This is the start of the stable review cycle for the 4.19.143 release.
There are 125 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.143-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.143-rc1
Hector Martin <[email protected]>
ALSA: usb-audio: Update documentation comment for MS2109 quirk
Peilin Ye <[email protected]>
HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
Jarkko Sakkinen <[email protected]>
tpm: Unify the mismatching TPM space buffer sizes
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Handle ZLP for sg requests
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix handling ZLP
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Don't setup more than requested
Josef Bacik <[email protected]>
btrfs: check the right error variable in btrfs_del_dir_entries_in_log
Alan Stern <[email protected]>
usb: storage: Add unusual_uas entry for Sony PSZ drives
Tom Rix <[email protected]>
USB: cdc-acm: rework notification_buffer resizing
Andy Shevchenko <[email protected]>
USB: gadget: u_f: Unbreak offset calculation in VLAs
Brooke Basile <[email protected]>
USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
Brooke Basile <[email protected]>
USB: gadget: u_f: add overflow checks to VLA macros
Tang Bin <[email protected]>
usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
Cyril Roelandt <[email protected]>
USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
Alan Stern <[email protected]>
USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
Kai-Heng Feng <[email protected]>
USB: quirks: Add no-lpm quirk for another Raydium touchscreen
Thinh Nguyen <[email protected]>
usb: uas: Add quirk for PNY Pro Elite
Alan Stern <[email protected]>
USB: yurex: Fix bad gfp argument
Evan Quan <[email protected]>
drm/amd/pm: correct Vega12 swctf limit setting
Evan Quan <[email protected]>
drm/amd/pm: correct Vega10 swctf limit setting
Alex Deucher <[email protected]>
drm/amdgpu: Fix buffer overflow in INFO ioctl
qiuguorui1 <[email protected]>
irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake
Thomas Gleixner <[email protected]>
genirq/matrix: Deal with the sillyness of for_each_cpu() on UP
Heikki Krogerus <[email protected]>
device property: Fix the secondary firmware node handling in set_primary_fwnode()
Rafael J. Wysocki <[email protected]>
PM: sleep: core: Fix the handling of pending runtime resume requests
Ding Hui <[email protected]>
xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed
Kai-Heng Feng <[email protected]>
xhci: Do warm-reset when both CAS and XDEV_RESUME are set
Li Jun <[email protected]>
usb: host: xhci: fix ep context print mismatch in debugfs
Thomas Gleixner <[email protected]>
XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
Jan Kara <[email protected]>
writeback: Fix sync livelock due to b_dirty_time processing
Jan Kara <[email protected]>
writeback: Avoid skipping inode writeback
Jan Kara <[email protected]>
writeback: Protect inode->i_io_list with inode->i_lock
Sergey Senozhatsky <[email protected]>
serial: 8250: change lock order in serial8250_do_startup()
Valmer Huhn <[email protected]>
serial: 8250_exar: Fix number of ports for Commtech PCIe cards
Lukas Wunner <[email protected]>
serial: pl011: Don't leak amba_ports entry on driver register error
Lukas Wunner <[email protected]>
serial: pl011: Fix oops on -EPROBE_DEFER
Tamseel Shams <[email protected]>
serial: samsung: Removes the IRQ not found warning
George Kennedy <[email protected]>
vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize()
Tetsuo Handa <[email protected]>
vt: defer kfree() of vc_screenbuf in vc_do_resize()
Evgeny Novikov <[email protected]>
USB: lvtest: return proper error code in probe
George Kennedy <[email protected]>
fbcon: prevent user font height or width change from causing potential out-of-bounds access
Filipe Manana <[email protected]>
btrfs: fix space cache memory leak after transaction abort
Marcos Paulo de Souza <[email protected]>
btrfs: reset compression level for lzo on remount
Ming Lei <[email protected]>
blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART
Hans de Goede <[email protected]>
HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands
Ming Lei <[email protected]>
block: loop: set discard granularity and alignment for block device backed loop
Athira Rajeev <[email protected]>
powerpc/perf: Fix soft lockups due to missed interrupt accounting
Sumera Priyadarsini <[email protected]>
net: gianfar: Add of_node_put() before goto statement
Alvin Šipraga <[email protected]>
macvlan: validate setting of multiple remote source MAC addresses
Saurav Kashyap <[email protected]>
Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command"
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix null pointer access during disconnect from subsystem
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Check if FW supports MQ before enabling
Stanley Chu <[email protected]>
scsi: ufs: Clean up completed request without interrupt notification
Adrian Hunter <[email protected]>
scsi: ufs: Improve interrupt handling for shared interrupts
Stanley Chu <[email protected]>
scsi: ufs: Fix possible infinite loop in ufshcd_hold
