summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-10-07efi/cper: Fix endianness of PCIe class codeLukas Wunner
The CPER parser assumes that the class code is big endian, but at least on this edk2-derived Intel Purley platform it's little endian: efi: EFI v2.50 by EDK II BIOS ID:PLYDCRB1.86B.0119.R05.1701181843 DMI: Intel Corporation PURLEY/PURLEY, BIOS PLYDCRB1.86B.0119.R05.1701181843 01/18/2017 {1}[Hardware Error]: device_id: 0000:5d:00.0 {1}[Hardware Error]: slot: 0 {1}[Hardware Error]: secondary_bus: 0x5e {1}[Hardware Error]: vendor_id: 0x8086, device_id: 0x2030 {1}[Hardware Error]: class_code: 000406 ^^^^^^ (should be 060400) Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Dave Young <dyoung@redhat.com> Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Cc: Jerry Snitselaar <jsnitsel@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Lyude Paul <lyude@redhat.com> Cc: Matthew Garrett <mjg59@google.com> Cc: Octavian Purdila <octavian.purdila@intel.com> Cc: Peter Jones <pjones@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Scott Talbert <swt@techie.net> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-efi@vger.kernel.org Cc: linux-integrity@vger.kernel.org Link: https://lkml.kernel.org/r/20191002165904.8819-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
2019-10-07Merge tag 'perf-urgent-for-mingo-5.4-20191001' of ↵Ingo Molnar
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf script: Andi Kleen: - Fix recovery from LBR/binary mismatch in the "brstackinsn" --field. perf annotate: Arnaldo Carvalho de Melo: - Propagate errors so that meaningful messages can be presented to the user in case of problems. perf map: Steve MacLean: - Fix handling of maps partially overlapped, resolving symbols in the ranges not replaced by new mmaps. perf tests: Ian Rogers: - Use raise() instead of NULL derefs to avoid causing a SIGILL rather than a SIGSEGV for optimized builds that turn NULL derefs into ud2 instructions. perf LLVM: Ian Rogers: - Don't access out-of-scope array. perf inject: Steve MacLean: - Fix JIT_CODE_MOVE filename, that was having a u64 truncaded into a 32-bit snprintf format and also a missing ".so" suffix in another case. libsubcmd: Ian Rogers: - Make _FORTIFY_SOURCE defines dependent on the feature, avoiding false positives with with memory sanitizers such as LLVM's ASan. Vendor specific events: Intel: Andi Kleen: - Fix period for Intel fixed counters. s390: Thomas Richter (2): - Fix some event details transaction for machine type 8561. tools headers UAPI: Arnaldo Carvalho de Melo: - Sync headers with the kernel, catching new usbdevfs ioctls and madvise behaviours to properly decode in 'perf trace' output. Documentation: Steve MacLean: - Correct and clarify jitdump spec. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2019-10-07Merge tag 'rxrpc-fixes-20191007' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== rxrpc: Syzbot-inspired fixes Here's a series of patches that fix a number of issues found by syzbot: (1) A reference leak on rxrpc_call structs in a sendmsg error path. (2) A tracepoint that looked in the rxrpc_peer record after putting it. Analogous with this, though not presently detected, the same bug is also fixed in relation to rxrpc_connection and rxrpc_call records. (3) Peer records don't pin local endpoint records, despite accessing them. (4) Access to connection crypto ops to clean up a call after the call's ref on that connection has been put. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-07hwmon: docs: Extend inspur-ipsps1 title underlineAdam Zerella
Sphinx is generating a build warning as the title underline of this file is too short. Signed-off-by: Adam Zerella <adam.zerella@gmail.com> Reviewed-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2019-10-07drm/i915/gt: Restore dropped 'interruptible' flagChris Wilson
Lost in the rebasing was Tvrtko's reminder that we need to keep an uninterruptible wait around for the Ironlake VT-d w/a Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20191006165002.30312-3-chris@chris-wilson.co.uk
2019-10-07arm64: Kconfig: Make CONFIG_COMPAT_VDSO a proper Kconfig optionWill Deacon
CONFIG_COMPAT_VDSO is defined by passing '-DCONFIG_COMPAT_VDSO' to the compiler when the generic compat vDSO code is in use. It's much cleaner and simpler to expose this as a proper Kconfig option (like x86 does), so do that and remove the bodge. Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: vdso32: Rename COMPATCC to CC_COMPATWill Deacon
