--
Hello Dear,
how are you today?hope you are fine
My name is Dr Ava Smith ,Am an English and French nationalities.
I will give you pictures and more details about me as soon as i hear from you
Thanks
Ava
This is another instance of incorrect use of list iterator and
checking it for NULL.
The list iterator value 'map' will *always* be set and non-NULL
by list_for_each_entry(), so it is incorrect to assume that the
iterator value will be NULL if the list is empty (in this case, the
check 'if (!map) {' will always be false and never exit as expected).
To fix the bug, use a new variable 'iter' as the list iterator,
while use the original variable 'map' as a dedicated pointer to
point to the found element.
Without this patch, Kernel crashes with below trace:
Unable to handle kernel access to user memory outside uaccess routines
at virtual address 0000ffff7fb03750
...
Call trace:
fastrpc_map_create+0x70/0x290 [fastrpc]
fastrpc_req_mem_map+0xf0/0x2dc [fastrpc]
fastrpc_device_ioctl+0x138/0xc60 [fastrpc]
__arm64_sys_ioctl+0xa8/0xec
invoke_syscall+0x48/0x114
el0_svc_common.constprop.0+0xd4/0xfc
do_el0_svc+0x28/0x90
el0_svc+0x3c/0x130
el0t_64_sync_handler+0xa4/0x130
el0t_64_sync+0x18c/0x190
Code: 14000016 f94000a5 eb05029f 54000260 (b94018a6)
---[ end trace 0000000000000000 ]---
Cc: stable(a)vger.kernel.org
Fixes: 5c1b97c7d7b7 ("misc: fastrpc: add support for FASTRPC_IOCTL_MEM_MAP/UNMAP")
Reported-by: Jan Jablonsky <jjablonsky(a)snapchat.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
---
drivers/misc/fastrpc.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 4bdc8e0df657..93ebd174d848 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1748,17 +1748,18 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
static int fastrpc_req_mem_unmap_impl(struct fastrpc_user *fl, struct fastrpc_mem_unmap *req)
{
struct fastrpc_invoke_args args[1] = { [0] = { 0 } };
- struct fastrpc_map *map = NULL, *m;
+ struct fastrpc_map *map = NULL, *iter, *m;
struct fastrpc_mem_unmap_req_msg req_msg = { 0 };
int err = 0;
u32 sc;
struct device *dev = fl->sctx->dev;
spin_lock(&fl->lock);
- list_for_each_entry_safe(map, m, &fl->maps, node) {
- if ((req->fd < 0 || map->fd == req->fd) && (map->raddr == req->vaddr))
+ list_for_each_entry_safe(iter, m, &fl->maps, node) {
+ if ((req->fd < 0 || iter->fd == req->fd) && (iter->raddr == req->vaddr)) {
+ map = iter;
break;
- map = NULL;
+ }
}
spin_unlock(&fl->lock);
--
2.21.0
TEST_GEN_FILES contains files that are generated during compilation and are
required to be included together with the test binaries, e.g. when
performing:
make -C tools/testing/selftests install INSTALL_PATH=/some/other/path [*]
Add test_encl.elf to TEST_GEN_FILES because otherwise the installed test
binary will fail to run.
[*] https://docs.kernel.org/dev-tools/kselftest.html
Cc: stable(a)vger.kernel.org
Fixes: 2adcba79e69d ("selftests/x86: Add a selftest for SGX")
Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org>
---
tools/testing/selftests/sgx/Makefile | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/sgx/Makefile b/tools/testing/selftests/sgx/Makefile
index 75af864e07b6..f3f312904bcc 100644
--- a/tools/testing/selftests/sgx/Makefile
+++ b/tools/testing/selftests/sgx/Makefile
@@ -17,6 +17,7 @@ ENCL_CFLAGS := -Wall -Werror -static -nostdlib -nostartfiles -fPIC \
-fno-stack-protector -mrdrnd $(INCLUDES)
TEST_CUSTOM_PROGS := $(OUTPUT)/test_sgx
+TEST_GEN_FILES := $(OUTPUT)/test_encl.elf
ifeq ($(CAN_BUILD_X86_64), 1)
all: $(TEST_CUSTOM_PROGS) $(OUTPUT)/test_encl.elf
--
2.36.1
From: Brian Bunker <brian(a)purestorage.com>
[ Upstream commit 6056a92ceb2a7705d61df7ec5370548e96aee258 ]
The handling of the ALUA transitioning state is currently broken. When a
target goes into this state, it is expected that the target is allowed to
stay in this state for the implicit transition timeout without a path
failure. The handler has this logic, but it gets skipped currently.
When the target transitions, there is in-flight I/O from the initiator. The
first of these responses from the target will be a unit attention letting
the initiator know that the ALUA state has changed. The remaining
in-flight I/Os, before the initiator finds out that the portal state has
changed, will return not ready, ALUA state is transitioning. The portal
state will change to SCSI_ACCESS_STATE_TRANSITIONING. This will lead to all
new I/O immediately failing the path unexpectedly. The path failure happens
in less than a second instead of the expected successes until the
transition timer is exceeded.
Allow I/Os to continue while the path is in the ALUA transitioning
state. The handler already takes care of a target that stays in the
transitioning state for too long by changing the state to ALUA state
standby once the transition timeout is exceeded at which point the path
will fail.
Link: https://lore.kernel.org/r/CAHZQxy+4sTPz9+pY3=7VJH+CLUJsDct81KtnR2be8ycN5mhq…
Reviewed-by: Hannes Reinecke <hare(a)suse.de>
Acked-by: Krishna Kant <krishna.kant(a)purestorage.com>
Acked-by: Seamus Connor <sconnor(a)purestorage.com>
Signed-off-by: Brian Bunker <brian(a)purestorage.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/scsi/device_handler/scsi_dh_alua.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 37d06f993b76..1d9be771f3ee 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -1172,9 +1172,8 @@ static blk_status_t alua_prep_fn(struct scsi_device *sdev, struct request *req)
case SCSI_ACCESS_STATE_OPTIMAL:
case SCSI_ACCESS_STATE_ACTIVE:
case SCSI_ACCESS_STATE_LBA:
- return BLK_STS_OK;
case SCSI_ACCESS_STATE_TRANSITIONING:
- return BLK_STS_AGAIN;
+ return BLK_STS_OK;
default:
req->rq_flags |= RQF_QUIET;
return BLK_STS_IOERR;
--
2.35.1
From: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
[ Upstream commit 26f9ce53817a8fd84b69a73473a7de852a24c897 ]
Aborting commands that have already been sent to the firmware can
cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped)
For instance:
- Command passes rdx_to_xfer state, maps sgl, sends to the firmware
- Reset occurs, qla2xxx performs ISP error recovery, aborts the command
- Target stack calls qlt_abort_cmd() and then qlt_free_cmd()
- BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not
unmapped
Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set.
Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8PR10MB4…
Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com>
Signed-off-by: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/scsi/qla2xxx/qla_target.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 6ef7a094ee51..b4a21adb3e73 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3286,6 +3286,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
spin_lock_irqsave(&cmd->cmd_lock, flags);
if (cmd->aborted) {
+ if (cmd->sg_mapped)
+ qlt_unmap_sg(vha, cmd);
+
spin_unlock_irqrestore(&cmd->cmd_lock, flags);
/*
* It's normal to see 2 calls in this path:
--
2.35.1
From: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
[ Upstream commit 26f9ce53817a8fd84b69a73473a7de852a24c897 ]
Aborting commands that have already been sent to the firmware can
cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped)
For instance:
- Command passes rdx_to_xfer state, maps sgl, sends to the firmware
- Reset occurs, qla2xxx performs ISP error recovery, aborts the command
- Target stack calls qlt_abort_cmd() and then qlt_free_cmd()
- BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not
unmapped
Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set.
Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8PR10MB4…
Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com>
Signed-off-by: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/scsi/qla2xxx/qla_target.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 97a0c2384aee..4b431ca55c96 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3639,6 +3639,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
spin_lock_irqsave(&cmd->cmd_lock, flags);
if (cmd->aborted) {
+ if (cmd->sg_mapped)
+ qlt_unmap_sg(vha, cmd);
+
spin_unlock_irqrestore(&cmd->cmd_lock, flags);
/*
* It's normal to see 2 calls in this path:
--
2.35.1
From: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
[ Upstream commit 26f9ce53817a8fd84b69a73473a7de852a24c897 ]
Aborting commands that have already been sent to the firmware can
cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped)
For instance:
- Command passes rdx_to_xfer state, maps sgl, sends to the firmware
- Reset occurs, qla2xxx performs ISP error recovery, aborts the command
- Target stack calls qlt_abort_cmd() and then qlt_free_cmd()
- BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not
unmapped
Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set.
Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8PR10MB4…
Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com>
Signed-off-by: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/scsi/qla2xxx/qla_target.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 09c52ef66887..27d3293eadf5 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3753,6 +3753,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
spin_lock_irqsave(&cmd->cmd_lock, flags);
if (cmd->aborted) {
+ if (cmd->sg_mapped)
+ qlt_unmap_sg(vha, cmd);
+
spin_unlock_irqrestore(&cmd->cmd_lock, flags);
/*
* It's normal to see 2 calls in this path:
--
2.35.1
From: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
[ Upstream commit 26f9ce53817a8fd84b69a73473a7de852a24c897 ]
Aborting commands that have already been sent to the firmware can
cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped)
For instance:
- Command passes rdx_to_xfer state, maps sgl, sends to the firmware
- Reset occurs, qla2xxx performs ISP error recovery, aborts the command
- Target stack calls qlt_abort_cmd() and then qlt_free_cmd()
- BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not
unmapped
Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set.
Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8PR10MB4…
Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com>
Signed-off-by: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/scsi/qla2xxx/qla_target.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index df598c377161..cb97565b6a33 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3768,6 +3768,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
spin_lock_irqsave(&cmd->cmd_lock, flags);
if (cmd->aborted) {
+ if (cmd->sg_mapped)
+ qlt_unmap_sg(vha, cmd);
+
spin_unlock_irqrestore(&cmd->cmd_lock, flags);
/*
* It's normal to see 2 calls in this path:
--
2.35.1
From: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
[ Upstream commit 26f9ce53817a8fd84b69a73473a7de852a24c897 ]
Aborting commands that have already been sent to the firmware can
cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped)
For instance:
- Command passes rdx_to_xfer state, maps sgl, sends to the firmware
- Reset occurs, qla2xxx performs ISP error recovery, aborts the command
- Target stack calls qlt_abort_cmd() and then qlt_free_cmd()
- BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not
unmapped
Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set.
Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8PR10MB4…
Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com>
Signed-off-by: Gleb Chesnokov <Chesnokov.G(a)raidix.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/scsi/qla2xxx/qla_target.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index cf9ae0ab489a..ba823e8eb902 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3773,6 +3773,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
spin_lock_irqsave(&cmd->cmd_lock, flags);
if (cmd->aborted) {
+ if (cmd->sg_mapped)
+ qlt_unmap_sg(vha, cmd);
+
spin_unlock_irqrestore(&cmd->cmd_lock, flags);
/*
* It's normal to see 2 calls in this path:
--
2.35.1
From: Brian Bunker <brian(a)purestorage.com>
[ Upstream commit 6056a92ceb2a7705d61df7ec5370548e96aee258 ]
The handling of the ALUA transitioning state is currently broken. When a
target goes into this state, it is expected that the target is allowed to
stay in this state for the implicit transition timeout without a path
failure. The handler has this logic, but it gets skipped currently.
