summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-02-22Merge branch 'for-6.3/hid-sensor' into for-linusBenjamin Tissoires
Allow more custom IIO sensors through HID (Philipp Jungkamp)
2023-02-22Merge branch 'for-6.3/evision' into for-linusBenjamin Tissoires
New hid-evision driver for EVision keyboards (Philippe Valembois)
2023-02-22Merge branch 'for-6.3/bigben' into for-linusBenjamin Tissoires
UAF protection in work struct (Pietro Borrello)
2023-02-22Merge branch 'for-6.3/asus' into for-linusBenjamin Tissoires
UAF protection in work struct (Pietro Borrello)
2023-02-22Merge branch 'for-6.3/hid-core' into for-linusBenjamin Tissoires
- constify hid_ll_driver (Thomas Weißschuh) - map standard Battery System Charging to upower (José Expósito) - couple of assorted fixes and new handling of HID usages (Jingyuan Liang & Ronald Tschalär)
2023-02-22netfilter: x_tables: fix percpu counter block leak on error path when ↵Pavel Tikhomirov
creating new netns Here is the stack where we allocate percpu counter block: +-< __alloc_percpu +-< xt_percpu_counter_alloc +-< find_check_entry # {arp,ip,ip6}_tables.c +-< translate_table And it can be leaked on this code path: +-> ip6t_register_table +-> translate_table # allocates percpu counter block +-> xt_register_table # fails there is no freeing of the counter block on xt_register_table fail. Note: xt_percpu_counter_free should be called to free it like we do in do_replace through cleanup_entry helper (or in __ip6t_unregister_table). Probability of hitting this error path is low AFAICS (xt_register_table can only return ENOMEM here, as it is not replacing anything, as we are creating new netns, and it is hard to imagine that all previous allocations succeeded and after that one in xt_register_table failed). But it's worth fixing even the rare leak. Fixes: 71ae0dff02d7 ("netfilter: xtables: use percpu rule counters") Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2023-02-22mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leakLiang He
In arizona_clk32k_enable(), we should use pm_runtime_resume_and_get() as pm_runtime_get_sync() will increase the refcnt even when it returns an error. Signed-off-by: Liang He <windhl@126.com> Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20230105061055.1509261-1-windhl@126.com
2023-02-22mfd: syscon: Allow reset control for syscon devicesJeremy Kerr
Simple syscon devices may require deassertion of a reset signal in order to access their register set. Rather than requiring a custom driver to implement this, we can use the generic "resets" specifiers to link a reset line to the syscon. This change adds an optional reset line to the syscon device description, and deasserts the reset if detected. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20230105005010.124948-3-jk@codeconstruct.com.au
2023-02-22dt-bindings: mfd/syscon: Add resets propertyJeremy Kerr
Simple syscon devices may require deassertion of a reset signal in order to access their register set. This change adds the `resets` property from reset.yaml#/properties/resets (referenced through core.yaml), specifying a maxItems of 1 for a single (optional) reset descriptor. This will allow a future change to the syscon driver to implement reset control. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20230105005010.124948-2-jk@codeconstruct.com.au
2023-02-22dt-bindings: mfd: syscon: Add amd,pensando-elba-syscon compatibleBrad Larson
Add the AMD Pensando Elba SoC system registers compatible Signed-off-by: Brad Larson <blarson@amd.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20230119035136.21603-6-blarson@amd.com
2023-02-22dt-bindings: mfd: qcom,tcsr: Add compatible for MSM8226Matti Lehtimäki
Document the qcom,msm8226-tcsr compatible. Signed-off-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20230112202612.791455-5-matti.lehtimaki@gmail.com
2023-02-22mfd: simple-mfd-i2c: Fix incoherent comment regarding DT registrationLee Jones
Signed-off-by: Lee Jones <lee@kernel.org>
2023-02-22mfd: axp20x: Switch to the sys-off handler APISamuel Holland
