- Linux-stable-mirror - lists.linaro.org

[PATCH 1/2] gfs2: Multi-block allocations in gfs2_page_mkwrite

by Andreas Gruenbacher

In gfs2_page_mkwrite's gfs2_allocate_page_backing helper, try to allocate as many blocks at once as we need. Pass in the size of the requested allocation. Fixes: 35af80aef99b ("gfs2: don't use buffer_heads in gfs2_allocate_page_backing") Cc: stable(a)vger.kernel.org # v5.3+ Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> --- fs/gfs2/file.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c index 33ace1832294..30b857017fd3 100644 --- a/fs/gfs2/file.c +++ b/fs/gfs2/file.c @@ -381,27 +381,28 @@ static void gfs2_size_hint(struct file *filep, loff_t offset, size_t size) /** * gfs2_allocate_page_backing - Allocate blocks for a write fault * @page: The (locked) page to allocate backing for + * @length: Size of the allocation * * We try to allocate all the blocks required for the page in one go. This * might fail for various reasons, so we keep trying until all the blocks to * back this page are allocated. If some of the blocks are already allocated, * that is ok too. */ -static int gfs2_allocate_page_backing(struct page *page) +static int gfs2_allocate_page_backing(struct page *page, unsigned int length) { u64 pos = page_offset(page); - u64 size = PAGE_SIZE; do { struct iomap iomap = { }; - if (gfs2_iomap_get_alloc(page->mapping->host, pos, 1, &iomap)) + if (gfs2_iomap_get_alloc(page->mapping->host, pos, length, &iomap)) return -EIO; - iomap.length = min(iomap.length, size); - size -= iomap.length; + if (length < iomap.length) + iomap.length = length; + length -= iomap.length; pos += iomap.length; - } while (size > 0); + } while (length > 0); return 0; } @@ -501,7 +502,7 @@ static vm_fault_t gfs2_page_mkwrite(struct vm_fault *vmf) if (gfs2_is_stuffed(ip)) ret = gfs2_unstuff_dinode(ip, page); if (ret == 0) - ret = gfs2_allocate_page_backing(page); + ret = gfs2_allocate_page_backing(page, PAGE_SIZE); out_trans_end: if (ret) -- 2.20.1

6 years

1
0
0 0

[PATCH AUTOSEL 4.4 01/44] iio: dac: mcp4922: fix error handling in mcp4922_write_raw

by Sasha Levin

From: Marcus Folkesson <marcus.folkesson(a)gmail.com> [ Upstream commit 0833627fc3f757a0dca11e2a9c46c96335a900ee ] Do not try to write negative values and make sure that the write goes well. Signed-off-by: Marcus Folkesson <marcus.folkesson(a)gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/iio/dac/mcp4922.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c index 3854d201a5d6c..68dd0be1ac076 100644 --- a/drivers/iio/dac/mcp4922.c +++ b/drivers/iio/dac/mcp4922.c @@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev, long mask) { struct mcp4922_state *state = iio_priv(indio_dev); + int ret; if (val2 != 0) return -EINVAL; switch (mask) { case IIO_CHAN_INFO_RAW: - if (val > GENMASK(chan->scan_type.realbits-1, 0)) + if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0)) return -EINVAL; val <<= chan->scan_type.shift; - state->value[chan->channel] = val; - return mcp4922_spi_write(state, chan->channel, val); + + ret = mcp4922_spi_write(state, chan->channel, val); + if (!ret) + state->value[chan->channel] = val; + return ret; + default: return -EINVAL; } -- 2.20.1

6 years

1
43
0 0

[PATCH AUTOSEL 4.9 01/64] ath10k: fix kernel panic by moving pci flush after napi_disable

