May 2022 - Linux-stable-mirror

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.4.192 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 06 May 2022 15:25:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.192-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.4.192-rc1 Christophe Leroy <christophe.leroy(a)csgroup.eu> mm, hugetlb: allow for "high" userspace addresses Shijie Hu <hushijie3(a)huawei.com> hugetlbfs: get unmapped area below TASK_UNMAPPED_BASE for hugetlbfs Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix incorrect UA handling Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix wrong command frame length field encoding Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix wrong command retry handling Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix missing explicit ldisc flush Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix insufficient txframe size Florian Westphal <fw(a)strlen.de> netfilter: nft_socket: only do sk lookups when indev is available Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix malformed counter for out of frame data Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 Borislav Petkov <bp(a)suse.de> x86/cpu: Load microcode during restore_processor_state() Dinh Nguyen <dinguyen(a)kernel.org> net: ethernet: stmmac: fix write to sgmii_adapter_base Duoming Zhou <duoming(a)zju.edu.cn> drivers: net: hippi: Fix deadlock in rr_close() Ronnie Sahlberg <lsahlber(a)redhat.com> cifs: destage any unwritten data to the server before calling copychunk_write Mikulas Patocka <mpatocka(a)redhat.com> x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 Peilin Ye <peilin.ye(a)bytedance.com> ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() Zheyu Ma <zheyuma97(a)gmail.com> ASoC: wm8731: Disable the regulator when probing fails Pengcheng Yang <yangpc(a)wangsu.com> tcp: fix F-RTO may not work correctly when receiving DSACK Leon Romanovsky <leonro(a)nvidia.com> ixgbe: ensure IPsec VF<->PF compatibility Manish Chopra <manishc(a)marvell.com> bnx2x: fix napi API usage sequence Maxim Mikityanskiy <maximmi(a)nvidia.com> tls: Skip tls_append_frag on zero copy size Miaoqian Lin <linmq006(a)gmail.com> drm/amd/display: Fix memory leak in dcn21_clock_source_create Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK Jonathan Lemon <jonathan.lemon(a)gmail.com> net: bcmgenet: hide status block before TX timestamping Yang Yingliang <yangyingliang(a)huawei.com> clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() Eric Dumazet <edumazet(a)google.com> tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT Peilin Ye <peilin.ye(a)bytedance.com> ip_gre: Make o_seqno start from 0 in native mode liuyacan <liuyacan(a)corp.netease.com> net/smc: sync err code when tcp connection was refused Jian Shen <shenjian15(a)huawei.com> net: hns3: add validity check for message data length Xiaobing Luo <luoxiaobing0926(a)gmail.com> cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe Lv Ruyi <lv.ruyi(a)zte.com.cn> pinctrl: pistachio: fix use of irq_of_parse_and_map() Fabio Estevam <festevam(a)denx.de> arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock Max Krummenacher <max.krummenacher(a)toradex.com> ARM: dts: imx6ull-colibri: fix vqmmc regulator Xin Long <lucien.xin(a)gmail.com> sctp: check asoc strreset_chunk in sctp_generate_reconf_event Pengcheng Yang <yangpc(a)wangsu.com> tcp: ensure to use the most recently sent skb when filling the rate sample Francesco Ruggeri <fruggeri(a)arista.com> tcp: md5: incorrect tcp_header_len for incoming connections Eyal Birger <eyal.birger(a)gmail.com> bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook Miaoqian Lin <linmq006(a)gmail.com> mtd: rawnand: Fix return value check of wait_for_completion_timeout Pengcheng Yang <yangpc(a)wangsu.com> ipvs: correctly print the memory size of ip_vs_conn_tab Adam Ford <aford173(a)gmail.com> ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 Adam Ford <aford173(a)gmail.com> ARM: dts: am3517-evm: Fix misc pinmuxing H. Nikolaus Schaller <hns(a)goldelico.com> ARM: dts: Fix mmc order for omap3-gta04 Miaoqian Lin <linmq006(a)gmail.com> phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe Miaoqian Lin <linmq006(a)gmail.com> phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe Mark Brown <broonie(a)kernel.org> ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek Miaoqian Lin <linmq006(a)gmail.com> phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks Miaoqian Lin <linmq006(a)gmail.com> ARM: OMAP2+: Fix refcount leak in omap_gic_of_init Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> phy: samsung: exynos5250-sata: fix missing device put in probe error paths Miaoqian Lin <linmq006(a)gmail.com> phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe Fabio Estevam <festevam(a)gmail.com> ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue Weitao Wang <WeitaoWang-oc(a)zhaoxin.com> USB: Fix xhci event ring dequeue pointer ERDP update issue Chuanhong Guo <gch981213(a)gmail.com> mtd: rawnand: fix ecc parameters for mt7622 Christian Hewitt <christianshewitt(a)gmail.com> arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards Christian Hewitt <christianshewitt(a)gmail.com> arm64: dts: meson: remove CPU opps below 1GHz for G12B boards Pavel Skripkin <paskripkin(a)gmail.com> video: fbdev: udlfb: properly check endpoint type Mikulas Patocka <mpatocka(a)redhat.com> hex2bin: fix access beyond string end Mikulas Patocka <mpatocka(a)redhat.com> hex2bin: make the function hex_to_bin constant-time Wang Qing <wangqing(a)vivo.com> arch_topology: Do not set llc_sibling if llc_id is invalid Maciej W. Rozycki <macro(a)orcam.me.uk> serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: 8250: Also set sticky MCR bits in console restoration Johan Hovold <johan(a)kernel.org> serial: imx: fix overrun interrupts in DMA mode Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Return proper request status Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: core: Fix tx/rx threshold settings Vijayavardhan Vennapusa <vvreddy(a)codeaurora.org> usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() Dan Vacura <w36195(a)motorola.com> usb: gadget: uvc: Fix crash when encoding data for usb request Heikki Krogerus <heikki.krogerus(a)linux.intel.com> usb: typec: ucsi: Fix role swapping Hangyu Hua <hbh25y(a)gmail.com> usb: misc: fix improper handling of refcount in uss720_probe() Zheyu Ma <zheyuma97(a)gmail.com> iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() Michael Hennerich <michael.hennerich(a)analog.com> iio: dac: ad5446: Fix read_raw not returning set value Zizhuang Deng <sunsetdzz(a)gmail.com> iio: dac: ad5592r: Fix the missing return value. Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms Henry Lin <henryl(a)nvidia.com> xhci: stop polling roothubs after shutdown Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions Slark Xiao <slark_xiao(a)163.com> USB: serial: option: add support for Cinterion MV32-WA/MV32-WB Bruno Thomsen <bruno.thomsen(a)gmail.com> USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader Kees Cook <keescook(a)chromium.org> USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS Oliver Neukum <oneukum(a)suse.com> USB: quirks: add STRING quirk for VCOM device Oliver Neukum <oneukum(a)suse.com> USB: quirks: add a Realtek card reader Macpaul Lin <macpaul.lin(a)mediatek.com> usb: mtu3: fix USB 3.0 dual-role-switch from device to host Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> lightnvm: disable the subsystem Lin Ma <linma(a)zju.edu.cn> hamradio: remove needs_free_netdev to avoid UAF Lin Ma <linma(a)zju.edu.cn> hamradio: defer 6pack kfree after unregister_netdev Willy Tarreau <w(a)1wt.eu> floppy: disable FDRAWCMD by default ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/am3517-evm.dts | 45 ++++++++++++-- arch/arm/boot/dts/am3517-som.dtsi | 9 +++ arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 6 ++ arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 +++- arch/arm/boot/dts/imx6ull-colibri.dtsi | 2 +- arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts | 15 +++++ arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts | 15 +++++ arch/arm/boot/dts/logicpd-som-lv.dtsi | 15 ----- arch/arm/boot/dts/omap3-gta04.dtsi | 2 + arch/arm/mach-omap2/omap4-common.c | 2 + arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi | 40 ------------- arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi | 40 ------------- arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 20 ------- arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts | 4 ++ arch/x86/include/asm/microcode.h | 2 + arch/x86/kernel/cpu/microcode/core.c | 6 +- arch/x86/lib/usercopy_64.c | 2 +- arch/x86/power/cpu.c | 8 +++ drivers/base/arch_topology.c | 2 +- drivers/block/Kconfig | 16 +++++ drivers/block/floppy.c | 43 +++++++++---- drivers/bus/sunxi-rsb.c | 2 + drivers/clk/sunxi/clk-sun9i-mmc.c | 2 + drivers/cpufreq/sun50i-cpufreq-nvmem.c | 4 +- .../gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 1 + drivers/iio/dac/ad5446.c | 2 +- drivers/iio/dac/ad5592r-base.c | 2 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/lightnvm/Kconfig | 2 +- drivers/mtd/nand/raw/mtk_ecc.c | 12 ++-- drivers/mtd/nand/raw/sh_flctl.c | 14 +++-- drivers/net/dsa/lantiq_gswip.c | 3 - drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +-- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 7 +++ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 +++ drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 +- .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 12 ++-- drivers/net/hamradio/6pack.c | 5 +- drivers/net/hippi/rrunner.c | 2 + drivers/phy/motorola/phy-mapphone-mdm6600.c | 3 +- drivers/phy/samsung/phy-exynos5250-sata.c | 21 +++++-- drivers/phy/ti/phy-am654-serdes.c | 2 +- drivers/phy/ti/phy-omap-usb2.c | 2 +- drivers/pinctrl/pinctrl-pistachio.c | 6 +- drivers/tty/n_gsm.c | 40 +++++++------ drivers/tty/serial/8250/8250_pci.c | 8 +-- drivers/tty/serial/8250/8250_port.c | 2 +- drivers/tty/serial/imx.c | 2 +- drivers/usb/core/quirks.c | 6 ++ drivers/usb/dwc3/core.c | 8 +-- drivers/usb/dwc3/gadget.c | 31 +++++++++- drivers/usb/gadget/configfs.c | 2 + drivers/usb/gadget/function/uvc_queue.c | 2 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-ring.c | 2 + drivers/usb/host/xhci.c | 11 ++++ drivers/usb/misc/uss720.c | 3 +- drivers/usb/mtu3/mtu3_dr.c | 6 +- drivers/usb/serial/cp210x.c | 2 + drivers/usb/serial/option.c | 12 ++++ drivers/usb/serial/whiteheat.c | 5 +- drivers/usb/typec/ucsi/ucsi.c | 20 ++++--- drivers/video/fbdev/udlfb.c | 14 ++++- fs/cifs/smb2ops.c | 8 +++ fs/hugetlbfs/inode.c | 70 +++++++++++++++++++--- include/linux/kernel.h | 2 +- include/linux/sched/mm.h | 8 +++ include/net/tcp.h | 7 +++ lib/hexdump.c | 41 +++++++++---- mm/mmap.c | 8 --- net/core/lwt_bpf.c | 7 +-- net/ipv4/ip_gre.c | 8 +-- net/ipv4/tcp_input.c | 15 ++++- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 1 + net/ipv4/tcp_rate.c | 11 +++- net/ipv6/ip6_gre.c | 5 +- net/netfilter/ipvs/ip_vs_conn.c | 2 +- net/netfilter/nft_socket.c | 52 +++++++++++----- net/sctp/sm_sideeffect.c | 4 ++ net/smc/af_smc.c | 2 + net/tls/tls_device.c | 12 ++-- sound/soc/codecs/wm8731.c | 19 +++--- 84 files changed, 590 insertions(+), 304 deletions(-)

