March 2022 - Linux-stable-mirror

[PATCH] gpio: Revert regression in sysfs-gpio (gpiolib.c)

by Marcelo Roberto Jimenez

Some GPIO lines have stopped working after the patch commit 2ab73c6d8323f ("gpio: Support GPIO controllers without pin-ranges") And this has supposedly been fixed in the following patches commit 89ad556b7f96a ("gpio: Avoid using pin ranges with !PINCTRL") commit 6dbbf84603961 ("gpiolib: Don't free if pin ranges are not defined") But an erratic behavior where some GPIO lines work while others do not work has been introduced. This patch reverts those changes so that the sysfs-gpio interface works properly again. Signed-off-by: Marcelo Roberto Jimenez <marcelo.jimenez(a)gmail.com> --- Hi, My system is ARM926EJ-S rev 5 (v5l) (AT91SAM9G25), the board is an ACME Systems Arietta. The system used sysfs-gpio to manage a few gpio lines, and I have noticed that some have stopped working. The test script is very simple: #! /bin/bash cd /sys/class/gpio/ echo 24 > export cd pioA24 echo out > direction echo 0 > value cat value echo 1 > value cat value echo 0 > value cat value echo 1 > value cat value cd .. echo 24 > unexport In a "good" kernel, this script outputs 0, 1, 0, 1. In a bad kernel, the output result is 1, 1, 1, 1. Also it must be possible to run this script twice without errors, that was the issue with the gpiochip_generic_free() call that had been addressed in another patch. In my system PINCTRL is automatically selected by SOC_AT91SAM9 [=y] && ARCH_AT91 [=y] && ARCH_MULTI_V5 [=y] So it is not an option to disable it to make it work. Best regards, Marcelo. drivers/gpio/gpiolib.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index af5bb8fedfea..ac69ec8fb37a 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -1804,11 +1804,6 @@ static inline void gpiochip_irqchip_free_valid_mask(struct gpio_chip *gc) */ int gpiochip_generic_request(struct gpio_chip *gc, unsigned offset) { -#ifdef CONFIG_PINCTRL - if (list_empty(&gc->gpiodev->pin_ranges)) - return 0; -#endif - return pinctrl_gpio_request(gc->gpiodev->base + offset); } EXPORT_SYMBOL_GPL(gpiochip_generic_request); @@ -1820,11 +1815,6 @@ EXPORT_SYMBOL_GPL(gpiochip_generic_request); */ void gpiochip_generic_free(struct gpio_chip *gc, unsigned offset) { -#ifdef CONFIG_PINCTRL - if (list_empty(&gc->gpiodev->pin_ranges)) - return; -#endif - pinctrl_gpio_free(gc->gpiodev->base + offset); } EXPORT_SYMBOL_GPL(gpiochip_generic_free); -- 2.30.2

1 year, 11 months

9
27
0 0

[PATCH] ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min

by Marek Vasut

While the $val/$val2 values passed in from userspace are always >= 0 integers, the limits of the control can be signed integers and the $min can be non-zero and less than zero. To correctly validate $val/$val2 against platform_max, add the $min offset to val first. Fixes: 817f7c9335ec0 ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()") Signed-off-by: Marek Vasut <marex(a)denx.de> Cc: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org --- sound/soc/soc-ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index f24f7354f46fe..6389a512c4dc6 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -317,7 +317,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, mask = BIT(sign_bit + 1) - 1; val = ucontrol->value.integer.value[0]; - if (mc->platform_max && val > mc->platform_max) + if (mc->platform_max && ((int)val + min) > mc->platform_max) return -EINVAL; if (val > max - min) return -EINVAL; @@ -330,7 +330,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, val = val << shift; if (snd_soc_volsw_is_stereo(mc)) { val2 = ucontrol->value.integer.value[1]; - if (mc->platform_max && val2 > mc->platform_max) + if (mc->platform_max && ((int)val2 + min) > mc->platform_max) return -EINVAL; if (val2 > max - min) return -EINVAL; -- 2.34.1