by Sasha Levin

From: Tamizh chelvam <tamizhr(a)codeaurora.org> [ Upstream commit bd1d395070cca4f42a93e520b0597274789274a4 ] When continuously running wifi up/down sequence, the napi poll can be scheduled after the CE buffers being freed by ath10k_pci_flush Steps: In a certain condition, during wifi down below scenario might occur. ath10k_stop->ath10k_hif_stop->napi_schedule->ath10k_pci_flush->napi_poll(napi_synchronize). In the above scenario, CE buffer entries will be freed up and become NULL in ath10k_pci_flush. And the napi_poll has been invoked after the flush process and it will try to get the skb from the CE buffer entry and perform some action on that. Since the CE buffer already cleaned by pci flush this action will create NULL pointer dereference and trigger below kernel panic. Unable to handle kernel NULL pointer dereference at virtual address 0000005c PC is at ath10k_pci_htt_rx_cb+0x64/0x3ec [ath10k_pci] ath10k_pci_htt_rx_cb [ath10k_pci] ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci] ath10k_ce_per_engine_service [ath10k_pci] ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci] ath10k_ce_per_engine_service_any [ath10k_pci] ath10k_pci_napi_poll+0x48/0xec [ath10k_pci] ath10k_pci_napi_poll [ath10k_pci] net_rx_action+0xac/0x160 net_rx_action __do_softirq+0xdc/0x208 __do_softirq irq_exit+0x84/0xe0 irq_exit __handle_domain_irq+0x80/0xa0 __handle_domain_irq gic_handle_irq+0x38/0x5c gic_handle_irq __irq_usr+0x44/0x60 Tested on QCA4019 and firmware version 10.4.3.2.1.1-00010 Signed-off-by: Tamizh chelvam <tamizhr(a)codeaurora.org> Signed-off-by: Kalle Valo <kvalo(a)codeaurora.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/wireless/ath/ath10k/ahb.c | 4 ++-- drivers/net/wireless/ath/ath10k/pci.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c index da770af830369..125b5c31b2b0a 100644 --- a/drivers/net/wireless/ath/ath10k/ahb.c +++ b/drivers/net/wireless/ath/ath10k/ahb.c @@ -658,10 +658,10 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar) ath10k_ahb_irq_disable(ar); synchronize_irq(ar_ahb->irq); - ath10k_pci_flush(ar); - napi_synchronize(&ar->napi); napi_disable(&ar->napi); + + ath10k_pci_flush(ar); } static int ath10k_ahb_hif_power_up(struct ath10k *ar) diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c index 25b8d501d437e..b7bac14d1487b 100644 --- a/drivers/net/wireless/ath/ath10k/pci.c +++ b/drivers/net/wireless/ath/ath10k/pci.c @@ -1781,9 +1781,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) ath10k_pci_irq_disable(ar); ath10k_pci_irq_sync(ar); - ath10k_pci_flush(ar); napi_synchronize(&ar->napi); napi_disable(&ar->napi); + ath10k_pci_flush(ar); spin_lock_irqsave(&ar_pci->ps_lock, flags); WARN_ON(ar_pci->ps_wake_refcount > 0); -- 2.20.1

6 years

1
63
0 0

[PATCH AUTOSEL 4.14 001/103] iio: adc: max9611: explicitly cast gain_selectors

by Sasha Levin

From: Stefan Agner <stefan(a)agner.ch> [ Upstream commit b1ec0802503820ccbc894aadfd2a44da20232f5e ] After finding a reasonable gain, the function converts the configured gain to a gain configuration option selector enum max9611_csa_gain. Make the conversion clearly visible by using an explicit cast. This also avoids a warning seen with clang: drivers/iio/adc/max9611.c:292:16: warning: implicit conversion from enumeration type 'enum max9611_conf_ids' to different enumeration type 'enum max9611_csa_gain' [-Wenum-conversion] *csa_gain = gain_selectors[i]; ~ ^~~~~~~~~~~~~~~~~ Signed-off-by: Stefan Agner <stefan(a)agner.ch> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/iio/adc/max9611.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c index c61fbf5602718..33be07c78b96f 100644 --- a/drivers/iio/adc/max9611.c +++ b/drivers/iio/adc/max9611.c @@ -289,7 +289,7 @@ static int max9611_read_csa_voltage(struct max9611_dev *max9611, return ret; if (*adc_raw > 0) { - *csa_gain = gain_selectors[i]; + *csa_gain = (enum max9611_csa_gain)gain_selectors[i]; return 0; } } -- 2.20.1