3 years, 7 months

6
89
0 0

patch "fsl_lpuart: Don't enable interrupts too early" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled fsl_lpuart: Don't enable interrupts too early to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 401fb66a355eb0f22096cf26864324f8e63c7d78 Mon Sep 17 00:00:00 2001 From: Indan Zupancic <Indan.Zupancic(a)mep-info.com> Date: Thu, 5 May 2022 13:47:50 +0200 Subject: fsl_lpuart: Don't enable interrupts too early If an irq is pending when devm_request_irq() is called, the irq handler will cause a NULL pointer access because initialisation is not done yet. Fixes: 9d7ee0e28da59 ("tty: serial: lpuart: avoid report NULL interrupt") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Indan Zupancic <Indan.Zupancic(a)mep-info.com> Link: https://lore.kernel.org/r/20220505114750.45423-1-Indan.Zupancic@mep-info.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/fsl_lpuart.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 87789872f400..be12fee94db5 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -2664,6 +2664,7 @@ static int lpuart_probe(struct platform_device *pdev) struct device_node *np = pdev->dev.of_node; struct lpuart_port *sport; struct resource *res; + irq_handler_t handler; int ret; sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL); @@ -2741,17 +2742,11 @@ static int lpuart_probe(struct platform_device *pdev) if (lpuart_is_32(sport)) { lpuart_reg.cons = LPUART32_CONSOLE; - ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart32_int, 0, - DRIVER_NAME, sport); + handler = lpuart32_int; } else { lpuart_reg.cons = LPUART_CONSOLE; - ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart_int, 0, - DRIVER_NAME, sport); + handler = lpuart_int; } - - if (ret) - goto failed_irq_request; - ret = uart_add_one_port(&lpuart_reg, &sport->port); if (ret) goto failed_attach_port; @@ -2773,13 +2768,18 @@ static int lpuart_probe(struct platform_device *pdev) sport->port.rs485_config(&sport->port, &sport->port.rs485); + ret = devm_request_irq(&pdev->dev, sport->port.irq, handler, 0, + DRIVER_NAME, sport); + if (ret) + goto failed_irq_request; + return 0; +failed_irq_request: failed_get_rs485: failed_reset: uart_remove_one_port(&lpuart_reg, &sport->port); failed_attach_port: -failed_irq_request: lpuart_disable_clks(sport); failed_clock_enable: failed_out_of_range: -- 2.36.0