When the target transitions, there is in-flight I/O from the initiator. The
first of these responses from the target will be a unit attention letting
the initiator know that the ALUA state has changed. The remaining
in-flight I/Os, before the initiator finds out that the portal state has
changed, will return not ready, ALUA state is transitioning. The portal
state will change to SCSI_ACCESS_STATE_TRANSITIONING. This will lead to all
new I/O immediately failing the path unexpectedly. The path failure happens
in less than a second instead of the expected successes until the
transition timer is exceeded.
Allow I/Os to continue while the path is in the ALUA transitioning
state. The handler already takes care of a target that stays in the
transitioning state for too long by changing the state to ALUA state
standby once the transition timeout is exceeded at which point the path
will fail.
Link: https://lore.kernel.org/r/CAHZQxy+4sTPz9+pY3=7VJH+CLUJsDct81KtnR2be8ycN5mhq…
Reviewed-by: Hannes Reinecke <hare(a)suse.de>
Acked-by: Krishna Kant <krishna.kant(a)purestorage.com>
Acked-by: Seamus Connor <sconnor(a)purestorage.com>
Signed-off-by: Brian Bunker <brian(a)purestorage.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/scsi/device_handler/scsi_dh_alua.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 37d06f993b76..1d9be771f3ee 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -1172,9 +1172,8 @@ static blk_status_t alua_prep_fn(struct scsi_device *sdev, struct request *req)
case SCSI_ACCESS_STATE_OPTIMAL:
case SCSI_ACCESS_STATE_ACTIVE:
case SCSI_ACCESS_STATE_LBA:
- return BLK_STS_OK;
case SCSI_ACCESS_STATE_TRANSITIONING:
- return BLK_STS_AGAIN;
+ return BLK_STS_OK;
default:
req->rq_flags |= RQF_QUIET;
return BLK_STS_IOERR;
--
2.35.1
From: Bob Peterson <rpeterso(a)redhat.com>
[ Upstream commit 428f651cb80b227af47fc302e4931791f2fb4741 ]
Before this patch, function read_rindex_entry called compute_bitstructs
before it allocated a glock for the rgrp. But if compute_bitstructs found
a problem with the rgrp, it called gfs2_consist_rgrpd, and that called
gfs2_dump_glock for rgd->rd_gl which had not yet been assigned.
read_rindex_entry
compute_bitstructs
gfs2_consist_rgrpd
gfs2_dump_glock <---------rgd->rd_gl was not set.
This patch changes read_rindex_entry so it assigns an rgrp glock before
calling compute_bitstructs so gfs2_dump_glock does not reference an
unassigned pointer. If an error is discovered, the glock must also be
put, so a new goto and label were added.
Reported-by: syzbot+c6fd14145e2f62ca0784(a)syzkaller.appspotmail.com
Signed-off-by: Bob Peterson <rpeterso(a)redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
fs/gfs2/rgrp.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index c3b00ba92ed2..e21f8e10d70b 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -922,15 +922,15 @@ static int read_rindex_entry(struct gfs2_inode *ip)
spin_lock_init(&rgd->rd_rsspin);
mutex_init(&rgd->rd_mutex);
- error = compute_bitstructs(rgd);
- if (error)
- goto fail;
-
error = gfs2_glock_get(sdp, rgd->rd_addr,
&gfs2_rgrp_glops, CREATE, &rgd->rd_gl);
if (error)
goto fail;
+ error = compute_bitstructs(rgd);
+ if (error)
+ goto fail_glock;
+
rgd->rd_rgl = (struct gfs2_rgrp_lvb *)rgd->rd_gl->gl_lksb.sb_lvbptr;
rgd->rd_flags &= ~(GFS2_RDF_UPTODATE | GFS2_RDF_PREFERRED);
if (rgd->rd_data > sdp->sd_max_rg_data)
@@ -944,6 +944,7 @@ static int read_rindex_entry(struct gfs2_inode *ip)
}
error = 0; /* someone else read in the rgrp; free it and ignore it */
+fail_glock:
gfs2_glock_put(rgd->rd_gl);
fail:
--
2.35.1
This is the start of the stable review cycle for the 4.9.315 release.
There are 19 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.315-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.315-rc1
Yang Yingliang <yangyingliang(a)huawei.com>
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ping: fix address binding wrt vrf
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom MA510 modem
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom L610 modem
Ethan Yang <etyang(a)sierrawireless.com>
USB: serial: qcserial: add support for Sierra Wireless EM7590
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add device id for HP LM930 Display
Sergey Ryazanov <ryazanov.s.a(a)gmail.com>
usb: cdc-wdm: fix reading stuck on device close
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Generate notifications on changes for custom control
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Reject invalid values in custom control put()
Ji-Ze Hong (Peter Hong) <hpeter(a)gmail.com>
hwmon: (f71882fg) Fix negative temperature
Taehee Yoo <ap420073(a)gmail.com>
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
Alexandra Winter <wintera(a)linux.ibm.com>
s390/lcs: fix variable dereferenced before check
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix potential memory leak
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix variable dereferenced before check
Johannes Berg <johannes.berg(a)intel.com>
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
Eric Dumazet <edumazet(a)google.com>
netlink: do not reset transport header in netlink_recvmsg()
Lokesh Dhoundiyal <lokesh.dhoundiyal(a)alliedtelesis.co.nz>
ipv4: drop dst in multicast routing path
Tariq Toukan <tariqt(a)nvidia.com>
net: Fix features skip in for_each_netdev_feature()
-------------
Diffstat:
Makefile | 4 ++--
drivers/hwmon/f71882fg.c | 5 +++--
drivers/net/ethernet/sfc/ef10.c | 5 +++++
drivers/net/wireless/mac80211_hwsim.c | 3 +++
drivers/s390/net/ctcm_mpc.c | 6 +-----
drivers/s390/net/ctcm_sysfs.c | 5 +++--
drivers/s390/net/lcs.c | 7 ++++---
drivers/tty/serial/digicolor-usart.c | 2 +-
drivers/usb/class/cdc-wdm.c | 1 +
drivers/usb/serial/option.c | 4 ++++
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +
drivers/usb/serial/qcserial.c | 2 ++
include/linux/netdev_features.h | 4 ++--
net/ipv4/ping.c | 12 +++++++++++-
net/ipv4/route.c | 1 +
net/netlink/af_netlink.c | 1 -
sound/soc/codecs/max98090.c | 5 ++++-
sound/soc/soc-ops.c | 18 +++++++++++++++++-
19 files changed, 66 insertions(+), 21 deletions(-)
This is the start of the stable review cycle for the 4.14.280 release.
There are 25 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.280-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.280-rc1
Yang Yingliang <yangyingliang(a)huawei.com>
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ping: fix address binding wrt vrf
Zack Rusin <zackr(a)vmware.com>
drm/vmwgfx: Initialize drm_mode_fb_cmd2
Waiman Long <longman(a)redhat.com>
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom MA510 modem
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom L610 modem
Ethan Yang <etyang(a)sierrawireless.com>
USB: serial: qcserial: add support for Sierra Wireless EM7590
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add device id for HP LM930 Display
Sergey Ryazanov <ryazanov.s.a(a)gmail.com>
usb: cdc-wdm: fix reading stuck on device close
Eric Dumazet <edumazet(a)google.com>
tcp: resalt the secret every 10 seconds
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Generate notifications on changes for custom control
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Reject invalid values in custom control put()
Ji-Ze Hong (Peter Hong) <hpeter(a)gmail.com>
hwmon: (f71882fg) Fix negative temperature
Taehee Yoo <ap420073(a)gmail.com>
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
Guangguan Wang <guangguan.wang(a)linux.alibaba.com>
net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
Alexandra Winter <wintera(a)linux.ibm.com>
s390/lcs: fix variable dereferenced before check
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix potential memory leak
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix variable dereferenced before check
Randy Dunlap <rdunlap(a)infradead.org>
hwmon: (ltq-cputemp) restrict it to SOC_XWAY
Johannes Berg <johannes.berg(a)intel.com>
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
Eric Dumazet <edumazet(a)google.com>
netlink: do not reset transport header in netlink_recvmsg()
Lokesh Dhoundiyal <lokesh.dhoundiyal(a)alliedtelesis.co.nz>
ipv4: drop dst in multicast routing path
Tariq Toukan <tariqt(a)nvidia.com>
net: Fix features skip in for_each_netdev_feature()
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't skb_split skbuffs with frag_list
-------------
Diffstat:
Makefile | 4 ++--
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +-
drivers/hwmon/Kconfig | 2 +-
drivers/hwmon/f71882fg.c | 5 +++--
drivers/net/ethernet/sfc/ef10.c | 5 +++++
drivers/net/wireless/mac80211_hwsim.c | 3 +++
drivers/s390/net/ctcm_mpc.c | 6 +-----
drivers/s390/net/ctcm_sysfs.c | 5 +++--
drivers/s390/net/lcs.c | 7 ++++---
drivers/tty/serial/digicolor-usart.c | 2 +-
drivers/usb/class/cdc-wdm.c | 1 +
drivers/usb/serial/option.c | 4 ++++
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +
drivers/usb/serial/qcserial.c | 2 ++
include/linux/netdev_features.h | 4 ++--
kernel/cgroup/cpuset.c | 7 +++++--
net/batman-adv/fragmentation.c | 11 +++++++++++
net/core/secure_seq.c | 12 +++++++++---
net/ipv4/ping.c | 12 +++++++++++-
net/ipv4/route.c | 1 +
net/netlink/af_netlink.c | 1 -
net/smc/smc_rx.c | 4 ++--
sound/soc/codecs/max98090.c | 5 ++++-
sound/soc/soc-ops.c | 18 +++++++++++++++++-
25 files changed, 95 insertions(+), 30 deletions(-)
From: Jitao Shi <jitao.shi(a)mediatek.com>
To comply with the panel sequence, hold the mipi signal to LP00 before the dcs cmds transmission,
and pull the mipi signal high from LP00 to LP11 until the start of the dcs cmds transmission.
The normal panel timing is :
(1) pp1800 DC pull up
(2) avdd & avee AC pull high
(3) lcm_reset pull high -> pull low -> pull high
(4) Pull MIPI signal high (LP11) -> initial code -> send video data(HS mode)
The power-off sequence is reversed.
If dsi is not in cmd mode, then dsi will pull the mipi signal high in the mtk_output_dsi_enable function.
The delay in lane_ready func is the reaction time of dsi_rx after pulling up the mipi signal.