Mike Christie <[email protected]>
scsi: fcoe: Fix I/O path allocation
Sylwester Nawrocki <[email protected]>
ASoC: wm8994: Avoid attempts to read unreadable registers
Vineeth Vijayan <[email protected]>
s390/cio: add cond_resched() in the slow_eval_known_fn() loop
Amelie Delaunay <[email protected]>
spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
Xianting Tian <[email protected]>
fs: prevent BUG_ON in submit_bh_wbc()
Jan Kara <[email protected]>
ext4: correctly restore system zone info when remount fails
Jan Kara <[email protected]>
ext4: handle error of ext4_setup_system_zone() on remount
Lukas Czerner <[email protected]>
ext4: handle option set by mount flags correctly
zhangyi (F) <[email protected]>
jbd2: abort journal if free a async write error metadata buffer
Lukas Czerner <[email protected]>
ext4: handle read only external journal device
Jan Kara <[email protected]>
ext4: don't BUG on inconsistent journal feature
Lukas Czerner <[email protected]>
jbd2: make sure jh have b_transaction set in refile/unfile_buffer
Christophe JAILLET <[email protected]>
usb: gadget: f_tcm: Fix some resource leaks in some error paths
Wolfram Sang <[email protected]>
i2c: rcar: in slave mode, clear NACK earlier
Hou Pu <[email protected]>
null_blk: fix passing of REQ_FUA flag in null_handle_rq
Tianjia Zhang <[email protected]>
nvme-fc: Fix wrong return value in __nvme_fc_init_request()
Rob Clark <[email protected]>
drm/msm/adreno: fix updating ring fence
Sean Young <[email protected]>
media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
Zhi Chen <[email protected]>
Revert "ath10k: fix DMA related firmware crashes on multiple devices"
Andrey Konovalov <[email protected]>
efi: provide empty efi_enter_virtual_mode implementation
Changming Liu <[email protected]>
USB: sisusbvga: Fix a potential UB casued by left shifting a negative value
Arnd Bergmann <[email protected]>
powerpc/spufs: add CONFIG_COREDUMP dependency
David Brazdil <[email protected]>
KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe
Evgeny Novikov <[email protected]>
media: davinci: vpif_capture: fix potential double free
Jason Baron <[email protected]>
EDAC/ie31200: Fallback if host bridge device is already initialized
Javed Hasan <[email protected]>
scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
Xiubo Li <[email protected]>
ceph: fix potential mdsc use-after-free crash
Jing Xiangfeng <[email protected]>
scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
Qu Wenruo <[email protected]>
btrfs: file: reserve qgroup space after the hole punch range is locked
Chris Wilson <[email protected]>
locking/lockdep: Fix overflow in presentation of average lock-time
Aditya Pakki <[email protected]>
drm/nouveau: Fix reference count leak in nouveau_connector_detect
Aditya Pakki <[email protected]>
drm/nouveau: fix reference count leak in nv50_disp_atomic_commit
Aditya Pakki <[email protected]>
drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open
Li Guifu <[email protected]>
f2fs: fix use-after-free issue
Ikjoon Jang <[email protected]>
HID: quirks: add NOGET quirk for Logitech GROUP
Hans Verkuil <[email protected]>
cec-api: prevent leaking memory through hole in structure
Peng Fan <[email protected]>
mips/vdso: Fix resource leaks in genvdso.c
Reto Schneider <[email protected]>
rtlwifi: rtl8192cu: Prevent leaking urb
Yangbo Lu <[email protected]>
ARM: dts: ls1021a: output PPS signal on FIPER2
Qiushi Wu <[email protected]>
PCI: Fix pci_create_slot() reference count leak
Aditya Pakki <[email protected]>
omapfb: fix multiple reference count leaks due to pm_runtime_get_sync
Chao Yu <[email protected]>
f2fs: fix error path in do_recover_data()
Desnes A. Nunes do Rosario <[email protected]>
selftests/powerpc: Purge extra count_pmc() calls of ebb selftests
Dave Chinner <[email protected]>
xfs: Don't allow logging of XFS_ISTALE inodes
Dick Kennedy <[email protected]>
scsi: lpfc: Fix shost refcount mismatch when deleting vport
Navid Emamdoost <[email protected]>
drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails
Navid Emamdoost <[email protected]>
drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config
Navid Emamdoost <[email protected]>
drm/amd/display: fix ref count leak in amdgpu_drm_ioctl
Navid Emamdoost <[email protected]>
drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms
Aditya Pakki <[email protected]>
drm/radeon: fix multiple reference count leak
Qiushi Wu <[email protected]>
drm/amdkfd: Fix reference count leaks.
Robin Murphy <[email protected]>
iommu/iova: Don't BUG on invalid PFNs
Bodo Stroesser <[email protected]>
scsi: target: tcmu: Fix crash on ARM during cmd completion
Luis Chamberlain <[email protected]>
blktrace: ensure our debugfs dir exists
Jia-Ju Bai <[email protected]>
media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
Alexey Kardashevskiy <[email protected]>
powerpc/xive: Ignore kmemleak false positives
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep
Andy Shevchenko <[email protected]>
mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs
Qiushi Wu <[email protected]>
ASoC: tegra: Fix reference count leaks.
