From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 553DEC433F5 for ; Tue, 10 May 2022 13:30:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243496AbiEJNeb (ORCPT ); Tue, 10 May 2022 09:34:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32802 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242909AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 08E6B20D252; Tue, 10 May 2022 06:18:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 986E461532; Tue, 10 May 2022 13:18:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A540DC385C9; Tue, 10 May 2022 13:18:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188681; bh=QAylgGAnWTHI63CrZv++ZasyUi2vG4ZKOEZ/qv6ifDQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kPE89+DAkhAz+QzAQpdM+e0td3hqnlZzHx6Qevn4W7uTelYK5sDUWR8tz7QljN8Jy yOYeOEc/aJQzHZGEF5zTDtEivLZAORHzszPrH/o4II1JO5PbsRB3904c0WJpG67zfA kSqeNQKUOva/xKdXkR1EcaeN0AorW9ujvtY4oplA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fabien Parent , Chunfeng Yun , Macpaul Lin , Tainping Fang Subject: [PATCH 4.19 01/88] usb: mtu3: fix USB 3.0 dual-role-switch from device to host Date: Tue, 10 May 2022 15:06:46 +0200 Message-Id: <20220510130733.781213599@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Macpaul Lin commit 456244aeecd54249096362a173dfe06b82a5cafa upstream. Issue description: When an OTG port has been switched to device role and then switch back to host role again, the USB 3.0 Host (XHCI) will not be able to detect "plug in event of a connected USB 2.0/1.0 ((Highspeed and Fullspeed) devices until system reboot. Root cause and Solution: There is a condition checking flag "ssusb->otg_switch.is_u3_drd" in toggle_opstate(). At the end of role switch procedure, toggle_opstate() will be called to set DC_SESSION and SOFT_CONN bit. If "is_u3_drd" was set and switched the role to USB host 3.0, bit DC_SESSION and SOFT_CONN will be skipped hence caused the port cannot detect connected USB 2.0 (Highspeed and Fullspeed) devices. Simply remove the condition check to solve this issue. Fixes: d0ed062a8b75 ("usb: mtu3: dual-role mode support") Cc: stable@vger.kernel.org Tested-by: Fabien Parent Reviewed-by: Chunfeng Yun Signed-off-by: Macpaul Lin Signed-off-by: Tainping Fang Link: https://lore.kernel.org/r/20220419081245.21015-1-macpaul.lin@mediatek= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/mtu3/mtu3_dr.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) --- a/drivers/usb/mtu3/mtu3_dr.c +++ b/drivers/usb/mtu3/mtu3_dr.c @@ -30,10 +30,8 @@ enum mtu3_vbus_id_state { =20 static void toggle_opstate(struct ssusb_mtk *ssusb) { - if (!ssusb->otg_switch.is_u3_drd) { - mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); - mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); - } + mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); + mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); } =20 /* only port0 supports dual-role mode */ From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3BB3C433FE for ; Tue, 10 May 2022 13:29:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243376AbiEJNda (ORCPT ); Tue, 10 May 2022 09:33:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41388 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242989AbiEJNZU (ORCPT ); Tue, 10 May 2022 09:25:20 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 511A122D609; Tue, 10 May 2022 06:18:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C37BCB81CE7; Tue, 10 May 2022 13:18:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20DDDC385C2; Tue, 10 May 2022 13:18:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188710; bh=nO0HsBH97IIxsOjMZu1jbvvi+Us0BjRufFBiwIiqmSw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rWrf7/dmN4Vvg53n+f+8FH6xYJICaG70AuCPicWTFXFM3FzJUW/siGffduOj6d2KS HF7XDgIOhjXnxdDDVeVRdDx8Pm0K71QaBWLbLZuYfQ+bN8b3u13iZsEHN8e/zZ9ToZ 40FhT+yO4y50ytqeTS1irte+sNoiD/zpYylPqdM4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum Subject: [PATCH 4.19 02/88] USB: quirks: add a Realtek card reader Date: Tue, 10 May 2022 15:06:47 +0200 Message-Id: <20220510130733.808760233@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d upstream. This device is reported to stall when enummerated. Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220414110209.30924-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -404,6 +404,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0b05, 0x17e0), .driver_info =3D USB_QUIRK_IGNORE_REMOTE_WAKEUP }, =20 + /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ + { USB_DEVICE(0x0bda, 0x0151), .driver_info =3D USB_QUIRK_CONFIG_INTF_STRI= NGS }, + /* Realtek hub in Dell WD19 (Type-C) */ { USB_DEVICE(0x0bda, 0x0487), .driver_info =3D USB_QUIRK_NO_LPM }, { USB_DEVICE(0x0bda, 0x5487), .driver_info =3D USB_QUIRK_RESET_RESUME }, From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 051CEC433F5 for ; Tue, 10 May 2022 13:29:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243368AbiEJNdQ (ORCPT ); Tue, 10 May 2022 09:33:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50070 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243026AbiEJNZ1 (ORCPT ); Tue, 10 May 2022 09:25:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55AD022EA4F; Tue, 10 May 2022 06:18:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 41F52B81DA2; Tue, 10 May 2022 13:18:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D112C385A6; Tue, 10 May 2022 13:18:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188713; bh=iw5r7VXYhZZ7jk1+tRISB95kKILUAHqZqpWpvMsK8Bo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cgBy18GBOS6dTW6LXCQeuWOZ9ebQ99ssSfWk0y3JXtDUkC30Nv2dK7O7eTCTVwEn6 4SE+5yjAKOYeeIb+CYqm+T/2CjLo9ppAo+2d/FydBgyZ+GZUIjal2SSkymkgn9xrti nPTz3lRL66npkK4GiaBw3tq0lZ4+yAW/OROa6hK0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum Subject: [PATCH 4.19 03/88] USB: quirks: add STRING quirk for VCOM device Date: Tue, 10 May 2022 15:06:48 +0200 Message-Id: <20220510130733.838144982@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit ec547af8a9ea6441864bad34172676b5652ceb96 upstream. This has been reported to stall if queried Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220414123152.1700-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -511,6 +511,9 @@ static const struct usb_device_id usb_qu /* DJI CineSSD */ { USB_DEVICE(0x2ca3, 0x0031), .driver_info =3D USB_QUIRK_NO_LPM }, =20 + /* VCOM device */ + { USB_DEVICE(0x4296, 0x7570), .driver_info =3D USB_QUIRK_CONFIG_INTF_STRI= NGS }, + /* INTEL VALUE SSD */ { USB_DEVICE(0x8086, 0xf1a5), .driver_info =3D USB_QUIRK_RESET_RESUME }, From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 031B1C433FE for ; Tue, 10 May 2022 13:32:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243269AbiEJNf5 (ORCPT ); Tue, 10 May 2022 09:35:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50084 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243035AbiEJNZ1 (ORCPT ); Tue, 10 May 2022 09:25:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D09B22EA77; Tue, 10 May 2022 06:18:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9F58A61665; Tue, 10 May 2022 13:18:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90118C385C2; Tue, 10 May 2022 13:18:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188717; bh=ICZctLIchoodJ3+Rypdhc4DMeoSUKHvRYT1hN6mKWPc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lKnkS9yX1GJdxJ3HeW2S4RWkttNcy+nrM/P06vUdu17iJuHhI5Z7d+iAAMdI3HPHz 5FkPbAXVFol+l+sOQJraJvTkEApfzCVJDKiPW0esp9fXYhOmZoTThXezjX6JoWd7VX uj/l5oLxdrNkt52ioZif3LyalsyXbbnL3lYaQ3rg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Kees Cook , Johan Hovold Subject: [PATCH 4.19 04/88] USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS Date: Tue, 10 May 2022 15:06:49 +0200 Message-Id: <20220510130733.867169924@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook commit e23e50e7acc8d8f16498e9c129db33e6a00e80eb upstream. The sizeof(struct whitehat_dr_info) can be 4 bytes under CONFIG_AEABI=3Dn due to "-mabi=3Dapcs-gnu", even though it has a single u8: whiteheat_private { __u8 mcr; /* 0 1 */ /* size: 4, cachelines: 1, members: 1 */ /* padding: 3 */ /* last cacheline: 4 bytes */ }; The result is technically harmless, as both the source and the destinations are currently the same allocation size (4 bytes) and don't use their padding, but if anything were to ever be added after the "mcr" member in "struct whiteheat_private", it would be overwritten. The structs both have a single u8 "mcr" member, but are 4 bytes in padded size. The memcpy() destination was explicitly targeting the u8 member (size 1) with the length of the whole structure (size 4), triggering the memcpy buffer overflow warning: In file included from include/linux/string.h:253, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from include/linux/smp.h:13, from include/linux/lockdep.h:14, from include/linux/spinlock.h:62, from include/linux/mmzone.h:8, from include/linux/gfp.h:6, from include/linux/slab.h:15, from drivers/usb/serial/whiteheat.c:17: In function 'fortify_memcpy_chk', inlined from 'firm_send_command' at drivers/usb/serial/whiteheat.c:587:= 4: include/linux/fortify-string.h:328:25: warning: call to '__write_overflow_f= ield' declared with attribute warning: detected write beyond size of field = (1st parameter); maybe use struct_group()? [-Wattribute-warning] 328 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Instead, just assign the one byte directly. Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/202204142318.vDqjjSFn-lkp@intel.com Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220421001234.2421107-1-keescook@chromium.= org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/serial/whiteheat.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/usb/serial/whiteheat.c +++ b/drivers/usb/serial/whiteheat.c @@ -611,9 +611,8 @@ static int firm_send_command(struct usb_ switch (command) { case WHITEHEAT_GET_DTR_RTS: info =3D usb_get_serial_port_data(port); - memcpy(&info->mcr, command_info->result_buffer, - sizeof(struct whiteheat_dr_info)); - break; + info->mcr =3D command_info->result_buffer[0]; + break; } } exit: From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A9BFC433FE for ; Tue, 10 May 2022 13:35:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243657AbiEJNgB (ORCPT ); Tue, 10 May 2022 09:36:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58404 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243066AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0870122B75; Tue, 10 May 2022 06:18:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 65659B81CE7; Tue, 10 May 2022 13:18:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C92D7C385C9; Tue, 10 May 2022 13:18:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188720; bh=MgNU/KErX9XYknk3zj2PDYvQIh2K7GS2hYAzr7pzkmM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Hj4fZ9dM96UfskoHgAHIORalMAxGCNs0v/SnlJBM8eRFX/QSsvcGPkXPfektFTE2R QisDi9On1DQInoTr3Q1pxhgSsrvQmJ4sO42DTpalZabmYGnlljqXASvK8+LVtN0uiL U8fHN9wb9XPsUbC3727qyhL5AV9xnPNqpa57hy4k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bruno Thomsen , Johan Hovold Subject: [PATCH 4.19 05/88] USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader Date: Tue, 10 May 2022 15:06:50 +0200 Message-Id: <20220510130733.896688603@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bruno Thomsen commit 35a923a0b329c343e9e81d79518e2937eba06fcd upstream. Wireless reading of water and heat meters using 868 MHz wM-Bus mode C1. The two different product IDs allow detection of dongle antenna solution: - Internal antenna - External antenna using SMA connector https://www.kamstrup.com/en-en/water-solutions/water-meter-reading/usb-mete= r-reader Signed-off-by: Bruno Thomsen Link: https://lore.kernel.org/r/20220414081202.5591-1-bruno.thomsen@gmail.c= om Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -195,6 +195,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Contro= l, Monitoring and Data Logger */ { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */ { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */ + { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter R= eader (Int Ant) */ + { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter R= eader (Ext Ant) */ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D70E7C3A589 for ; Tue, 10 May 2022 13:38:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244781AbiEJNmI (ORCPT ); Tue, 10 May 2022 09:42:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32802 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243079AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B72A91683FC; Tue, 10 May 2022 06:18:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5E090B81B32; Tue, 10 May 2022 13:18:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8B39EC385A6; Tue, 10 May 2022 13:18:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188723; bh=Ug3fk8Vt8Pk8CQvWev9QH73Z1POTQgfDaPxABlOgu54=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yN8eXI2dEIVa2jYzcxH8nia8mnwmpL+cyuNYbtiTlHTuvuBNOlSxb6AZilCWqdtj5 wEc9GPTDG0n8aMLhJNrVztUXJZPLUlqCrgTjHlIc3nyC0PcoA3Z9PASe59F26An++9 Fae1BvaJ5ceGvhxAGGI7e7VewPAId0piM8upaGDg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slark Xiao , Johan Hovold Subject: [PATCH 4.19 06/88] USB: serial: option: add support for Cinterion MV32-WA/MV32-WB Date: Tue, 10 May 2022 15:06:51 +0200 Message-Id: <20220510130733.926886756@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Slark Xiao commit b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 upstream. Add support for Cinterion device MV32-WA/MV32-WB. MV32-WA PID is 0x00F1, and MV32-WB PID is 0x00F2. Test evidence as below: T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 4 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.20 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f1 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F1 USB Mobile Broadband S: SerialNumber=3D78ada8c4 C: #Ifs=3D 6 Cfg#=3D 1 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 1 Cls=3D02(commc) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim I: If#=3D0x1 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3D(none) I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D60 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 3 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.20 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f2 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F2 USB Mobile Broadband S: SerialNumber=3Dcdd06a78 C: #Ifs=3D 6 Cfg#=3D 1 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 1 Cls=3D02(commc) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim I: If#=3D0x1 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3D(none) I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D60 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption Interface 0&1: MBIM, 2:Modem, 3: GNSS, 4: NMEA, 5: Diag GNSS port don't use serial driver. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220414074434.5699-1-slark_xiao@163.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -432,6 +432,8 @@ static void option_instat_callback(struc #define CINTERION_PRODUCT_CLS8 0x00b0 #define CINTERION_PRODUCT_MV31_MBIM 0x00b3 #define CINTERION_PRODUCT_MV31_RMNET 0x00b7 +#define CINTERION_PRODUCT_MV32_WA 0x00f1 +#define CINTERION_PRODUCT_MV32_WB 0x00f2 =20 /* Olivetti products */ #define OLIVETTI_VENDOR_ID 0x0b3c @@ -1969,6 +1971,10 @@ static const struct usb_device_id option .driver_info =3D RSVD(3)}, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_= RMNET, 0xff), .driver_info =3D RSVD(0)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA, 0xff), + .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB, 0xff), + .driver_info =3D RSVD(3)}, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), .driver_info =3D RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F810C38A2D for ; Tue, 10 May 2022 13:38:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244396AbiEJNly (ORCPT ); Tue, 10 May 2022 09:41:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243081AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 205F023021D; Tue, 10 May 2022 06:18:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B446B61663; Tue, 10 May 2022 13:18:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BFEEAC385C2; Tue, 10 May 2022 13:18:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188726; bh=8lm3thwt99G1i9oKsvxb5K2n7Qp9sOJOBnjoL2NNz4E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CvFfCqqrxwZdJrkhOPxQymfFvRB++rF+6ZyoHgp5Y9dVVpJG4CEs2FOUIUeK3n3Na aJ2jwotfz3egIycPv1TENrBnggCyjI+DgcmMhfC6KZeMtzPT8i6FnVoZd/K9NbiRJt sJ8cZjo/47bIrYutq56hQOsZY+dPeUh4o4HSWAg8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , Johan Hovold Subject: [PATCH 4.19 07/88] USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions Date: Tue, 10 May 2022 15:06:52 +0200 Message-Id: <20220510130733.954582778@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniele Palmas commit f32c5a0423400e01f4d7c607949fa3a1f006e8fa upstream. Add support for the following Telit FN980 and FN990 compositions: 0x1057: tty, adb, rmnet, tty, tty, tty, tty, tty 0x1058: tty, adb, tty, tty, tty, tty, tty 0x1075: adb, tty Signed-off-by: Daniele Palmas Link: https://lore.kernel.org/r/20220406141408.580669-1-dnlplm@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1219,6 +1219,10 @@ static const struct usb_device_id option .driver_info =3D NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD9= 80 */ .driver_info =3D NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1057, 0xff), /* Telit FN9= 80 */ + .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1058, 0xff), /* Telit FN9= 80 (PCIe) */ + .driver_info =3D NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN9= 20 (rmnet) */ .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN9= 20 (MBIM) */ @@ -1235,6 +1239,8 @@ static const struct usb_device_id option .driver_info =3D NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN9= 90 (ECM) */ .driver_info =3D NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN9= 90 (PCIe) */ + .driver_info =3D RSVD(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 020A1C3A59D for ; Tue, 10 May 2022 13:38:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244849AbiEJNmM (ORCPT ); Tue, 10 May 2022 09:42:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243089AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 154812311CF; Tue, 10 May 2022 06:18:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A8810615F8; Tue, 10 May 2022 13:18:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B33B4C385A6; Tue, 10 May 2022 13:18:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188729; bh=syvbfAMOEbim3F1NblPad85qNNOn39u3qZiZAyUDIdY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cbm1qwslSwzwmAKHzPzEqJIdnQiLKZoogYMFMDvXvnSbESWBbtbD0+7myImmzdKjT DPvyHgGflhd6rMJdbcW+wSSvBCeYZl34bO5H5FWicape+Z/o/KJ3vEhAArT5993LIn y/qpfqM7amBvEhIN+Ou3nayofgHx4ENZ6j8pSFTg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Henry Lin , Mathias Nyman Subject: [PATCH 4.19 08/88] xhci: stop polling roothubs after shutdown Date: Tue, 10 May 2022 15:06:53 +0200 Message-Id: <20220510130733.986683627@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Henry Lin commit dc92944a014cd6a6f6c94299aaa36164dd2c238a upstream. While rebooting, XHCI controller and its bus device will be shut down in order by .shutdown callback. Stopping roothubs polling in xhci_shutdown() can prevent XHCI driver from accessing port status after its bus device shutdown. Take PCIe XHCI controller as example, if XHCI driver doesn't stop roothubs polling, XHCI driver may access PCIe BAR register for port status after parent PCIe root port driver is shutdown and cause PCIe bus error. [check shared hcd exist before stopping its roothub polling -Mathias] Cc: stable@vger.kernel.org Signed-off-by: Henry Lin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220408134823.2527272-3-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -778,6 +778,17 @@ void xhci_shutdown(struct usb_hcd *hcd) if (xhci->quirks & XHCI_SPURIOUS_REBOOT) usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev)); =20 + /* Don't poll the roothubs after shutdown. */ + xhci_dbg(xhci, "%s: stopping usb%d port polling.\n", + __func__, hcd->self.busnum); + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + del_timer_sync(&hcd->rh_timer); + + if (xhci->shared_hcd) { + clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); + del_timer_sync(&xhci->shared_hcd->rh_timer); + } + spin_lock_irq(&xhci->lock); xhci_halt(xhci); /* Workaround for spurious wakeups at shutdown with HSW */ From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 58564C43217 for ; Tue, 10 May 2022 13:35:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243853AbiEJNgZ (ORCPT ); Tue, 10 May 2022 09:36:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41370 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243092AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 431BF185C8F; Tue, 10 May 2022 06:18:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D12D961574; Tue, 10 May 2022 13:18:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0DBBC385C2; Tue, 10 May 2022 13:18:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188732; bh=sXILfzq9IW3DCNFKyH1tGuQNRkOLW85EMG6ylDqHGXM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0VNr79mSkRRMylbvytpex57m+NHNLxfm+0l3NuFuKAioEQgGmoqEAQ0XALBElJAQJ MCQkrWmWqgBQ2QXkx3Kqr97jNQwlpNVFX55UT5qj2S4glkMUyYGaL1p7mJ7W28vhN2 6UpSULqyqfbU+hHW3z2xQpCSO2X6b7M0kG0kS53s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zizhuang Deng , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.19 09/88] iio: dac: ad5592r: Fix the missing return value. Date: Tue, 10 May 2022 15:06:54 +0200 Message-Id: <20220510130734.015700859@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zizhuang Deng commit b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 upstream. The third call to `fwnode_property_read_u32` did not record the return value, resulting in `channel_offstate` possibly being assigned the wrong value. Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DA= Cs") Signed-off-by: Zizhuang Deng Link: https://lore.kernel.org/r/20220310125450.4164164-1-sunsetdzz@gmail.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/iio/dac/ad5592r-base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/dac/ad5592r-base.c +++ b/drivers/iio/dac/ad5592r-base.c @@ -531,7 +531,7 @@ static int ad5592r_alloc_channels(struct if (!ret) st->channel_modes[reg] =3D tmp; =20 - fwnode_property_read_u32(child, "adi,off-state", &tmp); + ret =3D fwnode_property_read_u32(child, "adi,off-state", &tmp); if (!ret) st->channel_offstate[reg] =3D tmp; } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E4C3C433EF for ; Tue, 10 May 2022 13:31:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243400AbiEJNfI (ORCPT ); Tue, 10 May 2022 09:35:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242910AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA3784EA3E; Tue, 10 May 2022 06:18:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8372561661; Tue, 10 May 2022 13:18:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 86DC4C385C6; Tue, 10 May 2022 13:18:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188683; bh=LlaNvZNC6zMQ2YYn7Jimy2RhtIUwN/GT9NAOZ5adIg8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OrlYIN9EZU5fud9CsrLxlldCb8RrgthmD4zIvY/8AaSy4BmJERlEY5047BtiQJK3O luXpBNs0/BmNMpVJ2z7vDLAZRloFCLznZkosmGYCEa7W4FX2Gxsa1DgF3mCmJ4L3bz F38nUWfA/0XdonQ3jGhfjQzAjGG5EqZ6rb2WvAko= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Hennerich , =?UTF-8?q?Nuno=20S=C3=A1?= , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.19 10/88] iio: dac: ad5446: Fix read_raw not returning set value Date: Tue, 10 May 2022 15:06:55 +0200 Message-Id: <20220510130734.044592292@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Hennerich commit 89a01cd688d3c0ac983ef0b0e5f40018ab768317 upstream. read_raw should return the un-scaled value. Fixes: 5e06bdfb46e8b ("staging:iio:dac:ad5446: Return cached value for 'raw= ' attribute") Signed-off-by: Michael Hennerich Reviewed-by: Nuno S=C3=A1 Link: https://lore.kernel.org/r/20220406105620.1171340-1-michael.hennerich@= analog.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/iio/dac/ad5446.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/dac/ad5446.c +++ b/drivers/iio/dac/ad5446.c @@ -171,7 +171,7 @@ static int ad5446_read_raw(struct iio_de =20 switch (m) { case IIO_CHAN_INFO_RAW: - *val =3D st->cached_val; + *val =3D st->cached_val >> chan->scan_type.shift; return IIO_VAL_INT; case IIO_CHAN_INFO_SCALE: *val =3D st->vref_mv; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02809C433F5 for ; Tue, 10 May 2022 13:30:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243463AbiEJNeR (ORCPT ); Tue, 10 May 2022 09:34:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60628 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241338AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D515D50B1C; Tue, 10 May 2022 06:18:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 93920B81B32; Tue, 10 May 2022 13:18:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7784C385C2; Tue, 10 May 2022 13:18:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188687; bh=Za0+Kg0GzcGKimpUtf0svjSHqpztZKZgkSCW3XGCFmU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rOfjn0VM8jiJaMMR1+tl6gJiFra+KcCfTfMfPRQGaBFBJIiCAlKAqu4bOar6A/0qk hX8MX2HeOETGeEMa9Quqd88ovNA6GkiNKmI5lcI9EoKtLy5LtECYvV21N7zvgpT+aM JZhM9zh11+vootPBdvlHYWoa5xSd7lawcbicKZlg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.19 11/88] iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() Date: Tue, 10 May 2022 15:06:56 +0200 Message-Id: <20220510130734.077236488@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma commit 3a26787dacf04257a68b16315c984eb2c340bc5e upstream. When the driver fails to enable the regulator 'vid', we will get the following splat: [ 79.955610] WARNING: CPU: 5 PID: 441 at drivers/regulator/core.c:2257 _r= egulator_put+0x3ec/0x4e0 [ 79.959641] RIP: 0010:_regulator_put+0x3ec/0x4e0 [ 79.967570] Call Trace: [ 79.967773] [ 79.967951] regulator_put+0x1f/0x30 [ 79.968254] devres_release_group+0x319/0x3d0 [ 79.968608] i2c_device_probe+0x766/0x940 Fix this by disabling the 'vdd' regulator when failing to enable 'vid' regulator. Signed-off-by: Zheyu Ma Link: https://lore.kernel.org/r/20220409034849.3717231-2-zheyuma97@gmail.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/iio/magnetometer/ak8975.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/iio/magnetometer/ak8975.c +++ b/drivers/iio/magnetometer/ak8975.c @@ -404,6 +404,7 @@ static int ak8975_power_on(const struct if (ret) { dev_warn(&data->client->dev, "Failed to enable specified Vid supply\n"); + regulator_disable(data->vdd); return ret; } /* From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5B39C4332F for ; Tue, 10 May 2022 13:30:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243454AbiEJNeK (ORCPT ); Tue, 10 May 2022 09:34:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242911AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 29D092181D5; Tue, 10 May 2022 06:18:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BBD2A61661; Tue, 10 May 2022 13:18:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD877C385C9; Tue, 10 May 2022 13:18:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188690; bh=9E39mHLbOPtkiWOEOKFy56IbZL3g5wvMyD0A5kF6R7k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=snUBKY2GIk/TPzL3FJdUPAoeNhpP1yUm8/J8NUVRD+e3Ytjx01kBGnmDOnANJq1zz GnIqIhbAOPi6eet/BiZshJ8ReaFwosjlhEGjVkMdmzjAjdqBvulBmBO4sieml5ZN1X HwaS8TFpK9nCNWVOHHRLzVPkuNyYEGGaC1++dKmI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Dongliang Mu , Hangyu Hua Subject: [PATCH 4.19 12/88] usb: misc: fix improper handling of refcount in uss720_probe() Date: Tue, 10 May 2022 15:06:57 +0200 Message-Id: <20220510130734.105636714@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit 0a96fa640dc928da9eaa46a22c46521b037b78ad upstream. usb_put_dev shouldn't be called when uss720_probe succeeds because of priv->usbdev. At the same time, priv->usbdev shouldn't be set to NULL before destroy_priv in uss720_disconnect because usb_put_dev is in destroy_priv. Fix this by moving priv->usbdev =3D NULL after usb_put_dev. Fixes: dcb4b8ad6a44 ("misc/uss720: fix memory leak in uss720_probe") Cc: stable Reviewed-by: Dongliang Mu Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220407024001.11761-1-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/misc/uss720.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/usb/misc/uss720.c +++ b/drivers/usb/misc/uss720.c @@ -71,6 +71,7 @@ static void destroy_priv(struct kref *kr =20 dev_dbg(&priv->usbdev->dev, "destroying priv datastructure\n"); usb_put_dev(priv->usbdev); + priv->usbdev =3D NULL; kfree(priv); } =20 @@ -736,7 +737,6 @@ static int uss720_probe(struct usb_inter parport_announce_port(pp); =20 usb_set_intfdata(intf, pp); - usb_put_dev(usbdev); return 0; =20 probe_abort: @@ -754,7 +754,6 @@ static void uss720_disconnect(struct usb usb_set_intfdata(intf, NULL); if (pp) { priv =3D pp->private_data; - priv->usbdev =3D NULL; priv->pp =3D NULL; dev_dbg(&intf->dev, "parport_remove_port\n"); parport_remove_port(pp); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C029C433F5 for ; Tue, 10 May 2022 13:30:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242045AbiEJNel (ORCPT ); Tue, 10 May 2022 09:34:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41360 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242912AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F41E321A94A; Tue, 10 May 2022 06:18:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8D63161665; Tue, 10 May 2022 13:18:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C550C385A6; Tue, 10 May 2022 13:18:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188693; bh=zL7m3jJKBlSnNR74+VWXMFcYh75Cfk2X59tlw/vprHk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eFVErV6zjDNHdQuYxTFVcJmRNtNvAChQ2CBKiiZUX82v9O5YkXEeWbdg3/TZTO7Ll OYgEoz3nUztgjYCI8bqHe4mNOzywWh9hbHWm3DM9fskYIQzxC+7436lUsBshlzkdED 5+tj7gUDdc4ehjleQ4fegvf22mtr6IUqJuOJd4TI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Vacura Subject: [PATCH 4.19 13/88] usb: gadget: uvc: Fix crash when encoding data for usb request Date: Tue, 10 May 2022 15:06:58 +0200 Message-Id: <20220510130734.133672673@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Vacura commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream. During the uvcg_video_pump() process, if an error occurs and uvcg_queue_cancel() is called, the buffer queue will be cleared out, but the current marker (queue->buf_used) of the active buffer (no longer active) is not reset. On the next iteration of uvcg_video_pump() the stale buf_used count will be used and the logic of min((unsigned int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a nbytes size, causing an invalid memory access. [80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. [80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. ... uvcg_queue_cancel() is called and the queue is cleared out, but the marker queue->buf_used is not reset. ... [80802.262328][ T8682] Unable to handle kernel paging request at virtual address ffffffc03af9f000 ... ... [80802.263138][ T8682] Call trace: [80802.263146][ T8682] __memcpy+0x12c/0x180 [80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0 [80802.263165][ T8682] process_one_work+0x2cc/0x568 [80802.263173][ T8682] worker_thread+0x28c/0x518 [80802.263181][ T8682] kthread+0x160/0x170 [80802.263188][ T8682] ret_from_fork+0x10/0x18 [80802.263198][ T8682] Code: a8c12829 a88130cb a8c130 Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videob= uf2 framework") Cc: Signed-off-by: Dan Vacura Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/gadget/function/uvc_queue.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/gadget/function/uvc_queue.c +++ b/drivers/usb/gadget/function/uvc_queue.c @@ -242,6 +242,8 @@ void uvcg_queue_cancel(struct uvc_video_ buf->state =3D UVC_BUF_STATE_ERROR; vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); } + queue->buf_used =3D 0; + /* This must be protected by the irqlock spinlock to avoid race * conditions between uvc_queue_buffer and the disconnection event that * could result in an interruptible wait in uvc_dequeue_buffer. Do not From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B6E9C4332F for ; Tue, 10 May 2022 13:30:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235527AbiEJNeF (ORCPT ); Tue, 10 May 2022 09:34:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41362 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242913AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BE11A22406F; Tue, 10 May 2022 06:18:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5924A615F8; Tue, 10 May 2022 13:18:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A8B0C385C6; Tue, 10 May 2022 13:18:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188695; bh=eFPjMgElhDEszECLNXLR9KghKw55KcyONnperHZm5LM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tOTPSSSSWzbXJZ34Fir2MuSqxLVbr2JKD9FcKGZhPk6y0Freh7TsXQ8avZ3hVq2G3 67MHC4IRzGtZ5PhEhvRwzNIcC/6gjtiyXepgIxnMUzl7lEpHafDM2DdoNoXrbxUQaT Zhrk8beZvXdofhZD0qKO7P3t4cPiM7a86AIiOzN8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vijayavardhan Vennapusa , Dan Vacura , stable Subject: [PATCH 4.19 14/88] usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() Date: Tue, 10 May 2022 15:06:59 +0200 Message-Id: <20220510130734.162062350@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vijayavardhan Vennapusa commit bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 upstream. If any function like UVC is deactivating gadget as part of composition switch which results in not calling pullup enablement, it is not getting enabled after switch to new composition due to this deactivation flag not cleared. This results in USB enumeration not happening after switch to new USB composition. Hence clear deactivation flag inside gadget structure in configfs_composite_unbind() before switch to new USB composition. Signed-off-by: Vijayavardhan Vennapusa Signed-off-by: Dan Vacura Cc: stable Link: https://lore.kernel.org/r/20220413211038.72797-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/gadget/configfs.