This is the start of the stable review cycle for the 4.19.164 release.
There are 346 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.164-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.164-rc1
Jubin Zhong <[email protected]>
PCI: Fix pci_slot_release() NULL pointer dereference
Carlos Garnacho <[email protected]>
platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
Dan Williams <[email protected]>
libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
SeongJae Park <[email protected]>
xenbus/xenbus_backend: Disallow pending watch messages
SeongJae Park <[email protected]>
xen/xenbus: Count pending messages for each watch
SeongJae Park <[email protected]>
xen/xenbus/xen_bus_type: Support will_handle watch callback
SeongJae Park <[email protected]>
xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
SeongJae Park <[email protected]>
xen/xenbus: Allow watches discard events before queueing
Pawel Wieczorkiewicz <[email protected]>
xen-blkback: set ring->xenblkd to NULL after kthread_stop()
Terry Zhou <[email protected]>
clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
Yangtao Li <[email protected]>
pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
Zhao Heming <[email protected]>
md/cluster: fix deadlock when node is doing resync job
Zhao Heming <[email protected]>
md/cluster: block reshape with remote resync job
Jonathan Cameron <[email protected]>
iio:imu:bmi160: Fix too large a buffer.
Jonathan Cameron <[email protected]>
iio:pressure:mpl3115: Force alignment of buffer
Jonathan Cameron <[email protected]>
iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
Jonathan Cameron <[email protected]>
iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
Qinglang Miao <[email protected]>
iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
Nuno Sá <[email protected]>
iio: buffer: Fix demux update
James Smart <[email protected]>
scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
James Smart <[email protected]>
scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
Praveenkumar I <[email protected]>
mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
Sven Eckelmann <[email protected]>
mtd: parser: cmdline: Fix parsing of part-names with colons
Miquel Raynal <[email protected]>
mtd: spinand: Fix OOB read
Evan Green <[email protected]>
soc: qcom: smp2p: Safely acquire spinlock without IRQs
Qinglang Miao <[email protected]>
spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
Lukas Wunner <[email protected]>
spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
Lukas Wunner <[email protected]>
spi: sc18is602: Don't leak SPI master in probe error path
Lukas Wunner <[email protected]>
spi: rb4xx: Don't leak SPI master in probe error path
Lukas Wunner <[email protected]>
spi: pic32: Don't leak DMA channels in probe error path
Lukas Wunner <[email protected]>
spi: davinci: Fix use-after-free on unbind
Lukas Wunner <[email protected]>
spi: spi-sh: Fix use-after-free on unbind
Zwane Mwaikambo <[email protected]>
drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
Dave Kleikamp <[email protected]>
jfs: Fix array index bounds check in dbAdjTree
Zhe Li <[email protected]>
jffs2: Fix GC exit abnormally
Richard Weinberger <[email protected]>
ubifs: wbuf: Don't leak kernel memory to flash
Steve French <[email protected]>
SMB3.1.1: do not log warning message if server doesn't populate salt
Steve French <[email protected]>
SMB3: avoid confusing warning message on mount to Azure
Luis Henriques <[email protected]>
ceph: fix race in concurrent __ceph_remove_cap invocations
Roberto Sassu <[email protected]>
ima: Don't modify file descriptor mode on the fly
David Hildenbrand <[email protected]>
powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
David Hildenbrand <[email protected]>
powerpc/powernv/memtrace: Don't leak kernel memory to user space
Christophe Leroy <[email protected]>
powerpc/xmon: Change printk() to pr_cont()
Tyrel Datwyler <[email protected]>
powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
Mathieu Desnoyers <[email protected]>
powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
Nicolas Ferre <[email protected]>
ARM: dts: at91: sama5d2: fix CAN message ram offset and size
H. Nikolaus Schaller <[email protected]>
ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
Marc Zyngier <[email protected]>
KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
Jan Kara <[email protected]>
ext4: fix deadlock with fs freezing and EA inodes
Chunguang Xu <[email protected]>
ext4: fix a memory leak of ext4_free_data
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix write unthrottling
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix write-wakeup use-after-free
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix stalled writes
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix write deadlock
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix dropped unthrottle interrupts
Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix write-wakeup deadlocks
Johan Hovold <[email protected]>
USB: serial: mos7720: fix parallel-port state restore
Borislav Petkov <[email protected]>
EDAC/amd64: Fix PCI component registration
Ard Biesheuvel <[email protected]>
crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
Athira Rajeev <[email protected]>
powerpc/perf: Exclude kernel samples while counting events in user space.
Ian Abbott <[email protected]>
staging: comedi: mf6x4: Fix AI end-of-conversion detection
Stefan Haberland <[email protected]>
s390/dasd: fix list corruption of lcu list
Stefan Haberland <[email protected]>
s390/dasd: fix list corruption of pavgroup group list
Stefan Haberland <[email protected]>
s390/dasd: prevent inconsistent LCU device data
Stefan Haberland <[email protected]>
s390/dasd: fix hanging device offline processing
Philipp Rudo <[email protected]>
s390/kexec_file: fix diag308 subcode when loading crash kernel
Sven Schnelle <[email protected]>
s390/smp: perform initial CPU reset also for SMT siblings
Takashi Iwai <[email protected]>
ALSA: usb-audio: Disable sample read check if firmware doesn't give back
Amadej Kastelic <[email protected]>
ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
Chris Chiu <[email protected]>
ALSA: hda/realtek: Apply jack fixup for Quanta NL3
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for MSI-GP73
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Fix a few more UBSAN fixes
Chris Chiu <[email protected]>
ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
Chris Chiu <[email protected]>
ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
Takashi Iwai <[email protected]>
ALSA: hda: Fix regressions on clear and reconfig sysfs
Hui Wang <[email protected]>
ACPI: PNP: compare the string length in the matching_id()
Daniel Scally <[email protected]>
Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
Rafael J. Wysocki <[email protected]>
PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
Connor McAdams <[email protected]>
ALSA: hda/ca0132 - Change Input Source enum strings.
Arnd Bergmann <[email protected]>
Input: cyapa_gen6 - fix out-of-bounds stack access
Sakari Ailus <[email protected]>
media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
Sakari Ailus <[email protected]>
media: ipu3-cio2: Validate mbus format in setting subdev format
Sakari Ailus <[email protected]>
media: ipu3-cio2: Serialise access to pad format
Sakari Ailus <[email protected]>
media: ipu3-cio2: Return actual subdev format
Sakari Ailus <[email protected]>
media: ipu3-cio2: Remove traces of returned buffers
Lukas Wunner <[email protected]>
media: netup_unidvb: Don't leak SPI master in probe error path
Sean Young <[email protected]>
media: sunxi-cir: ensure IR is handled when it is continuous
Alan Stern <[email protected]>
media: gspca: Fix memory leak in probe
Simon Beginn <[email protected]>
Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
Dmitry Torokhov <[email protected]>
Input: cros_ec_keyb - send 'scancodes' in addition to key events
Dongdong Wang <[email protected]>
lwt: Disable BH too in run_lwt_bpf()
Serge Hallyn <[email protected]>
fix namespaced fscaps when !CONFIG_SECURITY
Sara Sharon <[email protected]>
cfg80211: initialize rekey_data
Paul Kocialkowski <[email protected]>
ARM: sunxi: Add machine match for the Allwinner V3 SoC
Masahiro Yamada <[email protected]>
kconfig: fix return value of do_error_if()
Jernej Skrabec <[email protected]>
clk: sunxi-ng: Make sure divider tables have sentinel
Christophe JAILLET <[email protected]>
clk: s2mps11: Fix a resource leak in error handling paths in the probe function
Dan Carpenter <[email protected]>
qlcnic: Fix error code in probe
Zheng Zengkai <[email protected]>
perf record: Fix memory leak when using '--user-regs=?' to list registers
Lokesh Vutla <[email protected]>
pwm: lp3943: Dynamically allocate PWM chip base
Uwe Kleine-König <[email protected]>
pwm: zx: Add missing cleanup in error path
Zhang Qilong <[email protected]>
clk: ti: Fix memleak in ti_fapll_synth_setup
Arnd Bergmann <[email protected]>
watchdog: coh901327: add COMMON_CLK dependency
Manivannan Sadhasivam <[email protected]>
watchdog: qcom: Avoid context switch in restart handler
Zhang Qilong <[email protected]>
libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
Vincent Stehlé <[email protected]>
net: korina: fix return value
Christophe JAILLET <[email protected]>
net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
Christophe JAILLET <[email protected]>
net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
Dwaipayan Ray <[email protected]>
checkpatch: fix unescaped left brace
Vincent Stehlé <[email protected]>
powerpc/ps3: use dma_mapping_error()
Bongsu Jeon <[email protected]>
nfc: s3fwrn5: Release the nfc firmware
Anton Ivanov <[email protected]>
um: chan_xterm: Fix fd leak
Anton Ivanov <[email protected]>
um: tty: Fix handling of close in tty lines
Anton Ivanov <[email protected]>
um: Monitor error events in IRQ controller
Wang Wensheng <[email protected]>
watchdog: Fix potential dereferencing of null pointer
Lingling Xu <[email protected]>
watchdog: sprd: check busy bit before new loading rather than after that
Lingling Xu <[email protected]>
watchdog: sprd: remove watchdog disable from resume fail path
Guenter Roeck <[email protected]>
watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
Marc Zyngier <[email protected]>
irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
Dan Carpenter <[email protected]>
ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
Johannes Berg <[email protected]>
mac80211: don't set set TDLS STA bandwidth wider than possible
Marek Szyprowski <[email protected]>
extcon: max77693: Fix modalias string
Dmitry Osipenko <[email protected]>
clk: tegra: Fix duplicated SE clock entry
Zhang Changzhong <[email protected]>
bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
Masami Hiramatsu <[email protected]>
x86/kprobes: Restore BTF if the single-stepping is cancelled
Cheng Lin <[email protected]>
nfs_common: need lock during iterate through the list
kazuo ito <[email protected]>
nfsd: Fix message level for normal termination
Yang Yingliang <[email protected]>
speakup: fix uninitialized flush_lock
Zhang Qilong <[email protected]>
usb: oxu210hp-hcd: Fix memory leak in oxu_create
Zhang Qilong <[email protected]>
usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
Nathan Lynch <[email protected]>
powerpc/pseries/hibernation: remove redundant cacheinfo update
Nathan Lynch <[email protected]>
powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
Vadim Pasternak <[email protected]>
platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
Zhang Changzhong <[email protected]>
scsi: fnic: Fix error return code in fnic_probe()
Arnd Bergmann <[email protected]>
seq_buf: Avoid type mismatch for seq_buf_init
Zhang Qilong <[email protected]>
scsi: pm80xx: Fix error return in pm8001_pci_probe()
Qinglang Miao <[email protected]>
scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
Pali Rohár <[email protected]>
cpufreq: scpi: Add missing MODULE_ALIAS
Pali Rohár <[email protected]>
cpufreq: loongson1: Add missing MODULE_ALIAS
Pali Rohár <[email protected]>
cpufreq: st: Add missing MODULE_DEVICE_TABLE
Pali Rohár <[email protected]>
cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
Pali Rohár <[email protected]>
cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
Keqian Zhu <[email protected]>
clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
Qinglang Miao <[email protected]>
dm ioctl: fix error return code in target_message
Chuhong Yuan <[email protected]>
ASoC: jz4740-i2s: add missed checks for clk_get()
Leon Romanovsky <[email protected]>
net/mlx5: Properly convey driver version to firmware
Jing Xiangfeng <[email protected]>
memstick: r592: Fix error return in r592_probe()
Chen-Yu Tsai <[email protected]>
arm64: dts: rockchip: Fix UART pull-ups on rk3328
Yu Kuai <[email protected]>
pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
Claudiu Beznea <[email protected]>
ARM: dts: at91: sama5d2: map securam as device
Yu Kuai <[email protected]>
clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
Dan Carpenter <[email protected]>
media: saa7146: fix array overflow in vidioc_s_audio()
Jason Gunthorpe <[email protected]>
vfio-pci: Use io_remap_pfn_range() for PCI IO memory
NeilBrown <[email protected]>
NFS: switch nfsiod to be an UNBOUND workqueue.
