* [PATCH AUTOSEL 4.9 02/21] mfd: twl-core: Fix section annotations on {,un}protect_pm_master
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 03/21] mfd: db8500-prcmu: Fix some section annotations Sasha Levin
` (18 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nathan Chancellor, Lee Jones, Sasha Levin, linux-omap
From: Nathan Chancellor <natechancellor@gmail.com>
[ Upstream commit 8838555089f0345b87f4277fe5a8dd647dc65589 ]
When building the kernel with Clang, the following section mismatch
warning appears:
WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from
the function twl_probe() to the function
.init.text:unprotect_pm_master()
The function twl_probe() references
the function __init unprotect_pm_master().
This is often because twl_probe lacks a __init
annotation or the annotation of unprotect_pm_master is wrong.
Remove the __init annotation on the *protect_pm_master functions so
there is no more mismatch.
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/twl-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index c64615dca2bd..1d58df856548 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,
* letting it generate the right frequencies for USB, MADC, and
* other purposes.
*/
-static inline int __init protect_pm_master(void)
+static inline int protect_pm_master(void)
{
int e = 0;
@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void)
return e;
}
-static inline int __init unprotect_pm_master(void)
+static inline int unprotect_pm_master(void)
{
int e = 0;
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 03/21] mfd: db8500-prcmu: Fix some section annotations
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 02/21] mfd: twl-core: Fix section annotations on {,un}protect_pm_master Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 04/21] mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported Sasha Levin
` (17 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Nathan Chancellor, Lee Jones, Sasha Levin
From: Nathan Chancellor <natechancellor@gmail.com>
[ Upstream commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 ]
When building the kernel with Clang, the following section mismatch
warnings appear:
WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from
the function db8500_prcmu_probe() to the function
.init.text:init_prcm_registers()
The function db8500_prcmu_probe() references
the function __init init_prcm_registers().
This is often because db8500_prcmu_probe lacks a __init
annotation or the annotation of init_prcm_registers is wrong.
WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from
the function db8500_prcmu_probe() to the function
.init.text:fw_project_name()
The function db8500_prcmu_probe() references
the function __init fw_project_name().
This is often because db8500_prcmu_probe lacks a __init
annotation or the annotation of fw_project_name is wrong.
db8500_prcmu_probe should not be marked as __init so remove the __init
annotation from fw_project_name and init_prcm_registers.
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/db8500-prcmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index ca38a6a14110..26ccf3f4ade9 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2588,7 +2588,7 @@ static struct irq_chip prcmu_irq_chip = {
.irq_unmask = prcmu_irq_unmask,
};
-static __init char *fw_project_name(u32 project)
+static char *fw_project_name(u32 project)
{
switch (project) {
case PRCMU_FW_PROJECT_U8500:
@@ -2736,7 +2736,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)
INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work);
}
-static void __init init_prcm_registers(void)
+static void init_prcm_registers(void)
{
u32 val;
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 04/21] mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 02/21] mfd: twl-core: Fix section annotations on {,un}protect_pm_master Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 03/21] mfd: db8500-prcmu: Fix some section annotations Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 05/21] mfd: ab8500-core: Return zero in get_register_interruptible() Sasha Levin
` (16 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Nicolas Boichat, Lee Jones, Sasha Levin
From: Nicolas Boichat <drinkcat@chromium.org>
[ Upstream commit a177276aa098aa47a100d51a13eaaef029604b6d ]
If the PMIC ID is unknown, the current code would call
irq_domain_remove and panic, as pmic->irq_domain is only
initialized by mt6397_irq_init.
Return immediately with an error, if the chip ID is unsupported.
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/mt6397-core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
index e14d8b058f0c..5d4c10f05450 100644
--- a/drivers/mfd/mt6397-core.c
+++ b/drivers/mfd/mt6397-core.c
@@ -306,8 +306,7 @@ static int mt6397_probe(struct platform_device *pdev)
default:
dev_err(&pdev->dev, "unsupported chip: %d\n", id);
- ret = -ENODEV;
- break;
+ return -ENODEV;
}
if (ret) {
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 05/21] mfd: ab8500-core: Return zero in get_register_interruptible()
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (2 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 04/21] mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 06/21] mfd: qcom_rpm: write fw_version to CTRL_REG Sasha Levin
` (15 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Dan Carpenter, Lee Jones, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 ]
This function is supposed to return zero on success or negative error
codes on error. Unfortunately, there is a bug so it sometimes returns
non-zero, positive numbers on success.
