From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 388DDC43219 for ; Mon, 24 Jan 2022 19:21:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349402AbiAXTUl (ORCPT ); Mon, 24 Jan 2022 14:20:41 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42048 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346038AbiAXTMX (ORCPT ); Mon, 24 Jan 2022 14:12:23 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 123996130B; Mon, 24 Jan 2022 19:12:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE045C340E5; Mon, 24 Jan 2022 19:12:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051542; bh=CBPENbkco7iWTiGBptNuAshMijpXyfLZVEct9/ZpMIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xOm6hkhL7r2ErUvPJgpL0u+pIfF6fz2tIR97BhyHR4j6J96RWU8+ntkyPKSkMl/WP pwJb275lbTOs4MSBrpTw4XlhScx76dO0661tPL/4DWIQg8DVBUWvNT5D0pH5x8Mw3F t7PMLU2uY0/YNqUC2rEZoVCHIOo/l8+ok0LkhaXE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Marcel Holtmann Subject: [PATCH 4.19 001/239] Bluetooth: bfusb: fix division by zero in send path Date: Mon, 24 Jan 2022 19:40:39 +0100 Message-Id: <20220124183943.163048809@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit b5e6fa7a12572c82f1e7f2f51fbb02a322291291 upstream. Add the missing bulk-out endpoint sanity check to probe() to avoid division by zero in bfusb_send_frame() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=3D0")). Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/bluetooth/bfusb.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/bluetooth/bfusb.c +++ b/drivers/bluetooth/bfusb.c @@ -644,6 +644,9 @@ static int bfusb_probe(struct usb_interf data->bulk_out_ep =3D bulk_out_ep->desc.bEndpointAddress; data->bulk_pkt_size =3D le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize); =20 + if (!data->bulk_pkt_size) + goto done; + rwlock_init(&data->lock); =20 data->reassembly =3D NULL; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59520C3526D for ; Tue, 25 Jan 2022 01:59:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3413095AbiAYAiY (ORCPT ); Mon, 24 Jan 2022 19:38:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2363974AbiAXXq1 (ORCPT ); Mon, 24 Jan 2022 18:46:27 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DC9E6C061A0F; Mon, 24 Jan 2022 11:12:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7A63E6090A; Mon, 24 Jan 2022 19:12:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 426DAC340E5; Mon, 24 Jan 2022 19:12:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051576; bh=4120A8VZL9g296UsoEXLhv0BwjBUN3MDhIHhMhZ5CP4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RBKeoU8fApu7RDFmHsDH735UfsPLP1g2IsN22yU2DDk3eGcOWblZG2Te1V2kuPniv vuN2pNgrZq3+Cpipxj1gow6ymJGdwHhderOl6QSVsuw2+Qs8AGWTh80dflsVKm41J9 nbIfzikHPSrYH85O4vz6j2K1PTPJavDskMaG1UB4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan McDowell , Alan Stern Subject: [PATCH 4.19 002/239] USB: core: Fix bug in resuming hubs handling of wakeup requests Date: Mon, 24 Jan 2022 19:40:40 +0100 Message-Id: <20220124183943.194108428@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 0f663729bb4afc92a9986b66131ebd5b8a9254d1 upstream. Bugzilla #213839 reports a 7-port hub that doesn't work properly when devices are plugged into some of the ports; the kernel goes into an unending disconnect/reinitialize loop as shown in the bug report. This "7-port hub" comprises two four-port hubs with one plugged into the other; the failures occur when a device is plugged into one of the downstream hub's ports. (These hubs have other problems too. For example, they bill themselves as USB-2.0 compliant but they only run at full speed.) It turns out that the failures are caused by bugs in both the kernel and the hub. The hub's bug is that it reports a different bmAttributes value in its configuration descriptor following a remote wakeup (0xe0 before, 0xc0 after -- the wakeup-support bit has changed). The kernel's bug is inside the hub driver's resume handler. When hub_activate() sees that one of the hub's downstream ports got a wakeup request from a child device, it notes this fact by setting the corresponding bit in the hub->change_bits variable. But this variable is meant for connection changes, not wakeup events; setting it causes the driver to believe the downstream port has been disconnected and then connected again (in addition to having received a wakeup request). Because of this, the hub driver then tries to check whether the device currently plugged into the downstream port is the same as the device that had been attached there before. Normally this check succeeds and wakeup handling continues with no harm done (which is why the bug remained undetected until now). But with these dodgy hubs, the check fails because the config descriptor has changed. This causes the hub driver to reinitialize the child device, leading to the disconnect/reinitialize loop described in the bug report. The proper way to note reception of a downstream wakeup request is to set a bit in the hub->event_bits variable instead of hub->change_bits. That way the hub driver will realize that something has happened to the port but will not think the port and child device have been disconnected. This patch makes that change. Cc: Tested-by: Jonathan McDowell Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YdCw7nSfWYPKWQoD@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/core/hub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1197,7 +1197,7 @@ static void hub_activate(struct usb_hub */ if (portchange || (hub_is_superspeed(hub->hdev) && port_resumed)) - set_bit(port1, hub->change_bits); + set_bit(port1, hub->event_bits); =20 } else if (udev->persist_enabled) { #ifdef CONFIG_PM From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 250D4C433EF for ; Mon, 24 Jan 2022 19:57:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356362AbiAXT5u (ORCPT ); Mon, 24 Jan 2022 14:57:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51830 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345107AbiAXT3L (ORCPT ); Mon, 24 Jan 2022 14:29:11 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AAFD3C061370; Mon, 24 Jan 2022 11:13:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5C617B811FC; Mon, 24 Jan 2022 19:13:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80F64C340E5; Mon, 24 Jan 2022 19:13:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051611; bh=ZfBUl0u5AfHOOTBI41FpO7qivmtViI+G6jcWj/wLIu4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zIeUZW2P4QKJrSLb1ELMJlUu9iwJ5jOsjBWo8Yr0q2mZPU/mvoj3kUr6F2HZszfi1 7fbCwnXvFsM+zepybK9Qc4M40tUJRKL7j0zKsytwC01H9cHayjZpwRb3uzE33v2F1k Dav47Ajew46a/tyTJi5Mu60MxAM+ZWYlSApUGeZs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , syzbot+3ae6a2b06f131ab9849f@syzkaller.appspotmail.com Subject: [PATCH 4.19 003/239] USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status Date: Mon, 24 Jan 2022 19:40:41 +0100 Message-Id: <20220124183943.223398994@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 1d7d4c07932e04355d6e6528d44a2f2c9e354346 upstream. When the USB core code for getting root-hub status reports was originally written, it was assumed that the hub driver would be its only caller. But this isn't true now; user programs can use usbfs to communicate with root hubs and get status reports. When they do this, they may use a transfer_buffer that is smaller than the data returned by the HCD, which will lead to a buffer overflow error when usb_hcd_poll_rh_status() tries to store the status data. This was discovered by syzbot: BUG: KASAN: slab-out-of-bounds in memcpy include/linux/fortify-string.h:225= [inline] BUG: KASAN: slab-out-of-bounds in usb_hcd_poll_rh_status+0x5f4/0x780 driver= s/usb/core/hcd.c:776 Write of size 2 at addr ffff88801da403c0 by task syz-executor133/4062 This patch fixes the bug by reducing the amount of status data if it won't fit in the transfer_buffer. If some data gets discarded then the URB's completion status is set to -EOVERFLOW rather than 0, to let the user know what happened. Reported-and-tested-by: syzbot+3ae6a2b06f131ab9849f@syzkaller.appspotmail.c= om Signed-off-by: Alan Stern Cc: Link: https://lore.kernel.org/r/Yc+3UIQJ2STbxNua@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/core/hcd.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -750,6 +750,7 @@ void usb_hcd_poll_rh_status(struct usb_h { struct urb *urb; int length; + int status; unsigned long flags; char buffer[6]; /* Any root hubs with > 31 ports? */ =20 @@ -767,11 +768,17 @@ void usb_hcd_poll_rh_status(struct usb_h if (urb) { clear_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); hcd->status_urb =3D NULL; + if (urb->transfer_buffer_length >=3D length) { + status =3D 0; + } else { + status =3D -EOVERFLOW; + length =3D urb->transfer_buffer_length; + } urb->actual_length =3D length; memcpy(urb->transfer_buffer, buffer, length); =20 usb_hcd_unlink_urb_from_ep(hcd, urb); - usb_hcd_giveback_urb(hcd, urb, 0); + usb_hcd_giveback_urb(hcd, urb, status); } else { length =3D 0; set_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10FE1C433FE for ; Mon, 24 Jan 2022 19:37:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354248AbiAXTgS (ORCPT ); Mon, 24 Jan 2022 14:36:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51654 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352436AbiAXTa1 (ORCPT ); Mon, 24 Jan 2022 14:30:27 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 08E77C02982E; Mon, 24 Jan 2022 11:13:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4F52FB81223; Mon, 24 Jan 2022 19:13:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 590DFC340E5; Mon, 24 Jan 2022 19:13:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051630; bh=MOM5gMZz79kna8oNQJ7UrBfangfUqQQv7yzRdLAipa0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OFDqsX10xXkD8/5yTkjQXSyX4XTi//8APmcAVnIQVrwm1+3kGQ9736iWMiyJt4o4y tMk2Uz+UebLuseEck9aUiH89ebOK/I3TA2mPLPnBqxWJwHnKm7xFsEEgD7HuSJYx8Z 33BI+aeMDAEs2Wq/vERWmqAztaOwpOWfiSU9TKr8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Gleixner , Anna-Maria Gleixner , Oliver Hartkopp , Marc Kleine-Budde , Ziyang Xuan Subject: [PATCH 4.19 004/239] can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet Date: Mon, 24 Jan 2022 19:40:42 +0100 Message-Id: <20220124183943.254127396@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thomas Gleixner commit bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68 upstream. This patch switches the timer to HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the hrtimer_tasklet. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Gleixner Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde Signed-off-by: Ziyang Xuan Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/can/bcm.c | 156 +++++++++++++++++++----------------------------------= ----- 1 file changed, 52 insertions(+), 104 deletions(-) --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -105,7 +105,6 @@ struct bcm_op { unsigned long frames_abs, frames_filtered; struct bcm_timeval ival1, ival2; struct hrtimer timer, thrtimer; - struct tasklet_struct tsklet, thrtsklet; ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg; int rx_ifindex; int cfsiz; @@ -374,25 +373,34 @@ static void bcm_send_to_user(struct bcm_ } } =20 -static void bcm_tx_start_timer(struct bcm_op *op) +static bool bcm_tx_set_expiry(struct bcm_op *op, struct hrtimer *hrt) { + ktime_t ival; + if (op->kt_ival1 && op->count) - hrtimer_start(&op->timer, - ktime_add(ktime_get(), op->kt_ival1), - HRTIMER_MODE_ABS); + ival =3D op->kt_ival1; else if (op->kt_ival2) - hrtimer_start(&op->timer, - ktime_add(ktime_get(), op->kt_ival2), - HRTIMER_MODE_ABS); + ival =3D op->kt_ival2; + else + return false; + + hrtimer_set_expires(hrt, ktime_add(ktime_get(), ival)); + return true; } =20 -static void bcm_tx_timeout_tsklet(unsigned long data) +static void bcm_tx_start_timer(struct bcm_op *op) { - struct bcm_op *op =3D (struct bcm_op *)data; + if (bcm_tx_set_expiry(op, &op->timer)) + hrtimer_start_expires(&op->timer, HRTIMER_MODE_ABS_SOFT); +} + +/* bcm_tx_timeout_handler - performs cyclic CAN frame transmissions */ +static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer) +{ + struct bcm_op *op =3D container_of(hrtimer, struct bcm_op, timer); struct bcm_msg_head msg_head; =20 if (op->kt_ival1 && (op->count > 0)) { - op->count--; if (!op->count && (op->flags & TX_COUNTEVT)) { =20 @@ -410,22 +418,12 @@ static void bcm_tx_timeout_tsklet(unsign } bcm_can_tx(op); =20 - } else if (op->kt_ival2) + } else if (op->kt_ival2) { bcm_can_tx(op); + } =20 - bcm_tx_start_timer(op); -} - -/* - * bcm_tx_timeout_handler - performs cyclic CAN frame transmissions - */ -static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer) -{ - struct bcm_op *op =3D container_of(hrtimer, struct bcm_op, timer); - - tasklet_schedule(&op->tsklet); - - return HRTIMER_NORESTART; + return bcm_tx_set_expiry(op, &op->timer) ? + HRTIMER_RESTART : HRTIMER_NORESTART; } =20 /* @@ -492,7 +490,7 @@ static void bcm_rx_update_and_send(struc /* do not send the saved data - only start throttle timer */ hrtimer_start(&op->thrtimer, ktime_add(op->kt_lastmsg, op->kt_ival2), - HRTIMER_MODE_ABS); + HRTIMER_MODE_ABS_SOFT); return; } =20 @@ -551,14 +549,21 @@ static void bcm_rx_starttimer(struct bcm return; =20 if (op->kt_ival1) - hrtimer_start(&op->timer, op->kt_ival1, HRTIMER_MODE_REL); + hrtimer_start(&op->timer, op->kt_ival1, HRTIMER_MODE_REL_SOFT); } =20 -static void bcm_rx_timeout_tsklet(unsigned long data) +/* bcm_rx_timeout_handler - when the (cyclic) CAN frame reception timed ou= t */ +static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer) { - struct bcm_op *op =3D (struct bcm_op *)data; + struct bcm_op *op =3D container_of(hrtimer, struct bcm_op, timer); struct bcm_msg_head msg_head; =20 + /* if user wants to be informed, when cyclic CAN-Messages come back */ + if ((op->flags & RX_ANNOUNCE_RESUME) && op->last_frames) { + /* clear received CAN frames to indicate 'nothing received' */ + memset(op->last_frames, 0, op->nframes * op->cfsiz); + } + /* create notification to user */ memset(&msg_head, 0, sizeof(msg_head)); msg_head.opcode =3D RX_TIMEOUT; @@ -570,25 +575,6 @@ static void bcm_rx_timeout_tsklet(unsign msg_head.nframes =3D 0; =20 bcm_send_to_user(op, &msg_head, NULL, 0); -} - -/* - * bcm_rx_timeout_handler - when the (cyclic) CAN frame reception timed out - */ -static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer) -{ - struct bcm_op *op =3D container_of(hrtimer, struct bcm_op, timer); - - /* schedule before NET_RX_SOFTIRQ */ - tasklet_hi_schedule(&op->tsklet); - - /* no restart of the timer is done here! */ - - /* if user wants to be informed, when cyclic CAN-Messages come back */ - if ((op->flags & RX_ANNOUNCE_RESUME) && op->last_frames) { - /* clear received CAN frames to indicate 'nothing received' */ - memset(op->last_frames, 0, op->nframes * op->cfsiz); - } =20 return HRTIMER_NORESTART; } @@ -596,14 +582,12 @@ static enum hrtimer_restart bcm_rx_timeo /* * bcm_rx_do_flush - helper for bcm_rx_thr_flush */ -static inline int bcm_rx_do_flush(struct bcm_op *op, int update, - unsigned int index) +static inline int bcm_rx_do_flush(struct bcm_op *op, unsigned int index) { struct canfd_frame *lcf =3D op->last_frames + op->cfsiz * index; =20 if ((op->last_frames) && (lcf->flags & RX_THR)) { - if (update) - bcm_rx_changed(op, lcf); + bcm_rx_changed(op, lcf); return 1; } return 0; @@ -611,11 +595,8 @@ static inline int bcm_rx_do_flush(struct =20 /* * bcm_rx_thr_flush - Check for throttled data and send it to the userspace - * - * update =3D=3D 0 : just check if throttled data is available (any irq c= ontext) - * update =3D=3D 1 : check and send throttled data to userspace (soft_irq = context) */ -static int bcm_rx_thr_flush(struct bcm_op *op, int update) +static int bcm_rx_thr_flush(struct bcm_op *op) { int updated =3D 0; =20 @@ -624,24 +605,16 @@ static int bcm_rx_thr_flush(struct bcm_o =20 /* for MUX filter we start at index 1 */ for (i =3D 1; i < op->nframes; i++) - updated +=3D bcm_rx_do_flush(op, update, i); + updated +=3D bcm_rx_do_flush(op, i); =20 } else { /* for RX_FILTER_ID and simple filter */ - updated +=3D bcm_rx_do_flush(op, update, 0); + updated +=3D bcm_rx_do_flush(op, 0); } =20 return updated; } =20 -static void bcm_rx_thr_tsklet(unsigned long data) -{ - struct bcm_op *op =3D (struct bcm_op *)data; - - /* push the changed data to the userspace */ - bcm_rx_thr_flush(op, 1); -} - /* * bcm_rx_thr_handler - the time for blocked content updates is over now: * Check for throttled data and send it to the usersp= ace @@ -650,9 +623,7 @@ static enum hrtimer_restart bcm_rx_thr_h { struct bcm_op *op =3D container_of(hrtimer, struct bcm_op, thrtimer); =20 - tasklet_schedule(&op->thrtsklet); - - if (bcm_rx_thr_flush(op, 0)) { + if (bcm_rx_thr_flush(op)) { hrtimer_forward(hrtimer, ktime_get(), op->kt_ival2); return HRTIMER_RESTART; } else { @@ -748,23 +719,8 @@ static struct bcm_op *bcm_find_op(struct =20 static void bcm_remove_op(struct bcm_op *op) { - if (op->tsklet.func) { - while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) || - test_bit(TASKLET_STATE_RUN, &op->tsklet.state) || - hrtimer_active(&op->timer)) { - hrtimer_cancel(&op->timer); - tasklet_kill(&op->tsklet); - } - } - - if (op->thrtsklet.func) { - while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) || - test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) || - hrtimer_active(&op->thrtimer)) { - hrtimer_cancel(&op->thrtimer); - tasklet_kill(&op->thrtsklet); - } - } + hrtimer_cancel(&op->timer); + hrtimer_cancel(&op->thrtimer); =20 if ((op->frames) && (op->frames !=3D &op->sframe)) kfree(op->frames); @@ -998,15 +954,13 @@ static int bcm_tx_setup(struct bcm_msg_h op->ifindex =3D ifindex; =20 /* initialize uninitialized (kzalloc) structure */ - hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&op->timer, CLOCK_MONOTONIC, + HRTIMER_MODE_REL_SOFT); op->timer.function =3D bcm_tx_timeout_handler; =20 - /* initialize tasklet for tx countevent notification */ - tasklet_init(&op->tsklet, bcm_tx_timeout_tsklet, - (unsigned long) op); - /* currently unused in tx_ops */ - hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, + HRTIMER_MODE_REL_SOFT); =20 /* add this bcm_op to the list of the tx_ops */ list_add(&op->list, &bo->tx_ops); @@ -1175,20 +1129,14 @@ static int bcm_rx_setup(struct bcm_msg_h op->rx_ifindex =3D ifindex; =20 /* initialize uninitialized (kzalloc) structure */ - hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&op->timer, CLOCK_MONOTONIC, + HRTIMER_MODE_REL_SOFT); op->timer.function =3D bcm_rx_timeout_handler; =20 - /* initialize tasklet for rx timeout notification */ - tasklet_init(&op->tsklet, bcm_rx_timeout_tsklet, - (unsigned long) op); - - hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, + HRTIMER_MODE_REL_SOFT); op->thrtimer.function =3D bcm_rx_thr_handler; =20 - /* initialize tasklet for rx throttle handling */ - tasklet_init(&op->thrtsklet, bcm_rx_thr_tsklet, - (unsigned long) op); - /* add this bcm_op to the list of the rx_ops */ list_add(&op->list, &bo->rx_ops); =20 @@ -1234,12 +1182,12 @@ static int bcm_rx_setup(struct bcm_msg_h */ op->kt_lastmsg =3D 0; hrtimer_cancel(&op->thrtimer); - bcm_rx_thr_flush(op, 1); + bcm_rx_thr_flush(op); } =20 if ((op->flags & STARTTIMER) && op->kt_ival1) hrtimer_start(&op->timer, op->kt_ival1, - HRTIMER_MODE_REL); + HRTIMER_MODE_REL_SOFT); } =20 /* now we can register for can_ids, if we added a new bcm_op */ From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A78A8C433EF for ; Mon, 24 Jan 2022 19:44:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236375AbiAXToL (ORCPT ); Mon, 24 Jan 2022 14:44:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352462AbiAXTab (ORCPT ); Mon, 24 Jan 2022 14:30:31 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EEB81C029830; Mon, 24 Jan 2022 11:13:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 77FA46090A; Mon, 24 Jan 2022 19:13:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F8F3C340E5; Mon, 24 Jan 2022 19:13:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051632; bh=zjFhddV6fMo/XM9nnuuK90VsKmvyM28pHTpGTioDg3o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NREVZplD9evTi1zOzP/QsNuiMZzQOeP/5wf6H27lkPjPuHq3d53r1pl+/R90crVhp +heKURdbIT9HjY7ovZYqZvdO1weH0sWloAdVztmKaJsJC1A0pj00F5gLBCQGztWPA0 vYH5qKmyjoy+JTXEPz6PjTrrn8oPG4kmZjlg1Zko= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Laurent Bernaille , Daniel Borkmann , Maciej Fijalkowski , Toshiaki Makita , Eric Dumazet , Paolo Abeni , John Fastabend , Willem de Bruijn , Eric Dumazet , "David S. Miller" Subject: [PATCH 4.19 005/239] veth: Do not record rx queue hint in veth_xmit Date: Mon, 24 Jan 2022 19:40:43 +0100 Message-Id: <20220124183943.285108675@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Borkmann commit 710ad98c363a66a0cd8526465426c5c5f8377ee0 upstream. Laurent reported that they have seen a significant amount of TCP retransmis= sions at high throughput from applications residing in network namespaces talking= to the outside world via veths. The drops were seen on the qdisc layer (fq_cod= el, as per systemd default) of the phys device such as ena or virtio_net due to= all traffic hitting a _single_ TX queue _despite_ multi-queue device. (Note tha= t the setup was _not_ using XDP on veths as the issue is generic.) More specifically, after edbea9220251 ("veth: Store queue_mapping independe= ntly of XDP prog presence") which made it all the way back to v4.19.184+, skb_record_rx_queue() would set skb->queue_mapping to 1 (given 1 RX and 1 TX queue by default for veths) instead of leaving at 0. This is eventually retained and callbacks like ena_select_queue() will also= pick single queue via netdev_core_pick_tx()'s ndo_select_queue() once all the tr= affic is forwarded to that device via upper stack or other means. Similarly, for = others not implementing ndo_select_queue() if XPS is disabled, netdev_pick_tx() mi= ght call into the skb_tx_hash() and check for prior skb_rx_queue_recorded() as = well. In general, it is a _bad_ idea for virtual devices like veth to mess around= with queue selection [by default]. Given dev->real_num_tx_queues is by default 1, the skb->queue_mapping was left untouched, and so prior to edbea9220251 the netdev_core_pick_tx() could do its job upon __dev_queue_xmit() on the phys = device. Unbreak this and restore prior behavior by removing the skb_record_rx_queue= () from veth_xmit() altogether. If the veth peer has an XDP program attached, then it would return the firs= t RX queue index in xdp_md->rx_queue_index (unless configured in non-default man= ner). However, this is still better than breaking the generic case. Fixes: edbea9220251 ("veth: Store queue_mapping independently of XDP prog p= resence") Fixes: 638264dc9022 ("veth: Support per queue XDP ring") Reported-by: Laurent Bernaille Signed-off-by: Daniel Borkmann Cc: Maciej Fijalkowski Cc: Toshiaki Makita Cc: Eric Dumazet Cc: Paolo Abeni Cc: John Fastabend Cc: Willem de Bruijn Acked-by: John Fastabend Reviewed-by: Eric Dumazet Acked-by: Toshiaki Makita Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/veth.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -197,7 +197,6 @@ static netdev_tx_t veth_xmit(struct sk_b if (rxq < rcv->real_num_rx_queues) { rq =3D &rcv_priv->rq[rxq]; rcv_xdp =3D rcu_access_pointer(rq->xdp_prog); - skb_record_rx_queue(skb, rxq); } =20 if (likely(veth_forward_skb(rcv, skb, rq, rcv_xdp) =3D=3D NET_RX_SUCCESS)= ) { From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53677C4332F for ; Mon, 24 Jan 2022 19:22:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234974AbiAXTV5 (ORCPT ); Mon, 24 Jan 2022 14:21:57 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41504 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345281AbiAXTN4 (ORCPT ); Mon, 24 Jan 2022 14:13:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8C54461320; Mon, 24 Jan 2022 19:13:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6954CC340E5; Mon, 24 Jan 2022 19:13:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051636; bh=u7PT4VEBoCpl1z4UKdzURqBUvQQ7yDGByyBCzgv/Jh8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=py9OTItyD5c5AJsP+bJuSLZ/i75F+VcKxcBuOJg+ULZy6c1J2/nifW+arH1+emBoL 7fA9J3Cmw4WiztNlTlpaOZUeKcT3NN3+T7bm6dtYYFjky6UUC123K6zaSc90PRFT3R 6T+KiVU4132tx1wwMhPbmm6DoX8twEzo6lMl0Q5I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Orlando Chamberlain , Aditya Garg , Andy Shevchenko , Lee Jones Subject: [PATCH 4.19 006/239] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() Date: Mon, 24 Jan 2022 19:40:44 +0100 Message-Id: <20220124183943.317102196@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Shevchenko commit c9e143084d1a602f829115612e1ec79df3727c8b upstream. The runtime PM callback may be called as soon as the runtime PM facility is enabled and activated. It means that ->suspend() may be called before we finish probing the device in the ACPI case. Hence, NULL pointer dereference: intel-lpss INT34BA:00: IRQ index 0 not found BUG: kernel NULL pointer dereference, address: 0000000000000030 ... Workqueue: pm pm_runtime_work RIP: 0010:intel_lpss_suspend+0xb/0x40 [intel_lpss] To fix this, first try to register the device and only after that enable runtime PM facility. Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices") Reported-by: Orlando Chamberlain Reported-by: Aditya Garg Signed-off-by: Andy Shevchenko Tested-by: Aditya Garg Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20211101190008.86473-1-andriy.shevchenko@li= nux.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/mfd/intel-lpss-acpi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/mfd/intel-lpss-acpi.c +++ b/drivers/mfd/intel-lpss-acpi.c @@ -80,6 +80,7 @@ static int intel_lpss_acpi_probe(struct { struct intel_lpss_platform_info *info; const struct acpi_device_id *id; + int ret; =20 id =3D acpi_match_device(intel_lpss_acpi_ids, &pdev->dev); if (!id) @@ -93,10 +94,14 @@ static int intel_lpss_acpi_probe(struct info->mem =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); info->irq =3D platform_get_irq(pdev, 0); =20 + ret =3D intel_lpss_probe(&pdev->dev, info); + if (ret) + return ret; + pm_runtime_set_active(&pdev->dev); pm_runtime_enable(&pdev->dev); =20 - return intel_lpss_probe(&pdev->dev, info); + return 0; } =20 static int intel_lpss_acpi_remove(struct platform_device *pdev) From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9E72C43217 for ; Mon, 24 Jan 2022 19:37:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354320AbiAXTg3 (ORCPT ); Mon, 24 Jan 2022 14:36:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52784 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352698AbiAXTa5 (ORCPT ); Mon, 24 Jan 2022 14:30:57 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 20EE6C028C15; Mon, 24 Jan 2022 11:14:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B2CB36124E; Mon, 24 Jan 2022 19:13:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E809C340E5; Mon, 24 Jan 2022 19:13:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051639; bh=6tmTeqTNP3KBX1hcRrZiqO7BaY+kpbpNKJCvnuGuh6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GrNhsCSFPrj8msPQ3tFhOQs89F3Es9XQu4kPkU9Dz+SnyZpLOxvDynXDOQ4Adq3ng klH0QriPDdY9Qz8vKbbgYCCURKN3a3QB8bI3a3sm5EPq62zbcCAHVXS22PfuUc3DwP GrIRB+q52kyfS2wktdJUq71RCUIgwZ5AeqCQLzww= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Kleine-Budde Subject: [PATCH 4.19 007/239] can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data Date: Mon, 24 Jan 2022 19:40:45 +0100 Message-Id: <20220124183943.347749020@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marc Kleine-Budde commit 4a8737ff068724f509d583fef404d349adba80d6 upstream. The received data contains the channel the received data is associated with. If the channel number is bigger than the actual number of channels assume broken or malicious USB device and shut it down. This fixes the error found by clang: | drivers/net/can/usb/gs_usb.c:386:6: error: variable 'dev' is used | uninitialized whenever 'if' condition= is true | if (hf->channel >=3D GS_MAX_INTF) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ | drivers/net/can/usb/gs_usb.c:474:10: note: uninitialized use occurs here | hf, dev->gs_hf_size, gs_usb_receive_bulk_callba= ck, | ^~~ Link: https://lore.kernel.org/all/20211210091158.408326-1-mkl@pengutronix.de Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices= ") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/can/usb/gs_usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -328,7 +328,7 @@ static void gs_usb_receive_bulk_callback =20 /* device reports out of range channel id */ if (hf->channel >=3D GS_MAX_INTF) - goto resubmit_urb; + goto device_detach; =20 dev =3D usbcan->canch[hf->channel]; =20 @@ -413,6 +413,7 @@ static void gs_usb_receive_bulk_callback =20 /* USB failure take down all interfaces */ if (rc =3D=3D -ENODEV) { + device_detach: for (rc =3D 0; rc < GS_MAX_INTF; rc++) { if (usbcan->canch[rc]) netif_device_detach(usbcan->canch[rc]->netdev); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82812C2BA4C for ; Mon, 24 Jan 2022 19:22:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344470AbiAXTWB (ORCPT ); Mon, 24 Jan 2022 14:22:01 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43500 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344337AbiAXTOD (ORCPT ); Mon, 24 Jan 2022 14:14:03 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F147960BB9; Mon, 24 Jan 2022 19:14:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E208C36AE3; Mon, 24 Jan 2022 19:14:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051642; bh=28t1sweoB4qHEe4T76xab8j4fhECdC4c7ySIQE2cgDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e+Qtbu8CBTTVxA0q10fGAzfb0SBEGFvIeukKCD1wdr+1rf4KFD6N3RX/xzcvCG7Ed lZ28s0mwFnEoZbBc4aXuhWlLW48urr2GGiV7sSeiwDzLR7bc0VQ8sq2pA0Y512BEhL mnvkiVbHPHvn0Z4IUvnYrf/cs4KrX//okKdw/Tt8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brian Silverman , Marc Kleine-Budde Subject: [PATCH 4.19 008/239] can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} Date: Mon, 24 Jan 2022 19:40:46 +0100 Message-Id: <20220124183943.377652679@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Brian Silverman commit 89d58aebe14a365c25ba6645414afdbf4e41cea4 upstream. No information is deliberately sent in hf->flags in host -> device communications, but the open-source candleLight firmware echoes it back, which can result in the GS_CAN_FLAG_OVERFLOW flag being set and generating spurious ERRORFRAMEs. While there also initialize the reserved member with 0. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices= ") Link: https://lore.kernel.org/all/20220106002952.25883-1-brian.silverman@bl= uerivertech.com Link: https://github.com/candle-usb/candleLight_fw/issues/87 Cc: stable@vger.kernel.org Signed-off-by: Brian Silverman [mkl: initialize the reserved member, too] Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/can/usb/gs_usb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -515,6 +515,8 @@ static netdev_tx_t gs_can_start_xmit(str =20 hf->echo_id =3D idx; hf->channel =3D dev->channel; + hf->flags =3D 0; + hf->reserved =3D 0; =20 cf =3D (struct can_frame *)skb->data; =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19DEBC43219 for ; Mon, 24 Jan 2022 19:37:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354392AbiAXTge (ORCPT ); Mon, 24 Jan 2022 14:36:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51812 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352844AbiAXTbL (ORCPT ); Mon, 24 Jan 2022 14:31:11 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF152C028C22; Mon, 24 Jan 2022 11:14:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9B55BB81232; Mon, 24 Jan 2022 19:14:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBD51C340E5; Mon, 24 Jan 2022 19:14:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051645; bh=h9OWux2i1YLh5BjrO9KQYEBGMBejsiK7N9nwnwNhnxc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pHP01jKj4ZrTM4WPBsVVOhcm6YLwfOIme96qWTmQ6z61ovZe4mhxCyaGpkEHTIdOh fOPsr9RwChad5OP5SfOej/ZkqzWUEunS/yYe2WIRtNolpUJk25tdgyYqaynv/q8UV4 fLh10O7eIMH0Ks2yOOmxeOqVWgv7s8kfoZuxI9pA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers , "Paul E. McKenney" , "Jason A. Donenfeld" Subject: [PATCH 4.19 009/239] random: fix data race on crng_node_pool Date: Mon, 24 Jan 2022 19:40:47 +0100 Message-Id: <20220124183943.409514111@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit 5d73d1e320c3fd94ea15ba5f79301da9a8bcc7de upstream. extract_crng() and crng_backtrack_protect() load crng_node_pool with a plain load, which causes undefined behavior if do_numa_crng_init() modifies it concurrently. Fix this by using READ_ONCE(). Note: as per the previous discussion https://lore.kernel.org/lkml/20211219025139.31085-1-ebiggers@kernel.org/T/#= u, READ_ONCE() is believed to be sufficient here, and it was requested that it be used here instead of smp_load_acquire(). Also change do_numa_crng_init() to set crng_node_pool using cmpxchg_release() instead of mb() + cmpxchg(), as the former is sufficient here but is more lightweight. Fixes: 1e7f583af67b ("random: make /dev/urandom scalable for silly userspac= e programs") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Acked-by: Paul E. McKenney Signed-off-by: Jason A. Donenfeld Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/char/random.c | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-) --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -831,8 +831,8 @@ static void do_numa_crng_init(struct wor crng_initialize(crng); pool[i] =3D crng; } - mb(); - if (cmpxchg(&crng_node_pool, NULL, pool)) { + /* pairs with READ_ONCE() in select_crng() */ + if (cmpxchg_release(&crng_node_pool, NULL, pool) !=3D NULL) { for_each_node(i) kfree(pool[i]); kfree(pool); @@ -845,8 +845,26 @@ static void numa_crng_init(void) { schedule_work(&numa_crng_init_work); } + +static struct crng_state *select_crng(void) +{ + struct crng_state **pool; + int nid =3D numa_node_id(); + + /* pairs with cmpxchg_release() in do_numa_crng_init() */ + pool =3D READ_ONCE(crng_node_pool); + if (pool && pool[nid]) + return pool[nid]; + + return &primary_crng; +} #else static void numa_crng_init(void) {} + +static struct crng_state *select_crng(void) +{ + return &primary_crng; +} #endif =20 /* @@ -995,15 +1013,7 @@ static void _extract_crng(struct crng_st =20 static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE]) { - struct crng_state *crng =3D NULL; - -#ifdef CONFIG_NUMA - if (crng_node_pool) - crng =3D crng_node_pool[numa_node_id()]; - if (crng =3D=3D NULL) -#endif - crng =3D &primary_crng; - _extract_crng(crng, out); + _extract_crng(select_crng(), out); } =20 /* @@ -1032,15 +1042,7 @@ static void _crng_backtrack_protect(stru =20 static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used) { - struct crng_state *crng =3D NULL; - -#ifdef CONFIG_NUMA - if (crng_node_pool) - crng =3D crng_node_pool[numa_node_id()]; - if (crng =3D=3D NULL) -#endif - crng =3D &primary_crng; - _crng_backtrack_protect(crng, tmp, used); + _crng_backtrack_protect(select_crng(), tmp, used); } =20 static ssize_t extract_crng_user(void __user *buf, size_t nbytes) From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB3C1C4332F for ; Tue, 25 Jan 2022 02:34:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420598AbiAYCYw (ORCPT ); Mon, 24 Jan 2022 21:24:52 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:38196 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346079AbiAXTM3 (ORCPT ); Mon, 24 Jan 2022 14:12:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 28D1DB8123D; Mon, 24 Jan 2022 19:12:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 259BBC340E5; Mon, 24 Jan 2022 19:12:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051545; bh=Vo4fc08dYU7Q2vdyaqh6jXfagzpgeNQG+pLuG1tBzYU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vfpfjgUkKnZPe4a5s4Pgfj64YPwMBfrHw1/ZCCJ2GD2lq4Q5+BEzRbFXrD9Tij+nL tEUs1XKAky8kELDicjfM7vegjBqLaZEMhO8jVBelg80lLvbSDHTSb481rxtEp9nHBr m9Esrd/QJP0JmdYdTv50XJLpMciHVpD1Y+9NcZgE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers , "Paul E. McKenney" , "Jason A. Donenfeld" Subject: [PATCH 4.19 010/239] random: fix data race on crng init time Date: Mon, 24 Jan 2022 19:40:48 +0100 Message-Id: <20220124183943.439160423@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit 009ba8568be497c640cab7571f7bfd18345d7b24 upstream. _extract_crng() does plain loads of crng->init_time and crng_global_init_time, which causes undefined behavior if crng_reseed() and RNDRESEEDCRNG modify these corrently. Use READ_ONCE() and WRITE_ONCE() to make the behavior defined. Don't fix the race on crng->init_time by protecting it with crng->lock, since it's not a problem for duplicate reseedings to occur. I.e., the lockless access with READ_ONCE() is fine. Fixes: d848e5f8e1eb ("random: add new ioctl RNDRESEEDCRNG") Fixes: e192be9d9a30 ("random: replace non-blocking pool with a Chacha20-bas= ed CRNG") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Acked-by: Paul E. McKenney Signed-off-by: Jason A. Donenfeld Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/char/random.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -969,7 +969,7 @@ static void crng_reseed(struct crng_stat crng->state[i+4] ^=3D buf.key[i] ^ rv; } memzero_explicit(&buf, sizeof(buf)); - crng->init_time =3D jiffies; + WRITE_ONCE(crng->init_time, jiffies); spin_unlock_irqrestore(&crng->lock, flags); if (crng =3D=3D &primary_crng && crng_init < 2) { invalidate_batched_entropy(); @@ -996,12 +996,15 @@ static void crng_reseed(struct crng_stat static void _extract_crng(struct crng_state *crng, __u8 out[CHACHA20_BLOCK_SIZE]) { - unsigned long v, flags; + unsigned long v, flags, init_time; =20 - if (crng_ready() && - (time_after(crng_global_init_time, crng->init_time) || - time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL))) - crng_reseed(crng, crng =3D=3D &primary_crng ? &input_pool : NULL); + if (crng_ready()) { + init_time =3D READ_ONCE(crng->init_time); + if (time_after(READ_ONCE(crng_global_init_time), init_time) || + time_after(jiffies, init_time + CRNG_RESEED_INTERVAL)) + crng_reseed(crng, crng =3D=3D &primary_crng ? + &input_pool : NULL); + } spin_lock_irqsave(&crng->lock, flags); if (arch_get_random_long(&v)) crng->state[14] ^=3D v; @@ -2074,7 +2077,7 @@ static long random_ioctl(struct file *f, if (crng_init < 2) return -ENODATA; crng_reseed(&primary_crng, &input_pool); - crng_global_init_time =3D jiffies - 1; + WRITE_ONCE(crng_global_init_time, jiffies - 1); return 0; default: return -EINVAL; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C287C433EF for ; Mon, 24 Jan 2022 19:58:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359259AbiAXT6H (ORCPT ); Mon, 24 Jan 2022 14:58:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51786 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351391AbiAXT06 (ORCPT ); Mon, 24 Jan 2022 14:26:58 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F3B7CC02B74F; Mon, 24 Jan 2022 11:12:29 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 927F460909; Mon, 24 Jan 2022 19:12:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 610A7C340E8; Mon, 24 Jan 2022 19:12:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051549; bh=T+56S/9BkRyTdv/V9EVsXJQEBPQFzty4gfufVZgmqdk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zVAZXlngkqXiLysRAzNg+ap67H+Na0vn6sPKEquyRIJEKbOqEwhfVB9NRxqX80ue7 2jXfl9Qn9f3SxRAb4XKku49Om2L8JlnbgnyySxVOW0Bq+V2227q6KDmi0fECndoGN9 A3DBORZsur5t4Qjj9Hp34vSvlJftIu73hgJMVifk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor Subject: [PATCH 4.19 011/239] staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() Date: Mon, 24 Jan 2022 19:40:49 +0100 Message-Id: <20220124183943.475656085@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit 502408a61f4b7eb4713f44bd77f4a48e6cb1b59a upstream. A new warning in clang points out a place in this file where a bitwise OR is being used with boolean expressions: In file included from drivers/staging/wlan-ng/prism2usb.c:2: drivers/staging/wlan-ng/hfa384x_usb.c:3787:7: warning: use of bitwise '|' w= ith boolean operands [-Wbitwise-instead-of-logical] ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) && ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/staging/wlan-ng/hfa384x_usb.c:3787:7: note: cast one or both operan= ds to int to silence this warning 1 warning generated. The comment explains that short circuiting here is undesirable, as the calls to test_and_{clear,set}_bit() need to happen for both sides of the expression. Clang's suggestion would work to silence the warning but the readability of the expression would suffer even more. To clean up the warning and make the block more readable, use a variable for each side of the bitwise expression. Link: https://github.com/ClangBuiltLinux/linux/issues/1478 Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20211014215703.3705371-1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/staging/wlan-ng/hfa384x_usb.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) --- a/drivers/staging/wlan-ng/hfa384x_usb.c +++ b/drivers/staging/wlan-ng/hfa384x_usb.c @@ -3903,18 +3903,18 @@ static void hfa384x_usb_throttlefn(struc =20 spin_lock_irqsave(&hw->ctlxq.lock, flags); =20 - /* - * We need to check BOTH the RX and the TX throttle controls, - * so we use the bitwise OR instead of the logical OR. - */ pr_debug("flags=3D0x%lx\n", hw->usb_flags); - if (!hw->wlandev->hwremoved && - ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) && - !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags)) | - (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) && - !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags)) - )) { - schedule_work(&hw->usb_work); + if (!hw->wlandev->hwremoved) { + bool rx_throttle =3D test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) && + !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags); + bool tx_throttle =3D test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) && + !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags); + /* + * We need to check BOTH the RX and the TX throttle controls, + * so we use the bitwise OR instead of the logical OR. + */ + if (rx_throttle | tx_throttle) + schedule_work(&hw->usb_work); } =20 spin_unlock_irqrestore(&hw->ctlxq.lock, flags); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E528C4332F for ; Mon, 24 Jan 2022 19:22:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349431AbiAXTUo (ORCPT ); Mon, 24 Jan 2022 14:20:44 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:39938 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346286AbiAXTMd (ORCPT ); Mon, 24 Jan 2022 14:12:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C7C3F612DE; Mon, 24 Jan 2022 19:12:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87D79C340E5; Mon, 24 Jan 2022 19:12:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051552; bh=2pDpaWx5MhnyIcZv45hliHuSeHM25XYVHYfE71ZrZbA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=y/KWYyGrACCQQZ8Q8INgQyOle8pjMkHEBRnRMXGZRI+d8I/zCptItjqLbbrPRW6bO lpQIpvJc19sQj0IbHFZ112tDKwxocro9WMrkoCjnAXGPICjzQsgV6ufxgAQJznEjUU 8mcPDGPvhFmKyrVh3O0RSop8XBGHEi3UVxYBjaS4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nick Desaulniers , Nathan Chancellor , =?UTF-8?q?D=C3=A1vid=20Bolvansk=C3=BD?= , =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Subject: [PATCH 4.19 012/239] drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() Date: Mon, 24 Jan 2022 19:40:50 +0100 Message-Id: <20220124183943.505209038@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Nathan Chancellor commit 2e70570656adfe1c5d9a29940faa348d5f132199 upstream. A new warning in clang points out a place in this file where a bitwise OR is being used with boolean types: drivers/gpu/drm/i915/intel_pm.c:3066:12: warning: use of bitwise '|' with b= oolean operands [-Wbitwise-instead-of-logical] changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_late= ncy, 12) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~= ~~~~~~~~ This construct is intentional, as it allows every one of the calls to ilk_increase_wm_latency() to occur (instead of short circuiting with logical OR) while still caring about the result of each call. To make this clearer to the compiler, use the '|=3D' operator to assign the result of each ilk_increase_wm_latency() call to changed, which keeps the meaning of the code the same but makes it obvious that every one of these calls is expected to happen. Link: https://github.com/ClangBuiltLinux/linux/issues/1473 Reported-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Suggested-by: D=C3=A1vid Bolvansk=C3=BD Reviewed-by: Nick Desaulniers Signed-off-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/20211014211916.3550122-= 1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/i915/intel_pm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/i915/intel_pm.c +++ b/drivers/gpu/drm/i915/intel_pm.c @@ -3002,9 +3002,9 @@ static void snb_wm_latency_quirk(struct * The BIOS provided WM memory latency values are often * inadequate for high resolution displays. Adjust them. */ - changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 1= 2) | - ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12) | - ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12); + changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 1= 2); + changed |=3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, = 12); + changed |=3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, = 12); =20 if (!changed) return; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67743C4167B for ; Mon, 24 Jan 2022 19:21:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349458AbiAXTUr (ORCPT ); Mon, 24 Jan 2022 14:20:47 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42248 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346348AbiAXTMh (ORCPT ); Mon, 24 Jan 2022 14:12:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C1221611A9; Mon, 24 Jan 2022 19:12:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97FE2C340E5; Mon, 24 Jan 2022 19:12:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051555; bh=7MC46cqVCemBIVTmpcjdimelq3KvYsWQumf2TrlMETo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QIv0oRvv+6nOyegDsecpJeOfQnpFJlxjDmgR86qGzivKyiUeKNHSxmdqd84kU8DbT gg4mQ7SzJUII0LvjdKDXJmosU/zXAZaZ2yx3m5+bsztFIWmGg/th8DL4rgbQi4g0+Z I+qcrWUdtgO2MwXlBOn1qgOLWkW4AV6uuphR+S1M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Masahiro Yamada , Paul Barker Subject: [PATCH 4.19 013/239] kbuild: Add $(KBUILD_HOSTLDFLAGS) to has_libelf test Date: Mon, 24 Jan 2022 19:40:51 +0100 Message-Id: <20220124183943.538536958@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit f634ca650f724347892068489c7920631a3aac6a upstream. Normally, invocations of $(HOSTCC) include $(KBUILD_HOSTLDFLAGS), which in turn includes $(HOSTLDFLAGS), which allows users to pass in their own flags when linking. However, the 'has_libelf' test does not, meaning that if a user requests a specific linker via HOSTLDFLAGS=3D-fuse-ld=3D..., it is not respected and the build might error. For example, if a user building with clang wants to use all of the LLVM tools without any GNU tools, they might remove all of the GNU tools from their system or PATH then build with $ make HOSTLDFLAGS=3D-fuse-ld=3Dlld LLVM=3D1 LLVM_IAS=3D1 which says use all of the LLVM tools, the integrated assembler, and ld.lld for linking host executables. Without this change, the build will error because $(HOSTCC) uses its default linker, rather than the one requested via -fuse-ld=3D..., which is GNU ld in clang's case in a default configuration. error: Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=3Dy, please install libelf-dev, libelf-devel or elfutils-libelf-devel make[1]: *** [Makefile:1260: prepare-objtool] Error 1 Add $(KBUILD_HOSTLDFLAGS) to the 'has_libelf' test so that the linker choice is respected. Link: https://github.com/ClangBuiltLinux/linux/issues/479 Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada Signed-off-by: Paul Barker Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/Makefile +++ b/Makefile @@ -972,7 +972,7 @@ HOST_LIBELF_LIBS =3D $(shell pkg-config li =20 ifdef CONFIG_STACK_VALIDATION has_libelf :=3D $(call try-run,\ - echo "int main() {}" | $(HOSTCC) -xc -o /dev/null $(HOST_LIBELF_LIBS) -,= 1,0) + echo "int main() {}" | $(HOSTCC) $(KBUILD_HOSTLDFLAGS) -xc -o /dev/null = $(HOST_LIBELF_LIBS) -,1,0) ifeq ($(has_libelf),1) objtool_target :=3D tools/objtool FORCE else From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8BE56C433FE for ; Mon, 24 Jan 2022 19:23:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349977AbiAXTW7 (ORCPT ); Mon, 24 Jan 2022 14:22:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42282 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346371AbiAXTMl (ORCPT ); Mon, 24 Jan 2022 14:12:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 04975611DA; Mon, 24 Jan 2022 19:12:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF88DC340E7; Mon, 24 Jan 2022 19:12:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051558; bh=an8wbRIoUSTqX7geJnMl5kKqR7w6jg1m7eh6WjdnOt4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J9rtlf9f5EZNvqpC7xK99ydPyWUKwupqVSoyyTB3mYNjCkD/ObaHn06ia7fPeOQ5o XX6p3w7afWuJ8NflCO1dMpL+q6nbIDo95q2O9HuciNzdcd2hOUANHE5FcZCdTDQuhh SUouzQR8Cp5veKi5CSciS4hg+ELljzGwCmRhcplg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Mike Marshall Subject: [PATCH 4.19 014/239] orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() Date: Mon, 24 Jan 2022 19:40:52 +0100 Message-Id: <20220124183943.568589736@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET commit 40a74870b2d1d3d44e13b3b73c6571dd34f5614d upstream. 'buffer_index_array' really looks like a bitmap. So it should be allocated as such. When kzalloc is called, a number of bytes is expected, but a number of longs is passed instead. In get(), if not enough memory is allocated, un-allocated memory may be read or written. So use bitmap_zalloc() to safely allocate the correct memory size and avoid un-expected behavior. While at it, change the corresponding kfree() into bitmap_free() to keep the semantic. Fixes: ea2c9c9f6574 ("orangefs: bufmap rewrite") Signed-off-by: Christophe JAILLET Signed-off-by: Mike Marshall Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/orangefs/orangefs-bufmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) --- a/fs/orangefs/orangefs-bufmap.c +++ b/fs/orangefs/orangefs-bufmap.c @@ -179,7 +179,7 @@ orangefs_bufmap_free(struct orangefs_buf { kfree(bufmap->page_array); kfree(bufmap->desc_array); - kfree(bufmap->buffer_index_array); + bitmap_free(bufmap->buffer_index_array); kfree(bufmap); } =20 @@ -229,8 +229,7 @@ orangefs_bufmap_alloc(struct ORANGEFS_de bufmap->desc_size =3D user_desc->size; bufmap->desc_shift =3D ilog2(bufmap->desc_size); =20 - bufmap->buffer_index_array =3D - kzalloc(DIV_ROUND_UP(bufmap->desc_count, BITS_PER_LONG), GFP_KERNEL); + bufmap->buffer_index_array =3D bitmap_zalloc(bufmap->desc_count, GFP_KERN= EL); if (!bufmap->buffer_index_array) goto out_free_bufmap; =20 @@ -253,7 +252,7 @@ orangefs_bufmap_alloc(struct ORANGEFS_de out_free_desc_array: kfree(bufmap->desc_array); out_free_index_array: - kfree(bufmap->buffer_index_array); + bitmap_free(bufmap->buffer_index_array); out_free_bufmap: kfree(bufmap); out: From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8E4FC433FE for ; Mon, 24 Jan 2022 19:21:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349521AbiAXTUy (ORCPT ); Mon, 24 Jan 2022 14:20:54 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:38408 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346427AbiAXTMr (ORCPT ); Mon, 24 Jan 2022 14:12:47 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B1969B8121A; Mon, 24 Jan 2022 19:12:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D8396C340E8; Mon, 24 Jan 2022 19:12:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051561; bh=sqIKcZ/QTMPYz57hTGY6s+dI4WplPMK/ztbGXgAGfns=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z6qH0vGxqa3dBGn7gv31Dut6jc6Iffa5pYS0VbPkT6MCNy258B8iidVTG5OC+iz1h /sS579gO1gs571EqUvQ89qTdyHJH8U2vUVa93CpTSMRJ03c1su6iS47IFg80n9YQGQ Z/oYCrCEQaYd+1YgUGGR5PcXpRGOkU2jmlaHLKjQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Hildenbrand , Eric Farman , Christian Borntraeger Subject: [PATCH 4.19 015/239] KVM: s390: Clarify SIGP orders versus STOP/RESTART Date: Mon, 24 Jan 2022 19:40:53 +0100 Message-Id: <20220124183943.599752654@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Farman commit 812de04661c4daa7ac385c0dfd62594540538034 upstream. With KVM_CAP_S390_USER_SIGP, there are only five Signal Processor orders (CONDITIONAL EMERGENCY SIGNAL, EMERGENCY SIGNAL, EXTERNAL CALL, SENSE, and SENSE RUNNING STATUS) which are intended for frequent use and thus are processed in-kernel. The remainder are sent to userspace with the KVM_CAP_S390_USER_SIGP capability. Of those, three orders (RESTART, STOP, and STOP AND STORE STATUS) have the potential to inject work back into the kernel, and thus are asynchronous. Let's look for those pending IRQs when processing one of the in-kernel SIGP orders, and return BUSY (CC2) if one is in process. This is in agreement with the Principles of Operation, which states that only one order can be "active" on a CPU at a time. Cc: stable@vger.kernel.org Suggested-by: David Hildenbrand Signed-off-by: Eric Farman Reviewed-by: Christian Borntraeger Acked-by: David Hildenbrand Link: https://lore.kernel.org/r/20211213210550.856213-2-farman@linux.ibm.com [borntraeger@linux.ibm.com: add stable tag] Signed-off-by: Christian Borntraeger Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/s390/kvm/interrupt.c | 7 +++++++ arch/s390/kvm/kvm-s390.c | 9 +++++++-- arch/s390/kvm/kvm-s390.h | 1 + arch/s390/kvm/sigp.c | 28 ++++++++++++++++++++++++++++ 4 files changed, 43 insertions(+), 2 deletions(-) --- a/arch/s390/kvm/interrupt.c +++ b/arch/s390/kvm/interrupt.c @@ -1900,6 +1900,13 @@ int kvm_s390_is_stop_irq_pending(struct return test_bit(IRQ_PEND_SIGP_STOP, &li->pending_irqs); } =20 +int kvm_s390_is_restart_irq_pending(struct kvm_vcpu *vcpu) +{ + struct kvm_s390_local_interrupt *li =3D &vcpu->arch.local_int; + + return test_bit(IRQ_PEND_RESTART, &li->pending_irqs); +} + void kvm_s390_clear_stop_irq(struct kvm_vcpu *vcpu) { struct kvm_s390_local_interrupt *li =3D &vcpu->arch.local_int; --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3844,10 +3844,15 @@ void kvm_s390_vcpu_stop(struct kvm_vcpu spin_lock(&vcpu->kvm->arch.start_stop_lock); online_vcpus =3D atomic_read(&vcpu->kvm->online_vcpus); =20 - /* SIGP STOP and SIGP STOP AND STORE STATUS has been fully processed */ + /* + * Set the VCPU to STOPPED and THEN clear the interrupt flag, + * now that the SIGP STOP and SIGP STOP AND STORE STATUS orders + * have been fully processed. This will ensure that the VCPU + * is kept BUSY if another VCPU is inquiring with SIGP SENSE. + */ + kvm_s390_set_cpuflags(vcpu, CPUSTAT_STOPPED); kvm_s390_clear_stop_irq(vcpu); =20 - kvm_s390_set_cpuflags(vcpu, CPUSTAT_STOPPED); __disable_ibs_on_vcpu(vcpu); =20 for (i =3D 0; i < online_vcpus; i++) { --- a/arch/s390/kvm/kvm-s390.h +++ b/arch/s390/kvm/kvm-s390.h @@ -372,6 +372,7 @@ void kvm_s390_destroy_adapters(struct kv int kvm_s390_ext_call_pending(struct kvm_vcpu *vcpu); extern struct kvm_device_ops kvm_flic_ops; int kvm_s390_is_stop_irq_pending(struct kvm_vcpu *vcpu); +int kvm_s390_is_restart_irq_pending(struct kvm_vcpu *vcpu); void kvm_s390_clear_stop_irq(struct kvm_vcpu *vcpu); int kvm_s390_set_irq_state(struct kvm_vcpu *vcpu, void __user *buf, int len); --- a/arch/s390/kvm/sigp.c +++ b/arch/s390/kvm/sigp.c @@ -288,6 +288,34 @@ static int handle_sigp_dst(struct kvm_vc if (!dst_vcpu) return SIGP_CC_NOT_OPERATIONAL; =20 + /* + * SIGP RESTART, SIGP STOP, and SIGP STOP AND STORE STATUS orders + * are processed asynchronously. Until the affected VCPU finishes + * its work and calls back into KVM to clear the (RESTART or STOP) + * interrupt, we need to return any new non-reset orders "busy". + * + * This is important because a single VCPU could issue: + * 1) SIGP STOP $DESTINATION + * 2) SIGP SENSE $DESTINATION + * + * If the SIGP SENSE would not be rejected as "busy", it could + * return an incorrect answer as to whether the VCPU is STOPPED + * or OPERATING. + */ + if (order_code !=3D SIGP_INITIAL_CPU_RESET && + order_code !=3D SIGP_CPU_RESET) { + /* + * Lockless check. Both SIGP STOP and SIGP (RE)START + * properly synchronize everything while processing + * their orders, while the guest cannot observe a + * difference when issuing other orders from two + * different VCPUs. + */ + if (kvm_s390_is_stop_irq_pending(dst_vcpu) || + kvm_s390_is_restart_irq_pending(dst_vcpu)) + return SIGP_CC_BUSY; + } + switch (order_code) { case SIGP_SENSE: vcpu->stat.instruction_sigp_sense++; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38688C433F5 for ; Mon, 24 Jan 2022 19:23:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350016AbiAXTXG (ORCPT ); Mon, 24 Jan 2022 14:23:06 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:38460 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241161AbiAXTMr (ORCPT ); Mon, 24 Jan 2022 14:12:47 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A39B4B8122A; Mon, 24 Jan 2022 19:12:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F37CC340E5; Mon, 24 Jan 2022 19:12:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051564; bh=uNGaLj2lMbEPT6PmZ400m7tw1ykXSU1lTSsCwt5jZ6Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ftgVtF6+EkelGP8WvfEEwhKl2gFNPZVP/kSJo/OsI1cUev/4cgox33EQ/ipTAMp+2 2vNg33DMRocvNeisuqm1QZTvAvbrKFrlaqJU8Ap3M4h4aKh9ZndvB0021Ye6KKgKKd rJyt1Og0LIQ4dli4qXzzVQqpc/GdlRBQs3rre8Qg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Kieran Bingham , Laurent Pinchart , Mauro Carvalho Chehab Subject: [PATCH 4.19 016/239] media: uvcvideo: fix division by zero at stream start Date: Mon, 24 Jan 2022 19:40:54 +0100 Message-Id: <20220124183943.630073909@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 8aa637bf6d70d2fb2ad4d708d8b9dd02b1c095df upstream. Add the missing bulk-endpoint max-packet sanity check to uvc_video_start_transfer() to avoid division by zero in uvc_alloc_urb_buffers() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=3D0")). Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") Cc: stable@vger.kernel.org # 2.6.26 Signed-off-by: Johan Hovold Reviewed-by: Kieran Bingham Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/uvc/uvc_video.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/media/usb/uvc/uvc_video.c +++ b/drivers/media/usb/uvc/uvc_video.c @@ -1854,6 +1854,10 @@ static int uvc_init_video(struct uvc_str if (ep =3D=3D NULL) return -EIO; =20 + /* Reject broken descriptors. */ + if (usb_endpoint_maxp(&ep->desc) =3D=3D 0) + return -EIO; + ret =3D uvc_init_video_bulk(stream, ep, gfp_flags); } =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66095C3526F for ; Mon, 24 Jan 2022 19:22:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345629AbiAXTWW (ORCPT ); Mon, 24 Jan 2022 14:22:22 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40054 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346436AbiAXTMs (ORCPT ); Mon, 24 Jan 2022 14:12:48 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 25CF96130A; Mon, 24 Jan 2022 19:12:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04A6DC340E5; Mon, 24 Jan 2022 19:12:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051567; bh=S+oUhieKCUVWkr3cNVSk7UFZZl4vLzAmix0sjkOrXIc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nNgxE7r2M7TXGFkbEB5hrLhayVqljzfpRaUxpkDwRyKtSlbZpzdtjqziNxFvUsOxP 1xpRFEKAAzhOrWme6gjzWiqk/+tgtmk6FsAivjvZ47MikyGvgceMzFHyI+L/wQg9Qq OnwjJm8thYgy6dkHuwir3ye/9XWEW3lhvC/5NMjk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+cce1ee31614c171f5595@syzkaller.appspotmail.com, Larry Finger , Kalle Valo Subject: [PATCH 4.19 017/239] rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled Date: Mon, 24 Jan 2022 19:40:55 +0100 Message-Id: <20220124183943.662258539@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Larry Finger commit 8b144dedb928e4e2f433a328d58f44c3c098d63e upstream. Syzbot reports the following WARNING: [200~raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 1206 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x1d/0x20 kernel/locking/irqflag-debug.c:10 Hardware initialization for the rtl8188cu can run for as long as 350 ms, and the routine may be called with interrupts disabled. To avoid locking the machine for this long, the current routine saves the interrupt flags and enables local interrupts. The problem is that it restores the flags at the end without disabling local interrupts first. This patch fixes commit a53268be0cb9 ("rtlwifi: rtl8192cu: Fix too long disable of IRQs"). Reported-by: syzbot+cce1ee31614c171f5595@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Fixes: a53268be0cb9 ("rtlwifi: rtl8192cu: Fix too long disable of IRQs") Signed-off-by: Larry Finger Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20211215171105.20623-1-Larry.Finger@lwfinge= r.net Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c @@ -1020,6 +1020,7 @@ int rtl92cu_hw_init(struct ieee80211_hw _InitPABias(hw); rtl92c_dm_init(hw); exit: + local_irq_disable(); local_irq_restore(flags); return err; } From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 433FDC433F5 for ; Mon, 24 Jan 2022 19:37:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353735AbiAXTfS (ORCPT ); Mon, 24 Jan 2022 14:35:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52008 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347073AbiAXT1l (ORCPT ); Mon, 24 Jan 2022 14:27:41 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 199D9C08E7BF; Mon, 24 Jan 2022 11:12:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CC106B8122F; Mon, 24 Jan 2022 19:12:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34347C340E8; Mon, 24 Jan 2022 19:12:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051570; bh=N8Rgi53AUy+5nlRNc2Il+oQgNwWJTC8Or3+tDrNCYHM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C9xReAzji9iIjedf3BxmJuhuZzhI0r11+gkq4l3DcGZQ/5w51b0+l8fDgluQONEGz 0NFMH8eqf5/RaJ+nItYEO3JzNdMqY49WWh30VpVbggjudMeqz2NoNurE2b6T7xKzjx VHovutbhtltDZSux8TQ1OWRGw4J2f0hNg2u2iHPw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gabriel Somlo , Johan Hovold , "Michael S. Tsirkin" Subject: [PATCH 4.19 018/239] firmware: qemu_fw_cfg: fix sysfs information leak Date: Mon, 24 Jan 2022 19:40:56 +0100 Message-Id: <20220124183943.701260030@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 1b656e9aad7f4886ed466094d1dc5ee4dd900d20 upstream. Make sure to always NUL-terminate file names retrieved from the firmware to avoid accessing data beyond the entry slab buffer and exposing it through sysfs in case the firmware data is corrupt. Fixes: 75f3e8e47f38 ("firmware: introduce sysfs driver for QEMU's fw_cfg de= vice") Cc: stable@vger.kernel.org # 4.6 Cc: Gabriel Somlo Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20211201132528.30025-4-johan@kernel.org Signed-off-by: Michael S. Tsirkin Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/firmware/qemu_fw_cfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/firmware/qemu_fw_cfg.c +++ b/drivers/firmware/qemu_fw_cfg.c @@ -598,7 +598,7 @@ static int fw_cfg_register_file(const st /* set file entry information */ entry->size =3D be32_to_cpu(f->size); entry->select =3D be16_to_cpu(f->select); - memcpy(entry->name, f->name, FW_CFG_MAX_FILE_PATH); + strscpy(entry->name, f->name, FW_CFG_MAX_FILE_PATH); =20 /* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */ err =3D kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype, From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A377C433EF for ; Mon, 24 Jan 2022 19:22:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349561AbiAXTU6 (ORCPT ); Mon, 24 Jan 2022 14:20:58 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40126 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237218AbiAXTMy (ORCPT ); Mon, 24 Jan 2022 14:12:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4DDBF612A5; Mon, 24 Jan 2022 19:12:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 295A1C340E5; Mon, 24 Jan 2022 19:12:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051573; bh=OvvClgg8tVQtTWn8Qm3ypBSAwn/4B4w1SBC5HNpllfA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nC9NwQUv3mTm4sKWSKqhN/V4/KpfdCp+owOENuDimkxCqvznqZthb583JxinWBvwD NtY7fRn+nnPwILDKqJIRKNrl42n0KqAwegFCSyfN9mFaeJ+os2WjjZ3ida2IWm7C/L tdANfK/DfDoItfbjc64NA8jIBHCufka2CrylgUpI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qiushi Wu , Kees Cook , Johan Hovold , "Michael S. Tsirkin" Subject: [PATCH 4.19 019/239] firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries Date: Mon, 24 Jan 2022 19:40:57 +0100 Message-Id: <20220124183943.732948213@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit d3e305592d69e21e36b76d24ca3c01971a2d09be upstream. Commit fe3c60684377 ("firmware: Fix a reference count leak.") "fixed" a kobject leak in the file registration helper by properly calling kobject_put() for the entry in case registration of the object fails (e.g. due to a name collision). This would however result in a NULL pointer dereference when the release function tries to remove the never added entry from the fw_cfg_entry_cache list. Fix this by moving the list-removal out of the release function. Note that the offending commit was one of the benign looking umn.edu fixes which was reviewed but not reverted. [1][2] [1] https://lore.kernel.org/r/202105051005.49BFABCE@keescook [2] https://lore.kernel.org/all/YIg7ZOZvS3a8LjSv@kroah.com Fixes: fe3c60684377 ("firmware: Fix a reference count leak.") Cc: stable@vger.kernel.org # 5.8 Cc: Qiushi Wu Cc: Kees Cook Cc: Greg Kroah-Hartman Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20211201132528.30025-2-johan@kernel.org Signed-off-by: Michael S. Tsirkin Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/firmware/qemu_fw_cfg.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) --- a/drivers/firmware/qemu_fw_cfg.c +++ b/drivers/firmware/qemu_fw_cfg.c @@ -385,9 +385,7 @@ static void fw_cfg_sysfs_cache_cleanup(v struct fw_cfg_sysfs_entry *entry, *next; =20 list_for_each_entry_safe(entry, next, &fw_cfg_entry_cache, list) { - /* will end up invoking fw_cfg_sysfs_cache_delist() - * via each object's release() method (i.e. destructor) - */ + fw_cfg_sysfs_cache_delist(entry); kobject_put(&entry->kobj); } } @@ -445,7 +443,6 @@ static void fw_cfg_sysfs_release_entry(s { struct fw_cfg_sysfs_entry *entry =3D to_entry(kobj); =20 - fw_cfg_sysfs_cache_delist(entry); kfree(entry); } =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 911BDC4332F for ; Mon, 24 Jan 2022 19:37:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353811AbiAXTfZ (ORCPT ); Mon, 24 Jan 2022 14:35:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52248 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351810AbiAXT2r (ORCPT ); Mon, 24 Jan 2022 14:28:47 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B36AC061A78; Mon, 24 Jan 2022 11:13:02 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 58E26B811F9; Mon, 24 Jan 2022 19:13:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56CDCC340E5; Mon, 24 Jan 2022 19:12:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051580; bh=9pdLfRAIC3i+Ov8lz3nUmCShg09W06WgYN964DB+O1w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mfagK2C1lnL3h/tal9WreCw5fOfgpCoo3m58Pj15wW9Vsk0lbedVaQgazSess+iWg QkeoYYkPCUHho13G4Xef13J0Zn6A4WlTtiIEjcEoq/lu1dP5o5evNDQcQ0zaLJ1ZRW RFBcHWNAF/irHTZHM9uaJI5vCqkrCK9cdQsSJzk4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gabriel Somlo , Johan Hovold Subject: [PATCH 4.19 020/239] firmware: qemu_fw_cfg: fix kobject leak in probe error path Date: Mon, 24 Jan 2022 19:40:58 +0100 Message-Id: <20220124183943.764526428@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 47a1db8e797da01a1309bf42e0c0d771d4e4d4f3 upstream. An initialised kobject must be freed using kobject_put() to avoid leaking associated resources (e.g. the object name). Commit fe3c60684377 ("firmware: Fix a reference count leak.") "fixed" the leak in the first error path of the file registration helper but left the second one unchanged. This "fix" would however result in a NULL pointer dereference due to the release function also removing the never added entry from the fw_cfg_entry_cache list. This has now been addressed. Fix the remaining kobject leak by restoring the common error path and adding the missing kobject_put(). Fixes: 75f3e8e47f38 ("firmware: introduce sysfs driver for QEMU's fw_cfg de= vice") Cc: stable@vger.kernel.org # 4.6 Cc: Gabriel Somlo Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20211201132528.30025-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/firmware/qemu_fw_cfg.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) --- a/drivers/firmware/qemu_fw_cfg.c +++ b/drivers/firmware/qemu_fw_cfg.c @@ -600,15 +600,13 @@ static int fw_cfg_register_file(const st /* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */ err =3D kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype, fw_cfg_sel_ko, "%d", entry->select); - if (err) { - kobject_put(&entry->kobj); - return err; - } + if (err) + goto err_put_entry; =20 /* add raw binary content access */ err =3D sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw); if (err) - goto err_add_raw; + goto err_del_entry; =20 /* try adding "/sys/firmware/qemu_fw_cfg/by_name/" symlink */ fw_cfg_build_symlink(fw_cfg_fname_kset, &entry->kobj, entry->name); @@ -617,9 +615,10 @@ static int fw_cfg_register_file(const st fw_cfg_sysfs_cache_enlist(entry); return 0; =20 -err_add_raw: +err_del_entry: kobject_del(&entry->kobj); - kfree(entry); +err_put_entry: + kobject_put(&entry->kobj); return err; } =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 121C6C43219 for ; Mon, 24 Jan 2022 19:37:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354041AbiAXTft (ORCPT ); Mon, 24 Jan 2022 14:35:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51320 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351849AbiAXT24 (ORCPT ); Mon, 24 Jan 2022 14:28:56 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1CACEC029808; Mon, 24 Jan 2022 11:13:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B183060BFB; Mon, 24 Jan 2022 19:13:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89091C36AE9; Mon, 24 Jan 2022 19:13:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051583; bh=ZXmHV626MKlRKHjGTecpf95Tig3baN8fCoHHphGTCvw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gGpat4eUAtJ/+3P/xfxt7mgRVYPLiG3jddVajW7ftWXL8vaBUP/8oTnhH6WSBUFpv 1yVz1PRMhaRJtRsAHfaFg7mZtbw3ReB7k+2DEEcPzlgsU4OCcXASzdqC4DazBR4Hgm cY1X5a6MsgK1A7Cmc4JQc9tSyFl+2p4cYNKucZX4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christian Lachner , Takashi Iwai Subject: [PATCH 4.19 021/239] ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows Date: Mon, 24 Jan 2022 19:40:59 +0100 Message-Id: <20220124183943.796509349@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christian Lachner commit c1933008679586b20437280463110c967d66f865 upstream. This patch addresses an issue where after rebooting from Windows into Linux there would be no audio output. It turns out that the Realtek Audio driver on Windows changes some coeffs which are not being reset/reinitialized when rebooting the machine. As a result, there is no audio output until these coeffs are being reset to their initial state. This patch takes care of that by setting known-good (initial) values to the coeffs. We initially relied upon alc1220_fixup_clevo_p950() to fix some pins in the connection list. However, it also sets coef 0x7 which does not need to be touched. Furthermore, to prevent mixing device-specific quirks I introduced a new alc1220_fixup_gb_x570() which is heavily based on alc1220_fixup_clevo_p950() but does not set coeff 0x7 and fixes the coeffs that are actually needed instead. This new alc1220_fixup_gb_x570() is believed to also work for other boards, like the Gigabyte X570 Aorus Extreme and the newer Gigabyte Aorus X570S Master. However, as there is no way for me to test these I initially only enable this new behaviour for the mainboard I have which is the Gigabyte X570(non-S) Aorus Master. I tested this patch on the 5.15 branch as well as on master and it is working well for me. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=3D205275 Signed-off-by: Christian Lachner Fixes: 0d45e86d2267d ("ALSA: hda/realtek - Fix silent output on Gigabyte X5= 70 Aorus Master") Cc: Link: https://lore.kernel.org/r/20220103140517.30273-2-gladiac@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/pci/hda/patch_realtek.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -1910,6 +1910,7 @@ enum { ALC887_FIXUP_ASUS_BASS, ALC887_FIXUP_BASS_CHMAP, ALC1220_FIXUP_GB_DUAL_CODECS, + ALC1220_FIXUP_GB_X570, ALC1220_FIXUP_CLEVO_P950, ALC1220_FIXUP_CLEVO_PB51ED, ALC1220_FIXUP_CLEVO_PB51ED_PINS, @@ -2099,6 +2100,29 @@ static void alc1220_fixup_gb_dual_codecs } } =20 +static void alc1220_fixup_gb_x570(struct hda_codec *codec, + const struct hda_fixup *fix, + int action) +{ + static const hda_nid_t conn1[] =3D { 0x0c }; + static const struct coef_fw gb_x570_coefs[] =3D { + WRITE_COEF(0x1a, 0x01c1), + WRITE_COEF(0x1b, 0x0202), + WRITE_COEF(0x43, 0x3005), + {} + }; + + switch (action) { + case HDA_FIXUP_ACT_PRE_PROBE: + snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn1), conn1); + snd_hda_override_conn_list(codec, 0x1b, ARRAY_SIZE(conn1), conn1); + break; + case HDA_FIXUP_ACT_INIT: + alc_process_coef_fw(codec, gb_x570_coefs); + break; + } +} + static void alc1220_fixup_clevo_p950(struct hda_codec *codec, const struct hda_fixup *fix, int action) @@ -2401,6 +2425,10 @@ static const struct hda_fixup alc882_fix .type =3D HDA_FIXUP_FUNC, .v.func =3D alc1220_fixup_gb_dual_codecs, }, + [ALC1220_FIXUP_GB_X570] =3D { + .type =3D HDA_FIXUP_FUNC, + .v.func =3D alc1220_fixup_gb_x570, + }, [ALC1220_FIXUP_CLEVO_P950] =3D { .type =3D HDA_FIXUP_FUNC, .v.func =3D alc1220_fixup_clevo_p950, @@ -2503,7 +2531,7 @@ static const struct snd_pci_quirk alc882 SND_PCI_QUIRK(0x13fe, 0x1009, "Advantech MIT-W101", ALC886_FIXUP_EAPD), SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP= _FRONT_HP_NO_PRESENCE), SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_D= UAL_CODECS), - SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP= _CLEVO_P950), + SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP= _GB_X570), SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP= _CLEVO_P950), SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950), SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950), From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55AD5C41535 for ; Mon, 24 Jan 2022 19:37:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353991AbiAXTfn (ORCPT ); Mon, 24 Jan 2022 14:35:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52288 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351864AbiAXT25 (ORCPT ); Mon, 24 Jan 2022 14:28:57 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A4DCC08E823; Mon, 24 Jan 2022 11:13:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DE923612FC; Mon, 24 Jan 2022 19:13:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C0C7C36AE9; Mon, 24 Jan 2022 19:13:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051586; bh=Q+MxbbWQVajUN34Ta0HIEmYAyo52hSUK/g2MXOMUHZo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iXpH7K3X4uK64A1s3YkMSG0lMdXyJ0J7DUCS1z3rrZBOCCFzTPCZGj14f3SR41DTM A1kdrP0l+cNNd0xz7N3VpjAqfMs9Amvbx6fKajWZbmTS6Z8p4LQqI6rCCk5p0ksLQA oGrEGlHTwvdNSMCGiqFzN+asD1N+Qig5G0R905vo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Jiri Kosina Subject: [PATCH 4.19 022/239] HID: uhid: Fix worker destroying device without any protection Date: Mon, 24 Jan 2022 19:41:00 +0100 Message-Id: <20220124183943.826952634@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jann Horn commit 4ea5763fb79ed89b3bdad455ebf3f33416a81624 upstream. uhid has to run hid_add_device() from workqueue context while allowing parallel use of the userspace API (which is protected with ->devlock). But hid_add_device() can fail. Currently, that is handled by immediately destroying the associated HID device, without using ->devlock - but if there are concurrent requests from userspace, that's wrong and leads to NULL dereferences and/or memory corruption (via use-after-free). Fix it by leaving the HID device as-is in the worker. We can clean it up later, either in the UHID_DESTROY command handler or in the ->release() handler. Cc: stable@vger.kernel.org Fixes: 67f8ecc550b5 ("HID: uhid: fix timeout when probe races with IO") Signed-off-by: Jann Horn Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/uhid.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) --- a/drivers/hid/uhid.c +++ b/drivers/hid/uhid.c @@ -31,11 +31,22 @@ =20 struct uhid_device { struct mutex devlock; + + /* This flag tracks whether the HID device is usable for commands from + * userspace. The flag is already set before hid_add_device(), which + * runs in workqueue context, to allow hid_add_device() to communicate + * with userspace. + * However, if hid_add_device() fails, the flag is cleared without + * holding devlock. + * We guarantee that if @running changes from true to false while you're + * holding @devlock, it's still fine to access @hid. + */ bool running; =20 __u8 *rd_data; uint rd_size; =20 + /* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */ struct hid_device *hid; struct uhid_event input_buf; =20 @@ -66,9 +77,18 @@ static void uhid_device_add_worker(struc if (ret) { hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret); =20 - hid_destroy_device(uhid->hid); - uhid->hid =3D NULL; + /* We used to call hid_destroy_device() here, but that's really + * messy to get right because we have to coordinate with + * concurrent writes from userspace that might be in the middle + * of using uhid->hid. + * Just leave uhid->hid as-is for now, and clean it up when + * userspace tries to close or reinitialize the uhid instance. + * + * However, we do have to clear the ->running flag and do a + * wakeup to make sure userspace knows that the device is gone. + */ uhid->running =3D false; + wake_up_interruptible(&uhid->report_wait); } } =20 @@ -477,7 +497,7 @@ static int uhid_dev_create2(struct uhid_ void *rd_data; int ret; =20 - if (uhid->running) + if (uhid->hid) return -EALREADY; =20 rd_size =3D ev->u.create2.rd_size; @@ -559,7 +579,7 @@ static int uhid_dev_create(struct uhid_d =20 static int uhid_dev_destroy(struct uhid_device *uhid) { - if (!uhid->running) + if (!uhid->hid) return -EINVAL; =20 uhid->running =3D false; @@ -568,6 +588,7 @@ static int uhid_dev_destroy(struct uhid_ cancel_work_sync(&uhid->worker); =20 hid_destroy_device(uhid->hid); + uhid->hid =3D NULL; kfree(uhid->rd_data); =20 return 0; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2714AC433EF for ; Mon, 24 Jan 2022 19:22:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349717AbiAXTVN (ORCPT ); Mon, 24 Jan 2022 14:21:13 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:37356 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241855AbiAXTNM (ORCPT ); Mon, 24 Jan 2022 14:13:12 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9E9DEB8121F; Mon, 24 Jan 2022 19:13:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD9D6C340E5; Mon, 24 Jan 2022 19:13:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051589; bh=OJgXraE3CkdOVHg29qdBH/iVtI++R1ULCOak5Wi3edk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FeZ5CurVbh2PzeNrAXKlJ4PWscSchjn/RbbD9gMaDTq9cK3VEMMWuPIw6WTR/an85 F7LebyR2n8kiI5kmcHIsxj4W/fBpzPDvNWcXKmH4gW09b9StxbFqJyFNu7YY4nha87 EsWkDXRruZOhg2LR6BumvH5RdoFLVbjD/hbKPVis= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Gerecke , Ping Cheng , Jiri Kosina Subject: [PATCH 4.19 023/239] HID: wacom: Reset expected and received contact counts at the same time Date: Mon, 24 Jan 2022 19:41:01 +0100 Message-Id: <20220124183943.857676857@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Gerecke commit 546e41ac994cc185ef3de610ca849a294b5df3ba upstream. These two values go hand-in-hand and must be valid for the driver to behave correctly. We are currently lazy about updating the values and rely on the "expected" code flow to take care of making sure they're valid at the point they're needed. The "expected" flow changed somewhat with commit f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report"), however. This led to problems with the DTH-2452 due (in part) to *all* contacts being fully processed -- even those past the expected contact count. Specifically, the received count gets reset to 0 once all expected fingers are processed, but not the expected count. The rest of the contacts in the report are then *also* processed since now the driver thinks we've only processed 0 of N expected contacts. Later commits such as 7fb0413baa7f (HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts) worked around the DTH-2452 issue by skipping the invalid contacts at the end of the report, but this is not a complete fix. The confidence flag cannot be relied on when a contact is removed (see the following patch), and dealing with that condition re-introduces the DTH-2452 issue unless we also address this contact count laziness. By resetting expected and received counts at the same time we ensure the driver understands that there are 0 more contacts expected in the report. Similarly, we also make sure to reset the received count if for some reason we're out of sync in the pre-report phase. Link: https://github.com/linuxwacom/input-wacom/issues/288 Fixes: f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per repor= t") CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke Reviewed-by: Ping Cheng Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/wacom_wac.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -2620,11 +2620,14 @@ static void wacom_wac_finger_pre_report( hid_data->cc_index >=3D 0) { struct hid_field *field =3D report->field[hid_data->cc_index]; int value =3D field->value[hid_data->cc_value_index]; - if (value) + if (value) { hid_data->num_expected =3D value; + hid_data->num_received =3D 0; + } } else { hid_data->num_expected =3D wacom_wac->features.touch_max; + hid_data->num_received =3D 0; } } =20 @@ -2648,6 +2651,7 @@ static void wacom_wac_finger_report(stru =20 input_sync(input); wacom_wac->hid_data.num_received =3D 0; + wacom_wac->hid_data.num_expected =3D 0; =20 /* keep touch state for pen event */ wacom_wac->shared->touch_down =3D wacom_wac_finger_count_touches(wacom_wa= c); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C709C433FE for ; Mon, 24 Jan 2022 19:37:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354014AbiAXTfp (ORCPT ); Mon, 24 Jan 2022 14:35:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351890AbiAXT27 (ORCPT ); Mon, 24 Jan 2022 14:28:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 812A9C06135D; Mon, 24 Jan 2022 11:13:13 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1E61E612FE; Mon, 24 Jan 2022 19:13:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF521C340E5; Mon, 24 Jan 2022 19:13:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051592; bh=INA086hqSWtwfZHOLhkrFU+jwIwMPMlerwTlFpXtk6s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cmwWFpd+kmDXHOCvXIMIr5kG6DsVr0pQ916pnxuTed46HY1KhuIXc4GY5q/UyH5yZ tT3tWwTAIqySAyrZopS5inct2xjFgxB2HHVWaAslH9wXtaltGweLVMw8AqckkjJPxn P+pkPsKC3q3+QPfrxsDeQJeh2rqN7M/FPfVfT8W0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Gerecke , Ping Cheng , Jiri Kosina Subject: [PATCH 4.19 024/239] HID: wacom: Ignore the confidence flag when a touch is removed Date: Mon, 24 Jan 2022 19:41:02 +0100 Message-Id: <20220124183943.888440598@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Gerecke commit df03e9bd6d4806619b4cdc91a3d7695818a8e2b7 upstream. AES hardware may internally re-classify a contact that it thought was intentional as a palm. Intentional contacts are reported as "down" with the confidence bit set. When this re-classification occurs, however, the state transitions to "up" with the confidence bit cleared. This kind of transition appears to be legal according to Microsoft docs, but we do not handle it correctly. Because the confidence bit is clear, we don't call `wacom_wac_finger_slot` and update userspace. This causes hung touches that confuse userspace and interfere with pen arbitration. This commit adds a special case to ignore the confidence flag if a contact is reported as removed. This ensures we do not leave a hung touch if one of these re-classification events occured. Ideally we'd have some way to also let userspace know that the touch has been re-classified as a palm and needs to be canceled, but that's not possible right now :) Link: https://github.com/linuxwacom/input-wacom/issues/288 Fixes: 7fb0413baa7f (HID: wacom: Use "Confidence" flag to prevent reporting= invalid contacts) CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke Reviewed-by: Ping Cheng Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/wacom_wac.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -2529,6 +2529,24 @@ static void wacom_wac_finger_slot(struct } } =20 +static bool wacom_wac_slot_is_active(struct input_dev *dev, int key) +{ + struct input_mt *mt =3D dev->mt; + struct input_mt_slot *s; + + if (!mt) + return false; + + for (s =3D mt->slots; s !=3D mt->slots + mt->num_slots; s++) { + if (s->key =3D=3D key && + input_mt_get_value(s, ABS_MT_TRACKING_ID) >=3D 0) { + return true; + } + } + + return false; +} + static void wacom_wac_finger_event(struct hid_device *hdev, struct hid_field *field, struct hid_usage *usage, __s32 value) { @@ -2571,9 +2589,14 @@ static void wacom_wac_finger_event(struc =20 =20 if (usage->usage_index + 1 =3D=3D field->report_count) { - if (equivalent_usage =3D=3D wacom_wac->hid_data.last_slot_field && - wacom_wac->hid_data.confidence) - wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); + if (equivalent_usage =3D=3D wacom_wac->hid_data.last_slot_field) { + bool touch_removed =3D wacom_wac_slot_is_active(wacom_wac->touch_input, + wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch; + + if (wacom_wac->hid_data.confidence || touch_removed) { + wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); + } + } } } =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F520C3526E for ; Mon, 24 Jan 2022 20:57:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1443055AbiAXU4N (ORCPT ); Mon, 24 Jan 2022 15:56:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38722 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1385491AbiAXUd3 (ORCPT ); Mon, 24 Jan 2022 15:33:29 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 34EF0C061366; Mon, 24 Jan 2022 11:13:18 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E5700B811F9; Mon, 24 Jan 2022 19:13:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 088EDC340E5; Mon, 24 Jan 2022 19:13:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051595; bh=2Vc5uuT2sZZYyfYgafyeNPF3odAtR3w3IPP05lx1XxE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GZa4/994ccEa2soU0uAa7Ga+JachJxQlACjTn721WM3PrZkPId3+FnRpiWBYplR0Y /j6XU44HBBvolVk1423uJ5XH+yythLQQDtPLo1y0jiZwB7tsClPbQp+1KU8c4qfczU RqEIfEXW1jsW5z4JqTFv6NleQswx5NqCNA/F+/aQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Gerecke , Ping Cheng , Jiri Kosina Subject: [PATCH 4.19 025/239] HID: wacom: Avoid using stale array indicies to read contact count Date: Mon, 24 Jan 2022 19:41:03 +0100 Message-Id: <20220124183943.920097912@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Gerecke commit 20f3cf5f860f9f267a6a6e5642d3d0525edb1814 upstream. If we ever see a touch report with contact count data we initialize several variables used to read the contact count in the pre-report phase. These variables are never reset if we process a report which doesn't contain a contact count, however. This can cause the pre- report function to trigger a read of arbitrary memory (e.g. NULL if we're lucky) and potentially crash the driver. This commit restores resetting of the variables back to default "none" values that were used prior to the commit mentioned below. Link: https://github.com/linuxwacom/input-wacom/issues/276 Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report p= hase) CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke Reviewed-by: Ping Cheng Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/wacom_wac.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -2610,6 +2610,10 @@ static void wacom_wac_finger_pre_report( =20 hid_data->confidence =3D true; =20 + hid_data->cc_report =3D 0; + hid_data->cc_index =3D -1; + hid_data->cc_value_index =3D -1; + for (i =3D 0; i < report->maxfield; i++) { struct hid_field *field =3D report->field[i]; int j; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8579CC4167E for ; Mon, 24 Jan 2022 19:37:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353867AbiAXTfa (ORCPT ); Mon, 24 Jan 2022 14:35:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344991AbiAXT3K (ORCPT ); Mon, 24 Jan 2022 14:29:10 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 312ADC061368; Mon, 24 Jan 2022 11:13:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E3B71B8122F; Mon, 24 Jan 2022 19:13:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20A15C340E5; Mon, 24 Jan 2022 19:13:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051598; bh=MouureKsaSP7tMgNm+xCoUVff72Se1F9IIFgBjduPQ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=twigKzCqWOw5A9z4hJheS98Mj3Kr6jE2AHoh+thrGpNC8p9H2X6jT5YdZd69/r+mG nf/VpzypxUYWdPto1mRqs49N7N6QL/gGArVB44X2KQ7CH+p2jq3Pv9tOgTOQeQJdNG fuRj5bknIURqwX/0tQEn95s9VT/oRaeilQg7KfaE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chao Yu , Jaegeuk Kim Subject: [PATCH 4.19 026/239] f2fs: fix to do sanity check in is_alive() Date: Mon, 24 Jan 2022 19:41:04 +0100 Message-Id: <20220124183943.957395248@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chao Yu commit 77900c45ee5cd5da63bd4d818a41dbdf367e81cd upstream. In fuzzed image, SSA table may indicate that a data block belongs to invalid node, which node ID is out-of-range (0, 1, 2 or max_nid), in order to avoid migrating inconsistent data in such corrupted image, let's do sanity check anyway before data block migration. Cc: stable@vger.kernel.org Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/f2fs/gc.