1 year, 11 months

6
14
0 0

[PATCH v3 0/2] mm: fix cma allocation fail sometimes

by Dong Aisheng

We observed an issue with NXP 5.15 LTS kernel that dma_alloc_coherent() may fail sometimes when there're multiple processes trying to allocate CMA memory. This issue can be very easily reproduced on MX6Q SDB board with latest linux-next kernel by writing a test module creating 16 or 32 threads allocating random size of CMA memory in parallel at the background. Or simply enabling CONFIG_CMA_DEBUG, you can see endless of CMA alloc retries during booting: [ 1.452124] cma: cma_alloc(): memory range at (ptrval) is busy,retrying .... (thousands of reties) The root cause of this issue is that since commit a4efc174b382 ("mm/cma.c: remove redundant cma_mutex lock"), CMA supports concurrent memory allocation. It's possible that the memory range process A try to alloc has already been isolated by the allocation of process B during memory migration. The problem here is that the memory range isolated during one allocation by start_isolate_page_range() could be much bigger than the real size we want to alloc due to the range is aligned to MAX_ORDER_NR_PAGES. Taking an ARMv7 platform with 1G memory as an example, when MAX_ORDER_NR_PAGES is big (e.g. 32M with max_order 14) and CMA memory is relatively small (e.g. 128M), there're only 4 MAX_ORDER slot, then it's very easy that all CMA memory may have already been isolated by other processes when one trying to allocate memory using dma_alloc_coherent(). Since current CMA code will only scan one time of whole available CMA memory, then dma_alloc_coherent() may easy fail due to contention with other processes. This patchset introduces a retry mechanism to rescan CMA bitmap for -EBUSY error in case the target pageblock may has been temporarily isolated by others and released later. It also improves the CMA allocation performance by trying the next MAX_ORDER_NR_PAGES range during reties rather than looping within the same isolated range in small steps which wasting CPU mips. The following test is based on linux-next: next-20211213. Without the fix, it's easily fail. # insmod cma_alloc.ko pnum=16 [ 274.322369] CMA alloc test enter: thread number: 16 [ 274.329948] cpu: 0, pid: 692, index 4 pages 144 [ 274.330143] cpu: 1, pid: 694, index 2 pages 44 [ 274.330359] cpu: 2, pid: 695, index 7 pages 757 [ 274.330760] cpu: 2, pid: 696, index 4 pages 144 [ 274.330974] cpu: 2, pid: 697, index 6 pages 512 [ 274.331223] cpu: 2, pid: 698, index 6 pages 512 [ 274.331499] cpu: 2, pid: 699, index 2 pages 44 [ 274.332228] cpu: 2, pid: 700, index 0 pages 7 [ 274.337421] cpu: 0, pid: 701, index 1 pages 38 [ 274.337618] cpu: 2, pid: 702, index 0 pages 7 [ 274.344669] cpu: 1, pid: 703, index 0 pages 7 [ 274.344807] cpu: 3, pid: 704, index 6 pages 512 [ 274.348269] cpu: 2, pid: 705, index 5 pages 148 [ 274.349490] cma: cma_alloc: reserved: alloc failed, req-size: 38 pages, ret: -16 [ 274.366292] cpu: 1, pid: 706, index 4 pages 144 [ 274.366562] cpu: 0, pid: 707, index 3 pages 128 [ 274.367356] cma: cma_alloc: reserved: alloc failed, req-size: 128 pages, ret: -16 [ 274.367370] cpu: 0, pid: 707, index 3 pages 128 failed [ 274.371148] cma: cma_alloc: reserved: alloc failed, req-size: 148 pages, ret: -16 [ 274.375348] cma: cma_alloc: reserved: alloc failed, req-size: 144 pages, ret: -16 [ 274.384256] cpu: 2, pid: 708, index 0 pages 7 .... With the fix, 32 threads allocating in parallel can pass overnight stress test. root@imx6qpdlsolox:~# insmod cma_alloc.ko pnum=32 [ 112.976809] cma_alloc: loading out-of-tree module taints kernel. [ 112.984128] CMA alloc test enter: thread number: 32 [ 112.989748] cpu: 2, pid: 707, index 6 pages 512 [ 112.994342] cpu: 1, pid: 708, index 6 pages 512 [ 112.995162] cpu: 0, pid: 709, index 3 pages 128 [ 112.995867] cpu: 2, pid: 710, index 0 pages 7 [ 112.995910] cpu: 3, pid: 711, index 2 pages 44 [ 112.996005] cpu: 3, pid: 712, index 7 pages 757 [ 112.996098] cpu: 3, pid: 713, index 7 pages 757 ... [41877.368163] cpu: 1, pid: 737, index 2 pages 44 [41877.369388] cpu: 1, pid: 736, index 3 pages 128 [41878.486516] cpu: 0, pid: 737, index 2 pages 44 [41878.486515] cpu: 2, pid: 739, index 4 pages 144 [41878.486622] cpu: 1, pid: 736, index 3 pages 128 [41878.486948] cpu: 2, pid: 735, index 7 pages 757 [41878.487279] cpu: 2, pid: 738, index 4 pages 144 [41879.526603] cpu: 1, pid: 739, index 3 pages 128 [41879.606491] cpu: 2, pid: 737, index 3 pages 128 [41879.606550] cpu: 0, pid: 736, index 0 pages 7 [41879.612271] cpu: 2, pid: 738, index 4 pages 144 ... v1: https://patchwork.kernel.org/project/linux-mm/cover/20211215080242.3034856-… v2: https://patchwork.kernel.org/project/linux-mm/cover/20220112131552.3329380-… Dong Aisheng (2): mm: cma: fix allocation may fail sometimes mm: cma: try next MAX_ORDER_NR_PAGES during retry mm/cma.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.25.1

1 year, 11 months

5
13
0 0

[PATCH] ice: ice_sched: fix an incorrect NULL check on list iterator

by Xiaomeng Tong

The bugs are here: if (old_agg_vsi_info) if (old_agg_vsi_info && !old_agg_vsi_info->tc_bitmap[0]) { The list iterator value 'old_agg_vsi_info' will *always* be set and non-NULL by list_for_each_entry_safe(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element found (in this case, the check 'if (old_agg_vsi_info)' will always be true unexpectly). To fix the bug, use a new variable 'iter' as the list iterator, while use the original variable 'old_agg_vsi_info' as a dedicated pointer to point to the found element. Cc: stable(a)vger.kernel.org Fixes: 37c592062b16d ("ice: remove the VSI info from previous agg") Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- drivers/net/ethernet/intel/ice/ice_sched.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c index 7947223536e3..fba524148a09 100644 --- a/drivers/net/ethernet/intel/ice/ice_sched.c +++ b/drivers/net/ethernet/intel/ice/ice_sched.c @@ -2757,6 +2757,7 @@ ice_sched_assoc_vsi_to_agg(struct ice_port_info *pi, u32 agg_id, u16 vsi_handle, unsigned long *tc_bitmap) { struct ice_sched_agg_vsi_info *agg_vsi_info, *old_agg_vsi_info = NULL; + struct ice_sched_agg_vsi_info *iter; struct ice_sched_agg_info *agg_info, *old_agg_info; struct ice_hw *hw = pi->hw; int status = 0; @@ -2774,11 +2775,13 @@ ice_sched_assoc_vsi_to_agg(struct ice_port_info *pi, u32 agg_id, if (old_agg_info && old_agg_info != agg_info) { struct ice_sched_agg_vsi_info *vtmp; - list_for_each_entry_safe(old_agg_vsi_info, vtmp, + list_for_each_entry_safe(iter, vtmp, &old_agg_info->agg_vsi_list, list_entry) - if (old_agg_vsi_info->vsi_handle == vsi_handle) + if (iter->vsi_handle == vsi_handle) { + old_agg_vsi_info = iter; break; + } } /* check if entry already exist */ -- 2.17.1