Calum Mackay <[email protected]>
lockd: don't use interval-based rebinding over TCP
Trond Myklebust <[email protected]>
SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
Olga Kornievskaia <[email protected]>
NFSv4.2: condition READDIR's mask for security label based on LSM state
Christophe JAILLET <[email protected]>
ath10k: Release some resources in an error handling path
Christophe JAILLET <[email protected]>
ath10k: Fix an error handling path
Rakesh Pillai <[email protected]>
ath10k: Fix the parsing error in service available event
Qinglang Miao <[email protected]>
platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
Alexandre Belloni <[email protected]>
ARM: dts: at91: at91sam9rl: fix ADC triggers
Artem Lapkin <[email protected]>
arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
Bharat Gooty <[email protected]>
PCI: iproc: Fix out-of-bound array accesses
Colin Ian King <[email protected]>
PCI: Fix overflow in command-line resource alignment requests
Bjorn Helgaas <[email protected]>
PCI: Bounds-check command-line resource alignment requests
Marc Zyngier <[email protected]>
genirq/irqdomain: Don't try to free an interrupt that has no mapping
Zhang Qilong <[email protected]>
power: supply: bq24190_charger: fix reference leak
Hans de Goede <[email protected]>
power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
Chen-Yu Tsai <[email protected]>
arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
Chris Packham <[email protected]>
ARM: dts: Remove non-existent i2c1 from 98dx3236
Jing Xiangfeng <[email protected]>
HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
Dan Carpenter <[email protected]>
media: max2175: fix max2175_set_csm_mode() error code
Qinglang Miao <[email protected]>
mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
Daniel T. Lee <[email protected]>
samples: bpf: Fix lwt_len_hist reusing previous BPF map
Vadim Pasternak <[email protected]>
platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
Vadim Pasternak <[email protected]>
platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
Keita Suzuki <[email protected]>
media: siano: fix memory leak of debugfs members in smsdvb_hotplug
Zhihao Cheng <[email protected]>
dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
Qinglang Miao <[email protected]>
cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
Sebastian Andrzej Siewior <[email protected]>
orinoco: Move context allocation after processing the skb
Cristian Birsan <[email protected]>
ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
Cristian Birsan <[email protected]>
ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
Qinglang Miao <[email protected]>
memstick: fix a double-free bug in memstick_check
Kamal Heib <[email protected]>
RDMA/cxgb4: Validate the number of CQEs
Zhang Qilong <[email protected]>
Input: omap4-keypad - fix runtime PM error handling
Zhihao Cheng <[email protected]>
drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
Zhang Qilong <[email protected]>
soc: ti: Fix reference imbalance in knav_dma_probe
Zhang Qilong <[email protected]>
soc: ti: knav_qmss: fix reference leak in knav_queue_probe
Uwe Kleine-König <[email protected]>
spi: fix resource leak for drivers without .remove callback
Zhang Qilong <[email protected]>
crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
Nathan Chancellor <[email protected]>
crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
Christophe Leroy <[email protected]>
powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
Zhang Qilong <[email protected]>
spi: mxs: fix reference leak in mxs_spi_probe
Yang Yingliang <[email protected]>
usb/max3421: fix return error code in max3421_probe()
Dmitry Torokhov <[email protected]>
Input: ads7846 - fix unaligned access on 7845
Oleksij Rempel <[email protected]>
Input: ads7846 - fix integer overflow on Rt calculation
David Jander <[email protected]>
Input: ads7846 - fix race that causes missing releases
Yang Yingliang <[email protected]>
drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
Yang Yingliang <[email protected]>
video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
Qinglang Miao <[email protected]>
media: solo6x10: fix missing snd_card_free in error handling case
Martin Wilck <[email protected]>
scsi: core: Fix VPD LUN ID designator priorities
Jerome Brunet <[email protected]>
ASoC: meson: fix COMPILE_TEST error
Yu Kuai <[email protected]>
media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
Colin Ian King <[email protected]>
media: tm6000: Fix sizeof() mismatches
Jing Xiangfeng <[email protected]>
staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
Zhang Qilong <[email protected]>
staging: greybus: codecs: Fix reference counter leak in error handling
Jack Xu <[email protected]>
crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
Necip Fazil Yildiran <[email protected]>
MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
Arnd Bergmann <[email protected]>
RDMa/mthca: Work around -Wenum-conversion warning
Zhang Qilong <[email protected]>
ASoC: arizona: Fix a wrong free in wm8997_probe
Vincent Bernat <[email protected]>
net: evaluate net.ipv4.conf.all.proxy_arp_pvlan
Vincent Bernat <[email protected]>
net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
Zhang Qilong <[email protected]>
ASoC: wm8998: Fix PM disable depth imbalance on error
Tsuchiya Yuto <[email protected]>
mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
Qinglang Miao <[email protected]>
spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
Zhang Qilong <[email protected]>
spi: tegra114: fix reference leak in tegra spi ops
Zhang Qilong <[email protected]>
spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
Zhang Qilong <[email protected]>
spi: tegra20-slink: fix reference leak in slink ops of tegra20
Zhang Qilong <[email protected]>
spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
Anant Thazhemadam <[email protected]>
Bluetooth: hci_h5: fix memory leak in h5_close
Anmol Karn <[email protected]>
Bluetooth: Fix null pointer dereference in hci_event_packet()
Paweł Chmiel <[email protected]>
arm64: dts: exynos: Correct psci compatible used on Exynos7
Paweł Chmiel <[email protected]>
arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
Paul Moore <[email protected]>
selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
Cezary Rojewski <[email protected]>
ASoC: pcm: DRAIN support reactivation
Dmitry Baryshkov <[email protected]>
drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
Zhang Qilong <[email protected]>
spi: img-spfi: fix reference leak in img_spfi_resume
Jordan Niethe <[email protected]>
powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
Arnd Bergmann <[email protected]>
drm/amdgpu: fix build_coefficients() argument
Colin Ian King <[email protected]>
crypto: inside-secure - Fix sizeof() mismatch
Christophe Leroy <[email protected]>
crypto: talitos - Fix return type of current_desc_hdr()
Christophe Leroy <[email protected]>
crypto: talitos - Endianess in current_desc_hdr()
Thomas Gleixner <[email protected]>
sched: Reenable interrupts in do_sched_yield()
Peng Liu <[email protected]>
sched/deadline: Fix sched_dl_global_validate()
David Woodhouse <[email protected]>
x86/apic: Fix x2apic enablement without interrupt remapping
Ard Biesheuvel <[email protected]>
ARM: p2v: fix handling of LPAE translation in BE mode
Arvind Sankar <[email protected]>
x86/mm/ident_map: Check for errors from ident_pud_init()
Bob Pearson <[email protected]>
RDMA/rxe: Compute PSN windows correctly
Joel Stanley <[email protected]>
ARM: dts: aspeed: s2600wf: Fix VGA memory region location
Tianyue Ren <[email protected]>
selinux: fix error initialization in inode_doinit_with_dentry()
Kamal Heib <[email protected]>
RDMA/bnxt_re: Set queue pair state when being queried
Douglas Anderson <[email protected]>
soc: qcom: geni: More properly switch to DMA mode
Nicolas Boichat <[email protected]>
soc: mediatek: Check if power domains can be powered on at boot time
Dan Carpenter <[email protected]>
soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
Krzysztof Kozlowski <[email protected]>
drm/tve200: Fix handling of platform_get_irq() error
Tom Rix <[email protected]>
drm/gma500: fix double free of gma_connector
Leo Yan <[email protected]>
perf cs-etm: Move definition of 'traceid_list' global variable from header file
Leo Yan <[email protected]>
perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata
Dae R. Jeong <[email protected]>
md: fix a warning caused by a race between concurrent md_ioctl()s
Eric Biggers <[email protected]>
crypto: af_alg - avoid undefined behavior accessing salg_name
Antti Palosaari <[email protected]>
media: msi2500: assign SPI bus number dynamically
Jan Kara <[email protected]>
quota: Sanity-check quota file headers on load
Peilin Ye <[email protected]>
Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
Alexey Kardashevskiy <[email protected]>
serial_core: Check for port state when tty is in error state
Julian Sax <[email protected]>
HID: i2c-hid: add Vero K147 to descriptor override
Arnd Bergmann <[email protected]>
scsi: megaraid_sas: Check user-provided offsets
Mao Jinlong <[email protected]>
coresight: tmc-etr: Check if page is valid before dma_map_page()
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
Fabio Estevam <[email protected]>
usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
Will McVicker <[email protected]>
USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
Jack Pham <[email protected]>
usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
Will McVicker <[email protected]>
USB: gadget: f_midi: setup SuperSpeed Plus descriptors
taehyun.cho <[email protected]>
USB: gadget: f_acm: add support for SuperSpeed Plus
Johan Hovold <[email protected]>
USB: serial: option: add interface-number sanity check to flag handling
Nicolin Chen <[email protected]>
soc/tegra: fuse: Fix index bug in get_process_id
Thomas Gleixner <[email protected]>
dm table: Remove BUG_ON(in_interrupt())
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Increase IOCInit request timeout to 30s
Sven Eckelmann <[email protected]>
vxlan: Copy needed_tailroom from lowerdev
Sven Eckelmann <[email protected]>
vxlan: Add needed_headroom for lower device
Mark Rutland <[email protected]>
arm64: syscall: exit userspace before unmasking exceptions
Qinglang Miao <[email protected]>
drm/tegra: sor: Disable clocks on error in tegra_sor_init()
Nicholas Piggin <[email protected]>
kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
Deepak R Varma <[email protected]>
drm/tegra: replace idr_init() by idr_init_base()
Björn Töpel <[email protected]>
ixgbe: avoid premature Rx buffer reuse
Leon Romanovsky <[email protected]>
RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
Toke Høiland-Jørgensen <[email protected]>
selftests/bpf/test_offload.py: Reset ethtool features after failed setting
Chunyan Zhang <[email protected]>
gpio: eic-sprd: break loop when getting NULL device resource
Subash Abhinov Kasiviswanathan <[email protected]>
netfilter: x_tables: Switch synchronization to RCU
Johannes Thumshirn <[email protected]>
block: factor out requeue handling from dispatch code
Geert Uytterhoeven <[email protected]>
clk: renesas: r9a06g032: Drop __packed for portability
Zhang Qilong <[email protected]>
can: softing: softing_netdev_open(): fix error handling
Luc Van Oostenryck <[email protected]>
xsk: Fix xsk_poll()'s return type
Randy Dunlap <[email protected]>
scsi: bnx2i: Requires MMU
Baruch Siach <[email protected]>
gpio: mvebu: fix potential user-after-free on probe
Icenowy Zheng <[email protected]>
ARM: dts: sun8i: v3s: fix GIC node memory range
Andy Shevchenko <[email protected]>
pinctrl: baytrail: Avoid clearing debounce value when turning it off
Andy Shevchenko <[email protected]>
pinctrl: merrifield: Set default bias in case no particular value given
Xiaochen Shen <[email protected]>
x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled
James Morse <[email protected]>
x86/resctrl: Remove unused struct mbm_state::chunks_bw
Fangrui Song <[email protected]>
arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S
Vincenzo Frascino <[email protected]>
arm64: lse: Fix LSE atomics with LLVM
Sami Tolvanen <[email protected]>
arm64: lse: fix LSE atomics with LLVM's integrated assembler
Xin Xiong <[email protected]>
drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
Oleksandr Andrushchenko <[email protected]>
drm/xen-front: Fix misused IS_ERR_OR_NULL checks
Alexander Sverdlin <[email protected]>
serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Fix potential out-of-bounds shift
Thomas Gleixner <[email protected]>
USB: sisusbvga: Make console support depend on BROKEN
Oliver Neukum <[email protected]>
USB: UAS: introduce a quirk to set no_write_same
Li Jun <[email protected]>
xhci: Give USB2 ports time to enter U3 in bus suspend
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix control 'access overflow' errors from chmap
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential out-of-bounds shift
Oliver Neukum <[email protected]>
USB: add RESET_RESUME quirk for Snapscan 1212
Bui Quang Minh <[email protected]>
USB: dummy-hcd: Fix uninitialized array use in init()
Steven Rostedt (VMware) <[email protected]>
ktest.pl: If size of log is too big to email, email error message
Zhang Changzhong <[email protected]>
net: bridge: vlan: fix error return code in __vlan_add()
Martin Blumenstingl <[email protected]>
net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
Fugang Duan <[email protected]>
net: stmmac: delete the eee_ctrl_timer after napi disabled
Moshe Shemesh <[email protected]>
net/mlx4_en: Handle TX error CQE
Sergej Bauer <[email protected]>
lan743x: fix for potential NULL pointer dereference with bare card
Moshe Shemesh <[email protected]>
net/mlx4_en: Avoid scheduling restart task if it is already running
Neal Cardwell <[email protected]>
tcp: fix cwnd-limited bug for TSO deferral where we send nothing
Eric Dumazet <[email protected]>
tcp: select sane initial rcvq_space.space for big MSS
Fugang Duan <[email protected]>
net: stmmac: free tx skb buffer in stmmac_resume()
Eric Dumazet <[email protected]>
mac80211: mesh: fix mesh_pathtbl_init() error path
Ansuel Smith <[email protected]>
PCI: qcom: Add missing reset for ipq806x
Arvind Sankar <[email protected]>
compiler.h: fix barrier_data() on clang
Thomas Gleixner <[email protected]>
x86/apic/vector: Fix ordering in vector assignment
Andy Lutomirski <[email protected]>
x86/membarrier: Get rid of a dubious optimization
Arvind Sankar <[email protected]>
x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
Dan Carpenter <[email protected]>
scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
Arnd Bergmann <[email protected]>
kbuild: avoid static_assert for genksyms
Bean Huo <[email protected]>
mmc: block: Fixup condition for CMD13 polling for RPMB requests
Coiby Xu <[email protected]>
pinctrl: amd: remove debounce filter setting in IRQ type setting
Chris Chiu <[email protected]>
Input: i8042 - add Acer laptops to the i8042 reset list
Dmitry Torokhov <[email protected]>
Input: cm109 - do not stomp on control URB
Max Verevkin <[email protected]>
platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
Timo Witte <[email protected]>
platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE
Hans de Goede <[email protected]>
platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen
Hans de Goede <[email protected]>
platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e
Hao Si <[email protected]>
soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
Xu Qiang <[email protected]>
irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend
Can Guo <[email protected]>
scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
Vineet Gupta <[email protected]>
ARC: stack unwinding: don't assume non-current task is sleeping
Michael Ellerman <[email protected]>
powerpc: Drop -me200 addition to build flags
Sara Sharon <[email protected]>
iwlwifi: mvm: fix kernel panic in case of assert during CSA
Markus Reichl <[email protected]>
arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
Johannes Berg <[email protected]>
iwlwifi: pcie: limit memory read spin time
Nathan Chancellor <[email protected]>
spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
Lukas Wunner <[email protected]>
spi: bcm2835aux: Fix use-after-free on unbind
Fangrui Song <[email protected]>
x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S
Nick Desaulniers <[email protected]>
Kbuild: do not emit debug info for assembly with LLVM_IAS=1
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 1 +
Documentation/networking/ip-sysctl.txt | 3 +
Makefile | 7 +-
arch/arc/kernel/stacktrace.c | 23 ++--
arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 -
arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts | 4 +-
arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 ++
arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 ++
arch/arm/boot/dts/at91sam9rl.dtsi | 19 ++--
arch/arm/boot/dts/exynos5410-odroidxu.dts | 6 +-
arch/arm/boot/dts/exynos5410-pinctrl.dtsi | 28 +++++
arch/arm/boot/dts/exynos5410.dtsi | 4 +
arch/arm/boot/dts/omap4-panda-es.dts | 2 +-
arch/arm/boot/dts/sama5d2.dtsi | 7 +-
arch/arm/boot/dts/sun8i-v3s.dtsi | 2 +-
arch/arm/kernel/head.S | 6 +-
arch/arm/mach-shmobile/pm-rmobile.c | 1 +
arch/arm/mach-sunxi/sunxi.c | 1 +
.../boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
arch/arm64/boot/dts/exynos/exynos7.dtsi | 12 +-
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 1 +
arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 +--
arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 +
arch/arm64/include/asm/atomic_lse.h | 76 +++++++++----
arch/arm64/include/asm/kvm_host.h | 1 +
arch/arm64/include/asm/lse.h | 6 +-
arch/arm64/kernel/syscall.c | 2 +-
arch/arm64/kvm/sys_regs.c | 1 +
arch/arm64/lib/memcpy.S | 3 +-
arch/arm64/lib/memmove.S | 3 +-
arch/arm64/lib/memset.S | 3 +-
arch/mips/bcm47xx/Kconfig | 1 +
arch/powerpc/Makefile | 1 -
arch/powerpc/include/asm/book3s/32/pgtable.h | 4 +-
arch/powerpc/include/asm/cputable.h | 5 -
arch/powerpc/include/asm/nohash/pgtable.h | 4 +-
arch/powerpc/kernel/head_64.S | 8 +-
arch/powerpc/kernel/rtas.c | 2 +-
arch/powerpc/kernel/setup-common.c | 4 +-
arch/powerpc/perf/core-book3s.c | 10 ++
arch/powerpc/platforms/powernv/memtrace.c | 44 +++++--
arch/powerpc/platforms/pseries/suspend.c | 4 -
arch/powerpc/xmon/nonstdio.c | 2 +-
arch/s390/kernel/smp.c | 18 +--
arch/s390/purgatory/head.S | 9 +-
arch/um/drivers/chan_user.c | 4 +-
arch/um/drivers/xterm.c | 5 +
arch/um/os-Linux/irq.c | 2 +-
arch/x86/include/asm/apic.h | 1 +
arch/x86/include/asm/pgtable_types.h | 1 +
arch/x86/include/asm/sync_core.h | 9 +-
arch/x86/kernel/apic/apic.c | 14 ++-
arch/x86/kernel/apic/vector.c | 24 ++--
arch/x86/kernel/apic/x2apic_phys.c | 9 ++
arch/x86/kernel/cpu/intel_rdt.h | 2 -
arch/x86/kernel/cpu/intel_rdt_monitor.c | 7 +-
arch/x86/kernel/kprobes/core.c | 5 +
arch/x86/lib/memcpy_64.S | 6 +-
arch/x86/lib/memmove_64.S | 4 +-
arch/x86/lib/memset_64.S | 6 +-
arch/x86/mm/ident_map.c | 12 +-
arch/x86/mm/mem_encrypt_identity.c | 4 +-
arch/x86/mm/tlb.c | 10 +-
block/blk-mq.c | 29 +++--
crypto/af_alg.c | 10 +-
crypto/ecdh.c | 9 +-
drivers/acpi/acpi_pnp.c | 3 +
drivers/acpi/device_pm.c | 41 ++-----
drivers/acpi/resource.c | 2 +-
drivers/block/xen-blkback/xenbus.c | 4 +-
drivers/bluetooth/hci_h5.c | 3 +
drivers/bus/fsl-mc/fsl-mc-allocator.c | 4 +-
drivers/bus/mips_cdmm.c | 4 +-
drivers/clk/clk-s2mps11.c | 1 +
drivers/clk/mvebu/armada-37xx-xtal.c | 4 +-
drivers/clk/renesas/r9a06g032-clocks.c | 2 +-
drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 +
drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 1 +
drivers/clk/tegra/clk-id.h | 1 +
drivers/clk/tegra/clk-tegra-periph.c | 2 +-
drivers/clk/ti/fapll.c | 11 +-
drivers/clocksource/arm_arch_timer.c | 23 ++--
drivers/clocksource/cadence_ttc_timer.c | 18 +--
drivers/cpufreq/highbank-cpufreq.c | 7 ++
drivers/cpufreq/loongson1-cpufreq.c | 1 +
drivers/cpufreq/mediatek-cpufreq.c | 1 +
drivers/cpufreq/scpi-cpufreq.c | 1 +
drivers/cpufreq/sti-cpufreq.c | 7 ++
drivers/crypto/amcc/crypto4xx_core.c | 2 +-
drivers/crypto/inside-secure/safexcel.c | 2 +-
drivers/crypto/omap-aes.c | 3 +-
drivers/crypto/qat/qat_common/qat_hal.c | 2 +-
drivers/crypto/talitos.c | 10 +-
drivers/dma/mv_xor_v2.c | 4 +-
drivers/edac/amd64_edac.c | 26 +++--
drivers/extcon/extcon-max77693.c | 2 +-
drivers/gpio/gpio-eic-sprd.c | 2 +-
drivers/gpio/gpio-mvebu.c | 16 ++-
.../drm/amd/display/modules/color/color_gamma.c | 2 +-
drivers/gpu/drm/drm_dp_aux_dev.c | 2 +-
drivers/gpu/drm/drm_dp_mst_topology.c | 7 +-
drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++
drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
drivers/gpu/drm/tegra/drm.c | 2 +-
drivers/gpu/drm/tegra/sor.c | 10 +-
drivers/gpu/drm/tve200/tve200_drv.c | 4 +-
drivers/gpu/drm/xen/xen_drm_front.c | 2 +-
drivers/gpu/drm/xen/xen_drm_front_gem.c | 8 +-
drivers/gpu/drm/xen/xen_drm_front_kms.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++
drivers/hsi/controllers/omap_ssi_core.c | 2 +-
drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +
drivers/iio/adc/rockchip_saradc.c | 2 +-
drivers/iio/imu/bmi160/bmi160_core.c | 4 +-
drivers/iio/industrialio-buffer.c | 6 +-
drivers/iio/light/rpr0521.c | 17 ++-
drivers/iio/light/st_uvis25.h | 5 +
drivers/iio/light/st_uvis25_core.c | 8 +-
drivers/iio/pressure/mpl3115.c | 9 +-
drivers/infiniband/core/cm.c | 2 +
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
drivers/infiniband/hw/cxgb4/cq.c | 3 +
drivers/infiniband/hw/mthca/mthca_cq.c | 2 +-
drivers/infiniband/hw/mthca/mthca_dev.h | 1 -
drivers/infiniband/sw/rxe/rxe_req.c | 3 +-
drivers/input/keyboard/cros_ec_keyb.c | 1 +
drivers/input/keyboard/omap4-keypad.c | 89 +++++++++------
drivers/input/misc/cm109.c | 7 +-
drivers/input/mouse/cyapa_gen6.c | 2 +-
drivers/input/serio/i8042-x86ia64io.h | 42 +++++++
drivers/input/touchscreen/ads7846.c | 52 +++++----
drivers/input/touchscreen/goodix.c | 12 ++
drivers/irqchip/irq-alpine-msi.c | 3 +-
drivers/irqchip/irq-gic-v3-its.c | 16 +--
drivers/md/dm-ioctl.c | 1 +
drivers/md/dm-table.c | 6 -
drivers/md/md-cluster.c | 67 ++++++-----
drivers/md/md.c | 21 +++-
drivers/media/common/siano/smsdvb-main.c | 5 +-
drivers/media/i2c/max2175.c | 2 +-
drivers/media/pci/intel/ipu3/ipu3-cio2.c | 62 +++++-----
drivers/media/pci/intel/ipu3/ipu3-cio2.h | 1 +
drivers/media/pci/netup_unidvb/netup_unidvb_spi.c | 5 +-
drivers/media/pci/saa7146/mxb.c | 19 ++--
drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
.../media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 +
drivers/media/rc/sunxi-cir.c | 2 +
drivers/media/usb/gspca/gspca.c | 1 +
drivers/media/usb/msi2500/msi2500.c | 2 +-
drivers/media/usb/tm6000/tm6000-video.c | 5 +-
drivers/memstick/core/memstick.c | 1 -
drivers/memstick/host/r592.c | 12 +-
drivers/mmc/core/block.c | 2 +-
drivers/mtd/cmdlinepart.c | 14 ++-
drivers/mtd/nand/raw/qcom_nandc.c | 2 +
drivers/mtd/nand/spi/core.c | 4 +
drivers/net/can/softing/softing_main.c | 9 +-
drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 ++--
drivers/net/ethernet/korina.c | 2 +-
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 21 ++--
drivers/net/ethernet/mellanox/mlx4/en_tx.c | 40 +++++--
drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 12 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +-
drivers/net/ethernet/microchip/lan743x_ethtool.c | 9 +-
drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 +
.../net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 6 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 27 ++++-
drivers/net/vxlan.c | 3 +
drivers/net/wireless/ath/ath10k/usb.c | 7 +-
drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +-
drivers/net/wireless/ath/ath10k/wmi.c | 9 +-
drivers/net/wireless/ath/ath10k/wmi.h | 1 +
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 36 ++++--
.../net/wireless/intersil/orinoco/orinoco_usb.c | 14 +--
drivers/net/wireless/marvell/mwifiex/main.c | 2 +
drivers/net/wireless/st/cw1200/main.c | 2 +
drivers/net/xen-netback/xenbus.c | 6 +-
drivers/nfc/s3fwrn5/firmware.c | 4 +-
drivers/nvdimm/label.c | 13 ++-
drivers/pci/controller/dwc/pcie-qcom.c | 12 ++
drivers/pci/controller/pcie-iproc.c | 10 +-
drivers/pci/pci-acpi.c | 4 +-
drivers/pci/pci.c | 14 ++-
drivers/pci/slot.c | 6 +-
drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +-
drivers/pinctrl/intel/pinctrl-merrifield.c | 8 ++
drivers/pinctrl/pinctrl-amd.c | 7 --
drivers/pinctrl/pinctrl-falcon.c | 14 ++-
drivers/pinctrl/sunxi/pinctrl-sunxi.c | 6 +-
drivers/platform/x86/acer-wmi.c | 1 +
drivers/platform/x86/dell-smbios-base.c | 1 +
drivers/platform/x86/intel-vbtn.c | 12 ++
drivers/platform/x86/mlx-platform.c | 16 +--
drivers/platform/x86/thinkpad_acpi.c | 10 +-
drivers/power/supply/axp288_charger.c | 28 +++--
drivers/power/supply/bq24190_charger.c | 20 +++-
drivers/ps3/ps3stor_lib.c | 2 +-
drivers/pwm/pwm-lp3943.c | 1 +
drivers/pwm/pwm-zx.c | 1 +
drivers/s390/block/dasd_alias.c | 22 +++-
drivers/scsi/be2iscsi/be_main.c | 4 +-
drivers/scsi/bnx2i/Kconfig | 1 +
drivers/scsi/fnic/fnic_main.c | 1 +
drivers/scsi/lpfc/lpfc_mem.c | 6 +-
drivers/scsi/lpfc/lpfc_sli.c | 10 +-
drivers/scsi/megaraid/megaraid_sas_base.c | 16 ++-
drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
drivers/scsi/pm8001/pm8001_init.c | 3 +-
drivers/scsi/qedi/qedi_main.c | 4 +-
drivers/scsi/scsi_lib.c | 126 ++++++++++++++-------
drivers/scsi/ufs/ufshcd.c | 7 ++
drivers/slimbus/qcom-ngd-ctrl.c | 6 +
drivers/soc/fsl/dpio/dpio-driver.c | 5 +-
drivers/soc/mediatek/mtk-scpsys.c | 5 +-
drivers/soc/qcom/qcom-geni-se.c | 17 ++-
drivers/soc/qcom/smp2p.c | 5 +-
drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +-
drivers/soc/ti/knav_dma.c | 13 ++-
drivers/soc/ti/knav_qmss_queue.c | 4 +-
drivers/spi/spi-bcm2835aux.c | 17 +--
drivers/spi/spi-bcm63xx-hsspi.c | 4 +-
drivers/spi/spi-davinci.c | 2 +-
drivers/spi/spi-img-spfi.c | 4 +-
drivers/spi/spi-mxs.c | 1 +
drivers/spi/spi-pic32.c | 1 +
drivers/spi/spi-rb4xx.c | 2 +-
drivers/spi/spi-sc18is602.c | 13 +--
drivers/spi/spi-sh.c | 13 +--
drivers/spi/spi-st-ssc4.c | 5 +-
drivers/spi/spi-tegra114.c | 2 +
drivers/spi/spi-tegra20-sflash.c | 1 +
drivers/spi/spi-tegra20-slink.c | 2 +
drivers/spi/spi-ti-qspi.c | 1 +
drivers/spi/spi.c | 19 ++--
drivers/staging/comedi/drivers/mf6x4.c | 3 +-
drivers/staging/gasket/gasket_interrupt.c | 15 ++-
drivers/staging/greybus/audio_codec.c | 2 +
drivers/staging/mt7621-spi/spi-mt7621.c | 2 +
drivers/staging/speakup/speakup_dectlk.c | 2 +-
drivers/tty/serial/8250/8250_omap.c | 5 -
drivers/tty/serial/serial_core.c | 4 +
drivers/usb/chipidea/ci_hdrc_imx.c | 3 +-
drivers/usb/core/quirks.c | 3 +
drivers/usb/gadget/function/f_acm.c | 2 +-
drivers/usb/gadget/function/f_fs.c | 5 +-
drivers/usb/gadget/function/f_midi.c | 6 +
drivers/usb/gadget/function/f_rndis.c | 4 +-
drivers/usb/gadget/udc/dummy_hcd.c | 2 +-
drivers/usb/host/ehci-omap.c | 1 +
drivers/usb/host/max3421-hcd.c | 3 +-
drivers/usb/host/oxu210hp-hcd.c | 4 +-
drivers/usb/host/xhci-hub.c | 4 +
drivers/usb/misc/sisusbvga/Kconfig | 2 +-
drivers/usb/serial/digi_acceleport.c | 45 +++-----
drivers/usb/serial/keyspan_pda.c | 63 ++++++-----
drivers/usb/serial/mos7720.c | 2 +
drivers/usb/serial/option.c | 23 +++-
drivers/usb/storage/uas.c | 3 +
drivers/usb/storage/unusual_uas.h | 7 +-
drivers/usb/storage/usb.c | 3 +
drivers/vfio/pci/vfio_pci.c | 4 +-
drivers/video/fbdev/atmel_lcdfb.c | 2 +-
drivers/watchdog/Kconfig | 3 +-
drivers/watchdog/qcom-wdt.c | 2 +-
drivers/watchdog/sprd_wdt.c | 34 +++---
drivers/watchdog/watchdog_core.c | 22 ++--
drivers/xen/xen-pciback/xenbus.c | 2 +-
drivers/xen/xenbus/xenbus.h | 2 +
drivers/xen/xenbus/xenbus_client.c | 8 +-
drivers/xen/xenbus/xenbus_probe.c | 1 +
drivers/xen/xenbus/xenbus_probe_backend.c | 7 ++
drivers/xen/xenbus/xenbus_xs.c | 34 ++++--
fs/ceph/caps.c | 11 +-
fs/cifs/smb2ops.c | 3 +-
fs/cifs/smb2pdu.c | 7 +-
fs/cifs/smb2pdu.h | 14 ++-
fs/ext4/inode.c | 19 +++-
fs/ext4/mballoc.c | 1 +
fs/jffs2/readinode.c | 16 +++
fs/jfs/jfs_dmap.h | 2 +-
fs/lockd/host.c | 20 ++--
fs/nfs/inode.c | 2 +-
fs/nfs/nfs4proc.c | 10 +-
fs/nfs_common/grace.c | 6 +-
fs/nfsd/nfssvc.c | 3 +-
fs/quota/quota_v2.c | 19 ++++
fs/ubifs/io.c | 13 ++-
include/acpi/acpi_bus.h | 5 -
include/linux/build_bug.h | 5 +
include/linux/compiler-clang.h | 1 -
include/linux/compiler-gcc.h | 19 ----
include/linux/compiler.h | 18 ++-
include/linux/inetdevice.h | 4 +-
include/linux/netfilter/x_tables.h | 5 +-
include/linux/security.h | 2 +-
include/linux/seq_buf.h | 2 +-
include/linux/sunrpc/xprt.h | 1 +
include/linux/trace_seq.h | 4 +-
include/linux/usb_usual.h | 2 +
include/uapi/linux/if_alg.h | 16 +++
include/xen/xenbus.h | 15 ++-
kernel/cpu.c | 6 +-
kernel/irq/irqdomain.c | 11 +-
kernel/sched/core.c | 6 +-
kernel/sched/deadline.c | 5 +-
kernel/sched/sched.h | 42 +++----
net/bluetooth/hci_event.c | 17 +--
net/bridge/br_vlan.c | 4 +-
net/core/lwt_bpf.c | 8 +-
net/ipv4/netfilter/arp_tables.c | 14 +--
net/ipv4/netfilter/ip_tables.c | 14 +--
net/ipv4/tcp_input.c | 3 +-
net/ipv4/tcp_output.c | 9 +-
net/ipv6/netfilter/ip6_tables.c | 14 +--
net/mac80211/mesh_pathtbl.c | 4 +-
net/mac80211/vht.c | 14 ++-
net/netfilter/x_tables.c | 49 +++-----
net/sunrpc/xprt.c | 65 ++++++++---
net/sunrpc/xprtrdma/module.c | 1 +
net/sunrpc/xprtrdma/transport.c | 1 +
net/sunrpc/xprtsock.c | 4 +
net/wireless/nl80211.c | 2 +-
net/xdp/xsk.c | 8 +-
samples/bpf/lwt_len_hist.sh | 2 +
samples/bpf/test_lwt_bpf.sh | 0
scripts/checkpatch.pl | 2 +-
scripts/kconfig/preprocess.c | 2 +-
security/integrity/ima/ima_crypto.c | 20 +---
security/selinux/hooks.c | 16 ++-
sound/core/oss/pcm_oss.c | 28 +++--
sound/pci/hda/hda_codec.c | 2 +-
sound/pci/hda/hda_sysfs.c | 2 +-
sound/pci/hda/patch_ca0132.c | 2 +-
sound/pci/hda/patch_realtek.c | 4 +
sound/soc/codecs/wm8997.c | 2 +
sound/soc/codecs/wm8998.c | 4 +-
sound/soc/codecs/wm_adsp.c | 5 +-
sound/soc/jz4740/jz4740-i2s.c | 4 +
sound/soc/meson/Kconfig | 2 +-
sound/soc/soc-pcm.c | 2 +
sound/usb/clock.c | 6 +
sound/usb/format.c | 2 +
sound/usb/quirks.c | 1 +
sound/usb/stream.c | 6 +-
tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 8 +-
tools/perf/util/cs-etm.c | 29 ++++-
tools/perf/util/cs-etm.h | 10 +-
tools/perf/util/parse-regs-options.c | 2 +-
tools/testing/ktest/ktest.pl | 7 +-
tools/testing/selftests/bpf/test_offload.py | 1 +
354 files changed, 2093 insertions(+), 1109 deletions(-)
From: Dan Carpenter <[email protected]>
commit eeaf06af6f87e1dba371fbe42674e6f963220b9c upstream.
My patch caused kernel Oopses and delays in boot. Revert it.
The problem was that I moved the "mem->dma = paddr;" before the call to
be_fill_queue(). But the first thing that the be_fill_queue() function
does is memset the whole struct to zero which overwrites the assignment.
Link: https://lore.kernel.org/r/X8jXkt6eThjyVP1v@mwanda
Fixes: 38b2db564d9a ("scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()")
Cc: stable <[email protected]>
Reported-by: Thomas Lamprecht <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/scsi/be2iscsi/be_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -3039,7 +3039,6 @@ static int beiscsi_create_eqs(struct bei
goto create_eq_error;
}
- mem->dma = paddr;
mem->va = eq_vaddress;
ret = be_fill_queue(eq, phba->params.num_eq_entries,
sizeof(struct be_eq_entry), eq_vaddress);
@@ -3049,6 +3048,7 @@ static int beiscsi_create_eqs(struct bei
goto create_eq_error;
}
+ mem->dma = paddr;
ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
BEISCSI_EQ_DELAY_DEF);
if (ret) {
@@ -3105,7 +3105,6 @@ static int beiscsi_create_cqs(struct bei
goto create_cq_error;
}
- mem->dma = paddr;
ret = be_fill_queue(cq, phba->params.num_cq_entries,
sizeof(struct sol_cqe), cq_vaddress);
if (ret) {
@@ -3115,6 +3114,7 @@ static int beiscsi_create_cqs(struct bei
goto create_cq_error;
}
+ mem->dma = paddr;
ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false,
false, 0);
if (ret) {
From: Xin Xiong <[email protected]>
commit a34a0a632dd991a371fec56431d73279f9c54029 upstream
drm_dp_mst_allocate_vcpi() invokes
drm_dp_mst_topology_get_port_validated(), which increases the refcount
of the "port".