3 years, 7 months

1
0
0 0

patch "serial: 8250_mtk: Fix register address for XON/XOFF character" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled serial: 8250_mtk: Fix register address for XON/XOFF character to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From e1bfdbc7daca171c74a577b3dd0b36d76bb0ffcc Mon Sep 17 00:00:00 2001 From: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Date: Wed, 27 Apr 2022 15:23:28 +0200 Subject: serial: 8250_mtk: Fix register address for XON/XOFF character The XON1/XOFF1 character registers are at offset 0xa0 and 0xa8 respectively, so we cannot use the definition in serial_port.h. Fixes: bdbd0a7f8f03 ("serial: 8250-mtk: modify baudrate setting") Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220427132328.228297-4-angelogioacchino.delregno… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/8250/8250_mtk.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c index 28e36459642c..21053db93ff1 100644 --- a/drivers/tty/serial/8250/8250_mtk.c +++ b/drivers/tty/serial/8250/8250_mtk.c @@ -57,6 +57,9 @@ #define MTK_UART_FEATURE_SEL 39 /* Feature Selection register */ #define MTK_UART_FEAT_NEWRMAP BIT(0) /* Use new register map */ +#define MTK_UART_XON1 40 /* I/O: Xon character 1 */ +#define MTK_UART_XOFF1 42 /* I/O: Xoff character 1 */ + #ifdef CONFIG_SERIAL_8250_DMA enum dma_rx_status { DMA_RX_START = 0, @@ -278,8 +281,8 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) (serial_in(up, MTK_UART_EFR) & (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); - serial_out(up, UART_XON1, START_CHAR(port->state->port.tty)); - serial_out(up, UART_XOFF1, STOP_CHAR(port->state->port.tty)); + serial_out(up, MTK_UART_XON1, START_CHAR(port->state->port.tty)); + serial_out(up, MTK_UART_XOFF1, STOP_CHAR(port->state->port.tty)); serial_out(up, UART_LCR, lcr); mtk8250_disable_intrs(up, MTK_UART_IER_CTSI|MTK_UART_IER_RTSI); mtk8250_enable_intrs(up, MTK_UART_IER_XOFFI); -- 2.36.0

3 years, 7 months

1
0
0 0

patch "serial: 8250_mtk: Make sure to select the right FEATURE_SEL" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled serial: 8250_mtk: Make sure to select the right FEATURE_SEL to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 6f81fdded0d024c7d4084d434764f30bca1cd6b1 Mon Sep 17 00:00:00 2001 From: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Date: Wed, 27 Apr 2022 15:23:27 +0200 Subject: serial: 8250_mtk: Make sure to select the right FEATURE_SEL Set the FEATURE_SEL at probe time to make sure that BIT(0) is enabled: this guarantees that when the port is configured as AP UART, the right register layout is interpreted by the UART IP. Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220427132328.228297-3-angelogioacchino.delregno… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/8250/8250_mtk.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c index cd62a5f34014..28e36459642c 100644 --- a/drivers/tty/serial/8250/8250_mtk.c +++ b/drivers/tty/serial/8250/8250_mtk.c @@ -54,6 +54,9 @@ #define MTK_UART_TX_TRIGGER 1 #define MTK_UART_RX_TRIGGER MTK_UART_RX_SIZE +#define MTK_UART_FEATURE_SEL 39 /* Feature Selection register */ +#define MTK_UART_FEAT_NEWRMAP BIT(0) /* Use new register map */ + #ifdef CONFIG_SERIAL_8250_DMA enum dma_rx_status { DMA_RX_START = 0, @@ -569,6 +572,10 @@ static int mtk8250_probe(struct platform_device *pdev) uart.dma = data->dma; #endif + /* Set AP UART new register map */ + writel(MTK_UART_FEAT_NEWRMAP, uart.port.membase + + (MTK_UART_FEATURE_SEL << uart.port.regshift)); + /* Disable Rate Fix function */ writel(0x0, uart.port.membase + (MTK_UART_RATE_FIX << uart.port.regshift)); -- 2.36.0