1 year, 11 months

4
3
0 0

[PATCH v2] carl9170: tx: fix an incorrect use of list iterator

by Xiaomeng Tong

If the previous list_for_each_entry_continue_rcu() don't exit early (no goto hit inside the loop), the iterator 'cvif' after the loop will be a bogus pointer to an invalid structure object containing the HEAD (&ar->vif_list). As a result, the use of 'cvif' after that will lead to a invalid memory access (i.e., 'cvif->id': the invalid pointer dereference when return back to/after the callsite in the carl9170_update_beacon()). The original intention should have been to return the valid 'cvif' when found in list, NULL otherwise. So just return NULL when no entry found, to fix this bug. Cc: stable(a)vger.kernel.org Fixes: 1f1d9654e183c ("carl9170: refactor carl9170_update_beacon") Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- changes since v1: - just return NULL when no entry found (Christian Lamparter) v1:https://lore.kernel.org/lkml/20220327072947.10744-1-xiam0nd.tong@gmail.c… --- drivers/net/wireless/ath/carl9170/tx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c index 1b76f4434c06..791f9f120af3 100644 --- a/drivers/net/wireless/ath/carl9170/tx.c +++ b/drivers/net/wireless/ath/carl9170/tx.c @@ -1558,6 +1558,9 @@ static struct carl9170_vif_info *carl9170_pick_beaconing_vif(struct ar9170 *ar) goto out; } } while (ar->beacon_enabled && i--); + + /* no entry found in list */ + return NULL; } out: -- 2.17.1

1 year, 11 months

3
3
0 0

[PATCH v3] usb: gadget: uvc: Fix crash when encoding data for usb request

by Dan Vacura

During the uvcg_video_pump() process, if an error occurs and uvcg_queue_cancel() is called, the buffer queue will be cleared out, but the current marker (queue->buf_used) of the active buffer (no longer active) is not reset. On the next iteration of uvcg_video_pump() the stale buf_used count will be used and the logic of min((unsigned int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a nbytes size, causing an invalid memory access. [80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. [80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. ... uvcg_queue_cancel() is called and the queue is cleared out, but the marker queue->buf_used is not reset. ... [80802.262328][ T8682] Unable to handle kernel paging request at virtual address ffffffc03af9f000 ... ... [80802.263138][ T8682] Call trace: [80802.263146][ T8682] __memcpy+0x12c/0x180 [80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0 [80802.263165][ T8682] process_one_work+0x2cc/0x568 [80802.263173][ T8682] worker_thread+0x28c/0x518 [80802.263181][ T8682] kthread+0x160/0x170 [80802.263188][ T8682] ret_from_fork+0x10/0x18 [80802.263198][ T8682] Code: a8c12829 a88130cb a8c130 Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework") Cc: <stable(a)vger.kernel.org> Signed-off-by: Dan Vacura <w36195(a)motorola.com> --- Changes in v3: - Cc stable Changes in v2: - Add Fixes tag drivers/usb/gadget/function/uvc_queue.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c index d852ac9e47e7..2cda982f3765 100644 --- a/drivers/usb/gadget/function/uvc_queue.c +++ b/drivers/usb/gadget/function/uvc_queue.c @@ -264,6 +264,8 @@ void uvcg_queue_cancel(struct uvc_video_queue *queue, int disconnect) buf->state = UVC_BUF_STATE_ERROR; vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); } + queue->buf_used = 0; + /* This must be protected by the irqlock spinlock to avoid race * conditions between uvc_queue_buffer and the disconnection event that * could result in an interruptible wait in uvc_dequeue_buffer. Do not -- 2.32.0

1 year, 11 months

2
4
0 0

[PATCH] misc: fastrpc: fix an incorrect NULL check on list iterator

by Xiaomeng Tong

The bug is here: if (!buf) { The list iterator value 'buf' will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty (in this case, the check 'if (!buf) {' will always be false and never exit expectly). To fix the bug, use a new variable 'iter' as the list iterator, while use the original variable 'buf' as a dedicated pointer to point to the found element. Cc: stable(a)vger.kernel.org Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- drivers/misc/fastrpc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index aa1682b94a23..45aaf54a7560 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1353,17 +1353,18 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_req_munmap *req) { struct fastrpc_invoke_args args[1] = { [0] = { 0 } }; - struct fastrpc_buf *buf, *b; + struct fastrpc_buf *buf = NULL, *iter, *b; struct fastrpc_munmap_req_msg req_msg; struct device *dev = fl->sctx->dev; int err; u32 sc; spin_lock(&fl->lock); - list_for_each_entry_safe(buf, b, &fl->mmaps, node) { - if ((buf->raddr == req->vaddrout) && (buf->size == req->size)) + list_for_each_entry_safe(iter, b, &fl->mmaps, node) { + if ((iter->raddr == req->vaddrout) && (iter->size == req->size)) { + buf = iter; break; - buf = NULL; + } } spin_unlock(&fl->lock); -- 2.17.1