Qiushi Wu <[email protected]>
ASoC: img-parallel-out: Fix a reference count leak
Qiushi Wu <[email protected]>
ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt
Randy Dunlap <[email protected]>
ALSA: pci: delete repeated words in comments
Mahesh Bandewar <[email protected]>
ipvlan: fix device features
Shay Agroskin <[email protected]>
net: ena: Make missed_tx stat incremental
Cong Wang <[email protected]>
tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
Peilin Ye <[email protected]>
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
Necip Fazil Yildiran <[email protected]>
net: qrtr: fix usage of idr in port assignment to socket
Miaohe Lin <[email protected]>
net: Fix potential wrong skb->protocol in skb_vlan_untag()
Mark Tomlinson <[email protected]>
gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY
Michael Ellerman <[email protected]>
powerpc/64s: Don't init FSCR_DSCR in __init_FSCR()
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/ls1021a.dtsi | 2 +-
arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | 2 +-
arch/arm64/kvm/hyp/switch.c | 2 +-
arch/mips/vdso/genvdso.c | 10 ++
arch/powerpc/kernel/cpu_setup_power.S | 2 +-
arch/powerpc/perf/core-book3s.c | 4 +
arch/powerpc/platforms/cell/Kconfig | 1 +
arch/powerpc/sysdev/xive/native.c | 2 +
block/blk-mq-sched.c | 9 ++
block/blk-mq.c | 9 ++
drivers/base/core.c | 12 +-
drivers/base/power/main.c | 16 +-
drivers/block/loop.c | 33 ++--
drivers/block/null_blk_main.c | 2 +-
drivers/char/tpm/tpm-chip.c | 9 +-
drivers/char/tpm/tpm.h | 6 +-
drivers/char/tpm/tpm2-space.c | 26 +--
drivers/char/tpm/tpmrm-dev.c | 2 +-
drivers/edac/ie31200_edac.c | 50 +++++-
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 5 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 +-
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 ++-
.../gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 7 +-
.../gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c | 6 +-
drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +-
drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +-
drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +-
drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 +-
drivers/gpu/drm/radeon/radeon_connectors.c | 20 ++-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
drivers/hid/i2c-hid/i2c-hid-core.c | 22 +--
drivers/hid/usbhid/hiddev.c | 4 +
drivers/i2c/busses/i2c-rcar.c | 1 +
drivers/iommu/iova.c | 4 +-
drivers/irqchip/irq-stm32-exti.c | 14 +-
drivers/media/cec/cec-api.c | 8 +-
drivers/media/pci/ttpci/av7110.c | 5 +-
drivers/media/platform/davinci/vpif_capture.c | 2 -
drivers/media/rc/gpio-ir-tx.c | 7 +-
drivers/mfd/intel-lpss-pci.c | 3 +
drivers/net/ethernet/amazon/ena/ena_netdev.c | 5 +-
drivers/net/ethernet/freescale/gianfar.c | 4 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 2 +-
drivers/net/ipvlan/ipvlan_main.c | 27 +++-
drivers/net/macvlan.c | 21 ++-
drivers/net/wireless/ath/ath10k/hw.h | 2 +-
drivers/net/wireless/realtek/rtlwifi/usb.c | 5 +-
drivers/nvme/host/fc.c | 4 +-
drivers/pci/slot.c | 6 +-
drivers/s390/cio/css.c | 5 +
drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
drivers/scsi/lpfc/lpfc_vport.c | 26 +--
drivers/scsi/qla2xxx/qla_mbx.c | 8 -
drivers/scsi/qla2xxx/qla_nvme.c | 5 +
drivers/scsi/qla2xxx/qla_os.c | 5 +
drivers/scsi/scsi_transport_iscsi.c | 2 +-
drivers/scsi/ufs/ufshcd.c | 14 +-
drivers/spi/spi-stm32.c | 3 +-
drivers/target/target_core_user.c | 9 +-
drivers/tty/serial/8250/8250_exar.c | 24 ++-
drivers/tty/serial/8250/8250_port.c | 9 +-
drivers/tty/serial/amba-pl011.c | 16 +-
drivers/tty/serial/samsung.c | 8 +-
drivers/tty/vt/vt.c | 5 +-
drivers/tty/vt/vt_ioctl.c | 12 +-
drivers/usb/class/cdc-acm.c | 22 ++-
drivers/usb/core/quirks.c | 7 +
drivers/usb/dwc3/gadget.c | 104 +++++++++---
drivers/usb/gadget/function/f_ncm.c | 81 ++++++++--
drivers/usb/gadget/function/f_tcm.c | 7 +-
drivers/usb/gadget/u_f.h | 38 +++--
drivers/usb/host/ohci-exynos.c | 5 +-
drivers/usb/host/xhci-debugfs.c | 8 +-
drivers/usb/host/xhci-hub.c | 19 +--
drivers/usb/host/xhci.c | 3 +-
drivers/usb/misc/lvstest.c | 2 +-
drivers/usb/misc/sisusbvga/sisusb.c | 2 +-
drivers/usb/misc/yurex.c | 2 +-
drivers/usb/storage/unusual_devs.h | 2 +-
drivers/usb/storage/unusual_uas.h | 14 ++
drivers/video/fbdev/core/fbcon.c | 25 ++-
drivers/video/fbdev/omap2/omapfb/dss/dispc.c | 7 +-
drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 7 +-
drivers/video/fbdev/omap2/omapfb/dss/dss.c | 7 +-
drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c | 5 +-
drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c | 5 +-
drivers/video/fbdev/omap2/omapfb/dss/venc.c | 7 +-
drivers/xen/events/events_base.c | 16 +-
fs/btrfs/disk-io.c | 1 +
fs/btrfs/file.c | 8 +-
fs/btrfs/free-space-cache.c | 2 +-