I noticed this bug during review and I can't test it. It does appear
that the return is sometimes propogated back to _regmap_read() where all
non-zero returns are treated as failure so this may affect run time.
Fixes: 47c1697508f2 ("mfd: Align ab8500 with the abx500 interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/ab8500-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 589eebfc13df..2f212bdc187a 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -257,7 +257,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,
mutex_unlock(&ab8500->lock);
dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret);
- return ret;
+ return (ret < 0) ? ret : 0;
}
static int ab8500_get_register(struct device *dev, u8 bank,
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 06/21] mfd: qcom_rpm: write fw_version to CTRL_REG
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (3 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 05/21] mfd: ab8500-core: Return zero in get_register_interruptible() Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 07/21] mfd: wm5110: Add missing ASRC rate register Sasha Levin
` (14 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jonathan Marek, Lee Jones, Sasha Levin
From: Jonathan Marek <jonathan@marek.ca>
[ Upstream commit 504e4175829c44328773b96ad9c538e4783a8d22 ]
This is required as part of the initialization sequence on certain SoCs.
If these registers are not initialized, the hardware can be unresponsive.
This fixes the driver on apq8060 (HP TouchPad device).
Signed-off-by: Jonathan Marek <jonathan@marek.ca>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/qcom_rpm.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
index 52fafea06067..8d420c37b2a6 100644
--- a/drivers/mfd/qcom_rpm.c
+++ b/drivers/mfd/qcom_rpm.c
@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev)
return -EFAULT;
}
+ writel(fw_version[0], RPM_CTRL_REG(rpm, 0));
+ writel(fw_version[1], RPM_CTRL_REG(rpm, 1));
+ writel(fw_version[2], RPM_CTRL_REG(rpm, 2));
+
dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0],
fw_version[1],
fw_version[2]);
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 07/21] mfd: wm5110: Add missing ASRC rate register
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (4 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 06/21] mfd: qcom_rpm: write fw_version to CTRL_REG Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 08/21] mfd: mc13xxx: Fix a missing check of a register-read failure Sasha Levin
` (13 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Charles Keepax, Lee Jones, Sasha Levin, patches
From: Charles Keepax <ckeepax@opensource.cirrus.com>
[ Upstream commit 04c801c18ded421845324255e660147a6f58dcd6 ]
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/wm5110-tables.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
index 1ee68bd440fb..16c6e2accfaa 100644
--- a/drivers/mfd/wm5110-tables.c
+++ b/drivers/mfd/wm5110-tables.c
@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = {
{ 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */
{ 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */
{ 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */
+ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */
{ 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */
{ 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */
{ 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */
@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)
case ARIZONA_ASRC_ENABLE:
case ARIZONA_ASRC_STATUS:
case ARIZONA_ASRC_RATE1:
+ case ARIZONA_ASRC_RATE2:
case ARIZONA_ISRC_1_CTRL_1:
case ARIZONA_ISRC_1_CTRL_2:
case ARIZONA_ISRC_1_CTRL_3:
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 08/21] mfd: mc13xxx: Fix a missing check of a register-read failure
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (5 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 07/21] mfd: wm5110: Add missing ASRC rate register Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 09/21] qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier Sasha Levin
` (12 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kangjie Lu, Lee Jones, Sasha Levin
From: Kangjie Lu <kjlu@umn.edu>
[ Upstream commit 9e28989d41c0eab57ec0bb156617a8757406ff8a ]
When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will
contain random value. Further execution uses "old_adc0" even when
mc13xxx_reg_read() fails.