Fixes: 2dd8075d2185 ("drm/mediatek: mtk_dsi: Use the drm_panel_bridge API")
Cc: <stable(a)vger.kernel.org> # 6.6.x: b255d51e3967: sched: Modify dsi funcs to atomic operations
Cc: <stable(a)vger.kernel.org> # 6.6.x: 72c69c977502: sched: Separate poweron/poweroff from enable/disable and define new funcs
Cc: <stable(a)vger.kernel.org> # 6.6.x
Signed-off-by: Jitao Shi <jitao.shi(a)mediatek.com>
Signed-off-by: Xinlei Lee <xinlei.lee(a)mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
---
drivers/gpu/drm/mediatek/mtk_dsi.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index d9a6b928dba8..25e84d9426bf 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -203,6 +203,7 @@ struct mtk_dsi {
struct mtk_phy_timing phy_timing;
int refcount;
bool enabled;
+ bool lanes_ready;
u32 irq_data;
wait_queue_head_t irq_wait_queue;
const struct mtk_dsi_driver_data *driver_data;
@@ -661,18 +662,11 @@ static int mtk_dsi_poweron(struct mtk_dsi *dsi)
mtk_dsi_reset_engine(dsi);
mtk_dsi_phy_timconfig(dsi);
- mtk_dsi_rxtx_control(dsi);
- usleep_range(30, 100);
- mtk_dsi_reset_dphy(dsi);
mtk_dsi_ps_control_vact(dsi);
mtk_dsi_set_vm_cmd(dsi);
mtk_dsi_config_vdo_timing(dsi);
mtk_dsi_set_interrupt_enable(dsi);
- mtk_dsi_clk_ulp_mode_leave(dsi);
- mtk_dsi_lane0_ulp_mode_leave(dsi);
- mtk_dsi_clk_hs_mode(dsi, 0);
-
return 0;
err_disable_engine_clk:
clk_disable_unprepare(dsi->engine_clk);
@@ -701,6 +695,23 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi)
clk_disable_unprepare(dsi->digital_clk);
phy_power_off(dsi->phy);
+
+ dsi->lanes_ready = false;
+}
+
+static void mtk_dsi_lane_ready(struct mtk_dsi *dsi)
+{
+ if (!dsi->lanes_ready) {
+ dsi->lanes_ready = true;
+ mtk_dsi_rxtx_control(dsi);
+ usleep_range(30, 100);
+ mtk_dsi_reset_dphy(dsi);
+ mtk_dsi_clk_ulp_mode_leave(dsi);
+ mtk_dsi_lane0_ulp_mode_leave(dsi);
+ mtk_dsi_clk_hs_mode(dsi, 0);
+ msleep(20);
+ /* The reaction time after pulling up the mipi signal for dsi_rx */
+ }
}
static void mtk_output_dsi_enable(struct mtk_dsi *dsi)
@@ -708,6 +719,7 @@ static void mtk_output_dsi_enable(struct mtk_dsi *dsi)
if (dsi->enabled)
return;
+ mtk_dsi_lane_ready(dsi);
mtk_dsi_set_mode(dsi);
mtk_dsi_clk_hs_mode(dsi, 1);
@@ -1017,6 +1029,8 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,
if (MTK_DSI_HOST_IS_READ(msg->type))
irq_flag |= LPRX_RD_RDY_INT_FLAG;
+ mtk_dsi_lane_ready(dsi);
+
ret = mtk_dsi_host_send_cmd(dsi, msg, irq_flag);
if (ret)
goto restore_dsi_mode;
--
2.18.0
This is the start of the stable review cycle for the 4.19.244 release.
There are 32 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.244-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.244-rc1
Yang Yingliang <yangyingliang(a)huawei.com>
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ping: fix address binding wrt vrf
Sudip Mukherjee <sudipm.mukherjee(a)gmail.com>
MIPS: fix allmodconfig build with latest mkimage
Zack Rusin <zackr(a)vmware.com>
drm/vmwgfx: Initialize drm_mode_fb_cmd2
Waiman Long <longman(a)redhat.com>
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
Miaoqian Lin <linmq006(a)gmail.com>
slimbus: qcom: Fix IRQ check in qcom_slim_probe
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom MA510 modem
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom L610 modem
Ethan Yang <etyang(a)sierrawireless.com>
USB: serial: qcserial: add support for Sierra Wireless EM7590
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add device id for HP LM930 Display
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
usb: typec: tcpci: Don't skip cleanup in .remove() on error
Sergey Ryazanov <ryazanov.s.a(a)gmail.com>
usb: cdc-wdm: fix reading stuck on device close
Eric Dumazet <edumazet(a)google.com>
tcp: resalt the secret every 10 seconds
Sven Schnelle <svens(a)linux.ibm.com>
s390: disable -Warray-bounds
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Generate notifications on changes for custom control
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Reject invalid values in custom control put()
Ji-Ze Hong (Peter Hong) <hpeter(a)gmail.com>
hwmon: (f71882fg) Fix negative temperature
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix filesystem block deallocation for short writes
Taehee Yoo <ap420073(a)gmail.com>
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
Guangguan Wang <guangguan.wang(a)linux.alibaba.com>
net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
Paolo Abeni <pabeni(a)redhat.com>
net/sched: act_pedit: really ensure the skb is writable
Alexandra Winter <wintera(a)linux.ibm.com>
s390/lcs: fix variable dereferenced before check
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix potential memory leak
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix variable dereferenced before check
Randy Dunlap <rdunlap(a)infradead.org>
hwmon: (ltq-cputemp) restrict it to SOC_XWAY
Johannes Berg <johannes.berg(a)intel.com>
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
Eric Dumazet <edumazet(a)google.com>
netlink: do not reset transport header in netlink_recvmsg()
Lokesh Dhoundiyal <lokesh.dhoundiyal(a)alliedtelesis.co.nz>
ipv4: drop dst in multicast routing path
Tariq Toukan <tariqt(a)nvidia.com>
net: Fix features skip in for_each_netdev_feature()
Camel Guo <camel.guo(a)axis.com>
hwmon: (tmp401) Add OF device ID table
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't skb_split skbuffs with frag_list
-------------
Diffstat:
Makefile | 4 ++--
arch/mips/generic/board-ocelot_pcb123.its.S | 10 +++++-----
arch/s390/Makefile | 10 ++++++++++
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +-
drivers/hwmon/Kconfig | 2 +-
drivers/hwmon/f71882fg.c | 5 +++--
drivers/hwmon/tmp401.c | 11 +++++++++++
drivers/net/ethernet/sfc/ef10.c | 5 +++++
drivers/net/wireless/mac80211_hwsim.c | 3 +++
drivers/s390/net/ctcm_mpc.c | 6 +-----
drivers/s390/net/ctcm_sysfs.c | 5 +++--
drivers/s390/net/lcs.c | 7 ++++---
drivers/slimbus/qcom-ctrl.c | 4 ++--
drivers/tty/serial/digicolor-usart.c | 2 +-
drivers/usb/class/cdc-wdm.c | 1 +
drivers/usb/serial/option.c | 4 ++++
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +
drivers/usb/serial/qcserial.c | 2 ++
drivers/usb/typec/tcpci.c | 2 +-
fs/gfs2/bmap.c | 11 +++++------
include/linux/netdev_features.h | 4 ++--
include/net/tc_act/tc_pedit.h | 1 +
kernel/cgroup/cpuset.c | 7 +++++--
net/batman-adv/fragmentation.c | 11 +++++++++++
net/core/secure_seq.c | 12 +++++++++---
net/ipv4/ping.c | 12 +++++++++++-
net/ipv4/route.c | 1 +
net/netlink/af_netlink.c | 1 -
net/sched/act_pedit.c | 26 ++++++++++++++++++++++----
net/smc/smc_rx.c | 4 ++--
sound/soc/codecs/max98090.c | 5 ++++-
sound/soc/soc-ops.c | 18 +++++++++++++++++-
33 files changed, 152 insertions(+), 48 deletions(-)
This is the start of the stable review cycle for the 5.10.117 release.
