aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-10-11Merge tag 'modules-for-v5.4-rc3' of ↵Linus Torvalds8-22/+27
git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull module fixes from Jessica Yu: "Code cleanups and kbuild/namespace related fixups from Masahiro. Most importantly, it fixes a namespace-related modpost issue for external module builds - Fix broken external module builds due to a modpost bug in read_dump(), where the namespace was not being strdup'd and sym->namespace would be set to bogus data. - Various namespace-related kbuild fixes and cleanups thanks to Masahiro Yamada" * tag 'modules-for-v5.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: doc: move namespaces.rst from kbuild/ to core-api/ nsdeps: make generated patches independent of locale nsdeps: fix hashbang of scripts/nsdeps kbuild: fix build error of 'make nsdeps' in clean tree module: rename __kstrtab_ns_* to __kstrtabns_* to avoid symbol conflict modpost: fix broken sym->namespace for external module builds module: swap the order of symbol.namespace scripts: add_namespace: Fix coccicheck failed
2019-10-11Merge tag 'hyperv-fixes-signed' of ↵Linus Torvalds2-46/+16
git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V fixes from Sasha Levin: "Two fixes from Dexuan Cui: - Fix a (harmless) warning when building vmbus without CONFIG_PM_SLEEP - Fix for a memory leak (and optimization) in the hyperv mouse code" * tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: vmbus: Fix harmless building warnings without CONFIG_PM_SLEEP HID: hyperv: Use in-place iterator API in the channel callback
2019-10-11Documentation/process: Add fallthrough pseudo-keywordJoe Perches2-11/+24
Describe the fallthrough pseudo-keyword. Convert the coding-style.rst example to the keyword style. Add description and links to deprecated.rst. Miguel Ojeda comments on the eventual [[fallthrough]] syntax: "Note that C17/C18 does not have [[fallthrough]]. C++17 introduced it, as it is mentioned above. I would keep the __attribute__((fallthrough)) -> [[fallthrough]] change you did, though, since that is indeed the standard syntax (given the paragraph references C++17). I was told by Aaron Ballman (who is proposing them for C) that it is more or less likely that it becomes standardized in C2x. However, it is still not added to the draft (other attributes are already, though). See N2268 and N2269: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2268.pdf (fallthrough) http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2269.pdf (attributes in general)" Signed-off-by: Joe Perches <[email protected]> Acked-by: Nick Desaulniers <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2019-10-11compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case useJoe Perches1-0/+17
Reserve the pseudo keyword 'fallthrough' for the ability to convert the various case block /* fallthrough */ style comments to appear to be an actual reserved word with the same gcc case block missing fallthrough warning capability. All switch/case blocks now should end in one of: break; fallthrough; goto <label>; return [expression]; continue; In C mode, GCC supports the __fallthrough__ attribute since 7.1, the same time the warning and the comment parsing were introduced. fallthrough devolves to an empty "do {} while (0)" if the compiler version (any version less than gcc 7) does not support the attribute. Signed-off-by: Joe Perches <[email protected]> Acked-by: Peter Zijlstra (Intel) <[email protected]> Suggested-by: Dan Carpenter <[email protected]> Cc: Miguel Ojeda <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2019-10-11net: sctp: Rename fallthrough label to unhandledJoe Perches1-6/+6
fallthrough will become a pseudo reserved keyword so this only use of fallthrough is better renamed to allow it. Signed-off-by: Joe Perches <[email protected]> Reviewed-by: Nick Desaulniers <[email protected]> Reviewed-by: Kees Cook <[email protected]> Acked-by: Neil Horman <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2019-10-11Merge tag 'drm-fixes-2019-10-11' of git://anongit.freedesktop.org/drm/drmLinus Torvalds24-96/+234