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -1412,6 +1412,8 @@ static void configfs_composite_unbind(st usb_ep_autoconfig_reset(cdev->gadget); spin_lock_irqsave(&gi->spinlock, flags); cdev->gadget =3D NULL; + cdev->deactivations =3D 0; + gadget->deactivated =3D false; set_gadget_data(gadget, NULL); spin_unlock_irqrestore(&gi->spinlock, flags); } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1A9FC43217 for ; Tue, 10 May 2022 13:29:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243416AbiEJNdo (ORCPT ); Tue, 10 May 2022 09:33:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60668 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242918AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2A3B53A48; Tue, 10 May 2022 06:18:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5D96761668; Tue, 10 May 2022 13:18:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68CAEC385A6; Tue, 10 May 2022 13:18:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188698; bh=+grnLIzZYxR/nMl7yAVFrelR1Lzn8s2vGyxaI23KT5E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SN+gw1V2vWdtwEsC9h25w0gqkfq9eQyoKiPY3swXwLkzxjQUKMMUMStmxvRRPnEH7 yMAFDU/jKrRh+wR6J7ogvQsP/MjN/X9IZ/6VHiicfJxo0lY8F5CpXz9Evx4w6G9PPu aUk7p1Wi9WDeb5UhlZsijdH3aDelf/bJ+PC/Ij3c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thinh Nguyen Subject: [PATCH 4.19 15/88] usb: dwc3: core: Fix tx/rx threshold settings Date: Tue, 10 May 2022 15:07:00 +0200 Message-Id: <20220510130734.190151470@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thinh Nguyen commit f28ad9069363dec7deb88032b70612755eed9ee6 upstream. The current driver logic checks against 0 to determine whether the periodic tx/rx threshold settings are set, but we may get bogus values from uninitialized variables if no device property is set. Properly default these variables to 0. Fixes: 938a5ad1d305 ("usb: dwc3: Check for ESS TX/RX threshold config") Cc: Signed-off-by: Thinh Nguyen Link: https://lore.kernel.org/r/cccfce990b11b730b0dae42f9d217dc6fb988c90.16= 49727139.git.Thinh.Nguyen@synopsys.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/dwc3/core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -1213,10 +1213,10 @@ static void dwc3_get_properties(struct d u8 lpm_nyet_threshold; u8 tx_de_emphasis; u8 hird_threshold; - u8 rx_thr_num_pkt_prd; - u8 rx_max_burst_prd; - u8 tx_thr_num_pkt_prd; - u8 tx_max_burst_prd; + u8 rx_thr_num_pkt_prd =3D 0; + u8 rx_max_burst_prd =3D 0; + u8 tx_thr_num_pkt_prd =3D 0; + u8 tx_max_burst_prd =3D 0; =20 /* default to highest possible threshold */ lpm_nyet_threshold =3D 0xf; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 790BEC433EF for ; Tue, 10 May 2022 13:31:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241616AbiEJNfS (ORCPT ); Tue, 10 May 2022 09:35:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242922AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7458E5EBF6; Tue, 10 May 2022 06:18:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2F6EBB81CE7; Tue, 10 May 2022 13:18:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 78BF8C385C2; Tue, 10 May 2022 13:18:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188701; bh=5DaDxR42mwGSr1uVDRE0OYynjZnYKWwQ0Cz0LyU4kj8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ajEPrs5R6QczeNACTMc+XWS+AyXsU1gWmlDZJ+v9Jplwk9f20IpUN4XZkgKWpn+Sw LbDU+8K/Apt8GXm4hxvOiNLu//iNYXZeOHHnjo6iMmavF791pQlWsu6XJuhEo8W7fQ Z/26byzUYdDD3HgCDKXf8TYGvhpVFIoShQLvUOJo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thinh Nguyen Subject: [PATCH 4.19 16/88] usb: dwc3: gadget: Return proper request status Date: Tue, 10 May 2022 15:07:01 +0200 Message-Id: <20220510130734.217598344@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thinh Nguyen commit c7428dbddcf4ea1919e1c8e15f715b94ca359268 upstream. If the user sets the usb_request's no_interrupt, then there will be no completion event for the request. Currently the driver incorrectly uses the event status of a different request to report the status for a request with no_interrupt. The dwc3 driver needs to check the TRB status associated with the request when reporting its status. Note: this is only applicable to missed_isoc TRB completion status, but the other status are also listed for completeness/documentation. Fixes: 6d8a019614f3 ("usb: dwc3: gadget: check for Missed Isoc from event s= tatus") Cc: Signed-off-by: Thinh Nguyen Link: https://lore.kernel.org/r/db2c80108286cfd108adb05bad52138b78d7c3a7.16= 50673655.git.Thinh.Nguyen@synopsys.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/dwc3/gadget.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2415,6 +2415,7 @@ static int dwc3_gadget_ep_cleanup_comple const struct dwc3_event_depevt *event, struct dwc3_request *req, int status) { + int request_status; int ret; =20 if (req->request.num_mapped_sgs) @@ -2444,7 +2445,35 @@ static int dwc3_gadget_ep_cleanup_comple req->needs_extra_trb =3D false; } =20 - dwc3_gadget_giveback(dep, req, status); + /* + * The event status only reflects the status of the TRB with IOC set. + * For the requests that don't set interrupt on completion, the driver + * needs to check and return the status of the completed TRBs associated + * with the request. Use the status of the last TRB of the request. + */ + if (req->request.no_interrupt) { + struct dwc3_trb *trb; + + trb =3D dwc3_ep_prev_trb(dep, dep->trb_dequeue); + switch (DWC3_TRB_SIZE_TRBSTS(trb->size)) { + case DWC3_TRBSTS_MISSED_ISOC: + /* Isoc endpoint only */ + request_status =3D -EXDEV; + break; + case DWC3_TRB_STS_XFER_IN_PROG: + /* Applicable when End Transfer with ForceRM=3D0 */ + case DWC3_TRBSTS_SETUP_PENDING: + /* Control endpoint only */ + case DWC3_TRBSTS_OK: + default: + request_status =3D 0; + break; + } + } else { + request_status =3D status; + } + + dwc3_gadget_giveback(dep, req, request_status); =20 out: return ret; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D004AC433EF for ; Tue, 10 May 2022 13:29:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243423AbiEJNdu (ORCPT ); Tue, 10 May 2022 09:33:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60154 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242944AbiEJNZT (ORCPT ); Tue, 10 May 2022 09:25:19 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D865F229069; Tue, 10 May 2022 06:18:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 48310CE1E73; Tue, 10 May 2022 13:18:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53E60C385A6; Tue, 10 May 2022 13:18:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188704; bh=KuEDchK1xt4RAfy8GkCUQ79VgEtPAkixDOkJZp07Tyg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tBIfxceSxuOzdvp+qrKyCxIq7fUJOSgW/qcB3f4fmI6bT9+FSCKWzkZwgmWRr8PMv OAyPRTv4+QH1q32TIJ00CsmAZUBpcLdjz1sT9cGRIDRtlMxXGgSWvUp7pu0301RTZe nI+S2xCI0LuAKcybNBqekOKyURy62jy+i6yxILyY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= , Johan Hovold Subject: [PATCH 4.19 17/88] serial: imx: fix overrun interrupts in DMA mode Date: Tue, 10 May 2022 15:07:02 +0200 Message-Id: <20220510130734.246749915@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Johan Hovold commit 3ee82c6e41f3d2212647ce0bc5a05a0f69097824 upstream. Commit 76821e222c18 ("serial: imx: ensure that RX irqs are off if RX is off") accidentally enabled overrun interrupts unconditionally when deferring DMA enable until after the receiver has been enabled during startup. Fix this by using the DMA-initialised instead of DMA-enabled flag to determine whether overrun interrupts should be enabled. Note that overrun interrupts are already accounted for in imx_uart_clear_rx_errors() when using DMA since commit 41d98b5da92f ("serial: imx-serial - update RX error counters when DMA is used"). Fixes: 76821e222c18 ("serial: imx: ensure that RX irqs are off if RX is off= ") Cc: stable@vger.kernel.org # 4.17 Cc: Uwe Kleine-K=C3=B6nig Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220411081957.7846-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/serial/imx.c +++ b/drivers/tty/serial/imx.c @@ -1369,7 +1369,7 @@ static int imx_uart_startup(struct uart_ imx_uart_writel(sport, ucr1, UCR1); =20 ucr4 =3D imx_uart_readl(sport, UCR4) & ~UCR4_OREN; - if (!sport->dma_is_enabled) + if (!dma_is_inited) ucr4 |=3D UCR4_OREN; imx_uart_writel(sport, ucr4, UCR4); =20 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A74CCC433EF for ; Tue, 10 May 2022 13:29:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242821AbiEJNdg (ORCPT ); Tue, 10 May 2022 09:33:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41372 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242976AbiEJNZT (ORCPT ); Tue, 10 May 2022 09:25:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E1A6C229FE4; Tue, 10 May 2022 06:18:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2966C61707; Tue, 10 May 2022 13:18:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 287F8C385C6; Tue, 10 May 2022 13:18:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188707; bh=splPW+3YbvYkpcz/Ca/ySeLcEBXwqBz273Zt3NCyp9o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ywogkjinJCNj7GgfueQOsV1UWDDLv7M8kOWeV66Npusm7shtMUqld8CsggwwnN6Gc GRqjLOaLlLGA+4snt4wir9GlVwYCAtXiYpPQryM3+nEdPqr3a725bu93s1KQiykD3j SKrhIovTB5eqv4RlnMci8aW2602hVRMWoDxUKj0o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , Andy Shevchenko Subject: [PATCH 4.19 18/88] serial: 8250: Also set sticky MCR bits in console restoration Date: Tue, 10 May 2022 15:07:03 +0200 Message-Id: <20220510130734.276790150@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej W. Rozycki commit 6e6eebdf5e2455f089ccd000754a0deaeb79af82 upstream. Sticky MCR bits are lost in console restoration if console suspending has been disabled. This currently affects the AFE bit, which works in combination with RTS which we set, so we want to make sure the UART retains control of its FIFO where previously requested. Also specific drivers may need other bits in the future. Signed-off-by: Maciej W. Rozycki Fixes: 4516d50aabed ("serial: 8250: Use canary to restart console after sus= pend") Cc: stable@vger.kernel.org # v4.0+ Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181518490.9383@angie.or= cam.me.uk Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/8250/8250_port.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/serial/8250/8250_port.c +++ b/drivers/tty/serial/8250/8250_port.c @@ -3273,7 +3273,7 @@ static void serial8250_console_restore(s =20 serial8250_set_divisor(port, baud, quot, frac); serial_port_out(port, UART_LCR, up->lcr); - serial8250_out_MCR(up, UART_MCR_DTR | UART_MCR_RTS); + serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS); } =20 /* From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCED3C38A04 for ; Tue, 10 May 2022 13:40:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244012AbiEJNnJ (ORCPT ); Tue, 10 May 2022 09:43:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243266AbiEJN3I (ORCPT ); Tue, 10 May 2022 09:29:08 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7508F3DDDE; Tue, 10 May 2022 06:21:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 99913CE1E73; Tue, 10 May 2022 13:21:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A1AAEC385A6; Tue, 10 May 2022 13:20:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188859; bh=ljAp3L6ejEaut1G2rpqxIWAvHX0+PXzJjFMUlc6tosM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UwXLN54YyTLnu9H/7L5EAO09cfGNCBzKh0Xtr7jW3ngDv/gEqVhs5rVIsW7hHM4IE eaoYdEq/sgLkKpHLal+lhXJmBSbIUfnzYlr37HVbVhsmqwrGX+tXNupK34Tu0L5L05 rjEnjEjTj2hbQAt0En1kChnFBTLLmNU1/soKfwjo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , stable , Andy Shevchenko Subject: [PATCH 4.19 19/88] serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device Date: Tue, 10 May 2022 15:07:04 +0200 Message-Id: <20220510130734.306546556@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej W. Rozycki commit 637674fa40059cddcc3ad2212728965072f62ea3 upstream. The EndRun PTP/1588 dual serial port device is based on the Oxford Semiconductor OXPCIe952 UART device with the PCI vendor:device ID set for EndRun Technologies and is therefore driven by a fixed 62.5MHz clock input derived from the 100MHz PCI Express clock. The clock rate is divided by the oversampling rate of 16 as it is supplied to the baud rate generator, yielding the baud base of 3906250. Replace the incorrect baud base of 4000000 with the right value of 3906250 then, complementing commit 6cbe45d8ac93 ("serial: 8250: Correct the clock for OxSemi PCIe devices"). Signed-off-by: Maciej W. Rozycki Cc: stable Fixes: 1bc8cde46a159 ("8250_pci: Added driver for Endrun Technologies PTP P= CIe card.") Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181515270.9383@angie.or= cam.me.uk Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/8250/8250_pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/tty/serial/8250/8250_pci.c +++ b/drivers/tty/serial/8250/8250_pci.c @@ -2656,7 +2656,7 @@ enum pci_board_num_t { pbn_panacom2, pbn_panacom4, pbn_plx_romulus, - pbn_endrun_2_4000000, + pbn_endrun_2_3906250, pbn_oxsemi, pbn_oxsemi_1_4000000, pbn_oxsemi_2_4000000, @@ -3172,10 +3172,10 @@ static struct pciserial_board pci_boards * signal now many ports are available * 2 port 952 Uart support */ - [pbn_endrun_2_4000000] =3D { + [pbn_endrun_2_3906250] =3D { .flags =3D FL_BASE0, .num_ports =3D 2, - .base_baud =3D 4000000, + .base_baud =3D 3906250, .uart_offset =3D 0x200, .first_offset =3D 0x1000, }, @@ -4028,7 +4028,7 @@ static const struct pci_device_id serial */ { PCI_VENDOR_ID_ENDRUN, PCI_DEVICE_ID_ENDRUN_1588, PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_endrun_2_4000000 }, + pbn_endrun_2_3906250 }, /* * Quatech cards. These actually have configurable clocks but for * now we just use the default. From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8A04C47080 for ; Tue, 10 May 2022 13:38:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244522AbiEJNl6 (ORCPT ); Tue, 10 May 2022 09:41:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43858 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243102AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2C39185CB2; Tue, 10 May 2022 06:19:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8700EB81D0D; Tue, 10 May 2022 13:18:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D8104C385A6; Tue, 10 May 2022 13:18:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188738; bh=NjnK29MjuULgTy0QyQxqWlcYlZfkz0pDzUHCyUBjQAs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AB6Y9zkrgR47D+oiNCAQltIkCuXYWJ2N5b25zVh+GAiHJ9vKoObiPjYpKPGlwYvZ5 zPFzM2Qc9oMTQabZkSVVKOuDhiZRHPAhv5q8S6LNudqsY8iYY077nPxoKQEK019h0y 4WaEK7XD72VtQhzxzPiVLhMWDRCWQTInVD1PfMbs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Linus Torvalds Subject: [PATCH 4.19 20/88] hex2bin: make the function hex_to_bin constant-time Date: Tue, 10 May 2022 15:07:05 +0200 Message-Id: <20220510130734.334896733@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit e5be15767e7e284351853cbaba80cde8620341fb upstream. The function hex2bin is used to load cryptographic keys into device mapper targets dm-crypt and dm-integrity. It should take constant time independent on the processed data, so that concurrently running unprivileged code can't infer any information about the keys via microarchitectural convert channels. This patch changes the function hex_to_bin so that it contains no branches and no memory accesses. Note that this shouldn't cause performance degradation because the size of the new function is the same as the size of the old function (on x86-64) - and the new function causes no branch misprediction penalties. I compile-tested this function with gcc on aarch64 alpha arm hppa hppa64 i386 ia64 m68k mips32 mips64 powerpc powerpc64 riscv sh4 s390x sparc32 sparc64 x86_64 and with clang on aarch64 arm hexagon i386 mips32 mips64 powerpc powerpc64 s390x sparc32 sparc64 x86_64 to verify that there are no branches in the generated code. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/linux/kernel.h | 2 +- lib/hexdump.c | 32 +++++++++++++++++++++++++------- 2 files changed, 26 insertions(+), 8 deletions(-) --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -631,7 +631,7 @@ static inline char *hex_byte_pack_upper( return buf; } =20 -extern int hex_to_bin(char ch); +extern int hex_to_bin(unsigned char ch); extern int __must_check hex2bin(u8 *dst, const char *src, size_t count); extern char *bin2hex(char *dst, const void *src, size_t count); =20 --- a/lib/hexdump.c +++ b/lib/hexdump.c @@ -25,15 +25,33 @@ EXPORT_SYMBOL(hex_asc_upper); * * hex_to_bin() converts one hex digit to its actual value or -1 in case o= f bad * input. + * + * This function is used to load cryptographic keys, so it is coded in suc= h a + * way that there are no conditions or memory accesses that depend on data. + * + * Explanation of the logic: + * (ch - '9' - 1) is negative if ch <=3D '9' + * ('0' - 1 - ch) is negative if ch >=3D '0' + * we "and" these two values, so the result is negative if ch is in the ra= nge + * '0' ... '9' + * we are only interested in the sign, so we do a shift ">> 8"; note that = right + * shift of a negative value is implementation-defined, so we cast the + * value to (unsigned) before the shift --- we have 0xffffff if ch is in + * the range '0' ... '9', 0 otherwise + * we "and" this value with (ch - '0' + 1) --- we have a value 1 ... 10 if= ch is + * in the range '0' ... '9', 0 otherwise + * we add this value to -1 --- we have a value 0 ... 9 if ch is in the ran= ge '0' + * ... '9', -1 otherwise + * the next line is similar to the previous one, but we need to decode both + * uppercase and lowercase letters, so we use (ch & 0xdf), which converts + * lowercase to uppercase */ -int hex_to_bin(char ch) +int hex_to_bin(unsigned char ch) { - if ((ch >=3D '0') && (ch <=3D '9')) - return ch - '0'; - ch =3D tolower(ch); - if ((ch >=3D 'a') && (ch <=3D 'f')) - return ch - 'a' + 10; - return -1; + unsigned char cu =3D ch & 0xdf; + return -1 + + ((ch - '0' + 1) & (unsigned)((ch - '9' - 1) & ('0' - 1 - ch)) >> 8) + + ((cu - 'A' + 11) & (unsigned)((cu - 'F' - 1) & ('A' - 1 - cu)) >> 8); } EXPORT_SYMBOL(hex_to_bin); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D51DC4167E for ; Tue, 10 May 2022 13:35:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244151AbiEJNg4 (ORCPT ); Tue, 10 May 2022 09:36:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41372 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243355AbiEJN0q (ORCPT ); Tue, 10 May 2022 09:26:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74861235C19; Tue, 10 May 2022 06:19:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 923B9B81DA2; Tue, 10 May 2022 13:19:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3BD5C385A6; Tue, 10 May 2022 13:19:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188769; bh=YI5UjmM43NAUlBOvm8tcF0gqikdn9+lJvBigtD/JjAc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p8636/7F35T4k/cUxVIhY6ZYPBNUU5m4eL+BN9wsNldikQndNyHbY9xRZKZWTCaKK 1U10iGMbeAAdJap3gd880r/YwhMGqSAq2BPFsx/6atc946nOIws9DySH0Nm1b5BQ2q Z9JJzSdph5BxjnbmGcl12vv26ONfjimmt7nKpMJE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Andy Shevchenko , Linus Torvalds Subject: [PATCH 4.19 21/88] hex2bin: fix access beyond string end Date: Tue, 10 May 2022 15:07:06 +0200 Message-Id: <20220510130734.364009494@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit e4d8a29997731b3bb14059024b24df9f784288d0 upstream. If we pass too short string to "hex2bin" (and the string size without the terminating NUL character is even), "hex2bin" reads one byte after the terminating NUL character. This patch fixes it. Note that hex_to_bin returns -1 on error and hex2bin return -EINVAL on error - so we can't just return the variable "hi" or "lo" on error. This inconsistency may be fixed in the next merge window, but for the purpose of fixing this bug, we just preserve the existing behavior and return -1 and -EINVAL. Signed-off-by: Mikulas Patocka Reviewed-by: Andy Shevchenko Fixes: b78049831ffe ("lib: add error checking to hex2bin") Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- lib/hexdump.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/lib/hexdump.c +++ b/lib/hexdump.c @@ -66,10 +66,13 @@ EXPORT_SYMBOL(hex_to_bin); int hex2bin(u8 *dst, const char *src, size_t count) { while (count--) { - int hi =3D hex_to_bin(*src++); - int lo =3D hex_to_bin(*src++); + int hi, lo; =20 - if ((hi < 0) || (lo < 0)) + hi =3D hex_to_bin(*src++); + if (unlikely(hi < 0)) + return -EINVAL; + lo =3D hex_to_bin(*src++); + if (unlikely(lo < 0)) return -EINVAL; =20 *dst++ =3D (hi << 4) | lo; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4BFBFC4707F for ; Tue, 10 May 2022 13:38:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244150AbiEJNle (ORCPT ); Tue, 10 May 2022 09:41:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243561AbiEJN1A (ORCPT ); Tue, 10 May 2022 09:27:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF85F23886F; Tue, 10 May 2022 06:20:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 55381616D0; Tue, 10 May 2022 13:20:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 622B9C385CD; Tue, 10 May 2022 13:19:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188799; bh=zWF1IvJ/JqDFFxzMfKbdnAuJ8RlHsywurthgCDlnSU4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L6BAKxqUURjclWGw+kk4K+/5pcaMlrfSWjzQd6AzVk3K9/yIEAxik5HrJVYetXmF4 ki8YuVHraIGJ8B7DMH5r8q0gNTE1h9PKidgUEISJaY0f8nor4HklOLzetw9bqrUb1y BIm7VVCXx89azVw/4HXa1AUdAzDUbB/NMvS7Tmz0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chuanhong Guo , Miquel Raynal , Sasha Levin Subject: [PATCH 4.19 22/88] mtd: rawnand: fix ecc parameters for mt7622 Date: Tue, 10 May 2022 15:07:07 +0200 Message-Id: <20220510130734.392563510@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chuanhong Guo [ Upstream commit 9fe4e0d3cbfe90152137963cc024ecb63db6e8e6 ] According to the datasheet, mt7622 only has 5 ECC capabilities instead of 7, and the decoding error register is arranged as follows: +------+---------+---------+---------+---------+ | Bits | 19:15 | 14:10 | 9:5 | 4:0 | +------+---------+---------+---------+---------+ | Name | ERRNUM3 | ERRNUM2 | ERRNUM1 | ERRNUM0 | +------+---------+---------+---------+---------+ This means err_mask should be 0x1f instead of 0x3f and the number of bits shifted in mtk_ecc_get_stats should be 5 instead of 8. This commit introduces err_shift for the difference in this register and fix other existing parameters. Public MT7622 reference manual can be found on [0] and the info this commit is based on is from page 656 and page 660. [0]: https://wiki.banana-pi.org/Banana_Pi_BPI-R64#Documents Fixes: 98dea8d71931 ("mtd: nand: mtk: Support MT7622 NAND flash controller.= ") Signed-off-by: Chuanhong Guo Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220402160315.919094-1-gch981213@g= mail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/mtd/nand/raw/mtk_ecc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/mtd/nand/raw/mtk_ecc.c b/drivers/mtd/nand/raw/mtk_ecc.c index 6432bd70c3b3..9e4a78a80802 100644 --- a/drivers/mtd/nand/raw/mtk_ecc.c +++ b/drivers/mtd/nand/raw/mtk_ecc.c @@ -51,6 +51,7 @@ =20 struct mtk_ecc_caps { u32 err_mask; + u32 err_shift; const u8 *ecc_strength; const u32 *ecc_regs; u8 num_ecc_strength; @@ -84,7 +85,7 @@ static const u8 ecc_strength_mt2712[] =3D { }; =20 static const u8 ecc_strength_mt7622[] =3D { - 4, 6, 8, 10, 12, 14, 16 + 4, 6, 8, 10, 12 }; =20 enum mtk_ecc_regs { @@ -229,7 +230,7 @@ void mtk_ecc_get_stats(struct mtk_ecc *ecc, struct mtk_= ecc_stats *stats, for (i =3D 0; i < sectors; i++) { offset =3D (i >> 2) << 2; err =3D readl(ecc->regs + ECC_DECENUM0 + offset); - err =3D err >> ((i % 4) * 8); + err =3D err >> ((i % 4) * ecc->caps->err_shift); err &=3D ecc->caps->err_mask; if (err =3D=3D ecc->caps->err_mask) { /* uncorrectable errors */ @@ -453,6 +454,7 @@ EXPORT_SYMBOL(mtk_ecc_get_parity_bits); =20 static const struct mtk_ecc_caps mtk_ecc_caps_mt2701 =3D { .err_mask =3D 0x3f, + .err_shift =3D 8, .ecc_strength =3D ecc_strength_mt2701, .ecc_regs =3D mt2701_ecc_regs, .num_ecc_strength =3D 20, @@ -463,6 +465,7 @@ static const struct mtk_ecc_caps mtk_ecc_caps_mt2701 = =3D { =20 static const struct mtk_ecc_caps mtk_ecc_caps_mt2712 =3D { .err_mask =3D 0x7f, + .err_shift =3D 8, .ecc_strength =3D ecc_strength_mt2712, .ecc_regs =3D mt2712_ecc_regs, .num_ecc_strength =3D 23, @@ -472,10 +475,11 @@ static const struct mtk_ecc_caps mtk_ecc_caps_mt2712 = =3D { }; =20 static const struct mtk_ecc_caps mtk_ecc_caps_mt7622 =3D { - .err_mask =3D 0x3f, + .err_mask =3D 0x1f, + .err_shift =3D 5, .ecc_strength =3D ecc_strength_mt7622, .ecc_regs =3D mt7622_ecc_regs, - .num_ecc_strength =3D 7, + .num_ecc_strength =3D 5, .ecc_mode_shift =3D 4, .parity_bits =3D 13, .pg_irq_sel =3D 0, --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B2F7C433FE for ; Tue, 10 May 2022 13:38:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243746AbiEJNlE (ORCPT ); Tue, 10 May 2022 09:41:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50072 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243792AbiEJN11 (ORCPT ); Tue, 10 May 2022 09:27:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D3F592BFBD2; Tue, 10 May 2022 06:20:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 69891616D0; Tue, 10 May 2022 13:20:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 692BAC385C2; Tue, 10 May 2022 13:20:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188830; bh=shvRf/SMuN2C4qkWzfKRtwCcm8FwCj/TkpyfwJJHOXE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K7/1MzhBWasnG0x0neMk/JjVomEb3rB51EEpTGNxDIRUKn3mLQg0x2ubdBUrJd8lg 1HTtC3yJ+wvEEbyXDjxO0JXoeEYnfTmMUwnjx//p0QAHtvYmOSXzrdtLgPAmEZOYip 0AVGvhK7au0C9OuLWSUuImVvSvX+Ai7G3OTFeSdc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peter Chen , Weitao Wang , Mathias Nyman , Sasha Levin Subject: [PATCH 4.19 23/88] USB: Fix xhci event ring dequeue pointer ERDP update issue Date: Tue, 10 May 2022 15:07:08 +0200 Message-Id: <20220510130734.420598020@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Weitao Wang [ Upstream commit e91ac20889d1a26d077cc511365cd7ff4346a6f3 ] In some situations software handles TRB events slower than adding TRBs. If the number of TRB events to be processed in a given interrupt is exactly the same as the event ring size 256, then the local variable "event_ring_deq" that holds the initial dequeue position is equal to software_dequeue after handling all 256 interrupts. It will cause driver to not update ERDP to hardware, Software dequeue pointer is out of sync with ERDP on interrupt exit. On the next interrupt, the event ring may full but driver will not update ERDP as software_dequeue is equal to ERDP. [ 536.377115] xhci_hcd 0000:00:12.0: ERROR unknown event type 37 [ 566.933173] sd 8:0:0:0: [sdb] tag#27 uas_eh_abort_handler 0 uas-tag 7 in= flight: CMD OUT [ 566.933181] sd 8:0:0:0: [sdb] tag#27 CDB: Write(10) 2a 00 17 71 e6 78 00= 00 08 00 [ 572.041186] xhci_hcd On some situataions,the0000:00:12.0: xHCI host not = responding to stop endpoint command. [ 572.057193] xhci_hcd 0000:00:12.0: Host halt failed, -110 [ 572.057196] xhci_hcd 0000:00:12.0: xHCI host controller not responding, = assume dead [ 572.057236] sd 8:0:0:0: [sdb] tag#26 uas_eh_abort_handler 0 uas-tag 6 in= flight: CMD [ 572.057240] sd 8:0:0:0: [sdb] tag#26 CDB: Write(10) 2a 00 38 eb cc d8 00= 00 08 00 [ 572.057244] sd 8:0:0:0: [sdb] tag#25 uas_eh_abort_handler 0 uas-tag 5 in= flight: CMD Hardware ERDP is updated mid event handling if there are more than 128 events in an interrupt (half of ring size). Fix this by updating the software local variable at the same time as hardware ERDP. [commit message rewording -Mathias] Fixes: dc0ffbea5729 ("usb: host: xhci: update event ring dequeue pointer on= purpose") Reviewed-by: Peter Chen Signed-off-by: Weitao Wang Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220408134823.2527272-2-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci-ring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index f5bd91752f2d..e18b675fb7af 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2848,6 +2848,8 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (event_loop++ < TRBS_PER_SEGMENT / 2) continue; xhci_update_erst_dequeue(xhci, event_ring_deq); + event_ring_deq =3D xhci->event_ring->dequeue; + event_loop =3D 0; } =20 --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A752C352A7 for ; Tue, 10 May 2022 13:38:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243873AbiEJNlU (ORCPT ); Tue, 10 May 2022 09:41:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50084 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243899AbiEJN1f (ORCPT ); Tue, 10 May 2022 09:27:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6665C2C255E; Tue, 10 May 2022 06:20:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id ABA3F616D0; Tue, 10 May 2022 13:20:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B11E4C385A6; Tue, 10 May 2022 13:20:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188845; bh=/A+a3bk4xx74A+u/WRwLO3Lza7C3KHpa+IWrB4azzCQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OZHvBT5q1gNF9/e32nL+auABysYIyCY0/gJ1d9DUmkrVit2YZrUsFA85rz/ebJ0Me td48BdLq36Diff6cLt2UY9k1EYG2XPc3/PKBvOw32U39s1HrneFuXhq0U+7bbIu8cz nhn5BxeruIFGkXOS3CClEBkq0jmXJJswIMp+1lKM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fabio Estevam , Tim Harvey , Max Krummenacher , Shawn Guo , Sasha Levin Subject: [PATCH 4.19 24/88] ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue Date: Tue, 10 May 2022 15:07:09 +0200 Message-Id: <20220510130734.447917545@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Fabio Estevam [ Upstream commit fa51e1dc4b91375bc18349663a52395ad585bd3c ] On a custom carrier board with a i.MX6Q Apalis SoM, the sgtl5000 codec on the SoM is often not detected and the following error message is seen when the sgtl5000 driver tries to read the ID register: sgtl5000 1-000a: Error reading chip id -6 The reason for the error is that the MCLK clock is not provided early enough. Fix the problem by describing the MCLK pinctrl inside the codec node instead of placing it inside the audmux pinctrl group. With this change applied the sgtl5000 is always detected on every boot. Fixes: 693e3ffaae5a ("ARM: dts: imx6: Add support for Toradex Apalis iMX6Q/= D SoM") Signed-off-by: Fabio Estevam Reviewed-by: Tim Harvey Acked-by: Max Krummenacher Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm/boot/dts/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/imx6= qdl-apalis.dtsi index 05f07ea3e8c8..ed783c91b002 100644 --- a/arch/arm/boot/dts/imx6qdl-apalis.dtsi +++ b/arch/arm/boot/dts/imx6qdl-apalis.dtsi @@ -313,6 +313,8 @@ vgen6_reg: vgen6 { codec: sgtl5000@a { compatible =3D "fsl,sgtl5000"; reg =3D <0x0a>; + pinctrl-names =3D "default"; + pinctrl-0 =3D <&pinctrl_sgtl5000>; clocks =3D <&clks IMX6QDL_CLK_CKO>; VDDA-supply =3D <®_module_3v3_audio>; VDDIO-supply =3D <®_module_3v3>; @@ -540,8 +542,6 @@ MX6QDL_PAD_DISP0_DAT20__AUD4_TXC 0x130b0 MX6QDL_PAD_DISP0_DAT21__AUD4_TXD 0x130b0 MX6QDL_PAD_DISP0_DAT22__AUD4_TXFS 0x130b0 MX6QDL_PAD_DISP0_DAT23__AUD4_RXD 0x130b0 - /* SGTL5000 sys_mclk */ - MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 >; }; =20 @@ -807,6 +807,12 @@ MX6QDL_PAD_NANDF_CS1__GPIO6_IO14 0x000b0 >; }; =20 + pinctrl_sgtl5000: sgtl5000grp { + fsl,pins =3D < + MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 + >; + }; + pinctrl_spdif: spdifgrp { fsl,pins =3D < MX6QDL_PAD_GPIO_16__SPDIF_IN 0x1b0b0 --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D125C4321E for ; Tue, 10 May 2022 13:40:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243989AbiEJNmb (ORCPT ); Tue, 10 May 2022 09:42:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243967AbiEJN1o (ORCPT ); Tue, 10 May 2022 09:27:44 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F55B140AC; Tue, 10 May 2022 06:20:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 55021CE1E73; Tue, 10 May 2022 13:20:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 72D80C385A6; Tue, 10 May 2022 13:20:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188847; bh=pz8zjZPWrbsGCPy0NPZ+4qZXWpmaB0sZuWf9cMya9uU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZeltMjU/7eppVCfh6nJUDIcIMMpHodI7+LCvAicGoKE0vkC3wGu3et9BgmAiSeanh Yh4YG5JDPhJcPdLzVGMFbnSTbfUky8209j0TNViHtbnIQMqYgZeUtGApp/tN7UxihW 3vMPztfpPrBK86Ke19OVjNLqB8vdYNG3SO1Sm/Zo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Krzysztof Kozlowski , Vinod Koul , Sasha Levin Subject: [PATCH 4.19 25/88] phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe Date: Tue, 10 May 2022 15:07:10 +0200 Message-Id: <20220510130734.477403714@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 388ec8f079f2f20d5cd183c3bc6f33cbc3ffd3ef ] The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") Signed-off-by: Miaoqian Lin Reviewed-by: Krzysztof Kozlowski Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220407091857.230386-1-krzysztof.kozlowski= @linaro.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/phy/samsung/phy-exynos5250-sata.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/phy/samsung/phy-exynos5250-sata.c b/drivers/phy/samsun= g/phy-exynos5250-sata.c index 60e13afcd9b8..7960c69d09a6 100644 --- a/drivers/phy/samsung/phy-exynos5250-sata.c +++ b/drivers/phy/samsung/phy-exynos5250-sata.c @@ -193,6 +193,7 @@ static int exynos_sata_phy_probe(struct platform_device= *pdev) return -EINVAL; =20 sata_phy->client =3D of_find_i2c_device_by_node(node); + of_node_put(node); if (!sata_phy->client) return -EPROBE_DEFER; =20 --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7D14C433F5 for ; Tue, 10 May 2022 13:40:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243081AbiEJNmQ (ORCPT ); Tue, 10 May 2022 09:42:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243973AbiEJN1p (ORCPT ); Tue, 10 May 2022 09:27:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A040A17058; Tue, 10 May 2022 06:20:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3C5EF61768; Tue, 10 May 2022 13:20:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3EFD6C385A6; Tue, 10 May 2022 13:20:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188850; bh=yLrBDSoik5lYxYHt4/zuvrMAWSDosPSALRSAGfIGK3E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HBzuHFFxnik+6LPJJJ5lERA9vl94FwetTD+La0dFRt9b9arwBntn7YsUAy/4QEbi3 u1HMaUEgr3JdOW19uRaQVkumD6XqPvC29rmgF5hxR6PBo0K0+RHdcgyPmQZu1P8M4e F9/EyVH96KhGe5wRe1uXVdMAvFmltxfQX7t78pDQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Alim Akhtar , Vinod Koul , Sasha Levin Subject: [PATCH 4.19 26/88] phy: samsung: exynos5250-sata: fix missing device put in probe error paths Date: Tue, 10 May 2022 15:07:11 +0200 Message-Id: <20220510130734.506299687@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski [ Upstream commit 5c8402c4db45dd55c2c93c8d730f5dfa7c78a702 ] The actions of of_find_i2c_device_by_node() in probe function should be reversed in error paths by putting the reference to obtained device. Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20220407091857.230386-2-krzysztof.kozlowski= @linaro.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/phy/samsung/phy-exynos5250-sata.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/phy/samsung/phy-exynos5250-sata.c b/drivers/phy/samsun= g/phy-exynos5250-sata.c index 7960c69d09a6..2c39d2fd3cd8 100644 --- a/drivers/phy/samsung/phy-exynos5250-sata.c +++ b/drivers/phy/samsung/phy-exynos5250-sata.c @@ -202,20 +202,21 @@ static int exynos_sata_phy_probe(struct platform_devi= ce *pdev) sata_phy->phyclk =3D devm_clk_get(dev, "sata_phyctrl"); if (IS_ERR(sata_phy->phyclk)) { dev_err(dev, "failed to get clk for PHY\n"); - return PTR_ERR(sata_phy->phyclk); + ret =3D PTR_ERR(sata_phy->phyclk); + goto put_dev; } =20 ret =3D clk_prepare_enable(sata_phy->phyclk); if (ret < 0) { dev_err(dev, "failed to enable source clk\n"); - return ret; + goto put_dev; } =20 sata_phy->phy =3D devm_phy_create(dev, NULL, &exynos_sata_phy_ops); if (IS_ERR(sata_phy->phy)) { - clk_disable_unprepare(sata_phy->phyclk); dev_err(dev, "failed to create PHY\n"); - return PTR_ERR(sata_phy->phy); + ret =3D PTR_ERR(sata_phy->phy); + goto clk_disable; } =20 phy_set_drvdata(sata_phy->phy, sata_phy); @@ -223,11 +224,18 @@ static int exynos_sata_phy_probe(struct platform_devi= ce *pdev) phy_provider =3D devm_of_phy_provider_register(dev, of_phy_simple_xlate); if (IS_ERR(phy_provider)) { - clk_disable_unprepare(sata_phy->phyclk); - return PTR_ERR(phy_provider); + ret =3D PTR_ERR(phy_provider); + goto clk_disable; } =20 return 0; + +clk_disable: + clk_disable_unprepare(sata_phy->phyclk); +put_dev: + put_device(&sata_phy->client->dev); + + return ret; } =20 static const struct of_device_id exynos_sata_phy_of_match[] =3D { --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD8A0C352A7 for ; Tue, 10 May 2022 13:40:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243705AbiEJNmh (ORCPT ); Tue, 10 May 2022 09:42:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243122AbiEJN2b (ORCPT ); Tue, 10 May 2022 09:28:31 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DBAED2528B; Tue, 10 May 2022 06:20:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EACC5616D0; Tue, 10 May 2022 13:20:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 078CBC385C2; Tue, 10 May 2022 13:20:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188853; bh=TrEdLr6RrI2ecmeFH2LJ1ZCxHozPoF75vuqC83vbSXg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Yj6R58hsLUT2Po8b8oyfEw4jldaJLvYIXX5AtOBF9dBfKWbYEU2EUlA/tWc49slS1 UJFgZWRc+JzKmTM01nCXQC7TutdQaD/QaI9TIu/brmGU1hm/CE+o6e1uQzIcMcJk91 e5UP4FMFeach8jjT0HxqlZ4p7LtllbyIYIIP1dpQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Tony Lindgren , Sasha Levin Subject: [PATCH 4.19 27/88] ARM: OMAP2+: Fix refcount leak in omap_gic_of_init Date: Tue, 10 May 2022 15:07:12 +0200 Message-Id: <20220510130734.535705606@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 0f83e6b4161617014017a694888dd8743f46f071 ] The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. Fixes: fd1c07861491 ("ARM: OMAP4: Fix the init code to have OMAP4460 errata= available in DT build") Signed-off-by: Miaoqian Lin Message-Id: <20220309104302.18398-1-linmq006@gmail.com> Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/mach-omap2/omap4-common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4= -common.c index 7074cfd1ff41..79a1e4c51e3d 100644 --- a/arch/arm/mach-omap2/omap4-common.c +++ b/arch/arm/mach-omap2/omap4-common.c @@ -318,10 +318,12 @@ void __init omap_gic_of_init(void) =20 np =3D of_find_compatible_node(NULL, NULL, "arm,cortex-a9-gic"); gic_dist_base_addr =3D of_iomap(np, 0); + of_node_put(np); WARN_ON(!gic_dist_base_addr); =20 np =3D of_find_compatible_node(NULL, NULL, "arm,cortex-a9-twd-timer"); twd_base =3D of_iomap(np, 0); + of_node_put(np); WARN_ON(!twd_base); =20 skip_errata_init: --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39347C433F5 for ; Tue, 10 May 2022 13:38:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237883AbiEJNmm (ORCPT ); Tue, 10 May 2022 09:42:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56842 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239589AbiEJN3F (ORCPT ); Tue, 10 May 2022 09:29:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07B5D366BF; Tue, 10 May 2022 06:20:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9CCEF61663; Tue, 10 May 2022 13:20:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC30FC385A6; Tue, 10 May 2022 13:20:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188856; bh=laynf76DuemHAcHFOzu1PPKqPkAK/Zd29BLiX/RFYHQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=028mdfjE39TYjHl6BBc4uGaS+RRrgBwuVtPgVqLvi61vSDBxcYnW81pmjO+4oGqW+ Kw8x2NL7TeVMrMDMAeOwvj4tXxBNTJ3ACTkkI/zLYOMApHRst7eI6PhnDAsid6xLg9 g3cznQHdwxMHk+zS2B6bjlC/Yl3lOGZqWpnlVq80= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "H. Nikolaus Schaller" , Tony Lindgren , Sasha Levin Subject: [PATCH 4.19 28/88] ARM: dts: Fix mmc order for omap3-gta04 Date: Tue, 10 May 2022 15:07:13 +0200 Message-Id: <20220510130734.564462760@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: H. Nikolaus Schaller [ Upstream commit 09269dd050094593fc747f2a5853d189fefcb6b5 ] Commit a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") introduces general mmc aliases. Let's tailor them to the need of the GTA04 board which does not make use of mmc2 and mmc3 interfaces. Fixes: a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") Signed-off-by: H. Nikolaus Schaller Message-Id: Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/omap3-gta04.dtsi | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-g= ta04.dtsi index a5aed92ab54b..820bdd5326ab 100644 --- a/arch/arm/boot/dts/omap3-gta04.dtsi +++ b/arch/arm/boot/dts/omap3-gta04.dtsi @@ -29,6 +29,8 @@ memory@80000000 { aliases { display0 =3D &lcd; display1 =3D &tv0; + /delete-property/ mmc2; + /delete-property/ mmc3; }; =20 /* fixed 26MHz oscillator */ --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48EE0C4332F for ; Tue, 10 May 2022 13:35:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243825AbiEJNgN (ORCPT ); Tue, 10 May 2022 09:36:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243101AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 43E1619B3A7; Tue, 10 May 2022 06:19:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D52D36166B; Tue, 10 May 2022 13:19:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E6047C385C6; Tue, 10 May 2022 13:19:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188741; bh=VgK2SZSnyS3vDtBzW3c4OMgMyv8VJ77CYuAJhZfeGm8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XqtVG4mJopkoSBMaR45zj93Dfu8nda6JdvtshS7TTPutMfcaZtkgjSzeJxaslOjQO YkLn/C1wSU3oKyq3wwnFDeTpLY8Vgod+JS6hF2G7+ooHJL3LfmhFK5aPANw0p26YNS TGqgjQ2l3D2RdvJT3t5xUWMCOV0tkwdZy8TuY1/Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Adam Ford , Tony Lindgren , Sasha Levin Subject: [PATCH 4.19 29/88] ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 Date: Tue, 10 May 2022 15:07:14 +0200 Message-Id: <20220510130734.593321993@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Adam Ford [ Upstream commit 46ff3df87215ff42c0cd2c4bdb7d74540384a69c ] The pinout of the OMAP35 and DM37 variants of the SOM-LV are the same, but the macros which define the pinmuxing are different between OMAP3530 and DM3730. The pinmuxing was correct for for the DM3730, but wrong for the OMAP3530. Since the boot loader was correctly pin-muxing the pins, this was not obvious. As the bootloader not guaranteed to pinmux all the pins any more, this causes an issue, so the pinmux needs to be moved from a common file to their respective board files. Fixes: f8a2e3ff7103 ("ARM: dts: Add minimal support for LogicPD OMAP35xx SO= M-LV devkit") Signed-off-by: Adam Ford Message-Id: <20220303171818.11060-1-aford173@gmail.com> Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts | 15 +++++++++++++++ arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts | 15 +++++++++++++++ arch/arm/boot/dts/logicpd-som-lv.dtsi | 15 --------------- 3 files changed, 30 insertions(+), 15 deletions(-) diff --git a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts b/arch/arm/bo= ot/dts/logicpd-som-lv-35xx-devkit.dts index 32d0dc371fc3..4cd72b5e612b 100644 --- a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts +++ b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts @@ -15,3 +15,18 @@ / { model =3D "LogicPD Zoom OMAP35xx SOM-LV Development Kit"; compatible =3D "logicpd,dm3730-som-lv-devkit", "ti,omap3"; }; + +&omap3_pmx_core2 { + pinctrl-names =3D "default"; + pinctrl-0 =3D <&hsusb2_2_pins>; + hsusb2_2_pins: pinmux_hsusb2_2_pins { + pinctrl-single,pins =3D < + OMAP3430_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_= d10.hsusb2_clk */ + OMAP3430_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_= d11.hsusb2_stp */ + OMAP3430_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d12.hsusb2_dir */ + OMAP3430_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d13.hsusb2_nxt */ + OMAP3430_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d14.hsusb2_data0 */ + OMAP3430_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d15.hsusb2_data1 */ + >; + }; +}; diff --git a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts b/arch/arm/bo= ot/dts/logicpd-som-lv-37xx-devkit.dts index 24283739526c..2aca9111c699 100644 --- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts +++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts @@ -15,3 +15,18 @@ / { model =3D "LogicPD Zoom DM3730 SOM-LV Development Kit"; compatible =3D "logicpd,dm3730-som-lv-devkit", "ti,omap3630", "ti,omap3"; }; + +&omap3_pmx_core2 { + pinctrl-names =3D "default"; + pinctrl-0 =3D <&hsusb2_2_pins>; + hsusb2_2_pins: pinmux_hsusb2_2_pins { + pinctrl-single,pins =3D < + OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_= d10.hsusb2_clk */ + OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_= d11.hsusb2_stp */ + OMAP3630_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d12.hsusb2_dir */ + OMAP3630_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d13.hsusb2_nxt */ + OMAP3630_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d14.hsusb2_data0 */ + OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d15.hsusb2_data1 */ + >; + }; +}; diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logi= cpd-som-lv.dtsi index c5d54c4d3747..499eea86e102 100644 --- a/arch/arm/boot/dts/logicpd-som-lv.dtsi +++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi @@ -269,21 +269,6 @@ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sy= s_boot1.gpio_3 */ }; }; =20 -&omap3_pmx_core2 { - pinctrl-names =3D "default"; - pinctrl-0 =3D <&hsusb2_2_pins>; - hsusb2_2_pins: pinmux_hsusb2_2_pins { - pinctrl-single,pins =3D < - OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_= d10.hsusb2_clk */ - OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_= d11.hsusb2_stp */ - OMAP3630_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d12.hsusb2_dir */ - OMAP3630_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d13.hsusb2_nxt */ - OMAP3630_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d14.hsusb2_data0 */ - OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_= d15.hsusb2_data1 */ - >; - }; -}; - &uart2 { interrupts-extended =3D <&intc 73 &omap3_pmx_core OMAP3_UART2_RX>; pinctrl-names =3D "default"; --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86D39C43219 for ; Tue, 10 May 2022 13:35:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243962AbiEJNgg (ORCPT ); Tue, 10 May 2022 09:36:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44372 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243118AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0CD8018C048; Tue, 10 May 2022 06:19:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7F96D615F8; Tue, 10 May 2022 13:19:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 918F9C385A6; Tue, 10 May 2022 13:19:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188743; bh=W7ZK7KD0miQc+0GIjSeypunCKQIaBHTvFxVnApOunKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YapPu2c1KsWvG28HY0dMOK8UVKcVzrrA3PW4H90CxOD8ic0hUOxn2ZCjFR8hRsNxn o7odThb9wlBG6JgCnWropnK/7cPO3egODV2mUgBYC02NpfQhMqkjDD9X4PcWxFlkLh 2z1f7Jf6OsEgz/MRMBx1t2Quzc9fY92VbQjr9s1E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pengcheng Yang , Julian Anastasov , Simon Horman , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.19 30/88] ipvs: correctly print the memory size of ip_vs_conn_tab Date: Tue, 10 May 2022 15:07:15 +0200 Message-Id: <20220510130734.622178686@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pengcheng Yang [ Upstream commit eba1a872cb73314280d5448d934935b23e30b7ca ] The memory size of ip_vs_conn_tab changed after we use hlist instead of list. Fixes: 731109e78415 ("ipvs: use hlist instead of list") Signed-off-by: Pengcheng Yang Acked-by: Julian Anastasov Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/netfilter/ipvs/ip_vs_conn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_con= n.c index 2780a847701e..95c35aa639ec 100644 --- a/net/netfilter/ipvs/ip_vs_conn.c +++ b/net/netfilter/ipvs/ip_vs_conn.c @@ -1426,7 +1426,7 @@ int __init ip_vs_conn_init(void) pr_info("Connection hash table configured " "(size=3D%d, memory=3D%ldKbytes)\n", ip_vs_conn_tab_size, - (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024); + (long)(ip_vs_conn_tab_size*sizeof(*ip_vs_conn_tab))/1024); IP_VS_DBG(0, "Each connection entry needs %zd bytes at least\n", sizeof(struct ip_vs_conn)); =20 --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 775E2C4321E for ; Tue, 10 May 2022 13:35:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243904AbiEJNgd (ORCPT ); Tue, 10 May 2022 09:36:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243022AbiEJNZd (ORCPT ); Tue, 10 May 2022 09:25:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BF5BB1A44BD; Tue, 10 May 2022 06:19:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5F227615F8; Tue, 10 May 2022 13:19:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B886C385A6; Tue, 10 May 2022 13:19:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188746; bh=S/+SzEMNOP0N4XjUzqg+WnqgASmCVr/RyU9JiZu12Mc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QMrUKDlkh8K6IIzBLZkyfRaHLO/cn2wvGkTjx3KqYBW53m0Y5mlyoI/C+iSNOW5uo XN7HZfppH94azMQtDZfV3Aw3bH5B794r5v4s5UAJotiCjR19YiFWuSNL5GLNgL7vpG Da0w+RfXyWei4wXzgZNolenJDZptnk8zby1g1q70= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Miquel Raynal , Sasha Levin Subject: [PATCH 4.19 31/88] mtd: rawnand: Fix return value check of wait_for_completion_timeout Date: Tue, 10 May 2022 15:07:16 +0200 Message-Id: <20220510130734.650797002@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 084c16ab423a8890121b902b405823bfec5b4365 ] wait_for_completion_timeout() returns unsigned long not int. It returns 0 if timed out, and positive if completed. The check for <=3D 0 is ambiguous and should be =3D=3D 0 here indicating timeout which is the only error case. Fixes: 83738d87e3a0 ("mtd: sh_flctl: Add DMA capabilty") Signed-off-by: Miaoqian Lin Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220412083435.29254-1-linmq006@gma= il.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/mtd/nand/raw/sh_flctl.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/mtd/nand/raw/sh_flctl.c b/drivers/mtd/nand/raw/sh_flct= l.c index 683df1a12989..07ba149fa971 100644 --- a/drivers/mtd/nand/raw/sh_flctl.c +++ b/drivers/mtd/nand/raw/sh_flctl.c @@ -399,7 +399,8 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *fl= ctl, unsigned long *buf, dma_addr_t dma_addr; dma_cookie_t cookie; uint32_t reg; - int ret; + int ret =3D 0; + unsigned long time_left; =20 if (dir =3D=3D DMA_FROM_DEVICE) { chan =3D flctl->chan_fifo0_rx; @@ -440,13 +441,14 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *= flctl, unsigned long *buf, goto out; } =20 - ret =3D + time_left =3D wait_for_completion_timeout(&flctl->dma_complete, msecs_to_jiffies(3000)); =20 - if (ret <=3D 0) { + if (time_left =3D=3D 0) { dmaengine_terminate_all(chan); dev_err(&flctl->pdev->dev, "wait_for_completion_timeout\n"); + ret =3D -ETIMEDOUT; } =20 out: @@ -456,7 +458,7 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *fl= ctl, unsigned long *buf, =20 dma_unmap_single(chan->device->dev, dma_addr, len, dir); =20 - /* ret > 0 is success */ + /* ret =3D=3D 0 is success */ return ret; } =20 @@ -480,7 +482,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rl= en, int offset) =20 /* initiate DMA transfer */ if (flctl->chan_fifo0_rx && rlen >=3D 32 && - flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0) + !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE)) goto convert; /* DMA success */ =20 /* do polling transfer */ @@ -539,7 +541,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, in= t rlen, =20 /* initiate DMA transfer */ if (flctl->chan_fifo0_tx && rlen >=3D 32 && - flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0) + !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE)) return; /* DMA success */ =20 /* do polling transfer */ --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93761C433F5 for ; Tue, 10 May 2022 13:35:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236844AbiEJNjo (ORCPT ); Tue, 10 May 2022 09:39:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243235AbiEJN0i (ORCPT ); Tue, 10 May 2022 09:26:38 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E97171AD59A; Tue, 10 May 2022 06:19:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 19A0361574; Tue, 10 May 2022 13:19:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E940C385D9; Tue, 10 May 2022 13:19:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188749; bh=s5f/t7GKIrC/DOo4GxniZ8U7AtBWL3nX1eULqNQQRlc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WmCknKvhPwKXRrGeIN9vQIsexIa8ka9idH1Qd2M9in84R0teWYfHtmoeU9WmbVPQ5 /r7VPAm3UYnG6aoyNlX17dy75fKrjnaKQ7KQb7InAkHmRQzD+iUCI06u1dn94wgqmk RjHyxPReum4bM1nYdVtNRVE5MFIcYGJ8xLLeVqXo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Francesco Ruggeri , Eric Dumazet , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 32/88] tcp: md5: incorrect tcp_header_len for incoming connections Date: Tue, 10 May 2022 15:07:17 +0200 Message-Id: <20220510130734.679595336@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Francesco Ruggeri [ Upstream commit 5b0b9e4c2c895227c8852488b3f09839233bba54 ] In tcp_create_openreq_child we adjust tcp_header_len for md5 using the remote address in newsk. But that address is still 0 in newsk at this point, and it is only set later by the callers (tcp_v[46]_syn_recv_sock). Use the address from the request socket instead. Fixes: cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.") Signed-off-by: Francesco Ruggeri Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220421005026.686A45EC01F2@us226.sjc.arist= anetworks.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_minisocks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index a20b393b4501..c79cb949da66 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -550,7 +550,7 @@ struct sock *tcp_create_openreq_child(const struct sock= *sk, newtp->tsoffset =3D treq->ts_off; #ifdef CONFIG_TCP_MD5SIG newtp->md5sig_info =3D NULL; /*XXX*/ - if (newtp->af_specific->md5_lookup(sk, newsk)) + if (treq->af_specific->req_md5_lookup(sk, req_to_sk(req))) newtp->tcp_header_len +=3D TCPOLEN_MD5SIG_ALIGNED; #endif if (skb->len >=3D TCP_MSS_DEFAULT + newtp->tcp_header_len) --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AD14C433EF for ; Tue, 10 May 2022 13:38:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244284AbiEJNlt (ORCPT ); Tue, 10 May 2022 09:41:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33564 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243246AbiEJN0j (ORCPT ); Tue, 10 May 2022 09:26:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BAC72317D5; Tue, 10 May 2022 06:19:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F070661665; Tue, 10 May 2022 13:19:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0984DC385C2; Tue, 10 May 2022 13:19:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188752; bh=7QJDgg4sfkmypf0Qd7Xo9nYtMAuC3p7KgxsYAL5z3QI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eFWStOnhkuznbzJ7SfP5P2BDM+i4qKRLp13n4IcZMEVW60LzQaKh6Le0tDF25lXj5 9T8q6apHiYZYoBGvj92HlSQl8kplq/nAk35ehMSvslJEzrm0ioyj3gePc7NtAAJDkz snNA3ewKZe/NLYORXs67RWl9dD29NgMbnxxH5kN4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ying Xu , Xin Long , Marcelo Ricardo Leitner , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 33/88] sctp: check asoc strreset_chunk in sctp_generate_reconf_event Date: Tue, 10 May 2022 15:07:18 +0200 Message-Id: <20220510130734.707839964@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long [ Upstream commit 165e3e17fe8fe6a8aab319bc6e631a2e23b9a857 ] A null pointer reference issue can be triggered when the response of a stream reconf request arrives after the timer is triggered, such as: send Incoming SSN Reset Request ---> CPU0: reconf timer is triggered, go to the handler code before hold sk lock <--- reply with Outgoing SSN Reset Request CPU1: process Outgoing SSN Reset Request, and set asoc->strreset_chunk to NULL CPU0: continue the handler code, hold sk lock, and try to hold asoc->strreset_chunk, crash! In Ying Xu's testing, the call trace is: [ ] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ ] RIP: 0010:sctp_chunk_hold+0xe/0x40 [sctp] [ ] Call Trace: [ ] [ ] sctp_sf_send_reconf+0x2c/0x100 [sctp] [ ] sctp_do_sm+0xa4/0x220 [sctp] [ ] sctp_generate_reconf_event+0xbd/0xe0 [sctp] [ ] call_timer_fn+0x26/0x130 This patch is to fix it by returning from the timer handler if asoc strreset_chunk is already set to NULL. Fixes: 7b9438de0cd4 ("sctp: add stream reconf timer") Reported-by: Ying Xu Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/sctp/sm_sideeffect.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c index 2a94240eac36..82d96441e64d 100644 --- a/net/sctp/sm_sideeffect.c +++ b/net/sctp/sm_sideeffect.c @@ -473,6 +473,10 @@ void sctp_generate_reconf_event(struct timer_list *t) goto out_unlock; } =20 + /* This happens when the response arrives after the timer is triggered. */ + if (!asoc->strreset_chunk) + goto out_unlock; + error =3D sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT, SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_RECONF), asoc->state, asoc->ep, asoc, --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA146C388F3 for ; Tue, 10 May 2022 13:35:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244353AbiEJNha (ORCPT ); Tue, 10 May 2022 09:37:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33516 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243274AbiEJN0k (ORCPT ); Tue, 10 May 2022 09:26:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A7E8231CB1; Tue, 10 May 2022 06:19:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BF8B4B81D7A; Tue, 10 May 2022 13:19:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 083F7C385A6; Tue, 10 May 2022 13:19:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188755; bh=VkjXY59wzMY0vN+1WTwZLVdRbwyG7gsNrtDViAswDNs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MJRxvnDyFNMraFGBgR2++JkhTbezLWjge7vRJyrLe3YdGLP8sawvwEeoF6RSM9GaQ Ak6csjPOv4IzHhFvNQnVVEQK+TadUaN1qjKtKoNqUjv6P/MzidNYuh/XcqHBLodGHU GXIGz4Xc/gsXmijLiLTSNALGCsfeajUqjr59Moi8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Max Krummenacher , Denys Drozdov , Marcel Ziswiler , Shawn Guo , Sasha Levin Subject: [PATCH 4.19 34/88] ARM: dts: imx6ull-colibri: fix vqmmc regulator Date: Tue, 10 May 2022 15:07:19 +0200 Message-Id: <20220510130734.736251531@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Max Krummenacher [ Upstream commit 45974e4276a8d6653394f66666fc57d8ffa6de9a ] The correct spelling for the property is gpios. Otherwise, the regulator will neither reserve nor control any GPIOs. Thus, any SD/MMC card which can use UHS-I modes will fail. Fixes: c2e4987e0e02 ("ARM: dts: imx6ull: add Toradex Colibri iMX6ULL suppor= t") Signed-off-by: Max Krummenacher Signed-off-by: Denys Drozdov Signed-off-by: Marcel Ziswiler Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/imx6ull-colibri.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/boot/dts/imx6ull-colibri.dtsi b/arch/arm/boot/dts/imx= 6ull-colibri.dtsi index 6c63a7384611..4219239f0b58 100644 --- a/arch/arm/boot/dts/imx6ull-colibri.dtsi +++ b/arch/arm/boot/dts/imx6ull-colibri.dtsi @@ -37,7 +37,7 @@ reg_module_3v3_avdd: regulator-module-3v3-avdd { =20 reg_sd1_vmmc: regulator-sd1-vmmc { compatible =3D "regulator-gpio"; - gpio =3D <&gpio5 9 GPIO_ACTIVE_HIGH>; + gpios =3D <&gpio5 9 GPIO_ACTIVE_HIGH>; pinctrl-names =3D "default"; pinctrl-0 =3D <&pinctrl_snvs_reg_sd>; regulator-always-on; --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 201C1C4167D for ; Tue, 10 May 2022 13:35:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244071AbiEJNgs (ORCPT ); Tue, 10 May 2022 09:36:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50500 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243297AbiEJN0l (ORCPT ); Tue, 10 May 2022 09:26:41 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67C6B232769; Tue, 10 May 2022 06:19:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id B3D63CE1E73; Tue, 10 May 2022 13:19:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C558EC385C2; Tue, 10 May 2022 13:19:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188758; bh=QEzRlUyLSoDv4DWhDKqvVYlRLMcPMdP6GZmiGW4LfwI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ayIaR8IZ/xyMkmWz8qocvLhyPaWpptbgxqThCxPOsR01q+Tw+3WQKUXUOF7aGzuKR RrXQ0zs7PAM2Nqt4MUCMqphu/qW6n8DMrKQ7Uav0rsWjvte/xnEtoeyi6bSp0LuwGQ dPdCwN2XsS34rPsByT4Wock5aAe6VYXdfrfyVATk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zeal Robot , Lv Ruyi , Linus Walleij , Sasha Levin Subject: [PATCH 4.19 35/88] pinctrl: pistachio: fix use of irq_of_parse_and_map() Date: Tue, 10 May 2022 15:07:20 +0200 Message-Id: <20220510130734.765287522@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lv Ruyi [ Upstream commit 0c9843a74a85224a89daa81fa66891dae2f930e1 ] The irq_of_parse_and_map() function returns 0 on failure, and does not return an negative value. Fixes: cefc03e5995e ("pinctrl: Add Pistachio SoC pin control driver") Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Link: https://lore.kernel.org/r/20220424031430.3170759-1-lv.ruyi@zte.com.cn Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pinctrl/pinctrl-pistachio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-= pistachio.c index 0d7d379e9bb8..fb7340ad15b3 100644 --- a/drivers/pinctrl/pinctrl-pistachio.c +++ b/drivers/pinctrl/pinctrl-pistachio.c @@ -1374,10 +1374,10 @@ static int pistachio_gpio_register(struct pistachio= _pinctrl *pctl) } =20 irq =3D irq_of_parse_and_map(child, 0); - if (irq < 0) { - dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq); + if (!irq) { + dev_err(pctl->dev, "No IRQ for bank %u\n", i); of_node_put(child); - ret =3D irq; + ret =3D -EINVAL; goto err; } =20 --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6A7FC4167B for ; Tue, 10 May 2022 13:35:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243983AbiEJNgk (ORCPT ); Tue, 10 May 2022 09:36:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50074 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243312AbiEJN0m (ORCPT ); Tue, 10 May 2022 09:26:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0A0D3235174; Tue, 10 May 2022 06:19:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 35DCAB81DA2; Tue, 10 May 2022 13:19:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F69AC385C2; Tue, 10 May 2022 13:19:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188760; bh=M4Q9eVM6lmE4uplikDTI38Ff/aEMbxAHapDjP668/78=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wq88TyBG9/zit68LVhlH+ZLw0eKy8Z7Jkvr5vurN6RQSEqrATvr19DyaMrEAQ7Cyq kl8L4UyjJj7FohXQGligVHKK5PhhFuh9SKu2rkUX+CtI5MQzho4j6YSj17GJzFJ5Ts lb8euzOfZhVGYQmW3jGHOVoAkhZo3+IvjlBbhFpM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jian Shen , Guangbin Huang , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 36/88] net: hns3: add validity check for message data length Date: Tue, 10 May 2022 15:07:21 +0200 Message-Id: <20220510130734.797109644@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jian Shen [ Upstream commit 7d413735cb18ff73aaba3457b16b08332e8d3cc4 ] Add validity check for message data length in function hclge_send_mbx_msg(), avoid unexpected overflow. Fixes: dde1a86e93ca ("net: hns3: Add mailbox support to PF driver") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drive= rs/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index 997ca79ed892..7e49188c3009 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -60,6 +60,13 @@ static int hclge_send_mbx_msg(struct hclge_vport *vport,= u8 *msg, u16 msg_len, enum hclge_cmd_status status; struct hclge_desc desc; =20 + if (msg_len > HCLGE_MBX_MAX_MSG_SIZE) { + dev_err(&hdev->pdev->dev, + "msg data length(=3D%u) exceeds maximum(=3D%u)\n", + msg_len, HCLGE_MBX_MAX_MSG_SIZE); + return -EMSGSIZE; + } + resp_pf_to_vf =3D (struct hclge_mbx_pf_to_vf_cmd *)desc.data; =20 hclge_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_MBX_PF_TO_VF, false); --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E6E6C433EF for ; Tue, 10 May 2022 13:35:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244003AbiEJNgo (ORCPT ); Tue, 10 May 2022 09:36:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243313AbiEJN0n (ORCPT ); Tue, 10 May 2022 09:26:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AED6953A5D; Tue, 10 May 2022 06:19:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 47161615F8; Tue, 10 May 2022 13:19:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5AFC8C385C2; Tue, 10 May 2022 13:19:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188763; bh=RUW426/IJNQKhqFC5iVKIPc/IMVjJ+2w0oqd5YUC2LI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OaYJiIsBws/crGHfX1Y2EBN6i4v8swSF1QD478AjyZuL4+TGQNLYpT3q78jCSxQH0 qMiBvtt4wJVOgavqxbwV4nPYNivyCNUg6klbwWH20QqT4uQhEKvAOOwiLSFdfUV/Tb yKCgIaGLHYAjAk115xTbrWDD/cUDjDqCCwW4oDYs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , William Tu , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 37/88] ip_gre: Make o_seqno start from 0 in native mode Date: Tue, 10 May 2022 15:07:22 +0200 Message-Id: <20220510130734.824638697@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peilin Ye [ Upstream commit ff827beb706ed719c766acf36449801ded0c17fc ] For GRE and GRETAP devices, currently o_seqno starts from 1 in native mode. According to RFC 2890 2.2., "The first datagram is sent with a sequence number of 0." Fix it. It is worth mentioning that o_seqno already starts from 0 in collect_md mode, see gre_fb_xmit(), where tunnel->o_seqno is passed to gre_build_header() before getting incremented. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Peilin Ye Acked-by: William Tu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/ip_gre.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c index 0c431fd4b120..41d0f9bb5191 100644 --- a/net/ipv4/ip_gre.c +++ b/net/ipv4/ip_gre.c @@ -435,14 +435,12 @@ static void __gre_xmit(struct sk_buff *skb, struct ne= t_device *dev, __be16 proto) { struct ip_tunnel *tunnel =3D netdev_priv(dev); - - if (tunnel->parms.o_flags & TUNNEL_SEQ) - tunnel->o_seqno++; + __be16 flags =3D tunnel->parms.o_flags; =20 /* Push GRE header. */ gre_build_header(skb, tunnel->tun_hlen, - tunnel->parms.o_flags, proto, tunnel->parms.o_key, - htonl(tunnel->o_seqno)); + flags, proto, tunnel->parms.o_key, + (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); =20 ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); } --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D77BC433EF for ; Tue, 10 May 2022 13:36:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243670AbiEJNj6 (ORCPT ); Tue, 10 May 2022 09:39:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56150 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243347AbiEJN0p (ORCPT ); Tue, 10 May 2022 09:26:45 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1820F1B1CEC; Tue, 10 May 2022 06:19:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B5A7BB81DA3; Tue, 10 May 2022 13:19:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1732EC385C2; Tue, 10 May 2022 13:19:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188766; bh=I1U55y+kNna/a0XyQCHcwkElB9gZez0gqrjcr4EkknI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m0cAJd7g3tSbg+Niftz/3fJ5v4R0ZprbKM1c49/1BCLS5aZZhWyAreD42LC5KWIvM OXyMVSzD9ODj5EgkEmRIK+8rcEm79wB4nb4DghlvDC8lGB4YvoNzhnT3VDpXydJrvY TTncLD1rcaCx3ayp1wYiTHVro7JqXKGGkY7PXM14= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Doug Porter , Soheil Hassas Yeganeh , Neal Cardwell , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 38/88] tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT Date: Tue, 10 May 2022 15:07:23 +0200 Message-Id: <20220510130734.852784026@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 4bfe744ff1644fbc0a991a2677dc874475dd6776 ] I had this bug sitting for too long in my pile, it is time to fix it. Thanks to Doug Porter for reminding me of it! We had various attempts in the past, including commit 0cbe6a8f089e ("tcp: remove SOCK_QUEUE_SHRUNK"), but the issue is that TCP stack currently only generates EPOLLOUT from input path, when tp->snd_una has advanced and skb(s) cleaned from rtx queue. If a flow has a big RTT, and/or receives SACKs, it is possible that the notsent part (tp->write_seq - tp->snd_nxt) reaches 0 and no more data can be sent until tp->snd_una finally advances. What is needed is to also check if POLLOUT needs to be generated whenever tp->snd_nxt is advanced, from output path. This bug triggers more often after an idle period, as we do not receive ACK for at least one RTT. tcp_notsent_lowat could be a fraction of what CWND and pacing rate would allow to send during this RTT. In a followup patch, I will remove the bogus call to tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED) from tcp_check_space(). Fact that we have decided to generate an EPOLLOUT does not mean the application has immediately refilled the transmit queue. This optimistic call might have been the reason the bug seemed not too serious. Tested: 200 ms rtt, 1% packet loss, 32 MB tcp_rmem[2] and tcp_wmem[2] $ echo 500000 >/proc/sys/net/ipv4/tcp_notsent_lowat $ cat bench_rr.sh SUM=3D0 for i in {1..10} do V=3D`netperf -H remote_host -l30 -t TCP_RR -- -r 10000000,10000 -o LOCAL_B= YTES_SENT | egrep -v "MIGRATED|Bytes"` echo $V SUM=3D$(($SUM + $V)) done echo SUM=3D$SUM Before patch: $ bench_rr.sh 130000000 80000000 140000000 140000000 140000000 140000000 130000000 40000000 90000000 110000000 SUM=3D1140000000 After patch: $ bench_rr.sh 430000000 590000000 530000000 450000000 450000000 350000000 450000000 490000000 480000000 460000000 SUM=3D4680000000 # This is 410 % of the value before patch. Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") Signed-off-by: Eric Dumazet Reported-by: Doug Porter Cc: Soheil Hassas Yeganeh Cc: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/tcp.h | 1 + net/ipv4/tcp_input.c | 12 +++++++++++- net/ipv4/tcp_output.c | 1 + 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 3f0d654984cf..f0d2e2571f56 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -594,6 +594,7 @@ void tcp_synack_rtt_meas(struct sock *sk, struct reques= t_sock *req); void tcp_reset(struct sock *sk); void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *= skb); void tcp_fin(struct sock *sk); +void tcp_check_space(struct sock *sk); =20 /* tcp_timer.c */ void tcp_init_xmit_timers(struct sock *); diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 757e1f60e00d..d71326f3777c 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5167,7 +5167,17 @@ static void tcp_new_space(struct sock *sk) sk->sk_write_space(sk); } =20 -static void tcp_check_space(struct sock *sk) +/* Caller made space either from: + * 1) Freeing skbs in rtx queues (after tp->snd_una has advanced) + * 2) Sent skbs from output queue (and thus advancing tp->snd_nxt) + * + * We might be able to generate EPOLLOUT to the application if: + * 1) Space consumed in output/rtx queues is below sk->sk_sndbuf/2 + * 2) notsent amount (tp->write_seq - tp->snd_nxt) became + * small enough that tcp_stream_memory_free() decides it + * is time to generate EPOLLOUT. + */ +void tcp_check_space(struct sock *sk) { if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) { sock_reset_flag(sk, SOCK_QUEUE_SHRUNK); diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 97c3b616d594..8543cd724d54 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -69,6 +69,7 @@ static void tcp_event_new_data_sent(struct sock *sk, stru= ct sk_buff *skb) =20 NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT, tcp_skb_pcount(skb)); + tcp_check_space(sk); } =20 /* SND.NXT, if window was not shrunk or the amount of shrunk was less than= one --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 353E0C41535 for ; Tue, 10 May 2022 13:35:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244132AbiEJNgw (ORCPT ); Tue, 10 May 2022 09:36:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44432 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243363AbiEJN0q (ORCPT ); Tue, 10 May 2022 09:26:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 922EE236747; Tue, 10 May 2022 06:19:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4F816B81B32; Tue, 10 May 2022 13:19:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A97ADC385A6; Tue, 10 May 2022 13:19:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188772; bh=UIra3kRtMq6/pFL+lQMyzsAxAiUjlJL3RiOqVZl920o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J2dqj57auReR9wRWIQ3jyIJU2ZvppIrw9VDUfLMyQBwl3Kjl1i4z06RB8Yj6fPXyO o2IKRsoqbwKoQ4zDTcyP7UjK+mOVlP94RBeTOui0CZeWaXH+aeokBx9jDtGreYM28k hHizVP3hxy/uS019lOyzaroJRWcHbVuvluDGHx9g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Samuel Holland , Jernej Skrabec , Sasha Levin Subject: [PATCH 4.19 39/88] bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() Date: Tue, 10 May 2022 15:07:24 +0200 Message-Id: <20220510130734.884539587@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit fff8c10368e64e7f8960f149375c12ca5f3b30af ] This code is really spurious. It always returns an ERR_PTR, even when err is known to be 0 and calls put_device() after a successful device_register() call. It is likely that the return statement in the normal path is missing. Add 'return rdev;' to fix it. Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Seri= al Bus") Signed-off-by: Christophe JAILLET Reviewed-by: Samuel Holland Tested-by: Samuel Holland Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/ef2b9576350bba4c8e05e669e9535e9e2a415763.16= 50551719.git.christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/bus/sunxi-rsb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c index 2ca2cc56bcef..b85d013a9185 100644 --- a/drivers/bus/sunxi-rsb.c +++ b/drivers/bus/sunxi-rsb.c @@ -224,6 +224,8 @@ static struct sunxi_rsb_device *sunxi_rsb_device_create= (struct sunxi_rsb *rsb, =20 dev_dbg(&rdev->dev, "device %s registered\n", dev_name(&rdev->dev)); =20 + return rdev; + err_device_add: put_device(&rdev->dev); =20 --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62A3AC46467 for ; Tue, 10 May 2022 13:35:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244171AbiEJNhE (ORCPT ); Tue, 10 May 2022 09:37:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243380AbiEJN0r (ORCPT ); Tue, 10 May 2022 09:26:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0CA71236778; Tue, 10 May 2022 06:19:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2153DB81CE7; Tue, 10 May 2022 13:19:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7E008C385A6; Tue, 10 May 2022 13:19:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188774; bh=Pp2xubEQT4JNvnI5scJ8sOgY3MIdnbd32AZs3pTl5OI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=plUejHJxDG7w0xHfh1oogWrxxLMb2BjxloUtK1Z7zZfuQWglla5NZDpAqoc9X5xcx 8RTFIa6puJrWHUbaNRLXgrW1ycAKkevqHQy9F2MO3GiGuQILQrhxzw0Qmp+WzbFkMj 7UhyjKl0pMq5JP0JD0aiRjYa8DpHHNZVNGauzYy4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Yingliang , Samuel Holland , Jernej Skrabec , Sasha Levin Subject: [PATCH 4.19 40/88] clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() Date: Tue, 10 May 2022 15:07:25 +0200 Message-Id: <20220510130734.913395260@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit f58ca215cda1975f77b2b762903684a3c101bec9 ] It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Fixes: 7a6fca879f59 ("clk: sunxi: Add driver for A80 MMC config clocks/rese= ts") Signed-off-by: Yang Yingliang Reviewed-by: Samuel Holland Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220421134308.2885094-1-yangyingliang@huaw= ei.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/clk/sunxi/clk-sun9i-mmc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9= i-mmc.c index f00d8758ba24..a706ae9a010a 100644 --- a/drivers/clk/sunxi/clk-sun9i-mmc.c +++ b/drivers/clk/sunxi/clk-sun9i-mmc.c @@ -117,6 +117,8 @@ static int sun9i_a80_mmc_config_clk_probe(struct platfo= rm_device *pdev) spin_lock_init(&data->lock); =20 r =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!r) + return -EINVAL; /* one clock/reset pair per word */ count =3D DIV_ROUND_UP((resource_size(r)), SUN9I_MMC_WIDTH); data->membase =3D devm_ioremap_resource(&pdev->dev, r); --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 785D7C35296 for ; Tue, 10 May 2022 13:35:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244186AbiEJNhK (ORCPT ); Tue, 10 May 2022 09:37:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243407AbiEJN0s (ORCPT ); Tue, 10 May 2022 09:26:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 900F52370DB; Tue, 10 May 2022 06:19:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0327BB81B32; Tue, 10 May 2022 13:19:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56C2DC385A6; Tue, 10 May 2022 13:19:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188777; bh=KhIt1aZPblghE0JCoR3FVxLjEHJIj71rGY2VyzDn0j8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=keQUSDXMbKoO+6sUDVahwnYVatQpBlZ+CjzRR3XDhn882ZgdUllRTmFLi7xCfqk71 Wja4a0+OPfoazeK/i7ubajcpmbKtgqdy8Y2DybwcuErc/tY3F30cJiZH21OYmr7ehE P4/IEjIJhFcIid7EeaOQC/+I452OSZeEEDnwIOLE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Lemon , Florian Fainelli , Paolo Abeni , Sasha Levin Subject: [PATCH 4.19 41/88] net: bcmgenet: hide status block before TX timestamping Date: Tue, 10 May 2022 15:07:26 +0200 Message-Id: <20220510130734.942254644@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jonathan Lemon [ Upstream commit acac0541d1d65e81e599ec399d34d184d2424401 ] The hardware checksum offloading requires use of a transmit status block inserted before the outgoing frame data, this was updated in '9a9ba2a4aaaa ("net: bcmgenet: always enable status blocks")' However, skb_tx_timestamp() assumes that it is passed a raw frame and PTP parsing chokes on this status block. Fix this by calling __skb_pull(), which hides the TSB before calling skb_tx_timestamp(), so an outgoing PTP packet is parsed correctly. As the data in the skb has already been set up for DMA, and the dma_unmap_* calls use a separately stored address, there is no no effective change in the data transmission. Signed-off-by: Jonathan Lemon Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20220424165307.591145-1-jonathan.lemon@gmai= l.com Fixes: d03825fba459 ("net: bcmgenet: add skb_tx_timestamp call") Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/e= thernet/broadcom/genet/bcmgenet.c index d4be107ea4cd..96ef2dd46c78 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -1549,6 +1549,11 @@ static struct sk_buff *bcmgenet_put_tx_csum(struct n= et_device *dev, return skb; } =20 +static void bcmgenet_hide_tsb(struct sk_buff *skb) +{ + __skb_pull(skb, sizeof(struct status_64)); +} + static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *d= ev) { struct bcmgenet_priv *priv =3D netdev_priv(dev); @@ -1657,6 +1662,8 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb,= struct net_device *dev) } =20 GENET_CB(skb)->last_cb =3D tx_cb_ptr; + + bcmgenet_hide_tsb(skb); skb_tx_timestamp(skb); =20 /* Decrement total BD count and advance our write pointer */ --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AC90C352A7 for ; Tue, 10 May 2022 13:35:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244269AbiEJNhP (ORCPT ); Tue, 10 May 2022 09:37:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56076 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243417AbiEJN0t (ORCPT ); Tue, 10 May 2022 09:26:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D310F23724F; Tue, 10 May 2022 06:19:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 04F1961574; Tue, 10 May 2022 13:19:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14E61C385A6; Tue, 10 May 2022 13:19:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188780; bh=0XaKIhdZ38kf61J/XaHOpjL547BhcB38ZZHehKt22HY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HcCzfEmAMdH8uDGprWEh6u9jPAPxSrpwjGbWJvguGI1kzVliR25GbNRf87sFTp+Ei mJBYms1oKcTfJYs4wxb+oPJSwQWZ5AdWdAKIz2xoZjAgrsci4baHdAr7hi7EkABaMv J5KbUXUWwAwztSpk/hYZsoUJfPuikg+tm+kRMnuo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Christensen , Manish Chopra , Ariel Elior , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 42/88] bnx2x: fix napi API usage sequence Date: Tue, 10 May 2022 15:07:27 +0200 Message-Id: <20220510130734.971131687@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Manish Chopra [ Upstream commit af68656d66eda219b7f55ce8313a1da0312c79e1 ] While handling PCI errors (AER flow) driver tries to disable NAPI [napi_disable()] after NAPI is deleted [__netif_napi_del()] which causes unexpected system hang/crash. System message log shows the following: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 3222.537510] EEH: Detected PCI bus error on PHB#384-PE#800000 [ 3222.5375= 11] EEH: This PCI device has failed 2 times in the last hour and will be pe= rmanently disabled after 5 failures. [ 3222.537512] EEH: Notify device drivers to shutdown [ 3222.537513] EEH: B= eginning: 'error_detected(IO frozen)' [ 3222.537514] EEH: PE#800000 (PCI 0384:80:00.0): Invoking bnx2x->error_detected(IO frozen) [ 3222.537516] bnx2x: [bnx2x_io_error_detected:14236(eth14)]IO error detect= ed [ 3222.537650] EEH: PE#800000 (PCI 0384:80:00.0): bnx2x driver reports: 'need reset' [ 3222.537651] EEH: PE#800000 (PCI 0384:80:00.1): Invoking bnx2x->error_detected(IO frozen) [ 3222.537651] bnx2x: [bnx2x_io_error_detected:14236(eth13)]IO error detect= ed [ 3222.537729] EEH: PE#800000 (PCI 0384:80:00.1): bnx2x driver reports: 'need reset' [ 3222.537729] EEH: Finished:'error_detected(IO frozen)' with aggregate rec= overy state:'need reset' [ 3222.537890] EEH: Collect temporary log [ 3222.583481] EEH: of node=3D038= 4:80:00.0 [ 3222.583519] EEH: PCI device/vendor: 168e14e4 [ 3222.583557] EE= H: PCI cmd/status register: 00100140 [ 3222.583557] EEH: PCI-E capabilities= and status follow: [ 3222.583744] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.58= 3892] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.583893] EEH= : PCI-E 20: 00000000 [ 3222.583893] EEH: PCI-E AER capability register set = follows: [ 3222.584079] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 322= 2.584230] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.584= 378] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.584416] = EEH: PCI-E AER 30: 00000000 00000000 [ 3222.584416] EEH: of node=3D0384:80:= 00.1 [ 3222.584454] EEH: PCI device/vendor: 168e14e4 [ 3222.584491] EEH: PC= I cmd/status register: 00100140 [ 3222.584492] EEH: PCI-E capabilities and = status follow: [ 3222.584677] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.58= 4825] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.584826] EEH= : PCI-E 20: 00000000 [ 3222.584826] EEH: PCI-E AER capability register set = follows: [ 3222.585011] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 322= 2.585160] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.585= 309] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.585347] = EEH: PCI-E AER 30: 00000000 00000000 [ 3222.586872] RTAS: event: 5, Type: P= latform Error (224), Severity: 2 [ 3222.586873] EEH: Reset without hotplug = activity [ 3224.762767] EEH: Beginning: 'slot_reset' [ 3224.762770] EEH: PE#800000 (PCI 0384:80:00.0): Invoking bnx2x->slot_reset() [ 3224.762771] bnx2x: [bnx2x_io_slot_reset:14271(eth14)]IO slot reset initi= alizing... [ 3224.762887] bnx2x 0384:80:00.0: enabling device (0140 -> 0142) [ 3224.76= 8157] bnx2x: [bnx2x_io_slot_reset:14287(eth14)]IO slot reset --> driver unload Uninterruptible tasks =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D crash> ps | grep UN 213 2 11 c000000004c89e00 UN 0.0 0 0 [eehd] 215 2 0 c000000004c80000 UN 0.0 0 0 [kworker/0:2] 2196 1 28 c000000004504f00 UN 0.1 15936 11136 wickedd 4287 1 9 c00000020d076800 UN 0.0 4032 3008 agetty 4289 1 20 c00000020d056680 UN 0.0 7232 3840 agetty 32423 2 26 c00000020038c580 UN 0.0 0 0 [kworker/26:3] 32871 4241 27 c0000002609ddd00 UN 0.1 18624 11648 sshd 32920 10130 16 c00000027284a100 UN 0.1 48512 12608 sendmail 33092 32987 0 c000000205218b00 UN 0.1 48512 12608 sendmail 33154 4567 16 c000000260e51780 UN 0.1 48832 12864 pickup 33209 4241 36 c000000270cb6500 UN 0.1 18624 11712 sshd 33473 33283 0 c000000205211480 UN 0.1 48512 12672 sendmail 33531 4241 37 c00000023c902780 UN 0.1 18624 11648 sshd EEH handler hung while bnx2x sleeping and holding RTNL lock =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D crash> bt 213 PID: 213 TASK: c000000004c89e00 CPU: 11 COMMAND: "eehd" #0 [c000000004d477e0] __schedule at c000000000c70808 #1 [c000000004d478b0] schedule at c000000000c70ee0 #2 [c000000004d478e0] schedule_timeout at c000000000c76dec #3 [c000000004d479c0] msleep at c0000000002120cc #4 [c000000004d479f0] napi_disable at c000000000a06448 ^^^^^^^^^^^^^^^^ #5 [c000000004d47a30] bnx2x_netif_stop at c0080000018dba94 [bnx2x] #6 [c000000004d47a60] bnx2x_io_slot_reset at c0080000018a551c [bnx2x] #7 [c000000004d47b20] eeh_report_reset at c00000000004c9bc #8 [c000000004d47b90] eeh_pe_report at c00000000004d1a8 #9 [c000000004d47c40] eeh_handle_normal_event at c00000000004da64 And the sleeping source code =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D crash> dis -ls c000000000a06448 FILE: ../net/core/dev.c LINE: 6702 6697 { 6698 might_sleep(); 6699 set_bit(NAPI_STATE_DISABLE, &n->state); 6700 6701 while (test_and_set_bit(NAPI_STATE_SCHED, &n->state)) * 6702 msleep(1); 6703 while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state)) 6704 msleep(1); 6705 6706 hrtimer_cancel(&n->timer); 6707 6708 clear_bit(NAPI_STATE_DISABLE, &n->state); 6709 } EEH calls into bnx2x twice based on the system log above, first through bnx2x_io_error_detected() and then bnx2x_io_slot_reset(), and executes the following call chains: bnx2x_io_error_detected() +-> bnx2x_eeh_nic_unload() +-> bnx2x_del_all_napi() +-> __netif_napi_del() bnx2x_io_slot_reset() +-> bnx2x_netif_stop() +-> bnx2x_napi_disable() +->napi_disable() Fix this by correcting the sequence of NAPI APIs usage, that is delete the NAPI after disabling it. Fixes: 7fa6f34081f1 ("bnx2x: AER revised") Reported-by: David Christensen Tested-by: David Christensen Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Link: https://lore.kernel.org/r/20220426153913.6966-1-manishc@marvell.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net= /ethernet/broadcom/bnx2x/bnx2x_main.c index df4f77ad95c4..91ddde4d647c 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c @@ -14297,10 +14297,6 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp) =20 /* Stop Tx */ bnx2x_tx_disable(bp); - /* Delete all NAPI objects */ - bnx2x_del_all_napi(bp); - if (CNIC_LOADED(bp)) - bnx2x_del_all_napi_cnic(bp); netdev_reset_tc(bp->dev); =20 del_timer_sync(&bp->timer); @@ -14405,6 +14401,11 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct= pci_dev *pdev) bnx2x_drain_tx_queues(bp); bnx2x_send_unload_req(bp, UNLOAD_RECOVERY); bnx2x_netif_stop(bp, 1); + bnx2x_del_all_napi(bp); + + if (CNIC_LOADED(bp)) + bnx2x_del_all_napi_cnic(bp); + bnx2x_free_irq(bp); =20 /* Report UNLOAD_DONE to MCP */ --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E02DC4707A for ; Tue, 10 May 2022 13:35:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244283AbiEJNhU (ORCPT ); Tue, 10 May 2022 09:37:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243467AbiEJN0x (ORCPT ); Tue, 10 May 2022 09:26:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CD8DD2375DE; Tue, 10 May 2022 06:19:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63EF0B81D9A; Tue, 10 May 2022 13:19:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BE5ABC385C2; Tue, 10 May 2022 13:19:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188783; bh=kP8vkEbi7l6zQ+HStJBxrehrXF5ycY+sgq3il3p6mlc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jWS1XHVJd8mnRji2sn0URXMDkLqsWoBNDS3jMOqJDSEbaJBIkZD63NuKdtJPDlyIH +BW/a/tecjABOWmaEIouvO51YMyAXfuPlIESgEwWdL8NBoIhFgRCAXRRibfgmgRSws hsc6c6ZxDOcYXlMlU9Ro7pjuyHXkOxtgf4KodzfM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Mark Brown , Sasha Levin Subject: [PATCH 4.19 43/88] ASoC: wm8731: Disable the regulator when probing fails Date: Tue, 10 May 2022 15:07:28 +0200 Message-Id: <20220510130734.999412295@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit 92ccbf17eeacf510cf1eed9c252d9332ca24f02d ] When the driver fails during probing, the driver should disable the regulator, not just handle it in wm8731_hw_init(). The following log reveals it: [ 17.812483] WARNING: CPU: 1 PID: 364 at drivers/regulator/core.c:2257 _r= egulator_put+0x3ec/0x4e0 [ 17.815958] RIP: 0010:_regulator_put+0x3ec/0x4e0 [ 17.824467] Call Trace: [ 17.824774] [ 17.825040] regulator_bulk_free+0x82/0xe0 [ 17.825514] devres_release_group+0x319/0x3d0 [ 17.825882] i2c_device_probe+0x766/0x940 [ 17.829198] i2c_register_driver+0xb5/0x130 Signed-off-by: Zheyu Ma Link: https://lore.kernel.org/r/20220405121038.4094051-1-zheyuma97@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/soc/codecs/wm8731.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c index 7c8fad865d6b..3c5c02b034a9 100644 --- a/sound/soc/codecs/wm8731.c +++ b/sound/soc/codecs/wm8731.c @@ -604,7 +604,7 @@ static int wm8731_hw_init(struct device *dev, struct wm= 8731_priv *wm8731) ret =3D wm8731_reset(wm8731->regmap); if (ret < 0) { dev_err(dev, "Failed to issue reset: %d\n", ret); - goto err_regulator_enable; + goto err; } =20 /* Clear POWEROFF, keep everything else disabled */ @@ -621,10 +621,7 @@ static int wm8731_hw_init(struct device *dev, struct w= m8731_priv *wm8731) =20 regcache_mark_dirty(wm8731->regmap); =20 -err_regulator_enable: - /* Regulators will be enabled by bias management */ - regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); - +err: return ret; } =20 @@ -768,21 +765,27 @@ static int wm8731_i2c_probe(struct i2c_client *i2c, ret =3D PTR_ERR(wm8731->regmap); dev_err(&i2c->dev, "Failed to allocate register map: %d\n", ret); - return ret; + goto err_regulator_enable; } =20 ret =3D wm8731_hw_init(&i2c->dev, wm8731); if (ret !=3D 0) - return ret; + goto err_regulator_enable; =20 ret =3D devm_snd_soc_register_component(&i2c->dev, &soc_component_dev_wm8731, &wm8731_dai, 1); if (ret !=3D 0) { dev_err(&i2c->dev, "Failed to register CODEC: %d\n", ret); - return ret; + goto err_regulator_enable; } =20 return 0; + +err_regulator_enable: + /* Regulators will be enabled by bias management */ + regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); + + return ret; } =20 static int wm8731_i2c_remove(struct i2c_client *client) --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64D91C352AA for ; Tue, 10 May 2022 13:35:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244298AbiEJNh0 (ORCPT ); Tue, 10 May 2022 09:37:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243480AbiEJN0y (ORCPT ); Tue, 10 May 2022 09:26:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 31B39237BA6; Tue, 10 May 2022 06:19:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6D38C61532; Tue, 10 May 2022 13:19:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7E8CEC385A6; Tue, 10 May 2022 13:19:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188785; bh=jxEYhLXnDhoasLkMPJ3FCn7DdkdeY51RCTlf2BMdVK8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sac/kbq0rn4jHSu2f++GTvo3CHpiFlra+DRi33p5iykCtQFIppNkVDbNaRRwLm/sT aP/vFlL/IRdC0NTio/AIrVokdgREhKPam0ZJASYZ2Pg6/FRHBQpIJAKd4fgHK/mwwD XStKOwejvxxTmtLyEJ+BFhrAiUnZzbbZxyE4kwAI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Cong Wang , Peilin Ye , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 44/88] ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() Date: Tue, 10 May 2022 15:07:29 +0200 Message-Id: <20220510130735.028594116@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peilin Ye [ Upstream commit f40c064e933d7787ca7411b699504d7a2664c1f5 ] Do not update tunnel->tun_hlen in data plane code. Use a local variable instead, just like "tunnel_hlen" in net/ipv4/ip_gre.c:gre_fb_xmit(). Co-developed-by: Cong Wang Signed-off-by: Cong Wang Signed-off-by: Peilin Ye Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/ip6_gre.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c index 043e57d08a3e..4fd6c0929b14 100644 --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -750,6 +750,7 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, struct ip_tunnel_info *tun_info; const struct ip_tunnel_key *key; __be16 flags; + int tun_hlen; =20 tun_info =3D skb_tunnel_info(skb); if (unlikely(!tun_info || @@ -767,9 +768,9 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, dsfield =3D key->tos; flags =3D key->tun_flags & (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ); - tunnel->tun_hlen =3D gre_calc_hlen(flags); + tun_hlen =3D gre_calc_hlen(flags); =20 - gre_build_header(skb, tunnel->tun_hlen, + gre_build_header(skb, tun_hlen, flags, protocol, tunnel_id_to_key32(tun_info->key.tun_id), (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90F19C433F5 for ; Tue, 10 May 2022 13:35:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244313AbiEJNh2 (ORCPT ); Tue, 10 May 2022 09:37:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50068 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243500AbiEJN04 (ORCPT ); Tue, 10 May 2022 09:26:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1291F2375EA; Tue, 10 May 2022 06:19:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4C735615F8; Tue, 10 May 2022 13:19:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 561C9C385A6; Tue, 10 May 2022 13:19:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188788; bh=Q4Y3SyK/jeyCZmbyzItTJ1Zzlro6NPXoyjvomzCp6lw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JrUML8G4HV2qMta6dzFeo7wJnRUmKewSerGL2AaKKZ7HGWevkha2VSQzU8sh3zIuV NQnQZfTx6JepTnI2me/uOZBl4NCZD5g7glXYY0OPvqciOYVw3WV7AoUiFJTL9MQSte gxD4+BRdjhViDfbt+UBBIqSM7q7prWrvHujPp8H4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Linus Torvalds , Sasha Levin Subject: [PATCH 4.19 45/88] x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 Date: Tue, 10 May 2022 15:07:30 +0200 Message-Id: <20220510130735.057838356@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka [ Upstream commit a6823e4e360fe975bd3da4ab156df7c74c8b07f3 ] The first "if" condition in __memcpy_flushcache is supposed to align the "dest" variable to 8 bytes and copy data up to this alignment. However, this condition may misbehave if "size" is greater than 4GiB. The statement min_t(unsigned, size, ALIGN(dest, 8) - dest); casts both arguments to unsigned int and selects the smaller one. However, the cast truncates high bits in "size" and it results in misbehavior. For example: suppose that size =3D=3D 0x100000001, dest =3D=3D 0x200000002 min_t(unsigned, size, ALIGN(dest, 8) - dest) =3D=3D min_t(0x1, 0xe) =3D=3D= 0x1; ... dest +=3D 0x1; so we copy just one byte "and" dest remains unaligned. This patch fixes the bug by replacing unsigned with size_t. Signed-off-by: Mikulas Patocka Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/lib/usercopy_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c index 40dbbd8f1fe4..8c6d0fb72b3a 100644 --- a/arch/x86/lib/usercopy_64.c +++ b/arch/x86/lib/usercopy_64.c @@ -161,7 +161,7 @@ void memcpy_flushcache(void *_dst, const void *_src, si= ze_t size) =20 /* cache copy and flush to align dest */ if (!IS_ALIGNED(dest, 8)) { - unsigned len =3D min_t(unsigned, size, ALIGN(dest, 8) - dest); + size_t len =3D min_t(size_t, size, ALIGN(dest, 8) - dest); =20 memcpy((void *) dest, (void *) source, len); clean_cache_range((void *) dest, len); --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35DC4C433F5 for ; Tue, 10 May 2022 13:36:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243690AbiEJNkN (ORCPT ); Tue, 10 May 2022 09:40:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33248 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243507AbiEJN05 (ORCPT ); Tue, 10 May 2022 09:26:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 84DDD1B33C2; Tue, 10 May 2022 06:19:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 207E861532; Tue, 10 May 2022 13:19:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D002C385C2; Tue, 10 May 2022 13:19:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188791; bh=7GAuG015USrv20+qpuwNBVLPVFfXyP5uE6MrbuBZcTg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T3bJWjcUEFNLbE0aka3ip+AoJmp9WJ2uLmSEnQuFc34Urmkk885zncqdxXvfOXEi0 THiB26u7O3nLkuoQ0ZWYcWoas9IXBEFzJK22n95DTFYpGXU2Eo3I/7MoIeV9Rxmnvk mTgqt4pX9Tc6gy22/JdARaUlN5ZqsX0kp0rkw+hA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaoli Feng , Ronnie Sahlberg , Steve French , Sasha Levin Subject: [PATCH 4.19 46/88] cifs: destage any unwritten data to the server before calling copychunk_write Date: Tue, 10 May 2022 15:07:31 +0200 Message-Id: <20220510130735.087097286@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ronnie Sahlberg [ Upstream commit f5d0f921ea362636e4a2efb7c38d1ead373a8700 ] because the copychunk_write might cover a region of the file that has not y= et been sent to the server and thus fail. A simple way to reproduce this is: truncate -s 0 /mnt/testfile; strace -f -o x -ttT xfs_io -i -f -c 'pwrite 0k= 128k' -c 'fcollapse 16k 24k' /mnt/testfile the issue is that the 'pwrite 0k 128k' becomes rearranged on the wire with the 'fcollapse 16k 24k' due to write-back caching. fcollapse is implemented in cifs.ko as a SMB2 IOCTL(COPYCHUNK_WRITE) call and it will fail serverside since the file is still 0b in size serverside until the writes have been destaged. To avoid this we must ensure that we destage any unwritten data to the server before calling COPYCHUNK_WRITE. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=3D1997373 Reported-by: Xiaoli Feng Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/cifs/smb2ops.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 61955a7c838b..cc34a28aecbc 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -1144,9 +1144,17 @@ smb2_copychunk_range(const unsigned int xid, int chunks_copied =3D 0; bool chunk_sizes_updated =3D false; ssize_t bytes_written, total_bytes_written =3D 0; + struct inode *inode; =20 pcchunk =3D kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL); =20 + /* + * We need to flush all unwritten data before we can send the + * copychunk ioctl to the server. + */ + inode =3D d_inode(trgtfile->dentry); + filemap_write_and_wait(inode->i_mapping); + if (pcchunk =3D=3D NULL) return -ENOMEM; =20 --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D228FC38A04 for ; Tue, 10 May 2022 13:35:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244397AbiEJNhd (ORCPT ); Tue, 10 May 2022 09:37:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56076 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243524AbiEJN06 (ORCPT ); Tue, 10 May 2022 09:26:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 48CA32380E0; Tue, 10 May 2022 06:19:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D1E366165A; Tue, 10 May 2022 13:19:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC73AC385C2; Tue, 10 May 2022 13:19:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188794; bh=V8YUgaezTT2Bmh9ZPpBjU6t2I/wCUUmu7gMVP/8UlnY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CZ59v9n+Q1ufUVs6CEMwlhvr/NL5XfZHpmW12JQ1Mu5FFkz6ylESIj4JS80ZaVNQi veSFXXb0CHKNbG2Uuvi6bgMTx/opTc4VfhvaXGn/b5b83/Ou4SNEWsyV57rAZa9Pmg y71nuJS3ERs7TDEwQp0RsEjm2HjxPa/h0P77VOeo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Paolo Abeni , Sasha Levin Subject: [PATCH 4.19 47/88] drivers: net: hippi: Fix deadlock in rr_close() Date: Tue, 10 May 2022 15:07:32 +0200 Message-Id: <20220510130735.116361087@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit bc6de2878429e85c1f1afaa566f7b5abb2243eef ] There is a deadlock in rr_close(), which is shown below: (Thread 1) | (Thread 2) | rr_open() rr_close() | add_timer() spin_lock_irqsave() //(1) | (wait a time) ... | rr_timer() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold rrpriv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need rrpriv->lock in position (2) of thread 2. As a result, rr_close() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220417125519.82618-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/hippi/rrunner.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c index 2a8c33abb363..a24c55a6c79a 100644 --- a/drivers/net/hippi/rrunner.c +++ b/drivers/net/hippi/rrunner.c @@ -1352,7 +1352,9 @@ static int rr_close(struct net_device *dev) =20 rrpriv->fw_running =3D 0; =20 + spin_unlock_irqrestore(&rrpriv->lock, flags); del_timer_sync(&rrpriv->timer); + spin_lock_irqsave(&rrpriv->lock, flags); =20 writel(0, ®s->TxPi); writel(0, ®s->IpRxPi); --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61A97C38A2C for ; Tue, 10 May 2022 13:38:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244208AbiEJNlm (ORCPT ); Tue, 10 May 2022 09:41:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57064 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243536AbiEJN07 (ORCPT ); Tue, 10 May 2022 09:26:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E93022380E1; Tue, 10 May 2022 06:19:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 851D161532; Tue, 10 May 2022 13:19:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97BF7C385C9; Tue, 10 May 2022 13:19:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188797; bh=+IHCmlfZLlbxV1NwVzghPxvmkXQ1TyiCwy+ytS5Gm3s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lWNq+C1eJj0yeCkjilNDMJlsKwcBubLm83SFnlotyjimn/WzX3ZW2oOA28INqS7CH Az6CYpQ99yUqspHJYI0D9ikJmJeyu+pCYM4JWFccT9UKClv7eP2KRft3dUnQl3+/cS APFVctVfBxhJpxL7o5UcNQU3ROX/EDeoZ9CXen1M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Kyle D. Pelton" , Borislav Petkov , Pawan Gupta Subject: [PATCH 4.19 48/88] x86/cpu: Load microcode during restore_processor_state() Date: Tue, 10 May 2022 15:07:33 +0200 Message-Id: <20220510130735.145025332@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Borislav Petkov commit f9e14dbbd454581061c736bf70bf5cbb15ac927c upstream. When resuming from system sleep state, restore_processor_state() restores the boot CPU MSRs. These MSRs could be emulated by microcode. If microcode is not loaded yet, writing to emulated MSRs leads to unchecked MSR access error: ... PM: Calling lapic_suspend+0x0/0x210 unchecked MSR access error: WRMSR to 0x10f (tried to write 0x0...0) at rI= P: ... (native_write_msr) Call Trace: ? restore_processor_state x86_acpi_suspend_lowlevel acpi_suspend_enter suspend_devices_and_enter pm_suspend.cold state_store kobj_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write __x64_sys_write do_syscall_64 entry_SYSCALL_64_after_hwframe RIP: 0033:0x7fda13c260a7 To ensure microcode emulated MSRs are available for restoration, load the microcode on the boot CPU before restoring these MSRs. [ Pawan: write commit message and productize it. ] Fixes: e2a1256b17b1 ("x86/speculation: Restore speculation related MSRs dur= ing S3 resume") Reported-by: Kyle D. Pelton Signed-off-by: Borislav Petkov Signed-off-by: Pawan Gupta Tested-by: Kyle D. Pelton Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215841 Link: https://lore.kernel.org/r/4350dfbf785cd482d3fafa72b2b49c83102df3ce.16= 50386317.git.pawan.kumar.gupta@linux.