These reference counting issues take place in two exception handling
paths separately. Either when “slots” is less than 0 or when
drm_dp_init_vcpi() returns a negative value, the function forgets to
reduce the refcnt increased drm_dp_mst_topology_get_port_validated(),
which results in a refcount leak.
Fix these issues by pulling up the error handling when "slots" is less
than 0, and calling drm_dp_mst_topology_put_port() before termination
when drm_dp_init_vcpi() returns a negative value.
Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi")
Cc: <[email protected]> # v4.12+
Signed-off-by: Xiyu Yang <[email protected]>
Signed-off-by: Xin Tan <[email protected]>
Signed-off-by: Xin Xiong <[email protected]>
Reviewed-by: Lyude Paul <[email protected]>
Signed-off-by: Lyude Paul <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine
[sudip: use old functions before rename]
Signed-off-by: Sudip Mukherjee <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2706,11 +2706,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm
{
int ret;
- port = drm_dp_get_validated_port_ref(mgr, port);
- if (!port)
+ if (slots < 0)
return false;
- if (slots < 0)
+ port = drm_dp_get_validated_port_ref(mgr, port);
+ if (!port)
return false;
if (port->vcpi.vcpi > 0) {
@@ -2725,6 +2725,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm
if (ret) {
DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
+ drm_dp_put_port(port);
goto out;
}
DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",
From: Takashi Iwai <[email protected]>
commit c6dde8ffd071aea9d1ce64279178e470977b235c upstream.
The current channel-map control implementation in USB-audio driver may
lead to an error message like
"control 3:0:0:Playback Channel Map:0: access overflow"
when CONFIG_SND_CTL_VALIDATION is set. It's because the chmap get
callback clears the whole array no matter which count is set, and
rather the false-positive detection.
This patch fixes the problem by clearing only the needed array range
at usb_chmap_ctl_get().
Cc: <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
sound/usb/stream.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -198,16 +198,16 @@ static int usb_chmap_ctl_get(struct snd_
struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
struct snd_usb_substream *subs = info->private_data;
struct snd_pcm_chmap_elem *chmap = NULL;
- int i;
+ int i = 0;
- memset(ucontrol->value.integer.value, 0,
- sizeof(ucontrol->value.integer.value));
if (subs->cur_audiofmt)
chmap = subs->cur_audiofmt->chmap;
if (chmap) {
for (i = 0; i < chmap->channels; i++)
ucontrol->value.integer.value[i] = chmap->map[i];
}
+ for (; i < subs->channels_max; i++)
+ ucontrol->value.integer.value[i] = 0;
return 0;
}
From: taehyun.cho <[email protected]>
commit 3ee05c20656782387aa9eb010fdb9bb16982ac3f upstream.
Setup the SuperSpeed Plus descriptors for f_acm. This allows the gadget
to work properly without crashing at SuperSpeed rates.
Cc: Felipe Balbi <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: taehyun.cho <[email protected]>
Signed-off-by: Will McVicker <[email protected]>
Reviewed-by: Peter Chen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/gadget/function/f_acm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -684,7 +684,7 @@ acm_bind(struct usb_configuration *c, st
acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
- acm_ss_function, NULL);
+ acm_ss_function, acm_ss_function);
if (status)
goto fail;
From: Will McVicker <[email protected]>
commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream.
Needed for SuperSpeed Plus support for f_midi. This allows the
gadget to work properly without crashing at SuperSpeed rates.
Cc: Felipe Balbi <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Will McVicker <[email protected]>
Reviewed-by: Peter Chen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/gadget/function/f_midi.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_config
f->ss_descriptors = usb_copy_descriptors(midi_function);
if (!f->ss_descriptors)
goto fail_f_midi;
+
+ if (gadget_is_superspeed_plus(c->cdev->gadget)) {
+ f->ssp_descriptors = usb_copy_descriptors(midi_function);
+ if (!f->ssp_descriptors)
+ goto fail_f_midi;
+ }
}
kfree(midi_function);
From: Jordan Niethe <[email protected]>
[ Upstream commit 3c0b976bf20d236c57adcefa80f86a0a1d737727 ]
Currently in generic_secondary_smp_init(), cur_cpu_spec->cpu_restore()
is called before a stack has been set up in r1. This was previously fine
as the cpu_restore() functions were implemented in assembly and did not
use a stack. However commit 5a61ef74f269 ("powerpc/64s: Support new
device tree binding for discovering CPU features") used
__restore_cpu_cpufeatures() as the cpu_restore() function for a
device-tree features based cputable entry. This is a C function and
hence uses a stack in r1.
generic_secondary_smp_init() is entered on the secondary cpus via the
primary cpu using the OPAL call opal_start_cpu(). In OPAL, each hardware
thread has its own stack. The OPAL call is ran in the primary's hardware
thread. During the call, a job is scheduled on a secondary cpu that will
start executing at the address of generic_secondary_smp_init(). Hence
the value that will be left in r1 when the secondary cpu enters the
kernel is part of that secondary cpu's individual OPAL stack. This means
that __restore_cpu_cpufeatures() will write to that OPAL stack. This is
not horribly bad as each hardware thread has its own stack and the call
that enters the kernel from OPAL never returns, but it is still wrong
and should be corrected.
Create the temp kernel stack before calling cpu_restore().
As noted by mpe, for a kexec boot, the secondary CPUs are released from
the spin loop at address 0x60 by smp_release_cpus() and then jump to
generic_secondary_smp_init(). The call to smp_release_cpus() is in
setup_arch(), and it comes before the call to emergency_stack_init().
emergency_stack_init() allocates an emergency stack in the PACA for each
CPU. This address in the PACA is what is used to set up the temp kernel
stack in generic_secondary_smp_init(). Move releasing the secondary CPUs
to after the PACAs have been allocated an emergency stack, otherwise the
PACA stack pointer will contain garbage and hence the temp kernel stack
created from it will be broken.
Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
Signed-off-by: Jordan Niethe <[email protected]>
Signed-off-by: Michael Ellerman <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/powerpc/kernel/head_64.S | 8 ++++----
arch/powerpc/kernel/setup-common.c | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 389da790c1296..4f7b225d78cff 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -423,6 +423,10 @@ generic_secondary_common_init:
/* From now on, r24 is expected to be logical cpuid */
mr r24,r5
+ /* Create a temp kernel stack for use before relocation is on. */
+ ld r1,PACAEMERGSP(r13)
+ subi r1,r1,STACK_FRAME_OVERHEAD
+
/* See if we need to call a cpu state restore handler */
LOAD_REG_ADDR(r23, cur_cpu_spec)
ld r23,0(r23)
@@ -451,10 +455,6 @@ generic_secondary_common_init:
sync /* order paca.run and cur_cpu_spec */
isync /* In case code patching happened */
- /* Create a temp kernel stack for use before relocation is on. */
- ld r1,PACAEMERGSP(r13)
- subi r1,r1,STACK_FRAME_OVERHEAD
-
b __secondary_start
#endif /* SMP */
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 508244bcf19c2..7787a26d47777 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -929,8 +929,6 @@ void __init setup_arch(char **cmdline_p)
/* On BookE, setup per-core TLB data structures. */
setup_tlb_core_data();
-
- smp_release_cpus();
#endif
/* Print various info about the machine that has been gathered so far. */
@@ -964,6 +962,8 @@ void __init setup_arch(char **cmdline_p)
exc_lvl_early_init();
emergency_stack_init();
+ smp_release_cpus();
+
initmem_init();
#ifdef CONFIG_DUMMY_CONSOLE
--
2.27.0
From: Antti Palosaari <[email protected]>
commit 9c60cc797cf72e95bb39f32316e9f0e5f85435f9 upstream.
SPI bus number must be assigned dynamically for each device, otherwise it
will crash when multiple devices are plugged to system.
Reported-and-tested-by: [email protected]
Cc: [email protected]
Signed-off-by: Antti Palosaari <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/media/usb/msi2500/msi2500.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/usb/msi2500/msi2500.c
+++ b/drivers/media/usb/msi2500/msi2500.c
@@ -1250,7 +1250,7 @@ static int msi2500_probe(struct usb_inte
}
dev->master = master;
- master->bus_num = 0;
+ master->bus_num = -1;
master->num_chipselect = 1;
master->transfer_one_message = msi2500_transfer_one_message;
spi_master_set_devdata(master, dev);
From: Ard Biesheuvel <[email protected]>
[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]
When running in BE mode on LPAE hardware with a PA-to-VA translation
that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
byte of the opcode. So fix that, by rotating the offset in r0 to the
right by 8 bits, which will put the 8-bit immediate in bits 31:24.
Note that this will also move bit #22 in its correct place when
applying the rotation to the constant #0x400000.
Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
Acked-by: Nicolas Pitre <[email protected]>
Reviewed-by: Linus Walleij <[email protected]>
Signed-off-by: Ard Biesheuvel <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/kernel/head.S | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 6b1148cafffdb..90add5ded3f1f 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -674,12 +674,8 @@ ARM_BE8(rev16 ip, ip)
ldrcc r7, [r4], #4 @ use branch for delay slot
bcc 1b
bx lr
-#else
-#ifdef CONFIG_CPU_ENDIAN_BE8
- moveq r0, #0x00004000 @ set bit 22, mov to mvn instruction
#else
moveq r0, #0x400000 @ set bit 22, mov to mvn instruction
-#endif
b 2f
1: ldr ip, [r7, r3]
#ifdef CONFIG_CPU_ENDIAN_BE8
@@ -688,7 +684,7 @@ ARM_BE8(rev16 ip, ip)
tst ip, #0x000f0000 @ check the rotation field
orrne ip, ip, r6, lsl #24 @ mask in offset bits 31-24
biceq ip, ip, #0x00004000 @ clear bit 22
- orreq ip, ip, r0 @ mask in offset bits 7-0
+ orreq ip, ip, r0, ror #8 @ mask in offset bits 7-0
#else
bic ip, ip, #0x000000ff
tst ip, #0xf00 @ check the rotation field
--
2.27.0
From: Arvind Sankar <[email protected]>
[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ]
Commit
ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
added ident_p4d_init() to support 5-level paging, but this function
doesn't check and return errors from ident_pud_init().
For example, the decompressor stub uses this code to create an identity
mapping. If it runs out of pages while trying to allocate a PMD
pagetable, the error will be currently ignored.
Fix this to propagate errors.
[ bp: Space out statements for better readability. ]
Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
Signed-off-by: Arvind Sankar <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
Reviewed-by: Joerg Roedel <[email protected]>
Acked-by: Kirill A. Shutemov <[email protected]>
Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/x86/mm/ident_map.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index fe7a12599d8eb..968d7005f4a72 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
unsigned long addr, unsigned long end)
{
unsigned long next;
+ int result;
for (; addr < end; addr = next) {
p4d_t *p4d = p4d_page + p4d_index(addr);
@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
if (p4d_present(*p4d)) {
pud = pud_offset(p4d, 0);
- ident_pud_init(info, pud, addr, next);
+ result = ident_pud_init(info, pud, addr, next);
+ if (result)
+ return result;
+
continue;
}
pud = (pud_t *)info->alloc_pgt_page(info->context);
if (!pud)
return -ENOMEM;
- ident_pud_init(info, pud, addr, next);
+
+ result = ident_pud_init(info, pud, addr, next);
+ if (result)
+ return result;
+
set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
}
--
2.27.0
From: Zhang Qilong <[email protected]>
[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ]
gb_pm_runtime_get_sync has increased the usage counter of the device here.
Forgetting to call gb_pm_runtime_put_noidle will result in usage counter
leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We
fixed it by adding it.
Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback")
Signed-off-by: Zhang Qilong <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/staging/greybus/audio_codec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
index 35acd55ca5ab7..6cbf69a57dfd9 100644
--- a/drivers/staging/greybus/audio_codec.c
+++ b/drivers/staging/greybus/audio_codec.c
@@ -489,6 +489,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
if (ret) {
dev_err_ratelimited(dai->dev, "%d: Error during set_config\n",
ret);
+ gb_pm_runtime_put_noidle(bundle);
mutex_unlock(&codec->lock);
return ret;
}
@@ -565,6 +566,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream,
break;
}
if (ret) {
+ gb_pm_runtime_put_noidle(bundle);
mutex_unlock(&codec->lock);
dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n",
ret);
--
2.27.0
From: Vincent Bernat <[email protected]>
[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]
Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
ignores a route whose interface is down. It is provided as a
per-interface sysctl. However, while a "all" variant is exposed, it
was a noop since it was never evaluated. We use the usual "or" logic
for this kind of sysctls.
Tested with:
ip link add type veth # veth0 + veth1
ip link add type veth # veth1 + veth2
ip link set up dev veth0
ip link set up dev veth1 # link-status paired with veth0
ip link set up dev veth2
ip link set up dev veth3 # link-status paired with veth2
# First available path
ip -4 addr add 203.0.113.${uts#H}/24 dev veth0
ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0
# Second available path
ip -4 addr add 192.0.2.${uts#H}/24 dev veth2
ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2
# More specific route through first path
ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0
ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0
# Less specific route through second path
ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2
ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2
# H1: enable on "all"
# H2: enable on "veth0"
for v in ipv4 ipv6; do
case $uts in
H1)
sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1
;;
H2)
sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1
;;
esac
done
set -xe
# When veth0 is up, best route is through veth0
ip -o route get 198.51.100.1 | grep -Fw veth0
ip -o route get 2001:db8:3::1 | grep -Fw veth0
# When veth0 is down, best route should be through veth2 on H1/H2,
# but on veth0 on H2
ip link set down dev veth1 # down veth0
ip route show
[ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0
[ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0
[ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2
[ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2
Without this patch, the two last lines would fail on H1 (the one using
the "all" sysctl). With the patch, everything succeeds as expected.
Also document the sysctl in `ip-sysctl.rst`.
Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down")
Signed-off-by: Vincent Bernat <[email protected]>
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
Documentation/networking/ip-sysctl.txt | 3 +++
include/linux/inetdevice.h | 2 +-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 3c617d620b6f8..94d42eb83588b 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1300,6 +1300,9 @@ igmpv3_unsolicited_report_interval - INTEGER
IGMPv3 report retransmit will take place.
Default: 1000 (1 seconds)
+ignore_routes_with_linkdown - BOOLEAN
+ Ignore routes whose link is down when performing a FIB lookup.
+
promote_secondaries - BOOLEAN
When a primary IP address is removed from this interface
promote a corresponding secondary IP address instead of
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index a64f21a97369a..11adf828edf58 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -126,7 +126,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
#define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \
- IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
+ IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
#define IN_DEV_ARPFILTER(in_dev) IN_DEV_ORCONF((in_dev), ARPFILTER)
#define IN_DEV_ARP_ACCEPT(in_dev) IN_DEV_ORCONF((in_dev), ARP_ACCEPT)
--
2.27.0
From: Eric Biggers <[email protected]>
commit 92eb6c3060ebe3adf381fd9899451c5b047bb14d upstream.
Commit 3f69cc60768b ("crypto: af_alg - Allow arbitrarily long algorithm
names") made the kernel start accepting arbitrarily long algorithm names
in sockaddr_alg. However, the actual length of the salg_name field
stayed at the original 64 bytes.
This is broken because the kernel can access indices >= 64 in salg_name,
which is undefined behavior -- even though the memory that is accessed
is still located within the sockaddr structure. It would only be
defined behavior if the array were properly marked as arbitrary-length
(either by making it a flexible array, which is the recommended way
these days, or by making it an array of length 0 or 1).
We can't simply change salg_name into a flexible array, since that would
break source compatibility with userspace programs that embed
sockaddr_alg into another struct, or (more commonly) declare a
sockaddr_alg like 'struct sockaddr_alg sa = { .salg_name = "foo" };'.
One solution would be to change salg_name into a flexible array only
when '#ifdef __KERNEL__'. However, that would keep userspace without an
easy way to actually use the longer algorithm names.
Instead, add a new structure 'sockaddr_alg_new' that has the flexible
array field, and expose it to both userspace and the kernel.
Make the kernel use it correctly in alg_bind().
This addresses the syzbot report
"UBSAN: array-index-out-of-bounds in alg_bind"
(https://syzkaller.appspot.com/bug?extid=92ead4eb8e26a26d465e).