Pull drm fixes from Dave Airlie: "The regular fixes pull for rc3. The i915 team found some fixes they (or I) missed for rc1, which is why this is a bit bigger than usual, otherwise there is a single amdgpu fix, some spi panel aliases, and a bridge fix. i915: - execlist access fixes - list deletion fix - CML display fix - HSW workaround extension to GT2 - chicken bit whitelist - GGTT resume issue - SKL GPU hangs for Vulkan compute amdgpu: - memory leak fix panel: - spi aliases tc358767: - bridge artifacts fix" * tag 'drm-fixes-2019-10-11' of git://anongit.freedesktop.org/drm/drm: (22 commits) drm/bridge: tc358767: fix max_tu_symbol value drm/i915/gt: execlists->active is serialised by the tasklet drm/i915/execlists: Protect peeking at execlists->active drm/i915: Fixup preempt-to-busy vs reset of a virtual request drm/i915: Only enqueue already completed requests drm/i915/execlists: Drop redundant list_del_init(&rq->sched.link) drm/i915/cml: Add second PCH ID for CMP drm/amdgpu: fix memory leak drm/panel: tpo-td043mtea1: Fix SPI alias drm/panel: tpo-td028ttec1: Fix SPI alias drm/panel: sony-acx565akm: Fix SPI alias drm/panel: nec-nl8048hl11: Fix SPI alias drm/panel: lg-lb035q02: Fix SPI alias drm/i915: Mark contents as dirty on a write fault drm/i915: Prevent bonded requests from overtaking each other on preemption drm/i915: Bump skl+ max plane width to 5k for linear/x-tiled drm/i915: Verify the engine after acquiring the active.lock drm/i915: Extend Haswell GT1 PSMI workaround to all drm/i915: Don't mix srcu tag and negative error codes drm/i915: Whitelist COMMON_SLICE_CHICKEN2 ...
2019-10-11Merge tag 'for-linus-20191010' of git://git.kernel.dk/linux-blockLinus Torvalds9-55/+29
Pull block fixes from Jens Axboe: - Fix wbt performance regression introduced with the blk-rq-qos refactoring (Harshad) - Fix io_uring fileset removal inadvertently killing the workqueue (me) - Fix io_uring typo in linked command nonblock submission (Pavel) - Remove spurious io_uring wakeups on request free (Pavel) - Fix null_blk zoned command error return (Keith) - Don't use freezable workqueues for backing_dev, also means we can revert a previous libata hack (Mika) - Fix nbd sysfs mutex dropped too soon at removal time (Xiubo) * tag 'for-linus-20191010' of git://git.kernel.dk/linux-block: nbd: fix possible sysfs duplicate warning null_blk: Fix zoned command return code io_uring: only flush workqueues on fileset removal io_uring: remove wait loop spurious wakeups blk-wbt: fix performance regression in wbt scale_up/scale_down Revert "libata, freezer: avoid block device removal while system is frozen" bdi: Do not use freezable workqueue io_uring: fix reversed nonblock flag for link submission
2019-10-11s390/uaccess: avoid (false positive) compiler warningsChristian Borntraeger1-2/+2
Depending on inlining decisions by the compiler, __get/put_user_fn might become out of line. Then the compiler is no longer able to tell that size can only be 1,2,4 or 8 due to the check in __get/put_user resulting in false positives like ./arch/s390/include/asm/uaccess.h: In function ‘__put_user_fn’: ./arch/s390/include/asm/uaccess.h:113:9: warning: ‘rc’ may be used uninitialized in this function [-Wmaybe-uninitialized] 113 | return rc; | ^~ ./arch/s390/include/asm/uaccess.h: In function ‘__get_user_fn’: ./arch/s390/include/asm/uaccess.h:143:9: warning: ‘rc’ may be used uninitialized in this function [-Wmaybe-uninitialized] 143 | return rc; | ^~ These functions are supposed to be always inlined. Mark it as such. Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Vasily Gorbik <[email protected]>
2019-10-11firmware: google: increment VPD key_len properlyBrian Norris1-1/+1