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/include/asm/microcode.h | 2 ++ arch/x86/kernel/cpu/microcode/core.c | 6 +++--- arch/x86/power/cpu.c | 8 ++++++++ 3 files changed, 13 insertions(+), 3 deletions(-) --- a/arch/x86/include/asm/microcode.h +++ b/arch/x86/include/asm/microcode.h @@ -133,11 +133,13 @@ extern void load_ucode_ap(void); void reload_early_microcode(void); extern bool get_builtin_firmware(struct cpio_data *cd, const char *name); extern bool initrd_gone; +void microcode_bsp_resume(void); #else static inline int __init microcode_init(void) { return 0; }; static inline void __init load_ucode_bsp(void) { } static inline void load_ucode_ap(void) { } static inline void reload_early_microcode(void) { } +static inline void microcode_bsp_resume(void) { } static inline bool get_builtin_firmware(struct cpio_data *cd, const char *name) { return fals= e; } #endif --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c @@ -773,9 +773,9 @@ static struct subsys_interface mc_cpu_in }; =20 /** - * mc_bp_resume - Update boot CPU microcode during resume. + * microcode_bsp_resume - Update boot CPU microcode during resume. */ -static void mc_bp_resume(void) +void microcode_bsp_resume(void) { int cpu =3D smp_processor_id(); struct ucode_cpu_info *uci =3D ucode_cpu_info + cpu; @@ -787,7 +787,7 @@ static void mc_bp_resume(void) } =20 static struct syscore_ops mc_syscore_ops =3D { - .resume =3D mc_bp_resume, + .resume =3D microcode_bsp_resume, }; =20 static int mc_cpu_starting(unsigned int cpu) --- a/arch/x86/power/cpu.c +++ b/arch/x86/power/cpu.c @@ -26,6 +26,7 @@ #include #include #include +#include =20 #ifdef CONFIG_X86_32 __visible unsigned long saved_context_ebx; @@ -268,6 +269,13 @@ static void notrace __restore_processor_ x86_platform.restore_sched_clock_state(); mtrr_bp_restore(); perf_restore_debug_store(); + + microcode_bsp_resume(); + + /* + * This needs to happen after the microcode has been updated upon resume + * because some of the MSRs are "emulated" in microcode. + */ msr_restore_context(ctxt); } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68769C4332F for ; Tue, 10 May 2022 13:36:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242146AbiEJNkd (ORCPT ); Tue, 10 May 2022 09:40:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243585AbiEJN1H (ORCPT ); Tue, 10 May 2022 09:27:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2ED6D238D69; Tue, 10 May 2022 06:20:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D3D27B81D0D; Tue, 10 May 2022 13:20:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 319FCC385C2; Tue, 10 May 2022 13:20:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188802; bh=6+rjE9zh4GATjXkM46Hk/BnlVF8MeLJ7vpypB9Ynn/I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ryu2HmD627E+CjrCpRh4hcK7wEoMrNoFP1EgslCouwWZG5LWtpJ7GuNZJPtc78qcW NV23eFqeUsP7cwC29lk14MuwN6c2ZdAN5oXD4lAc/gKk2VN9naJ71zKlKrlQver5sB sK66ip1jOMvYrdEndLxPtu0bVgeJN0fw+gjbeqt4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.19 49/88] tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 Date: Tue, 10 May 2022 15:07:34 +0200 Message-Id: <20220510130735.173693857@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 06d5afd4d640eea67f5623e76cd5fc03359b7f3c upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.5.2 describes that the signal octet in convergence layer type 2 can be either one or two bytes. The length is encoded in the EA bit. This is set 1 for the last byte in the sequence. gsmtty_modem_update() handles this correctly but gsm_dlci_data_output() fails to set EA to 1. There is no case in which we encode two signal octets as there is no case in which we send out a break signal. Therefore, always set the EA bit to 1 for the signal octet to fix this. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-5-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -823,7 +823,7 @@ static int gsm_dlci_data_output(struct g break; case 2: /* Unstructed with modem bits. Always one byte as we never send inline break data */ - *dp++ =3D gsm_encode_modem(dlci); + *dp++ =3D (gsm_encode_modem(dlci) << 1) | EA; break; } WARN_ON(kfifo_out_locked(dlci->fifo, dp , len, &dlci->lock) !=3D len); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 660A9C4332F for ; Tue, 10 May 2022 13:36:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243700AbiEJNkV (ORCPT ); Tue, 10 May 2022 09:40:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243600AbiEJN1K (ORCPT ); Tue, 10 May 2022 09:27:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C3DCB238D7D; Tue, 10 May 2022 06:20:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6F6AEB81DA4; Tue, 10 May 2022 13:20:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DDB6AC36B04; Tue, 10 May 2022 13:20:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188805; bh=6VN4nF8+UJQIq1boe5a/TbKIpy/mG9j7/xUzjRHZDa0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sqKQf8BcGmokNBFnp1L1WqMh1sQv1PAuQLou0AqEX7K9jMVLd7AxagAhulWQ9XNTu cJq5tasQP7LLYCDOVLopHribe2aQYToAFzsj86VR+K2qWU/FZwPGa19UiO09iCr0Us q/F4D2YG2OwKF91p8sEFEBqA6MrxrOpmEUCygkxw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.19 50/88] tty: n_gsm: fix malformed counter for out of frame data Date: Tue, 10 May 2022 15:07:35 +0200 Message-Id: <20220510130735.202359162@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit a24b4b2f660b7ddf3f484b37600bba382cb28a9d upstream. The gsm_mux field 'malformed' represents the number of malformed frames received. However, gsm1_receive() also increases this counter for any out of frame byte. Fix this by ignoring out of frame data for the malformed counter. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-7-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1959,7 +1959,8 @@ static void gsm1_receive(struct gsm_mux } /* Any partial frame was a runt so go back to start */ if (gsm->state !=3D GSM_START) { - gsm->malformed++; + if (gsm->state !=3D GSM_SEARCH) + gsm->malformed++; gsm->state =3D GSM_START; } /* A SOF in GSM_START means we are still reading idling or From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 128FBC38A05 for ; Tue, 10 May 2022 13:35:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244487AbiEJNhp (ORCPT ); Tue, 10 May 2022 09:37:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47754 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243625AbiEJN1M (ORCPT ); Tue, 10 May 2022 09:27:12 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7AE6B2397B0; Tue, 10 May 2022 06:20:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 97118CE1EA8; Tue, 10 May 2022 13:20:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A8F3BC385A6; Tue, 10 May 2022 13:20:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188808; bh=ri5FZx4k/xV0y56XosfN461TREudlontDU4CQIoNdhY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ay96emvMhukxDUoZYV+k0ovpmZVDcsSBjCvAIb5nV6E8CzGwzTTItHI0rhsYeVogg +QQm0TKe1woa+ErxpBvqb6OLbiDcvrRrbpN1p34dZ7uGmZb72cmtXHGW3Alr+qVJsa +i01k5aOgqJK2OPo8WwUXBip5VlFWOlaIz4wBJ3g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Westphal , Pablo Neira Ayuso , Topi Miettinen Subject: [PATCH 4.19 51/88] netfilter: nft_socket: only do sk lookups when indev is available Date: Tue, 10 May 2022 15:07:36 +0200 Message-Id: <20220510130735.230701489@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal commit 743b83f15d4069ea57c3e40996bf4a1077e0cdc1 upstream. Check if the incoming interface is available and NFT_BREAK in case neither skb->sk nor input device are set. Because nf_sk_lookup_slow*() assume packet headers are in the 'in' direction, use in postrouting is not going to yield a meaningful result. Same is true for the forward chain, so restrict the use to prerouting, input and output. Use in output work if a socket is already attached to the skb. Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket m= atching") Reported-and-tested-by: Topi Miettinen Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/netfilter/nft_socket.c | 52 ++++++++++++++++++++++++++++++++--------= ----- 1 file changed, 38 insertions(+), 14 deletions(-) --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -14,6 +14,32 @@ struct nft_socket { }; }; =20 +static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt) +{ + const struct net_device *indev =3D nft_in(pkt); + const struct sk_buff *skb =3D pkt->skb; + struct sock *sk =3D NULL; + + if (!indev) + return NULL; + + switch (nft_pf(pkt)) { + case NFPROTO_IPV4: + sk =3D nf_sk_lookup_slow_v4(nft_net(pkt), skb, indev); + break; +#if IS_ENABLED(CONFIG_NF_TABLES_IPV6) + case NFPROTO_IPV6: + sk =3D nf_sk_lookup_slow_v6(nft_net(pkt), skb, indev); + break; +#endif + default: + WARN_ON_ONCE(1); + break; + } + + return sk; +} + static void nft_socket_eval(const struct nft_expr *expr, struct nft_regs *regs, const struct nft_pktinfo *pkt) @@ -27,20 +53,7 @@ static void nft_socket_eval(const struct sk =3D NULL; =20 if (!sk) - switch(nft_pf(pkt)) { - case NFPROTO_IPV4: - sk =3D nf_sk_lookup_slow_v4(nft_net(pkt), skb, nft_in(pkt)); - break; -#if IS_ENABLED(CONFIG_NF_TABLES_IPV6) - case NFPROTO_IPV6: - sk =3D nf_sk_lookup_slow_v6(nft_net(pkt), skb, nft_in(pkt)); - break; -#endif - default: - WARN_ON_ONCE(1); - regs->verdict.code =3D NFT_BREAK; - return; - } + sk =3D nft_socket_do_lookup(pkt); =20 if (!sk) { regs->verdict.code =3D NFT_BREAK; @@ -123,6 +136,16 @@ static int nft_socket_dump(struct sk_buf return 0; } =20 +static int nft_socket_validate(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nft_data **data) +{ + return nft_chain_validate_hooks(ctx->chain, + (1 << NF_INET_PRE_ROUTING) | + (1 << NF_INET_LOCAL_IN) | + (1 << NF_INET_LOCAL_OUT)); +} + static struct nft_expr_type nft_socket_type; static const struct nft_expr_ops nft_socket_ops =3D { .type =3D &nft_socket_type, @@ -130,6 +153,7 @@ static const struct nft_expr_ops nft_soc .eval =3D nft_socket_eval, .init =3D nft_socket_init, .dump =3D nft_socket_dump, + .validate =3D nft_socket_validate, }; =20 static struct nft_expr_type nft_socket_type __read_mostly =3D { From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECF8FC43217 for ; Tue, 10 May 2022 13:35:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244457AbiEJNhg (ORCPT ); Tue, 10 May 2022 09:37:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56076 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243629AbiEJN1N (ORCPT ); Tue, 10 May 2022 09:27:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5012A239785; Tue, 10 May 2022 06:20:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6DFEA6165A; Tue, 10 May 2022 13:20:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 798CFC385A6; Tue, 10 May 2022 13:20:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188810; bh=sxiCbN+ILenB/XDVWSQ/sMfxDL0mOTmzR0g3TcbK7nA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bYdJ9QJ4IAxSOe/TBghxKMTaQMOutxMt7caIFb4PMm+LyoaDsdCj3KNDFEQ0VnbOL wBOSA/kBHw4aJJ1HZYfMeAQ0r+DCdgNdx31JHA4DipZttouGuRSCRZyMAdqyp9Pmi4 URokS8qshOcob8Idy+JvViYObmMi4la399FIGYqY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.19 52/88] tty: n_gsm: fix insufficient txframe size Date: Tue, 10 May 2022 15:07:37 +0200 Message-Id: <20220510130735.258680258@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 535bf600de75a859698892ee873521a48d289ec1 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.7.2 states that the maximum frame size (N1) refers to the length of the information field (i.e. user payload). However, 'txframe' stores the whole frame including frame header, checksum and start/end flags. We also need to consider the byte stuffing overhead. Define constant for the protocol overhead and adjust the 'txframe' size calculation accordingly to reserve enough space for a complete mux frame including byte stuffing for advanced option mode. Note that no byte stuffing is applied to the start and end flag. Also use MAX_MTU instead of MAX_MRU as this buffer is used for data transmission. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-8-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -72,6 +72,8 @@ module_param(debug, int, 0600); */ #define MAX_MRU 1500 #define MAX_MTU 1500 +/* SOF, ADDR, CTRL, LEN1, LEN2, ..., FCS, EOF */ +#define PROT_OVERHEAD 7 #define GSM_NET_TX_TIMEOUT (HZ*10) =20 /** @@ -2197,7 +2199,7 @@ static struct gsm_mux *gsm_alloc_mux(voi kfree(gsm); return NULL; } - gsm->txframe =3D kmalloc(2 * MAX_MRU + 2, GFP_KERNEL); + gsm->txframe =3D kmalloc(2 * (MAX_MTU + PROT_OVERHEAD - 1), GFP_KERNEL); if (gsm->txframe =3D=3D NULL) { kfree(gsm->buf); kfree(gsm); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C128AC38A06 for ; Tue, 10 May 2022 13:35:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244777AbiEJNiD (ORCPT ); Tue, 10 May 2022 09:38:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44432 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243667AbiEJN1P (ORCPT ); Tue, 10 May 2022 09:27:15 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF393239DB6; Tue, 10 May 2022 06:20:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 40FE8B81CF8; Tue, 10 May 2022 13:20:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9344AC385A6; Tue, 10 May 2022 13:20:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188814; bh=yu9sE/T90FsB+AVfl0at0UisupwhGrSZoDwZSWb/y0g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xO1DxS/wzSzvOmnjBbDivZBAbS9+UdD7PysHoxE9CDoPek0REG9Kr5kGGh5A/ILdz ANaSCglxN/PtVlpXfAjHsVRxdRHbivlA9g1jWwMebcKTMCIdUoW6Kr6I+vPlvmItx3 7U4lHwNLMEkwzKLS/RsTabORltt86NCT4Ajo+Pf8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.19 53/88] tty: n_gsm: fix missing explicit ldisc flush Date: Tue, 10 May 2022 15:07:38 +0200 Message-Id: <20220510130735.286583909@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 17eac652028501df7ea296b1d9b9c134db262b7d upstream. In gsm_cleanup_mux() the muxer is closed down and all queues are removed. However, removing the queues is done without explicit control of the underlying buffers. Flush those before freeing up our queues to ensure that all outgoing queues are cleared consistently. Otherwise, a new mux connection establishment attempt may time out while the underlying tty is still busy sending out the remaining data from the previous connection. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-10-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2099,6 +2099,7 @@ static void gsm_cleanup_mux(struct gsm_m gsm_dlci_release(gsm->dlci[i]); mutex_unlock(&gsm->mutex); /* Now wipe the queues */ + tty_ldisc_flush(gsm->tty); list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) kfree(txq); INIT_LIST_HEAD(&gsm->tx_list); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 772EDC433FE for ; Tue, 10 May 2022 13:35:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244539AbiEJNhs (ORCPT ); Tue, 10 May 2022 09:37:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56310 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243677AbiEJN1Q (ORCPT ); Tue, 10 May 2022 09:27:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DCFCE23BB68; Tue, 10 May 2022 06:20:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6EFF361718; Tue, 10 May 2022 13:20:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77157C385C2; Tue, 10 May 2022 13:20:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188816; bh=Uxla52M27+0qSzgfL2qiyHT91PQLi/q28UXlL77YfxI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z7Ladz9hJHRgRqGjowHcxdTqULWWUnYBxB4uFogHfjgmYaK+Bou0Zj1KQk42ff6wd 0rDmOOIoCbeHltKdJ5ucxViZwqbdDuJzY6FeBepVMNBm0oWjw7Yaq8TfeYHFFUZo1F ct/kN/ibKY9ABEgEpOAIxrri0S0tAdut1IJF+IbE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.19 54/88] tty: n_gsm: fix wrong command retry handling Date: Tue, 10 May 2022 15:07:39 +0200 Message-Id: <20220510130735.314933416@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit d0bcdffcad5a22f202e3bf37190c0dd8c080ea92 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.7.3 states that the valid range for the maximum number of retransmissions (N2) is from 0 to 255 (both including). gsm_config() fails to limit this range correctly. Furthermore, gsm_control_retransmit() handles this number incorrectly by performing N2 - 1 retransmission attempts. Setting N2 to zero results in more than 255 retransmission attempts. Fix the range check in gsm_config() and the value handling in gsm_control_send() and gsm_control_retransmit() to comply with 3GPP 27.010. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-11-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1329,7 +1329,6 @@ static void gsm_control_retransmit(struc spin_lock_irqsave(&gsm->control_lock, flags); ctrl =3D gsm->pending_cmd; if (ctrl) { - gsm->cretries--; if (gsm->cretries =3D=3D 0) { gsm->pending_cmd =3D NULL; ctrl->error =3D -ETIMEDOUT; @@ -1338,6 +1337,7 @@ static void gsm_control_retransmit(struc wake_up(&gsm->event); return; } + gsm->cretries--; gsm_control_transmit(gsm, ctrl); mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100); } @@ -1378,7 +1378,7 @@ retry: =20 /* If DLCI0 is in ADM mode skip retries, it won't respond */ if (gsm->dlci[0]->mode =3D=3D DLCI_MODE_ADM) - gsm->cretries =3D 1; + gsm->cretries =3D 0; else gsm->cretries =3D gsm->n2; =20 @@ -2517,7 +2517,7 @@ static int gsmld_config(struct tty_struc /* Check the MRU/MTU range looks sane */ if (c->mru > MAX_MRU || c->mtu > MAX_MTU || c->mru < 8 || c->mtu < 8) return -EINVAL; - if (c->n2 < 3) + if (c->n2 > 255) return -EINVAL; if (c->encapsulation > 1) /* Basic, advanced, no I */ return -EINVAL; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 068B7C43217 for ; Tue, 10 May 2022 13:38:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243778AbiEJNlN (ORCPT ); Tue, 10 May 2022 09:41:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243693AbiEJN1R (ORCPT ); Tue, 10 May 2022 09:27:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A082E25D111; Tue, 10 May 2022 06:20:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 39B786165A; Tue, 10 May 2022 13:20:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 48DFCC385A6; Tue, 10 May 2022 13:20:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188819; bh=sN5HR7f9AJoRolKAArwQTOKUueVNLwfQy/wUH8Trtu8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1u+t7QMRhMxyIBZmSzfUqsMQV2i2rlwSHHVXEkXrCsP/Uhs7EPnByEOjcvDbSm2CX +DVbQDyW1tDIYCmjSTEU5Mpv7Q6NAqUyql1FBc6faXubkySVFbMlUnHz5IxnLYD6wf VVt1SGUM6088/ib4NpgZb81bLPnrGr5uONE4Hs2w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.19 55/88] tty: n_gsm: fix wrong command frame length field encoding Date: Tue, 10 May 2022 15:07:40 +0200 Message-Id: <20220510130735.343311933@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 398867f59f956985f4c324f173eff7b946e14bd8 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.4.6.1 states that each command frame shall be made up from type, length and value. Looking for example in chapter 5.4.6.3.5 at the description for the encoding of a flow control on command it becomes obvious, that the type and length field is always present whereas the value may be zero bytes long. The current implementation omits the length field if the value is not present. This is wrong. Correct this by always sending the length in gsm_control_transmit(). So far only the modem status command (MSC) has included a value and encoded its length directly. Therefore, also change gsmtty_modem_update(). Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-12-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1302,11 +1302,12 @@ static void gsm_control_response(struct =20 static void gsm_control_transmit(struct gsm_mux *gsm, struct gsm_control *= ctrl) { - struct gsm_msg *msg =3D gsm_data_alloc(gsm, 0, ctrl->len + 1, gsm->ftype); + struct gsm_msg *msg =3D gsm_data_alloc(gsm, 0, ctrl->len + 2, gsm->ftype); if (msg =3D=3D NULL) return; - msg->data[0] =3D (ctrl->cmd << 1) | 2 | EA; /* command */ - memcpy(msg->data + 1, ctrl->data, ctrl->len); + msg->data[0] =3D (ctrl->cmd << 1) | CR | EA; /* command */ + msg->data[1] =3D (ctrl->len << 1) | EA; + memcpy(msg->data + 2, ctrl->data, ctrl->len); gsm_data_queue(gsm->dlci[0], msg); } =20 @@ -2860,19 +2861,17 @@ static struct tty_ldisc_ops tty_ldisc_pa =20 static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk) { - u8 modembits[5]; + u8 modembits[3]; struct gsm_control *ctrl; int len =3D 2; =20 - if (brk) + modembits[0] =3D (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ + modembits[1] =3D (gsm_encode_modem(dlci) << 1) | EA; + if (brk) { + modembits[2] =3D (brk << 4) | 2 | EA; /* Length, Break, EA */ len++; - - modembits[0] =3D len << 1 | EA; /* Data bytes */ - modembits[1] =3D dlci->addr << 2 | 3; /* DLCI, EA, 1 */ - modembits[2] =3D gsm_encode_modem(dlci) << 1 | EA; - if (brk) - modembits[3] =3D brk << 4 | 2 | EA; /* Valid, EA */ - ctrl =3D gsm_control_send(dlci->gsm, CMD_MSC, modembits, len + 1); + } + ctrl =3D gsm_control_send(dlci->gsm, CMD_MSC, modembits, len); if (ctrl =3D=3D NULL) return -ENOMEM; return gsm_control_wait(dlci->gsm, ctrl); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89DA5C4332F for ; Tue, 10 May 2022 13:35:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244616AbiEJNhx (ORCPT ); Tue, 10 May 2022 09:37:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243711AbiEJN1S (ORCPT ); Tue, 10 May 2022 09:27:18 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 567D62B9CAA; Tue, 10 May 2022 06:20:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1B0AF61574; Tue, 10 May 2022 13:20:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 22E8CC385A6; Tue, 10 May 2022 13:20:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188822; bh=sez7NumXTVra4gd9RtME3YPtIGK5USefbtel839FBvQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CuF8fLxJ9s9+I5PJ7S5o5/EwiYL9KPK6q+15Jv9sMc8u1VhtY3tFfJWkOp2atXZ0k 2OlZYIW6V/c4cQnEnDVQMyWdnLcm7SqEJbZ+2TlcmU2Dnlc2umv2JS8yyPJ5jAwC55 dRhjRyuJx/Jr1SdScwOazIZJqL4j+JtaJlsrAsRA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.19 56/88] tty: n_gsm: fix incorrect UA handling Date: Tue, 10 May 2022 15:07:41 +0200 Message-Id: <20220510130735.370979256@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit ff9166c623704337bd6fe66fce2838d9768a6634 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.4.4.2 states that any received unnumbered acknowledgment (UA) with its poll/final (PF) bit set to 0 shall be discarded. Currently, all UA frame are handled in the same way regardless of the PF bit. This does not comply with the standard. Remove the UA case in gsm_queue() to process only UA frames with PF bit set to 1 to abide the standard. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-20-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1811,7 +1811,6 @@ static void gsm_queue(struct gsm_mux *gs gsm_response(gsm, address, UA); gsm_dlci_close(dlci); break; - case UA: case UA|PF: if (cr =3D=3D 0 || dlci =3D=3D NULL) break; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DE3CAC433F5 for ; Tue, 10 May 2022 13:36:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241599AbiEJNkn (ORCPT ); Tue, 10 May 2022 09:40:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243768AbiEJN1X (ORCPT ); Tue, 10 May 2022 09:27:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 497D92BD217; Tue, 10 May 2022 06:20:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 78A21B81CF8; Tue, 10 May 2022 13:20:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4504C385C2; Tue, 10 May 2022 13:20:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188825; bh=dnjGH4X54RaK+1LVipStRQRfJJyRB8ZUDUbQ9R3Sj8s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v0cP42nx9jKGt3J4IraM3AlwY+QuQ73heQZnHVckZz7UZqq8gArcGE8iF3DoLpg5H e43wm3GMyTVrkq6l4QsiYjPPu+BSjCCMTyXIhUTsfJbpEG14x4ULTVkMyVGVd2n3hj 7fLICB44fEiKggrACBU9muuWLKze9TutSfZFeQk0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Hillf Danton , syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com, Emil Velikov , Daniel Vetter , Sean Paul , Chris Wilson , Eric Anholt , Sam Ravnborg , Rob Clark , Daniel Vetter , Ovidiu Panait Subject: [PATCH 4.19 57/88] drm/vgem: Close use-after-free race in vgem_gem_create Date: Tue, 10 May 2022 15:07:42 +0200 Message-Id: <20220510130735.399310423@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Vetter commit 4b848f20eda5974020f043ca14bacf7a7e634fc8 upstream. There's two references floating around here (for the object reference, not the handle_count reference, that's a different thing): - The temporary reference held by vgem_gem_create, acquired by creating the object and released by calling drm_gem_object_put_unlocked. - The reference held by the object handle, created by drm_gem_handle_create. This one generally outlives the function, except if a 2nd thread races with a GEM_CLOSE ioctl call. So usually everything is correct, except in that race case, where the access to gem_object->size could be looking at freed data already. Which again isn't a real problem (userspace shot its feet off already with the race, we could return garbage), but maybe someone can exploit this as an information leak. Cc: Dan Carpenter Cc: Hillf Danton Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Emil Velikov Cc: Daniel Vetter Cc: Sean Paul Cc: Chris Wilson Cc: Eric Anholt Cc: Sam Ravnborg Cc: Rob Clark Reviewed-by: Chris Wilson Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-= 1-daniel.vetter@ffwll.ch [OP: backport to 4.19: adjusted DRM_DEBUG() -> DRM_DEBUG_DRIVER()] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/vgem/vgem_drv.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/vgem/vgem_drv.c +++ b/drivers/gpu/drm/vgem/vgem_drv.c @@ -189,9 +189,10 @@ static struct drm_gem_object *vgem_gem_c return ERR_CAST(obj); =20 ret =3D drm_gem_handle_create(file, &obj->base, handle); - drm_gem_object_put_unlocked(&obj->base); - if (ret) + if (ret) { + drm_gem_object_put_unlocked(&obj->base); return ERR_PTR(ret); + } =20 return &obj->base; } @@ -214,7 +215,9 @@ static int vgem_gem_dumb_create(struct d args->size =3D gem_object->size; args->pitch =3D pitch; =20 - DRM_DEBUG_DRIVER("Created object of size %lld\n", size); + drm_gem_object_put_unlocked(gem_object); + + DRM_DEBUG_DRIVER("Created object of size %llu\n", args->size); =20 return 0; } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAF76C433EF for ; Tue, 10 May 2022 13:37:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235295AbiEJNk5 (ORCPT ); Tue, 10 May 2022 09:40:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243795AbiEJN11 (ORCPT ); Tue, 10 May 2022 09:27:27 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 397E32BF338; Tue, 10 May 2022 06:20:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id A908DCE1EA8; Tue, 10 May 2022 13:20:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3F68C385C2; Tue, 10 May 2022 13:20:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188828; bh=PRKpjmAziyif22JPjrTY50Wia+ji3fC+UzeKpw1I3yc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GnO0SsFlpCg5EYAGwgEg6lzF8vMYLc18Pfuz29VRJkKXFLOVCAVMYrkZkISIwiDdJ ndUR0CSfLGifZDdUI+bHvj2Oxkh+hOpFyA3JAjdivRC1v5BfhfqZjqnnmlcWHkT2MH HL5oJW/GPGTnq/8kAQlj5iAg2HkFFEfPGkAvra+A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Bogendoerfer Subject: [PATCH 4.19 58/88] MIPS: Fix CP0 counter erratum detection for R4k CPUs Date: Tue, 10 May 2022 15:07:43 +0200 Message-Id: <20220510130735.427780069@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Maciej W. Rozycki commit f0a6c68f69981214cb7858738dd2bc81475111f7 upstream. Fix the discrepancy between the two places we check for the CP0 counter erratum in along with the incorrect comparison of the R4400 revision number against 0x30 which matches none and consistently consider all R4000 and R4400 processors affected, as documented in processor errata publications[1][2][3], following the mapping between CP0 PRId register values and processor models: PRId | Processor Model Reviewed-by: Philippe Mathieu-Daud=C3=A9 Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee ---------+-------------------- 00000422 | R4000 Revision 2.2 00000430 | R4000 Revision 3.0 00000440 | R4400 Revision 1.0 00000450 | R4400 Revision 2.0 00000460 | R4400 Revision 3.0 No other revision of either processor has ever been spotted. Contrary to what has been stated in commit ce202cbb9e0b ("[MIPS] Assume R4000/R4400 newer than 3.0 don't have the mfc0 count bug") marking the CP0 counter as buggy does not preclude it from being used as either a clock event or a clock source device. It just cannot be used as both at a time, because in that case clock event interrupts will be occasionally lost, and the use as a clock event device takes precedence. Compare against 0x4ff in `can_use_mips_counter' so that a single machine instruction is produced. [1] "MIPS R4000PC/SC Errata, Processor Revision 2.2 and 3.0", MIPS Technologies Inc., May 10, 1994, Erratum 53, p.13 [2] "MIPS R4400PC/SC Errata, Processor Revision 1.0", MIPS Technologies Inc., February 9, 1994, Erratum 21, p.4 [3] "MIPS R4400PC/SC Errata, Processor Revision 2.0 & 3.0", MIPS Technologies Inc., January 24, 1995, Erratum 14, p.3 Signed-off-by: Maciej W. Rozycki Fixes: ce202cbb9e0b ("[MIPS] Assume R4000/R4400 newer than 3.0 don't have t= he mfc0 count bug") Cc: stable@vger.kernel.org # v2.6.24+ Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Thomas Bogendoerfer Signed-off-by: Greg Kroah-Hartman --- arch/mips/include/asm/timex.h | 8 ++++---- arch/mips/kernel/time.c | 11 +++-------- 2 files changed, 7 insertions(+), 12 deletions(-) --- a/arch/mips/include/asm/timex.h +++ b/arch/mips/include/asm/timex.h @@ -40,9 +40,9 @@ typedef unsigned int cycles_t; =20 /* - * On R4000/R4400 before version 5.0 an erratum exists such that if the - * cycle counter is read in the exact moment that it is matching the - * compare register, no interrupt will be generated. + * On R4000/R4400 an erratum exists such that if the cycle counter is + * read in the exact moment that it is matching the compare register, + * no interrupt will be generated. * * There is a suggested workaround and also the erratum can't strike if * the compare interrupt isn't being used as the clock source device. @@ -63,7 +63,7 @@ static inline int can_use_mips_counter(u if (!__builtin_constant_p(cpu_has_counter)) asm volatile("" : "=3Dm" (cpu_data[0].options)); if (likely(cpu_has_counter && - prid >=3D (PRID_IMP_R4000 | PRID_REV_ENCODE_44(5, 0)))) + prid > (PRID_IMP_R4000 | PRID_REV_ENCODE_44(15, 15)))) return 1; else return 0; --- a/arch/mips/kernel/time.c +++ b/arch/mips/kernel/time.c @@ -140,15 +140,10 @@ static __init int cpu_has_mfc0_count_bug case CPU_R4400MC: /* * The published errata for the R4400 up to 3.0 say the CPU - * has the mfc0 from count bug. + * has the mfc0 from count bug. This seems the last version + * produced. */ - if ((current_cpu_data.processor_id & 0xff) <=3D 0x30) - return 1; - - /* - * we assume newer revisions are ok - */ - return 0; + return 1; } =20 return 0; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AEAF0C43219 for ; Tue, 10 May 2022 13:35:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244659AbiEJNhz (ORCPT ); Tue, 10 May 2022 09:37:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243804AbiEJN11 (ORCPT ); Tue, 10 May 2022 09:27:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C94082BD0D4; Tue, 10 May 2022 06:20:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2A049616EC; Tue, 10 May 2022 13:20:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 363B1C385A6; Tue, 10 May 2022 13:20:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188833; bh=HzT4e//cRWYScmtmkllaGVg74dsuod3wBbHRjHLM0ak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nSzzX0zHUzdMBCHfqdaMSJzpMkWgCVrlDF9Hjz5N4OsrW+r/ZidIVVzxayxTWvMS6 LsN0F/fqaL5gBDzrhQWrNXqv+9g5qq6RWiTDlDF8fk2TA9EzzSNxWflE/p1rGQ4Qol Zr2Q/7wG+VXHM+AR8Yt7nMUmM2bfHU7nm/pEJ/mM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller Subject: [PATCH 4.19 59/88] parisc: Merge model and model name into one line in /proc/cpuinfo Date: Tue, 10 May 2022 15:07:44 +0200 Message-Id: <20220510130735.456907210@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit 5b89966bc96a06f6ad65f64ae4b0461918fcc9d3 upstream. The Linux tool "lscpu" shows the double amount of CPUs if we have "model" and "model name" in two different lines in /proc/cpuinfo. This change combines the model and the model name into one line. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/parisc/kernel/processor.