fs/btrfs/super.c | 1 +
fs/btrfs/tree-log.c | 10 +-
fs/buffer.c | 9 ++
fs/ceph/mds_client.c | 14 +-
fs/ext4/block_validity.c | 8 -
fs/ext4/super.c | 175 ++++++++++++++-------
fs/f2fs/f2fs.h | 4 +-
fs/f2fs/inline.c | 19 ++-
fs/f2fs/node.c | 6 +-
fs/f2fs/recovery.c | 10 +-
fs/f2fs/super.c | 5 +-
fs/fs-writeback.c | 83 +++++-----
fs/jbd2/transaction.c | 26 +++
fs/xfs/xfs_icache.c | 3 +-
fs/xfs/xfs_inode.c | 25 ++-
fs/xfs/xfs_trans_inode.c | 2 +
include/linux/efi.h | 4 +
include/linux/fs.h | 8 +-
include/trace/events/writeback.h | 13 +-
kernel/irq/matrix.c | 7 +
kernel/locking/lockdep_proc.c | 2 +-
kernel/trace/blktrace.c | 12 ++
net/core/skbuff.c | 4 +-
net/ipv6/ip6_tunnel.c | 10 +-
net/qrtr/qrtr.c | 20 +--
net/smc/smc_diag.c | 16 +-
net/tipc/netlink_compat.c | 12 +-
sound/pci/cs46xx/cs46xx_lib.c | 2 +-
sound/pci/cs46xx/dsp_spos_scb_lib.c | 2 +-
sound/pci/hda/hda_codec.c | 2 +-
sound/pci/hda/hda_generic.c | 2 +-
sound/pci/hda/patch_sigmatel.c | 2 +-
sound/pci/ice1712/prodigy192.c | 2 +-
sound/pci/oxygen/xonar_dg.c | 2 +-
sound/soc/codecs/wm8958-dsp2.c | 4 +
sound/soc/img/img-i2s-in.c | 4 +-
sound/soc/img/img-parallel-out.c | 4 +-
sound/soc/tegra/tegra30_ahub.c | 4 +-
sound/soc/tegra/tegra30_i2s.c | 4 +-
sound/usb/quirks-table.h | 4 +-
.../powerpc/pmu/ebb/back_to_back_ebbs_test.c | 2 -
.../selftests/powerpc/pmu/ebb/cycles_test.c | 2 -
.../powerpc/pmu/ebb/cycles_with_freeze_test.c | 2 -
.../powerpc/pmu/ebb/cycles_with_mmcr2_test.c | 2 -
tools/testing/selftests/powerpc/pmu/ebb/ebb.c | 2 -
.../powerpc/pmu/ebb/ebb_on_willing_child_test.c | 2 -
.../powerpc/pmu/ebb/lost_exception_test.c | 1 -
.../selftests/powerpc/pmu/ebb/multi_counter_test.c | 7 -
.../powerpc/pmu/ebb/multi_ebb_procs_test.c | 2 -
.../selftests/powerpc/pmu/ebb/pmae_handling_test.c | 2 -
.../powerpc/pmu/ebb/pmc56_overflow_test.c | 2 -
146 files changed, 1106 insertions(+), 474 deletions(-)
From: Aditya Pakki <[email protected]>
[ Upstream commit a2cdf39536b0d21fb06113f5e16692513d7bcb9c ]
nv50_disp_atomic_commit() calls calls pm_runtime_get_sync and in turn
increments the reference count. In case of failure, decrement the
ref count before returning the error.
Signed-off-by: Aditya Pakki <[email protected]>
Signed-off-by: Ben Skeggs <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 10107e551fac3..e06ea8c8184cb 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -1920,8 +1920,10 @@ nv50_disp_atomic_commit(struct drm_device *dev,
int ret, i;
ret = pm_runtime_get_sync(dev->dev);
- if (ret < 0 && ret != -EACCES)
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put_autosuspend(dev->dev);
return ret;
+ }
ret = drm_atomic_helper_setup_commit(state, nonblock);
if (ret)
--
2.25.1
From: Aditya Pakki <[email protected]>
[ Upstream commit 990a1162986e8eff7ca18cc5a0e03b4304392ae2 ]
nouveau_connector_detect() calls pm_runtime_get_sync and in turn
increments the reference count. In case of failure, decrement the
ref count before returning the error.
Signed-off-by: Aditya Pakki <[email protected]>
Signed-off-by: Ben Skeggs <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index fb0094fc55834..b71afde8f115a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -551,8 +551,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
pm_runtime_get_noresume(dev->dev);
} else {
ret = pm_runtime_get_sync(dev->dev);
- if (ret < 0 && ret != -EACCES)
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put_autosuspend(dev->dev);
return conn_status;
+ }
}
nv_encoder = nouveau_connector_ddc_detect(connector);
--
2.25.1
From: Shay Agroskin <[email protected]>
[ Upstream commit ccd143e5150f24b9ba15145c7221b61dd9e41021 ]
Most statistics in ena driver are incremented, meaning that a stat's
value is a sum of all increases done to it since driver/queue
initialization.
This patch makes all statistics this way, effectively making missed_tx
statistic incremental.
Also added a comment regarding rx_drops and tx_drops to make it
clearer how these counters are calculated.
Fixes: 11095fdb712b ("net: ena: add statistics for missed tx packets")
Signed-off-by: Shay Agroskin <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/ethernet/amazon/ena/ena_netdev.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -2736,7 +2736,7 @@ static int check_missing_comp_in_tx_queu
}
u64_stats_update_begin(&tx_ring->syncp);
- tx_ring->tx_stats.missed_tx = missed_tx;
+ tx_ring->tx_stats.missed_tx += missed_tx;
u64_stats_update_end(&tx_ring->syncp);
return rc;
@@ -3544,6 +3544,9 @@ static void ena_keep_alive_wd(void *adap
rx_drops = ((u64)desc->rx_drops_high << 32) | desc->rx_drops_low;
u64_stats_update_begin(&adapter->syncp);
+ /* These stats are accumulated by the device, so the counters indicate
+ * all drops since last reset.