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/f2fs/gc.c +++ b/fs/f2fs/gc.c @@ -589,6 +589,9 @@ static bool is_alive(struct f2fs_sb_info set_sbi_flag(sbi, SBI_NEED_FSCK); } =20 + if (f2fs_check_nid_range(sbi, dni->ino)) + return false; + *nofs =3D ofs_of_node(node_page); source_blkaddr =3D datablock_addr(NULL, node_page, ofs_in_node); f2fs_put_page(node_page, 1); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2EACC433F5 for ; Mon, 24 Jan 2022 19:23:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345458AbiAXTXc (ORCPT ); Mon, 24 Jan 2022 14:23:32 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:38960 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344855AbiAXTNZ (ORCPT ); Mon, 24 Jan 2022 14:13:25 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 25F8FB811F9; Mon, 24 Jan 2022 19:13:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4BBB9C340E5; Mon, 24 Jan 2022 19:13:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051601; bh=Oo2lX6416TxPeLNk85BzSqjJdoOIIwJmRJQe4N3bdMg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PSh/NZIjPASiyLOL5Jp0Ct3SkrbEAFqUntEiLtYX/yy9kK9J8lKTW2HH0arRNMNFh QkdiibcJkgY3T/AW6GUPlLH5x0qt+IW6NbROtBWEB7nctEqiHIx9ppd6Whcti7oCV5 Ku27iyZ3+Ax42gpfJEhvWLrMZHOPOpZC8bakvEJA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , "David S. Miller" , syzbot+7f23bcddf626e0593a39@syzkaller.appspotmail.com Subject: [PATCH 4.19 027/239] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() Date: Mon, 24 Jan 2022 19:41:05 +0100 Message-Id: <20220124183943.988707524@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski commit dded08927ca3c31a5c37f8e7f95fe98770475dd4 upstream. Syzbot detected a NULL pointer dereference of nfc_llcp_sock->dev pointer (which is a 'struct nfc_dev *') with calls to llcp_sock_sendmsg() after a failed llcp_sock_bind(). The message being sent is a SOCK_DGRAM. KASAN report: BUG: KASAN: null-ptr-deref in nfc_alloc_send_skb+0x2d/0xc0 Read of size 4 at addr 00000000000005c8 by task llcp_sock_nfc_a/899 CPU: 5 PID: 899 Comm: llcp_sock_nfc_a Not tainted 5.16.0-rc6-next-2021122= 4-00001-gc6437fbf18b0 #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/0= 1/2014 Call Trace: dump_stack_lvl+0x45/0x59 ? nfc_alloc_send_skb+0x2d/0xc0 __kasan_report.cold+0x117/0x11c ? mark_lock+0x480/0x4f0 ? nfc_alloc_send_skb+0x2d/0xc0 kasan_report+0x38/0x50 nfc_alloc_send_skb+0x2d/0xc0 nfc_llcp_send_ui_frame+0x18c/0x2a0 ? nfc_llcp_send_i_frame+0x230/0x230 ? __local_bh_enable_ip+0x86/0xe0 ? llcp_sock_connect+0x470/0x470 ? llcp_sock_connect+0x470/0x470 sock_sendmsg+0x8e/0xa0 ____sys_sendmsg+0x253/0x3f0 ... The issue was visible only with multiple simultaneous calls to bind() and sendmsg(), which resulted in most of the bind() calls to fail. The bind() was failing on checking if there is available WKS/SDP/SAP (respective bit in 'struct nfc_llcp_local' fields). When there was no available WKS/SDP/SAP, the bind returned error but the sendmsg() to such socket was able to trigger mentioned NULL pointer dereference of nfc_llcp_sock->dev. The code looks simply racy and currently it protects several paths against race with checks for (!nfc_llcp_sock->local) which is NULL-ified in error paths of bind(). The llcp_sock_sendmsg() did not have such check but called function nfc_llcp_send_ui_frame() had, although not protected with lock_sock(). Therefore the race could look like (same socket is used all the time): CPU0 CPU1 =3D=3D=3D=3D =3D=3D=3D=3D llcp_sock_bind() - lock_sock() - success - release_sock() - return 0 llcp_sock_sendmsg() - lock_sock() - release_sock() llcp_sock_bind(), same socket - lock_sock() - error - nfc_llcp_send_ui_frame() - if (!llcp_sock->local) - llcp_sock->local =3D NULL - nfc_put_device(dev) - dereference llcp_sock->dev - release_sock() - return -ERRNO The nfc_llcp_send_ui_frame() checked llcp_sock->local outside of the lock, which is racy and ineffective check. Instead, its caller llcp_sock_sendmsg(), should perform the check inside lock_sock(). Reported-and-tested-by: syzbot+7f23bcddf626e0593a39@syzkaller.appspotmail.c= om Fixes: b874dec21d1c ("NFC: Implement LLCP connection less Tx path") Cc: Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/nfc/llcp_sock.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -796,6 +796,11 @@ static int llcp_sock_sendmsg(struct sock =20 lock_sock(sk); =20 + if (!llcp_sock->local) { + release_sock(sk); + return -ENODEV; + } + if (sk->sk_type =3D=3D SOCK_DGRAM) { DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, msg->msg_name); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76A9DC4321E for ; Mon, 24 Jan 2022 19:22:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347805AbiAXTVk (ORCPT ); Mon, 24 Jan 2022 14:21:40 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:37484 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346476AbiAXTN1 (ORCPT ); Mon, 24 Jan 2022 14:13:27 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 503D2B81239; Mon, 24 Jan 2022 19:13:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7C8CEC340EA; Mon, 24 Jan 2022 19:13:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051605; bh=u3hqC005zgAfTeEBbqJI6R/01xzTbGJA4szGvz28xBg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TCdPrq/T5vHawUcLRoHMXr4o2aPD1e8izrfcibjtbnmCDhWqTTZDO8s3nxvYLRIZe R6LKhqSns+asEa6MDrtEJle6GfA7FwlZOsg7gg0/f3d6TC93C38G/3lItnWduFSbvm 5459k7klm4c9gcGVLwQkRej+0gtFc0wNvKbMbwiY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefan Riedmueller , Han Xu , Miquel Raynal Subject: [PATCH 4.19 028/239] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 Date: Mon, 24 Jan 2022 19:41:06 +0100 Message-Id: <20220124183944.021761016@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stefan Riedmueller commit aa1baa0e6c1aa4872e481dce4fc7fd6f3dd8496b upstream. There is no need to explicitly set the default gpmi clock rate during boot for the i.MX 6 since this is done during nand_detect anyway. Signed-off-by: Stefan Riedmueller Cc: stable@vger.kernel.org Acked-by: Han Xu Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20211102202022.15551-1-ceggers@arri= .de Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 9 --------- 1 file changed, 9 deletions(-) --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c @@ -612,15 +612,6 @@ static int gpmi_get_clks(struct gpmi_nan r->clock[i] =3D clk; } =20 - if (GPMI_IS_MX6(this)) - /* - * Set the default value for the gpmi clock. - * - * If you want to use the ONFI nand which is in the - * Synchronous Mode, you should change the clock as you need. - */ - clk_set_rate(r->clock[0], 22000000); - return 0; =20 err_clock: From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BEA0FC433EF for ; Mon, 24 Jan 2022 19:22:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349865AbiAXTVo (ORCPT ); Mon, 24 Jan 2022 14:21:44 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:39036 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347913AbiAXTNc (ORCPT ); Mon, 24 Jan 2022 14:13:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 69519B8122F; Mon, 24 Jan 2022 19:13:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 865FBC340E5; Mon, 24 Jan 2022 19:13:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051608; bh=vyqw9JCEbFyxhmvCDNiK7lJwnozf/joACBAFI2qbUfM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bA9Fy/3LDysX5pq5d4+XUJzJzf8Xm/etjfUvDvFcsi504WTZqLEopym7uPCkvwJNw Ygv/97n2BOHupuCbza+w14DTwfVnWJxSaEgKHjb5smILEZ2Rat3dt5pKx/VBGlh7KO d4gF0GHOwdYFYmMPIMMGfflmWR416qSWIlmOniwo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucas De Marchi , Bjorn Helgaas Subject: [PATCH 4.19 029/239] x86/gpu: Reserve stolen memory for first integrated Intel GPU Date: Mon, 24 Jan 2022 19:41:07 +0100 Message-Id: <20220124183944.052597788@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lucas De Marchi commit 9c494ca4d3a535f9ca11ad6af1813983c1c6cbdd upstream. "Stolen memory" is memory set aside for use by an Intel integrated GPU. The intel_graphics_quirks() early quirk reserves this memory when it is called for a GPU that appears in the intel_early_ids[] table of integrated GPUs. Previously intel_graphics_quirks() was marked as QFLAG_APPLY_ONCE, so it was called only for the first Intel GPU found. If a discrete GPU happened to be enumerated first, intel_graphics_quirks() was called for it but not for any integrated GPU found later. Therefore, stolen memory for such an integrated GPU was never reserved. For example, this problem occurs in this Alderlake-P (integrated) + DG2 (discrete) topology where the DG2 is found first, but stolen memory is associated with the integrated GPU: - 00:01.0 Bridge `- 03:00.0 DG2 discrete GPU - 00:02.0 Integrated GPU (with stolen memory) Remove the QFLAG_APPLY_ONCE flag and call intel_graphics_quirks() for every Intel GPU. Reserve stolen memory for the first GPU that appears in intel_early_ids[]. [bhelgaas: commit log, add code comment, squash in https://lore.kernel.org/r/20220118190558.2ququ4vdfjuahicm@ldmartin-desk2] Link: https://lore.kernel.org/r/20220114002843.2083382-1-lucas.demarchi@int= el.com Signed-off-by: Lucas De Marchi Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/kernel/early-quirks.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) --- a/arch/x86/kernel/early-quirks.c +++ b/arch/x86/kernel/early-quirks.c @@ -515,6 +515,7 @@ static const struct intel_early_ops gen1 .stolen_size =3D gen9_stolen_size, }; =20 +/* Intel integrated GPUs for which we need to reserve "stolen memory" */ static const struct pci_device_id intel_early_ids[] __initconst =3D { INTEL_I830_IDS(&i830_early_ops), INTEL_I845G_IDS(&i845_early_ops), @@ -584,6 +585,13 @@ static void __init intel_graphics_quirks u16 device; int i; =20 + /* + * Reserve "stolen memory" for an integrated GPU. If we've already + * found one, there's nothing to do for other (discrete) GPUs. + */ + if (resource_size(&intel_graphics_stolen_res)) + return; + device =3D read_pci_config_16(num, slot, func, PCI_DEVICE_ID); =20 for (i =3D 0; i < ARRAY_SIZE(intel_early_ids); i++) { @@ -696,7 +704,7 @@ static struct chipset early_qrk[] __init { PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST, PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check }, { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA, PCI_ANY_ID, - QFLAG_APPLY_ONCE, intel_graphics_quirks }, + 0, intel_graphics_quirks }, /* * HPET on the current version of the Baytrail platform has accuracy * problems: it will halt in deep idle state - so we disable it. From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 796B6C433FE for ; Tue, 25 Jan 2022 01:59:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3413445AbiAYAjH (ORCPT ); Mon, 24 Jan 2022 19:39:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57732 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2363970AbiAXXq1 (ORCPT ); Mon, 24 Jan 2022 18:46:27 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74898C061375; Mon, 24 Jan 2022 11:13:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EADAE612F5; Mon, 24 Jan 2022 19:13:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2506C36AF6; Mon, 24 Jan 2022 19:13:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051614; bh=mx9rIUd3VouY+JiiGn4HQCd3DlVSRSpLEkOm4VsenVg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yCcOpu//QqHej29vCRX3ExLzMIOJV2LJ/Ify47NR/jIoZvQrXEbJ69k2HNcX2RKBG 5IGk0aSMJCcTScnlL4NpVeBQY7VmCXzJQKIzYuBHX6LFjKtqmtpArfDXrIoKAZexDS IEgurjbZ2s+N6Tx/XXUC8jRBQ4oOLQ4idsOppEh8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Mateusz=20Jo=C5=84czyk?= , Nobuhiro Iwamatsu , Alessandro Zummo , Alexandre Belloni Subject: [PATCH 4.19 030/239] rtc: cmos: take rtc_lock while reading from CMOS Date: Mon, 24 Jan 2022 19:41:08 +0100 Message-Id: <20220124183944.083120302@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mateusz Jo=C5=84czyk commit 454f47ff464325223129b9b5b8d0b61946ec704d upstream. Reading from the CMOS involves writing to the index register and then reading from the data register. Therefore access to the CMOS has to be serialized with rtc_lock. This invocation of CMOS_READ was not serialized, which could cause trouble when other code is accessing CMOS at the same time. Use spin_lock_irq() like the rest of the function. Nothing in kernel modifies the RTC_DM_BINARY bit, so there could be a separate pair of spin_lock_irq() / spin_unlock_irq() before doing the math. Signed-off-by: Mateusz Jo=C5=84czyk Reviewed-by: Nobuhiro Iwamatsu Cc: Alessandro Zummo Cc: Alexandre Belloni Cc: stable@vger.kernel.org Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20211210200131.153887-2-mat.jonczyk@o2.pl Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/rtc/rtc-cmos.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/rtc/rtc-cmos.c +++ b/drivers/rtc/rtc-cmos.c @@ -467,7 +467,10 @@ static int cmos_set_alarm(struct device min =3D t->time.tm_min; sec =3D t->time.tm_sec; =20 + spin_lock_irq(&rtc_lock); rtc_control =3D CMOS_READ(RTC_CONTROL); + spin_unlock_irq(&rtc_lock); + if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) { /* Writing 0xff means "don't care" or "match all". */ mon =3D (mon <=3D 12) ? bin2bcd(mon) : 0xff; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0A68C41535 for ; Mon, 24 Jan 2022 19:22:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235042AbiAXTWL (ORCPT ); Mon, 24 Jan 2022 14:22:11 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:39126 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242600AbiAXTNk (ORCPT ); Mon, 24 Jan 2022 14:13:40 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B79B4B811FC; Mon, 24 Jan 2022 19:13:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC84BC340E5; Mon, 24 Jan 2022 19:13:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051617; bh=mzOXgJWu4huwItt9Jb9pt1M7G82FlnWck1CgOhpFlsE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=penyo4OWhPzqBwlqN66HFN5cMRa8hCZ4FyfqMNbTEKfgdp476HGwcrFP4r7G722F9 dM0ZMrFKtNqyJAvHpNEr4K+DPaYdGcG/M4lTFLAgyGUDv/0euCMFpTtcMqkF2VV68e JQK4gBrVEIlgbuoYHPiDEl8sphdexhPwe/oGko7k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 031/239] media: flexcop-usb: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:09 +0100 Message-Id: <20220124183944.116121404@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit cd1798a387825cc4a51282f5a611ad05bb1ad75f upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Note that the driver was multiplying some of the timeout values with HZ twice resulting in 3000-second timeouts with HZ=3D1000. Also note that two of the timeout defines are currently unused. Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device dr= iver") Cc: stable@vger.kernel.org # 3.0 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/b2c2/flexcop-usb.c | 10 +++++----- drivers/media/usb/b2c2/flexcop-usb.h | 12 ++++++------ 2 files changed, 11 insertions(+), 11 deletions(-) --- a/drivers/media/usb/b2c2/flexcop-usb.c +++ b/drivers/media/usb/b2c2/flexcop-usb.c @@ -86,7 +86,7 @@ static int flexcop_usb_readwrite_dw(stru 0, fc_usb->data, sizeof(u32), - B2C2_WAIT_FOR_OPERATION_RDW * HZ); + B2C2_WAIT_FOR_OPERATION_RDW); =20 if (ret !=3D sizeof(u32)) { err("error while %s dword from %d (%d).", read ? "reading" : @@ -154,7 +154,7 @@ static int flexcop_usb_v8_memory_req(str wIndex, fc_usb->data, buflen, - nWaitTime * HZ); + nWaitTime); if (ret !=3D buflen) ret =3D -EIO; =20 @@ -248,13 +248,13 @@ static int flexcop_usb_i2c_req(struct fl /* DKT 020208 - add this to support special case of DiSEqC */ case USB_FUNC_I2C_CHECKWRITE: pipe =3D B2C2_USB_CTRL_PIPE_OUT; - nWaitTime =3D 2; + nWaitTime =3D 2000; request_type |=3D USB_DIR_OUT; break; case USB_FUNC_I2C_READ: case USB_FUNC_I2C_REPEATREAD: pipe =3D B2C2_USB_CTRL_PIPE_IN; - nWaitTime =3D 2; + nWaitTime =3D 2000; request_type |=3D USB_DIR_IN; break; default: @@ -281,7 +281,7 @@ static int flexcop_usb_i2c_req(struct fl wIndex, fc_usb->data, buflen, - nWaitTime * HZ); + nWaitTime); =20 if (ret !=3D buflen) ret =3D -EIO; --- a/drivers/media/usb/b2c2/flexcop-usb.h +++ b/drivers/media/usb/b2c2/flexcop-usb.h @@ -91,13 +91,13 @@ typedef enum { UTILITY_SRAM_TESTVERIFY =3D 0x16, } flexcop_usb_utility_function_t; =20 -#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ) -#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ) +#define B2C2_WAIT_FOR_OPERATION_RW 1000 +#define B2C2_WAIT_FOR_OPERATION_RDW 3000 +#define B2C2_WAIT_FOR_OPERATION_WDW 1000 =20 -#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ) +#define B2C2_WAIT_FOR_OPERATION_V8READ 3000 +#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000 +#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000 =20 typedef enum { V8_MEMORY_PAGE_DVB_CI =3D 0x20, From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CF22C43219 for ; Mon, 24 Jan 2022 19:22:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344895AbiAXTWF (ORCPT ); Mon, 24 Jan 2022 14:22:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41294 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345871AbiAXTNm (ORCPT ); Mon, 24 Jan 2022 14:13:42 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1B2D56131E; Mon, 24 Jan 2022 19:13:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E27FEC340E5; Mon, 24 Jan 2022 19:13:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051620; bh=TKHdAe18EnCv1jjv/mi7ToHGM4RUPP9CaKAtUZa8NvQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NKK8D8YVxVBLYDkzJc9P0whTNBjapIAGCg1z3Lm3mRxczoqX+T4G5otD/Ab37dLq4 q6LlWUmPMRIeyA/Xxm6/LT8MLgexUNyR2HX31o+Ust0EF9dTRNMo5MPit4FmZU2dLF zTXPwAhccnx7fPmZCEE4uVGik0ZrwRT5UrDclKys= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 032/239] media: mceusb: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:10 +0100 Message-Id: <20220124183944.146935455@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 16394e998cbb050730536bdf7e89f5a70efbd974 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: stable@vger.kernel.org # 2.6.36 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/rc/mceusb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -1367,7 +1367,7 @@ static void mceusb_gen1_init(struct mceu */ ret =3D usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0), USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0, - data, USB_CTRL_MSG_SZ, HZ * 3); + data, USB_CTRL_MSG_SZ, 3000); dev_dbg(dev, "set address - ret =3D %d", ret); dev_dbg(dev, "set address - data[0] =3D %d, data[1] =3D %d", data[0], data[1]); @@ -1375,20 +1375,20 @@ static void mceusb_gen1_init(struct mceu /* set feature: bit rate 38400 bps */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), USB_REQ_SET_FEATURE, USB_TYPE_VENDOR, - 0xc04e, 0x0000, NULL, 0, HZ * 3); + 0xc04e, 0x0000, NULL, 0, 3000); =20 dev_dbg(dev, "set feature - ret =3D %d", ret); =20 /* bRequest 4: set char length to 8 bits */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), 4, USB_TYPE_VENDOR, - 0x0808, 0x0000, NULL, 0, HZ * 3); + 0x0808, 0x0000, NULL, 0, 3000); dev_dbg(dev, "set char length - retB =3D %d", ret); =20 /* bRequest 2: set handshaking to use DTR/DSR */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), 2, USB_TYPE_VENDOR, - 0x0000, 0x0100, NULL, 0, HZ * 3); + 0x0000, 0x0100, NULL, 0, 3000); dev_dbg(dev, "set handshake - retC =3D %d", ret); =20 /* device resume */ From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC9DEC433F5 for ; Mon, 24 Jan 2022 19:41:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355464AbiAXTla (ORCPT ); Mon, 24 Jan 2022 14:41:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51932 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348143AbiAXT3Z (ORCPT ); Mon, 24 Jan 2022 14:29:25 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E3A0C08E881; Mon, 24 Jan 2022 11:13:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1764760BFB; Mon, 24 Jan 2022 19:13:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02F00C340E5; Mon, 24 Jan 2022 19:13:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051623; bh=lDnMZdm1qIoBNi8zGpb9L19ogrWHp8r6Rf4WFn0gvus=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZWdQBpr4dXoOfLdqAfiYgVr1AuInPcd+krYj9KVptkkFCLtGdD7fXQpx+0THuCoux Le2rCVhSoBFOIPPOTi+OwFP6vxGlIXkIgEaKD8lFCwMeulkySfCAKPV2X/Eh4Cc825 0QR7H8DY+QpnJbHkz1aigb64uGq2x76WB9m5TAzE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 033/239] media: em28xx: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:11 +0100 Message-Id: <20220124183944.177318541@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: a6c2ba283565 ("[PATCH] v4l: 716: support for em28xx board family") Cc: stable@vger.kernel.org # 2.6.16 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/em28xx/em28xx-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/em28xx/em28xx-core.c +++ b/drivers/media/usb/em28xx/em28xx-core.c @@ -89,7 +89,7 @@ int em28xx_read_reg_req_len(struct em28x mutex_lock(&dev->ctrl_urb_lock); ret =3D usb_control_msg(udev, pipe, req, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, reg, dev->urb_buf, len, HZ); + 0x0000, reg, dev->urb_buf, len, 1000); if (ret < 0) { em28xx_regdbg("(pipe 0x%08x): IN: %02x %02x %02x %02x %02x %02x %02x %0= 2x failed with error %i\n", pipe, @@ -158,7 +158,7 @@ int em28xx_write_regs_req(struct em28xx memcpy(dev->urb_buf, buf, len); ret =3D usb_control_msg(udev, pipe, req, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, reg, dev->urb_buf, len, HZ); + 0x0000, reg, dev->urb_buf, len, 1000); mutex_unlock(&dev->ctrl_urb_lock); =20 if (ret < 0) { From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4BE7AC4167D for ; Mon, 24 Jan 2022 19:41:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355391AbiAXTlK (ORCPT ); Mon, 24 Jan 2022 14:41:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51952 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352027AbiAXT30 (ORCPT ); Mon, 24 Jan 2022 14:29:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38412C029818; Mon, 24 Jan 2022 11:13:49 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 004A5B81232; Mon, 24 Jan 2022 19:13:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A0CDC340E5; Mon, 24 Jan 2022 19:13:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051626; bh=jSDtslNoiyB+pHNp5QUV4hVr5+6MybxkHTQSJuJJGVw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ArxbN4MQVuQRuaUhLQpWVC1dLDrsakYCVpkyiyPQ1KEbDFYnVx5elxuWBQuvzy98l 1lG0EM5HauvHXTqWbW8OAhpDN5CTSyD/1HSc1ca0W8BKJBoyJidfjMJGf6CuUsbYCO gh9+h55DVCYQpfb/ryONdZ6wVK3mVVbfz9xWNnNs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 034/239] media: cpia2: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:12 +0100 Message-Id: <20220124183944.217550140@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 10729be03327f53258cb196362015ad5c6eabe02 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support") Cc: stable@vger.kernel.org # 2.6.17 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/cpia2/cpia2_usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/cpia2/cpia2_usb.c +++ b/drivers/media/usb/cpia2/cpia2_usb.c @@ -559,7 +559,7 @@ static int write_packet(struct usb_devic 0, /* index */ buf, /* buffer */ size, - HZ); + 1000); =20 kfree(buf); return ret; @@ -591,7 +591,7 @@ static int read_packet(struct usb_device 0, /* index */ buf, /* buffer */ size, - HZ); + 1000); =20 if (ret >=3D 0) memcpy(registers, buf, size); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A061C43217 for ; Mon, 24 Jan 2022 19:39:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353457AbiAXTjB (ORCPT ); Mon, 24 Jan 2022 14:39:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52328 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349068AbiAXTdM (ORCPT ); Mon, 24 Jan 2022 14:33:12 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF50AC0604E5; Mon, 24 Jan 2022 11:15:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7D30961318; Mon, 24 Jan 2022 19:15:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 57435C340E7; Mon, 24 Jan 2022 19:15:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051757; bh=GgOjZ/1tFz9VYO75zcEPMZcbTYbsMW2D7tZnPLdPDg0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q+wamm2EvVu/5gHRZ7veYclSLdjhwwaYkVUThRg0u2rVB397/B2kv1WzCSpTsyt3S dIl60YoL/VPkFL79HTfs0Ln9QnD8r/8fUkKXpvGvszTjk06CQoyrfAhtyZUDjOTT9K kQq5zh1teIoFH1tAXfu0EtCiLP6Lgx6+8pnOx5cA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 035/239] media: s2255: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:13 +0100 Message-Id: <20220124183944.257742940@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit f71d272ad4e354097020a4e6b1dc6e4b59feb50f upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Use the common control-message timeout define for the five-second timeouts. Fixes: 38f993ad8b1f ("V4L/DVB (8125): This driver adds support for the Sens= oray 2255 devices.") Cc: stable@vger.kernel.org # 2.6.27 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/s2255/s2255drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/s2255/s2255drv.c +++ b/drivers/media/usb/s2255/s2255drv.c @@ -1904,7 +1904,7 @@ static long s2255_vendor_req(struct s225 USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, Value, Index, buf, - TransferBufferLength, HZ * 5); + TransferBufferLength, USB_CTRL_SET_TIMEOUT); =20 if (r >=3D 0) memcpy(TransferBuffer, buf, TransferBufferLength); @@ -1913,7 +1913,7 @@ static long s2255_vendor_req(struct s225 r =3D usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE, Value, Index, buf, - TransferBufferLength, HZ * 5); + TransferBufferLength, USB_CTRL_SET_TIMEOUT); } kfree(buf); return r; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84D42C433EF for ; Mon, 24 Jan 2022 19:44:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344893AbiAXToI (ORCPT ); Mon, 24 Jan 2022 14:44:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352886AbiAXTbN (ORCPT ); Mon, 24 Jan 2022 14:31:13 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EC50FC028C2C; Mon, 24 Jan 2022 11:14:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8BADB612F3; Mon, 24 Jan 2022 19:14:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A1C6C340E5; Mon, 24 Jan 2022 19:14:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051652; bh=2oP2LDwVaJ0zFvAODpVplv81tT3l5LF8ATWXhfox+4U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d61HW+ive5VZEYoKLB96VbKVmfejX6JBAU0jTw30+rdXEqCjp5NLHJumRZBDfDLIX cWsdeQwvaM56fiRzxXyjqy97eQb5YaYrzLpaADjNkaj/9YLrzO+McA/1ZY0iC3xIW+ UIcfE6T1m1Va/X+C493Kd3QBT8wF9OY1Uy5j8du4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Kuron , Mauro Carvalho Chehab Subject: [PATCH 4.19 036/239] media: dib0700: fix undefined behavior in tuner shutdown Date: Mon, 24 Jan 2022 19:41:14 +0100 Message-Id: <20220124183944.289239575@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Kuron commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream. This fixes a problem where closing the tuner would leave it in a state where it would not tune to any channel when reopened. This problem was discovered as part of https://github.com/hselasky/webcamd/issues/16. Since adap->id is 0 or 1, this bit-shift overflows, which is undefined behavior. The driver still worked in practice as the overflow would in most environments result in 0, which rendered the line a no-op. When running the driver as part of webcamd however, the overflow could lead to 0xff due to optimizations by the compiler, which would, in the end, improperly shut down the tuner. The bug is a regression introduced in the commit referenced below. The present patch causes identical behavior to before that commit for adap->id equal to 0 or 1. The driver does not contain support for dib0700 devices with more adapters, assuming such even exist. Tests have been performed with the Xbox One Digital TV Tuner on amd64. Not all dib0700 devices are expected to be affected by the regression; this code path is only taken by those with incorrect endpoint numbers. Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5= bdd8201.1632689033.git.mchehab+huawei@kernel.org Cc: stable@vger.kernel.org Fixes: 7757ddda6f4f ("[media] DiB0700: add function to change I2C-speed") Signed-off-by: Michael Kuron Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/dvb-usb/dib0700_core.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -619,8 +619,6 @@ int dib0700_streaming_ctrl(struct dvb_us deb_info("the endpoint number (%i) is not correct, use the adapter id in= stead", adap->fe_adap[0].stream.props.endpoint); if (onoff) st->channel_state |=3D 1 << (adap->id); - else - st->channel_state |=3D 1 << ~(adap->id); } else { if (onoff) st->channel_state |=3D 1 << (adap->fe_adap[0].stream.props.endpoint-2); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A7F8C4332F for ; Mon, 24 Jan 2022 19:43:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355711AbiAXTnS (ORCPT ); Mon, 24 Jan 2022 14:43:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345943AbiAXTb3 (ORCPT ); Mon, 24 Jan 2022 14:31:29 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D172BC061A83; Mon, 24 Jan 2022 11:14:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 72D70612F4; Mon, 24 Jan 2022 19:14:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69F04C340E5; Mon, 24 Jan 2022 19:14:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051686; bh=Z+3gYJluckRbcTIpsFaWUA0l42oo2yBU1kbM0QAyt5w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hIbICPPq47JXHg9NM+iEn90meTYVv3QIo2OBrMg2G7Bp6ZZaYaqQPWoBeLfLG9FiP eC1dXaYkjh8tgecLL/St1wZWjjf4Bs+yBTnA+XSkKyKUekAu8BrbIkaTcde7ghFLa3 Lv5jAp+Z5uZ5GOQRdMWWByp9+ummV/DEVj4Russk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 037/239] media: redrat3: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:15 +0100 Message-Id: <20220124183944.320737070@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 2adc965c8bfa224e11ecccf9c92fd458c4236428 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device dr= iver") Cc: stable@vger.kernel.org # 3.0 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/rc/redrat3.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) --- a/drivers/media/rc/redrat3.c +++ b/drivers/media/rc/redrat3.c @@ -415,7 +415,7 @@ static int redrat3_send_cmd(int cmd, str udev =3D rr3->udev; res =3D usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), cmd, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - 0x0000, 0x0000, data, sizeof(u8), HZ * 10); + 0x0000, 0x0000, data, sizeof(u8), 10000); =20 if (res < 0) { dev_err(rr3->dev, "%s: Error sending rr3 cmd res %d, data %d", @@ -491,7 +491,7 @@ static u32 redrat3_get_timeout(struct re pipe =3D usb_rcvctrlpipe(rr3->udev, 0); ret =3D usb_control_msg(rr3->udev, pipe, RR3_GET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, HZ * 5); + RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, 5000); if (ret !=3D len) dev_warn(rr3->dev, "Failed to read timeout from hardware\n"); else { @@ -521,7 +521,7 @@ static int redrat3_set_timeout(struct rc ret =3D usb_control_msg(udev, usb_sndctrlpipe(udev, 0), RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, RR3_IR_IO_SIG_TIMEOUT, 0, timeout, sizeof(*timeout), - HZ * 25); + 25000); dev_dbg(dev, "set ir parm timeout %d ret 0x%02x\n", be32_to_cpu(*timeout), ret); =20 @@ -553,32 +553,32 @@ static void redrat3_reset(struct redrat3 *val =3D 0x01; rc =3D usb_control_msg(udev, rxpipe, RR3_RESET, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - RR3_CPUCS_REG_ADDR, 0, val, len, HZ * 25); + RR3_CPUCS_REG_ADDR, 0, val, len, 25000); dev_dbg(dev, "reset returned 0x%02x\n", rc); =20 *val =3D length_fuzz; rc =3D usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_LENGTH_FUZZ, 0, val, len, HZ * 25); + RR3_IR_IO_LENGTH_FUZZ, 0, val, len, 25000); dev_dbg(dev, "set ir parm len fuzz %d rc 0x%02x\n", *val, rc); =20 *val =3D (65536 - (minimum_pause * 2000)) / 256; rc =3D usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_MIN_PAUSE, 0, val, len, HZ * 25); + RR3_IR_IO_MIN_PAUSE, 0, val, len, 25000); dev_dbg(dev, "set ir parm min pause %d rc 0x%02x\n", *val, rc); =20 *val =3D periods_measure_carrier; rc =3D usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_PERIODS_MF, 0, val, len, HZ * 25); + RR3_IR_IO_PERIODS_MF, 0, val, len, 25000); dev_dbg(dev, "set ir parm periods measure carrier %d rc 0x%02x", *val, rc); =20 *val =3D RR3_DRIVER_MAXLENS; rc =3D usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_MAX_LENGTHS, 0, val, len, HZ * 25); + RR3_IR_IO_MAX_LENGTHS, 0, val, len, 25000); dev_dbg(dev, "set ir parm max lens %d rc 0x%02x\n", *val, rc); =20 kfree(val); @@ -596,7 +596,7 @@ static void redrat3_get_firmware_rev(str rc =3D usb_control_msg(rr3->udev, usb_rcvctrlpipe(rr3->udev, 0), RR3_FW_VERSION, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - 0, 0, buffer, RR3_FW_VERSION_LEN, HZ * 5); + 0, 0, buffer, RR3_FW_VERSION_LEN, 5000); =20 if (rc >=3D 0) dev_info(rr3->dev, "Firmware rev: %s", buffer); @@ -836,14 +836,14 @@ static int redrat3_transmit_ir(struct rc =20 pipe =3D usb_sndbulkpipe(rr3->udev, rr3->ep_out->bEndpointAddress); ret =3D usb_bulk_msg(rr3->udev, pipe, irdata, - sendbuf_len, &ret_len, 10 * HZ); + sendbuf_len, &ret_len, 10000); dev_dbg(dev, "sent %d bytes, (ret %d)\n", ret_len, ret); =20 /* now tell the hardware to transmit what we sent it */ pipe =3D usb_rcvctrlpipe(rr3->udev, 0); ret =3D usb_control_msg(rr3->udev, pipe, RR3_TX_SEND_SIGNAL, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - 0, 0, irdata, 2, HZ * 10); + 0, 0, irdata, 2, 10000); =20 if (ret < 0) dev_err(dev, "Error: control msg send failed, rc %d\n", ret); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A91E6C433EF for ; Mon, 24 Jan 2022 19:26:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350106AbiAXTYe (ORCPT ); Mon, 24 Jan 2022 14:24:34 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40470 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348429AbiAXTPX (ORCPT ); Mon, 24 Jan 2022 14:15:23 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C55D0B8121B; Mon, 24 Jan 2022 19:15:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 039C9C340E7; Mon, 24 Jan 2022 19:15:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051720; bh=V950xem1v9xwxVGnakH5w1P/y3OzfhnZwG553b3v7bk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZP+vERhJnBILPDEbmM3zwcFIJvIYTCPdSjH7QJ9n+7qY32CZTtjggqIXsvcFLEW6N pnyKrDs3TtMAigCAc+9M+ylDFR6Gpo/4uw0GJsEIwM8sBuWbonSNfkap0gdGyHlDUO MeRl0wLAT5plywy8K02YcoDG+QznbOSiJK8sWvDE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 038/239] media: pvrusb2: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:16 +0100 Message-Id: <20220124183944.352815291@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit b82bf9b9dc305d7d3d93eab106d70dbf2171b43e upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Cc: stable@vger.kernel.org # 2.6.18 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c @@ -1476,7 +1476,7 @@ static int pvr2_upload_firmware1(struct for (address =3D 0; address < fwsize; address +=3D 0x800) { memcpy(fw_ptr, fw_entry->data + address, 0x800); ret +=3D usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address, - 0, fw_ptr, 0x800, HZ); + 0, fw_ptr, 0x800, 1000); } =20 trace_firmware("Upload done, releasing device's CPU"); @@ -1614,7 +1614,7 @@ int pvr2_upload_firmware2(struct pvr2_hd ((u32 *)fw_ptr)[icnt] =3D swab32(((u32 *)fw_ptr)[icnt]); =20 ret |=3D usb_bulk_msg(hdw->usb_dev, pipe, fw_ptr,bcnt, - &actual_length, HZ); + &actual_length, 1000); ret |=3D (actual_length !=3D bcnt); if (ret) break; fw_done +=3D bcnt; @@ -3431,7 +3431,7 @@ void pvr2_hdw_cpufw_set_enabled(struct p 0xa0,0xc0, address,0, hdw->fw_buffer+address, - 0x800,HZ); + 0x800,1000); if (ret < 0) break; } =20 @@ -3970,7 +3970,7 @@ void pvr2_hdw_cpureset_assert(struct pvr /* Write the CPUCS register on the 8051. The lsb of the register is the reset bit; a 1 asserts reset while a 0 clears it. */ pipe =3D usb_sndctrlpipe(hdw->usb_dev, 0); - ret =3D usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,HZ); + ret =3D usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,1000); if (ret < 0) { pvr2_trace(PVR2_TRACE_ERROR_LEGS, "cpureset_assert(%d) error=3D%d",val,ret); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2310EC43217 for ; Mon, 24 Jan 2022 19:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350394AbiAXTYy (ORCPT ); Mon, 24 Jan 2022 14:24:54 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41504 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345749AbiAXTPj (ORCPT ); Mon, 24 Jan 2022 14:15:39 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 598C9612FC; Mon, 24 Jan 2022 19:15:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C495C340E5; Mon, 24 Jan 2022 19:15:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051738; bh=APWsZhwa5pVHhTAULT9fAjfDNrVdk3v3541Ngoypbog=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BWJlBjnP0nEHh2xgmzA+Yy9SPKBGYn+dE3szEc2zl+RQgQfPuRQ5uage/z9wt4c+L jVE7rFCB6nZ+xxujvAv15VZELMAYjaEHYhbXWxJpXScKnqvw8Ki+n7sKdJn9gfYUSG HYW9ek7bH2f7lv4+cchsfMxZ6SfEG8qWrrlOVKcE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 039/239] media: stk1160: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:17 +0100 Message-Id: <20220124183944.384759003@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replac= ement)") Cc: stable@vger.kernel.org # 3.7 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/stk1160/stk1160-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/stk1160/stk1160-core.c +++ b/drivers/media/usb/stk1160/stk1160-core.c @@ -75,7 +75,7 @@ int stk1160_read_reg(struct stk1160 *dev return -ENOMEM; ret =3D usb_control_msg(dev->udev, pipe, 0x00, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x00, reg, buf, sizeof(u8), HZ); + 0x00, reg, buf, sizeof(u8), 1000); if (ret < 0) { stk1160_err("read failed on reg 0x%x (%d)\n", reg, ret); @@ -95,7 +95,7 @@ int stk1160_write_reg(struct stk1160 *de =20 ret =3D usb_control_msg(dev->udev, pipe, 0x01, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - value, reg, NULL, 0, HZ); + value, reg, NULL, 0, 1000); if (ret < 0) { stk1160_err("write failed on reg 0x%x (%d)\n", reg, ret); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A2E4C4321E for ; Mon, 24 Jan 2022 19:26:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350455AbiAXTY5 (ORCPT ); Mon, 24 Jan 2022 14:24:57 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40686 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237442AbiAXTPo (ORCPT ); Mon, 24 Jan 2022 14:15:44 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 601EAB81238; Mon, 24 Jan 2022 19:15:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E90EC340F6; Mon, 24 Jan 2022 19:15:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051742; bh=gTiAsola0UWMwwPm3YlisJWsAT/oMqMZKVdHyRXMZh0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Aj4tcqTzhk4qx6Chu2TUgrf4Ox1BBkJRBFY2xL52SraFSbGbQuEzmNMsvCGBc1ei1 RdrqsPjdSxRZQ3Zq8xObWdQY9VTCzaUPfEB3t+S0oGyHB6txgSTKzrbgV4GW7z0Jc7 m78/GaTPJAfOe8IndmWx8LXhhjlEjDC/orVt5+1Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Marc Kleine-Budde Subject: [PATCH 4.19 040/239] can: softing_cs: softingcs_probe(): fix memleak on registration failure Date: Mon, 24 Jan 2022 19:41:18 +0100 Message-Id: <20220124183944.415549225@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit ced4913efb0acc844ed65cc01d091a85d83a2082 upstream. In case device registration fails during probe, the driver state and the embedded platform device structure needs to be freed using platform_device_put() to properly free all resources (e.g. the device name). Fixes: 0a0b7a5f7a04 ("can: add driver for Softing card") Link: https://lore.kernel.org/all/20211222104843.6105-1-johan@kernel.org Cc: stable@vger.kernel.org # 2.6.38 Signed-off-by: Johan Hovold Reviewed-by: Greg Kroah-Hartman Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/can/softing/softing_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/can/softing/softing_cs.c +++ b/drivers/net/can/softing/softing_cs.c @@ -304,7 +304,7 @@ static int softingcs_probe(struct pcmcia return 0; =20 platform_failed: - kfree(dev); + platform_device_put(pdev); mem_failed: pcmcia_bad: pcmcia_failed: From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E08FFC4167D for ; Mon, 24 Jan 2022 19:38:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347485AbiAXTiF (ORCPT ); Mon, 24 Jan 2022 14:38:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53186 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348693AbiAXTct (ORCPT ); Mon, 24 Jan 2022 14:32:49 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C732CC06175C; Mon, 24 Jan 2022 11:15:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 90A7BB81243; Mon, 24 Jan 2022 19:15:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A988EC36AF6; Mon, 24 Jan 2022 19:15:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051745; bh=klrBH5nyZMWKmNmb4becohaWwomwqQ1u6jORvNXAu9k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Oy/Z670zW4znsSM/XBGr4J71cWUGyTD6Rq3vRukApGuUBJ7XSz7W8CKQ0WLynOge+ cCMSrR7w7xv19ibZYuE3Z4Uz5p9b2K0GTEckPLH7+nKQPGxiBRN+w7oxKkQ1LpCaDK hQRsS/S6Iob9HsTflFjMg6UcXKBkFJvleDDvSd2M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Arnd Bergmann , Nick Desaulniers , Nathan Chancellor , Christophe Leroy Subject: [PATCH 4.19 041/239] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() Date: Mon, 24 Jan 2022 19:41:19 +0100 Message-Id: <20220124183944.447973032@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe Leroy commit bc93a22a19eb2b68a16ecf04cdf4b2ed65aaf398 upstream. On a kernel without CONFIG_STRICT_KERNEL_RWX, running EXEC_RODATA test leads to "Illegal instruction" failure. Looking at the content of rodata_objcopy.o, we see that the function content zeroes only: Disassembly of section .rodata: 0000000000000000 <.lkdtm_rodata_do_nothing>: 0: 00 00 00 00 .long 0x0 Add the contents flag in order to keep the content of the section while renaming it. Disassembly of section .rodata: 0000000000000000 <.lkdtm_rodata_do_nothing>: 0: 4e 80 00 20 blr Fixes: e9e08a07385e ("lkdtm: support llvm-objcopy") Cc: stable@vger.kernel.org Cc: Kees Cook Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Nick Desaulniers Cc: Nathan Chancellor Signed-off-by: Christophe Leroy Reviewed-by: Nick Desaulniers Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/8900731fbc05fb8b0de18af7133a8fc07c3c53a1.16= 33712176.git.christophe.leroy@csgroup.eu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/misc/lkdtm/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/misc/lkdtm/Makefile +++ b/drivers/misc/lkdtm/Makefile @@ -13,7 +13,7 @@ KCOV_INSTRUMENT_rodata.o :=3D n =20 OBJCOPYFLAGS :=3D OBJCOPYFLAGS_rodata_objcopy.o :=3D \ - --rename-section .noinstr.text=3D.rodata,alloc,readonly,load + --rename-section .noinstr.text=3D.rodata,alloc,readonly,load,contents targets +=3D rodata.o rodata_objcopy.o $(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE $(call if_changed,objcopy) From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BBCDBC43219 for ; Mon, 24 Jan 2022 19:26:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350496AbiAXTY7 (ORCPT ); Mon, 24 Jan 2022 14:24:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44916 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344692AbiAXTPt (ORCPT ); Mon, 24 Jan 2022 14:15:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 05CD960BB9; Mon, 24 Jan 2022 19:15:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC8A8C340E5; Mon, 24 Jan 2022 19:15:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051748; bh=LcFHXWk/CJPMEDuKn4mpuc4FpGa3nt8Tz577qgyfW3U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=apOfZAbSQFfof1K7jEW1K2xwNq6+9/6uBjng15LYHnSY5sJ6E+0iT1Lci61czOmOb vhU2HQ/JTOYUsxFLloX/YmlR/5b/8e+a1BNO4DRPx5Zi/TA2jzOgKzqCAeO49lKGiB Eyj5hN5tIJP731pSYe40mzDNxxI8mq+jwpoWfMnI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sam Bingner , Yifeng Li , Bjorn Helgaas , =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Subject: [PATCH 4.19 042/239] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller Date: Mon, 24 Jan 2022 19:41:20 +0100 Message-Id: <20220124183944.479480458@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Yifeng Li commit e445375882883f69018aa669b67cbb37ec873406 upstream. Like other SATA controller chips in the Marvell 88SE91xx series, the Marvell 88SE9125 has the same DMA requester ID hardware bug that prevents it from working under IOMMU. Add it to the list of devices that need the quirk. Without this patch, device initialization fails with DMA errors: ata8: softreset failed (1st FIS failed) DMAR: DRHD: handling fault status reg 2 DMAR: [DMA Write NO_PASID] Request device [03:00.1] fault addr 0xfffc0000= [fault reason 0x02] Present bit in context entry is clear DMAR: DRHD: handling fault status reg 2 DMAR: [DMA Read NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 = [fault reason 0x02] Present bit in context entry is clear After applying the patch, the controller can be successfully initialized: ata8: SATA link up 1.5 Gbps (SStatus 113 SControl 330) ata8.00: ATAPI: PIONEER BD-RW BDR-207M, 1.21, max UDMA/100 ata8.00: configured for UDMA/100 scsi 7:0:0:0: CD-ROM PIONEER BD-RW BDR-207M 1.21 PQ: 0 ANSI= : 5 Link: https://lore.kernel.org/r/YahpKVR+McJVDdkD@work Reported-by: Sam Bingner Tested-by: Sam Bingner Tested-by: Yifeng Li Signed-off-by: Yifeng Li Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Wilczy=C5=84ski Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pci/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -4040,6 +4040,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_M quirk_dma_func1_alias); DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123, quirk_dma_func1_alias); +/* https://bugzilla.kernel.org/show_bug.cgi?id=3D42679#c136 */ +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125, + quirk_dma_func1_alias); DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128, quirk_dma_func1_alias); /* https://bugzilla.kernel.org/show_bug.cgi?id=3D42679#c14 */ From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87267C433F5 for ; Mon, 24 Jan 2022 19:38:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346633AbiAXTie (ORCPT ); Mon, 24 Jan 2022 14:38:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53234 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348775AbiAXTdA (ORCPT ); Mon, 24 Jan 2022 14:33:00 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BF83C0604D4; Mon, 24 Jan 2022 11:15:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4252C61323; Mon, 24 Jan 2022 19:15:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A885C340E5; Mon, 24 Jan 2022 19:15:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051751; bh=ey1cT2WnF88VZ1H4BLhpk1c8POyCN/NKp1M7fvvKU6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yQpvj7uTDu2GFMYFmHYc72PrQAONV3gA3MXSnaZwfxFgODjLjpoxhhIwWsh0NmJxx aHc5xzu8qlKIDH1ebwTS/Dfz90lmDIfbxAKVEXr+WE7GihPOeKXuhqjbBRunNuiafi r6a+wBh0lcynNZf190mlIlSQ/f4h3Ftd6XrIpIwY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gang Li , Muchun Song , "Kirill A. Shutemov" , Hugh Dickins , Andrew Morton , Linus Torvalds Subject: [PATCH 4.19 043/239] shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Date: Mon, 24 Jan 2022 19:41:21 +0100 Message-Id: <20220124183944.509500256@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gang Li commit 62c9827cbb996c2c04f615ecd783ce28bcea894b upstream. Fix a data race in commit 779750d20b93 ("shmem: split huge pages beyond i_size under memory pressure"). Here are call traces causing race: Call Trace 1: shmem_unused_huge_shrink+0x3ae/0x410 ? __list_lru_walk_one.isra.5+0x33/0x160 super_cache_scan+0x17c/0x190 shrink_slab.part.55+0x1ef/0x3f0 shrink_node+0x10e/0x330 kswapd+0x380/0x740 kthread+0xfc/0x130 ? mem_cgroup_shrink_node+0x170/0x170 ? kthread_create_on_node+0x70/0x70 ret_from_fork+0x1f/0x30 Call Trace 2: shmem_evict_inode+0xd8/0x190 evict+0xbe/0x1c0 do_unlinkat+0x137/0x330 do_syscall_64+0x76/0x120 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 A simple explanation: Image there are 3 items in the local list (@list). In the first traversal, A is not deleted from @list. 1) A->B->C ^ | pos (leave) In the second traversal, B is deleted from @list. Concurrently, A is deleted from @list through shmem_evict_inode() since last reference counter of inode is dropped by other thread. Then the @list is corrupted. 2) A->B->C ^ ^ | | evict pos (drop) We should make sure the inode is either on the global list or deleted from any local list before iput(). Fixed by moving inodes back to global list before we put them. [akpm@linux-foundation.org: coding style fixes] Link: https://lkml.kernel.org/r/20211125064502.99983-1-ligang.bdlg@bytedanc= e.com Fixes: 779750d20b93 ("shmem: split huge pages beyond i_size under memory pr= essure") Signed-off-by: Gang Li Reviewed-by: Muchun Song Acked-by: Kirill A. Shutemov Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- mm/shmem.c | 37 +++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-) --- a/mm/shmem.c +++ b/mm/shmem.c @@ -451,7 +451,7 @@ static unsigned long shmem_unused_huge_s struct shmem_inode_info *info; struct page *page; unsigned long batch =3D sc ? sc->nr_to_scan : 128; - int removed =3D 0, split =3D 0; + int split =3D 0; =20 if (list_empty(&sbinfo->shrinklist)) return SHRINK_STOP; @@ -466,7 +466,6 @@ static unsigned long shmem_unused_huge_s /* inode is about to be evicted */ if (!inode) { list_del_init(&info->shrinklist); - removed++; goto next; } =20 @@ -474,12 +473,12 @@ static unsigned long shmem_unused_huge_s if (round_up(inode->i_size, PAGE_SIZE) =3D=3D round_up(inode->i_size, HPAGE_PMD_SIZE)) { list_move(&info->shrinklist, &to_remove); - removed++; goto next; } =20 list_move(&info->shrinklist, &list); next: + sbinfo->shrinklist_len--; if (!--batch) break; } @@ -499,7 +498,7 @@ next: inode =3D &info->vfs_inode; =20 if (nr_to_split && split >=3D nr_to_split) - goto leave; + goto move_back; =20 page =3D find_get_page(inode->i_mapping, (inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT); @@ -513,38 +512,44 @@ next: } =20 /* - * Leave the inode on the list if we failed to lock - * the page at this time. + * Move the inode on the list back to shrinklist if we failed + * to lock the page at this time. * * Waiting for the lock may lead to deadlock in the * reclaim path. */ if (!trylock_page(page)) { put_page(page); - goto leave; + goto move_back; } =20 ret =3D split_huge_page(page); unlock_page(page); put_page(page); =20 - /* If split failed leave the inode on the list */ + /* If split failed move the inode on the list back to shrinklist */ if (ret) - goto leave; + goto move_back; =20 split++; drop: list_del_init(&info->shrinklist); - removed++; -leave: + goto put; +move_back: + /* + * Make sure the inode is either on the global list or deleted + * from any local list before iput() since it could be deleted + * in another thread once we put the inode (then the local list + * is corrupted). + */ + spin_lock(&sbinfo->shrinklist_lock); + list_move(&info->shrinklist, &sbinfo->shrinklist); + sbinfo->shrinklist_len++; + spin_unlock(&sbinfo->shrinklist_lock); +put: iput(inode); } =20 - spin_lock(&sbinfo->shrinklist_lock); - list_splice_tail(&list, &sbinfo->shrinklist); - sbinfo->shrinklist_len -=3D removed; - spin_unlock(&sbinfo->shrinklist_lock); - return split; } =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3C08C4167D for ; Mon, 24 Jan 2022 19:26:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350587AbiAXTZF (ORCPT ); Mon, 24 Jan 2022 14:25:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:45032 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239566AbiAXTP4 (ORCPT ); Mon, 24 Jan 2022 14:15:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 708BB61317; Mon, 24 Jan 2022 19:15:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D605C340E5; Mon, 24 Jan 2022 19:15:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051754; bh=/Gj1MDv8sM9owJBcEAcALK1JjHW1CPfyWYHiZcDL3A4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=E9WloB8O6S+FZQvzR5LEThj66CRx2mYlX/8eM8l9f5w2Qy9ZbuLK+vQ0D3Wquj590 LCuAQhvBYn/pRYg7yNfYDVPhtfdfz5lG7Vk9n0pnj+Yl4WEtDxR93p/irFVJ1WIpKB yjYKL5J9jn1cPe7J2HWl2G7/JoWsjCa5KFF08BF4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brian Norris , Sam Ravnborg , Sasha Levin Subject: [PATCH 4.19 044/239] drm/panel: innolux-p079zca: Delete panel on attach() failure Date: Mon, 24 Jan 2022 19:41:22 +0100 Message-Id: <20220124183944.541633116@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Brian Norris [ Upstream commit 32a267e9c057e1636e7afdd20599aa5741a73079 ] If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't ready), we leave a dangling drm_panel reference to freed memory. Clean that up on failure. This problem exists since the driver's introduction, but is especially relevant after refactored for dual-DSI variants. Fixes: 14c8f2e9f8ea ("drm/panel: add Innolux P079ZCA panel driver") Fixes: 7ad4e4636c54 ("drm/panel: p079zca: Refactor panel driver to support = multiple panels") Signed-off-by: Brian Norris Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20210923173336.2.I9023c= f8811a3abf4964ed84eb681721d8bb489d6@changeid Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/dr= m/panel/panel-innolux-p079zca.c index 88c7d035ace66..362ff5555d2e7 100644 --- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c +++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c @@ -512,6 +512,7 @@ static void innolux_panel_del(struct innolux_panel *inn= olux) static int innolux_panel_probe(struct mipi_dsi_device *dsi) { const struct panel_desc *desc; + struct innolux_panel *innolux; int err; =20 desc =3D of_device_get_match_data(&dsi->dev); @@ -523,7 +524,14 @@ static int innolux_panel_probe(struct mipi_dsi_device = *dsi) if (err < 0) return err; =20 - return mipi_dsi_attach(dsi); + err =3D mipi_dsi_attach(dsi); + if (err < 0) { + innolux =3D mipi_dsi_get_drvdata(dsi); + innolux_panel_del(innolux); + return err; + } + + return 0; } =20 static int innolux_panel_remove(struct mipi_dsi_device *dsi) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99453C4167E for ; Mon, 24 Jan 2022 19:41:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242845AbiAXTkf (ORCPT ); Mon, 24 Jan 2022 14:40:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352901AbiAXTbO (ORCPT ); Mon, 24 Jan 2022 14:31:14 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1F311C028C31; Mon, 24 Jan 2022 11:14:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B1AD260917; Mon, 24 Jan 2022 19:14:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FD49C340E5; Mon, 24 Jan 2022 19:14:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051655; bh=mhPuVfgRFd2RapL/z1cdkOW64XqvZopmkecBub3MIng=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HjsqYz1FdDjhsLklY47MDvWJ/wX0YosZxgchYxqnJmL0Cy2lKU/5IdbZG87zsHm1h PRaDyxdE6nj81JZwR02rQs/ji+3gZSsE5A30tW3QkZb/9375XnFFNYNEt1Lu79xT5K FqlkuLOIvg7/5UAg31aNpGJEUZiSdHOnxmCwAkts= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.19 045/239] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Date: Mon, 24 Jan 2022 19:41:23 +0100 Message-Id: <20220124183944.571590635@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Hai [ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ] I got a kernel BUG report when doing fault injection test: Reported-by: Hulk Robot Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:45! ... RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d ... Call Trace: proto_unregister+0x83/0x220 cmtp_cleanup_sockets+0x37/0x40 [cmtp] cmtp_exit+0xe/0x1f [cmtp] do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns success. This will cause a kernel bug when accessing uncreated ctmp related data when the module exits. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin --- net/bluetooth/cmtp/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index 9873684a9d8ff..4764ed73f33bf 100644 --- a/net/bluetooth/cmtp/core.c +++ b/net/bluetooth/cmtp/core.c @@ -499,9 +499,7 @@ static int __init cmtp_init(void) { BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION); =20 - cmtp_init_sockets(); - - return 0; + return cmtp_init_sockets(); } =20 static void __exit cmtp_exit(void) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F8C3C35270 for ; Mon, 24 Jan 2022 19:22:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347106AbiAXTWc (ORCPT ); Mon, 24 Jan 2022 14:22:32 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:39916 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346648AbiAXTOV (ORCPT ); Mon, 24 Jan 2022 14:14:21 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 99F53B81240; Mon, 24 Jan 2022 19:14:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98867C340E8; Mon, 24 Jan 2022 19:14:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051658; bh=eiiBgW+XxpwQNWaaPPOzfBVjpsZcwzuTbsm/oHVuOQw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=c/2XDkSXtnIJQwYjowF/JImJ1UmvWCqDpyhUx+iO7MqKk7uF/uaKPp1tLfNa3CtFA uG7CMUl3KvURHO1wOEzBE4dUMWcoTf1p+36PMRwkaZ/NRgsfMOMzuYD8IbcHl/piGf Of9PEzYs0t7F1Pahxwo0vxunGXXWi0JAQjkm5Xek= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxime Ripard , Stephen Boyd , Nicolas Saenz Julienne , Michael Stapelberg , Sasha Levin Subject: [PATCH 4.19 046/239] clk: bcm-2835: Pick the closest clock rate Date: Mon, 24 Jan 2022 19:41:24 +0100 Message-Id: <20220124183944.601337955@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maxime Ripard [ Upstream commit 5517357a4733d7cf7c17fc79d0530cfa47add372 ] The driver currently tries to pick the closest rate that is lower than the rate being requested. This causes an issue with clk_set_min_rate() since it actively checks for the rounded rate to be above the minimum that was just set. Let's change the logic a bit to pick the closest rate to the requested rate, no matter if it's actually higher or lower. Fixes: 6d18b8adbe67 ("clk: bcm2835: Support for clock parent selection") Signed-off-by: Maxime Ripard Acked-by: Stephen Boyd Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne # boot and basic func= tionality Tested-by: Michael Stapelberg Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-= 2-maxime@cerno.tech Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/clk/bcm/clk-bcm2835.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c index e4fee233849d2..b14aa9ddd9456 100644 --- a/drivers/clk/bcm/clk-bcm2835.c +++ b/drivers/clk/bcm/clk-bcm2835.c @@ -1199,7 +1199,7 @@ static int bcm2835_clock_determine_rate(struct clk_hw= *hw, rate =3D bcm2835_clock_choose_div_and_prate(hw, i, req->rate, &div, &prate, &avgrate); - if (rate > best_rate && rate <=3D req->rate) { + if (abs(req->rate - rate) < abs(req->rate - best_rate)) { best_parent =3D parent; best_prate =3D prate; best_rate =3D rate; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B6B6C433F5 for ; Mon, 24 Jan 2022 19:22:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347754AbiAXTWh (ORCPT ); Mon, 24 Jan 2022 14:22:37 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:39968 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344966AbiAXTOY (ORCPT ); Mon, 24 Jan 2022 14:14:24 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BEC00B8122C; Mon, 24 Jan 2022 19:14:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2BC4C340E8; Mon, 24 Jan 2022 19:14:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051661; bh=itRsrbdPtq5naXO7FpQgj9HMS4CyX4drNFJAl/zuj1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x2n7nx5WlBayHqkcheHhrqHzPfIgkU5EaL3TIWUe3M8WHF0rnbLL8cOMh73eg+khJ B1oGtqZz1Hj4gppkrHp7+F0S0XARj8mCubRm76EM0H3N7fNZW9op6+aE+ZeBP26foS dKzjpUl+besAqA4BizykvspdtMhjAoNvek+PERUE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxime Ripard , Stephen Boyd , Nicolas Saenz Julienne , Michael Stapelberg , Sasha Levin Subject: [PATCH 4.19 047/239] clk: bcm-2835: Remove rounding up the dividers Date: Mon, 24 Jan 2022 19:41:25 +0100 Message-Id: <20220124183944.634413447@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maxime Ripard [ Upstream commit 8ca011ef4af48a7af7b15afd8a4a44039dd04cea ] The driver, once it found a divider, tries to round it up by increasing the least significant bit of the fractional part by one when the round_up argument is set and there's a remainder. However, since it increases the divider it will actually reduce the clock rate below what we were asking for, leading to issues with clk_set_min_rate() that will complain that our rounded clock rate is below the minimum of the rate. Since the dividers are fairly precise already, let's remove that part so that we can have clk_set_min_rate() working. This is effectively a revert of 9c95b32ca093 ("clk: bcm2835: add a round up ability to the clock divisor"). Fixes: 9c95b32ca093 ("clk: bcm2835: add a round up ability to the clock div= isor") Signed-off-by: Maxime Ripard Acked-by: Stephen Boyd Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne # boot and basic func= tionality Tested-by: Michael Stapelberg Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-= 3-maxime@cerno.tech Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/clk/bcm/clk-bcm2835.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c index b14aa9ddd9456..fd78dd5356ed7 100644 --- a/drivers/clk/bcm/clk-bcm2835.c +++ b/drivers/clk/bcm/clk-bcm2835.c @@ -915,8 +915,7 @@ static int bcm2835_clock_is_on(struct clk_hw *hw) =20 static u32 bcm2835_clock_choose_div(struct clk_hw *hw, unsigned long rate, - unsigned long parent_rate, - bool round_up) + unsigned long parent_rate) { struct bcm2835_clock *clock =3D bcm2835_clock_from_hw(hw); const struct bcm2835_clock_data *data =3D clock->data; @@ -928,10 +927,6 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw, =20 rem =3D do_div(temp, rate); div =3D temp; - - /* Round up and mask off the unused bits */ - if (round_up && ((div & unused_frac_mask) !=3D 0 || rem !=3D 0)) - div +=3D unused_frac_mask + 1; div &=3D ~unused_frac_mask; =20 /* different clamping limits apply for a mash clock */ @@ -1062,7 +1057,7 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw, struct bcm2835_clock *clock =3D bcm2835_clock_from_hw(hw); struct bcm2835_cprman *cprman =3D clock->cprman; const struct bcm2835_clock_data *data =3D clock->data; - u32 div =3D bcm2835_clock_choose_div(hw, rate, parent_rate, false); + u32 div =3D bcm2835_clock_choose_div(hw, rate, parent_rate); u32 ctl; =20 spin_lock(&cprman->regs_lock); @@ -1113,7 +1108,7 @@ static unsigned long bcm2835_clock_choose_div_and_pra= te(struct clk_hw *hw, =20 if (!(BIT(parent_idx) & data->set_rate_parent)) { *prate =3D clk_hw_get_rate(parent); - *div =3D bcm2835_clock_choose_div(hw, rate, *prate, true); + *div =3D bcm2835_clock_choose_div(hw, rate, *prate); =20 *avgrate =3D bcm2835_clock_rate_from_divisor(clock, *prate, *div); =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60F24C433EF for ; Mon, 24 Jan 2022 19:23:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348221AbiAXTXo (ORCPT ); Mon, 24 Jan 2022 14:23:44 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40006 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346733AbiAXTO3 (ORCPT ); Mon, 24 Jan 2022 14:14:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BECF7B81215; Mon, 24 Jan 2022 19:14:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02254C340E5; Mon, 24 Jan 2022 19:14:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051664; bh=p0Cnf3znkraPCt4x9KOiFNhs/tkGgmGpZ0kwQ9xYIz8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oXLeKPFEEAKKKX6Soq9vPKbyC1uNGMB6XKTFcHK2fl26JfbMPfB7HGQbcofqBuG6/ /X2s25sd+ugkQk8fCZYtHxtuDZk0Rs+50DOz0ZWSNGX+iPJp6F8OoSEtiMR15tlhyl 4j3ZOQUoCKVTs0xkVmxJMzjOXNQZgrfxR1B6Wq5A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bryan ODonoghue , Kalle Valo , Sasha Levin Subject: [PATCH 4.19 048/239] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND Date: Mon, 24 Jan 2022 19:41:26 +0100 Message-Id: <20220124183944.666314390@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bryan O'Donoghue [ Upstream commit 588b45c88ae130fe373a8c50edaf54735c3f4fe3 ] Firmware can trigger a missed beacon indication, this is not the same as a lost signal. Flag to Linux the missed beacon and let the WiFi stack decide for itself if the link is up or down by sending its own probe to determine this. We should only be signalling the link is lost when the firmware indicates Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680= hardware") Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20211027232529.657764-1-bryan.odonoghue@lin= aro.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/ath/wcn36xx/smd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/= ath/wcn36xx/smd.c index e75c1cfd85e63..741a830d9773b 100644 --- a/drivers/net/wireless/ath/wcn36xx/smd.c +++ b/drivers/net/wireless/ath/wcn36xx/smd.c @@ -2311,7 +2311,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36= xx *wcn, wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n", tmp->bss_index); vif =3D wcn36xx_priv_to_vif(tmp); - ieee80211_connection_loss(vif); + ieee80211_beacon_loss(vif); } return 0; } @@ -2326,7 +2326,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36= xx *wcn, wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n", rsp->bss_index); vif =3D wcn36xx_priv_to_vif(tmp); - ieee80211_connection_loss(vif); + ieee80211_beacon_loss(vif); return 0; } } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26204C433EF for ; Mon, 24 Jan 2022 19:22:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345781AbiAXTWm (ORCPT ); Mon, 24 Jan 2022 14:22:42 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43854 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346734AbiAXTO3 (ORCPT ); Mon, 24 Jan 2022 14:14:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4631D60909; Mon, 24 Jan 2022 19:14:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 125A4C340E5; Mon, 24 Jan 2022 19:14:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051667; bh=d23pXWXux0b/sd/FDTFAvhlEPzSEJl7kdCJKVQtmT4w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bupGS98cprj20EDkHsJ9BIk7u05Cgi0EyP+V24EXQZLOZFGd5CeaTUMdj+EnYSo3f ++YtFKttyEMMrU3xfcB8AYAAx3KyWrSZ/hlLd3R7mqUbFuRomUVxc167fhzoBqrb6C c0zvrg+zVn6DLvbhgOcDJEKUNUrOnp46CG3UoZ74= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bryan ODonoghue , Kalle Valo , Sasha Levin Subject: [PATCH 4.19 049/239] wcn36xx: Release DMA channel descriptor allocations Date: Mon, 24 Jan 2022 19:41:27 +0100 Message-Id: <20220124183944.697627697@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bryan O'Donoghue [ Upstream commit 3652096e5263ad67604b0323f71d133485f410e5 ] When unloading the driver we are not releasing the DMA descriptors which we previously allocated. Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680= hardware") Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20211105122152.1580542-3-bryan.odonoghue@li= naro.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/ath/wcn36xx/dxe.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/= ath/wcn36xx/dxe.c index 657525988d1ee..38eef1579db2d 100644 --- a/drivers/net/wireless/ath/wcn36xx/dxe.c +++ b/drivers/net/wireless/ath/wcn36xx/dxe.c @@ -954,4 +954,9 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn) =20 wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch); wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch); + + wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_l_ch); + wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_h_ch); + wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_l_ch); + wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_h_ch); } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 846B1C433F5 for ; Mon, 24 Jan 2022 19:29:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231531AbiAXT3E (ORCPT ); Mon, 24 Jan 2022 14:29:04 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43896 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347071AbiAXTOc (ORCPT ); Mon, 24 Jan 2022 14:14:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 762CF6090A; Mon, 24 Jan 2022 19:14:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D7BBC340E5; Mon, 24 Jan 2022 19:14:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051670; bh=d4twU/xt8Evsjk78l3La49ircXkQ1OuoTKgMSn0/0D8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TPrR0ymUlNpdCeeCTRMIkuxzExjbLgoJhXsAImRBii6tr1GrnwhhhOmccNXjh+FrZ Rk45hLiaOTJAprlOR2PjeMgVrX7ZWzPFvdRyifSHRl/ScuArQyVKqSVS28vQtJCMm5 8zXPhOMx5iPLt5Y3u8JQbsb5fA/pOpUmCAYkG4rk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dillon Min , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 050/239] media: videobuf2: Fix the size printk format Date: Mon, 24 Jan 2022 19:41:28 +0100 Message-Id: <20220124183944.727868893@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dillon Min [ Upstream commit c9ee220d76775e42f35d634479c978d9350077d3 ] Since the type of parameter size is unsigned long, it should printk by %lu, instead of %ld, fix it. Fixes: 7952be9b6ece ("media: drivers/media/common/videobuf2: rename from vi= deobuf") Signed-off-by: Dillon Min Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/common/videobuf2/videobuf2-dma-contig.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/driver= s/media/common/videobuf2/videobuf2-dma-contig.c index aff0ab7bf83d5..bbd5716d4c9cb 100644 --- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c +++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c @@ -154,7 +154,7 @@ static void *vb2_dc_alloc(struct device *dev, unsigned = long attrs, buf->cookie =3D dma_alloc_attrs(dev, size, &buf->dma_addr, GFP_KERNEL | gfp_flags, buf->attrs); if (!buf->cookie) { - dev_err(dev, "dma_alloc_coherent of size %ld failed\n", size); + dev_err(dev, "dma_alloc_coherent of size %lu failed\n", size); kfree(buf); return ERR_PTR(-ENOMEM); } @@ -206,9 +206,9 @@ static int vb2_dc_mmap(void *buf_priv, struct vm_area_s= truct *vma) =20 vma->vm_ops->open(vma); =20 - pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %ld\n", - __func__, (unsigned long)buf->dma_addr, vma->vm_start, - buf->size); + pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %lu\n", + __func__, (unsigned long)buf->dma_addr, vma->vm_start, + buf->size); =20 return 0; } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CDDAC433EF for ; Mon, 24 Jan 2022 19:43:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344318AbiAXTng (ORCPT ); Mon, 24 Jan 2022 14:43:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51954 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345683AbiAXTb3 (ORCPT ); Mon, 24 Jan 2022 14:31:29 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 97428C028BE3; Mon, 24 Jan 2022 11:14:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 54FC7B81235; Mon, 24 Jan 2022 19:14:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 696EFC340E5; Mon, 24 Jan 2022 19:14:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051674; bh=25Ko4hpiWyy/zvu15EXPbYLOPKyb4DyarnzWm4qNq5I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mkg9+6uegJMj4yEP6PdvYLvLhWME6uMKRFscxs4aHZTIqXi5Zuz47cv7zRNMHcpB1 W+QWIYVbwDFZ6IEPkJ6m4olNjc0a9tGdJ5BTFUocw4BT9TRu/Zs92HfMT3OOvL9ezT m1GCDzHMaXCgKmhbvt1pesgWuvVSnocW7Rer/yw4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Dongliang Mu , syzkaller , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 051/239] media: em28xx: fix memory leak in em28xx_init_dev Date: Mon, 24 Jan 2022 19:41:29 +0100 Message-Id: <20220124183944.759591047@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dongliang Mu [ Upstream commit 22be5a10d0b24eec9e45decd15d7e6112b25f080 ] In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails to deallocate the media_dev allocated in the em28xx_media_device_init. Fix this by adding em28xx_unregister_media_device to free media_dev. BTW, this patch is tested in my local syzkaller instance, and it can prevent the memory leak from occurring again. CC: Pavel Skripkin Fixes: 37ecc7b1278f ("[media] em28xx: add media controller support") Signed-off-by: Dongliang Mu Reported-by: syzkaller Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/em28xx/em28xx-cards.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em= 28xx/em28xx-cards.c index ec608f60d2c75..06da08f8efdb1 100644 --- a/drivers/media/usb/em28xx/em28xx-cards.c +++ b/drivers/media/usb/em28xx/em28xx-cards.c @@ -3515,8 +3515,10 @@ static int em28xx_init_dev(struct em28xx *dev, struc= t usb_device *udev, =20 if (dev->is_audio_only) { retval =3D em28xx_audio_setup(dev); - if (retval) - return -ENODEV; + if (retval) { + retval =3D -ENODEV; + goto err_deinit_media; + } em28xx_init_extension(dev); =20 return 0; @@ -3535,7 +3537,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct= usb_device *udev, dev_err(&dev->intf->dev, "%s: em28xx_i2c_register bus 0 - error [%d]!\n", __func__, retval); - return retval; + goto err_deinit_media; } =20 /* register i2c bus 1 */ @@ -3551,9 +3553,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct= usb_device *udev, "%s: em28xx_i2c_register bus 1 - error [%d]!\n", __func__, retval); =20 - em28xx_i2c_unregister(dev, 0); - - return retval; + goto err_unreg_i2c; } } =20 @@ -3561,6 +3561,12 @@ static int em28xx_init_dev(struct em28xx *dev, struc= t usb_device *udev, em28xx_card_setup(dev); =20 return 0; + +err_unreg_i2c: + em28xx_i2c_unregister(dev, 0); +err_deinit_media: + em28xx_unregister_media_device(dev); + return retval; } =20 static int em28xx_duplicate_dev(struct em28xx *dev) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18B31C433FE for ; Mon, 24 Jan 2022 19:43:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355691AbiAXTnK (ORCPT ); Mon, 24 Jan 2022 14:43:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345942AbiAXTb3 (ORCPT ); Mon, 24 Jan 2022 14:31:29 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2C121C028BE4; Mon, 24 Jan 2022 11:14:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B829060917; Mon, 24 Jan 2022 19:14:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93103C340E5; Mon, 24 Jan 2022 19:14:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051677; bh=vnfzU01oU3K111HF/yhjplnZMUUJJyYhNA2FRFWaTUk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=toPHgh3RXVPtHDj1Id5+g+mDB/Ks/CTiXFsRe2OlnkSF/h90Smom1KS3CI2X6DSG2 NxyfTYSUs/KEilwB5Q5XOJ/QPtr5jo0HgSyNRN9XObfTZ6OhBYOSd1q+5LrIhKtWrB zC+0LcizHyBVQTB909RN0/GrWS9axpVVJAje2saQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christian Hewitt , Neil Armstrong , Sasha Levin Subject: [PATCH 4.19 052/239] arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Date: Mon, 24 Jan 2022 19:41:30 +0100 Message-Id: <20220124183944.791419739@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christian Hewitt [ Upstream commit c019abb2feba3cbbd7cf7178f8e6499c4fa6fced ] The absence of this binding appears to be harmless in Linux but it breaks Ethernet support in mainline u-boot. So add the binding (which is present in all other u-boot supported GXBB device-trees). Fixes: fb72c03e0e32 ("ARM64: dts: meson-gxbb-wetek: add a wetek specific dt= si to cleanup hub and play2") Signed-off-by: Christian Hewitt Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20211012052522.30873-3-christianshewitt@gma= il.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64= /boot/dts/amlogic/meson-gxbb-wetek.dtsi index 70325b273bd2b..c7f06692d6c2a 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi @@ -6,6 +6,7 @@ */ =20 #include "meson-gxbb.dtsi" +#include =20 / { aliases { --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F203C433FE for ; Mon, 24 Jan 2022 19:43:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355737AbiAXTn1 (ORCPT ); Mon, 24 Jan 2022 14:43:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51944 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345699AbiAXTb3 (ORCPT ); Mon, 24 Jan 2022 14:31:29 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94042C028BE5; Mon, 24 Jan 2022 11:14:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3198560B88; Mon, 24 Jan 2022 19:14:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0840C340E5; Mon, 24 Jan 2022 19:14:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051680; bh=PlQem231B9ZJ6Nur+9/SuZiPSNd25scKJOTzlt/aIAA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kbWY//bPDKL2aJJT24wqzv/JiJ7Pcy9WtnKENWRSX3tXHt4tOyyhnbdQ3EaWI9YRT GEFsnhwaTu+mTlYOnxnhZAlvo6Llp+SKbuBBItJJgy5IzAJgdjIdv/s41DIKZ/MNvU Sj7e6tK1U4nxxvrUVRdS6Z2TbWzQ4ZIXCWbQtTEQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Marcel Holtmann , Sasha Levin , syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com Subject: [PATCH 4.19 053/239] Bluetooth: stop proccessing malicious adv data Date: Mon, 24 Jan 2022 19:41:31 +0100 Message-Id: <20220124183944.821850135@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin [ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ] Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The problem was in missing validaion check. We should check if data is not malicious and we can read next data block. If we won't check ptr validness, code can read a way beyond skb->end and it can cause problems, of course. Fixes: e95beb414168 ("Bluetooth: hci_le_adv_report_evt code refactoring") Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.c= om Signed-off-by: Pavel Skripkin Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/bluetooth/hci_event.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 937cada5595ee..c0dbb8ad00376 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -5391,7 +5391,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hde= v, struct sk_buff *skb) struct hci_ev_le_advertising_info *ev =3D ptr; s8 rssi; =20 - if (ev->length <=3D HCI_MAX_AD_LENGTH) { + if (ev->length <=3D HCI_MAX_AD_LENGTH && + ev->data + ev->length <=3D skb_tail_pointer(skb)) { rssi =3D ev->data[ev->length]; process_adv_report(hdev, ev->evt_type, &ev->bdaddr, ev->bdaddr_type, NULL, 0, rssi, @@ -5401,6 +5402,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hd= ev, struct sk_buff *skb) } =20 ptr +=3D sizeof(*ev) + ev->length + 1; + + if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { + bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); + break; + } } =20 hci_dev_unlock(hdev); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0863C433FE for ; Mon, 24 Jan 2022 19:23:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347226AbiAXTXs (ORCPT ); Mon, 24 Jan 2022 14:23:48 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40176 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348046AbiAXTOr (ORCPT ); Mon, 24 Jan 2022 14:14:47 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F20B0B8121C; Mon, 24 Jan 2022 19:14:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 24347C340E5; Mon, 24 Jan 2022 19:14:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051683; bh=D54MdEBmCYEy6ur7bgYgsa7SkjdZdJ+WIe8dfhTumU0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PDStTNV6mZVICQuZHYjGQOs67wGh+3UPgdYaIsry/4tyXlwQufllXMzzCuqAiKL40 MP1EydNPSaaSxXbzzzp0lAvx7rGlvXJQjpFVV2bOOb4lYL6OX5FoKj2OZTwi0K1MhB P+h+smN7obJUsBGvYawowjUzJFJoOwAISCG9qLXk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sumit Garg , Jens Wiklander , Sasha Levin Subject: [PATCH 4.19 054/239] tee: fix put order in teedev_close_context() Date: Mon, 24 Jan 2022 19:41:32 +0100 Message-Id: <20220124183944.853795376@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jens Wiklander [ Upstream commit f18397ab3ae23e8e43bba9986e66af6d4497f2ad ] Prior to this patch was teedev_close_context() calling tee_device_put() before teedev_ctx_put() leading to teedev_ctx_release() accessing ctx->teedev just after the reference counter was decreased on the teedev. Fix this by calling teedev_ctx_put() before tee_device_put(). Fixes: 217e0250cccb ("tee: use reference counting for tee_context") Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tee/tee_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index dd46b758852aa..d42fc2ae8592e 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -96,8 +96,10 @@ void teedev_ctx_put(struct tee_context *ctx) =20 static void teedev_close_context(struct tee_context *ctx) { - tee_device_put(ctx->teedev); + struct tee_device *teedev =3D ctx->teedev; + teedev_ctx_put(ctx); + tee_device_put(teedev); } =20 static int tee_release(struct inode *inode, struct file *filp) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53079C41535 for ; Mon, 24 Jan 2022 19:37:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354476AbiAXTgj (ORCPT ); Mon, 24 Jan 2022 14:36:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52008 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352986AbiAXTbo (ORCPT ); Mon, 24 Jan 2022 14:31:44 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D6F0C0604C2; Mon, 24 Jan 2022 11:14:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4C24FB8121A; Mon, 24 Jan 2022 19:14:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A36DC340E8; Mon, 24 Jan 2022 19:14:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051690; bh=1WLUy3+wsMM5QE1xCX6fNDNOZgozuI55MqJAlY91xTs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XXrCw73JdvTOazH0VNzRu73rVUg8oNL5g4gu4eorldgrFDRWaZs4Csi2PposaeYJK BiLg2zNwHdEFLEwCOwgJaywUt8c0ECp9V+mRHM+EQrQzacj6ecSYwnv85ecZkvOP/p 44pId+QUOvjVJUEKW9Rv09KjAz00zHnhG8p3PaLY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 055/239] media: dmxdev: fix UAF when dvb_register_device() fails Date: Mon, 24 Jan 2022 19:41:33 +0100 Message-Id: <20220124183944.881904471@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Hai [ Upstream commit ab599eb11882f834951c436cc080c3455ba32b9b ] I got a use-after-free report: dvbdev: dvb_register_device: failed to create device dvb1.dvr0 (-12) ... =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in dvb_dmxdev_release+0xce/0x2f0 ... Call Trace: dump_stack_lvl+0x6c/0x8b print_address_description.constprop.0+0x48/0x70 kasan_report.cold+0x82/0xdb __asan_load4+0x6b/0x90 dvb_dmxdev_release+0xce/0x2f0 ... Allocated by task 7666: kasan_save_stack+0x23/0x50 __kasan_kmalloc+0x83/0xa0 kmem_cache_alloc_trace+0x22e/0x470 dvb_register_device+0x12f/0x980 dvb_dmxdev_init+0x1f3/0x230 ... Freed by task 7666: kasan_save_stack+0x23/0x50 kasan_set_track+0x20/0x30 kasan_set_free_info+0x24/0x40 __kasan_slab_free+0xf2/0x130 kfree+0xd1/0x5c0 dvb_register_device.cold+0x1ac/0x1fa dvb_dmxdev_init+0x1f3/0x230 ... When dvb_register_device() in dvb_dmxdev_init() fails, dvb_dmxdev_init() does not return a failure, and the memory pointed to by dvbdev or dvr_dvbdev is invalid at this point. If they are used subsequently, it will result in UFA or null-ptr-deref. If dvb_register_device() in dvb_dmxdev_init() fails, fix the bug by making dvb_dmxdev_init() return an error as well. Link: https://lore.kernel.org/linux-media/20211015085741.1203283-1-wanghai3= 8@huawei.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/dvb-core/dmxdev.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxde= v.c index d548f98c7a67d..9e0ef3934fa3d 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -1412,7 +1412,7 @@ static const struct dvb_device dvbdev_dvr =3D { }; int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) { - int i; + int i, ret; =20 if (dmxdev->demux->open(dmxdev->demux) < 0) return -EUSERS; @@ -1431,14 +1431,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct d= vb_adapter *dvb_adapter) DMXDEV_STATE_FREE); } =20 - dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, + ret =3D dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, = dmxdev, DVB_DEVICE_DEMUX, dmxdev->filternum); - dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, + if (ret < 0) + goto err_register_dvbdev; + + ret =3D dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, dmxdev, DVB_DEVICE_DVR, dmxdev->filternum); + if (ret < 0) + goto err_register_dvr_dvbdev; =20 dvb_ringbuffer_init(&dmxdev->dvr_buffer, NULL, 8192); =20 return 0; + +err_register_dvr_dvbdev: + dvb_unregister_device(dmxdev->dvbdev); +err_register_dvbdev: + vfree(dmxdev->filter); + dmxdev->filter =3D NULL; + return ret; } =20 EXPORT_SYMBOL(dvb_dmxdev_init); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42915C433EF for ; Mon, 24 Jan 2022 19:43:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237769AbiAXTmy (ORCPT ); Mon, 24 Jan 2022 14:42:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52010 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353006AbiAXTbq (ORCPT ); Mon, 24 Jan 2022 14:31:46 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BAE94C0604CC; Mon, 24 Jan 2022 11:14:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5A58360B86; Mon, 24 Jan 2022 19:14:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E0C3C340E5; Mon, 24 Jan 2022 19:14:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051692; bh=2GBRf5isI7WxVEFzBNAez1QtihJLzttbdylD85HipyY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tvp2kzAwL+AStvF+Bz2CyJFxHGPmFQJ4eMwL8B7BFfANagOBGNh9MWBKa7zo37eSZ Kkxk9ifQWrBBJE+zvsUbhRTklJ1AkaJHRKist6ph9/4SG1ok7ZvH0tMuEftnqBRh/R OG6BIjzcYyRkoq5qnq2/W2vG9EU3KUJYWioOw+mk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Thara Gopinath , Herbert Xu , Sasha Levin Subject: [PATCH 4.19 056/239] crypto: qce - fix uaf on qce_ahash_register_one Date: Mon, 24 Jan 2022 19:41:34 +0100 Message-Id: <20220124183944.913708574@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye [ Upstream commit b4cb4d31631912842eb7dce02b4350cbb7562d5e ] Pointer base points to sub field of tmpl, it is dereferenced after tmpl is freed. Fix this by accessing base before free tmpl. Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver") Signed-off-by: Chengfeng Ye Acked-by: Thara Gopinath Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/crypto/qce/sha.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c index d8a5db11b7ea1..bffd4d15145d9 100644 --- a/drivers/crypto/qce/sha.c +++ b/drivers/crypto/qce/sha.c @@ -521,8 +521,8 @@ static int qce_ahash_register_one(const struct qce_ahas= h_def *def, =20 ret =3D crypto_register_ahash(alg); if (ret) { - kfree(tmpl); dev_err(qce->dev, "%s registration failed\n", base->cra_name); + kfree(tmpl); return ret; } =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF91FC43219 for ; Mon, 24 Jan 2022 19:41:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355165AbiAXTkF (ORCPT ); Mon, 24 Jan 2022 14:40:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346601AbiAXTb5 (ORCPT ); Mon, 24 Jan 2022 14:31:57 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F1E84C0604CE; Mon, 24 Jan 2022 11:14:56 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 913DF612A5; Mon, 24 Jan 2022 19:14:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 491E6C340E5; Mon, 24 Jan 2022 19:14:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051696; bh=Q28q87FmmGX2wFzBQMk/IK9QBCSY7CNqvceSIi454Ug=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MZN5gZpRQZPFYkQDoiR40IMHGsetREDcON5coLNs+NCgV0ewCQ8mcN/CEuT04nnZb P3VDf/IYyhQgk/MByncViZDUCEPysbhY1xVrH/M8hZ5PgjvRHtrDSqfgrnUjQneOis dpGgfe3gxEd6gInmPnhHshe5Ssu0r6xhb0i9B+1A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Richard Genoud , Sasha Levin Subject: [PATCH 4.19 057/239] tty: serial: atmel: Check return code of dmaengine_submit() Date: Mon, 24 Jan 2022 19:41:35 +0100 Message-Id: <20220124183944.948043434@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus [ Upstream commit 1e67bd2b8cb90b66e89562598e9c2046246832d3 ] The tx_submit() method of struct dma_async_tx_descriptor is entitled to do sanity checks and return errors if encountered. It's not the case for the DMA controller drivers that this client is using (at_h/xdmac), because they currently don't do sanity checks and always return a positive cookie at tx_submit() method. In case the controller drivers will implement sanity checks and return errors, print a message so that the client will be informed that something went wrong at tx_submit() level. Fixes: 08f738be88bb ("serial: at91: add tx dma support") Signed-off-by: Tudor Ambarus Acked-by: Richard Genoud Link: https://lore.kernel.org/r/20211125090028.786832-3-tudor.ambarus@micro= chip.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/atmel_serial.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_s= erial.c index 936d401f20b95..f6287d76b2984 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -918,6 +918,11 @@ static void atmel_tx_dma(struct uart_port *port) desc->callback =3D atmel_complete_tx_dma; desc->callback_param =3D atmel_port; atmel_port->cookie_tx =3D dmaengine_submit(desc); + if (dma_submit_error(atmel_port->cookie_tx)) { + dev_err(port->dev, "dma_submit_error %d\n", + atmel_port->cookie_tx); + return; + } } =20 if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) @@ -1176,6 +1181,11 @@ static int atmel_prepare_rx_dma(struct uart_port *po= rt) desc->callback_param =3D port; atmel_port->desc_rx =3D desc; atmel_port->cookie_rx =3D dmaengine_submit(desc); + if (dma_submit_error(atmel_port->cookie_rx)) { + dev_err(port->dev, "dma_submit_error %d\n", + atmel_port->cookie_rx); + goto chan_err; + } =20 return 0; =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AAE9C433F5 for ; Mon, 24 Jan 2022 19:24:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232444AbiAXTYE (ORCPT ); Mon, 24 Jan 2022 14:24:04 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44216 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348182AbiAXTPA (ORCPT ); Mon, 24 Jan 2022 14:15:00 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A1DED60917; Mon, 24 Jan 2022 19:14:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6FB3CC340E5; Mon, 24 Jan 2022 19:14:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051699; bh=iGX1mZJhwUEK5jqknqNU7KydGA/VgXiua29cyCulylc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=veKbQTb1tHPnnymKJK6OAzB67i0EO0Fxa7+E0cYkobkE7FhDrSf8NxBkU13qG8bM/ QRa9eg1orF+U5hPIXX+fTKWVRR4FXGIDEI4ZwZdyeUR+1DHAoCMgakNvj8bmafe/6D 7r3ZbPQ2erqoXVKTHCqWVSnZTB4hTE/bB5yca8iQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Sasha Levin Subject: [PATCH 4.19 058/239] tty: serial: atmel: Call dma_async_issue_pending() Date: Mon, 24 Jan 2022 19:41:36 +0100 Message-Id: <20220124183944.981674331@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus [ Upstream commit 4f4b9b5895614eb2e2b5f4cab7858f44bd113e1b ] The driver wrongly assummed that tx_submit() will start the transfer, which is not the case, now that the at_xdmac driver is fixed. tx_submit is supposed to push the current transaction descriptor to a pending queue, waiting for issue_pending to be called. issue_pending must start the transfer, not tx_submit. Fixes: 34df42f59a60 ("serial: at91: add rx dma support") Fixes: 08f738be88bb ("serial: at91: add tx dma support") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211125090028.786832-4-tudor.ambarus@micro= chip.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/atmel_serial.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_s= erial.c index f6287d76b2984..3ba9ed36d6362 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -923,6 +923,8 @@ static void atmel_tx_dma(struct uart_port *port) atmel_port->cookie_tx); return; } + + dma_async_issue_pending(chan); } =20 if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) @@ -1187,6 +1189,8 @@ static int atmel_prepare_rx_dma(struct uart_port *por= t) goto chan_err; } =20 + dma_async_issue_pending(atmel_port->chan_rx); + return 0; =20 chan_err: --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D58A3C433FE for ; Mon, 24 Jan 2022 19:24:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237344AbiAXTYQ (ORCPT ); Mon, 24 Jan 2022 14:24:16 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40326 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348225AbiAXTPE (ORCPT ); Mon, 24 Jan 2022 14:15:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8D9E9B8121A; Mon, 24 Jan 2022 19:15:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9400C340E5; Mon, 24 Jan 2022 19:15:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051702; bh=C/D2h9OZPFVVIfo9DacnrUoGpxJYsOFF0b8+7wbpPCo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nt6A8gjDkrTmtkIuyIznDf0/p/PjInc+3Ep2X13TOEvDvXrGlm9Tp1oTl/p8D3x0R E5iwQ0IRQHz1pKa9zReNAeqw2uRfjRQXx4XVv5bMFsIQmpWRiqh+eBAtO+9QhD14LW 3tLXgKUiSxgMqVxvCJQVuMV+iX0E38lk03ZUSN0s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Suresh Udipi , Kazuyoshi Akiyama , Michael Rodin , =?UTF-8?q?Niklas=20S=C3=B6derlund?= , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 059/239] media: rcar-csi2: Correct the selection of hsfreqrange Date: Mon, 24 Jan 2022 19:41:37 +0100 Message-Id: <20220124183945.017599609@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Suresh Udipi [ Upstream commit cee44d4fbacbbdfe62697ec94e76c6e4f726c5df ] hsfreqrange should be chosen based on the calculated mbps which is closer to the default bit rate and within the range as per table[1]. But current calculation always selects first value which is greater than or equal to the calculated mbps which may lead to chosing a wrong range in some cases. For example for 360 mbps for H3/M3N Existing logic selects Calculated value 360Mbps : Default 400Mbps Range [368.125 -433.125 mbps] This hsfreqrange is out of range. The logic is changed to get the default value which is closest to the calculated value [1] Calculated value 360Mbps : Default 350Mbps Range [320.625 -380.625 mpbs] [1] specs r19uh0105ej0200-r-car-3rd-generation.pdf [Table 25.9] Please note that According to Renesas in Table 25.9 the range for 220 default value is corrected as below |Range (Mbps) | Default Bit rate (Mbps) | ----------------------------------------------- | 197.125-244.125 | 220 | ----------------------------------------------- Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiv= er driver") Signed-off-by: Suresh Udipi Signed-off-by: Kazuyoshi Akiyama Signed-off-by: Michael Rodin Reviewed-by: Niklas S=C3=B6derlund Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/platform/rcar-vin/rcar-csi2.