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/arch/parisc/kernel/processor.c +++ b/arch/parisc/kernel/processor.c @@ -423,8 +423,7 @@ show_cpuinfo (struct seq_file *m, void * } seq_printf(m, " (0x%02lx)\n", boot_cpu_data.pdc.capabilities); =20 - seq_printf(m, "model\t\t: %s\n" - "model name\t: %s\n", + seq_printf(m, "model\t\t: %s - %s\n", boot_cpu_data.pdc.sys_model_name, cpuinfo->dev ? cpuinfo->dev->name : "Unknown"); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01906C4707E for ; Tue, 10 May 2022 13:35:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244725AbiEJNh7 (ORCPT ); Tue, 10 May 2022 09:37:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243852AbiEJN1b (ORCPT ); Tue, 10 May 2022 09:27:31 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 17E372C13FF; Tue, 10 May 2022 06:20:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 95113B81B32; Tue, 10 May 2022 13:20:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B084C385C2; Tue, 10 May 2022 13:20:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188836; bh=xcXfCRcoyhfyUlxipCdVEsXYo0JlNezMMEx8Crxqedw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WzcBvZqfEb90xGACMiLCFEWj/6qjA6SEuGP1DGWxVTCaPouZeGdIvj1uOzTe4w22U ziv9600r7Uwi9DDIRBGi/PBt9NxbqsU4/ikhFHnBtEvNIfg3i5jbSk+rhdAJXXXqzT F9XqBCDlex2eBShzri5KQdPco4IjtHmrlvIDAhSc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.19 60/88] ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Date: Tue, 10 May 2022 15:07:45 +0200 Message-Id: <20220510130735.485052969@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Sakamoto commit eb9d84b0ffe39893cb23b0b6712bbe3637fa25fa upstream. ALSA fireworks driver has a bug in its initial state to return count shorter than expected by 4 bytes to userspace applications when handling response frame for Echo Audio Fireworks transaction. It's due to missing addition of the size for the type of event in ALSA firewire stack. Fixes: 555e8a8f7f14 ("ALSA: fireworks: Add command/response functionality i= nto hwdep interface") Cc: Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220424102428.21109-1-o-takashi@sakamocchi= .jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/firewire/fireworks/fireworks_hwdep.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/firewire/fireworks/fireworks_hwdep.c +++ b/sound/firewire/fireworks/fireworks_hwdep.c @@ -35,6 +35,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, type =3D SNDRV_FIREWIRE_EVENT_EFW_RESPONSE; if (copy_to_user(buf, &type, sizeof(type))) return -EFAULT; + count +=3D sizeof(type); remained -=3D sizeof(type); buf +=3D sizeof(type); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6CA4C433EF for ; Tue, 10 May 2022 13:35:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241506AbiEJNjN (ORCPT ); Tue, 10 May 2022 09:39:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243866AbiEJN1c (ORCPT ); Tue, 10 May 2022 09:27:32 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E2BDE2607; Tue, 10 May 2022 06:20:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C72FB61663; Tue, 10 May 2022 13:20:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D4C32C385C2; Tue, 10 May 2022 13:20:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188839; bh=BaHdsdUszsfplAcfCPAXTALVmrrQ/oBKRZO7Yib0Los=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PNBlo2BDGCKkaT68rLa9DrLBfVAUKu9vKZEmggDnPeWcEASFsBHjbyZm1WC5nKMUr IS8zkevtt0ddE1iaISeWXJELe9LLq4tk09drGx1f7+SiNyHvXj23akYwBHn783+IaQ fN6DsTc4GSGm1vcJRKpaff36vrGMZyQgA8vaVaN4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrei Lalaev , Andy Shevchenko , Linus Walleij , Bartosz Golaszewski Subject: [PATCH 4.19 61/88] gpiolib: of: fix bounds check for gpio-reserved-ranges Date: Tue, 10 May 2022 15:07:46 +0200 Message-Id: <20220510130735.513439196@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andrei Lalaev commit e75f88efac05bf4e107e4171d8db6d8c3937252d upstream. Gpiolib interprets the elements of "gpio-reserved-ranges" as "start,size" because it clears "size" bits starting from the "start" bit in the according bitmap. So it has to use "greater" instead of "greater or equal" when perfo= rms bounds check to make sure that GPIOs are in the available range. Previous implementation skipped ranges that include the last GPIO in the range. I wrote the mail to the maintainers (https://lore.kernel.org/linux-gpio/20220412115554.159435-1-andrei.lalaev@e= mlid.com/T/#u) of the questioned DTSes (because I couldn't understand how the maintainers interpreted this property), but I haven't received a response. Since the questioned DTSes use "gpio-reserved-ranges =3D <0 4>" (i.e., the beginning of the range), this patch doesn't affect these DTSes a= t all. TBH this patch doesn't break any existing DTSes because none of them reserve gpios at the end of range. Fixes: 726cb3ba4969 ("gpiolib: Support 'gpio-reserved-ranges' property") Signed-off-by: Andrei Lalaev Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpio/gpiolib-of.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpio/gpiolib-of.c +++ b/drivers/gpio/gpiolib-of.c @@ -525,7 +525,7 @@ static void of_gpiochip_init_valid_mask( i, &start); of_property_read_u32_index(np, "gpio-reserved-ranges", i + 1, &count); - if (start >=3D chip->ngpio || start + count >=3D chip->ngpio) + if (start >=3D chip->ngpio || start + count > chip->ngpio) continue; =20 bitmap_clear(chip->valid_mask, start, count); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD029C4707A for ; Tue, 10 May 2022 13:38:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244069AbiEJNlY (ORCPT ); Tue, 10 May 2022 09:41:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50500 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243898AbiEJN1f (ORCPT ); Tue, 10 May 2022 09:27:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0AAE92C182B; Tue, 10 May 2022 06:20:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5C5EDB81CF8; Tue, 10 May 2022 13:20:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9276C385C2; Tue, 10 May 2022 13:20:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188842; bh=uWNfTbyVD20wguGhW1RfOtpw8PG/VpQ0yqM5YEg8S1A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YX+Bg6y0QSCZcQ62oORtesNgHwqaCTCQeIvbAf+yddqdc4bYfLD/MDszME8d4AjrQ G5B+tvZByLqhdmytEwkHaP7ptLuz9BKAQK7Fo4Jog8exH5f21lN2PGc4kDYYMlMwwU lUux9pGUprTh+EJlya7WDX3kvoEikQao4ZKFElz4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "wanghai (M)" , Trond Myklebust Subject: [PATCH 4.19 62/88] Revert "SUNRPC: attempt AF_LOCAL connect on setup" Date: Tue, 10 May 2022 15:07:47 +0200 Message-Id: <20220510130735.542425319@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Trond Myklebust commit a3d0562d4dc039bca39445e1cddde7951662e17d upstream. This reverts commit 7073ea8799a8cf73db60270986f14e4aae20fa80. We must not try to connect the socket while the transport is under construction, because the mechanisms to safely tear it down are not in place. As the code stands, we end up leaking the sockets on a connection error. Reported-by: wanghai (M) Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/sunrpc/xprtsock.c | 3 --- 1 file changed, 3 deletions(-) --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2974,9 +2974,6 @@ static struct rpc_xprt *xs_setup_local(s } xprt_set_bound(xprt); xs_format_peer_addresses(xprt, "local", RPCBIND_NETID_LOCAL); - ret =3D ERR_PTR(xs_local_setup_socket(transport)); - if (ret) - goto out_err; break; default: ret =3D ERR_PTR(-EAFNOSUPPORT); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B159C433EF for ; Tue, 10 May 2022 13:41:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244136AbiEJNpN (ORCPT ); Tue, 10 May 2022 09:45:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243798AbiEJNcP (ORCPT ); Tue, 10 May 2022 09:32:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D5FA52CFE8E; Tue, 10 May 2022 06:22:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4AD5C61663; Tue, 10 May 2022 13:22:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 502ACC385A6; Tue, 10 May 2022 13:22:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188931; bh=lyBqSR0EnOVA8i/cJ7U1vjDXnqHAh9OtfQbsNi3k8Ys=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ezj1ElVrWjSYPRkmFikVOGG3wgU3OJxWBY9E8r9E05kfxn+m6jILM2Kgf479HezGm eXOLoRcBQZ9Igr2zTJpUw4hgzDEmbJIFZaTgYR/e/+neZs+hcTEA4FB60BeOC1WyBj YSBjZdsB+e4LX53rqiSbxbmxy87mOBsqSmqH/m5g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.19 63/88] firewire: fix potential uaf in outbound_phy_packet_callback() Date: Tue, 10 May 2022 15:07:48 +0200 Message-Id: <20220510130735.571310602@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye commit b7c81f80246fac44077166f3e07103affe6db8ff upstream. &e->event and e point to the same address, and &e->event could be freed in queue_event. So there is a potential uaf issue if we dereference e after calling queue_event(). Fix this by adding a temporary variable to maintain e->client in advance, this can avoid the potential uaf issue. Cc: Signed-off-by: Chengfeng Ye Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-2-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/firewire/core-cdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c @@ -1495,6 +1495,7 @@ static void outbound_phy_packet_callback { struct outbound_phy_packet_event *e =3D container_of(packet, struct outbound_phy_packet_event, p); + struct client *e_client; =20 switch (status) { /* expected: */ @@ -1511,9 +1512,10 @@ static void outbound_phy_packet_callback } e->phy_packet.data[0] =3D packet->timestamp; =20 + e_client =3D e->client; queue_event(e->client, &e->event, &e->phy_packet, sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0); - client_put(e->client); + client_put(e_client); } =20 static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *a= rg) From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F283CC4707E for ; Tue, 10 May 2022 13:40:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244080AbiEJNnN (ORCPT ); Tue, 10 May 2022 09:43:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243287AbiEJN3M (ORCPT ); Tue, 10 May 2022 09:29:12 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C777F4664D; Tue, 10 May 2022 06:21:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 5C4B9CE1EA8; Tue, 10 May 2022 13:21:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7568CC385A6; Tue, 10 May 2022 13:21:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188861; bh=0w0xQr+Pu/llxYWRbwOnMuOVCGxAkws6yzESbdnf+gk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=of5ANiW1CWbqaIzBaJd1m0qdv8e39gX28djZO4uf3RpeMw1VtSWz8HYwjxv6RkjBD x55u5kvNH6ycZGucOvttL3xhzK4qjso6clohVP2YEMFCF0x5b/GQG4/zodLOKbEQQV eo/AUxNEEydaC7mn35XXSBc58ZwmnIy2C/7JtZzU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jakob Koschel , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.19 64/88] firewire: remove check of list iterator against head past the loop body Date: Tue, 10 May 2022 15:07:49 +0200 Message-Id: <20220510130735.599440441@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jakob Koschel commit 9423973869bd4632ffe669f950510c49296656e0 upstream. When list_for_each_entry() completes the iteration over the whole list without breaking the loop, the iterator value will be a bogus pointer computed based on the head element. While it is safe to use the pointer to determine if it was computed based on the head element, either with list_entry_is_head() or &pos->member =3D=3D head, using the iterator variable after the loop should be avoided. In preparation to limit the scope of a list iterator to the list traversal loop, use a dedicated pointer to point to the found element [1]. Link: https://lore.kernel.org/all/CAHk-=3DwgRr_D8CB-D9Kg-c=3DEHreAsk5SqXPwr= 9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Cc: Signed-off-by: Jakob Koschel Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-3-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/firewire/core-transaction.c | 30 ++++++++++++++++-------------- drivers/firewire/sbp2.c | 13 +++++++------ 2 files changed, 23 insertions(+), 20 deletions(-) --- a/drivers/firewire/core-transaction.c +++ b/drivers/firewire/core-transaction.c @@ -86,24 +86,25 @@ static int try_cancel_split_timeout(stru static int close_transaction(struct fw_transaction *transaction, struct fw_card *card, int rcode) { - struct fw_transaction *t; + struct fw_transaction *t =3D NULL, *iter; unsigned long flags; =20 spin_lock_irqsave(&card->lock, flags); - list_for_each_entry(t, &card->transaction_list, link) { - if (t =3D=3D transaction) { - if (!try_cancel_split_timeout(t)) { + list_for_each_entry(iter, &card->transaction_list, link) { + if (iter =3D=3D transaction) { + if (!try_cancel_split_timeout(iter)) { spin_unlock_irqrestore(&card->lock, flags); goto timed_out; } - list_del_init(&t->link); - card->tlabel_mask &=3D ~(1ULL << t->tlabel); + list_del_init(&iter->link); + card->tlabel_mask &=3D ~(1ULL << iter->tlabel); + t =3D iter; break; } } spin_unlock_irqrestore(&card->lock, flags); =20 - if (&t->link !=3D &card->transaction_list) { + if (t) { t->callback(card, rcode, NULL, 0, t->callback_data); return 0; } @@ -938,7 +939,7 @@ EXPORT_SYMBOL(fw_core_handle_request); =20 void fw_core_handle_response(struct fw_card *card, struct fw_packet *p) { - struct fw_transaction *t; + struct fw_transaction *t =3D NULL, *iter; unsigned long flags; u32 *data; size_t data_length; @@ -950,20 +951,21 @@ void fw_core_handle_response(struct fw_c rcode =3D HEADER_GET_RCODE(p->header[1]); =20 spin_lock_irqsave(&card->lock, flags); - list_for_each_entry(t, &card->transaction_list, link) { - if (t->node_id =3D=3D source && t->tlabel =3D=3D tlabel) { - if (!try_cancel_split_timeout(t)) { + list_for_each_entry(iter, &card->transaction_list, link) { + if (iter->node_id =3D=3D source && iter->tlabel =3D=3D tlabel) { + if (!try_cancel_split_timeout(iter)) { spin_unlock_irqrestore(&card->lock, flags); goto timed_out; } - list_del_init(&t->link); - card->tlabel_mask &=3D ~(1ULL << t->tlabel); + list_del_init(&iter->link); + card->tlabel_mask &=3D ~(1ULL << iter->tlabel); + t =3D iter; break; } } spin_unlock_irqrestore(&card->lock, flags); =20 - if (&t->link =3D=3D &card->transaction_list) { + if (!t) { timed_out: fw_notice(card, "unsolicited response (source %x, tlabel %x)\n", source, tlabel); --- a/drivers/firewire/sbp2.c +++ b/drivers/firewire/sbp2.c @@ -421,7 +421,7 @@ static void sbp2_status_write(struct fw_ void *payload, size_t length, void *callback_data) { struct sbp2_logical_unit *lu =3D callback_data; - struct sbp2_orb *orb; + struct sbp2_orb *orb =3D NULL, *iter; struct sbp2_status status; unsigned long flags; =20 @@ -446,17 +446,18 @@ static void sbp2_status_write(struct fw_ =20 /* Lookup the orb corresponding to this status write. */ spin_lock_irqsave(&lu->tgt->lock, flags); - list_for_each_entry(orb, &lu->orb_list, link) { + list_for_each_entry(iter, &lu->orb_list, link) { if (STATUS_GET_ORB_HIGH(status) =3D=3D 0 && - STATUS_GET_ORB_LOW(status) =3D=3D orb->request_bus) { - orb->rcode =3D RCODE_COMPLETE; - list_del(&orb->link); + STATUS_GET_ORB_LOW(status) =3D=3D iter->request_bus) { + iter->rcode =3D RCODE_COMPLETE; + list_del(&iter->link); + orb =3D iter; break; } } spin_unlock_irqrestore(&lu->tgt->lock, flags); =20 - if (&orb->link !=3D &lu->orb_list) { + if (orb) { orb->callback(orb, &status); kref_put(&orb->kref, free_orb); /* orb callback reference */ } else { From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F0C2C47084 for ; Tue, 10 May 2022 13:40:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243410AbiEJNoA (ORCPT ); Tue, 10 May 2022 09:44:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243392AbiEJNao (ORCPT ); Tue, 10 May 2022 09:30:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A968222B38D; Tue, 10 May 2022 06:21:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2EE96B81B32; Tue, 10 May 2022 13:21:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A071C385A6; Tue, 10 May 2022 13:21:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188892; bh=gdUdKjW7XpBqC98ng8uSCII3uv6RmKTxh7z3nkYusHc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Kf2OqDRi1ZyNtutywswqP3Y4TRXStAVrVhgq+YppDBvAEXoLL/ZQTvTVV1+kPItgu hEdFbhxnN+JCxrM3KEBFzfWm6lRBfBEWVhpoohx699aMgu1bBCxU6bUA5fXp6UiAm3 sX3KlqCF6nw/dlg4pJp/YBXtuYdg8nQOJwNEN0P0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niels Dossche , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.19 65/88] firewire: core: extend card->lock in fw_core_handle_bus_reset Date: Tue, 10 May 2022 15:07:50 +0200 Message-Id: <20220510130735.627286891@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niels Dossche commit a7ecbe92b9243edbe94772f6f2c854e4142a3345 upstream. card->local_node and card->bm_retries are both always accessed under card->lock. fw_core_handle_bus_reset has a check whose condition depends on card->local_node and whose body writes to card->bm_retries. Both of these accesses are not under card->lock. Move the lock acquiring of card->lock to before this check such that these accesses do happen when card->lock is held. fw_destroy_nodes is called inside the check. Since fw_destroy_nodes already acquires card->lock inside its function body, move this out to the callsites of fw_destroy_nodes. Also add a comment to indicate which locking is necessary when calling fw_destroy_nodes. Cc: Signed-off-by: Niels Dossche Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-4-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/firewire/core-card.c | 3 +++ drivers/firewire/core-topology.c | 9 +++------ 2 files changed, 6 insertions(+), 6 deletions(-) --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -681,6 +681,7 @@ EXPORT_SYMBOL_GPL(fw_card_release); void fw_core_remove_card(struct fw_card *card) { struct fw_card_driver dummy_driver =3D dummy_driver_template; + unsigned long flags; =20 card->driver->update_phy_reg(card, 4, PHY_LINK_ACTIVE | PHY_CONTENDER, 0); @@ -695,7 +696,9 @@ void fw_core_remove_card(struct fw_card dummy_driver.stop_iso =3D card->driver->stop_iso; card->driver =3D &dummy_driver; =20 + spin_lock_irqsave(&card->lock, flags); fw_destroy_nodes(card); + spin_unlock_irqrestore(&card->lock, flags); =20 /* Wait for all users, especially device workqueue jobs, to finish. */ fw_card_put(card); --- a/drivers/firewire/core-topology.c +++ b/drivers/firewire/core-topology.c @@ -386,16 +386,13 @@ static void report_found_node(struct fw_ card->bm_retries =3D 0; } =20 +/* Must be called with card->lock held */ void fw_destroy_nodes(struct fw_card *card) { - unsigned long flags; - - spin_lock_irqsave(&card->lock, flags); card->color++; if (card->local_node !=3D NULL) for_each_fw_node(card, card->local_node, report_lost_node); card->local_node =3D NULL; - spin_unlock_irqrestore(&card->lock, flags); } =20 static void move_tree(struct fw_node *node0, struct fw_node *node1, int po= rt) @@ -521,6 +518,8 @@ void fw_core_handle_bus_reset(struct fw_ struct fw_node *local_node; unsigned long flags; =20 + spin_lock_irqsave(&card->lock, flags); + /* * If the selfID buffer is not the immediate successor of the * previously processed one, we cannot reliably compare the @@ -532,8 +531,6 @@ void fw_core_handle_bus_reset(struct fw_ card->bm_retries =3D 0; } =20 - spin_lock_irqsave(&card->lock, flags); - card->broadcast_channel_allocated =3D card->broadcast_channel_auto_alloca= ted; card->node_id =3D node_id; /* From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CE4DC433EF for ; Tue, 10 May 2022 13:40:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243596AbiEJNok (ORCPT ); Tue, 10 May 2022 09:44:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243562AbiEJNbY (ORCPT ); Tue, 10 May 2022 09:31:24 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56E9F2CC13C; Tue, 10 May 2022 06:21:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 85F4661764; Tue, 10 May 2022 13:21:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FB79C385C6; Tue, 10 May 2022 13:21:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188911; bh=r0qu1SHTTBix2UxhC42n8aLxidZuhHFHggYUCqVygQo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WSaTGmyVoLlIzgD20DKvp80dv7LTUJlThF7LIeZ3zranhcwn6EyMfLFa4zmI32M0C 6lSCIsI8odzOoxjPD1kBszdQ4HM3Eyo484V1mXGhXww2RDq9xOtjEevwN0xu0Z+XIQ 94BiPPAKZTZvdadR52S97apq98cluUKikluae014= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Pfaff , Thomas Gleixner , Marc Zyngier Subject: [PATCH 4.19 66/88] genirq: Synchronize interrupt thread startup Date: Tue, 10 May 2022 15:07:51 +0200 Message-Id: <20220510130735.655568199@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thomas Pfaff commit 8707898e22fd665bc1d7b18b809be4b56ce25bdd upstream. A kernel hang can be observed when running setserial in a loop on a kernel with force threaded interrupts. The sequence of events is: setserial open("/dev/ttyXXX") request_irq() do_stuff() -> serial interrupt -> wake(irq_thread) desc->threads_active++; close() free_irq() kthread_stop(irq_thread) synchronize_irq() <- hangs because desc->threads_active !=3D 0 The thread is created in request_irq() and woken up, but does not get on a CPU to reach the actual thread function, which would handle the pending wake-up. kthread_stop() sets the should stop condition which makes the thread immediately exit, which in turn leaves the stale threads_active count around. This problem was introduced with commit 519cc8652b3a, which addressed a interrupt sharing issue in the PCIe code. Before that commit free_irq() invoked synchronize_irq(), which waits for the hard interrupt handler and also for associated threads to complete. To address the PCIe issue synchronize_irq() was replaced with __synchronize_hardirq(), which only waits for the hard interrupt handler to complete, but not for threaded handlers. This was done under the assumption, that the interrupt thread already reached the thread function and waits for a wake-up, which is guaranteed to be handled before acting on the stop condition. The problematic case, that the thread would not reach the thread function, was obviously overlooked. Make sure that the interrupt thread is really started and reaches thread_fn() before returning from __setup_irq(). This utilizes the existing wait queue in the interrupt descriptor. The wait queue is unused for non-shared interrupts. For shared interrupts the usage might cause a spurious wake-up of a waiter in synchronize_irq() or the completion of a threaded handler might cause a spurious wake-up of the waiter for the ready flag. Both are harmless and have no functional impact. [ tglx: Amended changelog ] Fixes: 519cc8652b3a ("genirq: Synchronize only with single thread on free_i= rq()") Signed-off-by: Thomas Pfaff Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/552fe7b4-9224-b183-bb87-a8f36d335690@pcs.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/irq/internals.h | 2 ++ kernel/irq/irqdesc.c | 2 ++ kernel/irq/manage.c | 39 +++++++++++++++++++++++++++++---------- 3 files changed, 33 insertions(+), 10 deletions(-) --- a/kernel/irq/internals.h +++ b/kernel/irq/internals.h @@ -29,12 +29,14 @@ extern struct irqaction chained_action; * IRQTF_WARNED - warning "IRQ_WAKE_THREAD w/o thread_fn" has been prin= ted * IRQTF_AFFINITY - irq thread is requested to adjust affinity * IRQTF_FORCED_THREAD - irq action is force threaded + * IRQTF_READY - signals that irq thread is ready */ enum { IRQTF_RUNTHREAD, IRQTF_WARNED, IRQTF_AFFINITY, IRQTF_FORCED_THREAD, + IRQTF_READY, }; =20 /* --- a/kernel/irq/irqdesc.c +++ b/kernel/irq/irqdesc.c @@ -404,6 +404,7 @@ static struct irq_desc *alloc_desc(int i lockdep_set_class(&desc->lock, &irq_desc_lock_class); mutex_init(&desc->request_mutex); init_rcu_head(&desc->rcu); + init_waitqueue_head(&desc->wait_for_threads); =20 desc_set_defaults(irq, desc, node, affinity, owner); irqd_set(&desc->irq_data, flags); @@ -568,6 +569,7 @@ int __init early_irq_init(void) raw_spin_lock_init(&desc[i].lock); lockdep_set_class(&desc[i].lock, &irq_desc_lock_class); mutex_init(&desc[i].request_mutex); + init_waitqueue_head(&desc[i].wait_for_threads); desc_set_defaults(i, &desc[i], node, NULL, NULL); } return arch_early_irq_init(); --- a/kernel/irq/manage.c +++ b/kernel/irq/manage.c @@ -1064,6 +1064,31 @@ static void irq_wake_secondary(struct ir } =20 /* + * Internal function to notify that a interrupt thread is ready. + */ +static void irq_thread_set_ready(struct irq_desc *desc, + struct irqaction *action) +{ + set_bit(IRQTF_READY, &action->thread_flags); + wake_up(&desc->wait_for_threads); +} + +/* + * Internal function to wake up a interrupt thread and wait until it is + * ready. + */ +static void wake_up_and_wait_for_irq_thread_ready(struct irq_desc *desc, + struct irqaction *action) +{ + if (!action || !action->thread) + return; + + wake_up_process(action->thread); + wait_event(desc->wait_for_threads, + test_bit(IRQTF_READY, &action->thread_flags)); +} + +/* * Interrupt handler thread */ static int irq_thread(void *data) @@ -1074,6 +1099,8 @@ static int irq_thread(void *data) irqreturn_t (*handler_fn)(struct irq_desc *desc, struct irqaction *action); =20 + irq_thread_set_ready(desc, action); + if (force_irqthreads && test_bit(IRQTF_FORCED_THREAD, &action->thread_flags)) handler_fn =3D irq_forced_thread_fn; @@ -1462,8 +1489,6 @@ __setup_irq(unsigned int irq, struct irq } =20 if (!shared) { - init_waitqueue_head(&desc->wait_for_threads); - /* Setup the type (level, edge polarity) if configured: */ if (new->flags & IRQF_TRIGGER_MASK) { ret =3D __irq_set_trigger(desc, @@ -1553,14 +1578,8 @@ __setup_irq(unsigned int irq, struct irq =20 irq_setup_timings(desc, new); =20 - /* - * Strictly no need to wake it up, but hung_task complains - * when no hard interrupt wakes the thread up. - */ - if (new->thread) - wake_up_process(new->thread); - if (new->secondary) - wake_up_process(new->secondary->thread); + wake_up_and_wait_for_irq_thread_ready(desc, new); + wake_up_and_wait_for_irq_thread_ready(desc, new->secondary); =20 register_irq_proc(irq, desc); new->dir =3D NULL; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A211C433F5 for ; Tue, 10 May 2022 13:41:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243975AbiEJNo5 (ORCPT ); Tue, 10 May 2022 09:44:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243742AbiEJNcM (ORCPT ); Tue, 10 May 2022 09:32:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F072E2CDEE4; Tue, 10 May 2022 06:21:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E6388B81D7A; Tue, 10 May 2022 13:21:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 47F0EC385A6; Tue, 10 May 2022 13:21:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188914; bh=A5Gm8vv4Lg2LnbsRDQ1x/R93fKZb81xT8n6buhK6Sjg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SUcVYG6Mp+m8JqTeU0vZCeQaXC63D/9G8iWhbezfKlmR0yCmfaiKH8qcvWx7kGeck 74Ne+gSat05dG92ZRlU2HLv4urh5V+GlzQfX3WNk2GzaculCAstjRzRoCbP65euEKI pXvbVf7Y+qW94qC8LfH85blcne3Fi7w9intFkqFw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown , Charles Keepax Subject: [PATCH 4.19 67/88] ASoC: wm8958: Fix change notifications for DSP controls Date: Tue, 10 May 2022 15:07:52 +0200 Message-Id: <20220510130735.683650758@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown commit b4f5c6b2e52b27462c0599e64e96e53b58438de1 upstream. The WM8958 DSP controls all return 0 on successful write, not a boolean value indicating if the write changed the value of the control. Fix this by returning 1 after a change, there is already a check at the start of each put() that skips the function in the case that there is no change. Signed-off-by: Mark Brown Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20220416125408.197440-1-broonie@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/soc/codecs/wm8958-dsp2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/sound/soc/codecs/wm8958-dsp2.c +++ b/sound/soc/codecs/wm8958-dsp2.c @@ -537,7 +537,7 @@ static int wm8958_mbc_put(struct snd_kco =20 wm8958_dsp_apply(component, mbc, wm8994->mbc_ena[mbc]); =20 - return 0; + return 1; } =20 #define WM8958_MBC_SWITCH(xname, xval) {\ @@ -663,7 +663,7 @@ static int wm8958_vss_put(struct snd_kco =20 wm8958_dsp_apply(component, vss, wm8994->vss_ena[vss]); =20 - return 0; + return 1; } =20 =20 @@ -737,7 +737,7 @@ static int wm8958_hpf_put(struct snd_kco =20 wm8958_dsp_apply(component, hpf % 3, ucontrol->value.integer.value[0]); =20 - return 0; + return 1; } =20 #define WM8958_HPF_SWITCH(xname, xval) {\ @@ -831,7 +831,7 @@ static int wm8958_enh_eq_put(struct snd_ =20 wm8958_dsp_apply(component, eq, ucontrol->value.integer.value[0]); =20 - return 0; + return 1; } =20 #define WM8958_ENH_EQ_SWITCH(xname, xval) {\ From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E270C46467 for ; Tue, 10 May 2022 13:44:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245061AbiEJNrS (ORCPT ); Tue, 10 May 2022 09:47:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243758AbiEJNcN (ORCPT ); Tue, 10 May 2022 09:32:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 52A3A2CCD09; Tue, 10 May 2022 06:22:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9483CB81DA2; Tue, 10 May 2022 13:21:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 06434C385A6; Tue, 10 May 2022 13:21:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188917; bh=2SQP/iK9dFo1azXQPmUtMwnMxA2HAIdd4EY0EdaBOnI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JKhtsD0tfcQOv9znnTJDubt0y3miVaRJLUdiWPpvIqeLUtRlwGSUdrrwlL8fg6uWn T4dzhkDLSyCYjHC+O5G2VtilSawxoucM+VHEWkhJlpSnSaajAByYvXUeSB/2NYaiLA fFO1Nh+Iqd9BA2BVKW/kU6RQ8Onrl6Y62p1/ZQfg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Andreas Larsson , Marc Kleine-Budde Subject: [PATCH 4.19 68/88] can: grcan: grcan_close(): fix deadlock Date: Tue, 10 May 2022 15:07:53 +0200 Message-Id: <20220510130735.711739117@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 47f070a63e735bcc8d481de31be1b5a1aa62b31c upstream. There are deadlocks caused by del_timer_sync(&priv->hang_timer) and del_timer_sync(&priv->rr_timer) in grcan_close(), one of the deadlocks are shown below: (Thread 1) | (Thread 2) | grcan_reset_timer() grcan_close() | mod_timer() spin_lock_irqsave() //(1) | (wait a time) ... | grcan_initiate_running_reset() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold priv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need priv->lock in position (2) of thread 2. As a result, grcan_close() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Link: https://lore.kernel.org/all/20220425042400.66517-1-duoming@zju.edu.cn Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN co= res") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Reviewed-by: Andreas Larsson Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/can/grcan.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/can/grcan.c +++ b/drivers/net/can/grcan.c @@ -1117,8 +1117,10 @@ static int grcan_close(struct net_device =20 priv->closing =3D true; if (priv->need_txbug_workaround) { + spin_unlock_irqrestore(&priv->lock, flags); del_timer_sync(&priv->hang_timer); del_timer_sync(&priv->rr_timer); + spin_lock_irqsave(&priv->lock, flags); } netif_stop_queue(dev); grcan_stop_hardware(dev); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B0B24C433FE for ; Tue, 10 May 2022 13:45:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240146AbiEJNtq (ORCPT ); Tue, 10 May 2022 09:49:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243765AbiEJNcN (ORCPT ); Tue, 10 May 2022 09:32:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5F59E2CE21D; Tue, 10 May 2022 06:22:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A5A916165A; Tue, 10 May 2022 13:22:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B44F6C385C2; Tue, 10 May 2022 13:21:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188920; bh=iXVVI4US+Q041s1HhJh5ERMO/BF9bJSOGPx+QLMsC9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jdSAmKXKJ4XWRk1ViTIEDzw0bXW7ZIb27xa/+qifwA9lM8hGb+2imyKdYLbO+Z0Ld 4eRyKEbVdtkhonhHLIwzvDYe2K3uyAJdidEKEbh93RxQql0BeNl5NJA0gWPCA3DfK8 Df2DLSTskFPmZPbfYJ6oml0GcnNoR0IJ/A2kMloU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Hellstrom , Andreas Larsson , Marc Kleine-Budde Subject: [PATCH 4.19 69/88] can: grcan: use ofdev->dev when allocating DMA memory Date: Tue, 10 May 2022 15:07:54 +0200 Message-Id: <20220510130735.739737967@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Hellstrom commit 101da4268626b00d16356a6bf284d66e44c46ff9 upstream. Use the device of the device tree node should be rather than the device of the struct net_device when allocating DMA buffers. The driver got away with it on sparc32 until commit 53b7670e5735 ("sparc: factor the dma coherent mapping into helper") after which the driver oopses. Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN co= res") Link: https://lore.kernel.org/all/20220429084656.29788-2-andreas@gaisler.com Cc: stable@vger.kernel.org Signed-off-by: Daniel Hellstrom Signed-off-by: Andreas Larsson Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/can/grcan.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/can/grcan.c +++ b/drivers/net/can/grcan.c @@ -252,6 +252,7 @@ struct grcan_device_config { struct grcan_priv { struct can_priv can; /* must be the first member */ struct net_device *dev; + struct device *ofdev_dev; struct napi_struct napi; =20 struct grcan_registers __iomem *regs; /* ioremap'ed registers */ @@ -928,7 +929,7 @@ static void grcan_free_dma_buffers(struc struct grcan_priv *priv =3D netdev_priv(dev); struct grcan_dma *dma =3D &priv->dma; =20 - dma_free_coherent(&dev->dev, dma->base_size, dma->base_buf, + dma_free_coherent(priv->ofdev_dev, dma->base_size, dma->base_buf, dma->base_handle); memset(dma, 0, sizeof(*dma)); } @@ -953,7 +954,7 @@ static int grcan_allocate_dma_buffers(st =20 /* Extra GRCAN_BUFFER_ALIGNMENT to allow for alignment */ dma->base_size =3D lsize + ssize + GRCAN_BUFFER_ALIGNMENT; - dma->base_buf =3D dma_alloc_coherent(&dev->dev, + dma->base_buf =3D dma_alloc_coherent(priv->ofdev_dev, dma->base_size, &dma->base_handle, GFP_KERNEL); @@ -1606,6 +1607,7 @@ static int grcan_setup_netdev(struct pla memcpy(&priv->config, &grcan_module_config, sizeof(struct grcan_device_config)); priv->dev =3D dev; + priv->ofdev_dev =3D &ofdev->dev; priv->regs =3D base; priv->can.bittiming_const =3D &grcan_bittiming_const; priv->can.do_set_bittiming =3D grcan_set_bittiming; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7FA3DC433EF for ; Tue, 10 May 2022 13:41:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244112AbiEJNpI (ORCPT ); Tue, 10 May 2022 09:45:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243776AbiEJNcO (ORCPT ); Tue, 10 May 2022 09:32:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A46F2CE23B; Tue, 10 May 2022 06:22:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 37550B81B32; Tue, 10 May 2022 13:22:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8CF17C385C2; Tue, 10 May 2022 13:22:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188923; bh=U8Zm7efx3T0aiQjtxjiMAYBYCBxvU/eYBJxGPuCrtAE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P/brdoGmMwnwi3Ev6YwP1gmQlIlHbRqo7xqIYykXsEFgn2tNmDMRYRxbLch+3VHiE HwBRVG7LxDDGUK8q7iooWB4F7/kCwMagirPuNBUQ9+hbLiINFg7cWjlRpbF1i58k4j 18r6eyT9emqnHaLI/DoQCYLsbxWpBlvrZHO/x594= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , "David S. Miller" Subject: [PATCH 4.19 70/88] nfc: replace improper check device_is_registered() in netlink related functions Date: Tue, 10 May 2022 15:07:55 +0200 Message-Id: <20220510130735.767747407@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit da5c0f119203ad9728920456a0f52a6d850c01cd upstream. The device_is_registered() in nfc core is used to check whether nfc device is registered in netlink related functions such as nfc_fw_download(), nfc_dev_up() and so on. Although device_is_registered() is protected by device_lock, there is still a race condition between device_del() and device_is_registered(). The root cause is that kobject_del() in device_del() is not protected by device_lock. (cleanup task) | (netlink task) | nfc_unregister_device | nfc_fw_download device_del | device_lock ... | if (!device_is_registered)//(1) kobject_del//(2) | ... ... | device_unlock The device_is_registered() returns the value of state_in_sysfs and the state_in_sysfs is set to zero in kobject_del(). If we pass check in position (1), then set zero in position (2). As a result, the check in position (1) is useless. This patch uses bool variable instead of device_is_registered() to judge whether the nfc device is registered, which is well synchronized. Fixes: 3e256b8f8dfa ("NFC: add nfc subsystem core") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/nfc/core.