The fix checks the return value of mc13xxx_reg_read(), and exits
the execution when it fails.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/mc13xxx-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
index d7f54e492aa6..6c16f170529f 100644
--- a/drivers/mfd/mc13xxx-core.c
+++ b/drivers/mfd/mc13xxx-core.c
@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
mc13xxx->adcflags |= MC13XXX_ADC_WORKING;
- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
+ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
+ if (ret)
+ goto out;
adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2;
adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC;
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 09/21] qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (6 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 08/21] mfd: mc13xxx: Fix a missing check of a register-read failure Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 10/21] net: hns: Fix use after free identified by SLUB debug Sasha Levin
` (11 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Denis Bolotin, Ariel Elior, David S . Miller, Sasha Levin, netdev
From: Denis Bolotin <dbolotin@marvell.com>
[ Upstream commit 46721c3d9e273aea880e9ff835b0e1271e1cd2fb ]
Make sure chain element is updated before ringing the doorbell.
Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qed/qed_ll2.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index a3360cbdb30b..5b968e6a0a7f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -1013,6 +1013,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn,
cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain);
rx_prod.bd_prod = cpu_to_le16(bd_prod);
rx_prod.cqe_prod = cpu_to_le16(cq_prod);
+
+ /* Make sure chain element is updated before ringing the doorbell */
+ dma_wmb();
+
DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod));
}
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 10/21] net: hns: Fix use after free identified by SLUB debug
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (7 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 09/21] qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 11/21] MIPS: ath79: Enable OF serial ports in the default config Sasha Levin
` (10 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yonglong Liu, Huazhong Tan, David S . Miller, Sasha Levin, netdev
From: Yonglong Liu <liuyonglong@huawei.com>
[ Upstream commit bb989501abcafa0de5f18b0ec0ec459b5b817908 ]
When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will
identify a use after free bug:
[134.189505] Unable to handle kernel paging request at virtual address
006b6b6b6b6b6b6b
[134.197553] Mem abort info:
[134.200381] ESR = 0x96000004
[134.203487] Exception class = DABT (current EL), IL = 32 bits
[134.209497] SET = 0, FnV = 0
[134.212596] EA = 0, S1PTW = 0
[134.215777] Data abort info:
[134.218701] ISV = 0, ISS = 0x00000004
[134.222596] CM = 0, WnR = 0
[134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges
[134.232851] Internal error: Oops: 96000004 [#1] SMP
[134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G
OE 4.19.5-1.2.34.aarch64 #1
[134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018
[134.255181] pstate: 20000005 (nzCv daif -PAN -UAO)
[134.260044] pc : hns_ae_put_handle+0x38/0x60
[134.264372] lr : hns_ae_put_handle+0x24/0x60
[134.268700] sp : ffff00001be93c50
[134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040
[134.277442] x27: 0000000000000000 x26: 0000000000000000
[134.282830] x25: 0000000056000000 x24: 0000000000000015
[134.288284] x23: ffff0000096fe098 x22: ffff000001050070
[134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098
[134.303287] x19: ffff80afb75ec098 x18: 0000000000000000
[134.312945] x17: 0000000000000000 x16: 0000000000000000
[134.322517] x15: 0000000000000002 x14: 0000000000000000
[134.332030] x13: dead000000000100 x12: ffff7e02bea3c988
[134.341487] x11: ffff80affbee9e68 x10: 0000000000000000
[134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000
[134.360569] x7 : dead000000000100 x6 : ffff000009579748
[134.370059] x5 : 0000000000210d00 x4 : 0000000000000000
[134.379550] x3 : 0000000000000001 x2 : 0000000000000000
[134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000
[134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd)
[134.408498] Call trace:
[134.414611] hns_ae_put_handle+0x38/0x60
[134.422208] hnae_put_handle+0xd4/0x108
[134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv]
[134.438342] platform_drv_remove+0x2c/0x70
[134.445958] device_release_driver_internal+0x174/0x208
[134.454810] driver_detach+0x70/0xd8
[134.461913] bus_remove_driver+0x64/0xe8
[134.469396] driver_unregister+0x34/0x60
[134.476822] platform_driver_unregister+0x20/0x30
[134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv]
[134.494634] __arm64_sys_delete_module+0x238/0x290
struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is
freed, than use hnae_handle will cause use after free panic.
This patch frees vf_cb after hnae_handle used.