Commit 4b708b7b1a2c ("firmware: google: check if size is valid when decoding VPD data") adds length checks, but the new vpd_decode_entry() function botched the logic -- it adds the key length twice, instead of adding the key and value lengths separately. On my local system, this means vpd.c's vpd_section_create_attribs() hits an error case after the first attribute it parses, since it's no longer looking at the correct offset. With this patch, I'm back to seeing all the correct attributes in /sys/firmware/vpd/... Fixes: 4b708b7b1a2c ("firmware: google: check if size is valid when decoding VPD data") Cc: <[email protected]> Cc: Hung-Te Lin <[email protected]> Signed-off-by: Brian Norris <[email protected]> Reviewed-by: Stephen Boyd <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-11MAINTAINERS: kgdb: Add myself as a reviewer for kgdb/kdbDouglas Anderson1-0/+1
I'm interested in kdb / kgdb and have sent various fixes over the years. I'd like to get CCed on patches so I can be aware of them and also help review. Signed-off-by: Douglas Anderson <[email protected]> Acked-by: Daniel Thompson <[email protected]> Link: https://lore.kernel.org/r/20190920104404.1.I237e68e8825e2d6ac26f8e847f521fe2fcc3705a@changeid Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-11spufs: fix a crash in spufs_create_root()Emmanuel Nicolet1-0/+1
The spu_fs_context was not set in fc->fs_private, this caused a crash when accessing ctx->mode in spufs_create_root(). Fixes: d2e0981c3b9a ("vfs: Convert spufs to use the new mount API") Signed-off-by: Emmanuel Nicolet <[email protected]> Signed-off-by: Michael Ellerman <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2019-10-10io_uring: fix sequence logic for timeout requestsJens Axboe1-17/+20
We have two ways a request can be deferred: 1) It's a regular request that depends on another one 2) It's a timeout that tracks completions We have a shared helper to determine whether to defer, and that attempts to make the right decision based on the request. But we only have some of this information in the caller. Un-share the two timeout/defer helpers so the caller can use the right one. Fixes: 5262f567987d ("io_uring: IORING_OP_TIMEOUT support") Reported-by: yangerkun <[email protected]> Reviewed-by: Jackie Liu <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-10-11Merge tag 'drm-intel-fixes-2019-10-10' of ↵Dave Airlie17-82/+188
git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix CML display by adding a missing ID. - Drop redundant list_del_init - Only enqueue already completed requests to avoid races - Fixup preempt-to-busy vs reset of a virtual request - Protect peeking at execlists->active - execlists->active is serialised by the tasklet drm-intel-next-fixes-2019-09-19: - Extend old HSW workaround to fix some GPU hangs on Haswell GT2 - Fix return error code on GEM mmap. - White list a chicken bit register for push constants legacy mode on Mesa - Fix resume issue related to GGTT restore - Remove incorrect BUG_ON on execlist's schedule-out - Fix unrecoverable GPU hangs with Vulkan compute workloads on SKL drm-intel-next-fixes-2019-09-26: - Fix concurrence on cases where requests where getting retired at same time as resubmitted to HW - Fix gen9 display resolutions by setting the right max plane width - Fix GPU hang on preemption - Mark contents as dirty on a write fault. This was breaking cursor sprite with dumb buffers. Signed-off-by: Dave Airlie <[email protected]> From: Rodrigo Vivi <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-10-11Merge tag 'drm-fixes-5.4-2019-10-09' of ↵Dave Airlie1-7/+7
git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.4-2019-10-09: amdgpu: - fix memory leak in bo_list ioctl error path Signed-off-by: Dave Airlie <[email protected]> From: Alex Deucher <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-10-11Merge tag 'drm-misc-fixes-2019-10-10' of ↵Dave Airlie6-7/+39
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull (less than what git shortlog provides): - SPI Aliases fixes for panels - One fix for the tc358767 bridge dealing with visual artifacts Signed-off-by: Dave Airlie <[email protected]> From: Maxime Ripard <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/20191010105137.j6juxht5dsobgxph@gilmour
2019-10-10SUNRPC: fix race to sk_err after xs_error_reportBenjamin Coddington2-9/+9
Since commit 4f8943f80883 ("SUNRPC: Replace direct task wakeups from softirq context") there has been a race to the value of the sk_err if both XPRT_SOCK_WAKE_ERROR and XPRT_SOCK_WAKE_DISCONNECT are set. In that case, we may end up losing the sk_err value that existed when xs_error_report was called. Fix this by reverting to the previous behavior: instead of using SO_ERROR to retrieve the value at a later time (which might also return sk_err_soft), copy the sk_err value onto struct sock_xprt, and use that value to wake pending tasks. Signed-off-by: Benjamin Coddington <[email protected]> Fixes: 4f8943f80883 ("SUNRPC: Replace direct task wakeups from softirq context") Signed-off-by: Anna Schumaker <[email protected]>
2019-10-10NFSv4: Fix leak of clp->cl_acceptor stringChuck Lever1-0/+1
Our client can issue multiple SETCLIENTID operations to the same server in some circumstances. Ensure that calls to nfs4_proc_setclientid() after the first one do not overwrite the previously allocated cl_acceptor string. unreferenced object 0xffff888461031800 (size 32): comm "mount.nfs", pid 2227, jiffies 4294822467 (age 1407.749s) hex dump (first 32 bytes): 6e 66 73 40 6b 6c 69 6d 74 2e 69 62 2e 31 30 31 [email protected] 35 67 72 61 6e 67 65 72 2e 6e 65 74 00 00 00 00 5granger.net.... backtrace: [<00000000ab820188>] __kmalloc+0x128/0x176 [<00000000eeaf4ec8>] gss_stringify_acceptor+0xbd/0x1a7 [auth_rpcgss] [<00000000e85e3382>] nfs4_proc_setclientid+0x34e/0x46c [nfsv4] [<000000003d9cf1fa>] nfs40_discover_server_trunking+0x7a/0xed [nfsv4] [<00000000b81c3787>] nfs4_discover_server_trunking+0x81/0x244 [nfsv4] [<000000000801b55f>] nfs4_init_client+0x1b0/0x238 [nfsv4] [<00000000977daf7f>] nfs4_set_client+0xfe/0x14d [nfsv4] [<0000000053a68a2a>] nfs4_create_server+0x107/0x1db [nfsv4] [<0000000088262019>] nfs4_remote_mount+0x2c/0x59 [nfsv4] [<00000000e84a2fd0>] legacy_get_tree+0x2d/0x4c [<00000000797e947c>] vfs_get_tree+0x20/0xc7 [<00000000ecabaaa8>] fc_mount+0xe/0x36 [<00000000f15fafc2>] vfs_kern_mount+0x74/0x8d [<00000000a3ff4e26>] nfs_do_root_mount+0x8a/0xa3 [nfsv4] [<00000000d1c2b337>] nfs4_try_mount+0x58/0xad [nfsv4] [<000000004c9bddee>] nfs_fs_mount+0x820/0x869 [nfs] Fixes: f11b2a1cfbf5 ("nfs4: copy acceptor name from context ... ") Signed-off-by: Chuck Lever <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2019-10-10MIPS: Disable Loongson MMI instructions for kernel buildPaul Burton2-0/+5
GCC 9.x automatically enables support for Loongson MMI instructions when using some -march= flags, and then errors out when -msoft-float is specified with: cc1: error: ‘-mloongson-mmi’ must be used with ‘-mhard-float’ The kernel shouldn't be using these MMI instructions anyway, just as it doesn't use floating point instructions. Explicitly disable them in order to fix the build with GCC 9.x. Signed-off-by: Paul Burton <[email protected]> Fixes: 3702bba5eb4f ("MIPS: Loongson: Add GCC 4.4 support for Loongson2E") Fixes: 6f7a251a259e ("MIPS: Loongson: Add basic Loongson 2F support") Fixes: 5188129b8c9f ("MIPS: Loongson-3: Improve -march option and move it to Platform") Cc: Huacai Chen <[email protected]> Cc: Jiaxun Yang <[email protected]> Cc: [email protected] # v2.6.32+ Cc: [email protected]
2019-10-10MIPS: elf_hwcap: Export userspace ASEsJiaxun Yang2-0/+44
A Golang developer reported MIPS hwcap isn't reflecting instructions that the processor actually supported so programs can't apply optimized code at runtime. Thus we export the ASEs that can be used in userspace programs. Reported-by: Meng Zhuo <[email protected]> Signed-off-by: Jiaxun Yang <[email protected]> Cc: [email protected] Cc: Paul Burton <[email protected]> Cc: <[email protected]> # 4.14+ Signed-off-by: Paul Burton <[email protected]>
2019-10-10Merge tag 'xfs-5.4-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linuxLinus Torvalds10-31/+29
Pull xfs fixes from Darrick Wong: "A couple of small code cleanups and bug fixes for rounding errors, metadata logging errors, and an extra layer of safeguards against leaking memory contents. - Fix a rounding error in the fallocate code - Minor code cleanups - Make sure to zero memory buffers before formatting metadata blocks - Fix a few places where we forgot to log an inode metadata update - Remove broken error handling that tried to clean up after a failure but still got it wrong" * tag 'xfs-5.4-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: move local to extent inode logging into bmap helper xfs: remove broken error handling on failed attr sf to leaf change xfs: log the inode on directory sf to block format change xfs: assure zeroed memory buffers for certain kmem allocations xfs: removed unused error variable from xchk_refcountbt_rec xfs: remove unused flags arg from xfs_get_aghdr_buf() xfs: Fix tail rounding in xfs_alloc_file_space()
2019-10-10nbd: fix possible sysfs duplicate warningXiubo Li1-1/+1
1. nbd_put takes the mutex and drops nbd->ref to 0. It then does idr_remove and drops the mutex. 2. nbd_genl_connect takes the mutex. idr_find/idr_for_each fails to find an existing device, so it does nbd_dev_add. 3. just before the nbd_put could call nbd_dev_remove or not finished totally, but if nbd_dev_add try to add_disk, we can hit: debugfs: Directory 'nbd1' with parent 'block' already present! This patch will make sure all the disk add/remove stuff are done by holding the nbd_index_mutex lock. Reported-by: Mike Christie <[email protected]> Reviewed-by: Josef Bacik <[email protected]> Signed-off-by: Xiubo Li <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-10-10xen: Stop abusing DT of_dma_configure APIRob Herring2-21/+4
As the removed comments say, these aren't DT based devices. of_dma_configure() is going to stop allowing a NULL DT node and calling it will no longer work. The comment is also now out of date as of commit 9ab91e7c5c51 ("arm64: default to the direct mapping in get_arch_dma_ops"). Direct mapping is now the default rather than dma_dummy_ops. According to Stefano and Oleksandr, the only other part needed is setting the DMA masks and there's no reason to restrict the masks to 32-bits. So set the masks to 64 bits. Cc: Robin Murphy <[email protected]> Cc: Julien Grall <[email protected]> Cc: Nicolas Saenz Julienne <[email protected]> Cc: Oleksandr Andrushchenko <[email protected]> Cc: Boris Ostrovsky <[email protected]> Cc: Juergen Gross <[email protected]> Cc: Stefano Stabellini <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: [email protected] Signed-off-by: Rob Herring <[email protected]> Acked-by: Oleksandr Andrushchenko <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2019-10-10Merge branch 'linus' of ↵Linus Torvalds2-0/+2
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "Fix build issues in arm/aes-ce" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: arm/aes-ce - add dependency on AES library crypto: arm/aes-ce - build for v8 architecture explicitly
2019-10-10Merge tag 'for-5.4-rc2-tag' of ↵Linus Torvalds6-13/+49
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few more stabitly fixes, one build warning fix. - fix inode allocation under NOFS context - fix leak in fiemap due to concurrent append writes - fix log-root tree updates - fix balance convert of single profile on 32bit architectures - silence false positive warning on old GCCs (code moved in rc1)" * tag 'for-5.4-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: silence maybe-uninitialized warning in clone_range btrfs: fix uninitialized ret in ref-verify btrfs: allocate new inode in NOFS context btrfs: fix balance convert to single on 32-bit host CPUs btrfs: fix incorrect updating of log root tree Btrfs: fix memory leak due to concurrent append writes with fiemap
2019-10-10Merge branch 'work.dcache' of ↵Linus Torvalds1-66/+71
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull dcache_readdir() fixes from Al Viro: "The couple of patches you'd been OK with; no hlist conversion yet, and cursors are still in the list of children" [ Al is referring to future work to avoid some nasty O(n**2) behavior with the readdir cursors when you have lots of concurrent readdirs. This is just a fix for a race with a trivial cleanup - Linus ] * 'work.dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: libfs: take cursors out of list when moving past the end of directory Fix the locking in dcache_readdir() and friends
2019-10-10Merge branch 'work.mount3' of ↵Linus Torvalds2-1/+10
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull mount fixes from Al Viro: "A couple of regressions from the mount series" * 'work.mount3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: vfs: add missing blkdev_put() in get_tree_bdev() shmem: fix LSM options parsing
2019-10-10MAINTAINERS: Remove Simon as Renesas SoC Co-MaintainerGeert Uytterhoeven2-4/+4
At the end of the v5.3 upstream kernel development cycle, Simon stepped down from his role as Renesas SoC maintainer. Remove his maintainership, git repository, and branch from the MAINTAINERS file, and add an entry to the CREDITS file to honor his work. Signed-off-by: Geert Uytterhoeven <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2019-10-10xen/grant-table: remove unnecessary printingFuqian Huang1-2/+1
xen_auto_xlat_grant_frames.vaddr is definitely NULL in this case. So the address printing is unnecessary. Signed-off-by: Fuqian Huang <[email protected]> Reviewed-by: Juergen Gross <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2019-10-10w1: ds250x: Fix build error without CRC16YueHaibing1-0/+1
If CRC16 is not set, building will fails: drivers/w1/slaves/w1_ds250x.o: In function `w1_ds2505_read_page': w1_ds250x.c:(.text+0x82f): undefined reference to `crc16' w1_ds250x.c:(.text+0x90a): undefined reference to `crc16' w1_ds250x.c:(.text+0x91a): undefined reference to `crc16' Reported-by: Hulk Robot <[email protected]> Fixes: 25ec8710d9c2 ("w1: add DS2501, DS2502, DS2505 EPROM device driver") Signed-off-by: YueHaibing <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10virt: vbox: fix memory leak in hgcm_call_preprocess_linaddrNavid Emamdoost1-1/+2
In hgcm_call_preprocess_linaddr memory is allocated for bounce_buf but is not released if copy_form_user fails. In order to prevent memory leak in case of failure, the assignment to bounce_buf_ret is moved before the error check. This way the allocated bounce_buf will be released by the caller. Fixes: 579db9d45cb4 ("virt: Add vboxguest VMMDEV communication code") Signed-off-by: Navid Emamdoost <[email protected]> Reviewed-by: Hans de Goede <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10binder: Fix comment headers on binder_alloc_prepare_to_free()Joel Fernandes (Google)1-1/+1
binder_alloc_buffer_lookup() doesn't exist and is named "binder_alloc_prepare_to_free()". Correct the code comments to reflect this. Signed-off-by: Joel Fernandes (Google) <[email protected]> Reviewed-by: Christian Brauner <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10binder: prevent UAF read in print_binder_transaction_log_entry()Christian Brauner2-2/+4
When a binder transaction is initiated on a binder device coming from a binderfs instance, a pointer to the name of the binder device is stashed in the binder_transaction_log_entry's context_name member. Later on it is used to print the name in print_binder_transaction_log_entry(). By the time print_binder_transaction_log_entry() accesses context_name binderfs_evict_inode() might have already freed the associated memory thereby causing a UAF. Do the simple thing and prevent this by copying the name of the binder device instead of stashing a pointer to it. Reported-by: Jann Horn <[email protected]> Fixes: 03e2e07e3814 ("binder: Make transaction_log available in binderfs") Link: https://lore.kernel.org/r/CAG48ez14Q0-F8LqsvcNbyR2o6gPW8SHXsm4u5jmD9MpsteM2Tw@mail.gmail.com Signed-off-by: Christian Brauner <[email protected]> Reviewed-by: Joel Fernandes (Google) <[email protected]> Acked-by: Todd Kjos <[email protected]> Reviewed-by: Hridya Valsaraju <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: yurex: fix NULL-derefs on disconnectJohan Hovold1-4/+7
The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL without making sure all code paths that used it were done with it. Before commit ef61eb43ada6 ("USB: yurex: Fix protection fault after device removal") this included the interrupt-in completion handler, but there are further accesses in dev_err and dev_dbg statements in yurex_write() and the driver-data destructor (sic!). Fix this by unconditionally stopping also the control URB at disconnect and by using a dedicated disconnected flag. Note that we need to take a reference to the struct usb_interface to avoid a use-after-free in the destructor whenever the device was disconnected while the character device was still open. Fixes: aadd6472d904 ("USB: yurex.c: remove dbg() usage") Fixes: 45714104b9e8 ("USB: yurex.c: remove err() usage") Cc: stable <[email protected]> # 3.5: ef61eb43ada6 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10tty: serial: imx: Use platform_get_irq_optional() for optional IRQsAnson Huang1-2/+2
All i.MX SoCs except i.MX1 have ONLY one necessary IRQ, use platform_get_irq_optional() to get second/third IRQ which are optional to avoid below error message during probe: [ 0.726219] imx-uart 30860000.serial: IRQ index 1 not found [ 0.731329] imx-uart 30860000.serial: IRQ index 2 not found Fixes: 7723f4c5ecdb8d83 ("driver core: platform: Add an error message to platform_get_irq*()") Signed-off-by: Anson Huang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10serial: fix kernel-doc warning in commentsRandy Dunlap1-0/+2
Fix Sphinx warning in serial_core.c: ../drivers/tty/serial/serial_core.c:1969: WARNING: Definition list ends without a blank line; unexpected unindent. Fixes: 73abaf87f01b ("serial: earlycon: Refactor parse_options into serial core") Signed-off-by: Randy Dunlap <[email protected]> Cc: Peter Hurley <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: use pr_err()Johan Hovold1-1/+1
Replace the one remaining printk with pr_err(). Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: drop redundant iowarrior mutexJohan Hovold1-12/+1
Drop the redundant iowarrior mutex introduced by commit 925ce689bb31 ("USB: autoconvert trivial BKL users to private mutex") which replaced an earlier BKL use. The lock serialised calls to open() against other open() and ioctl(), but neither is needed. Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: drop redundant disconnect mutexJohan Hovold1-15/+2
Drop the redundant disconnect mutex which was introduced after the open-disconnect race had been addressed generally in USB core by commit d4ead16f50f9 ("USB: prevent char device open/deregister race"). Specifically, the rw-semaphore in core guarantees that all calls to open() will have completed and that no new calls to open() will occur after usb_deregister_dev() returns. Hence there is no need use the driver data as an inverted disconnected flag. Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: fix use-after-free after driver unbindJohan Hovold1-0/+6
Make sure to stop also the asynchronous write URBs on disconnect() to avoid use-after-free in the completion handler after driver unbind. Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable <[email protected]> # 2.6.21: 51a2f077c44e ("USB: introduce usb_anchor") Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: fix use-after-free on releaseJohan Hovold1-1/+2
The driver was accessing its struct usb_interface from its release() callback without holding a reference. This would lead to a use-after-free whenever debugging was enabled and the device was disconnected while its character device was open. Fixes: 549e83500b80 ("USB: iowarrior: Convert local dbg macro to dev_dbg") Cc: stable <[email protected]> # 3.16 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: fix use-after-free on disconnectJohan Hovold1-4/+3
A recent fix addressing a deadlock on disconnect introduced a new bug by moving the present flag out of the critical section protected by the driver-data mutex. This could lead to a racing release() freeing the driver data before disconnect() is done with it. Due to insufficient locking a related use-after-free could be triggered also before the above mentioned commit. Specifically, the driver needs to hold the driver-data mutex also while checking the opened flag at disconnect(). Fixes: c468a8aa790e ("usb: iowarrior: fix deadlock on disconnect") Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable <[email protected]> # 2.6.21 Reported-by: [email protected] Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: chaoskey: fix use-after-free on releaseJohan Hovold1-2/+3
The driver was accessing its struct usb_interface in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open. Fixes: 66e3e591891d ("usb: Add driver for Altus Metrum ChaosKey device (v2)") Cc: stable <[email protected]> # 4.1 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: adutux: fix use-after-free on releaseJohan Hovold1-1/+2
The driver was accessing its struct usb_device in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open. Fixes: 66d4bc30d128 ("USB: adutux: remove custom debug macro") Cc: stable <[email protected]> # 3.12 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: ldusb: fix NULL-derefs on driver unbindJohan Hovold1-12/+12
The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL before making sure all completion handlers had run. This could lead to a NULL-pointer dereference in a number of dev_dbg, dev_warn and dev_err statements in the completion handlers which relies on said pointer. Fix this by unconditionally stopping all I/O and preventing resubmissions by poisoning the interrupt URBs at disconnect and using a dedicated disconnected flag. This also makes sure that all I/O has completed by the time the disconnect callback returns. Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver") Cc: stable <[email protected]> # 2.6.13 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: legousbtower: fix use-after-free on releaseJohan Hovold1-1/+2
The driver was accessing its struct usb_device in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open. Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro") Cc: stable <[email protected]> # 3.12 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10usb: cdns3: Fix for incorrect DMA mask.Pawel Laszczak1-0/+7
This patch restores the correct DMA mask after switching back to device mode. The issue occurred because Device part of controller use 32 bits DMA and Host side use 64 bits DMA. During loading XHCI driver the DMA mask used by driver is overwritten by XHCI driver so it must be restored to 32 bits. Reported-by: Pawel Laszczak <[email protected]> Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Pawel Laszczak <[email protected]> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Reviewed-by: Peter Chen <[email protected]> Tested-by: Roger Quadros <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10usb: cdns3: fix cdns3_core_init_role()Roger Quadros1-1/+19
At startup we should trigger the HW state machine only if it is OTG mode. Otherwise we should just start the respective role. Initialize idle role by default. If we don't do this then cdns3_idle_role_stop() is not called when switching to host/device role and so lane switch mechanism doesn't work. This results to super-speed device not working in one orientation if it was plugged before driver probe. Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Sekhar Nori <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10usb: cdns3: gadget: Fix full-speed modeRoger Quadros1-0/+1
We need to disable USB3 PHY for full-speed mode else gadget mode is broken. Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Sekhar Nori <[email protected]> Reviewed-by: Peter Chen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: usb-skeleton: drop redundant in-urb checkJohan Hovold1-2/+1
The driver bails out at probe if we can't find a bulk-in endpoint or if we fail to allocate the URB, so drop the check in read(). Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: usb-skeleton: fix use-after-free after driver unbindJohan Hovold1-0/+1
The driver failed to stop its read URB on disconnect, something which could lead to a use-after-free in the completion handler after driver unbind in case the character device has been closed. Fixes: e7389cc9a7ff ("USB: skel_read really sucks royally") Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.