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) --- a/net/nfc/core.c +++ b/net/nfc/core.c @@ -50,7 +50,7 @@ int nfc_fw_download(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -106,7 +106,7 @@ int nfc_dev_up(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -154,7 +154,7 @@ int nfc_dev_down(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -218,7 +218,7 @@ int nfc_start_poll(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -257,7 +257,7 @@ int nfc_stop_poll(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -302,7 +302,7 @@ int nfc_dep_link_up(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -346,7 +346,7 @@ int nfc_dep_link_down(struct nfc_dev *de =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -412,7 +412,7 @@ int nfc_activate_target(struct nfc_dev * =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -458,7 +458,7 @@ int nfc_deactivate_target(struct nfc_dev =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -505,7 +505,7 @@ int nfc_data_exchange(struct nfc_dev *de =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; kfree_skb(skb); goto error; @@ -562,7 +562,7 @@ int nfc_enable_se(struct nfc_dev *dev, u =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -611,7 +611,7 @@ int nfc_disable_se(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -1139,6 +1139,7 @@ int nfc_register_device(struct nfc_dev * dev->rfkill =3D NULL; } } + dev->shutting_down =3D false; device_unlock(&dev->dev); =20 rc =3D nfc_genl_device_added(dev); @@ -1171,12 +1172,10 @@ void nfc_unregister_device(struct nfc_de rfkill_unregister(dev->rfkill); rfkill_destroy(dev->rfkill); } + dev->shutting_down =3D true; device_unlock(&dev->dev); =20 if (dev->ops->check_presence) { - device_lock(&dev->dev); - dev->shutting_down =3D true; - device_unlock(&dev->dev); del_timer_sync(&dev->check_pres_timer); cancel_work_sync(&dev->check_pres_work); } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E186C433F5 for ; Tue, 10 May 2022 13:41:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244170AbiEJNpW (ORCPT ); Tue, 10 May 2022 09:45:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48820 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243781AbiEJNcO (ORCPT ); Tue, 10 May 2022 09:32:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50B652CF2A5; Tue, 10 May 2022 06:22:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1151DB81DA6; Tue, 10 May 2022 13:22:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 677F6C385A6; Tue, 10 May 2022 13:22:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188925; bh=tUBIoF9N6X0NiJbBCmDtbiWMfzpX2+Dhrt4Z/jqBemM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uFXi+tnl5mOV/uP2yeRlbQkNL3HvIK2c0ilH/W0uuB7c8bx5dqGEvdPyYGZrg7APc dVKe+zQuLdmXbuPrnXNaYYHlQyQXJ2dH/rMM+CVJmGAhOk9VZmhQiWD+bg7guBDqN/ 2ffXZMpmtb1BNmtvT+tVmOiatHuPHHrBTfjLu/Mw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , "David S. Miller" Subject: [PATCH 4.19 71/88] nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs Date: Tue, 10 May 2022 15:07:56 +0200 Message-Id: <20220510130735.795322640@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit d270453a0d9ec10bb8a802a142fb1b3601a83098 upstream. There are destructive operations such as nfcmrvl_fw_dnld_abort and gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware, gpio and so on could be destructed while the upper layer functions such as nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads to double-free, use-after-free and null-ptr-deref bugs. There are three situations that could lead to double-free bugs. The first situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_fw_dnld_start | ... | nfcmrvl_nci_unregister_dev release_firmware() | nfcmrvl_fw_dnld_abort kfree(fw) //(1) | fw_dnld_over | release_firmware ... | kfree(fw) //(2) | ... The second situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_fw_dnld_start | ... | mod_timer | (wait a time) | fw_dnld_timeout | nfcmrvl_nci_unregister_dev fw_dnld_over | nfcmrvl_fw_dnld_abort release_firmware | fw_dnld_over kfree(fw) //(1) | release_firmware ... | kfree(fw) //(2) The third situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_nci_recv_frame | if(..->fw_download_in_progress)| nfcmrvl_fw_dnld_recv_frame | queue_work | | fw_dnld_rx_work | nfcmrvl_nci_unregister_dev fw_dnld_over | nfcmrvl_fw_dnld_abort release_firmware | fw_dnld_over kfree(fw) //(1) | release_firmware | kfree(fw) //(2) The firmware struct is deallocated in position (1) and deallocated in position (2) again. The crash trace triggered by POC is like below: BUG: KASAN: double-free or invalid-free in fw_dnld_over Call Trace: kfree fw_dnld_over nfcmrvl_nci_unregister_dev nci_uart_tty_close tty_ldisc_kill tty_ldisc_hangup __tty_hangup.part.0 tty_release ... What's more, there are also use-after-free and null-ptr-deref bugs in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev, then, we dereference firmware, gpio or the members of priv->fw_dnld in nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen. This patch reorders destructive operations after nci_unregister_device in order to synchronize between cleanup routine and firmware download routine. The nci_unregister_device is well synchronized. If the device is detaching, the firmware download routine will goto error. If firmware download routine is executing, nci_unregister_device will wait until firmware download routine is finished. Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/nfc/nfcmrvl/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/nfc/nfcmrvl/main.c +++ b/drivers/nfc/nfcmrvl/main.c @@ -194,6 +194,7 @@ void nfcmrvl_nci_unregister_dev(struct n { struct nci_dev *ndev =3D priv->ndev; =20 + nci_unregister_device(ndev); if (priv->ndev->nfc_dev->fw_download_in_progress) nfcmrvl_fw_dnld_abort(priv); =20 @@ -202,7 +203,6 @@ void nfcmrvl_nci_unregister_dev(struct n if (gpio_is_valid(priv->config.reset_n_io)) gpio_free(priv->config.reset_n_io); =20 - nci_unregister_device(ndev); nci_free_device(ndev); kfree(priv); } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DBD8EC433F5 for ; Tue, 10 May 2022 13:41:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244068AbiEJNpB (ORCPT ); Tue, 10 May 2022 09:45:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243786AbiEJNcO (ORCPT ); Tue, 10 May 2022 09:32:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50CCE2CF2AF; Tue, 10 May 2022 06:22:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E8EAFB81DA2; Tue, 10 May 2022 13:22:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4709CC385A6; Tue, 10 May 2022 13:22:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188928; bh=Sv3CNk8W8AyFsAotdqqX5Fu23F++KbT6VeiopuDiOko=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ipqb7bndCe0rOdjAgb7WAqZhevDrspGteYf5BnTIl1WcJMQC59FAIHKvqkhwd0QUd 01uyvt4ElnLMDTczyGoLXwZuZ9cvExdr+Mv1Y/e1IlUC70HrFHHfBgrucS2b9r0O9h aw34TbeEZ4sOJYO7K8QPJqvJPdVgJl9C7eXhVf5A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Krzysztof Kozlowski , Paolo Abeni Subject: [PATCH 4.19 72/88] NFC: netlink: fix sleep in atomic bug when firmware download timeout Date: Tue, 10 May 2022 15:07:57 +0200 Message-Id: <20220510130735.824731709@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 4071bf121d59944d5cd2238de0642f3d7995a997 upstream. There are sleep in atomic bug that could cause kernel panic during firmware download process. The root cause is that nlmsg_new with GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer handler. The call trace is shown below: BUG: sleeping function called from invalid context at include/linux/sched/m= m.h:265 Call Trace: kmem_cache_alloc_node __alloc_skb nfc_genl_fw_download_done call_timer_fn __run_timers.part.0 run_timer_softirq __do_softirq ... The nlmsg_new with GFP_KERNEL parameter may sleep during memory allocation process, and the timer handler is run as the result of a "software interrupt" that should not call any other function that could sleep. This patch changes allocation mode of netlink message from GFP_KERNEL to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC flag makes memory allocation operation could be used in atomic context. Fixes: 9674da8759df ("NFC: Add firmware upload netlink command") Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD= ") Signed-off-by: Duoming Zhou Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220504055847.38026-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/nfc/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c @@ -1262,7 +1262,7 @@ int nfc_genl_fw_download_done(struct nfc struct sk_buff *msg; void *hdr; =20 - msg =3D nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + msg =3D nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); if (!msg) return -ENOMEM; =20 @@ -1278,7 +1278,7 @@ int nfc_genl_fw_download_done(struct nfc =20 genlmsg_end(msg, hdr); =20 - genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL); + genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC); =20 return 0; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C725CC38A05 for ; Tue, 10 May 2022 13:40:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242049AbiEJNnA (ORCPT ); Tue, 10 May 2022 09:43:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242818AbiEJN3K (ORCPT ); Tue, 10 May 2022 09:29:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C7A5C46B0C; Tue, 10 May 2022 06:21:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2FFED616E8; Tue, 10 May 2022 13:21:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39068C385C2; Tue, 10 May 2022 13:21:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188864; bh=beJbuLc5DeQE1QzkilhzXFk8FrAnqajPtypHf3GrpYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wjKVtdN5Zjo9wLgWKLNXQ4QjlwrqokrJKIBMDe++328VQU6NVvnEBu28UxCJ/Qmma CAyP8GctF7hu5XxgSXhY1+VFWjE9GJwDgT+oayL5FMInnA+WCuJrJWurJek9k0ZBII tAn1ZX4RhDKqoujMVHVON6dcekTQSW28WRK28bJE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Armin Wolf , Guenter Roeck Subject: [PATCH 4.19 73/88] hwmon: (adt7470) Fix warning on module removal Date: Tue, 10 May 2022 15:07:58 +0200 Message-Id: <20220510130735.853547233@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Armin Wolf commit 7b2666ce445c700b8dcee994da44ddcf050a0842 upstream. When removing the adt7470 module, a warning might be printed: do not call blocking ops when !TASK_RUNNING; state=3D1 set at [] adt7470_update_thread+0x7b/0x130 [adt7470] This happens because adt7470_update_thread() can leave the kthread in TASK_INTERRUPTIBLE state when the kthread is being stopped before the call of set_current_state(). Since kthread_exit() might sleep in exit_signals(), the warning is printed. Fix that by using schedule_timeout_interruptible() and removing the call of set_current_state(). This causes TASK_INTERRUPTIBLE to be set after kthread_should_stop() which might cause the kthread to exit. Reported-by: Zheyu Ma Fixes: 93cacfd41f82 (hwmon: (adt7470) Allow faster removal) Signed-off-by: Armin Wolf Tested-by: Zheyu Ma Link: https://lore.kernel.org/r/20220407101312.13331-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hwmon/adt7470.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/hwmon/adt7470.c +++ b/drivers/hwmon/adt7470.c @@ -33,6 +33,7 @@ #include #include #include +#include =20 /* Addresses to scan */ static const unsigned short normal_i2c[] =3D { 0x2C, 0x2E, 0x2F, I2C_CLIEN= T_END }; @@ -273,11 +274,10 @@ static int adt7470_update_thread(void *p adt7470_read_temperatures(client, data); mutex_unlock(&data->lock); =20 - set_current_state(TASK_INTERRUPTIBLE); if (kthread_should_stop()) break; =20 - schedule_timeout(msecs_to_jiffies(data->auto_update_interval)); + schedule_timeout_interruptible(msecs_to_jiffies(data->auto_update_interv= al)); } =20 return 0; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39052C433F5 for ; Tue, 10 May 2022 13:39:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241317AbiEJNnU (ORCPT ); Tue, 10 May 2022 09:43:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57662 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242086AbiEJN3P (ORCPT ); Tue, 10 May 2022 09:29:15 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7764449FAC; Tue, 10 May 2022 06:21:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7F7EAB81038; Tue, 10 May 2022 13:21:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2188C385A6; Tue, 10 May 2022 13:21:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188867; bh=Ym8GxnnVBZBQ9TUgzbGFvGfJY+zRyIlodEKpAVlkL4o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R2u4rOw1J1BCb0iZbJo4D65R6KdzDOLdH3rGkwlHgoiuwUN7TZvujDHm/K07XBvSZ HVtveP2ghbb2zAha5HJdBVB5H14kIi/fsZ4P88vOZOIldHhEdwHiMjIX9SHsBYqQ4E HUoB+gp7a0tQ9xI80DBMCyOjsJhJ/MsRdaSDy8yE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sascha Hauer , Codrin Ciubotariu , Mark Brown Subject: [PATCH 4.19 74/88] ASoC: dmaengine: Restore NULL prepare_slave_config() callback Date: Tue, 10 May 2022 15:07:59 +0200 Message-Id: <20220510130735.882469436@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Codrin Ciubotariu commit 660564fc9a92a893a14f255be434f7ea0b967901 upstream. As pointed out by Sascha Hauer, this patch changes: if (pmc->config && !pcm->config->prepare_slave_config) to: if (pmc->config && !pcm->config->prepare_slave_config) snd_dmaengine_pcm_prepare_slave_config() This breaks the drivers that do not need a call to dmaengine_slave_config(). Drivers that still need to call snd_dmaengine_pcm_prepare_slave_config(), but have a NULL pcm->config->prepare_slave_config should use snd_dmaengine_pcm_prepare_slave_config() as their prepare_slave_config callback. Fixes: 9a1e13440a4f ("ASoC: dmaengine: do not use a NULL prepare_slave_conf= ig() callback") Reported-by: Sascha Hauer Signed-off-by: Codrin Ciubotariu Link: https://lore.kernel.org/r/20220421125403.2180824-1-codrin.ciubotariu@= microchip.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/soc/soc-generic-dmaengine-pcm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/sound/soc/soc-generic-dmaengine-pcm.c +++ b/sound/soc/soc-generic-dmaengine-pcm.c @@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struc =20 memset(&slave_config, 0, sizeof(slave_config)); =20 - if (pcm->config && pcm->config->prepare_slave_config) - prepare_slave_config =3D pcm->config->prepare_slave_config; - else + if (!pcm->config) prepare_slave_config =3D snd_dmaengine_pcm_prepare_slave_config; + else + prepare_slave_config =3D pcm->config->prepare_slave_config; =20 if (prepare_slave_config) { ret =3D prepare_slave_config(substream, params, &slave_config); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 960DFC388F3 for ; Tue, 10 May 2022 13:40:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243852AbiEJNmv (ORCPT ); Tue, 10 May 2022 09:42:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243286AbiEJN3M (ORCPT ); Tue, 10 May 2022 09:29:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7611B473BB; Tue, 10 May 2022 06:21:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CC42461663; Tue, 10 May 2022 13:21:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3851C385C6; Tue, 10 May 2022 13:21:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188870; bh=tbJHvViQzV/JozlxA+VMglRr0mAAIM8Pbgmf2vmtYEw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p+JSGbbqqQVYRwzNMaCNiPCqwBdiiFd56+MncwVxVwmz3cbSUPYwQ0qOLyoCcAMQB ahN1Ef+Kd7vH6LSzMeGyqjaBb/TULKJzKFTxnjKdRIWpLr7rnB9Y97nvgo0mWQLhwG ivPjOsakJactlgjpi0aOw5JUBfdzKpSZN8hCfVl8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Yang Yingliang , Jakub Kicinski Subject: [PATCH 4.19 75/88] net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() Date: Tue, 10 May 2022 15:08:00 +0200 Message-Id: <20220510130735.909264374@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang commit 1a15267b7be77e0792cf0c7b36ca65c8eb2df0d8 upstream. The node pointer returned by of_get_child_by_name() with refcount increment= ed, so add of_node_put() after using it. Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external = MDIOs") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220428095716.540452-1-yangyingliang@huawe= i.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c @@ -873,6 +873,7 @@ static int sun8i_dwmac_register_mdio_mux =20 ret =3D mdio_mux_init(priv->device, mdio_mux, mdio_mux_syscon_switch_fn, &gmac->mux_handle, priv, priv->mii); + of_node_put(mdio_mux); return ret; } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B976AC433EF for ; Tue, 10 May 2022 13:39:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244185AbiEJNne (ORCPT ); Tue, 10 May 2022 09:43:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50504 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242973AbiEJN3n (ORCPT ); Tue, 10 May 2022 09:29:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB46F56416; Tue, 10 May 2022 06:21:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8C4BE61761; Tue, 10 May 2022 13:21:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9ACEDC385C6; Tue, 10 May 2022 13:21:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188873; bh=/8F670taQclENz0qzSApJEtsYRmSdHV0+LAvMGqYgiA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GSDtevDz0Q8BmIMzWzg8S3tr3H8Uo6dH00fentw560sPVtods3V73t7XIOXzxnZGD EsRQI2Bs6SL0mS1nO857CeLVw4AaoADqD2SS7o3UVqV1TTMYYsGFa/plRsujCa+A/Y Oil0U2/h2DLgVbFM9Yrl200EZIBOeRjWLejE0gMo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shravya Kumbham , Radhey Shyam Pandey , Paolo Abeni Subject: [PATCH 4.19 76/88] net: emaclite: Add error handling for of_address_to_resource() Date: Tue, 10 May 2022 15:08:01 +0200 Message-Id: <20220510130735.937653041@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shravya Kumbham commit 7a6bc33ab54923d325d9a1747ec9652c4361ebd1 upstream. check the return value of of_address_to_resource() and also add missing of_node_put() for np and npp nodes. Fixes: e0a3bc65448c ("net: emaclite: Support multiple phys connected to one= MDIO bus") Addresses-Coverity: Event check_return value. Signed-off-by: Shravya Kumbham Signed-off-by: Radhey Shyam Pandey Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c +++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c @@ -827,10 +827,10 @@ static int xemaclite_mdio_write(struct m static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) { struct mii_bus *bus; - int rc; struct resource res; struct device_node *np =3D of_get_parent(lp->phy_node); struct device_node *npp; + int rc, ret; =20 /* Don't register the MDIO bus if the phy_node or its parent node * can't be found. @@ -840,8 +840,14 @@ static int xemaclite_mdio_setup(struct n return -ENODEV; } npp =3D of_get_parent(np); - - of_address_to_resource(npp, 0, &res); + ret =3D of_address_to_resource(npp, 0, &res); + of_node_put(npp); + if (ret) { + dev_err(dev, "%s resource error!\n", + dev->of_node->full_name); + of_node_put(np); + return ret; + } if (lp->ndev->mem_start !=3D res.start) { struct phy_device *phydev; phydev =3D of_phy_find_device(lp->phy_node); @@ -850,6 +856,7 @@ static int xemaclite_mdio_setup(struct n "MDIO of the phy is not registered yet\n"); else put_device(&phydev->mdio.dev); + of_node_put(np); return 0; } =20 @@ -862,6 +869,7 @@ static int xemaclite_mdio_setup(struct n bus =3D mdiobus_alloc(); if (!bus) { dev_err(dev, "Failed to allocate mdiobus\n"); + of_node_put(np); return -ENOMEM; } =20 @@ -874,6 +882,7 @@ static int xemaclite_mdio_setup(struct n bus->parent =3D dev; =20 rc =3D of_mdiobus_register(bus, np); + of_node_put(np); if (rc) { dev_err(dev, "Failed to register mdio bus.\n"); goto err_register; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C351C433F5 for ; Tue, 10 May 2022 13:39:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244152AbiEJNn1 (ORCPT ); Tue, 10 May 2022 09:43:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243314AbiEJN3m (ORCPT ); Tue, 10 May 2022 09:29:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 82E99296BE3; Tue, 10 May 2022 06:21:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 46526616D0; Tue, 10 May 2022 13:21:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52C0DC385A6; Tue, 10 May 2022 13:21:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188875; bh=FxIhdZqIw91pbHMbO5gwTOdjHrJnWK2rh0Rb9gXuISc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rjVnthoAqRVLeN2Kb9OYWcE4kR+aDoqtLIkS9GP/qXK5/Miix9RCik8wZo9LQg4Sp TmfwN4YgdCxXtNqJWLVnXldAL3wovih6zkHrtAQGx10YMYQ6poJJ+irfbfD5MDVWMC hRWNc0nePODOkzWUQu8Zfxt0uv0YyCwgRl9crnAM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ido Schimmel , Petr Machata , Paolo Abeni Subject: [PATCH 4.19 77/88] selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational Date: Tue, 10 May 2022 15:08:02 +0200 Message-Id: <20220510130735.967186510@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ido Schimmel commit 3122257c02afd9f199a8fc84ae981e1fc4958532 upstream. In emulated environments, the bridge ports enslaved to br1 get a carrier before changing br1's PVID. This means that by the time the PVID is changed, br1 is already operational and configured with an IPv6 link-local address. When the test is run with netdevs registered by mlxsw, changing the PVID is vetoed, as changing the VID associated with an existing L3 interface is forbidden. This restriction is similar to the 8021q driver's restriction of changing the VID of an existing interface. Fix this by taking br1 down and bringing it back up when it is fully configured. With this fix, the test reliably passes on top of both the SW and HW data paths (emulated or not). Fixes: 239e754af854 ("selftests: forwarding: Test mirror-to-gretap w/ UL 80= 2.1q") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Link: https://lore.kernel.org/r/20220502084507.364774-1-idosch@nvidia.com Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh | 3 +++ 1 file changed, 3 insertions(+) --- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh +++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh @@ -61,9 +61,12 @@ setup_prepare() =20 vrf_prepare mirror_gre_topo_create + # Avoid changing br1's PVID while it is operational as a L3 interface. + ip link set dev br1 down =20 ip link set dev $swp3 master br1 bridge vlan add dev br1 vid 555 pvid untagged self + ip link set dev br1 up ip address add dev br1 192.0.2.129/28 ip address add dev br1 2001:db8:2::1/64 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0413BC433EF for ; Tue, 10 May 2022 13:40:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243796AbiEJNoL (ORCPT ); Tue, 10 May 2022 09:44:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50500 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243320AbiEJN36 (ORCPT ); Tue, 10 May 2022 09:29:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 112432983B1; Tue, 10 May 2022 06:21:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9BABBB81D9A; Tue, 10 May 2022 13:21:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C003C385C2; Tue, 10 May 2022 13:21:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188878; bh=xaxQ4D3S8c6xBDzlo5MOyl9OyEkK2VqCkaI1Jbqa9UA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fx6zyJMi51PqsB1Xre9+YiZm2OzUn93XKM6gOHaVmvmDkwPpx2sM4PJ6LUwY/uHqI d+Fp0DshLcLN5sPCyOcH2T2edHKpuBrcLE0y9W3gkmsoNKG1yGkno8lwFknLAvr+7W inCFkl/Pr/prijwfJ1wIbhwFgVDNEzAZ0wBj1wt4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Jakub Kicinski Subject: [PATCH 4.19 78/88] smsc911x: allow using IRQ0 Date: Tue, 10 May 2022 15:08:03 +0200 Message-Id: <20220510130735.995573707@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit 5ef9b803a4af0f5e42012176889b40bb2a978b18 upstream. The AlphaProject AP-SH4A-3A/AP-SH4AD-0A SH boards use IRQ0 for their SMSC LAN911x Ethernet chip, so the networking on them must have been broken by commit 965b2aa78fbc ("net/smsc911x: fix irq resource allocation failure") which filtered out 0 as well as the negative error codes -- it was kinda correct at the time, as platform_get_irq() could return 0 on of_irq_get() failure and on the actual 0 in an IRQ resource. This issue was fixed by me (back in 2016!), so we should be able to fix this driver to allow IRQ0 usage again... When merging this to the stable kernels, make sure you also merge commit e330b9a6bb35 ("platform: don't return 0 from platform_get_irq[_byname]() on error") -- that's my fix to platform_get_irq() for the DT platforms... Fixes: 965b2aa78fbc ("net/smsc911x: fix irq resource allocation failure") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/656036e4-6387-38df-b8a7-6ba683b16e63@omp.ru Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/smsc/smsc911x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/smsc/smsc911x.c +++ b/drivers/net/ethernet/smsc/smsc911x.c @@ -2446,7 +2446,7 @@ static int smsc911x_drv_probe(struct pla if (irq =3D=3D -EPROBE_DEFER) { retval =3D -EPROBE_DEFER; goto out_0; - } else if (irq <=3D 0) { + } else if (irq < 0) { pr_warn("Could not allocate irq resource\n"); retval =3D -ENODEV; goto out_0; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE4A7C433F5 for ; Tue, 10 May 2022 13:40:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238581AbiEJNoY (ORCPT ); Tue, 10 May 2022 09:44:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50084 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243295AbiEJNaB (ORCPT ); Tue, 10 May 2022 09:30:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A79872C3346; Tue, 10 May 2022 06:21:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4CA4EB81DA3; Tue, 10 May 2022 13:21:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6794C385C2; Tue, 10 May 2022 13:21:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188881; bh=9AB0eIkm2p52mhcWgP0ARdREWpNnfAQ5M4KPSUn+kQw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Iz86m1RPI6xqLla01n9e0+p1Fe/vQFzUspTJ6j53HPGWdY5OVCzcDBj5NvV2/3HvN FjILaM1W6NNndpyBtBTrHyjvl1wiVfeVHpJsHQqcfiPK275PGo7kkPiTJR4LHE+CF6 2bAlAI0sOh0V3UtvQfm1XjA9wEfjlG8VNbnho+EI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Filipe Manana , David Sterba Subject: [PATCH 4.19 79/88] btrfs: always log symlinks in full mode Date: Tue, 10 May 2022 15:08:04 +0200 Message-Id: <20220510130736.023490077@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Filipe Manana commit d0e64a981fd841cb0f28fcd6afcac55e6f1e6994 upstream. On Linux, empty symlinks are invalid, and attempting to create one with the system call symlink(2) results in an -ENOENT error and this is explicitly documented in the man page. If we rename a symlink that was created in the current transaction and its parent directory was logged before, we actually end up logging the symlink without logging its content, which is stored in an inline extent. That means that after a power failure we can end up with an empty symlink, having no content and an i_size of 0 bytes. It can be easily reproduced like this: $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt $ mkdir /mnt/testdir $ sync # Create a file inside the directory and fsync the directory. $ touch /mnt/testdir/foo $ xfs_io -c "fsync" /mnt/testdir # Create a symlink inside the directory and then rename the symlink. $ ln -s /mnt/testdir/foo /mnt/testdir/bar $ mv /mnt/testdir/bar /mnt/testdir/baz # Now fsync again the directory, this persist the log tree. $ xfs_io -c "fsync" /mnt/testdir $ mount /dev/sdc /mnt $ stat -c %s /mnt/testdir/baz 0 $ readlink /mnt/testdir/baz $ Fix this by always logging symlinks in full mode (LOG_INODE_ALL), so that their content is also logged. A test case for fstests will follow. CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/btrfs/tree-log.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -4907,6 +4907,18 @@ static int btrfs_log_inode(struct btrfs_ } =20 /* + * For symlinks, we must always log their content, which is stored in an + * inline extent, otherwise we could end up with an empty symlink after + * log replay, which is invalid on linux (symlink(2) returns -ENOENT if + * one attempts to create an empty symlink). + * We don't need to worry about flushing delalloc, because when we create + * the inline extent when the symlink is created (we never have delalloc + * for symlinks). + */ + if (S_ISLNK(inode->vfs_inode.i_mode)) + inode_only =3D LOG_INODE_ALL; + + /* * a brute force approach to making sure we get the most uptodate * copies of everything. */ @@ -5462,7 +5474,7 @@ process_leaf: } =20 ctx->log_new_dentries =3D false; - if (type =3D=3D BTRFS_FT_DIR || type =3D=3D BTRFS_FT_SYMLINK) + if (type =3D=3D BTRFS_FT_DIR) log_mode =3D LOG_INODE_ALL; ret =3D btrfs_log_inode(trans, root, BTRFS_I(di_inode), log_mode, 0, LLONG_MAX, ctx); From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 504B5C35296 for ; Tue, 10 May 2022 13:40:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243713AbiEJNoI (ORCPT ); Tue, 10 May 2022 09:44:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43210 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243383AbiEJNam (ORCPT ); Tue, 10 May 2022 09:30:42 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74EE62C5118; Tue, 10 May 2022 06:21:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 430EACE1E73; Tue, 10 May 2022 13:21:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5CD00C385D2; Tue, 10 May 2022 13:21:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188883; bh=1Fas1LvGVLFgARFgxEbiC/4i/KkIdYbbjjZ7lxc9u5A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0CN/5zWKby2DV7LHBgQrWdr9MJT9+lnhLV7i614fOOEdkqQzr7EHD5XDsoRAmSQ/0 vFtlLtwbjzLilUrKjra8u6MozTo/RDMKZKQH1xaKxvafbLBzQfVHWMJ+nn3QH8I72M 6bRao6ns/mwvk/hfeKVVuI7/A+IETl4ipkiG8FjQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Flavio Leitner , "David S. Miller" Subject: [PATCH 4.19 80/88] net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Date: Tue, 10 May 2022 15:08:05 +0200 Message-Id: <20220510130736.055349648@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit dba5bdd57bea587ea4f0b79b03c71135f84a7e8b upstream. syzbot reported an UAF in ip_mc_sf_allow() [1] Whenever RCU protected list replaces an object, the pointer to the new object needs to be updated _before_ the call to kfree_rcu() or call_rcu() Because kfree_rcu(ptr, rcu) got support for NULL ptr only recently in commit 12edff045bc6 ("rcu: Make kfree_rcu() ignore NULL pointers"), I chose to use the conditional to make sure stable backports won't miss this detail. if (psl) kfree_rcu(psl, rcu); net/ipv6/mcast.c has similar issues, addressed in a separate patch. [1] BUG: KASAN: use-after-free in ip_mc_sf_allow+0x6bb/0x6d0 net/ipv4/igmp.c:26= 55 Read of size 4 at addr ffff88807d37b904 by task syz-executor.5/908 CPU: 0 PID: 908 Comm: syz-executor.5 Not tainted 5.18.0-rc4-syzkaller-00064= -g8f4dd16603ce #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 ip_mc_sf_allow+0x6bb/0x6d0 net/ipv4/igmp.c:2655 raw_v4_input net/ipv4/raw.c:190 [inline] raw_local_deliver+0x4d1/0xbe0 net/ipv4/raw.c:218 ip_protocol_deliver_rcu+0xcf/0xb30 net/ipv4/ip_input.c:193 ip_local_deliver_finish+0x2ee/0x4c0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_local_deliver+0x1b3/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x1cb/0x2f0 net/ipv4/ip_input.c:437 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_rcv+0xaa/0xd0 net/ipv4/ip_input.c:556 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 netif_receive_skb_internal net/core/dev.c:5605 [inline] netif_receive_skb+0x13e/0x8e0 net/core/dev.c:5664 tun_rx_batched.isra.0+0x460/0x720 drivers/net/tun.c:1534 tun_get_user+0x28b7/0x3e30 drivers/net/tun.c:1985 tun_chr_write_iter+0xdb/0x200 drivers/net/tun.c:2015 call_write_iter include/linux/fs.h:2050 [inline] new_sync_write+0x38a/0x560 fs/read_write.c:504 vfs_write+0x7c0/0xac0 fs/read_write.c:591 ksys_write+0x127/0x250 fs/read_write.c:644 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f3f12c3bbff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 = 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff f= f 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 RSP: 002b:00007f3f13ea9130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3f12d9bf60 RCX: 00007f3f12c3bbff RDX: 0000000000000036 RSI: 0000000020002ac0 RDI: 00000000000000c8 RBP: 00007f3f12ce308d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000036 R11: 0000000000000293 R12: 0000000000000000 R13: 00007fffb68dd79f R14: 00007f3f13ea9300 R15: 0000000000022000 Allocated by task 908: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 kasan_kmalloc include/linux/kasan.h:234 [inline] __do_kmalloc mm/slab.c:3710 [inline] __kmalloc+0x209/0x4d0 mm/slab.c:3719 kmalloc include/linux/slab.h:586 [inline] sock_kmalloc net/core/sock.c:2501 [inline] sock_kmalloc+0xb5/0x100 net/core/sock.c:2492 ip_mc_source+0xba2/0x1100 net/ipv4/igmp.c:2392 do_ip_setsockopt net/ipv4/ip_sockglue.c:1296 [inline] ip_setsockopt+0x2312/0x3ab0 net/ipv4/ip_sockglue.c:1432 raw_setsockopt+0x274/0x2c0 net/ipv4/raw.c:861 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 753: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x13d/0x180 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:200 [inline] __cache_free mm/slab.c:3439 [inline] kmem_cache_free_bulk+0x69/0x460 mm/slab.c:3774 kfree_bulk include/linux/slab.h:437 [inline] kfree_rcu_work+0x51c/0xa10 kernel/rcu/tree.c:3318 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348 kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3595 ip_mc_msfilter+0x712/0xb60 net/ipv4/igmp.c:2510 do_ip_setsockopt net/ipv4/ip_sockglue.c:1257 [inline] ip_setsockopt+0x32e1/0x3ab0 net/ipv4/ip_sockglue.c:1432 raw_setsockopt+0x274/0x2c0 net/ipv4/raw.c:861 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348 call_rcu+0x99/0x790 kernel/rcu/tree.c:3074 mpls_dev_notify+0x552/0x8a0 net/mpls/af_mpls.c:1656 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1938 call_netdevice_notifiers_extack net/core/dev.c:1976 [inline] call_netdevice_notifiers net/core/dev.c:1990 [inline] unregister_netdevice_many+0x92e/0x1890 net/core/dev.c:10751 default_device_exit_batch+0x449/0x590 net/core/dev.c:11245 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff88807d37b900 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 4 bytes inside of 64-byte region [ffff88807d37b900, ffff88807d37b940) The buggy address belongs to the physical page: page:ffffea0001f4dec0 refcount:1 mapcount:0 mapping:0000000000000000 index:= 0xffff88807d37b180 pfn:0x7d37b flags: 0xfff00000000200(slab|node=3D0|zone=3D1|lastcpupid=3D0x7ff) raw: 00fff00000000200 ffff888010c41340 ffffea0001c795c8 ffff888010c40200 raw: ffff88807d37b180 ffff88807d37b000 000000010000001f 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x342040(_= _GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 2963, t= gid 2963 (udevd), ts 139732238007, free_ts 139730893262 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 __alloc_pages_node include/linux/gfp.h:587 [inline] kmem_getpages mm/slab.c:1378 [inline] cache_grow_begin+0x75/0x350 mm/slab.c:2584 cache_alloc_refill+0x27f/0x380 mm/slab.c:2957 ____cache_alloc mm/slab.c:3040 [inline] ____cache_alloc mm/slab.c:3023 [inline] __do_cache_alloc mm/slab.c:3267 [inline] slab_alloc mm/slab.c:3309 [inline] __do_kmalloc mm/slab.c:3708 [inline] __kmalloc+0x3b3/0x4d0 mm/slab.c:3719 kmalloc include/linux/slab.h:586 [inline] kzalloc include/linux/slab.h:714 [inline] tomoyo_encode2.part.0+0xe9/0x3a0 security/tomoyo/realpath.c:45 tomoyo_encode2 security/tomoyo/realpath.c:31 [inline] tomoyo_encode+0x28/0x50 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x186/0x620 security/tomoyo/realpath.c:288 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x21b/0x400 security/tomoyo/file.c:822 security_inode_getattr+0xcf/0x140 security/security.c:1350 vfs_getattr fs/stat.c:157 [inline] vfs_statx+0x16a/0x390 fs/stat.c:232 vfs_fstatat+0x8c/0xb0 fs/stat.c:255 __do_sys_newfstatat+0x91/0x110 fs/stat.c:425 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1356 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3328 [inline] free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423 __vunmap+0x85d/0xd30 mm/vmalloc.c:2667 __vfree+0x3c/0xd0 mm/vmalloc.c:2715 vfree+0x5a/0x90 mm/vmalloc.c:2746 __do_replace+0x16b/0x890 net/ipv6/netfilter/ip6_tables.c:1117 do_replace net/ipv6/netfilter/ip6_tables.c:1157 [inline] do_ip6t_set_ctl+0x90d/0xb90 net/ipv6/netfilter/ip6_tables.c:1639 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1026 tcp_setsockopt+0x136/0x2520 net/ipv4/tcp.c:3696 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88807d37b800: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ffff88807d37b880: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff88807d37b900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88807d37b980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88807d37ba00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc Fixes: c85bb41e9318 ("igmp: fix ip_mc_sf_allow race [v5]") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Flavio Leitner Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/igmp.