+ */
adapter->dev_stats.rx_drops = rx_drops;
u64_stats_update_end(&adapter->syncp);
}
From: Qiushi Wu <[email protected]>
[ Upstream commit 6b9fbb073636906eee9fe4d4c05a4f445b9e2a23 ]
pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
Signed-off-by: Qiushi Wu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
sound/soc/img/img-parallel-out.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c
index acc005217be06..f56752662b199 100644
--- a/sound/soc/img/img-parallel-out.c
+++ b/sound/soc/img/img-parallel-out.c
@@ -166,8 +166,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
}
ret = pm_runtime_get_sync(prl->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(prl->dev);
return ret;
+ }
reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL);
reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set;
--
2.25.1
From: Navid Emamdoost <[email protected]>
[ Upstream commit e008fa6fb41544b63973a529b704ef342f47cc65 ]
in amdgpu_display_crtc_set_config, the call to pm_runtime_get_sync
increments the counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 686a26de50f91..049a1961c3fa5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -275,7 +275,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
ret = pm_runtime_get_sync(dev->dev);
if (ret < 0)
- return ret;
+ goto out;
ret = drm_crtc_helper_set_config(set, ctx);
@@ -290,7 +290,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
take the current one */
if (active && !adev->have_disp_power_ref) {
adev->have_disp_power_ref = true;
- return ret;
+ goto out;
}
/* if we have no active crtcs, then drop the power ref
we got before */
@@ -299,6 +299,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
adev->have_disp_power_ref = false;
}
+out:
/* drop the power reference we got coming in here */
pm_runtime_put_autosuspend(dev->dev);
return ret;
--
2.25.1
From: Sean Young <[email protected]>
[ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
usleep_range() may take longer than the max argument due to scheduling,
especially under load. This is causing random errors in the transmitted
IR. Remove the usleep_range() in favour of busy-looping with udelay().
Signed-off-by: Sean Young <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/media/rc/gpio-ir-tx.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c
index cd476cab97820..4e70b67ccd181 100644
--- a/drivers/media/rc/gpio-ir-tx.c
+++ b/drivers/media/rc/gpio-ir-tx.c
@@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
// space
edge = ktime_add_us(edge, txbuf[i]);
delta = ktime_us_delta(edge, ktime_get());
- if (delta > 10) {
- spin_unlock_irqrestore(&gpio_ir->lock, flags);
- usleep_range(delta, delta + 10);
- spin_lock_irqsave(&gpio_ir->lock, flags);
- } else if (delta > 0) {
+ if (delta > 0)
udelay(delta);
- }
} else {
// pulse
ktime_t last = ktime_add_us(edge, txbuf[i]);
--
2.25.1
From: Hou Pu <[email protected]>
[ Upstream commit 2d62e6b038e729c3e4bfbfcfbd44800ef0883680 ]
REQ_FUA should be checked using rq->cmd_flags instead of req_op().
Fixes: deb78b419dfda ("nullb: emulate cache")
Signed-off-by: Hou Pu <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/block/null_blk_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index d2d7dc9cd58d2..4fef1fb918ece 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -1086,7 +1086,7 @@ static int null_handle_rq(struct nullb_cmd *cmd)
len = bvec.bv_len;
err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset,
op_is_write(req_op(rq)), sector,
- req_op(rq) & REQ_FUA);
+ rq->cmd_flags & REQ_FUA);
if (err) {
spin_unlock_irq(&nullb->lock);
return err;
--
2.25.1
From: Changming Liu <[email protected]>
[ Upstream commit 2b53a19284f537168fb506f2f40d7fda40a01162 ]
The char buffer buf, receives data directly from user space,
so its content might be negative and its elements are left
shifted to form an unsigned integer.
Since left shifting a negative value is undefined behavior, thus
change the char to u8 to elimintate this UB.
Signed-off-by: Changming Liu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/usb/misc/sisusbvga/sisusb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 6376be1f5fd22..4877bf82ad395 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -761,7 +761,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr,
u8 swap8, fromkern = kernbuffer ? 1 : 0;
u16 swap16;
u32 swap32, flag = (length >> 28) & 1;
- char buf[4];
+ u8 buf[4];
/* if neither kernbuffer not userbuffer are given, assume
* data in obuf
--
2.25.1
From: Qiushi Wu <[email protected]>
[ Upstream commit deca195383a6085be62cb453079e03e04d618d6e ]
Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put is not called in
error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.
Signed-off-by: Qiushi Wu <[email protected]>
Reviewed-by: Jon Hunter <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
sound/soc/tegra/tegra30_ahub.c | 4 +++-
sound/soc/tegra/tegra30_i2s.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index 43679aeeb12be..88e838ac937dc 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -655,8 +655,10 @@ static int tegra30_ahub_resume(struct device *dev)
int ret;
ret = pm_runtime_get_sync(dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put(dev);
return ret;
+ }
ret = regcache_sync(ahub->regmap_ahub);
ret |= regcache_sync(ahub->regmap_apbif);
pm_runtime_put(dev);
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index 0b176ea24914b..bf155c5092f06 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -551,8 +551,10 @@ static int tegra30_i2s_resume(struct device *dev)
int ret;
ret = pm_runtime_get_sync(dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put(dev);
return ret;
+ }
ret = regcache_sync(i2s->regmap);
pm_runtime_put(dev);
--
2.25.1
From: Javed Hasan <[email protected]>
[ Upstream commit e95b4789ff4380733006836d28e554dc296b2298 ]
In fcoe_sysfs_fcf_del(), we first deleted the fcf from the list and then
freed it if ctlr_dev was not NULL. This was causing a memory leak.
Free the fcf even if ctlr_dev is NULL.
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Girish Basrur <[email protected]>
Reviewed-by: Santosh Vernekar <[email protected]>
Reviewed-by: Saurav Kashyap <[email protected]>
Reviewed-by: Shyam Sundar <[email protected]>
Signed-off-by: Javed Hasan <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 24cbd0a2cc69f..658c0726581f9 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -267,9 +267,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new)
WARN_ON(!fcf_dev);
new->fcf_dev = NULL;
fcoe_fcf_device_delete(fcf_dev);
- kfree(new);
mutex_unlock(&cdev->lock);
}
+ kfree(new);
}
/**
--
2.25.1
From: Aditya Pakki <[email protected]>
[ Upstream commit bfad51c7633325b5d4b32444efe04329d53297b2 ]
nouveau_fbcon_open() calls calls pm_runtime_get_sync() that
increments the reference count. In case of failure, decrement the
ref count before returning the error.