6 years

1
102
0 0

patch "phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role"" added to char-misc-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role" to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 4bd5ead82d4b877ebe41daf95f28cda53205b039 Mon Sep 17 00:00:00 2001 From: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Date: Mon, 7 Oct 2019 16:55:10 +0900 Subject: phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role" Since the role_store() uses strncmp(), it's possible to refer out-of-memory if the sysfs data size is smaller than strlen("host"). This patch fixes it by using sysfs_streq() instead of strncmp(). Reported-by: Pavel Machek <pavel(a)denx.de> Fixes: 9bb86777fb71 ("phy: rcar-gen3-usb2: add sysfs for usb role swap") Cc: <stable(a)vger.kernel.org> # v4.10+ Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas(a)glider.be> Acked-by: Pavel Machek <pavel(a)denx.de> Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com> --- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c index 49ec67d46ccc..bfb22f868857 100644 --- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c +++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c @@ -21,6 +21,7 @@ #include <linux/platform_device.h> #include <linux/pm_runtime.h> #include <linux/regulator/consumer.h> +#include <linux/string.h> #include <linux/usb/of.h> #include <linux/workqueue.h> @@ -320,9 +321,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr, if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch)) return -EIO; - if (!strncmp(buf, "host", strlen("host"))) + if (sysfs_streq(buf, "host")) new_mode = PHY_MODE_USB_HOST; - else if (!strncmp(buf, "peripheral", strlen("peripheral"))) + else if (sysfs_streq(buf, "peripheral")) new_mode = PHY_MODE_USB_DEVICE; else return -EINVAL; -- 2.24.0

6 years

1
0
0 0

patch "appledisplay: fix error handling in the scheduled work" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled appledisplay: fix error handling in the scheduled work to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 91feb01596e5efc0cc922cc73f5583114dccf4d2 Mon Sep 17 00:00:00 2001 From: Oliver Neukum <oneukum(a)suse.com> Date: Wed, 6 Nov 2019 13:49:01 +0100 Subject: appledisplay: fix error handling in the scheduled work The work item can operate on 1. stale memory left over from the last transfer the actual length of the data transfered needs to be checked 2. memory already freed the error handling in appledisplay_probe() needs to cancel the work in that case Reported-and-tested-by: syzbot+495dab1f175edc9c2f13(a)syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum(a)suse.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20191106124902.7765-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/misc/appledisplay.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c index ac92725458b5..ba1eaabc7796 100644 --- a/drivers/usb/misc/appledisplay.c +++ b/drivers/usb/misc/appledisplay.c @@ -164,7 +164,12 @@ static int appledisplay_bl_get_brightness(struct backlight_device *bd) 0, pdata->msgdata, 2, ACD_USB_TIMEOUT); - brightness = pdata->msgdata[1]; + if (retval < 2) { + if (retval >= 0) + retval = -EMSGSIZE; + } else { + brightness = pdata->msgdata[1]; + } mutex_unlock(&pdata->sysfslock); if (retval < 0) @@ -299,6 +304,7 @@ static int appledisplay_probe(struct usb_interface *iface, if (pdata) { if (pdata->urb) { usb_kill_urb(pdata->urb); + cancel_delayed_work_sync(&pdata->work); if (pdata->urbdata) usb_free_coherent(pdata->udev, ACD_URB_BUFFER_LEN, pdata->urbdata, pdata->urb->transfer_dma); -- 2.24.0

6 years

1
0
0 0

patch "usbip: tools: fix fd leakage in the function of" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usbip: tools: fix fd leakage in the function of to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 26a4d4c00f85cb844dd11dd35e848b079c2f5e8f Mon Sep 17 00:00:00 2001 From: Hewenliang <hewenliang4(a)huawei.com> Date: Fri, 25 Oct 2019 00:35:15 -0400 Subject: usbip: tools: fix fd leakage in the function of read_attr_usbip_status We should close the fd before the return of read_attr_usbip_status. Fixes: 3391ba0e2792 ("usbip: tools: Extract generic code to be shared with vudc backend") Signed-off-by: Hewenliang <hewenliang4(a)huawei.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20191025043515.20053-1-hewenliang4@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- tools/usb/usbip/libsrc/usbip_host_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c index 2813aa821c82..d1d8ba2a4a40 100644 --- a/tools/usb/usbip/libsrc/usbip_host_common.c +++ b/tools/usb/usbip/libsrc/usbip_host_common.c @@ -57,7 +57,7 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev) } value = atoi(status); - + close(fd); return value; } -- 2.24.0