1 year, 11 months

3
2
0 0

[PATCH v2] mtd: spi-nor: core: Skip setting erase types when SPI_NOR_NO_ERASE is set

by Tudor Ambarus

Even if SPI_NOR_NO_ERASE was specified at flash declaration, the erase type of size nor->info->sector_size was incorrectly set as supported. Don't set erase types when SPI_NOR_NO_ERASE is set. Fixes: b199489d37b2 ("mtd: spi-nor: add the framework for SPI NOR") Signed-off-by: Tudor Ambarus <tudor.ambarus(a)microchip.com> Cc: stable(a)vger.kernel.org --- v2: - add comment, update commit message, split change in individual commit - add fixes tag and cc to stable. drivers/mtd/spi-nor/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index b4f141ad9c9c..64cf7b9df621 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -2392,6 +2392,10 @@ static void spi_nor_no_sfdp_init_params(struct spi_nor *nor) SPINOR_OP_PP, SNOR_PROTO_8_8_8_DTR); } + /* Skip setting erase types when SPI_NOR_NO_ERASE is set. */ + if (nor->info->flags & SPI_NOR_NO_ERASE) + return; + /* * Sector Erase settings. Sort Erase Types in ascending order, with the * smallest erase size starting at BIT(0). -- 2.25.1

1 year, 11 months

2
2
0 0

[PATCH v7 0/4] mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N

by Tokunori Ikegami

Since commit dfeae1073583("mtd: cfi_cmdset_0002: Change write buffer to check correct value") buffered writes fail on S29GL064N. This is because, on S29GL064N, reads return 0xFF at the end of DQ polling for write completion, where as, chip_good() check expects actual data written to the last location to be returned post DQ polling completion. Fix is to revert to using chip_good() for S29GL064N which only checks for DQ lines to settle down to determine write completion. Fixes: dfeae1073583("mtd: cfi_cmdset_0002: Change write buffer to check correct value") Signed-off-by: Tokunori Ikegami <ikegami.t(a)gmail.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/b687c259-6413-26c9-d4c9-b3afa69ea124@pengutronix.… Tokunori Ikegami (4): mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N mtd: cfi_cmdset_0002: Add S29GL064N ID definition mtd: cfi_cmdset_0002: Rename chip_ready variables drivers/mtd/chips/cfi_cmdset_0002.c | 112 ++++++++++++++-------------- include/linux/mtd/cfi.h | 1 + 2 files changed, 55 insertions(+), 58 deletions(-) -- 2.32.0

1 year, 11 months

5
10
0 0

[PATCH] iommu: fix an incorrect NULL check on list iterator

by Xiaomeng Tong

The bug is here: if (!iommu || iommu->dev->of_node != spec->np) { The list iterator value 'iommu' will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element is found (in fact, it will point to a invalid structure object containing HEAD). To fix the bug, run insert_iommu_master(dev, &iommu, spec); unlock and return 0 when found, otherwise unlock and return -ENODEV. Cc: stable(a)vger.kernel.org Fixes: f78ebca8ff3d6 ("iommu/msm: Add support for generic master bindings") Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- drivers/iommu/msm_iommu.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c index 3a38352b603f..1dbb8b0695ec 100644 --- a/drivers/iommu/msm_iommu.c +++ b/drivers/iommu/msm_iommu.c @@ -617,23 +617,17 @@ static int qcom_iommu_of_xlate(struct device *dev, { struct msm_iommu_dev *iommu; unsigned long flags; - int ret = 0; spin_lock_irqsave(&msm_iommu_lock, flags); list_for_each_entry(iommu, &qcom_iommu_devices, dev_node) - if (iommu->dev->of_node == spec->np) - break; - - if (!iommu || iommu->dev->of_node != spec->np) { - ret = -ENODEV; - goto fail; - } - - insert_iommu_master(dev, &iommu, spec); -fail: + if (iommu->dev->of_node == spec->np) { + insert_iommu_master(dev, &iommu, spec); + spin_unlock_irqrestore(&msm_iommu_lock, flags); + return 0; + } spin_unlock_irqrestore(&msm_iommu_lock, flags); - return ret; + return -ENODEV; } irqreturn_t msm_iommu_fault_handler(int irq, void *dev_id) -- 2.17.1

1 year, 11 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2022