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -2416,9 +2416,10 @@ int ip_mc_source(int add, int omode, str newpsl->sl_addr[i] =3D psl->sl_addr[i]; /* decrease mem now to avoid the memleak warning */ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc); - kfree_rcu(psl, rcu); } rcu_assign_pointer(pmc->sflist, newpsl); + if (psl) + kfree_rcu(psl, rcu); psl =3D newpsl; } rv =3D 1; /* > 0 for insert logic below if sl_count is 0 */ @@ -2516,11 +2517,13 @@ int ip_mc_msfilter(struct sock *sk, stru psl->sl_count, psl->sl_addr, 0); /* decrease mem now to avoid the memleak warning */ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc); - kfree_rcu(psl, rcu); - } else + } else { (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode, 0, NULL, 0); + } rcu_assign_pointer(pmc->sflist, newpsl); + if (psl) + kfree_rcu(psl, rcu); pmc->sfmode =3D msf->imsf_fmode; err =3D 0; done: From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3ED8FC38A2B for ; Tue, 10 May 2022 13:40:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243997AbiEJNnw (ORCPT ); Tue, 10 May 2022 09:43:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40106 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243378AbiEJNam (ORCPT ); Tue, 10 May 2022 09:30:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 750812C511A; Tue, 10 May 2022 06:21:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1555F616D0; Tue, 10 May 2022 13:21:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2103AC385A6; Tue, 10 May 2022 13:21:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188886; bh=NmlfjBAVVEP/vw+cxYqZN4npXt02El+JYjH9uacL4go=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DQCh7XtIEUUU3dr4s85wAprRgDQqiIQ69jkKAiucbhSIPYiU6QM8MeP2GRWVqOOqT weD2q6Pz5cB+ah6nxohD3QiA0ciGNJBr6piuZjlDxmWDPc7440d7JbLb+qOXeKpUmN 66B5h0eG9do6ErMVA5LmiwrBUtM+9IoimhWqek3k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasant Hegde , Sandipan Das , Paolo Bonzini , Sasha Levin Subject: [PATCH 4.19 81/88] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Date: Tue, 10 May 2022 15:08:06 +0200 Message-Id: <20220510130736.084725368@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sandipan Das [ Upstream commit 5a1bde46f98b893cda6122b00e94c0c40a6ead3c ] On some x86 processors, CPUID leaf 0xA provides information on Architectural Performance Monitoring features. It advertises a PMU version which Qemu uses to determine the availability of additional MSRs to manage the PMCs. Upon receiving a KVM_GET_SUPPORTED_CPUID ioctl request for the same, the kernel constructs return values based on the x86_pmu_capability irrespective of the vendor. This leaf and the additional MSRs are not supported on AMD and Hygon processors. If AMD PerfMonV2 is detected, the PMU version is set to 2 and guest startup breaks because of an attempt to access a non-existent MSR. Return zeros to avoid this. Fixes: a6c06ed1a60a ("KVM: Expose the architectural performance monitoring = CPUID leaf") Reported-by: Vasant Hegde Signed-off-by: Sandipan Das Message-Id: <3fef83d9c2b2f7516e8ff50d60851f29a4bcb716.1651058600.git.sandip= an.das@amd.com> Signed-off-by: Paolo Bonzini Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/kvm/cpuid.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 097eef712cdc..0489ffc3dfe5 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -532,6 +532,11 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entr= y2 *entry, u32 function, union cpuid10_eax eax; union cpuid10_edx edx; =20 + if (!static_cpu_has(X86_FEATURE_ARCH_PERFMON)) { + entry->eax =3D entry->ebx =3D entry->ecx =3D entry->edx =3D 0; + break; + } + perf_get_x86_pmu_capability(&cap); =20 /* --=20 2.35.1 From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09475C433EF for ; Tue, 10 May 2022 13:39:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243558AbiEJNno (ORCPT ); Tue, 10 May 2022 09:43:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57710 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243379AbiEJNam (ORCPT ); Tue, 10 May 2022 09:30:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 933F722A8BB; Tue, 10 May 2022 06:21:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 80365B81D9A; Tue, 10 May 2022 13:21:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0AF5C385A6; Tue, 10 May 2022 13:21:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188889; bh=vZukyU5lrQVD+Yudd7+ZS40qi3G/anqiDPUAELIdM3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2Iyb8/ZFtd21ScSVaCa8sb3Y3DdlAZ5+CUUcqE0QDSmZ2XjDgFcEJpFvRuwomfexI Kn9LfmHRIjDG89vS/DShasT4Wg5G0/bNaBdpBn6R9fUTutVDILvoFx6ZpcuR4evxK1 aYrHx9eSz7bnWk1k7nUHWR2IT/KsJGP7kRGnPoh0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ivan Babrou , Minchan Kim , Nitin Gupta , Sergey Senozhatsky , Jens Axboe , David Hildenbrand , Andrew Morton , Linus Torvalds Subject: [PATCH 4.19 82/88] mm: fix unexpected zeroed page mapping with zram swap Date: Tue, 10 May 2022 15:08:07 +0200 Message-Id: <20220510130736.113648841@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Minchan Kim commit e914d8f00391520ecc4495dd0ca0124538ab7119 upstream. Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault will read zeroed data The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't increase the refcount of swap slot at copy_mm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swap_slot_free_notify function. With this patch, CPU A will see correct data. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap_free swap_range_free bd_disk->fops->swap_slot_free_notify swap_readpage read zeroed data pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return on next refault will see mapped data by CPU B The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and do_swap_page is followed by swap_free so it will free the compressed form from in zram quickly. Link: https://lkml.kernel.org/r/YjTVVxIAsnKAXjTd@google.com Fixes: 0bcac06f27d7 ("mm, swap: skip swapcache for swapin of synchronous de= vice") Reported-by: Ivan Babrou Tested-by: Ivan Babrou Signed-off-by: Minchan Kim Cc: Nitin Gupta Cc: Sergey Senozhatsky Cc: Jens Axboe Cc: David Hildenbrand Cc: [4.14+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- mm/page_io.c | 55 ------------------------------------------------------- 1 file changed, 55 deletions(-) --- a/mm/page_io.c +++ b/mm/page_io.c @@ -71,55 +71,6 @@ void end_swap_bio_write(struct bio *bio) bio_put(bio); } =20 -static void swap_slot_free_notify(struct page *page) -{ - struct swap_info_struct *sis; - struct gendisk *disk; - swp_entry_t entry; - - /* - * There is no guarantee that the page is in swap cache - the software - * suspend code (at least) uses end_swap_bio_read() against a non- - * swapcache page. So we must check PG_swapcache before proceeding with - * this optimization. - */ - if (unlikely(!PageSwapCache(page))) - return; - - sis =3D page_swap_info(page); - if (!(sis->flags & SWP_BLKDEV)) - return; - - /* - * The swap subsystem performs lazy swap slot freeing, - * expecting that the page will be swapped out again. - * So we can avoid an unnecessary write if the page - * isn't redirtied. - * This is good for real swap storage because we can - * reduce unnecessary I/O and enhance wear-leveling - * if an SSD is used as the as swap device. - * But if in-memory swap device (eg zram) is used, - * this causes a duplicated copy between uncompressed - * data in VM-owned memory and compressed data in - * zram-owned memory. So let's free zram-owned memory - * and make the VM-owned decompressed page *dirty*, - * so the page should be swapped out somewhere again if - * we again wish to reclaim it. - */ - disk =3D sis->bdev->bd_disk; - entry.val =3D page_private(page); - if (disk->fops->swap_slot_free_notify && - __swap_count(sis, entry) =3D=3D 1) { - unsigned long offset; - - offset =3D swp_offset(entry); - - SetPageDirty(page); - disk->fops->swap_slot_free_notify(sis->bdev, - offset); - } -} - static void end_swap_bio_read(struct bio *bio) { struct page *page =3D bio_first_page_all(bio); @@ -135,7 +86,6 @@ static void end_swap_bio_read(struct bio } =20 SetPageUptodate(page); - swap_slot_free_notify(page); out: unlock_page(page); WRITE_ONCE(bio->bi_private, NULL); @@ -373,11 +323,6 @@ int swap_readpage(struct page *page, boo =20 ret =3D bdev_read_page(sis->bdev, map_swap_page(page, &sis->bdev), page); if (!ret) { - if (trylock_page(page)) { - swap_slot_free_notify(page); - unlock_page(page); - } - count_vm_event(PSWPIN); return 0; } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38B5AC433EF for ; Tue, 10 May 2022 13:46:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240210AbiEJNuY (ORCPT ); Tue, 10 May 2022 09:50:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48758 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243435AbiEJNa4 (ORCPT ); Tue, 10 May 2022 09:30:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7272C2C7A77; Tue, 10 May 2022 06:21:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7987061663; Tue, 10 May 2022 13:21:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89B24C385C9; Tue, 10 May 2022 13:21:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188894; bh=WCI11bdAGF3EREfpmGf7G6RtuJWIfLFDZarkLZWOsS0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DCmgZE6zY3YDNDoQpnFT6j0atRnWn4K1geToFA5kBjN1B1On/l1iEZbTmvheL6j/p QhDGG+zY3RJan1DOSDIhcyBe/OP+Z9xux+8r+eaCiQaqiyzKzdsYelFIWy2NIybuF0 XQEKv0h1hni2hHlDyi8fzmF5ZztNP06H2hSOeBHs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Francesco Ruggeri , "David S. Miller" Subject: [PATCH 4.19 83/88] tcp: make sure treq->af_specific is initialized Date: Tue, 10 May 2022 15:08:08 +0200 Message-Id: <20220510130736.143634816@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit ba5a4fdd63ae0c575707030db0b634b160baddd7 upstream. syzbot complained about a recent change in TCP stack, hitting a NULL pointer [1] tcp request sockets have an af_specific pointer, which was used before the blamed change only for SYNACK generation in non SYNCOOKIE mode. tcp requests sockets momentarily created when third packet coming from client in SYNCOOKIE mode were not using treq->af_specific. Make sure this field is populated, in the same way normal TCP requests sockets do in tcp_conn_request(). [1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cooki= es. Check SNMP counters. general protection fault, probably for non-canonical address 0xdffffc000000= 0001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted 5.18.0-rc3-syzkaller-002= 24-g5fd1fe4807f9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0 net/ipv4/tcp_minisocks.c:534 Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8 = 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 8= 5 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48 RSP: 0018:ffffc90000de0588 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100 RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008 RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0 R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f517fe58700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267 tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207 cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline] tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486 tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725 ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 process_backlog+0x3a0/0x7c0 net/core/dev.c:5847 __napi_poll+0xb3/0x6e0 net/core/dev.c:6413 napi_poll net/core/dev.c:6480 [inline] net_rx_action+0x8ec/0xc60 net/core/dev.c:6567 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 Fixes: 5b0b9e4c2c89 ("tcp: md5: incorrect tcp_header_len for incoming conne= ctions") Signed-off-by: Eric Dumazet Cc: Francesco Ruggeri Signed-off-by: David S. Miller [fruggeri: Account for backport conflicts from 35b2c3211609 and 6fc8c827dd4= f] Signed-off-by: Francesco Ruggeri Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/tcp.h | 5 +++++ net/ipv4/syncookies.c | 1 + net/ipv4/tcp_ipv4.c | 2 +- net/ipv6/syncookies.c | 1 + net/ipv6/tcp_ipv6.c | 2 +- 5 files changed, 9 insertions(+), 2 deletions(-) --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1939,6 +1939,11 @@ struct tcp_request_sock_ops { enum tcp_synack_type synack_type); }; =20 +extern const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops; +#if IS_ENABLED(CONFIG_IPV6) +extern const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops; +#endif + #ifdef CONFIG_SYN_COOKIES static inline __u32 cookie_init_sequence(const struct tcp_request_sock_ops= *ops, const struct sock *sk, struct sk_buff *skb, --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock =20 ireq =3D inet_rsk(req); treq =3D tcp_rsk(req); + treq->af_specific =3D &tcp_request_sock_ipv4_ops; treq->rcv_isn =3D ntohl(th->seq) - 1; treq->snt_isn =3D cookie; treq->ts_off =3D 0; --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1372,7 +1372,7 @@ struct request_sock_ops tcp_request_sock .syn_ack_timeout =3D tcp_syn_ack_timeout, }; =20 -static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops =3D { +const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops =3D { .mss_clamp =3D TCP_MSS_DEFAULT, #ifdef CONFIG_TCP_MD5SIG .req_md5_lookup =3D tcp_v4_md5_lookup, --- a/net/ipv6/syncookies.c +++ b/net/ipv6/syncookies.c @@ -181,6 +181,7 @@ struct sock *cookie_v6_check(struct sock =20 ireq =3D inet_rsk(req); treq =3D tcp_rsk(req); + treq->af_specific =3D &tcp_request_sock_ipv6_ops; treq->tfo_listener =3D false; =20 if (security_inet_conn_request(sk, skb, req)) --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -789,7 +789,7 @@ struct request_sock_ops tcp6_request_soc .syn_ack_timeout =3D tcp_syn_ack_timeout, }; =20 -static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops =3D { +const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops =3D { .mss_clamp =3D IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr), #ifdef CONFIG_TCP_MD5SIG From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 422F8C4167E for ; Tue, 10 May 2022 13:45:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244987AbiEJNrK (ORCPT ); Tue, 10 May 2022 09:47:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243574AbiEJNbY (ORCPT ); Tue, 10 May 2022 09:31:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9695D2C818C; Tue, 10 May 2022 06:21:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E5F33B81B32; Tue, 10 May 2022 13:21:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D13CC385A6; Tue, 10 May 2022 13:21:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188897; bh=m22VRSCGvY02pwAlVUge53me6XQ+HmqDRyiwK3/LdSs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xhbwz5dmxvqF2LY6qbh+99gVIokgDSwQto2hxql9RT4//miJvbFTpGZH6Y7P5ish+ 6FWxK/gQlYt2wc+b2rvnIjvxPjOPAzxBnP2+i/RsctFIxPtJIqjgsRPxNwr0VnGbhi dDQYgX3NRWDCgE2HGFkeywbrgJNnPHeKtQqn2d1U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiazi Li , Mike Snitzer , Mikulas Patocka , Mike Snitzer Subject: [PATCH 4.19 84/88] dm: fix mempool NULL pointer race when completing IO Date: Tue, 10 May 2022 15:08:09 +0200 Message-Id: <20220510130736.172498139@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiazi Li commit d208b89401e073de986dc891037c5a668f5d5d95 upstream. dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL: task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io [ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170 Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io(). Cc: stable@vger.kernel.org Signed-off-by: Jiazi Li Signed-off-by: Mike Snitzer Signed-off-by: Mikulas Patocka Reviewed-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/md/dm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -631,21 +631,20 @@ static void start_io_acct(struct dm_io * false, 0, &io->stats_aux); } =20 -static void end_io_acct(struct dm_io *io) +static void end_io_acct(struct mapped_device *md, struct bio *bio, + unsigned long start_time, struct dm_stats_aux *stats_aux) { - struct mapped_device *md =3D io->md; - struct bio *bio =3D io->orig_bio; - unsigned long duration =3D jiffies - io->start_time; + unsigned long duration =3D jiffies - start_time; int pending; int rw =3D bio_data_dir(bio); =20 generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, - io->start_time); + start_time); =20 if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), - true, duration, &io->stats_aux); + true, duration, stats_aux); =20 /* * After this is decremented the bio must not be touched if it is @@ -872,6 +871,8 @@ static void dec_pending(struct dm_io *io blk_status_t io_error; struct bio *bio; struct mapped_device *md =3D io->md; + unsigned long start_time =3D 0; + struct dm_stats_aux stats_aux; =20 /* Push-back supersedes any I/O errors */ if (unlikely(error)) { @@ -898,8 +899,10 @@ static void dec_pending(struct dm_io *io =20 io_error =3D io->status; bio =3D io->orig_bio; - end_io_acct(io); + start_time =3D io->start_time; + stats_aux =3D io->stats_aux; free_io(md, io); + end_io_acct(md, bio, start_time, &stats_aux); =20 if (io_error =3D=3D BLK_STS_DM_REQUEUE) return; From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C531C433F5 for ; Tue, 10 May 2022 13:46:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241107AbiEJNuw (ORCPT ); Tue, 10 May 2022 09:50:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243438AbiEJNa4 (ORCPT ); Tue, 10 May 2022 09:30:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 08B682C96EF; Tue, 10 May 2022 06:21:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B1DD7B81DA3; Tue, 10 May 2022 13:21:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 243DAC385A6; Tue, 10 May 2022 13:21:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188900; bh=QXC/i3nWTvZAaO7oHDiV8lInZ5xH74hfoB2oDb+Z6yg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0C/iHV3ZZMNhl6jksxBY7eqav9rwfpK2kB2Dyqv17yDQPBPT7nAqv9NHm0wyasNr/ zuvA8oH7OY5nWKutXCmBJlkJmjZc2HzTRr64uYN9wMS5Jh7x8nTukgYSudwXrYnZ0O ecZOikPzkaW8F3A08zScXmP0r1JlAr91e+0lYP2w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Mike Snitzer , Mike Snitzer Subject: [PATCH 4.19 85/88] dm: interlock pending dm_io and dm_wait_for_bios_completion Date: Tue, 10 May 2022 15:08:10 +0200 Message-Id: <20220510130736.201580940@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Snitzer commit 9f6dc633761006f974701d4c88da71ab68670749 upstream. Commit d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") didn't go far enough. When bio_end_io_acct ends the count of in-flight I/Os may reach zero and the DM device may be suspended. There is a possibility that the suspend races with dm_stats_account_io. Fix this by adding percpu "pending_io" counters to track outstanding dm_io. Move kicking of suspend queue to dm_io_dec_pending(). Also, rename md_in_flight_bios() to dm_in_flight_bios() and update it to iterate all pending_io counters. Fixes: d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") Cc: stable@vger.kernel.org Co-developed-by: Mikulas Patocka Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Mikulas Patocka Reviewed-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2475,6 +2475,8 @@ static int dm_wait_for_completion(struct } finish_wait(&md->wait, &wait); =20 + smp_rmb(); /* paired with atomic_dec_return in end_io_acct */ + return r; } From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19D8DC43219 for ; Tue, 10 May 2022 13:40:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243945AbiEJNob (ORCPT ); Tue, 10 May 2022 09:44:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243436AbiEJNa4 (ORCPT ); Tue, 10 May 2022 09:30:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 088792C96E1; Tue, 10 May 2022 06:21:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DF848615C8; Tue, 10 May 2022 13:21:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED148C385C2; Tue, 10 May 2022 13:21:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188903; bh=0zLrIOIS/uXNi/PoMZbKBbUyQytHmArs1AmrourD0Hc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QDGnZpT8+inlPIAZP7gn5vQpqMVTPwUpyTkwoTcwBIAF//KxHz0nKqePH8ZPeGhq4 cITkfzUVgtXT8E4d/Zc3rN5LuKNC4Li/bw9aD47c9NCueN/mxplZQoGWNIgM7ZeCAp JJp6uL71Iqet1zJfUWdhpZ1WontuSGTJR46hHPUI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Lorenzo Pieralisi Subject: [PATCH 4.19 86/88] PCI: aardvark: Clear all MSIs at setup Date: Tue, 10 May 2022 15:08:11 +0200 Message-Id: <20220510130736.230112786@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pali Roh=C3=A1r commit 7d8dc1f7cd007a7ce94c5b4c20d63a8b8d6d7751 upstream. We already clear all the other interrupts (ISR0, ISR1, HOST_CTRL_INT). Define a new macro PCIE_MSI_ALL_MASK and do the same clearing for MSIs, to ensure that we don't start receiving spurious interrupts. Use this new mask in advk_pcie_handle_msi(); Link: https://lore.kernel.org/r/20211130172913.9727-5-kabel@kernel.org Signed-off-by: Pali Roh=C3=A1r Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Lorenzo Pieralisi Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pci/controller/pci-aardvark.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/pci/controller/pci-aardvark.c +++ b/drivers/pci/controller/pci-aardvark.c @@ -103,6 +103,7 @@ #define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54) #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58) #define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C) +#define PCIE_MSI_ALL_MASK GENMASK(31, 0) #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) #define PCIE_MSI_DATA_MASK GENMASK(15, 0) =20 @@ -489,6 +490,7 @@ static void advk_pcie_setup_hw(struct ad advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG); =20 /* Clear all interrupts */ + advk_writel(pcie, PCIE_MSI_ALL_MASK, PCIE_MSI_STATUS_REG); advk_writel(pcie, PCIE_ISR0_ALL_MASK, PCIE_ISR0_REG); advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_REG); advk_writel(pcie, PCIE_IRQ_ALL_MASK, HOST_CTRL_INT_STATUS_REG); @@ -501,7 +503,7 @@ static void advk_pcie_setup_hw(struct ad advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_MASK_REG); =20 /* Unmask all MSI's */ - advk_writel(pcie, 0, PCIE_MSI_MASK_REG); + advk_writel(pcie, ~(u32)PCIE_MSI_ALL_MASK, PCIE_MSI_MASK_REG); =20 /* Enable summary interrupt for GIC SPI source */ reg =3D PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK); @@ -1037,7 +1039,7 @@ static void advk_pcie_handle_msi(struct =20 msi_mask =3D advk_readl(pcie, PCIE_MSI_MASK_REG); msi_val =3D advk_readl(pcie, PCIE_MSI_STATUS_REG); - msi_status =3D msi_val & ~msi_mask; + msi_status =3D msi_val & ((~msi_mask) & PCIE_MSI_ALL_MASK); =20 for (msi_idx =3D 0; msi_idx < MSI_IRQ_NUM; msi_idx++) { if (!(BIT(msi_idx) & msi_status)) From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CBB8C433EF for ; Tue, 10 May 2022 13:46:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244446AbiEJNuK (ORCPT ); Tue, 10 May 2022 09:50:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56310 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243451AbiEJNa6 (ORCPT ); Tue, 10 May 2022 09:30:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AFE972CC115; Tue, 10 May 2022 06:21:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D1934616E8; Tue, 10 May 2022 13:21:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DE530C385C2; Tue, 10 May 2022 13:21:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188906; bh=WL0sRRztelCduyY75GlVCGuknG1Ttv5FgWb8a90+HXY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NBMJcKNKQZbFfJHTC8fRDMZ8l3kiHvlOv2Pj4VEaEXCS/8WDFOWbBxuIGeKkTi8dQ 2ABuKjopwomxLkieC4t9brqCtejyaDJsEVveFXRmQGE30aTJIlTBxy2nPTqjLUUEMd pWMFTgGSI0Udsu0buLJWUBY4hJQXENS+ytHpNcHQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Lorenzo Pieralisi Subject: [PATCH 4.19 87/88] PCI: aardvark: Fix reading MSI interrupt number Date: Tue, 10 May 2022 15:08:12 +0200 Message-Id: <20220510130736.258414984@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pali Roh=C3=A1r commit 805dfc18dd3d4dd97a987d4406593b5a225b1253 upstream. In advk_pcie_handle_msi() it is expected that when bit i in the W1C register PCIE_MSI_STATUS_REG is cleared, the PCIE_MSI_PAYLOAD_REG is updated to contain the MSI number corresponding to index i. Experiments show that this is not so, and instead PCIE_MSI_PAYLOAD_REG always contains the number of the last received MSI, overall. Do not read PCIE_MSI_PAYLOAD_REG register for determining MSI interrupt number. Since Aardvark already forbids more than 32 interrupts and uses own allocated hwirq numbers, the msi_idx already corresponds to the received MSI number. Link: https://lore.kernel.org/r/20220110015018.26359-3-kabel@kernel.org Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller drive= r") Signed-off-by: Pali Roh=C3=A1r Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Lorenzo Pieralisi Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pci/controller/pci-aardvark.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) --- a/drivers/pci/controller/pci-aardvark.c +++ b/drivers/pci/controller/pci-aardvark.c @@ -1035,7 +1035,7 @@ static void advk_pcie_remove_irq_domain( static void advk_pcie_handle_msi(struct advk_pcie *pcie) { u32 msi_val, msi_mask, msi_status, msi_idx; - u16 msi_data; + int virq; =20 msi_mask =3D advk_readl(pcie, PCIE_MSI_MASK_REG); msi_val =3D advk_readl(pcie, PCIE_MSI_STATUS_REG); @@ -1045,13 +1045,9 @@ static void advk_pcie_handle_msi(struct if (!(BIT(msi_idx) & msi_status)) continue; =20 - /* - * msi_idx contains bits [4:0] of the msi_data and msi_data - * contains 16bit MSI interrupt number - */ advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG); - msi_data =3D advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK; - generic_handle_irq(msi_data); + virq =3D irq_find_mapping(pcie->msi_inner_domain, msi_idx); + generic_handle_irq(virq); } =20 advk_writel(pcie, PCIE_ISR0_MSI_INT_PENDING, From nobody Fri May 8 05:14:46 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1AD1CC433F5 for ; Tue, 10 May 2022 13:40:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243953AbiEJNot (ORCPT ); Tue, 10 May 2022 09:44:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243668AbiEJNbz (ORCPT ); Tue, 10 May 2022 09:31:55 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FDE52CC131; Tue, 10 May 2022 06:21:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B1E0860C1C; Tue, 10 May 2022 13:21:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B7500C385C2; Tue, 10 May 2022 13:21:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188909; bh=09iYEBo61QGv2MPZ1PJgYqKZ2Yf52Nz+eYKGn4iEPOY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xgtVKjR9WTsvRyjQoCG3Q/JXbr5ProvjQd//jHT5C0mhl6wrJVrSxzBFS20rPNg64 ocDtunPz+WxTe07QGETL3pTVe/I2/LXdA4WkowTwOdBiTF++sHwa3nWkqDk27AWWNk /5akQDVb1YyNPhUBl5Wv+oDH06S2CgpzzLsz6hqA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ricky Wu , Ulf Hansson , Christian Loehle Subject: [PATCH 4.19 88/88] mmc: rtsx: add 74 Clocks in power on flow Date: Tue, 10 May 2022 15:08:13 +0200 Message-Id: <20220510130736.285970056@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130733.735278074@linuxfoundation.org> References: <20220510130733.735278074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ricky WU commit 1f311c94aabdb419c28e3147bcc8ab89269f1a7e upstream. SD spec definition: "Host provides at least 74 Clocks before issuing first command" After 1ms for the voltage stable then start issuing the Clock signals if POWER STATE is MMC_POWER_OFF to MMC_POWER_UP to issue Clock signal to card MMC_POWER_UP to MMC_POWER_ON to stop issuing signal to card Signed-off-by: Ricky Wu Link: https://lore.kernel.org/r/1badf10aba764191a1a752edcbf90389@realtek.com Signed-off-by: Ulf Hansson Signed-off-by: Christian Loehle Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/mmc/host/rtsx_pci_sdmmc.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) --- a/drivers/mmc/host/rtsx_pci_sdmmc.c +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c @@ -49,10 +49,7 @@ struct realtek_pci_sdmmc { bool double_clk; bool eject; bool initial_mode; - int power_state; -#define SDMMC_POWER_ON 1 -#define SDMMC_POWER_OFF 0 - + int prev_power_state; int sg_count; s32 cookie; int cookie_sg_count; @@ -914,14 +911,21 @@ static int sd_set_bus_width(struct realt return err; } =20 -static int sd_power_on(struct realtek_pci_sdmmc *host) +static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power= _mode) { struct rtsx_pcr *pcr =3D host->pcr; int err; =20 - if (host->power_state =3D=3D SDMMC_POWER_ON) + if (host->prev_power_state =3D=3D MMC_POWER_ON) return 0; =20 + if (host->prev_power_state =3D=3D MMC_POWER_UP) { + rtsx_pci_write_register(pcr, SD_BUS_STAT, SD_CLK_TOGGLE_EN, 0); + goto finish; + } + + msleep(100); + rtsx_pci_init_cmd(pcr); rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_SELECT, 0x07, SD_MOD_SEL); rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_SHARE_MODE, @@ -940,11 +944,17 @@ static int sd_power_on(struct realtek_pc if (err < 0) return err; =20 + mdelay(1); + err =3D rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN); if (err < 0) return err; =20 - host->power_state =3D SDMMC_POWER_ON; + /* send at least 74 clocks */ + rtsx_pci_write_register(pcr, SD_BUS_STAT, SD_CLK_TOGGLE_EN, SD_CLK_TOGGLE= _EN); + +finish: + host->prev_power_state =3D power_mode; return 0; } =20 @@ -953,7 +963,7 @@ static int sd_power_off(struct realtek_p struct rtsx_pcr *pcr =3D host->pcr; int err; =20 - host->power_state =3D SDMMC_POWER_OFF; + host->prev_power_state =3D MMC_POWER_OFF; =20 rtsx_pci_init_cmd(pcr); =20 @@ -979,7 +989,7 @@ static int sd_set_power_mode(struct real if (power_mode =3D=3D MMC_POWER_OFF) err =3D sd_power_off(host); else - err =3D sd_power_on(host); + err =3D sd_power_on(host, power_mode); =20 return err; } @@ -1414,10 +1424,11 @@ static int rtsx_pci_sdmmc_drv_probe(stru =20 host =3D mmc_priv(mmc); host->pcr =3D pcr; + mmc->ios.power_delay_ms =3D 5; host->mmc =3D mmc; host->pdev =3D pdev; host->cookie =3D -1; - host->power_state =3D SDMMC_POWER_OFF; + host->prev_power_state =3D MMC_POWER_OFF; INIT_WORK(&host->work, sd_request); platform_set_drvdata(pdev, host); pcr->slots[RTSX_SD_CARD].p_dev =3D pdev;