6 years

1
0
0 0

patch "usb: Allow USB device to be warm reset in suspended state" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: Allow USB device to be warm reset in suspended state to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From e76b3bf7654c3c94554c24ba15a3d105f4006c80 Mon Sep 17 00:00:00 2001 From: Kai-Heng Feng <kai.heng.feng(a)canonical.com> Date: Wed, 6 Nov 2019 14:27:10 +0800 Subject: usb: Allow USB device to be warm reset in suspended state On Dell WD15 dock, sometimes USB ethernet cannot be detected after plugging cable to the ethernet port, the hub and roothub get runtime resumed and runtime suspended immediately: ... [ 433.315169] xhci_hcd 0000:3a:00.0: hcd_pci_runtime_resume: 0 [ 433.315204] usb usb4: usb auto-resume [ 433.315226] hub 4-0:1.0: hub_resume [ 433.315239] xhci_hcd 0000:3a:00.0: Get port status 4-1 read: 0x10202e2, return 0x10343 [ 433.315264] usb usb4-port1: status 0343 change 0001 [ 433.315279] xhci_hcd 0000:3a:00.0: clear port1 connect change, portsc: 0x10002e2 [ 433.315293] xhci_hcd 0000:3a:00.0: Get port status 4-2 read: 0x2a0, return 0x2a0 [ 433.317012] xhci_hcd 0000:3a:00.0: xhci_hub_status_data: stopping port polling. [ 433.422282] xhci_hcd 0000:3a:00.0: Get port status 4-1 read: 0x10002e2, return 0x343 [ 433.422307] usb usb4-port1: do warm reset [ 433.422311] usb 4-1: device reset not allowed in state 8 [ 433.422339] hub 4-0:1.0: state 7 ports 2 chg 0002 evt 0000 [ 433.422346] xhci_hcd 0000:3a:00.0: Get port status 4-1 read: 0x10002e2, return 0x343 [ 433.422356] usb usb4-port1: do warm reset [ 433.422358] usb 4-1: device reset not allowed in state 8 [ 433.422428] xhci_hcd 0000:3a:00.0: set port remote wake mask, actual port 0 status = 0xf0002e2 [ 433.422455] xhci_hcd 0000:3a:00.0: set port remote wake mask, actual port 1 status = 0xe0002a0 [ 433.422465] hub 4-0:1.0: hub_suspend [ 433.422475] usb usb4: bus auto-suspend, wakeup 1 [ 433.426161] xhci_hcd 0000:3a:00.0: xhci_hub_status_data: stopping port polling. [ 433.466209] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.510204] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.554051] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.598235] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.642154] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.686204] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.730205] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.774203] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.818207] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.862040] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting [ 433.862053] xhci_hcd 0000:3a:00.0: xhci_hub_status_data: stopping port polling. [ 433.862077] xhci_hcd 0000:3a:00.0: xhci_suspend: stopping port polling. [ 433.862096] xhci_hcd 0000:3a:00.0: // Setting command ring address to 0x8578fc001 [ 433.862312] xhci_hcd 0000:3a:00.0: hcd_pci_runtime_suspend: 0 [ 433.862445] xhci_hcd 0000:3a:00.0: PME# enabled [ 433.902376] xhci_hcd 0000:3a:00.0: restoring config space at offset 0xc (was 0x0, writing 0x20) [ 433.902395] xhci_hcd 0000:3a:00.0: restoring config space at offset 0x4 (was 0x100000, writing 0x100403) [ 433.902490] xhci_hcd 0000:3a:00.0: PME# disabled [ 433.902504] xhci_hcd 0000:3a:00.0: enabling bus mastering [ 433.902547] xhci_hcd 0000:3a:00.0: // Setting command ring address to 0x8578fc001 [ 433.902649] pcieport 0000:00:1b.0: PME: Spurious native interrupt! [ 433.902839] xhci_hcd 0000:3a:00.0: Port change event, 4-1, id 3, portsc: 0xb0202e2 [ 433.902842] xhci_hcd 0000:3a:00.0: resume root hub [ 433.902845] xhci_hcd 0000:3a:00.0: handle_port_status: starting port polling. [ 433.902877] xhci_hcd 0000:3a:00.0: xhci_resume: starting port polling. [ 433.902889] xhci_hcd 0000:3a:00.0: xhci_hub_status_data: stopping port polling. [ 433.902891] xhci_hcd 0000:3a:00.0: hcd_pci_runtime_resume: 0 [ 433.902919] usb usb4: usb wakeup-resume [ 433.902942] usb usb4: usb auto-resume [ 433.902966] hub 4-0:1.0: hub_resume ... As Mathias pointed out, the hub enters Cold Attach Status state and requires a warm reset. However usb_reset_device() bails out early when the device is in suspended state, as its callers port_event() and hub_event() don't always resume the device. Since there's nothing wrong to reset a suspended device, allow usb_reset_device() to do so to solve the issue. Signed-off-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com> Acked-by: Alan Stern <stern(a)rowland.harvard.edu> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20191106062710.29880-1-kai.heng.feng@canonical.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/core/hub.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index fdcfa85b5b12..1709895387b9 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -5840,7 +5840,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev) /** * usb_reset_device - warn interface drivers and perform a USB port reset - * @udev: device to reset (not in SUSPENDED or NOTATTACHED state) + * @udev: device to reset (not in NOTATTACHED state) * * Warns all drivers bound to registered interfaces (using their pre_reset * method), performs the port reset, and then lets the drivers know that @@ -5868,8 +5868,7 @@ int usb_reset_device(struct usb_device *udev) struct usb_host_config *config = udev->actconfig; struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); - if (udev->state == USB_STATE_NOTATTACHED || - udev->state == USB_STATE_SUSPENDED) { + if (udev->state == USB_STATE_NOTATTACHED) { dev_dbg(&udev->dev, "device reset not allowed in state %d\n", udev->state); return -EINVAL; -- 2.24.0