Signed-off-by: Aditya Pakki <[email protected]>
Signed-off-by: Ben Skeggs <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 406cb99af7f21..d4fe52ec4c966 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -189,8 +189,10 @@ nouveau_fbcon_open(struct fb_info *info, int user)
struct nouveau_fbdev *fbcon = info->par;
struct nouveau_drm *drm = nouveau_drm(fbcon->helper.dev);
int ret = pm_runtime_get_sync(drm->dev->dev);
- if (ret < 0 && ret != -EACCES)
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put(drm->dev->dev);
return ret;
+ }
return 0;
}
--
2.25.1
From: Michael Ellerman <[email protected]>
commit 0828137e8f16721842468e33df0460044a0c588b upstream.
__init_FSCR() was added originally in commit 2468dcf641e4 ("powerpc:
Add support for context switching the TAR register") (Feb 2013), and
only set FSCR_TAR.
At that point FSCR (Facility Status and Control Register) was not
context switched, so the setting was permanent after boot.
Later we added initialisation of FSCR_DSCR to __init_FSCR(), in commit
54c9b2253d34 ("powerpc: Set DSCR bit in FSCR setup") (Mar 2013), again
that was permanent after boot.
Then commit 2517617e0de6 ("powerpc: Fix context switch DSCR on
POWER8") (Aug 2013) added a limited context switch of FSCR, just the
FSCR_DSCR bit was context switched based on thread.dscr_inherit. That
commit said "This clears the H/FSCR DSCR bit initially", but it
didn't, it left the initialisation of FSCR_DSCR in __init_FSCR().
However the initial context switch from init_task to pid 1 would clear
FSCR_DSCR because thread.dscr_inherit was 0.
That commit also introduced the requirement that FSCR_DSCR be clear
for user processes, so that we can take the facility unavailable
interrupt in order to manage dscr_inherit.
Then in commit 152d523e6307 ("powerpc: Create context switch helpers
save_sprs() and restore_sprs()") (Dec 2015) FSCR was added to
thread_struct. However it still wasn't fully context switched, we just
took the existing value and set FSCR_DSCR if the new thread had
dscr_inherit set. FSCR was still initialised at boot to FSCR_DSCR |
FSCR_TAR, but that value was not propagated into the thread_struct, so
the initial context switch set FSCR_DSCR back to 0.
Finally commit b57bd2de8c6c ("powerpc: Improve FSCR init and context
switching") (Jun 2016) added a full context switch of the FSCR, and
added an initialisation of init_task.thread.fscr to FSCR_TAR |
FSCR_EBB, but omitted FSCR_DSCR.
The end result is that swapper runs with FSCR_DSCR set because of the
initialisation in __init_FSCR(), but no other processes do, they use
the value from init_task.thread.fscr.
Having FSCR_DSCR set for swapper allows it to access SPR 3 from
userspace, but swapper never runs userspace, so it has no useful
effect. It's also confusing to have the value initialised in two
places to two different values.
So remove FSCR_DSCR from __init_FSCR(), this at least gets us to the
point where there's a single value of FSCR, even if it's still set in
two places.
Signed-off-by: Michael Ellerman <[email protected]>
Tested-by: Alistair Popple <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Cc: Thadeu Lima de Souza Cascardo <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/powerpc/kernel/cpu_setup_power.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -183,7 +183,7 @@ __init_LPCR_ISA300:
__init_FSCR:
mfspr r3,SPRN_FSCR
- ori r3,r3,FSCR_TAR|FSCR_DSCR|FSCR_EBB
+ ori r3,r3,FSCR_TAR|FSCR_EBB
mtspr SPRN_FSCR,r3
blr
From: Qiushi Wu <[email protected]>
[ Upstream commit 20eca0123a35305e38b344d571cf32768854168c ]
kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Signed-off-by: Qiushi Wu <[email protected]>
Reviewed-by: Felix Kuehling <[email protected]>
Signed-off-by: Felix Kuehling <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 0805c423a5ce0..5cf499a07806a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -592,8 +592,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
ret = kobject_init_and_add(dev->kobj_node, &node_type,
sys_props.kobj_nodes, "%d", id);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(dev->kobj_node);
return ret;
+ }
dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node);
if (!dev->kobj_mem)
@@ -640,8 +642,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(mem->kobj, &mem_type,
dev->kobj_mem, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(mem->kobj);
return ret;
+ }
mem->attr.name = "properties";
mem->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -659,8 +663,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(cache->kobj, &cache_type,
dev->kobj_cache, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(cache->kobj);
return ret;
+ }
cache->attr.name = "properties";
cache->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -678,8 +684,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(iolink->kobj, &iolink_type,
dev->kobj_iolink, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(iolink->kobj);
return ret;
+ }
iolink->attr.name = "properties";
iolink->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -759,8 +767,10 @@ static int kfd_topology_update_sysfs(void)
ret = kobject_init_and_add(sys_props.kobj_topology,
&sysprops_type, &kfd_device->kobj,
"topology");
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(sys_props.kobj_topology);
return ret;
+ }
sys_props.kobj_nodes = kobject_create_and_add("nodes",
sys_props.kobj_topology);
--
2.25.1
From: Navid Emamdoost <[email protected]>
[ Upstream commit f79f94765f8c39db0b7dec1d335ab046aac03f20 ]
The call to pm_runtime_get_sync increments the counter even in case of
failure, leading to incorrect ref count.