For consistency with CROSS_COMPILE_COMPAT, mechanically rename COMPATCC to CC_COMPAT so that specifying aspects of the compat vDSO toolchain in the environment isn't needlessly confusing. Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: vdso32: Pass '--target' option to clang via VDSO_CAFLAGSWill Deacon
Directly passing the '--target' option to clang by appending to COMPATCC does not work if COMPATCC has been specified explicitly as an argument to Make unless the 'override' directive is used, which is ugly and different to what is done in the top-level Makefile. Move the '--target' option for clang out of COMPATCC and into VDSO_CAFLAGS, where it will be picked up when compiling and assembling the 32-bit vDSO under clang. Reported-by: Catalin Marinas <catalin.marinas@arm.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: vdso32: Don't use KBUILD_CPPFLAGS unconditionallyWill Deacon
KBUILD_CPPFLAGS is defined differently depending on whether the main compiler is clang or not. This means that it is not possible to build the compat vDSO with GCC if the rest of the kernel is built with clang. Define VDSO_CPPFLAGS directly to break this dependency and allow a clang kernel to build a compat vDSO with GCC: $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- \ CROSS_COMPILE_COMPAT=arm-linux-gnueabihf- CC=clang \ COMPATCC=arm-linux-gnueabihf-gcc Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: vdso32: Move definition of COMPATCC into vdso32/MakefileWill Deacon
There's no need to export COMPATCC, so just define it locally in the vdso32/Makefile, which is the only place where it is used. Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: Default to building compat vDSO with clang when CONFIG_CC_IS_CLANGWill Deacon
Rather than force the use of GCC for the compat cross-compiler, instead extract the target from CROSS_COMPILE_COMPAT and pass it to clang if the main compiler is clang. Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controllerMatthias Kaehlcke
The DDC/CI protocol involves sending a multi-byte request to the display via I2C, which is typically followed by a multi-byte response. The internal I2C controller only allows single byte reads/writes or reads of 8 sequential bytes, hence DDC/CI is not supported when the internal I2C controller is used. The I2C transfers complete without errors, however the data in the response is garbage. Abort transfers to/from slave address 0x37 (DDC) with -EOPNOTSUPP, to make it evident that the communication is failing. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Sean Paul <sean@poorly.run> Acked-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Link: https://patchwork.freedesktop.org/patch/msgid/20191002124354.v2.1.I709dfec496f5f0b44a7b61dcd4937924da8d8382@changeid
2019-10-07drm/i915: Update DRIVER_DATE to 20191007Joonas Lahtinen
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2019-10-07drm/sun4i: sun6i_mipi_dsi: fix DCS long write packet lengthIcenowy Zheng
The packet length of DCS long write packet should not be added with 1 when constructing long write packet. Fix this. Signed-off-by: Icenowy Zheng <icenowy@aosc.io> Signed-off-by: Maxime Ripard <mripard@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20191006160303.24413-4-icenowy@aosc.io
2019-10-07drm/sun4i: dsi: fix the overhead of the horizontal front porchIcenowy Zheng
The formula in the BSP kernel indicates that a 16-byte overhead is used when sending the HFP. However, this value is currently set to 6 in the sun6i_mipi_dsi driver, which makes some panels flashing. Fix this overhead value. Signed-off-by: Icenowy Zheng <icenowy@aosc.io> Signed-off-by: Maxime Ripard <mripard@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20191006160303.24413-3-icenowy@aosc.io
2019-10-07serial: 8250_omap: Fix gpio check for auto RTS/CTSAdam Ford
There are two checks to see if the manual gpio is configured, but these the check is seeing if the structure is NULL instead it should check to see if there are CTS and/or RTS pins defined. This patch uses checks for those individual pins instead of checking for the structure itself to restore auto RTS/CTS. Signed-off-by: Adam Ford <aford173@gmail.com> Reviewed-by: Yegor Yefremov <yegorslists@googlemail.com> Link: https://lore.kernel.org/r/20191006163314.23191-2-aford173@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07serial: mctrl_gpio: Check for NULL pointerAdam Ford
When using mctrl_gpio_to_gpiod, it dereferences gpios into a single requested GPIO. This dereferencing can break if gpios is NULL, so this patch adds a NULL check before dereferencing it. If gpios is NULL, this function will also return NULL. Signed-off-by: Adam Ford <aford173@gmail.com> Reviewed-by: Yegor Yefremov <yegorslists@googlemail.com> Link: https://lore.kernel.org/r/20191006163314.23191-1-aford173@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07tty: serial: fsl_lpuart: Fix lpuart_flush_buffer()Andrey Smirnov
Fix incorrect read-modify-write sequence in lpuart_flush_buffer() that was reading from UARTPFIFO and writing to UARTCFIFO instead of operating solely on the latter. Fixes: 9bc19af9dacb ("tty: serial: fsl_lpuart: Flush HW FIFOs in .flush_buffer") Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Reported-by: Vivien Didelot <vivien.didelot@gmail.com> Tested-by: Vivien Didelot <vivien.didelot@gmail.com> Tested-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Fabio Estevam <festevam@gmail.com> Cc: Stefan Agner <stefan@agner.ch> Cc: Chris Healy <cphealy@gmail.com> Cc: Cory Tusar <cory.tusar@zii.aero> Cc: Lucas Stach <l.stach@pengutronix.de> Cc: Jiri Slaby <jslaby@suse.com> Link: https://lore.kernel.org/r/20191004215537.5308-1-andrew.smirnov@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb:cdns3: Fix for CV CH9 running with g_zero driver.Pawel Laszczak
Patch fixes issue with Halt Endnpoint Test observed during using g_zero driver as DUT. Bug occurred only on some testing board. Endpoint can defer transition to Halted state if endpoint has pending requests. Patch add additional condition that allows to return correct endpoint status during Get Endpoint Status request even if the halting endpoint is in progress. Reported-by: Rahul Kumar <kurahul@cadence.com> Signed-off-by: Rahul Kumar <kurahul@cadence.com> Signed-off-by: Pawel Laszczak <pawell@cadence.com> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Tested-by: Roger Quadros <rogerq@ti.com> Link: https://lore.kernel.org/r/1570430355-26118-1-git-send-email-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb: dwc3: Remove dev_err() on platform_get_irq() failureHans de Goede
Since commit 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()"), platform_get_irq() will call dev_err() itself on failure, so there is no need for the driver to also do this. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Link: https://lore.kernel.org/r/20191005210449.3926-4-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb: dwc3: Switch to platform_get_irq_byname_optional()Hans de Goede
The dwc3 code to get the "peripheral" / "host" / "otg" IRQ first tries platform_get_irq_byname() and then falls back to the IRQ at index 0 if the platform_get_irq_byname(). In this case we do not want platform_get_irq_byname() to print an error on failure, so switch to platform_get_irq_byname_optional() instead which does not print an error. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205037 Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Link: https://lore.kernel.org/r/20191005210449.3926-3-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07driver core: platform: Add platform_get_irq_byname_optional()Hans de Goede
Some drivers (e.g dwc3) first try to get an IRQ byname and then fall back to the one at index 0. In this case we do not want the error(s) printed by platform_get_irq_byname(). This commit adds a new platform_get_irq_byname_optional(), which does not print errors, for this. While at it also improve the kdoc text for platform_get_irq_byname() a bit. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205037 Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://lore.kernel.org/r/20191005210449.3926-2-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07cec: add cec_adapter to cec_notifier_cec_adap_unregister()Hans Verkuil
It is possible for one HDMI connector to have multiple CEC adapters. The typical real-world scenario is that where one adapter is used when the device is in standby, and one that's better/smarter when the device is powered up. The cec-notifier changes were made with that in mind, but I missed that in order to support this you need to tell cec_notifier_cec_adap_unregister() which adapter you are unregistering from the notifier. Add this additional argument. It is currently unused, but once all drivers use this, the CEC core will be adapted for these use-cases. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Acked-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/e9fc8740-6be6-43a7-beee-ce2d7b54936e@xs4all.nl
2019-10-07staging: vt6655: Fix memory leak in vt6655_probeNavid Emamdoost
In vt6655_probe, if vnt_init() fails the cleanup code needs to be called like other error handling cases. The call to device_free_info() is added. Fixes: 67013f2c0e58 ("staging: vt6655: mac80211 conversion add main mac80211 functions") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191004200319.22394-1-navid.emamdoost@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07lib: vdso: Remove CROSS_COMPILE_COMPAT_VDSOVincenzo Frascino
arm64 was the last architecture using CROSS_COMPILE_COMPAT_VDSO config option. With this patch series the dependency in the architecture has been removed. Remove CROSS_COMPILE_COMPAT_VDSO from the Unified vDSO library code. Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Andy Lutomirski <luto@kernel.org> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: vdso32: Remove jump label config option in MakefileVincenzo Frascino
The jump labels are not used in vdso32 since it is not possible to run runtime patching on them. Remove the configuration option from the Makefile. Cc: Will Deacon <will@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: vdso32: Detect binutils support for dmb ishldVincenzo Frascino
Older versions of binutils (prior to 2.24) do not support the "ISHLD" option for memory barrier instructions, which leads to a build failure when assembling the vdso32 library. Add a compilation time mechanism that detects if binutils supports those instructions and configure the kernel accordingly. Cc: Will Deacon <will@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Reported-by: Will Deacon <will@kernel.org> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: vdso: Remove stale files from old assembly implementationVincenzo Frascino
Moving over to the generic C implementation of the vDSO inadvertently left some stale files behind which are no longer used. Remove them. Cc: Will Deacon <will@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: vdso32: Fix broken compat vDSO build warningsVincenzo Frascino
The .config file and the generated include/config/auto.conf can end up out of sync after a set of commands since CONFIG_CROSS_COMPILE_COMPAT_VDSO is not updated correctly. The sequence can be reproduced as follows: $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- defconfig [...] $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- menuconfig [set CONFIG_CROSS_COMPILE_COMPAT_VDSO="arm-linux-gnueabihf-"] $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- Which results in: arch/arm64/Makefile:62: CROSS_COMPILE_COMPAT not defined or empty, the compat vDSO will not be built even though the compat vDSO has been built: $ file arch/arm64/kernel/vdso32/vdso.so arch/arm64/kernel/vdso32/vdso.so: ELF 32-bit LSB pie executable, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=c67f6c786f2d2d6f86c71f708595594aa25247f6, stripped A similar case that involves changing the configuration parameter multiple times can be reconducted to the same family of problems. Remove the use of CONFIG_CROSS_COMPILE_COMPAT_VDSO altogether and instead rely on the cross-compiler prefix coming from the environment via CROSS_COMPILE_COMPAT, much like we do for the rest of the kernel. Cc: Will Deacon <will@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Reported-by: Will Deacon <will@kernel.org> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07arm64: mm: fix spurious fault detectionMark Rutland
When detecting a spurious EL1 translation fault, we attempt to compare ESR_EL1.DFSC with PAR_EL1.FST. We erroneously use FIELD_PREP() to extract PAR_EL1.FST, when we should be using FIELD_GET(). In the wise words of Robin Murphy: | FIELD_GET() is a UBFX, FIELD_PREP() is a BFI Using FIELD_PREP() means that that dfsc & ESR_ELx_FSC_TYPE is always zero, and hence not equal to ESR_ELx_FSC_FAULT. Thus we detect any unhandled translation fault as spurious. ... so let's use FIELD_GET() to ensure we don't decide all translation faults are spurious. ESR_EL1.DFSC occupies bits [5:0], and requires no shifting. Fixes: 42f91093b043332a ("arm64: mm: Ignore spurious translation faults taken from the kernel") Signed-off-by: Mark Rutland <mark.rutland@arm.com> Reported-by: Robin Murphy <robin.murphy@arm.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: James Morse <james.morse@arm.com> Cc: Will Deacon <will.deacon@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2019-10-07rxrpc: Fix call crypto state cleanupDavid Howells
Fix the cleanup of the crypto state on a call after the call has been disconnected. As the call has been disconnected, its connection ref has been discarded and so we can't go through that to get to the security ops table. Fix this by caching the security ops pointer in the rxrpc_call struct and using that when freeing the call security state. Also use this in other places we're dealing with call-specific security. The symptoms look like: BUG: KASAN: use-after-free in rxrpc_release_call+0xb2d/0xb60 net/rxrpc/call_object.c:481 Read of size 8 at addr ffff888062ffeb50 by task syz-executor.5/4764 Fixes: 1db88c534371 ("rxrpc: Fix -Wframe-larger-than= warnings from on-stack crypto") Reported-by: syzbot+eed305768ece6682bb7f@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com>
2019-10-07rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local recordDavid Howells
The rxrpc_peer record needs to hold a reference on the rxrpc_local record it points as the peer is used as a base to access information in the rxrpc_local record. This can cause problems in __rxrpc_put_peer(), where we need the network namespace pointer, and in rxrpc_send_keepalive(), where we need to access the UDP socket, leading to symptoms like: BUG: KASAN: use-after-free in __rxrpc_put_peer net/rxrpc/peer_object.c:411 [inline] BUG: KASAN: use-after-free in rxrpc_put_peer+0x685/0x6a0 net/rxrpc/peer_object.c:435 Read of size 8 at addr ffff888097ec0058 by task syz-executor823/24216 Fix this by taking a ref on the local record for the peer record. Fixes: ace45bec6d77 ("rxrpc: Fix firewall route keepalive") Fixes: 2baec2c3f854 ("rxrpc: Support network namespacing") Reported-by: syzbot+b9be979c55f2bea8ed30@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com>
2019-10-07rxrpc: Fix trace-after-put looking at the put call recordDavid Howells
rxrpc_put_call() calls trace_rxrpc_call() after it has done the decrement of the refcount - which looks at the debug_id in the call record. But unless the refcount was reduced to zero, we no longer have the right to look in the record and, indeed, it may be deleted by some other thread. Fix this by getting the debug_id out before decrementing the refcount and then passing that into the tracepoint. Fixes: e34d4234b0b7 ("rxrpc: Trace rxrpc_call usage") Signed-off-by: David Howells <dhowells@redhat.com>
2019-10-07rxrpc: Fix trace-after-put looking at the put connection recordDavid Howells
rxrpc_put_*conn() calls trace_rxrpc_conn() after they have done the decrement of the refcount - which looks at the debug_id in the connection record. But unless the refcount was reduced to zero, we no longer have the right to look in the record and, indeed, it may be deleted by some other thread. Fix this by getting the debug_id out before decrementing the refcount and then passing that into the tracepoint. Fixes: 363deeab6d0f ("rxrpc: Add connection tracepoint and client conn state tracepoint") Signed-off-by: David Howells <dhowells@redhat.com>
2019-10-07rxrpc: Fix trace-after-put looking at the put peer recordDavid Howells
rxrpc_put_peer() calls trace_rxrpc_peer() after it has done the decrement of the refcount - which looks at the debug_id in the peer record. But unless the refcount was reduced to zero, we no longer have the right to look in the record and, indeed, it may be deleted by some other thread. Fix this by getting the debug_id out before decrementing the refcount and then passing that into the tracepoint. This can cause the following symptoms: BUG: KASAN: use-after-free in __rxrpc_put_peer net/rxrpc/peer_object.c:411 [inline] BUG: KASAN: use-after-free in rxrpc_put_peer+0x685/0x6a0 net/rxrpc/peer_object.c:435 Read of size 8 at addr ffff888097ec0058 by task syz-executor823/24216 Fixes: 1159d4b496f5 ("rxrpc: Add a tracepoint to track rxrpc_peer refcounting") Reported-by: syzbot+b9be979c55f2bea8ed30@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com>
2019-10-07rxrpc: Fix call ref leakDavid Howells
When sendmsg() finds a call to continue on with, if the call is in an inappropriate state, it doesn't release the ref it just got on that call before returning an error. This causes the following symptom to show up with kasan: BUG: KASAN: use-after-free in rxrpc_send_keepalive+0x8a2/0x940 net/rxrpc/output.c:635 Read of size 8 at addr ffff888064219698 by task kworker/0:3/11077 where line 635 is: whdr.epoch = htonl(peer->local->rxnet->epoch); The local endpoint (which cannot be pinned by the call) has been released, but not the peer (which is pinned by the call). Fix this by releasing the call in the error path. Fixes: 37411cad633f ("rxrpc: Fix potential NULL-pointer exception") Reported-by: syzbot+d850c266e3df14da1d31@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com>
2019-10-07mtd: rawnand: au1550nd: Fix au_read_buf16() prototypePaul Burton
Commit 7e534323c416 ("mtd: rawnand: Pass a nand_chip object to chip->read_xxx() hooks") modified the prototype of the struct nand_chip read_buf function pointer. In the au1550nd driver we have 2 implementations of read_buf. The previously mentioned commit modified the au_read_buf() implementation to match the function pointer, but not au_read_buf16(). This results in a compiler warning for MIPS db1xxx_defconfig builds: drivers/mtd/nand/raw/au1550nd.c:443:57: warning: pointer type mismatch in conditional expression Fix this by updating the prototype of au_read_buf16() to take a struct nand_chip pointer as its first argument, as is expected after commit 7e534323c416 ("mtd: rawnand: Pass a nand_chip object to chip->read_xxx() hooks"). Note that this shouldn't have caused any functional issues at runtime, since the offset of the struct mtd_info within struct nand_chip is 0 making mtd_to_nand() effectively a type-cast. Signed-off-by: Paul Burton <paul.burton@mips.com> Fixes: 7e534323c416 ("mtd: rawnand: Pass a nand_chip object to chip->read_xxx() hooks") Cc: stable@vger.kernel.org # v4.20+ Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2019-10-07dt-bindings: mediatek: add mutex description for mt8183 displayYongqiang Niu
This patch add mutex description for mt8183 display Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07dt-bindings: mediatek: add dither description for mt8183 displayYongqiang Niu
Update device tree binding documention for the display subsystem for Mediatek MT8183 SOCs Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com> Reviewed-by: Rob Herring <robh at kernel.org> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07dt-bindings: mediatek: add ccorr description for mt8183 displayYongqiang Niu
Update device tree binding documention for the display subsystem for Mediatek MT8183 SOCs Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com> Reviewed-by: Rob Herring <robh at kernel.org> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07dt-bindings: mediatek: add ovl_2l description for mt8183 displayYongqiang Niu
Update device tree binding documention for the display subsystem for Mediatek MT8183 SOCs Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: add dphy reset after setting lanes numberJitao Shi
Add dphy reset after setting lanes number to avoid dphy fifo effor. Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: adjust dsi and mipi_tx probe sequenceJitao Shi
mtk_mipi_tx is the phy of mtk_dsi. mtk_dsi get the phy(mtk_mipi_tx) in probe(). So, mtk_mipi_tx init should be ahead of mtk_dsi. Or mtk_dsi will defer to wait mtk_mipi_tx probe done. Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: change the dsi phytiming calculate methodJitao Shi
Change the method of frame rate calc which can get more accurate frame rate. data rate = pixel_clock * bit_per_pixel / lanes Adjust hfp_wc to adapt the additional phy_data if MIPI_DSI_MODE_VIDEO_BURST hfp_wc = hfp * bpp - data_phy_cycles * lanes - 12 - 6; else hfp_wc = hfp * bpp - data_phy_cycles * lanes - 12; Note: //(2: 1 for sync, 1 for phy idle) data_phy_cycles = T_hs_exit + T_lpx + T_hs_prepare + T_hs_zero + 2; bpp: bit per pixel Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Tested-by: Ryan Case <ryandcase@chromium.org> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: add mt8183 dsi driver supportJitao Shi
Add mt8183 dsi driver data. Enable size control and reg commit control. Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: add frame size controlJitao Shi
Our new DSI chip has frame size control. So add the driver data to control for different chips. Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: add dsi reg commit disable controlJitao Shi
New DSI IP has shadow register and working reg. The register values are writen to shadow register. And then trigger with commit reg, the register values will be moved working register. This function is default on. But this driver doesn't use this function. So add the disable control. Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: replace writeb() with mtk_dsi_mask()Jitao Shi
The writeb() is unavailable in mt8173. Because the mt8173 dsi module doesn't support 8bit mode access. Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: fixes CMDQ reg address of mt8173 is different with mt2701Jitao Shi
Config the different CMDQ reg address in driver data. Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Signed-off-by: CK Hu <ck.hu@mediatek.com>
2019-10-07drm/mediatek: move mipi_dsi_host_register to probeJitao Shi
DSI panel driver need attach function which is include in mipi_dsi_host_ops. If mipi_dsi_host_register is not in probe, dsi panel will probe more delay. So move the mipi_dsi_host_register to probe from bind. Signed-off-by: Jitao Shi <jitao.shi@mediatek.com> Signed-off-by: CK Hu <ck.hu@mediatek.com>
generated by cgit (git 2.34.1) at 2025-09-14 17:08:02 +0000