Reported-by: [email protected]
Fixes: 3f69cc60768b ("crypto: af_alg - Allow arbitrarily long algorithm names")
Cc: <[email protected]> # v4.12+
Signed-off-by: Eric Biggers <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
crypto/af_alg.c | 10 +++++++---
include/uapi/linux/if_alg.h | 16 ++++++++++++++++
2 files changed, 23 insertions(+), 3 deletions(-)
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -151,7 +151,7 @@ static int alg_bind(struct socket *sock,
const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY;
struct sock *sk = sock->sk;
struct alg_sock *ask = alg_sk(sk);
- struct sockaddr_alg *sa = (void *)uaddr;
+ struct sockaddr_alg_new *sa = (void *)uaddr;
const struct af_alg_type *type;
void *private;
int err;
@@ -159,7 +159,11 @@ static int alg_bind(struct socket *sock,
if (sock->state == SS_CONNECTED)
return -EINVAL;
- if (addr_len < sizeof(*sa))
+ BUILD_BUG_ON(offsetof(struct sockaddr_alg_new, salg_name) !=
+ offsetof(struct sockaddr_alg, salg_name));
+ BUILD_BUG_ON(offsetof(struct sockaddr_alg, salg_name) != sizeof(*sa));
+
+ if (addr_len < sizeof(*sa) + 1)
return -EINVAL;
/* If caller uses non-allowed flag, return error. */
@@ -167,7 +171,7 @@ static int alg_bind(struct socket *sock,
return -EINVAL;
sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
- sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0;
+ sa->salg_name[addr_len - sizeof(*sa) - 1] = 0;
type = alg_get_type(sa->salg_type);
if (IS_ERR(type) && PTR_ERR(type) == -ENOENT) {
--- a/include/uapi/linux/if_alg.h
+++ b/include/uapi/linux/if_alg.h
@@ -24,6 +24,22 @@ struct sockaddr_alg {
__u8 salg_name[64];
};
+/*
+ * Linux v4.12 and later removed the 64-byte limit on salg_name[]; it's now an
+ * arbitrary-length field. We had to keep the original struct above for source
+ * compatibility with existing userspace programs, though. Use the new struct
+ * below if support for very long algorithm names is needed. To do this,
+ * allocate 'sizeof(struct sockaddr_alg_new) + strlen(algname) + 1' bytes, and
+ * copy algname (including the null terminator) into salg_name.
+ */
+struct sockaddr_alg_new {
+ __u16 salg_family;
+ __u8 salg_type[14];
+ __u32 salg_feat;
+ __u32 salg_mask;
+ __u8 salg_name[];
+};
+
struct af_alg_iv {
__u32 ivlen;
__u8 iv[0];
From: Qinglang Miao <[email protected]>
[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]
kfree(host->card) has been called in put_device so that
another kfree would raise cause a double-free bug.
Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
Reported-by: Hulk Robot <[email protected]>
Signed-off-by: Qinglang Miao <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Ulf Hansson <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/memstick/core/memstick.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index b1564cacd19e1..20ae8652adf44 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -469,7 +469,6 @@ static void memstick_check(struct work_struct *work)
host->card = card;
if (device_register(&card->dev)) {
put_device(&card->dev);
- kfree(host->card);
host->card = NULL;
}
} else
--
2.27.0
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit a4ccc37693a271330a46208afbeaed939d54fdbb ]
PHY disable/enable resets PLL registers to default values. Thus in
addition to restoring several registers we also need to restore VCO rate
settings.
Signed-off-by: Dmitry Baryshkov <[email protected]>
Fixes: c6659785dfb3 ("drm/msm/dsi/pll: call vco set rate explicitly")
Signed-off-by: Rob Clark <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
index 21a69b046625a..d15511b521cb7 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
@@ -554,6 +554,7 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
void __iomem *phy_base = pll_10nm->phy_cmn_mmio;
u32 val;
+ int ret;
val = pll_read(pll_10nm->mmio + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
val &= ~0x3;
@@ -568,6 +569,13 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
val |= cached->pll_mux;
pll_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val);
+ ret = dsi_pll_10nm_vco_set_rate(&pll->clk_hw, pll_10nm->vco_current_rate, pll_10nm->vco_ref_clk_rate);
+ if (ret) {
+ DRM_DEV_ERROR(&pll_10nm->pdev->dev,
+ "restore vco rate failed. ret=%d\n", ret);
+ return ret;
+ }
+
DBG("DSI PLL%d", pll_10nm->id);
return 0;
--
2.27.0
From: Yu Kuai <[email protected]>
[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ]
mtk_vcodec_release_dec_pm() will be called in two places:
a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error.
b. mtk_vcodec_dec_remove().
In both cases put_device() call is needed, since of_find_device_by_node()
was called in mtk_vcodec_init_dec_pm() previously.
Thus add put_devices() call in mtk_vcodec_release_dec_pm()
Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
Signed-off-by: Yu Kuai <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
index 79ca03ac449c3..3f64119e8c082 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
@@ -103,6 +103,7 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev)
{
pm_runtime_disable(dev->pm.dev);
+ put_device(dev->pm.larbvdec);
}
void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm)
--
2.27.0
From: Dan Carpenter <[email protected]>
[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]
The "a->index" value comes from the user via the ioctl. The problem is
that the shift can wrap resulting in setting "mxb->cur_audinput" to an
invalid value, which later results in an array overflow.
Fixes: 6680427791c9 ("[media] mxb: fix audio handling")
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/media/pci/saa7146/mxb.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
index 6b5582b7c5955..6e25654da2567 100644
--- a/drivers/media/pci/saa7146/mxb.c
+++ b/drivers/media/pci/saa7146/mxb.c
@@ -653,16 +653,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
struct mxb *mxb = (struct mxb *)dev->ext_priv;
DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
- if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
- if (mxb->cur_audinput != a->index) {
- mxb->cur_audinput = a->index;
- tea6420_route(mxb, a->index);
- if (mxb->cur_audinput == 0)
- mxb_update_audmode(mxb);
- }
- return 0;
+ if (a->index >= 32 ||
+ !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
+ return -EINVAL;
+
+ if (mxb->cur_audinput != a->index) {
+ mxb->cur_audinput = a->index;
+ tea6420_route(mxb, a->index);
+ if (mxb->cur_audinput == 0)
+ mxb_update_audmode(mxb);
}
- return -EINVAL;
+ return 0;
}
#ifdef CONFIG_VIDEO_ADV_DEBUG
--
2.27.0
From: Zhang Qilong <[email protected]>
[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ]
In omap4_keypad_probe, the patch fix several bugs.
1) pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak.
2) In err_unmap, forget to disable runtime of device,
pm_runtime_enable will increase power disable depth. Thus a
pairing decrement is needed on the error handling path to keep
it balanced.
3) In err_pm_disable, it will call pm_runtime_put_sync twice not
one time.
To fix this we factor out code reading revision and disabling touchpad, and
drop PM reference once we are done talking to the device.
Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets")
Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling")
Signed-off-by: Zhang Qilong <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++-----------
1 file changed, 53 insertions(+), 36 deletions(-)
diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index aeeef50cef9bb..adb1ecc969eeb 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -199,12 +199,8 @@ static int omap4_keypad_open(struct input_dev *input)
return 0;
}
-static void omap4_keypad_close(struct input_dev *input)
+static void omap4_keypad_stop(struct omap4_keypad *keypad_data)
{
- struct omap4_keypad *keypad_data = input_get_drvdata(input);
-
- disable_irq(keypad_data->irq);
-
/* Disable interrupts and wake-up events */
kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
OMAP4_VAL_IRQDISABLE);
@@ -213,7 +209,15 @@ static void omap4_keypad_close(struct input_dev *input)
/* clear pending interrupts */
kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+}
+
+static void omap4_keypad_close(struct input_dev *input)
+{
+ struct omap4_keypad *keypad_data;
+ keypad_data = input_get_drvdata(input);
+ disable_irq(keypad_data->irq);
+ omap4_keypad_stop(keypad_data);
enable_irq(keypad_data->irq);
pm_runtime_put_sync(input->dev.parent);
@@ -236,13 +240,37 @@ static int omap4_keypad_parse_dt(struct device *dev,
return 0;
}
+static int omap4_keypad_check_revision(struct device *dev,
+ struct omap4_keypad *keypad_data)
+{
+ unsigned int rev;
+
+ rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
+ rev &= 0x03 << 30;
+ rev >>= 30;
+ switch (rev) {
+ case KBD_REVISION_OMAP4:
+ keypad_data->reg_offset = 0x00;
+ keypad_data->irqreg_offset = 0x00;
+ break;
+ case KBD_REVISION_OMAP5:
+ keypad_data->reg_offset = 0x10;
+ keypad_data->irqreg_offset = 0x0c;
+ break;
+ default:
+ dev_err(dev, "Keypad reports unsupported revision %d", rev);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static int omap4_keypad_probe(struct platform_device *pdev)
{
struct omap4_keypad *keypad_data;
struct input_dev *input_dev;
struct resource *res;
unsigned int max_keys;
- int rev;
int irq;
int error;
@@ -282,41 +310,33 @@ static int omap4_keypad_probe(struct platform_device *pdev)
goto err_release_mem;
}
+ pm_runtime_enable(&pdev->dev);
/*
* Enable clocks for the keypad module so that we can read
* revision register.
*/
- pm_runtime_enable(&pdev->dev);
error = pm_runtime_get_sync(&pdev->dev);
if (error) {
dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
- goto err_unmap;
- }
- rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
- rev &= 0x03 << 30;
- rev >>= 30;
- switch (rev) {
- case KBD_REVISION_OMAP4:
- keypad_data->reg_offset = 0x00;
- keypad_data->irqreg_offset = 0x00;
- break;
- case KBD_REVISION_OMAP5:
- keypad_data->reg_offset = 0x10;
- keypad_data->irqreg_offset = 0x0c;
- break;
- default:
- dev_err(&pdev->dev,
- "Keypad reports unsupported revision %d", rev);
- error = -EINVAL;
- goto err_pm_put_sync;
+ pm_runtime_put_noidle(&pdev->dev);
+ } else {
+ error = omap4_keypad_check_revision(&pdev->dev,
+ keypad_data);
+ if (!error) {
+ /* Ensure device does not raise interrupts */
+ omap4_keypad_stop(keypad_data);
+ }
+ pm_runtime_put_sync(&pdev->dev);
}
+ if (error)
+ goto err_pm_disable;
/* input device allocation */
keypad_data->input = input_dev = input_allocate_device();
if (!input_dev) {
error = -ENOMEM;
- goto err_pm_put_sync;
+ goto err_pm_disable;
}
input_dev->name = pdev->name;
@@ -362,28 +382,25 @@ static int omap4_keypad_probe(struct platform_device *pdev)
goto err_free_keymap;
}
- device_init_wakeup(&pdev->dev, true);
- pm_runtime_put_sync(&pdev->dev);
-
error = input_register_device(keypad_data->input);
if (error < 0) {
dev_err(&pdev->dev, "failed to register input device\n");
- goto err_pm_disable;
+ goto err_free_irq;
}
+ device_init_wakeup(&pdev->dev, true);
platform_set_drvdata(pdev, keypad_data);
+
return 0;
-err_pm_disable:
- pm_runtime_disable(&pdev->dev);
+err_free_irq:
free_irq(keypad_data->irq, keypad_data);
err_free_keymap:
kfree(keypad_data->keymap);
err_free_input:
input_free_device(input_dev);
-err_pm_put_sync:
- pm_runtime_put_sync(&pdev->dev);
-err_unmap:
+err_pm_disable:
+ pm_runtime_disable(&pdev->dev);
iounmap(keypad_data->base);
err_release_mem:
release_mem_region(res->start, resource_size(res));
--
2.27.0
From: Alexandre Belloni <[email protected]>
[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ]
The triggers for the ADC were taken from at91sam9260 dtsi but are not
correct.
Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support")
Signed-off-by: Alexandre Belloni <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
index ad495f5a5790f..cdf016232fb7d 100644
--- a/arch/arm/boot/dts/at91sam9rl.dtsi
+++ b/arch/arm/boot/dts/at91sam9rl.dtsi
@@ -277,23 +277,26 @@
atmel,adc-use-res = "highres";
trigger0 {
- trigger-name = "timer-counter-0";
+ trigger-name = "external-rising";
trigger-value = <0x1>;
+ trigger-external;
};
+
trigger1 {
- trigger-name = "timer-counter-1";
- trigger-value = <0x3>;
+ trigger-name = "external-falling";
+ trigger-value = <0x2>;
+ trigger-external;
};
trigger2 {
- trigger-name = "timer-counter-2";
- trigger-value = <0x5>;
+ trigger-name = "external-any";
+ trigger-value = <0x3>;
+ trigger-external;
};
trigger3 {
- trigger-name = "external";
- trigger-value = <0x13>;
- trigger-external;
+ trigger-name = "continuous";
+ trigger-value = <0x6>;
};
};
--
2.27.0
From: Marc Zyngier <[email protected]>
[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ]
The alpine-msi driver has an interesting allocation error handling,
where it frees the same interrupts repeatedly. Hilarity follows.
This code is probably never executed, but let's fix it nonetheless.
Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller")
Signed-off-by: Marc Zyngier <[email protected]>
Reviewed-by: Antoine Tenart <[email protected]>
Cc: Tsahee Zidenberg <[email protected]>
Cc: Antoine Tenart <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/irqchip/irq-alpine-msi.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
index 23a3b877f7f1d..ede02dc2bcd0b 100644
--- a/drivers/irqchip/irq-alpine-msi.c
+++ b/drivers/irqchip/irq-alpine-msi.c
@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,
return 0;
err_sgi:
- while (--i >= 0)
- irq_domain_free_irqs_parent(domain, virq, i);
+ irq_domain_free_irqs_parent(domain, virq, i - 1);
alpine_msix_free_sgi(priv, sgi, nr_irqs);
return err;
}
--
2.27.0
From: Cheng Lin <[email protected]>
[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ]
If the elem is deleted during be iterated on it, the iteration
process will fall into an endless loop.
kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137]
PID: 17137 TASK: ffff8818d93c0000 CPU: 4 COMMAND: "nfsd"
[exception RIP: __state_in_grace+76]
RIP: ffffffffc00e817c RSP: ffff8818d3aefc98 RFLAGS: 00000246
RAX: ffff881dc0c38298 RBX: ffffffff81b03580 RCX: ffff881dc02c9f50
RDX: ffff881e3fce8500 RSI: 0000000000000001 RDI: ffffffff81b03580
RBP: ffff8818d3aefca0 R8: 0000000000000020 R9: ffff8818d3aefd40
R10: ffff88017fc03800 R11: ffff8818e83933c0 R12: ffff8818d3aefd40
R13: 0000000000000000 R14: ffff8818e8391068 R15: ffff8818fa6e4000
CS: 0010 SS: 0018
#0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace]
#1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd]
#2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd]
#3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd]
#4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd]
#5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc]
#6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc]
#7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd]
#8 [ffff8818d3aefec8] kthread at ffffffff810b88c1
#9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607
The troublemake elem:
crash> lock_manager ffff881dc0c38298
struct lock_manager {
list = {
next = 0xffff881dc0c38298,
prev = 0xffff881dc0c38298
},
block_opens = false
}
Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens")
Signed-off-by: Cheng Lin <[email protected]>
Signed-off-by: Yi Wang <[email protected]>
Signed-off-by: Chuck Lever <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/nfs_common/grace.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c
index 5be08f02a76bc..4f90c444907f5 100644
--- a/fs/nfs_common/grace.c
+++ b/fs/nfs_common/grace.c
@@ -68,10 +68,14 @@ __state_in_grace(struct net *net, bool open)
if (!open)
return !list_empty(grace_list);
+ spin_lock(&grace_lock);
list_for_each_entry(lm, grace_list, list) {
- if (lm->block_opens)
+ if (lm->block_opens) {
+ spin_unlock(&grace_lock);
return true;
+ }
}
+ spin_unlock(&grace_lock);
return false;
}
--
2.27.0
From: Arnd Bergmann <[email protected]>
[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ]
clang produces a build failure in configurations without COMMON_CLK
when a timeout calculation goes wrong:
arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable':
coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay'
Add a Kconfig dependency to only do build testing when COMMON_CLK
is enabled.
Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Signed-off-by: Arnd Bergmann <[email protected]>
Reviewed-by: Guenter Roeck <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Guenter Roeck <[email protected]>
Signed-off-by: Wim Van Sebroeck <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/watchdog/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 9feeb8e82d500..fa7f4c61524d9 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -515,7 +515,7 @@ config SUNXI_WATCHDOG
config COH901327_WATCHDOG
bool "ST-Ericsson COH 901 327 watchdog"
- depends on ARCH_U300 || (ARM && COMPILE_TEST)
+ depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST)
default y if MACH_U300
select WATCHDOG_CORE
help
--
2.27.0
From: Jernej Skrabec <[email protected]>
[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ]
Two clock divider tables are missing sentinel at the end. Effect of that
is that clock framework reads past the last entry. Fix that with adding
sentinel at the end.
Issue was discovered with KASan.
Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
Signed-off-by: Jernej Skrabec <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Acked-by: Maxime Ripard <[email protected]>
Signed-off-by: Stephen Boyd <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 +
drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
index 9ac6c299e0744..19304d6b2c05d 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
@@ -381,6 +381,7 @@ static struct clk_div_table ths_div_table[] = {
{ .val = 1, .div = 2 },
{ .val = 2, .div = 4 },
{ .val = 3, .div = 6 },
+ { /* Sentinel */ },
};
static const char * const ths_parents[] = { "osc24M" };
static struct ccu_div ths_clk = {
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
index 61e3ba12773ea..d9789378caf55 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
@@ -328,6 +328,7 @@ static struct clk_div_table ths_div_table[] = {
{ .val = 1, .div = 2 },
{ .val = 2, .div = 4 },
{ .val = 3, .div = 6 },
+ { /* Sentinel */ },
};
static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M",
0x074, 0, 2, ths_div_table, BIT(31), 0);
--
2.27.0
From: Masahiro Yamada <[email protected]>
[ Upstream commit 135b4957eac43af2aedf8e2a277b9540f33c2558 ]
$(error-if,...) is expanded to an empty string. Currently, it relies on
eval_clause() returning xstrdup("") when all attempts for expansion fail,
but the correct implementation is to make do_error_if() return xstrdup("").
Fixes: 1d6272e6fe43 ("kconfig: add 'info', 'warning-if', and 'error-if' built-in functions")
Signed-off-by: Masahiro Yamada <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
scripts/kconfig/preprocess.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 5ca2df790d3cf..389814b02d06b 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -111,7 +111,7 @@ static char *do_error_if(int argc, char *argv[])
if (!strcmp(argv[0], "y"))
pperror("%s", argv[1]);
- return NULL;
+ return xstrdup("");
}
static char *do_filename(int argc, char *argv[])
--
2.27.0
From: Christophe JAILLET <[email protected]>
[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ]
Some resource should be released in the error handling path of the probe
function, as already done in the remove function.
The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add
missing of_node_put and of_clk_del_provider")
Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11")
Signed-off-by: Christophe JAILLET <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Signed-off-by: Stephen Boyd <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/clk/clk-s2mps11.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 4080d4e78e8e4..f3aaefafba893 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -211,6 +211,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
return ret;
err_reg:
+ of_node_put(s2mps11_clks[0].clk_np);
while (--i >= 0)
clkdev_drop(s2mps11_clks[i].lookup);
--
2.27.0
From: Sven Schnelle <[email protected]>
commit b5e438ebd7e808d1d2435159ac4742e01a94b8da upstream.
Not resetting the SMT siblings might leave them in unpredictable
state. One of the observed problems was that the CPU timer wasn't
reset and therefore large system time values where accounted during
CPU bringup.
Cc: <[email protected]> # 4.0
Fixes: 10ad34bc76dfb ("s390: add SMT support")
Reviewed-by: Heiko Carstens <[email protected]>
Signed-off-by: Sven Schnelle <[email protected]>
Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/s390/kernel/smp.c | 18 +++---------------
1 file changed, 3 insertions(+), 15 deletions(-)
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -863,24 +863,12 @@ static void smp_start_secondary(void *cp
/* Upping and downing of CPUs */
int __cpu_up(unsigned int cpu, struct task_struct *tidle)
{
- struct pcpu *pcpu;
- int base, i, rc;
+ struct pcpu *pcpu = pcpu_devices + cpu;
+ int rc;
- pcpu = pcpu_devices + cpu;
if (pcpu->state != CPU_STATE_CONFIGURED)
return -EIO;
- base = smp_get_base_cpu(cpu);
- for (i = 0; i <= smp_cpu_mtid; i++) {
- if (base + i < nr_cpu_ids)
- if (cpu_online(base + i))
- break;
- }
- /*
- * If this is the first CPU of the core to get online
- * do an initial CPU reset.
- */
- if (i > smp_cpu_mtid &&
- pcpu_sigp_retry(pcpu_devices + base, SIGP_INITIAL_CPU_RESET, 0) !=
+ if (pcpu_sigp_retry(pcpu, SIGP_INITIAL_CPU_RESET, 0) !=
SIGP_CC_ORDER_CODE_ACCEPTED)
return -EIO;
From: Takashi Iwai <[email protected]>
commit 2506318e382c4c7daa77bdc48f80a0ee82804588 upstream.
It seems that the HD-audio clear and reconfig sysfs don't work any
longer after the recent driver core change. There are multiple issues
around that: the linked list corruption and the dead device handling.
The former issue is fixed by another patch for the driver core itself,
while the latter patch needs to be addressed in HD-audio side.
This patch corresponds to the latter, it recovers those broken
functions by replacing the device detach and attach actions with the
standard core API functions, which are almost equivalent with unbind
and bind actions.
Fixes: 654888327e9f ("driver core: Avoid binding drivers to dead devices")
Cc: <[email protected]>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=209207
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
sound/pci/hda/hda_codec.c | 2 +-
sound/pci/hda/hda_sysfs.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1782,7 +1782,7 @@ int snd_hda_codec_reset(struct hda_codec
return -EBUSY;
/* OK, let it free */
- snd_hdac_device_unregister(&codec->core);
+ device_release_driver(hda_codec_dev(codec));
/* allow device access again */
snd_hda_unlock_devices(bus);
--- a/sound/pci/hda/hda_sysfs.c
+++ b/sound/pci/hda/hda_sysfs.c
@@ -138,7 +138,7 @@ static int reconfig_codec(struct hda_cod
"The codec is being used, can't reconfigure.\n");
goto error;
}
- err = snd_hda_codec_configure(codec);
+ err = device_reprobe(hda_codec_dev(codec));
if (err < 0)
goto error;
err = snd_card_register(codec->card);
From: Zwane Mwaikambo <[email protected]>
commit 73b62cdb93b68d7e2c1d373c6a411bc00c53e702 upstream.
I observed this when unplugging a DP monitor whilst a computer is asleep
and then waking it up. This left DP chardev nodes still being present on
the filesystem and accessing these device nodes caused an oops because
drm_dp_aux_dev_get_by_minor() assumes a device exists if it is opened.
This can also be reproduced by creating a device node with mknod(1) and
issuing an open(2)
[166164.933198] BUG: kernel NULL pointer dereference, address: 0000000000000018
[166164.933202] #PF: supervisor read access in kernel mode
[166164.933204] #PF: error_code(0x0000) - not-present page
[166164.933205] PGD 0 P4D 0
[166164.933208] Oops: 0000 [#1] PREEMPT SMP NOPTI
[166164.933211] CPU: 4 PID: 99071 Comm: fwupd Tainted: G W
5.8.0-rc6+ #1
[166164.933213] Hardware name: LENOVO 20RD002VUS/20RD002VUS, BIOS R16ET25W
(1.11 ) 04/21/2020
[166164.933232] RIP: 0010:drm_dp_aux_dev_get_by_minor+0x29/0x70
[drm_kms_helper]
[166164.933234] Code: 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 fc 48 c7
c7 60 01 a4 c0 e8 26 ab 30 d7 44 89 e6 48 c7 c7 80 01 a4 c0 e8 47 94 d6 d6
<8b> 50 18 49 89 c4 48 8d 78 18 85 d2 74 33 8d 4a 01 89 d0 f0 0f b1
[166164.933236] RSP: 0018:ffffb7d7c41cbbf0 EFLAGS: 00010246
[166164.933237] RAX: 0000000000000000 RBX: ffff8a90001fe900 RCX: 0000000000000000
[166164.933238] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffffc0a40180
[166164.933239] RBP: ffffb7d7c41cbbf8 R08: 0000000000000000 R09: ffff8a93e157d6d0
[166164.933240] R10: 0000000000000000 R11: ffffffffc0a40188 R12: 0000000000000003
[166164.933241] R13: ffff8a9402200e80 R14: ffff8a90001fe900 R15: 0000000000000000
[166164.933244] FS: 00007f7fb041eb00(0000) GS:ffff8a9411500000(0000)
knlGS:0000000000000000
[166164.933245] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[166164.933246] CR2: 0000000000000018 CR3: 00000000352c2003 CR4: 00000000003606e0
[166164.933247] Call Trace:
[166164.933264] auxdev_open+0x1b/0x40 [drm_kms_helper]
[166164.933278] chrdev_open+0xa7/0x1c0
[166164.933282] ? cdev_put.part.0+0x20/0x20
[166164.933287] do_dentry_open+0x161/0x3c0
[166164.933291] vfs_open+0x2d/0x30
[166164.933297] path_openat+0xb27/0x10e0
[166164.933306] ? atime_needs_update+0x73/0xd0
[166164.933309] do_filp_open+0x91/0x100
[166164.933313] ? __alloc_fd+0xb2/0x150
[166164.933316] do_sys_openat2+0x210/0x2d0
[166164.933318] do_sys_open+0x46/0x80
[166164.933320] __x64_sys_openat+0x20/0x30
[166164.933328] do_syscall_64+0x52/0xc0
[166164.933336] entry_SYSCALL_64_after_hwframe+0x44/0xa9
(gdb) disassemble drm_dp_aux_dev_get_by_minor+0x29
Dump of assembler code for function drm_dp_aux_dev_get_by_minor:
0x0000000000017b10 <+0>: callq 0x17b15 <drm_dp_aux_dev_get_by_minor+5>
0x0000000000017b15 <+5>: push %rbp
0x0000000000017b16 <+6>: mov %rsp,%rbp
0x0000000000017b19 <+9>: push %r12
0x0000000000017b1b <+11>: mov %edi,%r12d
0x0000000000017b1e <+14>: mov $0x0,%rdi
0x0000000000017b25 <+21>: callq 0x17b2a <drm_dp_aux_dev_get_by_minor+26>
0x0000000000017b2a <+26>: mov %r12d,%esi
0x0000000000017b2d <+29>: mov $0x0,%rdi
0x0000000000017b34 <+36>: callq 0x17b39 <drm_dp_aux_dev_get_by_minor+41>
0x0000000000017b39 <+41>: mov 0x18(%rax),%edx <=========
0x0000000000017b3c <+44>: mov %rax,%r12
0x0000000000017b3f <+47>: lea 0x18(%rax),%rdi
0x0000000000017b43 <+51>: test %edx,%edx
0x0000000000017b45 <+53>: je 0x17b7a <drm_dp_aux_dev_get_by_minor+106>
0x0000000000017b47 <+55>: lea 0x1(%rdx),%ecx
0x0000000000017b4a <+58>: mov %edx,%eax
0x0000000000017b4c <+60>: lock cmpxchg %ecx,(%rdi)
0x0000000000017b50 <+64>: jne 0x17b76 <drm_dp_aux_dev_get_by_minor+102>
0x0000000000017b52 <+66>: test %edx,%edx
0x0000000000017b54 <+68>: js 0x17b6d <drm_dp_aux_dev_get_by_minor+93>
0x0000000000017b56 <+70>: test %ecx,%ecx
0x0000000000017b58 <+72>: js 0x17b6d <drm_dp_aux_dev_get_by_minor+93>
0x0000000000017b5a <+74>: mov $0x0,%rdi
0x0000000000017b61 <+81>: callq 0x17b66 <drm_dp_aux_dev_get_by_minor+86>
0x0000000000017b66 <+86>: mov %r12,%rax
0x0000000000017b69 <+89>: pop %r12
0x0000000000017b6b <+91>: pop %rbp
0x0000000000017b6c <+92>: retq
0x0000000000017b6d <+93>: xor %esi,%esi
0x0000000000017b6f <+95>: callq 0x17b74 <drm_dp_aux_dev_get_by_minor+100>
0x0000000000017b74 <+100>: jmp 0x17b5a <drm_dp_aux_dev_get_by_minor+74>
0x0000000000017b76 <+102>: mov %eax,%edx
0x0000000000017b78 <+104>: jmp 0x17b43 <drm_dp_aux_dev_get_by_minor+51>
0x0000000000017b7a <+106>: xor %r12d,%r12d
0x0000000000017b7d <+109>: jmp 0x17b5a <drm_dp_aux_dev_get_by_minor+74>
End of assembler dump.
(gdb) list *drm_dp_aux_dev_get_by_minor+0x29
0x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65).
60 static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
61 {
62 struct drm_dp_aux_dev *aux_dev = NULL;
63
64 mutex_lock(&aux_idr_mutex);
65 aux_dev = idr_find(&aux_idr, index);
66 if (!kref_get_unless_zero(&aux_dev->refcount))
67 aux_dev = NULL;
68 mutex_unlock(&aux_idr_mutex);
69
(gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount
$8 = 0x18
Looking at the caller, checks on the minor are pushed down to
drm_dp_aux_dev_get_by_minor()
static int auxdev_open(struct inode *inode, struct file *file)
{
unsigned int minor = iminor(inode);
struct drm_dp_aux_dev *aux_dev;
aux_dev = drm_dp_aux_dev_get_by_minor(minor); <====
if (!aux_dev)
return -ENODEV;
file->private_data = aux_dev;
return 0;
}
Fixes: e94cb37b34eb ("drm/dp: Add a drm_aux-dev module for reading/writing dpcd registers.")
Cc: <[email protected]> # v4.6+
Signed-off-by: Zwane Mwaikambo <[email protected]>
Reviewed-by: Lyude Paul <[email protected]>
[added Cc to stable]
Signed-off-by: Lyude Paul <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/drm_dp_aux_dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_dp_aux_dev.c
+++ b/drivers/gpu/drm/drm_dp_aux_dev.c
@@ -60,7 +60,7 @@ static struct drm_dp_aux_dev *drm_dp_aux
mutex_lock(&aux_idr_mutex);
aux_dev = idr_find(&aux_idr, index);
- if (!kref_get_unless_zero(&aux_dev->refcount))
+ if (aux_dev && !kref_get_unless_zero(&aux_dev->refcount))
aux_dev = NULL;
mutex_unlock(&aux_idr_mutex);
From: James Smart <[email protected]>
commit 62e3a931db60daf94fdb3159d685a5bc6ad4d0cf upstream.
The following calltrace was seen:
BUG: sleeping function called from invalid context at mm/slab.h:494
...
Call Trace:
dump_stack+0x9a/0xf0
___might_sleep.cold.63+0x13d/0x178
slab_pre_alloc_hook+0x6a/0x90
kmem_cache_alloc_trace+0x3a/0x2d0
lpfc_sli4_nvmet_alloc+0x4c/0x280 [lpfc]
lpfc_post_rq_buffer+0x2e7/0xa60 [lpfc]
lpfc_sli4_hba_setup+0x6b4c/0xa4b0 [lpfc]
lpfc_pci_probe_one_s4.isra.15+0x14f8/0x2280 [lpfc]
lpfc_pci_probe_one+0x260/0x2880 [lpfc]
local_pci_probe+0xd4/0x180
work_for_cpu_fn+0x51/0xa0
process_one_work+0x8f0/0x17b0
worker_thread+0x536/0xb50
kthread+0x30c/0x3d0
ret_from_fork+0x3a/0x50
A prior patch introduced a spin_lock_irqsave(hbalock) in the
lpfc_post_rq_buffer() routine. Call trace is seen as the hbalock is held
with interrupts disabled during a GFP_KERNEL allocation in
lpfc_sli4_nvmet_alloc().
Fix by reordering locking so that hbalock not held when calling
sli4_nvmet_alloc() (aka rqb_buf_list()).
Link: https://lore.kernel.org/r/[email protected]
Fixes: 411de511c694 ("scsi: lpfc: Fix RQ empty firmware trap")
Cc: <[email protected]> # v4.17+
Co-developed-by: Dick Kennedy <[email protected]>
Signed-off-by: Dick Kennedy <[email protected]>
Signed-off-by: James Smart <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/scsi/lpfc/lpfc_mem.c | 4 +---
drivers/scsi/lpfc/lpfc_sli.c | 10 ++++++++--
2 files changed, 9 insertions(+), 5 deletions(-)
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -560,8 +560,6 @@ lpfc_els_hbq_free(struct lpfc_hba *phba,
* Description: Allocates a DMA-mapped receive buffer from the lpfc_hrb_pool PCI
* pool along a non-DMA-mapped container for it.
*
- * Notes: Not interrupt-safe. Must be called with no locks held.
- *
* Returns:
* pointer to HBQ on success
* NULL on failure
@@ -631,7 +629,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *p
{
struct rqb_dmabuf *dma_buf;
- dma_buf = kzalloc(sizeof(struct rqb_dmabuf), GFP_KERNEL);
+ dma_buf = kzalloc(sizeof(*dma_buf), GFP_KERNEL);
if (!dma_buf)
return NULL;
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -6755,12 +6755,16 @@ lpfc_post_rq_buffer(struct lpfc_hba *phb
struct rqb_dmabuf *rqb_buffer;
LIST_HEAD(rqb_buf_list);
- spin_lock_irqsave(&phba->hbalock, flags);
rqbp = hrq->rqbp;
for (i = 0; i < count; i++) {
+ spin_lock_irqsave(&phba->hbalock, flags);
/* IF RQ is already full, don't bother */
- if (rqbp->buffer_count + i >= rqbp->entry_count - 1)
+ if (rqbp->buffer_count + i >= rqbp->entry_count - 1) {
+ spin_unlock_irqrestore(&phba->hbalock, flags);
break;
+ }
+ spin_unlock_irqrestore(&phba->hbalock, flags);
+
rqb_buffer = rqbp->rqb_alloc_buffer(phba);
if (!rqb_buffer)
break;
@@ -6769,6 +6773,8 @@ lpfc_post_rq_buffer(struct lpfc_hba *phb
rqb_buffer->idx = idx;
list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
}
+
+ spin_lock_irqsave(&phba->hbalock, flags);
while (!list_empty(&rqb_buf_list)) {
list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
hbuf.list);
From: Ard Biesheuvel <[email protected]>
commit 17858b140bf49961b71d4e73f1c3ea9bc8e7dda0 upstream.
ecdh_set_secret() casts a void* pointer to a const u64* in order to
feed it into ecc_is_key_valid(). This is not generally permitted by
the C standard, and leads to actual misalignment faults on ARMv6
cores. In some cases, these are fixed up in software, but this still
leads to performance hits that are entirely avoidable.
So let's copy the key into the ctx buffer first, which we will do
anyway in the common case, and which guarantees correct alignment.
Cc: <[email protected]>
Signed-off-by: Ard Biesheuvel <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
crypto/ecdh.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/crypto/ecdh.c
+++ b/crypto/ecdh.c
@@ -57,12 +57,13 @@ static int ecdh_set_secret(struct crypto
return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
ctx->private_key);
- if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
- (const u64 *)params.key, params.key_size) < 0)
- return -EINVAL;
-
memcpy(ctx->private_key, params.key, params.key_size);
+ if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
+ ctx->private_key, params.key_size) < 0) {
+ memzero_explicit(ctx->private_key, params.key_size);
+ return -EINVAL;
+ }
return 0;
}
From: Qinglang Miao <[email protected]>
commit 560c6b914c6ec7d9d9a69fddbb5bf3bf71433e8b upstream.
Fix the missing clk_disable_unprepare() of info->pclk
before return from rockchip_saradc_resume in the error
handling case when fails to prepare and enable info->clk.
Suggested-by: Robin Murphy <[email protected]>
Fixes: 44d6f2ef94f9 ("iio: adc: add driver for Rockchip saradc")
Signed-off-by: Qinglang Miao <[email protected]>
Cc: <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jonathan Cameron <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/iio/adc/rockchip_saradc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -383,7 +383,7 @@ static int rockchip_saradc_resume(struct
ret = clk_prepare_enable(info->clk);
if (ret)
- return ret;
+ clk_disable_unprepare(info->pclk);
return ret;
}
From: Johan Hovold <[email protected]>
commit 696c541c8c6cfa05d65aa24ae2b9e720fc01766e upstream.
Commit c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity
checks") broke write-unthrottle handling by dropping well-formed
unthrottle-interrupt packets which are precisely two bytes long. This
could lead to blocked writers not being woken up when buffer space again
becomes available.
Instead, stop unconditionally printing the third byte which is
(presumably) only valid on modem-line changes.
Fixes: c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity checks")
Cc: stable <[email protected]> # 4.11
Acked-by: Sebastian Andrzej Siewior <[email protected]>
Reviewed-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Johan Hovold <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/serial/keyspan_pda.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -172,11 +172,11 @@ static void keyspan_pda_rx_interrupt(str
break;
case 1:
/* status interrupt */
- if (len < 3) {
+ if (len < 2) {
dev_warn(&port->dev, "short interrupt message received\n");
break;
}
- dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]);
+ dev_dbg(&port->dev, "rx int, d1=%d\n", data[1]);
switch (data[1]) {
case 1: /* modemline change */
break;
From: Terry Zhou <[email protected]>
commit 6f37689cf6b38fff96de52e7f0d3e78f22803ba0 upstream.
There is an error in the current code that the XTAL MODE
pin was set to NB MPP1_31 which should be NB MPP1_9.
The latch register of NB MPP1_9 has different offset of 0x8.
Signed-off-by: Terry Zhou <[email protected]>
[pali: Fix pin name in commit message]
Signed-off-by: Pali Rohár <[email protected]>
Fixes: 7ea8250406a6 ("clk: mvebu: Add the xtal clock for Armada 3700 SoC")
Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Marek Behún <[email protected]>
Signed-off-by: Stephen Boyd <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/clk/mvebu/armada-37xx-xtal.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/clk/mvebu/armada-37xx-xtal.c
+++ b/drivers/clk/mvebu/armada-37xx-xtal.c
@@ -15,8 +15,8 @@
#include <linux/platform_device.h>
#include <linux/regmap.h>
-#define NB_GPIO1_LATCH 0xC
-#define XTAL_MODE BIT(31)
+#define NB_GPIO1_LATCH 0x8
+#define XTAL_MODE BIT(9)
static int armada_3700_xtal_clock_probe(struct platform_device *pdev)
{
From: Lukas Wunner <[email protected]>
commit a4729c3506c3eb1a6ca5c0289f4e7cafa4115065 upstream.
If the calls to devm_clk_get(), devm_spi_register_master() or
clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver,
the spi_master struct is erroneously not freed.
Fix by switching over to the new devm_spi_alloc_master() helper.
Fixes: 05aec357871f ("spi: Add SPI driver for Mikrotik RB4xx series boards")
Signed-off-by: Lukas Wunner <[email protected]>
Cc: <[email protected]> # v4.2+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <[email protected]> # v4.2+
Cc: Bert Vermeulen <[email protected]>
Link: https://lore.kernel.org/r/369bf26d71927f60943b1d9d8f51810f00b0237d.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/spi/spi-rb4xx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/spi/spi-rb4xx.c
+++ b/drivers/spi/spi-rb4xx.c
@@ -148,7 +148,7 @@ static int rb4xx_spi_probe(struct platfo
if (IS_ERR(spi_base))
return PTR_ERR(spi_base);
- master = spi_alloc_master(&pdev->dev, sizeof(*rbspi));
+ master = devm_spi_alloc_master(&pdev->dev, sizeof(*rbspi));
if (!master)
return -ENOMEM;
From: Borislav Petkov <[email protected]>
commit 706657b1febf446a9ba37dc51b89f46604f57ee9 upstream.
In order to setup its PCI component, the driver needs any node private
instance in order to get a reference to the PCI device and hand that
into edac_pci_create_generic_ctl(). For convenience, it uses the 0th
memory controller descriptor under the assumption that if any, the 0th
will be always present.
However, this assumption goes wrong when the 0th node doesn't have
memory and the driver doesn't initialize an instance for it:
EDAC amd64: F17h detected (node 0).
...
EDAC amd64: Node 0: No DIMMs detected.
But looking up node instances is not really needed - all one needs is
the pointer to the proper device which gets discovered during instance
init.
So stash that pointer into a variable and use it when setting up the
EDAC PCI component.
Clear that variable when the driver needs to unwind due to some
instances failing init to avoid any registration imbalance.
Cc: <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/edac/amd64_edac.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -18,6 +18,9 @@ static struct msr __percpu *msrs;
/* Per-node stuff */
static struct ecc_settings **ecc_stngs;
+/* Device for the PCI component */
+static struct device *pci_ctl_dev;
+
/*
* Valid scrub rates for the K8 hardware memory scrubber. We map the scrubbing
* bandwidth to a valid bit pattern. The 'set' operation finds the 'matching-
@@ -2563,6 +2566,9 @@ reserve_mc_sibling_devs(struct amd64_pvt
return -ENODEV;
}
+ if (!pci_ctl_dev)
+ pci_ctl_dev = &pvt->F0->dev;
+
edac_dbg(1, "F0: %s\n", pci_name(pvt->F0));
edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
edac_dbg(1, "F6: %s\n", pci_name(pvt->F6));
@@ -2587,6 +2593,9 @@ reserve_mc_sibling_devs(struct amd64_pvt
return -ENODEV;
}
+ if (!pci_ctl_dev)
+ pci_ctl_dev = &pvt->F2->dev;
+
edac_dbg(1, "F1: %s\n", pci_name(pvt->F1));
edac_dbg(1, "F2: %s\n", pci_name(pvt->F2));
edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
@@ -3441,21 +3450,10 @@ static void remove_one_instance(unsigned
static void setup_pci_device(void)
{
- struct mem_ctl_info *mci;
- struct amd64_pvt *pvt;
-
if (pci_ctl)
return;
- mci = edac_mc_find(0);
- if (!mci)
- return;
-
- pvt = mci->pvt_info;
- if (pvt->umc)
- pci_ctl = edac_pci_create_generic_ctl(&pvt->F0->dev, EDAC_MOD_STR);
- else
- pci_ctl = edac_pci_create_generic_ctl(&pvt->F2->dev, EDAC_MOD_STR);
+ pci_ctl = edac_pci_create_generic_ctl(pci_ctl_dev, EDAC_MOD_STR);
if (!pci_ctl) {
pr_warn("%s(): Unable to create PCI control\n", __func__);
pr_warn("%s(): PCI error report via EDAC not set\n", __func__);
@@ -3535,6 +3533,8 @@ static int __init amd64_edac_init(void)
return 0;
err_pci:
+ pci_ctl_dev = NULL;
+
msrs_free(msrs);
msrs = NULL;
@@ -3566,6 +3566,8 @@ static void __exit amd64_edac_exit(void)
kfree(ecc_stngs);
ecc_stngs = NULL;
+ pci_ctl_dev = NULL;
+
msrs_free(msrs);
msrs = NULL;
}
From: H. Nikolaus Schaller <[email protected]>
commit df9dbaf2c415cd94ad520067a1eccfee62f00a33 upstream.
The pinmux control register offset passed to OMAP4_IOPAD is odd.
Fixes: ab9a13665e7c ("ARM: dts: pandaboard: add gpio user button")
Cc: [email protected]
Signed-off-by: H. Nikolaus Schaller <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/arm/boot/dts/omap4-panda-es.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/omap4-panda-es.dts
+++ b/arch/arm/boot/dts/omap4-panda-es.dts
@@ -49,7 +49,7 @@
button_pins: pinmux_button_pins {
pinctrl-single,pins = <
- OMAP4_IOPAD(0x11b, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */
+ OMAP4_IOPAD(0x0fc, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */
>;
};
};
From: Nicolas Ferre <[email protected]>
commit 85b8350ae99d1300eb6dc072459246c2649a8e50 upstream.
CAN0 and CAN1 instances share the same message ram configured
at 0x210000 on sama5d2 Linux systems.
According to current configuration of CAN0, we need 0x1c00 bytes
so that the CAN1 don't overlap its message ram:
64 x RX FIFO0 elements => 64 x 72 bytes
32 x TXE (TX Event FIFO) elements => 32 x 8 bytes
32 x TXB (TX Buffer) elements => 32 x 72 bytes
So a total of 7168 bytes (0x1C00).
Fix offset to match this needed size.
Make the CAN0 message ram ioremap match exactly this size so that is
easily understandable. Adapt CAN1 size accordingly.
Fixes: bc6d5d7666b7 ("ARM: dts: at91: sama5d2: add m_can nodes")
Reported-by: Dan Sneddon <[email protected]>
Signed-off-by: Nicolas Ferre <[email protected]>
Signed-off-by: Alexandre Belloni <[email protected]>
Tested-by: Cristian Birsan <[email protected]>
Cc: [email protected] # v4.13+
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/arm/boot/dts/sama5d2.dtsi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -1298,7 +1298,7 @@
can0: can@f8054000 {
compatible = "bosch,m_can";
- reg = <0xf8054000 0x4000>, <0x210000 0x4000>;
+ reg = <0xf8054000 0x4000>, <0x210000 0x1c00>;
reg-names = "m_can", "message_ram";
interrupts = <56 IRQ_TYPE_LEVEL_HIGH 7>,
<64 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -1491,7 +1491,7 @@
can1: can@fc050000 {
compatible = "bosch,m_can";
- reg = <0xfc050000 0x4000>, <0x210000 0x4000>;
+ reg = <0xfc050000 0x4000>, <0x210000 0x3800>;
reg-names = "m_can", "message_ram";
interrupts = <57 IRQ_TYPE_LEVEL_HIGH 7>,
<65 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -1501,7 +1501,7 @@
assigned-clocks = <&can1_gclk>;
assigned-clock-parents = <&utmi>;
assigned-clock-rates = <40000000>;
- bosch,mram-cfg = <0x1100 0 0 64 0 0 32 32>;
+ bosch,mram-cfg = <0x1c00 0 0 64 0 0 32 32>;
status = "disabled";
};
From: Sakari Ailus <[email protected]>
commit 61e7f892b5ee1dd10ea8bff805f3c3fe6e535959 upstream.
If starting a video buffer queue fails, the buffers are returned to
videobuf2. Remove the reference to the buffer from the driver's queue as
well.
Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <[email protected]>
Cc: [email protected] # v4.16 and up
Reviewed-by: Andy Shevchenko <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/media/pci/intel/ipu3/ipu3-cio2.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -801,6 +801,7 @@ static void cio2_vb2_return_all_buffers(
atomic_dec(&q->bufs_queued);
vb2_buffer_done(&q->bufs[i]->vbb.vb2_buf,
state);
+ q->bufs[i] = NULL;
}
}
}
From: Pali Rohár <[email protected]>
[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.
Signed-off-by: Pali Rohár <[email protected]>
Fixes: ab0ea257fc58d ("cpufreq: st: Provide runtime initialised driver for ST's platforms")
Signed-off-by: Viresh Kumar <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/cpufreq/sti-cpufreq.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
index 6b5d241c30b70..2d09960afa591 100644
--- a/drivers/cpufreq/sti-cpufreq.c
+++ b/drivers/cpufreq/sti-cpufreq.c
@@ -295,6 +295,13 @@ register_cpufreq_dt:
}
module_init(sti_cpufreq_init);
+static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = {
+ { .compatible = "st,stih407" },
+ { .compatible = "st,stih410" },
+ { },
+};
+MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match);
+
MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver");
MODULE_AUTHOR("Ajitpal Singh <[email protected]>");
MODULE_AUTHOR("Lee Jones <[email protected]>");
--
2.27.0
From: Pali Rohár <[email protected]>
[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.
Signed-off-by: Pali Rohár <[email protected]>
Fixes: 501c574f4e3a5 ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC")
Signed-off-by: Viresh Kumar <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/cpufreq/mediatek-cpufreq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
index eb8920d398181..5a81e20f02824 100644
--- a/drivers/cpufreq/mediatek-cpufreq.c
+++ b/drivers/cpufreq/mediatek-cpufreq.c
@@ -554,6 +554,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
{ }
};
+MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
static int __init mtk_cpufreq_driver_init(void)
{
--
2.27.0
From: Zhihao Cheng <[email protected]>
[ Upstream commit c95e6515a8c065862361f7e0e452978ade7f94ec ]
Return the corresponding error code when first_msi_entry() returns
NULL in mv_xor_v2_probe().
Fixes: 19a340b1a820430 ("dmaengine: mv_xor_v2: new driver")
Reported-by: Hulk Robot <[email protected]>
Signed-off-by: Zhihao Cheng <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Vinod Koul <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/dma/mv_xor_v2.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index 8dc0aa4d73ab8..462adf7e4e952 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -777,8 +777,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
goto disable_clk;
msi_desc = first_msi_entry(&pdev->dev);
- if (!msi_desc)
+ if (!msi_desc) {
+ ret = -ENODEV;
goto free_msi_irqs;
+ }
xor_dev->msi_desc = msi_desc;
ret = devm_request_irq(&pdev->dev, msi_desc->irq,
--
2.27.0
From: Yang Yingliang <[email protected]>
[ Upstream commit 723ae803218da993143387bf966042eccefac077 ]
Return -ENOMEM when allocating refill memory failed.
Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform")
Reported-by: Hulk Robot <[email protected]>
Signed-off-by: Yang Yingliang <[email protected]>
Signed-off-by: Thomas Zimmermann <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index e884183c018ac..cb5ce73f72694 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -763,6 +763,7 @@ static int omap_dmm_probe(struct platform_device *dev)
&omap_dmm->refill_pa, GFP_KERNEL);
if (!omap_dmm->refill_va) {
dev_err(&dev->dev, "could not allocate refill memory\n");
+ ret = -ENOMEM;
goto fail;
}
--
2.27.0
From: Cristian Birsan <[email protected]>
[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]
The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.
Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
Signed-off-by: Cristian Birsan <[email protected]>
Signed-off-by: Alexandre Belloni <[email protected]>
Acked-by: Ludovic Desroches <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index 02c1d2958d780..74440dad43354 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -243,6 +243,11 @@
atmel,pins =
<AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>; /* PE9, conflicts with A9 */
};
+ pinctrl_usb_default: usb_default {
+ atmel,pins =
+ <AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+ AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+ };
};
};
};
@@ -260,6 +265,8 @@
&pioE 3 GPIO_ACTIVE_LOW
&pioE 4 GPIO_ACTIVE_LOW
>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usb_default>;
status = "okay";
};
--
2.27.0
From: Peilin Ye <[email protected]>
commit f7e0e8b2f1b0a09b527885babda3e912ba820798 upstream.
`num_reports` is not being properly checked. A malformed event packet with
a large `num_reports` number makes hci_le_direct_adv_report_evt() read out
of bounds. Fix it.
Cc: [email protected]
Fixes: 2f010b55884e ("Bluetooth: Add support for handling LE Direct Advertising Report events")
Reported-and-tested-by: [email protected]
Link: https://syzkaller.appspot.com/bug?extid=24ebd650e20bd263ca01
Signed-off-by: Peilin Ye <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/bluetooth/hci_event.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5596,21 +5596,19 @@ static void hci_le_direct_adv_report_evt
struct sk_buff *skb)
{
u8 num_reports = skb->data[0];
- void *ptr = &skb->data[1];
+ struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
- hci_dev_lock(hdev);
+ if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
+ return;
- while (num_reports--) {
- struct hci_ev_le_direct_adv_info *ev = ptr;
+ hci_dev_lock(hdev);
+ for (; num_reports; num_reports--, ev++)
process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
ev->bdaddr_type, &ev->direct_addr,
ev->direct_addr_type, ev->rssi, NULL, 0,
false);
- ptr += sizeof(*ev);
- }
-
hci_dev_unlock(hdev);
}
From: Paul Moore <[email protected]>
[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ]
A previous fix, commit 83370b31a915 ("selinux: fix error initialization
in inode_doinit_with_dentry()"), changed how failures were handled
before a SELinux policy was loaded. Unfortunately that patch was
potentially problematic for two reasons: it set the isec->initialized
state without holding a lock, and it didn't set the inode's SELinux
label to the "default" for the particular filesystem. The later can
be a problem if/when a later attempt to revalidate the inode fails
and SELinux reverts to the existing inode label.
This patch should restore the default inode labeling that existed
before the original fix, without affecting the LABEL_INVALID marking
such that revalidation will still be attempted in the future.
Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
Reported-by: Sven Schnelle <[email protected]>
Tested-by: Sven Schnelle <[email protected]>
Reviewed-by: Ondrej Mosnacek <[email protected]>
Signed-off-by: Paul Moore <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
security/selinux/hooks.c | 31 +++++++++++++------------------
1 file changed, 13 insertions(+), 18 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 02afe52a55d0d..08833bbb97aab 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1618,13 +1618,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
* inode_doinit with a dentry, before these inodes could
* be used again by userspace.
*/
- isec->initialized = LABEL_INVALID;
- /*
- * There is nothing useful to jump to the "out"
- * label, except a needless spin lock/unlock
- * cycle.
- */
- return 0;
+ goto out_invalid;
}
len = INITCONTEXTLEN;
@@ -1739,15 +1733,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
* inode_doinit() with a dentry, before these inodes
* could be used again by userspace.
*/
- if (!dentry) {
- isec->initialized = LABEL_INVALID;
- /*
- * There is nothing useful to jump to the "out"
- * label, except a needless spin lock/unlock
- * cycle.
- */
- return 0;
- }
+ if (!dentry)
+ goto out_invalid;
rc = selinux_genfs_get_sid(dentry, sclass,
sbsec->flags, &sid);
dput(dentry);
@@ -1760,11 +1747,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
out:
spin_lock(&isec->lock);
if (isec->initialized == LABEL_PENDING) {
- if (!sid || rc) {
+ if (rc) {
isec->initialized = LABEL_INVALID;
goto out_unlock;
}
-
isec->initialized = LABEL_INITIALIZED;
isec->sid = sid;
}
@@ -1772,6 +1758,15 @@ out:
out_unlock:
spin_unlock(&isec->lock);
return rc;
+
+out_invalid:
+ spin_lock(&isec->lock);
+ if (isec->initialized == LABEL_PENDING) {
+ isec->initialized = LABEL_INVALID;
+ isec->sid = sid;
+ }
+ spin_unlock(&isec->lock);
+ return 0;
}
/* Convert a Linux signal to an access vector. */
--
2.27.0
From: Dae R. Jeong <[email protected]>
commit c731b84b51bf7fe83448bea8f56a6d55006b0615 upstream.
Syzkaller reports a warning as belows.
WARNING: CPU: 0 PID: 9647 at drivers/md/md.c:7169
...
Call Trace:
...
RIP: 0010:md_ioctl+0x4017/0x5980 drivers/md/md.c:7169
RSP: 0018:ffff888096027950 EFLAGS: 00010293
RAX: ffff88809322c380 RBX: 0000000000000932 RCX: ffffffff84e266f2
RDX: 0000000000000000 RSI: ffffffff84e299f7 RDI: 0000000000000007
RBP: ffff888096027bc0 R08: ffff88809322c380 R09: ffffed101341a482
R10: ffff888096027940 R11: ffff88809a0d240f R12: 0000000000000932
R13: ffff8880a2c14100 R14: ffff88809a0d2268 R15: ffff88809a0d2408
__blkdev_driver_ioctl block/ioctl.c:304 [inline]
blkdev_ioctl+0xece/0x1c10 block/ioctl.c:606
block_ioctl+0xee/0x130 fs/block_dev.c:1930
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
This is caused by a race between two concurrenct md_ioctl()s closing
the array.
CPU1 (md_ioctl()) CPU2 (md_ioctl())
------ ------
set_bit(MD_CLOSING, &mddev->flags);
did_set_md_closing = true;
WARN_ON_ONCE(test_bit(MD_CLOSING,
&mddev->flags));
if(did_set_md_closing)
clear_bit(MD_CLOSING, &mddev->flags);
Fix the warning by returning immediately if the MD_CLOSING bit is set
in &mddev->flags which indicates that the array is being closed.
Fixes: 065e519e71b2 ("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop")
Reported-by: [email protected]
Cc: [email protected]
Signed-off-by: Dae R. Jeong <[email protected]>
Signed-off-by: Song Liu <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/md/md.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7214,8 +7214,11 @@ static int md_ioctl(struct block_device
err = -EBUSY;
goto out;
}
- WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags));
- set_bit(MD_CLOSING, &mddev->flags);
+ if (test_and_set_bit(MD_CLOSING, &mddev->flags)) {
+ mutex_unlock(&mddev->open_mutex);
+ err = -EBUSY;
+ goto out;
+ }
did_set_md_closing = true;
mutex_unlock(&mddev->open_mutex);
sync_blockdev(bdev);
From: Nicholas Piggin <[email protected]>
[ Upstream commit 8ff00399b153440c1c83e20c43020385b416415b ]
powerpc/64s keeps a counter in the mm which counts bits set in
mm_cpumask as well as other things. This means it can't use generic code
to clear bits out of the mask and doesn't adjust the arch specific
counter.
Add an arch override that allows powerpc/64s to use
clear_tasks_mm_cpumask().
Signed-off-by: Nicholas Piggin <[email protected]>
Reviewed-by: Aneesh Kumar K.V <[email protected]>
Acked-by: Peter Zijlstra (Intel) <[email protected]>
Signed-off-by: Michael Ellerman <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
kernel/cpu.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 08b9d6ba0807f..9a39a24f60253 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -776,6 +776,10 @@ void __init cpuhp_threads_init(void)
}
#ifdef CONFIG_HOTPLUG_CPU
+#ifndef arch_clear_mm_cpumask_cpu
+#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
+#endif
+
/**
* clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
* @cpu: a CPU id
@@ -811,7 +815,7 @@ void clear_tasks_mm_cpumask(int cpu)
t = find_lock_task_mm(p);
if (!t)
continue;
- cpumask_clear_cpu(cpu, mm_cpumask(t->mm));
+ arch_clear_mm_cpumask_cpu(cpu, t->mm);
task_unlock(t);
}
rcu_read_unlock();
--
2.27.0
From: Alexander Sverdlin <[email protected]>
commit d96f04d347e4011977abdbb4da5d8f303ebd26f8 upstream.
It has been observed that once per 300-1300 port openings the first
transmitted byte is being corrupted on AM3352 ("v" written to FIFO appeared
as "e" on the wire). It only happened if single byte has been transmitted
right after port open, which means, DMA is not used for this transfer and
the corruption never happened afterwards.
Therefore I've carefully re-read the MDR1 errata (link below), which says
"when accessing the MDR1 registers that causes a dummy under-run condition
that will freeze the UART in IrDA transmission. In UART mode, this may
corrupt the transferred data". Strictly speaking,
omap_8250_mdr1_errataset() performs a read access and if the value is the
same as should be written, exits without errata-recommended FIFO reset.
A brief check of the serial_omap_mdr1_errataset() from the competing
omap-serial driver showed it has no read access of MDR1. After removing the
read access from omap_8250_mdr1_errataset() the data corruption never
happened any more.
Link: https://www.ti.com/lit/er/sprz360i/sprz360i.pdf
Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
Cc: [email protected]
Signed-off-by: Alexander Sverdlin <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/tty/serial/8250/8250_omap.c | 5 -----
1 file changed, 5 deletions(-)
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -163,11 +163,6 @@ static void omap_8250_mdr1_errataset(str
struct omap8250_priv *priv)
{
u8 timeout = 255;
- u8 old_mdr1;
-
- old_mdr1 = serial_in(up, UART_OMAP_MDR1);
- if (old_mdr1 == priv->mdr1)
- return;
serial_out(up, UART_OMAP_MDR1, priv->mdr1);
udelay(2);
On Mon, Dec 28, 2020 at 01:45:19PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.164 release.
> There are 346 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 155 pass: 155 fail: 0
Qemu test results:
total: 418 pass: 418 fail: 0
Tested-by: Guenter Roeck <[email protected]>
Guenter
On Mon, 28 Dec 2020 at 18:50, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 4.19.164 release.
> There are 346 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.164-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <[email protected]>
Summary
------------------------------------------------------------------------
kernel: 4.19.164-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: c1838bdb8a07c9ea1120eb17b9b879246466e691
git describe: v4.19.163-347-gc1838bdb8a07
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.19.y/build/v4.19.163-347-gc1838bdb8a07
No regressions (compared to build v4.19.163)
No fixes (compared to build v4.19.163)
Ran 45371 total tests in the following environments and test suites.
Environments
--------------
- arm
- arm64
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- mips
- qemu-arm64-clang
- qemu-arm64-kasan
- qemu-x86_64-clang
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- s390
- sparc
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* linux-log-parser
* install-android-platform-tools-r2600
* kselftest
* kvm-unit-tests
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* fwts
* libhugetlbfs
* ltp-controllers-tests
* ltp-hugetlb-tests
* ltp-ipc-tests
* ltp-mm-tests
* ltp-tracing-tests
* network-basic-tests
* v4l2-compliance
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-io-tests
* ltp-open-posix-tests
* rcutorture
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
--
Linaro LKFT
https://lkft.linaro.org
Hi!
> This is the start of the stable review cycle for the 4.19.164 release.
> There are 346 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.164-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.19.y
Tested-by: Pavel Machek (CIP) <[email protected]>
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
On Wed, Dec 30, 2020 at 10:38:40AM +0100, Pavel Machek wrote:
> Hi!
>
> > This is the start of the stable review cycle for the 4.19.164 release.
> > There are 346 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.164-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> > and the diffstat can be found below.
>
> CIP testing did not find any problems here:
>
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.19.y
>
> Tested-by: Pavel Machek (CIP) <[email protected]>
Thanks for testing 2 of these and letting me know.
greg k-h
Hi!
> ecdh_set_secret() casts a void* pointer to a const u64* in order to
> feed it into ecc_is_key_valid(). This is not generally permitted by
> the C standard, and leads to actual misalignment faults on ARMv6
> cores. In some cases, these are fixed up in software, but this still
> leads to performance hits that are entirely avoidable.
>
> So let's copy the key into the ctx buffer first, which we will do
> anyway in the common case, and which guarantees correct alignment.
Fair enough... but: params.key_size is validated in
ecc_is_key_valid(), and that now happens _after_ memcpy.
How is it guaranteed that we don't overflow the buffer during memcpy?
> +++ b/crypto/ecdh.c
> @@ -57,12 +57,13 @@ static int ecdh_set_secret(struct crypto
> return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
> ctx->private_key);
>
> - if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
> - (const u64 *)params.key, params.key_size) < 0)
> - return -EINVAL;
> -
> memcpy(ctx->private_key, params.key, params.key_size);
>
> + if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
> + ctx->private_key, params.key_size) < 0) {
> + memzero_explicit(ctx->private_key, params.key_size);
> + return -EINVAL;
> + }
> return 0;
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
On Thu, 31 Dec 2020 at 21:09, Pavel Machek <[email protected]> wrote:
>
> Hi!
>
> > ecdh_set_secret() casts a void* pointer to a const u64* in order to
> > feed it into ecc_is_key_valid(). This is not generally permitted by
> > the C standard, and leads to actual misalignment faults on ARMv6
> > cores. In some cases, these are fixed up in software, but this still
> > leads to performance hits that are entirely avoidable.
> >
> > So let's copy the key into the ctx buffer first, which we will do
> > anyway in the common case, and which guarantees correct alignment.
>
> Fair enough... but: params.key_size is validated in
> ecc_is_key_valid(), and that now happens _after_ memcpy.
>
> How is it guaranteed that we don't overflow the buffer during memcpy?
>
It is not, thanks for pointing that out. There are some redundant
checks being performed, so you won't trigger it easily with fuzzing,
but afaict, an intentionally crafted invalid input could indeed
overflow the buffer.
I'll send a fix shortly.
> > +++ b/crypto/ecdh.c
> > @@ -57,12 +57,13 @@ static int ecdh_set_secret(struct crypto
> > return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
> > ctx->private_key);
> >
> > - if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
> > - (const u64 *)params.key, params.key_size) < 0)
> > - return -EINVAL;
> > -
> > memcpy(ctx->private_key, params.key, params.key_size);
> >
> > + if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
> > + ctx->private_key, params.key_size) < 0) {
> > + memzero_explicit(ctx->private_key, params.key_size);
> > + return -EINVAL;
> > + }
> > return 0;
>
> Best regards,
> Pavel
> --
> DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
> HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany