aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-01-22scsi: lpfc: nvme: avoid hang / use-after-free when destroying localportEwan D. Milne2-8/+10
We cannot wait on a completion object in the lpfc_nvme_lport structure in the _destroy_localport() code path because the NVMe/fc transport will free that structure immediately after the .localport_delete() callback. This results in a use-after-free, and a hang if slub_debug=FZPU is enabled. Fix this by putting the completion on the stack. Signed-off-by: Ewan D. Milne <[email protected]> Acked-by: James Smart <[email protected]> Signed-off-by: Martin K. Petersen <[email protected]>
2019-01-22scsi: communicate max segment size to the DMA mapping codeChristoph Hellwig5-29/+20
When a host driver sets a maximum segment size we should not only propagate that setting to the block layer, which can merge segments, but also to the DMA mapping layer which can merge segments as well. Fixes: 50c2e9107f ("scsi: introduce a max_segment_size host_template parameters") Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Martin K. Petersen <[email protected]>
2019-01-22net: dpaa2: improve PTP Kconfig optionYangbo Lu1-2/+3
Converted to use "imply" instead of "select" for PTP_1588_CLOCK driver selecting. This could break the hard dependency between the PTP clock subsystem and ethernet drivers. This patch also set "default y" for dpaa2 ptp driver building to provide user an available ptp clock in default. Signed-off-by: Yangbo Lu <[email protected]> Acked-by: Richard Cochran <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-01-22Merge branch 'qed-Error-recovery-process'David S. Miller18-202/+743
Michal Kalderon says: ==================== qed*: Error recovery process Parity errors might happen in the device's memories due to momentary bit flips which are caused by radiation. Errors that are not correctable initiate a process kill event, which blocks the device access towards the host and the network, and a recovery process is started in the management FW and in the driver. This series adds the support of this process in the qed core module and in the qede driver (patches 2 & 3). Patch 1 in the series revises the load sequence, to avoid PCI errors that might be observed during a recovery process. ==================== Signed-off-by: David S. Miller <[email protected]>
2019-01-22qede: Error recovery processTomer Tayar4-74/+314
This patch adds the error recovery process in the qede driver. The process includes a partial/customized driver unload and load, which allows it to look like a short suspend period to the kernel while preserving the net devices' state. Signed-off-by: Tomer Tayar <[email protected]> Signed-off-by: Ariel Elior <[email protected]> Signed-off-by: Michal Kalderon <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-01-22qed: Add infrastructure for error detection and recoveryTomer Tayar11-16/+251
This patch adds the detection and handling of a parity error ("process kill event"), including the update of the protocol drivers, and the prevention of any HW access that will lead to device access towards the host while recovery is in progress. It also provides the means for the protocol drivers to trigger a recovery process on their decision. Signed-off-by: Tomer Tayar <[email protected]> Signed-off-by: Ariel Elior <[email protected]> Signed-off-by: Michal Kalderon <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-01-22qed: Revise load sequence to avoid PCI errorsTomer Tayar7-112/+178
Initiating final cleanup after an ungraceful driver unload can lead to bad PCI accesses towards the host. This patch revises the load sequence so final cleanup is sent while the internal master enable is cleared, to prevent the host accesses, and clears the internal error indications just before enabling the internal master enable. Signed-off-by: Tomer Tayar <[email protected]> Signed-off-by: Ariel Elior <[email protected]> Signed-off-by: Michal Kalderon <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-01-22net/ipv6: don't return positive numbers when nothing was dumpedJakub Kicinski1-0/+2
in6_dump_addrs() returns a positive 1 if there was nothing to dump. This return value can not be passed as return from inet6_dump_addr() as is, because it will confuse rtnetlink, resulting in NLMSG_DONE never getting set: $ ip addr list dev lo EOF on netlink Dump terminated v2: flip condition to avoid a new goto (DaveA) Fixes: 7c1e8a3817c5 ("netlink: fixup regression in RTM_GETADDR") Reported-by: Brendan Galloway <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]> Reviewed-by: David Ahern <[email protected]> Tested-by: David Ahern <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-01-23Merge tag 'clk-fixes-for-linus' of ↵Linus Torvalds9-17/+23
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "This is a sort of random collection of clk fixes that have come in since the merge window: - Handful of memory allocation and potentially bad pointer usage fixes - JSON format was incorrect for clk_dump because it missed a comma - Two Kconfig fixes, one duplicate and one missing select line - Compiler warning fix for the VC5 clk driver - Name and rate fixes for PLLs in the stratix10 driver so it can properly detect PLL rates and parents" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: socfpga: stratix10: fix naming convention for the fixed-clocks clk: socfpga: stratix10: fix rate calculation for pll clocks clk: qcom: Select QCOM_GDSC with MSM_GCC_8998 clk: vc5: Abort clock configuration without upstream clock clk: sysfs: fix invalid JSON in clk_dump clk: imx: Remove Kconfig duplicate include clk: zynqmp: Fix memory allocation in zynqmp_clk_setup clk: tegra: dfll: Fix a potential Oop in remove() clk: imx: fix potential NULL dereference in imx8qxp_lpcg_clk_probe()
2019-01-23Merge tag 'linux-kselftest-5.0-rc4' of ↵Linus Torvalds7-16/+118
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "Fixes to rtc, seccomp and other tests" * tag 'linux-kselftest-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/seccomp: Abort without user notification support selftests: gpio-mockup-chardev: Check asprintf() for error selftests: seccomp: use LDLIBS instead of LDFLAGS selftests/vm/gup_benchmark.c: match gup struct to kernel tools/testing/selftests/x86/unwind_vdso.c: Remove duplicate header x86/mpx/selftests: fix spelling mistake "succeded" -> "succeeded" selftests: rtc: rtctest: add alarm test on minute boundary selftests: rtc: rtctest: fix alarm tests
2019-01-22writeback: synchronize sync(2) against cgroup writeback membership switchesTejun Heo3-2/+40
sync_inodes_sb() can race against cgwb (cgroup writeback) membership switches and fail to writeback some inodes. For example, if an inode switches to another wb while sync_inodes_sb() is in progress, the new wb might not be visible to bdi_split_work_to_wbs() at all or the inode might jump from a wb which hasn't issued writebacks yet to one which already has. This patch adds backing_dev_info->wb_switch_rwsem to synchronize cgwb switch path against sync_inodes_sb() so that sync_inodes_sb() is guaranteed to see all the target wbs and inodes can't jump wbs to escape syncing. v2: Fixed misplaced rwsem init. Spotted by Jiufei. Signed-off-by: Tejun Heo <[email protected]> Reported-by: Jiufei Xue <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Acked-by: Jan Kara <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-01-22net: ip_gre: use erspan key field for tunnel lookupLorenzo Bianconi3-13/+17
Use ERSPAN key header field as tunnel key in gre_parse_header routine since ERSPAN protocol sets the key field of the external GRE header to 0 resulting in a tunnel lookup fail in ip6gre_err. In addition remove key field parsing and pskb_may_pull check in erspan_rcv and ip6erspan_rcv Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support") Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-01-22net: sun: cassini: Cleanup license conflictThomas Gleixner2-28/+2
The recent addition of SPDX license identifiers to the files in drivers/net/ethernet/sun created a licensing conflict. The cassini driver files contain a proper license notice: * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of the * License, or (at your option) any later version. but the SPDX change added: SPDX-License-Identifier: GPL-2.0 So the file got tagged GPL v2 only while in fact it is licensed under GPL v2 or later. It's nice that people care about the SPDX tags, but they need to be more careful about it. Not everything under (the) sun belongs to ... Fix up the SPDX identifier and remove the boiler plate text as it is redundant. Fixes: c861ef83d771 ("sun: Add SPDX license tags to Sun network drivers") Signed-off-by: Thomas Gleixner <[email protected]> Cc: Shannon Nelson <[email protected]> Cc: Zhu Yanjun <[email protected]> Cc: David S. Miller <[email protected]> Cc: [email protected] Cc: [email protected] Acked-by: Shannon Nelson <[email protected]> Reviewed-by: Zhu Yanjun <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-01-22dm: add missing trace_block_split() to __split_and_process_bio()Mike Snitzer1-0/+1
Provides useful context about bio splits in blktrace. Signed-off-by: Mike Snitzer <[email protected]>
2019-01-22dm: fix dm_wq_work() to only use __split_and_process_bio() if appropriateMike Snitzer1-6/+12
Otherwise targets that don't support/expect IO splitting could resubmit bios using code paths with unnecessary IO splitting complexity. Depends-on: 24113d487843 ("dm: avoid indirect call in __dm_make_request") Fixes: 978e51ba38e00 ("dm: optimize bio-based NVMe IO submission") Signed-off-by: Mike Snitzer <[email protected]>
2019-01-23Merge branch 'for-linus' of ↵Linus Torvalds4-13/+18
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - descriptor parsing regression fix for devices that have more than 16 collections, from Peter Hutterer (and followup cleanup from Philipp Zabel) - quirk for Goodix touchpad * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: core: simplify active collection tracking HID: i2c-hid: Disable runtime PM on Goodix touchpad HID: core: replace the collection tree pointers with indices
2019-01-22vfio/pci: Cleanup license messThomas Gleixner2-10/+2
The recently added nvlink2 VFIO driver introduced a license conflict in two files. In both cases the SPDX license identifier is: SPDX-License-Identifier: GPL-2.0+ but the files contain also the following license boiler plate text: * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation The latter is GPL-2.9-only and not GPL-2.0=. Looking deeper. The nvlink source file is derived from vfio_pci_igd.c which is also licensed under GPL-2.0-only and it can be assumed that the file was copied and modified. As the original file is licensed GPL-2.0-only it's not possible to relicense derivative work to GPL-2.0-or-later. Fix the SPDX identifier and remove the boiler plate as it is redundant. Fixes: 7f92891778df ("vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver") Signed-off-by: Thomas Gleixner <[email protected]> Cc: Alexey Kardashevskiy <[email protected]> Cc: Alex Williamson <[email protected]> Cc: Michael Ellerman <[email protected]> Cc: [email protected] Signed-off-by: Alex Williamson <[email protected]>
2019-01-22block: cover another queue enter recursion via BIO_QUEUE_ENTEREDMing Lei2-10/+11
Except for blk_queue_split(), bio_split() is used for splitting bio too, then the remained bio is often resubmit to queue via generic_make_request(). So the same queue enter recursion exits in this case too. Unfortunatley commit cd4a4ae4683dc2 doesn't help this case. This patch covers the above case by setting BIO_QUEUE_ENTERED before calling q->make_request_fn. In theory the per-bio flag is used to simulate one stack variable, it is just fine to clear it after q->make_request_fn is returned. Especially the same bio can't be submitted from another context. Fixes: cd4a4ae4683dc2 ("block: don't use blocking queue entered for recursive bio submits") Cc: Tetsuo Handa <[email protected]> Cc: NeilBrown <[email protected]> Reviewed-by: Mike Snitzer <[email protected]> Signed-off-by: Ming Lei <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-01-22x86/Kconfig: Select PCI_LOCKLESS_CONFIG if PCI is enabledSinan Kaya1-1/+1
After commit 5d32a66541c4 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. PCI_LOCKLESS_CONFIG depends on PCI but this dependency has not been mentioned in the Kconfig so add an explicit dependency here and fix WARNING: unmet direct dependencies detected for PCI_LOCKLESS_CONFIG Depends on [n]: PCI [=n] Selected by [y]: - X86 [=y] Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Cc: "H. Peter Anvin" <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: [email protected] Cc: x86-ml <[email protected]> Link: https://lkml.kernel.org/r/[email protected]
2019-01-22direct-io: allow direct writes to empty inodesErnesto A. Fernández1-2/+3
On a DIO_SKIP_HOLES filesystem, the ->get_block() method is currently not allowed to create blocks for an empty inode. This confusion comes from trying to bit shift a negative number, so check the size of the inode first. The problem is most visible for hfsplus, because the fallback to buffered I/O doesn't happen and the write fails with EIO. This is in part the fault of the module, because it gives a wrong return value on ->get_block(); that will be fixed in a separate patch. Reviewed-by: Jeff Moyer <[email protected]> Reviewed-by: Jan Kara <[email protected]> Signed-off-by: Ernesto A. Fernández <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-01-22i3c: master: Fix an error checking typo in 'cdns_i3c_master_probe()'Christophe JAILLET1-2/+2
Fix a cut'n'paste typo. Checking 'master->sysclk' is expected here. Fixes: 603f2bee2c54 ("i3c: master: Add driver for Cadence IP") Signed-off-by: Christophe JAILLET <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: switch from d_add() to d_instantiate()Christian Brauner1-1/+1
In a previous commit we switched from a d_alloc_name() + d_lookup() combination to setup a new dentry and find potential duplicates to the more idiomatic lookup_one_len(). As far as I understand, this also means we need to switch from d_add() to d_instantiate() since lookup_one_len() will create a new dentry when it doesn't find an existing one and add the new dentry to the hash queues. So we only need to call d_instantiate() to connect the dentry to the inode and turn it into a positive dentry. If we were to use d_add() we sure see stack traces like the following indicating that adding the same dentry twice over the same inode: [ 744.441889] CPU: 4 PID: 2849 Comm: landscape-sysin Not tainted 5.0.0-rc1-brauner-binderfs #243 [ 744.441889] Hardware name: Dell DCS XS24-SC2 /XS24-SC2 , BIOS S59_3C20 04/07/2011 [ 744.441889] RIP: 0010:__d_lookup_rcu+0x76/0x190 [ 744.441889] Code: 89 75 c0 49 c1 e9 20 49 89 fd 45 89 ce 41 83 e6 07 42 8d 04 f5 00 00 00 00 89 45 c8 eb 0c 48 8b 1b 48 85 db 0f 84 81 00 00 00 <44> 8b 63 fc 4c 3b 6b 10 75 ea 48 83 7b 08 00 74 e3 41 83 e4 fe 41 [ 744.441889] RSP: 0018:ffffb8c984e27ad0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 744.441889] RAX: 0000000000000038 RBX: ffff9407ef770c08 RCX: ffffb8c980011000 [ 744.441889] RDX: ffffb8c984e27b54 RSI: ffffb8c984e27ce0 RDI: ffff9407e6689600 [ 744.441889] RBP: ffffb8c984e27b28 R08: ffffb8c984e27ba4 R09: 0000000000000007 [ 744.441889] R10: ffff9407e5c4f05c R11: 973f3eb9d84a94e5 R12: 0000000000000002 [ 744.441889] R13: ffff9407e6689600 R14: 0000000000000007 R15: 00000007bfef7a13 [ 744.441889] FS: 00007f0db13bb740(0000) GS:ffff9407f3b00000(0000) knlGS:0000000000000000 [ 744.441889] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 744.441889] CR2: 00007f0dacc51024 CR3: 000000032961a000 CR4: 00000000000006e0 [ 744.441889] Call Trace: [ 744.441889] lookup_fast+0x53/0x300 [ 744.441889] walk_component+0x49/0x350 [ 744.441889] ? inode_permission+0x63/0x1a0 [ 744.441889] link_path_walk.part.33+0x1bc/0x5a0 [ 744.441889] ? path_init+0x190/0x310 [ 744.441889] path_lookupat+0x95/0x210 [ 744.441889] filename_lookup+0xb6/0x190 [ 744.441889] ? __check_object_size+0xb8/0x1b0 [ 744.441889] ? strncpy_from_user+0x50/0x1a0 [ 744.441889] user_path_at_empty+0x36/0x40 [ 744.441889] ? user_path_at_empty+0x36/0x40 [ 744.441889] vfs_statx+0x76/0xe0 [ 744.441889] __do_sys_newstat+0x3d/0x70 [ 744.441889] __x64_sys_newstat+0x16/0x20 [ 744.441889] do_syscall_64+0x5a/0x120 [ 744.441889] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 744.441889] RIP: 0033:0x7f0db0ec2775 [ 744.441889] Code: 00 00 00 75 05 48 83 c4 18 c3 e8 26 55 02 00 66 0f 1f 44 00 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 e1 b6 2d 00 f7 d8 64 89 [ 744.441889] RSP: 002b:00007ffc36bc9388 EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 744.441889] RAX: ffffffffffffffda RBX: 00007ffc36bc9300 RCX: 00007f0db0ec2775 [ 744.441889] RDX: 00007ffc36bc9400 RSI: 00007ffc36bc9400 RDI: 00007f0dad26f050 [ 744.441889] RBP: 0000000000c0bc60 R08: 0000000000000000 R09: 0000000000000001 [ 744.441889] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc36bc9400 [ 744.441889] R13: 0000000000000001 R14: 00000000ffffff9c R15: 0000000000c0bc60 Cc: Al Viro <[email protected]> Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: drop lock in binderfs_binder_ctl_createChristian Brauner1-4/+0
The binderfs_binder_ctl_create() call is a no-op on subsequent calls and the first call is done before we unlock the suberblock. Hence, there is no need to take inode_lock() in there. Let's remove it. Suggested-by: Al Viro <[email protected]> Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: kill_litter_super() before cleanupChristian Brauner1-1/+2
Al pointed out that first calling kill_litter_super() before cleaning up info is more correct since destroying info doesn't depend on the state of the dentries and inodes. That the opposite remains true is not guaranteed. Suggested-by: Al Viro <[email protected]> Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: rework binderfs_binder_device_create()Christian Brauner1-20/+19
- switch from d_alloc_name() + d_lookup() to lookup_one_len(): Instead of using d_alloc_name() and then doing a d_lookup() with the allocated dentry to find whether a device with the name we're trying to create already exists switch to using lookup_one_len(). The latter will either return the existing dentry or a new one. - switch from kmalloc() + strscpy() to kmemdup(): Use a more idiomatic way to copy the name for the new dentry that userspace gave us. Suggested-by: Al Viro <[email protected]> Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: rework binderfs_fill_super()Christian Brauner1-30/+11
Al pointed out that on binderfs_fill_super() error deactivate_locked_super() will call binderfs_kill_super() so all of the freeing and putting we currently do in binderfs_fill_super() is unnecessary and buggy. Let's simply return errors and let binderfs_fill_super() take care of cleaning up on error. Suggested-by: Al Viro <[email protected]> Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: prevent renaming the control dentryChristian Brauner1-18/+10
- make binderfs control dentry immutable: We don't allow to unlink it since it is crucial for binderfs to be useable but if we allow to rename it we make the unlink trivial to bypass. So prevent renaming too and simply treat the control dentry as immutable. - add is_binderfs_control_device() helper: Take the opportunity and turn the check for the control dentry into a separate helper is_binderfs_control_device() since it's now used in two places. - simplify binderfs_rename(): Instead of hand-rolling our custom version of simple_rename() just dumb the whole function down to first check whether we're trying to rename the control dentry. If we do EPERM the caller and if not call simple_rename(). Suggested-by: Al Viro <[email protected]> Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: remove outdated commentChristian Brauner1-4/+0
The comment stems from an early version of that patchset and is just confusing now. Cc: Al Viro <[email protected]> Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: use __u32 for device numbersChristian Brauner1-2/+2
We allow more then 255 binderfs binder devices to be created since there are workloads that require more than that. If we use __u8 we'll overflow after 255. So let's use a __u32. Note that there's no released kernel with binderfs out there so this is not a regression. Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22binderfs: use correct include guards in headerChristian Brauner1-3/+3
When we switched over from binder_ctl.h to binderfs.h we forgot to change the include guards. It's minor but it's obviously correct. Signed-off-by: Christian Brauner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22staging: android: ion: Support cpu access during dma_buf_detachLiam Mark1-1/+1
Often userspace doesn't know when the kernel will be calling dma_buf_detach on the buffer. If userpace starts its CPU access at the same time as the sg list is being freed it could end up accessing the sg list after it has been freed. Thread A Thread B - DMA_BUF_IOCTL_SYNC IOCT - ion_dma_buf_begin_cpu_access - list_for_each_entry - ion_dma_buf_detatch - free_duped_table - dma_sync_sg_for_cpu Fix this by getting the ion_buffer lock before freeing the sg table memory. Fixes: 2a55e7b5e544 ("staging: android: ion: Call dma_map_sg for syncing and mapping") Signed-off-by: Liam Mark <[email protected]> Acked-by: Laura Abbott <[email protected]> Acked-by: Andrew F. Davis <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22can: flexcan: fix NULL pointer exception during bringupUwe Kleine-König1-1/+1
Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb) and in the body accessed regs->mb[i] which is an out-of-bounds array access that then resulted in an access to an reserved register area. Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add provision for variable payload size") to iterate a bit differently but still runs one iteration too much resulting to call flexcan_get_mb(priv, priv->mb_count) which results in a WARN_ON and then a NULL pointer exception. This only affects devices compatible with "fsl,p1010-flexcan", "fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan", "fsl,imx28-flexcan", so newer i.MX SoCs are not affected. Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") Signed-off-by: Uwe Kleine-König <[email protected]> Cc: linux-stable <[email protected]> # >= 4.20 Signed-off-by: Marc Kleine-Budde <[email protected]>
2019-01-22can: flexcan: fix 'passing zero to ERR_PTR()' warningYueHaibing1-1/+1
Fix a static code checker warning: drivers/net/can/flexcan.c:1435 flexcan_setup_stop_mode() warn: passing zero to 'PTR_ERR' Fixes: de3578c198c6 ("can: flexcan: add self wakeup support") Signed-off-by: YueHaibing <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]>
2019-01-22can: bcm: check timer values before ktime conversionOliver Hartkopp1-0/+27
Kyungtae Kim detected a potential integer overflow in bcm_[rx|tx]_setup() when the conversion into ktime multiplies the given value with NSEC_PER_USEC (1000). Reference: https://marc.info/?l=linux-can&m=154732118819828&w=2 Add a check for the given tv_usec, so that the value stays below one second. Additionally limit the tv_sec value to a reasonable value for CAN related use-cases of 400 days and ensure all values to be positive. Reported-by: Kyungtae Kim <[email protected]> Tested-by: Oliver Hartkopp <[email protected]> Signed-off-by: Oliver Hartkopp <[email protected]> Cc: linux-stable <[email protected]> # >= 2.6.26 Tested-by: Kyungtae Kim <[email protected]> Acked-by: Andre Naujoks <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]>
2019-01-22can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by ↵Manfred Schlaegl1-14/+13
removing it This patch revert commit 7da11ba5c506 ("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb") After introduction of this change we encountered following new error message on various i.MX plattforms (flexcan): | flexcan 53fc8000.can can0: __can_get_echo_skb: BUG! Trying to echo non | existing skb: can_priv::echo_skb[0] The introduction of the message was a mistake because priv->echo_skb[idx] = NULL is a perfectly valid in following case: If CAN_RAW_LOOPBACK is disabled (setsockopt) in applications, the pkt_type of the tx skb's given to can_put_echo_skb is set to PACKET_LOOPBACK. In this case can_put_echo_skb will not set priv->echo_skb[idx]. It is therefore kept NULL. As additional argument for revert: The order of check and usage of idx was changed. idx is used to access an array element before checking it's boundaries. Signed-off-by: Manfred Schlaegl <[email protected]> Fixes: 7da11ba5c506 ("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb") Cc: linux-stable <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]>
2019-01-22drm/sun4i: hdmi: Fix usage of TMDS clockPriit Laes1-0/+4
Although TMDS clock is required for HDMI to properly function, nobody called clk_prepare_enable(). This fixes reference counting issues and makes sure clock is running when it needs to be running. Due to TDMS clock being parent clock for DDC clock, TDMS clock was turned on/off for each EDID probe, causing spurious failures for certain HDMI/DVI screens. Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support") Signed-off-by: Priit Laes <[email protected]> [Maxime: Moved the TMDS clock enable earlier] Signed-off-by: Maxime Ripard <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-01-22serial: fsl_lpuart: fix maximum acceptable baud rate with over-samplingTomonori Sakita1-1/+1
Using over-sampling ratio, lpuart can accept baud rate upto uartclk / 4. Signed-off-by: Tomonori Sakita <[email protected]> Signed-off-by: Atsushi Nemoto <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22tty: serial: qcom_geni_serial: Allow mctrl when flow control is disabledMatthias Kaehlcke1-2/+2
The geni set/get_mctrl() functions currently do nothing unless hardware flow control is enabled. Remove this arbitrary limitation. Suggested-by: Johan Hovold <[email protected]> Fixes: 8a8a66a1a18a ("tty: serial: qcom_geni_serial: Add support for flow control") Signed-off-by: Matthias Kaehlcke <[email protected]> Reviewed-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-01-22mmc: dw_mmc-bluefield: : Fix the license informationLiming Sun1-5/+0
The SPDX license identifier and the boiler plate text are contradicting. Only the SPDX license identifier is needed. The other one is removed. Fixes: 86958dcc5ad7 ("mmc: dw_mmc-bluefield: Add driver extension") Cc: [email protected] Reviewed-by: David Woods <[email protected]> Signed-off-by: Liming Sun <[email protected]> Signed-off-by: Ulf Hansson <[email protected]>
2019-01-22mmc: meson-gx: enable signal re-sampling together with tuningAndreas Fenkart1-5/+9
card detection fails on "BeeLink Mini M8 SII" if enabled too early mmc1: error -110 whilst initialising MMC card Fixes: 71645e65729f ("mmc: meson-gx: add signal resampling") Signed-off-by: Andreas Fenkart <[email protected]> Reviewed-by: Jerome Brunet <[email protected]> Tested-by: Jerome Brunet <[email protected]> Signed-off-by: Ulf Hansson <[email protected]>
2019-01-22Merge tag 'xarray-5.0-rc3' of git://git.infradead.org/users/willy/linux-daxLinus Torvalds4-113/+278
Pull XArray fixes from Matthew Wilcox: "Fix some oversights in the XArray porcelain API: - support for m68k's two-byte aligned pointers - reserving entries using xa_insert() - missing xa_insert_bh() and xa_insert_irq() functions - simplify using xa_for_each() - use lockdep correctly - a few other minor fixes and improvements" * tag 'xarray-5.0-rc3' of git://git.infradead.org/users/willy/linux-dax: XArray: Fix an arithmetic error in xa_is_err XArray tests: Check mark 2 gets squashed XArray: Fix typo in comment XArray: Honour reserved entries in xa_insert XArray: Permit storing 2-byte-aligned pointers XArray: Change xa_for_each iterator XArray: Turn xa_init_flags into a static inline XArray tests: Add RCU locking
2019-01-22ide: fix a typo in the settings proc file nameChristoph Hellwig1-1/+1
Fixes: ec7d9c9ce8 ("ide: replace ->proc_fops with ->proc_show") Reported-by: kernel test robot <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2019-01-21drm/amd/powerplay: OD setting fix on Vega10Kenneth Feng1-1/+21
gfxclk for OD setting is limited to 1980M for non-acg ASICs of Vega10 Signed-off-by: Kenneth Feng <[email protected]> Reviewed-by: Evan Quan <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2019-01-22Merge tag 'iommu-fixes-v5.0-rc3' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fix from Joerg Roedel: "One fix only for now: Fix probe deferral in iommu/of code (broke with recent changes to iommu_ops->add_device invocation)" * tag 'iommu-fixes-v5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/of: Fix probe-deferral
2019-01-22Merge tag 'arc-5.0-rc3' of ↵Linus Torvalds10-103/+276
git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC architecture updates from Vineet Gupta: - Perf support for raw events - boot log printing: return stack, action points - fix memset to avoid prefetchw bleeding past end of buffer - do_page_fault fix for mmap_sem held while returning to userspace - other misc fixes * tag 'arc-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARCv2: lib: memeset: fix doing prefetchw outside of buffer ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while handle_mm_fault ARC: show_regs: lockdep: re-enable preemption ARC: show_regs: lockdep: avoid page allocator... ARC: perf: avoid kernel killing where it is possible ARC: perf: move HW events mapping to separate function ARC: perf: introduce Kernel PMU events support ARC: perf: trivial code cleanup ARC: perf: map generic branches to correct hardware condition ARC: adjust memblock_reserve of kernel memory arc: remove redundant kernel-space generic-y ARC: fix __ffs return value to avoid build warnings ARC: boot log: print Action point details ARCv2: boot log: BPU return stack depth
2019-01-21acpi/nfit: Fix command-supported detectionDan Williams1-14/+40
The _DSM function number validation only happens to succeed when the generic Linux command number translation corresponds with a DSM-family-specific function number. This breaks NVDIMM-N implementations that correctly implement _LSR, _LSW, and _LSI, but do not happen to publish support for DSM function numbers 4, 5, and 6. Recall that the support for _LS{I,R,W} family of methods results in the DIMM being marked as supporting those command numbers at acpi_nfit_register_dimms() time. The DSM function mask is only used for ND_CMD_CALL support of non-NVDIMM_FAMILY_INTEL devices. Fixes: 31eca76ba2fc ("nfit, libnvdimm: limited/whitelisted dimm command...") Cc: <[email protected]> Link: https://github.com/pmem/ndctl/issues/78 Reported-by: Sujith Pandel <[email protected]> Tested-by: Sujith Pandel <[email protected]> Reviewed-by: Vishal Verma <[email protected]> Reviewed-by: Jeff Moyer <[email protected]> Signed-off-by: Dan Williams <[email protected]>
2019-01-21acpi/nfit: Block function zero DSMsDan Williams1-0/+7
In preparation for using function number 0 as an error value, prevent it from being considered a valid function value by acpi_nfit_ctl(). Cc: <[email protected]> Cc: stuart hayes <[email protected]> Fixes: e02fb7264d8a ("nfit: add Microsoft NVDIMM DSM command set...") Reported-by: Jeff Moyer <[email protected]> Reviewed-by: Jeff Moyer <[email protected]> Signed-off-by: Dan Williams <[email protected]>
2019-01-21libnvdimm/security: Require nvdimm_security_setup_events() to succeedDan Williams5-11/+24
The following warning: ACPI0012:00: security event setup failed: -19 ...is meant to capture exceptional failures of sysfs_get_dirent(), however it will also fail in the common case when security support is disabled. A few issues: 1/ A dev_warn() report for a common case is too chatty 2/ The setup of this notifier is generic, no need for it to be driven from the nfit driver, it can exist completely in the core. 3/ If it fails for any reason besides security support being disabled, that's fatal and should abort DIMM activation. Userspace may hang if it never gets overwrite notifications. 4/ The dirent needs to be released. Move the call to the core 'dimm' driver, make it conditional on security support being active, make it fatal for the exceptional case, add the missing sysfs_put() at device disable time. Fixes: 7d988097c546 ("...Add security DSM overwrite support") Reviewed-by: Dave Jiang <[email protected]> Signed-off-by: Dan Williams <[email protected]>
2019-01-21nfit_test: fix security state pull for nvdimm security nfit_testDave Jiang1-2/+2
The override status function needs to be updated to use the proper request parameter in order to get the security state. Fixes: 3c13e2ac747a ("...Add test support for Intel nvdimm security DSMs") Reported-by: Vishal Verma <[email protected]> Signed-off-by: Dave Jiang <[email protected]> Signed-off-by: Dan Williams <[email protected]>
2019-01-21tty: Handle problem if line discipline does not have receive_bufGreg Kroah-Hartman1-1/+2
Some tty line disciplines do not have a receive buf callback, so properly check for that before calling it. If they do not have this callback, just eat the character quietly, as we can't fail this call. Reported-by: Jann Horn <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.