There are 68 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 18 May 2022 21:35:34 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.117-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.117-rc2
Gustavo A. R. Silva <gustavoars(a)kernel.org>
SUNRPC: Fix fall-through warnings for Clang
Jens Axboe <axboe(a)kernel.dk>
io_uring: always use original task when preparing req identity
Dan Vacura <w36195(a)motorola.com>
usb: gadget: uvc: allow for application to cleanly shutdown
Michael Tretter <m.tretter(a)pengutronix.de>
usb: gadget: uvc: rename function to be more consistent
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ping: fix address binding wrt vrf
Mike Rapoport <rppt(a)kernel.org>
arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
Francesco Dolcini <francesco.dolcini(a)toradex.com>
net: phy: Fix race condition on link status change
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Don't call connect() more than once on a TCP socket
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Prevent immediate close+reconnect
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Clean up scheduling of autoclose
Zack Rusin <zackr(a)vmware.com>
drm/vmwgfx: Initialize drm_mode_fb_cmd2
Waiman Long <longman(a)redhat.com>
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
Manuel Ullmann <labre(a)posteo.de>
net: atlantic: always deep reset on pm op, fixing up my null deref regression
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
i40e: i40e_main: fix a missing check on list iterator
Robin Murphy <robin.murphy(a)arm.com>
drm/nouveau/tegra: Stop using iommu_present()
Jeff Layton <jlayton(a)kernel.org>
ceph: fix setting of xattrs on async created inodes
AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
serial: 8250_mtk: Fix register address for XON/XOFF character
AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
serial: 8250_mtk: Fix UART_EFR register address
Miaoqian Lin <linmq006(a)gmail.com>
slimbus: qcom: Fix IRQ check in qcom_slim_probe
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom MA510 modem
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom L610 modem
Ethan Yang <etyang(a)sierrawireless.com>
USB: serial: qcserial: add support for Sierra Wireless EM7590
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add device id for HP LM930 Display
ChiYuan Huang <cy_huang(a)richtek.com>
usb: typec: tcpci_mt6360: Update for BMC PHY setting
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
usb: typec: tcpci: Don't skip cleanup in .remove() on error
Sergey Ryazanov <ryazanov.s.a(a)gmail.com>
usb: cdc-wdm: fix reading stuck on device close
Daniel Starke <daniel.starke(a)siemens.com>
tty: n_gsm: fix mux activation issues in gsm_config()
Yang Yingliang <yangyingliang(a)huawei.com>
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
Thiébaud Weksteen <tweek(a)google.com>
firmware_loader: use kernel credentials when reading firmware
Eric Dumazet <edumazet(a)google.com>
tcp: resalt the secret every 10 seconds
Matthew Hagan <mnhagan88(a)gmail.com>
net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT
Shravya Kumbham <shravya.kumbham(a)xilinx.com>
net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
Sven Schnelle <svens(a)linux.ibm.com>
s390: disable -Warray-bounds
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Generate notifications on changes for custom control
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Reject invalid values in custom control put()
Ji-Ze Hong (Peter Hong) <hpeter(a)gmail.com>
hwmon: (f71882fg) Fix negative temperature
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix filesystem block deallocation for short writes
Maxim Mikityanskiy <maximmi(a)nvidia.com>
tls: Fix context leak on tls_device_down
Taehee Yoo <ap420073(a)gmail.com>
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
Guangguan Wang <guangguan.wang(a)linux.alibaba.com>
net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down()
Florian Fainelli <f.fainelli(a)gmail.com>
net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral
Paolo Abeni <pabeni(a)redhat.com>
net/sched: act_pedit: really ensure the skb is writable
Alexandra Winter <wintera(a)linux.ibm.com>
s390/lcs: fix variable dereferenced before check
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix potential memory leak
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix variable dereferenced before check
Joel Savitz <jsavitz(a)redhat.com>
selftests: vm: Makefile: rename TARGETS to VMTARGETS
Randy Dunlap <rdunlap(a)infradead.org>
hwmon: (ltq-cputemp) restrict it to SOC_XWAY
Jesse Brandeburg <jesse.brandeburg(a)intel.com>
dim: initialize all struct fields
Yang Yingliang <yangyingliang(a)huawei.com>
ionic: fix missing pci_release_regions() on error in ionic_probe()
Dan Aloni <dan.aloni(a)vastdata.com>
nfs: fix broken handling of the softreval mount option
Johannes Berg <johannes.berg(a)intel.com>
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
Taehee Yoo <ap420073(a)gmail.com>
net: sfc: fix memory leak due to ptp channel
Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com>
sfc: Use swap() instead of open coding it
Eric Dumazet <edumazet(a)google.com>
netlink: do not reset transport header in netlink_recvmsg()
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
Lokesh Dhoundiyal <lokesh.dhoundiyal(a)alliedtelesis.co.nz>
ipv4: drop dst in multicast routing path
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted
Tariq Toukan <tariqt(a)nvidia.com>
net: Fix features skip in for_each_netdev_feature()
Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com>
mac80211: Reset MBSSID parameters upon connection
Camel Guo <camel.guo(a)axis.com>
hwmon: (tmp401) Add OF device ID table
Guenter Roeck <linux(a)roeck-us.net>
iwlwifi: iwl-dbg: Use del_timer_sync() before freeing
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't skb_split skbuffs with frag_list
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/io.h | 3 ++
arch/arm/mm/ioremap.c | 8 ++++
arch/arm64/include/asm/io.h | 4 ++
arch/arm64/mm/ioremap.c | 9 +++++
arch/s390/Makefile | 10 +++++
drivers/base/firmware_loader/main.c | 17 ++++++++
drivers/gpu/drm/nouveau/nouveau_backlight.c | 9 +++--
drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +-
drivers/hwmon/Kconfig | 2 +-
drivers/hwmon/f71882fg.c | 5 ++-
drivers/hwmon/tmp401.c | 11 ++++++
drivers/net/dsa/bcm_sf2.c | 3 ++
.../net/ethernet/aquantia/atlantic/aq_pci_func.c | 4 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++
drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ++++++-------
drivers/net/ethernet/mscc/ocelot_flower.c | 5 ++-
drivers/net/ethernet/mscc/ocelot_vcap.c | 9 ++++-
.../net/ethernet/pensando/ionic/ionic_bus_pci.c | 3 +-
drivers/net/ethernet/sfc/ef10.c | 5 +++
drivers/net/ethernet/sfc/efx_channels.c | 21 +++++-----
drivers/net/ethernet/sfc/ptp.c | 14 ++++++-
drivers/net/ethernet/sfc/ptp.h | 1 +
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 --------
drivers/net/phy/phy.c | 45 +++++++++++++++++++---
drivers/net/phy/sfp.c | 12 +++++-
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +-
drivers/net/wireless/mac80211_hwsim.c | 3 ++
drivers/s390/net/ctcm_mpc.c | 6 +--
drivers/s390/net/ctcm_sysfs.c | 5 ++-
drivers/s390/net/lcs.c | 7 ++--
drivers/slimbus/qcom-ctrl.c | 4 +-
drivers/tty/n_gsm.c | 12 ++++--
drivers/tty/serial/8250/8250_mtk.c | 22 ++++++-----
drivers/tty/serial/digicolor-usart.c | 5 +--
drivers/usb/class/cdc-wdm.c | 1 +
drivers/usb/gadget/function/f_uvc.c | 32 +++++++++++++--
drivers/usb/gadget/function/uvc.h | 2 +
drivers/usb/gadget/function/uvc_v4l2.c | 3 +-
drivers/usb/serial/option.c | 4 ++
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +
drivers/usb/serial/qcserial.c | 2 +
drivers/usb/typec/tcpm/tcpci.c | 2 +-
drivers/usb/typec/tcpm/tcpci_mt6360.c | 26 +++++++++++++
fs/ceph/file.c | 16 ++++++--
fs/file_table.c | 1 +
fs/gfs2/bmap.c | 11 +++---
fs/io_uring.c | 2 +-
fs/nfs/fs_context.c | 2 +-
include/linux/netdev_features.h | 4 +-
include/linux/sunrpc/xprtsock.h | 1 +
include/net/tc_act/tc_pedit.h | 1 +
include/trace/events/sunrpc.h | 1 -
kernel/cgroup/cpuset.c | 7 +++-
lib/dim/net_dim.c | 44 ++++++++++-----------
net/batman-adv/fragmentation.c | 11 ++++++
net/core/secure_seq.c | 12 ++++--
net/ipv4/ping.c | 15 +++++++-
net/ipv4/route.c | 1 +
net/mac80211/mlme.c | 6 +++
net/netlink/af_netlink.c | 1 -
net/sched/act_pedit.c | 26 +++++++++++--
net/smc/smc_rx.c | 4 +-
net/sunrpc/rpc_pipe.c | 1 +
net/sunrpc/xprt.c | 36 ++++++++---------
net/sunrpc/xprtsock.c | 37 ++++++++++++------
net/tls/tls_device.c | 3 ++
sound/soc/codecs/max98090.c | 5 ++-
sound/soc/soc-ops.c | 18 ++++++++-
tools/testing/selftests/vm/Makefile | 10 ++---
72 files changed, 486 insertions(+), 184 deletions(-)
From: Willy Tarreau <w(a)1wt.eu>
commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream.
Interrupt handler bad_flp_intr() may cause a UAF on the recently freed
request just to increment the error count. There's no point keeping
that one in the request anyway, and since the interrupt handler uses a
static pointer to the error which cannot be kept in sync with the
pending request, better make it use a static error counter that's reset
for each new request. This reset now happens when entering
redo_fd_request() for a new request via set_next_request().
One initial concern about a single error counter was that errors on one
floppy drive could be reported on another one, but this problem is not
real given that the driver uses a single drive at a time, as that
PC-compatible controllers also have this limitation by using shared
signals. As such the error count is always for the "current" drive.
Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com>
Suggested-by: Linus Torvalds <torvalds(a)linuxfoundation.org>
Tested-by: Denis Efremov <efremov(a)linux.com>
Signed-off-by: Willy Tarreau <w(a)1wt.eu>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Signed-off-by: Denis Efremov <efremov(a)linux.com>
---
drivers/block/floppy.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index cfe1bfb3c20e..216ee1057b12 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -516,8 +516,8 @@ static unsigned long fdc_busy;
static DECLARE_WAIT_QUEUE_HEAD(fdc_wait);
static DECLARE_WAIT_QUEUE_HEAD(command_done);
-/* Errors during formatting are counted here. */
-static int format_errors;
+/* errors encountered on the current (or last) request */
+static int floppy_errors;
/* Format request descriptor. */
static struct format_descr format_req;
@@ -537,7 +537,6 @@ static struct format_descr format_req;
static char *floppy_track_buffer;
static int max_buffer_sectors;
-static int *errors;
typedef void (*done_f)(int);
static const struct cont_t {
void (*interrupt)(void);
@@ -1426,7 +1425,7 @@ static int interpret_errors(void)
if (DP->flags & FTD_MSG)
DPRINT("Over/Underrun - retrying\n");
bad = 0;
- } else if (*errors >= DP->max_errors.reporting) {
+ } else if (floppy_errors >= DP->max_errors.reporting) {
print_errors();
}
if (ST2 & ST2_WC || ST2 & ST2_BC)
@@ -2049,7 +2048,7 @@ static void bad_flp_intr(void)
if (!next_valid_format())
return;
}
- err_count = ++(*errors);
+ err_count = ++floppy_errors;
INFBOUND(DRWE->badness, err_count);
if (err_count > DP->max_errors.abort)
cont->done(0);
@@ -2194,9 +2193,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
return -EINVAL;
}
format_req = *tmp_format_req;
- format_errors = 0;
cont = &format_cont;
- errors = &format_errors;
+ floppy_errors = 0;
ret = wait_til_done(redo_format, true);
if (ret == -EINTR)
return -EINTR;
@@ -2679,7 +2677,7 @@ static int make_raw_rw_request(void)
*/
if (!direct ||
(indirect * 2 > direct * 3 &&
- *errors < DP->max_errors.read_track &&
+ floppy_errors < DP->max_errors.read_track &&
((!probing ||
(DP->read_track & (1 << DRS->probed_format)))))) {
max_size = blk_rq_sectors(current_req);
@@ -2812,8 +2810,10 @@ static int set_next_request(void)
fdc_queue = 0;
if (q) {
current_req = blk_fetch_request(q);
- if (current_req)
+ if (current_req) {
+ floppy_errors = 0;
break;
+ }
}
} while (fdc_queue != old_pos);
@@ -2873,7 +2873,6 @@ static void redo_fd_request(void)
_floppy = floppy_type + DP->autodetect[DRS->probed_format];
} else
probing = 0;
- errors = &(current_req->errors);
tmp = make_raw_rw_request();
if (tmp < 2) {
request_done(tmp);
--
2.35.3
From: Willy Tarreau <w(a)1wt.eu>
commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream.
Interrupt handler bad_flp_intr() may cause a UAF on the recently freed
request just to increment the error count. There's no point keeping
that one in the request anyway, and since the interrupt handler uses a
static pointer to the error which cannot be kept in sync with the
pending request, better make it use a static error counter that's reset
for each new request. This reset now happens when entering
redo_fd_request() for a new request via set_next_request().
One initial concern about a single error counter was that errors on one
floppy drive could be reported on another one, but this problem is not
real given that the driver uses a single drive at a time, as that
PC-compatible controllers also have this limitation by using shared
signals. As such the error count is always for the "current" drive.
Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com>
Suggested-by: Linus Torvalds <torvalds(a)linuxfoundation.org>
Tested-by: Denis Efremov <efremov(a)linux.com>
Signed-off-by: Willy Tarreau <w(a)1wt.eu>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Signed-off-by: Denis Efremov <efremov(a)linux.com>
---
drivers/block/floppy.c | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 97c8fc4d6e7b..0e66314415c5 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -520,8 +520,8 @@ static unsigned long fdc_busy;
static DECLARE_WAIT_QUEUE_HEAD(fdc_wait);
static DECLARE_WAIT_QUEUE_HEAD(command_done);
-/* Errors during formatting are counted here. */
-static int format_errors;
+/* errors encountered on the current (or last) request */
+static int floppy_errors;
/* Format request descriptor. */
static struct format_descr format_req;
@@ -541,7 +541,6 @@ static struct format_descr format_req;
static char *floppy_track_buffer;
static int max_buffer_sectors;
-static int *errors;
typedef void (*done_f)(int);
static const struct cont_t {
void (*interrupt)(void);
@@ -1434,7 +1433,7 @@ static int interpret_errors(void)
if (DP->flags & FTD_MSG)
DPRINT("Over/Underrun - retrying\n");
bad = 0;
- } else if (*errors >= DP->max_errors.reporting) {
+ } else if (floppy_errors >= DP->max_errors.reporting) {
print_errors();
}
if (ST2 & ST2_WC || ST2 & ST2_BC)
@@ -2054,7 +2053,7 @@ static void bad_flp_intr(void)
if (!next_valid_format())
return;
}
- err_count = ++(*errors);
+ err_count = ++floppy_errors;
INFBOUND(DRWE->badness, err_count);
if (err_count > DP->max_errors.abort)
cont->done(0);
@@ -2199,9 +2198,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
return -EINVAL;
}
format_req = *tmp_format_req;
- format_errors = 0;
cont = &format_cont;
- errors = &format_errors;
+ floppy_errors = 0;
ret = wait_til_done(redo_format, true);
if (ret == -EINTR)
return -EINTR;
@@ -2684,7 +2682,7 @@ static int make_raw_rw_request(void)
*/
if (!direct ||
(indirect * 2 > direct * 3 &&
- *errors < DP->max_errors.read_track &&
+ floppy_errors < DP->max_errors.read_track &&
((!probing ||
(DP->read_track & (1 << DRS->probed_format)))))) {
max_size = blk_rq_sectors(current_req);
@@ -2818,7 +2816,7 @@ static int set_next_request(void)
if (q) {
current_req = blk_fetch_request(q);
if (current_req) {
- current_req->error_count = 0;
+ floppy_errors = 0;
break;
}
}
@@ -2880,7 +2878,6 @@ static void redo_fd_request(void)
_floppy = floppy_type + DP->autodetect[DRS->probed_format];
} else
probing = 0;
- errors = &(current_req->error_count);
tmp = make_raw_rw_request();
if (tmp < 2) {
request_done(tmp);
--
2.35.3
From: Willy Tarreau <w(a)1wt.eu>
commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream.
Interrupt handler bad_flp_intr() may cause a UAF on the recently freed
request just to increment the error count. There's no point keeping
that one in the request anyway, and since the interrupt handler uses a
static pointer to the error which cannot be kept in sync with the
pending request, better make it use a static error counter that's reset
for each new request. This reset now happens when entering
redo_fd_request() for a new request via set_next_request().
One initial concern about a single error counter was that errors on one
floppy drive could be reported on another one, but this problem is not
real given that the driver uses a single drive at a time, as that
PC-compatible controllers also have this limitation by using shared
signals. As such the error count is always for the "current" drive.
Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com>
Suggested-by: Linus Torvalds <torvalds(a)linuxfoundation.org>
Tested-by: Denis Efremov <efremov(a)linux.com>
Signed-off-by: Willy Tarreau <w(a)1wt.eu>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Signed-off-by: Denis Efremov <efremov(a)linux.com>
---
drivers/block/floppy.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index f24e3791e840..e133ff5fa596 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -521,8 +521,8 @@ static unsigned long fdc_busy;
static DECLARE_WAIT_QUEUE_HEAD(fdc_wait);
static DECLARE_WAIT_QUEUE_HEAD(command_done);
-/* Errors during formatting are counted here. */
-static int format_errors;
+/* errors encountered on the current (or last) request */
+static int floppy_errors;
/* Format request descriptor. */
static struct format_descr format_req;
@@ -542,7 +542,6 @@ static struct format_descr format_req;
static char *floppy_track_buffer;
static int max_buffer_sectors;
-static int *errors;
typedef void (*done_f)(int);
static const struct cont_t {
void (*interrupt)(void);
@@ -1435,7 +1434,7 @@ static int interpret_errors(void)
if (DP->flags & FTD_MSG)
DPRINT("Over/Underrun - retrying\n");
bad = 0;
- } else if (*errors >= DP->max_errors.reporting) {
+ } else if (floppy_errors >= DP->max_errors.reporting) {
print_errors();
}
if (ST2 & ST2_WC || ST2 & ST2_BC)
@@ -2055,7 +2054,7 @@ static void bad_flp_intr(void)
if (!next_valid_format())
return;
}
- err_count = ++(*errors);
+ err_count = ++floppy_errors;
INFBOUND(DRWE->badness, err_count);
if (err_count > DP->max_errors.abort)
cont->done(0);
@@ -2200,9 +2199,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
return -EINVAL;
}
format_req = *tmp_format_req;
- format_errors = 0;
cont = &format_cont;
- errors = &format_errors;
+ floppy_errors = 0;
ret = wait_til_done(redo_format, true);
if (ret == -EINTR)
return -EINTR;
@@ -2677,7 +2675,7 @@ static int make_raw_rw_request(void)
*/
if (!direct ||
(indirect * 2 > direct * 3 &&
- *errors < DP->max_errors.read_track &&
+ floppy_errors < DP->max_errors.read_track &&
((!probing ||
(DP->read_track & (1 << DRS->probed_format)))))) {
max_size = blk_rq_sectors(current_req);
@@ -2801,10 +2799,11 @@ static int set_next_request(void)
current_req = list_first_entry_or_null(&floppy_reqs, struct request,
queuelist);
if (current_req) {
- current_req->error_count = 0;
+ floppy_errors = 0;
list_del_init(¤t_req->queuelist);
+ return 1;
}
- return current_req != NULL;
+ return 0;
}
static void redo_fd_request(void)
@@ -2860,7 +2859,6 @@ static void redo_fd_request(void)
_floppy = floppy_type + DP->autodetect[DRS->probed_format];
} else
probing = 0;
- errors = &(current_req->error_count);
tmp = make_raw_rw_request();
if (tmp < 2) {
request_done(tmp);
--
2.35.3
From: Willy Tarreau <w(a)1wt.eu>
commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream.
Interrupt handler bad_flp_intr() may cause a UAF on the recently freed
request just to increment the error count. There's no point keeping
that one in the request anyway, and since the interrupt handler uses a
static pointer to the error which cannot be kept in sync with the
pending request, better make it use a static error counter that's reset
for each new request. This reset now happens when entering
redo_fd_request() for a new request via set_next_request().
One initial concern about a single error counter was that errors on one
floppy drive could be reported on another one, but this problem is not
real given that the driver uses a single drive at a time, as that
PC-compatible controllers also have this limitation by using shared
signals. As such the error count is always for the "current" drive.
Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com>
Suggested-by: Linus Torvalds <torvalds(a)linuxfoundation.org>
Tested-by: Denis Efremov <efremov(a)linux.com>
Signed-off-by: Willy Tarreau <w(a)1wt.eu>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Signed-off-by: Denis Efremov <efremov(a)linux.com>
---
Handled *errors in make_raw_rw_request().
drivers/block/floppy.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index c9411fe2f0af..4ef407a33996 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -509,8 +509,8 @@ static unsigned long fdc_busy;
static DECLARE_WAIT_QUEUE_HEAD(fdc_wait);
static DECLARE_WAIT_QUEUE_HEAD(command_done);
-/* Errors during formatting are counted here. */
-static int format_errors;
+/* errors encountered on the current (or last) request */
+static int floppy_errors;
/* Format request descriptor. */
static struct format_descr format_req;
@@ -530,7 +530,6 @@ static struct format_descr format_req;
static char *floppy_track_buffer;
static int max_buffer_sectors;
-static int *errors;
typedef void (*done_f)(int);
static const struct cont_t {
void (*interrupt)(void);
@@ -1455,7 +1454,7 @@ static int interpret_errors(void)
if (drive_params[current_drive].flags & FTD_MSG)
DPRINT("Over/Underrun - retrying\n");
bad = 0;
- } else if (*errors >= drive_params[current_drive].max_errors.reporting) {
+ } else if (floppy_errors >= drive_params[current_drive].max_errors.reporting) {
print_errors();
}
if (reply_buffer[ST2] & ST2_WC || reply_buffer[ST2] & ST2_BC)
@@ -2095,7 +2094,7 @@ static void bad_flp_intr(void)
if (!next_valid_format(current_drive))
return;
}
- err_count = ++(*errors);
+ err_count = ++floppy_errors;
INFBOUND(write_errors[current_drive].badness, err_count);
if (err_count > drive_params[current_drive].max_errors.abort)
cont->done(0);
@@ -2240,9 +2239,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
return -EINVAL;
}
format_req = *tmp_format_req;
- format_errors = 0;
cont = &format_cont;
- errors = &format_errors;
+ floppy_errors = 0;
ret = wait_til_done(redo_format, true);
if (ret == -EINTR)
return -EINTR;
@@ -2721,7 +2719,7 @@ static int make_raw_rw_request(void)
*/
if (!direct ||
(indirect * 2 > direct * 3 &&
- *errors < drive_params[current_drive].max_errors.read_track &&
+ floppy_errors < drive_params[current_drive].max_errors.read_track &&
((!probing ||
(drive_params[current_drive].read_track & (1 << drive_state[current_drive].probed_format)))))) {
max_size = blk_rq_sectors(current_req);
@@ -2846,10 +2844,11 @@ static int set_next_request(void)
current_req = list_first_entry_or_null(&floppy_reqs, struct request,
queuelist);
if (current_req) {
- current_req->error_count = 0;
+ floppy_errors = 0;
list_del_init(¤t_req->queuelist);
+ return 1;
}
- return current_req != NULL;
+ return 0;
}
/* Starts or continues processing request. Will automatically unlock the
@@ -2908,7 +2907,6 @@ static void redo_fd_request(void)
_floppy = floppy_type + drive_params[current_drive].autodetect[drive_state[current_drive].probed_format];
} else
probing = 0;
- errors = &(current_req->error_count);
tmp = make_raw_rw_request();
if (tmp < 2) {
request_done(tmp);
--
2.35.3
This is the start of the stable review cycle for the 5.4.195 release.
There are 43 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.195-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.195-rc1
Yang Yingliang <yangyingliang(a)huawei.com>
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ping: fix address binding wrt vrf
Mike Rapoport <rppt(a)linux.ibm.com>
arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
Francesco Dolcini <francesco.dolcini(a)toradex.com>
net: phy: Fix race condition on link status change
Sudip Mukherjee <sudipm.mukherjee(a)gmail.com>
MIPS: fix build with gcc-12
Zack Rusin <zackr(a)vmware.com>
drm/vmwgfx: Initialize drm_mode_fb_cmd2
Waiman Long <longman(a)redhat.com>
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
i40e: i40e_main: fix a missing check on list iterator
Robin Murphy <robin.murphy(a)arm.com>
drm/nouveau/tegra: Stop using iommu_present()
AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
serial: 8250_mtk: Fix register address for XON/XOFF character
AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
serial: 8250_mtk: Fix UART_EFR register address
Miaoqian Lin <linmq006(a)gmail.com>
slimbus: qcom: Fix IRQ check in qcom_slim_probe
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom MA510 modem
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom L610 modem
Ethan Yang <etyang(a)sierrawireless.com>
USB: serial: qcserial: add support for Sierra Wireless EM7590
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add device id for HP LM930 Display
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
usb: typec: tcpci: Don't skip cleanup in .remove() on error
Sergey Ryazanov <ryazanov.s.a(a)gmail.com>
usb: cdc-wdm: fix reading stuck on device close
Daniel Starke <daniel.starke(a)siemens.com>
tty: n_gsm: fix mux activation issues in gsm_config()
Eric Dumazet <edumazet(a)google.com>
tcp: resalt the secret every 10 seconds
Shravya Kumbham <shravya.kumbham(a)xilinx.com>
net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
Sven Schnelle <svens(a)linux.ibm.com>
s390: disable -Warray-bounds
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Generate notifications on changes for custom control
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Reject invalid values in custom control put()
Ji-Ze Hong (Peter Hong) <hpeter(a)gmail.com>
hwmon: (f71882fg) Fix negative temperature
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix filesystem block deallocation for short writes
Taehee Yoo <ap420073(a)gmail.com>
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
Guangguan Wang <guangguan.wang(a)linux.alibaba.com>
net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
Paolo Abeni <pabeni(a)redhat.com>
net/sched: act_pedit: really ensure the skb is writable
Alexandra Winter <wintera(a)linux.ibm.com>
s390/lcs: fix variable dereferenced before check
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix potential memory leak
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix variable dereferenced before check
Randy Dunlap <rdunlap(a)infradead.org>
hwmon: (ltq-cputemp) restrict it to SOC_XWAY
Jesse Brandeburg <jesse.brandeburg(a)intel.com>
dim: initialize all struct fields
Johannes Berg <johannes.berg(a)intel.com>
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
Eric Dumazet <edumazet(a)google.com>
netlink: do not reset transport header in netlink_recvmsg()
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
Lokesh Dhoundiyal <lokesh.dhoundiyal(a)alliedtelesis.co.nz>
ipv4: drop dst in multicast routing path
Tariq Toukan <tariqt(a)nvidia.com>
net: Fix features skip in for_each_netdev_feature()
Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com>
mac80211: Reset MBSSID parameters upon connection
Camel Guo <camel.guo(a)axis.com>
hwmon: (tmp401) Add OF device ID table
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't skb_split skbuffs with frag_list
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/io.h | 3 ++
arch/arm/mm/ioremap.c | 8 ++++
arch/arm64/include/asm/io.h | 4 ++
arch/arm64/mm/ioremap.c | 9 +++++
arch/mips/jz4740/setup.c | 2 +-
arch/s390/Makefile | 10 +++++
drivers/gpu/drm/nouveau/nouveau_backlight.c | 9 +++--
drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +-
drivers/hwmon/Kconfig | 2 +-
drivers/hwmon/f71882fg.c | 5 ++-
drivers/hwmon/tmp401.c | 11 ++++++
drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ++++++-------
drivers/net/ethernet/sfc/ef10.c | 5 +++
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 --------
drivers/net/phy/phy.c | 45 +++++++++++++++++++---
drivers/net/wireless/mac80211_hwsim.c | 3 ++
drivers/s390/net/ctcm_mpc.c | 6 +--
drivers/s390/net/ctcm_sysfs.c | 5 ++-
drivers/s390/net/lcs.c | 7 ++--
drivers/slimbus/qcom-ctrl.c | 4 +-
drivers/tty/n_gsm.c | 12 ++++--
drivers/tty/serial/8250/8250_mtk.c | 22 ++++++-----
drivers/tty/serial/digicolor-usart.c | 2 +-
drivers/usb/class/cdc-wdm.c | 1 +
drivers/usb/serial/option.c | 4 ++
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +
drivers/usb/serial/qcserial.c | 2 +
drivers/usb/typec/tcpm/tcpci.c | 2 +-
fs/gfs2/bmap.c | 11 +++---
include/linux/netdev_features.h | 4 +-
include/net/tc_act/tc_pedit.h | 1 +
kernel/cgroup/cpuset.c | 7 +++-
lib/dim/net_dim.c | 44 ++++++++++-----------
net/batman-adv/fragmentation.c | 11 ++++++
net/core/secure_seq.c | 12 ++++--
net/ipv4/ping.c | 12 +++++-
net/ipv4/route.c | 1 +
net/mac80211/mlme.c | 6 +++
net/netlink/af_netlink.c | 1 -
net/sched/act_pedit.c | 26 +++++++++++--
net/smc/smc_rx.c | 4 +-
sound/soc/codecs/max98090.c | 5 ++-
sound/soc/soc-ops.c | 18 ++++++++-
46 files changed, 281 insertions(+), 117 deletions(-)
These 3 commits from upstream allow us to have more fine grained control
over the MMC command timeouts and this solves the following timeouts
that we have seen on our systems across suspend/resume cycles:
[ 14.907496] usb usb2: root hub lost power or was reset
[ 15.216232] usb 1-1: reset high-speed USB device number 2 using
xhci-hcd
[ 15.485812] bcmgenet 8f00000.ethernet eth0: Link is Down
[ 15.525328] mmc1: error -110 doing runtime resume
[ 15.531864] OOM killer enabled.
Thanks!
Ulf Hansson (3):
mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
mmc: block: Use generic_cmd6_time when modifying
INAND_CMD38_ARG_EXT_CSD
mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
drivers/mmc/card/block.c | 6 +++---
drivers/mmc/core/core.c | 5 ++++-
drivers/mmc/core/mmc_ops.c | 9 +++++----
3 files changed, 12 insertions(+), 8 deletions(-)
--
2.25.1
These 3 commits from upstream allow us to have more fine grained control
over the MMC command timeouts and this solves the following timeouts
that we have seen on our systems across suspend/resume cycles:
[ 14.907496] usb usb2: root hub lost power or was reset
[ 15.216232] usb 1-1: reset high-speed USB device number 2 using
xhci-hcd
[ 15.485812] bcmgenet 8f00000.ethernet eth0: Link is Down
[ 15.525328] mmc1: error -110 doing runtime resume
[ 15.531864] OOM killer enabled.
Thanks!
Ulf Hansson (3):
mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
mmc: block: Use generic_cmd6_time when modifying
INAND_CMD38_ARG_EXT_CSD
mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
drivers/mmc/core/block.c | 6 +++---
drivers/mmc/core/mmc_ops.c | 27 ++++++++++++++-------------
2 files changed, 17 insertions(+), 16 deletions(-)
--
2.25.1
V2:
https://lore.kernel.org/linux-sgx/cover.1652131695.git.reinette.chatre@inte…
Changes since V2:
- Expand audience of series to include stable team, x86 maintainers, and lkml.
- Mark pages as dirty after receiving important data, not before. (Dave)
- Improve changelogs.
- Add Haitao and Jarkko's tags.
- Fix incorrect exit if address does not have enclave page associated. (Dave)
- See individual patches for detailed changes.
First version of series was submitted with incomplete fixes as RFC V1:
https://lore.kernel.org/linux-sgx/cover.1651171455.git.reinette.chatre@inte…
Changes since RFC V1:
- Remaining issue was root-caused with debugging help from Dave.
Patch 4/5 is new and eliminates all occurences of the ENCLS[ELDU] related
WARN.
- Drop "x86/sgx: Do not free backing memory on ENCLS[ELDU] failure" from
series. ENCLS[ELDU] failure is not recoverable so it serves no purpose to
keep the backing memory that could not be restored to the enclave.
- Patch 1/5 is new and refactors sgx_encl_put_backing() to only put
references to pages and not also mark the pages as dirty. (Dave)
- Mark PCMD page dirty before (not after) writing data to it. (Dave)
- Patch 5/5 is new and adds debug code to WARN if PCMD page is ever
found to contain data after it is truncated. (Dave)
== Cover Letter ==
Hi Everybody,
Haitao reported encountering the following WARN while stress testing SGX
with the SGX2 series [1] applied:
ELDU returned 1073741837 (0x4000000d)
WARNING: CPU: 72 PID: 24407 at arch/x86/kernel/cpu/sgx/encl.c:81 sgx_encl_eldu+0x3cf/0x400
...
Call Trace:
<TASK>
? xa_load+0x6e/0xa0
__sgx_encl_load_page+0x3d/0x80
sgx_encl_load_page_in_vma+0x4a/0x60
sgx_vma_fault+0x7f/0x3b0
? sysvec_call_function_single+0x66/0xd0
? asm_sysvec_call_function_single+0x12/0x20
__do_fault+0x39/0x110
__handle_mm_fault+0x1222/0x15a0
handle_mm_fault+0xdb/0x2c0
do_user_addr_fault+0x1d1/0x650
? exit_to_user_mode_prepare+0x45/0x170
exc_page_fault+0x76/0x170
? asm_exc_page_fault+0x8/0x30
asm_exc_page_fault+0x1e/0x30
...
</TASK>
ENCLS[ELDU] is returning a #GP when attempting to load an enclave
page from the backing store into the enclave.
Haitao's stress testing involves running two concurrent loops of the SGX2
selftests on a system with 4GB EPC memory. One of the tests is modified
to reduce the oversubscription heap size:
diff --git a/tools/testing/selftests/sgx/main.c b/tools/testing/selftests/sgx/main.c
index d480c2dd2858..12008789325b 100644
--- a/tools/testing/selftests/sgx/main.c
+++ b/tools/testing/selftests/sgx/main.c
@@ -398,7 +398,7 @@ TEST_F_TIMEOUT(enclave, unclobbered_vdso_oversubscribed_remove, 900)
* Create enclave with additional heap that is as big as all
* available physical SGX memory.
*/
- total_mem = get_total_epc_mem();
+ total_mem = get_total_epc_mem()/16;
ASSERT_NE(total_mem, 0);
TH_LOG("Creating an enclave with %lu bytes heap may take a while ...",
total_mem);
If the the test compiled with above snippet is renamed as "test_sgx_small"
and the original renamed as "test_sgx_large" the two concurrent loops are
run as follows:
(for i in $(seq 1 999); do echo "Iteration $i"; sudo ./test_sgx_large; done ) > log.large 2>&1
(for i in $(seq 1 9999); do echo "Iteration $i"; sudo ./test_sgx_small; done ) > log.small 2>&1
If the SGX driver is modified to always WARN when ENCLS[ELDU] encounters a #GP
(see below) then the WARN appears after a few iterations of "test_sgx_large"
and shows up throughout the testing.
diff --git a/arch/x86/kernel/cpu/sgx/encls.h b/arch/x86/kernel/cpu/sgx/encls.h
index 99004b02e2ed..68c1dbc84ed3 100644
--- a/arch/x86/kernel/cpu/sgx/encls.h
+++ b/arch/x86/kernel/cpu/sgx/encls.h
@@ -18,7 +18,7 @@
#define ENCLS_WARN(r, name) { \
do { \
int _r = (r); \
- WARN_ONCE(_r, "%s returned %d (0x%x)\n", (name), _r, _r); \
+ WARN(_r, "%s returned %d (0x%x)\n", (name), _r, _r); \
} while (0); \
}
I learned the following during investigation of the issue:
* Reverting commit 08999b2489b4 ("x86/sgx: Free backing memory after
faulting the enclave page") resolves the issue. With that commit
reverted the concurrent selftest loops can run to completion without
encountering any WARNs.
* The issue is also resolved if only the calls (introduced by commit
08999b2489b4 ("x86/sgx: Free backing memory after faulting the enclave
page") ) to sgx_encl_truncate_backing_page() within __sgx_encl_eldu()
are disabled.
* ENCLS[ELDU] faults with #GP when the provided PCMD data is all zeroes. It
does so because of a check that is not documented in the SDM. In this
check a page type of zero indicates an SECS page is being loaded into the
enclave, but since the SECS data is not empty the instruction faults with
#GP.
The fixes in this series address scenarios where the PCMD data in the
backing store may not be correct. While the SGX2 tests uncovered these
issues, the fixes are not related to SGX2 and apply on top of v5.18-rc6.
There are no occurences of the WARN when the stress testing is performed
with this series applied.
Thank you very much
Reinette
[1] https://lore.kernel.org/lkml/cover.1649878359.git.reinette.chatre@intel.com/
Reinette Chatre (5):
x86/sgx: Disconnect backing page references from dirty status
x86/sgx: Mark PCMD page as dirty when modifying contents
x86/sgx: Obtain backing storage page with enclave mutex held
x86/sgx: Fix race between reclaimer and page fault handler
x86/sgx: Ensure no data in PCMD page after truncate
arch/x86/kernel/cpu/sgx/encl.c | 113 ++++++++++++++++++++++++++++++---
arch/x86/kernel/cpu/sgx/encl.h | 2 +-
arch/x86/kernel/cpu/sgx/main.c | 13 ++--
3 files changed, 114 insertions(+), 14 deletions(-)
base-commit: c5eb0a61238dd6faf37f58c9ce61c9980aaffd7a
--
2.25.1
For some sev ioctl interfaces, input may be passed that is less than or
equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP
firmware returns. In this case, kmalloc will allocate memory that is the
size of the input rather than the size of the data. Since PSP firmware
doesn't fully overwrite the buffer, the sev ioctl interfaces with the
issue may return uninitialized slab memory.
Currently, all of the ioctl interfaces in the ccp driver are safe, but
to prevent future problems, change all ioctl interfaces that allocate
memory with kmalloc to use kzalloc and memset the data buffer to zero in
sev_ioctl_do_platform_status.
Fixes: e799035609e15 ("crypto: ccp: Implement SEV_PEK_CSR ioctl command")
Fixes: 76a2b524a4b1d ("crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command")
Fixes: d6112ea0cb344 ("crypto: ccp - introduce SEV_GET_ID2 command")
Cc: stable(a)vger.kernel.org
Reported-by: Andy Nguyen <theflow(a)google.com>
Suggested-by: David Rientjes <rientjes(a)google.com>
Suggested-by: Peter Gonda <pgonda(a)google.com>
Signed-off-by: John Allen <john.allen(a)amd.com>
---
v2:
- Add fixes tags and CC stable(a)vger.kernel.org
v3:
- memset data buffer to zero in sev_ioctl_do_platform_status
---
drivers/crypto/ccp/sev-dev.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 6ab93dfd478a..da143cc3a8f5 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -551,6 +551,8 @@ static int sev_ioctl_do_platform_status(struct sev_issue_cmd *argp)
struct sev_user_data_status data;
int ret;
+ memset(&data, 0, sizeof(data));
+
ret = __sev_do_cmd_locked(SEV_CMD_PLATFORM_STATUS, &data, &argp->error);
if (ret)
return ret;
@@ -604,7 +606,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable)
if (input.length > SEV_FW_BLOB_MAX_SIZE)
return -EFAULT;
- blob = kmalloc(input.length, GFP_KERNEL);
+ blob = kzalloc(input.length, GFP_KERNEL);
if (!blob)
return -ENOMEM;
@@ -828,7 +830,7 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp)
input_address = (void __user *)input.address;
if (input.address && input.length) {
- id_blob = kmalloc(input.length, GFP_KERNEL);
+ id_blob = kzalloc(input.length, GFP_KERNEL);
if (!id_blob)
return -ENOMEM;
@@ -947,14 +949,14 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)
if (input.cert_chain_len > SEV_FW_BLOB_MAX_SIZE)
return -EFAULT;
- pdh_blob = kmalloc(input.pdh_cert_len, GFP_KERNEL);
+ pdh_blob = kzalloc(input.pdh_cert_len, GFP_KERNEL);
if (!pdh_blob)
return -ENOMEM;
data.pdh_cert_address = __psp_pa(pdh_blob);
data.pdh_cert_len = input.pdh_cert_len;
- cert_blob = kmalloc(input.cert_chain_len, GFP_KERNEL);
+ cert_blob = kzalloc(input.cert_chain_len, GFP_KERNEL);
if (!cert_blob) {
ret = -ENOMEM;
goto e_free_pdh;
--
2.34.1
From: Gong Yuanjun <ruc_gongyuanjun(a)163.com>
In the for-loop in _rtl92e_update_rxcounts(),
i is a u8 counter while priv->rtllib->LinkDetectInfo.SlotNum is
a u16 num, there is a potential infinite loop if SlotNum is larger
than u8_max.
Change the u8 loop counter i into u16.
Signed-off-by: Gong Yuanjun <ruc_gongyuanjun(a)163.com>
---
drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
index b9ce71848023..3c5082abc583 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
@@ -1342,7 +1342,7 @@ static void _rtl92e_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum,
u32 *TotalRxDataNum)
{
u16 SlotIndex;
- u8 i;
+ u16 i;
*TotalRxBcnNum = 0;
*TotalRxDataNum = 0;
--
2.17.1
[add stable(a)vger.kernel.org to the recipients]
On Tuesday 17 May 2022 09:30:24 CEST Christian König wrote:
> Am 17.05.22 um 09:27 schrieb Jerome Pouiller:
> > From: Jérôme Pouiller <jerome.pouiller(a)silabs.com>
> >
> > The typedefs u32 and u64 are not available in userspace. Thus user get
> > an error he try to use DMA_BUF_SET_NAME_A or DMA_BUF_SET_NAME_B:
> >
> > $ gcc -Wall -c -MMD -c -o ioctls_list.o ioctls_list.c
> > In file included from /usr/include/x86_64-linux-gnu/asm/ioctl.h:1,
> > from /usr/include/linux/ioctl.h:5,
> > from /usr/include/asm-generic/ioctls.h:5,
> > from ioctls_list.c:11:
> > ioctls_list.c:463:29: error: ‘u32’ undeclared here (not in a function)
> > 463 | { "DMA_BUF_SET_NAME_A", DMA_BUF_SET_NAME_A, -1, -1 }, // linux/dma-buf.h
> > | ^~~~~~~~~~~~~~~~~~
> > ioctls_list.c:464:29: error: ‘u64’ undeclared here (not in a function)
> > 464 | { "DMA_BUF_SET_NAME_B", DMA_BUF_SET_NAME_B, -1, -1 }, // linux/dma-buf.h
> > | ^~~~~~~~~~~~~~~~~~
> >
> > The issue was initially reported here[1].
> >
> > [1]: https://urldefense.com/v3/__https://nam11.safelinks.protection.outlook.com/…
> >
> > Signed-off-by: Jérôme Pouiller <jerome.pouiller(a)silabs.com>
>
> Good catch, Reviewed-by: Christian König <christian.koenig(a)amd.com>
>
> CC: stable?
Done
> Fixes: ?
Fixes: a5bff92eaac4 ("dma-buf: Fix SET_NAME ioctl uapi")
--
Jérôme Pouiller
Dear ,
Please can I have your attention and possibly help me for humanity's
sake please. I am writing this message with a heavy heart filled with
sorrows and sadness.
Please if you can respond, i have an issue that i will be most
grateful if you could help me deal with it please.
Julian
This is the start of the stable review cycle for the 5.10.117 release.
There are 66 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.117-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.117-rc1
Dan Vacura <w36195(a)motorola.com>
usb: gadget: uvc: allow for application to cleanly shutdown
Michael Tretter <m.tretter(a)pengutronix.de>
usb: gadget: uvc: rename function to be more consistent
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ping: fix address binding wrt vrf
Mike Rapoport <rppt(a)kernel.org>
arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
Francesco Dolcini <francesco.dolcini(a)toradex.com>
net: phy: Fix race condition on link status change
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Don't call connect() more than once on a TCP socket
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Prevent immediate close+reconnect
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Clean up scheduling of autoclose
Zack Rusin <zackr(a)vmware.com>
drm/vmwgfx: Initialize drm_mode_fb_cmd2
Waiman Long <longman(a)redhat.com>
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
Manuel Ullmann <labre(a)posteo.de>
net: atlantic: always deep reset on pm op, fixing up my null deref regression
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
i40e: i40e_main: fix a missing check on list iterator
Robin Murphy <robin.murphy(a)arm.com>
drm/nouveau/tegra: Stop using iommu_present()
Jeff Layton <jlayton(a)kernel.org>
ceph: fix setting of xattrs on async created inodes
AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
serial: 8250_mtk: Fix register address for XON/XOFF character
AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
serial: 8250_mtk: Fix UART_EFR register address
Miaoqian Lin <linmq006(a)gmail.com>
slimbus: qcom: Fix IRQ check in qcom_slim_probe
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom MA510 modem
Sven Schwermer <sven.schwermer(a)disruptive-technologies.com>
USB: serial: option: add Fibocom L610 modem
Ethan Yang <etyang(a)sierrawireless.com>
USB: serial: qcserial: add support for Sierra Wireless EM7590
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add device id for HP LM930 Display
ChiYuan Huang <cy_huang(a)richtek.com>
usb: typec: tcpci_mt6360: Update for BMC PHY setting
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
usb: typec: tcpci: Don't skip cleanup in .remove() on error
Sergey Ryazanov <ryazanov.s.a(a)gmail.com>
usb: cdc-wdm: fix reading stuck on device close
Daniel Starke <daniel.starke(a)siemens.com>
tty: n_gsm: fix mux activation issues in gsm_config()
Yang Yingliang <yangyingliang(a)huawei.com>
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
Thiébaud Weksteen <tweek(a)google.com>
firmware_loader: use kernel credentials when reading firmware
Eric Dumazet <edumazet(a)google.com>
tcp: resalt the secret every 10 seconds
Matthew Hagan <mnhagan88(a)gmail.com>
net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT
Shravya Kumbham <shravya.kumbham(a)xilinx.com>
net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
Sven Schnelle <svens(a)linux.ibm.com>
s390: disable -Warray-bounds
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Generate notifications on changes for custom control
Mark Brown <broonie(a)kernel.org>
ASoC: max98090: Reject invalid values in custom control put()
Ji-Ze Hong (Peter Hong) <hpeter(a)gmail.com>
hwmon: (f71882fg) Fix negative temperature
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix filesystem block deallocation for short writes
Maxim Mikityanskiy <maximmi(a)nvidia.com>
tls: Fix context leak on tls_device_down
Taehee Yoo <ap420073(a)gmail.com>
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
Guangguan Wang <guangguan.wang(a)linux.alibaba.com>
net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down()
Florian Fainelli <f.fainelli(a)gmail.com>
net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral
Paolo Abeni <pabeni(a)redhat.com>
net/sched: act_pedit: really ensure the skb is writable
Alexandra Winter <wintera(a)linux.ibm.com>
s390/lcs: fix variable dereferenced before check
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix potential memory leak
Alexandra Winter <wintera(a)linux.ibm.com>
s390/ctcm: fix variable dereferenced before check
Joel Savitz <jsavitz(a)redhat.com>
selftests: vm: Makefile: rename TARGETS to VMTARGETS
Randy Dunlap <rdunlap(a)infradead.org>
hwmon: (ltq-cputemp) restrict it to SOC_XWAY
Jesse Brandeburg <jesse.brandeburg(a)intel.com>
dim: initialize all struct fields
Yang Yingliang <yangyingliang(a)huawei.com>
ionic: fix missing pci_release_regions() on error in ionic_probe()
Dan Aloni <dan.aloni(a)vastdata.com>
nfs: fix broken handling of the softreval mount option
Johannes Berg <johannes.berg(a)intel.com>
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
Taehee Yoo <ap420073(a)gmail.com>
net: sfc: fix memory leak due to ptp channel
Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com>
sfc: Use swap() instead of open coding it
Eric Dumazet <edumazet(a)google.com>
netlink: do not reset transport header in netlink_recvmsg()
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
Lokesh Dhoundiyal <lokesh.dhoundiyal(a)alliedtelesis.co.nz>
ipv4: drop dst in multicast routing path
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted
Tariq Toukan <tariqt(a)nvidia.com>
net: Fix features skip in for_each_netdev_feature()
Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com>
mac80211: Reset MBSSID parameters upon connection
Camel Guo <camel.guo(a)axis.com>
hwmon: (tmp401) Add OF device ID table
Guenter Roeck <linux(a)roeck-us.net>
iwlwifi: iwl-dbg: Use del_timer_sync() before freeing
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't skb_split skbuffs with frag_list
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/io.h | 3 ++
arch/arm/mm/ioremap.c | 8 ++++
arch/arm64/include/asm/io.h | 4 ++
arch/arm64/mm/ioremap.c | 9 +++++
arch/s390/Makefile | 10 +++++
drivers/base/firmware_loader/main.c | 17 ++++++++
drivers/gpu/drm/nouveau/nouveau_backlight.c | 9 +++--
drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +-
drivers/hwmon/Kconfig | 2 +-
drivers/hwmon/f71882fg.c | 5 ++-
drivers/hwmon/tmp401.c | 11 ++++++
drivers/net/dsa/bcm_sf2.c | 3 ++
.../net/ethernet/aquantia/atlantic/aq_pci_func.c | 4 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++
drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ++++++-------
drivers/net/ethernet/mscc/ocelot_flower.c | 5 ++-
drivers/net/ethernet/mscc/ocelot_vcap.c | 9 ++++-
.../net/ethernet/pensando/ionic/ionic_bus_pci.c | 3 +-
drivers/net/ethernet/sfc/ef10.c | 5 +++
drivers/net/ethernet/sfc/efx_channels.c | 21 +++++-----
drivers/net/ethernet/sfc/ptp.c | 14 ++++++-
drivers/net/ethernet/sfc/ptp.h | 1 +
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 --------
drivers/net/phy/phy.c | 45 +++++++++++++++++++---
drivers/net/phy/sfp.c | 12 +++++-
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +-
drivers/net/wireless/mac80211_hwsim.c | 3 ++
drivers/s390/net/ctcm_mpc.c | 6 +--
drivers/s390/net/ctcm_sysfs.c | 5 ++-
drivers/s390/net/lcs.c | 7 ++--
drivers/slimbus/qcom-ctrl.c | 4 +-
drivers/tty/n_gsm.c | 12 ++++--
drivers/tty/serial/8250/8250_mtk.c | 22 ++++++-----
drivers/tty/serial/digicolor-usart.c | 5 +--
drivers/usb/class/cdc-wdm.c | 1 +
drivers/usb/gadget/function/f_uvc.c | 32 +++++++++++++--
drivers/usb/gadget/function/uvc.h | 2 +
drivers/usb/gadget/function/uvc_v4l2.c | 3 +-
drivers/usb/serial/option.c | 4 ++
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +
drivers/usb/serial/qcserial.c | 2 +
drivers/usb/typec/tcpm/tcpci.c | 2 +-
drivers/usb/typec/tcpm/tcpci_mt6360.c | 26 +++++++++++++
fs/ceph/file.c | 16 ++++++--
fs/file_table.c | 1 +
fs/gfs2/bmap.c | 11 +++---
fs/nfs/fs_context.c | 2 +-
include/linux/netdev_features.h | 4 +-
include/linux/sunrpc/xprtsock.h | 1 +
include/net/tc_act/tc_pedit.h | 1 +
include/trace/events/sunrpc.h | 1 -
kernel/cgroup/cpuset.c | 7 +++-
lib/dim/net_dim.c | 44 ++++++++++-----------
net/batman-adv/fragmentation.c | 11 ++++++
net/core/secure_seq.c | 12 ++++--
net/ipv4/ping.c | 15 +++++++-
net/ipv4/route.c | 1 +
net/mac80211/mlme.c | 6 +++
net/netlink/af_netlink.c | 1 -
net/sched/act_pedit.c | 26 +++++++++++--
net/smc/smc_rx.c | 4 +-
net/sunrpc/xprt.c | 36 ++++++++---------
net/sunrpc/xprtsock.c | 35 +++++++++++------
net/tls/tls_device.c | 3 ++
sound/soc/codecs/max98090.c | 5 ++-
sound/soc/soc-ops.c | 18 ++++++++-
tools/testing/selftests/vm/Makefile | 10 ++---
70 files changed, 482 insertions(+), 183 deletions(-)
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: i2c: imx412: Fix reset GPIO polarity
Author: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
Date: Fri Apr 15 13:59:51 2022 +0200
The imx412/imx577 sensor has a reset line that is active low not active
high. Currently the logic for this is inverted.
The right way to define the reset line is to declare it active low in the
DTS and invert the logic currently contained in the driver.
The DTS should represent the hardware does i.e. reset is active low.
So:
+ reset-gpios = <&tlmm 78 GPIO_ACTIVE_LOW>;
not:
- reset-gpios = <&tlmm 78 GPIO_ACTIVE_HIGH>;
I was a bit reticent about changing this logic since I thought it might
negatively impact @intel.com users. Googling a bit though I believe this
sensor is used on "Keem Bay" which is clearly a DTS based system and is not
upstream yet.
Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
Reviewed-by: Jacopo Mondi <jacopo(a)jmondi.org>
Reviewed-by: Daniele Alessandrelli <daniele.alessandrelli(a)intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org>
drivers/media/i2c/imx412.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
---
diff --git a/drivers/media/i2c/imx412.c b/drivers/media/i2c/imx412.c
index be3f6ea55559..e6be6b4250f5 100644
--- a/drivers/media/i2c/imx412.c
+++ b/drivers/media/i2c/imx412.c
@@ -1011,7 +1011,7 @@ static int imx412_power_on(struct device *dev)
struct imx412 *imx412 = to_imx412(sd);
int ret;
- gpiod_set_value_cansleep(imx412->reset_gpio, 1);
+ gpiod_set_value_cansleep(imx412->reset_gpio, 0);
ret = clk_prepare_enable(imx412->inclk);
if (ret) {
@@ -1024,7 +1024,7 @@ static int imx412_power_on(struct device *dev)
return 0;
error_reset:
- gpiod_set_value_cansleep(imx412->reset_gpio, 0);
+ gpiod_set_value_cansleep(imx412->reset_gpio, 1);
return ret;
}
@@ -1040,7 +1040,7 @@ static int imx412_power_off(struct device *dev)
struct v4l2_subdev *sd = dev_get_drvdata(dev);
struct imx412 *imx412 = to_imx412(sd);
- gpiod_set_value_cansleep(imx412->reset_gpio, 0);
+ gpiod_set_value_cansleep(imx412->reset_gpio, 1);
clk_disable_unprepare(imx412->inclk);
Yanming reported a kernel bug in Bugzilla kernel [1], which can be
reproduced. The bug message is:
The kernel message is shown below:
kernel BUG at fs/inode.c:611!
Call Trace:
evict+0x282/0x4e0
__dentry_kill+0x2b2/0x4d0
dput+0x2dd/0x720
do_renameat2+0x596/0x970
__x64_sys_rename+0x78/0x90
do_syscall_64+0x3b/0x90
[1] https://bugzilla.kernel.org/show_bug.cgi?id=215895
The bug is due to fuzzed inode has both inline_data and encrypted flags.
During f2fs_evict_inode(), as the inode was deleted by rename(), it
will cause inline data conversion due to conflicting flags. The page
cache will be polluted and the panic will be triggered in clear_inode().
Try fixing the bug by doing more sanity checks for inline data inode in
sanity_check_inode().
Cc: stable(a)vger.kernel.org
Reported-by: Ming Yan <yanming(a)tju.edu.cn>
Signed-off-by: Chao Yu <chao.yu(a)oppo.com>
---
v3:
- clean up commit message suggested by Bagas Sanjaya.
fs/f2fs/f2fs.h | 8 ++++++++
fs/f2fs/inode.c | 3 +--
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 492af5b96de1..0dc2461ef02c 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -4126,6 +4126,14 @@ static inline void f2fs_set_encrypted_inode(struct inode *inode)
*/
static inline bool f2fs_post_read_required(struct inode *inode)
{
+ /*
+ * used by sanity_check_inode(), when disk layout fields has not
+ * been synchronized to inmem fields.
+ */
+ if (S_ISREG(inode->i_mode) && (file_is_encrypt(inode) ||
+ F2FS_I(inode)->i_flags & F2FS_COMPR_FL ||
+ file_is_verity(inode)))
+ return true;
return f2fs_encrypted_file(inode) || fsverity_active(inode) ||
f2fs_compressed_file(inode);
}
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index 2fce8fa0dac8..5e494c98e3c2 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -276,8 +276,7 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page)
}
}
- if (f2fs_has_inline_data(inode) &&
- (!S_ISREG(inode->i_mode) && !S_ISLNK(inode->i_mode))) {
+ if (f2fs_has_inline_data(inode) && !f2fs_may_inline_data(inode)) {
set_sbi_flag(sbi, SBI_NEED_FSCK);
f2fs_warn(sbi, "%s: inode (ino=%lx, mode=%u) should not have inline_data, run fsck to fix",
__func__, inode->i_ino, inode->i_mode);
--
2.32.0