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
index 0b4d90ceea7a..864f107ed48f 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
@@ -149,12 +149,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
int i;
- vf_cb->mac_cb = NULL;
-
- kfree(vf_cb);
-
for (i = 0; i < handle->q_num; i++)
hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
+
+ kfree(vf_cb);
}
static void hns_ae_ring_enable_all(struct hnae_handle *handle, int val)
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 11/21] MIPS: ath79: Enable OF serial ports in the default config
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (8 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 10/21] net: hns: Fix use after free identified by SLUB debug Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 12/21] scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param Sasha Levin
` (9 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alban Bedel, Paul Burton, linux-mips, Ralf Baechle, James Hogan,
Sasha Levin
From: Alban Bedel <albeu@free.fr>
[ Upstream commit 565dc8a4f55e491935bfb04866068d21784ea9a4 ]
CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF
boards, enable it in the default config to get a working setup out of
the box.
Signed-off-by: Alban Bedel <albeu@free.fr>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: linux-mips@vger.kernel.org
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/configs/ath79_defconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig
index 134879c1310a..4ed369c0ec6a 100644
--- a/arch/mips/configs/ath79_defconfig
+++ b/arch/mips/configs/ath79_defconfig
@@ -74,6 +74,7 @@ CONFIG_SERIAL_8250_CONSOLE=y
# CONFIG_SERIAL_8250_PCI is not set
CONFIG_SERIAL_8250_NR_UARTS=1
CONFIG_SERIAL_8250_RUNTIME_UARTS=1
+CONFIG_SERIAL_OF_PLATFORM=y
CONFIG_SERIAL_AR933X=y
CONFIG_SERIAL_AR933X_CONSOLE=y
# CONFIG_HW_RANDOM is not set
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 12/21] scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (9 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 11/21] MIPS: ath79: Enable OF serial ports in the default config Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 13/21] scsi: isci: initialize shost fully before calling scsi_add_host() Sasha Levin
` (8 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: YueHaibing, Martin K . Petersen, Sasha Levin, linux-scsi
From: YueHaibing <yuehaibing@huawei.com>
[ Upstream commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 ]
The return code should be check while qla4xxx_copy_from_fwddb_param fails.
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla4xxx/ql4_os.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index d8c03431d0aa..f9f899ec9427 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -7245,6 +7245,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha,
rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn,
fw_ddb_entry);
+ if (rc)
+ goto free_sess;
ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n",
__func__, fnode_sess->dev.kobj.name);
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 13/21] scsi: isci: initialize shost fully before calling scsi_add_host()
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (10 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 12/21] scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 14/21] MIPS: jazz: fix 64bit build Sasha Levin
` (7 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Logan Gunthorpe, Intel SCU Linux support, Artur Paszkiewicz,
James E.J. Bottomley, Martin K. Petersen, Christoph Hellwig,
Jens Axboe, Jeff Moyer, Sasha Levin, linux-scsi
From: Logan Gunthorpe <logang@deltatee.com>
[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ]
scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the
command size to allocate based on the prot_capabilities. In the isci
driver, scsi_host_set_prot() is called after scsi_add_host() so the command
size gets calculated to be smaller than it needs to be. Eventually,
scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it
was sized correctly and a buffer overrun may occur.
However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line
size, the mistake can go unnoticed.
The bug was noticed after the struct request size was reduced by commit
9d037ad707ed ("block: remove req->timeout_list")
Which likely reduced the allocated space for the request by an entire cache
line, enough that the overflow could be hit and it caused a panic, on boot,
at:
RIP: 0010:t10_pi_complete+0x77/0x1c0
Call Trace:
<IRQ>
sd_done+0xf5/0x340
scsi_finish_command+0xc3/0x120
blk_done_softirq+0x83/0xb0
__do_softirq+0xa1/0x2e6
irq_exit+0xbc/0xd0
call_function_single_interrupt+0xf/0x20
</IRQ>
sd_done() would call scsi_prot_sg_count() which reads the number of
entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of
the allocated space it reads a garbage number and erroneously calls
t10_pi_complete().
To prevent this, the calls to scsi_host_set_prot() are moved into
isci_host_alloc() before the call to scsi_add_host(). Out of caution, also
move the similar call to scsi_host_set_guard().
Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support")
Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Cc: Intel SCU Linux support <intel-linux-scu@intel.com>
Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Jeff Moyer <jmoyer@redhat.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/isci/init.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 77128d680e3b..6f38fa1f468a 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -595,6 +595,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
shost->max_lun = ~0;
shost->max_cmd_len = MAX_COMMAND_SIZE;
+ /* turn on DIF support */
+ scsi_host_set_prot(shost,
+ SHOST_DIF_TYPE1_PROTECTION |
+ SHOST_DIF_TYPE2_PROTECTION |
+ SHOST_DIF_TYPE3_PROTECTION);
+ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
+
err = scsi_add_host(shost, &pdev->dev);
if (err)
goto err_shost;
@@ -682,13 +689,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
goto err_host_alloc;
}
pci_info->hosts[i] = h;
-
- /* turn on DIF support */
- scsi_host_set_prot(to_shost(h),
- SHOST_DIF_TYPE1_PROTECTION |
- SHOST_DIF_TYPE2_PROTECTION |
- SHOST_DIF_TYPE3_PROTECTION);
- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
}
err = isci_setup_interrupts(pdev);
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 14/21] MIPS: jazz: fix 64bit build
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (11 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 13/21] scsi: isci: initialize shost fully before calling scsi_add_host() Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 15/21] net: stmmac: Fix PCI module removal leak Sasha Levin
` (6 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Bogendoerfer, Paul Burton, Ralf Baechle, James Hogan,
linux-mips, Sasha Levin
From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
[ Upstream commit 41af167fbc0032f9d7562854f58114eaa9270336 ]
64bit JAZZ builds failed with
linux-next/arch/mips/jazz/jazzdma.c: In function `vdma_init`:
/linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration
of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`?
[-Werror=implicit-function-declaration]
pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
^~~~~~~~~
CKSEG1ADDR
/linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from
integer of different size [-Werror=int-to-pointer-cast]
pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
^
In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0,
from /linux-next/include/linux/compiler.h:248,
from /linux-next/include/linux/kernel.h:10,
from /linux-next/arch/mips/jazz/jazzdma.c:11:
/linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from
pointer to integer of different size [-Werror=pointer-to-int-cast]
#define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */
^
/linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in
expansion of macro `_ACAST32_`
#define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff)
^~~~~~~~~
/linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of
macro `CPHYSADDR`
r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup
fixes this.
Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/jazz/jazzdma.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
index db6f5afff4ff..ea897912bc71 100644
--- a/arch/mips/jazz/jazzdma.c
+++ b/arch/mips/jazz/jazzdma.c
@@ -71,14 +71,15 @@ static int __init vdma_init(void)
get_order(VDMA_PGTBL_SIZE));
BUG_ON(!pgtbl);
dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
/*
* Clear the R4030 translation table
*/
vdma_pgtbl_init();
- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
+ CPHYSADDR((unsigned long)pgtbl));
r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 15/21] net: stmmac: Fix PCI module removal leak
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (12 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 14/21] MIPS: jazz: fix 64bit build Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 16/21] isdn: i4l: isdn_tty: Fix some concurrency double-free bugs Sasha Levin
` (5 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jose Abreu, Joao Pinto, David S . Miller, Giuseppe Cavallaro,
Alexandre Torgue, Jose Abreu, Sasha Levin, netdev
From: Jose Abreu <jose.abreu@synopsys.com>
[ Upstream commit 6dea7e1881fd86b80da64e476ac398008daed857 ]
Since commit b7d0f08e9129, the enable / disable of PCI device is not
managed which will result in IO regions not being automatically unmapped.
As regions continue mapped it is currently not possible to remove and
then probe again the PCI module of stmmac.
Fix this by manually unmapping regions on remove callback.