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/pl= atform/rcar-vin/rcar-csi2.c index 23f55514b002a..bdcddc48e2f08 100644 --- a/drivers/media/platform/rcar-vin/rcar-csi2.c +++ b/drivers/media/platform/rcar-vin/rcar-csi2.c @@ -416,16 +416,23 @@ static int rcsi2_wait_phy_start(struct rcar_csi2 *pri= v) static int rcsi2_set_phypll(struct rcar_csi2 *priv, unsigned int mbps) { const struct rcsi2_mbps_reg *hsfreq; + const struct rcsi2_mbps_reg *hsfreq_prev =3D NULL; =20 - for (hsfreq =3D priv->info->hsfreqrange; hsfreq->mbps !=3D 0; hsfreq++) + for (hsfreq =3D priv->info->hsfreqrange; hsfreq->mbps !=3D 0; hsfreq++) { if (hsfreq->mbps >=3D mbps) break; + hsfreq_prev =3D hsfreq; + } =20 if (!hsfreq->mbps) { dev_err(priv->dev, "Unsupported PHY speed (%u Mbps)", mbps); return -ERANGE; } =20 + if (hsfreq_prev && + ((mbps - hsfreq_prev->mbps) <=3D (hsfreq->mbps - mbps))) + hsfreq =3D hsfreq_prev; + rcsi2_write(priv, PHYPLL_REG, PHYPLL_HSFREQRANGE(hsfreq->reg)); =20 return 0; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73024C433F5 for ; Mon, 24 Jan 2022 19:24:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344846AbiAXTYY (ORCPT ); Mon, 24 Jan 2022 14:24:24 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44326 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348251AbiAXTPI (ORCPT ); Mon, 24 Jan 2022 14:15:08 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D6A96612F3; Mon, 24 Jan 2022 19:15:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DFE97C340E5; Mon, 24 Jan 2022 19:15:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051705; bh=J8UPVYYR4aRg63SZEZ+MYskLvViqUeX5n6JxDgjLrkA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RQjGZbBR0Mti2E5nyjs9mMHjhMiwgIjN+spK+eAOF98HpFb7poo/jROQ+Pn+aCCk5 PAR3oBs6xytO8eHR+4VB8Oq6qrWsTDkybABAFtRsSyMNjCH5owNxsSnZnf3YO5RIYG d7z//yjAXdwxk4WNnKwQTpqJBdjUpsUwhkwpO2Xs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Yang Yingliang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 060/239] media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() Date: Mon, 24 Jan 2022 19:41:38 +0100 Message-Id: <20220124183945.049951657@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit ef054e345ed8c79ce1121a3599b5a2dfd78e57a0 ] n the 'radio->hdl.error' error handling, ctrl handler allocated by v4l2_ctrl_new_std() does not released, and caused memory leak as follows: unreferenced object 0xffff888033d54200 (size 256): comm "i2c-si470x-19", pid 909, jiffies 4294914203 (age 8.072s) hex dump (first 32 bytes): e8 69 11 03 80 88 ff ff 00 46 d5 33 80 88 ff ff .i.......F.3.... 10 42 d5 33 80 88 ff ff 10 42 d5 33 80 88 ff ff .B.3.....B.3.... backtrace: [<00000000086bd4ed>] __kmalloc_node+0x1eb/0x360 [<00000000bdb68871>] kvmalloc_node+0x66/0x120 [<00000000fac74e4c>] v4l2_ctrl_new+0x7b9/0x1c60 [videodev] [<00000000693bf940>] v4l2_ctrl_new_std+0x19b/0x270 [videodev] [<00000000c0cb91bc>] si470x_i2c_probe+0x2d3/0x9a0 [radio_si470x_i2c] [<0000000056a6f01f>] i2c_device_probe+0x4d8/0xbe0 Fix the error handling path to avoid memory leak. Reported-by: Hulk Robot Fixes: 8c081b6f9a9b ("media: radio: Critical v4l2 registration...") Signed-off-by: Yang Yingliang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/radio/si470x/radio-si470x-i2c.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/= radio/si470x/radio-si470x-i2c.c index cc68bdac0c367..7c49eaee67f36 100644 --- a/drivers/media/radio/si470x/radio-si470x-i2c.c +++ b/drivers/media/radio/si470x/radio-si470x-i2c.c @@ -381,7 +381,7 @@ static int si470x_i2c_probe(struct i2c_client *client, if (radio->hdl.error) { retval =3D radio->hdl.error; dev_err(&client->dev, "couldn't register control\n"); - goto err_dev; + goto err_all; } =20 /* video device initialization */ @@ -465,7 +465,6 @@ err_rds: kfree(radio->buffer); err_ctrl: v4l2_ctrl_handler_free(&radio->hdl); -err_dev: v4l2_device_unregister(&radio->v4l2_dev); err_radio: kfree(radio); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C97CFC433EF for ; Mon, 24 Jan 2022 19:24:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344285AbiAXTYT (ORCPT ); Mon, 24 Jan 2022 14:24:19 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44358 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348273AbiAXTPJ (ORCPT ); Mon, 24 Jan 2022 14:15:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E9281612FA; Mon, 24 Jan 2022 19:15:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA4D8C340E5; Mon, 24 Jan 2022 19:15:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051708; bh=vQxa3OKPW4dCeFASeWVK/aTkRn+gKtR3N8LvRWNxdF0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N13T2ow8XYL9j0aYu2U1XpmirHEltUT4y1FEpRH0CtxVv+rTiPUGediLtr8ogBZ5U VbuXNXPnibF0fZ0ZBKCI6OYZ0JKnQ2jKb+QJ6h3XF3Pc8KADm7i8cl6e4L/h/vi+az pDiKOYJ+k6at/sHkDuk3VPHfadj9IznE6/BAvL+8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dafna Hirschfeld , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 061/239] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released Date: Mon, 24 Jan 2022 19:41:39 +0100 Message-Id: <20220124183945.080723468@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dafna Hirschfeld [ Upstream commit 9f89c881bffbdffe4060ffaef3489a2830a6dd9c ] The func v4l2_m2m_ctx_release waits for currently running jobs to finish and then stop streaming both queues and frees the buffers. All this should be done before the call to mtk_vcodec_enc_release which frees the encoder handler. This fixes null-pointer dereference bug: [ 638.028076] Mem abort info: [ 638.030932] ESR =3D 0x96000004 [ 638.033978] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [ 638.039293] SET =3D 0, FnV =3D 0 [ 638.042338] EA =3D 0, S1PTW =3D 0 [ 638.045474] FSC =3D 0x04: level 0 translation fault [ 638.050349] Data abort info: [ 638.053224] ISV =3D 0, ISS =3D 0x00000004 [ 638.057055] CM =3D 0, WnR =3D 0 [ 638.060018] user pgtable: 4k pages, 48-bit VAs, pgdp=3D000000012b6db000 [ 638.066485] [00000000000001a0] pgd=3D0000000000000000, p4d=3D00000000000= 00000 [ 638.073277] Internal error: Oops: 96000004 [#1] SMP [ 638.078145] Modules linked in: rfkill mtk_vcodec_dec mtk_vcodec_enc uvcv= ideo mtk_mdp mtk_vcodec_common videobuf2_dma_contig v4l2_h264 cdc_ether v4l= 2_mem2mem videobuf2_vmalloc usbnet videobuf2_memops videobuf2_v4l2 r8152 vi= deobuf2_common videodev cros_ec_sensors cros_ec_sensors_core industrialio_t= riggered_buffer kfifo_buf elan_i2c elants_i2c sbs_battery mc cros_usbpd_cha= rger cros_ec_chardev cros_usbpd_logger crct10dif_ce mtk_vpu fuse ip_tables = x_tables ipv6 [ 638.118583] CPU: 0 PID: 212 Comm: kworker/u8:5 Not tainted 5.15.0-06427-= g58a1d4dcfc74-dirty #109 [ 638.127357] Hardware name: Google Elm (DT) [ 638.131444] Workqueue: mtk-vcodec-enc mtk_venc_worker [mtk_vcodec_enc] [ 638.137974] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE= =3D--) [ 638.144925] pc : vp8_enc_encode+0x34/0x2b0 [mtk_vcodec_enc] [ 638.150493] lr : venc_if_encode+0xac/0x1b0 [mtk_vcodec_enc] [ 638.156060] sp : ffff8000124d3c40 [ 638.159364] x29: ffff8000124d3c40 x28: 0000000000000000 x27: 00000000000= 00000 [ 638.166493] x26: 0000000000000000 x25: ffff0000e7f252d0 x24: ffff8000124= d3d58 [ 638.173621] x23: ffff8000124d3d58 x22: ffff8000124d3d60 x21: 00000000000= 00001 [ 638.180750] x20: ffff80001137e000 x19: 0000000000000000 x18: 00000000000= 00001 [ 638.187878] x17: 000000040044ffff x16: 00400032b5503510 x15: 00000000000= 00000 [ 638.195006] x14: ffff8000118536c0 x13: ffff8000ee1da000 x12: 0000000030d= 4d91d [ 638.202134] x11: 0000000000000000 x10: 0000000000000980 x9 : ffff8000124= d3b20 [ 638.209262] x8 : ffff0000c18d4ea0 x7 : ffff0000c18d44c0 x6 : ffff0000c18= d44c0 [ 638.216391] x5 : ffff80000904a3b0 x4 : ffff8000124d3d58 x3 : ffff8000124= d3d60 [ 638.223519] x2 : ffff8000124d3d78 x1 : 0000000000000001 x0 : ffff8000113= 7efb8 [ 638.230648] Call trace: [ 638.233084] vp8_enc_encode+0x34/0x2b0 [mtk_vcodec_enc] [ 638.238304] venc_if_encode+0xac/0x1b0 [mtk_vcodec_enc] [ 638.243525] mtk_venc_worker+0x110/0x250 [mtk_vcodec_enc] [ 638.248918] process_one_work+0x1f8/0x498 [ 638.252923] worker_thread+0x140/0x538 [ 638.256664] kthread+0x148/0x158 [ 638.259884] ret_from_fork+0x10/0x20 [ 638.263455] Code: f90023f9 2a0103f5 aa0303f6 aa0403f8 (f940d277) [ 638.269538] ---[ end trace e374fc10f8e181f5 ]--- [gst-master] root@debian:~/gst-build# [ 638.019193] Unable to handle kerne= l NULL pointer dereference at virtual address 00000000000001a0 Fixes: 4e855a6efa547 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video En= coder Driver") Signed-off-by: Dafna Hirschfeld Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drive= rs/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c index 83f859e8509c9..b95006a864c26 100644 --- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c +++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c @@ -217,11 +217,11 @@ static int fops_vcodec_release(struct file *file) mtk_v4l2_debug(1, "[%d] encoder", ctx->id); mutex_lock(&dev->dev_mutex); =20 + v4l2_m2m_ctx_release(ctx->m2m_ctx); mtk_vcodec_enc_release(ctx); v4l2_fh_del(&ctx->fh); v4l2_fh_exit(&ctx->fh); v4l2_ctrl_handler_free(&ctx->ctrl_hdl); - v4l2_m2m_ctx_release(ctx->m2m_ctx); =20 list_del_init(&ctx->list); kfree(ctx); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22446C433F5 for ; Mon, 24 Jan 2022 19:42:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350661AbiAXTmt (ORCPT ); Mon, 24 Jan 2022 14:42:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52534 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346657AbiAXTb5 (ORCPT ); Mon, 24 Jan 2022 14:31:57 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 23859C0604D0; Mon, 24 Jan 2022 11:15:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B546F60010; Mon, 24 Jan 2022 19:15:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B0216C340E5; Mon, 24 Jan 2022 19:15:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051711; bh=5gpMEpfmr3TqHNa/BGaMeGbq5ejMLPM/MNPnSfuyYV4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1Rt6/596G5jbbGnSX/zR+nNC+lNJjGm+pjNSxVFVt62KwlVhBZlxDvhSytQe3WQTK xc2aaJtnzAyjaaBUBdlNE6+y/mRFIogrx0p+s25+slB52aQl6FswMGXGfntU0keoaC rNditeh8DoqvJZ7FzE8w/UpLgQpxJ7ggVRAUO+hg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Westphal , Pablo Neira Ayuso , Sasha Levin , Amish Chana Subject: [PATCH 4.19 062/239] netfilter: bridge: add support for pppoe filtering Date: Mon, 24 Jan 2022 19:41:40 +0100 Message-Id: <20220124183945.109568268@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal [ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ] This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for bridged traffic. Looking at the original commit it doesn't appear this ever worked: static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *= *pskb, [..] if (skb->protocol =3D=3D htons(ETH_P_8021Q)) { skb_pull(skb, VLAN_HLEN); skb->network_header +=3D VLAN_HLEN; + } else if (skb->protocol =3D=3D htons(ETH_P_PPP_SES)) { + skb_pull(skb, PPPOE_SES_HLEN); + skb->network_header +=3D PPPOE_SES_HLEN; } [..] NF_HOOK(... POST_ROUTING, ...) ... but the adjusted offsets are never restored. The alternative would be to rip this code out for good, but otoh we'd have to keep this anyway for the vlan handling (which works because vlan tag info is in the skb, not the packet payload). Reported-and-tested-by: Amish Chana Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 e= ncapsulated in pppoe traffic") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/bridge/br_netfilter_hooks.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hook= s.c index c5380c6baf2e7..4b9d1d6bbf6f9 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -727,6 +727,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) mtu =3D nf_bridge->frag_max_size; =20 + nf_bridge_update_protocol(skb); + nf_bridge_push_encap_header(skb); + if (skb_is_gso(skb) || skb->len + mtu_reserved <=3D mtu) { nf_bridge_info_free(skb); return br_dev_queue_push_xmit(net, sk, skb); @@ -744,8 +747,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff =20 IPCB(skb)->frag_max_size =3D nf_bridge->frag_max_size; =20 - nf_bridge_update_protocol(skb); - data =3D this_cpu_ptr(&brnf_frag_data_storage); =20 data->vlan_tci =3D skb->vlan_tci; @@ -768,8 +769,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff =20 IP6CB(skb)->frag_max_size =3D nf_bridge->frag_max_size; =20 - nf_bridge_update_protocol(skb); - data =3D this_cpu_ptr(&brnf_frag_data_storage); data->encap_size =3D nf_bridge_encap_header_len(skb); data->size =3D ETH_HLEN + data->encap_size; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 254D4C35268 for ; Mon, 24 Jan 2022 19:40:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355144AbiAXTkE (ORCPT ); Mon, 24 Jan 2022 14:40:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52528 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346634AbiAXTb5 (ORCPT ); Mon, 24 Jan 2022 14:31:57 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D5C0BC061748; Mon, 24 Jan 2022 11:15:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 91DEFB8122A; Mon, 24 Jan 2022 19:15:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D698BC340E5; Mon, 24 Jan 2022 19:15:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051714; bh=DNjlJ3BmDE5JutTMDSqdqDXzzaoCpJzIK0jEiHSOS6U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=taHEFoF8+4PjqaAu5SX6T7G9suDP7SUA3E2lceMFxWFSo+uWF0fU6fsNvejp9Pf8M Di1grIZA2jHJxK2tZSLD9MJmzQYHCBUGHV0VDO7wdasNn/r2XtpQlWoJjKY5THXrE8 tscOTWt+9k3s8x4YZPUFcNpTA2nNLnOaYyoixOEg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Baryshkov , Bjorn Andersson , Sasha Levin Subject: [PATCH 4.19 063/239] arm64: dts: qcom: msm8916: fix MMC controller aliases Date: Mon, 24 Jan 2022 19:41:41 +0100 Message-Id: <20220124183945.139319638@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dmitry Baryshkov [ Upstream commit b0293c19d42f6d6951c2fab9a47fed50baf2c14d ] Change sdhcN aliases to mmcN to make them actually work. Currently the board uses non-standard aliases sdhcN, which do not work, resulting in mmc0 and mmc1 hosts randomly changing indices between boots. Fixes: c4da5a561627 ("arm64: dts: qcom: Add msm8916 sdhci configuration nod= es") Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20211201020559.1611890-1-dmitry.baryshkov@l= inaro.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qc= om/msm8916.dtsi index ba42c62399226..078ae020a77b8 100644 --- a/arch/arm64/boot/dts/qcom/msm8916.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi @@ -27,8 +27,8 @@ #size-cells =3D <2>; =20 aliases { - sdhc1 =3D &sdhc_1; /* SDC1 eMMC slot */ - sdhc2 =3D &sdhc_2; /* SDC2 SD card slot */ + mmc0 =3D &sdhc_1; /* SDC1 eMMC slot */ + mmc1 =3D &sdhc_2; /* SDC2 SD card slot */ }; =20 chosen { }; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FF2DC43219 for ; Mon, 24 Jan 2022 19:38:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354779AbiAXTh4 (ORCPT ); Mon, 24 Jan 2022 14:37:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53106 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347734AbiAXTc1 (ORCPT ); Mon, 24 Jan 2022 14:32:27 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 083D2C061749; Mon, 24 Jan 2022 11:15:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A1520B81223; Mon, 24 Jan 2022 19:15:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E6426C340E5; Mon, 24 Jan 2022 19:15:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051717; bh=A2NvKwd73D8pQ6vaWh6pCK/nGc+b3GhvLNFIRFxwTA0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=baQgDcUWgb4my/afV8ynTlk1AWFntrjWTFC2iTsCezzB7XS1dKjNQb37omgdhXzHj rxwmplQn4MvrIRwCD8aKGW29ECiYXX6qeFDRSLISnFefWJvb9QMKTFvt8yRUM0gdaz 6uMxgn+iSfE+SSzev7kakLKknRka3vYIQ6B7fE+s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Alex Deucher , Sasha Levin Subject: [PATCH 4.19 064/239] drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() Date: Mon, 24 Jan 2022 19:41:42 +0100 Message-Id: <20220124183945.169579704@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit b220110e4cd442156f36e1d9b4914bb9e87b0d00 ] In amdgpu_connector_lcd_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, and there is a dereference of it in amdgpu_connector_lcd_native_mode(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Fix this bug add a check of mode. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DRM_AMDGPU=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Signed-off-by: Zhou Qingyang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/d= rm/amd/amdgpu/amdgpu_connectors.c index e1be3fd4d7a45..3e4305c3c9831 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c @@ -388,6 +388,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *en= coder) native_mode->vdisplay !=3D 0 && native_mode->clock !=3D 0) { mode =3D drm_mode_duplicate(dev, native_mode); + if (!mode) + return NULL; + mode->type =3D DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; drm_mode_set_name(mode); =20 @@ -402,6 +405,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *en= coder) * simpler. */ mode =3D drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay,= 60, true, false, false); + if (!mode) + return NULL; + mode->type =3D DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode= ->name); } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF10EC35270 for ; Mon, 24 Jan 2022 19:26:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350201AbiAXTYk (ORCPT ); Mon, 24 Jan 2022 14:24:40 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:38960 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348461AbiAXTPZ (ORCPT ); Mon, 24 Jan 2022 14:15:25 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BADF2B811F9; Mon, 24 Jan 2022 19:15:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1513FC340E5; Mon, 24 Jan 2022 19:15:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051723; bh=EEbx2n70TOp6CXrt5bJmDq0vuVgf8XQ9pufv2ReR28I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TKIQom3+xEkrpSS1Y4SXLjdKyC/sNyeQlg8C8APKo/3AFoEwTsZsYBJfqn1J8H0oK Bx/HUXSnyVrSh0iUHH2VQhk+cPOJiyOoBrXZ4HGlQK2pPWoq7jMVS6ZzDiD8b4GiLt 03ta63VT2c/x56wlcnOmi0H1XbQ1f1iadYXGg7Xs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Zhou Qingyang , Alex Deucher , Sasha Levin Subject: [PATCH 4.19 065/239] drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() Date: Mon, 24 Jan 2022 19:41:43 +0100 Message-Id: <20220124183945.200714864@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zhou Qingyang [ Upstream commit ab50cb9df8896b39aae65c537a30de2c79c19735 ] In radeon_driver_open_kms(), radeon_vm_bo_add() is assigned to vm->ib_bo_va and passes and used in radeon_vm_bo_set_addr(). In radeon_vm_bo_set_addr(), there is a dereference of vm->ib_bo_va, which could lead to a NULL pointer dereference on failure of radeon_vm_bo_add(). Fix this bug by adding a check of vm->ib_bo_va. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DRM_RADEON=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: cc9e67e3d700 ("drm/radeon: fix VM IB handling") Reviewed-by: Christian K=C3=B6nig Signed-off-by: Zhou Qingyang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/radeon/radeon_kms.c | 36 ++++++++++++++++------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/r= adeon_kms.c index 3f75b4be7fa4a..b60365d3a432a 100644 --- a/drivers/gpu/drm/radeon/radeon_kms.c +++ b/drivers/gpu/drm/radeon/radeon_kms.c @@ -623,6 +623,8 @@ void radeon_driver_lastclose_kms(struct drm_device *dev) int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_p= riv) { struct radeon_device *rdev =3D dev->dev_private; + struct radeon_fpriv *fpriv; + struct radeon_vm *vm; int r; =20 file_priv->driver_priv =3D NULL; @@ -635,8 +637,6 @@ int radeon_driver_open_kms(struct drm_device *dev, stru= ct drm_file *file_priv) =20 /* new gpu have virtual address space support */ if (rdev->family >=3D CHIP_CAYMAN) { - struct radeon_fpriv *fpriv; - struct radeon_vm *vm; =20 fpriv =3D kzalloc(sizeof(*fpriv), GFP_KERNEL); if (unlikely(!fpriv)) { @@ -647,35 +647,39 @@ int radeon_driver_open_kms(struct drm_device *dev, st= ruct drm_file *file_priv) if (rdev->accel_working) { vm =3D &fpriv->vm; r =3D radeon_vm_init(rdev, vm); - if (r) { - kfree(fpriv); - goto out_suspend; - } + if (r) + goto out_fpriv; =20 r =3D radeon_bo_reserve(rdev->ring_tmp_bo.bo, false); - if (r) { - radeon_vm_fini(rdev, vm); - kfree(fpriv); - goto out_suspend; - } + if (r) + goto out_vm_fini; =20 /* map the ib pool buffer read only into * virtual address space */ vm->ib_bo_va =3D radeon_vm_bo_add(rdev, vm, rdev->ring_tmp_bo.bo); + if (!vm->ib_bo_va) { + r =3D -ENOMEM; + goto out_vm_fini; + } + r =3D radeon_vm_bo_set_addr(rdev, vm->ib_bo_va, RADEON_VA_IB_OFFSET, RADEON_VM_PAGE_READABLE | RADEON_VM_PAGE_SNOOPED); - if (r) { - radeon_vm_fini(rdev, vm); - kfree(fpriv); - goto out_suspend; - } + if (r) + goto out_vm_fini; } file_priv->driver_priv =3D fpriv; } =20 + if (!r) + goto out_suspend; + +out_vm_fini: + radeon_vm_fini(rdev, vm); +out_fpriv: + kfree(fpriv); out_suspend: pm_runtime_mark_last_busy(dev->dev); pm_runtime_put_autosuspend(dev->dev); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD1B1C4332F for ; Mon, 24 Jan 2022 19:26:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350256AbiAXTYo (ORCPT ); Mon, 24 Jan 2022 14:24:44 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44530 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230384AbiAXTP2 (ORCPT ); Mon, 24 Jan 2022 14:15:28 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 32D35612A5; Mon, 24 Jan 2022 19:15:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E3D7C340E5; Mon, 24 Jan 2022 19:15:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051726; bh=+Y5rCE8pky0SVMuid6BEie+bScD2LnKU6fGjCqvgFGU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J9bEX6f8K1muS17Lh6z/B9GkMLC0GwEeN8xwbUOC9otbOcjqC/jawW3WIXIuSpB4d /+oNkykwMMf2hvjLAZoHm8EZM40ZOGyc3AZBQ9fl2s5CDlJ2er3X//Xj0Dnj2KPQFC l545ivIrRMdQeyF8+qjwhr03CmAImpU2dsann6MQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lizhi Hou , Sasha Levin Subject: [PATCH 4.19 066/239] tty: serial: uartlite: allow 64 bit address Date: Mon, 24 Jan 2022 19:41:44 +0100 Message-Id: <20220124183945.237568972@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lizhi Hou [ Upstream commit 3672fb65155530b5eea6225685c75329b6debec3 ] The base address of uartlite registers could be 64 bit address which is from device resource. When ulite_probe() calls ulite_assign(), this 64 bit address is casted to 32-bit. The fix is to replace "u32" type with "phys_addr_t" type for the base address in ulite_assign() argument list. Fixes: 8fa7b6100693 ("[POWERPC] Uartlite: Separate the bus binding from the= driver proper") Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20211129202302.1319033-1-lizhi.hou@xilinx.c= om Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/uartlite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c index 8df3058226687..5d1b7455e627d 100644 --- a/drivers/tty/serial/uartlite.c +++ b/drivers/tty/serial/uartlite.c @@ -618,7 +618,7 @@ static struct uart_driver ulite_uart_driver =3D { * * Returns: 0 on success, <0 otherwise */ -static int ulite_assign(struct device *dev, int id, u32 base, int irq, +static int ulite_assign(struct device *dev, int id, phys_addr_t base, int = irq, struct uartlite_data *pdata) { struct uart_port *port; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05563C433F5 for ; Mon, 24 Jan 2022 19:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350365AbiAXTYx (ORCPT ); Mon, 24 Jan 2022 14:24:53 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40546 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343943AbiAXTPe (ORCPT ); Mon, 24 Jan 2022 14:15:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EF3D9B8122A; Mon, 24 Jan 2022 19:15:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A8F8C340E5; Mon, 24 Jan 2022 19:15:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051729; bh=H+TtTiaS+wXHHNh6mrbg38+/ZuFn+N7M8uOJBPK0OBQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WGkN14v/pSxcuBofLN5tA3mwCuDjolgI9jA+9qKz94GxSC+jFJdnZDNc8CxsU3r6f JR6zAr3asBCTGXRWYRlytS7UvAIMDIylEfkjcSWwWcIdmV1XfKm7478xIl/Hp9kmSu 4vvxZa9irRILZF8tAeMVJDIOdvyuGX+vOR5Cpnnw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lino Sanfilippo , Sasha Levin Subject: [PATCH 4.19 067/239] serial: amba-pl011: do not request memory region twice Date: Mon, 24 Jan 2022 19:41:45 +0100 Message-Id: <20220124183945.267710790@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lino Sanfilippo [ Upstream commit d1180405c7b5c7a1c6bde79d5fc24fe931430737 ] With commit 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") the function devm_ioremap() called from pl011_setup_port() was replaced with devm_ioremap_resource(). Since this function not only remaps but also requests the ports io memory region it now collides with the .config_port() callback which requests the same region at uart port registration. Since devm_ioremap_resource() already claims the memory successfully, the request in .config_port() fails. Later at uart port deregistration the attempt to release the unclaimed memory also fails. The failure results in a =E2=80=9CTrying to free nonexis= tent resource" warning. Fix these issues by removing the callbacks that implement the redundant memory allocation/release. Also make sure that changing the drivers io memory base address via TIOCSSERIAL is not allowed any more. Fixes: 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") Signed-off-by: Lino Sanfilippo Link: https://lore.kernel.org/r/20211129174238.8333-1-LinoSanfilippo@gmx.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/amba-pl011.c | 27 +++------------------------ 1 file changed, 3 insertions(+), 24 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl01= 1.c index 3d63e9a71c376..5edc3813a9b99 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -2094,32 +2094,13 @@ static const char *pl011_type(struct uart_port *por= t) return uap->port.type =3D=3D PORT_AMBA ? uap->type : NULL; } =20 -/* - * Release the memory region(s) being used by 'port' - */ -static void pl011_release_port(struct uart_port *port) -{ - release_mem_region(port->mapbase, SZ_4K); -} - -/* - * Request the memory region(s) being used by 'port' - */ -static int pl011_request_port(struct uart_port *port) -{ - return request_mem_region(port->mapbase, SZ_4K, "uart-pl011") - !=3D NULL ? 0 : -EBUSY; -} - /* * Configure/autoconfigure the port. */ static void pl011_config_port(struct uart_port *port, int flags) { - if (flags & UART_CONFIG_TYPE) { + if (flags & UART_CONFIG_TYPE) port->type =3D PORT_AMBA; - pl011_request_port(port); - } } =20 /* @@ -2134,6 +2115,8 @@ static int pl011_verify_port(struct uart_port *port, = struct serial_struct *ser) ret =3D -EINVAL; if (ser->baud_base < 9600) ret =3D -EINVAL; + if (port->mapbase !=3D (unsigned long) ser->iomem_base) + ret =3D -EINVAL; return ret; } =20 @@ -2151,8 +2134,6 @@ static const struct uart_ops amba_pl011_pops =3D { .flush_buffer =3D pl011_dma_flush_buffer, .set_termios =3D pl011_set_termios, .type =3D pl011_type, - .release_port =3D pl011_release_port, - .request_port =3D pl011_request_port, .config_port =3D pl011_config_port, .verify_port =3D pl011_verify_port, #ifdef CONFIG_CONSOLE_POLL @@ -2182,8 +2163,6 @@ static const struct uart_ops sbsa_uart_pops =3D { .shutdown =3D sbsa_uart_shutdown, .set_termios =3D sbsa_uart_set_termios, .type =3D pl011_type, - .release_port =3D pl011_release_port, - .request_port =3D pl011_request_port, .config_port =3D pl011_config_port, .verify_port =3D pl011_verify_port, #ifdef CONFIG_CONSOLE_POLL --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDB3EC433F5 for ; Mon, 24 Jan 2022 19:26:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350330AbiAXTYu (ORCPT ); Mon, 24 Jan 2022 14:24:50 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40558 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343524AbiAXTPf (ORCPT ); Mon, 24 Jan 2022 14:15:35 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0EB5AB8121F; Mon, 24 Jan 2022 19:15:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3045CC340E5; Mon, 24 Jan 2022 19:15:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051732; bh=pUEzmvsB/pzJ/e1MCSvYHZXzc52nrVDsD0HUPDnJMUc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zmb3wxAgIIl9gCA5oU5qdvjIlPOu3XbwZSIY3bPzg5FFf20nRAUCg7CAnXopDvj1U kCouvpIwz3qT9vkNzG2JzdfoOE/+xqzney9oVD7oocFQ3ONKOWtyq90KLK4GiiroEA d6Mc1keKlZLdYadLDQpab9vkAJ3jyL1pWpEPfYU8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tasos Sahanidis , Denis Efremov , Jens Axboe , Sasha Levin Subject: [PATCH 4.19 068/239] floppy: Fix hang in watchdog when disk is ejected Date: Mon, 24 Jan 2022 19:41:46 +0100 Message-Id: <20220124183945.297103403@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tasos Sahanidis [ Upstream commit fb48febce7e30baed94dd791e19521abd2c3fd83 ] When the watchdog detects a disk change, it calls cancel_activity(), which in turn tries to cancel the fd_timer delayed work. In the above scenario, fd_timer_fn is set to fd_watchdog(), meaning it is trying to cancel its own work. This results in a hang as cancel_delayed_work_sync() is waiting for the watchdog (itself) to return, which never happens. This can be reproduced relatively consistently by attempting to read a broken floppy, and ejecting it while IO is being attempted and retried. To resolve this, this patch calls cancel_delayed_work() instead, which cancels the work without waiting for the watchdog to return and finish. Before this regression was introduced, the code in this section used del_timer(), and not del_timer_sync() to delete the watchdog timer. Link: https://lore.kernel.org/r/399e486c-6540-db27-76aa-7a271b061f76@tasoss= ah.com Fixes: 070ad7e793dc ("floppy: convert to delayed work and single-thread wq") Signed-off-by: Tasos Sahanidis Signed-off-by: Denis Efremov Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/block/floppy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 8f444b375761c..49ac9596c862e 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -1002,7 +1002,7 @@ static DECLARE_DELAYED_WORK(fd_timer, fd_timer_workfn= ); static void cancel_activity(void) { do_floppy =3D NULL; - cancel_delayed_work_sync(&fd_timer); + cancel_delayed_work(&fd_timer); cancel_work_sync(&floppy_work); } =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81801C43217 for ; Mon, 24 Jan 2022 19:26:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350344AbiAXTYv (ORCPT ); Mon, 24 Jan 2022 14:24:51 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44614 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345000AbiAXTPg (ORCPT ); Mon, 24 Jan 2022 14:15:36 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 44C7960010; Mon, 24 Jan 2022 19:15:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 57CA2C340E5; Mon, 24 Jan 2022 19:15:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051735; bh=suquYQEhvvhQdPUfWh50Vlo6qQzW8pXNTM+Kg+H+w6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DGLhGXgNrWNP3fVaH6j5g6wQZ0E1N3XbdecnDc7r9s9QmgGAmcDy618EiFJStnBVm f5hxtQquaj9N81AJO58DI+UkmGFK1lfFbSGNKjvMWaOVCt7PZCb8o0j8uCMHPNR2y1 P8LEe/i3vQ2ZfVPsmsknuvppnT2HBJzPJ49rp9m8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 069/239] media: dib8000: Fix a memleak in dib8000_init() Date: Mon, 24 Jan 2022 19:41:47 +0100 Message-Id: <20220124183945.326162430@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 8dbdcc7269a83305ee9d677b75064d3530a48ee2 ] In dib8000_init(), the variable fe is not freed or passed out on the failure of dib8000_identify(&state->i2c), which could lead to a memleak. Fix this bug by adding a kfree of fe in the error path. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DVB_DIB8000=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: 77e2c0f5d471 ("V4L/DVB (12900): DiB8000: added support for DiBcom IS= DB-T/ISDB-Tsb demodulator DiB8000") Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/dvb-frontends/dib8000.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-fron= tends/dib8000.c index 5fa787e023c7e..4b9e4afa4c61f 100644 --- a/drivers/media/dvb-frontends/dib8000.c +++ b/drivers/media/dvb-frontends/dib8000.c @@ -4476,8 +4476,10 @@ static struct dvb_frontend *dib8000_init(struct i2c_= adapter *i2c_adap, u8 i2c_ad =20 state->timf_default =3D cfg->pll->timf; =20 - if (dib8000_identify(&state->i2c) =3D=3D 0) + if (dib8000_identify(&state->i2c) =3D=3D 0) { + kfree(fe); goto error; + } =20 dibx000_init_i2c_master(&state->i2c_master, DIB8000, state->i2c.adap, sta= te->i2c.addr); =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2929FC433EF for ; Mon, 24 Jan 2022 19:28:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348123AbiAXT1z (ORCPT ); Mon, 24 Jan 2022 14:27:55 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:42900 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345004AbiAXTRx (ORCPT ); Mon, 24 Jan 2022 14:17:53 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 54614B81236; Mon, 24 Jan 2022 19:17:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68744C340E5; Mon, 24 Jan 2022 19:17:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051870; bh=anLyqKY8xcsWg1zMq4nAdOxhcpkR8TKpIZYGmfktLU4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zHUzKFuyYj7O1ztLjR97lT868Q6hocO/pXeMPdFbA1pq3neEzxn1xDIK/4BP62G0R lCainNlY+5lz5D+ZiEOC0ii5KGtVOcO3/67dvPQXC33G0+FET7/5CLp60ftcFk6Gth qqh7DvEmpUCeEsVY5nQxXEX571Ha4RGbMWtA9JhY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 070/239] media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() Date: Mon, 24 Jan 2022 19:41:48 +0100 Message-Id: <20220124183945.355676783@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 0407c49ebe330333478440157c640fffd986f41b ] In mxb_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. saa7146_vv_release() will be called on failure of mxb_probe(dev). There is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init(). Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_MXB=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: 03b1930efd3c ("V4L/DVB: saa7146: fix regression of the av7110/budget= -av driver") Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/pci/saa7146/mxb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mx= b.c index 6e25654da2567..bfa7a7d15dbf6 100644 --- a/drivers/media/pci/saa7146/mxb.c +++ b/drivers/media/pci/saa7146/mxb.c @@ -695,10 +695,16 @@ static struct saa7146_ext_vv vv_data; static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio= n_data *info) { struct mxb *mxb; + int ret; =20 DEB_EE("dev:%p\n", dev); =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + ERR("Error in saa7146_vv_init()"); + return ret; + } + if (mxb_probe(dev)) { saa7146_vv_release(dev); return -1; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B599C433EF for ; Mon, 24 Jan 2022 19:26:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350629AbiAXTZG (ORCPT ); Mon, 24 Jan 2022 14:25:06 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:41008 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345553AbiAXTQF (ORCPT ); Mon, 24 Jan 2022 14:16:05 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4CC76B81239; Mon, 24 Jan 2022 19:16:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8AC0FC340E5; Mon, 24 Jan 2022 19:16:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051761; bh=fxIcijDm8L9oCOppf0o3EfmLEZnZ6wIJ8/2oMQ+qcvQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J8zXUhb3ncHjePDoVPLQxM86hoLC2DqUHor64b1JCnvH9m8gabJiDgrrYrRG8LsYx 4JWLLUb8K8ub7iiKnffkHY3ZaPvhmnSUK6FC0EyYA1EbGYXWqV3t0YU7higoCBWWwG vIGdnFKw6MlLgohwuRrKBzouPXvaaFp5pNvO5Xuk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Schlabbach , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 071/239] media: si2157: Fix "warm" tuner state detection Date: Mon, 24 Jan 2022 19:41:49 +0100 Message-Id: <20220124183945.386721052@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Schlabbach [ Upstream commit a6441ea29cb2c9314654e093a1cd8020b9b851c8 ] Commit e955f959ac52 ("media: si2157: Better check for running tuner in init") completely broke the "warm" tuner detection of the si2157 driver due to a simple endian error: The Si2157 CRYSTAL_TRIM property code is 0x0402 and needs to be transmitted LSB first. However, it was inserted MSB first, causing the warm detection to always fail and spam the kernel log with tuner initialization messages each time the DVB frontend device was closed and reopened: [ 312.215682] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 312.264334] si2157 16-0060: firmware version: 3.0.5 [ 342.248593] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 342.295743] si2157 16-0060: firmware version: 3.0.5 [ 372.328574] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 372.385035] si2157 16-0060: firmware version: 3.0.5 Also, the reinitializations were observed disturb _other_ tuners on multi-tuner cards such as the Hauppauge WinTV-QuadHD, leading to missed or errored packets when one of the other DVB frontend devices on that card was opened. Fix the order of the property code bytes to make the warm detection work again, also reducing the tuner initialization message in the kernel log to once per power-on, as well as fixing the interference with other tuners. Link: https://lore.kernel.org/linux-media/trinity-2a86eb9d-6264-4387-95e1-b= a7b79a4050f-1638392923493@3c-app-gmx-bap03 Fixes: e955f959ac52 ("media: si2157: Better check for running tuner in init= ") Reported-by: Robert Schlabbach Signed-off-by: Robert Schlabbach Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/tuners/si2157.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c index 13770b038048e..a4bba669f234d 100644 --- a/drivers/media/tuners/si2157.c +++ b/drivers/media/tuners/si2157.c @@ -89,7 +89,7 @@ static int si2157_init(struct dvb_frontend *fe) dev_dbg(&client->dev, "\n"); =20 /* Try to get Xtal trim property, to verify tuner still running */ - memcpy(cmd.args, "\x15\x00\x04\x02", 4); + memcpy(cmd.args, "\x15\x00\x02\x04", 4); cmd.wlen =3D 4; cmd.rlen =3D 4; ret =3D si2157_cmd_execute(client, &cmd); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F348DC4332F for ; Mon, 24 Jan 2022 19:41:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355542AbiAXTlr (ORCPT ); Mon, 24 Jan 2022 14:41:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53352 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353763AbiAXTfU (ORCPT ); Mon, 24 Jan 2022 14:35:20 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E4D9CC0A893A; Mon, 24 Jan 2022 11:16:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7B4996121F; Mon, 24 Jan 2022 19:16:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4FC1BC340E5; Mon, 24 Jan 2022 19:16:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051794; bh=/MtwEjQmi6Z/hKYMuHWTxOW7JOqE1TNJzX7HKcDbGzQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zmug4/KEt78FkiQpU2HRvNTV3IkH5AgU0YOIayLDJm+lXZNetX89HmQnqceIdwr7s tTncvXq5fqKb8cOI4m24cDWhHmLB9a22ov1/EcJTHkmB3ZtouYTquLcMf0ddCvFlsw jvEx2vKOMzKjGs4ra+jwf8c48BAjvvBPFQP5l4hY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Li Hua , "Peter Zijlstra (Intel)" , Sasha Levin Subject: [PATCH 4.19 072/239] sched/rt: Try to restart rt period timer when rt runtime exceeded Date: Mon, 24 Jan 2022 19:41:50 +0100 Message-Id: <20220124183945.417814701@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Li Hua [ Upstream commit 9b58e976b3b391c0cf02e038d53dd0478ed3013c ] When rt_runtime is modified from -1 to a valid control value, it may cause the task to be throttled all the time. Operations like the following will trigger the bug. E.g: 1. echo -1 > /proc/sys/kernel/sched_rt_runtime_us 2. Run a FIFO task named A that executes while(1) 3. echo 950000 > /proc/sys/kernel/sched_rt_runtime_us When rt_runtime is -1, The rt period timer will not be activated when task A enqueued. And then the task will be throttled after setting rt_runtime to 950,000. The task will always be throttled because the rt period timer is not activated. Fixes: d0b27fa77854 ("sched: rt-group: synchonised bandwidth period") Reported-by: Hulk Robot Signed-off-by: Li Hua Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20211203033618.11895-1-hucool.lihua@huawei.= com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/sched/rt.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index b980cc96604fa..70e8cd3954745 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -50,11 +50,8 @@ void init_rt_bandwidth(struct rt_bandwidth *rt_b, u64 pe= riod, u64 runtime) rt_b->rt_period_timer.function =3D sched_rt_period_timer; } =20 -static void start_rt_bandwidth(struct rt_bandwidth *rt_b) +static inline void do_start_rt_bandwidth(struct rt_bandwidth *rt_b) { - if (!rt_bandwidth_enabled() || rt_b->rt_runtime =3D=3D RUNTIME_INF) - return; - raw_spin_lock(&rt_b->rt_runtime_lock); if (!rt_b->rt_period_active) { rt_b->rt_period_active =3D 1; @@ -72,6 +69,14 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b) raw_spin_unlock(&rt_b->rt_runtime_lock); } =20 +static void start_rt_bandwidth(struct rt_bandwidth *rt_b) +{ + if (!rt_bandwidth_enabled() || rt_b->rt_runtime =3D=3D RUNTIME_INF) + return; + + do_start_rt_bandwidth(rt_b); +} + void init_rt_rq(struct rt_rq *rt_rq) { struct rt_prio_array *array; @@ -980,13 +985,17 @@ static void update_curr_rt(struct rq *rq) =20 for_each_sched_rt_entity(rt_se) { struct rt_rq *rt_rq =3D rt_rq_of_se(rt_se); + int exceeded; =20 if (sched_rt_runtime(rt_rq) !=3D RUNTIME_INF) { raw_spin_lock(&rt_rq->rt_runtime_lock); rt_rq->rt_time +=3D delta_exec; - if (sched_rt_runtime_exceeded(rt_rq)) + exceeded =3D sched_rt_runtime_exceeded(rt_rq); + if (exceeded) resched_curr(rq); raw_spin_unlock(&rt_rq->rt_runtime_lock); + if (exceeded) + do_start_rt_bandwidth(sched_rt_bandwidth(rt_rq)); } } } @@ -2655,8 +2664,12 @@ static int sched_rt_global_validate(void) =20 static void sched_rt_do_global(void) { + unsigned long flags; + + raw_spin_lock_irqsave(&def_rt_bandwidth.rt_runtime_lock, flags); def_rt_bandwidth.rt_runtime =3D global_rt_runtime(); def_rt_bandwidth.rt_period =3D ns_to_ktime(global_rt_period()); + raw_spin_unlock_irqrestore(&def_rt_bandwidth.rt_runtime_lock, flags); } =20 int sched_rt_handler(struct ctl_table *table, int write, --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77E07C4321E for ; Mon, 24 Jan 2022 19:26:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350829AbiAXTZY (ORCPT ); Mon, 24 Jan 2022 14:25:24 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:42402 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347914AbiAXTRM (ORCPT ); Mon, 24 Jan 2022 14:17:12 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A50D3B81232; Mon, 24 Jan 2022 19:17:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE194C340E5; Mon, 24 Jan 2022 19:17:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051829; bh=ZpzskAMDsXMc0AdS51AL/fglH6GoxgYxnHsplx/d8gI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jdPtLMtqs51dOTWw01SqFOXfxozffEuMRpty9oRC/jx5Zw1/wGAOhEMYAk1vFROJ/ JgMZ+b5veHGPlHiuGAPAx7kziYBE0+DEVVE8vW36X4NsvjSHHQUlSDhso8XN1p4imy YaDuVH2+8jPmNrFpe1NrCHkT1LTJPUpnllsppCjo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Steffen Klassert , Sasha Levin Subject: [PATCH 4.19 073/239] xfrm: fix a small bug in xfrm_sa_len() Date: Mon, 24 Jan 2022 19:41:51 +0100 Message-Id: <20220124183945.447070797@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 7770a39d7c63faec6c4f33666d49a8cb664d0482 ] copy_user_offload() will actually push a struct struct xfrm_user_offload, which is different than (struct xfrm_state *)->xso (struct xfrm_state_offload) Fixes: d77e38e612a01 ("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Eric Dumazet Cc: Steffen Klassert Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index f94abe1fdd58f..87932f6ad9d75 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2813,7 +2813,7 @@ static inline unsigned int xfrm_sa_len(struct xfrm_st= ate *x) if (x->props.extra_flags) l +=3D nla_total_size(sizeof(x->props.extra_flags)); if (x->xso.dev) - l +=3D nla_total_size(sizeof(x->xso)); + l +=3D nla_total_size(sizeof(struct xfrm_user_offload)); if (x->props.smark.v | x->props.smark.m) { l +=3D nla_total_size(sizeof(x->props.smark.v)); l +=3D nla_total_size(sizeof(x->props.smark.m)); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB9B7C35272 for ; Mon, 24 Jan 2022 19:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359001AbiAXT4I (ORCPT ); Mon, 24 Jan 2022 14:56:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53492 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354759AbiAXThv (ORCPT ); Mon, 24 Jan 2022 14:37:51 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 33F1CC0085BD; Mon, 24 Jan 2022 11:17:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B13E56131D; Mon, 24 Jan 2022 19:17:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 84D45C340E5; Mon, 24 Jan 2022 19:17:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051851; bh=MVcReX3W2UATrsEc/FCbBHApTKVMcOq6AMGjgtU5CP0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fJocDCPBDEdIOz8mb18qcqcXQoWCfRbwohMsxnW1k7S1bzTiKMo+P0tMdSpiQ/LA/ NexNgklJVF/Uzwvcyfm5Mt2dU6Z0k177UJPrKqyehVSAp+6L8BrCvS5wL7ApFVmLWh hkzokrZ9qgoF4t1m4h2v/iBhTBGpC2jm057/uiVc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marek Vasut , Nicolas Toromanoff , Herbert Xu , Sasha Levin Subject: [PATCH 4.19 074/239] crypto: stm32/cryp - fix double pm exit Date: Mon, 24 Jan 2022 19:41:52 +0100 Message-Id: <20220124183945.477087875@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nicolas Toromanoff [ Upstream commit 6c12e742785bf9333faf60bfb96575bdd763448e ] Delete extraneous lines in probe error handling code: pm was disabled twice. Fixes: 65f9aa36ee47 ("crypto: stm32/cryp - Add power management support") Reported-by: Marek Vasut Signed-off-by: Nicolas Toromanoff Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/crypto/stm32/stm32-cryp.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32= -cryp.c index 23b0b7bd64c7f..b3b49dce11369 100644 --- a/drivers/crypto/stm32/stm32-cryp.c +++ b/drivers/crypto/stm32/stm32-cryp.c @@ -2036,8 +2036,6 @@ err_engine1: list_del(&cryp->list); spin_unlock(&cryp_list.lock); =20 - pm_runtime_disable(dev); - pm_runtime_put_noidle(dev); pm_runtime_disable(dev); pm_runtime_put_noidle(dev); =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89FFBC433FE for ; Mon, 24 Jan 2022 19:48:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347913AbiAXTs0 (ORCPT ); Mon, 24 Jan 2022 14:48:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344735AbiAXTiB (ORCPT ); Mon, 24 Jan 2022 14:38:01 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 23256C034018; Mon, 24 Jan 2022 11:17:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CC65461302; Mon, 24 Jan 2022 19:17:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9BC50C340E7; Mon, 24 Jan 2022 19:17:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051854; bh=EJgoFtTl4eify1IUXr818WdwvCYS5XNlYluJSAyTn+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dBmBIqdFTy0u1eCp4yoDwpD4w4E0zIjqshiPZyjQFjuGif1AEb8CTFVUytmuLuGRx WOYi21zr6EeZjFvddbWb1JJtuNb2pwPxRxwBJRRqFiKE7fLih+HJTINcSLFx7WGttK 9Ez9QZWF0UJWGo0X2703qTKma3KCkgcvHKNBb9CY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Anton Vasilyev , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 075/239] media: dw2102: Fix use after free Date: Mon, 24 Jan 2022 19:41:53 +0100 Message-Id: <20220124183945.506614198@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Anton Vasilyev [ Upstream commit 589a9f0eb799f77de2c09583bf5bad221fa5d685 ] dvb_usb_device_init stores parts of properties at d->props and d->desc and uses it on dvb_usb_device_exit. Free of properties on module probe leads to use after free. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=3D204597 The patch makes properties static instead of allocated on heap to prevent memleak and use after free. Also fixes s421_properties.devices initialization to have 2 element instead of 6 copied from p7500_properties. [mchehab: fix function call alignments] Link: https://lore.kernel.org/linux-media/20190822104147.4420-1-vasilyev@is= pras.ru Signed-off-by: Anton Vasilyev Fixes: 299c7007e936 ("media: dw2102: Fix memleak on sequence of probes") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/dvb-usb/dw2102.c | 338 ++++++++++++++++++----------- 1 file changed, 215 insertions(+), 123 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb= /dw2102.c index 9ce8b4d79d1fa..ebb0c982a6f21 100644 --- a/drivers/media/usb/dvb-usb/dw2102.c +++ b/drivers/media/usb/dvb-usb/dw2102.c @@ -2101,46 +2101,153 @@ static struct dvb_usb_device_properties s6x0_prope= rties =3D { } }; =20 -static const struct dvb_usb_device_description d1100 =3D { - "Prof 1100 USB ", - {&dw2102_table[PROF_1100], NULL}, - {NULL}, -}; +static struct dvb_usb_device_properties p1100_properties =3D { + .caps =3D DVB_USB_IS_AN_I2C_ADAPTER, + .usb_ctrl =3D DEVICE_SPECIFIC, + .size_of_priv =3D sizeof(struct dw2102_state), + .firmware =3D P1100_FIRMWARE, + .no_reconnect =3D 1, =20 -static const struct dvb_usb_device_description d660 =3D { - "TeVii S660 USB", - {&dw2102_table[TEVII_S660], NULL}, - {NULL}, -}; + .i2c_algo =3D &s6x0_i2c_algo, + .rc.core =3D { + .rc_interval =3D 150, + .rc_codes =3D RC_MAP_TBS_NEC, + .module_name =3D "dw2102", + .allowed_protos =3D RC_PROTO_BIT_NEC, + .rc_query =3D prof_rc_query, + }, =20 -static const struct dvb_usb_device_description d480_1 =3D { - "TeVii S480.1 USB", - {&dw2102_table[TEVII_S480_1], NULL}, - {NULL}, + .generic_bulk_ctrl_endpoint =3D 0x81, + .num_adapters =3D 1, + .download_firmware =3D dw2102_load_firmware, + .read_mac_address =3D s6x0_read_mac_address, + .adapter =3D { + { + .num_frontends =3D 1, + .fe =3D {{ + .frontend_attach =3D stv0288_frontend_attach, + .stream =3D { + .type =3D USB_BULK, + .count =3D 8, + .endpoint =3D 0x82, + .u =3D { + .bulk =3D { + .buffersize =3D 4096, + } + } + }, + } }, + } + }, + .num_device_descs =3D 1, + .devices =3D { + {"Prof 1100 USB ", + {&dw2102_table[PROF_1100], NULL}, + {NULL}, + }, + } }; =20 -static const struct dvb_usb_device_description d480_2 =3D { - "TeVii S480.2 USB", - {&dw2102_table[TEVII_S480_2], NULL}, - {NULL}, -}; +static struct dvb_usb_device_properties s660_properties =3D { + .caps =3D DVB_USB_IS_AN_I2C_ADAPTER, + .usb_ctrl =3D DEVICE_SPECIFIC, + .size_of_priv =3D sizeof(struct dw2102_state), + .firmware =3D S660_FIRMWARE, + .no_reconnect =3D 1, =20 -static const struct dvb_usb_device_description d7500 =3D { - "Prof 7500 USB DVB-S2", - {&dw2102_table[PROF_7500], NULL}, - {NULL}, -}; + .i2c_algo =3D &s6x0_i2c_algo, + .rc.core =3D { + .rc_interval =3D 150, + .rc_codes =3D RC_MAP_TEVII_NEC, + .module_name =3D "dw2102", + .allowed_protos =3D RC_PROTO_BIT_NEC, + .rc_query =3D dw2102_rc_query, + }, =20 -static const struct dvb_usb_device_description d421 =3D { - "TeVii S421 PCI", - {&dw2102_table[TEVII_S421], NULL}, - {NULL}, + .generic_bulk_ctrl_endpoint =3D 0x81, + .num_adapters =3D 1, + .download_firmware =3D dw2102_load_firmware, + .read_mac_address =3D s6x0_read_mac_address, + .adapter =3D { + { + .num_frontends =3D 1, + .fe =3D {{ + .frontend_attach =3D ds3000_frontend_attach, + .stream =3D { + .type =3D USB_BULK, + .count =3D 8, + .endpoint =3D 0x82, + .u =3D { + .bulk =3D { + .buffersize =3D 4096, + } + } + }, + } }, + } + }, + .num_device_descs =3D 3, + .devices =3D { + {"TeVii S660 USB", + {&dw2102_table[TEVII_S660], NULL}, + {NULL}, + }, + {"TeVii S480.1 USB", + {&dw2102_table[TEVII_S480_1], NULL}, + {NULL}, + }, + {"TeVii S480.2 USB", + {&dw2102_table[TEVII_S480_2], NULL}, + {NULL}, + }, + } }; =20 -static const struct dvb_usb_device_description d632 =3D { - "TeVii S632 USB", - {&dw2102_table[TEVII_S632], NULL}, - {NULL}, +static struct dvb_usb_device_properties p7500_properties =3D { + .caps =3D DVB_USB_IS_AN_I2C_ADAPTER, + .usb_ctrl =3D DEVICE_SPECIFIC, + .size_of_priv =3D sizeof(struct dw2102_state), + .firmware =3D P7500_FIRMWARE, + .no_reconnect =3D 1, + + .i2c_algo =3D &s6x0_i2c_algo, + .rc.core =3D { + .rc_interval =3D 150, + .rc_codes =3D RC_MAP_TBS_NEC, + .module_name =3D "dw2102", + .allowed_protos =3D RC_PROTO_BIT_NEC, + .rc_query =3D prof_rc_query, + }, + + .generic_bulk_ctrl_endpoint =3D 0x81, + .num_adapters =3D 1, + .download_firmware =3D dw2102_load_firmware, + .read_mac_address =3D s6x0_read_mac_address, + .adapter =3D { + { + .num_frontends =3D 1, + .fe =3D {{ + .frontend_attach =3D prof_7500_frontend_attach, + .stream =3D { + .type =3D USB_BULK, + .count =3D 8, + .endpoint =3D 0x82, + .u =3D { + .bulk =3D { + .buffersize =3D 4096, + } + } + }, + } }, + } + }, + .num_device_descs =3D 1, + .devices =3D { + {"Prof 7500 USB DVB-S2", + {&dw2102_table[PROF_7500], NULL}, + {NULL}, + }, + } }; =20 static struct dvb_usb_device_properties su3000_properties =3D { @@ -2212,6 +2319,59 @@ static struct dvb_usb_device_properties su3000_prope= rties =3D { } }; =20 +static struct dvb_usb_device_properties s421_properties =3D { + .caps =3D DVB_USB_IS_AN_I2C_ADAPTER, + .usb_ctrl =3D DEVICE_SPECIFIC, + .size_of_priv =3D sizeof(struct dw2102_state), + .power_ctrl =3D su3000_power_ctrl, + .num_adapters =3D 1, + .identify_state =3D su3000_identify_state, + .i2c_algo =3D &su3000_i2c_algo, + + .rc.core =3D { + .rc_interval =3D 150, + .rc_codes =3D RC_MAP_SU3000, + .module_name =3D "dw2102", + .allowed_protos =3D RC_PROTO_BIT_RC5, + .rc_query =3D su3000_rc_query, + }, + + .read_mac_address =3D su3000_read_mac_address, + + .generic_bulk_ctrl_endpoint =3D 0x01, + + .adapter =3D { + { + .num_frontends =3D 1, + .fe =3D {{ + .streaming_ctrl =3D su3000_streaming_ctrl, + .frontend_attach =3D m88rs2000_frontend_attach, + .stream =3D { + .type =3D USB_BULK, + .count =3D 8, + .endpoint =3D 0x82, + .u =3D { + .bulk =3D { + .buffersize =3D 4096, + } + } + } + } }, + } + }, + .num_device_descs =3D 2, + .devices =3D { + { "TeVii S421 PCI", + { &dw2102_table[TEVII_S421], NULL }, + { NULL }, + }, + { "TeVii S632 USB", + { &dw2102_table[TEVII_S632], NULL }, + { NULL }, + }, + } +}; + static struct dvb_usb_device_properties t220_properties =3D { .caps =3D DVB_USB_IS_AN_I2C_ADAPTER, .usb_ctrl =3D DEVICE_SPECIFIC, @@ -2329,101 +2489,33 @@ static struct dvb_usb_device_properties tt_s2_4600= _properties =3D { static int dw2102_probe(struct usb_interface *intf, const struct usb_device_id *id) { - int retval =3D -ENOMEM; - struct dvb_usb_device_properties *p1100; - struct dvb_usb_device_properties *s660; - struct dvb_usb_device_properties *p7500; - struct dvb_usb_device_properties *s421; - - p1100 =3D kmemdup(&s6x0_properties, - sizeof(struct dvb_usb_device_properties), GFP_KERNEL); - if (!p1100) - goto err0; - - /* copy default structure */ - /* fill only different fields */ - p1100->firmware =3D P1100_FIRMWARE; - p1100->devices[0] =3D d1100; - p1100->rc.core.rc_query =3D prof_rc_query; - p1100->rc.core.rc_codes =3D RC_MAP_TBS_NEC; - p1100->adapter->fe[0].frontend_attach =3D stv0288_frontend_attach; - - s660 =3D kmemdup(&s6x0_properties, - sizeof(struct dvb_usb_device_properties), GFP_KERNEL); - if (!s660) - goto err1; - - s660->firmware =3D S660_FIRMWARE; - s660->num_device_descs =3D 3; - s660->devices[0] =3D d660; - s660->devices[1] =3D d480_1; - s660->devices[2] =3D d480_2; - s660->adapter->fe[0].frontend_attach =3D ds3000_frontend_attach; - - p7500 =3D kmemdup(&s6x0_properties, - sizeof(struct dvb_usb_device_properties), GFP_KERNEL); - if (!p7500) - goto err2; - - p7500->firmware =3D P7500_FIRMWARE; - p7500->devices[0] =3D d7500; - p7500->rc.core.rc_query =3D prof_rc_query; - p7500->rc.core.rc_codes =3D RC_MAP_TBS_NEC; - p7500->adapter->fe[0].frontend_attach =3D prof_7500_frontend_attach; - - - s421 =3D kmemdup(&su3000_properties, - sizeof(struct dvb_usb_device_properties), GFP_KERNEL); - if (!s421) - goto err3; - - s421->num_device_descs =3D 2; - s421->devices[0] =3D d421; - s421->devices[1] =3D d632; - s421->adapter->fe[0].frontend_attach =3D m88rs2000_frontend_attach; - - if (0 =3D=3D dvb_usb_device_init(intf, &dw2102_properties, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, &dw2104_properties, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, &dw3101_properties, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, &s6x0_properties, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, p1100, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, s660, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, p7500, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, s421, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, &su3000_properties, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, &t220_properties, - THIS_MODULE, NULL, adapter_nr) || - 0 =3D=3D dvb_usb_device_init(intf, &tt_s2_4600_properties, - THIS_MODULE, NULL, adapter_nr)) { - - /* clean up copied properties */ - kfree(s421); - kfree(p7500); - kfree(s660); - kfree(p1100); + if (!(dvb_usb_device_init(intf, &dw2102_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &dw2104_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &dw3101_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &s6x0_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &p1100_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &s660_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &p7500_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &s421_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &su3000_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &t220_properties, + THIS_MODULE, NULL, adapter_nr) && + dvb_usb_device_init(intf, &tt_s2_4600_properties, + THIS_MODULE, NULL, adapter_nr))) { =20 return 0; } =20 - retval =3D -ENODEV; - kfree(s421); -err3: - kfree(p7500); -err2: - kfree(s660); -err1: - kfree(p1100); -err0: - return retval; + return -ENODEV; } =20 static void dw2102_disconnect(struct usb_interface *intf) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4975BC433FE for ; Mon, 24 Jan 2022 19:27:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351581AbiAXT1e (ORCPT ); Mon, 24 Jan 2022 14:27:34 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44614 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345934AbiAXTRi (ORCPT ); Mon, 24 Jan 2022 14:17:38 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id ED9946133D; Mon, 24 Jan 2022 19:17:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0F6FC340E7; Mon, 24 Jan 2022 19:17:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051857; bh=2tlDt6Cs63ivblVqNROf09tHbLBAy/Z87u2ytLnMtfQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PLqsANrBh7VYOfKK+WRqn46qVeBQVTUSTFCpvOmLy7MwiQGONovCxMbpSQbJnGWoH G8wNys9l2lpeBCqeBu5MrY+hXHI8JA2cVNZX943eKCn+TA/Vn3KUb8l6A9O/MTCkxC YWCtWpwKx3KWMUvFHBuJxRAsZ3YosphQF1uLhCdM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 076/239] media: msi001: fix possible null-ptr-deref in msi001_probe() Date: Mon, 24 Jan 2022 19:41:54 +0100 Message-Id: <20220124183945.536846034@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Hai [ Upstream commit 3d5831a40d3464eea158180eb12cbd81c5edfb6a ] I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000060 ... RIP: 0010:v4l2_ctrl_auto_cluster+0x57/0x270 ... Call Trace: msi001_probe+0x13b/0x24b [msi001] spi_probe+0xeb/0x130 ... do_syscall_64+0x35/0xb0 In msi001_probe(), if the creation of control for bandwidth_auto fails, there will be a null-ptr-deref issue when it is used in v4l2_ctrl_auto_cluster(). Check dev->hdl.error before v4l2_ctrl_auto_cluster() to fix this bug. Link: https://lore.kernel.org/linux-media/20211026112348.2878040-1-wanghai3= 8@huawei.com Fixes: 93203dd6c7c4 ("[media] msi001: Mirics MSi001 silicon tuner driver") Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/tuners/msi001.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/media/tuners/msi001.c b/drivers/media/tuners/msi001.c index 5de6ed7287085..13ffe196b7a42 100644 --- a/drivers/media/tuners/msi001.c +++ b/drivers/media/tuners/msi001.c @@ -451,6 +451,13 @@ static int msi001_probe(struct spi_device *spi) V4L2_CID_RF_TUNER_BANDWIDTH_AUTO, 0, 1, 1, 1); dev->bandwidth =3D v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, V4L2_CID_RF_TUNER_BANDWIDTH, 200000, 8000000, 1, 200000); + if (dev->hdl.error) { + ret =3D dev->hdl.error; + dev_err(&spi->dev, "Could not initialize controls\n"); + /* control init failed, free handler */ + goto err_ctrl_handler_free; + } + v4l2_ctrl_auto_cluster(2, &dev->bandwidth_auto, 0, false); dev->lna_gain =3D v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, V4L2_CID_RF_TUNER_LNA_GAIN, 0, 1, 1, 1); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74496C433F5 for ; Mon, 24 Jan 2022 19:49:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354394AbiAXTtG (ORCPT ); Mon, 24 Jan 2022 14:49:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53672 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348789AbiAXTif (ORCPT ); Mon, 24 Jan 2022 14:38:35 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A6236C004999; Mon, 24 Jan 2022 11:17:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 05ACC60010; Mon, 24 Jan 2022 19:17:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1AE4C340E5; Mon, 24 Jan 2022 19:17:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051860; bh=bIveQD0UNRG8aGH1KYH14F78irHWOXLBnVi87Hh4uCk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QMt2h7F+J15k4QaMRETXMs15pafCday6gsHALymWU40yZ0WIkrfhsQcz5dKO1hZzu t/MhQQJWJWQEQPYni70IZLjVzPqZ3/CI8jE/m7XxCU2HPu2MDNWxnJ7bvXteGynsvU I7yj2a/U6sLj2pJ6rkaF5if4pt53x6qNaInVm9Bk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 077/239] media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes Date: Mon, 24 Jan 2022 19:41:55 +0100 Message-Id: <20220124183945.566055920@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 43f0633f89947df57fe0b5025bdd741768007708 ] The return value of dma_set_coherent_mask() is not always 0. To catch the exception in case that dma is not support the mask. Link: https://lore.kernel.org/linux-media/20211206022201.1639460-1-jiasheng= @iscas.ac.cn Fixes: b0444f18e0b1 ("[media] coda: add i.MX6 VDOA driver") Signed-off-by: Jiasheng Jiang Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/platform/coda/imx-vdoa.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/coda/imx-vdoa.c b/drivers/media/platfor= m/coda/imx-vdoa.c index 96ab4b61669a3..36d50c3f9b08a 100644 --- a/drivers/media/platform/coda/imx-vdoa.c +++ b/drivers/media/platform/coda/imx-vdoa.c @@ -295,7 +295,11 @@ static int vdoa_probe(struct platform_device *pdev) struct resource *res; int ret; =20 - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + ret =3D dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) { + dev_err(&pdev->dev, "DMA enable failed\n"); + return ret; + } =20 vdoa =3D devm_kzalloc(&pdev->dev, sizeof(*vdoa), GFP_KERNEL); if (!vdoa) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60F62C35272 for ; Mon, 24 Jan 2022 19:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350984AbiAXTZn (ORCPT ); Mon, 24 Jan 2022 14:25:43 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40686 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237064AbiAXTRp (ORCPT ); Mon, 24 Jan 2022 14:17:45 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DD47BB8121B; Mon, 24 Jan 2022 19:17:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11AEFC340E7; Mon, 24 Jan 2022 19:17:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051863; bh=1sSqDaJPH/+skylYR7kvEPfgqd39uXU5YvP69TS1FaE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NPyIaFA53dL7ghz3kHv0Htlwdl6wCb+27l9Uenkn+3UrlFNWaOji6DxUuP/9iNDNh chQVbwDYZ5TSITHlyYG+9EokFj6CuiCGWZsa5cuYK6qZ7KZx6El7lEelmxBtxdxKAx Lggqo3NpcRdCvzyfurdWwmk22tU2Yl5sQVgm7YnE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Baryshkov , Abhinav Kumar , Rob Clark , Sasha Levin Subject: [PATCH 4.19 078/239] drm/msm/dpu: fix safe status debugfs file Date: Mon, 24 Jan 2022 19:41:56 +0100 Message-Id: <20220124183945.597314098@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dmitry Baryshkov [ Upstream commit f31b0e24d31e18b4503eeaf0032baeacc0beaff6 ] Make safe_status debugfs fs file actually return safe status rather than danger status data. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Link: https://lore.kernel.org/r/20211201222633.2476780-3-dmitry.baryshkov@l= inaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Rob Clark Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/= disp/dpu1/dpu_kms.c index 2d9b7b5fb49c8..52474dcd25738 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c @@ -97,8 +97,8 @@ static int _dpu_danger_signal_status(struct seq_file *s, &status); } else { seq_puts(s, "\nSafe signal status:\n"); - if (kms->hw_mdp->ops.get_danger_status) - kms->hw_mdp->ops.get_danger_status(kms->hw_mdp, + if (kms->hw_mdp->ops.get_safe_status) + kms->hw_mdp->ops.get_safe_status(kms->hw_mdp, &status); } pm_runtime_put_sync(&kms->pdev->dev); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A999C433F5 for ; Mon, 24 Jan 2022 20:00:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347385AbiAXUA3 (ORCPT ); Mon, 24 Jan 2022 15:00:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54222 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349361AbiAXTi6 (ORCPT ); Mon, 24 Jan 2022 14:38:58 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C7810C003665; Mon, 24 Jan 2022 11:17:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6709B61302; Mon, 24 Jan 2022 19:17:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3BB1CC340E7; Mon, 24 Jan 2022 19:17:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051866; bh=Om5sd+3e1cpnSZ+/leGsmM2f/cQJeIzDtq0QRpYDL1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PCaVoPgz9O9WkQ4E3CS9KRVpi7tsPlxt0KoCk1J0eiGUNGZF938GnAHak3eOngNxR Ew2ALeKQJ+hRyZPecKmtvq57mf/WoZt55nzImUzRmBqo/eHdlLtrbpYrbh7705q69r tgnR5qWajfW5dUPiWA9QUqyzt3gj4JOIxoDdKW8w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Antony Antony , Eyal Birger , Steffen Klassert , Sasha Levin Subject: [PATCH 4.19 079/239] xfrm: interface with if_id 0 should return error Date: Mon, 24 Jan 2022 19:41:57 +0100 Message-Id: <20220124183945.629660706@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Antony Antony [ Upstream commit 8dce43919566f06e865f7e8949f5c10d8c2493f5 ] xfrm interface if_id =3D 0 would cause xfrm policy lookup errors since Commit 9f8550e4bd9d. Now explicitly fail to create an xfrm interface when if_id =3D 0 With this commit: ip link add ipsec0 type xfrm dev lo if_id 0 Error: if_id must be non zero. v1->v2 change: - add Fixes: tag Fixes: 9f8550e4bd9d ("xfrm: fix disable_xfrm sysctl when used on xfrm inter= faces") Signed-off-by: Antony Antony Reviewed-by: Eyal Birger Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/xfrm/xfrm_interface.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index 35a020a709852..054897358d904 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -662,11 +662,16 @@ static int xfrmi_newlink(struct net *src_net, struct = net_device *dev, struct netlink_ext_ack *extack) { struct net *net =3D dev_net(dev); - struct xfrm_if_parms p; + struct xfrm_if_parms p =3D {}; struct xfrm_if *xi; int err; =20 xfrmi_netlink_parms(data, &p); + if (!p.if_id) { + NL_SET_ERR_MSG(extack, "if_id must be non zero"); + return -EINVAL; + } + xi =3D xfrmi_locate(net, &p); if (xi) return -EEXIST; @@ -691,7 +696,12 @@ static int xfrmi_changelink(struct net_device *dev, st= ruct nlattr *tb[], { struct xfrm_if *xi =3D netdev_priv(dev); struct net *net =3D xi->net; - struct xfrm_if_parms p; + struct xfrm_if_parms p =3D {}; + + if (!p.if_id) { + NL_SET_ERR_MSG(extack, "if_id must be non zero"); + return -EINVAL; + } =20 xfrmi_netlink_parms(data, &p); xi =3D xfrmi_locate(net, &p); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D060DC433EF for ; Mon, 24 Jan 2022 19:39:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244144AbiAXTjI (ORCPT ); Mon, 24 Jan 2022 14:39:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53356 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353196AbiAXTdV (ORCPT ); Mon, 24 Jan 2022 14:33:21 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ED3ABC08E912; Mon, 24 Jan 2022 11:16:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8CBD960918; Mon, 24 Jan 2022 19:16:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 738DCC340E5; Mon, 24 Jan 2022 19:16:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051764; bh=Tlfrbg2JF29oRUFyyFYNKlReUyZNttyjxT+hByjmtTA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yyWYdffHmUIzrR3kGjY8pb/ADX3rEgkWppCUjGRi2WGkBu1pmwmJSVpRAvv1B1TAh wbTdRzNyibXILtlTYX0f12tYllZsiDiVC5YZ0xbmeFtrqryLo2wz3BTuDwsF3rGvpr 2erR2+rhMl4J4wASG7NanTrSTIsvQTPWLArR4Cv8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Antony Antony , Steffen Klassert , Sasha Levin Subject: [PATCH 4.19 080/239] xfrm: state and policy should fail if XFRMA_IF_ID 0 Date: Mon, 24 Jan 2022 19:41:58 +0100 Message-Id: <20220124183945.668743375@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Antony Antony [ Upstream commit 68ac0f3810e76a853b5f7b90601a05c3048b8b54 ] xfrm ineterface does not allow xfrm if_id =3D 0 fail to create or update xfrm state and policy. With this commit: ip xfrm policy add src 192.0.2.1 dst 192.0.2.2 dir out if_id 0 RTNETLINK answers: Invalid argument ip xfrm state add src 192.0.2.1 dst 192.0.2.2 proto esp spi 1 \ reqid 1 mode tunnel aead 'rfc4106(gcm(aes))' \ 0x1111111111111111111111111111111111111111 96 if_id 0 RTNETLINK answers: Invalid argument v1->v2 change: - add Fixes: tag Fixes: 9f8550e4bd9d ("xfrm: fix disable_xfrm sysctl when used on xfrm inter= faces") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/xfrm/xfrm_user.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 87932f6ad9d75..8d8f9e778cd4f 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -620,8 +620,13 @@ static struct xfrm_state *xfrm_state_construct(struct = net *net, =20 xfrm_smark_init(attrs, &x->props.smark); =20 - if (attrs[XFRMA_IF_ID]) + if (attrs[XFRMA_IF_ID]) { x->if_id =3D nla_get_u32(attrs[XFRMA_IF_ID]); + if (!x->if_id) { + err =3D -EINVAL; + goto error; + } + } =20 err =3D __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]); if (err) @@ -1327,8 +1332,13 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, s= truct nlmsghdr *nlh, =20 mark =3D xfrm_mark_get(attrs, &m); =20 - if (attrs[XFRMA_IF_ID]) + if (attrs[XFRMA_IF_ID]) { if_id =3D nla_get_u32(attrs[XFRMA_IF_ID]); + if (!if_id) { + err =3D -EINVAL; + goto out_noput; + } + } =20 if (p->info.seq) { x =3D xfrm_find_acq_byseq(net, mark, p->info.seq); @@ -1630,8 +1640,13 @@ static struct xfrm_policy *xfrm_policy_construct(str= uct net *net, struct xfrm_us =20 xfrm_mark_get(attrs, &xp->mark); =20 - if (attrs[XFRMA_IF_ID]) + if (attrs[XFRMA_IF_ID]) { xp->if_id =3D nla_get_u32(attrs[XFRMA_IF_ID]); + if (!xp->if_id) { + err =3D -EINVAL; + goto error; + } + } =20 return xp; error: --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE379C433F5 for ; Mon, 24 Jan 2022 19:26:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350664AbiAXTZI (ORCPT ); Mon, 24 Jan 2022 14:25:08 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:45272 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242895AbiAXTQK (ORCPT ); Mon, 24 Jan 2022 14:16:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4BC9060B86; Mon, 24 Jan 2022 19:16:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B999C340E5; Mon, 24 Jan 2022 19:16:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051766; bh=rNFNOaUveDWG3n5enoqmhQglyshTNpn0X82fcUAeWog=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lmlsi0iDp6eG0QK0B/5OVR72g8gx2+eZqz0ng62fFNsWvzoD6aDHDUoCHzUi6R5TJ FFdAx5sUK+cBabfX6zWnXLfKF/YEJ9b+7QF5+2HEA4gQGLVY3lMp0v0igsr4EqJSap QlM1SvYkc/7eKLiO18gcPp79bCgHUur6YY8wkli0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wei Yongjun , Sasha Levin Subject: [PATCH 4.19 081/239] usb: ftdi-elan: fix memory leak on device disconnect Date: Mon, 24 Jan 2022 19:41:59 +0100 Message-Id: <20220124183945.699408618@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit 1646566b5e0c556f779180a8514e521ac735de1e ] 'ftdi' is alloced when probe device, but not free on device disconnect, this cause a memory leak as follows: unreferenced object 0xffff88800d584000 (size 8400): comm "kworker/0:2", pid 3809, jiffies 4295453055 (age 13.784s) hex dump (first 32 bytes): 00 40 58 0d 80 88 ff ff 00 40 58 0d 80 88 ff ff .@X......@X..... 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. backtrace: [<000000000d47f947>] kmalloc_order_trace+0x19/0x110 mm/slab_common.c:960 [<000000008548ac68>] ftdi_elan_probe+0x8c/0x880 drivers/usb/misc/ftdi-e= lan.c:2647 [<000000007f73e422>] usb_probe_interface+0x31b/0x800 drivers/usb/core/d= river.c:396 [<00000000fe8d07fc>] really_probe+0x299/0xc30 drivers/base/dd.c:517 [<0000000005da7d32>] __driver_probe_device+0x357/0x500 drivers/base/dd.= c:751 [<000000003c2c9579>] driver_probe_device+0x4e/0x140 drivers/base/dd.c:7= 81 Fix it by freeing 'ftdi' after nobody use it. Fixes: a5c66e4b2418 ("USB: ftdi-elan: client driver for ELAN Uxxx adapters") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20211217083428.2441-1-weiyongjun1@huawei.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/misc/ftdi-elan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c index 76c718ac8c78d..adc2a380be79f 100644 --- a/drivers/usb/misc/ftdi-elan.c +++ b/drivers/usb/misc/ftdi-elan.c @@ -202,6 +202,7 @@ static void ftdi_elan_delete(struct kref *kref) mutex_unlock(&ftdi_module_lock); kfree(ftdi->bulk_in_buffer); ftdi->bulk_in_buffer =3D NULL; + kfree(ftdi); } =20 static void ftdi_elan_put_kref(struct usb_ftdi *ftdi) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00FB6C4332F for ; Mon, 24 Jan 2022 19:26:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350691AbiAXTZK (ORCPT ); Mon, 24 Jan 2022 14:25:10 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:45302 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344024AbiAXTQK (ORCPT ); Mon, 24 Jan 2022 14:16:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6271060918; Mon, 24 Jan 2022 19:16:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F701C340E5; Mon, 24 Jan 2022 19:16:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051769; bh=R/8W69jPQrWexMmMn+5pYEBZEBte7tNLSs8/YEVRk5Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qLjh70yvt5bJ/HuqpF8Gwy6+TuHHTQ9m3W4VweGsdbrD/KyM66Ike/FECks2jnaJY LwbklB5ShgR2i63GWARqWeyU53am6AWhbvtycJXzUJ+0HQl4rDjqGKtxWiGdbQs+SD TLjBF1ySLf8MZTe7ezH7Rz2L5aOWtFNwvbOF1fc0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Gregory CLEMENT , Sasha Levin Subject: [PATCH 4.19 082/239] ARM: dts: armada-38x: Add generic compatible to UART nodes Date: Mon, 24 Jan 2022 19:42:00 +0100 Message-Id: <20220124183945.730959014@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Marek Beh=C3=BAn [ Upstream commit 62480772263ab6b52e758f2346c70a526abd1d28 ] Add generic compatible string "ns16550a" to serial port nodes of Armada 38x. This makes it possible to use earlycon. Fixes: 0d3d96ab0059 ("ARM: mvebu: add Device Tree description of the Armada= 380/385 SoCs") Signed-off-by: Pali Roh=C3=A1r Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Gregory CLEMENT Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/armada-38x.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-3= 8x.dtsi index 929459c427605..6f32f12332824 100644 --- a/arch/arm/boot/dts/armada-38x.dtsi +++ b/arch/arm/boot/dts/armada-38x.dtsi @@ -163,7 +163,7 @@ }; =20 uart0: serial@12000 { - compatible =3D "marvell,armada-38x-uart"; + compatible =3D "marvell,armada-38x-uart", "ns16550a"; reg =3D <0x12000 0x100>; reg-shift =3D <2>; interrupts =3D ; @@ -173,7 +173,7 @@ }; =20 uart1: serial@12100 { - compatible =3D "marvell,armada-38x-uart"; + compatible =3D "marvell,armada-38x-uart", "ns16550a"; reg =3D <0x12100 0x100>; reg-shift =3D <2>; interrupts =3D ; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0420C433EF for ; Mon, 24 Jan 2022 19:40:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355059AbiAXTjz (ORCPT ); Mon, 24 Jan 2022 14:39:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349371AbiAXTd7 (ORCPT ); Mon, 24 Jan 2022 14:33:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 012FBC09B04F; Mon, 24 Jan 2022 11:16:14 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 968AF6130A; Mon, 24 Jan 2022 19:16:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6C958C340E5; Mon, 24 Jan 2022 19:16:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051773; bh=ePwTLxA62Y36SORi+qh5QbEO3e+K23U1KOM0lweoOO0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lx/c3da//267pxA023+TpriEV1jJVju4Ek5UwyTK/QX94Z5NVKBwZdDWAgcsRn4E6 x79x7sqc7iZ5UCorWruKDreobb2I6gGu64sXG65FzGbvh8a0jSHbXvv2VMKJWgXC6K RQuD+pz6/6kHipGdOzNme8gapsjJbfs0dJAjDzu0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Martin Blumenstingl , Ulf Hansson , Sasha Levin Subject: [PATCH 4.19 083/239] mmc: meson-mx-sdio: add IRQ check Date: Mon, 24 Jan 2022 19:42:01 +0100 Message-Id: <20220124183945.759993210@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov [ Upstream commit 8fc9a77bc64e1f23d07953439817d8402ac9706f ] The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_threaded_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_threaded_irq() with the invalid IRQ #s. Fixes: ed80a13bb4c4 ("mmc: meson-mx-sdio: Add a driver for the Amlogic Meso= n8 and Meson8b SoC") Signed-off-by: Sergey Shtylyov Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20211217202717.10041-3-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/mmc/host/meson-mx-sdio.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-s= dio.c index 27837a794e7b3..1f7e4352b0677 100644 --- a/drivers/mmc/host/meson-mx-sdio.c +++ b/drivers/mmc/host/meson-mx-sdio.c @@ -668,6 +668,11 @@ static int meson_mx_mmc_probe(struct platform_device *= pdev) } =20 irq =3D platform_get_irq(pdev, 0); + if (irq < 0) { + ret =3D irq; + goto error_free_mmc; + } + ret =3D devm_request_threaded_irq(host->controller_dev, irq, meson_mx_mmc_irq, meson_mx_mmc_irq_thread, IRQF_ONESHOT, --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DFCAC433EF for ; Mon, 24 Jan 2022 19:28:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345296AbiAXT25 (ORCPT ); Mon, 24 Jan 2022 14:28:57 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:41144 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345800AbiAXTQU (ORCPT ); Mon, 24 Jan 2022 14:16:20 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 706E7B81235; Mon, 24 Jan 2022 19:16:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E22BC340E5; Mon, 24 Jan 2022 19:16:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051776; bh=X5jJ6NhYJuoshh5xIzUWV+HwgGDkQAbbJZYP703Wfao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gFdi7DUcc1fui/3wIE2VZmnnxKUc9REZ5RqbmQI7RS5HzH3IGP+B+l7fLQxSnRczM waxklV8n96AN2vEmnF0LCyiB7lBg+Da7MsVrc6bPm7AQYwZ27qmSsT9MVYR8lrwz37 yAeP8k5noVgzXangw8BYMAmffzL9TxIud6B9YBGY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhang Zixun , Borislav Petkov , Sasha Levin Subject: [PATCH 4.19 084/239] x86/mce/inject: Avoid out-of-bounds write when setting flags Date: Mon, 24 Jan 2022 19:42:02 +0100 Message-Id: <20220124183945.791813622@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhang Zixun [ Upstream commit de768416b203ac84e02a757b782a32efb388476f ] A contrived zero-length write, for example, by using write(2): ... ret =3D write(fd, str, 0); ... to the "flags" file causes: BUG: KASAN: stack-out-of-bounds in flags_write Write of size 1 at addr ffff888019be7ddf by task writefile/3787 CPU: 4 PID: 3787 Comm: writefile Not tainted 5.16.0-rc7+ #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/0= 1/2014 due to accessing buf one char before its start. Prevent such out-of-bounds access. [ bp: Productize into a proper patch. Link below is the next best thing because the original mail didn't get archived on lore. ] Fixes: 0451d14d0561 ("EDAC, mce_amd_inj: Modify flags attribute to use stri= ng arguments") Signed-off-by: Zhang Zixun Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/linux-edac/YcnePfF1OOqoQwrX@zn.tnic/ Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/kernel/cpu/mcheck/mce-inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/= mcheck/mce-inject.c index 9cc524be3c949..14dc3c1f7fb43 100644 --- a/arch/x86/kernel/cpu/mcheck/mce-inject.c +++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c @@ -354,7 +354,7 @@ static ssize_t flags_write(struct file *filp, const cha= r __user *ubuf, char buf[MAX_FLAG_OPT_SIZE], *__buf; int err; =20 - if (cnt > MAX_FLAG_OPT_SIZE) + if (!cnt || cnt > MAX_FLAG_OPT_SIZE) return -EINVAL; =20 if (copy_from_user(&buf, ubuf, cnt)) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76FB7C433EF for ; Mon, 24 Jan 2022 19:28:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344554AbiAXT2x (ORCPT ); Mon, 24 Jan 2022 14:28:53 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:41208 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346362AbiAXTQW (ORCPT ); Mon, 24 Jan 2022 14:16:22 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 85162B81233; Mon, 24 Jan 2022 19:16:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A0615C340E5; Mon, 24 Jan 2022 19:16:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051779; bh=vwY5hP5VDu7uqgnjFVH0ubcGCxncZciHJeB2Ey2PIB4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bn/YxmshkJPfW4VOMUUvF1gANAEaK8djBuY5jZoK788EzhnEz3ekIChyO+gQNubjK zxD8//IYg478cV1uAyKIjmwH5wVtak70Qm8LddNKQ/TrOVs+ihCMyZecgQTNT7kJMc bN7jjAoHpwm/uvTf6gXfIntpJwTtp/4/ctCTMI7E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.19 085/239] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() Date: Mon, 24 Jan 2022 19:42:03 +0100 Message-Id: <20220124183945.822686934@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit ca0fe0d7c35c97528bdf621fdca75f13157c27af ] In __nonstatic_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_PCCARD_NONSTATIC=3Dy show no new warnings, and our static analyzer no longer warns about this code. Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into o= ne module") Signed-off-by: Zhou Qingyang [linux@dominikbrodowski.net: Fix typo in commit message] Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pcmcia/rsrc_nonstatic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstati= c.c index 49377d502b740..5cb29d6951df2 100644 --- a/drivers/pcmcia/rsrc_nonstatic.c +++ b/drivers/pcmcia/rsrc_nonstatic.c @@ -693,6 +693,9 @@ static struct resource *__nonstatic_find_io_region(stru= ct pcmcia_socket *s, unsigned long min =3D base; int ret; =20 + if (!res) + return NULL; + data.mask =3D align - 1; data.offset =3D base & data.mask; data.map =3D &s_data->io_db; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2236EC43219 for ; Mon, 24 Jan 2022 19:26:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350717AbiAXTZO (ORCPT ); Mon, 24 Jan 2022 14:25:14 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:45504 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343689AbiAXTQX (ORCPT ); Mon, 24 Jan 2022 14:16:23 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EF7A56131E; Mon, 24 Jan 2022 19:16:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAE33C340E5; Mon, 24 Jan 2022 19:16:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051782; bh=FFc92ucDMk1pQ5zu/eaB0zb0C06jywc23rLv9Ce6chs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qAd2QmHKvqEZpJU+pt0u5MOMHeDsu4St9UlWL3O5/rgdU95VelllKkqsYTubYQcCC MgHJ3H1q+2PMQYUKzRqki1cM6SS4Pjrc0L08UJlvhQYOODE8p5SPNpN7IrIfHuufTz zYcd2wQlXZxsVd4Rc38QPDWobERZYWVyRLUR6Hn0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.19 086/239] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() Date: Mon, 24 Jan 2022 19:42:04 +0100 Message-Id: <20220124183945.853766473@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 977d2e7c63c3d04d07ba340b39987742e3241554 ] In nonstatic_find_mem_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_PCCARD_NONSTATIC=3Dy show no new warnings, and our static analyzer no longer warns about this code. Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into o= ne module") Signed-off-by: Zhou Qingyang Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pcmcia/rsrc_nonstatic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstati= c.c index 5cb29d6951df2..123420cac6b54 100644 --- a/drivers/pcmcia/rsrc_nonstatic.c +++ b/drivers/pcmcia/rsrc_nonstatic.c @@ -815,6 +815,9 @@ static struct resource *nonstatic_find_mem_region(u_lon= g base, u_long num, unsigned long min, max; int ret, i, j; =20 + if (!res) + return NULL; + low =3D low || !(s->features & SS_CAP_PAGE_REGS); =20 data.mask =3D align - 1; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56313C433EF for ; Mon, 24 Jan 2022 19:41:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348496AbiAXTkw (ORCPT ); Mon, 24 Jan 2022 14:40:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52782 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353545AbiAXTe6 (ORCPT ); Mon, 24 Jan 2022 14:34:58 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6ED56C0219BF; Mon, 24 Jan 2022 11:16:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0E62661320; Mon, 24 Jan 2022 19:16:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB7A5C340E7; Mon, 24 Jan 2022 19:16:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051785; bh=q5W9hIOQRdyJnbVfoV96IYZAH+fk/4zycAksEdJnDqY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tR4ELxWNivesxZkTHO80gxp9hF8HrtnhArNvK1C/L29WcQjMtJ7cTtMUUsixYw6VY x1lJ9Qd2t2GMYNTzvwFqchWFjHmOiuZdXu+VPS/45nC4h7yHTSQG/9E95q8PrdqunV uWSQLFH2j4nqh3OLRqAfaJYx9qZjPBS+30v5hBZs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xin Xiong , Xiyu Yang , Xin Tan , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.19 087/239] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Date: Mon, 24 Jan 2022 19:42:05 +0100 Message-Id: <20220124183945.883816661@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Xiong [ Upstream commit d94a69cb2cfa77294921aae9afcfb866e723a2da ] The issue takes place in one error path of clusterip_tg_check(). When memcmp() returns nonzero, the function simply returns the error code, forgetting to decrease the reference count of a clusterip_config object, which is bumped earlier by clusterip_config_find_get(). This may incur reference count leak. Fix this issue by decrementing the refcount of the object in specific error path. Fixes: 06aa151ad1fc74 ("netfilter: ipt_CLUSTERIP: check MAC address when du= plicate config is set") Signed-off-by: Xin Xiong Signed-off-by: Xiyu Yang Signed-off-by: Xin Tan Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CL= USTERIP.c index 2fa1963259880..954c96f4ddd0f 100644 --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c @@ -509,8 +509,11 @@ static int clusterip_tg_check(const struct xt_tgchk_pa= ram *par) if (IS_ERR(config)) return PTR_ERR(config); } - } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) + } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) { + clusterip_config_entry_put(config); + clusterip_config_put(config); return -EINVAL; + } =20 ret =3D nf_ct_netns_get(par->net, par->family); if (ret < 0) { --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97018C4332F for ; Mon, 24 Jan 2022 19:31:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352203AbiAXT3w (ORCPT ); Mon, 24 Jan 2022 14:29:52 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43854 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346786AbiAXTQ3 (ORCPT ); Mon, 24 Jan 2022 14:16:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 43A6E61320; Mon, 24 Jan 2022 19:16:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 19921C340E7; Mon, 24 Jan 2022 19:16:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051788; bh=EmSmdj2VP4v+XjAGMC1f/EnmITY0uUNRs0WMJ0+ywm4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MUdkSmN7OUnMb11iGzNLTWmSg/UZWETPVtorcEmIRrBgXzp2r2TRfQBi4SbQtHbp2 9W5Y4B4MYtHDKxOt/7CKyUns7/X5P69Y2ZH8w6KGrWEC70RwvfKntYLQKV4sE0fV0C td3E+ZCJpViD+DsWMEXMFa9RyGhAj6+3mZxQS8T0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Paul Mackerras , linux-ppp@vger.kernel.org, syzbot , Guillaume Nault , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 088/239] ppp: ensure minimum packet size in ppp_write() Date: Mon, 24 Jan 2022 19:42:06 +0100 Message-Id: <20220124183945.918547329@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 44073187990d5629804ce0627525f6ea5cfef171 ] It seems pretty clear ppp layer assumed user space would always be kind to provide enough data in their write() to a ppp device. This patch makes sure user provides at least 2 bytes. It adds PPP_PROTO_LEN macro that could replace in net-next many occurrences of hard-coded 2 value. I replaced only one occurrence to ease backports to stable kernels. The bug manifests in the following report: BUG: KMSAN: uninit-value in ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp= _generic.c:1740 ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 __ppp_xmit_process+0x23e/0x4b0 drivers/net/ppp/ppp_generic.c:1640 ppp_xmit_process+0x1fe/0x480 drivers/net/ppp/ppp_generic.c:1661 ppp_write+0x5cb/0x5e0 drivers/net/ppp/ppp_generic.c:513 do_iter_write+0xb0c/0x1500 fs/read_write.c:853 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] ppp_write+0x11d/0x5e0 drivers/net/ppp/ppp_generic.c:501 do_iter_write+0xb0c/0x1500 fs/read_write.c:853 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Cc: Paul Mackerras Cc: linux-ppp@vger.kernel.org Reported-by: syzbot Acked-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ppp/ppp_generic.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c index dc9de8731c564..3f335b57d5cde 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -73,6 +73,8 @@ #define MPHDRLEN 6 /* multilink protocol header length */ #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */ =20 +#define PPP_PROTO_LEN 2 + /* * An instance of /dev/ppp can be associated with either a ppp * interface unit or a ppp channel. In both cases, file->private_data @@ -502,6 +504,9 @@ static ssize_t ppp_write(struct file *file, const char = __user *buf, =20 if (!pf) return -ENXIO; + /* All PPP packets should start with the 2-byte protocol */ + if (count < PPP_PROTO_LEN) + return -EINVAL; ret =3D -ENOMEM; skb =3D alloc_skb(count + pf->hdrlen, GFP_KERNEL); if (!skb) @@ -1550,7 +1555,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) } =20 ++ppp->stats64.tx_packets; - ppp->stats64.tx_bytes +=3D skb->len - 2; + ppp->stats64.tx_bytes +=3D skb->len - PPP_PROTO_LEN; =20 switch (proto) { case PPP_IP: --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BDDBC433EF for ; Mon, 24 Jan 2022 19:47:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351111AbiAXTol (ORCPT ); Mon, 24 Jan 2022 14:44:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53322 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353726AbiAXTfR (ORCPT ); Mon, 24 Jan 2022 14:35:17 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4362DC0A8935; Mon, 24 Jan 2022 11:16:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0BF89B8124B; Mon, 24 Jan 2022 19:16:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C877C36AEB; Mon, 24 Jan 2022 19:16:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051791; bh=dYJFQJQWgzq8pRIio+EnX/nFkyQjIy06kZPs+pFGbsA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D6HdM67qb++8ArHUFxP48Gpgv7HSKcQO2Q6CEIs2rAn9ySl27x7GAWDuhNFV2JAV4 XLuKii8ICq+bcovKoFQaKBAacWPIkykkHwNIOXCICgYmqvyVros6KSBADRqpCIiy7x T5171z4i7G8SBGAMNFx0fMnXMhy6D7V7dVukluKE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Elder , Jiasheng Jiang , Sasha Levin Subject: [PATCH 4.19 089/239] staging: greybus: audio: Check null pointer Date: Mon, 24 Jan 2022 19:42:07 +0100 Message-Id: <20220124183945.947863922@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 2e81948177d769106754085c3e03534e6cc1f623 ] As the possible alloc failure of devm_kcalloc(), it could return null pointer. Therefore, 'strings' should be checked and return NULL if alloc fails to prevent the dereference of the NULL pointer. Also, the caller should also deal with the return value of the gb_generate_enum_strings() and return -ENOMEM if returns NULL. Moreover, because the memory allocated with devm_kzalloc() will be freed automatically when the last reference to the device is dropped, the 'gbe' in gbaudio_tplg_create_enum_kctl() and gbaudio_tplg_create_enum_ctl() do not need to free manually. But the 'control' in gbaudio_tplg_create_widget() and gbaudio_tplg_process_kcontrols() has a specially error handle to cleanup. So it should be better to cleanup 'control' when fails. Fixes: e65579e335da ("greybus: audio: topology: Enable enumerated control s= upport") Reviewed-by: Alex Elder Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20220104150628.1987906-1-jiasheng@iscas.ac.= cn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/staging/greybus/audio_topology.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/gre= ybus/audio_topology.c index 860247d718184..a48e59fe18e81 100644 --- a/drivers/staging/greybus/audio_topology.c +++ b/drivers/staging/greybus/audio_topology.c @@ -145,6 +145,9 @@ static const char **gb_generate_enum_strings(struct gba= udio_module_info *gb, =20 items =3D le32_to_cpu(gbenum->items); strings =3D devm_kcalloc(gb->dev, items, sizeof(char *), GFP_KERNEL); + if (!strings) + return NULL; + data =3D gbenum->names; =20 for (i =3D 0; i < items; i++) { @@ -662,6 +665,8 @@ static int gbaudio_tplg_create_enum_kctl(struct gbaudio= _module_info *gb, /* since count=3D1, and reg is dummy */ gbe->max =3D le32_to_cpu(gb_enum->items); gbe->texts =3D gb_generate_enum_strings(gb, gb_enum); + if (!gbe->texts) + return -ENOMEM; =20 /* debug enum info */ dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max, @@ -871,6 +876,8 @@ static int gbaudio_tplg_create_enum_ctl(struct gbaudio_= module_info *gb, /* since count=3D1, and reg is dummy */ gbe->max =3D le32_to_cpu(gb_enum->items); gbe->texts =3D gb_generate_enum_strings(gb, gb_enum); + if (!gbe->texts) + return -ENOMEM; =20 /* debug enum info */ dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max, @@ -1044,6 +1051,10 @@ static int gbaudio_tplg_create_widget(struct gbaudio= _module_info *module, csize +=3D le16_to_cpu(gbenum->names_length); control->texts =3D (const char * const *) gb_generate_enum_strings(module, gbenum); + if (!control->texts) { + ret =3D -ENOMEM; + goto error; + } control->items =3D le32_to_cpu(gbenum->items); } else { csize =3D sizeof(struct gb_audio_control); @@ -1192,6 +1203,10 @@ static int gbaudio_tplg_process_kcontrols(struct gba= udio_module_info *module, csize +=3D le16_to_cpu(gbenum->names_length); control->texts =3D (const char * const *) gb_generate_enum_strings(module, gbenum); + if (!control->texts) { + ret =3D -ENOMEM; + goto error; + } control->items =3D le32_to_cpu(gbenum->items); } else { csize =3D sizeof(struct gb_audio_control); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40D40C433FE for ; Mon, 24 Jan 2022 19:26:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350740AbiAXTZQ (ORCPT ); Mon, 24 Jan 2022 14:25:16 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:41586 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347230AbiAXTQk (ORCPT ); Mon, 24 Jan 2022 14:16:40 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4FA7AB81215; Mon, 24 Jan 2022 19:16:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7AE03C340E5; Mon, 24 Jan 2022 19:16:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051798; bh=zVPS0If2alR0wY66jaCmi13jFkq5TKN5ONOT0LACKHM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YASEoDadU6vvLznslZMO3XAFQ173UCyWIvO6vwGioGHorAkZWKDL0bImkUwCOX0ZB 4iRUeSOak+uYwbfY8uJXQ7WVLh8uqVr/1lsnzaGFv1QrO6ElW2zy/kbJnyY0+8YcsV kEpiXVsQE066lqon4FfNGsN1yn9DKBQscGG/IpPQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 090/239] fsl/fman: Check for null pointer after calling devm_ioremap Date: Mon, 24 Jan 2022 19:42:08 +0100 Message-Id: <20220124183945.978317598@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit d5a73ec96cc57cf67e51b12820fc2354e7ca46f8 ] As the possible failure of the allocation, the devm_ioremap() may return NULL pointer. Take tgec_initialization() as an example. If allocation fails, the params->base_addr will be NULL pointer and will be assigned to tgec->regs in tgec_config(). Then it will cause the dereference of NULL pointer in set_mac_address(), which is called by tgec_init(). Therefore, it should be better to add the sanity check after the calling of the devm_ioremap(). Fixes: 3933961682a3 ("fsl/fman: Add FMan MAC driver") Signed-off-by: Jiasheng Jiang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/freescale/fman/mac.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethern= et/freescale/fman/mac.c index a847b9c3b31a9..713abcd9371fa 100644 --- a/drivers/net/ethernet/freescale/fman/mac.c +++ b/drivers/net/ethernet/freescale/fman/mac.c @@ -94,14 +94,17 @@ static void mac_exception(void *handle, enum fman_mac_e= xceptions ex) __func__, ex); } =20 -static void set_fman_mac_params(struct mac_device *mac_dev, - struct fman_mac_params *params) +static int set_fman_mac_params(struct mac_device *mac_dev, + struct fman_mac_params *params) { struct mac_priv_s *priv =3D mac_dev->priv; =20 params->base_addr =3D (typeof(params->base_addr)) devm_ioremap(priv->dev, mac_dev->res->start, resource_size(mac_dev->res)); + if (!params->base_addr) + return -ENOMEM; + memcpy(¶ms->addr, mac_dev->addr, sizeof(mac_dev->addr)); params->max_speed =3D priv->max_speed; params->phy_if =3D mac_dev->phy_if; @@ -112,6 +115,8 @@ static void set_fman_mac_params(struct mac_device *mac_= dev, params->event_cb =3D mac_exception; params->dev_id =3D mac_dev; params->internal_phy_node =3D priv->internal_phy_node; + + return 0; } =20 static int tgec_initialization(struct mac_device *mac_dev) @@ -123,7 +128,9 @@ static int tgec_initialization(struct mac_device *mac_d= ev) =20 priv =3D mac_dev->priv; =20 - set_fman_mac_params(mac_dev, ¶ms); + err =3D set_fman_mac_params(mac_dev, ¶ms); + if (err) + goto _return; =20 mac_dev->fman_mac =3D tgec_config(¶ms); if (!mac_dev->fman_mac) { @@ -169,7 +176,9 @@ static int dtsec_initialization(struct mac_device *mac_= dev) =20 priv =3D mac_dev->priv; =20 - set_fman_mac_params(mac_dev, ¶ms); + err =3D set_fman_mac_params(mac_dev, ¶ms); + if (err) + goto _return; =20 mac_dev->fman_mac =3D dtsec_config(¶ms); if (!mac_dev->fman_mac) { @@ -218,7 +227,9 @@ static int memac_initialization(struct mac_device *mac_= dev) =20 priv =3D mac_dev->priv; =20 - set_fman_mac_params(mac_dev, ¶ms); + err =3D set_fman_mac_params(mac_dev, ¶ms); + if (err) + goto _return; =20 if (priv->max_speed =3D=3D SPEED_10000) params.phy_if =3D PHY_INTERFACE_MODE_XGMII; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE484C4167E for ; Mon, 24 Jan 2022 19:57:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352667AbiAXT5M (ORCPT ); Mon, 24 Jan 2022 14:57:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53476 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354010AbiAXTfp (ORCPT ); Mon, 24 Jan 2022 14:35:45 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9DF32C0617AA; Mon, 24 Jan 2022 11:16:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 671B6B8122C; Mon, 24 Jan 2022 19:16:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 92956C340E5; Mon, 24 Jan 2022 19:16:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051801; bh=g8ixSqcY0Ao9RXrC+KAENnCMRhstpUIFshIN3sXklTI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bblztRuS100v773T8Ni+xkQBhQNPHXplsNoXhLBHIlW4pBm9hTgBJJ2OUe96MQOel frdaTtCZ9uzSNFMhOqFomjmNaBBnY9matu/WJVUfFDhB0GtyIW8IOGavMPyQD5LMc6 juODxCTeyJGvPDv9tvtEsQAZzshwVC6+OKpsGwks= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.19 091/239] Bluetooth: hci_bcm: Check for error irq Date: Mon, 24 Jan 2022 19:42:09 +0100 Message-Id: <20220124183946.010461138@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit b38cd3b42fba66cc538edb9cf77e07881f43f8e2 ] For the possible failure of the platform_get_irq(), the returned irq could be error number and will finally cause the failure of the request_irq(). Consider that platform_get_irq() can now in certain cases return -EPROBE_DEFER, and the consequences of letting request_irq() effectively convert that into -EINVAL, even at probe time rather than later on. So it might be better to check just now. Fixes: 0395ffc1ee05 ("Bluetooth: hci_bcm: Add PM for BCM devices") Signed-off-by: Jiasheng Jiang Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/bluetooth/hci_bcm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c index 3e386f68faa02..1a298f13bcc87 100644 --- a/drivers/bluetooth/hci_bcm.c +++ b/drivers/bluetooth/hci_bcm.c @@ -1052,7 +1052,12 @@ static int bcm_probe(struct platform_device *pdev) return -ENOMEM; =20 dev->dev =3D &pdev->dev; - dev->irq =3D platform_get_irq(pdev, 0); + + ret =3D platform_get_irq(pdev, 0); + if (ret < 0) + return ret; + + dev->irq =3D ret; =20 if (has_acpi_companion(&pdev->dev)) { ret =3D bcm_acpi_probe(dev); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A25FEC433F5 for ; Mon, 24 Jan 2022 20:02:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354179AbiAXUCV (ORCPT ); Mon, 24 Jan 2022 15:02:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53492 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354033AbiAXTfs (ORCPT ); Mon, 24 Jan 2022 14:35:48 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DDDE8C0617AB; Mon, 24 Jan 2022 11:16:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9A64CB81232; Mon, 24 Jan 2022 19:16:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6D92C340E5; Mon, 24 Jan 2022 19:16:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051804; bh=gZSDVsfYlsAxlWnp9Aw1egp1OcnEtoIW76K3GdYQkMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LjV9gJ9aeM2maLmAyiEZQSqDoLDOZbsIP+3dD1nnVNI6FdzN1ItZ4gAEgW6TpysRJ G6q8HkRjd0+OCIS6hskPzQtdQohXzWurutm0+zCCwMKrMBo9lmlXdblHMz71A6ZQec UoXD19wbg6yu4++3DAHyKl24KHp+DQyTsqvT8nJE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Mark Brown , Sasha Levin Subject: [PATCH 4.19 092/239] spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe Date: Mon, 24 Jan 2022 19:42:10 +0100 Message-Id: <20220124183946.040344577@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 69c1b87516e327a60b39f96b778fe683259408bf ] If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable(). Add missing pm_runtime_disable() for meson_spifc_probe. Fixes: c3e4bc5434d2 ("spi: meson: Add support for Amlogic Meson SPIFC") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220107075424.7774-1-linmq006@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/spi/spi-meson-spifc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c index 616566e793c62..28975b6f054fa 100644 --- a/drivers/spi/spi-meson-spifc.c +++ b/drivers/spi/spi-meson-spifc.c @@ -357,6 +357,7 @@ static int meson_spifc_probe(struct platform_device *pd= ev) return 0; out_clk: clk_disable_unprepare(spifc->clk); + pm_runtime_disable(spifc->dev); out_err: spi_master_put(master); return ret; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE705C433F5 for ; Mon, 24 Jan 2022 19:48:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356054AbiAXTpI (ORCPT ); Mon, 24 Jan 2022 14:45:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354097AbiAXTf7 (ORCPT ); Mon, 24 Jan 2022 14:35:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B8DDEC0617AE; Mon, 24 Jan 2022 11:16:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 190066135D; Mon, 24 Jan 2022 19:16:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA468C340E5; Mon, 24 Jan 2022 19:16:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051807; bh=PP9uLvzWC9cDcqDXuUVuJjBDEv8xT7ubGng62qaT7qs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZqqePjufXT6O8AK/Lpg8Kf1nMplipREk1L4j2arAe4kgEZZC99mRKG0rWog2QulJ+ KC8pzhzsMAp6fHykYOuQo/vNKpuUyJ5eHpYbvm+24IK7TivIijipTM6S6FreV3WOwL aZIig1ycwwDrLjYKrVAVFH6i/oUw3v/qgIk2GTHc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chen Jun , Jarkko Sakkinen , Sasha Levin Subject: [PATCH 4.19 093/239] tpm: add request_locality before write TPM_INT_ENABLE Date: Mon, 24 Jan 2022 19:42:11 +0100 Message-Id: <20220124183946.069737911@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chen Jun [ Upstream commit 0ef333f5ba7f24f5d8478425c163d3097f1c7afd ] Locality is not appropriately requested before writing the int mask. Add the missing boilerplate. Fixes: e6aef069b6e9 ("tpm_tis: convert to using locality callbacks") Signed-off-by: Chen Jun Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/char/tpm/tpm_tis_core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_cor= e.c index c9a5f34097df5..c95ce9323d77a 100644 --- a/drivers/char/tpm/tpm_tis_core.c +++ b/drivers/char/tpm/tpm_tis_core.c @@ -874,7 +874,15 @@ int tpm_tis_core_init(struct device *dev, struct tpm_t= is_data *priv, int irq, intmask |=3D TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; intmask &=3D ~TPM_GLOBAL_INT_ENABLE; + + rc =3D request_locality(chip, 0); + if (rc < 0) { + rc =3D -ENODEV; + goto out_err; + } + tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); + release_locality(chip, 0); =20 rc =3D tpm2_probe(chip); if (rc) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 538D6C4167B for ; Mon, 24 Jan 2022 19:26:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350793AbiAXTZV (ORCPT ); Mon, 24 Jan 2022 14:25:21 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:46090 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243013AbiAXTQw (ORCPT ); Mon, 24 Jan 2022 14:16:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 35464613B3; Mon, 24 Jan 2022 19:16:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17CE8C340E5; Mon, 24 Jan 2022 19:16:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051810; bh=eZnupatPIV3ci7NnZFNHGOgaYKGfQO9VVbfWgx6Ag74=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vXKlrLywV4pgrqcBvjHWqCN1gjqBiSi5+sLeoISwSZs6bNcKsZZLVPUaqwXMCy1it G3nrBVqk4B3JhQuuxAwrPiStS+grNWK9Hjn0L3X7VnPxIQ/eW+YQ0cEcz4ColQe400 b7Nf3JI6y8WNBdb9QSrzLDwUKlNqdptfBcst9dGQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kurt Van Dijck , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.19 094/239] can: softing: softing_startstop(): fix set but not used variable warning Date: Mon, 24 Jan 2022 19:42:12 +0100 Message-Id: <20220124183946.099402713@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marc Kleine-Budde [ Upstream commit 370d988cc529598ebaec6487d4f84c2115dc696b ] In the function softing_startstop() the variable error_reporting is assigned but not used. The code that uses this variable is commented out. Its stated that the functionality is not finally verified. To fix the warning: | drivers/net/can/softing/softing_fw.c:424:9: error: variable 'error_report= ing' set but not used [-Werror,-Wunused-but-set-variable] remove the comment, activate the code, but add a "0 &&" to the if expression and rely on the optimizer rather than the preprocessor to remove the code. Link: https://lore.kernel.org/all/20220109103126.1872833-1-mkl@pengutronix.= de Fixes: 03fd3cf5a179 ("can: add driver for Softing card") Cc: Kurt Van Dijck Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/can/softing/softing_fw.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing= /softing_fw.c index aac58ce6e371a..209eddeb822e5 100644 --- a/drivers/net/can/softing/softing_fw.c +++ b/drivers/net/can/softing/softing_fw.c @@ -576,18 +576,19 @@ int softing_startstop(struct net_device *dev, int up) if (ret < 0) goto failed; } - /* enable_error_frame */ - /* + + /* enable_error_frame + * * Error reporting is switched off at the moment since * the receiving of them is not yet 100% verified * This should be enabled sooner or later - * - if (error_reporting) { + */ + if (0 && error_reporting) { ret =3D softing_fct_cmd(card, 51, "enable_error_frame"); if (ret < 0) goto failed; } - */ + /* initialize interface */ iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 2]); iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 4]); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74F6FC433FE for ; Mon, 24 Jan 2022 19:28:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348151AbiAXT2C (ORCPT ); Mon, 24 Jan 2022 14:28:02 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:41852 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347558AbiAXTQ5 (ORCPT ); Mon, 24 Jan 2022 14:16:57 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0CF73B8122C; Mon, 24 Jan 2022 19:16:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31811C340E5; Mon, 24 Jan 2022 19:16:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051813; bh=X/v5IuwqHcVUCiRsJOL2BOtTSjI51ZmzRnPqQBxRUMU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UxCrMJ/LjWevn7QxgJlI6RGRpkx39TJlbDdEjKd3uiC43El5j5Ggr93YUUoGRq8k3 RNyZBreBIp6TMfGWERM0D1yEiUcx6LZSxYjVDDlfpiAHsf5IxcSR6xmxedhipMGodz 3SPag0I4v8Gm6Bo0gnnWgsUkJa1iOLq7rkSW4jZ4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.19 095/239] can: xilinx_can: xcan_probe(): check for error irq Date: Mon, 24 Jan 2022 19:42:13 +0100 Message-Id: <20220124183946.129286782@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit c6564c13dae25cd7f8e1de5127b4da4500ee5844 ] For the possible failure of the platform_get_irq(), the returned irq could be error number and will finally cause the failure of the request_irq(). Consider that platform_get_irq() can now in certain cases return -EPROBE_DEFER, and the consequences of letting request_irq() effectively convert that into -EINVAL, even at probe time rather than later on. So it might be better to check just now. Fixes: b1201e44f50b ("can: xilinx CAN controller support") Link: https://lore.kernel.org/all/20211224021324.1447494-1-jiasheng@iscas.a= c.cn Signed-off-by: Jiasheng Jiang Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/can/xilinx_can.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c index b01c6da4dd814..90447a420ec7c 100644 --- a/drivers/net/can/xilinx_can.c +++ b/drivers/net/can/xilinx_can.c @@ -1536,7 +1536,12 @@ static int xcan_probe(struct platform_device *pdev) spin_lock_init(&priv->tx_lock); =20 /* Get IRQ for the device */ - ndev->irq =3D platform_get_irq(pdev, 0); + ret =3D platform_get_irq(pdev, 0); + if (ret < 0) + goto err_free; + + ndev->irq =3D ret; + ndev->flags |=3D IFF_ECHO; /* We support local echo */ =20 platform_set_drvdata(pdev, ndev); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85182C3526D for ; Mon, 24 Jan 2022 19:57:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345733AbiAXT4p (ORCPT ); Mon, 24 Jan 2022 14:56:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354598AbiAXTgt (ORCPT ); Mon, 24 Jan 2022 14:36:49 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A25F0C06137F; Mon, 24 Jan 2022 11:16:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5FD43B8121C; Mon, 24 Jan 2022 19:16:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70B88C340E5; Mon, 24 Jan 2022 19:16:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051817; bh=roOoVmBLp8DGLovcxZsX04NbD9zAfwHu/iuBHS6vXH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mTopkVwaT+3kDZSKLWF10HJuMaaKYn029nvUP4UgMfaFS9Yxn4oFpIOmVrdxp9aSO AF/6BAjrcg9TsS+rRd5x6HiFW8+7Pnt5p5tRPvkO8NUD5uRfB5tMVGtDzMFggN62Xo t+3uBaJl6KgAMhYbS+4HVVrmHu1o+0Z4NOod4nms= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , "Matthew Wilcox (Oracle)" , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.19 096/239] pcmcia: fix setting of kthread task states Date: Mon, 24 Jan 2022 19:42:14 +0100 Message-Id: <20220124183946.158719236@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dominik Brodowski [ Upstream commit fbb3485f1f931102d8ba606f1c28123f5b48afa3 ] We need to set TASK_INTERRUPTIBLE before calling kthread_should_stop(). Otherwise, kthread_stop() might see that the pccardd thread is still in TASK_RUNNING state and fail to wake it up. Additionally, we only need to set the state back to TASK_RUNNING if kthread_should_stop() breaks the loop. Cc: Greg Kroah-Hartman Reported-by: Al Viro Reviewed-by: Matthew Wilcox (Oracle) Fixes: d3046ba809ce ("pcmcia: fix a boot time warning in pcmcia cs code") Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pcmcia/cs.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c index 8c8caec3a72cc..182e5ef4ab83d 100644 --- a/drivers/pcmcia/cs.c +++ b/drivers/pcmcia/cs.c @@ -669,18 +669,16 @@ static int pccardd(void *__skt) if (events || sysfs_events) continue; =20 + set_current_state(TASK_INTERRUPTIBLE); if (kthread_should_stop()) break; =20 - set_current_state(TASK_INTERRUPTIBLE); - schedule(); =20 - /* make sure we are running */ - __set_current_state(TASK_RUNNING); - try_to_freeze(); } + /* make sure we are running before we exit */ + __set_current_state(TASK_RUNNING); =20 /* shut down socket, if a device is still present */ if (skt->state & SOCKET_PRESENT) { --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A1C1C4332F for ; Mon, 24 Jan 2022 19:27:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351654AbiAXT1o (ORCPT ); Mon, 24 Jan 2022 14:27:44 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44216 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347648AbiAXTRB (ORCPT ); Mon, 24 Jan 2022 14:17:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E920260917; Mon, 24 Jan 2022 19:17:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B7865C340E5; Mon, 24 Jan 2022 19:16:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051820; bh=gUBygmoEBQDPFQekCp2li5xY7NKosJ7ZgGesRhBIraQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SPRna9w79WLkd2jSwZBHZ5yA5EdfPbtr1bM3jd3rrE9iO7R8V0FhG/yf7y+GA0mHf iUGT/4uP6lj+yFSNQsybHiAWzK2TZ8HRcOjpc9X//DZdJghZUmXcndmouiiTXHpHfc ygLCwgvUVASEmje6E1NEmFAUylAAanIC7CNu18Hs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Arnd Bergmann , Jakub Kicinski , Sasha Levin , syzbot+003c0a286b9af5412510@syzkaller.appspotmail.com Subject: [PATCH 4.19 097/239] net: mcs7830: handle usb read errors properly Date: Mon, 24 Jan 2022 19:42:15 +0100 Message-Id: <20220124183946.190555778@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin [ Upstream commit d668769eb9c52b150753f1653f7f5a0aeb8239d2 ] Syzbot reported uninit value in mcs7830_bind(). The problem was in missing validation check for bytes read via usbnet_read_cmd(). usbnet_read_cmd() internally calls usb_control_msg(), that returns number of bytes read. Code should validate that requested number of bytes was actually read. So, this patch adds missing size validation check inside mcs7830_get_reg() to prevent uninit value bugs Reported-and-tested-by: syzbot+003c0a286b9af5412510@syzkaller.appspotmail.c= om Fixes: 2a36d7083438 ("USB: driver for mcs7830 (aka DeLOCK) USB ethernet ada= pter") Signed-off-by: Pavel Skripkin Reviewed-by: Arnd Bergmann Link: https://lore.kernel.org/r/20220106225716.7425-1-paskripkin@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/usb/mcs7830.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c index 5a47e5510ca82..c0f52a622964f 100644 --- a/drivers/net/usb/mcs7830.c +++ b/drivers/net/usb/mcs7830.c @@ -121,8 +121,16 @@ static const char driver_name[] =3D "MOSCHIP usb-ether= net driver"; =20 static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *= data) { - return usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, - 0x0000, index, data, size); + int ret; + + ret =3D usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, + 0x0000, index, data, size); + if (ret < 0) + return ret; + else if (ret < size) + return -ENODATA; + + return ret; } =20 static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, const = void *data) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A492C35276 for ; Mon, 24 Jan 2022 19:57:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344460AbiAXT4m (ORCPT ); Mon, 24 Jan 2022 14:56:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354667AbiAXTg7 (ORCPT ); Mon, 24 Jan 2022 14:36:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DD11AC0612F8; Mon, 24 Jan 2022 11:17:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9AE56B81236; Mon, 24 Jan 2022 19:17:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2E49C36AE9; Mon, 24 Jan 2022 19:17:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051823; bh=M2+xpmoMG2NGJVhNb6RBrBI9zSJc9RCc0W1WeKz/v80=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ucL6Fnu2dcFxzz5Oz4SHNvrjL8pybacqBj8WblczGozRsJp+m0SrZeAkoB8Uk0SCg ByLea2dXXIJkLaPMqimPhM42xVomdLI0UsN05S74Vxoxe5ah7gZD3+WD7r1HFiGA0q 0HeXf3orYJNeGwsk/Qx5yazEId1nkIdi/HtoA3B4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Czerner , Jan Kara , Theodore Tso , Sasha Levin Subject: [PATCH 4.19 098/239] ext4: avoid trim error on fs with small groups Date: Mon, 24 Jan 2022 19:42:16 +0100 Message-Id: <20220124183946.222952786@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara [ Upstream commit 173b6e383d2a204c9921ffc1eca3b87aa2106c33 ] A user reported FITRIM ioctl failing for him on ext4 on some devices without apparent reason. After some debugging we've found out that these devices (being LVM volumes) report rather large discard granularity of 42MB and the filesystem had 1k blocksize and thus group size of 8MB. Because ext4 FITRIM implementation puts discard granularity into minlen, ext4_trim_fs() declared the trim request as invalid. However just silently doing nothing seems to be a more appropriate reaction to such combination of parameters since user did not specify anything wrong. CC: Lukas Czerner Fixes: 5c2ed62fd447 ("ext4: Adjust minlen with discard_granularity in the F= ITRIM ioctl") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20211112152202.26614-1-jack@suse.cz Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/ext4/ioctl.c | 2 -- fs/ext4/mballoc.c | 8 ++++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 21c9ebfe83478..484cb68c34d92 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -1052,8 +1052,6 @@ resizefs_out: sizeof(range))) return -EFAULT; =20 - range.minlen =3D max((unsigned int)range.minlen, - q->limits.discard_granularity); ret =3D ext4_trim_fs(sb, &range); if (ret < 0) return ret; diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 447aa17c804e2..db8243627b085 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -5260,6 +5260,7 @@ out: */ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) { + struct request_queue *q =3D bdev_get_queue(sb->s_bdev); struct ext4_group_info *grp; ext4_group_t group, first_group, last_group; ext4_grpblk_t cnt =3D 0, first_cluster, last_cluster; @@ -5278,6 +5279,13 @@ int ext4_trim_fs(struct super_block *sb, struct fstr= im_range *range) start >=3D max_blks || range->len < sb->s_blocksize) return -EINVAL; + /* No point to try to trim less than discard granularity */ + if (range->minlen < q->limits.discard_granularity) { + minlen =3D EXT4_NUM_B2C(EXT4_SB(sb), + q->limits.discard_granularity >> sb->s_blocksize_bits); + if (minlen > EXT4_CLUSTERS_PER_GROUP(sb)) + goto out; + } if (end >=3D max_blks) end =3D max_blks - 1; if (end <=3D first_data_blk) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70062C4707A for ; Mon, 24 Jan 2022 19:57:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345307AbiAXT4n (ORCPT ); Mon, 24 Jan 2022 14:56:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54242 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354666AbiAXTg7 (ORCPT ); Mon, 24 Jan 2022 14:36:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0AD51C0612FC; Mon, 24 Jan 2022 11:17:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A5202B81232; Mon, 24 Jan 2022 19:17:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8EB5C340E5; Mon, 24 Jan 2022 19:17:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051826; bh=/9vfmZF8Y2rYM7HSv/gz+9NfEvjBBAacOA4J8BTCFkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dtEU5N7C5lcC9UbdGKaeVz2NfuFDk5fdcSg+MKqj+S+YZwrVq9aF7TenSK+uP4mDR FY/xZqqSQN2IDO9IQFC5/A0ZR1XI9g4G+1WRUGvd1JlrUaFs6vWAqSFXEIo/Wz2K8G T1B8G4F7bgUml0S5x5SOpfkioGHr0VRIkLMWjZEI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.19 099/239] ALSA: jack: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:17 +0100 Message-Id: <20220124183946.253930476@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 06764dc931848c3a9bc01a63bbf76a605408bb54 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: 9058cbe1eed2 ("ALSA: jack: implement kctl creating for jack devices") Link: https://lore.kernel.org/r/20211116071314.15065-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/core/jack.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/core/jack.c b/sound/core/jack.c index 847a8f3fd06ea..acb531749efb0 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -68,10 +68,13 @@ static int snd_jack_dev_free(struct snd_device *device) struct snd_card *card =3D device->card; struct snd_jack_kctl *jack_kctl, *tmp_jack_kctl; =20 + down_write(&card->controls_rwsem); list_for_each_entry_safe(jack_kctl, tmp_jack_kctl, &jack->kctl_list, list= ) { list_del_init(&jack_kctl->list); snd_ctl_remove(card, jack_kctl->kctl); } + up_write(&card->controls_rwsem); + if (jack->private_free) jack->private_free(jack); =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18FE2C35275 for ; Mon, 24 Jan 2022 19:57:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359229AbiAXT4h (ORCPT ); Mon, 24 Jan 2022 14:56:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53282 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345733AbiAXThN (ORCPT ); Mon, 24 Jan 2022 14:37:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 11563C0604F5; Mon, 24 Jan 2022 11:17:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C1CE1B81240; Mon, 24 Jan 2022 19:17:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF6BAC340E8; Mon, 24 Jan 2022 19:17:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051832; bh=YMq4YagArqu2SkbnR06hP9VJO2Gh6ajfWQWPQ1uzrCE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1aRgW+Kz1JjebxkWt5C0UfGEH887IUDZsr3X+RpqTPa8JnYaqgpb/NhEbwAPO3O6n xmLbT7j5/MLkbtcVbz2bUHcccvJ1G9w2LjbfEmdMqS7852yM1+BeQ8MAHosXEyi8T9 Pm6G/rIVNPAPUzA42KPTmIhUIZ/Nl/UqbqVKjNoU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.19 100/239] ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:18 +0100 Message-Id: <20220124183946.284895097@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 5471e9762e1af4b7df057a96bfd46cc250979b88 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: a8ff48cb7083 ("ALSA: pcm: Free chmap at PCM free callback, too") Link: https://lore.kernel.org/r/20211116071314.15065-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/core/pcm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/core/pcm.c b/sound/core/pcm.c index 01b9d62eef14d..b6ed38dec4357 100644 --- a/sound/core/pcm.c +++ b/sound/core/pcm.c @@ -874,7 +874,11 @@ EXPORT_SYMBOL(snd_pcm_new_internal); static void free_chmap(struct snd_pcm_str *pstr) { if (pstr->chmap_kctl) { - snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl); + struct snd_card *card =3D pstr->pcm->card; + + down_write(&card->controls_rwsem); + snd_ctl_remove(card, pstr->chmap_kctl); + up_write(&card->controls_rwsem); pstr->chmap_kctl =3D NULL; } } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55CC5C433FE for ; Mon, 24 Jan 2022 20:01:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347034AbiAXUBz (ORCPT ); Mon, 24 Jan 2022 15:01:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349657AbiAXThT (ORCPT ); Mon, 24 Jan 2022 14:37:19 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28A98C034008; Mon, 24 Jan 2022 11:17:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D2374B8121A; Mon, 24 Jan 2022 19:17:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF6A2C340E7; Mon, 24 Jan 2022 19:17:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051835; bh=5W3Wnby5D5BExJWBZmyQ2pjt9uT3rIujybiHWOD9L0U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SyIwELqtofVLc/eEa9dQxp0YSnBL87Gj2HgeTnUPDYvbjQRVAHjalHOzZlP6las+S 2oiT4yMXmEjV31+jpHnLogJ6lVNwcryYYbEblkF91PVDdjdFIIVvkNC1473Ilnel6i oUCroG+Ph1JbgvJkFvWyCV4SsM0dEVlwvJxH2fZk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.19 101/239] ALSA: hda: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:19 +0100 Message-Id: <20220124183946.315812307@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 80bd64af75b4bb11c0329bc66c35da2ddfb66d88 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: d13bd412dce2 ("ALSA: hda - Manage kcontrol lists") Link: https://lore.kernel.org/r/20211116071314.15065-3-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/pci/hda/hda_codec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 7f1e763ccca88..b43558ffd78ab 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -1705,8 +1705,11 @@ void snd_hda_ctls_clear(struct hda_codec *codec) { int i; struct hda_nid_item *items =3D codec->mixers.list; + + down_write(&codec->card->controls_rwsem); for (i =3D 0; i < codec->mixers.used; i++) snd_ctl_remove(codec->card, items[i].kctl); + up_write(&codec->card->controls_rwsem); snd_array_free(&codec->mixers); snd_array_free(&codec->nids); } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D4EAC41535 for ; Mon, 24 Jan 2022 19:57:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359158AbiAXT4a (ORCPT ); Mon, 24 Jan 2022 14:56:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349667AbiAXThT (ORCPT ); Mon, 24 Jan 2022 14:37:19 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2FB4EC03400B; Mon, 24 Jan 2022 11:17:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C9C0AB8121A; Mon, 24 Jan 2022 19:17:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D898C340E5; Mon, 24 Jan 2022 19:17:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051838; bh=Qv3iaepdUWUPB8G3RKHiXJh6nOrf8T5JCWPTQVoXFDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gsb1bnPW53q9csd4VzVtWuff//depYjG/LkiqmV7AtMFAm56cZ5yj9zLr7ZlZVwAW +I0e3t/8G4peXWl9XPKVpyAmrN7dQQAWJ6D9JBKivbPBTNRN8JtJivhOhC56ocQzpo BsUT6lRurOVONtwU+VwdOAUmvinkD/di2eB73A+s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kamal Heib , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.19 102/239] RDMA/hns: Validate the pkey index Date: Mon, 24 Jan 2022 19:42:20 +0100 Message-Id: <20220124183946.346995735@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kamal Heib [ Upstream commit 2a67fcfa0db6b4075515bd23497750849b88850f ] Before query pkey, make sure that the queried index is valid. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Link: https://lore.kernel.org/r/20211117145954.123893-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/hw/hns/hns_roce_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband= /hw/hns/hns_roce_main.c index c5cae9a38c044..5e60a2596d2bf 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -295,6 +295,9 @@ static enum rdma_link_layer hns_roce_get_link_layer(str= uct ib_device *device, static int hns_roce_query_pkey(struct ib_device *ib_dev, u8 port, u16 inde= x, u16 *pkey) { + if (index > 0) + return -EINVAL; + *pkey =3D PKEY_ID; =20 return 0; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0870C35268 for ; Mon, 24 Jan 2022 19:26:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350947AbiAXTZj (ORCPT ); Mon, 24 Jan 2022 14:25:39 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:42540 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345649AbiAXTRY (ORCPT ); Mon, 24 Jan 2022 14:17:24 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0EFD8B8121A; Mon, 24 Jan 2022 19:17:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20377C340E5; Mon, 24 Jan 2022 19:17:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051841; bh=4iNiahPieKRqDiDjeJ6kqxnvQqLQ/zw+eC7/XomDRSE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L0307G1ivl/5vV9NQ1dP7Lc6sbYBaCBSlY/5A5q3z6ZwUw+9TG3sfAqCxO20uSt54 HwlNKouRBafcK6jLmp9W2yhHaK6+/wwzS1ldiW2C9w31z74DRqtgGhpyx4MaccTpny +I8MxosB/mNQ/g/uyfNukaZLMaTwbkyYDlkr5irY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peiwei Hu , Michael Ellerman , Sasha Levin Subject: [PATCH 4.19 103/239] powerpc/prom_init: Fix improper check of prom_getprop() Date: Mon, 24 Jan 2022 19:42:21 +0100 Message-Id: <20220124183946.377505729@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peiwei Hu [ Upstream commit 869fb7e5aecbc163003f93f36dcc26d0554319f6 ] prom_getprop() can return PROM_ERROR. Binary operator can not identify it. Fixes: 94d2dde738a5 ("[POWERPC] Efika: prune fixups and make them more care= full") Signed-off-by: Peiwei Hu Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/tencent_BA28CC6897B7C95A92EB8C580B5D1858910= 5@qq.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/kernel/prom_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_ini= t.c index af1e38febe496..29a8087a49010 100644 --- a/arch/powerpc/kernel/prom_init.c +++ b/arch/powerpc/kernel/prom_init.c @@ -2805,7 +2805,7 @@ static void __init fixup_device_tree_efika_add_phy(vo= id) =20 /* Check if the phy-handle property exists - bail if it does */ rv =3D prom_getprop(node, "phy-handle", prop, sizeof(prop)); - if (!rv) + if (rv <=3D 0) return; =20 /* --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E61FAC433EF for ; Mon, 24 Jan 2022 20:01:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376370AbiAXUBc (ORCPT ); Mon, 24 Jan 2022 15:01:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352416AbiAXThV (ORCPT ); Mon, 24 Jan 2022 14:37:21 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ECAA5C034012; Mon, 24 Jan 2022 11:17:25 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8BEE160909; Mon, 24 Jan 2022 19:17:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68B11C340E5; Mon, 24 Jan 2022 19:17:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051845; bh=hoGmMt6X0klq0+u7iW/1fCYXghyAHMkMKI5zDTPe7y0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AEU2wC2z9vKDnMngquQdHrei289fV7pZjb7am5zcmYlG3Hd03M9klKGrhup5urzxq UORk8tMEx1YNxFjUtl50EWFQ7JI8gU9xgNaw2mzOKfzTJCcudXx4hTrhzUZk+Jfbwk xwnpantNstUOqhsN+3nbl518qt1QEMquSlhU7Exo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Bulwahn , Mark Brown , Sasha Levin Subject: [PATCH 4.19 104/239] ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA Date: Mon, 24 Jan 2022 19:42:22 +0100 Message-Id: <20220124183946.409590500@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Bulwahn [ Upstream commit 49f893253ab43566e34332a969324531fea463f6 ] Commit f37fe2f9987b ("ASoC: uniphier: add support for UniPhier AIO common driver") adds configs SND_SOC_UNIPHIER_{LD11,PXS2}, which select the non-existing config SND_SOC_UNIPHIER_AIO_DMA. Hence, ./scripts/checkkconfigsymbols.py warns: SND_SOC_UNIPHIER_AIO_DMA Referencing files: sound/soc/uniphier/Kconfig Probably, there is actually no further config intended to be selected here. So, just drop selecting the non-existing config. Fixes: f37fe2f9987b ("ASoC: uniphier: add support for UniPhier AIO common d= river") Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20211125095158.8394-2-lukas.bulwahn@gmail.c= om Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/soc/uniphier/Kconfig | 2 -- 1 file changed, 2 deletions(-) diff --git a/sound/soc/uniphier/Kconfig b/sound/soc/uniphier/Kconfig index aa3592ee1358b..ddfa6424c656b 100644 --- a/sound/soc/uniphier/Kconfig +++ b/sound/soc/uniphier/Kconfig @@ -23,7 +23,6 @@ config SND_SOC_UNIPHIER_LD11 tristate "UniPhier LD11/LD20 Device Driver" depends on SND_SOC_UNIPHIER select SND_SOC_UNIPHIER_AIO - select SND_SOC_UNIPHIER_AIO_DMA help This adds ASoC driver for Socionext UniPhier LD11/LD20 input and output that can be used with other codecs. @@ -34,7 +33,6 @@ config SND_SOC_UNIPHIER_PXS2 tristate "UniPhier PXs2 Device Driver" depends on SND_SOC_UNIPHIER select SND_SOC_UNIPHIER_AIO - select SND_SOC_UNIPHIER_AIO_DMA help This adds ASoC driver for Socionext UniPhier PXs2 input and output that can be used with other codecs. --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8828C4167B for ; Mon, 24 Jan 2022 19:57:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359069AbiAXT4S (ORCPT ); Mon, 24 Jan 2022 14:56:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53894 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347390AbiAXThf (ORCPT ); Mon, 24 Jan 2022 14:37:35 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DE41C034016; Mon, 24 Jan 2022 11:17:29 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B20B56131D; Mon, 24 Jan 2022 19:17:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B3D0C340E8; Mon, 24 Jan 2022 19:17:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051848; bh=N0oQUiaIHtDW7XHvXmF08AzAXS3DvHsObImsogfjiTU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xkUxufUt3NA0Mb0BULHthqZVSSn8AOIdV8fA/W9XT5ssUoJ6tADWI6NT6yBIVGO9A CXsn0nkA5BW4cPYNspP4YKC8ffvFtpxaLT4phgyvoq0TVTC4vOxkJffKij4PtKg8fO 6oA5Cul0dwoayXbyqjAD3nNsH5Q9OLCoFcXxA4Os= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bixuan Cui , Takashi Iwai , Sasha Levin Subject: [PATCH 4.19 105/239] ALSA: oss: fix compile error when OSS_DEBUG is enabled Date: Mon, 24 Jan 2022 19:42:23 +0100 Message-Id: <20220124183946.446789306@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bixuan Cui [ Upstream commit 8e7daf318d97f25e18b2fc7eb5909e34cd903575 ] Fix compile error when OSS_DEBUG is enabled: sound/core/oss/pcm_oss.c: In function 'snd_pcm_oss_set_trigger': sound/core/oss/pcm_oss.c:2055:10: error: 'substream' undeclared (first use in this function); did you mean 'csubstream'? pcm_dbg(substream->pcm, "pcm_oss: trigger =3D 0x%x\n", trigger); ^ Fixes: 61efcee8608c ("ALSA: oss: Use standard printk helpers") Signed-off-by: Bixuan Cui Link: https://lore.kernel.org/r/1638349134-110369-1-git-send-email-cuibixua= n@linux.alibaba.com Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/core/oss/pcm_oss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 2b3bd6f31e4c1..cd68a0ae82d31 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -2070,7 +2070,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss= _file *pcm_oss_file, int tr int err, cmd; =20 #ifdef OSS_DEBUG - pcm_dbg(substream->pcm, "pcm_oss: trigger =3D 0x%x\n", trigger); + pr_debug("pcm_oss: trigger =3D 0x%x\n", trigger); #endif =09 psubstream =3D pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC41BC433FE for ; Mon, 24 Jan 2022 20:00:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359614AbiAXT7z (ORCPT ); Mon, 24 Jan 2022 14:59:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348920AbiAXTk7 (ORCPT ); Mon, 24 Jan 2022 14:40:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AFA34C0613E7; Mon, 24 Jan 2022 11:19:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4EED761317; Mon, 24 Jan 2022 19:19:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2ED46C340E8; Mon, 24 Jan 2022 19:19:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051979; bh=0KD1eiKFQZ+15lvlwGjcpA2CZ9608oocxiXbhgHw+rM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mTNoHkbi2G/vIR0yU+zQDWXHU8RLjoSS60GeyVzCoww+t201svbfVvO+Kv2H92rX5 Oy6I/a4CIKxZvbN5FhPH92ndO6j7CZCJhOvteOSpC6gF4AcBHlTQtxUf7wEISGZyJ8 W3i1WH8v1+lijfeUkiSZw26ii8IXWzkscvFEecTs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Sasha Levin Subject: [PATCH 4.19 106/239] char/mwave: Adjust io port register size Date: Mon, 24 Jan 2022 19:42:24 +0100 Message-Id: <20220124183946.477016172@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook [ Upstream commit f5912cc19acd7c24b2dbf65a6340bf194244f085 ] Using MKWORD() on a byte-sized variable results in OOB read. Expand the size of the reserved area so both MKWORD and MKBYTE continue to work without overflow. Silences this warning on a -Warray-bounds build: drivers/char/mwave/3780i.h:346:22: error: array subscript 'short unsigned i= nt[0]' is partly outside array bounds of 'DSP_ISA_SLAVE_CONTROL[1]' [-Werro= r=3Darray-bounds] 346 | #define MKWORD(var) (*((unsigned short *)(&var))) | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/mwave/3780i.h:356:40: note: in definition of macro 'OutWordDsp' 356 | #define OutWordDsp(index,value) outw(value,usDspBaseIO+index) | ^~~~~ drivers/char/mwave/3780i.c:373:41: note: in expansion of macro 'MKWORD' 373 | OutWordDsp(DSP_IsaSlaveControl, MKWORD(rSlaveControl)); | ^~~~~~ drivers/char/mwave/3780i.c:358:31: note: while referencing 'rSlaveControl' 358 | DSP_ISA_SLAVE_CONTROL rSlaveControl; | ^~~~~~~~~~~~~ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20211203084206.3104326-1-keescook@chromium.= org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/char/mwave/3780i.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/mwave/3780i.h b/drivers/char/mwave/3780i.h index 9ccb6b270b071..95164246afd1a 100644 --- a/drivers/char/mwave/3780i.h +++ b/drivers/char/mwave/3780i.h @@ -68,7 +68,7 @@ typedef struct { unsigned char ClockControl:1; /* RW: Clock control: 0=3Dnormal, 1=3Dstop = 3780i clocks */ unsigned char SoftReset:1; /* RW: Soft reset 0=3Dnormal, 1=3Dsoft reset a= ctive */ unsigned char ConfigMode:1; /* RW: Configuration mode, 0=3Dnormal, 1=3Dco= nfig mode */ - unsigned char Reserved:5; /* 0: Reserved */ + unsigned short Reserved:13; /* 0: Reserved */ } DSP_ISA_SLAVE_CONTROL; =20 =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08F2BC41535 for ; Mon, 24 Jan 2022 19:26:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351026AbiAXTZr (ORCPT ); Mon, 24 Jan 2022 14:25:47 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:46904 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242860AbiAXTR4 (ORCPT ); Mon, 24 Jan 2022 14:17:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D0B7F60010; Mon, 24 Jan 2022 19:17:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9070EC340E5; Mon, 24 Jan 2022 19:17:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051873; bh=ZKj5uNOC/s2GY6wnIqIljyZ3oiYEhoGF8RHpon+/GPY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yfAfSJPOWWBpKVCGsO8ohYcokiP/kL218iH8aVDRpPeyrLJhUjT75x46huid31fAA lX1S0M+itEchV458EGlMETMoZdOHPCkDqtHBi/vvHDb6YhVwoBcR6dTIyym9AaPTtx XZthwU+65V1/bAn/hSjGfBdnK/nUnHyE1KUg0FZA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Sasha Levin Subject: [PATCH 4.19 107/239] uio: uio_dmem_genirq: Catch the Exception Date: Mon, 24 Jan 2022 19:42:25 +0100 Message-Id: <20220124183946.508012683@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit eec91694f927d1026974444eb6a3adccd4f1cbc2 ] The return value of dma_set_coherent_mask() is not always 0. To catch the exception in case that dma is not support the mask. Fixes: 0a0c3b5a24bd ("Add new uio device for dynamic memory allocation") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20211204000326.1592687-1-jiasheng@iscas.ac.= cn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/uio/uio_dmem_genirq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c index a00b4aee6c799..a31b9d5260ca0 100644 --- a/drivers/uio/uio_dmem_genirq.c +++ b/drivers/uio/uio_dmem_genirq.c @@ -194,7 +194,11 @@ static int uio_dmem_genirq_probe(struct platform_devic= e *pdev) goto bad0; } =20 - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + ret =3D dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) { + dev_err(&pdev->dev, "DMA enable failed\n"); + return ret; + } =20 priv->uioinfo =3D uioinfo; spin_lock_init(&priv->lock); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B7F4C433F5 for ; Mon, 24 Jan 2022 21:27:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1452131AbiAXVYG (ORCPT ); Mon, 24 Jan 2022 16:24:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45164 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350425AbiAXU5F (ORCPT ); Mon, 24 Jan 2022 15:57:05 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B2076C110F33; Mon, 24 Jan 2022 11:18:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5191A60918; Mon, 24 Jan 2022 19:18:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31F0CC340E5; Mon, 24 Jan 2022 19:18:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051907; bh=I5g32WXKgHPSR8SEIEeB0HviWhU+yo4ohTjx1FEUO9I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UDrCgavj08fU8wtHvmDBD7op80DCQqCWzr8BQS6w1bFO6J2MGCV6IEHiY3F26rzVD vBuDQLULRdNw3WHi0MD93rSwIodCGZ9l6qijFXTSAMhn00Mw2FWAyuVi0eGi5OgRcj PFVpS1cyPv24M0MTBqOYhzH3GB+rwz66w/4mZC08= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robin Murphy , Hector Martin , Joerg Roedel , Sasha Levin Subject: [PATCH 4.19 108/239] iommu/io-pgtable-arm: Fix table descriptor paddr formatting Date: Mon, 24 Jan 2022 19:42:26 +0100 Message-Id: <20220124183946.539996444@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hector Martin [ Upstream commit 9abe2ac834851a7d0b0756e295cf7a292c45ca53 ] Table descriptors were being installed without properly formatting the address using paddr_to_iopte, which does not match up with the iopte_deref in __arm_lpae_map. This is incorrect for the LPAE pte format, as it does not handle the high bits properly. This was found on Apple T6000 DARTs, which require a new pte format (different shift); adding support for that to paddr_to_iopte/iopte_to_paddr caused it to break badly, as even <48-bit addresses would end up incorrect in that case. Fixes: 6c89928ff7a0 ("iommu/io-pgtable-arm: Support 52-bit physical address= ") Acked-by: Robin Murphy Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20211120031343.88034-1-marcan@marcan.st Signed-off-by: Joerg Roedel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/iommu/io-pgtable-arm.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index 2f79efd16a052..4bd2dd70acaec 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -346,11 +346,12 @@ static int arm_lpae_init_pte(struct arm_lpae_io_pgtab= le *data, static arm_lpae_iopte arm_lpae_install_table(arm_lpae_iopte *table, arm_lpae_iopte *ptep, arm_lpae_iopte curr, - struct io_pgtable_cfg *cfg) + struct arm_lpae_io_pgtable *data) { arm_lpae_iopte old, new; + struct io_pgtable_cfg *cfg =3D &data->iop.cfg; =20 - new =3D __pa(table) | ARM_LPAE_PTE_TYPE_TABLE; + new =3D paddr_to_iopte(__pa(table), data) | ARM_LPAE_PTE_TYPE_TABLE; if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS) new |=3D ARM_LPAE_PTE_NSTABLE; =20 @@ -402,7 +403,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *d= ata, unsigned long iova, if (!cptep) return -ENOMEM; =20 - pte =3D arm_lpae_install_table(cptep, ptep, 0, cfg); + pte =3D arm_lpae_install_table(cptep, ptep, 0, data); if (pte) __arm_lpae_free_pages(cptep, tblsz, cfg); } else if (!(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA) && @@ -562,7 +563,7 @@ static size_t arm_lpae_split_blk_unmap(struct arm_lpae_= io_pgtable *data, __arm_lpae_init_pte(data, blk_paddr, pte, lvl, &tablep[i]); } =20 - pte =3D arm_lpae_install_table(tablep, ptep, blk_pte, cfg); + pte =3D arm_lpae_install_table(tablep, ptep, blk_pte, data); if (pte !=3D blk_pte) { __arm_lpae_free_pages(tablep, tablesz, cfg); /* --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CEA9C3526F for ; Mon, 24 Jan 2022 19:26:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351283AbiAXT0S (ORCPT ); Mon, 24 Jan 2022 14:26:18 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:44216 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348603AbiAXTTE (ORCPT ); Mon, 24 Jan 2022 14:19:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 42F7060918; Mon, 24 Jan 2022 19:19:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1D6DEC340E5; Mon, 24 Jan 2022 19:19:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051942; bh=uuJiFNoGK9y9RIKBCEDI7ZPR30cHVIw3x5Z+z1EnbF0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ggc7l3xHAWt1IB0AMNcnIplzV2ZjksQ8IsvsFoYzopSvVvH5KU/UhY7ejrXjbiU6i 1zbZAiYZ2MlGDpbVpnOgWoMgwmJkEs6ISbgVKYqfV+g6ikjyarke7grxKBkLa90FeF Boz3VNawL/SdmKzCd2RzgdSTOiTr0vdRUzxrruAI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexey Dobriyan , Bean Huo , Bart Van Assche , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.19 109/239] scsi: ufs: Fix race conditions related to driver data Date: Mon, 24 Jan 2022 19:42:27 +0100 Message-Id: <20220124183946.570409809@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bart Van Assche [ Upstream commit 21ad0e49085deb22c094f91f9da57319a97188e4 ] The driver data pointer must be set before any callbacks are registered that use that pointer. Hence move the initialization of that pointer from after the ufshcd_init() call to inside ufshcd_init(). Link: https://lore.kernel.org/r/20211203231950.193369-7-bvanassche@acm.org Fixes: 3b1d05807a9a ("[SCSI] ufs: Segregate PCI Specific Code") Reported-by: Alexey Dobriyan Tested-by: Bean Huo Reviewed-by: Bean Huo Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - drivers/scsi/ufs/ufshcd-pltfrm.c | 2 -- drivers/scsi/ufs/ufshcd.c | 7 +++++++ 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/ufs/tc-dwc-g210-pci.c b/drivers/scsi/ufs/tc-dwc-g= 210-pci.c index 2f41722a8c28d..2c6cb7f6b61a6 100644 --- a/drivers/scsi/ufs/tc-dwc-g210-pci.c +++ b/drivers/scsi/ufs/tc-dwc-g210-pci.c @@ -138,7 +138,6 @@ tc_dwc_g210_pci_probe(struct pci_dev *pdev, const struc= t pci_device_id *id) return err; } =20 - pci_set_drvdata(pdev, hba); pm_runtime_put_noidle(&pdev->dev); pm_runtime_allow(&pdev->dev); =20 diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-plt= frm.c index 30c22e16b1e34..57985841a879e 100644 --- a/drivers/scsi/ufs/ufshcd-pltfrm.c +++ b/drivers/scsi/ufs/ufshcd-pltfrm.c @@ -348,8 +348,6 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, goto dealloc_host; } =20 - platform_set_drvdata(pdev, hba); - pm_runtime_set_active(&pdev->dev); pm_runtime_enable(&pdev->dev); =20 diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index b18430efb00fb..fee1989e23f01 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -8046,6 +8046,13 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *m= mio_base, unsigned int irq) struct Scsi_Host *host =3D hba->host; struct device *dev =3D hba->dev; =20 + /* + * dev_set_drvdata() must be called before any callbacks are registered + * that use dev_get_drvdata() (frequency scaling, clock scaling, hwmon, + * sysfs). + */ + dev_set_drvdata(dev, hba); + if (!mmio_base) { dev_err(hba->dev, "Invalid memory reference for mmio_base is NULL\n"); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1094AC35268 for ; Mon, 24 Jan 2022 19:51:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357611AbiAXTvE (ORCPT ); Mon, 24 Jan 2022 14:51:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54584 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344690AbiAXTkg (ORCPT ); Mon, 24 Jan 2022 14:40:36 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB1B8C07A966; Mon, 24 Jan 2022 11:19:22 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 707BDB81232; Mon, 24 Jan 2022 19:19:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 99063C340E5; Mon, 24 Jan 2022 19:19:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051961; bh=vvYjAPxxL+ZjqcEidLvpz0cKF/e03ciPhpXnnDJYgtQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Cmh+Ceo3l2mFIYF7+bvm5LNHjLPGXXOZb1Ad06pYUB66RVO39VZH5xN5WWlqZo8Au BcBh3Wy/h82vcxdYkpu9pgj19eIBIUShmghVYC7Z79/CRvpZtaa99kwdiFKAuSWzne Olx8HkTlZwAdnr4jnFhU6NJsRSGu3U78e1dsQ5gw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Avihai Horon , Mark Zhang , Leon Romanovsky , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.19 110/239] RDMA/core: Let ib_find_gid() continue search even after empty entry Date: Mon, 24 Jan 2022 19:42:28 +0100 Message-Id: <20220124183946.600613206@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Avihai Horon [ Upstream commit 483d805191a23191f8294bbf9b4e94836f5d92e4 ] Currently, ib_find_gid() will stop searching after encountering the first empty GID table entry. This behavior is wrong since neither IB nor RoCE spec enforce tightly packed GID tables. For example, when a valid GID entry exists at index N, and if a GID entry is empty at index N-1, ib_find_gid() will fail to find the valid entry. Fix it by making ib_find_gid() continue searching even after encountering missing entries. Fixes: 5eb620c81ce3 ("IB/core: Add helpers for uncached GID and P_Key searc= hes") Link: https://lore.kernel.org/r/e55d331b96cecfc2cf19803d16e7109ea966882d.16= 39055490.git.leonro@nvidia.com Signed-off-by: Avihai Horon Reviewed-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/core/device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/dev= ice.c index 6a585c3e21923..ffd0f43e2129f 100644 --- a/drivers/infiniband/core/device.c +++ b/drivers/infiniband/core/device.c @@ -1039,7 +1039,8 @@ int ib_find_gid(struct ib_device *device, union ib_gi= d *gid, for (i =3D 0; i < device->port_immutable[port].gid_tbl_len; ++i) { ret =3D rdma_query_gid(device, port, i, &tmp_gid); if (ret) - return ret; + continue; + if (!memcmp(&tmp_gid, gid, sizeof *gid)) { *port_num =3D port; if (index) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7DA61C433EF for ; Mon, 24 Jan 2022 19:26:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351334AbiAXT0q (ORCPT ); Mon, 24 Jan 2022 14:26:46 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:42540 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345805AbiAXTT0 (ORCPT ); Mon, 24 Jan 2022 14:19:26 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 87007B8123F; Mon, 24 Jan 2022 19:19:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3E0EC340E5; Mon, 24 Jan 2022 19:19:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051964; bh=iS+y03BfRF0LeTvWUGV0QoMfW2bryzaHTzsrUFwQqKk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wj/s0s3BBdivZ9XZX35DB2RmMoWXJXqnwiDSFi+mbd52AhlH9R9vI3f5ktK9eTajg o3dqqveVXQ38l09ymNTNxLZVNleTO7Zm3JWknJcRMPKM/7UvexD6/V+N7++Y3ez6iI 2fhtGGOFlF378Y4tG8FHKu5Sfs4s4bBoq27YlS0g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Mark Brown , Sasha Levin Subject: [PATCH 4.19 111/239] ASoC: rt5663: Handle device_property_read_u32_array error codes Date: Mon, 24 Jan 2022 19:42:29 +0100 Message-Id: <20220124183946.631656385@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 2167c0b205960607fb136b4bb3c556a62be1569a ] The return value of device_property_read_u32_array() is not always 0. To catch the exception in case that devm_kzalloc failed and the rt5663->imp_table was NULL, which caused the failure of device_property_read_u32_array. Fixes: 450f0f6a8fb4 ("ASoC: rt5663: Add the manual offset field to compensa= te the DC offset") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20211215031550.70702-1-jiasheng@iscas.ac.cn Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/soc/codecs/rt5663.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c index 9bd24ad422407..dd77f131ce6c5 100644 --- a/sound/soc/codecs/rt5663.c +++ b/sound/soc/codecs/rt5663.c @@ -3446,6 +3446,7 @@ static void rt5663_calibrate(struct rt5663_priv *rt56= 63) static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) { int table_size; + int ret; =20 device_property_read_u32(dev, "realtek,dc_offset_l_manual", &rt5663->pdata.dc_offset_l_manual); @@ -3462,9 +3463,11 @@ static int rt5663_parse_dp(struct rt5663_priv *rt566= 3, struct device *dev) table_size =3D sizeof(struct impedance_mapping_table) * rt5663->pdata.impedance_sensing_num; rt5663->imp_table =3D devm_kzalloc(dev, table_size, GFP_KERNEL); - device_property_read_u32_array(dev, + ret =3D device_property_read_u32_array(dev, "realtek,impedance_sensing_table", (u32 *)rt5663->imp_table, table_size); + if (ret) + return ret; } =20 return 0; @@ -3489,8 +3492,11 @@ static int rt5663_i2c_probe(struct i2c_client *i2c, =20 if (pdata) rt5663->pdata =3D *pdata; - else - rt5663_parse_dp(rt5663, &i2c->dev); + else { + ret =3D rt5663_parse_dp(rt5663, &i2c->dev); + if (ret) + return ret; + } =20 regmap =3D devm_regmap_init_i2c(i2c, &temp_regmap); if (IS_ERR(regmap)) { --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21547C433EF for ; Mon, 24 Jan 2022 19:26:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346637AbiAXT0k (ORCPT ); Mon, 24 Jan 2022 14:26:40 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48328 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345698AbiAXTT2 (ORCPT ); Mon, 24 Jan 2022 14:19:28 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DC7AF6121F; Mon, 24 Jan 2022 19:19:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9FB4CC340E8; Mon, 24 Jan 2022 19:19:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051967; bh=/0GNHOcGMKJ+IUCw8BtEQJCDlBLL5fjf7fhxbTN3nVE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M/BzC18JXSyHdjD2yZZyXgz0pNABfzlS+/5YS1eRkSk4RT+ENgYmZ3QAU1jA62Tpy s6RjD6zssOu30g75BHSW0ZfXtqd3ZdGGFRZD4Ho2b+jIG+/Txa8rerX6P5vX9l/C2i 3cPerwlDTacX95LTitOUoAKAMM+6PgkRAOMdtqvw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , Mark Brown , Vinod Koul , Sasha Levin Subject: [PATCH 4.19 112/239] dmaengine: pxa/mmp: stop referencing config->slave_id Date: Mon, 24 Jan 2022 19:42:30 +0100 Message-Id: <20220124183946.660918740@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arnd Bergmann [ Upstream commit 134c37fa250a87a7e77c80a7c59ae16c462e46e0 ] The last driver referencing the slave_id on Marvell PXA and MMP platforms was the SPI driver, but this stopped doing so a long time ago, so the TODO from the earlier patch can no be removed. Fixes: b729bf34535e ("spi/pxa2xx: Don't use slave_id of dma_slave_config") Fixes: 13b3006b8ebd ("dma: mmp_pdma: add filter function") Signed-off-by: Arnd Bergmann Acked-by: Mark Brown Link: https://lore.kernel.org/r/20211122222203.4103644-7-arnd@kernel.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/dma/mmp_pdma.c | 6 ------ drivers/dma/pxa_dma.c | 7 ------- 2 files changed, 13 deletions(-) diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c index eb3a1f42ab065..e8b2d3e31de80 100644 --- a/drivers/dma/mmp_pdma.c +++ b/drivers/dma/mmp_pdma.c @@ -722,12 +722,6 @@ static int mmp_pdma_config(struct dma_chan *dchan, =20 chan->dir =3D cfg->direction; chan->dev_addr =3D addr; - /* FIXME: drivers should be ported over to use the filter - * function. Once that's done, the following two lines can - * be removed. - */ - if (cfg->slave_id) - chan->drcmr =3D cfg->slave_id; =20 return 0; } diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c index b31c28b67ad3e..c54986902b9d2 100644 --- a/drivers/dma/pxa_dma.c +++ b/drivers/dma/pxa_dma.c @@ -960,13 +960,6 @@ static void pxad_get_config(struct pxad_chan *chan, *dcmd |=3D PXA_DCMD_BURST16; else if (maxburst =3D=3D 32) *dcmd |=3D PXA_DCMD_BURST32; - - /* FIXME: drivers should be ported over to use the filter - * function. Once that's done, the following two lines can - * be removed. - */ - if (chan->cfg.slave_id) - chan->drcmr =3D chan->cfg.slave_id; } =20 static struct dma_async_tx_descriptor * --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86FA2C433F5 for ; Mon, 24 Jan 2022 19:27:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351368AbiAXT04 (ORCPT ); Mon, 24 Jan 2022 14:26:56 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:44076 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348696AbiAXTTd (ORCPT ); Mon, 24 Jan 2022 14:19:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A8217B81232; Mon, 24 Jan 2022 19:19:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C97A1C340E5; Mon, 24 Jan 2022 19:19:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051970; bh=1yauvXetk58pWxmMyB0UDk1pAUbRKeClGbIyRmsWcmA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fI8vkZEHxMxxyOD74kdbkJgvagXZNmUETsRv099aVStNruzk1P0KSlx+znPbPWHh4 0mOzxd+oVnWYu1+1WZ05+vLlhI/Ee3aWAQ4FI4yxsD30nN9OCXsf7SvDmImgAD2BSs 7DTr/NlLxn0O6r3y7IvkGkxQdiJoJ/f84zIX3c28= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Garry , Xiongfeng Wang , Robin Murphy , Joerg Roedel , Sasha Levin Subject: [PATCH 4.19 113/239] iommu/iova: Fix race between FQ timeout and teardown Date: Mon, 24 Jan 2022 19:42:31 +0100 Message-Id: <20220124183946.700834582@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiongfeng Wang [ Upstream commit d7061627d701c90e1cac1e1e60c45292f64f3470 ] It turns out to be possible for hotplugging out a device to reach the stage of tearing down the device's group and default domain before the domain's flush queue has drained naturally. At this point, it is then possible for the timeout to expire just before the del_timer() call in free_iova_flush_queue(), such that we then proceed to free the FQ resources while fq_flush_timeout() is still accessing them on another CPU. Crashes due to this have been observed in the wild while removing NVMe devices. Close the race window by using del_timer_sync() to safely wait for any active timeout handler to finish before we start to free things. We already avoid any locking in free_iova_flush_queue() since the FQ is supposed to be inactive anyway, so the potential deadlock scenario does not apply. Fixes: 9a005a800ae8 ("iommu/iova: Add flush timer") Reviewed-by: John Garry Signed-off-by: Xiongfeng Wang [ rm: rewrite commit message ] Signed-off-by: Robin Murphy Link: https://lore.kernel.org/r/0a365e5b07f14b7344677ad6a9a734966a8422ce.16= 39753638.git.robin.murphy@arm.com Signed-off-by: Joerg Roedel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/iommu/iova.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c index ce5cd05253db9..fdd68d8e8adc6 100644 --- a/drivers/iommu/iova.c +++ b/drivers/iommu/iova.c @@ -75,8 +75,7 @@ static void free_iova_flush_queue(struct iova_domain *iov= ad) if (!has_iova_flush_queue(iovad)) return; =20 - if (timer_pending(&iovad->fq_timer)) - del_timer(&iovad->fq_timer); + del_timer_sync(&iovad->fq_timer); =20 fq_destroy_all_entries(iovad); =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DB96C433FE for ; Mon, 24 Jan 2022 19:51:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233592AbiAXTvM (ORCPT ); Mon, 24 Jan 2022 14:51:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55156 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345601AbiAXTkg (ORCPT ); Mon, 24 Jan 2022 14:40:36 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94C17C0613DE; Mon, 24 Jan 2022 11:19:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 316B2612F3; Mon, 24 Jan 2022 19:19:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E850FC340E5; Mon, 24 Jan 2022 19:19:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051973; bh=Yl19xK2S3Yrf+HDHivDr1Qg8Bb/pOf54XZ1Z8dK3gjo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r/hOYHoPlyrKbNPul/AbPfHTWi191C6dC8symJckAEkzyRvX2x2ht+ySynNYBJEp+ p6x7Ms9++Cok2xxz07iJDQizdQ+3mJ50XzIO2oljU3tM/mUT9mwGOS1r87FzX96CJL kJYYgNPICz59AY2LiLTnEf6LJETku5xBsLGxS7TI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Mark Brown , Sasha Levin Subject: [PATCH 4.19 114/239] ASoC: mediatek: Check for error clk pointer Date: Mon, 24 Jan 2022 19:42:32 +0100 Message-Id: <20220124183946.729470383@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 9de2b9286a6dd16966959b3cb34fc2ddfd39213e ] Yes, you are right and now the return code depending on the init_clks(). Fixes: 6078c651947a ("soc: mediatek: Refine scpsys to support multiple plat= form") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20211222015157.1025853-1-jiasheng@iscas.ac.= cn Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/soc/mediatek/mtk-scpsys.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-s= cpsys.c index ef54f1638d207..01fcad7c8fae8 100644 --- a/drivers/soc/mediatek/mtk-scpsys.c +++ b/drivers/soc/mediatek/mtk-scpsys.c @@ -341,12 +341,17 @@ out: return ret; } =20 -static void init_clks(struct platform_device *pdev, struct clk **clk) +static int init_clks(struct platform_device *pdev, struct clk **clk) { int i; =20 - for (i =3D CLK_NONE + 1; i < CLK_MAX; i++) + for (i =3D CLK_NONE + 1; i < CLK_MAX; i++) { clk[i] =3D devm_clk_get(&pdev->dev, clk_names[i]); + if (IS_ERR(clk[i])) + return PTR_ERR(clk[i]); + } + + return 0; } =20 static struct scp *init_scp(struct platform_device *pdev, @@ -356,7 +361,7 @@ static struct scp *init_scp(struct platform_device *pde= v, { struct genpd_onecell_data *pd_data; struct resource *res; - int i, j; + int i, j, ret; struct scp *scp; struct clk *clk[CLK_MAX]; =20 @@ -411,7 +416,9 @@ static struct scp *init_scp(struct platform_device *pde= v, =20 pd_data->num_domains =3D num; =20 - init_clks(pdev, clk); + ret =3D init_clks(pdev, clk); + if (ret) + return ERR_PTR(ret); =20 for (i =3D 0; i < num; i++) { struct scp_domain *scpd =3D &scp->domains[i]; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37E9FC4332F for ; Mon, 24 Jan 2022 20:00:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359720AbiAXUAF (ORCPT ); Mon, 24 Jan 2022 15:00:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54648 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348804AbiAXTkz (ORCPT ); Mon, 24 Jan 2022 14:40:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 37F65C0613E6; Mon, 24 Jan 2022 11:19:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E4B39B81249; Mon, 24 Jan 2022 19:19:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 07B2FC340E7; Mon, 24 Jan 2022 19:19:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051976; bh=QMWYLrt8iQbcEWQT/CMGJk+AiXwb31DZVl21V+GXoQs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J39H91+yz2I/u6FG6PevGIiCQToQ/jszeZI3NnbPUnBPbMarO7e4Qe/N4QIx3h05n PLgyKc3QTlh/ogSa2iZ/EzjtHqK83XQsQdzzBKdWMGr9MukrjQREnGccKmMvTrkV13 WPweaFB1RuxTvVl0AvB+Pb1ncZ5XnNkgBwE6L4G4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Krzysztof Kozlowski , Mark Brown , Sasha Levin Subject: [PATCH 4.19 115/239] ASoC: samsung: idma: Check of ioremap return value Date: Mon, 24 Jan 2022 19:42:33 +0100 Message-Id: <20220124183946.761209146@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 3ecb46755eb85456b459a1a9f952c52986bce8ec ] Because of the potential failure of the ioremap(), the buf->area could be NULL. Therefore, we need to check it and return -ENOMEM in order to transfer the error. Fixes: f09aecd50f39 ("ASoC: SAMSUNG: Add I2S0 internal dma driver") Signed-off-by: Jiasheng Jiang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20211228034026.1659385-1-jiasheng@iscas.ac.= cn Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/soc/samsung/idma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c index b1f09b942410d..e397f5e10e33e 100644 --- a/sound/soc/samsung/idma.c +++ b/sound/soc/samsung/idma.c @@ -369,6 +369,8 @@ static int preallocate_idma_buffer(struct snd_pcm *pcm,= int stream) buf->addr =3D idma.lp_tx_addr; buf->bytes =3D idma_hardware.buffer_bytes_max; buf->area =3D (unsigned char * __force)ioremap(buf->addr, buf->bytes); + if (!buf->area) + return -ENOMEM; =20 return 0; } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3448CC4167D for ; Mon, 24 Jan 2022 19:26:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351047AbiAXTZu (ORCPT ); Mon, 24 Jan 2022 14:25:50 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:46972 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345363AbiAXTR6 (ORCPT ); Mon, 24 Jan 2022 14:17:58 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DE4A761361; Mon, 24 Jan 2022 19:17:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF3C7C340E5; Mon, 24 Jan 2022 19:17:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051876; bh=2C18HuDLscgc4+tKatxU9QstG6/auVKahETKdInN1gE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2BpiDSZZPtKzzd+kpBq4n/PNBkzkDgJtKbeBmcjIFfwj8TcUTd5CyjVLMxqSPji9d JkabvRqrOEy8FwWDHzKdCrG/gaD35crG2MUT6BzeYqtfFfQDYdDjF4Iiv1VMMnOh+1 p5GCPpMoZcBRpdL7gfyk+bmgCNRI8mUuXezFddRE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wei Yongjun , Sasha Levin Subject: [PATCH 4.19 116/239] misc: lattice-ecp3-config: Fix task hung when firmware load failed Date: Mon, 24 Jan 2022 19:42:34 +0100 Message-Id: <20220124183946.791509343@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit fcee5ce50bdb21116711e38635e3865594af907e ] When firmware load failed, kernel report task hung as follows: INFO: task xrun:5191 blocked for more than 147 seconds. Tainted: G W 5.16.0-rc5-next-20211220+ #11 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:xrun state:D stack: 0 pid: 5191 ppid: 270 flags:0x0000= 0004 Call Trace: __schedule+0xc12/0x4b50 kernel/sched/core.c:4986 schedule+0xd7/0x260 kernel/sched/core.c:6369 (discriminator 1) schedule_timeout+0x7aa/0xa80 kernel/time/timer.c:1857 wait_for_completion+0x181/0x290 kernel/sched/completion.c:85 lattice_ecp3_remove+0x32/0x40 drivers/misc/lattice-ecp3-config.c:221 spi_remove+0x72/0xb0 drivers/spi/spi.c:409 lattice_ecp3_remove() wait for signals from firmware loading, but when load failed, firmware_load() does not send this signal. This cause device remove hung. Fix it by sending signal even if load failed. Fixes: 781551df57c7 ("misc: Add Lattice ECP3 FPGA configuration via SPI") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20211228125522.3122284-1-weiyongjun1@huawei= .com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/misc/lattice-ecp3-config.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/misc/lattice-ecp3-config.c b/drivers/misc/lattice-ecp3= -config.c index 626fdcaf25101..645d26536114f 100644 --- a/drivers/misc/lattice-ecp3-config.c +++ b/drivers/misc/lattice-ecp3-config.c @@ -81,12 +81,12 @@ static void firmware_load(const struct firmware *fw, vo= id *context) =20 if (fw =3D=3D NULL) { dev_err(&spi->dev, "Cannot load firmware, aborting\n"); - return; + goto out; } =20 if (fw->size =3D=3D 0) { dev_err(&spi->dev, "Error: Firmware size is 0!\n"); - return; + goto out; } =20 /* Fill dummy data (24 stuffing bits for commands) */ @@ -108,7 +108,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) dev_err(&spi->dev, "Error: No supported FPGA detected (JEDEC_ID=3D%08x)!\n", jedec_id); - return; + goto out; } =20 dev_info(&spi->dev, "FPGA %s detected\n", ecp3_dev[i].name); @@ -121,7 +121,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) buffer =3D kzalloc(fw->size + 8, GFP_KERNEL); if (!buffer) { dev_err(&spi->dev, "Error: Can't allocate memory!\n"); - return; + goto out; } =20 /* @@ -160,7 +160,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) "Error: Timeout waiting for FPGA to clear (status=3D%08x)!\n", status); kfree(buffer); - return; + goto out; } =20 dev_info(&spi->dev, "Configuring the FPGA...\n"); @@ -186,7 +186,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) release_firmware(fw); =20 kfree(buffer); - +out: complete(&data->fw_loaded); } =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FD24C35274 for ; Mon, 24 Jan 2022 19:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351070AbiAXTZy (ORCPT ); Mon, 24 Jan 2022 14:25:54 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43012 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344204AbiAXTSD (ORCPT ); Mon, 24 Jan 2022 14:18:03 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A169BB8119D; Mon, 24 Jan 2022 19:18:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C47DDC340E5; Mon, 24 Jan 2022 19:17:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051879; bh=wNJQ1Il1mgRJmfGV4m1U3Mn/8rvUO5cjMqt67o9ex3M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rf1AAih5/uUNZqAE08GtnsSZpeDs/6a7oOem084WAcufKqHJ5QhPz9DX0GdU/d4G8 ffCaaGtYRk8ibSBKmC4B1j2f6vkUBdDEc/Z4hEfqpZ87M8d38AeNzVCJ72nBLuqTo3 evUoeeKGMXpkonnMBPeKSM9RZXMydNrmZPVOvqHk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , kernel test robot , Jonathan Cameron , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.19 117/239] mips: lantiq: add support for clk_set_parent() Date: Mon, 24 Jan 2022 19:42:35 +0100 Message-Id: <20220124183946.829927628@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 76f66dfd60dc5d2f9dec22d99091fea1035c5d03 ] Provide a simple implementation of clk_set_parent() in the lantiq subarch so that callers of it will build without errors. Fixes these build errors: ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] u= ndefined! ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] und= efined! Fixes: 171bb2f19ed6 ("MIPS: Lantiq: Add initial support for Lantiq SoCs") Signed-off-by: Randy Dunlap Reported-by: kernel test robot --to=3Dlinux-mips@vger.kernel.org --cc=3D"John Crispin " = --cc=3D"Jonathan Cameron " --cc=3D"Russell King " --cc=3D"Andy Shevchenko " --cc= =3Dalsa-devel@alsa-project.org --to=3D"Thomas Bogendoerfer " Reviewed-by: Jonathan Cameron Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/mips/lantiq/clk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c index a8e309dcd38d7..f5fab99d1751c 100644 --- a/arch/mips/lantiq/clk.c +++ b/arch/mips/lantiq/clk.c @@ -166,6 +166,12 @@ struct clk *clk_get_parent(struct clk *clk) } EXPORT_SYMBOL(clk_get_parent); =20 +int clk_set_parent(struct clk *clk, struct clk *parent) +{ + return 0; +} +EXPORT_SYMBOL(clk_set_parent); + static inline u32 get_counter_resolution(void) { u32 res; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90B34C4167B for ; Mon, 24 Jan 2022 21:28:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1452099AbiAXVYD (ORCPT ); Mon, 24 Jan 2022 16:24:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1443215AbiAXU4b (ORCPT ); Mon, 24 Jan 2022 15:56:31 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28A47C0D9431; Mon, 24 Jan 2022 11:18:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E55BAB8123D; Mon, 24 Jan 2022 19:18:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1B52C340E5; Mon, 24 Jan 2022 19:18:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051882; bh=TYR6G0G1NNZYgGiHfvo4P7O8iCjHHs0h9Uv+G6h0s/I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JDPGAkDSImTTwFUOZ4m02MmyNheI3dwy3yO6hGF15Kwcwjf9yFWO2f9VNTMfdfm3c 4TecFQFjVezSt4smLjhHWwiKNzyFiJOXym/6+4MaeYtmN97LQXd4gMi21s3aKTSqHE vJicPHssYQ6kf/xDjWGmZhwfupSettaK2DH/v3eA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Jonathan Cameron , Florian Fainelli , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.19 118/239] mips: bcm63xx: add support for clk_set_parent() Date: Mon, 24 Jan 2022 19:42:36 +0100 Message-Id: <20220124183946.860857778@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 6f03055d508ff4feb8db02ba3df9303a1db8d381 ] The MIPS BMC63XX subarch does not provide/support clk_set_parent(). This causes build errors in a few drivers, so add a simple implementation of that function so that callers of it will build without errors. Fixes these build errors: ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] u= ndefined! ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] und= efined! Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx f= amily of SOCs." ) Signed-off-by: Randy Dunlap Reviewed-by: Jonathan Cameron Acked-by: Florian Fainelli Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/mips/bcm63xx/clk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c index aba6e2d6a736c..dcfa0ea912fe1 100644 --- a/arch/mips/bcm63xx/clk.c +++ b/arch/mips/bcm63xx/clk.c @@ -387,6 +387,12 @@ struct clk *clk_get_parent(struct clk *clk) } EXPORT_SYMBOL(clk_get_parent); =20 +int clk_set_parent(struct clk *clk, struct clk *parent) +{ + return 0; +} +EXPORT_SYMBOL(clk_set_parent); + unsigned long clk_get_rate(struct clk *clk) { if (!clk) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B915AC433EF for ; Mon, 24 Jan 2022 21:37:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1455168AbiAXVex (ORCPT ); Mon, 24 Jan 2022 16:34:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45160 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348495AbiAXU5F (ORCPT ); Mon, 24 Jan 2022 15:57:05 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 78473C0D9433; Mon, 24 Jan 2022 11:18:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 158FD60909; Mon, 24 Jan 2022 19:18:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2532C340E5; Mon, 24 Jan 2022 19:18:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051885; bh=NGhZjXS4KdgHxuHTra3Zo18KP6/yuT5w/WsUHTf9LhQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nOExfnP9xjXB6Q9k/5oKpa/XT/RNn6jocwImqXaHA3CW6G/n+qqL9kJOFwrzCV3ML TIBhDwRO9o9HuAjQLeMMDiyDQN/6fwkdNq5Zc3IHPVX8g0+Meb3rcwDBY7qCOvVe4l JJdhqiwHQNpJ8dEbDvWkn/8ufpuazCeDKmMvyWc8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kamal Heib , Leon Romanovsky , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.19 119/239] RDMA/cxgb4: Set queue pair state when being queried Date: Mon, 24 Jan 2022 19:42:37 +0100 Message-Id: <20220124183946.890289842@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kamal Heib [ Upstream commit e375b9c92985e409c4bb95dd43d34915ea7f5e28 ] The API for ib_query_qp requires the driver to set cur_qp_state on return, add the missing set. Fixes: 67bbc05512d8 ("RDMA/cxgb4: Add query_qp support") Link: https://lore.kernel.org/r/20211220152530.60399-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/hw/cxgb4/qp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4= /qp.c index 20e3128f59b14..aa48627fc0bfa 100644 --- a/drivers/infiniband/hw/cxgb4/qp.c +++ b/drivers/infiniband/hw/cxgb4/qp.c @@ -2483,6 +2483,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp= _attr *attr, memset(attr, 0, sizeof *attr); memset(init_attr, 0, sizeof *init_attr); attr->qp_state =3D to_ib_qp_state(qhp->attr.state); + attr->cur_qp_state =3D to_ib_qp_state(qhp->attr.state); init_attr->cap.max_send_wr =3D qhp->attr.sq_num_entries; init_attr->cap.max_recv_wr =3D qhp->attr.rq_num_entries; init_attr->cap.max_send_sge =3D qhp->attr.sq_max_sges; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B84EAC4332F for ; Mon, 24 Jan 2022 19:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351091AbiAXTZz (ORCPT ); Mon, 24 Jan 2022 14:25:55 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47142 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229976AbiAXTSJ (ORCPT ); Mon, 24 Jan 2022 14:18:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 432C560909; Mon, 24 Jan 2022 19:18:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1590C340E5; Mon, 24 Jan 2022 19:18:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051888; bh=ri41GA+rvvOGALv/2S5SeTe6pJ0+n/UxBzOZzgqgoRs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XcmKYK8lWclGql16JYpctV2oRA20sRFqieLhlR0pPDi8xHX2FPLZ2cz81NIFVzmCW QSjJrxYKj72E7z+1qtlnNKc6wjkVUYxg1vc4FzDMk84skstxKAWy0KMpcp5mXU7KOI yDyaA7YyjYJx2H4EpWY22bBHgm0Tj1G6iziCC9A0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wei Yongjun , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.19 120/239] Bluetooth: Fix debugfs entry leak in hci_register_dev() Date: Mon, 24 Jan 2022 19:42:38 +0100 Message-Id: <20220124183946.921198853@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit 5a4bb6a8e981d3d0d492aa38412ee80b21033177 ] Fault injection test report debugfs entry leak as follows: debugfs: Directory 'hci0' with parent 'bluetooth' already present! When register_pm_notifier() failed in hci_register_dev(), the debugfs create by debugfs_create_dir() do not removed in the error handing path. Add the remove debugfs code to fix it. Signed-off-by: Wei Yongjun Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 26acacb2fa95f..a5755e0645439 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3263,6 +3263,7 @@ int hci_register_dev(struct hci_dev *hdev) return id; =20 err_wqueue: + debugfs_remove_recursive(hdev->debugfs); destroy_workqueue(hdev->workqueue); destroy_workqueue(hdev->req_workqueue); err: --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B57B1C43219 for ; Mon, 24 Jan 2022 19:28:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348174AbiAXT2F (ORCPT ); Mon, 24 Jan 2022 14:28:05 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43174 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346908AbiAXTSO (ORCPT ); Mon, 24 Jan 2022 14:18:14 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EE2FDB81239; Mon, 24 Jan 2022 19:18:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31119C340E5; Mon, 24 Jan 2022 19:18:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051891; bh=LPPlPD6ORgm9S9P5/5krIKf+1DfSqW/soWywH7Rs4lk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IDnwQuX1tPjDNwcQExFSpFh285XAwzIReErdZKnSQCRcxIBK5ojzX76Ez/Lk2uIIL iAlS6r2WNBbPN6ijHxXpm9KVAoxGnaNL2CPuj/0Ul1K0EvN5b2GCKWeeFDjbiKuJI7 AH2qG0tWvypT0yP8xD9guoQQL+NPeSLmGh8xm0lA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Aring , David Teigland , Sasha Levin Subject: [PATCH 4.19 121/239] fs: dlm: filter user dlm messages for kernel locks Date: Mon, 24 Jan 2022 19:42:39 +0100 Message-Id: <20220124183946.950983553@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Aring [ Upstream commit 6c2e3bf68f3e5e5a647aa52be246d5f552d7496d ] This patch fixes the following crash by receiving a invalid message: [ 160.672220] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 160.676206] BUG: KASAN: user-memory-access in dlm_user_add_ast+0xc3/0x370 [ 160.679659] Read of size 8 at addr 00000000deadbeef by task kworker/u32:= 13/319 [ 160.681447] [ 160.681824] CPU: 10 PID: 319 Comm: kworker/u32:13 Not tainted 5.14.0-rc2= + #399 [ 160.683472] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.14.0-1.module+el8= .6.0+12648+6ede71a5 04/01/2014 [ 160.685574] Workqueue: dlm_recv process_recv_sockets [ 160.686721] Call Trace: [ 160.687310] dump_stack_lvl+0x56/0x6f [ 160.688169] ? dlm_user_add_ast+0xc3/0x370 [ 160.689116] kasan_report.cold.14+0x116/0x11b [ 160.690138] ? dlm_user_add_ast+0xc3/0x370 [ 160.690832] dlm_user_add_ast+0xc3/0x370 [ 160.691502] _receive_unlock_reply+0x103/0x170 [ 160.692241] _receive_message+0x11df/0x1ec0 [ 160.692926] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 160.693700] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 160.694427] ? lock_acquire+0x175/0x400 [ 160.695058] ? do_purge.isra.51+0x200/0x200 [ 160.695744] ? lock_acquired+0x360/0x5d0 [ 160.696400] ? lock_contended+0x6a0/0x6a0 [ 160.697055] ? lock_release+0x21d/0x5e0 [ 160.697686] ? lock_is_held_type+0xe0/0x110 [ 160.698352] ? lock_is_held_type+0xe0/0x110 [ 160.699026] ? ___might_sleep+0x1cc/0x1e0 [ 160.699698] ? dlm_wait_requestqueue+0x94/0x140 [ 160.700451] ? dlm_process_requestqueue+0x240/0x240 [ 160.701249] ? down_write_killable+0x2b0/0x2b0 [ 160.701988] ? do_raw_spin_unlock+0xa2/0x130 [ 160.702690] dlm_receive_buffer+0x1a5/0x210 [ 160.703385] dlm_process_incoming_buffer+0x726/0x9f0 [ 160.704210] receive_from_sock+0x1c0/0x3b0 [ 160.704886] ? dlm_tcp_shutdown+0x30/0x30 [ 160.705561] ? lock_acquire+0x175/0x400 [ 160.706197] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 160.706941] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 160.707681] process_recv_sockets+0x32/0x40 [ 160.708366] process_one_work+0x55e/0xad0 [ 160.709045] ? pwq_dec_nr_in_flight+0x110/0x110 [ 160.709820] worker_thread+0x65/0x5e0 [ 160.710423] ? process_one_work+0xad0/0xad0 [ 160.711087] kthread+0x1ed/0x220 [ 160.711628] ? set_kthread_struct+0x80/0x80 [ 160.712314] ret_from_fork+0x22/0x30 The issue is that we received a DLM message for a user lock but the destination lock is a kernel lock. Note that the address which is trying to derefence is 00000000deadbeef, which is in a kernel lock lkb->lkb_astparam, this field should never be derefenced by the DLM kernel stack. In case of a user lock lkb->lkb_astparam is lkb->lkb_ua (memory is shared by a union field). The struct lkb_ua will be handled by the DLM kernel stack but on a kernel lock it will contain invalid data and ends in most likely crashing the kernel. It can be reproduced with two cluster nodes. node 2: dlm_tool join test echo "862 fooobaar 1 2 1" > /sys/kernel/debug/dlm/test_locks echo "862 3 1" > /sys/kernel/debug/dlm/test_waiters node 1: dlm_tool join test python: foo =3D DLM(h_cmd=3D3, o_nextcmd=3D1, h_nodeid=3D1, h_lockspace=3D0x7722202= 7, \ m_type=3D7, m_flags=3D0x1, m_remid=3D0x862, m_result=3D0xFFFEFFFE) newFile =3D open("/sys/kernel/debug/dlm/comms/2/rawmsg", "wb") newFile.write(bytes(foo)) Signed-off-by: Alexander Aring Signed-off-by: David Teigland Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/dlm/lock.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index a928ba008d7d7..26a4847efccca 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -3977,6 +3977,14 @@ static int validate_message(struct dlm_lkb *lkb, str= uct dlm_message *ms) int from =3D ms->m_header.h_nodeid; int error =3D 0; =20 + /* currently mixing of user/kernel locks are not supported */ + if (ms->m_flags & DLM_IFL_USER && ~lkb->lkb_flags & DLM_IFL_USER) { + log_error(lkb->lkb_resource->res_ls, + "got user dlm message for a kernel lock"); + error =3D -EINVAL; + goto out; + } + switch (ms->m_type) { case DLM_MSG_CONVERT: case DLM_MSG_UNLOCK: @@ -4005,6 +4013,7 @@ static int validate_message(struct dlm_lkb *lkb, stru= ct dlm_message *ms) error =3D -EINVAL; } =20 +out: if (error) log_error(lkb->lkb_resource->res_ls, "ignore invalid message %d from %d %x %x %x %d", --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 562A8C3526E for ; Mon, 24 Jan 2022 19:26:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351116AbiAXTZ7 (ORCPT ); Mon, 24 Jan 2022 14:25:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47230 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347277AbiAXTSP (ORCPT ); Mon, 24 Jan 2022 14:18:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 89763613EA; Mon, 24 Jan 2022 19:18:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A31DC340E5; Mon, 24 Jan 2022 19:18:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051895; bh=dR6pZiRW7TNa1iTDp9N7qtUKzFnTqgXitlsxGEtbyDs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AxcIcu9QQC8C2B/94eFLQrDz7gcFq/YvF5d+6orNW+veV+gXe4kFqNY659Obk+ojP 2kc6r6UVGRHYEfkl1uEJ90DpZvA3vcPGdEvRBR2qSNaNWxT3vd+X9/p2NVF85UJg6I XkxPsJSB4gNgaemq8kv9pn+1GduG7/PLQWVcezfA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.19 122/239] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply Date: Mon, 24 Jan 2022 19:42:40 +0100 Message-Id: <20220124183946.980614135@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit ae80b6033834342601e99f74f6a62ff5092b1cee ] Unexpected WDCMSG_TARGET_START replay can lead to null-ptr-deref when ar->tx_cmd->odata is NULL. The patch adds a null check to prevent such case. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] ar5523_cmd+0x46a/0x581 [ar5523] ar5523_probe.cold+0x1b7/0x18da [ar5523] ? ar5523_cmd_rx_cb+0x7a0/0x7a0 [ar5523] ? __pm_runtime_set_status+0x54a/0x8f0 ? _raw_spin_trylock_bh+0x120/0x120 ? pm_runtime_barrier+0x220/0x220 ? __pm_runtime_resume+0xb1/0xf0 usb_probe_interface+0x25b/0x710 really_probe+0x209/0x5d0 driver_probe_device+0xc6/0x1b0 device_driver_attach+0xe2/0x120 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the code (fourth byte in usb packet) to WDCMSG_TARGET_START, I got the null-ptr-deref bug. I believe the bug is triggerable whenever cmd->odata is NULL. After patching, I tested with the same input and no longer see the KASAN report. This was NOT tested on a real device. Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YXsmPQ3awHFLuAj2@10-18-43-117.dynapool.wire= less.nyu.edu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/ath/ar5523/ar5523.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireles= s/ath/ar5523/ar5523.c index 4c57e79e5779a..58e189ec672f9 100644 --- a/drivers/net/wireless/ath/ar5523/ar5523.c +++ b/drivers/net/wireless/ath/ar5523/ar5523.c @@ -153,6 +153,10 @@ static void ar5523_cmd_rx_cb(struct urb *urb) ar5523_err(ar, "Invalid reply to WDCMSG_TARGET_START"); return; } + if (!cmd->odata) { + ar5523_err(ar, "Unexpected WDCMSG_TARGET_START reply"); + return; + } memcpy(cmd->odata, hdr + 1, sizeof(u32)); cmd->olen =3D sizeof(u32); cmd->res =3D 0; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 618E9C4332F for ; Mon, 24 Jan 2022 21:27:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1451964AbiAXVXv (ORCPT ); Mon, 24 Jan 2022 16:23:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44592 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1443277AbiAXU4g (ORCPT ); Mon, 24 Jan 2022 15:56:36 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6C877C110F30; Mon, 24 Jan 2022 11:18:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 09FDF60BB9; Mon, 24 Jan 2022 19:18:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BE8CDC340E5; Mon, 24 Jan 2022 19:18:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051898; bh=42cKnB73ycwsYbytnMtn+m7ZqxOi3VaJu09BCcgAuRU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hNQZ5L8Cvab0bSwn2+4DzrZsgx/mzTkQghIvGsrGHSQ8Vgq1OUkGNe+Ht3ty6VVZ5 pxU8AjPennwDieHls7XwYGyWCEfLx+4a1PfU0FpPzX5PzNab2W9fQx44lJlZratNCZ 37KDbnX0bdJKsmMauFLWmTIBesDM/5Tcst0sls00= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Diego Viola , Ben Skeggs , Karol Herbst , Sasha Levin Subject: [PATCH 4.19 123/239] drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR Date: Mon, 24 Jan 2022 19:42:41 +0100 Message-Id: <20220124183947.011511046@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ben Skeggs [ Upstream commit 1d2271d2fb85e54bfc9630a6c30ac0feb9ffb983 ] There have been reports of the WFI timing out on some boards, and a patch was proposed to just remove it. This stuff is rather fragile, and I believe the WFI might be needed with our FW prior to GM200. However, we probably should not be touching PMU during init on GPUs where we depend on NVIDIA FW, outside of limited circumstances, so this should be a somewhat safer change that achieves the desired result. Reported-by: Diego Viola Signed-off-by: Ben Skeggs Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://gitlab.freedesktop.org/drm/nouveau/-/merge_requests/10 Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- .../gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 +++++++++++-------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c b/drivers/gpu/d= rm/nouveau/nvkm/subdev/pmu/base.c index ce70a193caa7f..8cf3d1b4662de 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c @@ -70,20 +70,13 @@ nvkm_pmu_fini(struct nvkm_subdev *subdev, bool suspend) return 0; } =20 -static int +static void nvkm_pmu_reset(struct nvkm_pmu *pmu) { struct nvkm_device *device =3D pmu->subdev.device; =20 if (!pmu->func->enabled(pmu)) - return 0; - - /* Inhibit interrupts, and wait for idle. */ - nvkm_wr32(device, 0x10a014, 0x0000ffff); - nvkm_msec(device, 2000, - if (!nvkm_rd32(device, 0x10a04c)) - break; - ); + return; =20 /* Reset. */ if (pmu->func->reset) @@ -94,25 +87,37 @@ nvkm_pmu_reset(struct nvkm_pmu *pmu) if (!(nvkm_rd32(device, 0x10a10c) & 0x00000006)) break; ); - - return 0; } =20 static int nvkm_pmu_preinit(struct nvkm_subdev *subdev) { struct nvkm_pmu *pmu =3D nvkm_pmu(subdev); - return nvkm_pmu_reset(pmu); + nvkm_pmu_reset(pmu); + return 0; } =20 static int nvkm_pmu_init(struct nvkm_subdev *subdev) { struct nvkm_pmu *pmu =3D nvkm_pmu(subdev); - int ret =3D nvkm_pmu_reset(pmu); - if (ret =3D=3D 0 && pmu->func->init) - ret =3D pmu->func->init(pmu); - return ret; + struct nvkm_device *device =3D pmu->subdev.device; + + if (!pmu->func->init) + return 0; + + if (pmu->func->enabled(pmu)) { + /* Inhibit interrupts, and wait for idle. */ + nvkm_wr32(device, 0x10a014, 0x0000ffff); + nvkm_msec(device, 2000, + if (!nvkm_rd32(device, 0x10a04c)) + break; + ); + + nvkm_pmu_reset(pmu); + } + + return pmu->func->init(pmu); } =20 static int --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 749E7C46467 for ; Mon, 24 Jan 2022 19:26:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351137AbiAXT0C (ORCPT ); Mon, 24 Jan 2022 14:26:02 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43284 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347027AbiAXTSY (ORCPT ); Mon, 24 Jan 2022 14:18:24 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C2E82B810BD; Mon, 24 Jan 2022 19:18:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED846C340E5; Mon, 24 Jan 2022 19:18:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051901; bh=+aGuwueJniqiioIn5b6jEmBIotGjO8kDhMbexpL+TjI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LKG5CevZBwwjQ/ySvay91VzDpfzS/Gh0/UnNvovFfP4NzKNKHp8Oo2G0ByKeLewwn Ej/qEPagEMi7VPTmmLj+jrQe1zpM/K8LsoKVnDFQCd9s5F2FZP5QZqrXjoGbWFfCfY mgfIF/NbOHNO6yDWg0cpWFeRWig9BD8juLSD/DO4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Keeping , Pavankumar Kondeti , Sasha Levin Subject: [PATCH 4.19 124/239] usb: gadget: f_fs: Use stream_open() for endpoint files Date: Mon, 24 Jan 2022 19:42:42 +0100 Message-Id: <20220124183947.047032517@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavankumar Kondeti [ Upstream commit c76ef96fc00eb398c8fc836b0eb2f82bcc619dc7 ] Function fs endpoint file operations are synchronized via an interruptible mutex wait. However we see threads that do ep file operations concurrently are getting blocked for the mutex lock in __fdget_pos(). This is an uninterruptible wait and we see hung task warnings and kernel panic if hung_task_panic systcl is enabled if host does not send/receive the data for long time. The reason for threads getting blocked in __fdget_pos() is due to the file position protection introduced by the commit 9c225f2655e3 ("vfs: atomic f_pos accesses as per POSIX"). Since function fs endpoint files does not have the notion of the file position, switch to the stream mode. This will bypass the file position mutex and threads will be blocked in interruptible state for the function fs mutex. It should not affects user space as we are only changing the task state changes the task state from UNINTERRUPTIBLE to INTERRUPTIBLE while waiting for the USB transfers to be finished. However there is a slight change to the O_NONBLOCK behavior. Earlier threads that are using O_NONBLOCK are also getting blocked inside fdget_pos(). Now they reach to function fs and error code is returned. The non blocking behavior is actually honoured now. Reviewed-by: John Keeping Signed-off-by: Pavankumar Kondeti Link: https://lore.kernel.org/r/1636712682-1226-1-git-send-email-quic_pkond= eti@quicinc.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/gadget/function/f_fs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/functi= on/f_fs.c index f070082124742..9271a7009a00f 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -607,7 +607,7 @@ static int ffs_ep0_open(struct inode *inode, struct fil= e *file) file->private_data =3D ffs; ffs_data_opened(ffs); =20 - return 0; + return stream_open(inode, file); } =20 static int ffs_ep0_release(struct inode *inode, struct file *file) @@ -1071,7 +1071,7 @@ ffs_epfile_open(struct inode *inode, struct file *fil= e) file->private_data =3D epfile; ffs_data_opened(epfile->ffs); =20 - return 0; + return stream_open(inode, file); } =20 static int ffs_aio_cancel(struct kiocb *kiocb) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D02A3C35275 for ; Mon, 24 Jan 2022 19:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351163AbiAXT0F (ORCPT ); Mon, 24 Jan 2022 14:26:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:45504 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347059AbiAXTS1 (ORCPT ); Mon, 24 Jan 2022 14:18:27 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 47D3B60B86; Mon, 24 Jan 2022 19:18:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 068B9C340E5; Mon, 24 Jan 2022 19:18:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051904; bh=RKOUeEIT2OTdH0HT/qTJnMAncQPd625vzYG4H7TFQig=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DypTFgbEOEEvnCyJF9lMuI+Rqbsyukzxsk89pnYegOkPRKbw5H1UdASnLt3HP5B0S uDwGhLDn0hQ1QJOwFt/kpbDZHezSLM7mNBpn6vqymiOXWGU6JGoWnv+kEesY5im+Am JKAqjQteXwBGQo43AQ663LV39Zl/f7xyWtN1iiNE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= , Jiri Kosina , Sasha Levin Subject: [PATCH 4.19 125/239] HID: apple: Do not reset quirks when the Fn key is not found Date: Mon, 24 Jan 2022 19:42:43 +0100 Message-Id: <20220124183947.086797520@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jos=C3=A9 Exp=C3=B3sito [ Upstream commit a5fe7864d8ada170f19cc47d176bf8260ffb4263 ] When a keyboard without a function key is detected, instead of removing all quirks, remove only the APPLE_HAS_FN quirk. Signed-off-by: Jos=C3=A9 Exp=C3=B3sito Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/hid-apple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c index 4e3dd3f55a963..80ecbf14d3c82 100644 --- a/drivers/hid/hid-apple.c +++ b/drivers/hid/hid-apple.c @@ -392,7 +392,7 @@ static int apple_input_configured(struct hid_device *hd= ev, =20 if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disab= ling Fn key handling\n"); - asc->quirks =3D 0; + asc->quirks &=3D ~APPLE_HAS_FN; } =20 return 0; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 92870C4707A for ; Mon, 24 Jan 2022 19:26:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351181AbiAXT0H (ORCPT ); Mon, 24 Jan 2022 14:26:07 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:43854 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344211AbiAXTSb (ORCPT ); Mon, 24 Jan 2022 14:18:31 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 86D8260BB9; Mon, 24 Jan 2022 19:18:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4FE49C340E5; Mon, 24 Jan 2022 19:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051910; bh=4I2F3w+qvMx8ERrKqBcHEf041oDFYR5vHFs3Gc44x9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OVr8cpuxMwaxKNjzIGsSf4vpWrxNXd6ijY42tptn7dLOJZ2xMY8WdnqM6lemygcdV yrcd6TYJsU7MGc3F8yPAUavbCRnjHYqNh0ftogy4U29Fbg60ZAXkkMHwtE3/O+/JBZ crJh9s8n3oTLDVQ5xiwa0zvR8tT53sIsF0cSje4Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 126/239] media: b2c2: Add missing check in flexcop_pci_isr: Date: Mon, 24 Jan 2022 19:42:44 +0100 Message-Id: <20220124183947.118696172@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit b13203032e679674c7c518f52a7ec0801ca3a829 ] A out-of-bounds bug can be triggered by an interrupt, the reason for this bug is the lack of checking of register values. In flexcop_pci_isr, the driver reads value from a register and uses it as a dma address. Finally, this address will be passed to the count parameter of find_next_packet. If this value is larger than the size of dma, the index of buffer will be out-of-bounds. Fix this by adding a check after reading the value of the register. The following KASAN report reveals it: BUG: KASAN: slab-out-of-bounds in find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] BUG: KASAN: slab-out-of-bounds in _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] BUG: KASAN: slab-out-of-bounds in dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 Read of size 1 at addr ffff8880608c00a0 by task swapper/2/0 CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xec/0x156 lib/dump_stack.c:118 print_address_description+0x78/0x290 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x25b/0x380 mm/kasan/report.c:412 __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:430 find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 flexcop_pass_dmx_data+0x2e/0x40 drivers/media/common/b2c2/flexcop.c:167 flexcop_pci_isr+0x3d1/0x5d0 drivers/media/pci/b2c2/flexcop-pci.c:212 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61 Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 62 2f 8c 48 89 e5 e8 fb 31 e8 f8 8b 05 75 4f 8e 03 85 c0 7e 07 0f 00 2d 8a 61 66 00 fb f4 <5d> c3 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde RAX: 0000000000000000 RBX: ffffffff8bde44c8 RCX: ffffffff88a11285 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2f6200 RBP: ffff88806b71fcc8 R08: fffffbfff185ec40 R09: fffffbfff185ec40 R10: 0000000000000001 R11: fffffbfff185ec40 R12: 0000000000000002 R13: ffffffff8be9d6e0 R14: 0000000000000000 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x6f/0x360 arch/x86/kernel/process.c:557 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Allocated by task 1: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2741 [inline] slab_alloc mm/slub.c:2749 [inline] kmem_cache_alloc+0xeb/0x280 mm/slub.c:2754 kmem_cache_zalloc include/linux/slab.h:699 [inline] __kernfs_new_node+0xe2/0x6f0 fs/kernfs/dir.c:633 kernfs_new_node+0x9a/0x120 fs/kernfs/dir.c:693 __kernfs_create_file+0x5f/0x340 fs/kernfs/file.c:992 sysfs_add_file_mode_ns+0x22a/0x4e0 fs/sysfs/file.c:306 create_files fs/sysfs/group.c:63 [inline] internal_create_group+0x34e/0xc30 fs/sysfs/group.c:147 sysfs_create_group fs/sysfs/group.c:173 [inline] sysfs_create_groups+0x9c/0x140 fs/sysfs/group.c:200 driver_add_groups+0x3e/0x50 drivers/base/driver.c:129 bus_add_driver+0x3a5/0x790 drivers/base/bus.c:684 driver_register+0x1cd/0x410 drivers/base/driver.c:170 __pci_register_driver+0x197/0x200 drivers/pci/pci-driver.c:1411 cx88_audio_pci_driver_init+0x23/0x25 drivers/media/pci/cx88/cx88-alsa.c: 1017 do_one_initcall+0xe0/0x610 init/main.c:884 do_initcall_level init/main.c:952 [inline] do_initcalls init/main.c:960 [inline] do_basic_setup init/main.c:978 [inline] kernel_init_freeable+0x4d0/0x592 init/main.c:1145 kernel_init+0x18/0x190 init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880608c0000 which belongs to the cache kernfs_node_cache of size 160 The buggy address is located 0 bytes to the right of 160-byte region [ffff8880608c0000, ffff8880608c00a0) The buggy address belongs to the page: page:ffffea0001823000 count:1 mapcount:0 mapping:ffff88806bed1e00 index:0x0 compound_mapcount: 0 flags: 0x100000000008100(slab|head) raw: 0100000000008100 dead000000000100 dead000000000200 ffff88806bed1e00 raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880608bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880608c0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880608c0080: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 ^ ffff8880608c0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880608c0180: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Link: https://lore.kernel.org/linux-media/1620723603-30912-1-git-send-email= -zheyuma97@gmail.com Reported-by: Zheyu Ma Signed-off-by: Zheyu Ma Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/pci/b2c2/flexcop-pci.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/= flexcop-pci.c index cc6527e355373..b7d8e34ffd5da 100644 --- a/drivers/media/pci/b2c2/flexcop-pci.c +++ b/drivers/media/pci/b2c2/flexcop-pci.c @@ -184,6 +184,8 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_i= d) dma_addr_t cur_addr =3D fc->read_ibi_reg(fc,dma1_008).dma_0x8.dma_cur_addr << 2; u32 cur_pos =3D cur_addr - fc_pci->dma[0].dma_addr0; + if (cur_pos > fc_pci->dma[0].size * 2) + goto error; =20 deb_irq("%u irq: %08x cur_addr: %llx: cur_pos: %08x, last_cur_pos: %08x = ", jiffies_to_usecs(jiffies - fc_pci->last_irq), @@ -224,6 +226,7 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_i= d) ret =3D IRQ_NONE; } =20 +error: spin_unlock_irqrestore(&fc_pci->irq_lock, flags); return ret; } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52A48C433FE for ; Mon, 24 Jan 2022 19:28:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348207AbiAXT2M (ORCPT ); Mon, 24 Jan 2022 14:28:12 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43438 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347567AbiAXTSh (ORCPT ); Mon, 24 Jan 2022 14:18:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5EB27B81235; Mon, 24 Jan 2022 19:18:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6DC20C340E5; Mon, 24 Jan 2022 19:18:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051914; bh=gFwZuW3NXLcLBklwYKoFtGkp+6a7uJzR9q7GsSnsAtk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eS3zvRGF60l7mHyEnKrwagv0qiv7N4zSp+kPVhF1KpKMM2uZ4phlR3x6mlW3jRiFq G7/xoNR1oTO5Mg8VowYHZsmjrfCyRCiH+lbnFXx6zSou+WcijZwiNpuUwz8K/Q1scW 9sNA1LgIx1VtWbhzZH4p9reIpcTRGp0TOZ2/dJ5Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Bulwahn , Arnd Bergmann , Shawn Guo , Sasha Levin Subject: [PATCH 4.19 127/239] ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART Date: Mon, 24 Jan 2022 19:42:45 +0100 Message-Id: <20220124183947.149798691@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Bulwahn [ Upstream commit b0100bce4ff82ec1ccd3c1f3d339fd2df6a81784 ] Since commit 4b563a066611 ("ARM: imx: Remove imx21 support"), the config DEBUG_IMX21_IMX27_UART is really only debug support for IMX27. So, rename this option to DEBUG_IMX27_UART and adjust dependencies in Kconfig and rename the definitions to IMX27 as further clean-up. This issue was discovered with ./scripts/checkkconfigsymbols.py, which reported that DEBUG_IMX21_IMX27_UART depends on the non-existing config SOC_IMX21. Signed-off-by: Lukas Bulwahn Reviewed-by: Arnd Bergmann Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/Kconfig.debug | 14 +++++++------- arch/arm/include/debug/imx-uart.h | 18 +++++++++--------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug index 01c760929c9e4..12a023c542e45 100644 --- a/arch/arm/Kconfig.debug +++ b/arch/arm/Kconfig.debug @@ -405,12 +405,12 @@ choice Say Y here if you want kernel low-level debugging support on i.MX25. =20 - config DEBUG_IMX21_IMX27_UART - bool "i.MX21 and i.MX27 Debug UART" - depends on SOC_IMX21 || SOC_IMX27 + config DEBUG_IMX27_UART + bool "i.MX27 Debug UART" + depends on SOC_IMX27 help Say Y here if you want kernel low-level debugging support - on i.MX21 or i.MX27. + on i.MX27. =20 config DEBUG_IMX28_UART bool "i.MX28 Debug UART" @@ -1454,7 +1454,7 @@ config DEBUG_IMX_UART_PORT int "i.MX Debug UART Port Selection" depends on DEBUG_IMX1_UART || \ DEBUG_IMX25_UART || \ - DEBUG_IMX21_IMX27_UART || \ + DEBUG_IMX27_UART || \ DEBUG_IMX31_UART || \ DEBUG_IMX35_UART || \ DEBUG_IMX50_UART || \ @@ -1507,12 +1507,12 @@ config DEBUG_LL_INCLUDE default "debug/icedcc.S" if DEBUG_ICEDCC default "debug/imx.S" if DEBUG_IMX1_UART || \ DEBUG_IMX25_UART || \ - DEBUG_IMX21_IMX27_UART || \ + DEBUG_IMX27_UART || \ DEBUG_IMX31_UART || \ DEBUG_IMX35_UART || \ DEBUG_IMX50_UART || \ DEBUG_IMX51_UART || \ - DEBUG_IMX53_UART ||\ + DEBUG_IMX53_UART || \ DEBUG_IMX6Q_UART || \ DEBUG_IMX6SL_UART || \ DEBUG_IMX6SX_UART || \ diff --git a/arch/arm/include/debug/imx-uart.h b/arch/arm/include/debug/imx= -uart.h index bce58e975ad1f..c750cc9876f6d 100644 --- a/arch/arm/include/debug/imx-uart.h +++ b/arch/arm/include/debug/imx-uart.h @@ -14,13 +14,6 @@ #define IMX1_UART_BASE_ADDR(n) IMX1_UART##n##_BASE_ADDR #define IMX1_UART_BASE(n) IMX1_UART_BASE_ADDR(n) =20 -#define IMX21_UART1_BASE_ADDR 0x1000a000 -#define IMX21_UART2_BASE_ADDR 0x1000b000 -#define IMX21_UART3_BASE_ADDR 0x1000c000 -#define IMX21_UART4_BASE_ADDR 0x1000d000 -#define IMX21_UART_BASE_ADDR(n) IMX21_UART##n##_BASE_ADDR -#define IMX21_UART_BASE(n) IMX21_UART_BASE_ADDR(n) - #define IMX25_UART1_BASE_ADDR 0x43f90000 #define IMX25_UART2_BASE_ADDR 0x43f94000 #define IMX25_UART3_BASE_ADDR 0x5000c000 @@ -29,6 +22,13 @@ #define IMX25_UART_BASE_ADDR(n) IMX25_UART##n##_BASE_ADDR #define IMX25_UART_BASE(n) IMX25_UART_BASE_ADDR(n) =20 +#define IMX27_UART1_BASE_ADDR 0x1000a000 +#define IMX27_UART2_BASE_ADDR 0x1000b000 +#define IMX27_UART3_BASE_ADDR 0x1000c000 +#define IMX27_UART4_BASE_ADDR 0x1000d000 +#define IMX27_UART_BASE_ADDR(n) IMX27_UART##n##_BASE_ADDR +#define IMX27_UART_BASE(n) IMX27_UART_BASE_ADDR(n) + #define IMX31_UART1_BASE_ADDR 0x43f90000 #define IMX31_UART2_BASE_ADDR 0x43f94000 #define IMX31_UART3_BASE_ADDR 0x5000c000 @@ -115,10 +115,10 @@ =20 #ifdef CONFIG_DEBUG_IMX1_UART #define UART_PADDR IMX_DEBUG_UART_BASE(IMX1) -#elif defined(CONFIG_DEBUG_IMX21_IMX27_UART) -#define UART_PADDR IMX_DEBUG_UART_BASE(IMX21) #elif defined(CONFIG_DEBUG_IMX25_UART) #define UART_PADDR IMX_DEBUG_UART_BASE(IMX25) +#elif defined(CONFIG_DEBUG_IMX27_UART) +#define UART_PADDR IMX_DEBUG_UART_BASE(IMX27) #elif defined(CONFIG_DEBUG_IMX31_UART) #define UART_PADDR IMX_DEBUG_UART_BASE(IMX31) #elif defined(CONFIG_DEBUG_IMX35_UART) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F55BC433FE for ; Mon, 24 Jan 2022 19:28:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348244AbiAXT2O (ORCPT ); Mon, 24 Jan 2022 14:28:14 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43482 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347169AbiAXTSm (ORCPT ); Mon, 24 Jan 2022 14:18:42 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8366FB811F9; Mon, 24 Jan 2022 19:18:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ABCE6C340E5; Mon, 24 Jan 2022 19:18:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051917; bh=teqJf60VfZfCyKR10hz8RbabCK/klAXvLnO3Vng0KDM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d8s/QQ9gpValdTBTlqYLQrdjYJdc/QtBplUDCzx+2ma0+P0HXDxbhEmvo7uvIvc1P hhWtvTCTLPQwXYGwLtMEMacZCjypecJ5wA73yqdGbi9Gif48CQpgtJvNooQQCZVPRk igzzB5/JuAh9tvM95MLt2Jx0E+fGqgq7Ag/rjBZM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biederman , Danielle Ratson , Ido Schimmel , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 128/239] mlxsw: pci: Add shutdown method in PCI driver Date: Mon, 24 Jan 2022 19:42:46 +0100 Message-Id: <20220124183947.181183438@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Danielle Ratson [ Upstream commit c1020d3cf4752f61a6a413f632ea2ce2370e150d ] On an arm64 platform with the Spectrum ASIC, after loading and executing a new kernel via kexec, the following trace [1] is observed. This seems to be caused by the fact that the device is not properly shutdown before executing the new kernel. Fix this by implementing a shutdown method which mirrors the remove method, as recommended by the kexec maintainer [2][3]. [1] BUG: Bad page state in process devlink pfn:22f73d page:fffffe00089dcf40 refcount:-1 mapcount:0 mapping:0000000000000000 index= :0x0 flags: 0x2ffff00000000000() raw: 2ffff00000000000 0000000000000000 ffffffff089d0201 0000000000000000 raw: 0000000000000000 0000000000000000 ffffffffffffffff 0000000000000000 page dumped because: nonzero _refcount Modules linked in: CPU: 1 PID: 16346 Comm: devlink Tainted: G B 5.8.0-rc6-custom-273020-gac6b3= 65b1bf5 #44 Hardware name: Marvell Armada 7040 TX4810M (DT) Call trace: dump_backtrace+0x0/0x1d0 show_stack+0x1c/0x28 dump_stack+0xbc/0x118 bad_page+0xcc/0xf8 check_free_page_bad+0x80/0x88 __free_pages_ok+0x3f8/0x418 __free_pages+0x38/0x60 kmem_freepages+0x200/0x2a8 slab_destroy+0x28/0x68 slabs_destroy+0x60/0x90 ___cache_free+0x1b4/0x358 kfree+0xc0/0x1d0 skb_free_head+0x2c/0x38 skb_release_data+0x110/0x1a0 skb_release_all+0x2c/0x38 consume_skb+0x38/0x130 __dev_kfree_skb_any+0x44/0x50 mlxsw_pci_rdq_fini+0x8c/0xb0 mlxsw_pci_queue_fini.isra.0+0x28/0x58 mlxsw_pci_queue_group_fini+0x58/0x88 mlxsw_pci_aqs_fini+0x2c/0x60 mlxsw_pci_fini+0x34/0x50 mlxsw_core_bus_device_unregister+0x104/0x1d0 mlxsw_devlink_core_bus_device_reload_down+0x2c/0x48 devlink_reload+0x44/0x158 devlink_nl_cmd_reload+0x270/0x290 genl_rcv_msg+0x188/0x2f0 netlink_rcv_skb+0x5c/0x118 genl_rcv+0x3c/0x50 netlink_unicast+0x1bc/0x278 netlink_sendmsg+0x194/0x390 __sys_sendto+0xe0/0x158 __arm64_sys_sendto+0x2c/0x38 el0_svc_common.constprop.0+0x70/0x168 do_el0_svc+0x28/0x88 el0_sync_handler+0x88/0x190 el0_sync+0x140/0x180 [2] https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1195432.html [3] https://patchwork.kernel.org/project/linux-scsi/patch/20170212214920.28866-= 1-anton@ozlabs.org/#20116693 Cc: Eric Biederman Signed-off-by: Danielle Ratson Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlxsw/pci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethern= et/mellanox/mlxsw/pci.c index a903e97793f9a..addd5765576d9 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/pci.c +++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c @@ -1825,6 +1825,7 @@ int mlxsw_pci_driver_register(struct pci_driver *pci_= driver) { pci_driver->probe =3D mlxsw_pci_probe; pci_driver->remove =3D mlxsw_pci_remove; + pci_driver->shutdown =3D mlxsw_pci_remove; return pci_register_driver(pci_driver); } EXPORT_SYMBOL(mlxsw_pci_driver_register); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 203C5C433FE for ; Mon, 24 Jan 2022 19:28:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348238AbiAXT2V (ORCPT ); Mon, 24 Jan 2022 14:28:21 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47602 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347744AbiAXTSm (ORCPT ); Mon, 24 Jan 2022 14:18:42 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E2D7F612A5; Mon, 24 Jan 2022 19:18:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF00FC340E5; Mon, 24 Jan 2022 19:18:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051920; bh=Ip5LnmXDb4tkMvfsIY1uAxTfOJtB/97a1bovNF5y6Yg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R0Ylf53CfrxC7lL323CnQwsGJstbu5KmOc6i6sFdV3+mDKgmfFYpPBR2Z0IQaBdlM xZ3d2GQxqN+X3v3olf3FqhemijQ3g9ocXhctHoUEKUOPKlk2WrDKA1fm/HFtWzL8q0 NOufRamOIF8nGw7vprMIKBOhMNrondWi2iKl4IVg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Martyn Welch , Peter Senna Tschudin , Martyn Welch , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Sasha Levin Subject: [PATCH 4.19 129/239] drm/bridge: megachips: Ensure both bridges are probed before registration Date: Mon, 24 Jan 2022 19:42:47 +0100 Message-Id: <20220124183947.211670242@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Martyn Welch [ Upstream commit 11632d4aa2b3f126790e81a4415d6c23103cf8bb ] In the configuration used by the b850v3, the STDP2690 is used to read EDID data whilst it's the STDP4028 which can detect when monitors are connected. This can result in problems at boot with monitors connected when the STDP4028 is probed first, a monitor is detected and an attempt is made to read the EDID data before the STDP2690 has probed: [ 3.795721] Unable to handle kernel NULL pointer dereference at virtual = address 00000018 [ 3.803845] pgd =3D (ptrval) [ 3.806581] [00000018] *pgd=3D00000000 [ 3.810180] Internal error: Oops: 5 [#1] SMP ARM [ 3.814813] Modules linked in: [ 3.817879] CPU: 0 PID: 64 Comm: kworker/u4:1 Not tainted 5.15.0 #1 [ 3.824161] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 3.830705] Workqueue: events_unbound deferred_probe_work_func [ 3.836565] PC is at stdp2690_get_edid+0x44/0x19c [ 3.841286] LR is at ge_b850v3_lvds_get_modes+0x2c/0x5c [ 3.846526] pc : [<805eae10>] lr : [<805eb138>] psr: 80000013 [ 3.852802] sp : 81c359d0 ip : 7dbb550b fp : 81c35a1c [ 3.858037] r10: 81c73840 r9 : 81c73894 r8 : 816d9800 [ 3.863270] r7 : 00000000 r6 : 81c34000 r5 : 00000000 r4 : 810c35f0 [ 3.869808] r3 : 80e3e294 r2 : 00000080 r1 : 00000cc0 r0 : 81401180 [ 3.876349] Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment= none [ 3.883499] Control: 10c5387d Table: 1000404a DAC: 00000051 [ 3.889254] Register r0 information: slab kmem_cache start 81401180 poin= ter offset 0 [ 3.897034] Register r1 information: non-paged memory [ 3.902097] Register r2 information: non-paged memory [ 3.907160] Register r3 information: non-slab/vmalloc memory [ 3.912832] Register r4 information: non-slab/vmalloc memory [ 3.918503] Register r5 information: NULL pointer [ 3.923217] Register r6 information: non-slab/vmalloc memory [ 3.928887] Register r7 information: NULL pointer [ 3.933601] Register r8 information: slab kmalloc-1k start 816d9800 poin= ter offset 0 size 1024 [ 3.942244] Register r9 information: slab kmalloc-2k start 81c73800 poin= ter offset 148 size 2048 [ 3.951058] Register r10 information: slab kmalloc-2k start 81c73800 poi= nter offset 64 size 2048 [ 3.959873] Register r11 information: non-slab/vmalloc memory [ 3.965632] Register r12 information: non-paged memory [ 3.970781] Process kworker/u4:1 (pid: 64, stack limit =3D 0x(ptrval)) [ 3.977148] Stack: (0x81c359d0 to 0x81c36000) [ 3.981517] 59c0: 80b2b668 80b2b5bc = 000002e2 0000034e [ 3.989712] 59e0: 81c35a8c 816d98e8 81c35a14 7dbb550b 805bfcd0 810c35f0 = 81c73840 824addc0 [ 3.997906] 5a00: 00001000 816d9800 81c73894 81c73840 81c35a34 81c35a20 = 805eb138 805eadd8 [ 4.006099] 5a20: 810c35f0 00000045 81c35adc 81c35a38 80594188 805eb118 = 80d7c788 80dd1848 [ 4.014292] 5a40: 00000000 81c35a50 80dca950 811194d3 80dca7c4 80dca944 = 80dca91c 816d9800 [ 4.022485] 5a60: 81c34000 81c760a8 816d9800 80c58c98 810c35f0 816d98e8 = 00001000 00001000 [ 4.030678] 5a80: 00000000 00000000 8017712c 81c60000 00000002 00000001 = 00000000 00000000 [ 4.038870] 5aa0: 816d9900 816d9900 00000000 7dbb550b 805c700c 00000008 = 826282c8 826282c8 [ 4.047062] 5ac0: 00001000 81e1ce40 00001000 00000002 81c35bf4 81c35ae0 = 805d9694 80593fc0 [ 4.055255] 5ae0: 8017a970 80179ad8 00000179 00000000 81c35bcc 81c35b00 = 80177108 8017a950 [ 4.063447] 5b00: 00000000 81c35b10 81c34000 00000000 81004fd8 81010a38 = 00000000 00000059 [ 4.071639] 5b20: 816d98d4 81fbb718 00000013 826282c8 8017a940 81c35b40 = 81134448 00000400 [ 4.079831] 5b40: 00000178 00000000 e063b9c1 00000000 c2000049 00000040 = 00000000 00000008 [ 4.088024] 5b60: 82628300 82628380 00000000 00000000 81c34000 00000000 = 81fbb700 82628340 [ 4.096216] 5b80: 826283c0 00001000 00000000 00000010 816d9800 826282c0 = 801766f8 00000000 [ 4.104408] 5ba0: 00000000 81004fd8 00000049 00000000 00000000 00000001 = 80dcf940 80178de4 [ 4.112601] 5bc0: 81c35c0c 7dbb550b 80178de4 81fbb700 00000010 00000010 = 810c35f4 81e1ce40 [ 4.120793] 5be0: 81c40908 0000000c 81c35c64 81c35bf8 805a7f18 805d94a0 = 81c35c3c 816d9800 [ 4.128985] 5c00: 00000010 81c34000 81c35c2c 81c35c18 8012fce0 805be90c = 81c35c3c 81c35c28 [ 4.137178] 5c20: 805be90c 80173210 81fbb600 81fbb6b4 81c35c5c 7dbb550b = 81c35c64 81fbb700 [ 4.145370] 5c40: 816d9800 00000010 810c35f4 81e1ce40 81c40908 0000000c = 81c35c84 81c35c68 [ 4.153565] 5c60: 805a8c78 805a7ed0 816d9800 81fbb700 00000010 00000000 = 81c35cac 81c35c88 [ 4.161758] 5c80: 805a8dc4 805a8b68 816d9800 00000000 816d9800 00000000 = 8179f810 810c42d0 [ 4.169950] 5ca0: 81c35ccc 81c35cb0 805e47b0 805a8d18 824aa240 81e1ea80 = 81c40908 81126b60 [ 4.178144] 5cc0: 81c35d14 81c35cd0 8060db1c 805e46cc 81c35d14 81c35ce0 = 80dd90f8 810c4d58 [ 4.186338] 5ce0: 80dd90dc 81fe9740 fffffffe 81fe9740 81e1ea80 00000000 = 810c4d6c 80c4b95c [ 4.194531] 5d00: 80dd9a3c 815c6810 81c35d34 81c35d18 8060dc9c 8060d8fc = 8246b440 815c6800 [ 4.202724] 5d20: 815c6810 eefd8e00 81c35d44 81c35d38 8060dd80 8060dbec = 81c35d6c 81c35d48 [ 4.210918] 5d40: 805e98a4 8060dd70 00000000 815c6810 810c45b0 81126e90 = 81126e90 80dd9a3c [ 4.219112] 5d60: 81c35d8c 81c35d70 80619574 805e9808 815c6810 00000000 = 810c45b0 81126e90 [ 4.227305] 5d80: 81c35db4 81c35d90 806168dc 80619514 80625df0 80623c80 = 815c6810 810c45b0 [ 4.235498] 5da0: 81c35e6c 815c6810 81c35dec 81c35db8 80616d04 80616800 = 81c35de4 81c35dc8 [ 4.243691] 5dc0: 808382b0 80b2f444 8116e310 8116e314 81c35e6c 815c6810 = 00000003 80dd9a3c [ 4.251884] 5de0: 81c35e14 81c35df0 80616ec8 80616c60 00000001 810c45b0 = 81c35e6c 815c6810 [ 4.260076] 5e00: 00000001 80dd9a3c 81c35e34 81c35e18 80617338 80616e90 = 00000000 81c35e6c [ 4.268269] 5e20: 80617284 81c34000 81c35e64 81c35e38 80614730 80617290 = 81c35e64 8171a06c [ 4.276461] 5e40: 81e220b8 7dbb550b 815c6810 81c34000 815c6854 81126e90 = 81c35e9c 81c35e68 [ 4.284654] 5e60: 8061673c 806146a8 8060f5e0 815c6810 00000001 7dbb550b = 00000000 810c5080 [ 4.292847] 5e80: 810c5320 815c6810 81126e90 00000000 81c35eac 81c35ea0 = 80617554 80616650 [ 4.301040] 5ea0: 81c35ecc 81c35eb0 80615694 80617544 810c5080 810c5080 = 810c5094 81126e90 [ 4.309233] 5ec0: 81c35efc 81c35ed0 80615c6c 8061560c 80615bc0 810c50c0 = 817eeb00 81412800 [ 4.317425] 5ee0: 814c3000 00000000 814c300d 81119a60 81c35f3c 81c35f00 = 80141488 80615bcc [ 4.325618] 5f00: 81c60000 81c34000 81c35f24 81c35f18 80143078 817eeb00 = 81412800 817eeb18 [ 4.333811] 5f20: 81412818 81003d00 00000088 81412800 81c35f74 81c35f40 = 80141a48 80141298 [ 4.342005] 5f40: 81c35f74 81c34000 801481ac 817efa40 817efc00 801417d8 = 817eeb00 00000000 [ 4.350199] 5f60: 815a7e7c 81c34000 81c35fac 81c35f78 80149b1c 801417e4 = 817efc20 817efc20 [ 4.358391] 5f80: ffffe000 817efa40 801499a8 00000000 00000000 00000000 = 00000000 00000000 [ 4.366583] 5fa0: 00000000 81c35fb0 80100130 801499b4 00000000 00000000 = 00000000 00000000 [ 4.374774] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 = 00000000 00000000 [ 4.382966] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 = 00000000 00000000 [ 4.391155] Backtrace: [ 4.393613] [<805eadcc>] (stdp2690_get_edid) from [<805eb138>] (ge_b850v= 3_lvds_get_modes+0x2c/0x5c) [ 4.402691] r10:81c73840 r9:81c73894 r8:816d9800 r7:00001000 r6:824addc= 0 r5:81c73840 [ 4.410534] r4:810c35f0 [ 4.413073] [<805eb10c>] (ge_b850v3_lvds_get_modes) from [<80594188>] (d= rm_helper_probe_single_connector_modes+0x1d4/0x84c) [ 4.424240] r5:00000045 r4:810c35f0 [ 4.427822] [<80593fb4>] (drm_helper_probe_single_connector_modes) from = [<805d9694>] (drm_client_modeset_probe+0x200/0x1384) [ 4.439074] r10:00000002 r9:00001000 r8:81e1ce40 r7:00001000 r6:826282c= 8 r5:826282c8 [ 4.446917] r4:00000008 [ 4.449455] [<805d9494>] (drm_client_modeset_probe) from [<805a7f18>] (_= _drm_fb_helper_initial_config_and_unlock+0x54/0x5b4) [ 4.460713] r10:0000000c r9:81c40908 r8:81e1ce40 r7:810c35f4 r6:0000001= 0 r5:00000010 [ 4.468556] r4:81fbb700 [ 4.471095] [<805a7ec4>] (__drm_fb_helper_initial_config_and_unlock) fro= m [<805a8c78>] (drm_fbdev_client_hotplug+0x11c/0x1b0) [ 4.482434] r10:0000000c r9:81c40908 r8:81e1ce40 r7:810c35f4 r6:0000001= 0 r5:816d9800 [ 4.490276] r4:81fbb700 [ 4.492814] [<805a8b5c>] (drm_fbdev_client_hotplug) from [<805a8dc4>] (d= rm_fbdev_generic_setup+0xb8/0x1a4) [ 4.502494] r7:00000000 r6:00000010 r5:81fbb700 r4:816d9800 [ 4.508160] [<805a8d0c>] (drm_fbdev_generic_setup) from [<805e47b0>] (im= x_drm_bind+0xf0/0x130) [ 4.516805] r7:810c42d0 r6:8179f810 r5:00000000 r4:816d9800 [ 4.522474] [<805e46c0>] (imx_drm_bind) from [<8060db1c>] (try_to_bring_= up_master+0x22c/0x2f0) [ 4.531116] r7:81126b60 r6:81c40908 r5:81e1ea80 r4:824aa240 [ 4.536783] [<8060d8f0>] (try_to_bring_up_master) from [<8060dc9c>] (__c= omponent_add+0xbc/0x184) [ 4.545597] r10:815c6810 r9:80dd9a3c r8:80c4b95c r7:810c4d6c r6:0000000= 0 r5:81e1ea80 [ 4.553440] r4:81fe9740 [ 4.555980] [<8060dbe0>] (__component_add) from [<8060dd80>] (component_= add+0x1c/0x20) [ 4.563921] r7:eefd8e00 r6:815c6810 r5:815c6800 r4:8246b440 [ 4.569589] [<8060dd64>] (component_add) from [<805e98a4>] (dw_hdmi_imx_= probe+0xa8/0xe8) [ 4.577702] [<805e97fc>] (dw_hdmi_imx_probe) from [<80619574>] (platform= _probe+0x6c/0xc8) [ 4.585908] r9:80dd9a3c r8:81126e90 r7:81126e90 r6:810c45b0 r5:815c6810= r4:00000000 [ 4.593662] [<80619508>] (platform_probe) from [<806168dc>] (really_prob= e+0xe8/0x460) [ 4.601524] r7:81126e90 r6:810c45b0 r5:00000000 r4:815c6810 [ 4.607191] [<806167f4>] (really_probe) from [<80616d04>] (__driver_prob= e_device+0xb0/0x230) [ 4.615658] r7:815c6810 r6:81c35e6c r5:810c45b0 r4:815c6810 [ 4.621326] [<80616c54>] (__driver_probe_device) from [<80616ec8>] (driv= er_probe_device+0x44/0xe0) [ 4.630313] r9:80dd9a3c r8:00000003 r7:815c6810 r6:81c35e6c r5:8116e314= r4:8116e310 [ 4.638068] [<80616e84>] (driver_probe_device) from [<80617338>] (__devi= ce_attach_driver+0xb4/0x12c) [ 4.647227] r9:80dd9a3c r8:00000001 r7:815c6810 r6:81c35e6c r5:810c45b0= r4:00000001 [ 4.654981] [<80617284>] (__device_attach_driver) from [<80614730>] (bus= _for_each_drv+0x94/0xd8) [ 4.663794] r7:81c34000 r6:80617284 r5:81c35e6c r4:00000000 [ 4.669461] [<8061469c>] (bus_for_each_drv) from [<8061673c>] (__device_= attach+0xf8/0x190) [ 4.677753] r7:81126e90 r6:815c6854 r5:81c34000 r4:815c6810 [ 4.683419] [<80616644>] (__device_attach) from [<80617554>] (device_ini= tial_probe+0x1c/0x20) [ 4.691971] r8:00000000 r7:81126e90 r6:815c6810 r5:810c5320 r4:810c5080 [ 4.698681] [<80617538>] (device_initial_probe) from [<80615694>] (bus_p= robe_device+0x94/0x9c) [ 4.707318] [<80615600>] (bus_probe_device) from [<80615c6c>] (deferred_= probe_work_func+0xac/0xf0) [ 4.716305] r7:81126e90 r6:810c5094 r5:810c5080 r4:810c5080 [ 4.721973] [<80615bc0>] (deferred_probe_work_func) from [<80141488>] (p= rocess_one_work+0x1fc/0x54c) [ 4.731139] r10:81119a60 r9:814c300d r8:00000000 r7:814c3000 r6:8141280= 0 r5:817eeb00 [ 4.738981] r4:810c50c0 r3:80615bc0 [ 4.742563] [<8014128c>] (process_one_work) from [<80141a48>] (worker_th= read+0x270/0x570) [ 4.750765] r10:81412800 r9:00000088 r8:81003d00 r7:81412818 r6:817eeb1= 8 r5:81412800 [ 4.758608] r4:817eeb00 [ 4.761147] [<801417d8>] (worker_thread) from [<80149b1c>] (kthread+0x17= 4/0x190) [ 4.768574] r10:81c34000 r9:815a7e7c r8:00000000 r7:817eeb00 r6:801417d= 8 r5:817efc00 [ 4.776417] r4:817efa40 [ 4.778955] [<801499a8>] (kthread) from [<80100130>] (ret_from_fork+0x14= /0x24) [ 4.786201] Exception stack(0x81c35fb0 to 0x81c35ff8) [ 4.791266] 5fa0: 00000000 00000000 = 00000000 00000000 [ 4.799459] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 = 00000000 00000000 [ 4.807651] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 4.814279] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:0000000= 0 r5:801499a8 [ 4.822120] r4:817efa40 [ 4.824664] Code: e3a02080 e593001c e3a01d33 e3a05000 (e5979018) Split the registration from the STDP4028 probe routine and only perform registration once both the STDP4028 and STDP2690 have probed. Signed-off-by: Martyn Welch CC: Peter Senna Tschudin CC: Martyn Welch CC: Neil Armstrong CC: Robert Foss CC: Laurent Pinchart CC: Jonas Karlman CC: Jernej Skrabec Signed-off-by: Robert Foss Link: https://patchwork.freedesktop.org/patch/msgid/43552c3404e8fdf92d8bc56= 58fac24e9f03c2c57.1637836606.git.martyn.welch@collabora.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- .../bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 40 +++++++++++++------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/dri= vers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c index dcf091f9d843f..a8d776edccc15 100644 --- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c @@ -302,19 +302,10 @@ out: mutex_unlock(&ge_b850v3_lvds_dev_mutex); } =20 -static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, - const struct i2c_device_id *id) +static int ge_b850v3_register(void) { + struct i2c_client *stdp4028_i2c =3D ge_b850v3_lvds_ptr->stdp4028_i2c; struct device *dev =3D &stdp4028_i2c->dev; - int ret; - - ret =3D ge_b850v3_lvds_init(dev); - - if (ret) - return ret; - - ge_b850v3_lvds_ptr->stdp4028_i2c =3D stdp4028_i2c; - i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr); =20 /* drm bridge initialization */ ge_b850v3_lvds_ptr->bridge.funcs =3D &ge_b850v3_lvds_funcs; @@ -336,6 +327,27 @@ static int stdp4028_ge_b850v3_fw_probe(struct i2c_clie= nt *stdp4028_i2c, "ge-b850v3-lvds-dp", ge_b850v3_lvds_ptr); } =20 +static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, + const struct i2c_device_id *id) +{ + struct device *dev =3D &stdp4028_i2c->dev; + int ret; + + ret =3D ge_b850v3_lvds_init(dev); + + if (ret) + return ret; + + ge_b850v3_lvds_ptr->stdp4028_i2c =3D stdp4028_i2c; + i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr); + + /* Only register after both bridges are probed */ + if (!ge_b850v3_lvds_ptr->stdp2690_i2c) + return 0; + + return ge_b850v3_register(); +} + static int stdp4028_ge_b850v3_fw_remove(struct i2c_client *stdp4028_i2c) { ge_b850v3_lvds_remove(); @@ -379,7 +391,11 @@ static int stdp2690_ge_b850v3_fw_probe(struct i2c_clie= nt *stdp2690_i2c, ge_b850v3_lvds_ptr->stdp2690_i2c =3D stdp2690_i2c; i2c_set_clientdata(stdp2690_i2c, ge_b850v3_lvds_ptr); =20 - return 0; + /* Only register after both bridges are probed */ + if (!ge_b850v3_lvds_ptr->stdp4028_i2c) + return 0; + + return ge_b850v3_register(); } =20 static int stdp2690_ge_b850v3_fw_remove(struct i2c_client *stdp2690_i2c) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F18AC4321E for ; Mon, 24 Jan 2022 21:28:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1451944AbiAXVXt (ORCPT ); Mon, 24 Jan 2022 16:23:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44572 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1443258AbiAXU4e (ORCPT ); Mon, 24 Jan 2022 15:56:34 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 272A6C07A94A; Mon, 24 Jan 2022 11:18:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E2D97B81238; Mon, 24 Jan 2022 19:18:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DB59CC340E5; Mon, 24 Jan 2022 19:18:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051923; bh=M4UE480JwyzeOBq6t7B72Ees1unLdZDrfoZ7S9bjVYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bdg/XbhFrMJFdewhn/BIPQ++Wng3kND2otsxRKLFG0uBj+jF9tYH72GMYrPB7zaCF P2rkpsjLHhyvkhLeZxivi/6XRhvFbU/T29fSJVn425QrUE0ZhtQ9JAXwA1vrmAcWFj 5rjaGW5q9M5Ak+NvpEBShmcG2tDMwcyadP5WXZG4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans de Goede , Andy Shevchenko , Sasha Levin Subject: [PATCH 4.19 130/239] gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use Date: Mon, 24 Jan 2022 19:42:48 +0100 Message-Id: <20220124183947.242153916@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hans de Goede [ Upstream commit bdfd6ab8fdccd8b138837efff66f4a1911496378 ] If the IRQ is already in use, then acpi_dev_gpio_irq_get_by() really should not change the type underneath the current owner. I specifically hit an issue with this an a Chuwi Hi8 Super (CWI509) Bay Trail tablet, when the Boot OS selection in the BIOS is set to Android. In this case _STA for a MAX17047 ACPI I2C device wrongly returns 0xf and the _CRS resources for this device include a GpioInt pointing to a GPIO already in use by an _AEI handler, with a different type then specified in the _CRS for the MAX17047 device. Leading to the acpi_dev_gpio_irq_get() call done by the i2c-core-acpi.c code changing the type breaking the _AEI handler. Now this clearly is a bug in the DSDT of this tablet (in Android mode), but in general calling irq_set_irq_type() on an IRQ which already is in use seems like a bad idea. Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpio/gpiolib-acpi.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c index b018909a4e46c..47cdc1f89e3fb 100644 --- a/drivers/gpio/gpiolib-acpi.c +++ b/drivers/gpio/gpiolib-acpi.c @@ -904,10 +904,17 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, i= nt index) irq_flags =3D acpi_dev_get_irq_type(info.triggering, info.polarity); =20 - /* Set type if specified and different than the current one */ - if (irq_flags !=3D IRQ_TYPE_NONE && - irq_flags !=3D irq_get_trigger_type(irq)) - irq_set_irq_type(irq, irq_flags); + /* + * If the IRQ is not already in use then set type + * if specified and different than the current one. + */ + if (can_request_irq(irq, irq_flags)) { + if (irq_flags !=3D IRQ_TYPE_NONE && + irq_flags !=3D irq_get_trigger_type(irq)) + irq_set_irq_type(irq, irq_flags); + } else { + dev_dbg(&adev->dev, "IRQ %d already in use\n", irq); + } =20 return irq; } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C244DC433F5 for ; Mon, 24 Jan 2022 19:27:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347058AbiAXT10 (ORCPT ); Mon, 24 Jan 2022 14:27:26 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43606 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347155AbiAXTSt (ORCPT ); Mon, 24 Jan 2022 14:18:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4BBDDB8121F; Mon, 24 Jan 2022 19:18:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6F7A6C340E5; Mon, 24 Jan 2022 19:18:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051927; bh=5AK/ZD+OO4TiPDAZvOFjQFvLrOlNWLTVM/ikSQ8BP24=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W3/8hExv6fh0vWAT6WVi97xrVzev4OR5s5EP4u2PliM/VQyMOcOgpLiiuo8hLTU6t PSnx1hPt4YOf950faLmg/BCFE9bPIsGux8Tshh07zriE5m1tIuktvTPSfvz/KrcRTp DcVmi8IxTM2/VT6UPH+OTIokCHgUJvyyBIRGWbd8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Sebastian Reichel , Sasha Levin Subject: [PATCH 4.19 131/239] HSI: core: Fix return freed object in hsi_new_client Date: Mon, 24 Jan 2022 19:42:49 +0100 Message-Id: <20220124183947.273001947@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye [ Upstream commit a1ee1c08fcd5af03187dcd41dcab12fd5b379555 ] cl is freed on error of calling device_register, but this object is return later, which will cause uaf issue. Fix it by return NULL on error. Signed-off-by: Chengfeng Ye Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hsi/hsi_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c index 71895da63810b..daf2de837a30a 100644 --- a/drivers/hsi/hsi_core.c +++ b/drivers/hsi/hsi_core.c @@ -115,6 +115,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port, if (device_register(&cl->device) < 0) { pr_err("hsi: failed to register client: %s\n", info->name); put_device(&cl->device); + goto err; } =20 return cl; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 077A0C47080 for ; Mon, 24 Jan 2022 19:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351226AbiAXT0N (ORCPT ); Mon, 24 Jan 2022 14:26:13 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47732 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347286AbiAXTSx (ORCPT ); Mon, 24 Jan 2022 14:18:53 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BE5A1613FB; Mon, 24 Jan 2022 19:18:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 92DD8C340E5; Mon, 24 Jan 2022 19:18:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051930; bh=6Byzn/6VorrS7Ix6QruNYbVAGyhknKS2Ab5K3vt0LHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kbZJbPnL7tzJgTUoM/OvbhILVbs6emz2fhNa1MQ4uhr+hh2o/HW6ZI4UWNlrCriVZ buKKjYeuZkcbxk8FUXrVoCUXriKt13olv+MkILeFVR+58is2AP+nXK4fjM+Siml4+o Ve84fHn4+7HycdzaTkxpUqgcqB2k+WQk3gUq7sbw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brendan Dolan-Gavitt , Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.19 132/239] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() Date: Mon, 24 Jan 2022 19:42:50 +0100 Message-Id: <20220124183947.305595733@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit 04d80663f67ccef893061b49ec8a42ff7045ae84 ] Currently, with an unknown recv_type, mwifiex_usb_recv just return -1 without restoring the skb. Next time mwifiex_usb_rx_complete is invoked with the same skb, calling skb_put causes skb_over_panic. The bug is triggerable with a compromised/malfunctioning usb device. After applying the patch, skb_over_panic no longer shows up with the same input. Attached is the panic report from fuzzing. skbuff: skb_over_panic: text:000000003bf1b5fa len:2048 put:4 head:00000000dd6a115b data:000000000a9445d8 tail:0x844 end:0x840 dev: kernel BUG at net/core/skbuff.c:109! invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 PID: 198 Comm: in:imklog Not tainted 5.6.0 #60 RIP: 0010:skb_panic+0x15f/0x161 Call Trace: ? mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] skb_put.cold+0x24/0x24 mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 Reported-by: Brendan Dolan-Gavitt Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.= home Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/marvell/mwifiex/usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wirel= ess/marvell/mwifiex/usb.c index e6234b53a5ca2..90490d2c6d177 100644 --- a/drivers/net/wireless/marvell/mwifiex/usb.c +++ b/drivers/net/wireless/marvell/mwifiex/usb.c @@ -130,7 +130,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *ada= pter, default: mwifiex_dbg(adapter, ERROR, "unknown recv_type %#x\n", recv_type); - return -1; + ret =3D -1; + goto exit_restore_skb; } break; case MWIFIEX_USB_EP_DATA: --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5C5AAC433EF for ; Mon, 24 Jan 2022 19:26:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351262AbiAXT0P (ORCPT ); Mon, 24 Jan 2022 14:26:15 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43682 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347324AbiAXTS4 (ORCPT ); Mon, 24 Jan 2022 14:18:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 97FA2B81238; Mon, 24 Jan 2022 19:18:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB02DC340E5; Mon, 24 Jan 2022 19:18:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051933; bh=yASnKoJ36bqi+XEUG0nb+NCnUaJoGBfW7yEqt+nlY9c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IYrSKzXh+sKLkno7vv7GXMHmebHEgH4EHIbeM0AVDbsXkfOiE4pF0lteyaZfy9obx 4kLxnC1sFomiRJsyD7gKaFI0UauQ9gzZWGfZWJjg/M9ojI6r1C0VQq2lyfMrrbFA7E W4mxK9XAh+T8aBS0IEnzFnqq97YFraQ5x26m+paU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brendan Dolan-Gavitt , Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.19 133/239] rsi: Fix out-of-bounds read in rsi_read_pkt() Date: Mon, 24 Jan 2022 19:42:51 +0100 Message-Id: <20220124183947.339549577@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit f1cb3476e48b60c450ec3a1d7da0805bffc6e43a ] rsi_get_* functions rely on an offset variable from usb input. The size of usb input is RSI_MAX_RX_USB_PKT_SIZE(3000), while 2-byte offset can be up to 0xFFFF. Thus a large offset can cause out-of-bounds read. The patch adds a bound checking condition when rcv_pkt_len is 0, indicating it's USB. It's unclear whether this is triggerable from other type of bus. The following check might help in that case. offset > rcv_pkt_len - FRAME_DESC_SZ The bug is trigerrable with conpromised/malfunctioning USB devices. I tested the patch with the crashing input and got no more bug report. Attached is the KASAN report from fuzzing. BUG: KASAN: slab-out-of-bounds in rsi_read_pkt+0x42e/0x500 [rsi_91x] Read of size 2 at addr ffff888019439fdb by task RX-Thread/227 CPU: 0 PID: 227 Comm: RX-Thread Not tainted 5.6.0 #66 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? rsi_read_pkt+0x42e/0x500 [rsi_91x] ? rsi_read_pkt+0x42e/0x500 [rsi_91x] __kasan_report.cold+0x37/0x7c ? rsi_read_pkt+0x42e/0x500 [rsi_91x] kasan_report+0xe/0x20 rsi_read_pkt+0x42e/0x500 [rsi_91x] rsi_usb_rx_thread+0x1b1/0x2fc [rsi_usb] ? rsi_probe+0x16a0/0x16a0 [rsi_usb] ? _raw_spin_lock_irqsave+0x7b/0xd0 ? _raw_spin_trylock_bh+0x120/0x120 ? __wake_up_common+0x10b/0x520 ? rsi_probe+0x16a0/0x16a0 [rsi_usb] kthread+0x2b5/0x3b0 ? kthread_create_on_node+0xd0/0xd0 ret_from_fork+0x22/0x40 Reported-by: Brendan Dolan-Gavitt Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YXxXS4wgu2OsmlVv@10-18-43-117.dynapool.wire= less.nyu.edu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/rsi/rsi_91x_main.c | 4 ++++ drivers/net/wireless/rsi/rsi_91x_usb.c | 1 - drivers/net/wireless/rsi/rsi_usb.h | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless= /rsi/rsi_91x_main.c index d90d8ab56fa28..c6f5c46cc88e7 100644 --- a/drivers/net/wireless/rsi/rsi_91x_main.c +++ b/drivers/net/wireless/rsi/rsi_91x_main.c @@ -23,6 +23,7 @@ #include "rsi_common.h" #include "rsi_coex.h" #include "rsi_hal.h" +#include "rsi_usb.h" =20 u32 rsi_zone_enabled =3D /* INFO_ZONE | INIT_ZONE | @@ -173,6 +174,9 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt,= s32 rcv_pkt_len) frame_desc =3D &rx_pkt[index]; actual_length =3D *(u16 *)&frame_desc[0]; offset =3D *(u16 *)&frame_desc[2]; + if (!rcv_pkt_len && offset > + RSI_MAX_RX_USB_PKT_SIZE - FRAME_DESC_SZ) + goto fail; =20 queueno =3D rsi_get_queueno(frame_desc, offset); length =3D rsi_get_length(frame_desc, offset); diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/= rsi/rsi_91x_usb.c index 984f99ad40960..da09e130710e0 100644 --- a/drivers/net/wireless/rsi/rsi_91x_usb.c +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c @@ -312,7 +312,6 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8= ep_num, gfp_t mem_flags) struct sk_buff *skb; u8 dword_align_bytes =3D 0; =20 -#define RSI_MAX_RX_USB_PKT_SIZE 3000 skb =3D dev_alloc_skb(RSI_MAX_RX_USB_PKT_SIZE); if (!skb) return -ENOMEM; diff --git a/drivers/net/wireless/rsi/rsi_usb.h b/drivers/net/wireless/rsi/= rsi_usb.h index 5b2eddd1a2ee5..3d3d2643088d0 100644 --- a/drivers/net/wireless/rsi/rsi_usb.h +++ b/drivers/net/wireless/rsi/rsi_usb.h @@ -43,6 +43,8 @@ #define RSI_USB_BUF_SIZE 4096 #define RSI_USB_CTRL_BUF_SIZE 0x04 =20 +#define RSI_MAX_RX_USB_PKT_SIZE 3000 + struct rx_usb_ctrl_block { u8 *data; struct urb *rx_urb; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24D11C433FE for ; Mon, 24 Jan 2022 19:26:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351246AbiAXT0O (ORCPT ); Mon, 24 Jan 2022 14:26:14 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47850 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347361AbiAXTS5 (ORCPT ); Mon, 24 Jan 2022 14:18:57 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 01C146135E; Mon, 24 Jan 2022 19:18:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D605DC340E5; Mon, 24 Jan 2022 19:18:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051936; bh=0LzPtP+1imS3yKjOyhidBSJgXssfUSqeD1/ITevQIJ4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ECo2+pwpNt0BDCJHh9nGJ27jnYSAzcS+jQOZ/6uMS2zHTIS47+w3NLtUy6yYY4Nb4 GQuQehss9A6EC4S6LCSGOCNoN5vJkZnDgj0BWwonagHRX73ZC6lZvaXzjOm6k20Ugx AOitDdK/Jy+dZ+JpVoACXCmOdFOo7G8Tqu5rVs4U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Neal Liu , Sasha Levin Subject: [PATCH 4.19 134/239] usb: uhci: add aspeed ast2600 uhci support Date: Mon, 24 Jan 2022 19:42:52 +0100 Message-Id: <20220124183947.370932685@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Neal Liu [ Upstream commit 554abfe2eadec97d12c71d4a69da1518478f69eb ] Enable ast2600 uhci quirks. Signed-off-by: Neal Liu Link: https://lore.kernel.org/r/20211126100021.2331024-1-neal_liu@aspeedtec= h.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/host/uhci-platform.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/uhci-platform.c b/drivers/usb/host/uhci-platf= orm.c index 89700e26fb296..813ff3660e9f1 100644 --- a/drivers/usb/host/uhci-platform.c +++ b/drivers/usb/host/uhci-platform.c @@ -113,7 +113,8 @@ static int uhci_hcd_platform_probe(struct platform_devi= ce *pdev) num_ports); } if (of_device_is_compatible(np, "aspeed,ast2400-uhci") || - of_device_is_compatible(np, "aspeed,ast2500-uhci")) { + of_device_is_compatible(np, "aspeed,ast2500-uhci") || + of_device_is_compatible(np, "aspeed,ast2600-uhci")) { uhci->is_aspeed =3D 1; dev_info(&pdev->dev, "Enabled Aspeed implementation workarounds\n"); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9B71C433EF for ; Mon, 24 Jan 2022 19:28:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351693AbiAXT2d (ORCPT ); Mon, 24 Jan 2022 14:28:33 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:41852 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348563AbiAXTTD (ORCPT ); Mon, 24 Jan 2022 14:19:03 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CF6E6B8122A; Mon, 24 Jan 2022 19:19:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E872FC340E5; Mon, 24 Jan 2022 19:18:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051939; bh=a1ol1Ld7y3ive1VbszzAmoNm60fUPuoWYybtgCS6bXA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0KCVignwWe7bwPs1zQAoq+e8hRFZzHfNcDKr9XKx4V6N5hcCNFJC+opNECd6tLaGB +9G78X1Nd5YyZuqn3mQEqn7HJqz3ZuefCg9E1WbdpzBkCw9FZY4htZ/hxg36G7P2s3 orpoMY2kwid90MTDItcJJdNf7UWlFgeISqVYAV/o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com, Xiongwei Song , Denis Efremov , Jens Axboe , Sasha Levin Subject: [PATCH 4.19 135/239] floppy: Add max size check for user space request Date: Mon, 24 Jan 2022 19:42:53 +0100 Message-Id: <20220124183947.403685809@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiongwei Song [ Upstream commit 545a32498c536ee152331cd2e7d2416aa0f20e01 ] We need to check the max request size that is from user space before allocating pages. If the request size exceeds the limit, return -EINVAL. This check can avoid the warning below from page allocator. WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 current_gfp_context incl= ude/linux/sched/mm.h:195 [inline] WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 __alloc_pages+0x45d/0x50= 0 mm/page_alloc.c:5356 Modules linked in: CPU: 3 PID: 16525 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:__alloc_pages+0x45d/0x500 mm/page_alloc.c:5344 Code: be c9 00 00 00 48 c7 c7 20 4a 97 89 c6 05 62 32 a7 0b 01 e8 74 9a 42 = 07 e9 6a ff ff ff 0f 0b e9 a0 fd ff ff 40 80 e5 3f eb 88 <0f> 0b e9 18 ff f= f ff 4c 89 ef 44 89 e6 45 31 ed e8 1e 76 ff ff e9 RSP: 0018:ffffc90023b87850 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff92004770f0b RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000033 RDI: 0000000000010cc1 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff81bb4686 R11: 0000000000000001 R12: ffffffff902c1960 R13: 0000000000000033 R14: 0000000000000000 R15: ffff88804cf64a30 FS: 0000000000000000(0000) GS:ffff88802cd00000(0063) knlGS:00000000f44b4b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002c921000 CR3: 000000004f507000 CR4: 0000000000150ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 __get_free_pages+0x8/0x40 mm/page_alloc.c:5418 raw_cmd_copyin drivers/block/floppy.c:3113 [inline] raw_cmd_ioctl drivers/block/floppy.c:3160 [inline] fd_locked_ioctl+0x12e5/0x2820 drivers/block/floppy.c:3528 fd_ioctl drivers/block/floppy.c:3555 [inline] fd_compat_ioctl+0x891/0x1b60 drivers/block/floppy.c:3869 compat_blkdev_ioctl+0x3b8/0x810 block/ioctl.c:662 __do_compat_sys_ioctl+0x1c7/0x290 fs/ioctl.c:972 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Reported-by: syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211116131033.27685-1-sxwjean@me.com Signed-off-by: Xiongwei Song Signed-off-by: Denis Efremov Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/block/floppy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 49ac9596c862e..e6e95e67c40ee 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -3123,6 +3123,8 @@ static void raw_cmd_free(struct floppy_raw_cmd **ptr) } } =20 +#define MAX_LEN (1UL << MAX_ORDER << PAGE_SHIFT) + static int raw_cmd_copyin(int cmd, void __user *param, struct floppy_raw_cmd **rcmd) { @@ -3160,7 +3162,7 @@ loop: ptr->resultcode =3D 0; =20 if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) { - if (ptr->length <=3D 0) + if (ptr->length <=3D 0 || ptr->length >=3D MAX_LEN) return -EINVAL; ptr->kernel_data =3D (char *)fd_dma_mem_alloc(ptr->length); fallback_on_nodma_alloc(&ptr->kernel_data, ptr->length); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB7B9C41535 for ; Mon, 24 Jan 2022 19:50:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357562AbiAXTuQ (ORCPT ); Mon, 24 Jan 2022 14:50:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355107AbiAXTkB (ORCPT ); Mon, 24 Jan 2022 14:40:01 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C6757C0612A7; Mon, 24 Jan 2022 11:19:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 27D7B6140C; Mon, 24 Jan 2022 19:19:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08E82C340E5; Mon, 24 Jan 2022 19:19:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051945; bh=Bom9tySjE4yaK810prdtgeNbiLhRB7EH8JZuDDgOKlw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g/kVjTXH2rafPEQZfR3zzeTb5hYDO4VE2KWkoUX3DOAQPhfI3SmGJTRAvpvv0+Rt5 6loDxp33ksEoJpnfafKTcb8ZVWmhUxtm9hbkmTdyms9uCv4awAiu9jNsWRlbqjfE+7 8mZBAAKmv2SbuDvQK7+ellsnFaMZRwkFOB2GAfXQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, James Hilliard , Laurent Pinchart , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 136/239] media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. Date: Mon, 24 Jan 2022 19:42:54 +0100 Message-Id: <20220124183947.436079457@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: James Hilliard [ Upstream commit c8ed7d2f614cd8b315981d116c7a2fb01829500d ] Some uvc devices appear to require the maximum allowed USB timeout for GET_CUR/SET_CUR requests. So lets just bump the UVC control timeout to 5 seconds which is the same as the usb ctrl get/set defaults: USB_CTRL_GET_TIMEOUT 5000 USB_CTRL_SET_TIMEOUT 5000 It fixes the following runtime warnings: Failed to query (GET_CUR) UVC control 11 on unit 2: -110 (exp. 1). Failed to query (SET_CUR) UVC control 3 on unit 2: -110 (exp. 2). Signed-off-by: James Hilliard Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/uvc/uvcvideo.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvi= deo.h index a738486fd9d64..839ba3cc53119 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -176,7 +176,7 @@ /* Maximum status buffer size in bytes of interrupt URB. */ #define UVC_MAX_STATUS_SIZE 16 =20 -#define UVC_CTRL_CONTROL_TIMEOUT 500 +#define UVC_CTRL_CONTROL_TIMEOUT 5000 #define UVC_CTRL_STREAMING_TIMEOUT 5000 =20 /* Maximum allowed number of control mappings per device */ --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42226C35276 for ; Mon, 24 Jan 2022 19:26:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344398AbiAXT02 (ORCPT ); Mon, 24 Jan 2022 14:26:28 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48064 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239985AbiAXTTJ (ORCPT ); Mon, 24 Jan 2022 14:19:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2B78460917; Mon, 24 Jan 2022 19:19:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09AFFC340E5; Mon, 24 Jan 2022 19:19:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051948; bh=IgOmWKurGb8OpPoy0PJCtd1kBOIPTV6l0o9s3riMki8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ksMb4RCjVlsWcfBo5Nr+hlR6MD1l1o7dSkYs3gIitFus30F5bOntVTotp2cPWQYL7 Zart6df94NDSEXnB5txm+pxOihjKM0DvNPVjjT8o1ypcMNT/gQkDsPYMNHCBkWkdgb prrf+0JeBigYg9h+Sw1pKjZkOlu0PJFvQ05Le4XI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 137/239] media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() Date: Mon, 24 Jan 2022 19:42:55 +0100 Message-Id: <20220124183947.466527591@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 348df8035301dd212e3cc2860efe4c86cb0d3303 ] In hexium_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. In hexium_detach(), saa7146_vv_release() will be called and there is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init() according to the following logic. Both hexium_attach() and hexium_detach() are callback functions of the variable 'extension', so there exists a possible call chain directly from hexium_attach() to hexium_detach(): hexium_attach(dev, info) -- fail to alloc memory to dev->vv_data | in saa7146_vv_init(). | | hexium_detach() -- a dereference of dev->vv_data in saa7146_vv_release() Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_HEXIUM_ORION=3Dm show no new warnings, and our static analyzer no longer warns about this code. Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/pci/saa7146/hexium_orion.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/pci/saa7146/hexium_orion.c b/drivers/media/pci/s= aa7146/hexium_orion.c index a794f9e5f9908..b88aa1feb7df2 100644 --- a/drivers/media/pci/saa7146/hexium_orion.c +++ b/drivers/media/pci/saa7146/hexium_orion.c @@ -367,10 +367,16 @@ static struct saa7146_ext_vv vv_data; static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_exten= sion_data *info) { struct hexium *hexium =3D (struct hexium *) dev->ext_priv; + int ret; =20 DEB_EE("\n"); =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + pr_err("Error in saa7146_vv_init()\n"); + return ret; + } + vv_data.vid_ops.vidioc_enum_input =3D vidioc_enum_input; vv_data.vid_ops.vidioc_g_input =3D vidioc_g_input; vv_data.vid_ops.vidioc_s_input =3D vidioc_s_input; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3F1AC433F5 for ; Mon, 24 Jan 2022 19:28:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348298AbiAXT2X (ORCPT ); Mon, 24 Jan 2022 14:28:23 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:42402 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348625AbiAXTTN (ORCPT ); Mon, 24 Jan 2022 14:19:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E5739B8123D; Mon, 24 Jan 2022 19:19:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09A5FC340E5; Mon, 24 Jan 2022 19:19:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051951; bh=NZ86/jhMQ53LYMnML1i/s5E3FRSxzSncXmKzzl4r9Tk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IH0OzLn19YcjmHYXd6AhLB5LF+wQaz1Kt/rsG4qeg+3qsK+KgFQ9qsJvmarA/hsZ6 6Qdz9WgUu5U9EBJXPoHNTuIPISW7we1ibEYeUaGN7a5bQ3jH/xMfFj62ycTHmpaVUs RZjYTe8AZOIgORyjfj3R281P2p263w2UMUZ+OiV8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, rkardell@mida.se, Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 138/239] media: m920x: dont use stack on USB reads Date: Mon, 24 Jan 2022 19:42:56 +0100 Message-Id: <20220124183947.498514593@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mauro Carvalho Chehab [ Upstream commit a2ab06d7c4d6bfd0b545a768247a70463e977e27 ] Using stack-allocated pointers for USB message data don't work. This driver is almost OK with that, except for the I2C read logic. Fix it by using a temporary read buffer, just like on all other calls to m920x_read(). Link: https://lore.kernel.org/all/ccc99e48-de4f-045e-0fe4-61e3118e3f74@mida= .se/ Reported-by: rkardell@mida.se Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/usb/dvb-usb/m920x.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/= m920x.c index 22554d9abd432..3b2a0f36fc38e 100644 --- a/drivers/media/usb/dvb-usb/m920x.c +++ b/drivers/media/usb/dvb-usb/m920x.c @@ -277,6 +277,13 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, st= ruct i2c_msg msg[], int nu /* Should check for ack here, if we knew how. */ } if (msg[i].flags & I2C_M_RD) { + char *read =3D kmalloc(1, GFP_KERNEL); + if (!read) { + ret =3D -ENOMEM; + kfree(read); + goto unlock; + } + for (j =3D 0; j < msg[i].len; j++) { /* Last byte of transaction? * Send STOP, otherwise send ACK. */ @@ -284,9 +291,12 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, st= ruct i2c_msg msg[], int nu =20 if ((ret =3D m920x_read(d->udev, M9206_I2C, 0x0, 0x20 | stop, - &msg[i].buf[j], 1)) !=3D 0) + read, 1)) !=3D 0) goto unlock; + msg[i].buf[j] =3D read[0]; } + + kfree(read); } else { for (j =3D 0; j < msg[i].len; j++) { /* Last byte of transaction? Then send STOP. */ --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59457C35278 for ; Mon, 24 Jan 2022 19:26:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344639AbiAXT0f (ORCPT ); Mon, 24 Jan 2022 14:26:35 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48160 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345146AbiAXTTP (ORCPT ); Mon, 24 Jan 2022 14:19:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 733B5613F9; Mon, 24 Jan 2022 19:19:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 33B96C340E7; Mon, 24 Jan 2022 19:19:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051954; bh=ZC36WnheV32GTiyfyRTPvOOYO8m2u9dH7wQLkkmFlDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uHD7JqthSUlMrvY0v2OgWryxBX4iWjgO2iU851RHcAjIDjUv08QNxrWJlJU4hTFVP 24ce2D684VdFIi1im3d+kDqNQ/zzR4IJyXHLH5ZWibi+fb07XCLXR2qzTGdqj/PF4q wuMaaP7LPhpq63aK1JNiniBipFKkw3k2oQLgCK58= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Emmanuel Grumbach , Maximilian Ernestus , Johannes Berg , Luca Coelho , Sasha Levin Subject: [PATCH 4.19 139/239] iwlwifi: mvm: synchronize with FW after multicast commands Date: Mon, 24 Jan 2022 19:42:57 +0100 Message-Id: <20220124183947.527614489@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johannes Berg [ Upstream commit db66abeea3aefed481391ecc564fb7b7fb31d742 ] If userspace installs a lot of multicast groups very quickly, then we may run out of command queue space as we send the updates in an asynchronous fashion (due to locking concerns), and the CPU can create them faster than the firmware can process them. This is true even when mac80211 has a work struct that gets scheduled. Fix this by synchronizing with the firmware after sending all those commands - outside of the iteration we can send a synchronous echo command that just has the effect of the CPU waiting for the prior asynchronous commands to finish. This also will cause fewer of the commands to be sent to the firmware overall, because the work will only run once when rescheduled multiple times while it's running. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D213649 Suggested-by: Emmanuel Grumbach Reported-by: Maximilian Ernestus Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20211204083238.51aea5b79ea4.I88a447= 98efda16e9fe480fb3e94224931d311b29@changeid Signed-off-by: Luca Coelho Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/ne= t/wireless/intel/iwlwifi/mvm/mac80211.c index 697a66acba9ce..3f37fb64e71c2 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -1623,6 +1623,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *= mvm) struct iwl_mvm_mc_iter_data iter_data =3D { .mvm =3D mvm, }; + int ret; =20 lockdep_assert_held(&mvm->mutex); =20 @@ -1632,6 +1633,22 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm = *mvm) ieee80211_iterate_active_interfaces_atomic( mvm->hw, IEEE80211_IFACE_ITER_NORMAL, iwl_mvm_mc_iface_iterator, &iter_data); + + /* + * Send a (synchronous) ech command so that we wait for the + * multiple asynchronous MCAST_FILTER_CMD commands sent by + * the interface iterator. Otherwise, we might get here over + * and over again (by userspace just sending a lot of these) + * and the CPU can send them faster than the firmware can + * process them. + * Note that the CPU is still faster - but with this we'll + * actually send fewer commands overall because the CPU will + * not schedule the work in mac80211 as frequently if it's + * still running when rescheduled (possibly multiple times). + */ + ret =3D iwl_mvm_send_cmd_pdu(mvm, ECHO_CMD, 0, 0, NULL); + if (ret) + IWL_ERR(mvm, "Failed to synchronize multicast groups update\n"); } =20 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw, --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FC33C433EF for ; Mon, 24 Jan 2022 19:51:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351315AbiAXTvQ (ORCPT ); Mon, 24 Jan 2022 14:51:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242936AbiAXTkf (ORCPT ); Mon, 24 Jan 2022 14:40:35 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9367BC07A962; Mon, 24 Jan 2022 11:19:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 502A6B81240; Mon, 24 Jan 2022 19:19:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7533AC340E5; Mon, 24 Jan 2022 19:19:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051958; bh=jLeeFf393B8HjgrocufcT+n/GYkXVkQ4rnUo38UVcLM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q5S8QB9mRec7+rWOHhYNpMDWElcLp1ikoTQqktimJGbLJAW9jyrZ/BL3ijKDW/62u eZJnE/zQ+/qeIBCx2TLMrdTQHNyxd3DMDyLj+d7V0szjuAtD8phpjYMe09A+XJEHbw jLJn0nnW7/alzX8t0ItNpb6isT5XUzywPHK4lfBg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sebastian Gottschall , Kalle Valo , Sasha Levin Subject: [PATCH 4.19 140/239] ath10k: Fix tx hanging Date: Mon, 24 Jan 2022 19:42:58 +0100 Message-Id: <20220124183947.558107343@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sebastian Gottschall [ Upstream commit e8a91863eba3966a447d2daa1526082d52b5db2a ] While running stress tests in roaming scenarios (switching ap's every 5 seconds, we discovered a issue which leads to tx hangings of exactly 5 seconds while or after scanning for new accesspoints. We found out that this hanging is triggered by ath10k_mac_wait_tx_complete since the empty_tx_wq was not wake when the num_tx_pending counter reaches zero. To fix this, we simply move the wake_up call to htt_tx_dec_pending, since this call was missed on several locations within the ath10k code. Signed-off-by: Sebastian Gottschall Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210505085806.11474-1-s.gottschall@dd-wrt.= com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/ath/ath10k/htt_tx.c | 3 +++ drivers/net/wireless/ath/ath10k/txrx.c | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireles= s/ath/ath10k/htt_tx.c index fd011bdabb963..3718d4dfc6d60 100644 --- a/drivers/net/wireless/ath/ath10k/htt_tx.c +++ b/drivers/net/wireless/ath/ath10k/htt_tx.c @@ -158,6 +158,9 @@ void ath10k_htt_tx_dec_pending(struct ath10k_htt *htt) htt->num_pending_tx--; if (htt->num_pending_tx =3D=3D htt->max_num_pending_tx - 1) ath10k_mac_tx_unlock(htt->ar, ATH10K_TX_PAUSE_Q_FULL); + + if (htt->num_pending_tx =3D=3D 0) + wake_up(&htt->empty_tx_wq); } =20 int ath10k_htt_tx_inc_pending(struct ath10k_htt *htt) diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/= ath/ath10k/txrx.c index 6c47e4b6aa6cd..888a8f4aff5d8 100644 --- a/drivers/net/wireless/ath/ath10k/txrx.c +++ b/drivers/net/wireless/ath/ath10k/txrx.c @@ -91,8 +91,6 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, =20 ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id); ath10k_htt_tx_dec_pending(htt); - if (htt->num_pending_tx =3D=3D 0) - wake_up(&htt->empty_tx_wq); spin_unlock_bh(&htt->tx_lock); =20 dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28DBAC4167D for ; Mon, 24 Jan 2022 20:00:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359367AbiAXT7g (ORCPT ); Mon, 24 Jan 2022 14:59:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55334 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355439AbiAXTlX (ORCPT ); Mon, 24 Jan 2022 14:41:23 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 16EE0C06176F; Mon, 24 Jan 2022 11:21:25 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B2E16B8121A; Mon, 24 Jan 2022 19:21:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C8D72C340E5; Mon, 24 Jan 2022 19:21:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052083; bh=A9QrOZZOs90LBJJ2cTE2RJkFHsE+7U4j+ayQc02i0ss=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y19p9JZogE0hMwG3lk1sXqNowAB0lYq0xoUWVA06S1MEFHsMcDrbBw2jewb2FyBFz wq5stcFXxyJFbMKMVhQ+cB894mL7wBuHEJZoSCPzNh6f0/uQLEQwLK+yO+BGdyaE/1 RfRg34Fl4O6jHFYfgpWCfkXniw5KZg2X/kr3VBi0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Antoine Tenart , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 141/239] net-sysfs: update the queue counts in the unregistration path Date: Mon, 24 Jan 2022 19:42:59 +0100 Message-Id: <20220124183947.587473748@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Antoine Tenart [ Upstream commit d7dac083414eb5bb99a6d2ed53dc2c1b405224e5 ] When updating Rx and Tx queue kobjects, the queue count should always be updated to match the queue kobjects count. This was not done in the net device unregistration path, fix it. Tracking all queue count updates will allow in a following up patch to detect illegal updates. Signed-off-by: Antoine Tenart Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/core/net-sysfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index fe0d255d66c8b..e5dc04cb55992 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -1616,6 +1616,9 @@ static void remove_queue_kobjects(struct net_device *= dev) =20 net_rx_queue_update_kobjects(dev, real_rx, 0); netdev_queue_update_kobjects(dev, real_tx, 0); + + dev->real_num_rx_queues =3D 0; + dev->real_num_tx_queues =3D 0; #ifdef CONFIG_SYSFS kset_unregister(dev->queues_kset); #endif --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D10EC433EF for ; Mon, 24 Jan 2022 19:56:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358754AbiAXTzo (ORCPT ); Mon, 24 Jan 2022 14:55:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54224 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348952AbiAXTk7 (ORCPT ); Mon, 24 Jan 2022 14:40:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91AC0C07A968; Mon, 24 Jan 2022 11:19:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 30F3C612F3; Mon, 24 Jan 2022 19:19:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A596C340E5; Mon, 24 Jan 2022 19:19:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051982; bh=vPTjVddl5DKb6MbfQQ7t/DzPJ0dMH0IYt5/qolz2wgk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ylTvvB/WdWBBFrQmbF5JU8R69IlzDBi3QAFD1oYZoEOwXmCQXKOqI+1BxsZHNU56r 7gpCwWVSnvfq9WlI+MA1U9WRdpf1YX7FwKhyQ3RWo/+s6C5C7fJpnOJOsj5mXAM3u7 Zia/WEtWOMYEvg4kwcxIGiSYBRiXR6fUdhgSdbt4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Borislav Petkov , Sasha Levin Subject: [PATCH 4.19 142/239] x86/mce: Mark mce_panic() noinstr Date: Mon, 24 Jan 2022 19:43:00 +0100 Message-Id: <20220124183947.617320258@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Borislav Petkov [ Upstream commit 3c7ce80a818fa7950be123cac80cd078e5ac1013 ] And allow instrumentation inside it because it does calls to other facilities which will not be tagged noinstr. Fixes vmlinux.o: warning: objtool: do_machine_check()+0xc73: call to mce_panic(= ) leaves .noinstr.text section Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20211208111343.8130-8-bp@alien8.de Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/kernel/cpu/mcheck/mce.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/= mce.c index 2a13468f87739..56c4456434a82 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -295,11 +295,17 @@ static void wait_for_panic(void) panic("Panicing machine check CPU died"); } =20 -static void mce_panic(const char *msg, struct mce *final, char *exp) +static noinstr void mce_panic(const char *msg, struct mce *final, char *ex= p) { - int apei_err =3D 0; struct llist_node *pending; struct mce_evt_llist *l; + int apei_err =3D 0; + + /* + * Allow instrumentation around external facilities usage. Not that it + * matters a whole lot since the machine is going to panic anyway. + */ + instrumentation_begin(); =20 if (!fake_panic) { /* @@ -314,7 +320,7 @@ static void mce_panic(const char *msg, struct mce *fina= l, char *exp) } else { /* Don't log too much for fake panic */ if (atomic_inc_return(&mce_fake_panicked) > 1) - return; + goto out; } pending =3D mce_gen_pool_prepare_records(); /* First print corrected ones that are still unlogged */ @@ -352,6 +358,9 @@ static void mce_panic(const char *msg, struct mce *fina= l, char *exp) panic(msg); } else pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg); + +out: + instrumentation_end(); } =20 /* Support code for software error injection */ --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55B7EC433EF for ; Mon, 24 Jan 2022 19:31:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352119AbiAXT3m (ORCPT ); Mon, 24 Jan 2022 14:29:42 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47230 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349128AbiAXTUR (ORCPT ); Mon, 24 Jan 2022 14:20:17 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1C5936131E; Mon, 24 Jan 2022 19:20:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAA6EC340E5; Mon, 24 Jan 2022 19:20:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052016; bh=IV9sGNAAhIv0lTHD76UObbI1oGTX0q68vnnkRH5LISs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MlRi065GJUkhqaDp9aXO8Q1+v2tZMTZrH8nBivPvF0XGw1El23mtiNdsBDUNPnwkH n4hxhfj2Eop7usjUJuF6S5iXrZVv9t2lzHmQb+20tImWUjq6hmZcLJaIE27XMtXTjX dNQ3ntfHdJBy5fjZ5/f8vDk07p+EnHEKOZ0m272Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Borislav Petkov , Sasha Levin Subject: [PATCH 4.19 143/239] x86/mce: Mark mce_end() noinstr Date: Mon, 24 Jan 2022 19:43:01 +0100 Message-Id: <20220124183947.646418035@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Borislav Petkov [ Upstream commit b4813539d37fa31fed62cdfab7bd2dd8929c5b2e ] It is called by the #MC handler which is noinstr. Fixes vmlinux.o: warning: objtool: do_machine_check()+0xbd6: call to memset() l= eaves .noinstr.text section Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20211208111343.8130-9-bp@alien8.de Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/kernel/cpu/mcheck/mce.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/= mce.c index 56c4456434a82..26adaad3f2587 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -1030,10 +1030,13 @@ static int mce_start(int *no_way_out) * Synchronize between CPUs after main scanning loop. * This invokes the bulk of the Monarch processing. */ -static int mce_end(int order) +static noinstr int mce_end(int order) { - int ret =3D -1; u64 timeout =3D (u64)mca_cfg.monarch_timeout * NSEC_PER_USEC; + int ret =3D -1; + + /* Allow instrumentation around external facilities. */ + instrumentation_begin(); =20 if (!timeout) goto reset; @@ -1077,7 +1080,8 @@ static int mce_end(int order) /* * Don't reset anything. That's done by the Monarch. */ - return 0; + ret =3D 0; + goto out; } =20 /* @@ -1092,6 +1096,10 @@ reset: * Let others run again. */ atomic_set(&mce_executing, 0); + +out: + instrumentation_end(); + return ret; } =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09FFDC433F5 for ; Mon, 24 Jan 2022 19:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358508AbiAXTzW (ORCPT ); Mon, 24 Jan 2022 14:55:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54702 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354102AbiAXTlC (ORCPT ); Mon, 24 Jan 2022 14:41:02 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AA695C061747; Mon, 24 Jan 2022 11:20:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4F059B8121A; Mon, 24 Jan 2022 19:20:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7FE29C340E5; Mon, 24 Jan 2022 19:20:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052049; bh=2Ao0xJWtEm824Wm0cz0zDXdrq9k9TSs5nYnz5dAhi+M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pJN1icgo+P5z+WxTW0jT9IHg3pz+fYqnCwn7DpPgZ9R2KFguKDu6fR1g4T87S53wl ngpLzmAAN8A5KCEcdxCyWu8NZt/0k8kZXfpyyAZrSZKeFD/3TLk7rlmCF2QevwL67l vipLu/hHuej7s+7mhFpb2TTd1bgSDhRGrr1LpQls= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Borislav Petkov , Sasha Levin Subject: [PATCH 4.19 144/239] x86/mce: Mark mce_read_aux() noinstr Date: Mon, 24 Jan 2022 19:43:02 +0100 Message-Id: <20220124183947.676611681@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Borislav Petkov [ Upstream commit db6c996d6ce45dfb44891f0824a65ecec216f47a ] Fixes vmlinux.o: warning: objtool: do_machine_check()+0x681: call to mce_read_a= ux() leaves .noinstr.text section Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20211208111343.8130-10-bp@alien8.de Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/kernel/cpu/mcheck/mce.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/= mce.c index 26adaad3f2587..8f36ccf26ceca 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -651,7 +651,7 @@ static struct notifier_block mce_default_nb =3D { /* * Read ADDR and MISC registers. */ -static void mce_read_aux(struct mce *m, int i) +static noinstr void mce_read_aux(struct mce *m, int i) { if (m->status & MCI_STATUS_MISCV) m->misc =3D mce_rdmsrl(msr_ops.misc(i)); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB74EC433EF for ; Tue, 25 Jan 2022 02:28:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420806AbiAYCZ3 (ORCPT ); Mon, 24 Jan 2022 21:25:29 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:45052 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349676AbiAXTVI (ORCPT ); Mon, 24 Jan 2022 14:21:08 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2E3C4B8121C; Mon, 24 Jan 2022 19:21:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D767C340E7; Mon, 24 Jan 2022 19:21:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052065; bh=mJzXnS1IcEmpxWvMgmaLHW9EGxrSV9VAOnlDQMkv5PE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HAXrpTpwwj7j405ShQ8jBsiGJcjPRPfktlisELvgvfnYS4wamLkZarvSaAphHJk/z 4Fd0bO7r8GWFkVUsYbUztkvYWcKhGTQibz779JdNXtwTi4wm4DW2LdXU2F7xCoSZ9z JE7TQWpklEtuEBb+bU0T1+8eOfBm9k+3l1Cum/qM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Suresh Kumar , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 145/239] net: bonding: debug: avoid printing debug logs when bond is not notifying peers Date: Mon, 24 Jan 2022 19:43:03 +0100 Message-Id: <20220124183947.707901508@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Suresh Kumar [ Upstream commit fee32de284ac277ba434a2d59f8ce46528ff3946 ] Currently "bond_should_notify_peers: slave ..." messages are printed whenev= er "bond_should_notify_peers" function is called. +++ Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): Received LACPDU on po= rt 1 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): Rx Machine: Port=3D1,= Last State=3D6, Curr State=3D6 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): partner sync=3D1 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 ... Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): Received LACPDU on por= t 2 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): Rx Machine: Port=3D2, = Last State=3D6, Curr State=3D6 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): partner sync=3D1 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +++ This is confusing and can also clutter up debug logs. Print logs only when the peer notification happens. Signed-off-by: Suresh Kumar Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/bonding/bond_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_mai= n.c index d6c5f41b17f7e..2d70cdd26f89d 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -782,14 +782,14 @@ static bool bond_should_notify_peers(struct bonding *= bond) slave =3D rcu_dereference(bond->curr_active_slave); rcu_read_unlock(); =20 - netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", - slave ? slave->dev->name : "NULL"); - if (!slave || !bond->send_peer_notif || !netif_carrier_ok(bond->dev) || test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state)) return false; =20 + netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", + slave ? slave->dev->name : "NULL"); + return true; } =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BAC0DC4332F for ; Tue, 25 Jan 2022 02:28:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420823AbiAYCZc (ORCPT ); Mon, 24 Jan 2022 21:25:32 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:45064 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349705AbiAXTVL (ORCPT ); Mon, 24 Jan 2022 14:21:11 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F3816B8122A; Mon, 24 Jan 2022 19:21:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2BC4BC340E5; Mon, 24 Jan 2022 19:21:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052068; bh=xAngeKfXCJtF/25f0h8+pSD9XBwTu6oIqZSVUBcS/cQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=niA8N7BQLwbTJGLj7bXdajUNzarX3hE1WdnR7o04nVVZMwQZEWZi4RN+QnX+gpZlI k/g9P4fBrVNOfD6uq1jZj1OosUJkH5g+nUk/JRpJ1u2o9t7P7pqa86A+6gD9Y7DT/I Xhn/+SZiZy/4544jUpsXN1w5K54D1eW76+X77sQk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paolo Abeni , Daniel Borkmann , =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Sasha Levin Subject: [PATCH 4.19 146/239] bpf: Do not WARN in bpf_warn_invalid_xdp_action() Date: Mon, 24 Jan 2022 19:43:04 +0100 Message-Id: <20220124183947.737950237@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Paolo Abeni [ Upstream commit 2cbad989033bff0256675c38f96f5faab852af4b ] The WARN_ONCE() in bpf_warn_invalid_xdp_action() can be triggered by any bugged program, and even attaching a correct program to a NIC not supporting the given action. The resulting splat, beyond polluting the logs, fouls automated tools: e.g. a syzkaller reproducers using an XDP program returning an unsupported action will never pass validation. Replace the WARN_ONCE with a less intrusive pr_warn_once(). Signed-off-by: Paolo Abeni Signed-off-by: Daniel Borkmann Acked-by: Toke H=C3=B8iland-J=C3=B8rgensen Link: https://lore.kernel.org/bpf/016ceec56e4817ebb2a9e35ce794d5c917df572c.= 1638189075.git.pabeni@redhat.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/core/filter.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 01496c7cb42d7..7d68c98a00aa8 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -5534,9 +5534,9 @@ void bpf_warn_invalid_xdp_action(u32 act) { const u32 act_max =3D XDP_REDIRECT; =20 - WARN_ONCE(1, "%s XDP return value %u, expect packet loss!\n", - act > act_max ? "Illegal" : "Driver unsupported", - act); + pr_warn_once("%s XDP return value %u, expect packet loss!\n", + act > act_max ? "Illegal" : "Driver unsupported", + act); } EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action); =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0C54C4167B for ; Mon, 24 Jan 2022 19:52:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348036AbiAXTwG (ORCPT ); Mon, 24 Jan 2022 14:52:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355415AbiAXTlQ (ORCPT ); Mon, 24 Jan 2022 14:41:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 058CAC06175D; Mon, 24 Jan 2022 11:21:14 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C0F8DB81235; Mon, 24 Jan 2022 19:21:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0F5BC340E5; Mon, 24 Jan 2022 19:21:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052071; bh=FSpJDSpfVsJcYGFNZhFJVzsi85MzAyRlNh/wIUlnzeE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lVDZ0x9qd64mlpFei8mEBKAsp3bRptpxli9o49sTh9AjWEKqJtsv4YUdGBNgzTgtY 4dYM0NVBZgcoyXRzxeOEQyle//UKKdlUMIjxX1c4+yxEzrUMCKXkGL3Ine2Ks8uDd8 EdC+pERj/4JHDX/NB9Q0XLrbeIvYK+gfp+b7f5YE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alistair Francis , Benjamin Tissoires , Sasha Levin Subject: [PATCH 4.19 147/239] HID: quirks: Allow inverting the absolute X/Y values Date: Mon, 24 Jan 2022 19:43:05 +0100 Message-Id: <20220124183947.769204985@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alistair Francis [ Upstream commit fd8d135b2c5e88662f2729e034913f183455a667 ] Add a HID_QUIRK_X_INVERT/HID_QUIRK_Y_INVERT quirk that can be used to invert the X/Y values. Signed-off-by: Alistair Francis [bentiss: silence checkpatch warning] Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20211208124045.61815-2-alistair@alistair23.= me Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/hid-input.c | 6 ++++++ include/linux/hid.h | 2 ++ 2 files changed, 8 insertions(+) diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c index d56ef395eb693..dd3f4aa052980 100644 --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -1246,6 +1246,12 @@ void hidinput_hid_event(struct hid_device *hid, stru= ct hid_field *field, struct =20 input =3D field->hidinput->input; =20 + if (usage->type =3D=3D EV_ABS && + (((*quirks & HID_QUIRK_X_INVERT) && usage->code =3D=3D ABS_X) || + ((*quirks & HID_QUIRK_Y_INVERT) && usage->code =3D=3D ABS_Y))) { + value =3D field->logical_maximum - value; + } + if (usage->hat_min < usage->hat_max || usage->hat_dir) { int hat_dir =3D usage->hat_dir; if (!hat_dir) diff --git a/include/linux/hid.h b/include/linux/hid.h index da824ba9fb9a2..c51ebce2197e0 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -353,6 +353,8 @@ struct hid_item { /* BIT(9) reserved for backward compatibility, was NO_INIT_INPUT_REPORTS */ #define HID_QUIRK_ALWAYS_POLL BIT(10) #define HID_QUIRK_INPUT_PER_APP BIT(11) +#define HID_QUIRK_X_INVERT BIT(12) +#define HID_QUIRK_Y_INVERT BIT(13) #define HID_QUIRK_SKIP_OUTPUT_REPORTS BIT(16) #define HID_QUIRK_SKIP_OUTPUT_REPORT_ID BIT(17) #define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP BIT(18) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2ABDFC433EF for ; Tue, 25 Jan 2022 02:33:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420868AbiAYCZm (ORCPT ); Mon, 24 Jan 2022 21:25:42 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49358 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349747AbiAXTVP (ORCPT ); Mon, 24 Jan 2022 14:21:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E1CF2612FA; Mon, 24 Jan 2022 19:21:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C57C7C340E5; Mon, 24 Jan 2022 19:21:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052074; bh=s1zOZaBKK25K2dWFszrxbwGQGSRLpyHYOg5sPtaaNN0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zOgpe3AsXCON5gF8Io9Kx4LlIl2IQr8pBuijB3v72jboshCKIMTOfv5+nOuhajYWS WCaFhKup8mUJGg/se87e2veOVdgBvrSQA/YgSspv3LQ+1t0x16cdWPiqt9Xony4p/r 0a37D9h8bsi5J05vzZ7sqOF0YPV1II3OVG72py8g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sean Young , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 148/239] media: igorplugusb: receiver overflow should be reported Date: Mon, 24 Jan 2022 19:43:06 +0100 Message-Id: <20220124183947.801806290@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Young [ Upstream commit 8fede658e7ddb605bbd68ed38067ddb0af033db4 ] Without this, some IR will be missing mid-stream and we might decode something which never really occurred. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/rc/igorplugusb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c index f563ddd7f7392..98a13532a5968 100644 --- a/drivers/media/rc/igorplugusb.c +++ b/drivers/media/rc/igorplugusb.c @@ -73,9 +73,11 @@ static void igorplugusb_irdata(struct igorplugusb *ir, u= nsigned len) if (start >=3D len) { dev_err(ir->dev, "receive overflow invalid: %u", overflow); } else { - if (overflow > 0) + if (overflow > 0) { dev_warn(ir->dev, "receive overflow, at least %u lost", overflow); + ir_raw_event_reset(ir->rc); + } =20 do { rawir.duration =3D ir->buf_in[i] * 85333; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82A7CC4167B for ; Mon, 24 Jan 2022 19:31:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352421AbiAXTaY (ORCPT ); Mon, 24 Jan 2022 14:30:24 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:45170 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349782AbiAXTVT (ORCPT ); Mon, 24 Jan 2022 14:21:19 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 68D33B81235; Mon, 24 Jan 2022 19:21:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97825C340E5; Mon, 24 Jan 2022 19:21:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052077; bh=1Dan8dXqoNzgwNf+GccsTIVQp+glgJ3SqFIhl/iSHJc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Rz7+K3vLov8WE4g3OldmFwAjeN4xww3ku+1BX+kIp7//bjdLbD75fBHkCPS3rRIO8 HzBecpFGI/and9LQ2IRAeQnrALUCbX1ooUAg5n1pZ+YPxbxhlC6rI2jhmr88+m6BiF hpfN2LIMeISidq5ue7Kp/gOv4CwBB7/tnLrGgzpQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 149/239] media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() Date: Mon, 24 Jan 2022 19:43:07 +0100 Message-Id: <20220124183947.833217517@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 3af86b046933ba513d08399dba0d4d8b50d607d0 ] In hexium_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. saa7146_vv_release() will be called on failure of saa7146_register_device(). There is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init(). Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_HEXIUM_GEMINI=3Dm show no new warnings, and our static analyzer no longer warns about this code. Link: https://lore.kernel.org/linux-media/20211203154030.111210-1-zhou1615@= umn.edu Signed-off-by: Zhou Qingyang Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/common/saa7146/saa7146_fops.c | 2 +- drivers/media/pci/saa7146/hexium_gemini.c | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/media/common/saa7146/saa7146_fops.c b/drivers/media/co= mmon/saa7146/saa7146_fops.c index d4987fd05d05f..d91bd32bd1f04 100644 --- a/drivers/media/common/saa7146/saa7146_fops.c +++ b/drivers/media/common/saa7146/saa7146_fops.c @@ -524,7 +524,7 @@ int saa7146_vv_init(struct saa7146_dev* dev, struct saa= 7146_ext_vv *ext_vv) ERR("out of memory. aborting.\n"); kfree(vv); v4l2_ctrl_handler_free(hdl); - return -1; + return -ENOMEM; } =20 saa7146_video_uops.init(dev,vv); diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/= saa7146/hexium_gemini.c index 8c56d4c37a525..3513b1a6fcee9 100644 --- a/drivers/media/pci/saa7146/hexium_gemini.c +++ b/drivers/media/pci/saa7146/hexium_gemini.c @@ -296,7 +296,12 @@ static int hexium_attach(struct saa7146_dev *dev, stru= ct saa7146_pci_extension_d hexium_set_input(hexium, 0); hexium->cur_input =3D 0; =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + i2c_del_adapter(&hexium->i2c_adapter); + kfree(hexium); + return ret; + } =20 vv_data.vid_ops.vidioc_enum_input =3D vidioc_enum_input; vv_data.vid_ops.vidioc_g_input =3D vidioc_g_input; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57A27C433F5 for ; Mon, 24 Jan 2022 19:52:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351533AbiAXTwV (ORCPT ); Mon, 24 Jan 2022 14:52:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355412AbiAXTlQ (ORCPT ); Mon, 24 Jan 2022 14:41:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA50CC06175E; Mon, 24 Jan 2022 11:21:22 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 90D17B811F9; Mon, 24 Jan 2022 19:21:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B7526C340E5; Mon, 24 Jan 2022 19:21:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052080; bh=TXblizUNnF0qFAWhKFQNE34d8SwkK57tLFPlgMicx4A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1pFLRIZkgD9q9/Q6c8isODjLyFUcONKjEE6zW8P5HELxq3bx3vtcDK+J+/qE9eRqi KSpsb/fyYhOU4URkPL3LnUTTzpVyq2TOKcKf76797nyzd+HYdZPwmuNn2wEfLbZMMq P2u2SrWagMHFeuwMpa0bmzi/HDsxsg/Va2mCtRsE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "H. Nikolaus Schaller" , Ulf Hansson , Sasha Levin Subject: [PATCH 4.19 150/239] mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO Date: Mon, 24 Jan 2022 19:43:08 +0100 Message-Id: <20220124183947.864839011@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ulf Hansson [ Upstream commit 8c3e5b74b9e2146f564905e50ca716591c76d4f1 ] The mmc core takes a specific path to support initializing of a non-standard SDIO card. This is triggered by looking for the card-quirk, MMC_QUIRK_NONSTD_SDIO. In mmc_sdio_init_card() this gets rather messy, as it causes the code to bail out earlier, compared to the usual path. This leads to that the OCR doesn't get saved properly in card->ocr. Fortunately, only omap_hsmmc has been using the MMC_QUIRK_NONSTD_SDIO and is dealing with the issue, by assigning a hardcoded value (0x80) to card->ocr from an ->init_card() ops. To make the behaviour consistent, let's instead rely on the core to save the OCR in card->ocr during initialization. Reported-by: H. Nikolaus Schaller Signed-off-by: Ulf Hansson Signed-off-by: H. Nikolaus Schaller Link: https://lore.kernel.org/r/e7936cff7fc24d187ef2680d3b4edb0ade58f293.16= 36564631.git.hns@goldelico.com Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/mmc/core/sdio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c index 4e72ad24322f7..5f1ee88aa7615 100644 --- a/drivers/mmc/core/sdio.c +++ b/drivers/mmc/core/sdio.c @@ -634,6 +634,8 @@ try_again: if (host->ops->init_card) host->ops->init_card(host, card); =20 + card->ocr =3D ocr_card; + /* * If the host and card support UHS-I mode request the card * to switch to 1.8V signaling level. No 1.8v signalling if @@ -740,7 +742,7 @@ try_again: =20 card =3D oldcard; } - card->ocr =3D ocr_card; + mmc_fixup_device(card, sdio_fixup_methods); =20 if (card->type =3D=3D MMC_TYPE_SD_COMBO) { --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6ECBAC43217 for ; Mon, 24 Jan 2022 19:27:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345578AbiAXT1U (ORCPT ); Mon, 24 Jan 2022 14:27:20 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:40686 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348839AbiAXTTr (ORCPT ); Mon, 24 Jan 2022 14:19:47 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A6C3FB8121B; Mon, 24 Jan 2022 19:19:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9D03C340E8; Mon, 24 Jan 2022 19:19:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051985; bh=BiDawCDCR9XnHyP+jduSugMt5j1biVVhOqB9aUPbh90=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2Xd9bBSJUhV6/nhZpBZKeD6y3PidL9tqTGDXlQDse8ATHomPVfG3gnQbKGx3uxXnk aBBvQDuxnXk73pyRXYRhl1BismM+xH4s0mZc+f7qfJta4bLaxnmZamp/IrMvbykEaS OkYW9I3WUFZ8FPY8LhruRfHWjPzAhbzca8LDIT3o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gaosheng Cui , Richard Guy Briggs , Paul Moore , Sasha Levin Subject: [PATCH 4.19 151/239] audit: ensure userspace is penalized the same as the kernel when under pressure Date: Mon, 24 Jan 2022 19:43:09 +0100 Message-Id: <20220124183947.896612524@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paul Moore [ Upstream commit 8f110f530635af44fff1f4ee100ecef0bac62510 ] Due to the audit control mutex necessary for serializing audit userspace messages we haven't been able to block/penalize userspace processes that attempt to send audit records while the system is under audit pressure. The result is that privileged userspace applications have a priority boost with respect to audit as they are not bound by the same audit queue throttling as the other tasks on the system. This patch attempts to restore some balance to the system when under audit pressure by blocking these privileged userspace tasks after they have finished their audit processing, and dropped the audit control mutex, but before they return to userspace. Reported-by: Gaosheng Cui Tested-by: Gaosheng Cui Reviewed-by: Richard Guy Briggs Signed-off-by: Paul Moore Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/audit.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/kernel/audit.c b/kernel/audit.c index 968921d376b98..c5e034fe14bbb 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1528,6 +1528,20 @@ static void audit_receive(struct sk_buff *skb) nlh =3D nlmsg_next(nlh, &len); } audit_ctl_unlock(); + + /* can't block with the ctrl lock, so penalize the sender now */ + if (audit_backlog_limit && + (skb_queue_len(&audit_queue) > audit_backlog_limit)) { + DECLARE_WAITQUEUE(wait, current); + + /* wake kauditd to try and flush the queue */ + wake_up_interruptible(&kauditd_wait); + + add_wait_queue_exclusive(&audit_backlog_wait, &wait); + set_current_state(TASK_UNINTERRUPTIBLE); + schedule_timeout(audit_backlog_wait_time); + remove_wait_queue(&audit_backlog_wait, &wait); + } } =20 /* Run custom bind function on netlink socket group connect or bind reques= ts. */ @@ -1772,7 +1786,9 @@ struct audit_buffer *audit_log_start(struct audit_con= text *ctx, gfp_t gfp_mask, * task_tgid_vnr() since auditd_pid is set in audit_receive_msg() * using a PID anchored in the caller's namespace * 2. generator holding the audit_cmd_mutex - we don't want to block - * while holding the mutex */ + * while holding the mutex, although we do penalize the sender + * later in audit_receive() when it is safe to block + */ if (!(auditd_test_task(current) || audit_ctl_owner_current())) { long stime =3D audit_backlog_wait_time; =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F17B2C433FE for ; Mon, 24 Jan 2022 20:00:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359593AbiAXT7w (ORCPT ); Mon, 24 Jan 2022 14:59:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54220 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348943AbiAXTk7 (ORCPT ); Mon, 24 Jan 2022 14:40:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6B64DC07A969; Mon, 24 Jan 2022 11:19:49 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0A3F36131E; Mon, 24 Jan 2022 19:19:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF034C340E5; Mon, 24 Jan 2022 19:19:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051988; bh=QxD6f8bCjJFWssCLpcbLaovKwmesr/ybAtyxFxsTYWI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gUHlEy62y8p1WEFzD+udy+gpvTbwWwoPPltUTNGO7qTNrdWIE69WVxMnBXDRe3xpf mi3RhZ/8C6y5/Q1xS1gCY0saB2aLcCI4aNnLFVorBHC9r1BVy0/1w8LPDQwHbmT8w+ rhU7sGGpYNbx3/1g+3/mmIdBSqHueVeo37HXQu+4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thierry Reding , Sasha Levin Subject: [PATCH 4.19 152/239] arm64: tegra: Adjust length of CCPLEX cluster MMIO region Date: Mon, 24 Jan 2022 19:43:10 +0100 Message-Id: <20220124183947.926707942@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thierry Reding [ Upstream commit 2b14cbd643feea5fc17c6e8bead4e71088c69acd ] The Tegra186 CCPLEX cluster register region is 4 MiB is length, not 4 MiB - 1. This was likely presumed to be the "limit" rather than length. Fix it up. Signed-off-by: Thierry Reding Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm64/boot/dts/nvidia/tegra186.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts= /nvidia/tegra186.dtsi index b762227f6aa18..fc5d047ca50bc 100644 --- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi @@ -372,7 +372,7 @@ =20 ccplex@e000000 { compatible =3D "nvidia,tegra186-ccplex-cluster"; - reg =3D <0x0 0x0e000000 0x0 0x3fffff>; + reg =3D <0x0 0x0e000000 0x0 0x400000>; =20 nvidia,bpmp =3D <&bpmp>; }; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31F6CC4707F for ; Mon, 24 Jan 2022 19:56:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358700AbiAXTzl (ORCPT ); Mon, 24 Jan 2022 14:55:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54226 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346586AbiAXTk7 (ORCPT ); Mon, 24 Jan 2022 14:40:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 250A6C0613EB; Mon, 24 Jan 2022 11:19:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D7507B8121C; Mon, 24 Jan 2022 19:19:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01305C340E5; Mon, 24 Jan 2022 19:19:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051991; bh=kvwgCkmFoSxmqbuxq0+LLTbOC4PKAA/V/FrSQ2rRFSw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N1T5XmYI88nrh6aRIVxS8LTOQ1wuOKY3R17XjtRTs72FhKimXtIoWwrzw1IEbpZ0h b4RggGDuchJX4HcUSIEwx+7yKjwO1BCjOVfWYl+RKnJASy7aIcsVaf/wohXD/lcQ03 5CAOCnu0sikNXP7xfeqnBzEfnoWKtR65Qd57o5WQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Kai-Heng Feng , Sasha Levin Subject: [PATCH 4.19 153/239] usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 Date: Mon, 24 Jan 2022 19:43:11 +0100 Message-Id: <20220124183947.959125470@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kai-Heng Feng [ Upstream commit 00558586382891540c59c9febc671062425a6e47 ] When a new USB device gets plugged to nested hubs, the affected hub, which connects to usb 2-1.4-port2, doesn't report there's any change, hence the nested hubs go back to runtime suspend like nothing happened: [ 281.032951] usb usb2: usb wakeup-resume [ 281.032959] usb usb2: usb auto-resume [ 281.032974] hub 2-0:1.0: hub_resume [ 281.033011] usb usb2-port1: status 0263 change 0000 [ 281.033077] hub 2-0:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.049797] usb 2-1: usb wakeup-resume [ 281.069800] usb 2-1: Waited 0ms for CONNECT [ 281.069810] usb 2-1: finish resume [ 281.070026] hub 2-1:1.0: hub_resume [ 281.070250] usb 2-1-port4: status 0203 change 0000 [ 281.070272] usb usb2-port1: resume, status 0 [ 281.070282] hub 2-1:1.0: state 7 ports 4 chg 0010 evt 0000 [ 281.089813] usb 2-1.4: usb wakeup-resume [ 281.109792] usb 2-1.4: Waited 0ms for CONNECT [ 281.109801] usb 2-1.4: finish resume [ 281.109991] hub 2-1.4:1.0: hub_resume [ 281.110147] usb 2-1.4-port2: status 0263 change 0000 [ 281.110234] usb 2-1-port4: resume, status 0 [ 281.110239] usb 2-1-port4: status 0203, change 0000, 10.0 Gb/s [ 281.110266] hub 2-1.4:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.110426] hub 2-1.4:1.0: hub_suspend [ 281.110565] usb 2-1.4: usb auto-suspend, wakeup 1 [ 281.130998] hub 2-1:1.0: hub_suspend [ 281.137788] usb 2-1: usb auto-suspend, wakeup 1 [ 281.142935] hub 2-0:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.177828] usb 2-1: usb wakeup-resume [ 281.197839] usb 2-1: Waited 0ms for CONNECT [ 281.197850] usb 2-1: finish resume [ 281.197984] hub 2-1:1.0: hub_resume [ 281.198203] usb 2-1-port4: status 0203 change 0000 [ 281.198228] usb usb2-port1: resume, status 0 [ 281.198237] hub 2-1:1.0: state 7 ports 4 chg 0010 evt 0000 [ 281.217835] usb 2-1.4: usb wakeup-resume [ 281.237834] usb 2-1.4: Waited 0ms for CONNECT [ 281.237845] usb 2-1.4: finish resume [ 281.237990] hub 2-1.4:1.0: hub_resume [ 281.238067] usb 2-1.4-port2: status 0263 change 0000 [ 281.238148] usb 2-1-port4: resume, status 0 [ 281.238152] usb 2-1-port4: status 0203, change 0000, 10.0 Gb/s [ 281.238166] hub 2-1.4:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.238385] hub 2-1.4:1.0: hub_suspend [ 281.238523] usb 2-1.4: usb auto-suspend, wakeup 1 [ 281.258076] hub 2-1:1.0: hub_suspend [ 281.265744] usb 2-1: usb auto-suspend, wakeup 1 [ 281.285976] hub 2-0:1.0: hub_suspend [ 281.285988] usb usb2: bus auto-suspend, wakeup 1 USB 3.2 spec, 9.2.5.4 "Changing Function Suspend State" says that "If the link is in a non-U0 state, then the device must transition the link to U0 prior to sending the remote wake message", but the hub only transits the link to U0 after signaling remote wakeup. So be more forgiving and use a 20ms delay to let the link transit to U0 for remote wakeup. Suggested-by: Alan Stern Acked-by: Alan Stern Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20211215120108.336597-1-kai.heng.feng@canon= ical.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/core/hub.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 7feb25559e079..29cc2aa5abff5 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1082,7 +1082,10 @@ static void hub_activate(struct usb_hub *hub, enum h= ub_activation_type type) } else { hub_power_on(hub, true); } - } + /* Give some time on remote wakeup to let links to transit to U0 */ + } else if (hub_is_superspeed(hub->hdev)) + msleep(20); + init2: =20 /* --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8AC5EC35271 for ; Mon, 24 Jan 2022 19:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358731AbiAXTzn (ORCPT ); Mon, 24 Jan 2022 14:55:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348964AbiAXTk7 (ORCPT ); Mon, 24 Jan 2022 14:40:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A579C0613EC; Mon, 24 Jan 2022 11:19:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 11E1FB8121A; Mon, 24 Jan 2022 19:19:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 22CB1C340E5; Mon, 24 Jan 2022 19:19:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051994; bh=Y61sEYe89JMN62S2d5pSk0ZMtlqtnSfDmA0d2mMjqnQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0mJ8wv5/ZvWiEPD9Zt/YAWeueIp0QcxsDpsEANzzzkNAtikYmHuZl6I+c+k6BWHgP 1MZU9ypJ46E3l3Fh2Av+UEcJWFzvnsqZ0yFwEMUydRqN6J+3vWBgtHP95QL/9blTRl It42y0AZy0aN9n5M1SAEXGPtph9l3A0bWIYBOiso= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.19 154/239] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream Date: Mon, 24 Jan 2022 19:43:12 +0100 Message-Id: <20220124183947.989896492@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit 6ce708f54cc8d73beca213cec66ede5ce100a781 ] Large pkt_len can lead to out-out-bound memcpy. Current ath9k_hif_usb_rx_stream allows combining the content of two urb inputs to one pkt. The first input can indicate the size of the pkt. Any remaining size is saved in hif_dev->rx_remain_len. While processing the next input, memcpy is used with rx_remain_len. 4-byte pkt_len can go up to 0xffff, while a single input is 0x4000 maximum in size (MAX_RX_BUF_SIZE). Thus, the patch adds a check for pkt_len which must not exceed 2 * MAX_RX_BUG_SIZE. BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_ht= c] Read of size 46393 at addr ffff888018798000 by task kworker/0:1/23 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 5.6.0 #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] __kasan_report.cold+0x37/0x7c ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] kasan_report+0xe/0x20 check_memory_region+0x15a/0x1d0 memcpy+0x20/0x50 ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? hif_usb_mgmt_cb+0x2d9/0x2d9 [ath9k_htc] ? _raw_spin_lock_irqsave+0x7b/0xd0 ? _raw_spin_trylock_bh+0x120/0x120 ? __usb_unanchor_urb+0x12f/0x210 __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the value of pkt_tag to ATH_USB_RX_STREAM_MODE_TAG in QEMU emulation, I found the KASAN report. The bug is triggerable whenever pkt_len is above two MAX_RX_BUG_SIZE. I used the same input that crashes to test the driver works when applying the patch. Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YXsidrRuK6zBJicZ@10-18-43-117.dynapool.wire= less.nyu.edu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireles= s/ath/ath9k/hif_usb.c index 2ed98aaed6fb5..c8c7afe0e343e 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -590,6 +590,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_= usb *hif_dev, return; } =20 + if (pkt_len > 2 * MAX_RX_BUF_SIZE) { + dev_err(&hif_dev->udev->dev, + "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); + RX_STAT_INC(skb_dropped); + return; + } + pad_len =3D 4 - (pkt_len & 0x3); if (pad_len =3D=3D 4) pad_len =3D 0; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6707BC3526F for ; Mon, 24 Jan 2022 19:56:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358781AbiAXTzq (ORCPT ); Mon, 24 Jan 2022 14:55:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54222 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348963AbiAXTk7 (ORCPT ); Mon, 24 Jan 2022 14:40:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A36D3C0613EE; Mon, 24 Jan 2022 11:20:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E7781B8122C; Mon, 24 Jan 2022 19:19:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 48825C340E5; Mon, 24 Jan 2022 19:19:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643051997; bh=+/o87wEgqY3BX09jI3yJPJIclzPS1/TWr+xS85HssFE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Yjs15q/v/dYVz0QSmf62MXUd4n5FksUmbzGHYbCCL2/HVbtyIByywqiluT4kFbUuL VXx+B5GeC9HD69kRgi5tsqi3sNH6MSiQrt99kSumF4YLwSX5GhnfGKUpMYrI2odwx7 tbBp6Habzc4EmG1BOnSr8jdQEVbq9dfagyrNwJY4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Berg , Luca Coelho , Sasha Levin Subject: [PATCH 4.19 155/239] iwlwifi: fix leaks/bad data after failed firmware load Date: Mon, 24 Jan 2022 19:43:13 +0100 Message-Id: <20220124183948.020242158@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johannes Berg [ Upstream commit ab07506b0454bea606095951e19e72c282bfbb42 ] If firmware load fails after having loaded some parts of the firmware, e.g. the IML image, then this would leak. For the host command list we'd end up running into a WARN on the next attempt to load another firmware image. Fix this by calling iwl_dealloc_ucode() on failures, and make that also clear the data so we start fresh on the next round. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20211210110539.1f742f0eb58a.I1315f2= 2f6aa632d94ae2069f85e1bca5e734dce0@changeid Signed-off-by: Luca Coelho Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wir= eless/intel/iwlwifi/iwl-drv.c index db6628d390a2a..72f5df66cdeb5 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -183,6 +183,9 @@ static void iwl_dealloc_ucode(struct iwl_drv *drv) =20 for (i =3D 0; i < IWL_UCODE_TYPE_MAX; i++) iwl_free_fw_img(drv, drv->fw.img + i); + + /* clear the data for the aborted load case */ + memset(&drv->fw, 0, sizeof(drv->fw)); } =20 static int iwl_alloc_fw_desc(struct iwl_drv *drv, struct fw_desc *desc, @@ -1270,6 +1273,7 @@ static void iwl_req_fw_callback(const struct firmware= *ucode_raw, void *context) int i; bool load_module =3D false; bool usniffer_images =3D false; + bool failure =3D true; =20 fw->ucode_capa.max_probe_length =3D IWL_DEFAULT_MAX_PROBE_LENGTH; fw->ucode_capa.standard_phy_calibration_size =3D @@ -1537,6 +1541,7 @@ static void iwl_req_fw_callback(const struct firmware= *ucode_raw, void *context) op->name, err); #endif } + failure =3D false; goto free; =20 try_again: @@ -1552,6 +1557,9 @@ static void iwl_req_fw_callback(const struct firmware= *ucode_raw, void *context) complete(&drv->request_firmware_complete); device_release_driver(drv->trans->dev); free: + if (failure) + iwl_dealloc_ucode(drv); + if (pieces) { for (i =3D 0; i < ARRAY_SIZE(pieces->img); i++) kfree(pieces->img[i].sec); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE521C35268 for ; Mon, 24 Jan 2022 19:56:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358572AbiAXTz1 (ORCPT ); Mon, 24 Jan 2022 14:55:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349076AbiAXTlA (ORCPT ); Mon, 24 Jan 2022 14:41:00 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB718C07A96A; Mon, 24 Jan 2022 11:20:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6AFDF612FA; Mon, 24 Jan 2022 19:20:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C996C340E5; Mon, 24 Jan 2022 19:20:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052000; bh=6DzRQODJCjeMyBnMxcQy/tJblSzRKBAhvfHA3MzPxh0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R05fWYbiTuO0n3zCr3lQI5CfgOuA+8NwMM1SToPClI9HPq3p5hTS9E2DMDorhZ305 vDnPcjZ0IaEvgf6JVa8zAjhLxs+KZOoZdiJw/lPUV9DEp6Xw8KHiOOSVc+tCjrWvRw ZgL7Ef4nAXnmkV4mvlox1uMhfejHvzxDEcjAkEDE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Berg , Luca Coelho , Sasha Levin Subject: [PATCH 4.19 156/239] iwlwifi: remove module loading failure message Date: Mon, 24 Jan 2022 19:43:14 +0100 Message-Id: <20220124183948.051913651@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johannes Berg [ Upstream commit 6518f83ffa51131daaf439b66094f684da3fb0ae ] When CONFIG_DEBUG_TEST_DRIVER_REMOVE is set, iwlwifi crashes when the opmode module cannot be loaded, due to completing the completion before using drv->dev, which can then already be freed. Fix this by removing the (fairly useless) message. Moving the completion later causes a deadlock instead, so that's not an option. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/20211210091245.289008-2-luca@coelho.fi Signed-off-by: Luca Coelho Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wir= eless/intel/iwlwifi/iwl-drv.c index 72f5df66cdeb5..c44108823f796 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -1532,15 +1532,8 @@ static void iwl_req_fw_callback(const struct firmwar= e *ucode_raw, void *context) * else from proceeding if the module fails to load * or hangs loading. */ - if (load_module) { + if (load_module) request_module("%s", op->name); -#ifdef CONFIG_IWLWIFI_OPMODE_MODULAR - if (err) - IWL_ERR(drv, - "failed to load module %s (error %d), is dynamic loading enabled?\n", - op->name, err); -#endif - } failure =3D false; goto free; =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FFE8C3526E for ; Mon, 24 Jan 2022 19:56:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358630AbiAXTzd (ORCPT ); Mon, 24 Jan 2022 14:55:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54242 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349082AbiAXTlA (ORCPT ); Mon, 24 Jan 2022 14:41:00 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 76CDAC07A96C; Mon, 24 Jan 2022 11:20:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3EBA3B81215; Mon, 24 Jan 2022 19:20:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58DDFC340E5; Mon, 24 Jan 2022 19:20:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052004; bh=1Qg4OYv91lGRhtfStxqbwAGY3ECUEntVoppTLd+0S4o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=A9Uj6CFTTfXzpr6fdOM4jkksHmxEN7CzXaaBNvuTXoq8rhbtiZJctfW/iAuWWflIz ch3ScCfMPiJoTOZqvLM451Qflm9X1Yb2eYJhFlejTXNKZNXF/mNPJI4u+Ji8GVOoAq LXUbIyRBGvGe9U/0YJmFT6IxVj7AlO/2ckjYZJqc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ilan Peer , Luca Coelho , Sasha Levin Subject: [PATCH 4.19 157/239] iwlwifi: mvm: Fix calculation of frame length Date: Mon, 24 Jan 2022 19:43:15 +0100 Message-Id: <20220124183948.089617963@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ilan Peer [ Upstream commit 40a0b38d7a7f91a6027287e0df54f5f547e8d27e ] The RADA might include in the Rx frame the MIC and CRC bytes. These bytes should be removed for non monitor interfaces and should not be passed to mac80211. Fix the Rx processing to remove the extra bytes on non monitor cases. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20211219121514.098be12c801e.I1d8173= 3d8a75b84c3b20eb6e0d14ab3405ca6a86@changeid Signed-off-by: Luca Coelho Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wi= reless/intel/iwlwifi/mvm/rxmq.c index 77e3694536421..9a4848d69e9e1 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c @@ -151,12 +151,39 @@ static int iwl_mvm_create_skb(struct iwl_mvm *mvm, st= ruct sk_buff *skb, struct iwl_rx_mpdu_desc *desc =3D (void *)pkt->data; unsigned int headlen, fraglen, pad_len =3D 0; unsigned int hdrlen =3D ieee80211_hdrlen(hdr->frame_control); + u8 mic_crc_len =3D u8_get_bits(desc->mac_flags1, + IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK) << 1; =20 if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) { len -=3D 2; pad_len =3D 2; } =20 + /* + * For non monitor interface strip the bytes the RADA might not have + * removed. As monitor interface cannot exist with other interfaces + * this removal is safe. + */ + if (mic_crc_len && !ieee80211_hw_check(mvm->hw, RX_INCLUDES_FCS)) { + u32 pkt_flags =3D le32_to_cpu(pkt->len_n_flags); + + /* + * If RADA was not enabled then decryption was not performed so + * the MIC cannot be removed. + */ + if (!(pkt_flags & FH_RSCSR_RADA_EN)) { + if (WARN_ON(crypt_len > mic_crc_len)) + return -EINVAL; + + mic_crc_len -=3D crypt_len; + } + + if (WARN_ON(mic_crc_len > len)) + return -EINVAL; + + len -=3D mic_crc_len; + } + /* If frame is small enough to fit in skb->head, pull it completely. * If not, only pull ieee80211_hdr (including crypto if present, and * an additional 8 bytes for SNAP/ethertype, see below) so that --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EAF6BC433FE for ; Mon, 24 Jan 2022 19:29:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344418AbiAXT3N (ORCPT ); Mon, 24 Jan 2022 14:29:13 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48746 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349071AbiAXTUK (ORCPT ); Mon, 24 Jan 2022 14:20:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9883861317; Mon, 24 Jan 2022 19:20:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B519C340E5; Mon, 24 Jan 2022 19:20:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052007; bh=2POWAd983rmLTzegXs88h1p/oWSCn2Gje3KOmqdlqlE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xDLkIggJJkhbAjEoxs69bGRik1FUaEzrCKhHAANX8zagDJIt86KV7LZ5HL8tH+E1J 8u2Dkrsq1ZMf2mENYm98C004X7e/7TVWpQkwXq1v2aXQ2ZCJ70wd42rvsQSOvsrdrp 2yZokeLtLH21zXOc/rOCo25eS0H7mxFBVIYBo6gA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Jeff Dike , Richard Weinberger , Anton Ivanov , linux-um@lists.infradead.org, Sasha Levin Subject: [PATCH 4.19 158/239] um: registers: Rename function names to avoid conflicts and build problems Date: Mon, 24 Jan 2022 19:43:16 +0100 Message-Id: <20220124183948.120592624@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 077b7320942b64b0da182aefd83c374462a65535 ] The function names init_registers() and restore_registers() are used in several net/ethernet/ and gpu/drm/ drivers for other purposes (not calls to UML functions), so rename them. This fixes multiple build errors. Signed-off-by: Randy Dunlap Cc: Jeff Dike Cc: Richard Weinberger Cc: Anton Ivanov Cc: linux-um@lists.infradead.org Signed-off-by: Richard Weinberger Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/um/include/shared/registers.h | 4 ++-- arch/um/os-Linux/registers.c | 4 ++-- arch/um/os-Linux/start_up.c | 2 +- arch/x86/um/syscalls_64.c | 3 ++- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/arch/um/include/shared/registers.h b/arch/um/include/shared/re= gisters.h index a74449b5b0e31..12ad7c435e97f 100644 --- a/arch/um/include/shared/registers.h +++ b/arch/um/include/shared/registers.h @@ -16,8 +16,8 @@ extern int restore_fp_registers(int pid, unsigned long *f= p_regs); extern int save_fpx_registers(int pid, unsigned long *fp_regs); extern int restore_fpx_registers(int pid, unsigned long *fp_regs); extern int save_registers(int pid, struct uml_pt_regs *regs); -extern int restore_registers(int pid, struct uml_pt_regs *regs); -extern int init_registers(int pid); +extern int restore_pid_registers(int pid, struct uml_pt_regs *regs); +extern int init_pid_registers(int pid); extern void get_safe_registers(unsigned long *regs, unsigned long *fp_regs= ); extern unsigned long get_thread_reg(int reg, jmp_buf *buf); extern int get_fp_registers(int pid, unsigned long *regs); diff --git a/arch/um/os-Linux/registers.c b/arch/um/os-Linux/registers.c index 2ff8d4fe83c4f..34a5963bd7efd 100644 --- a/arch/um/os-Linux/registers.c +++ b/arch/um/os-Linux/registers.c @@ -21,7 +21,7 @@ int save_registers(int pid, struct uml_pt_regs *regs) return 0; } =20 -int restore_registers(int pid, struct uml_pt_regs *regs) +int restore_pid_registers(int pid, struct uml_pt_regs *regs) { int err; =20 @@ -36,7 +36,7 @@ int restore_registers(int pid, struct uml_pt_regs *regs) static unsigned long exec_regs[MAX_REG_NR]; static unsigned long exec_fp_regs[FP_SIZE]; =20 -int init_registers(int pid) +int init_pid_registers(int pid) { int err; =20 diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c index 82bf5f8442ba4..2c75f2d638681 100644 --- a/arch/um/os-Linux/start_up.c +++ b/arch/um/os-Linux/start_up.c @@ -336,7 +336,7 @@ void __init os_early_checks(void) check_tmpexec(); =20 pid =3D start_ptraced_child(); - if (init_registers(pid)) + if (init_pid_registers(pid)) fatal("Failed to initialize default registers"); stop_ptraced_child(pid, 1, 1); } diff --git a/arch/x86/um/syscalls_64.c b/arch/x86/um/syscalls_64.c index 58f51667e2e4b..8249685b40960 100644 --- a/arch/x86/um/syscalls_64.c +++ b/arch/x86/um/syscalls_64.c @@ -11,6 +11,7 @@ #include #include /* XXX This should get the constants from libc */ #include +#include =20 long arch_prctl(struct task_struct *task, int option, unsigned long __user *arg2) @@ -35,7 +36,7 @@ long arch_prctl(struct task_struct *task, int option, switch (option) { case ARCH_SET_FS: case ARCH_SET_GS: - ret =3D restore_registers(pid, ¤t->thread.regs.regs); + ret =3D restore_pid_registers(pid, ¤t->thread.regs.regs); if (ret) return ret; break; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87ADCC433EF for ; Mon, 24 Jan 2022 19:29:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347188AbiAXT32 (ORCPT ); Mon, 24 Jan 2022 14:29:28 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:44520 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349083AbiAXTUN (ORCPT ); Mon, 24 Jan 2022 14:20:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 71EE4B81215; Mon, 24 Jan 2022 19:20:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94417C340E5; Mon, 24 Jan 2022 19:20:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052010; bh=M+C72fu1TYuBwspSurqtW2dRhsY/waKoaRw+xlfV8vU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BxMsxa6TzSlU3/JHVxDaAGXU4ztvrKlAhWzcfpLK4aw342JT1yw9XVrfMRR/Z0HYe IL/p723GXn0AxyxV4KI9XV0T6bHQWoJz/wg22wPJJSm2KsXOyn887yLC2s9R/+oVbu 7qhQXWFOapGYXOFm09xCpthIPVjcn9YLyQH0z6xw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kyeong Yoo , Richard Weinberger , Sasha Levin Subject: [PATCH 4.19 159/239] jffs2: GC deadlock reading a page that is used in jffs2_write_begin() Date: Mon, 24 Jan 2022 19:43:17 +0100 Message-Id: <20220124183948.151995130@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kyeong Yoo [ Upstream commit aa39cc675799bc92da153af9a13d6f969c348e82 ] GC task can deadlock in read_cache_page() because it may attempt to release a page that is actually allocated by another task in jffs2_write_begin(). The reason is that in jffs2_write_begin() there is a small window a cache page is allocated for use but not set Uptodate yet. This ends up with a deadlock between two tasks: 1) A task (e.g. file copy) - jffs2_write_begin() locks a cache page - jffs2_write_end() tries to lock "alloc_sem" from jffs2_reserve_space() <-- STUCK 2) GC task (jffs2_gcd_mtd3) - jffs2_garbage_collect_pass() locks "alloc_sem" - try to lock the same cache page in read_cache_page() <-- STUCK So to avoid this deadlock, hold "alloc_sem" in jffs2_write_begin() while reading data in a cache page. Signed-off-by: Kyeong Yoo Signed-off-by: Richard Weinberger Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/jffs2/file.c | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c index 7d8654a1472ef..3047872fdac9b 100644 --- a/fs/jffs2/file.c +++ b/fs/jffs2/file.c @@ -135,20 +135,15 @@ static int jffs2_write_begin(struct file *filp, struc= t address_space *mapping, struct page *pg; struct inode *inode =3D mapping->host; struct jffs2_inode_info *f =3D JFFS2_INODE_INFO(inode); + struct jffs2_sb_info *c =3D JFFS2_SB_INFO(inode->i_sb); pgoff_t index =3D pos >> PAGE_SHIFT; uint32_t pageofs =3D index << PAGE_SHIFT; int ret =3D 0; =20 - pg =3D grab_cache_page_write_begin(mapping, index, flags); - if (!pg) - return -ENOMEM; - *pagep =3D pg; - jffs2_dbg(1, "%s()\n", __func__); =20 if (pageofs > inode->i_size) { /* Make new hole frag from old EOF to new page */ - struct jffs2_sb_info *c =3D JFFS2_SB_INFO(inode->i_sb); struct jffs2_raw_inode ri; struct jffs2_full_dnode *fn; uint32_t alloc_len; @@ -159,7 +154,7 @@ static int jffs2_write_begin(struct file *filp, struct = address_space *mapping, ret =3D jffs2_reserve_space(c, sizeof(ri), &alloc_len, ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); if (ret) - goto out_page; + goto out_err; =20 mutex_lock(&f->sem); memset(&ri, 0, sizeof(ri)); @@ -189,7 +184,7 @@ static int jffs2_write_begin(struct file *filp, struct = address_space *mapping, ret =3D PTR_ERR(fn); jffs2_complete_reservation(c); mutex_unlock(&f->sem); - goto out_page; + goto out_err; } ret =3D jffs2_add_full_dnode_to_inode(c, f, fn); if (f->metadata) { @@ -204,13 +199,26 @@ static int jffs2_write_begin(struct file *filp, struc= t address_space *mapping, jffs2_free_full_dnode(fn); jffs2_complete_reservation(c); mutex_unlock(&f->sem); - goto out_page; + goto out_err; } jffs2_complete_reservation(c); inode->i_size =3D pageofs; mutex_unlock(&f->sem); } =20 + /* + * While getting a page and reading data in, lock c->alloc_sem until + * the page is Uptodate. Otherwise GC task may attempt to read the same + * page in read_cache_page(), which causes a deadlock. + */ + mutex_lock(&c->alloc_sem); + pg =3D grab_cache_page_write_begin(mapping, index, flags); + if (!pg) { + ret =3D -ENOMEM; + goto release_sem; + } + *pagep =3D pg; + /* * Read in the page if it wasn't already present. Cannot optimize away * the whole page write case until jffs2_write_end can handle the @@ -220,15 +228,17 @@ static int jffs2_write_begin(struct file *filp, struc= t address_space *mapping, mutex_lock(&f->sem); ret =3D jffs2_do_readpage_nolock(inode, pg); mutex_unlock(&f->sem); - if (ret) - goto out_page; + if (ret) { + unlock_page(pg); + put_page(pg); + goto release_sem; + } } jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags); - return ret; =20 -out_page: - unlock_page(pg); - put_page(pg); +release_sem: + mutex_unlock(&c->alloc_sem); +out_err: return ret; } =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A739C433F5 for ; Mon, 24 Jan 2022 19:31:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352079AbiAXT3f (ORCPT ); Mon, 24 Jan 2022 14:29:35 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43174 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349106AbiAXTUP (ORCPT ); Mon, 24 Jan 2022 14:20:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 816F7B81233; Mon, 24 Jan 2022 19:20:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF6F7C340E5; Mon, 24 Jan 2022 19:20:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052013; bh=FNVb3dcHIBLomxyIdcLDZf6bDvbLp1BTjjK8xjoWU5A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0A+q92prHDfR3XAGLy/4WSH7WfDVvdPQjqOe6TVMwRPRQJcl37twItikpUs1q/MyX BvKQbC6VHBb8lnkZ9q91ygqIzlVCkrPfWhAzprsJ68eazyKE98JjJ/t3zaNK7OwEBy oPSrBqtcKYmN80Vc4q4X6pIW81H4fCVfdJW8JUAo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Langsdorf , Bob Moore , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 4.19 160/239] ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions Date: Mon, 24 Jan 2022 19:43:18 +0100 Message-Id: <20220124183948.185753446@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Langsdorf [ Upstream commit f81bdeaf816142e0729eea0cc84c395ec9673151 ] ACPICA commit bc02c76d518135531483dfc276ed28b7ee632ce1 The current ACPI_ACCESS_*_WIDTH defines do not provide a way to test that size is small enough to not cause an overflow when applied to a 32-bit integer. Rather than adding more magic numbers, add ACPI_ACCESS_*_SHIFT, ACPI_ACCESS_*_MAX, and ACPI_ACCESS_*_DEFAULT #defines and redefine ACPI_ACCESS_*_WIDTH in terms of the new #defines. This was inititally reported on Linux where a size of 102 in ACPI_ACCESS_BIT_WIDTH caused an overflow error in the SPCR initialization code. Link: https://github.com/acpica/acpica/commit/bc02c76d Signed-off-by: Mark Langsdorf Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/acpi/actypes.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h index 2939a6cd7fecb..9fc1dfc7f4c32 100644 --- a/include/acpi/actypes.h +++ b/include/acpi/actypes.h @@ -532,8 +532,14 @@ typedef u64 acpi_integer; * Can be used with access_width of struct acpi_generic_address and access= _size of * struct acpi_resource_generic_register. */ -#define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + 2)) -#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) - 1)) +#define ACPI_ACCESS_BIT_SHIFT 2 +#define ACPI_ACCESS_BYTE_SHIFT -1 +#define ACPI_ACCESS_BIT_MAX (31 - ACPI_ACCESS_BIT_SHIFT) +#define ACPI_ACCESS_BYTE_MAX (31 - ACPI_ACCESS_BYTE_SHIFT) +#define ACPI_ACCESS_BIT_DEFAULT (8 - ACPI_ACCESS_BIT_SHIFT) +#define ACPI_ACCESS_BYTE_DEFAULT (8 - ACPI_ACCESS_BYTE_SHIFT) +#define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + ACPI_ACCESS_BIT_SHIFT)) +#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) + ACPI_ACCESS_BYTE_SHIF= T)) =20 /*************************************************************************= ****** * --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A818C433FE for ; Mon, 24 Jan 2022 19:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358648AbiAXTze (ORCPT ); Mon, 24 Jan 2022 14:55:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55250 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349088AbiAXTlA (ORCPT ); Mon, 24 Jan 2022 14:41:00 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D4DDC07A96E; Mon, 24 Jan 2022 11:20:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2B27060010; Mon, 24 Jan 2022 19:20:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F165BC340E8; Mon, 24 Jan 2022 19:20:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052019; bh=7z0emsLHzxyyyK8JWHHyYkGDcaTiOkQ8xx+Sr2z/9nk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ufSMoEWayBjVU7LYzvDVhxIOdo/qMLbNEqCLP7fo+cWLBEyDe9SePQMcqM7vgvUFs XDlwxbatxuK6iDdJSKVNZiTmnUPRvynKIznBAEC/ms81syrw/vXygVBjpJZs3+g4wb c3x36aJPq9V7bsje+qr/Ba9Zgt0gk7L0EUPyW6sQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Asselstine , "Rafael J. Wysocki" , Bob Moore , Sasha Levin Subject: [PATCH 4.19 161/239] ACPICA: Utilities: Avoid deleting the same object twice in a row Date: Mon, 24 Jan 2022 19:43:19 +0100 Message-Id: <20220124183948.217644407@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rafael J. Wysocki [ Upstream commit 1cdfe9e346b4c5509ffe19ccde880fd259d9f7a3 ] ACPICA commit c11af67d8f7e3d381068ce7771322f2b5324d687 If original_count is 0 in acpi_ut_update_ref_count (), acpi_ut_delete_internal_obj () is invoked for the target object, which is incorrect, because that object has been deleted once already and the memory allocated to store it may have been reclaimed and allocated for a different purpose by the host OS. Moreover, a confusing debug message following the "Reference Count is already zero, cannot decrement" warning is printed in that case. To fix this issue, make acpi_ut_update_ref_count () return after finding that original_count is 0 and printing the above warning. Link: https://github.com/acpica/acpica/commit/c11af67d Link: https://github.com/acpica/acpica/pull/652 Reported-by: Mark Asselstine Signed-off-by: Rafael J. Wysocki Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/acpi/acpica/utdelete.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c index 0dc8dea815823..db79a826e6b8d 100644 --- a/drivers/acpi/acpica/utdelete.c +++ b/drivers/acpi/acpica/utdelete.c @@ -410,6 +410,7 @@ acpi_ut_update_ref_count(union acpi_operand_object *obj= ect, u32 action) ACPI_WARNING((AE_INFO, "Obj %p, Reference Count is already zero, cannot decrement\n", object)); + return; } =20 ACPI_DEBUG_PRINT_RAW((ACPI_DB_ALLOCATIONS, --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11060C433EF for ; Mon, 24 Jan 2022 19:51:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350023AbiAXTvo (ORCPT ); Mon, 24 Jan 2022 14:51:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349109AbiAXTlB (ORCPT ); Mon, 24 Jan 2022 14:41:01 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7386C07A96F; Mon, 24 Jan 2022 11:20:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7195761361; Mon, 24 Jan 2022 19:20:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 307ACC340E5; Mon, 24 Jan 2022 19:20:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052022; bh=vRc4FKxoBlp4SE/upsbfd9TZfulO9790g5FOheuat9w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mmlyMMWV6JmWCnD/Nr77xDNHTqpURnPqLCDYOavtDA3uDiai7A0nKwtb85MesVjaE k4abunRlLa+sc1jKMCjlLN4etx6NEaWLpOcIH2ea3yC+u3+loJrGPZnr2WYTVpfLlT aB4eHnJkTnGS0RADEaNm/SMbAyvURu8qCM23FBz0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lenny Szubowicz , "Rafael J. Wysocki" , Bob Moore , Sasha Levin Subject: [PATCH 4.19 162/239] ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Date: Mon, 24 Jan 2022 19:43:20 +0100 Message-Id: <20220124183948.249471660@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rafael J. Wysocki [ Upstream commit 24ea5f90ec9548044a6209685c5010edd66ffe8f ] ACPICA commit d984f12041392fa4156b52e2f7e5c5e7bc38ad9e If Operand[0] is a reference of the ACPI_REFCLASS_REFOF class, acpi_ex_opcode_1A_0T_1R () calls acpi_ns_get_attached_object () to obtain return_desc which may require additional resolution with the help of acpi_ex_read_data_from_field (). If the latter fails, the reference counter of the original return_desc is decremented which is incorrect, because acpi_ns_get_attached_object () does not increment the reference counter of the object returned by it. This issue may lead to premature deletion of the attached object while it is still attached and a use-after-free and crash in the host OS. For example, this may happen when on evaluation of ref_of() a local region field where there is no registered handler for the given Operation Region. Fix it by making acpi_ex_opcode_1A_0T_1R () return Status right away after a acpi_ex_read_data_from_field () failure. Link: https://github.com/acpica/acpica/commit/d984f120 Link: https://github.com/acpica/acpica/pull/685 Reported-by: Lenny Szubowicz Signed-off-by: Rafael J. Wysocki Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/acpi/acpica/exoparg1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c index ba9fbae0cf91f..319f4bc6a8394 100644 --- a/drivers/acpi/acpica/exoparg1.c +++ b/drivers/acpi/acpica/exoparg1.c @@ -1007,7 +1007,8 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_= state *walk_state) (walk_state, return_desc, &temp_desc); if (ACPI_FAILURE(status)) { - goto cleanup; + return_ACPI_STATUS + (status); } =20 return_desc =3D temp_desc; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7FDFC433F5 for ; Mon, 24 Jan 2022 19:51:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357800AbiAXTvx (ORCPT ); Mon, 24 Jan 2022 14:51:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349134AbiAXTlB (ORCPT ); Mon, 24 Jan 2022 14:41:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62986C07A970; Mon, 24 Jan 2022 11:20:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1DAA6B810BD; Mon, 24 Jan 2022 19:20:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43535C340E5; Mon, 24 Jan 2022 19:20:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052025; bh=6NDXrddUvSfe0I2HKh1EdO5J80jG1dYvDOHuf3zhnZE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wj1sMAt6hFpEqE5RRsxheTeF0Ws0EIZFFLZ/y0RBwqiLlchidPc3J3oej4uPvbijq C7S+T0Hyf1tpEOimSyyGFtm/ym+uJAcS8ql3bq76UdiJQqlCn7PsRjkhO5IMHfsAkA GWFOHgjTAEeBeinNMB8c1QJCGy4Lk3zsKX9K1MGw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Kirill A. Shutemov" , "Rafael J. Wysocki" , Bob Moore , Sasha Levin Subject: [PATCH 4.19 163/239] ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 Date: Mon, 24 Jan 2022 19:43:21 +0100 Message-Id: <20220124183948.281676149@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kirill A. Shutemov [ Upstream commit 1d4e0b3abb168b2ee1eca99c527cffa1b80b6161 ] ACPICA commit 3dd7e1f3996456ef81bfe14cba29860e8d42949e According to ACPI 6.4, Section 16.2, the CPU cache flushing is required on entering to S1, S2, and S3, but the ACPICA code flushes the CPU cache regardless of the sleep state. Blind cache flush on entering S5 causes problems for TDX. Flushing happens with WBINVD that is not supported in the TDX environment. TDX only supports S5 and adjusting ACPICA code to conform to the spec more strictly fixes the issue. Link: https://github.com/acpica/acpica/commit/3dd7e1f3 Signed-off-by: Kirill A. Shutemov [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/acpi/acpica/hwesleep.c | 4 +++- drivers/acpi/acpica/hwsleep.c | 4 +++- drivers/acpi/acpica/hwxfsleep.c | 2 -- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c index 9516966124ae3..9380a5e214da4 100644 --- a/drivers/acpi/acpica/hwesleep.c +++ b/drivers/acpi/acpica/hwesleep.c @@ -104,7 +104,9 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state) =20 /* Flush caches, as per ACPI specification */ =20 - ACPI_FLUSH_CPU_CACHE(); + if (sleep_state < ACPI_STATE_S4) { + ACPI_FLUSH_CPU_CACHE(); + } =20 status =3D acpi_os_enter_sleep(sleep_state, sleep_control, 0); if (status =3D=3D AE_CTRL_TERMINATE) { diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c index f4282370947c8..6368ff544af1a 100644 --- a/drivers/acpi/acpica/hwsleep.c +++ b/drivers/acpi/acpica/hwsleep.c @@ -110,7 +110,9 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state) =20 /* Flush caches, as per ACPI specification */ =20 - ACPI_FLUSH_CPU_CACHE(); + if (sleep_state < ACPI_STATE_S4) { + ACPI_FLUSH_CPU_CACHE(); + } =20 status =3D acpi_os_enter_sleep(sleep_state, pm1a_control, pm1b_control); if (status =3D=3D AE_CTRL_TERMINATE) { diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfslee= p.c index dc1e44ccaae20..d0dca7dae080c 100644 --- a/drivers/acpi/acpica/hwxfsleep.c +++ b/drivers/acpi/acpica/hwxfsleep.c @@ -189,8 +189,6 @@ acpi_status acpi_enter_sleep_state_s4bios(void) return_ACPI_STATUS(status); } =20 - ACPI_FLUSH_CPU_CACHE(); - status =3D acpi_hw_write_port(acpi_gbl_FADT.smi_command, (u32)acpi_gbl_FADT.s4_bios_request, 8); =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98434C2BA4C for ; Mon, 24 Jan 2022 19:56:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358460AbiAXTzR (ORCPT ); Mon, 24 Jan 2022 14:55:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54692 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353078AbiAXTlC (ORCPT ); Mon, 24 Jan 2022 14:41:02 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 45DA1C07A971; Mon, 24 Jan 2022 11:20:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0464BB8119D; Mon, 24 Jan 2022 19:20:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C211C340E5; Mon, 24 Jan 2022 19:20:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052028; bh=9KzqLyWNPtNjyKUaNk7Wi21QeiU1/TQnVwSNi8tWifw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aHx3LxLW0ZrOT4uJ6kDdkihNbFMjIdTjaX5WzzbnhFEmH7RcSVzziC9XDhM33yTM0 aRJtrAMrhG9z1i74ZeWpvGcM3wIhfxLzR0XCZ7FHgzOnbm5W63q5e4gLjzAsazdJPP EsyYdC02cE9QpaMrbuohc2m1G6pun/7LAfrsd9MM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zongmin Zhou , Alex Deucher , Sasha Levin Subject: [PATCH 4.19 164/239] drm/amdgpu: fixup bad vram size on gmc v8 Date: Mon, 24 Jan 2022 19:43:22 +0100 Message-Id: <20220124183948.311273742@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zongmin Zhou [ Upstream commit 11544d77e3974924c5a9c8a8320b996a3e9b2f8b ] Some boards(like RX550) seem to have garbage in the upper 16 bits of the vram size register. Check for this and clamp the size properly. Fixes boards reporting bogus amounts of vram. after add this patch,the maximum GPU VRAM size is 64GB, otherwise only 64GB vram size will be used. Signed-off-by: Zongmin Zhou Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/am= dgpu/gmc_v8_0.c index 1a744f964b301..358004a4650b6 100644 --- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c @@ -520,10 +520,10 @@ static void gmc_v8_0_mc_program(struct amdgpu_device = *adev) static int gmc_v8_0_mc_init(struct amdgpu_device *adev) { int r; + u32 tmp; =20 adev->gmc.vram_width =3D amdgpu_atombios_get_vram_width(adev); if (!adev->gmc.vram_width) { - u32 tmp; int chansize, numchan; =20 /* Get VRAM informations */ @@ -567,8 +567,15 @@ static int gmc_v8_0_mc_init(struct amdgpu_device *adev) adev->gmc.vram_width =3D numchan * chansize; } /* size in MB on si */ - adev->gmc.mc_vram_size =3D RREG32(mmCONFIG_MEMSIZE) * 1024ULL * 1024ULL; - adev->gmc.real_vram_size =3D RREG32(mmCONFIG_MEMSIZE) * 1024ULL * 1024ULL; + tmp =3D RREG32(mmCONFIG_MEMSIZE); + /* some boards may have garbage in the upper 16 bits */ + if (tmp & 0xffff0000) { + DRM_INFO("Probable bad vram size: 0x%08x\n", tmp); + if (tmp & 0xffff) + tmp &=3D 0xffff; + } + adev->gmc.mc_vram_size =3D tmp * 1024ULL * 1024ULL; + adev->gmc.real_vram_size =3D adev->gmc.mc_vram_size; =20 if (!(adev->flags & AMD_IS_APU)) { r =3D amdgpu_device_resize_fb_bar(adev); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A939C433FE for ; Mon, 24 Jan 2022 19:31:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352242AbiAXT34 (ORCPT ); Mon, 24 Jan 2022 14:29:56 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:44700 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349302AbiAXTUe (ORCPT ); Mon, 24 Jan 2022 14:20:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4405BB8119D; Mon, 24 Jan 2022 19:20:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A82CC340E5; Mon, 24 Jan 2022 19:20:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052032; bh=fvew88oc9rXfBgGTAJEf7GitKFB3blNqbg6pMgytd3s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YjZhMRTBr66WL2EE89plmcLMb8PvXDD+cxQDlRErASYkKDWYf/6yN7Kaj+dEFT4vT PyjItSInFhlLjt7OwZ0UbcklySoBDDgl/yU0f6jkAgalBdbVynJZgA/Qe7kKgEVGmM HZE8bUX7UVcJFUsydPPmyOR65YwSOoeNgB06WlaQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Hans de Goede , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 4.19 165/239] ACPI: battery: Add the ThinkPad "Not Charging" quirk Date: Mon, 24 Jan 2022 19:43:23 +0100 Message-Id: <20220124183948.340959603@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Thomas Wei=C3=9Fschuh [ Upstream commit e96c1197aca628f7d2480a1cc3214912b40b3414 ] The EC/ACPI firmware on Lenovo ThinkPads used to report a status of "Unknown" when the battery is between the charge start and charge stop thresholds. On Windows, it reports "Not Charging" so the quirk has been added to also report correctly. Now the "status" attribute returns "Not Charging" when the battery on ThinkPads is not physicaly charging. Signed-off-by: Thomas Wei=C3=9Fschuh Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/acpi/battery.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index 0bbf8b453ebf2..d4e42a578e186 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -78,6 +78,7 @@ static int battery_bix_broken_package; static int battery_notification_delay_ms; static int battery_ac_is_broken; static int battery_check_pmic =3D 1; +static int battery_quirk_notcharging; static unsigned int cache_time =3D 1000; module_param(cache_time, uint, 0644); MODULE_PARM_DESC(cache_time, "cache time in milliseconds"); @@ -246,6 +247,8 @@ static int acpi_battery_get_property(struct power_suppl= y *psy, val->intval =3D POWER_SUPPLY_STATUS_CHARGING; else if (acpi_battery_is_charged(battery)) val->intval =3D POWER_SUPPLY_STATUS_FULL; + else if (battery_quirk_notcharging) + val->intval =3D POWER_SUPPLY_STATUS_NOT_CHARGING; else val->intval =3D POWER_SUPPLY_STATUS_UNKNOWN; break; @@ -1350,6 +1353,12 @@ battery_do_not_check_pmic_quirk(const struct dmi_sys= tem_id *d) return 0; } =20 +static int __init battery_quirk_not_charging(const struct dmi_system_id *d) +{ + battery_quirk_notcharging =3D 1; + return 0; +} + static const struct dmi_system_id bat_dmi_table[] __initconst =3D { { /* NEC LZ750/LS */ @@ -1394,6 +1403,19 @@ static const struct dmi_system_id bat_dmi_table[] __= initconst =3D { DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 320-10ICR"), }, }, + { + /* + * On Lenovo ThinkPads the BIOS specification defines + * a state when the bits for charging and discharging + * are both set to 0. That state is "Not Charging". + */ + .callback =3D battery_quirk_not_charging, + .ident =3D "Lenovo ThinkPad", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"), + }, + }, {}, }; =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C86CC43217 for ; Mon, 24 Jan 2022 19:31:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352313AbiAXTaF (ORCPT ); Mon, 24 Jan 2022 14:30:05 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:44724 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349341AbiAXTUh (ORCPT ); Mon, 24 Jan 2022 14:20:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3BC24B810BD; Mon, 24 Jan 2022 19:20:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7262CC340E7; Mon, 24 Jan 2022 19:20:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052035; bh=SxxwnMfSk4Ap3HH/T1GeP+W5fi6E/M5OdYQhitu79yk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e72Hn5sFajy4h1zZg/RbmmazIGreaOXS3OBA5wYVDMo+aNcMT2zHsMKv+kijZqEEC XF9u25h8fFVmuEnJ3NqosSNh/WftrlJLp3biTwzr7l7H+4fm0C5APGb+04tdx9nbyE kEtvq8vnz9SVTsaNns2nZ85OKAYHZ1l2fBHXQ3yY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba , Sasha Levin Subject: [PATCH 4.19 166/239] btrfs: remove BUG_ON() in find_parent_nodes() Date: Mon, 24 Jan 2022 19:43:24 +0100 Message-Id: <20220124183948.372038283@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josef Bacik [ Upstream commit fcba0120edf88328524a4878d1d6f4ad39f2ec81 ] We search for an extent entry with .offset =3D -1, which shouldn't be a thing, but corruption happens. Add an ASSERT() for the developers, return -EUCLEAN for mortals. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/btrfs/backref.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index 6b8824de2abb2..0073182d4e689 100644 --- a/fs/btrfs/backref.c +++ b/fs/btrfs/backref.c @@ -1160,7 +1160,12 @@ again: ret =3D btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0); if (ret < 0) goto out; - BUG_ON(ret =3D=3D 0); + if (ret =3D=3D 0) { + /* This shouldn't happen, indicates a bug or fs corruption. */ + ASSERT(ret !=3D 0); + ret =3D -EUCLEAN; + goto out; + } =20 #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS if (trans && likely(trans->type !=3D __TRANS_DUMMY) && --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6053AC4321E for ; Mon, 24 Jan 2022 20:00:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359562AbiAXT7t (ORCPT ); Mon, 24 Jan 2022 14:59:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54694 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353154AbiAXTlB (ORCPT ); Mon, 24 Jan 2022 14:41:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 64064C07A972; Mon, 24 Jan 2022 11:20:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1B01CB8122C; Mon, 24 Jan 2022 19:20:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 46767C340E5; Mon, 24 Jan 2022 19:20:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052037; bh=9k+0td24Rq5fuWTlvA2sDlkDcCThTqWcZMKgeg9KNVY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1Eqe0TGlFk8oNlIyukGA1flwlkEXdv2JOCXydv9Joha0eN+gQRNKF96B4wJjXfuyC 4jmtdB0ynLlcqYZjE5fdToEn2W8MeOwrkQ8djUXq85n1vom1TpvnVVztXEg10irHcA FGchTktuXwaFg4PN8IVNyimeV4aAFMLrScfYDok0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba , Sasha Levin Subject: [PATCH 4.19 167/239] btrfs: remove BUG_ON(!eie) in find_parent_nodes Date: Mon, 24 Jan 2022 19:43:25 +0100 Message-Id: <20220124183948.403152892@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josef Bacik [ Upstream commit 9f05c09d6baef789726346397438cca4ec43c3ee ] If we're looking for leafs that point to a data extent we want to record the extent items that point at our bytenr. At this point we have the reference and we know for a fact that this leaf should have a reference to our bytenr. However if there's some sort of corruption we may not find any references to our leaf, and thus could end up with eie =3D=3D NULL. Replace this BUG_ON() with an ASSERT() and then return -EUCLEAN for the mortals. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/btrfs/backref.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index 0073182d4e689..3fe15d6f40873 100644 --- a/fs/btrfs/backref.c +++ b/fs/btrfs/backref.c @@ -1313,10 +1313,18 @@ again: goto out; if (!ret && extent_item_pos) { /* - * we've recorded that parent, so we must extend - * its inode list here + * We've recorded that parent, so we must extend + * its inode list here. + * + * However if there was corruption we may not + * have found an eie, return an error in this + * case. */ - BUG_ON(!eie); + ASSERT(eie); + if (!eie) { + ret =3D -EUCLEAN; + goto out; + } while (eie->next) eie =3D eie->next; eie->next =3D ref->inode_list; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3FF94C47080 for ; Mon, 24 Jan 2022 19:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358549AbiAXTzZ (ORCPT ); Mon, 24 Jan 2022 14:55:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54690 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353222AbiAXTlB (ORCPT ); Mon, 24 Jan 2022 14:41:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21AB5C07A973; Mon, 24 Jan 2022 11:20:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DDA84B8122C; Mon, 24 Jan 2022 19:20:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A343C340E8; Mon, 24 Jan 2022 19:20:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052040; bh=G/c4LNnucpXtwkCHxSEbJWbQlWj6wH/TH00PIgn6fJM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0J4rnQfOCoWUkJhyzQ0OQk46aRoahwgF5ISsxJAaxMI8/apkpMm6fd4+m/osZvY7k nUaNO5brkqhR2b0irVVNPJnnFopi3RVfEa2XmF0yDT641ESWXTq7/7qlKoUu16A9fI JwbFP6f9vM3EcAz6hxKs3aCyEJ1H+T4+uMeD5agU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxime Bizon , Florian Fainelli , Andrew Lunn , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 168/239] net: mdio: Demote probed message to debug print Date: Mon, 24 Jan 2022 19:43:26 +0100 Message-Id: <20220124183948.439360846@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Fainelli [ Upstream commit 7590fc6f80ac2cbf23e6b42b668bbeded070850b ] On systems with large numbers of MDIO bus/muxes the message indicating that a given MDIO bus has been successfully probed is repeated for as many buses we have, which can eat up substantial boot time for no reason, demote to a debug print. Reported-by: Maxime Bizon Signed-off-by: Florian Fainelli Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220103194024.2620-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/phy/mdio_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 3207da2224f67..eaa890a6a5d21 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -426,7 +426,7 @@ int __mdiobus_register(struct mii_bus *bus, struct modu= le *owner) mdiobus_setup_mdiodev_from_board_info(bus, mdiobus_create_device); =20 bus->state =3D MDIOBUS_REGISTERED; - pr_info("%s: probed\n", bus->name); + dev_dbg(&bus->dev, "probed\n"); return 0; =20 error: --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7D7DC4707A for ; Mon, 24 Jan 2022 19:56:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358480AbiAXTzT (ORCPT ); Mon, 24 Jan 2022 14:55:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54696 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353371AbiAXTlC (ORCPT ); Mon, 24 Jan 2022 14:41:02 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13839C07A974; Mon, 24 Jan 2022 11:20:45 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AE96EB8121C; Mon, 24 Jan 2022 19:20:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBD82C340E5; Mon, 24 Jan 2022 19:20:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052043; bh=XjqBh/T238oH1vfD/s4WhMqH03h32udr8UJJtPFrAFY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GbVwo8cjkDpyXL4cqassSTIBrLVgsa/SpYanV7pAxiCFHH71V2RlGwW7/KiCEKw+3 94kABVstu9lKCpIOCnJqfk391xHummTobmeXR7MNq1p25yBL95MEXI/rFq1Fwoo08b B3RO3+H5g/77n/444gj6sVwD/qyavoIIOnZLYO/M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Goldwyn Rodrigues , Ping-Ke Shih , Johannes Berg , Sasha Levin Subject: [PATCH 4.19 169/239] mac80211: allow non-standard VHT MCS-10/11 Date: Mon, 24 Jan 2022 19:43:27 +0100 Message-Id: <20220124183948.470185428@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ping-Ke Shih [ Upstream commit 04be6d337d37400ad5b3d5f27ca87645ee5a18a3 ] Some AP can possibly try non-standard VHT rate and mac80211 warns and drops packets, and leads low TCP throughput. Rate marked as a VHT rate but data is invalid: MCS: 10, NSS: 2 WARNING: CPU: 1 PID: 7817 at net/mac80211/rx.c:4856 ieee80211_rx_list+0= x223/0x2f0 [mac8021 Since commit c27aa56a72b8 ("cfg80211: add VHT rate entries for MCS-10 and M= CS-11") has added, mac80211 adds this support as well. After this patch, throughput is good and iw can get the bitrate: rx bitrate: 975.1 MBit/s VHT-MCS 10 80MHz short GI VHT-NSS 2 or rx bitrate: 1083.3 MBit/s VHT-MCS 11 80MHz short GI VHT-NSS 2 Buglink: https://bugzilla.suse.com/show_bug.cgi?id=3D1192891 Reported-by: Goldwyn Rodrigues Signed-off-by: Ping-Ke Shih Link: https://lore.kernel.org/r/20220103013623.17052-1-pkshih@realtek.com Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/mac80211/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index e0baa563a4dea..c42cc79895202 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -4620,7 +4620,7 @@ void ieee80211_rx_napi(struct ieee80211_hw *hw, struc= t ieee80211_sta *pubsta, goto drop; break; case RX_ENC_VHT: - if (WARN_ONCE(status->rate_idx > 9 || + if (WARN_ONCE(status->rate_idx > 11 || !status->nss || status->nss > 8, "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d= \n", --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E4E9C35270 for ; Mon, 24 Jan 2022 19:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358531AbiAXTzY (ORCPT ); Mon, 24 Jan 2022 14:55:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54700 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354104AbiAXTlC (ORCPT ); Mon, 24 Jan 2022 14:41:02 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C4B50C061744; Mon, 24 Jan 2022 11:20:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 80064B811F9; Mon, 24 Jan 2022 19:20:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADFE2C340E5; Mon, 24 Jan 2022 19:20:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052046; bh=Up/mfvhONYj+Dx9dzEmZmji4FSEdxlZp4ge0yxhkITo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VlIFFoP6TC+0d/VNDowc/Gitn5lT6Ggb08ub/tzCLHoeCBQ3Nx2sJKArtjZuFp0jI 9xMTtbEJCnWmuejV8m3RMWnLxFz/g8WF/uLeBWeQutXHcrgYqccL8uzAKv/UqTvtPL bq9SepZYsarGKfr+AYV3M2Lo49mODTw4MMnsY1Bs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joe Thornber , Mike Snitzer , Sasha Levin Subject: [PATCH 4.19 170/239] dm btree: add a defensive bounds check to insert_at() Date: Mon, 24 Jan 2022 19:43:28 +0100 Message-Id: <20220124183948.506574080@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joe Thornber [ Upstream commit 85bca3c05b6cca31625437eedf2060e846c4bbad ] Corrupt metadata could trigger an out of bounds write. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/md/persistent-data/dm-btree.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-= data/dm-btree.c index 8aae0624a2971..6383afb88f319 100644 --- a/drivers/md/persistent-data/dm-btree.c +++ b/drivers/md/persistent-data/dm-btree.c @@ -83,14 +83,16 @@ void inc_children(struct dm_transaction_manager *tm, st= ruct btree_node *n, } =20 static int insert_at(size_t value_size, struct btree_node *node, unsigned = index, - uint64_t key, void *value) - __dm_written_to_disk(value) + uint64_t key, void *value) + __dm_written_to_disk(value) { uint32_t nr_entries =3D le32_to_cpu(node->header.nr_entries); + uint32_t max_entries =3D le32_to_cpu(node->header.max_entries); __le64 key_le =3D cpu_to_le64(key); =20 if (index > nr_entries || - index >=3D le32_to_cpu(node->header.max_entries)) { + index >=3D max_entries || + nr_entries >=3D max_entries) { DMERR("too many entries in btree node for insert"); __dm_unbless_for_disk(value); return -ENOMEM; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC387C43219 for ; Tue, 25 Jan 2022 02:34:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420684AbiAYCZH (ORCPT ); Mon, 24 Jan 2022 21:25:07 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49106 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349496AbiAXTUx (ORCPT ); Mon, 24 Jan 2022 14:20:53 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6804660909; Mon, 24 Jan 2022 19:20:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50C1AC340E5; Mon, 24 Jan 2022 19:20:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052051; bh=diNtmretYvBMH6ruzlzMmmbrIGYcwFDWMdE2r2P1wKI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1HI3Iz7ElAW9yyU5C0nhQx0ykGNcWBeOolQtkRqFdJZW3W5HDDWfaZ64O0ohYqjBw YTNyGTtf5+g9lQLUG9zkJqjmJZUidkEEyOGc2XDGa6w8IZisUrH9dTHce4aX3dt2rg k69pymccGfzld1XFBshBv/OoiZctQsAiOLM+6yuE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joe Thornber , Mike Snitzer , Sasha Levin Subject: [PATCH 4.19 171/239] dm space map common: add bounds check to sm_ll_lookup_bitmap() Date: Mon, 24 Jan 2022 19:43:29 +0100 Message-Id: <20220124183948.538720161@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joe Thornber [ Upstream commit cba23ac158db7f3cd48a923d6861bee2eb7a2978 ] Corrupted metadata could warrant returning error from sm_ll_lookup_bitmap(). Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/md/persistent-data/dm-space-map-common.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/= persistent-data/dm-space-map-common.c index a284762e548e1..5115a27196038 100644 --- a/drivers/md/persistent-data/dm-space-map-common.c +++ b/drivers/md/persistent-data/dm-space-map-common.c @@ -279,6 +279,11 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t= b, uint32_t *result) struct disk_index_entry ie_disk; struct dm_block *blk; =20 + if (b >=3D ll->nr_blocks) { + DMERR_LIMIT("metadata block out of bounds"); + return -EINVAL; + } + b =3D do_div(index, ll->entries_per_block); r =3D ll->load_ie(ll, index, &ie_disk); if (r < 0) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4741EC433EF for ; Tue, 25 Jan 2022 02:28:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420738AbiAYCZN (ORCPT ); Mon, 24 Jan 2022 21:25:13 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49136 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349527AbiAXTUz (ORCPT ); Mon, 24 Jan 2022 14:20:55 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4080160BB9; Mon, 24 Jan 2022 19:20:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21D83C340E5; Mon, 24 Jan 2022 19:20:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052054; bh=LN39jkHUz74/NBozCkDKwTlU1Stu8vWcvU+ZnywHaE4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iKF9mgJVtaBF1aV0EQCCsePg+952A9LluOxvRpbO81ABd2O0y+vCHjeF+Sgloq7H6 MltxGFDvWyrFBdJuF3Wn+PEHUMndMA5lfq2LcKLPSchKodB2PL8qKos1jZ1tvjUGAH aycirkKQxo4CwITBaL57Hm8qNIE3n+amZ9AHdRzA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Corentin Labbe , "Russell King (Oracle)" , Andrew Lunn , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 172/239] net: phy: marvell: configure RGMII delays for 88E1118 Date: Mon, 24 Jan 2022 19:43:30 +0100 Message-Id: <20220124183948.571646714@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Russell King (Oracle) [ Upstream commit f22725c95ececb703c3f741e8f946d23705630b7 ] Corentin Labbe reports that the SSI 1328 does not work when allowing the PHY to operate at gigabit speeds, but does work with the generic PHY driver. This appears to be because m88e1118_config_init() writes a fixed value to the MSCR register, claiming that this is to enable 1G speeds. However, this always sets bits 4 and 5, enabling RGMII transmit and receive delays. The suspicion is that the original board this was added for required the delays to make 1G speeds work. Add the necessary configuration for RGMII delays for the 88E1118 to bring this into line with the requirements for RGMII support, and thus make the SSI 1328 work. Corentin Labbe has tested this on gemini-ssi1328 and gemini-ns2502. Reported-by: Corentin Labbe Tested-by: Corentin Labbe Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/phy/marvell.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c index 832a401c5fa56..484f6691b9c9f 100644 --- a/drivers/net/phy/marvell.c +++ b/drivers/net/phy/marvell.c @@ -930,6 +930,12 @@ static int m88e1118_config_init(struct phy_device *phy= dev) if (err < 0) return err; =20 + if (phy_interface_is_rgmii(phydev)) { + err =3D m88e1121_config_aneg_rgmii_delays(phydev); + if (err < 0) + return err; + } + /* Adjust LED Control */ if (phydev->dev_flags & MARVELL_PHY_M1118_DNS323_LEDS) err =3D phy_write(phydev, 0x10, 0x1100); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D1C3C433F5 for ; Mon, 24 Jan 2022 19:52:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240742AbiAXTwN (ORCPT ); Mon, 24 Jan 2022 14:52:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55310 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355414AbiAXTlQ (ORCPT ); Mon, 24 Jan 2022 14:41:16 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6FF9EC061757; Mon, 24 Jan 2022 11:20:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 10264612FA; Mon, 24 Jan 2022 19:20:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA563C340E8; Mon, 24 Jan 2022 19:20:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052057; bh=+182Jy79sK9MXiS+S8hwpNplD7VC97KSLLO+0dqvPJc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KyvvuwtTO0AU+jzur0E71fg9t0Gc7R9wpYkjgI5tMywTUzRXjG8WKvPJjf5k3l9X1 3g97vSm2NyVNql7Ej6e+y4v0CT4TKd0ZMz41f/6pWC/NumKuO/AkDCad47egPNFB8B MjcAdQWPZQAcjj5hvVAui8N9vXGAXRz0KO9VJ4Tg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Russell King (Oracle)" , Linus Walleij , Corentin Labbe , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 173/239] net: gemini: allow any RGMII interface mode Date: Mon, 24 Jan 2022 19:43:31 +0100 Message-Id: <20220124183948.603778604@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Russell King (Oracle) [ Upstream commit 4e4f325a0a55907b14f579e6b1a38c53755e3de2 ] The four RGMII interface modes take care of the required RGMII delay configuration at the PHY and should not be limited by the network MAC driver. Sadly, gemini was only permitting RGMII mode with no delays, which would require the required delay to be inserted via PCB tracking or by the MAC. However, there are designs that require the PHY to add the delay, which is impossible without Gemini permitting the other three PHY interface modes. Fix the driver to allow these. Signed-off-by: Russell King (Oracle) Reviewed-by: Linus Walleij Tested-by: Corentin Labbe Link: https://lore.kernel.org/r/E1n4mpT-002PLd-Ha@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/cortina/gemini.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/c= ortina/gemini.c index 5242687060b44..f8a3d1fecb0a5 100644 --- a/drivers/net/ethernet/cortina/gemini.c +++ b/drivers/net/ethernet/cortina/gemini.c @@ -304,21 +304,21 @@ static void gmac_speed_set(struct net_device *netdev) switch (phydev->speed) { case 1000: status.bits.speed =3D GMAC_SPEED_1000; - if (phydev->interface =3D=3D PHY_INTERFACE_MODE_RGMII) + if (phy_interface_mode_is_rgmii(phydev->interface)) status.bits.mii_rmii =3D GMAC_PHY_RGMII_1000; netdev_dbg(netdev, "connect %s to RGMII @ 1Gbit\n", phydev_name(phydev)); break; case 100: status.bits.speed =3D GMAC_SPEED_100; - if (phydev->interface =3D=3D PHY_INTERFACE_MODE_RGMII) + if (phy_interface_mode_is_rgmii(phydev->interface)) status.bits.mii_rmii =3D GMAC_PHY_RGMII_100_10; netdev_dbg(netdev, "connect %s to RGMII @ 100 Mbit\n", phydev_name(phydev)); break; case 10: status.bits.speed =3D GMAC_SPEED_10; - if (phydev->interface =3D=3D PHY_INTERFACE_MODE_RGMII) + if (phy_interface_mode_is_rgmii(phydev->interface)) status.bits.mii_rmii =3D GMAC_PHY_RGMII_100_10; netdev_dbg(netdev, "connect %s to RGMII @ 10 Mbit\n", phydev_name(phydev)); @@ -389,6 +389,9 @@ static int gmac_setup_phy(struct net_device *netdev) status.bits.mii_rmii =3D GMAC_PHY_GMII; break; case PHY_INTERFACE_MODE_RGMII: + case PHY_INTERFACE_MODE_RGMII_ID: + case PHY_INTERFACE_MODE_RGMII_TXID: + case PHY_INTERFACE_MODE_RGMII_RXID: netdev_dbg(netdev, "RGMII: set GMAC0 and GMAC1 to MII/RGMII mode\n"); status.bits.mii_rmii =3D GMAC_PHY_RGMII_100_10; --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02D9EC433FE for ; Tue, 25 Jan 2022 02:28:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420760AbiAYCZR (ORCPT ); Mon, 24 Jan 2022 21:25:17 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49180 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349589AbiAXTVB (ORCPT ); Mon, 24 Jan 2022 14:21:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D4522612A5; Mon, 24 Jan 2022 19:21:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9782C340E5; Mon, 24 Jan 2022 19:20:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052060; bh=OTBb49Fi/RleHdQTOg9kHAnjLKJeSfvgKcpSmDTOnYQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ibt6HRqxVVvRTqpw4A7aDEeIelLC0uMnnX+4HKA1fkxxCXHHQL0rmChaaJ6jrVczU 8AKzc5nBisZBA3Tzu9S2ok81mlejw37VaTHZYeJTuMYEfP0WOzJU8K/bB8O86X233W s8apt8fxnUf58k9LsG3Mqv8yfCyxNDYqbsAlcF9g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Konrad Dybcio , Mark Brown , Sasha Levin Subject: [PATCH 4.19 174/239] regulator: qcom_smd: Align probe function with rpmh-regulator Date: Mon, 24 Jan 2022 19:43:32 +0100 Message-Id: <20220124183948.634961612@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Konrad Dybcio [ Upstream commit 14e2976fbabdacb01335d7f91eeebbc89c67ddb1 ] The RPMh regulator driver is much newer and gets more attention, which in consequence makes it do a few things better. Update qcom_smd-regulator's probe function to mimic what rpmh-regulator does to address a couple of issues: - Probe defer now works correctly, before it used to, well, kinda just die.. This fixes reliable probing on (at least) PM8994, because Linux apparently cannot deal with supply map dependencies yet.. - Regulator data is now matched more sanely: regulator data is matched against each individual regulator node name and throwing an -EINVAL if data is missing, instead of just assuming everything is fine and iterating over all subsequent array members. - status =3D "disabled" will now work for disabling individual regulators in DT. Previously it didn't seem to do much if anything at all. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20211230023442.1123424-1-konrad.dybcio@soma= inline.org Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/regulator/qcom_smd-regulator.c | 100 +++++++++++++++++-------- 1 file changed, 70 insertions(+), 30 deletions(-) diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qco= m_smd-regulator.c index fe2fb36803e0b..8d920a3ad40b8 100644 --- a/drivers/regulator/qcom_smd-regulator.c +++ b/drivers/regulator/qcom_smd-regulator.c @@ -17,6 +17,7 @@ #include #include #include +#include #include =20 struct qcom_rpm_reg { @@ -673,52 +674,91 @@ static const struct of_device_id rpm_of_match[] =3D { }; MODULE_DEVICE_TABLE(of, rpm_of_match); =20 -static int rpm_reg_probe(struct platform_device *pdev) +/** + * rpm_regulator_init_vreg() - initialize all attributes of a qcom_smd-reg= ulator + * @vreg: Pointer to the individual qcom_smd-regulator resource + * @dev: Pointer to the top level qcom_smd-regulator PMIC device + * @node: Pointer to the individual qcom_smd-regulator resource + * device node + * @rpm: Pointer to the rpm bus node + * @pmic_rpm_data: Pointer to a null-terminated array of qcom_smd-regulator + * resources defined for the top level PMIC device + * + * Return: 0 on success, errno on failure + */ +static int rpm_regulator_init_vreg(struct qcom_rpm_reg *vreg, struct devic= e *dev, + struct device_node *node, struct qcom_smd_rpm *rpm, + const struct rpm_regulator_data *pmic_rpm_data) { - const struct rpm_regulator_data *reg; - const struct of_device_id *match; - struct regulator_config config =3D { }; + struct regulator_config config =3D {}; + const struct rpm_regulator_data *rpm_data; struct regulator_dev *rdev; + int ret; + + for (rpm_data =3D pmic_rpm_data; rpm_data->name; rpm_data++) + if (of_node_name_eq(node, rpm_data->name)) + break; + + if (!rpm_data->name) { + dev_err(dev, "Unknown regulator %pOFn\n", node); + return -EINVAL; + } + + vreg->dev =3D dev; + vreg->rpm =3D rpm; + vreg->type =3D rpm_data->type; + vreg->id =3D rpm_data->id; + + memcpy(&vreg->desc, rpm_data->desc, sizeof(vreg->desc)); + vreg->desc.name =3D rpm_data->name; + vreg->desc.supply_name =3D rpm_data->supply; + vreg->desc.owner =3D THIS_MODULE; + vreg->desc.type =3D REGULATOR_VOLTAGE; + vreg->desc.of_match =3D rpm_data->name; + + config.dev =3D dev; + config.of_node =3D node; + config.driver_data =3D vreg; + + rdev =3D devm_regulator_register(dev, &vreg->desc, &config); + if (IS_ERR(rdev)) { + ret =3D PTR_ERR(rdev); + dev_err(dev, "%pOFn: devm_regulator_register() failed, ret=3D%d\n", node= , ret); + return ret; + } + + return 0; +} + +static int rpm_reg_probe(struct platform_device *pdev) +{ + struct device *dev =3D &pdev->dev; + const struct rpm_regulator_data *vreg_data; + struct device_node *node; struct qcom_rpm_reg *vreg; struct qcom_smd_rpm *rpm; + int ret; =20 rpm =3D dev_get_drvdata(pdev->dev.parent); if (!rpm) { - dev_err(&pdev->dev, "unable to retrieve handle to rpm\n"); + dev_err(&pdev->dev, "Unable to retrieve handle to rpm\n"); return -ENODEV; } =20 - match =3D of_match_device(rpm_of_match, &pdev->dev); - if (!match) { - dev_err(&pdev->dev, "failed to match device\n"); + vreg_data =3D of_device_get_match_data(dev); + if (!vreg_data) return -ENODEV; - } =20 - for (reg =3D match->data; reg->name; reg++) { + for_each_available_child_of_node(dev->of_node, node) { vreg =3D devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL); if (!vreg) return -ENOMEM; =20 - vreg->dev =3D &pdev->dev; - vreg->type =3D reg->type; - vreg->id =3D reg->id; - vreg->rpm =3D rpm; - - memcpy(&vreg->desc, reg->desc, sizeof(vreg->desc)); - - vreg->desc.id =3D -1; - vreg->desc.owner =3D THIS_MODULE; - vreg->desc.type =3D REGULATOR_VOLTAGE; - vreg->desc.name =3D reg->name; - vreg->desc.supply_name =3D reg->supply; - vreg->desc.of_match =3D reg->name; - - config.dev =3D &pdev->dev; - config.driver_data =3D vreg; - rdev =3D devm_regulator_register(&pdev->dev, &vreg->desc, &config); - if (IS_ERR(rdev)) { - dev_err(&pdev->dev, "failed to register %s\n", reg->name); - return PTR_ERR(rdev); + ret =3D rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data); + + if (ret < 0) { + of_node_put(node); + return ret; } } =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 615F2C4321E for ; Mon, 24 Jan 2022 19:31:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352384AbiAXTaP (ORCPT ); Mon, 24 Jan 2022 14:30:15 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:41852 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349641AbiAXTVF (ORCPT ); Mon, 24 Jan 2022 14:21:05 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6092FB8121F; Mon, 24 Jan 2022 19:21:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 901EFC340E5; Mon, 24 Jan 2022 19:21:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052063; bh=ybTUdVpSs4tP9fA30UA8SByCPb6Bm5xSjfuBftAAKl0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hSEVsva8gp9WT/49Idq8clXMkx+YJO+Pvmo2X7uD+P+yskS9dSPOwVn4ncGqBO97H aJVhXPgbk/nlRfKY4zz88oOf4q2+rqT2Pz+5IKzlcpCGrUfPptW9mnj+06o8/je5oa c/x+2r2ixaYFNHK7Xthjb1D0wYjLrvKUqVlS62Dk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Russell King , Lukas Wunner , Sasha Levin Subject: [PATCH 4.19 175/239] serial: pl010: Drop CR register reset on set_termios Date: Mon, 24 Jan 2022 19:43:33 +0100 Message-Id: <20220124183948.668143983@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner [ Upstream commit 08a0c6dff91c965e39905cf200d22db989203ccb ] pl010_set_termios() briefly resets the CR register to zero. Where does this register write come from? The PL010 driver's IRQ handler ambauart_int() originally modified the CR register without holding the port spinlock. ambauart_set_termios() also modified that register. To prevent concurrent read-modify-writes by the IRQ handler and to prevent transmission while changing baudrate, ambauart_set_termios() had to disable interrupts. That is achieved by writing zero to the CR register. However in 2004 the PL010 driver was amended to acquire the port spinlock in the IRQ handler, obviating the need to disable interrupts in ->set_termios(): https://git.kernel.org/history/history/c/157c0342e591 That rendered the CR register write obsolete. Drop it. Cc: Russell King Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/fcaff16e5b1abb4cc3da5a2879ac13f278b99ed0.16= 41128728.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/amba-pl010.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl01= 0.c index 2c37d11726aba..13f882e5e7b76 100644 --- a/drivers/tty/serial/amba-pl010.c +++ b/drivers/tty/serial/amba-pl010.c @@ -452,14 +452,11 @@ pl010_set_termios(struct uart_port *port, struct kter= mios *termios, if ((termios->c_cflag & CREAD) =3D=3D 0) uap->port.ignore_status_mask |=3D UART_DUMMY_RSR_RX; =20 - /* first, disable everything */ old_cr =3D readb(uap->port.membase + UART010_CR) & ~UART010_CR_MSIE; =20 if (UART_ENABLE_MS(port, termios->c_cflag)) old_cr |=3D UART010_CR_MSIE; =20 - writel(0, uap->port.membase + UART010_CR); - /* Set baud rate */ quot -=3D 1; writel((quot & 0xf00) >> 8, uap->port.membase + UART010_LCRM); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ACD16C4167E for ; Mon, 24 Jan 2022 20:07:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377381AbiAXUFY (ORCPT ); Mon, 24 Jan 2022 15:05:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356828AbiAXTr0 (ORCPT ); Mon, 24 Jan 2022 14:47:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 11834C038AEB; Mon, 24 Jan 2022 11:23:18 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BABFBB810BD; Mon, 24 Jan 2022 19:23:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E6331C340E5; Mon, 24 Jan 2022 19:23:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052194; bh=5Ymn2AW/zGqbjw3qp2nR15M/bmz7QlMmrneVUroSo4g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vCWCgfat/DXx8mHeHIK5uMfDo57a1tGH2ypsclv3GOznEHRsFXV8safVxpJb30TVU NGrBCrD/gleI45GwhSbjDUVBXfOdMQEbIsICjzno6ES7tSuEMwohT4S+XnL4ofs2tt K8QvIvUYKBAgojFuYtBOxBhyf4oZJSRc3MWMX7uo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Wunner , Sasha Levin Subject: [PATCH 4.19 176/239] serial: core: Keep mctrl register state and cached copy in sync Date: Mon, 24 Jan 2022 19:43:34 +0100 Message-Id: <20220124183948.698401680@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner [ Upstream commit 93a770b7e16772530196674ffc79bb13fa927dc6 ] struct uart_port contains a cached copy of the Modem Control signals. It is used to skip register writes in uart_update_mctrl() if the new signal state equals the old signal state. It also avoids a register read to obtain the current state of output signals. When a uart_port is registered, uart_configure_port() changes signal state but neglects to keep the cached copy in sync. That may cause a subsequent register write to be incorrectly skipped. Fix it before it trips somebody up. This behavior has been present ever since the serial core was introduced in 2002: https://git.kernel.org/history/history/c/33c0d1b0c3eb So far it was never an issue because the cached copy is initialized to 0 by kzalloc() and when uart_configure_port() is executed, at most DTR has been set by uart_set_options() or sunsu_console_setup(). Therefore, a stable designation seems unnecessary. Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/bceeaba030b028ed810272d55d5fc6f3656ddddb.16= 41129752.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/serial_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_c= ore.c index 63aefe7e91be1..ab4d0f6058c04 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -2347,7 +2347,8 @@ uart_configure_port(struct uart_driver *drv, struct u= art_state *state, * We probably don't need a spinlock around this, but */ spin_lock_irqsave(&port->lock, flags); - port->ops->set_mctrl(port, port->mctrl & TIOCM_DTR); + port->mctrl &=3D TIOCM_DTR; + port->ops->set_mctrl(port, port->mctrl); spin_unlock_irqrestore(&port->lock, flags); =20 /* --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50114C433FE for ; Mon, 24 Jan 2022 19:31:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352598AbiAXTap (ORCPT ); Mon, 24 Jan 2022 14:30:45 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:42540 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343636AbiAXTV3 (ORCPT ); Mon, 24 Jan 2022 14:21:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 90A1EB8121A; Mon, 24 Jan 2022 19:21:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8A54C340E5; Mon, 24 Jan 2022 19:21:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052086; bh=1rb8EM3XDFWr+VyTcb3Rfus7JTqCNfeY0zVb9E/f6mQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tpg51rJ8glNdt6DyvsTDgA4/8dGNkx2DZpTaoaWUFJX8YURP7cYvB2VP0RedTkqfG Sd3jCbNjaInUACjSIrTXB4MpEjug8DBdzDsECLsL/OYZO+D6lCFitZ0E+8nRBK9EGB lDGL1ZJnYpTz3yvMLN3ZfUoY3nN1bHE4fpvi69qI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John David Anglin , Helge Deller , Sasha Levin Subject: [PATCH 4.19 177/239] parisc: Avoid calling faulthandler_disabled() twice Date: Mon, 24 Jan 2022 19:43:35 +0100 Message-Id: <20220124183948.728992883@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John David Anglin [ Upstream commit 9e9d4b460f23bab61672eae397417d03917d116c ] In handle_interruption(), we call faulthandler_disabled() to check whether = the fault handler is not disabled. If the fault handler is disabled, we immedia= tely call do_page_fault(). It then calls faulthandler_disabled(). If disabled, do_page_fault() attempts to fixup the exception by jumping to no_context: no_context: if (!user_mode(regs) && fixup_exception(regs)) { return; } parisc_terminate("Bad Address (null pointer deref?)", regs, code, a= ddress); Apart from the error messages, the two blocks of code perform the same function. We can avoid two calls to faulthandler_disabled() by a simple revision to the code in handle_interruption(). Note: I didn't try to fix the formatting of this code block. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/parisc/kernel/traps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c index abeb5321a83fc..d7a66d8525091 100644 --- a/arch/parisc/kernel/traps.c +++ b/arch/parisc/kernel/traps.c @@ -750,7 +750,7 @@ void notrace handle_interruption(int code, struct pt_re= gs *regs) * unless pagefault_disable() was called before. */ =20 - if (fault_space =3D=3D 0 && !faulthandler_disabled()) + if (faulthandler_disabled() || fault_space =3D=3D 0) { /* Clean up and return if in exception table. */ if (fixup_exception(regs)) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BA97C433FE for ; Mon, 24 Jan 2022 19:59:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357936AbiAXT7I (ORCPT ); Mon, 24 Jan 2022 14:59:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54648 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350012AbiAXTnC (ORCPT ); Mon, 24 Jan 2022 14:43:02 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 25316C03327C; Mon, 24 Jan 2022 11:22:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B8E6560B86; Mon, 24 Jan 2022 19:22:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9ECC0C340E5; Mon, 24 Jan 2022 19:21:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052120; bh=jbFpHmEm0LhR9WntBAIKJZUHg3ZypDEqqJtUJca1zAo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DIRa/la6ErLOijpnknOUstaC8TZM6lIpGO50kyafjtRSMtorRHiL/45JcPxHZh3Vz ME/IAiK4la4zTYqfOYOcVDC36LjcVeId5NBFb+Gtoyx7z2/VmjBzo9UTWepYRD+IGa wIdq3I5/pLBclHHtQu8BRdjFyKWIfajMCBOn3UUw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.19 178/239] powerpc/6xx: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:36 +0100 Message-Id: <20220124183948.760342880@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit f6e82647ff71d427d4148964b71f239fba9d7937 ] for_each_compatible_node performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ expression e; local idexpression n; @@ @@ local idexpression n; expression e; @@ for_each_compatible_node(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-2-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/p= latforms/embedded6xx/hlwd-pic.c index 8112b39879d67..7b4edf1cb2c8d 100644 --- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c @@ -220,6 +220,7 @@ void hlwd_pic_probe(void) irq_set_chained_handler(cascade_virq, hlwd_pic_irq_cascade); hlwd_irq_host =3D host; + of_node_put(np); break; } } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19546C43217 for ; Mon, 24 Jan 2022 19:31:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347313AbiAXTbi (ORCPT ); Mon, 24 Jan 2022 14:31:38 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:44700 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347562AbiAXTWg (ORCPT ); Mon, 24 Jan 2022 14:22:36 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7C684B81253; Mon, 24 Jan 2022 19:22:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 912B6C340EA; Mon, 24 Jan 2022 19:22:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052154; bh=GLtLK6jPA6nPtqriz3ZVOeIfZ5OpRTdv6BTEh612+3M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=INCVsA7GwDQhjnM1wL2kvp8Seh0SDlmhkBN8V1JcaCFW9mAdxWe0H65bxmFMTyNY9 F38v7fpdD8qEVJ8tMzIqCN73HoZa5BqnfSsDVsmg7jTRw6R193VU+IyVTp2yYI+AtN qPpGwzUWq/RuPg3Q5CdMgXWKlf1lFMF3ZHPutemo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.19 179/239] powerpc/powernv: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:37 +0100 Message-Id: <20220124183948.791126261@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit 7d405a939ca960162eb30c1475759cb2fdf38f8c ] for_each_compatible_node performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ local idexpression n; expression e; @@ for_each_compatible_node(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-4-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/platforms/powernv/opal-lpc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platf= orms/powernv/opal-lpc.c index 6c7ad1d8b32ed..21f0edcfb84ad 100644 --- a/arch/powerpc/platforms/powernv/opal-lpc.c +++ b/arch/powerpc/platforms/powernv/opal-lpc.c @@ -400,6 +400,7 @@ void __init opal_lpc_init(void) if (!of_get_property(np, "primary", NULL)) continue; opal_lpc_chip_id =3D of_get_ibm_chip_id(np); + of_node_put(np); break; } if (opal_lpc_chip_id < 0) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55E89C433FE for ; Mon, 24 Jan 2022 19:31:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352804AbiAXTbF (ORCPT ); Mon, 24 Jan 2022 14:31:05 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:47070 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346355AbiAXTW6 (ORCPT ); Mon, 24 Jan 2022 14:22:58 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 160F2B8121B; Mon, 24 Jan 2022 19:22:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2CBA4C340E5; Mon, 24 Jan 2022 19:22:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052175; bh=KMxJK1iIQOsIy0NuPpIiSoxPGHXz/J4x23TAqBxugmY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=u2qDPfA1umsqqPCqNi5+nJ6KvpMNECCRhev1vYRpSFhfPYMdxz/92PM4O5FK5Cxrz JwlA4EtvfIPuKqzQgygKU/RQQFYalEkwLKIqzL84CdKbZ+2pOWv2ozeWhsMLBqniDo rnr0BjlZrV5JuGm1sK50h0x2XbtpWFGIZ3E+q/Mo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.19 180/239] powerpc/cell: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:38 +0100 Message-Id: <20220124183948.822127222@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit a841fd009e51c8c0a8f07c942e9ab6bb48da8858 ] for_each_node_by_name performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ expression e,e1; local idexpression n; @@ for_each_node_by_name(n, e1) { ... when !=3D of_node_put(n) when !=3D e =3D n ( return n; | + of_node_put(n); ? return ...; ) ... } // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-7-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/platforms/cell/iommu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/c= ell/iommu.c index 12352a58072ab..d9c2c4cc60be1 100644 --- a/arch/powerpc/platforms/cell/iommu.c +++ b/arch/powerpc/platforms/cell/iommu.c @@ -1088,6 +1088,7 @@ static int __init cell_iommu_fixed_mapping_init(void) if (hbase < dbase || (hend > (dbase + dsize))) { pr_debug("iommu: hash window doesn't fit in" "real DMA window\n"); + of_node_put(np); return -1; } } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 432B8C433FE for ; Mon, 24 Jan 2022 20:07:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377128AbiAXUFA (ORCPT ); Mon, 24 Jan 2022 15:05:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56220 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356721AbiAXTrE (ORCPT ); Mon, 24 Jan 2022 14:47:04 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 03CC2C061781; Mon, 24 Jan 2022 11:23:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 94BAC60909; Mon, 24 Jan 2022 19:22:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 57D64C340E5; Mon, 24 Jan 2022 19:22:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052179; bh=lonuAKS53DUKY+ol5S4xBe1LsE3sXOcVFIl4cO81vTE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=00RuObrDchfJM1rjRyNhOr0TkF04o4IGlMIAXyjX1/nLXVLMxSAFAuEOl+ghA2fNr henCf2sqgITzT5Cyl2n1n+KVICaLzZYc1OSNAo/lctzCqVY67dbNFTPHh3Y9DQdnKx /4ZNZCZFgkAR2x29yka2Ja/q4DjGjJ/R3dJHZkNM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.19 181/239] powerpc/btext: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:39 +0100 Message-Id: <20220124183948.851048779@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit a1d2b210ffa52d60acabbf7b6af3ef7e1e69cda0 ] for_each_node_by_type performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ local idexpression n; expression e; @@ for_each_node_by_type(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-6-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/kernel/btext.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c index b2072d5bbf2bb..a046504d8bfaf 100644 --- a/arch/powerpc/kernel/btext.c +++ b/arch/powerpc/kernel/btext.c @@ -258,8 +258,10 @@ int __init btext_find_display(int allow_nonstdout) rc =3D btext_initialize(np); printk("result: %d\n", rc); } - if (rc =3D=3D 0) + if (rc =3D=3D 0) { + of_node_put(np); break; + } } return rc; } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CFA6C43217 for ; Mon, 24 Jan 2022 19:31:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352839AbiAXTbK (ORCPT ); Mon, 24 Jan 2022 14:31:10 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49180 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346367AbiAXTXG (ORCPT ); Mon, 24 Jan 2022 14:23:06 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BEC9C61490; Mon, 24 Jan 2022 19:23:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9BECAC36AE3; Mon, 24 Jan 2022 19:23:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052182; bh=fqghv2tM9KQdZtwnpamw7ZoE6favq2oByT6WYmfaJKk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VOaSXvOxxv9voBj/zuy+k6rmOPU+tc98sbAO+R8u5Y6osuPSnQLYLRxFi0Wlz/85Y RSHuP4sfm3wvWbzTMV0JYM91G7gtSPV5aK3W6csp7BNqfnmDnPyr378wrGiXp91RBj rlXlDXH4GllLagTIVum6HJAl6tKj0xa0rkc+nnWk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nicholas Piggin , Laurent Dufour , Michael Ellerman , Sasha Levin Subject: [PATCH 4.19 182/239] powerpc/watchdog: Fix missed watchdog reset due to memory ordering race Date: Mon, 24 Jan 2022 19:43:40 +0100 Message-Id: <20220124183948.881059269@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nicholas Piggin [ Upstream commit 5dad4ba68a2483fc80d70b9dc90bbe16e1f27263 ] It is possible for all CPUs to miss the pending cpumask becoming clear, and then nobody resetting it, which will cause the lockup detector to stop working. It will eventually expire, but watchdog_smp_panic will avoid doing anything if the pending mask is clear and it will never be reset. Order the cpumask clear vs the subsequent test to close this race. Add an extra check for an empty pending mask when the watchdog fires and finds its bit still clear, to try to catch any other possible races or bugs here and keep the watchdog working. The extra test in arch_touch_nmi_watchdog is required to prevent the new warning from firing off. Signed-off-by: Nicholas Piggin Reviewed-by: Laurent Dufour Debugged-by: Laurent Dufour Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211110025056.2084347-2-npiggin@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/kernel/watchdog.c | 41 +++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c index af3c15a1d41eb..75b2a6c4db5a5 100644 --- a/arch/powerpc/kernel/watchdog.c +++ b/arch/powerpc/kernel/watchdog.c @@ -132,6 +132,10 @@ static void set_cpumask_stuck(const struct cpumask *cp= umask, u64 tb) { cpumask_or(&wd_smp_cpus_stuck, &wd_smp_cpus_stuck, cpumask); cpumask_andnot(&wd_smp_cpus_pending, &wd_smp_cpus_pending, cpumask); + /* + * See wd_smp_clear_cpu_pending() + */ + smp_mb(); if (cpumask_empty(&wd_smp_cpus_pending)) { wd_smp_last_reset_tb =3D tb; cpumask_andnot(&wd_smp_cpus_pending, @@ -217,13 +221,44 @@ static void wd_smp_clear_cpu_pending(int cpu, u64 tb) =20 cpumask_clear_cpu(cpu, &wd_smp_cpus_stuck); wd_smp_unlock(&flags); + } else { + /* + * The last CPU to clear pending should have reset the + * watchdog so we generally should not find it empty + * here if our CPU was clear. However it could happen + * due to a rare race with another CPU taking the + * last CPU out of the mask concurrently. + * + * We can't add a warning for it. But just in case + * there is a problem with the watchdog that is causing + * the mask to not be reset, try to kick it along here. + */ + if (unlikely(cpumask_empty(&wd_smp_cpus_pending))) + goto none_pending; } return; } + cpumask_clear_cpu(cpu, &wd_smp_cpus_pending); + + /* + * Order the store to clear pending with the load(s) to check all + * words in the pending mask to check they are all empty. This orders + * with the same barrier on another CPU. This prevents two CPUs + * clearing the last 2 pending bits, but neither seeing the other's + * store when checking if the mask is empty, and missing an empty + * mask, which ends with a false positive. + */ + smp_mb(); if (cpumask_empty(&wd_smp_cpus_pending)) { unsigned long flags; =20 +none_pending: + /* + * Double check under lock because more than one CPU could see + * a clear mask with the lockless check after clearing their + * pending bits. + */ wd_smp_lock(&flags); if (cpumask_empty(&wd_smp_cpus_pending)) { wd_smp_last_reset_tb =3D tb; @@ -314,8 +349,12 @@ void arch_touch_nmi_watchdog(void) { unsigned long ticks =3D tb_ticks_per_usec * wd_timer_period_ms * 1000; int cpu =3D smp_processor_id(); - u64 tb =3D get_tb(); + u64 tb; =20 + if (!cpumask_test_cpu(cpu, &watchdog_cpumask)) + return; + + tb =3D get_tb(); if (tb - per_cpu(wd_timer_tb, cpu) >=3D ticks) { per_cpu(wd_timer_tb, cpu) =3D tb; wd_smp_clear_cpu_pending(cpu, tb); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD3A2C43219 for ; Mon, 24 Jan 2022 20:07:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377236AbiAXUFK (ORCPT ); Mon, 24 Jan 2022 15:05:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56300 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356808AbiAXTrX (ORCPT ); Mon, 24 Jan 2022 14:47:23 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 23B4EC038AE9; Mon, 24 Jan 2022 11:23:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B795E60010; Mon, 24 Jan 2022 19:23:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D07EC340E7; Mon, 24 Jan 2022 19:23:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052185; bh=q5V/oWsy8/Any2yGd1E9n2BPhXEB4Nbics/VFJRxRGQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kLRp1dQbdqFXE6iHDkMgd++kF/Kj+TyQPArv0PLjIcEYGnscjJzcbIa4up74XZ/6N 66+YPSeDJB3JHnC2atdXAvSXyUMVHaBvy71sVdrXGL24Vfe+rJ7z9521mbL+Lw7sXA 0Z586HCNPrLjqDoqiWeSN3uoQ3WxjzvkxrMTr7T8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Heiner Kallweit , Jean Delvare , Wolfram Sang , Sasha Levin Subject: [PATCH 4.19 183/239] i2c: i801: Dont silently correct invalid transfer size Date: Mon, 24 Jan 2022 19:43:41 +0100 Message-Id: <20220124183948.918214094@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Heiner Kallweit [ Upstream commit effa453168a7eeb8a562ff4edc1dbf9067360a61 ] If an invalid block size is provided, reject it instead of silently changing it to a supported value. Especially critical I see the case of a write transfer with block length 0. In this case we have no guarantee that the byte we would write is valid. When silently reducing a read to 32 bytes then we don't return an error and the caller may falsely assume that we returned the full requested data. If this change should break any (broken) caller, then I think we should fix the caller. Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/i2c/busses/i2c-i801.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c index efafd028c5d16..fb0ddaad87d2e 100644 --- a/drivers/i2c/busses/i2c-i801.c +++ b/drivers/i2c/busses/i2c-i801.c @@ -774,6 +774,11 @@ static int i801_block_transaction(struct i801_priv *pr= iv, int result =3D 0; unsigned char hostc; =20 + if (read_write =3D=3D I2C_SMBUS_READ && command =3D=3D I2C_SMBUS_BLOCK_DA= TA) + data->block[0] =3D I2C_SMBUS_BLOCK_MAX; + else if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) + return -EPROTO; + if (command =3D=3D I2C_SMBUS_I2C_BLOCK_DATA) { if (read_write =3D=3D I2C_SMBUS_WRITE) { /* set I2C_EN bit in configuration register */ @@ -787,16 +792,6 @@ static int i801_block_transaction(struct i801_priv *pr= iv, } } =20 - if (read_write =3D=3D I2C_SMBUS_WRITE - || command =3D=3D I2C_SMBUS_I2C_BLOCK_DATA) { - if (data->block[0] < 1) - data->block[0] =3D 1; - if (data->block[0] > I2C_SMBUS_BLOCK_MAX) - data->block[0] =3D I2C_SMBUS_BLOCK_MAX; - } else { - data->block[0] =3D 32; /* max for SMBus block reads */ - } - /* Experience has shown that the block buffer can only be used for SMBus (not I2C) block transactions, even though the datasheet doesn't mention this limitation. */ --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90EDFC4321E for ; Mon, 24 Jan 2022 20:07:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377207AbiAXUFI (ORCPT ); Mon, 24 Jan 2022 15:05:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56802 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356810AbiAXTrX (ORCPT ); Mon, 24 Jan 2022 14:47:23 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B93CC06178C; Mon, 24 Jan 2022 11:23:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E2B5D612A5; Mon, 24 Jan 2022 19:23:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEDC5C340EA; Mon, 24 Jan 2022 19:23:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052188; bh=cfgNBCaLfspusGGx3TWNkR2/M1NK5ZI0i2GmyN/yYHA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D6g8byy3fJ+10Jn9OMo4BJfvScf5SkMjASYouGrXCSvd349vXczIvfOL+i2YO5X/o dxhHw3S8hnwJtOsxTy6YPmACVrduqXfBEOq3FGxdSlWoaresbqJA8yLIZSX1WPkmLw s1eySWn3GWugr5+RL+6DpluzZ15YrgdaOSDqnjFA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Ellerman , Sasha Levin Subject: [PATCH 4.19 184/239] powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING Date: Mon, 24 Jan 2022 19:43:42 +0100 Message-Id: <20220124183948.947195852@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Ellerman [ Upstream commit a4ac0d249a5db80e79d573db9e4ad29354b643a8 ] setup_profiling_timer() is only needed when CONFIG_PROFILING is enabled. Fixes the following W=3D1 warning when CONFIG_PROFILING=3Dn: linux/arch/powerpc/kernel/smp.c:1638:5: error: no previous prototype for = =E2=80=98setup_profiling_timer=E2=80=99 Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211124093254.1054750-5-mpe@ellerman.id.au Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/kernel/smp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c index 14adfeacfa46e..4853ac67cf21f 100644 --- a/arch/powerpc/kernel/smp.c +++ b/arch/powerpc/kernel/smp.c @@ -1070,10 +1070,12 @@ void start_secondary(void *unused) BUG(); } =20 +#ifdef CONFIG_PROFILING int setup_profiling_timer(unsigned int multiplier) { return 0; } +#endif =20 #ifdef CONFIG_SCHED_SMT /* cpumask of CPUs with asymetric SMT dependancy */ --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4C0EC4332F for ; Mon, 24 Jan 2022 19:32:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348024AbiAXTcU (ORCPT ); Mon, 24 Jan 2022 14:32:20 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:45064 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350040AbiAXTXR (ORCPT ); Mon, 24 Jan 2022 14:23:17 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D1692B8121C; Mon, 24 Jan 2022 19:23:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E4CCC340E5; Mon, 24 Jan 2022 19:23:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052191; bh=sTCekZEw9uEAHrjdVyISUfUMGWrR2PuYEye6KgK+SL0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ht8LFdzBY0K7b4jRbm7ALRjh7ZHZ0BJje1jOEuyIWIXBDGNiCf+tZRjnijaGeja1P rw49gpvbBU3hqWELTBft96IpZ2vYotQiFaFIGiUYE31nmEEpsAjXO8cgbAyC7oXcUz HMnij8NSXj93ITUZwQekzYq8500QEMqUzpx9Mo8E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joakim Tjernlund , Scott Wood , Wolfram Sang , Sasha Levin Subject: [PATCH 4.19 185/239] i2c: mpc: Correct I2C reset procedure Date: Mon, 24 Jan 2022 19:43:43 +0100 Message-Id: <20220124183948.985958504@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joakim Tjernlund [ Upstream commit ebe82cf92cd4825c3029434cabfcd2f1780e64be ] Current I2C reset procedure is broken in two ways: 1) It only generate 1 START instead of 9 STARTs and STOP. 2) It leaves the bus Busy so every I2C xfer after the first fixup calls the reset routine again, for every xfer there after. This fixes both errors. Signed-off-by: Joakim Tjernlund Acked-by: Scott Wood Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/i2c/busses/i2c-mpc.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c index af349661fd769..8de8296d25831 100644 --- a/drivers/i2c/busses/i2c-mpc.c +++ b/drivers/i2c/busses/i2c-mpc.c @@ -105,23 +105,30 @@ static irqreturn_t mpc_i2c_isr(int irq, void *dev_id) /* Sometimes 9th clock pulse isn't generated, and slave doesn't release * the bus, because it wants to send ACK. * Following sequence of enabling/disabling and sending start/stop generat= es - * the 9 pulses, so it's all OK. + * the 9 pulses, each with a START then ending with STOP, so it's all OK. */ static void mpc_i2c_fixup(struct mpc_i2c *i2c) { int k; - u32 delay_val =3D 1000000 / i2c->real_clk + 1; - - if (delay_val < 2) - delay_val =3D 2; + unsigned long flags; =20 for (k =3D 9; k; k--) { writeccr(i2c, 0); - writeccr(i2c, CCR_MSTA | CCR_MTX | CCR_MEN); + writeb(0, i2c->base + MPC_I2C_SR); /* clear any status bits */ + writeccr(i2c, CCR_MEN | CCR_MSTA); /* START */ + readb(i2c->base + MPC_I2C_DR); /* init xfer */ + udelay(15); /* let it hit the bus */ + local_irq_save(flags); /* should not be delayed further */ + writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSTA); /* delay SDA */ readb(i2c->base + MPC_I2C_DR); - writeccr(i2c, CCR_MEN); - udelay(delay_val << 1); + if (k !=3D 1) + udelay(5); + local_irq_restore(flags); } + writeccr(i2c, CCR_MEN); /* Initiate STOP */ + readb(i2c->base + MPC_I2C_DR); + udelay(15); /* Let STOP propagate */ + writeccr(i2c, 0); } =20 static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E6F6C433EF for ; Tue, 25 Jan 2022 02:33:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420902AbiAYCZs (ORCPT ); Mon, 24 Jan 2022 21:25:48 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48328 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343730AbiAXTVa (ORCPT ); Mon, 24 Jan 2022 14:21:30 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B66A96121F; Mon, 24 Jan 2022 19:21:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 939E1C340E5; Mon, 24 Jan 2022 19:21:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052089; bh=DrDXfsqHh2FEtC2DRMTIv+/soE/QWkgoZin5Cpq2nFw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X97P3/t49MdVAuidZE6VEI6hvoU+vM3fNOK0Gb4sv/JW5GTteZt0YouqmhUMrGgXr e4iJAIZRumGGITFtQlbkItHErxYPe/3kErp8NQfI5DFDqPOffsf+HZFQGb+7H4vZI8 1bavqwbztobU/I93m81H3KPwgjxfmb3c1ApzitMc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Christophe Leroy , Sasha Levin Subject: [PATCH 4.19 186/239] w1: Misuse of get_user()/put_user() reported by sparse Date: Mon, 24 Jan 2022 19:43:44 +0100 Message-Id: <20220124183949.016357499@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe Leroy [ Upstream commit 33dc3e3e99e626ce51f462d883b05856c6c30b1d ] sparse warnings: (new ones prefixed by >>) >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in= initializer (different address spaces) @@ expected char [noderef] __us= er *_pu_addr @@ got char *buf @@ drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [nodere= f] __user *_pu_addr drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in= initializer (different address spaces) @@ expected char const [noderef= ] __user *_gu_addr @@ got char const *buf @@ drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [= noderef] __user *_gu_addr drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf The buffer buf is a failsafe buffer in kernel space, it's not user memory hence doesn't deserve the use of get_user() or put_user(). Access 'buf' content directly. Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ Reported-by: kernel test robot Signed-off-by: Christophe Leroy Link: https://lore.kernel.org/r/d14ed8d71ad4372e6839ae427f91441d3ba0e94d.16= 37946316.git.christophe.leroy@csgroup.eu Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/w1/slaves/w1_ds28e04.c | 26 ++++++-------------------- 1 file changed, 6 insertions(+), 20 deletions(-) diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c index ec234b846eb3c..e5eb19a34ee2a 100644 --- a/drivers/w1/slaves/w1_ds28e04.c +++ b/drivers/w1/slaves/w1_ds28e04.c @@ -34,7 +34,7 @@ static int w1_strong_pullup =3D 1; module_param_named(strong_pullup, w1_strong_pullup, int, 0); =20 /* enable/disable CRC checking on DS28E04-100 memory accesses */ -static char w1_enable_crccheck =3D 1; +static bool w1_enable_crccheck =3D true; =20 #define W1_EEPROM_SIZE 512 #define W1_PAGE_COUNT 16 @@ -341,32 +341,18 @@ static BIN_ATTR_RW(pio, 1); static ssize_t crccheck_show(struct device *dev, struct device_attribute *= attr, char *buf) { - if (put_user(w1_enable_crccheck + 0x30, buf)) - return -EFAULT; - - return sizeof(w1_enable_crccheck); + return sysfs_emit(buf, "%d\n", w1_enable_crccheck); } =20 static ssize_t crccheck_store(struct device *dev, struct device_attribute = *attr, const char *buf, size_t count) { - char val; - - if (count !=3D 1 || !buf) - return -EINVAL; + int err =3D kstrtobool(buf, &w1_enable_crccheck); =20 - if (get_user(val, buf)) - return -EFAULT; + if (err) + return err; =20 - /* convert to decimal */ - val =3D val - 0x30; - if (val !=3D 0 && val !=3D 1) - return -EINVAL; - - /* set the new value */ - w1_enable_crccheck =3D val; - - return sizeof(w1_enable_crccheck); + return count; } =20 static DEVICE_ATTR_RW(crccheck); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CEC6EC4332F for ; Tue, 25 Jan 2022 02:33:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420931AbiAYCZu (ORCPT ); Mon, 24 Jan 2022 21:25:50 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49702 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344886AbiAXTVd (ORCPT ); Mon, 24 Jan 2022 14:21:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8814A60917; Mon, 24 Jan 2022 19:21:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A2DEC340E8; Mon, 24 Jan 2022 19:21:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052092; bh=8dtuI81vH2nEg04/VDZ3p6Ngyx8DAV+nwowjYqyLxQs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y3ndXdzCiKxuOi0jKmNBFnnevJmLWTf5MJOE9w+izIReQPBzUsGs0mbRFf+glA9mx nlRkM30bM5bIjDN42KLBjoRth8j+ewStZXV6hQmCeQ3vMJ29A4dY5Y110HxwsC1uMM oW2GQ0CY8Wd9yi4x8lI0VHeP4B8nnxCvTz0Dq7ps= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zqiang , syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com, Takashi Iwai , Sasha Levin Subject: [PATCH 4.19 187/239] ALSA: seq: Set upper limit of processed events Date: Mon, 24 Jan 2022 19:43:45 +0100 Message-Id: <20220124183949.046047461@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 6fadb494a638d8b8a55864ecc6ac58194f03f327 ] Currently ALSA sequencer core tries to process the queued events as much as possible when they become dispatchable. If applications try to queue too massive events to be processed at the very same timing, the sequencer core would still try to process such all events, either in the interrupt context or via some notifier; in either away, it might be a cause of RCU stall or such problems. As a potential workaround for those problems, this patch adds the upper limit of the amount of events to be processed. The remaining events are processed in the next batch, so they won't be lost. For the time being, it's limited up to 1000 events per queue, which should be high enough for any normal usages. Reported-by: Zqiang Reported-by: syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211102033222.3849-1-qiang.zhang1211@gmail= .com Link: https://lore.kernel.org/r/20211207165146.2888-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/core/seq/seq_queue.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c index 28b4dd45b8d1d..a23ba648db845 100644 --- a/sound/core/seq/seq_queue.c +++ b/sound/core/seq/seq_queue.c @@ -247,12 +247,15 @@ struct snd_seq_queue *snd_seq_queue_find_name(char *n= ame) =20 /* -------------------------------------------------------- */ =20 +#define MAX_CELL_PROCESSES_IN_QUEUE 1000 + void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) { unsigned long flags; struct snd_seq_event_cell *cell; snd_seq_tick_time_t cur_tick; snd_seq_real_time_t cur_time; + int processed =3D 0; =20 if (q =3D=3D NULL) return; @@ -275,6 +278,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int a= tomic, int hop) if (!cell) break; snd_seq_dispatch_event(cell, atomic, hop); + if (++processed >=3D MAX_CELL_PROCESSES_IN_QUEUE) + goto out; /* the rest processed at the next batch */ } =20 /* Process time queue... */ @@ -284,14 +289,19 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int= atomic, int hop) if (!cell) break; snd_seq_dispatch_event(cell, atomic, hop); + if (++processed >=3D MAX_CELL_PROCESSES_IN_QUEUE) + goto out; /* the rest processed at the next batch */ } =20 + out: /* free lock */ spin_lock_irqsave(&q->check_lock, flags); if (q->check_again) { q->check_again =3D 0; - spin_unlock_irqrestore(&q->check_lock, flags); - goto __again; + if (processed < MAX_CELL_PROCESSES_IN_QUEUE) { + spin_unlock_irqrestore(&q->check_lock, flags); + goto __again; + } } q->check_blocked =3D 0; spin_unlock_irqrestore(&q->check_lock, flags); --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08732C43219 for ; Mon, 24 Jan 2022 20:00:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359320AbiAXT7c (ORCPT ); Mon, 24 Jan 2022 14:59:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349339AbiAXTlc (ORCPT ); Mon, 24 Jan 2022 14:41:32 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D9FBC07A978; Mon, 24 Jan 2022 11:21:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A1F8561361; Mon, 24 Jan 2022 19:21:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 717D3C340E5; Mon, 24 Jan 2022 19:21:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052095; bh=JSmRYlIV/nVbbICD6eiKf9M9QQghEUe51u2q/tZL6HI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r/3s7LCFJcJ3do0VdqJ3avlwrbb2ZvxhFkMAlNDk9HXV0TOFSm9AKHymxpzYZPT7a xIUbIEq9XsNon6JpGfAdy9Ny4jfdFVrFy5guIx/oGp/9M+3/qIP/cjEJaw3GnyB5TJ mESQzZHak6zeTaB9QgTVhah/RgsRE8sR45h82XqI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Hari Bathini , Michael Ellerman , Sasha Levin Subject: [PATCH 4.19 188/239] powerpc: handle kdump appropriately with crash_kexec_post_notifiers option Date: Mon, 24 Jan 2022 19:43:46 +0100 Message-Id: <20220124183949.085683045@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hari Bathini [ Upstream commit 219572d2fc4135b5ce65c735d881787d48b10e71 ] Kdump can be triggered after panic_notifers since commit f06e5153f4ae2 ("kernel/panic.c: add "crash_kexec_post_notifiers" option for kdump after panic_notifers") introduced crash_kexec_post_notifiers option. But using this option would mean smp_send_stop(), that marks all other CPUs as offline, gets called before kdump is triggered. As a result, kdump routines fail to save other CPUs' registers. To fix this, kdump friendly crash_smp_send_stop() function was introduced with kernel commit 0ee59413c967 ("x86/panic: replace smp_send_stop() with kdump friendly version in panic path"). Override this kdump friendly weak function to handle crash_kexec_post_notifiers option appropriately on powerpc. Reported-by: kernel test robot Signed-off-by: Hari Bathini [Fixed signature of crash_stop_this_cpu() - reported by lkp@intel.com] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211207103719.91117-1-hbathini@linux.ibm.c= om Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/kernel/smp.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c index 4853ac67cf21f..60fc3c71aa7b0 100644 --- a/arch/powerpc/kernel/smp.c +++ b/arch/powerpc/kernel/smp.c @@ -564,6 +564,36 @@ void crash_send_ipi(void (*crash_ipi_callback)(struct = pt_regs *)) } #endif =20 +#ifdef CONFIG_NMI_IPI +static void crash_stop_this_cpu(struct pt_regs *regs) +#else +static void crash_stop_this_cpu(void *dummy) +#endif +{ + /* + * Just busy wait here and avoid marking CPU as offline to ensure + * register data is captured appropriately. + */ + while (1) + cpu_relax(); +} + +void crash_smp_send_stop(void) +{ + static bool stopped =3D false; + + if (stopped) + return; + + stopped =3D true; + +#ifdef CONFIG_NMI_IPI + smp_send_nmi_ipi(NMI_IPI_ALL_OTHERS, crash_stop_this_cpu, 1000000); +#else + smp_call_function(crash_stop_this_cpu, NULL, 0); +#endif /* CONFIG_NMI_IPI */ +} + #ifdef CONFIG_NMI_IPI static void nmi_stop_this_cpu(struct pt_regs *regs) { --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25081C4332F for ; Mon, 24 Jan 2022 19:53:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351814AbiAXTw6 (ORCPT ); Mon, 24 Jan 2022 14:52:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55008 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234964AbiAXTmC (ORCPT ); Mon, 24 Jan 2022 14:42:02 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 93EF4C0401F9; Mon, 24 Jan 2022 11:21:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 504B9B8122C; Mon, 24 Jan 2022 19:21:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5EC7DC340E5; Mon, 24 Jan 2022 19:21:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052098; bh=9uuTNGN4fd8TIPEbjUjg8u469Jw6qL+92O7t1DCz5R4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=joy4VfxCgwXNO5CKZ3PEVyOgDrHjzP0SWn1jc79vdMbZou66o8UbZeG6LrWJtBREz vv+bTAT1GVLWJZo2zr11ssBFNE7ogCKCp8n8ZLQqTucS1ZAbp+4yoZ5bCUUJYcqk2V pE3bcNUfWqougSF7MxdxypuZzbUyXrmCCA7wUljA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zeal Robot , Ye Guojin , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.19 189/239] MIPS: OCTEON: add put_device() after of_find_device_by_node() Date: Mon, 24 Jan 2022 19:43:47 +0100 Message-Id: <20220124183949.123070769@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Guojin [ Upstream commit 858779df1c0787d3fec827fb705708df9ebdb15b ] This was found by coccicheck: ./arch/mips/cavium-octeon/octeon-platform.c, 332, 1-7, ERROR missing put_device; call of_find_device_by_node on line 324, but without a corresponding object release within this function. ./arch/mips/cavium-octeon/octeon-platform.c, 395, 1-7, ERROR missing put_device; call of_find_device_by_node on line 387, but without a corresponding object release within this function. ./arch/mips/cavium-octeon/octeon-usb.c, 512, 3-9, ERROR missing put_device; call of_find_device_by_node on line 515, but without a corresponding object release within this function. ./arch/mips/cavium-octeon/octeon-usb.c, 543, 1-7, ERROR missing put_device; call of_find_device_by_node on line 515, but without a corresponding object release within this function. Reported-by: Zeal Robot Signed-off-by: Ye Guojin Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/mips/cavium-octeon/octeon-platform.c | 2 ++ arch/mips/cavium-octeon/octeon-usb.c | 1 + 2 files changed, 3 insertions(+) diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-o= cteon/octeon-platform.c index 5ba181e87d2c1..4d83f5bc7211c 100644 --- a/arch/mips/cavium-octeon/octeon-platform.c +++ b/arch/mips/cavium-octeon/octeon-platform.c @@ -328,6 +328,7 @@ static int __init octeon_ehci_device_init(void) =20 pd->dev.platform_data =3D &octeon_ehci_pdata; octeon_ehci_hw_start(&pd->dev); + put_device(&pd->dev); =20 return ret; } @@ -391,6 +392,7 @@ static int __init octeon_ohci_device_init(void) =20 pd->dev.platform_data =3D &octeon_ohci_pdata; octeon_ohci_hw_start(&pd->dev); + put_device(&pd->dev); =20 return ret; } diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon= /octeon-usb.c index 75189ff2f3c78..3465452e28195 100644 --- a/arch/mips/cavium-octeon/octeon-usb.c +++ b/arch/mips/cavium-octeon/octeon-usb.c @@ -543,6 +543,7 @@ static int __init dwc3_octeon_device_init(void) devm_iounmap(&pdev->dev, base); devm_release_mem_region(&pdev->dev, res->start, resource_size(res)); + put_device(&pdev->dev); } } while (node !=3D NULL); =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5579C433F5 for ; Mon, 24 Jan 2022 19:52:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352354AbiAXTwu (ORCPT ); Mon, 24 Jan 2022 14:52:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55028 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344119AbiAXTmE (ORCPT ); Mon, 24 Jan 2022 14:42:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62D9FC08ED7B; Mon, 24 Jan 2022 11:21:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2AAE1B811F9; Mon, 24 Jan 2022 19:21:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5EE5CC340E7; Mon, 24 Jan 2022 19:21:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052100; bh=Lnom6LnckZNdK5Md7AfhpynDWEz288hE0TFhXJoixF4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NZjy21PMEgm2npwtewDk8SC6egkU2ziG1P36bn4hffw5PA0E67DX0nAsF+KoLkqL5 qXqTlHZLGZ3+jYnWgEATtMCnidVmJ/2e+rMdcad4wxdSlIID0DteNcnS4dlFmTeHmD vJLNnPtUmdurbe69cGsAqbdLwQXdlmAyIpOpnwAw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wolfram Sang , Lakshmi Sowjanya D , Andy Shevchenko , Jarkko Nikula , Sasha Levin Subject: [PATCH 4.19 190/239] i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters Date: Mon, 24 Jan 2022 19:43:48 +0100 Message-Id: <20220124183949.154249958@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lakshmi Sowjanya D [ Upstream commit d52097010078c1844348dc0e467305e5f90fd317 ] The data type of hcnt and lcnt in the struct dw_i2c_dev is of type u16. It's better to have same data type in struct dw_scl_sda_cfg as well. Reported-by: Wolfram Sang Signed-off-by: Lakshmi Sowjanya D Signed-off-by: Andy Shevchenko Signed-off-by: Jarkko Nikula Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/i2c/busses/i2c-designware-pcidrv.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busse= s/i2c-designware-pcidrv.c index d50f804872149..4e6b3fb01c7a6 100644 --- a/drivers/i2c/busses/i2c-designware-pcidrv.c +++ b/drivers/i2c/busses/i2c-designware-pcidrv.c @@ -36,10 +36,10 @@ enum dw_pci_ctl_id_t { }; =20 struct dw_scl_sda_cfg { - u32 ss_hcnt; - u32 fs_hcnt; - u32 ss_lcnt; - u32 fs_lcnt; + u16 ss_hcnt; + u16 fs_hcnt; + u16 ss_lcnt; + u16 fs_lcnt; u32 sda_hold; }; =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 713CBC433F5 for ; Mon, 24 Jan 2022 19:58:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350818AbiAXT6s (ORCPT ); Mon, 24 Jan 2022 14:58:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348327AbiAXTmf (ORCPT ); Mon, 24 Jan 2022 14:42:35 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B7D47C08EE18; Mon, 24 Jan 2022 11:21:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 75845B8122C; Mon, 24 Jan 2022 19:21:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43AD6C340E5; Mon, 24 Jan 2022 19:21:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052104; bh=Qf6XnIzeElSZlaTPE0+w9iFReX52uTDmquC2axMPOMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i+WPU0dbfQrbRnhMiu/hj6m6DNwT6T9VWWAFpwFNptCCKk7tzTOHJz6f9PO4DMbVY yuGCqupcO9CJgz5OfOjS7AYPsZk/8Xm8FlW6v2BrPBDzGZKVV9Ca+OvJeVb+vF49HH +ruPDdUHTJ8pVS2zEgQb3uo+snutG197hTSjtUcI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tianjia Zhang , Nathan Chancellor , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.19 191/239] MIPS: Octeon: Fix build errors using clang Date: Mon, 24 Jan 2022 19:43:49 +0100 Message-Id: <20220124183949.188145353@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tianjia Zhang [ Upstream commit 95339b70677dc6f9a2d669c4716058e71b8dc1c7 ] A large number of the following errors is reported when compiling with clang: cvmx-bootinfo.h:326:3: error: adding 'int' to a string does not append to= the string [-Werror,-Wstring-plus-int] ENUM_BRD_TYPE_CASE(CVMX_BOARD_TYPE_NULL) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cvmx-bootinfo.h:321:20: note: expanded from macro 'ENUM_BRD_TYPE_CASE' case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ ~~~^~~~ cvmx-bootinfo.h:326:3: note: use array indexing to silence this warning cvmx-bootinfo.h:321:20: note: expanded from macro 'ENUM_BRD_TYPE_CASE' case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ ^ Follow the prompts to use the address operator '&' to fix this error. Signed-off-by: Tianjia Zhang Reviewed-by: Nathan Chancellor Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/mips/include/asm/octeon/cvmx-bootinfo.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/mips/include/asm/octeon/cvmx-bootinfo.h b/arch/mips/inclu= de/asm/octeon/cvmx-bootinfo.h index 62787765575ef..ce6e5fddce0bf 100644 --- a/arch/mips/include/asm/octeon/cvmx-bootinfo.h +++ b/arch/mips/include/asm/octeon/cvmx-bootinfo.h @@ -315,7 +315,7 @@ enum cvmx_chip_types_enum { =20 /* Functions to return string based on type */ #define ENUM_BRD_TYPE_CASE(x) \ - case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ + case x: return (&#x[16]); /* Skip CVMX_BOARD_TYPE_ */ static inline const char *cvmx_board_type_to_string(enum cvmx_board_types_enum type) { @@ -404,7 +404,7 @@ static inline const char *cvmx_board_type_to_string(enum } =20 #define ENUM_CHIP_TYPE_CASE(x) \ - case x: return(#x + 15); /* Skip CVMX_CHIP_TYPE */ + case x: return (&#x[15]); /* Skip CVMX_CHIP_TYPE */ static inline const char *cvmx_chip_type_to_string(enum cvmx_chip_types_enum type) { --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E4ABC433F5 for ; Mon, 24 Jan 2022 19:53:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351895AbiAXTxY (ORCPT ); Mon, 24 Jan 2022 14:53:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348646AbiAXTmg (ORCPT ); Mon, 24 Jan 2022 14:42:36 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BBC06C033270; Mon, 24 Jan 2022 11:21:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 60631B8122C; Mon, 24 Jan 2022 19:21:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FF81C340E5; Mon, 24 Jan 2022 19:21:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052107; bh=dPECgQQvYcxOo2hldr1cbm6OU4xhatPfSlbAjSYEegw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2tFsebKfXfDRZT6i3k6ZWPH//jwcd/jRjLF+4cn2A038cREKif1AcCD0yFYqraww9 iciCc+ZNGojoiSjItNMSA2+vBfnEznvm4pC6dw26ZXJFkJFhOM7hMHpz5/E7AHkqIj PICiJbW/iBAMzXWNeXWcGLDUORJtOTpZ91C0sPC4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Baoquan He , Christoph Hellwig , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.19 192/239] scsi: sr: Dont use GFP_DMA Date: Mon, 24 Jan 2022 19:43:50 +0100 Message-Id: <20220124183949.219917316@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christoph Hellwig [ Upstream commit d94d94969a4ba07a43d62429c60372320519c391 ] The allocated buffers are used as a command payload, for which the block layer and/or DMA API do the proper bounce buffering if needed. Link: https://lore.kernel.org/r/20211222090842.920724-1-hch@lst.de Reported-by: Baoquan He Reviewed-by: Baoquan He Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/sr.c | 2 +- drivers/scsi/sr_vendor.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c index 84dd776d36c33..fdbd5c691d333 100644 --- a/drivers/scsi/sr.c +++ b/drivers/scsi/sr.c @@ -885,7 +885,7 @@ static void get_capabilities(struct scsi_cd *cd) =20 =20 /* allocate transfer buffer */ - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) { sr_printk(KERN_ERR, cd, "out of memory.\n"); return; diff --git a/drivers/scsi/sr_vendor.c b/drivers/scsi/sr_vendor.c index b9db2ec6d0361..996bccadd3866 100644 --- a/drivers/scsi/sr_vendor.c +++ b/drivers/scsi/sr_vendor.c @@ -113,7 +113,7 @@ int sr_set_blocklength(Scsi_CD *cd, int blocklength) if (cd->vendor =3D=3D VENDOR_TOSHIBA) density =3D (blocklength > 2048) ? 0x81 : 0x83; =20 - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 @@ -161,7 +161,7 @@ int sr_cd_check(struct cdrom_device_info *cdi) if (cd->cdi.mask & CDC_MULTI_SESSION) return 0; =20 - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79BCEC43217 for ; Mon, 24 Jan 2022 19:31:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352645AbiAXTaw (ORCPT ); Mon, 24 Jan 2022 14:30:52 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:45558 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233251AbiAXTVy (ORCPT ); Mon, 24 Jan 2022 14:21:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A5943B8122C; Mon, 24 Jan 2022 19:21:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6F7FC340E7; Mon, 24 Jan 2022 19:21:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052110; bh=FpjEEp5qZAA2Ti4wiR35cwToImkcThW+7KWjliH3LY0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LI9V4mLHejCVtHwPU1DgKY903IchOm2EU2Oj0GdPGIKBrPR2Z8aZ2PATSLqKDSbwr w9Vk8MXPWrVg5sn7CbsYT0EhN0VFqfPeFn/H9uzOxt2EhJu7oscY8gl5BOi8HLrDEA FBWV62ON0ASH4iczxeYIwIC8b557RzcKHSReO78w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tzung-Bi Shih , Mark Brown , Sasha Levin Subject: [PATCH 4.19 193/239] ASoC: mediatek: mt8173: fix device_node leak Date: Mon, 24 Jan 2022 19:43:51 +0100 Message-Id: <20220124183949.250798327@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tzung-Bi Shih [ Upstream commit 493433785df0075afc0c106ab65f10a605d0b35d ] Fixes the device_node leak. Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20211224064719.2031210-2-tzungbi@google.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/soc/mediatek/mt8173/mt8173-max98090.c | 3 +++ sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 ++ sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 ++ sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 ++ 4 files changed, 9 insertions(+) diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediat= ek/mt8173/mt8173-max98090.c index 902d111016d6f..431ba3db17594 100644 --- a/sound/soc/mediatek/mt8173/mt8173-max98090.c +++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c @@ -169,6 +169,9 @@ static int mt8173_max98090_dev_probe(struct platform_de= vice *pdev) if (ret) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); + + of_node_put(codec_node); + of_node_put(platform_node); return ret; } =20 diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c b/sound/soc/m= ediatek/mt8173/mt8173-rt5650-rt5514.c index 582174d98c6c9..cdb3940710379 100644 --- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c +++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c @@ -217,6 +217,8 @@ static int mt8173_rt5650_rt5514_dev_probe(struct platfo= rm_device *pdev) if (ret) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); + + of_node_put(platform_node); return ret; } =20 diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/m= ediatek/mt8173/mt8173-rt5650-rt5676.c index b3670c8a5b8de..242f99716c619 100644 --- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c @@ -274,6 +274,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platfo= rm_device *pdev) if (ret) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); + + of_node_put(platform_node); return ret; } =20 diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek= /mt8173/mt8173-rt5650.c index 7a89b4aad182f..14011a70bcc41 100644 --- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c +++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c @@ -301,6 +301,8 @@ static int mt8173_rt5650_dev_probe(struct platform_devi= ce *pdev) if (ret) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); + + of_node_put(platform_node); return ret; } =20 --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98373C433EF for ; Mon, 24 Jan 2022 19:31:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352663AbiAXTay (ORCPT ); Mon, 24 Jan 2022 14:30:54 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:45578 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237734AbiAXTV5 (ORCPT ); Mon, 24 Jan 2022 14:21:57 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DD225B81232; Mon, 24 Jan 2022 19:21:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 018C3C340E5; Mon, 24 Jan 2022 19:21:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052113; bh=AXv0bhwDFHYDlHSaMxBSRFCsCriGi5RSJxtkFLs0kwU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=u6HMrRAIkHQfgVULCXOc2ADSZ2arp8by4ZzAEkKxBu50avDnusCgK5TqIOmEAHe+1 kGNa1uBeJyyjF/Z8S0octbofYBmHbbdlguhaqGSMU2+8ZopSd9o1UUWhQdxQldN1cw 1BkuYklwSCXnQmtZSyekvImCd2ELyQzgTqj3vizE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yauhen Kharuzhy , Hans de Goede , Sebastian Reichel , Sasha Levin Subject: [PATCH 4.19 194/239] power: bq25890: Enable continuous conversion for ADC at charging Date: Mon, 24 Jan 2022 19:43:52 +0100 Message-Id: <20220124183949.279829944@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yauhen Kharuzhy [ Upstream commit 80211be1b9dec04cc2805d3d81e2091ecac289a1 ] Instead of one shot run of ADC at beginning of charging, run continuous conversion to ensure that all charging-related values are monitored properly (input voltage, input current, themperature etc.). Signed-off-by: Yauhen Kharuzhy Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/power/supply/bq25890_charger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/power/supply/bq25890_charger.c b/drivers/power/supply/= bq25890_charger.c index 8e2c41ded171c..e90253b3f6561 100644 --- a/drivers/power/supply/bq25890_charger.c +++ b/drivers/power/supply/bq25890_charger.c @@ -521,12 +521,12 @@ static void bq25890_handle_state_change(struct bq2589= 0_device *bq, =20 if (!new_state->online) { /* power removed */ /* disable ADC */ - ret =3D bq25890_field_write(bq, F_CONV_START, 0); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 0); if (ret < 0) goto error; } else if (!old_state.online) { /* power inserted */ /* enable ADC, to have control of charge current/voltage */ - ret =3D bq25890_field_write(bq, F_CONV_START, 1); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 1); if (ret < 0) goto error; } --=20 2.34.1 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8844AC433EF for ; Mon, 24 Jan 2022 19:31:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352678AbiAXTa4 (ORCPT ); Mon, 24 Jan 2022 14:30:56 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:50176 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234470AbiAXTV5 (ORCPT ); Mon, 24 Jan 2022 14:21:57 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 557B461483; Mon, 24 Jan 2022 19:21:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 298A6C340E5; Mon, 24 Jan 2022 19:21:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052116; bh=n3NJfTp/Pp/vZAidsmeEXWJbiKjAhzMri3BOT8j4izQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TaagOhaNc/CBn0ksx45ffk9oMOf3QdPssT9bRXBy92Zf0zelXepT/Pc7styOAukUm Dij2921Zq4v3tGEC7z2ijINPMqJzRheeM6Hdjbn12ASTas/SpOLnW8w4Uu9LKjdTUu czAk2YVXyAVztpQvdKh5Rlgy2yEirHvwEMHn8/7g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bjorn Andersson , Arnaud Pouliquen , Mathieu Poirier Subject: [PATCH 4.19 195/239] rpmsg: core: Clean up resources on announce_create failure. Date: Mon, 24 Jan 2022 19:43:53 +0100 Message-Id: <20220124183949.311818706@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arnaud Pouliquen commit 8066c615cb69b7da8a94f59379847b037b3a5e46 upstream. During the rpmsg_dev_probe, if rpdev->ops->announce_create returns an error, the rpmsg device and default endpoint should be freed before exiting the function. Fixes: 5e619b48677c ("rpmsg: Split rpmsg core and virtio backend") Suggested-by: Bjorn Andersson Signed-off-by: Arnaud Pouliquen Reviewed-by: Bjorn Andersson Cc: stable Link: https://lore.kernel.org/r/20211206190758.10004-1-arnaud.pouliquen@fos= s.st.com Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/rpmsg/rpmsg_core.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) --- a/drivers/rpmsg/rpmsg_core.c +++ b/drivers/rpmsg/rpmsg_core.c @@ -473,13 +473,25 @@ static int rpmsg_dev_probe(struct device err =3D rpdrv->probe(rpdev); if (err) { dev_err(dev, "%s: failed: %d\n", __func__, err); - if (ept) - rpmsg_destroy_ept(ept); - goto out; + goto destroy_ept; } =20 - if (ept && rpdev->ops->announce_create) + if (ept && rpdev->ops->announce_create) { err =3D rpdev->ops->announce_create(rpdev); + if (err) { + dev_err(dev, "failed to announce creation\n"); + goto remove_rpdev; + } + } + + return 0; + +remove_rpdev: + if (rpdrv->remove) + rpdrv->remove(rpdev); +destroy_ept: + if (ept) + rpmsg_destroy_ept(ept); out: return err; } From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5C78FC4332F for ; Mon, 24 Jan 2022 19:54:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357138AbiAXTyM (ORCPT ); Mon, 24 Jan 2022 14:54:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355648AbiAXTnC (ORCPT ); Mon, 24 Jan 2022 14:43:02 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4BCDBC09424B; Mon, 24 Jan 2022 11:22:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E082B613B3; Mon, 24 Jan 2022 19:22:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94F55C340E5; Mon, 24 Jan 2022 19:22:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052123; bh=H7nvbYrauUoPT2xybAP6oulzQf5nTaPhNr5TPD56VnU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WTiCqKDFWBPoD/a6m3b618L43Cjj6xD1Wzr7K2v2YQmdu6GO8PVCstNA+UgVFcaoJ xoApaWTO6gwHbzD2OT+7XDymG0dd8cUfEpNEsbqlDHUiI+X6knYsUuTnhogt1mC/35 vBSisPJPAoRCMyKrycVIuY5uUbuil8oTIcDr0ncs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Petr Cvachoucek , Richard Weinberger Subject: [PATCH 4.19 196/239] ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers Date: Mon, 24 Jan 2022 19:43:54 +0100 Message-Id: <20220124183949.342700197@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Petr Cvachoucek commit 3fea4d9d160186617ff40490ae01f4f4f36b28ff upstream. it seems freeing the write buffers in the error path of the ubifs_remount_rw() is wrong. It leads later to a kernel oops like this: [10016.431274] UBIFS (ubi0:0): start fixing up free space [10090.810042] UBIFS (ubi0:0): free space fixup complete [10090.814623] UBIFS error (ubi0:0 pid 512): ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4 [10101.915108] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 517 [10105.275498] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 [10105.284352] Mem abort info: [10105.287160] ESR =3D 0x96000006 [10105.290252] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [10105.295592] SET =3D 0, FnV =3D 0 [10105.298652] EA =3D 0, S1PTW =3D 0 [10105.301848] Data abort info: [10105.304723] ISV =3D 0, ISS =3D 0x00000006 [10105.308573] CM =3D 0, WnR =3D 0 [10105.311564] user pgtable: 4k pages, 48-bit VAs, pgdp=3D00000000f03d1000 [10105.318034] [0000000000000030] pgd=3D00000000f6cee003, pud=3D00000000f4884003, pmd=3D0000000000000000 [10105.326783] Internal error: Oops: 96000006 [#1] PREEMPT SMP [10105.332355] Modules linked in: ath10k_pci ath10k_core ath mac80211 libarc4 cfg80211 nvme nvme_core cryptodev(O) [10105.342468] CPU: 3 PID: 518 Comm: touch Tainted: G O 5.4.3 #1 [10105.349517] Hardware name: HYPEX CPU (DT) [10105.353525] pstate: 40000005 (nZcv daif -PAN -UAO) [10105.358324] pc : atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 [10105.364596] lr : mutex_lock+0x1c/0x34 [10105.368253] sp : ffff000075633aa0 [10105.371563] x29: ffff000075633aa0 x28: 0000000000000001 [10105.376874] x27: ffff000076fa80c8 x26: 0000000000000004 [10105.382185] x25: 0000000000000030 x24: 0000000000000000 [10105.387495] x23: 0000000000000000 x22: 0000000000000038 [10105.392807] x21: 000000000000000c x20: ffff000076fa80c8 [10105.398119] x19: ffff000076fa8000 x18: 0000000000000000 [10105.403429] x17: 0000000000000000 x16: 0000000000000000 [10105.408741] x15: 0000000000000000 x14: fefefefefefefeff [10105.414052] x13: 0000000000000000 x12: 0000000000000fe0 [10105.419364] x11: 0000000000000fe0 x10: ffff000076709020 [10105.424675] x9 : 0000000000000000 x8 : 00000000000000a0 [10105.429986] x7 : ffff000076fa80f4 x6 : 0000000000000030 [10105.435297] x5 : 0000000000000000 x4 : 0000000000000000 [10105.440609] x3 : 0000000000000000 x2 : ffff00006f276040 [10105.445920] x1 : ffff000075633ab8 x0 : 0000000000000030 [10105.451232] Call trace: [10105.453676] atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 [10105.459600] ubifs_garbage_collect+0xb4/0x334 [10105.463956] ubifs_budget_space+0x398/0x458 [10105.468139] ubifs_create+0x50/0x180 [10105.471712] path_openat+0x6a0/0x9b0 [10105.475284] do_filp_open+0x34/0x7c [10105.478771] do_sys_open+0x78/0xe4 [10105.482170] __arm64_sys_openat+0x1c/0x24 [10105.486180] el0_svc_handler+0x84/0xc8 [10105.489928] el0_svc+0x8/0xc [10105.492808] Code: 52800013 17fffffb d2800003 f9800011 (c85ffc05) [10105.498903] ---[ end trace 46b721d93267a586 ]--- To reproduce the problem: 1. Filesystem initially mounted read-only, free space fixup flag set. 2. mount -o remount,rw 3. it takes some time (free space fixup running) ... try to terminate running mount by CTRL-C ... does not respond, only after free space fixup is complete ... then "ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4" 4. mount -o remount,rw ... now finished instantly (fixup already done). 5. Create file or just unmount the filesystem and we get the oops. Cc: Fixes: b50b9f408502 ("UBIFS: do not free write-buffers when in R/O mode") Signed-off-by: Petr Cvachoucek Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/ubifs/super.c | 1 - 1 file changed, 1 deletion(-) --- a/fs/ubifs/super.c +++ b/fs/ubifs/super.c @@ -1730,7 +1730,6 @@ out: kthread_stop(c->bgt); c->bgt =3D NULL; } - free_wbufs(c); kfree(c->write_reserve_buf); c->write_reserve_buf =3D NULL; vfree(c->ileb_buf); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CFC3C4332F for ; Mon, 24 Jan 2022 19:31:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352719AbiAXTa6 (ORCPT ); Mon, 24 Jan 2022 14:30:58 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:45960 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345181AbiAXTWJ (ORCPT ); Mon, 24 Jan 2022 14:22:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9C486B811F9; Mon, 24 Jan 2022 19:22:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6C59C340E5; Mon, 24 Jan 2022 19:22:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052126; bh=/5/CJb6Fyon2cuhp/4IYOBwBZ4GC+0GuDTvi8QtMyYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D2auywxv+Qm67H1AneJy101i1yEn3n8VCM+vrVPDQ4NOZohzseqrzWjTwnaOSviFB B/qRpHATfF3DBY7wtARlaP9zPEAMrT3+DSWatOQmo53FPZD6+EFZtdrBEKki9aMdH8 7Dp0pMuQMi6Y15DAwvpAiVNetTzu7PudCYlbbtqg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rafael Gago Castano , Jan Kiszka , Su Bao Cheng , Lukas Wunner Subject: [PATCH 4.19 197/239] serial: Fix incorrect rs485 polarity on uart open Date: Mon, 24 Jan 2022 19:43:55 +0100 Message-Id: <20220124183949.373291831@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner commit d3b3404df318504ec084213ab1065b73f49b0f1d upstream. Commit a6845e1e1b78 ("serial: core: Consider rs485 settings to drive RTS") sought to deassert RTS when opening an rs485-enabled uart port. That way, the transceiver does not occupy the bus until it transmits data. Unfortunately, the commit mixed up the logic and *asserted* RTS instead of *deasserting* it: The commit amended uart_port_dtr_rts(), which raises DTR and RTS when opening an rs232 port. "Raising" actually means lowering the signal that's coming out of the uart, because an rs232 transceiver not only changes a signal's voltage level, it also *inverts* the signal. See the simplified schematic in the MAX232 datasheet for an example: https://www.ti.com/lit/ds/symlink/max232.pdf So, to raise RTS on an rs232 port, TIOCM_RTS is *set* in port->mctrl and that results in the signal being driven low. In contrast to rs232, the signal level for rs485 Transmit Enable is the identity, not the inversion: If the transceiver expects a "high" RTS signal for Transmit Enable, the signal coming out of the uart must also be high, so TIOCM_RTS must be *cleared* in port->mctrl. The commit did the exact opposite, but it's easy to see why given the confusing semantics of rs232 and rs485. Fix it. Fixes: a6845e1e1b78 ("serial: core: Consider rs485 settings to drive RTS") Cc: stable@vger.kernel.org # v4.14+ Cc: Rafael Gago Castano Cc: Jan Kiszka Cc: Su Bao Cheng Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/9395767847833f2f3193c49cde38501eeb3b5669.16= 39821059.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/serial_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -159,7 +159,7 @@ static void uart_port_dtr_rts(struct uar int RTS_after_send =3D !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND); =20 if (raise) { - if (rs485_on && !RTS_after_send) { + if (rs485_on && RTS_after_send) { uart_set_mctrl(uport, TIOCM_DTR); uart_clear_mctrl(uport, TIOCM_RTS); } else { @@ -168,7 +168,7 @@ static void uart_port_dtr_rts(struct uar } else { unsigned int clear =3D TIOCM_DTR; =20 - clear |=3D (!rs485_on || !RTS_after_send) ? TIOCM_RTS : 0; + clear |=3D (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0; uart_clear_mctrl(uport, clear); } } From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCFA5C433EF for ; Mon, 24 Jan 2022 19:54:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346232AbiAXTyU (ORCPT ); Mon, 24 Jan 2022 14:54:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55310 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355708AbiAXTnR (ORCPT ); Mon, 24 Jan 2022 14:43:17 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 05330C09426F; Mon, 24 Jan 2022 11:22:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B6D6EB81238; Mon, 24 Jan 2022 19:22:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DCB4DC340E5; Mon, 24 Jan 2022 19:22:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052129; bh=RBxzockm7IGww9Gidb7iHej/D4Pfg9LdFunCed2fnb0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iFjdcqo2N5JoYSHuUJdgSc7Tyk1GMDTan4xsddo5Ugz+n3aNVcbMrBKHdKx8ge8h0 npEEAfdZVTTjbQusfe/kt7kw1dfZxXZf5jEnadn/daghFPqlMq9TMjcaNalakZCn4U cYnXa1/3stjCmUJF6+248aZXiI3WhC5KcaLRHKMg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrey Ryabinin , "Peter Zijlstra (Intel)" , Daniel Jordan , Tejun Heo Subject: [PATCH 4.19 198/239] cputime, cpuacct: Include guest time in user time in cpuacct.stat Date: Mon, 24 Jan 2022 19:43:56 +0100 Message-Id: <20220124183949.404799676@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andrey Ryabinin commit 9731698ecb9c851f353ce2496292ff9fcea39dff upstream. cpuacct.stat in no-root cgroups shows user time without guest time included int it. This doesn't match with user time shown in root cpuacct.stat and /proc//stat. This also affects cgroup2's cpu.stat in the same way. Make account_guest_time() to add user time to cgroup's cpustat to fix this. Fixes: ef12fefabf94 ("cpuacct: add per-cgroup utime/stime statistics") Signed-off-by: Andrey Ryabinin Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Daniel Jordan Acked-by: Tejun Heo Cc: Link: https://lore.kernel.org/r/20211115164607.23784-1-arbn@yandex-team.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/sched/cputime.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -146,10 +146,10 @@ void account_guest_time(struct task_stru =20 /* Add guest time to cpustat. */ if (task_nice(p) > 0) { - cpustat[CPUTIME_NICE] +=3D cputime; + task_group_account_field(p, CPUTIME_NICE, cputime); cpustat[CPUTIME_GUEST_NICE] +=3D cputime; } else { - cpustat[CPUTIME_USER] +=3D cputime; + task_group_account_field(p, CPUTIME_USER, cputime); cpustat[CPUTIME_GUEST] +=3D cputime; } } From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74A5AC433F5 for ; Mon, 24 Jan 2022 19:54:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357046AbiAXTyY (ORCPT ); Mon, 24 Jan 2022 14:54:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348066AbiAXTnV (ORCPT ); Mon, 24 Jan 2022 14:43:21 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A845C094275; Mon, 24 Jan 2022 11:22:13 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3932360010; Mon, 24 Jan 2022 19:22:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10751C340E5; Mon, 24 Jan 2022 19:22:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052132; bh=32f1GQzhq8P7rtzI6K3kbis7qu0LI7dysxm9i2zoPKc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PVbwqyaFY/1xleS8oZA+j2NPUDWO1mi4trrGWMSADy8e/wfj5xE86cB/pJS8DhghL +lQ5Oh3aYpyWn6FhR+zBOYBL5UwKMZSmih41VDdA3J7DQrGELYqUjk6RNw1EpsCbTy H60xCHosd904Uk10z4TCUeLDp9kusj8D76Cgx+Mw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ilan Peer , Luca Coelho Subject: [PATCH 4.19 199/239] iwlwifi: mvm: Increase the scan timeout guard to 30 seconds Date: Mon, 24 Jan 2022 19:43:57 +0100 Message-Id: <20220124183949.441382787@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ilan Peer commit ced50f1133af12f7521bb777fcf4046ca908fb77 upstream. With the introduction of 6GHz channels the scan guard timeout should be adjusted to account for the following extreme case: - All 6GHz channels are scanned passively: 58 channels. - The scan is fragmented with the following parameters: 3 fragments, 95 TUs suspend time, 44 TUs maximal out of channel time. The above would result with scan time of more than 24 seconds. Thus, set the timeout to 30 seconds. Cc: stable@vger.kernel.org Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20211210090244.3c851b93aef5.I346fa2= e1d79220a6770496e773c6f87a2ad9e6c4@changeid Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c @@ -1555,7 +1555,7 @@ static int iwl_mvm_check_running_scans(s return -EIO; } =20 -#define SCAN_TIMEOUT 20000 +#define SCAN_TIMEOUT 30000 =20 void iwl_mvm_scan_timeout_wk(struct work_struct *work) { From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CDB3DC4707F for ; Mon, 24 Jan 2022 19:57:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358302AbiAXTyw (ORCPT ); Mon, 24 Jan 2022 14:54:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344288AbiAXTnd (ORCPT ); Mon, 24 Jan 2022 14:43:33 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 35985C09427E; Mon, 24 Jan 2022 11:22:18 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F250DB81236; Mon, 24 Jan 2022 19:22:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21C70C340E7; Mon, 24 Jan 2022 19:22:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052135; bh=k6hFSNaZQpyFhrbjAzHTCV+pR3fyHRq4OVMIzVn/ZKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RzzBOJstmrOuMehpB8PdJBBbrd6PWuTApfCobUaK2BqvJ2NTUfFHwpNCz11EdpRA8 YyoJfv6xnHzHtcN2wc2dtvC54fiR9fhlP9tnZ9VXbVTnSVjY/wcTyPf6AAbtXcMxhT +i8QYzwd8i6Ie7ZoiYNNmrilAe4I8exz9bSw2TyU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vlastimil Babka , Gerald Schaefer , Alexander Gordeev , Heiko Carstens Subject: [PATCH 4.19 200/239] s390/mm: fix 2KB pgtable release race Date: Mon, 24 Jan 2022 19:43:58 +0100 Message-Id: <20220124183949.471391396@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Gordeev commit c2c224932fd0ee6854d6ebfc8d059c2bcad86606 upstream. There is a race on concurrent 2KB-pgtables release paths when both upper and lower halves of the containing parent page are freed, one via page_table_free_rcu() + __tlb_remove_table(), and the other via page_table_free(). The race might lead to a corruption as result of remove of list item in page_table_free() concurrently with __free_page() in __tlb_remove_table(). Let's assume first the lower and next the upper 2KB-pgtables are freed from a page. Since both halves of the page are allocated the tracking byte (bits 24-31 of the page _refcount) has value of 0x03 initially: CPU0 CPU1 Reviewed-by: Gerald Schaefer Suggested-by: Vlastimil Babka Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee ---- ---- page_table_free_rcu() // lower half { // _refcount[31..24] =3D=3D 0x03 ... atomic_xor_bits(&page->_refcount, 0x11U << (0 + 24)); // _refcount[31..24] <=3D 0x12 ... table =3D table | (1U << 0); tlb_remove_table(tlb, table); } ... __tlb_remove_table() { // _refcount[31..24] =3D=3D 0x12 mask =3D _table & 3; // mask <=3D 0x01 ... page_table_free() // upper half { // _refcount[31..24] =3D=3D 0x12 ... atomic_xor_bits( &page->_refcount, 1U << (1 + 24)); // _refcount[31..24] <=3D 0x10 // mask <=3D 0x10 ... atomic_xor_bits(&page->_refcount, mask << (4 + 24)); // _refcount[31..24] <=3D 0x00 // mask <=3D 0x00 ... if (mask !=3D 0) // =3D=3D false break; fallthrough; ... if (mask & 3) // =3D=3D false ... else __free_page(page); list_del(&page->lru); ^^^^^^^^^^^^^^^^^^ RACE! ^^^^^^^^^^^^^^^^^^^^^ } ... } The problem is page_table_free() releases the page as result of lower nibble unset and __tlb_remove_table() observing zero too early. With this update page_table_free() will use the similar logic as page_table_free_rcu() + __tlb_remove_table(), and mark the fragment as pending for removal in the upper nibble until after the list_del(). In other words, the parent page is considered as unreferenced and safe to release only when the lower nibble is cleared already and unsetting a bit in upper nibble results in that nibble turned zero. Cc: stable@vger.kernel.org Suggested-by: Vlastimil Babka Reviewed-by: Gerald Schaefer Signed-off-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman --- arch/s390/mm/pgalloc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/s390/mm/pgalloc.c +++ b/arch/s390/mm/pgalloc.c @@ -256,13 +256,15 @@ void page_table_free(struct mm_struct *m /* Free 2K page table fragment of a 4K page */ bit =3D (__pa(table) & ~PAGE_MASK)/(PTRS_PER_PTE*sizeof(pte_t)); spin_lock_bh(&mm->context.lock); - mask =3D atomic_xor_bits(&page->_refcount, 1U << (bit + 24)); + mask =3D atomic_xor_bits(&page->_refcount, 0x11U << (bit + 24)); mask >>=3D 24; if (mask & 3) list_add(&page->lru, &mm->context.pgtable_list); else list_del(&page->lru); spin_unlock_bh(&mm->context.lock); + mask =3D atomic_xor_bits(&page->_refcount, 0x10U << (bit + 24)); + mask >>=3D 24; if (mask !=3D 0) return; } else { From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BABD6C433EF for ; Mon, 24 Jan 2022 20:00:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359420AbiAXT7l (ORCPT ); Mon, 24 Jan 2022 14:59:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54960 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347778AbiAXTnx (ORCPT ); Mon, 24 Jan 2022 14:43:53 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D772AC02C30A; Mon, 24 Jan 2022 11:22:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 74ED161491; Mon, 24 Jan 2022 19:22:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 481EBC340EF; Mon, 24 Jan 2022 19:22:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052138; bh=QAW+5nGZUHNDtS8WUTH89x+IqYTXaclC0CdjyXIXtTg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ga2rGNlxH94QVeRSRtIhhPIwv23HCcPTkQJa04XHbUHhla79z2NO1qR18H2gmp98Z fHVJMOueUCEd5p50DbBf5Al1YTJZDbzyLQa8TRgibvEtxFlx1iQXy1VC5lNUjrs36Q 51SK+MdMC+fCSp88C22BtQ8WXOYugNN7eo1C7JEc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Lucas Stach , Christian Gmeiner Subject: [PATCH 4.19 201/239] drm/etnaviv: limit submit sizes Date: Mon, 24 Jan 2022 19:43:59 +0100 Message-Id: <20220124183949.502885321@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lucas Stach commit 6dfa2fab8ddd46faa771a102672176bee7a065de upstream. Currently we allow rediculous amounts of kernel memory being allocated via the etnaviv GEM_SUBMIT ioctl, which is a pretty easy DoS vector. Put some reasonable limits in to fix this. The commandstream size is limited to 64KB, which was already a soft limit on older kernels after which the kernel only took submits on a best effort base, so there is no userspace that tries to submit commandstreams larger than this. Even if the whole commandstream is a single incrementing address load, the size limit also limits the number of potential relocs and referenced buffers to slightly under 64K, so use the same limit for those arguments. The performance monitoring infrastructure currently supports less than 50 performance counter signals, so limiting them to 128 on a single submit seems like a reasonably future-proof number for now. This number can be bumped if needed without breaking the interface. Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Signed-off-by: Lucas Stach Reviewed-by: Christian Gmeiner Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c @@ -444,6 +444,12 @@ int etnaviv_ioctl_gem_submit(struct drm_ return -EINVAL; } =20 + if (args->stream_size > SZ_64K || args->nr_relocs > SZ_64K || + args->nr_bos > SZ_64K || args->nr_pmrs > 128) { + DRM_ERROR("submit arguments out of size limits\n"); + return -EINVAL; + } + /* * Copy the command submission and bo array to kernel space in * one go, and do this outside of any locks. From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E922C433EF for ; Mon, 24 Jan 2022 19:57:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358892AbiAXTz7 (ORCPT ); Mon, 24 Jan 2022 14:55:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355862AbiAXToE (ORCPT ); Mon, 24 Jan 2022 14:44:04 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13F2AC02B8C5; Mon, 24 Jan 2022 11:22:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9FFAC6131E; Mon, 24 Jan 2022 19:22:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6482EC340E5; Mon, 24 Jan 2022 19:22:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052142; bh=TqIHgv56NEhzscdSjyNbYIuSq5WGNXRyGvRmEURN6lE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fGT5tB+zFiIQZIzZptdoasTEjCFsQboTuvhS6z7LWzOdCFT0s0bhlAsIPE4RG+SoS CAxLyglp4bE8yUzfu3NsZbK9qzrYZVLjwnK728I0zd94sxnr+xkbhHycowY1j1GPW9 5LPUjko8WlYe2WfPDOcjBZaMHJjmvJAfnsAwzKRc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jan Kara , stable@kernel.org, Theodore Tso , syzbot+3b6f9218b1301ddda3e2@syzkaller.appspotmail.com Subject: [PATCH 4.19 202/239] ext4: make sure to reset inode lockdep class when quota enabling fails Date: Mon, 24 Jan 2022 19:44:00 +0100 Message-Id: <20220124183949.531077186@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara commit 4013d47a5307fdb5c13370b5392498b00fedd274 upstream. When we succeed in enabling some quota type but fail to enable another one with quota feature, we correctly disable all enabled quota types. However we forget to reset i_data_sem lockdep class. When the inode gets freed and reused, it will inherit this lockdep class (i_data_sem is initialized only when a slab is created) and thus eventually lockdep barfs about possible deadlocks. Reported-and-tested-by: syzbot+3b6f9218b1301ddda3e2@syzkaller.appspotmail.c= om Signed-off-by: Jan Kara Cc: stable@kernel.org Link: https://lore.kernel.org/r/20211007155336.12493-3-jack@suse.cz Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/ext4/super.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5883,8 +5883,19 @@ static int ext4_enable_quotas(struct sup "Failed to enable quota tracking " "(type=3D%d, err=3D%d). Please run " "e2fsck to fix.", type, err); - for (type--; type >=3D 0; type--) + for (type--; type >=3D 0; type--) { + struct inode *inode; + + inode =3D sb_dqopt(sb)->files[type]; + if (inode) + inode =3D igrab(inode); dquot_quota_off(sb, type); + if (inode) { + lockdep_set_quota_inode(inode, + I_DATA_SEM_NORMAL); + iput(inode); + } + } =20 return err; } From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 177F1C433F5 for ; Mon, 24 Jan 2022 19:32:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243006AbiAXTbw (ORCPT ); Mon, 24 Jan 2022 14:31:52 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:46340 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345996AbiAXTWa (ORCPT ); Mon, 24 Jan 2022 14:22:30 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 804B3B81215; Mon, 24 Jan 2022 19:22:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8B8A8C340E5; Mon, 24 Jan 2022 19:22:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052145; bh=zhxegM3sBBiujj8RPue3C+DEmvIsUk70MnMMWX3SENk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XCVlsu39ayCxeh4HNEb9u8yEXiR15U3Kopnr60OESxzlGMQR+tL3llQ827NHI7DCL IbN7BcYx1W3tSDbsl/3A/5kcUiYYHxqjLDYFXvlYSJCiwT5+ogOAGmkDpgy61euPXC mOm0CCPP5QHQE9t+EYEQCBu6VZZgUPxzU9FN8pPE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jan Kara , stable@kernel.org, Theodore Tso Subject: [PATCH 4.19 203/239] ext4: make sure quota gets properly shutdown on error Date: Mon, 24 Jan 2022 19:44:01 +0100 Message-Id: <20220124183949.561283422@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara commit 15fc69bbbbbc8c72e5f6cc4e1be0f51283c5448e upstream. When we hit an error when enabling quotas and setting inode flags, we do not properly shutdown quota subsystem despite returning error from Q_QUOTAON quotactl. This can lead to some odd situations like kernel using quota file while it is still writeable for userspace. Make sure we properly cleanup the quota subsystem in case of error. Signed-off-by: Jan Kara Cc: stable@kernel.org Link: https://lore.kernel.org/r/20211007155336.12493-2-jack@suse.cz Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/ext4/super.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5797,10 +5797,7 @@ static int ext4_quota_on(struct super_bl =20 lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA); err =3D dquot_quota_on(sb, type, format_id, path); - if (err) { - lockdep_set_quota_inode(path->dentry->d_inode, - I_DATA_SEM_NORMAL); - } else { + if (!err) { struct inode *inode =3D d_inode(path->dentry); handle_t *handle; =20 @@ -5820,7 +5817,12 @@ static int ext4_quota_on(struct super_bl ext4_journal_stop(handle); unlock_inode: inode_unlock(inode); + if (err) + dquot_quota_off(sb, type); } + if (err) + lockdep_set_quota_inode(path->dentry->d_inode, + I_DATA_SEM_NORMAL); return err; } =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43A5DC43219 for ; Mon, 24 Jan 2022 19:31:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352984AbiAXTbn (ORCPT ); Mon, 24 Jan 2022 14:31:43 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:46416 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347384AbiAXTWd (ORCPT ); Mon, 24 Jan 2022 14:22:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 71BECB81236; Mon, 24 Jan 2022 19:22:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9F2B3C340E5; Mon, 24 Jan 2022 19:22:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052148; bh=FRukRTFFv3IyJWhgY9Oz80eIT2Q6q8nsT2qXjYOW4+U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cQIqpfxCqySjuhIFsoTe1sH3HvS4/hOqxyFe1+Mjx6N2zj8nqmPX0iLLsR9pxL6W5 +8JFN0paKjqXiTEYy+OI5e1JaJSqDE41CzPVh1K9exb03C5AgPxCt5OA9uMcJ40gMm pXZpgzRwsuLMeDI9Is8a5C+a7APvYSjNs1tF5SME= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeroen van Wolffelaar , =?UTF-8?q?Lu=C3=ADs=20Henriques?= , Theodore Tso , stable@kernel.org Subject: [PATCH 4.19 204/239] ext4: set csum seed in tmp inode while migrating to extents Date: Mon, 24 Jan 2022 19:44:02 +0100 Message-Id: <20220124183949.590528678@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lu=C3=ADs Henriques commit e81c9302a6c3c008f5c30beb73b38adb0170ff2d upstream. When migrating to extents, the temporary inode will have it's own checksum seed. This means that, when swapping the inodes data, the inode checksums will be incorrect. This can be fixed by recalculating the extents checksums again. Or simply by copying the seed into the temporary inode. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D213357 Reported-by: Jeroen van Wolffelaar Signed-off-by: Lu=C3=ADs Henriques Link: https://lore.kernel.org/r/20211214175058.19511-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/ext4/migrate.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -477,6 +477,17 @@ int ext4_ext_migrate(struct inode *inode ext4_journal_stop(handle); goto out_unlock; } + /* + * Use the correct seed for checksum (i.e. the seed from 'inode'). This + * is so that the metadata blocks will have the correct checksum after + * the migration. + * + * Note however that, if a crash occurs during the migration process, + * the recovery process is broken because the tmp_inode checksums will + * be wrong and the orphans cleanup will fail. + */ + ei =3D EXT4_I(inode); + EXT4_I(tmp_inode)->i_csum_seed =3D ei->i_csum_seed; i_size_write(tmp_inode, i_size_read(inode)); /* * Set the i_nlink to zero so it will be deleted later @@ -520,7 +531,6 @@ int ext4_ext_migrate(struct inode *inode goto out_tmp_inode; } =20 - ei =3D EXT4_I(inode); i_data =3D ei->i_data; memset(&lb, 0, sizeof(lb)); =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23E73C4321E for ; Mon, 24 Jan 2022 19:32:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353020AbiAXTbs (ORCPT ); Mon, 24 Jan 2022 14:31:48 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:46536 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347528AbiAXTWd (ORCPT ); Mon, 24 Jan 2022 14:22:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 68A7DB81238; Mon, 24 Jan 2022 19:22:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94296C340E5; Mon, 24 Jan 2022 19:22:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052151; bh=KeomZLIWd+QIVICLZe1MUJ5tC2c1xzdB1gqDYtN779Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z7a6wUp5C3qrh1vcC2CKN0Z7+iVw1gtzWs5Gs906QyDOC3xel405Fzprs0YLqzv2V 37TdDv3vPb8WKqtIbSzk6811VJcyA8AKALfUcznhMnt9HdWhe+sU8cwlL25SaNwUKm 5P4OatMc0LvLsbQGI4pKeIk/WH3mEyz4xMYSXf+M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ye Bin , Jan Kara , Theodore Tso , stable@kernel.org Subject: [PATCH 4.19 205/239] ext4: Fix BUG_ON in ext4_bread when write quota data Date: Mon, 24 Jan 2022 19:44:03 +0100 Message-Id: <20220124183949.629111091@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin commit 380a0091cab482489e9b19e07f2a166ad2b76d5c upstream. We got issue as follows when run syzkaller: [ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep:= Abort forced by user [ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only [ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '= (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle !=3D NULL = || create =3D=3D 0' [ 167.983601] ------------[ cut here ]------------ [ 167.984245] kernel BUG at fs/ext4/inode.c:847! [ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.= 0-rc5-next-20211217+ #123 [ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS = ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504 [ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 = c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f= > 0b 8b 04 244 [ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282 [ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 00000000000= 00000 [ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6= dee66 [ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed10736= 3fa09 [ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0= 761e8 [ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 00000000000= 00001 [ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:= 0000000000000000 [ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000= 006e0 [ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000= 00000 [ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000= 00400 [ 168.001899] Call Trace: [ 168.002235] [ 168.007167] ext4_bread+0xd/0x53 [ 168.007612] ext4_quota_write+0x20c/0x5c0 [ 168.010457] write_blk+0x100/0x220 [ 168.010944] remove_free_dqentry+0x1c6/0x440 [ 168.011525] free_dqentry.isra.0+0x565/0x830 [ 168.012133] remove_tree+0x318/0x6d0 [ 168.014744] remove_tree+0x1eb/0x6d0 [ 168.017346] remove_tree+0x1eb/0x6d0 [ 168.019969] remove_tree+0x1eb/0x6d0 [ 168.022128] qtree_release_dquot+0x291/0x340 [ 168.023297] v2_release_dquot+0xce/0x120 [ 168.023847] dquot_release+0x197/0x3e0 [ 168.024358] ext4_release_dquot+0x22a/0x2d0 [ 168.024932] dqput.part.0+0x1c9/0x900 [ 168.025430] __dquot_drop+0x120/0x190 [ 168.025942] ext4_clear_inode+0x86/0x220 [ 168.026472] ext4_evict_inode+0x9e8/0xa22 [ 168.028200] evict+0x29e/0x4f0 [ 168.028625] dispose_list+0x102/0x1f0 [ 168.029148] evict_inodes+0x2c1/0x3e0 [ 168.030188] generic_shutdown_super+0xa4/0x3b0 [ 168.030817] kill_block_super+0x95/0xd0 [ 168.031360] deactivate_locked_super+0x85/0xd0 [ 168.031977] cleanup_mnt+0x2bc/0x480 [ 168.033062] task_work_run+0xd1/0x170 [ 168.033565] do_exit+0xa4f/0x2b50 [ 168.037155] do_group_exit+0xef/0x2d0 [ 168.037666] __x64_sys_exit_group+0x3a/0x50 [ 168.038237] do_syscall_64+0x3b/0x90 [ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae In order to reproduce this problem, the following conditions need to be met: 1. Ext4 filesystem with no journal; 2. Filesystem image with incorrect quota data; 3. Abort filesystem forced by user; 4. umount filesystem; As in ext4_quota_write: ... if (EXT4_SB(sb)->s_journal && !handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=3D%llu, len= =3D%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len); return -EIO; } ... We only check handle if NULL when filesystem has journal. There is need check handle if NULL even when filesystem has no journal. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5999,7 +5999,7 @@ static ssize_t ext4_quota_write(struct s struct buffer_head *bh; handle_t *handle =3D journal_current_handle(); =20 - if (EXT4_SB(sb)->s_journal && !handle) { + if (!handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=3D%llu, len=3D%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0F25C433EF for ; Mon, 24 Jan 2022 19:57:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352925AbiAXT5j (ORCPT ); Mon, 24 Jan 2022 14:57:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55310 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356113AbiAXTpR (ORCPT ); Mon, 24 Jan 2022 14:45:17 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90AD7C02415F; Mon, 24 Jan 2022 11:22:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2FD86614AA; Mon, 24 Jan 2022 19:22:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0BF7EC36B0C; Mon, 24 Jan 2022 19:22:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052157; bh=Rx8dchfiegJrJJRwYhJBopyQhGvxJQNkEZe4Sd9hbbY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=13JPWYd2FLiGj+nz4W6ZLu8KEGdAtmDk5VXl3903os+ioVt64T9ZlpzB9+pAYBu2g OUXuRPZZifYmmRljrCxYyA2xST7Qaq2qTqA0GA4a5vb1TRzj+j8dD3deZnevMfkjdt Je0/kVE0NRfm0rIOuRVbJnZOrWqoSPLHpXNymHTo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Theodore Tso , Lukas Czerner , stable@kernel.org Subject: [PATCH 4.19 206/239] ext4: dont use the orphan list when migrating an inode Date: Mon, 24 Jan 2022 19:44:04 +0100 Message-Id: <20220124183949.658666774@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Theodore Ts'o commit 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 upstream. We probably want to remove the indirect block to extents migration feature after a deprecation window, but until then, let's fix a potential data loss problem caused by the fact that we put the tmp_inode on the orphan list. In the unlikely case where we crash and do a journal recovery, the data blocks belonging to the inode being migrated are also represented in the tmp_inode on the orphan list --- and so its data blocks will get marked unallocated, and available for reuse. Instead, stop putting the tmp_inode on the oprhan list. So in the case where we crash while migrating the inode, we'll leak an inode, which is not a disaster. It will be easily fixed the next time we run fsck, and it's better than potentially having blocks getting claimed by two different files, and losing data as a result. Signed-off-by: Theodore Ts'o Reviewed-by: Lukas Czerner Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/ext4/migrate.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -455,12 +455,12 @@ int ext4_ext_migrate(struct inode *inode percpu_down_write(&sbi->s_writepages_rwsem); =20 /* - * Worst case we can touch the allocation bitmaps, a bgd - * block, and a block to link in the orphan list. We do need - * need to worry about credits for modifying the quota inode. + * Worst case we can touch the allocation bitmaps and a block + * group descriptor block. We do need need to worry about + * credits for modifying the quota inode. */ handle =3D ext4_journal_start(inode, EXT4_HT_MIGRATE, - 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); + 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); =20 if (IS_ERR(handle)) { retval =3D PTR_ERR(handle); @@ -481,10 +481,6 @@ int ext4_ext_migrate(struct inode *inode * Use the correct seed for checksum (i.e. the seed from 'inode'). This * is so that the metadata blocks will have the correct checksum after * the migration. - * - * Note however that, if a crash occurs during the migration process, - * the recovery process is broken because the tmp_inode checksums will - * be wrong and the orphans cleanup will fail. */ ei =3D EXT4_I(inode); EXT4_I(tmp_inode)->i_csum_seed =3D ei->i_csum_seed; @@ -496,7 +492,6 @@ int ext4_ext_migrate(struct inode *inode clear_nlink(tmp_inode); =20 ext4_ext_tree_init(handle, tmp_inode); - ext4_orphan_add(handle, tmp_inode); ext4_journal_stop(handle); =20 /* @@ -521,12 +516,6 @@ int ext4_ext_migrate(struct inode *inode =20 handle =3D ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); if (IS_ERR(handle)) { - /* - * It is impossible to update on-disk structures without - * a handle, so just rollback in-core changes and live other - * work to orphan_list_cleanup() - */ - ext4_orphan_del(NULL, tmp_inode); retval =3D PTR_ERR(handle); goto out_tmp_inode; } From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6CB1C4167D for ; Mon, 24 Jan 2022 20:07:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376911AbiAXUEd (ORCPT ); Mon, 24 Jan 2022 15:04:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356359AbiAXTqB (ORCPT ); Mon, 24 Jan 2022 14:46:01 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5713CC02417B; Mon, 24 Jan 2022 11:22:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EA72E6143D; Mon, 24 Jan 2022 19:22:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBBEBC340E8; Mon, 24 Jan 2022 19:22:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052160; bh=T4/i0YuXX/RMcyoaCx/hrRoyWRKFKPUqGz9imKlq18w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RRbOcHXKXtDrWbwlXI3Ua5jakU8m74I/qmEPlu/m/X5WWFU0+5hdAgz/FsilPlU4c 9epGAVvKpjLmdTkIa/62ApY0scJYkuZ3rPLa2leoq/faic9f/0n8Ke+/3T/Aehu4gn PEu2Xbdz5yLeQvBKC4posgKZw/VRGNKdo6tO/MHI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marek Vasut , Alexandre Torgue , Fabien Dessenne , Herbert Xu , Lionel Debieve , Nicolas Toromanoff , linux-arm-kernel@lists.infradead.org, linux-stm32@st-md-mailman.stormreply.com, Nicolas Toromanoff Subject: [PATCH 4.19 207/239] crypto: stm32/crc32 - Fix kernel BUG triggered in probe() Date: Mon, 24 Jan 2022 19:44:05 +0100 Message-Id: <20220124183949.688480674@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marek Vasut commit 29009604ad4e3ef784fd9b9fef6f23610ddf633d upstream. The include/linux/crypto.h struct crypto_alg field cra_driver_name descript= ion states "Unique name of the transformation provider. " ... " this contains t= he name of the chip or provider and the name of the transformation algorithm." In case of the stm32-crc driver, field cra_driver_name is identical for all registered transformation providers and set to the name of the driver itsel= f, which is incorrect. This patch fixes it by assigning a unique cra_driver_na= me to each registered transformation provider. The kernel crash is triggered when the driver calls crypto_register_shashes= () which calls crypto_register_shash(), which calls crypto_register_alg(), whi= ch calls __crypto_register_alg(), which returns -EEXIST, which is propagated back through this call chain. Upon -EEXIST from crypto_register_shash(), the crypto_register_shashes() starts unregistering the providers back, and calls crypto_unregister_shash(), which calls crypto_unregister_alg(), and this is where the BUG() triggers due to incorrect cra_refcnt. Fixes: b51dbe90912a ("crypto: stm32 - Support for STM32 CRC32 crypto module= ") Signed-off-by: Marek Vasut Cc: # 4.12+ Cc: Alexandre Torgue Cc: Fabien Dessenne Cc: Herbert Xu Cc: Lionel Debieve Cc: Nicolas Toromanoff Cc: linux-arm-kernel@lists.infradead.org Cc: linux-stm32@st-md-mailman.stormreply.com To: linux-crypto@vger.kernel.org Acked-by: Nicolas Toromanoff Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/crypto/stm32/stm32_crc32.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/crypto/stm32/stm32_crc32.c +++ b/drivers/crypto/stm32/stm32_crc32.c @@ -230,7 +230,7 @@ static struct shash_alg algs[] =3D { .digestsize =3D CHKSUM_DIGEST_SIZE, .base =3D { .cra_name =3D "crc32", - .cra_driver_name =3D DRIVER_NAME, + .cra_driver_name =3D "stm32-crc32-crc32", .cra_priority =3D 200, .cra_flags =3D CRYPTO_ALG_OPTIONAL_KEY, .cra_blocksize =3D CHKSUM_BLOCK_SIZE, @@ -252,7 +252,7 @@ static struct shash_alg algs[] =3D { .digestsize =3D CHKSUM_DIGEST_SIZE, .base =3D { .cra_name =3D "crc32c", - .cra_driver_name =3D DRIVER_NAME, + .cra_driver_name =3D "stm32-crc32-crc32c", .cra_priority =3D 200, .cra_flags =3D CRYPTO_ALG_OPTIONAL_KEY, .cra_blocksize =3D CHKSUM_BLOCK_SIZE, From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46AD7C433F5 for ; Mon, 24 Jan 2022 20:07:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377072AbiAXUEx (ORCPT ); Mon, 24 Jan 2022 15:04:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56726 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356705AbiAXTrE (ORCPT ); Mon, 24 Jan 2022 14:47:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 001EEC038ADC; Mon, 24 Jan 2022 11:22:45 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8B9FEB8123F; Mon, 24 Jan 2022 19:22:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9EFFC340E5; Mon, 24 Jan 2022 19:22:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052163; bh=mJ7EnTXoE+3TzNWISKOxh44ytbpCqkpAZk/lHkYoLTw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sReFaDQoXuD53fU5UKCSfXMc6vC61oD/njv/23l5UTwltyP9+ovLcP0vjK4cvRH2U pQWrwSDoM5iHaWJb0cwpV5Sxm8GlPFi7QLcDkPsTwSHXrRhMxY0odsZBjmYxP9S+ee RPPzNLV5uS5nrIcBimzEBID12Oh09ZtGtnNeJjIg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, KaiChieh Chuang , Mark Brown , Will McVicker Subject: [PATCH 4.19 208/239] ASoC: dpcm: prevent snd_soc_dpcm use after free Date: Mon, 24 Jan 2022 19:44:06 +0100 Message-Id: <20220124183949.720547325@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: KaiChieh Chuang commit a9764869779081e8bf24da07ac040e8f3efcf13a upstream. The dpcm get from fe_clients/be_clients may be free before use Add a spin lock at snd_soc_card level, to protect the dpcm instance. The lock may be used in atomic context, so use spin lock. Use irq spin lock version, since the lock may be used in interrupts. possible race condition between void dpcm_be_disconnect( ... list_del(&dpcm->list_be); list_del(&dpcm->list_fe); kfree(dpcm); ... and for_each_dpcm_fe() for_each_dpcm_be*() race condition example Thread 1: snd_soc_dapm_mixer_update_power() -> soc_dpcm_runtime_update() -> dpcm_be_disconnect() -> kfree(dpcm); Thread 2: dpcm_fe_dai_trigger() -> dpcm_be_dai_trigger() -> snd_soc_dpcm_can_be_free_stop() -> if (dpcm->fe =3D=3D fe) Excpetion Scenario: two FE link to same BE FE1 -> BE FE2 -> Thread 1: switch of mixer between FE2 -> BE Thread 2: pcm_stop FE1 Exception: Unable to handle kernel paging request at virtual address dead0000000000e0 pc=3D<> [] dpcm_be_dai_trigger+0x29c/0x47c sound/soc/soc-pcm.c:3226 if (dpcm->fe =3D=3D fe) lr=3D<> [] dpcm_fe_dai_do_trigger+0x94/0x26c Backtrace: [] notify_die+0x68/0xb8 [] die+0x118/0x2a8 [] __do_kernel_fault+0x13c/0x14c [] do_translation_fault+0x64/0xa0 [] do_mem_abort+0x4c/0xd0 [] el1_da+0x24/0x40 [] dpcm_be_dai_trigger+0x29c/0x47c [] dpcm_fe_dai_do_trigger+0x94/0x26c [] dpcm_fe_dai_trigger+0x3c/0x44 [] snd_pcm_do_stop+0x50/0x5c [] snd_pcm_action+0xb4/0x13c [] snd_pcm_drop+0xa0/0x128 [] snd_pcm_common_ioctl+0x9d8/0x30f0 [] snd_pcm_ioctl_compat+0x29c/0x2f14 [] compat_SyS_ioctl+0x128/0x244 [] el0_svc_naked+0x34/0x38 [] 0xffffffffffffffff Signed-off-by: KaiChieh Chuang Signed-off-by: Mark Brown [willmcvicker: move spinlock to bottom of struct snd_soc_card] Signed-off-by: Will McVicker Cc: stable@vger.kernel.org # 4.19+ Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/sound/soc.h | 2 ++ sound/soc/soc-core.c | 1 + sound/soc/soc-pcm.c | 40 +++++++++++++++++++++++++++++++++------- 3 files changed, 36 insertions(+), 7 deletions(-) --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -1113,6 +1113,8 @@ struct snd_soc_card { u32 pop_time; =20 void *drvdata; + + spinlock_t dpcm_lock; }; =20 /* SoC machine DAI configuration, glues a codec and cpu DAI together */ --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -2752,6 +2752,7 @@ int snd_soc_register_card(struct snd_soc card->instantiated =3D 0; mutex_init(&card->mutex); mutex_init(&card->dapm_mutex); + spin_lock_init(&card->dpcm_lock); =20 ret =3D snd_soc_instantiate_card(card); if (ret !=3D 0) --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1221,6 +1221,7 @@ static int dpcm_be_connect(struct snd_so struct snd_soc_pcm_runtime *be, int stream) { struct snd_soc_dpcm *dpcm; + unsigned long flags; =20 /* only add new dpcms */ list_for_each_entry(dpcm, &fe->dpcm[stream].be_clients, list_be) { @@ -1236,8 +1237,10 @@ static int dpcm_be_connect(struct snd_so dpcm->fe =3D fe; be->dpcm[stream].runtime =3D fe->dpcm[stream].runtime; dpcm->state =3D SND_SOC_DPCM_LINK_STATE_NEW; + spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_add(&dpcm->list_be, &fe->dpcm[stream].be_clients); list_add(&dpcm->list_fe, &be->dpcm[stream].fe_clients); + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); =20 dev_dbg(fe->dev, "connected new DPCM %s path %s %s %s\n", stream ? "capture" : "playback", fe->dai_link->name, @@ -1283,6 +1286,7 @@ static void dpcm_be_reparent(struct snd_ void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream) { struct snd_soc_dpcm *dpcm, *d; + unsigned long flags; =20 list_for_each_entry_safe(dpcm, d, &fe->dpcm[stream].be_clients, list_be) { dev_dbg(fe->dev, "ASoC: BE %s disconnect check for %s\n", @@ -1302,8 +1306,10 @@ void dpcm_be_disconnect(struct snd_soc_p #ifdef CONFIG_DEBUG_FS debugfs_remove(dpcm->debugfs_state); #endif + spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_del(&dpcm->list_be); list_del(&dpcm->list_fe); + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); kfree(dpcm); } } @@ -1557,10 +1563,13 @@ int dpcm_process_paths(struct snd_soc_pc void dpcm_clear_pending_state(struct snd_soc_pcm_runtime *fe, int stream) { struct snd_soc_dpcm *dpcm; + unsigned long flags; =20 + spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_for_each_entry(dpcm, &fe->dpcm[stream].be_clients, list_be) dpcm->be->dpcm[stream].runtime_update =3D SND_SOC_DPCM_UPDATE_NO; + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); } =20 static void dpcm_be_dai_startup_unwind(struct snd_soc_pcm_runtime *fe, @@ -2626,6 +2635,7 @@ static int dpcm_run_update_startup(struc struct snd_soc_dpcm *dpcm; enum snd_soc_dpcm_trigger trigger =3D fe->dai_link->trigger[stream]; int ret; + unsigned long flags; =20 dev_dbg(fe->dev, "ASoC: runtime %s open on FE %s\n", stream ? "capture" : "playback", fe->dai_link->name); @@ -2695,11 +2705,13 @@ close: dpcm_be_dai_shutdown(fe, stream); disconnect: /* disconnect any non started BEs */ + spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_for_each_entry(dpcm, &fe->dpcm[stream].be_clients, list_be) { struct snd_soc_pcm_runtime *be =3D dpcm->be; if (be->dpcm[stream].state !=3D SND_SOC_DPCM_STATE_START) dpcm->state =3D SND_SOC_DPCM_LINK_STATE_FREE; } + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); =20 return ret; } @@ -3278,7 +3290,10 @@ int snd_soc_dpcm_can_be_free_stop(struct { struct snd_soc_dpcm *dpcm; int state; + int ret =3D 1; + unsigned long flags; =20 + spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_for_each_entry(dpcm, &be->dpcm[stream].fe_clients, list_fe) { =20 if (dpcm->fe =3D=3D fe) @@ -3287,12 +3302,15 @@ int snd_soc_dpcm_can_be_free_stop(struct state =3D dpcm->fe->dpcm[stream].state; if (state =3D=3D SND_SOC_DPCM_STATE_START || state =3D=3D SND_SOC_DPCM_STATE_PAUSED || - state =3D=3D SND_SOC_DPCM_STATE_SUSPEND) - return 0; + state =3D=3D SND_SOC_DPCM_STATE_SUSPEND) { + ret =3D 0; + break; + } } + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); =20 /* it's safe to free/stop this BE DAI */ - return 1; + return ret; } EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_free_stop); =20 @@ -3305,7 +3323,10 @@ int snd_soc_dpcm_can_be_params(struct sn { struct snd_soc_dpcm *dpcm; int state; + int ret =3D 1; + unsigned long flags; =20 + spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_for_each_entry(dpcm, &be->dpcm[stream].fe_clients, list_fe) { =20 if (dpcm->fe =3D=3D fe) @@ -3315,12 +3336,15 @@ int snd_soc_dpcm_can_be_params(struct sn if (state =3D=3D SND_SOC_DPCM_STATE_START || state =3D=3D SND_SOC_DPCM_STATE_PAUSED || state =3D=3D SND_SOC_DPCM_STATE_SUSPEND || - state =3D=3D SND_SOC_DPCM_STATE_PREPARE) - return 0; + state =3D=3D SND_SOC_DPCM_STATE_PREPARE) { + ret =3D 0; + break; + } } + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); =20 /* it's safe to change hw_params */ - return 1; + return ret; } EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_params); =20 @@ -3359,6 +3383,7 @@ static ssize_t dpcm_show_state(struct sn struct snd_pcm_hw_params *params =3D &fe->dpcm[stream].hw_params; struct snd_soc_dpcm *dpcm; ssize_t offset =3D 0; + unsigned long flags; =20 /* FE state */ offset +=3D scnprintf(buf + offset, size - offset, @@ -3386,6 +3411,7 @@ static ssize_t dpcm_show_state(struct sn goto out; } =20 + spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_for_each_entry(dpcm, &fe->dpcm[stream].be_clients, list_be) { struct snd_soc_pcm_runtime *be =3D dpcm->be; params =3D &dpcm->hw_params; @@ -3406,7 +3432,7 @@ static ssize_t dpcm_show_state(struct sn params_channels(params), params_rate(params)); } - + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); out: return offset; } From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8925C433FE for ; Mon, 24 Jan 2022 20:07:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377095AbiAXUEz (ORCPT ); Mon, 24 Jan 2022 15:04:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56214 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356708AbiAXTrE (ORCPT ); Mon, 24 Jan 2022 14:47:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C9E0BC038ADE; Mon, 24 Jan 2022 11:22:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6EF6EB810BD; Mon, 24 Jan 2022 19:22:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3A3EC340E5; Mon, 24 Jan 2022 19:22:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052166; bh=HJF1USL0tK5yt1VH2wuXAGk9bp4CfHgV/w0pSwgs8ZM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ro9gttmReiYHy/V5lWEX2sIWoooyoGRFLnBALRlp4V+yiY3UG1Xk5oYsK/UyDmCx7 rfVhQaNeuhZ41QVKXvCK3SKqG60VhsZeXyNRiTKkgZdA/3jplIiwdL0S2w3HRwvIr0 9y+LwqGg51B9pJUDS1hThmXOREC2HcPRr6CI7rcc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pascal Paillet , Mark Brown , Andre Kalb Subject: [PATCH 4.19 209/239] regulator: core: Let boot-on regulators be powered off Date: Mon, 24 Jan 2022 19:44:07 +0100 Message-Id: <20220124183949.754390300@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pascal Paillet commit 089b3f61ecfc43ca4ea26d595e1d31ead6de3f7b upstream. Boot-on regulators are always kept on because their use_count value is now incremented at boot time and never cleaned. Only increment count value for alway-on regulators. regulator_late_cleanup() is now able to power off boot-on regulators when unused. Fixes: 05f224ca6693 ("regulator: core: Clean enabling always-on regulators = + their supplies") Signed-off-by: Pascal Paillet Link: https://lore.kernel.org/r/20191113102737.27831-1-p.paillet@st.com Signed-off-by: Mark Brown Acked-by: Andre Kalb Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/regulator/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -1211,7 +1211,9 @@ static int set_machine_constraints(struc rdev_err(rdev, "failed to enable\n"); return ret; } - rdev->use_count++; + + if (rdev->constraints->always_on) + rdev->use_count++; } =20 print_constraints(rdev); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB520C43219 for ; Mon, 24 Jan 2022 19:31:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352789AbiAXTbE (ORCPT ); Mon, 24 Jan 2022 14:31:04 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:51292 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347213AbiAXTWu (ORCPT ); Mon, 24 Jan 2022 14:22:50 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F085D6141C; Mon, 24 Jan 2022 19:22:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC400C340E5; Mon, 24 Jan 2022 19:22:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052169; bh=tjiI83nL6UJQvRW0FyOjkoiSq6W6ioe2SX4RcJz4nYI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NSxGscQg66j1pPml3bHMhdqQOfgzWsvCukjPD5THqL76uFZ5jVHGtTh3WPaMJyVxA bxy4mmA8F3DwodvYZ/mDDL/G8vfbXpXHAUVdWEJhSCmCU2ZCaoR0n3RSRGevrIknXc ixmTlsTsptVWTaHckv4QfyIa9ARn+Dk66vE8oCYk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Jan Stancek , Borislav Petkov , Alex Deucher Subject: [PATCH 4.19 210/239] drm/radeon: fix error handling in radeon_driver_open_kms Date: Mon, 24 Jan 2022 19:44:08 +0100 Message-Id: <20220124183949.784680847@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Christian K=C3=B6nig commit 4722f463896cc0ef1a6f1c3cb2e171e949831249 upstream. The return value was never initialized so the cleanup code executed when it isn't even necessary. Just add proper error handling. Fixes: ab50cb9df889 ("drm/radeon/radeon_kms: Fix a NULL pointer dereference= in radeon_driver_open_kms()") Signed-off-by: Christian K=C3=B6nig Tested-by: Jan Stancek Tested-by: Borislav Petkov Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/radeon/radeon_kms.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) --- a/drivers/gpu/drm/radeon/radeon_kms.c +++ b/drivers/gpu/drm/radeon/radeon_kms.c @@ -641,18 +641,18 @@ int radeon_driver_open_kms(struct drm_de fpriv =3D kzalloc(sizeof(*fpriv), GFP_KERNEL); if (unlikely(!fpriv)) { r =3D -ENOMEM; - goto out_suspend; + goto err_suspend; } =20 if (rdev->accel_working) { vm =3D &fpriv->vm; r =3D radeon_vm_init(rdev, vm); if (r) - goto out_fpriv; + goto err_fpriv; =20 r =3D radeon_bo_reserve(rdev->ring_tmp_bo.bo, false); if (r) - goto out_vm_fini; + goto err_vm_fini; =20 /* map the ib pool buffer read only into * virtual address space */ @@ -660,7 +660,7 @@ int radeon_driver_open_kms(struct drm_de rdev->ring_tmp_bo.bo); if (!vm->ib_bo_va) { r =3D -ENOMEM; - goto out_vm_fini; + goto err_vm_fini; } =20 r =3D radeon_vm_bo_set_addr(rdev, vm->ib_bo_va, @@ -668,19 +668,21 @@ int radeon_driver_open_kms(struct drm_de RADEON_VM_PAGE_READABLE | RADEON_VM_PAGE_SNOOPED); if (r) - goto out_vm_fini; + goto err_vm_fini; } file_priv->driver_priv =3D fpriv; } =20 - if (!r) - goto out_suspend; + pm_runtime_mark_last_busy(dev->dev); + pm_runtime_put_autosuspend(dev->dev); + return 0; =20 -out_vm_fini: +err_vm_fini: radeon_vm_fini(rdev, vm); -out_fpriv: +err_fpriv: kfree(fpriv); -out_suspend: + +err_suspend: pm_runtime_mark_last_busy(dev->dev); pm_runtime_put_autosuspend(dev->dev); return r; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC886C433EF for ; Mon, 24 Jan 2022 19:32:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343962AbiAXTcz (ORCPT ); Mon, 24 Jan 2022 14:32:55 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:51338 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349910AbiAXTWy (ORCPT ); Mon, 24 Jan 2022 14:22:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2B0E061317; Mon, 24 Jan 2022 19:22:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C643C340E5; Mon, 24 Jan 2022 19:22:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052172; bh=cBBZ8JPUy6BY7CZDXyLC6eF5svJh0zfrQtIgk2t0K3Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0J/Y9Z0s8MpgpVlYnogvejAzkWdh9TLvtJP3Lv9VbYXQZ7iVSZDzDi39UmAPM2Ks3 tdsxpJ32wDanJIZXNgCUhSeRtJUh9sT5YrbXkqj55+F8P9pZsWsMXHDaPmC/p/bAzk 5zxTamde5eFKMiuiU/xVjsbIut8Wb8xfRN8tVlsE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Merlijn Wajer , Pavel Machek , Sebastian Reichel , Tony Lindgren Subject: [PATCH 4.19 211/239] ARM: dts: Fix vcsi regulator to be always-on for droid4 to prevent hangs Date: Mon, 24 Jan 2022 19:44:09 +0100 Message-Id: <20220124183949.823156871@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tony Lindgren commit ddb52945999dcf35787bf221b62108806182578d upstream. In addition to using vcsi regulator for the display, looks like droid4 is using vcsi regulator to trigger off mode internally with the PMIC firmware when the SoC enters deeper idle states. This is configured in the Motorola Mapphone Linux kernel sources as "zerov_regulator". As we currently don't support off mode during idle for omap4, we must prevent vcsi from being disabled when the display is blanked to prevent the PMIC change to off mode. Otherwise the device will hang on entering idle when the display is blanked. Before commit 089b3f61ecfc ("regulator: core: Let boot-on regulators be powered off"), the boot-on regulators never got disabled like they should and vcsi did not get turned off on idle. Let's fix the issue by setting vcsi to always-on for now. Later on we may want to claim the vcsi regulator also in the PM code if needed. Fixes: 089b3f61ecfc ("regulator: core: Let boot-on regulators be powered of= f") Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Signed-off-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi @@ -165,12 +165,12 @@ regulator-enable-ramp-delay =3D <1000>; }; =20 - /* Used by DSS */ + /* Used by DSS and is the "zerov_regulator" trigger for SoC off mode */ vcsi: VCSI { regulator-min-microvolt =3D <1800000>; regulator-max-microvolt =3D <1800000>; regulator-enable-ramp-delay =3D <1000>; - regulator-boot-on; + regulator-always-on; }; =20 vdac: VDAC { From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC5B4C4167D for ; Tue, 25 Jan 2022 02:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420990AbiAYCZz (ORCPT ); Mon, 24 Jan 2022 21:25:55 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:48310 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350254AbiAXTYo (ORCPT ); Mon, 24 Jan 2022 14:24:44 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5B69EB8122C; Mon, 24 Jan 2022 19:24:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0AE68C340E5; Mon, 24 Jan 2022 19:24:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052282; bh=64djAcdFOZX9lox2mWpaTdgR3LKocNI2zq5giDpMUEs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UO5PPYXD240o8DvYSFmBoqyqQu5ooV1RJcbUqlIdwEP18RueMhAIUUvIua5NGINfR stUvh8EG9RYTY8EV2H4gaq9CSoWoNYzRCLqd1Y1qPuLzlenPsLqnh7MqszRm6+rRjV ja9U4k+aTMqCS/WvbAUs7JpF9UwgvNWpy7/ldfHw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julius Werner , Ben Hutchings Subject: [PATCH 4.19 212/239] firmware: Update Kconfig help text for Google firmware Date: Mon, 24 Jan 2022 19:44:10 +0100 Message-Id: <20220124183949.855915546@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ben Hutchings commit d185a3466f0cd5af8f1c5c782c53bc0e6f2e7136 upstream. The help text for GOOGLE_FIRMWARE states that it should only be enabled when building a kernel for Google's own servers. However, many of the drivers dependent on it are also useful on Chromebooks or on any platform using coreboot. Update the help text to reflect this double duty. Fixes: d384d6f43d1e ("firmware: google memconsole: Add coreboot support") Reviewed-by: Julius Werner Signed-off-by: Ben Hutchings Link: https://lore.kernel.org/r/20180618225540.GD14131@decadent.org.uk Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/firmware/google/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/firmware/google/Kconfig +++ b/drivers/firmware/google/Kconfig @@ -2,9 +2,9 @@ menuconfig GOOGLE_FIRMWARE bool "Google Firmware Drivers" default n help - These firmware drivers are used by Google's servers. They are - only useful if you are working directly on one of their - proprietary servers. If in doubt, say "N". + These firmware drivers are used by Google servers, + Chromebooks and other devices using coreboot firmware. + If in doubt, say "N". =20 if GOOGLE_FIRMWARE =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E516EC4167D for ; Mon, 24 Jan 2022 20:07:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377272AbiAXUFO (ORCPT ); Mon, 24 Jan 2022 15:05:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356831AbiAXTr0 (ORCPT ); Mon, 24 Jan 2022 14:47:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 318A3C038AEC; Mon, 24 Jan 2022 11:23:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CCA15B8123F; Mon, 24 Jan 2022 19:23:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1643C340E5; Mon, 24 Jan 2022 19:23:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052197; bh=+5B2a8108S7AUZGD06016KZBTI+r/kEmX5RhV/EvtKU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ihVZ/g2cXH+wcz1KNpmiL1gXE5TeK5iw0ulnZvCa6/TbIzBZBeie0FKzEHKojhKmv UjKG4tqyLp5M7U4C/XwwUVaCJK8hocU97RiAcTNoRtHDPedUeKvyX4FEpgw1Wje45Z M7Dust+j66aGsQTpgzb+jljEF2Up6aMIqMMwvi0U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Suresh Udipi , Michael Rodin , =?UTF-8?q?Niklas=20S=C3=B6derlund?= , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 213/239] media: rcar-csi2: Optimize the selection PHTW register Date: Mon, 24 Jan 2022 19:44:11 +0100 Message-Id: <20220124183949.887495650@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Suresh Udipi commit 549cc89cd09a85aaa16dc07ef3db811d5cf9bcb1 upstream. PHTW register is selected based on default bit rate from Table[1]. for the bit rates less than or equal to 250. Currently first value of default bit rate which is greater than or equal to the caculated mbps is selected. This selection can be further improved by selecting the default bit rate which is nearest to the calculated value. [1] specs r19uh0105ej0200-r-car-3rd-generation.pdf [Table 25.12] Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiv= er driver") Signed-off-by: Suresh Udipi Signed-off-by: Michael Rodin Reviewed-by: Niklas S=C3=B6derlund Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/platform/rcar-vin/rcar-csi2.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/media/platform/rcar-vin/rcar-csi2.c +++ b/drivers/media/platform/rcar-vin/rcar-csi2.c @@ -843,10 +843,17 @@ static int rcsi2_phtw_write_mbps(struct const struct rcsi2_mbps_reg *values, u16 code) { const struct rcsi2_mbps_reg *value; + const struct rcsi2_mbps_reg *prev_value =3D NULL; =20 - for (value =3D values; value->mbps; value++) + for (value =3D values; value->mbps; value++) { if (value->mbps >=3D mbps) break; + prev_value =3D value; + } + + if (prev_value && + ((mbps - prev_value->mbps) <=3D (value->mbps - mbps))) + value =3D prev_value; =20 if (!value->mbps) { dev_err(priv->dev, "Unsupported PHY speed (%u Mbps)", mbps); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD800C433EF for ; Mon, 24 Jan 2022 20:08:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349302AbiAXUHm (ORCPT ); Mon, 24 Jan 2022 15:07:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56222 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353876AbiAXTtF (ORCPT ); Mon, 24 Jan 2022 14:49:05 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66857C02B847; Mon, 24 Jan 2022 11:23:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2F005B810BD; Mon, 24 Jan 2022 19:23:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D3EFC340E5; Mon, 24 Jan 2022 19:23:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052231; bh=vwRGDU4N4TbEApmcUFKQ4hpx5acenT08Vv9AbCWceh8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FbsR3AsDrMbeBvEpyLfBdV8P2vDlATc0LlmkkQ2qw333MQwU2w1YQWEISNrB7LPYU PJ6BLC3NP0DZZAKj+y/sLqEZhwU/cifIhb65YSAa17l4t6PWnunfZIzfMjDt4HkdcN NJcIYIB2ty9YXJYAhtrpTYDRXiMiDITKTzx6cbZ4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Bulwahn , Jonathan Corbet Subject: [PATCH 4.19 214/239] Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization Date: Mon, 24 Jan 2022 19:44:12 +0100 Message-Id: <20220124183949.917800767@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Bulwahn commit 82ca67321f55a8d1da6ac3ed611da3c32818bb37 upstream. The config RANDOMIZE_SLAB does not exist, the authors probably intended to refer to the config RANDOMIZE_BASE, which provides kernel address-space randomization. They probably just confused SLAB with BASE (these two four-letter words coincidentally share three common letters), as they also point out the config SLAB_FREELIST_RANDOM as further randomization within the same sentence. Fix the reference of the config for kernel address-space randomization to the config that provides that. Fixes: 6e88559470f5 ("Documentation: Add section about CPU vulnerabilities = for Spectre") Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20211230171940.27558-1-lukas.bulwahn@gmail.= com Signed-off-by: Jonathan Corbet Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- Documentation/admin-guide/hw-vuln/spectre.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -468,7 +468,7 @@ Spectre variant 2 before invoking any firmware code to prevent Spectre variant 2 exploits using the firmware. =20 - Using kernel address space randomization (CONFIG_RANDOMIZE_SLAB=3Dy + Using kernel address space randomization (CONFIG_RANDOMIZE_BASE=3Dy and CONFIG_SLAB_FREELIST_RANDOM=3Dy in the kernel configuration) makes attacks on the kernel generally more difficult. =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A51CC433EF for ; Mon, 24 Jan 2022 19:32:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347511AbiAXTcC (ORCPT ); Mon, 24 Jan 2022 14:32:02 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:52656 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345874AbiAXTYV (ORCPT ); Mon, 24 Jan 2022 14:24:21 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 97B7F61447; Mon, 24 Jan 2022 19:24:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58207C340E5; Mon, 24 Jan 2022 19:24:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052260; bh=hHYPuzQMlbi5BWrijAFproJ8AIh6hz9KF3iVdpWexwk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jfTKlzHoNe7TQ130Uz55/1uhmoaqc1+qecy2drWgt0ypQnnEuWG7sNPzpWD7366eW kiKPTO8XXs412t53ubLcGkefeonZgLUZu59OCaaEHGCBwNabDRp0RLXjgeMo8zW7KU IxHq3xjh1338Ou/R+i5/lMDhryOOqoDuDAEx28f4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yixing Liu , Wenpeng Liang , Jason Gunthorpe Subject: [PATCH 4.19 215/239] RDMA/hns: Modify the mapping attribute of doorbell to device Date: Mon, 24 Jan 2022 19:44:13 +0100 Message-Id: <20220124183949.946783914@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yixing Liu commit 39d5534b1302189c809e90641ffae8cbdc42a8fc upstream. It is more general for ARM device drivers to use the device attribute to map PCI BAR spaces. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Link: https://lore.kernel.org/r/20211206133652.27476-1-liangwenpeng@huawei.= com Signed-off-by: Yixing Liu Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -432,7 +432,7 @@ static int hns_roce_mmap(struct ib_ucont return -EINVAL; =20 if (vma->vm_pgoff =3D=3D 0) { - vma->vm_page_prot =3D pgprot_noncached(vma->vm_page_prot); + vma->vm_page_prot =3D pgprot_device(vma->vm_page_prot); if (io_remap_pfn_range(vma, vma->vm_start, to_hr_ucontext(context)->uar.pfn, PAGE_SIZE, vma->vm_page_prot)) From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6808C4167B for ; Tue, 25 Jan 2022 02:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420975AbiAYCZy (ORCPT ); Mon, 24 Jan 2022 21:25:54 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:52702 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346455AbiAXTYY (ORCPT ); Mon, 24 Jan 2022 14:24:24 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C0F5761318; Mon, 24 Jan 2022 19:24:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7FF60C340E7; Mon, 24 Jan 2022 19:24:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052263; bh=7MnhLEjkv5OmPQOjR5kPlUEAsHS1KKAq0CkG2/QiCQc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mr1xntGIE8Qpc7Ss5hNqsXQDS3cfwYs2NxzBiCNl6lixPI1UENuklwGBuow6KcKnA sm4Z+KrxalqfWSyGiw+lyXsbLotrjRdwOxnICgD9WBRL9WTo7sC8xipQfxdbYbpCKF YugVc1meqVEENfFe1mgiBjd1Edk2TeOEP2ahyHOk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengguang Xu , Zhu Yanjun , Bob Pearson , Jason Gunthorpe Subject: [PATCH 4.19 216/239] RDMA/rxe: Fix a typo in opcode name Date: Mon, 24 Jan 2022 19:44:14 +0100 Message-Id: <20220124183949.976768513@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengguang Xu commit 8d1cfb884e881efd69a3be4ef10772c71cb22216 upstream. There is a redundant ']' in the name of opcode IB_OPCODE_RC_SEND_MIDDLE, so just fix it. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20211218112320.3558770-1-cgxu519@mykernel.n= et Signed-off-by: Chengguang Xu Acked-by: Zhu Yanjun Reviewed-by: Bob Pearson Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/sw/rxe/rxe_opcode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/sw/rxe/rxe_opcode.c +++ b/drivers/infiniband/sw/rxe/rxe_opcode.c @@ -137,7 +137,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NU } }, [IB_OPCODE_RC_SEND_MIDDLE] =3D { - .name =3D "IB_OPCODE_RC_SEND_MIDDLE]", + .name =3D "IB_OPCODE_RC_SEND_MIDDLE", .mask =3D RXE_PAYLOAD_MASK | RXE_REQ_MASK | RXE_SEND_MASK | RXE_MIDDLE_MASK, .length =3D RXE_BTH_BYTES, From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5507C433EF for ; Mon, 24 Jan 2022 20:28:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356749AbiAXUYi (ORCPT ); Mon, 24 Jan 2022 15:24:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57746 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350049AbiAXTv3 (ORCPT ); Mon, 24 Jan 2022 14:51:29 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55F7EC041885; Mon, 24 Jan 2022 11:24:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EA1D46131E; Mon, 24 Jan 2022 19:24:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEEC2C340E7; Mon, 24 Jan 2022 19:24:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052266; bh=GwsqnG/gu0747YUbSDPjrOYQDrFTjAXab4YSsPoCaww=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pyrDEpS+ttu1t6NRGuIE27BFNXfrKVYPFIF2wPbczqvB5lze1n5EcwN28/3BCDIfN mFgbBr3F/qJgTMG7+OzTh89FSH47no2iFfM0M1LvU6vN9x6xOFdCUC4trLuFIu0GE+ Kk95s9iRqrz5N9nbTeeuM/HrkoZTFf8FFHJ2MFlY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Amelie Delaunay , Vinod Koul Subject: [PATCH 4.19 217/239] dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK Date: Mon, 24 Jan 2022 19:44:15 +0100 Message-Id: <20220124183950.008557386@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Amelie Delaunay commit e7f110889a87307fb0fed408a5dee1707796ca04 upstream. This patch fixes STM32_MDMA_CTBR_TSEL_MASK, which is [5:0], not [7:0]. Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20211220165827.1238097-1-amelie.delaunay@fo= ss.st.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/dma/stm32-mdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/dma/stm32-mdma.c +++ b/drivers/dma/stm32-mdma.c @@ -194,7 +194,7 @@ #define STM32_MDMA_CTBR(x) (0x68 + 0x40 * (x)) #define STM32_MDMA_CTBR_DBUS BIT(17) #define STM32_MDMA_CTBR_SBUS BIT(16) -#define STM32_MDMA_CTBR_TSEL_MASK GENMASK(7, 0) +#define STM32_MDMA_CTBR_TSEL_MASK GENMASK(5, 0) #define STM32_MDMA_CTBR_TSEL(n) STM32_MDMA_SET(n, \ STM32_MDMA_CTBR_TSEL_MASK) =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCC25C433F5 for ; Mon, 24 Jan 2022 20:29:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1383605AbiAXU10 (ORCPT ); Mon, 24 Jan 2022 15:27:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346281AbiAXTvt (ORCPT ); Mon, 24 Jan 2022 14:51:49 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 93042C04188D; Mon, 24 Jan 2022 11:24:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 909E2B8122C; Mon, 24 Jan 2022 19:24:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF529C340E7; Mon, 24 Jan 2022 19:24:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052269; bh=gk9HNkOw8giGGMPD+7p+DjpVIM6kP8mjUyFj3QJZWyw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C8TA59XMZGvBBtUMbD3p+1swcDOqyyvc6Tm4302pOYFz7FxAp6MY0TdeXLKiEVprt 16lyxz5GVytFK+oPONlx/yBYWMGdfvkwhuk9QFSjkFoXBuCcpumFqERSbsA2Xc3RxH x5yV+SUjwnxChT3ls+jQeBBjfCvTIGf8nEbydiUU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Naresh Kamboju , Anders Roxell , Nathan Chancellor , Arnd Bergmann , Michael Ellerman Subject: [PATCH 4.19 218/239] powerpc/cell: Fix clang -Wimplicit-fallthrough warning Date: Mon, 24 Jan 2022 19:44:16 +0100 Message-Id: <20220124183950.039483697@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Anders Roxell commit e89257e28e844f5d1d39081bb901d9f1183a7705 upstream. Clang warns: arch/powerpc/platforms/cell/pervasive.c:81:2: error: unannotated fall-throu= gh between switch labels case SRR1_WAKEEE: ^ arch/powerpc/platforms/cell/pervasive.c:81:2: note: insert 'break;' to avoi= d fall-through case SRR1_WAKEEE: ^ break; 1 error generated. Clang is more pedantic than GCC, which does not warn when failing through to a case that is just break or return. Clang's version is more in line with the kernel's own stance in deprecated.rst. Add athe missing break to silence the warning. Fixes: 6e83985b0f6e ("powerpc/cbe: Do not process external or decremeter in= terrupts from sreset") Reported-by: Naresh Kamboju Signed-off-by: Anders Roxell Reviewed-by: Nathan Chancellor Reviewed-by: Arnd Bergmann Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211207110228.698956-1-anders.roxell@linar= o.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/platforms/cell/pervasive.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/powerpc/platforms/cell/pervasive.c +++ b/arch/powerpc/platforms/cell/pervasive.c @@ -90,6 +90,7 @@ static int cbe_system_reset_exception(st switch (regs->msr & SRR1_WAKEMASK) { case SRR1_WAKEDEC: set_dec(1); + break; case SRR1_WAKEEE: /* * Handle these when interrupts get re-enabled and we take From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CA6BC433EF for ; Mon, 24 Jan 2022 20:24:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354391AbiAXUY0 (ORCPT ); Mon, 24 Jan 2022 15:24:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57828 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347958AbiAXTvu (ORCPT ); Mon, 24 Jan 2022 14:51:50 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 24B5BC04188E; Mon, 24 Jan 2022 11:24:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B671C613EA; Mon, 24 Jan 2022 19:24:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDA4DC340E7; Mon, 24 Jan 2022 19:24:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052272; bh=3U9VP1OuruVXeNmVCUIDrfmA01G3vDMoXgFxbdOhwwE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=INB7Mwa2z3doEfIlGXMlwxQr7S7eph8fUReZboB5YyZXCduxzABbfmB8qxRqmLVEY f4EBUYI6BimKglKmQuYvD+cuSh8sdrtOdR9JoIyuDD7loVzrTy++A2nRAgeR1tpRym 8NxSFqv6QBxR9sO7beLNpgqTv2ZhQwZU1mrPQr40= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tobias Waldekranz , Jakub Kicinski Subject: [PATCH 4.19 219/239] powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses Date: Mon, 24 Jan 2022 19:44:17 +0100 Message-Id: <20220124183950.075823521@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tobias Waldekranz commit 0d375d610fa96524e2ee2b46830a46a7bfa92a9f upstream. This block is used in (at least) T1024 and T1040, including their variants like T1023 etc. Fixes: d55ad2967d89 ("powerpc/mpc85xx: Create dts components for the FSL Qo= rIQ DPAA FMan") Signed-off-by: Tobias Waldekranz Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi +++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi @@ -79,6 +79,7 @@ fman0: fman@400000 { #size-cells =3D <0>; compatible =3D "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg =3D <0xfc000 0x1000>; + fsl,erratum-a009885; }; =20 xmdio0: mdio@fd000 { @@ -86,6 +87,7 @@ fman0: fman@400000 { #size-cells =3D <0>; compatible =3D "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg =3D <0xfd000 0x1000>; + fsl,erratum-a009885; }; }; =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5C67C433EF for ; Mon, 24 Jan 2022 20:29:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1383520AbiAXU1U (ORCPT ); Mon, 24 Jan 2022 15:27:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346363AbiAXTvz (ORCPT ); Mon, 24 Jan 2022 14:51:55 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 788B9C04188F; Mon, 24 Jan 2022 11:24:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 155E5612FA; Mon, 24 Jan 2022 19:24:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9A21C340E5; Mon, 24 Jan 2022 19:24:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052275; bh=SkxgkeQKtRzsXP4qhrbvLWmh+8iL7PKLaOqj4Z1DGOc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0EP+NX0BFVNgRJecxkiojmdn4SmuxlNK3evvGjtS3IuXAd5lRmkxoEAj1DNCEIORL 0oxOhnCJapbfE1z66DJpM/jiMCFTEXdo5CtmH8dw0+1DOc+l8JedxuduZ8KElCVKc1 +Ad3ly447unj1T1usWN5nZV0QFvGPif3Dmkm5OdA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tobias Waldekranz , Andrew Lunn , Jakub Kicinski Subject: [PATCH 4.19 220/239] net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module Date: Mon, 24 Jan 2022 19:44:18 +0100 Message-Id: <20220124183950.104279032@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tobias Waldekranz commit 3f7c239c7844d2044ed399399d97a5f1c6008e1b upstream. As reported by sparse: In the remove path, the driver would attempt to unmap its own priv pointer - instead of the io memory that it mapped in probe. Fixes: 9f35a7342cff ("net/fsl: introduce Freescale 10G MDIO driver") Signed-off-by: Tobias Waldekranz Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/freescale/xgmac_mdio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/freescale/xgmac_mdio.c +++ b/drivers/net/ethernet/freescale/xgmac_mdio.c @@ -301,9 +301,10 @@ err_ioremap: static int xgmac_mdio_remove(struct platform_device *pdev) { struct mii_bus *bus =3D platform_get_drvdata(pdev); + struct mdio_fsl_priv *priv =3D bus->priv; =20 mdiobus_unregister(bus); - iounmap(bus->priv); + iounmap(priv->mdio_base); mdiobus_free(bus); =20 return 0; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC076C433FE for ; Mon, 24 Jan 2022 20:29:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1383561AbiAXU1W (ORCPT ); Mon, 24 Jan 2022 15:27:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57850 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357833AbiAXTvz (ORCPT ); Mon, 24 Jan 2022 14:51:55 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 654B0C041890; Mon, 24 Jan 2022 11:24:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 05AB36129A; Mon, 24 Jan 2022 19:24:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0067EC340E5; Mon, 24 Jan 2022 19:24:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052278; bh=sGOvretFgauqF2/LGbvj1iZr7JxVo+3umuYUrti16Ho=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=loPmA3VfwmSWpFR5H+jGCQU2kZ3U1ll6fPVih3tkLU/r/0fEzhCsvaW1nc0WXEMlX eXEs0CNycmAZvjvl/sCAorpY9yxPDxKxvM3T1mlox13y3R0ji3uI5TWgffgexXjInY 8N2CA4hB9Lr1/ImDCYAYsFV9YqiXlNXwncdj/0wg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Helge Deller Subject: [PATCH 4.19 221/239] parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries Date: Mon, 24 Jan 2022 19:44:19 +0100 Message-Id: <20220124183950.132688245@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Miaoqian Lin commit d24846a4246b6e61ecbd036880a4adf61681d241 upstream. kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add()=EF=BC=9A If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object. Fix memory leak by calling kobject_put(). Fixes: 73f368cf679b ("Kobject: change drivers/parisc/pdc_stable.c to use ko= bject_init_and_add") Signed-off-by: Miaoqian Lin Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/parisc/pdc_stable.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/parisc/pdc_stable.c +++ b/drivers/parisc/pdc_stable.c @@ -992,8 +992,10 @@ pdcs_register_pathentries(void) entry->kobj.kset =3D paths_kset; err =3D kobject_init_and_add(&entry->kobj, &ktype_pdcspath, NULL, "%s", entry->name); - if (err) + if (err) { + kobject_put(&entry->kobj); return err; + } =20 /* kobject is now registered */ write_lock(&entry->rw_lock); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A4EEC433F5 for ; Mon, 24 Jan 2022 20:07:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377361AbiAXUFV (ORCPT ); Mon, 24 Jan 2022 15:05:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56812 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356834AbiAXTr0 (ORCPT ); Mon, 24 Jan 2022 14:47:26 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 97281C038AEF; Mon, 24 Jan 2022 11:23:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 35EDA6131E; Mon, 24 Jan 2022 19:23:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C6AFC340E5; Mon, 24 Jan 2022 19:23:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052200; bh=63F1nd3KDMNKL6yqbHKJOnOSr+qJ79dax9b58eVEicc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r/RKbzNEg6hXgmPJnmbOea+Am8Emm0wRwJSvq9/5EF+kVIT8K6dZmUCQrcYaSdPrl kbl1NfxOakoWHtqt3fuE122oCWxr8FBSdC97G3/IfjbrIjPYypt02wrq+z4pUkxobj lfa3DhazgZqDtihYGp4ZOAnmUjYmmdP6OpMkodEQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Jakub Kicinski Subject: [PATCH 4.19 222/239] af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress Date: Mon, 24 Jan 2022 19:44:20 +0100 Message-Id: <20220124183950.169864061@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 9d6d7f1cb67cdee15f1a0e85aacfb924e0e02435 upstream. wait_for_unix_gc() reads unix_tot_inflight & gc_in_progress without synchronization. Adds READ_ONCE()/WRITE_ONCE() and their associated comments to better document the intent. BUG: KCSAN: data-race in unix_inflight / wait_for_unix_gc write to 0xffffffff86e2b7c0 of 4 bytes by task 9380 on cpu 0: unix_inflight+0x1e8/0x260 net/unix/scm.c:63 unix_attach_fds+0x10c/0x1e0 net/unix/scm.c:121 unix_scm_to_skb net/unix/af_unix.c:1674 [inline] unix_dgram_sendmsg+0x679/0x16b0 net/unix/af_unix.c:1817 unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 __do_sys_sendmmsg net/socket.c:2578 [inline] __se_sys_sendmmsg net/socket.c:2575 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffffffff86e2b7c0 of 4 bytes by task 9375 on cpu 1: wait_for_unix_gc+0x24/0x160 net/unix/garbage.c:196 unix_dgram_sendmsg+0x8e/0x16b0 net/unix/af_unix.c:1772 unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 __do_sys_sendmmsg net/socket.c:2578 [inline] __se_sys_sendmmsg net/socket.c:2575 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000002 -> 0x00000004 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 9375 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Fixes: 9915672d4127 ("af_unix: limit unix_tot_inflight") Signed-off-by: Eric Dumazet Reported-by: syzbot Link: https://lore.kernel.org/r/20220114164328.2038499-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/unix/garbage.c | 14 +++++++++++--- net/unix/scm.c | 6 ++++-- 2 files changed, 15 insertions(+), 5 deletions(-) --- a/net/unix/garbage.c +++ b/net/unix/garbage.c @@ -197,8 +197,11 @@ void wait_for_unix_gc(void) { /* If number of inflight sockets is insane, * force a garbage collect right now. + * Paired with the WRITE_ONCE() in unix_inflight(), + * unix_notinflight() and gc_in_progress(). */ - if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress) + if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && + !READ_ONCE(gc_in_progress)) unix_gc(); wait_event(unix_gc_wait, gc_in_progress =3D=3D false); } @@ -218,7 +221,9 @@ void unix_gc(void) if (gc_in_progress) goto out; =20 - gc_in_progress =3D true; + /* Paired with READ_ONCE() in wait_for_unix_gc(). */ + WRITE_ONCE(gc_in_progress, true); + /* First, select candidates for garbage collection. Only * in-flight sockets are considered, and from those only ones * which don't have any external reference. @@ -304,7 +309,10 @@ void unix_gc(void) =20 /* All candidates should have been detached by now. */ BUG_ON(!list_empty(&gc_candidates)); - gc_in_progress =3D false; + + /* Paired with READ_ONCE() in wait_for_unix_gc(). */ + WRITE_ONCE(gc_in_progress, false); + wake_up(&unix_gc_wait); =20 out: --- a/net/unix/scm.c +++ b/net/unix/scm.c @@ -56,7 +56,8 @@ void unix_inflight(struct user_struct *u } else { BUG_ON(list_empty(&u->link)); } - unix_tot_inflight++; + /* Paired with READ_ONCE() in wait_for_unix_gc() */ + WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1); } user->unix_inflight++; spin_unlock(&unix_gc_lock); @@ -76,7 +77,8 @@ void unix_notinflight(struct user_struct =20 if (atomic_long_dec_and_test(&u->inflight)) list_del_init(&u->link); - unix_tot_inflight--; + /* Paired with READ_ONCE() in wait_for_unix_gc() */ + WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1); } user->unix_inflight--; spin_unlock(&unix_gc_lock); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B008C433EF for ; Mon, 24 Jan 2022 20:07:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377451AbiAXUFa (ORCPT ); Mon, 24 Jan 2022 15:05:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56404 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343914AbiAXTrs (ORCPT ); Mon, 24 Jan 2022 14:47:48 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 72947C061797; Mon, 24 Jan 2022 11:23:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2E55BB8119D; Mon, 24 Jan 2022 19:23:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4CCE6C340E5; Mon, 24 Jan 2022 19:23:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052203; bh=eGU5BZn9pv3lxR8n0x8YyiDNk3dQsF9nkslcgbj7S0M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fTFhPB0YhSaEjwXeQ/ilTQQE8jVv4OZMefVM5QjKho1wQkvqiU+/ui8+iAQlGvP+e rq6sFhMwLLzcfm5vTMHh+s1xFMv4jod4YCCb1Jpdg5PDptxgvsT0xnaKdDNYED9yRg ABJWQI4fOZvRQ/yQoTB7rnDat7AExnR46accAj54= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Hancock , Andrew Lunn , "David S. Miller" Subject: [PATCH 4.19 223/239] net: axienet: Wait for PhyRstCmplt after core reset Date: Mon, 24 Jan 2022 19:44:21 +0100 Message-Id: <20220124183950.200828682@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Hancock commit b400c2f4f4c53c86594dd57098970d97d488bfde upstream. When resetting the device, wait for the PhyRstCmplt bit to be set in the interrupt status register before continuing initialization, to ensure that the core is actually ready. When using an external PHY, this also ensures we do not start trying to access the PHY while it is still in reset. The PHY reset is initiated by the core reset which is triggered just above, but remains asserted for 5ms after the core is reset according to the documentation. The MgtRdy bit could also be waited for, but unfortunately when using 7-series devices, the bit does not appear to work as documented (it seems to behave as some sort of link state indication and not just an indication the transceiver is ready) so it can't really be relied on for this purpose. Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethern= et driver") Signed-off-by: Robert Hancock Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -279,6 +279,16 @@ static int axienet_dma_bd_init(struct ne axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET, cr | XAXIDMA_CR_RUNSTOP_MASK); =20 + /* Wait for PhyRstCmplt bit to be set, indicating the PHY reset has finis= hed */ + ret =3D read_poll_timeout(axienet_ior, value, + value & XAE_INT_PHYRSTCMPLT_MASK, + DELAY_OF_ONE_MILLISEC, 50000, false, lp, + XAE_IS_OFFSET); + if (ret) { + dev_err(lp->dev, "%s: timeout waiting for PhyRstCmplt\n", __func__); + return ret; + } + return 0; out: axienet_dma_bd_release(ndev); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2461AC2BA4C for ; Mon, 24 Jan 2022 20:07:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377470AbiAXUFc (ORCPT ); Mon, 24 Jan 2022 15:05:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56432 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349990AbiAXTry (ORCPT ); Mon, 24 Jan 2022 14:47:54 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2B350C038AF4; Mon, 24 Jan 2022 11:23:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BEF1961496; Mon, 24 Jan 2022 19:23:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73D23C36AE2; Mon, 24 Jan 2022 19:23:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052207; bh=WIhonFUuLPDgILEzIj8zMYalQ6tBoRgyQ7YNS/mS6RA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SE8YkIDaapaFZ9eUce/9+9jnmS0VU3QKn01siD7rAMVySd5tnI0Us0LCVX2WmBGkO Un2z+2AHk8fB54rAsAp8MZsu7249JJOhKAupvSLbrdInb2Sk/uUVXwNkjHOltZwIC2 658d8DArUz10ruBOO1uVSPT8cWmQntxR19Uy5aqY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Hancock , "David S. Miller" Subject: [PATCH 4.19 224/239] net: axienet: fix number of TX ring slots for available check Date: Mon, 24 Jan 2022 19:44:22 +0100 Message-Id: <20220124183950.232834013@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Hancock commit aba57a823d2985a2cc8c74a2535f3a88e68d9424 upstream. The check for the number of available TX ring slots was off by 1 since a slot is required for the skb header as well as each fragment. This could result in overwriting a TX ring slot that was still in use. Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethern= et driver") Signed-off-by: Robert Hancock Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -682,7 +682,7 @@ axienet_start_xmit(struct sk_buff *skb, num_frag =3D skb_shinfo(skb)->nr_frags; cur_p =3D &lp->tx_bd_v[lp->tx_bd_tail]; =20 - if (axienet_check_tx_bd_space(lp, num_frag)) { + if (axienet_check_tx_bd_space(lp, num_frag + 1)) { if (netif_queue_stopped(ndev)) return NETDEV_TX_BUSY; =20 @@ -692,7 +692,7 @@ axienet_start_xmit(struct sk_buff *skb, smp_mb(); =20 /* Space might have just been freed - check again */ - if (axienet_check_tx_bd_space(lp, num_frag)) + if (axienet_check_tx_bd_space(lp, num_frag + 1)) return NETDEV_TX_BUSY; =20 netif_wake_queue(ndev); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28D90C35268 for ; Mon, 24 Jan 2022 20:07:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377600AbiAXUFn (ORCPT ); Mon, 24 Jan 2022 15:05:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356980AbiAXTsL (ORCPT ); Mon, 24 Jan 2022 14:48:11 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3C89DC038AF8; Mon, 24 Jan 2022 11:23:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CED7C60010; Mon, 24 Jan 2022 19:23:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90EEBC340E5; Mon, 24 Jan 2022 19:23:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052210; bh=U+eiWYMugops2qGWPhAC285h643ykhpyv+8sf2oFFCs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YAcxZtSUFk9inF8FuHJIBtR6WFPnH21lD3Hg7vKA/cezgzLhlLiBP9meLiWOA7X+Q u2bZWIahfxhkg0K56luMNuMjed7LaaCwKC+XXREdXPK5IK+AUXk9lYntcyfVffZdsY j5rNM94QstcReRWLyuqeeSjqNmmUFDfXzjdhg06I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Laurence de Bruxelles , Alexandre Belloni Subject: [PATCH 4.19 225/239] rtc: pxa: fix null pointer dereference Date: Mon, 24 Jan 2022 19:44:23 +0100 Message-Id: <20220124183950.263085309@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Laurence de Bruxelles commit 34127b3632b21e5c391756e724b1198eb9917981 upstream. With the latest stable kernel versions the rtc on the PXA based Zaurus does not work, when booting I see the following kernel messages: pxa-rtc pxa-rtc: failed to find rtc clock source pxa-rtc pxa-rtc: Unable to init SA1100 RTC sub-device pxa-rtc: probe of pxa-rtc failed with error -2 hctosys: unable to open rtc device (rtc0) I think this is because commit f2997775b111 ("rtc: sa1100: fix possible race condition") moved the allocation of the rtc_device struct out of sa1100_rtc_init and into sa1100_rtc_probe. This means that pxa_rtc_probe also needs to do allocation for the rtc_device struct, otherwise sa1100_rtc_init will try to dereference a null pointer. This patch adds that allocation by copying how sa1100_rtc_probe in drivers/rtc/rtc-sa1100.c does it; after the IRQs are set up a managed rtc_device is allocated. I've tested this patch with `qemu-system-arm -machine akita` and with a real Zaurus SL-C1000 applied to 4.19, 5.4, and 5.10. Signed-off-by: Laurence de Bruxelles Fixes: f2997775b111 ("rtc: sa1100: fix possible race condition") Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220101154149.12026-1-lfdebrux@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/rtc/rtc-pxa.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/rtc/rtc-pxa.c +++ b/drivers/rtc/rtc-pxa.c @@ -349,6 +349,10 @@ static int __init pxa_rtc_probe(struct p return -ENXIO; } =20 + sa1100_rtc->rtc =3D devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(sa1100_rtc->rtc)) + return PTR_ERR(sa1100_rtc->rtc); + pxa_rtc->base =3D devm_ioremap(dev, pxa_rtc->ress->start, resource_size(pxa_rtc->ress)); if (!pxa_rtc->base) { From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5CDEC433EF for ; Tue, 25 Jan 2022 02:33:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3421067AbiAYC0F (ORCPT ); Mon, 24 Jan 2022 21:26:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56608 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244557AbiAXTsh (ORCPT ); Mon, 24 Jan 2022 14:48:37 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50DD3C02B8D6; Mon, 24 Jan 2022 11:23:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C60EFB810BD; Mon, 24 Jan 2022 19:23:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D666EC340E5; Mon, 24 Jan 2022 19:23:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052213; bh=Cxrhw0mczMyhZ1QX+B6rSfeV8iyoAeiPu4kVy1aqEBY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j9NYMuchI3L3FabQl2ozMpKyWh+hWM47Ze3vf2wXBvy+FoJYilbReAXwcAF+vU8A9 WlkPAYUZnyUFMxXHjwn9YJtZyojMirPL6NKPGSVBfG5muOZgXrvDy0qh7phTfH1VLt yS0vaVChfKh2QZPh5lvzkFxDXKTXZThEmpL4RT3o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , "Eric W. Biederman" , "David S. Miller" Subject: [PATCH 4.19 226/239] netns: add schedule point in ops_exit_list() Date: Mon, 24 Jan 2022 19:44:24 +0100 Message-Id: <20220124183950.294608115@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 2836615aa22de55b8fca5e32fe1b27a67cda625e upstream. When under stress, cleanup_net() can have to dismantle netns in big numbers. ops_exit_list() currently calls many helpers [1] that have no schedule point, and we can end up with soft lockups, particularly on hosts with many cpus. Even for moderate amount of netns processed by cleanup_net() this patch avoids latency spikes. [1] Some of these helpers like fib_sync_up() and fib_sync_down_dev() are very slow because net/ipv4/fib_semantics.c uses host-wide hash tables, and ifindex is used as the only input of two hash functions. ifindexes tend to be the same for all netns (lo.ifindex=3D=3D1 per inst= ance) This will be fixed in a separate patch. Fixes: 72ad937abd0a ("net: Add support for batching network namespace clean= ups") Signed-off-by: Eric Dumazet Cc: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/core/net_namespace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -149,8 +149,10 @@ static void ops_exit_list(const struct p { struct net *net; if (ops->exit) { - list_for_each_entry(net, net_exit_list, exit_list) + list_for_each_entry(net, net_exit_list, exit_list) { ops->exit(net); + cond_resched(); + } } if (ops->exit_batch) ops->exit_batch(net_exit_list); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8D132C433FE for ; Mon, 24 Jan 2022 20:07:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377750AbiAXUF4 (ORCPT ); Mon, 24 Jan 2022 15:05:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244771AbiAXTsh (ORCPT ); Mon, 24 Jan 2022 14:48:37 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A3960C02B8D7; Mon, 24 Jan 2022 11:23:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2EB7160BB9; Mon, 24 Jan 2022 19:23:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D8A36C340E5; Mon, 24 Jan 2022 19:23:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052216; bh=DthYjh+AUf6U0msGHmNsk3EuOaLtsWRn1QyFhfakDLQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rWE5SqG2v1mFbW/+idzRSVNaom5Pn8Pv+hAIJXMKxrh984dj9b2Ib377bnqeZqD4q IdBhEkQA3myBDAWFfgouImKPj/nJfIXEWdyDRbF9NGBwqhRPKU9syf2g3EuwC2XZjN niu9A5/JOJeDyPmqA0S7SmwSrGYHETcmH8OxVqU4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guillaume Nault , Jakub Kicinski Subject: [PATCH 4.19 227/239] libcxgb: Dont accidentally set RTO_ONLINK in cxgb_find_route() Date: Mon, 24 Jan 2022 19:44:25 +0100 Message-Id: <20220124183950.325346337@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guillaume Nault commit a915deaa9abe4fb3a440312c954253a6a733608e upstream. Mask the ECN bits before calling ip_route_output_ports(). The tos variable might be passed directly from an IPv4 header, so it may have the last ECN bit set. This interferes with the route lookup process as ip_route_output_key_hash() interpretes this bit specially (to restrict the route scope). Found by code inspection, compile tested only. Fixes: 804c2f3e36ef ("libcxgb,iw_cxgb4,cxgbit: add cxgb_find_route()") Signed-off-by: Guillaume Nault Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c +++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c @@ -32,6 +32,7 @@ =20 #include #include +#include #include #include =20 @@ -99,7 +100,7 @@ cxgb_find_route(struct cxgb4_lld_info *l =20 rt =3D ip_route_output_ports(&init_net, &fl4, NULL, peer_ip, local_ip, peer_port, local_port, IPPROTO_TCP, - tos, 0); + tos & ~INET_ECN_MASK, 0); if (IS_ERR(rt)) return NULL; n =3D dst_neigh_lookup(&rt->dst, &peer_ip); From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2100C433F5 for ; Tue, 25 Jan 2022 02:33:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3421090AbiAYC0N (ORCPT ); Mon, 24 Jan 2022 21:26:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56126 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346121AbiAXTsk (ORCPT ); Mon, 24 Jan 2022 14:48:40 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AA328C02B8E1; Mon, 24 Jan 2022 11:23:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 03D2AB8122A; Mon, 24 Jan 2022 19:23:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18AF4C340E5; Mon, 24 Jan 2022 19:23:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052219; bh=/wufMqX4nHb3ttYgY9ynSmxAtApyX6khtVhKyV0tUd8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fUM4o/dq5XkUzTwiUVIuVIFU4YppmiwWFGevErI4PXYxE8UwdDVm1KeyrtzMEMRGc ip6Fr+NW0g2I/wR/MIDhS+1tL5Jqg0tWWqyh0dXZiMpl9+GUvI8AuCiq6xynTOaenA hmQYd6st7Au95IFYFvO2kHX+QAbbNd8BQOqspD5M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.19 228/239] dmaengine: at_xdmac: Dont start transactions at tx_submit level Date: Mon, 24 Jan 2022 19:44:26 +0100 Message-Id: <20220124183950.357338128@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit bccfb96b59179d4f96cbbd1ddff8fac6d335eae4 upstream. tx_submit is supposed to push the current transaction descriptor to a pending queue, waiting for issue_pending() to be called. issue_pending() must start the transfer, not tx_submit(), thus remove at_xdmac_start_xfer() from at_xdmac_tx_submit(). Clients of at_xdmac that assume that tx_submit() starts the transfer must be updated and call dma_async_issue_pending() if they miss to call it (one example is atmel_serial). As the at_xdmac_start_xfer() is now called only from at_xdmac_advance_work() when !at_xdmac_chan_is_enabled(), the at_xdmac_chan_is_enabled() check is no longer needed in at_xdmac_start_xfer(), thus remove it. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-2-tudor.ambarus@micro= chip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/dma/at_xdmac.c | 6 ------ 1 file changed, 6 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -344,9 +344,6 @@ static void at_xdmac_start_xfer(struct a =20 dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, first); =20 - if (at_xdmac_chan_is_enabled(atchan)) - return; - /* Set transfer as active to not try to start it again. */ first->active_xfer =3D true; =20 @@ -430,9 +427,6 @@ static dma_cookie_t at_xdmac_tx_submit(s dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", __func__, atchan, desc); list_add_tail(&desc->xfer_node, &atchan->xfers_list); - if (list_is_singular(&atchan->xfers_list)) - at_xdmac_start_xfer(atchan, desc); - spin_unlock_irqrestore(&atchan->lock, irqflags); return cookie; } From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9713FC4332F for ; Mon, 24 Jan 2022 20:07:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349175AbiAXUHM (ORCPT ); Mon, 24 Jan 2022 15:07:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56638 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346820AbiAXTsl (ORCPT ); Mon, 24 Jan 2022 14:48:41 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C3802C02B8E2; Mon, 24 Jan 2022 11:23:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 649906121F; Mon, 24 Jan 2022 19:23:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4628EC340E5; Mon, 24 Jan 2022 19:23:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052222; bh=XvKunCyUTqhoDJttVMh5EWZ4rnj0JNBQ0NSEL9yv4Ak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BZuPRJQb3930e/gGI83wQTHQ/xHjQxwXHMAyaaVEicelT4diMxYKaGAezsVX1iRdZ JQSnWRIdxA/dfZWg7SSD/0fW+jNpIOY15Z5WsqMi2gcijDtVaS9s3SgYFp0iLID/OP WmDA+hOPU7GWi2hxM2OjIKm4CbXIGLL79fzzj4fE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.19 229/239] dmaengine: at_xdmac: Print debug message after realeasing the lock Date: Mon, 24 Jan 2022 19:44:27 +0100 Message-Id: <20220124183950.387625015@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 5edc24ac876a928f36f407a0fcdb33b94a3a210f upstream. It is desirable to do the prints without the lock held if possible, so move the print after the lock is released. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-4-tudor.ambarus@micro= chip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/dma/at_xdmac.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -424,10 +424,12 @@ static dma_cookie_t at_xdmac_tx_submit(s spin_lock_irqsave(&atchan->lock, irqflags); cookie =3D dma_cookie_assign(tx); =20 - dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", - __func__, atchan, desc); list_add_tail(&desc->xfer_node, &atchan->xfers_list); spin_unlock_irqrestore(&atchan->lock, irqflags); + + dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", + __func__, atchan, desc); + return cookie; } =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8EC93C4332F for ; Mon, 24 Jan 2022 20:07:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358986AbiAXUH2 (ORCPT ); Mon, 24 Jan 2022 15:07:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350541AbiAXTtE (ORCPT ); Mon, 24 Jan 2022 14:49:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D87A8C02B8F1; Mon, 24 Jan 2022 11:23:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2F772B8122A; Mon, 24 Jan 2022 19:23:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 469FBC340E8; Mon, 24 Jan 2022 19:23:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052225; bh=1pszC8haO9AcQCNEv/+zUuqg25w5JfFjf7bNYenSnDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uqZdcdCbo2RCuMtKSNRv9WQLP+/3gexJSjlStLp5/VM+6rvGK3lYS6eBdluuCg58j Z4fM7kbsnM5mxRojJ1gQHB+Mqz1FeY7lIZiciU6l6K+rlAHDcAD8oCocfJ2gqiYj42 0ZXCjLdreVtCYD/QZQtI8/6KuGjEJST4Tcpzvn5M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.19 230/239] dmaengine: at_xdmac: Fix lld view setting Date: Mon, 24 Jan 2022 19:44:28 +0100 Message-Id: <20220124183950.417192507@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 1385eb4d14d447cc5d744bc2ac34f43be66c9963 upstream. AT_XDMAC_CNDC_NDVIEW_NDV3 was set even for AT_XDMAC_MBR_UBC_NDV2, because of the wrong bit handling. Fix it. Fixes: ee0fe35c8dcd ("dmaengine: xdmac: Handle descriptor's view 3 register= s") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-10-tudor.ambarus@micr= ochip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/dma/at_xdmac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -100,6 +100,7 @@ #define AT_XDMAC_CNDC_NDE (0x1 << 0) /* Channel x Next Descriptor Enabl= e */ #define AT_XDMAC_CNDC_NDSUP (0x1 << 1) /* Channel x Next Descriptor Sou= rce Update */ #define AT_XDMAC_CNDC_NDDUP (0x1 << 2) /* Channel x Next Descriptor Des= tination Update */ +#define AT_XDMAC_CNDC_NDVIEW_MASK GENMASK(28, 27) #define AT_XDMAC_CNDC_NDVIEW_NDV0 (0x0 << 3) /* Channel x Next Descripto= r View 0 */ #define AT_XDMAC_CNDC_NDVIEW_NDV1 (0x1 << 3) /* Channel x Next Descripto= r View 1 */ #define AT_XDMAC_CNDC_NDVIEW_NDV2 (0x2 << 3) /* Channel x Next Descripto= r View 2 */ @@ -359,7 +360,8 @@ static void at_xdmac_start_xfer(struct a */ if (at_xdmac_chan_is_cyclic(atchan)) reg =3D AT_XDMAC_CNDC_NDVIEW_NDV1; - else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3) + else if ((first->lld.mbr_ubc & + AT_XDMAC_CNDC_NDVIEW_MASK) =3D=3D AT_XDMAC_MBR_UBC_NDV3) reg =3D AT_XDMAC_CNDC_NDVIEW_NDV3; else reg =3D AT_XDMAC_CNDC_NDVIEW_NDV2; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 552F0C433F5 for ; Mon, 24 Jan 2022 20:08:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378516AbiAXUHd (ORCPT ); Mon, 24 Jan 2022 15:07:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350567AbiAXTtE (ORCPT ); Mon, 24 Jan 2022 14:49:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E974C02B8F9; Mon, 24 Jan 2022 11:23:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 24B01B8121F; Mon, 24 Jan 2022 19:23:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4FAFAC340E5; Mon, 24 Jan 2022 19:23:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052228; bh=cM8e0f4FcNE+MacCiN8jXQAKoaEqErh8xnFDFuWA15U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nu02ac7d1AwFUAI5V7pDbsihDnaXDpSUH3ffJAi1pe5RCBpX+x/c3oAraDzAy0CCK HZ1Y6OFTjFcsrpP4E2boA5nS1ZTNFhukFgpd1JZ0IcLmu+/6b3H7D8zGdM4gDoHYNe ltzJW3MyGiwrs9TPMv5Bg7jEOu9/yZNmNzNTyjH0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.19 231/239] dmaengine: at_xdmac: Fix at_xdmac_lld struct definition Date: Mon, 24 Jan 2022 19:44:29 +0100 Message-Id: <20220124183950.447174875@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 912f7c6f7fac273f40e621447cf17d14b50d6e5b upstream. The hardware channel next descriptor view structure contains just fields of 32 bits, while dma_addr_t can be of type u64 or u32 depending on CONFIG_ARCH_DMA_ADDR_T_64BIT. Force u32 to comply with what the hardware expects. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-11-tudor.ambarus@micr= ochip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/dma/at_xdmac.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -232,15 +232,15 @@ struct at_xdmac { =20 /* Linked List Descriptor */ struct at_xdmac_lld { - dma_addr_t mbr_nda; /* Next Descriptor Member */ - u32 mbr_ubc; /* Microblock Control Member */ - dma_addr_t mbr_sa; /* Source Address Member */ - dma_addr_t mbr_da; /* Destination Address Member */ - u32 mbr_cfg; /* Configuration Register */ - u32 mbr_bc; /* Block Control Register */ - u32 mbr_ds; /* Data Stride Register */ - u32 mbr_sus; /* Source Microblock Stride Register */ - u32 mbr_dus; /* Destination Microblock Stride Register */ + u32 mbr_nda; /* Next Descriptor Member */ + u32 mbr_ubc; /* Microblock Control Member */ + u32 mbr_sa; /* Source Address Member */ + u32 mbr_da; /* Destination Address Member */ + u32 mbr_cfg; /* Configuration Register */ + u32 mbr_bc; /* Block Control Register */ + u32 mbr_ds; /* Data Stride Register */ + u32 mbr_sus; /* Source Microblock Stride Register */ + u32 mbr_dus; /* Destination Microblock Stride Register */ }; =20 /* 64-bit alignment needed to update CNDA and CUBC registers in an atomic = way. */ From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C6DBC433EF for ; Tue, 25 Jan 2022 02:34:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3421404AbiAYC0v (ORCPT ); Mon, 24 Jan 2022 21:26:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357234AbiAXTtj (ORCPT ); Mon, 24 Jan 2022 14:49:39 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C1744C02B85E; Mon, 24 Jan 2022 11:23:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7F82BB8119D; Mon, 24 Jan 2022 19:23:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77C35C340E5; Mon, 24 Jan 2022 19:23:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052235; bh=vOXL6mDMuE3FEEnsEWT8d+ESEXgBcEAP+vCQtONFlDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yBwZOKDcIDR7qzLNGZidtv4zjaViR2edROzy74C6p7wb3K4Xtw2bzNVzX1mbWymwP amq5sy3ViDCvtldo7G84s2c/JZmr7hyGVnogb+dPMhpZZ/2QIOMlUawtPGNygbnwGK WGCPEIqzfaRHvayPgDjrSP8DXBgHpS26/oBYLc2c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kevin Bracey , Eric Dumazet , Jiri Pirko , Vimalkumar , Jakub Kicinski Subject: [PATCH 4.19 232/239] net_sched: restore "mpu xxx" handling Date: Mon, 24 Jan 2022 19:44:30 +0100 Message-Id: <20220124183950.477490702@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kevin Bracey commit fb80445c438c78b40b547d12b8d56596ce4ccfeb upstream. commit 56b765b79e9a ("htb: improved accuracy at high rates") broke "overhead X", "linklayer atm" and "mpu X" attributes. "overhead X" and "linklayer atm" have already been fixed. This restores the "mpu X" handling, as might be used by DOCSIS or Ethernet shaping: tc class add ... htb rate X overhead 4 mpu 64 The code being fixed is used by htb, tbf and act_police. Cake has its own mpu handling. qdisc_calculate_pkt_len still uses the size table containing values adjusted for mpu by user space. iproute2 tc has always passed mpu into the kernel via a tc_ratespec structure, but the kernel never directly acted on it, merely stored it so that it could be read back by `tc class show`. Rather, tc would generate length-to-time tables that included the mpu (and linklayer) in their construction, and the kernel used those tables. Since v3.7, the tables were no longer used. Along with "mpu", this also broke "overhead" and "linklayer" which were fixed in 01cb71d2d47b ("net_sched: restore "overhead xxx" handling", v3.10) and 8a8e3d84b171 ("net_sched: restore "linklayer atm" handling", v3.11). "overhead" was fixed by simply restoring use of tc_ratespec::overhead - this had originally been used by the kernel but was initially omitted from the new non-table-based calculations. "linklayer" had been handled in the table like "mpu", but the mode was not originally passed in tc_ratespec. The new implementation was made to handle it by getting new versions of tc to pass the mode in an extended tc_ratespec, and for older versions of tc the table contents were analysed at load time to deduce linklayer. As "mpu" has always been given to the kernel in tc_ratespec, accompanying the mpu-based table, we can restore system functionality with no userspace change by making the kernel act on the tc_ratespec value. Fixes: 56b765b79e9a ("htb: improved accuracy at high rates") Signed-off-by: Kevin Bracey Cc: Eric Dumazet Cc: Jiri Pirko Cc: Vimalkumar Link: https://lore.kernel.org/r/20220112170210.1014351-1-kevin@bracey.fi Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/sch_generic.h | 5 +++++ net/sched/sch_generic.c | 1 + 2 files changed, 6 insertions(+) --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -1077,6 +1077,7 @@ struct psched_ratecfg { u64 rate_bytes_ps; /* bytes per second */ u32 mult; u16 overhead; + u16 mpu; u8 linklayer; u8 shift; }; @@ -1086,6 +1087,9 @@ static inline u64 psched_l2t_ns(const st { len +=3D r->overhead; =20 + if (len < r->mpu) + len =3D r->mpu; + if (unlikely(r->linklayer =3D=3D TC_LINKLAYER_ATM)) return ((u64)(DIV_ROUND_UP(len,48)*53) * r->mult) >> r->shift; =20 @@ -1108,6 +1112,7 @@ static inline void psched_ratecfg_getrat res->rate =3D min_t(u64, r->rate_bytes_ps, ~0U); =20 res->overhead =3D r->overhead; + res->mpu =3D r->mpu; res->linklayer =3D (r->linklayer & TC_LINKLAYER_MASK); } =20 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -1367,6 +1367,7 @@ void psched_ratecfg_precompute(struct ps { memset(r, 0, sizeof(*r)); r->overhead =3D conf->overhead; + r->mpu =3D conf->mpu; r->rate_bytes_ps =3D max_t(u64, conf->rate, rate64); r->linklayer =3D (conf->linklayer & TC_LINKLAYER_MASK); r->mult =3D 1; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8CA0C433FE for ; Mon, 24 Jan 2022 19:33:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348998AbiAXTdI (ORCPT ); Mon, 24 Jan 2022 14:33:08 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:50176 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346471AbiAXTYA (ORCPT ); Mon, 24 Jan 2022 14:24:00 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E735460BB9; Mon, 24 Jan 2022 19:23:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF61CC340E5; Mon, 24 Jan 2022 19:23:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052238; bh=mJbQsbWtC+xw4C+MzRUCa4EPjipCNEFmq2YWwdMxPco=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L+UBpxbWwuzBIn2y1jWntTozMN0c6+aHxpfjLaBy4G+jJ2cJbN2Hgs2lQALxET2nK w72g7xapMah/n+OKYqNrrEcEvEQ2z6w+C49Jt+xxhUQPlzAuA2zJlVu2oEjy/0BiDF QlrdJafgWRzvIOTSnfC8dKMRdT13c/0+00C6lmGQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Florian Fainelli , "David S. Miller" Subject: [PATCH 4.19 233/239] bcmgenet: add WOL IRQ check Date: Mon, 24 Jan 2022 19:44:31 +0100 Message-Id: <20220124183950.513747155@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit 9deb48b53e7f4056c2eaa2dc2ee3338df619e4f6 upstream. The driver neglects to check the result of platform_get_irq_optional()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL. Stop calling devm_request_irq() with the invalid IRQ #s. Fixes: 8562056f267d ("net: bcmgenet: request Wake-on-LAN interrupt") Signed-off-by: Sergey Shtylyov Acked-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3516,10 +3516,12 @@ static int bcmgenet_probe(struct platfor =20 /* Request the WOL interrupt and advertise suspend if available */ priv->wol_irq_disabled =3D true; - err =3D devm_request_irq(&pdev->dev, priv->wol_irq, bcmgenet_wol_isr, 0, - dev->name, priv); - if (!err) - device_set_wakeup_capable(&pdev->dev, 1); + if (priv->wol_irq > 0) { + err =3D devm_request_irq(&pdev->dev, priv->wol_irq, + bcmgenet_wol_isr, 0, dev->name, priv); + if (!err) + device_set_wakeup_capable(&pdev->dev, 1); + } =20 /* Set the needed headroom to account for any possible * features enabling/disabling at runtime From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC125C433F5 for ; Tue, 25 Jan 2022 02:34:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3421536AbiAYC1H (ORCPT ); Mon, 24 Jan 2022 21:27:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351000AbiAXTul (ORCPT ); Mon, 24 Jan 2022 14:50:41 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EBFDFC019B19; Mon, 24 Jan 2022 11:24:03 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B514BB8121F; Mon, 24 Jan 2022 19:24:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9DF7C340E7; Mon, 24 Jan 2022 19:24:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052241; bh=4vD56yFlgUBC5atksTz50D4Z2EyBrU/6DhqxbVI8tNM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z0HYXFlXUDqFI/JPxUjk9Vy5wHkU+xn05tf7HLTnyyay4Iq9YcBSO3ZUS/CFHj3Vg +Cyreyk9QfxnyyzRAhMR6fzxSJDVWWMSnfSB6RZx0in/Yz2Ml4GkJPhjNc1Zk3xsGc 4KFp7GX2BJ00I4PE/bdXoXjp/FaCXk+EktQJxNwk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Matthias Schiffer , Frank Rowand , Rob Herring Subject: [PATCH 4.19 234/239] scripts/dtc: dtx_diff: remove broken example from help text Date: Mon, 24 Jan 2022 19:44:32 +0100 Message-Id: <20220124183950.543102350@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Matthias Schiffer commit d8adf5b92a9d2205620874d498c39923ecea8749 upstream. dtx_diff suggests to use <(...) syntax to pipe two inputs into it, but this has never worked: The /proc/self/fds/... paths passed by the shell will fail the `[ -f "${dtx}" ] && [ -r "${dtx}" ]` check in compile_to_dts, but even with this check removed, the function cannot work: hexdump will eat up the DTB magic, making the subsequent dtc call fail, as a pipe cannot be rewound. Simply remove this broken example, as there is already an alternative one that works fine. Fixes: 10eadc253ddf ("dtc: create tool to diff device trees") Signed-off-by: Matthias Schiffer Reviewed-by: Frank Rowand Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220113081918.10387-1-matthias.schiffer@ew= .tq-group.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- scripts/dtc/dtx_diff | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) --- a/scripts/dtc/dtx_diff +++ b/scripts/dtc/dtx_diff @@ -56,12 +56,8 @@ Otherwise DTx is treated as a dts source or '/include/' to be processed. =20 If DTx_1 and DTx_2 are in different architectures, then this script - may not work since \${ARCH} is part of the include path. Two possible - workarounds: - - `basename $0` \\ - <(ARCH=3Darch_of_dtx_1 `basename $0` DTx_1) \\ - <(ARCH=3Darch_of_dtx_2 `basename $0` DTx_2) + may not work since \${ARCH} is part of the include path. The following + workaround can be used: =20 `basename $0` ARCH=3Darch_of_dtx_1 DTx_1 >tmp_dtx_1.dts `basename $0` ARCH=3Darch_of_dtx_2 DTx_2 >tmp_dtx_2.dts From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 703ADC4321E for ; Tue, 25 Jan 2022 02:34:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3421587AbiAYC1O (ORCPT ); Mon, 24 Jan 2022 21:27:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57176 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357622AbiAXTvE (ORCPT ); Mon, 24 Jan 2022 14:51:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5CA81C019B22; Mon, 24 Jan 2022 11:24:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CA728B810BD; Mon, 24 Jan 2022 19:24:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EEFC9C340E5; Mon, 24 Jan 2022 19:24:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052244; bh=/WuAenPvtHoOYxe2cLjzMTFFnpRHp7Hh7oLwX6A9/98=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U7IBz2xxnlE7JW5mKZ9tGtXyPaR73ch53Dmd+wXg+ngc0pYtNtn2VZimYn/hiKins Qp27xI5ewwuwz2GHMqe4ulAjy2RJRpu6x/TzxGNBBctVVwBtE0KtbraO/jpwLlBdZy XyhqELjop+L1UPX27RVNE7Sce5dmfO/C5/zhJvhw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , "David S. Miller" Subject: [PATCH 4.19 235/239] lib82596: Fix IRQ check in sni_82596_probe Date: Mon, 24 Jan 2022 19:44:33 +0100 Message-Id: <20220124183950.574194009@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit 99218cbf81bf21355a3de61cd46a706d36e900e6 upstream. platform_get_irq() returns negative error number instead 0 on failure. And the doc of platform_get_irq() provides a usage example: int irq =3D platform_get_irq(pdev, 0); if (irq < 0) return irq; Fix the check of return value to catch errors correctly. Fixes: 115978859272 ("i825xx: Move the Intel 82586/82593/82596 based driver= s") Signed-off-by: Miaoqian Lin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/i825xx/sni_82596.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/i825xx/sni_82596.c +++ b/drivers/net/ethernet/i825xx/sni_82596.c @@ -122,9 +122,10 @@ static int sni_82596_probe(struct platfo netdevice->dev_addr[5] =3D readb(eth_addr + 0x06); iounmap(eth_addr); =20 - if (!netdevice->irq) { + if (netdevice->irq < 0) { printk(KERN_ERR "%s: IRQ not found for i82596 at 0x%lx\n", __FILE__, netdevice->base_addr); + retval =3D netdevice->irq; goto probe_failed; } =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 816ECC4167D for ; Tue, 25 Jan 2022 02:34:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3421608AbiAYC1R (ORCPT ); Mon, 24 Jan 2022 21:27:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57632 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357626AbiAXTvF (ORCPT ); Mon, 24 Jan 2022 14:51:05 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 46BC4C019B2B; Mon, 24 Jan 2022 11:24:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0CCF2B81223; Mon, 24 Jan 2022 19:24:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21941C340E5; Mon, 24 Jan 2022 19:24:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052247; bh=o4vXwjtGO5bckZbOzF25uhyLz3mbp8Clz6bUC0ZiGSE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m9hPhN6Uv920AUX7Mm1fSy6WYhypYg3PF9t9DvCLWUpT6lWB9nRR63pE2mtFjiy4i qINXOtNtyfiI6q8KmvDBiTqrAwPUeIW+2eZP8Ty5+5FIZU9L6JHrwPylu0ZlBOcaKR iwcriwCW6D36s6jt/I/tr1X1ZGxyDSYxUr/rs5aY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Patrick Doyle , Richard Weinberger , Yoshio Furuyama , Miquel Raynal , Frieder Schrempf Subject: [PATCH 4.19 236/239] mtd: nand: bbt: Fix corner case in bad block table handling Date: Mon, 24 Jan 2022 19:44:34 +0100 Message-Id: <20220124183950.604686824@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Doyle, Patrick commit fd0d8d85f7230052e638a56d1bfea170c488e6bc upstream. In the unlikely event that both blocks 10 and 11 are marked as bad (on a 32 bit machine), then the process of marking block 10 as bad stomps on cached entry for block 11. There are (of course) other examples. Signed-off-by: Patrick Doyle Reviewed-by: Richard Weinberger Signed-off-by: Yoshio Furuyama [: Fixed the title] Signed-off-by: Miquel Raynal Cc: Frieder Schrempf Link: https://lore.kernel.org/linux-mtd/774a92693f311e7de01e5935e720a179fb1= b2468.1616635406.git.ytc-mb-yfuruyama7@kioxia.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/mtd/nand/bbt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/mtd/nand/bbt.c +++ b/drivers/mtd/nand/bbt.c @@ -123,7 +123,7 @@ int nanddev_bbt_set_block_status(struct unsigned int rbits =3D bits_per_block + offs - BITS_PER_LONG; =20 pos[1] &=3D ~GENMASK(rbits - 1, 0); - pos[1] |=3D val >> rbits; + pos[1] |=3D val >> (bits_per_block - rbits); } =20 return 0; From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF9EDC433F5 for ; Mon, 24 Jan 2022 19:32:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347490AbiAXTcA (ORCPT ); Mon, 24 Jan 2022 14:32:00 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:52506 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348369AbiAXTYL (ORCPT ); Mon, 24 Jan 2022 14:24:11 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 701D760010; Mon, 24 Jan 2022 19:24:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3BE41C340E5; Mon, 24 Jan 2022 19:24:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052250; bh=+CWjJhb3LHq2nkKWhUKIM9khMf6V6/hB/5bZ3Edscmk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XdLidgITTPvkiMhvT638G1YDoxJOlWinwWKOquAN6Zf8FIU1LAv2v2QJd5dcliS6P oyNNV2rtOXbjzHmuIAnNYhr3x61CVSrMmQF5F0dg1oBt/EeULLwO+fHSLuJmyNPND9 EoPP4EyVzb5Es3zqMDaz8YkqZvULIHSNFsmaHzqQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Suren Baghdasaryan , Ben Hutchings Subject: [PATCH 4.19 237/239] mips,s390,sh,sparc: gup: Work around the "COW can break either way" issue Date: Mon, 24 Jan 2022 19:44:35 +0100 Message-Id: <20220124183950.633915249@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ben Hutchings In Linux 4.14 and 4.19 these architectures still have their own implementations of get_user_pages_fast(). These also need to force the write flag on when taking the fast path. Fixes: 407faed92b4a ("gup: document and work around "COW can break either w= ay" issue") Fixes: 5e24029791e8 ("gup: document and work around "COW can break either w= ay" issue") Signed-off-by: Ben Hutchings Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/mips/mm/gup.c | 9 ++++++++- arch/s390/mm/gup.c | 9 ++++++++- arch/sh/mm/gup.c | 9 ++++++++- arch/sparc/mm/gup.c | 9 ++++++++- 4 files changed, 32 insertions(+), 4 deletions(-) --- a/arch/mips/mm/gup.c +++ b/arch/mips/mm/gup.c @@ -274,7 +274,14 @@ int get_user_pages_fast(unsigned long st next =3D pgd_addr_end(addr, end); if (pgd_none(pgd)) goto slow; - if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) goto slow; } while (pgdp++, addr =3D next, addr !=3D end); local_irq_enable(); --- a/arch/s390/mm/gup.c +++ b/arch/s390/mm/gup.c @@ -287,7 +287,14 @@ int get_user_pages_fast(unsigned long st =20 might_sleep(); start &=3D PAGE_MASK; - nr =3D __get_user_pages_fast(start, nr_pages, write, pages); + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + nr =3D __get_user_pages_fast(start, nr_pages, 1, pages); if (nr =3D=3D nr_pages) return nr; =20 --- a/arch/sh/mm/gup.c +++ b/arch/sh/mm/gup.c @@ -242,7 +242,14 @@ int get_user_pages_fast(unsigned long st next =3D pgd_addr_end(addr, end); if (pgd_none(pgd)) goto slow; - if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) goto slow; } while (pgdp++, addr =3D next, addr !=3D end); local_irq_enable(); --- a/arch/sparc/mm/gup.c +++ b/arch/sparc/mm/gup.c @@ -303,7 +303,14 @@ int get_user_pages_fast(unsigned long st next =3D pgd_addr_end(addr, end); if (pgd_none(pgd)) goto slow; - if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) goto slow; } while (pgdp++, addr =3D next, addr !=3D end); =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6E24C433FE for ; Mon, 24 Jan 2022 20:09:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242995AbiAXUJH (ORCPT ); Mon, 24 Jan 2022 15:09:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57180 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357638AbiAXTvF (ORCPT ); Mon, 24 Jan 2022 14:51:05 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E7E1EC019B35; Mon, 24 Jan 2022 11:24:14 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 63AB06129A; Mon, 24 Jan 2022 19:24:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A175C340E7; Mon, 24 Jan 2022 19:24:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052253; bh=VrSWKIYqPDS97VKyu7UXifrnr9TueyD//pc1gpqyH6A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gxk38lX/jZyBDys73izOqrXfQvec0HOPEQ7hrDJdNki4CO280ecjVHXi1eVRyPR4s T1kIfPJR30cNLE7tsMq03YMXk8SQJ2ZG3yhLM0nE6WSNpoTL3Hz9Q1PoonA/Iev73J DnkIKMg3XdfF7CXNaTX8BW0UekzeoSAr1h2LSUWg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com, Miklos Szeredi , Jan Kara , Ben Hutchings Subject: [PATCH 4.19 238/239] fuse: fix bad inode Date: Mon, 24 Jan 2022 19:44:36 +0100 Message-Id: <20220124183950.661842106@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miklos Szeredi commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 upstream. Jan Kara's analysis of the syzbot report (edited): The reproducer opens a directory on FUSE filesystem, it then attaches dnotify mark to the open directory. After that a fuse_do_getattr() call finds that attributes returned by the server are inconsistent, and calls make_bad_inode() which, among other things does: inode->i_mode =3D S_IFREG; This then confuses dnotify which doesn't tear down its structures properly and eventually crashes. Avoid calling make_bad_inode() on a live inode: switch to a private flag on the fuse inode. Also add the test to ops which the bad_inode_ops would have caught. This bug goes back to the initial merge of fuse in 2.6.14... Reported-by: syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com Signed-off-by: Miklos Szeredi Tested-by: Jan Kara Cc: [bwh: Backported to 4.19: - Drop changes in fuse_dir_fsync(), fuse_readahead(), fuse_evict_inode() - In fuse_get_link(), return ERR_PTR(-EIO) for bad inodes - Convert some additional calls to is_bad_inode() - Adjust filename, context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/fuse/acl.c | 6 ++++++ fs/fuse/dir.c | 40 +++++++++++++++++++++++++++++++++++----- fs/fuse/file.c | 27 ++++++++++++++++++--------- fs/fuse/fuse_i.h | 12 ++++++++++++ fs/fuse/inode.c | 2 +- fs/fuse/xattr.c | 9 +++++++++ 6 files changed, 81 insertions(+), 15 deletions(-) --- a/fs/fuse/acl.c +++ b/fs/fuse/acl.c @@ -19,6 +19,9 @@ struct posix_acl *fuse_get_acl(struct in void *value =3D NULL; struct posix_acl *acl; =20 + if (fuse_is_bad(inode)) + return ERR_PTR(-EIO); + if (!fc->posix_acl || fc->no_getxattr) return NULL; =20 @@ -53,6 +56,9 @@ int fuse_set_acl(struct inode *inode, st const char *name; int ret; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fc->posix_acl || fc->no_setxattr) return -EOPNOTSUPP; =20 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -187,7 +187,7 @@ static int fuse_dentry_revalidate(struct int ret; =20 inode =3D d_inode_rcu(entry); - if (inode && is_bad_inode(inode)) + if (inode && fuse_is_bad(inode)) goto invalid; else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) || (flags & LOOKUP_REVAL)) { @@ -364,6 +364,9 @@ static struct dentry *fuse_lookup(struct bool outarg_valid =3D true; bool locked; =20 + if (fuse_is_bad(dir)) + return ERR_PTR(-EIO); + locked =3D fuse_lock_inode(dir); err =3D fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name, &outarg, &inode); @@ -504,6 +507,9 @@ static int fuse_atomic_open(struct inode struct fuse_conn *fc =3D get_fuse_conn(dir); struct dentry *res =3D NULL; =20 + if (fuse_is_bad(dir)) + return -EIO; + if (d_in_lookup(entry)) { res =3D fuse_lookup(dir, entry, 0); if (IS_ERR(res)) @@ -552,6 +558,9 @@ static int create_new_entry(struct fuse_ int err; struct fuse_forget_link *forget; =20 + if (fuse_is_bad(dir)) + return -EIO; + forget =3D fuse_alloc_forget(); if (!forget) return -ENOMEM; @@ -679,6 +688,9 @@ static int fuse_unlink(struct inode *dir struct fuse_conn *fc =3D get_fuse_conn(dir); FUSE_ARGS(args); =20 + if (fuse_is_bad(dir)) + return -EIO; + args.in.h.opcode =3D FUSE_UNLINK; args.in.h.nodeid =3D get_node_id(dir); args.in.numargs =3D 1; @@ -715,6 +727,9 @@ static int fuse_rmdir(struct inode *dir, struct fuse_conn *fc =3D get_fuse_conn(dir); FUSE_ARGS(args); =20 + if (fuse_is_bad(dir)) + return -EIO; + args.in.h.opcode =3D FUSE_RMDIR; args.in.h.nodeid =3D get_node_id(dir); args.in.numargs =3D 1; @@ -793,6 +808,9 @@ static int fuse_rename2(struct inode *ol struct fuse_conn *fc =3D get_fuse_conn(olddir); int err; =20 + if (fuse_is_bad(olddir)) + return -EIO; + if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE)) return -EINVAL; =20 @@ -928,7 +946,7 @@ static int fuse_do_getattr(struct inode if (!err) { if (fuse_invalid_attr(&outarg.attr) || (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { - make_bad_inode(inode); + fuse_make_bad(inode); err =3D -EIO; } else { fuse_change_attributes(inode, &outarg.attr, @@ -1125,6 +1143,9 @@ static int fuse_permission(struct inode bool refreshed =3D false; int err =3D 0; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; =20 @@ -1262,7 +1283,7 @@ retry: dput(dentry); goto retry; } - if (is_bad_inode(inode)) { + if (fuse_is_bad(inode)) { dput(dentry); return -EIO; } @@ -1360,7 +1381,7 @@ static int fuse_readdir(struct file *fil u64 attr_version =3D 0; bool locked; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 req =3D fuse_get_req(fc, 1); @@ -1420,6 +1441,9 @@ static const char *fuse_get_link(struct if (!dentry) return ERR_PTR(-ECHILD); =20 + if (fuse_is_bad(inode)) + return ERR_PTR(-EIO); + link =3D kmalloc(PAGE_SIZE, GFP_KERNEL); if (!link) return ERR_PTR(-ENOMEM); @@ -1718,7 +1742,7 @@ int fuse_do_setattr(struct dentry *dentr =20 if (fuse_invalid_attr(&outarg.attr) || (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { - make_bad_inode(inode); + fuse_make_bad(inode); err =3D -EIO; goto error; } @@ -1774,6 +1798,9 @@ static int fuse_setattr(struct dentry *e struct file *file =3D (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL; int ret; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(get_fuse_conn(inode))) return -EACCES; =20 @@ -1832,6 +1859,9 @@ static int fuse_getattr(const struct pat struct inode *inode =3D d_inode(path->dentry); struct fuse_conn *fc =3D get_fuse_conn(inode); =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; =20 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -210,6 +210,9 @@ int fuse_open_common(struct inode *inode fc->atomic_o_trunc && fc->writeback_cache; =20 + if (fuse_is_bad(inode)) + return -EIO; + err =3D generic_file_open(inode, file); if (err) return err; @@ -411,7 +414,7 @@ static int fuse_flush(struct file *file, struct fuse_flush_in inarg; int err; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 if (fc->no_flush) @@ -459,7 +462,7 @@ int fuse_fsync_common(struct file *file, struct fuse_fsync_in inarg; int err; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 inode_lock(inode); @@ -774,7 +777,7 @@ static int fuse_readpage(struct file *fi int err; =20 err =3D -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; =20 err =3D fuse_do_readpage(file, page); @@ -901,7 +904,7 @@ static int fuse_readpages(struct file *f int nr_alloc =3D min_t(unsigned, nr_pages, FUSE_MAX_PAGES_PER_REQ); =20 err =3D -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; =20 data.file =3D file; @@ -931,6 +934,9 @@ static ssize_t fuse_file_read_iter(struc struct inode *inode =3D iocb->ki_filp->f_mapping->host; struct fuse_conn *fc =3D get_fuse_conn(inode); =20 + if (fuse_is_bad(inode)) + return -EIO; + /* * In auto invalidate mode, always update attributes on read. * Otherwise, only update if we attempt to read past EOF (to ensure @@ -1131,7 +1137,7 @@ static ssize_t fuse_perform_write(struct int err =3D 0; ssize_t res =3D 0; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 if (inode->i_size < pos + iov_iter_count(ii)) @@ -1188,6 +1194,9 @@ static ssize_t fuse_file_write_iter(stru ssize_t err; loff_t endbyte =3D 0; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (get_fuse_conn(inode)->writeback_cache) { /* Update size (EOF optimization) and mode (SUID clearing) */ err =3D fuse_update_attributes(mapping->host, file); @@ -1424,7 +1433,7 @@ static ssize_t __fuse_direct_read(struct ssize_t res; struct inode *inode =3D file_inode(io->iocb->ki_filp); =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 res =3D fuse_direct_io(io, iter, ppos, 0); @@ -1446,7 +1455,7 @@ static ssize_t fuse_direct_write_iter(st struct fuse_io_priv io =3D FUSE_IO_PRIV_SYNC(iocb); ssize_t res; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 /* Don't allow parallel writes to the same file */ @@ -1920,7 +1929,7 @@ static int fuse_writepages(struct addres int err; =20 err =3D -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; =20 data.inode =3D inode; @@ -2705,7 +2714,7 @@ long fuse_ioctl_common(struct file *file if (!fuse_allow_current_process(fc)) return -EACCES; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 return fuse_do_ioctl(file, cmd, arg, flags); --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -118,6 +118,8 @@ enum { FUSE_I_INIT_RDPLUS, /** An operation changing file size is in progress */ FUSE_I_SIZE_UNSTABLE, + /* Bad inode */ + FUSE_I_BAD, }; =20 struct fuse_conn; @@ -700,6 +702,16 @@ static inline u64 get_node_id(struct ino return get_fuse_inode(inode)->nodeid; } =20 +static inline void fuse_make_bad(struct inode *inode) +{ + set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); +} + +static inline bool fuse_is_bad(struct inode *inode) +{ + return unlikely(test_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state)); +} + /** Device operations */ extern const struct file_operations fuse_dev_operations; =20 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -317,7 +317,7 @@ struct inode *fuse_iget(struct super_blo unlock_new_inode(inode); } else if ((inode->i_mode ^ attr->mode) & S_IFMT) { /* Inode has changed type, any I/O on the old should fail */ - make_bad_inode(inode); + fuse_make_bad(inode); iput(inode); goto retry; } --- a/fs/fuse/xattr.c +++ b/fs/fuse/xattr.c @@ -113,6 +113,9 @@ ssize_t fuse_listxattr(struct dentry *en struct fuse_getxattr_out outarg; ssize_t ret; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; =20 @@ -178,6 +181,9 @@ static int fuse_xattr_get(const struct x struct dentry *dentry, struct inode *inode, const char *name, void *value, size_t size) { + if (fuse_is_bad(inode)) + return -EIO; + return fuse_getxattr(inode, name, value, size); } =20 @@ -186,6 +192,9 @@ static int fuse_xattr_set(const struct x const char *name, const void *value, size_t size, int flags) { + if (fuse_is_bad(inode)) + return -EIO; + if (!value) return fuse_removexattr(inode, name); =20 From nobody Tue Jun 30 05:24:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14740C433EF for ; Mon, 24 Jan 2022 20:09:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353938AbiAXUJR (ORCPT ); Mon, 24 Jan 2022 15:09:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57244 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345252AbiAXTvT (ORCPT ); Mon, 24 Jan 2022 14:51:19 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4988C019B3B; Mon, 24 Jan 2022 11:24:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5D857612FA; Mon, 24 Jan 2022 19:24:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4734EC340E5; Mon, 24 Jan 2022 19:24:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643052256; bh=8fEnRPti32v240Rgrcx2wQprpQYqogqlTQ6lb/w3fLk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x0hJoRZC/7xffE2lqPaxB2Y+sJfQpYFUpHVDNJVz8Ce4SuaPD9AwQFHtSIzXbn4rG w/rF15M3quTmiN33r7l0DD/2KjlL2hodeOQFvpAdkpsGNaOwjhpYk68/2b4rFNv21w +ZXTVa2w3RXlLf4sqk9qrRyLOLdRloyYlBo5nCBw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Amir Goldstein , Miklos Szeredi , Ben Hutchings Subject: [PATCH 4.19 239/239] fuse: fix live lock in fuse_iget() Date: Mon, 24 Jan 2022 19:44:37 +0100 Message-Id: <20220124183950.693455840@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183943.102762895@linuxfoundation.org> References: <20220124183943.102762895@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Amir Goldstein commit 775c5033a0d164622d9d10dd0f0a5531639ed3ed upstream. Commit 5d069dbe8aaf ("fuse: fix bad inode") replaced make_bad_inode() in fuse_iget() with a private implementation fuse_make_bad(). The private implementation fails to remove the bad inode from inode cache, so the retry loop with iget5_locked() finds the same bad inode and marks it bad forever. kmsg snip: [ ] rcu: INFO: rcu_sched self-detected stall on CPU ... [ ] ? bit_wait_io+0x50/0x50 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ? find_inode.isra.32+0x60/0xb0 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ilookup5_nowait+0x65/0x90 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ilookup5.part.36+0x2e/0x80 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ? fuse_inode_eq+0x20/0x20 [ ] iget5_locked+0x21/0x80 [ ] ? fuse_inode_eq+0x20/0x20 [ ] fuse_iget+0x96/0x1b0 Fixes: 5d069dbe8aaf ("fuse: fix bad inode") Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/fuse/fuse_i.h | 1 + 1 file changed, 1 insertion(+) --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -704,6 +704,7 @@ static inline u64 get_node_id(struct ino =20 static inline void fuse_make_bad(struct inode *inode) { + remove_inode_hash(inode); set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); } =20