6 years

1
0
0 0

Re: Patch "net: bcmgenet: soft reset 40nm EPHYs before MAC init" has been added to the 4.19-stable tree

by Doug Berger

Just to triple check, this commit should be removed from the 4.19-stable tree too. Thanks, Doug On 11/6/19 6:33 AM, gregkh(a)linuxfoundation.org wrote: > > This is a note to let you know that I've just added the patch titled > > net: bcmgenet: soft reset 40nm EPHYs before MAC init > > to the 4.19-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > net-bcmgenet-soft-reset-40nm-ephys-before-mac-init.patch > and it can be found in the queue-4.19 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > > From foo@baz Wed 06 Nov 2019 03:31:22 PM CET > From: Doug Berger <opendmb(a)gmail.com> > Date: Wed, 16 Oct 2019 16:06:31 -0700 > Subject: net: bcmgenet: soft reset 40nm EPHYs before MAC init > > From: Doug Berger <opendmb(a)gmail.com> > > [ Upstream commit 1f515486275a08a17a2c806b844cca18f7de5b34 ] > > It turns out that the "Workaround for putting the PHY in IDDQ mode" > used by the internal EPHYs on 40nm Set-Top Box chips when powering > down puts the interface to the GENET MAC in a state that can cause > subsequent MAC resets to be incomplete. > > Rather than restore the forced soft reset when powering up internal > PHYs, this commit moves the invocation of phy_init_hw earlier in > the MAC initialization sequence to just before the MAC reset in the > open and resume functions. This allows the interface to be stable > and allows the MAC resets to be successful. > > The bcmgenet_mii_probe() function is split in two to accommodate > this. The new function bcmgenet_mii_connect() handles the first > half of the functionality before the MAC initialization, and the > bcmgenet_mii_config() function is extended to provide the remaining > PHY configuration following the MAC initialization. > > Fixes: 484bfa1507bf ("Revert "net: bcmgenet: Software reset EPHY after power on"") > Signed-off-by: Doug Berger <opendmb(a)gmail.com> > Acked-by: Florian Fainelli <f.fainelli(a)gmail.com> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > --- > drivers/net/ethernet/broadcom/genet/bcmgenet.c | 28 +++--- > drivers/net/ethernet/broadcom/genet/bcmgenet.h | 2 > drivers/net/ethernet/broadcom/genet/bcmmii.c | 112 +++++++++++-------------- > 3 files changed, 69 insertions(+), 73 deletions(-) > > --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c > +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c > @@ -2879,6 +2879,12 @@ static int bcmgenet_open(struct net_devi > if (priv->internal_phy) > bcmgenet_power_up(priv, GENET_POWER_PASSIVE); > > + ret = bcmgenet_mii_connect(dev); > + if (ret) { > + netdev_err(dev, "failed to connect to PHY\n"); > + goto err_clk_disable; > + } > + > /* take MAC out of reset */ > bcmgenet_umac_reset(priv); > > @@ -2888,6 +2894,12 @@ static int bcmgenet_open(struct net_devi > reg = bcmgenet_umac_readl(priv, UMAC_CMD); > priv->crc_fwd_en = !!