In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index c770d73352a79..c15286858f0bf 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -718,8 +718,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (encoder) {
@@ -856,8 +858,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
encoder = amdgpu_connector_best_single_encoder(connector);
@@ -979,8 +983,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
@@ -1329,8 +1335,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
--
2.25.1
From: Jia-Ju Bai <[email protected]>
[ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
The value av7110->debi_virt is stored in DMA memory, and it is assigned
to data, and thus data[0] can be modified at any time by malicious
hardware. In this case, "if (data[0] < 2)" can be passed, but then
data[0] can be changed into a large number, which may cause buffer
overflow when the code "av7110->ci_slot[data[0]]" is used.
To fix this possible bug, data[0] is assigned to a local variable, which
replaces the use of data[0].
Signed-off-by: Jia-Ju Bai <[email protected]>
Signed-off-by: Sean Young <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/media/pci/ttpci/av7110.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
index d6816effb8786..d02b5fd940c12 100644
--- a/drivers/media/pci/ttpci/av7110.c
+++ b/drivers/media/pci/ttpci/av7110.c
@@ -424,14 +424,15 @@ static void debiirq(unsigned long cookie)
case DATA_CI_GET:
{
u8 *data = av7110->debi_virt;
+ u8 data_0 = data[0];
- if ((data[0] < 2) && data[2] == 0xff) {
+ if (data_0 < 2 && data[2] == 0xff) {
int flags = 0;
if (data[5] > 0)
flags |= CA_CI_MODULE_PRESENT;
if (data[5] > 5)
flags |= CA_CI_MODULE_READY;
- av7110->ci_slot[data[0]].flags = flags;
+ av7110->ci_slot[data_0].flags = flags;
} else
ci_get_data(&av7110->ci_rbuffer,
av7110->debi_virt,
--
2.25.1
On 9/1/20 9:09 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.143 release.
> There are 125 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.143-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <[email protected]>
thanks,
-- Shuah
On Tue, 1 Sep 2020 at 20:53, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 4.19.143 release.
> There are 125 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.143-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <[email protected]>
Summary
------------------------------------------------------------------------
kernel: 4.19.143-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: ae6e3cc29bb4eca8baf48409319aa290efcba5f5
git describe: v4.19.142-126-gae6e3cc29bb4
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.142-126-gae6e3cc29bb4
No regressions (compared to build v4.19.142)
No fixes (compared to build v4.19.142)
Ran 35939 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- nxp-ls2088
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* kselftest/drivers
* kselftest/filesystems
* kselftest/net
* libhugetlbfs
* linux-log-parser
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cve-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* perf
* v4l2-compliance
* ltp-cap_bounds-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-mm-tests
* network-basic-tests
* ltp-fs-tests
* ltp-ipc-tests
* ltp-open-posix-tests
* ltp-sched-tests
* igt-gpu-tools
* ssuite
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-native/drivers
* kselftest-vsyscall-mode-native/filesystems
* kselftest-vsyscall-mode-native/net
* kselftest-vsyscall-mode-none
* kselftest-vsyscall-mode-none/drivers
* kselftest-vsyscall-mode-none/filesystems
* kselftest-vsyscall-mode-none/net
--
Linaro LKFT
https://lkft.linaro.org
Hi!
> This is the start of the stable review cycle for the 4.19.143 release.
> There are 125 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
CIP testing did not find any problems (test:x86_siemens failure is
because those boards are offline).
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/184417281
Best regards,
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Hi!
>
> [ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
>
> usleep_range() may take longer than the max argument due to scheduling,
> especially under load. This is causing random errors in the transmitted
> IR. Remove the usleep_range() in favour of busy-looping with udelay().
>
> Signed-off-by: Sean Young <[email protected]>
I don't believe this should be in stable.
Yes, it probably fixes someone's remote control.
It also introduces > half a second (!) with interrupts disabled
(according to the code comments), which will break other devices on
the system.
Less intrusive solutions should be explored, first. Like.. if that
part is time-critical, perhaps it should set itself at realtime
priority, so that scheduler has motivation to schedule it at the right
times?
Perhaps usleep_range should be delta, delta+1?
Perhaps udelay makes sense to use for more than 10usec?
Best regards,
Pavel
> @@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
> // space
> edge = ktime_add_us(edge, txbuf[i]);
> delta = ktime_us_delta(edge, ktime_get());
> - if (delta > 10) {
> - spin_unlock_irqrestore(&gpio_ir->lock, flags);
> - usleep_range(delta, delta + 10);
> - spin_lock_irqsave(&gpio_ir->lock, flags);
> - } else if (delta > 0) {
> + if (delta > 0)
> udelay(delta);
> - }
> } else {
> // pulse
> ktime_t last = ktime_add_us(edge, txbuf[i]);
> --
> 2.25.1
>
>
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Hi Pavel,
On Wed, Sep 02, 2020 at 12:25:21PM +0200, Pavel Machek wrote:
> Hi!
> >
> > [ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
> >
> > usleep_range() may take longer than the max argument due to scheduling,
> > especially under load. This is causing random errors in the transmitted
> > IR. Remove the usleep_range() in favour of busy-looping with udelay().
> >
> > Signed-off-by: Sean Young <[email protected]>
>
> I don't believe this should be in stable.
>
> Yes, it probably fixes someone's remote control.
>
> It also introduces > half a second (!) with interrupts disabled
> (according to the code comments), which will break other devices on
> the system.
Yes, I've always been uncormfortable with this code, but nothing else I
tried worked.
BTW the delay has a maximum of half a second, but the point stands of
course.
> Less intrusive solutions should be explored, first. Like.. if that
> part is time-critical, perhaps it should set itself at realtime
> priority, so that scheduler has motivation to schedule it at the right
> times?
That is an interesting idea, I'll explore that.
> Perhaps usleep_range should be delta, delta+1?
I'm pretty sure I tried that and it didn't work. I'll give it another go.
> Perhaps udelay makes sense to use for more than 10usec?
I don't follow -- what are you suggesting here?
So any other ideas here would be very welcome. I'm happy to explore options,
so far under load the output is can be total garbage if you're unlucky.
Thanks,
Sean
>
> Best regards,
> Pavel
>
> > @@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
> > // space
> > edge = ktime_add_us(edge, txbuf[i]);
> > delta = ktime_us_delta(edge, ktime_get());
> > - if (delta > 10) {
> > - spin_unlock_irqrestore(&gpio_ir->lock, flags);
> > - usleep_range(delta, delta + 10);
> > - spin_lock_irqsave(&gpio_ir->lock, flags);
> > - } else if (delta > 0) {
> > + if (delta > 0)
> > udelay(delta);
> > - }
> > } else {
> > // pulse
> > ktime_t last = ktime_add_us(edge, txbuf[i]);
> > --
> > 2.25.1
> >
> >
>
> --
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
On Tue, Sep 01, 2020 at 05:09:15PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.143 release.
> There are 125 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 155 pass: 155 fail: 0
Qemu test results:
total: 421 pass: 421 fail: 0
Tested-by: Guenter Roeck <[email protected]>
Guenter
On Wed, Sep 02, 2020 at 12:06:21PM +0200, Pavel Machek wrote:
> Hi!
>
> > This is the start of the stable review cycle for the 4.19.143 release.
> > There are 125 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> > Anything received after that time might be too late.
>
> CIP testing did not find any problems (test:x86_siemens failure is
> because those boards are offline).
>
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/184417281
Thanks for testing two of these and letting me know.
greg k-h
Hi Sean,
On Wed, 2 Sep 2020, Sean Young wrote:
> Hi Pavel,
>
> On Wed, Sep 02, 2020 at 12:25:21PM +0200, Pavel Machek wrote:
>> Hi!
>>>
>>> [ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
>>>
>>> usleep_range() may take longer than the max argument due to scheduling,
>>> especially under load. This is causing random errors in the transmitted
>>> IR. Remove the usleep_range() in favour of busy-looping with udelay().
>>>
>>> Signed-off-by: Sean Young <[email protected]>
>>
>> I don't believe this should be in stable.
>>
>> Yes, it probably fixes someone's remote control.
>>
>> It also introduces > half a second (!) with interrupts disabled
>> (according to the code comments), which will break other devices on
>> the system.
>
> Yes, I've always been uncomfortable with this code, but nothing else I
> tried worked.
>
> BTW the delay has a maximum of half a second, but the point stands of
> course.
>
>> Less intrusive solutions should be explored, first. Like.. if that
>> part is time-critical, perhaps it should set itself at realtime
>> priority, so that scheduler has motivation to schedule it at the right
>> times?
>
> That is an interesting idea, I'll explore that.
>
Did you try anything around this? It looks like it might be required for
devices like the raspbetty pi zero w (see more details below).
Is there a way to temporarily increase the priority of the existing
thread? or is the preferred way to do readtime priority with a dedicated
thread? Assuming the latter: What's the preferred way to transfer data &
control from the user's thread to the dedicated thread and back? I'd
guess some sort of queue or mailbox?
>> Perhaps usleep_range should be delta, delta+1?
>
> I'm pretty sure I tried that and it didn't work. I'll give it another go.
>
Shouldn't max actually be less than delta? Otherwise the code is
indicating that it's okay to sleep for longer than delta + rescheduling
overhead.
I tried your latest patch ("re-introduce sleeping for periods of > 50us")
on my Pi Zero W and the post-usleep "remaining" delta is anywhere between
-25,500us and -50us (i.e. usleep_range usually oversleeps!).
The upstream patch gives very stable results: post-udelay delta is
typically <10us (i.e. it's underdelaying just a tiny bit).
I tried adding a module_param to tune the sleep threshold buffer but
because typical delays are 500us and 1,500us and the worst usleep overruns
are way larger than that, effectively I had to set it so that usleep never
triggered
I even tried usleep_range(0, delta - buffer), but that produced the same
behaviour. (I even saw a post-usleep delta of -125,000us once!)
I added a call to switch to the FIFO scheduler at priority 50 (the same
as the recently proposed sched_set_fifo function would do), and (as long
as ir-ctl is run as root) it brings the post-usleep delta to ~500us (or
with usleep_range(0, ...) for large deltas the post-usleep delta was
between ~500us and ~5000us - still undersleeping and very acceptable).
Note that pwm-ir-tx has the same issue and so should probably get the same
fixes (when they're figured out what they'll be).
>> Perhaps udelay makes sense to use for more than 10usec?
>
> I don't follow -- what are you suggesting here?
>
> So any other ideas here would be very welcome. I'm happy to explore options,
> so far under load the output is can be total garbage if you're unlucky.
>
>
> Thanks,
>
> Sean
>
>
>>
>> Best regards,
>> Pavel
>>
>>> @@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
>>> // space
>>> edge = ktime_add_us(edge, txbuf[i]);
>>> delta = ktime_us_delta(edge, ktime_get());
>>> - if (delta > 10) {
>>> - spin_unlock_irqrestore(&gpio_ir->lock, flags);
>>> - usleep_range(delta, delta + 10);
>>> - spin_lock_irqsave(&gpio_ir->lock, flags);
>>> - } else if (delta > 0) {
>>> + if (delta > 0)
>>> udelay(delta);
>>> - }
>>> } else {
>>> // pulse
>>> ktime_t last = ktime_add_us(edge, txbuf[i]);
>>> --
>>> 2.25.1
>>>
>>>
>>
>> --
>> (english) http://www.livejournal.com/~pavelmachek
>> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
>
>
>
--
- Norman Rasmussen
?- Email: [email protected]
?- Home page: http://norman.rasmussen.co.za/