3 years, 7 months

1
0
0 0

patch "serial: 8250_mtk: Fix UART_EFR register address" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled serial: 8250_mtk: Fix UART_EFR register address to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From bb0b197aadd928f52ce6f01f0ee977f0a08cf1be Mon Sep 17 00:00:00 2001 From: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Date: Wed, 27 Apr 2022 15:23:26 +0200 Subject: serial: 8250_mtk: Fix UART_EFR register address On MediaTek SoCs, the UART IP is 16550A compatible, but there are some specific quirks: we are declaring a register shift of 2, but this is only valid for the majority of the registers, as there are some that are out of the standard layout. Specifically, this driver is using definitions from serial_reg.h, where we have a UART_EFR register defined as 2: this results in a 0x8 offset, but there we have the FCR register instead. The right offset for the EFR register on MediaTek UART is at 0x98, so, following the decimal definition convention in serial_reg.h and accounting for the register left shift of two, add and use the correct register address for this IP, defined as decimal 38, so that the final calculation results in (0x26 << 2) = 0x98. Fixes: bdbd0a7f8f03 ("serial: 8250-mtk: modify baudrate setting") Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220427132328.228297-2-angelogioacchino.delregno… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/8250/8250_mtk.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c index f4a0caa56f84..cd62a5f34014 100644 --- a/drivers/tty/serial/8250/8250_mtk.c +++ b/drivers/tty/serial/8250/8250_mtk.c @@ -37,6 +37,7 @@ #define MTK_UART_IER_RTSI 0x40 /* Enable RTS Modem status interrupt */ #define MTK_UART_IER_CTSI 0x80 /* Enable CTS Modem status interrupt */ +#define MTK_UART_EFR 38 /* I/O: Extended Features Register */ #define MTK_UART_EFR_EN 0x10 /* Enable enhancement feature */ #define MTK_UART_EFR_RTS 0x40 /* Enable hardware rx flow control */ #define MTK_UART_EFR_CTS 0x80 /* Enable hardware tx flow control */ @@ -169,7 +170,7 @@ static void mtk8250_dma_enable(struct uart_8250_port *up) MTK_UART_DMA_EN_RX | MTK_UART_DMA_EN_TX); serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); - serial_out(up, UART_EFR, UART_EFR_ECB); + serial_out(up, MTK_UART_EFR, UART_EFR_ECB); serial_out(up, UART_LCR, lcr); if (dmaengine_slave_config(dma->rxchan, &dma->rxconf) != 0) @@ -232,7 +233,7 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) int lcr = serial_in(up, UART_LCR); serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); - serial_out(up, UART_EFR, UART_EFR_ECB); + serial_out(up, MTK_UART_EFR, UART_EFR_ECB); serial_out(up, UART_LCR, lcr); lcr = serial_in(up, UART_LCR); @@ -241,7 +242,7 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) serial_out(up, MTK_UART_ESCAPE_DAT, MTK_UART_ESCAPE_CHAR); serial_out(up, MTK_UART_ESCAPE_EN, 0x00); serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); - serial_out(up, UART_EFR, serial_in(up, UART_EFR) & + serial_out(up, MTK_UART_EFR, serial_in(up, MTK_UART_EFR) & (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK))); serial_out(up, UART_LCR, lcr); mtk8250_disable_intrs(up, MTK_UART_IER_XOFFI | @@ -255,8 +256,8 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); /*enable hw flow control*/ - serial_out(up, UART_EFR, MTK_UART_EFR_HW_FC | - (serial_in(up, UART_EFR) & + serial_out(up, MTK_UART_EFR, MTK_UART_EFR_HW_FC | + (serial_in(up, MTK_UART_EFR) & (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); serial_out(up, UART_LCR, lcr); @@ -270,8 +271,8 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); /*enable sw flow control */ - serial_out(up, UART_EFR, MTK_UART_EFR_XON1_XOFF1 | - (serial_in(up, UART_EFR) & + serial_out(up, MTK_UART_EFR, MTK_UART_EFR_XON1_XOFF1 | + (serial_in(up, MTK_UART_EFR) & (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); serial_out(up, UART_XON1, START_CHAR(port->state->port.tty)); -- 2.36.0

3 years, 7 months

1
0
0 0

patch "tty/serial: digicolor: fix possible null-ptr-deref in" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty/serial: digicolor: fix possible null-ptr-deref in to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 447ee1516f19f534a228dda237eddb202f23e163 Mon Sep 17 00:00:00 2001 From: Yang Yingliang <yangyingliang(a)huawei.com> Date: Thu, 5 May 2022 20:46:21 +0800 Subject: tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref. And use devm_platform_get_and_ioremap_resource() to simplify code. Fixes: 5930cb3511df ("serial: driver for Conexant Digicolor USART") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Baruch Siach <baruch(a)tkos.co.il> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220505124621.1592697-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/digicolor-usart.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c index 6d70fea76bb3..e37a917b9dbb 100644 --- a/drivers/tty/serial/digicolor-usart.c +++ b/drivers/tty/serial/digicolor-usart.c @@ -471,11 +471,10 @@ static int digicolor_uart_probe(struct platform_device *pdev) if (IS_ERR(uart_clk)) return PTR_ERR(uart_clk); - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - dp->port.mapbase = res->start; - dp->port.membase = devm_ioremap_resource(&pdev->dev, res); + dp->port.membase = devm_platform_get_and_ioremap_resource(pdev, 0, &res); if (IS_ERR(dp->port.membase)) return PTR_ERR(dp->port.membase); + dp->port.mapbase = res->start; irq = platform_get_irq(pdev, 0); if (irq < 0) -- 2.36.0

3 years, 7 months

1
0
0 0

patch "serial: pch: don't overwrite xmit->buf[0] by x_char" added to tty-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled serial: pch: don't overwrite xmit->buf[0] by x_char to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the tty-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. From d9f3af4fbb1d955bbaf872d9e76502f6e3e803cb Mon Sep 17 00:00:00 2001 From: Jiri Slaby <jslaby(a)suse.cz> Date: Tue, 3 May 2022 10:08:03 +0200 Subject: serial: pch: don't overwrite xmit->buf[0] by x_char When x_char is to be sent, the TX path overwrites whatever is in the circular buffer at offset 0 with x_char and sends it using pch_uart_hal_write(). I don't understand how this was supposed to work if xmit->buf[0] already contained some character. It must have been lost. Remove this whole pop_tx_x() concept and do the work directly in the callers. (Without printing anything using dev_dbg().) Cc: <stable(a)vger.kernel.org> Fixes: 3c6a483275f4 (Serial: EG20T: add PCH_UART driver) Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20220503080808.28332-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/pch_uart.c | 27 +++++++-------------------- 1 file changed, 7 insertions(+), 20 deletions(-) diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c index f872613a5e83..6cb631487383 100644 --- a/drivers/tty/serial/pch_uart.c +++ b/drivers/tty/serial/pch_uart.c @@ -624,22 +624,6 @@ static int push_rx(struct eg20t_port *priv, const unsigned char *buf, return 0; } -static int pop_tx_x(struct eg20t_port *priv, unsigned char *buf) -{ - int ret = 0; - struct uart_port *port = &priv->port; - - if (port->x_char) { - dev_dbg(priv->port.dev, "%s:X character send %02x (%lu)\n", - __func__, port->x_char, jiffies); - buf[0] = port->x_char; - port->x_char = 0; - ret = 1; - } - - return ret; -} - static int dma_push_rx(struct eg20t_port *priv, int size) { int room; @@ -889,9 +873,10 @@ static unsigned int handle_tx(struct eg20t_port *priv) fifo_size = max(priv->fifo_size, 1); tx_empty = 1; - if (pop_tx_x(priv, xmit->buf)) { - pch_uart_hal_write(priv, xmit->buf, 1); + if (port->x_char) { + pch_uart_hal_write(priv, &port->x_char, 1); port->icount.tx++; + port->x_char = 0; tx_empty = 0; fifo_size--; } @@ -948,9 +933,11 @@ static unsigned int dma_handle_tx(struct eg20t_port *priv) } fifo_size = max(priv->fifo_size, 1); - if (pop_tx_x(priv, xmit->buf)) { - pch_uart_hal_write(priv, xmit->buf, 1); + + if (port->x_char) { + pch_uart_hal_write(priv, &port->x_char, 1); port->icount.tx++; + port->x_char = 0; fifo_size--; } -- 2.36.0

3 years, 7 months

1
0
0 0

patch "usb: gadget: uvc: allow for application to cleanly shutdown" added to usb-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: gadget: uvc: allow for application to cleanly shutdown to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From b81ac4395bbeaf36e078dea1a48c02dd97b76235 Mon Sep 17 00:00:00 2001 From: Dan Vacura <w36195(a)motorola.com> Date: Tue, 3 May 2022 15:10:38 -0500 Subject: usb: gadget: uvc: allow for application to cleanly shutdown Several types of kernel panics can occur due to timing during the uvc gadget removal. This appears to be a problem with gadget resources being managed by both the client application's v4l2 open/close and the UDC gadget bind/unbind. Since the concept of USB_GADGET_DELAYED_STATUS doesn't exist for unbind, add a wait to allow for the application to close out. Some examples of the panics that can occur are: <1>[ 1147.652313] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 <4>[ 1147.652510] Call trace: <4>[ 1147.652514] usb_gadget_disconnect+0x74/0x1f0 <4>[ 1147.652516] usb_gadget_deactivate+0x38/0x168 <4>[ 1147.652520] usb_function_deactivate+0x54/0x90 <4>[ 1147.652524] uvc_function_disconnect+0x14/0x38 <4>[ 1147.652527] uvc_v4l2_release+0x34/0xa0 <4>[ 1147.652537] __fput+0xdc/0x2c0 <4>[ 1147.652540] ____fput+0x10/0x1c <4>[ 1147.652545] task_work_run+0xe4/0x12c <4>[ 1147.652549] do_notify_resume+0x108/0x168 <1>[ 282.950561][ T1472] Unable to handle kernel NULL pointer dereference at virtual address 00000000000005b8 <6>[ 282.953111][ T1472] Call trace: <6>[ 282.953121][ T1472] usb_function_deactivate+0x54/0xd4 <6>[ 282.953134][ T1472] uvc_v4l2_release+0xac/0x1e4 <6>[ 282.953145][ T1472] v4l2_release+0x134/0x1f0 <6>[ 282.953167][ T1472] __fput+0xf4/0x428 <6>[ 282.953178][ T1472] ____fput+0x14/0x24 <6>[ 282.953193][ T1472] task_work_run+0xac/0x130 <3>[ 213.410077][ T29] configfs-gadget gadget: uvc: Failed to queue request (-108). <1>[ 213.410116][ T29] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000003 <6>[ 213.413460][ T29] Call trace: <6>[ 213.413474][ T29] uvcg_video_pump+0x1f0/0x384 <6>[ 213.413489][ T29] process_one_work+0x2a4/0x544 <6>[ 213.413502][ T29] worker_thread+0x350/0x784 <6>[ 213.413515][ T29] kthread+0x2ac/0x320 <6>[ 213.413528][ T29] ret_from_fork+0x10/0x30 Signed-off-by: Dan Vacura <w36195(a)motorola.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220503201039.71720-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/gadget/function/f_uvc.c | 25 +++++++++++++++++++++++++ drivers/usb/gadget/function/uvc.h | 2 ++ drivers/usb/gadget/function/uvc_v4l2.c | 3 ++- 3 files changed, 29 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c index 71bb5e477dba..d37965867b23 100644 --- a/drivers/usb/gadget/function/f_uvc.c +++ b/drivers/usb/gadget/function/f_uvc.c @@ -890,13 +890,37 @@ static void uvc_function_unbind(struct usb_configuration *c, { struct usb_composite_dev *cdev = c->cdev; struct uvc_device *uvc = to_uvc(f); + long wait_ret = 1; uvcg_info(f, "%s()\n", __func__); + /* If we know we're connected via v4l2, then there should be a cleanup + * of the device from userspace either via UVC_EVENT_DISCONNECT or + * though the video device removal uevent. Allow some time for the + * application to close out before things get deleted. + */ + if (uvc->func_connected) { + uvcg_dbg(f, "waiting for clean disconnect\n"); + wait_ret = wait_event_interruptible_timeout(uvc->func_connected_queue, + uvc->func_connected == false, msecs_to_jiffies(500)); + uvcg_dbg(f, "done waiting with ret: %ld\n", wait_ret); + } + device_remove_file(&uvc->vdev.dev, &dev_attr_function_name); video_unregister_device(&uvc->vdev); v4l2_device_unregister(&uvc->v4l2_dev); + if (uvc->func_connected) { + /* Wait for the release to occur to ensure there are no longer any + * pending operations that may cause panics when resources are cleaned + * up. + */ + uvcg_warn(f, "%s no clean disconnect, wait for release\n", __func__); + wait_ret = wait_event_interruptible_timeout(uvc->func_connected_queue, + uvc->func_connected == false, msecs_to_jiffies(1000)); + uvcg_dbg(f, "done waiting for release with ret: %ld\n", wait_ret); + } + usb_ep_free_request(cdev->gadget->ep0, uvc->control_req); kfree(uvc->control_buf); @@ -915,6 +939,7 @@ static struct usb_function *uvc_alloc(struct usb_function_instance *fi) mutex_init(&uvc->video.mutex); uvc->state = UVC_STATE_DISCONNECTED; + init_waitqueue_head(&uvc->func_connected_queue); opts = fi_to_f_uvc_opts(fi); mutex_lock(&opts->lock); diff --git a/drivers/usb/gadget/function/uvc.h b/drivers/usb/gadget/function/uvc.h index c3607a32b986..886103a1fe9b 100644 --- a/drivers/usb/gadget/function/uvc.h +++ b/drivers/usb/gadget/function/uvc.h @@ -14,6 +14,7 @@ #include <linux/spinlock.h> #include <linux/usb/composite.h> #include <linux/videodev2.h> +#include <linux/wait.h> #include <media/v4l2-device.h> #include <media/v4l2-dev.h> @@ -129,6 +130,7 @@ struct uvc_device { struct usb_function func; struct uvc_video video; bool func_connected; + wait_queue_head_t func_connected_queue; /* Descriptors */ struct { diff --git a/drivers/usb/gadget/function/uvc_v4l2.c b/drivers/usb/gadget/function/uvc_v4l2.c index a2c78690c5c2..fd8f73bb726d 100644 --- a/drivers/usb/gadget/function/uvc_v4l2.c +++ b/drivers/usb/gadget/function/uvc_v4l2.c @@ -253,10 +253,11 @@ uvc_v4l2_subscribe_event(struct v4l2_fh *fh, static void uvc_v4l2_disable(struct uvc_device *uvc) { - uvc->func_connected = false; uvc_function_disconnect(uvc); uvcg_video_enable(&uvc->video, 0); uvcg_free_buffers(&uvc->video.queue); + uvc->func_connected = false; + wake_up_interruptible(&uvc->func_connected_queue); } static int -- 2.36.0

3 years, 7 months

1
0
0 0

patch "usb: typec: tcpci: Don't skip cleanup in .remove() on error" added to usb-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: typec: tcpci: Don't skip cleanup in .remove() on error to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From bbc126ae381cf0a27822c1f822d0aeed74cc40d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig(a)pengutronix.de> Date: Mon, 2 May 2022 10:04:56 +0200 Subject: usb: typec: tcpci: Don't skip cleanup in .remove() on error MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Returning an error value in an i2c remove callback results in an error message being emitted by the i2c core, but otherwise it doesn't make a difference. The device goes away anyhow and the devm cleanups are called. In this case the remove callback even returns early without stopping the tcpm worker thread and various timers. A work scheduled on the work queue, or a firing timer after tcpci_remove() returned probably results in a use-after-free situation because the regmap and driver data were freed. So better make sure that tcpci_unregister_port() is called even if disabling the irq failed. Also emit a more specific error message instead of the i2c core's "remove failed (EIO), will be ignored" and return 0 to suppress the core's warning. This patch is (also) a preparation for making i2c remove callbacks return void. Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable <stable(a)vger.kernel.org> Acked-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Link: https://lore.kernel.org/r/20220502080456.21568-1-u.kleine-koenig@pengutroni… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/typec/tcpm/tcpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c index e07d26a3cd8e..f33e08eb7670 100644 --- a/drivers/usb/typec/tcpm/tcpci.c +++ b/drivers/usb/typec/tcpm/tcpci.c @@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client) /* Disable chip interrupts before unregistering port */ err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); if (err < 0) - return err; + dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err)); tcpci_unregister_port(chip->tcpci); -- 2.36.0

3 years, 7 months

1
0
0 0

patch "usb: cdc-wdm: fix reading stuck on device close" added to usb-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: cdc-wdm: fix reading stuck on device close to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 01e01f5c89773c600a9f0b32c888de0146066c3a Mon Sep 17 00:00:00 2001 From: Sergey Ryazanov <ryazanov.s.a(a)gmail.com> Date: Sun, 1 May 2022 20:58:28 +0300 Subject: usb: cdc-wdm: fix reading stuck on device close cdc-wdm tracks whether a response reading request is in-progress and blocks the next request from being sent until the previous request is completed. As soon as last user closes the cdc-wdm device file, the driver cancels any ongoing requests, resets the pending response counter, but leaves the response reading in-progress flag (WDM_RESPONDING) untouched. So if the user closes the device file during the response receive request is being performed, no more data will be obtained from the modem. The request will be cancelled, effectively preventing the WDM_RESPONDING flag from being reseted. Keeping the flag set will prevent a new response receive request from being sent, permanently blocking the read path. The read path will staying blocked until the module will be reloaded or till the modem will be re-attached. This stuck has been observed with a Huawei E3372 modem attached to an OpenWrt router and using the comgt utility to set up a network connection. Fix this issue by clearing the WDM_RESPONDING flag on the device file close. Without this fix, the device reading stuck can be easily reproduced in a few connection establishing attempts. With this fix, a load test for modem connection re-establishing worked for several hours without any issues. Fixes: 922a5eadd5a3 ("usb: cdc-wdm: Fix race between autosuspend and reading from the device") Signed-off-by: Sergey Ryazanov <ryazanov.s.a(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Acked-by: Oliver Neukum <oneukum(a)suse.com> Link: https://lore.kernel.org/r/20220501175828.8185-1-ryazanov.s.a@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/cdc-wdm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c index 7f2c83f299d3..eebe782380fb 100644 --- a/drivers/usb/class/cdc-wdm.c +++ b/drivers/usb/class/cdc-wdm.c @@ -774,6 +774,7 @@ static int wdm_release(struct inode *inode, struct file *file) poison_urbs(desc); spin_lock_irq(&desc->iuspin); desc->resp_count = 0; + clear_bit(WDM_RESPONDING, &desc->flags); spin_unlock_irq(&desc->iuspin); desc->manage_power(desc->intf, 0); unpoison_urbs(desc); -- 2.36.0

3 years, 7 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2022