(reg & CMD_CRC_FWD); > > + ret = bcmgenet_mii_config(dev, true); > + if (ret) { > + netdev_err(dev, "unsupported PHY\n"); > + goto err_disconnect_phy; > + } > + > bcmgenet_set_hw_addr(priv, dev->dev_addr); > > if (priv->internal_phy) { > @@ -2903,7 +2915,7 @@ static int bcmgenet_open(struct net_devi > ret = bcmgenet_init_dma(priv); > if (ret) { > netdev_err(dev, "failed to initialize DMA\n"); > - goto err_clk_disable; > + goto err_disconnect_phy; > } > > /* Always enable ring 16 - descriptor ring */ > @@ -2926,25 +2938,19 @@ static int bcmgenet_open(struct net_devi > goto err_irq0; > } > > - ret = bcmgenet_mii_probe(dev); > - if (ret) { > - netdev_err(dev, "failed to connect to PHY\n"); > - goto err_irq1; > - } > - > bcmgenet_netif_start(dev); > > netif_tx_start_all_queues(dev); > > return 0; > > -err_irq1: > - free_irq(priv->irq1, priv); > err_irq0: > free_irq(priv->irq0, priv); > err_fini_dma: > bcmgenet_dma_teardown(priv); > bcmgenet_fini_dma(priv); > +err_disconnect_phy: > + phy_disconnect(dev->phydev); > err_clk_disable: > if (priv->internal_phy) > bcmgenet_power_down(priv, GENET_POWER_PASSIVE); > @@ -3657,6 +3663,8 @@ static int bcmgenet_resume(struct device > if (priv->internal_phy) > bcmgenet_power_up(priv, GENET_POWER_PASSIVE); > > + phy_init_hw(dev->phydev); > + > bcmgenet_umac_reset(priv); > > init_umac(priv); > @@ -3665,8 +3673,6 @@ static int bcmgenet_resume(struct device > if (priv->wolopts) > clk_disable_unprepare(priv->clk_wol); > > - phy_init_hw(dev->phydev); > - > /* Speed settings must be restored */ > bcmgenet_mii_config(priv->dev, false); > > --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h > +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h > @@ -723,8 +723,8 @@ GENET_IO_MACRO(rbuf, GENET_RBUF_OFF); > > /* MDIO routines */ > int bcmgenet_mii_init(struct net_device *dev); > +int bcmgenet_mii_connect(struct net_device *dev); > int bcmgenet_mii_config(struct net_device *dev, bool init); > -int bcmgenet_mii_probe(struct net_device *dev); > void bcmgenet_mii_exit(struct net_device *dev); > void bcmgenet_phy_power_set(struct net_device *dev, bool enable); > void bcmgenet_mii_setup(struct net_device *dev); > --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c > +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c > @@ -176,6 +176,46 @@ static void bcmgenet_moca_phy_setup(stru > bcmgenet_fixed_phy_link_update); > } > > +int bcmgenet_mii_connect(struct net_device *dev) > +{ > + struct bcmgenet_priv *priv = netdev_priv(dev); > + struct device_node *dn = priv->pdev->dev.of_node; > + struct phy_device *phydev; > + u32 phy_flags = 0; > + int ret; > + > + /* Communicate the integrated PHY revision */ > + if (priv->internal_phy) > + phy_flags = priv->gphy_rev; > + > + /* Initialize link state variables that bcmgenet_mii_setup() uses */ > + priv->old_link = -1; > + priv->old_speed = -1; > + priv->old_duplex = -1; > + priv->old_pause = -1; > + > + if (dn) { > + phydev = of_phy_connect(dev, priv->phy_dn, bcmgenet_mii_setup, > + phy_flags, priv->phy_interface); > + if (!phydev) { > + pr_err("could not attach to PHY\n"); > + return -ENODEV; > + } > + } else { > + phydev = dev->phydev; > + phydev->dev_flags = phy_flags; > + > + ret = phy_connect_direct(dev, phydev, bcmgenet_mii_setup, > + priv->phy_interface); > + if (ret) { > + pr_err("could not attach to PHY\n"); > + return -ENODEV; > + } > + } > + > + return 0; > +} > + > int bcmgenet_mii_config(struct net_device *dev, bool init) > { > struct bcmgenet_priv *priv = netdev_priv(dev); > @@ -269,71 +309,21 @@ int bcmgenet_mii_config(struct net_devic > bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL); > } > > - if (init) > - dev_info(kdev, "configuring instance for %s\n", phy_name); > - > - return 0; > -} > - > -int bcmgenet_mii_probe(struct net_device *dev) > -{ > - struct bcmgenet_priv *priv = netdev_priv(dev); > - struct device_node *dn = priv->pdev->dev.of_node; > - struct phy_device *phydev; > - u32 phy_flags = 0; > - int ret; > - > - /* Communicate the integrated PHY revision */ > - if (priv->internal_phy) > - phy_flags = priv->gphy_rev; > - > - /* Initialize link state variables that bcmgenet_mii_setup() uses */ > - priv->old_link = -1; > - priv->old_speed = -1; > - priv->old_duplex = -1; > - priv->old_pause = -1; > - > - if (dn) { > - phydev = of_phy_connect(dev, priv->phy_dn, bcmgenet_mii_setup, > - phy_flags, priv->phy_interface); > - if (!phydev) { > - pr_err("could not attach to PHY\n"); > - return -ENODEV; > - } > - } else { > - phydev = dev->phydev; > - phydev->dev_flags = phy_flags; > + if (init) { > + phydev->advertising = phydev->supported; > > - ret = phy_connect_direct(dev, phydev, bcmgenet_mii_setup, > - priv->phy_interface); > - if (ret) { > - pr_err("could not attach to PHY\n"); > - return -ENODEV; > - } > - } > + /* The internal PHY has its link interrupts routed to the > + * Ethernet MAC ISRs. On GENETv5 there is a hardware issue > + * that prevents the signaling of link UP interrupts when > + * the link operates at 10Mbps, so fallback to polling for > + * those versions of GENET. > + */ > + if (priv->internal_phy && !GENET_IS_V5(priv)) > + phydev->irq = PHY_IGNORE_INTERRUPT; > > - /* Configure port multiplexer based on what the probed PHY device since > - * reading the 'max-speed' property determines the maximum supported > - * PHY speed which is needed for bcmgenet_mii_config() to configure > - * things appropriately. > - */ > - ret = bcmgenet_mii_config(dev, true); > - if (ret) { > - phy_disconnect(dev->phydev); > - return ret; > + dev_info(kdev, "configuring instance for %s\n", phy_name); > } > > - phydev->advertising = phydev->supported; > - > - /* The internal PHY has its link interrupts routed to the > - * Ethernet MAC ISRs. On GENETv5 there is a hardware issue > - * that prevents the signaling of link UP interrupts when > - * the link operates at 10Mbps, so fallback to polling for > - * those versions of GENET. > - */ > - if (priv->internal_phy && !GENET_IS_V5(priv)) > - dev->phydev->irq = PHY_IGNORE_INTERRUPT; > - > return 0; > } > > > > Patches currently in stable-queue which might be from opendmb(a)gmail.com are > > queue-4.19/net-phy-bcm7xxx-define-soft_reset-for-40nm-ephy.patch > queue-4.19/net-bcmgenet-reset-40nm-ephy-on-energy-detect.patch > queue-4.19/net-bcmgenet-don-t-set-phydev-link-from-mac.patch > queue-4.19/net-bcmgenet-soft-reset-40nm-ephys-before-mac-init.patch >

6 years

2
1
0 0

[git:media_tree/master] media: vivid: Fix wrong locking that causes race conditions on streaming stop

by Mauro Carvalho Chehab

This is an automatic generated email to let you know that the following patch were queued: Subject: media: vivid: Fix wrong locking that causes race conditions on streaming stop Author: Alexander Popov <alex.popov(a)linux.com> Date: Sun Nov 3 23:17:19 2019 +0100 There is the same incorrect approach to locking implemented in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out() and sdr_cap_stop_streaming(). These functions are called during streaming stopping with vivid_dev.mutex locked. And they all do the same mistake while stopping their kthreads, which need to lock this mutex as well. See the example from vivid_stop_generating_vid_cap(): /* shutdown control thread */ vivid_grab_controls(dev, false); mutex_unlock(&dev->mutex); kthread_stop(dev->kthread_vid_cap); dev->kthread_vid_cap = NULL; mutex_lock(&dev->mutex); But when this mutex is unlocked, another vb2_fop_read() can lock it instead of vivid_thread_vid_cap() and manipulate the buffer queue. That causes a use-after-free access later. To fix those issues let's: 1. avoid unlocking the mutex in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out() and sdr_cap_stop_streaming(); 2. use mutex_trylock() with schedule_timeout_uninterruptible() in the loops of the vivid kthread handlers. Signed-off-by: Alexander Popov <alex.popov(a)linux.com> Acked-by: Linus Torvalds <torvalds(a)linux-foundation.org> Tested-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Cc: <stable(a)vger.kernel.org> # for v3.18 and up Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> drivers/media/platform/vivid/vivid-kthread-cap.c | 8 +++++--- drivers/media/platform/vivid/vivid-kthread-out.c | 8 +++++--- drivers/media/platform/vivid/vivid-sdr-cap.c | 8 +++++--- 3 files changed, 15 insertions(+), 9 deletions(-) --- diff --git a/drivers/media/platform/vivid/vivid-kthread-cap.c b/drivers/media/platform/vivid/vivid-kthread-cap.c index 9f981e8bae6e..01a9d671b947 100644 --- a/drivers/media/platform/vivid/vivid-kthread-cap.c +++ b/drivers/media/platform/vivid/vivid-kthread-cap.c @@ -818,7 +818,11 @@ static int vivid_thread_vid_cap(void *data) if (kthread_should_stop()) break; - mutex_lock(&dev->mutex); + if (!mutex_trylock(&dev->mutex)) { + schedule_timeout_uninterruptible(1); + continue; + } + cur_jiffies = jiffies; if (dev->cap_seq_resync) { dev->jiffies_vid_cap = cur_jiffies; @@ -998,8 +1002,6 @@ void vivid_stop_generating_vid_cap(struct vivid_dev *dev, bool *pstreaming) /* shutdown control thread */ vivid_grab_controls(dev, false); - mutex_unlock(&dev->mutex); kthread_stop(dev->kthread_vid_cap); dev->kthread_vid_cap = NULL; - mutex_lock(&dev->mutex); } diff --git a/drivers/media/platform/vivid/vivid-kthread-out.c b/drivers/media/platform/vivid/vivid-kthread-out.c index c974235d7de3..6780687978f9 100644 --- a/drivers/media/platform/vivid/vivid-kthread-out.c +++ b/drivers/media/platform/vivid/vivid-kthread-out.c @@ -166,7 +166,11 @@ static int vivid_thread_vid_out(void *data) if (kthread_should_stop()) break; - mutex_lock(&dev->mutex); + if (!mutex_trylock(&dev->mutex)) { + schedule_timeout_uninterruptible(1); + continue; + } + cur_jiffies = jiffies; if (dev->out_seq_resync) { dev->jiffies_vid_out = cur_jiffies; @@ -344,8 +348,6 @@ void vivid_stop_generating_vid_out(struct vivid_dev *dev, bool *pstreaming) /* shutdown control thread */ vivid_grab_controls(dev, false); - mutex_unlock(&dev->mutex); kthread_stop(dev->kthread_vid_out); dev->kthread_vid_out = NULL; - mutex_lock(&dev->mutex); } diff --git a/drivers/media/platform/vivid/vivid-sdr-cap.c b/drivers/media/platform/vivid/vivid-sdr-cap.c index 9acc709b0740..2b7522e16efc 100644 --- a/drivers/media/platform/vivid/vivid-sdr-cap.c +++ b/drivers/media/platform/vivid/vivid-sdr-cap.c @@ -141,7 +141,11 @@ static int vivid_thread_sdr_cap(void *data) if (kthread_should_stop()) break; - mutex_lock(&dev->mutex); + if (!mutex_trylock(&dev->mutex)) { + schedule_timeout_uninterruptible(1); + continue; + } + cur_jiffies = jiffies; if (dev->sdr_cap_seq_resync) { dev->jiffies_sdr_cap = cur_jiffies; @@ -303,10 +307,8 @@ static void sdr_cap_stop_streaming(struct vb2_queue *vq) } /* shutdown control thread */ - mutex_unlock(&dev->mutex); kthread_stop(dev->kthread_sdr_cap); dev->kthread_sdr_cap = NULL; - mutex_lock(&dev->mutex); } static void sdr_cap_buf_request_complete(struct vb2_buffer *vb)

6 years

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror