aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-10-11Merge tag 'drm-fixes-2019-10-11' of git://anongit.freedesktop.org/drm/drmLinus Torvalds24-96/+234
Pull drm fixes from Dave Airlie: "The regular fixes pull for rc3. The i915 team found some fixes they (or I) missed for rc1, which is why this is a bit bigger than usual, otherwise there is a single amdgpu fix, some spi panel aliases, and a bridge fix. i915: - execlist access fixes - list deletion fix - CML display fix - HSW workaround extension to GT2 - chicken bit whitelist - GGTT resume issue - SKL GPU hangs for Vulkan compute amdgpu: - memory leak fix panel: - spi aliases tc358767: - bridge artifacts fix" * tag 'drm-fixes-2019-10-11' of git://anongit.freedesktop.org/drm/drm: (22 commits) drm/bridge: tc358767: fix max_tu_symbol value drm/i915/gt: execlists->active is serialised by the tasklet drm/i915/execlists: Protect peeking at execlists->active drm/i915: Fixup preempt-to-busy vs reset of a virtual request drm/i915: Only enqueue already completed requests drm/i915/execlists: Drop redundant list_del_init(&rq->sched.link) drm/i915/cml: Add second PCH ID for CMP drm/amdgpu: fix memory leak drm/panel: tpo-td043mtea1: Fix SPI alias drm/panel: tpo-td028ttec1: Fix SPI alias drm/panel: sony-acx565akm: Fix SPI alias drm/panel: nec-nl8048hl11: Fix SPI alias drm/panel: lg-lb035q02: Fix SPI alias drm/i915: Mark contents as dirty on a write fault drm/i915: Prevent bonded requests from overtaking each other on preemption drm/i915: Bump skl+ max plane width to 5k for linear/x-tiled drm/i915: Verify the engine after acquiring the active.lock drm/i915: Extend Haswell GT1 PSMI workaround to all drm/i915: Don't mix srcu tag and negative error codes drm/i915: Whitelist COMMON_SLICE_CHICKEN2 ...
2019-10-11Merge tag 'for-linus-20191010' of git://git.kernel.dk/linux-blockLinus Torvalds9-55/+29
Pull block fixes from Jens Axboe: - Fix wbt performance regression introduced with the blk-rq-qos refactoring (Harshad) - Fix io_uring fileset removal inadvertently killing the workqueue (me) - Fix io_uring typo in linked command nonblock submission (Pavel) - Remove spurious io_uring wakeups on request free (Pavel) - Fix null_blk zoned command error return (Keith) - Don't use freezable workqueues for backing_dev, also means we can revert a previous libata hack (Mika) - Fix nbd sysfs mutex dropped too soon at removal time (Xiubo) * tag 'for-linus-20191010' of git://git.kernel.dk/linux-block: nbd: fix possible sysfs duplicate warning null_blk: Fix zoned command return code io_uring: only flush workqueues on fileset removal io_uring: remove wait loop spurious wakeups blk-wbt: fix performance regression in wbt scale_up/scale_down Revert "libata, freezer: avoid block device removal while system is frozen" bdi: Do not use freezable workqueue io_uring: fix reversed nonblock flag for link submission
2019-10-11s390/uaccess: avoid (false positive) compiler warningsChristian Borntraeger1-2/+2
Depending on inlining decisions by the compiler, __get/put_user_fn might become out of line. Then the compiler is no longer able to tell that size can only be 1,2,4 or 8 due to the check in __get/put_user resulting in false positives like ./arch/s390/include/asm/uaccess.h: In function ‘__put_user_fn’: ./arch/s390/include/asm/uaccess.h:113:9: warning: ‘rc’ may be used uninitialized in this function [-Wmaybe-uninitialized] 113 | return rc; | ^~ ./arch/s390/include/asm/uaccess.h: In function ‘__get_user_fn’: ./arch/s390/include/asm/uaccess.h:143:9: warning: ‘rc’ may be used uninitialized in this function [-Wmaybe-uninitialized] 143 | return rc; | ^~ These functions are supposed to be always inlined. Mark it as such. Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Vasily Gorbik <[email protected]>
2019-10-11firmware: google: increment VPD key_len properlyBrian Norris1-1/+1
Commit 4b708b7b1a2c ("firmware: google: check if size is valid when decoding VPD data") adds length checks, but the new vpd_decode_entry() function botched the logic -- it adds the key length twice, instead of adding the key and value lengths separately. On my local system, this means vpd.c's vpd_section_create_attribs() hits an error case after the first attribute it parses, since it's no longer looking at the correct offset. With this patch, I'm back to seeing all the correct attributes in /sys/firmware/vpd/... Fixes: 4b708b7b1a2c ("firmware: google: check if size is valid when decoding VPD data") Cc: <[email protected]> Cc: Hung-Te Lin <[email protected]> Signed-off-by: Brian Norris <[email protected]> Reviewed-by: Stephen Boyd <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-11MAINTAINERS: kgdb: Add myself as a reviewer for kgdb/kdbDouglas Anderson1-0/+1
I'm interested in kdb / kgdb and have sent various fixes over the years. I'd like to get CCed on patches so I can be aware of them and also help review. Signed-off-by: Douglas Anderson <[email protected]> Acked-by: Daniel Thompson <[email protected]> Link: https://lore.kernel.org/r/20190920104404.1.I237e68e8825e2d6ac26f8e847f521fe2fcc3705a@changeid Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-11spufs: fix a crash in spufs_create_root()Emmanuel Nicolet1-0/+1
The spu_fs_context was not set in fc->fs_private, this caused a crash when accessing ctx->mode in spufs_create_root(). Fixes: d2e0981c3b9a ("vfs: Convert spufs to use the new mount API") Signed-off-by: Emmanuel Nicolet <[email protected]> Signed-off-by: Michael Ellerman <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2019-10-10io_uring: fix sequence logic for timeout requestsJens Axboe1-17/+20
We have two ways a request can be deferred: 1) It's a regular request that depends on another one 2) It's a timeout that tracks completions We have a shared helper to determine whether to defer, and that attempts to make the right decision based on the request. But we only have some of this information in the caller. Un-share the two timeout/defer helpers so the caller can use the right one. Fixes: 5262f567987d ("io_uring: IORING_OP_TIMEOUT support") Reported-by: yangerkun <[email protected]> Reviewed-by: Jackie Liu <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-10-11Merge tag 'drm-intel-fixes-2019-10-10' of ↵Dave Airlie17-82/+188
git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix CML display by adding a missing ID. - Drop redundant list_del_init - Only enqueue already completed requests to avoid races - Fixup preempt-to-busy vs reset of a virtual request - Protect peeking at execlists->active - execlists->active is serialised by the tasklet drm-intel-next-fixes-2019-09-19: - Extend old HSW workaround to fix some GPU hangs on Haswell GT2 - Fix return error code on GEM mmap. - White list a chicken bit register for push constants legacy mode on Mesa - Fix resume issue related to GGTT restore - Remove incorrect BUG_ON on execlist's schedule-out - Fix unrecoverable GPU hangs with Vulkan compute workloads on SKL drm-intel-next-fixes-2019-09-26: - Fix concurrence on cases where requests where getting retired at same time as resubmitted to HW - Fix gen9 display resolutions by setting the right max plane width - Fix GPU hang on preemption - Mark contents as dirty on a write fault. This was breaking cursor sprite with dumb buffers. Signed-off-by: Dave Airlie <[email protected]> From: Rodrigo Vivi <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-10-11Merge tag 'drm-fixes-5.4-2019-10-09' of ↵Dave Airlie1-7/+7
git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.4-2019-10-09: amdgpu: - fix memory leak in bo_list ioctl error path Signed-off-by: Dave Airlie <[email protected]> From: Alex Deucher <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-10-11Merge tag 'drm-misc-fixes-2019-10-10' of ↵Dave Airlie6-7/+39
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull (less than what git shortlog provides): - SPI Aliases fixes for panels - One fix for the tc358767 bridge dealing with visual artifacts Signed-off-by: Dave Airlie <[email protected]> From: Maxime Ripard <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/20191010105137.j6juxht5dsobgxph@gilmour
2019-10-10SUNRPC: fix race to sk_err after xs_error_reportBenjamin Coddington2-9/+9
Since commit 4f8943f80883 ("SUNRPC: Replace direct task wakeups from softirq context") there has been a race to the value of the sk_err if both XPRT_SOCK_WAKE_ERROR and XPRT_SOCK_WAKE_DISCONNECT are set. In that case, we may end up losing the sk_err value that existed when xs_error_report was called. Fix this by reverting to the previous behavior: instead of using SO_ERROR to retrieve the value at a later time (which might also return sk_err_soft), copy the sk_err value onto struct sock_xprt, and use that value to wake pending tasks. Signed-off-by: Benjamin Coddington <[email protected]> Fixes: 4f8943f80883 ("SUNRPC: Replace direct task wakeups from softirq context") Signed-off-by: Anna Schumaker <[email protected]>
2019-10-10NFSv4: Fix leak of clp->cl_acceptor stringChuck Lever1-0/+1
Our client can issue multiple SETCLIENTID operations to the same server in some circumstances. Ensure that calls to nfs4_proc_setclientid() after the first one do not overwrite the previously allocated cl_acceptor string. unreferenced object 0xffff888461031800 (size 32): comm "mount.nfs", pid 2227, jiffies 4294822467 (age 1407.749s) hex dump (first 32 bytes): 6e 66 73 40 6b 6c 69 6d 74 2e 69 62 2e 31 30 31 [email protected] 35 67 72 61 6e 67 65 72 2e 6e 65 74 00 00 00 00 5granger.net.... backtrace: [<00000000ab820188>] __kmalloc+0x128/0x176 [<00000000eeaf4ec8>] gss_stringify_acceptor+0xbd/0x1a7 [auth_rpcgss] [<00000000e85e3382>] nfs4_proc_setclientid+0x34e/0x46c [nfsv4] [<000000003d9cf1fa>] nfs40_discover_server_trunking+0x7a/0xed [nfsv4] [<00000000b81c3787>] nfs4_discover_server_trunking+0x81/0x244 [nfsv4] [<000000000801b55f>] nfs4_init_client+0x1b0/0x238 [nfsv4] [<00000000977daf7f>] nfs4_set_client+0xfe/0x14d [nfsv4] [<0000000053a68a2a>] nfs4_create_server+0x107/0x1db [nfsv4] [<0000000088262019>] nfs4_remote_mount+0x2c/0x59 [nfsv4] [<00000000e84a2fd0>] legacy_get_tree+0x2d/0x4c [<00000000797e947c>] vfs_get_tree+0x20/0xc7 [<00000000ecabaaa8>] fc_mount+0xe/0x36 [<00000000f15fafc2>] vfs_kern_mount+0x74/0x8d [<00000000a3ff4e26>] nfs_do_root_mount+0x8a/0xa3 [nfsv4] [<00000000d1c2b337>] nfs4_try_mount+0x58/0xad [nfsv4] [<000000004c9bddee>] nfs_fs_mount+0x820/0x869 [nfs] Fixes: f11b2a1cfbf5 ("nfs4: copy acceptor name from context ... ") Signed-off-by: Chuck Lever <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
2019-10-10MIPS: Disable Loongson MMI instructions for kernel buildPaul Burton2-0/+5
GCC 9.x automatically enables support for Loongson MMI instructions when using some -march= flags, and then errors out when -msoft-float is specified with: cc1: error: ‘-mloongson-mmi’ must be used with ‘-mhard-float’ The kernel shouldn't be using these MMI instructions anyway, just as it doesn't use floating point instructions. Explicitly disable them in order to fix the build with GCC 9.x. Signed-off-by: Paul Burton <[email protected]> Fixes: 3702bba5eb4f ("MIPS: Loongson: Add GCC 4.4 support for Loongson2E") Fixes: 6f7a251a259e ("MIPS: Loongson: Add basic Loongson 2F support") Fixes: 5188129b8c9f ("MIPS: Loongson-3: Improve -march option and move it to Platform") Cc: Huacai Chen <[email protected]> Cc: Jiaxun Yang <[email protected]> Cc: [email protected] # v2.6.32+ Cc: [email protected]
2019-10-10MIPS: elf_hwcap: Export userspace ASEsJiaxun Yang2-0/+44
A Golang developer reported MIPS hwcap isn't reflecting instructions that the processor actually supported so programs can't apply optimized code at runtime. Thus we export the ASEs that can be used in userspace programs. Reported-by: Meng Zhuo <[email protected]> Signed-off-by: Jiaxun Yang <[email protected]> Cc: [email protected] Cc: Paul Burton <[email protected]> Cc: <[email protected]> # 4.14+ Signed-off-by: Paul Burton <[email protected]>
2019-10-10Merge tag 'xfs-5.4-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linuxLinus Torvalds10-31/+29
Pull xfs fixes from Darrick Wong: "A couple of small code cleanups and bug fixes for rounding errors, metadata logging errors, and an extra layer of safeguards against leaking memory contents. - Fix a rounding error in the fallocate code - Minor code cleanups - Make sure to zero memory buffers before formatting metadata blocks - Fix a few places where we forgot to log an inode metadata update - Remove broken error handling that tried to clean up after a failure but still got it wrong" * tag 'xfs-5.4-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: move local to extent inode logging into bmap helper xfs: remove broken error handling on failed attr sf to leaf change xfs: log the inode on directory sf to block format change xfs: assure zeroed memory buffers for certain kmem allocations xfs: removed unused error variable from xchk_refcountbt_rec xfs: remove unused flags arg from xfs_get_aghdr_buf() xfs: Fix tail rounding in xfs_alloc_file_space()
2019-10-10nbd: fix possible sysfs duplicate warningXiubo Li1-1/+1
1. nbd_put takes the mutex and drops nbd->ref to 0. It then does idr_remove and drops the mutex. 2. nbd_genl_connect takes the mutex. idr_find/idr_for_each fails to find an existing device, so it does nbd_dev_add. 3. just before the nbd_put could call nbd_dev_remove or not finished totally, but if nbd_dev_add try to add_disk, we can hit: debugfs: Directory 'nbd1' with parent 'block' already present! This patch will make sure all the disk add/remove stuff are done by holding the nbd_index_mutex lock. Reported-by: Mike Christie <[email protected]> Reviewed-by: Josef Bacik <[email protected]> Signed-off-by: Xiubo Li <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-10-10xen: Stop abusing DT of_dma_configure APIRob Herring2-21/+4
As the removed comments say, these aren't DT based devices. of_dma_configure() is going to stop allowing a NULL DT node and calling it will no longer work. The comment is also now out of date as of commit 9ab91e7c5c51 ("arm64: default to the direct mapping in get_arch_dma_ops"). Direct mapping is now the default rather than dma_dummy_ops. According to Stefano and Oleksandr, the only other part needed is setting the DMA masks and there's no reason to restrict the masks to 32-bits. So set the masks to 64 bits. Cc: Robin Murphy <[email protected]> Cc: Julien Grall <[email protected]> Cc: Nicolas Saenz Julienne <[email protected]> Cc: Oleksandr Andrushchenko <[email protected]> Cc: Boris Ostrovsky <[email protected]> Cc: Juergen Gross <[email protected]> Cc: Stefano Stabellini <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: [email protected] Signed-off-by: Rob Herring <[email protected]> Acked-by: Oleksandr Andrushchenko <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2019-10-10Merge branch 'linus' of ↵Linus Torvalds2-0/+2
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "Fix build issues in arm/aes-ce" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: arm/aes-ce - add dependency on AES library crypto: arm/aes-ce - build for v8 architecture explicitly
2019-10-10Merge tag 'for-5.4-rc2-tag' of ↵Linus Torvalds6-13/+49
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few more stabitly fixes, one build warning fix. - fix inode allocation under NOFS context - fix leak in fiemap due to concurrent append writes - fix log-root tree updates - fix balance convert of single profile on 32bit architectures - silence false positive warning on old GCCs (code moved in rc1)" * tag 'for-5.4-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: silence maybe-uninitialized warning in clone_range btrfs: fix uninitialized ret in ref-verify btrfs: allocate new inode in NOFS context btrfs: fix balance convert to single on 32-bit host CPUs btrfs: fix incorrect updating of log root tree Btrfs: fix memory leak due to concurrent append writes with fiemap
2019-10-10Merge branch 'work.dcache' of ↵Linus Torvalds1-66/+71
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull dcache_readdir() fixes from Al Viro: "The couple of patches you'd been OK with; no hlist conversion yet, and cursors are still in the list of children" [ Al is referring to future work to avoid some nasty O(n**2) behavior with the readdir cursors when you have lots of concurrent readdirs. This is just a fix for a race with a trivial cleanup - Linus ] * 'work.dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: libfs: take cursors out of list when moving past the end of directory Fix the locking in dcache_readdir() and friends
2019-10-10Merge branch 'work.mount3' of ↵Linus Torvalds2-1/+10
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull mount fixes from Al Viro: "A couple of regressions from the mount series" * 'work.mount3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: vfs: add missing blkdev_put() in get_tree_bdev() shmem: fix LSM options parsing
2019-10-10MAINTAINERS: Remove Simon as Renesas SoC Co-MaintainerGeert Uytterhoeven2-4/+4
At the end of the v5.3 upstream kernel development cycle, Simon stepped down from his role as Renesas SoC maintainer. Remove his maintainership, git repository, and branch from the MAINTAINERS file, and add an entry to the CREDITS file to honor his work. Signed-off-by: Geert Uytterhoeven <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2019-10-10xen/grant-table: remove unnecessary printingFuqian Huang1-2/+1
xen_auto_xlat_grant_frames.vaddr is definitely NULL in this case. So the address printing is unnecessary. Signed-off-by: Fuqian Huang <[email protected]> Reviewed-by: Juergen Gross <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2019-10-10w1: ds250x: Fix build error without CRC16YueHaibing1-0/+1
If CRC16 is not set, building will fails: drivers/w1/slaves/w1_ds250x.o: In function `w1_ds2505_read_page': w1_ds250x.c:(.text+0x82f): undefined reference to `crc16' w1_ds250x.c:(.text+0x90a): undefined reference to `crc16' w1_ds250x.c:(.text+0x91a): undefined reference to `crc16' Reported-by: Hulk Robot <[email protected]> Fixes: 25ec8710d9c2 ("w1: add DS2501, DS2502, DS2505 EPROM device driver") Signed-off-by: YueHaibing <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10virt: vbox: fix memory leak in hgcm_call_preprocess_linaddrNavid Emamdoost1-1/+2
In hgcm_call_preprocess_linaddr memory is allocated for bounce_buf but is not released if copy_form_user fails. In order to prevent memory leak in case of failure, the assignment to bounce_buf_ret is moved before the error check. This way the allocated bounce_buf will be released by the caller. Fixes: 579db9d45cb4 ("virt: Add vboxguest VMMDEV communication code") Signed-off-by: Navid Emamdoost <[email protected]> Reviewed-by: Hans de Goede <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10binder: Fix comment headers on binder_alloc_prepare_to_free()Joel Fernandes (Google)1-1/+1
binder_alloc_buffer_lookup() doesn't exist and is named "binder_alloc_prepare_to_free()". Correct the code comments to reflect this. Signed-off-by: Joel Fernandes (Google) <[email protected]> Reviewed-by: Christian Brauner <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10binder: prevent UAF read in print_binder_transaction_log_entry()Christian Brauner2-2/+4
When a binder transaction is initiated on a binder device coming from a binderfs instance, a pointer to the name of the binder device is stashed in the binder_transaction_log_entry's context_name member. Later on it is used to print the name in print_binder_transaction_log_entry(). By the time print_binder_transaction_log_entry() accesses context_name binderfs_evict_inode() might have already freed the associated memory thereby causing a UAF. Do the simple thing and prevent this by copying the name of the binder device instead of stashing a pointer to it. Reported-by: Jann Horn <[email protected]> Fixes: 03e2e07e3814 ("binder: Make transaction_log available in binderfs") Link: https://lore.kernel.org/r/CAG48ez14Q0-F8LqsvcNbyR2o6gPW8SHXsm4u5jmD9MpsteM2Tw@mail.gmail.com Signed-off-by: Christian Brauner <[email protected]> Reviewed-by: Joel Fernandes (Google) <[email protected]> Acked-by: Todd Kjos <[email protected]> Reviewed-by: Hridya Valsaraju <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: yurex: fix NULL-derefs on disconnectJohan Hovold1-4/+7
The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL without making sure all code paths that used it were done with it. Before commit ef61eb43ada6 ("USB: yurex: Fix protection fault after device removal") this included the interrupt-in completion handler, but there are further accesses in dev_err and dev_dbg statements in yurex_write() and the driver-data destructor (sic!). Fix this by unconditionally stopping also the control URB at disconnect and by using a dedicated disconnected flag. Note that we need to take a reference to the struct usb_interface to avoid a use-after-free in the destructor whenever the device was disconnected while the character device was still open. Fixes: aadd6472d904 ("USB: yurex.c: remove dbg() usage") Fixes: 45714104b9e8 ("USB: yurex.c: remove err() usage") Cc: stable <[email protected]> # 3.5: ef61eb43ada6 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10tty: serial: imx: Use platform_get_irq_optional() for optional IRQsAnson Huang1-2/+2
All i.MX SoCs except i.MX1 have ONLY one necessary IRQ, use platform_get_irq_optional() to get second/third IRQ which are optional to avoid below error message during probe: [ 0.726219] imx-uart 30860000.serial: IRQ index 1 not found [ 0.731329] imx-uart 30860000.serial: IRQ index 2 not found Fixes: 7723f4c5ecdb8d83 ("driver core: platform: Add an error message to platform_get_irq*()") Signed-off-by: Anson Huang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10serial: fix kernel-doc warning in commentsRandy Dunlap1-0/+2
Fix Sphinx warning in serial_core.c: ../drivers/tty/serial/serial_core.c:1969: WARNING: Definition list ends without a blank line; unexpected unindent. Fixes: 73abaf87f01b ("serial: earlycon: Refactor parse_options into serial core") Signed-off-by: Randy Dunlap <[email protected]> Cc: Peter Hurley <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: use pr_err()Johan Hovold1-1/+1
Replace the one remaining printk with pr_err(). Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: drop redundant iowarrior mutexJohan Hovold1-12/+1
Drop the redundant iowarrior mutex introduced by commit 925ce689bb31 ("USB: autoconvert trivial BKL users to private mutex") which replaced an earlier BKL use. The lock serialised calls to open() against other open() and ioctl(), but neither is needed. Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: drop redundant disconnect mutexJohan Hovold1-15/+2
Drop the redundant disconnect mutex which was introduced after the open-disconnect race had been addressed generally in USB core by commit d4ead16f50f9 ("USB: prevent char device open/deregister race"). Specifically, the rw-semaphore in core guarantees that all calls to open() will have completed and that no new calls to open() will occur after usb_deregister_dev() returns. Hence there is no need use the driver data as an inverted disconnected flag. Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: fix use-after-free after driver unbindJohan Hovold1-0/+6
Make sure to stop also the asynchronous write URBs on disconnect() to avoid use-after-free in the completion handler after driver unbind. Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable <[email protected]> # 2.6.21: 51a2f077c44e ("USB: introduce usb_anchor") Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: fix use-after-free on releaseJohan Hovold1-1/+2
The driver was accessing its struct usb_interface from its release() callback without holding a reference. This would lead to a use-after-free whenever debugging was enabled and the device was disconnected while its character device was open. Fixes: 549e83500b80 ("USB: iowarrior: Convert local dbg macro to dev_dbg") Cc: stable <[email protected]> # 3.16 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: iowarrior: fix use-after-free on disconnectJohan Hovold1-4/+3
A recent fix addressing a deadlock on disconnect introduced a new bug by moving the present flag out of the critical section protected by the driver-data mutex. This could lead to a racing release() freeing the driver data before disconnect() is done with it. Due to insufficient locking a related use-after-free could be triggered also before the above mentioned commit. Specifically, the driver needs to hold the driver-data mutex also while checking the opened flag at disconnect(). Fixes: c468a8aa790e ("usb: iowarrior: fix deadlock on disconnect") Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable <[email protected]> # 2.6.21 Reported-by: [email protected] Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: chaoskey: fix use-after-free on releaseJohan Hovold1-2/+3
The driver was accessing its struct usb_interface in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open. Fixes: 66e3e591891d ("usb: Add driver for Altus Metrum ChaosKey device (v2)") Cc: stable <[email protected]> # 4.1 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: adutux: fix use-after-free on releaseJohan Hovold1-1/+2
The driver was accessing its struct usb_device in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open. Fixes: 66d4bc30d128 ("USB: adutux: remove custom debug macro") Cc: stable <[email protected]> # 3.12 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: ldusb: fix NULL-derefs on driver unbindJohan Hovold1-12/+12
The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL before making sure all completion handlers had run. This could lead to a NULL-pointer dereference in a number of dev_dbg, dev_warn and dev_err statements in the completion handlers which relies on said pointer. Fix this by unconditionally stopping all I/O and preventing resubmissions by poisoning the interrupt URBs at disconnect and using a dedicated disconnected flag. This also makes sure that all I/O has completed by the time the disconnect callback returns. Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver") Cc: stable <[email protected]> # 2.6.13 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: legousbtower: fix use-after-free on releaseJohan Hovold1-1/+2
The driver was accessing its struct usb_device in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open. Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro") Cc: stable <[email protected]> # 3.12 Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10usb: cdns3: Fix for incorrect DMA mask.Pawel Laszczak1-0/+7
This patch restores the correct DMA mask after switching back to device mode. The issue occurred because Device part of controller use 32 bits DMA and Host side use 64 bits DMA. During loading XHCI driver the DMA mask used by driver is overwritten by XHCI driver so it must be restored to 32 bits. Reported-by: Pawel Laszczak <[email protected]> Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Pawel Laszczak <[email protected]> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Reviewed-by: Peter Chen <[email protected]> Tested-by: Roger Quadros <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10usb: cdns3: fix cdns3_core_init_role()Roger Quadros1-1/+19
At startup we should trigger the HW state machine only if it is OTG mode. Otherwise we should just start the respective role. Initialize idle role by default. If we don't do this then cdns3_idle_role_stop() is not called when switching to host/device role and so lane switch mechanism doesn't work. This results to super-speed device not working in one orientation if it was plugged before driver probe. Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Sekhar Nori <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10usb: cdns3: gadget: Fix full-speed modeRoger Quadros1-0/+1
We need to disable USB3 PHY for full-speed mode else gadget mode is broken. Signed-off-by: Roger Quadros <[email protected]> Signed-off-by: Sekhar Nori <[email protected]> Reviewed-by: Peter Chen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: usb-skeleton: drop redundant in-urb checkJohan Hovold1-2/+1
The driver bails out at probe if we can't find a bulk-in endpoint or if we fail to allocate the URB, so drop the check in read(). Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: usb-skeleton: fix use-after-free after driver unbindJohan Hovold1-0/+1
The driver failed to stop its read URB on disconnect, something which could lead to a use-after-free in the completion handler after driver unbind in case the character device has been closed. Fixes: e7389cc9a7ff ("USB: skel_read really sucks royally") Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10USB: usb-skeleton: fix NULL-deref on disconnectJohan Hovold1-3/+4
The driver was using its struct usb_interface pointer as an inverted disconnected flag and was setting it to NULL before making sure all completion handlers had run. This could lead to NULL-pointer dereferences in the dev_err() statements in the completion handlers which relies on said pointer. Fix this by using a dedicated disconnected flag. Note that this is also addresses a NULL-pointer dereference at release() and a struct usb_interface reference leak introduced by a recent runtime PM fix, which depends on and should have been submitted together with this patch. Fixes: 4212cd74ca6f ("USB: usb-skeleton.c: remove err() usage") Fixes: 5c290a5e42c3 ("USB: usb-skeleton: fix runtime PM after driver unbind") Cc: stable <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-10-10Merge tag 'iio-fixes-for-5.4a' of ↵Greg Kroah-Hartman16-182/+290
https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes for the 5.4 cycle. * adis16400 - Make sure to free memory on a few failure paths. * adxl372 - Fix wrong fifo depth - Fix wrong indexing of data from the fifo. - Perform a reset at startup to avoid a problem with inconsistent state. * axp288 - This is a fix for a fix. The original fix made sure we kept the configuration from some firmwares to preserve a bias current. Unfortunately it appears the previous behaviour was working around a buggy firmware by overwriting the wrong value it had. Hence a regression was seen. * bmc150 - Fix the centre temperature. This was due to an error in one of the datasheets. * hx711 - Fix an issue where a badly timed interrupt could lead to a control line being high long enough to put the device into a low power state. * meson_sar_adc - Fix a case where the irq was enabled before everything it uses was allocated. * st_lsm6dsx - Ensure we don't set the sensor sensitivity to 0 as it will force all readings to 0. - Fix a wait time for the slave i2c controller when the accelerometer is not enabled. * stm32-adc - Precursor for fix. Move a set of register definitions to a header. - Fix a race when several ADCs are in use with some using interrupts to control the dataflow and some using DMA. * vcnl4000 - Fix a garbage of_match_table in which a string was passed instead of the intended enum. * tag 'iio-fixes-for-5.4a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: Fix an undefied reference error in noa1305_probe iio: light: opt3001: fix mutex unlock race iio: adc: ad799x: fix probe error handling iio: light: add missing vcnl4040 of_compatible iio: light: fix vcnl4000 devicetree hooks iio: imu: st_lsm6dsx: fix waitime for st_lsm6dsx i2c controller iio: adc: axp288: Override TS pin bias current for some models iio: imu: adis16400: fix memory leak iio: imu: adis16400: release allocated memory on failure iio: adc: stm32-adc: fix a race when using several adcs with dma and irq iio: adc: stm32-adc: move registers definitions iio: accel: adxl372: Perform a reset at start up iio: accel: adxl372: Fix push to buffers lost samples iio: accel: adxl372: Fix/remove limitation for FIFO samples iio: adc: hx711: fix bug in sampling of data iio: fix center temperature of bmc150-accel-core iio: imu: st_lsm6dsx: forbid 0 sensor sensitivity iio: adc: meson_saradc: Fix memory allocation order
2019-10-10drm/bridge: tc358767: fix max_tu_symbol valueTomi Valkeinen1-1/+6
max_tu_symbol was programmed to TU_SIZE_RECOMMENDED - 1, which is not what the spec says. The spec says: roundup ((input active video bandwidth in bytes/output active video bandwidth in bytes) * tu_size) It is not quite clear what the above means, but calculating max_tu_symbol = (input Bps / output Bps) * tu_size seems to work and fixes the issues seen. This fixes artifacts in some videomodes (e.g. 1024x768@60 on 2-lanes & 1.62Gbps was pretty bad for me). Signed-off-by: Tomi Valkeinen <[email protected]> Tested-by: Jyri Sarha <[email protected]> Signed-off-by: Andrzej Hajda <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2019-10-10s390/cio: fix virtio-ccw DMA without PVHalil Pasic3-2/+8
Commit 37db8985b211 ("s390/cio: add basic protected virtualization support") breaks virtio-ccw devices with VIRTIO_F_IOMMU_PLATFORM for non Protected Virtualization (PV) guests. The problem is that the dma_mask of the ccw device, which is used by virtio core, gets changed from 64 to 31 bit, because some of the DMA allocations do require 31 bit addressable memory. For PV the only drawback is that some of the virtio structures must end up in ZONE_DMA because we have the bounce the buffers mapped via DMA API anyway. But for non PV guests we have a problem: because of the 31 bit mask guests bigger than 2G are likely to try bouncing buffers. The swiotlb however is only initialized for PV guests, because we don't want to bounce anything for non PV guests. The first such map kills the guest. Since the DMA API won't allow us to specify for each allocation whether we need memory from ZONE_DMA (31 bit addressable) or any DMA capable memory will do, let us use coherent_dma_mask (which is used for allocations) to force allocating form ZONE_DMA while changing dma_mask to DMA_BIT_MASK(64) so that at least the streaming API will regard the whole memory DMA capable. Signed-off-by: Halil Pasic <[email protected]> Reported-by: Marc Hartmayer <[email protected]> Suggested-by: Robin Murphy <[email protected]> Fixes: 37db8985b211 ("s390/cio: add basic protected virtualization support") Link: https://lore.kernel.org/lkml/[email protected] Reviewed-by: Christoph Hellwig <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Vasily Gorbik <[email protected]>
2019-10-09null_blk: Fix zoned command return codeKeith Busch1-2/+1
The return code from null_handle_zoned() sets the cmd->error value. Returning OK status when an error occured overwrites the intended cmd->error. Return the appropriate error code instead of setting the error in the cmd. Fixes: fceb5d1b19cbe626 ("null_blk: create a helper for zoned devices") Cc: Chaitanya Kulkarni <[email protected]> Signed-off-by: Keith Busch <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.