus_inst *inst, struct v4l2_format *f)
else
return NULL;
fmt = find_format(inst, pixmp->pixelformat, f->type);
+ if (!fmt)
+ return NULL;
}
pixmp->width = clamp(pixmp->width, frame_width_min(inst),
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 073/293] PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 072/293] media: venus: venc: Fix potential null pointer dereference on pointer fmt Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 074/293] PCI: PM: Enable PME if it can be signaled from D3cold Greg Kroah-Hartman
` (226 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mika Westerberg, Utkarsh H Patel,
Koba Ko, Rafael J. Wysocki, Sasha Levin
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit da9f2150684ea684a7ddd6d7f0e38b2bdf43dcd8 ]
It is inconsistent to return PCI_D0 from pci_target_state() instead
of the original target state if 'wakeup' is true and the device
cannot signal PME from D0.
This only happens when the device cannot signal PME from the original
target state and any shallower power states (including D0) and that
case is effectively equivalent to the one in which PME singaling is
not supported at all. Since the original target state is returned in
the latter case, make the function do that in the former one too.
Link: https://lore.kernel.org/linux-pm/3149540.aeNJFYEL58@kreacher/
Fixes: 666ff6f83e1d ("PCI/PM: Avoid using device_may_wakeup() for runtime PM")
Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Reported-by: Koba Ko <koba.ko@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 9ebf32de8575..a9fc40458d62 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2274,16 +2274,20 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup)
if (dev->current_state == PCI_D3cold)
target_state = PCI_D3cold;
- if (wakeup) {
+ if (wakeup && dev->pme_support) {
+ pci_power_t state = target_state;
+
/*
* Find the deepest state from which the device can generate
* PME#.
*/
- if (dev->pme_support) {
- while (target_state
- && !(dev->pme_support & (1 << target_state)))
- target_state--;
- }
+ while (state && !(dev->pme_support & (1 << state)))
+ state--;
+
+ if (state)
+ return state;
+ else if (dev->pme_support & 1)
+ return PCI_D0;
}
return target_state;
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 074/293] PCI: PM: Enable PME if it can be signaled from D3cold
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 073/293] PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 075/293] soc: qcom: smsm: Fix missed interrupts if state changes while masked Greg Kroah-Hartman
` (225 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mika Westerberg, Utkarsh H Patel,
Koba Ko, Rafael J. Wysocki, Sasha Levin
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit 0e00392a895c95c6d12d42158236c8862a2f43f2 ]
PME signaling is only enabled by __pci_enable_wake() if the target
device can signal PME from the given target power state (to avoid
pointless reconfiguration of the device), but if the hierarchy above
the device goes into D3cold, the device itself will end up in D3cold
too, so if it can signal PME from D3cold, it should be enabled to
do so in __pci_enable_wake().
[Note that if the device does not end up in D3cold and it cannot
signal PME from the original target power state, it will not signal
PME, so in that case the behavior does not change.]
Link: https://lore.kernel.org/linux-pm/3149540.aeNJFYEL58@kreacher/
Fixes: 5bcc2fb4e815 ("PCI PM: Simplify PCI wake-up code")
Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Reported-by: Koba Ko <koba.ko@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index a9fc40458d62..1a78bf39ee9a 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2170,7 +2170,14 @@ static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable
if (enable) {
int error;
- if (pci_pme_capable(dev, state))
+ /*
+ * Enable PME signaling if the device can signal PME from
+ * D3cold regardless of whether or not it can signal PME from
+ * the current target state, because that will allow it to
+ * signal PME when the hierarchy above it goes into D3cold and
+ * the device itself ends up in D3cold as a result of that.
+ */
+ if (pci_pme_capable(dev, state) || pci_pme_capable(dev, PCI_D3cold))
pci_pme_active(dev, true);
else
ret = 1;
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 075/293] soc: qcom: smsm: Fix missed interrupts if state changes while masked
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 074/293] PCI: PM: Enable PME if it can be signaled from D3cold Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 076/293] Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow Greg Kroah-Hartman
` (224 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephan Gerhold, Bjorn Andersson,
Sasha Levin
From: Stephan Gerhold <stephan@gerhold.net>
[ Upstream commit e3d4571955050736bbf3eda0a9538a09d9fcfce8 ]
The SMSM driver detects interrupt edges by tracking the last state
it has seen (and has triggered the interrupt handler for). This works
fine, but only if the interrupt does not change state while masked.
For example, if an interrupt is unmasked while the state is HIGH,
the stored last_value for that interrupt might still be LOW. Then,
when the remote processor triggers smsm_intr() we assume that nothing
has changed, even though the state might have changed from HIGH to LOW.
Attempt to fix this by checking the current remote state before
unmasking an IRQ. Use atomic operations to avoid the interrupt handler
from interfering with the unmask function.
This fixes modem crashes in some edge cases with the BAM-DMUX driver.
Specifically, the BAM-DMUX interrupt handler is not called for the
HIGH -> LOW smsm state transition if the BAM-DMUX driver is loaded
(and therefore unmasks the interrupt) after the modem was already started:
qcom-q6v5-mss 4080000.remoteproc: fatal error received: a2_task.c:3188:
Assert FALSE failed: A2 DL PER deadlock timer expired waiting for Apps ACK
Fixes: c97c4090ff72 ("soc: qcom: smsm: Add driver for Qualcomm SMSM")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20210712135703.324748-2-stephan@gerhold.net
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/smsm.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c
index 50214b620865..2b49d2c212da 100644
--- a/drivers/soc/qcom/smsm.c
+++ b/drivers/soc/qcom/smsm.c
@@ -117,7 +117,7 @@ struct smsm_entry {
DECLARE_BITMAP(irq_enabled, 32);
DECLARE_BITMAP(irq_rising, 32);
DECLARE_BITMAP(irq_falling, 32);
- u32 last_value;
+ unsigned long last_value;
u32 *remote_state;
u32 *subscription;
@@ -212,8 +212,7 @@ static irqreturn_t smsm_intr(int irq, void *data)
u32 val;
val = readl(entry->remote_state);
- changed = val ^ entry->last_value;
- entry->last_value = val;
+ changed = val ^ xchg(&entry->last_value, val);
for_each_set_bit(i, entry->irq_enabled, 32) {
if (!(changed & BIT(i)))
@@ -274,6 +273,12 @@ static void smsm_unmask_irq(struct irq_data *irqd)
struct qcom_smsm *smsm = entry->smsm;
u32 val;
+ /* Make sure our last cached state is up-to-date */
+ if (readl(entry->remote_state) & BIT(irq))
+ set_bit(irq, &entry->last_value);
+ else
+ clear_bit(irq, &entry->last_value);
+
set_bit(irq, entry->irq_enabled);
if (entry->subscription) {
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 076/293] Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 075/293] soc: qcom: smsm: Fix missed interrupts if state changes while masked Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 077/293] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs Greg Kroah-Hartman
` (223 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Marcel Holtmann,
Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]
An earlier commit replaced using batostr to using %pMR sprintf for the
construction of session->name. Static analysis detected that this new
method can use a total of 21 characters (including the trailing '\0')
so we need to increase the BTNAMSIZ from 18 to 21 to fix potential
buffer overflows.
Addresses-Coverity: ("Out-of-bounds write")
Fixes: fcb73338ed53 ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/cmtp/cmtp.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
index c32638dddbf9..f6b9dc4e408f 100644
--- a/net/bluetooth/cmtp/cmtp.h
+++ b/net/bluetooth/cmtp/cmtp.h
@@ -26,7 +26,7 @@
#include <linux/types.h>
#include <net/bluetooth/bluetooth.h>
-#define BTNAMSIZ 18
+#define BTNAMSIZ 21
/* CMTP ioctl defines */
#define CMTPCONNADD _IOW('C', 200, int)
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 077/293] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 076/293] Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 078/293] arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 Greg Kroah-Hartman
` (222 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Baryshkov, Rob Clark,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit a41cdb693595ae1904dd793fc15d6954f4295e27 ]
dpu_hw_ctl_clear_all_blendstages() clears settings for the few first LMs
instead of mixers actually used for the CTL. Change it to clear
necessary data, using provided mixer ids.
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210704230519.4081467-1-dmitry.baryshkov@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
index 79bafea66354..a40ea5c68572 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
@@ -296,10 +296,12 @@ static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx)
int i;
for (i = 0; i < ctx->mixer_count; i++) {
- DPU_REG_WRITE(c, CTL_LAYER(LM_0 + i), 0);
- DPU_REG_WRITE(c, CTL_LAYER_EXT(LM_0 + i), 0);
- DPU_REG_WRITE(c, CTL_LAYER_EXT2(LM_0 + i), 0);
- DPU_REG_WRITE(c, CTL_LAYER_EXT3(LM_0 + i), 0);
+ enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id;
+
+ DPU_REG_WRITE(c, CTL_LAYER(mixer_id), 0);
+ DPU_REG_WRITE(c, CTL_LAYER_EXT(mixer_id), 0);
+ DPU_REG_WRITE(c, CTL_LAYER_EXT2(mixer_id), 0);
+ DPU_REG_WRITE(c, CTL_LAYER_EXT3(mixer_id), 0);
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 078/293] arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 077/293] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 079/293] Bluetooth: fix repeated calls to sco_sock_kill Greg Kroah-Hartman
` (221 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sam Protsenko, Marc Zyngier,
Krzysztof Kozlowski, Alim Akhtar, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
[ Upstream commit 01c72cad790cb6cd3ccbe4c1402b6cb6c6bbffd0 ]
The GIC-400 CPU interfaces address range is defined as 0x2000-0x3FFF (by
ARM).
Reported-by: Sam Protsenko <semen.protsenko@linaro.org>
Reported-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Link: https://lore.kernel.org/r/20210805072110.4730-1-krzysztof.kozlowski@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index 5c5e57026c27..c607297922fd 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -91,7 +91,7 @@
#address-cells = <0>;
interrupt-controller;
reg = <0x11001000 0x1000>,
- <0x11002000 0x1000>,
+ <0x11002000 0x2000>,
<0x11004000 0x2000>,
<0x11006000 0x2000>;
};
--
2.30.2
^ permalink raw reply related [flat|nested] 301+ messages in thread* [PATCH 4.19 079/293] Bluetooth: fix repeated calls to sco_sock_kill
2021-09-20 16:39 [PATCH 4.19 000/293] 4.19.207-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2021-09-20 16:40 ` [PATCH 4.19 078/293] arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 Greg Kroah-Hartman
@ 2021-09-20 16:40 ` Greg Kroah-Hartman
2021-09-20 16:40 ` [PATCH 4.19 080/293] drm/msm/dsi: Fix some reference counted resource leaks Greg Kroah-Hartman
` (220 subsequent siblings)
299 siblings, 0 replies; 301+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-20 16:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Desmond Cheong Zhi Xi,
Luiz Augusto von Dentz, Sasha Levin
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
[ Upstream commit e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 ]
In commit 4e1a720d0312 ("Bluetooth: avoid killing an already killed
socket"), a check was added to sco_sock_kill to skip killing a socket
if the SOCK_DEAD flag was set.
This was done after a trace for a use-after-free bug showed that the
same sock pointer was being killed twice.
Unfortunately, this check prevents sco_sock_kill from running on any
socket. sco_sock_kill kills a socket only if it's zapped and orphaned,
however sock_orphan announces that the socket is dead before detaching
it. i.e., orphaned sockets have the SOCK_DEAD flag set.
To fix this, we remove the check for SOCK_DEAD, and avoid repeated
calls to sco_sock_kill by removing incorrect calls in:
1. sco_sock_timeout. The socket should not be killed on timeout as
further processing is expected to be done. For example,
sco_sock_connect sets the timer then waits for the socket to be
connected or for an error to be returned.
2. sco_conn_del. This function should clean up resources