Changes from v1:
- Fix build error
Cc: Joao Pinto <jpinto@synopsys.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: Alexandre Torgue <alexandre.torgue@st.com>
Fixes: b7d0f08e9129 ("net: stmmac: Fix WoL for PCI-based setups")
Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index eafc28142cd2..49eaede34eea 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -231,7 +231,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
*/
static void stmmac_pci_remove(struct pci_dev *pdev)
{
+ int i;
+
stmmac_dvr_remove(&pdev->dev);
+
+ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) {
+ if (pci_resource_len(pdev, i) == 0)
+ continue;
+ pcim_iounmap_regions(pdev, BIT(i));
+ break;
+ }
+
pci_disable_device(pdev);
}
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 16/21] isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (13 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 15/21] net: stmmac: Fix PCI module removal leak Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 17/21] atm: he: fix sign-extension overflow on large shift Sasha Levin
` (4 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jia-Ju Bai, David S . Miller, Sasha Levin, netdev
From: Jia-Ju Bai <baijiaju1990@gmail.com>
[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]
The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be
concurrently executed.
isdn_tty_tiocmset
isdn_tty_modem_hup
line 719: kfree(info->dtmf_state);
line 721: kfree(info->silence_state);
line 723: kfree(info->adpcms);
line 725: kfree(info->adpcmr);
isdn_tty_set_termios
isdn_tty_modem_hup
line 719: kfree(info->dtmf_state);
line 721: kfree(info->silence_state);
line 723: kfree(info->adpcms);
line 725: kfree(info->adpcmr);
Thus, some concurrency double-free bugs may occur.
These possible bugs are found by a static tool written by myself and
my manual code review.
To fix these possible bugs, the mutex lock "modem_info_mutex" used in
isdn_tty_tiocmset() is added in isdn_tty_set_termios().
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/isdn/i4l/isdn_tty.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 63eaa0a9f8a1..d4e0d1602c80 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -1455,15 +1455,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
{
modem_info *info = (modem_info *) tty->driver_data;
+ mutex_lock(&modem_info_mutex);
if (!old_termios)
isdn_tty_change_speed(info);
else {
if (tty->termios.c_cflag == old_termios->c_cflag &&
tty->termios.c_ispeed == old_termios->c_ispeed &&
- tty->termios.c_ospeed == old_termios->c_ospeed)
+ tty->termios.c_ospeed == old_termios->c_ospeed) {
+ mutex_unlock(&modem_info_mutex);
return;
+ }
isdn_tty_change_speed(info);
}
+ mutex_unlock(&modem_info_mutex);
}
/*
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 17/21] atm: he: fix sign-extension overflow on large shift
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (14 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 16/21] isdn: i4l: isdn_tty: Fix some concurrency double-free bugs Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 18/21] leds: lp5523: fix a missing check of return value of lp55xx_read Sasha Levin
` (3 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Colin Ian King, David S . Miller, Sasha Levin, netdev
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ]
Shifting the 1 by exp by an int can lead to sign-extension overlow when
exp is 31 since 1 is an signed int and sign-extending this result to an
unsigned long long will set the upper 32 bits. Fix this by shifting an
unsigned long.
Detected by cppcheck:
(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/atm/he.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 31b513a23ae0..985a5800a637 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
instead of '/ 512', use '>> 9' to prevent a call
to divdu3 on x86 platforms
*/
- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9;
+ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9;
if (rate_cps < 10)
rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 18/21] leds: lp5523: fix a missing check of return value of lp55xx_read
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (15 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 17/21] atm: he: fix sign-extension overflow on large shift Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 19/21] mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky Sasha Levin
` (2 subsequent siblings)
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kangjie Lu, Jacek Anaszewski, Sasha Levin, linux-leds
From: Kangjie Lu <kjlu@umn.edu>
[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ]
When lp55xx_read() fails, "status" is an uninitialized variable and thus
may contain random value; using it leads to undefined behaviors.
The fix inserts a check for the return value of lp55xx_read: if it
fails, returns with its error code.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/leds-lp5523.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index c5b30f06218a..44ceed7ac3c5 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
/* Let the programs run for couple of ms and check the engine status */
usleep_range(3000, 6000);
- lp55xx_read(chip, LP5523_REG_STATUS, &status);
+ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
+ if (ret)
+ return ret;
status &= LP5523_ENG_STATUS_MASK;
if (status != LP5523_ENG_STATUS_MASK) {
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 19/21] mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (16 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 18/21] leds: lp5523: fix a missing check of return value of lp55xx_read Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 20/21] net/mlx5e: Fix wrong (zero) TX drop counter indication for representor Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 21/21] isdn: avm: Fix string plus integer warning from Clang Sasha Levin
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ido Schimmel, David S . Miller, Sasha Levin, netdev
From: Ido Schimmel <idosch@mellanox.com>
[ Upstream commit 64254a2054611205798e6bde634639bc704573ac ]
The driver currently treats static FDB entries as both static and
sticky. This is incorrect and prevents such entries from being roamed to
a different port via learning.
Fix this by configuring static entries with ageing disabled and roaming
enabled.
In net-next we can add proper support for the newly introduced 'sticky'
flag.
Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
Reviewed-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 60e1edcbe573..7ca1ab5c1936 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -794,7 +794,7 @@ static int mlxsw_sp_port_vlans_add(struct mlxsw_sp_port *mlxsw_sp_port,
static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic)
{
return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS :
- MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY;
+ MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG;
}
static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
@@ -806,7 +806,7 @@ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
const char *mac, u16 fid, bool adding,
enum mlxsw_reg_sfd_rec_action action,
- bool dynamic)
+ enum mlxsw_reg_sfd_rec_policy policy)
{
char *sfd_pl;
u8 num_rec;
@@ -817,8 +817,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
return -ENOMEM;
mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
- mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
- mac, fid, action, local_port);
+ mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port);
num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
if (err)
@@ -837,7 +836,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
bool dynamic)
{
return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding,
- MLXSW_REG_SFD_REC_ACTION_NOP, dynamic);
+ MLXSW_REG_SFD_REC_ACTION_NOP,
+ mlxsw_sp_sfd_rec_policy(dynamic));
}
int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
@@ -845,7 +845,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
{
return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding,
MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER,
- false);
+ MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY);
}
static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 20/21] net/mlx5e: Fix wrong (zero) TX drop counter indication for representor
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (17 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 19/21] mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 21/21] isdn: avm: Fix string plus integer warning from Clang Sasha Levin
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tariq Toukan, Saeed Mahameed, Sasha Levin, netdev, linux-rdma
From: Tariq Toukan <tariqt@mellanox.com>
[ Upstream commit 7fdc1adc52d3975740547a78c2df329bb207f15d ]
For representors, the TX dropped counter is not folded from the
per-ring counters. Fix it.
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index bf1c09ca73c0..b210c171a380 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -91,6 +91,7 @@ static void mlx5e_update_sw_rep_counters(struct mlx5e_priv *priv)
s->tx_packets += sq_stats->packets;
s->tx_bytes += sq_stats->bytes;
+ s->tx_queue_dropped += sq_stats->dropped;
}
}
}
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 4.9 21/21] isdn: avm: Fix string plus integer warning from Clang
2019-02-13 2:40 [PATCH AUTOSEL 4.9 01/21] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
` (18 preceding siblings ...)
2019-02-13 2:40 ` [PATCH AUTOSEL 4.9 20/21] net/mlx5e: Fix wrong (zero) TX drop counter indication for representor Sasha Levin
@ 2019-02-13 2:40 ` Sasha Levin
19 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2019-02-13 2:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nathan Chancellor, David S . Miller, Sasha Levin, netdev
From: Nathan Chancellor <natechancellor@gmail.com>
[ Upstream commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 ]
A recent commit in Clang expanded the -Wstring-plus-int warning, showing
some odd behavior in this file.
drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int]
cinfo->version[j] = "\0\0" + 1;
~~~~~~~^~~
drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning
cinfo->version[j] = "\0\0" + 1;
^
& [ ]
1 warning generated.
This is equivalent to just "\0". Nick pointed out that it is smarter to
use "" instead of "\0" because "" is used elsewhere in the kernel and
can be deduplicated at the linking stage.
Link: https://github.com/ClangBuiltLinux/linux/issues/309
Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/isdn/hardware/avm/b1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
index 4d9b195547c5..df2a10157720 100644
--- a/drivers/isdn/hardware/avm/b1.c
+++ b/drivers/isdn/hardware/avm/b1.c
@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo)
int i, j;
for (j = 0; j < AVM_MAXVERSION; j++)
- cinfo->version[j] = "\0\0" + 1;
+ cinfo->version[j] = "";
for (i = 0, j = 0;
j < AVM_MAXVERSION && i < cinfo->versionlen;
j++, i += cinfo->versionbuf[i] + 1)
--
2.19.1
^ permalink raw reply [flat|nested] 21+ messages in thread