This removes a layer of indirection through pm_power_off() and allows the PMIC handler to be used as a fallback when firmware power off fails. This happens on boards like the Clockwork DevTerm R-01 where OpenSBI does not know how to use the PMIC to power off the board. Move the check for AXP288 to avoid registering a dummy handler. Signed-off-by: Samuel Holland <samuel@sholland.org> [Lee: Removed superfluous new line] Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221228162752.14204-1-samuel@sholland.org
2023-02-22mfd: core: Spelling s/compement/complement/Geert Uytterhoeven
Fix a misspelling of "complement". Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/aa7abd7103a0e4be954ea63de78f12e8251b2964.1673271092.git.geert+renesas@glider.be
2023-02-22mfd: max8925: Remove the unused function irq_to_max8925()Jiapeng Chong
The function irq_to_max8925() is defined in the max8925-core.c file, but not called elsewhere, so remove this unused function. drivers/mfd/max8925-core.c:472:40: warning: unused function 'irq_to_max8925'. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3561 Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221227081805.54185-1-jiapeng.chong@linux.alibaba.com
2023-02-22mfd: qcom-pm8xxx: Remove set but unused variable 'rev'Jiapeng Chong
Variable rev is not effectively used in the function, so delete it. drivers/mfd/qcom-pm8xxx.c:513:6: warning: variable 'rev' set but not used. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3558 Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221227081921.56448-1-jiapeng.chong@linux.alibaba.com
2023-02-22dt-bindings: mfd: syscon: Document GXP register compatibleNick Hawkins
Document hpe,gxp-sysreg compatible for GXP registers. Signed-off-by: Nick Hawkins <nick.hawkins@hpe.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221216183532.78933-4-nick.hawkins@hpe.com
2023-02-22mfd: twl4030-power: Drop empty platform remove functionUwe Kleine-König
A remove callback just returning 0 is equivalent to no remove callback at all. So drop the useless function. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221212214352.3776110-1-u.kleine-koenig@pengutronix.de
2023-02-22mfd: twl: Fix TWL6032 phy vbus detectionAndreas Kemnade
TWL6032 has a few charging registers prepended before the charging registers the TWL6030 has. To be able to use common register defines declare the additional registers as additional module. At the moment this affects the access to CHARGERUSB_CTRL1 in phy-twl6030-usb. Without this patch, it is accessing the wrong register on TWL6032. The consequence is that presence of Vbus is not reported. Cc: Bin Liu <b-liu@ti.com> Cc: Tony Lindgren <tony@atomide.com> Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221208215723.217557-1-andreas@kemnade.info
2023-02-22mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()Qiheng Lin
`req` is allocated in pcf50633_adc_async_read(), but adc_enqueue_request() could fail to insert the `req` into queue. We need to check the return value and free it in the case of failure. Fixes: 08c3e06a5eb2 ("mfd: PCF50633 adc driver") Signed-off-by: Qiheng Lin <linqiheng@huawei.com> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221208061555.8776-1-linqiheng@huawei.com
2023-02-22MAINTAINERS: Move MFD from a Supported to Maintaied stateLee Jones
No one is funding MFD maintenance. S: *Status*, one of the following: Supported: Someone is actually paid to look after this. Maintained: Someone actually looks after it. Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221206105038.124613-1-lee@kernel.org
2023-02-22dt-bindings: mfd: cros-ec: Add compatible string for UART supportBhanu Prakash Maiya
Add a compatible string to support the UART implementation of the cros ec interface. The driver does not support the reg and interrupt properties, so exempt them from being required for UART compatible nodes. Signed-off-by: Bhanu Prakash Maiya <bhanumaiya@chromium.org> Co-developed-by: Mark Hasemeyer <markhas@chromium.org> Signed-off-by: Mark Hasemeyer <markhas@chromium.org> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221207104005.v10.2.I9e018ecb8bdf341648cb64417085978ff0d22a46@changeid
2023-02-22mfd: Use sysfs_emit() to instead of scnprintf()ye xingchen
Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen <ye.xingchen@zte.com.cn> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/202212021528368292334@zte.com.cn
2023-02-22mfd: cs5535: Don't build on UMLRandy Dunlap
The cs5535-mfd driver uses CPU-specific data that is not available for ARCH=um builds, so don't allow it to be built for UML. Prevents these build errors: In file included from ../arch/x86/include/asm/olpc.h:7, from ../drivers/mfd/cs5535-mfd.c:17: ../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’: ../arch/x86/include/asm/geode.h:16:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && ../arch/x86/include/asm/geode.h:16:46: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && ../arch/x86/include/asm/geode.h:17:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ 17 | (boot_cpu_data.x86 == 5) && ../arch/x86/include/asm/geode.h:18:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ 18 | (boot_cpu_data.x86_model == 5)); ../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’: ../arch/x86/include/asm/geode.h:23:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && ../arch/x86/include/asm/geode.h:23:46: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && ../arch/x86/include/asm/geode.h:24:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ 24 | (boot_cpu_data.x86 == 5) && ../arch/x86/include/asm/geode.h:25:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ 25 | (boot_cpu_data.x86_model == 10)); Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221201012541.11809-1-rdunlap@infradead.org
2023-02-22mfd: axp20x: Fix order of pek rise and fall eventsAren Moynihan
The power button can get "stuck" if the rising edge and falling edge irq are read in the same pass. This can often be triggered when resuming from suspend if the power button is released before the kernel handles the interrupt. Swapping the order of the rise and fall events makes sure that the press event is handled first, which prevents this situation. Signed-off-by: Aren Moynihan <aren@peacevolution.org> Reviewed-by: Samuel Holland <samuel@sholland.org> Tested-by: Samuel Holland <samuel@sholland.org> Acked-by: Chen-Yu Tsai <wens@csie.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221208220225.635414-1-aren@peacevolution.org
2023-02-22dt-bindings: mfd: qcom,spmi-pmic: Document PMICs bundled with SM8550Neil Armstrong
Document compatible for the pm8550, pm8550b, pm8550ve, pm8550vs, pmk8550. pm8010 & pmr735d SPMI PMICs Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20221114-narmstrong-sm8550-upstream-spmi-v2-1-b839bf2d558a@linaro.org
2023-02-22mfd: rk808: Re-add rk808-clkout to RK818Tom Fitzhenry
Fixes RK818 (e.g. on Pinephone Pro) to register its clock, without which dependent devices (e.g. wifi/BT, via sdio-wifi-pwrseq) fail to probe. This line was removed in commit 3633daacea2e ("mfd: rk808: Permit having multiple PMIC instances"), but only from RK818. Fixes: 3633daacea2e ("mfd: rk808: Permit having multiple PMIC instances") Signed-off-by: Tom Fitzhenry <tom@tom-fitzhenry.me.uk> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Acked-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/20230102111147.2580861-1-tom@tom-fitzhenry.me.uk
2023-02-22Merge tags 'ib-mfd-extcon-i2c-v6.3' and 'ib-mfd-fpga-hwmon-v6.3-1' into ↵Lee Jones
ibs-for-mfd-merged Immutable branch between MFD, Extcon and I2C due for the v6.3 merge window Immutable branch between MFD, FPGA and HWMON due for the v6.3 merge window
2023-02-22powerpc/pseries: Avoid hcall in plpks_is_available() on non-pseriesRussell Currey
plpks_is_available() can be called on any platform via kexec but calls _plpks_get_config() which makes a hcall, which will only work on pseries. Fix this by returning early in plpks_is_available() if hcalls aren't possible. Fixes: 119da30d037d ("powerpc/pseries: Expose PLPKS config values, support additional fields") Reported-by: Murphy Zhou <jencce.kernel@gmail.com> Signed-off-by: Russell Currey <ruscur@russell.cc> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20230222021708.146257-1-ruscur@russell.cc
2023-02-21scsi: zfcp: Trace when request remove fails after qdio send failsBenjamin Block
When we fail to send a FSF request in 'zfcp_fsf_req_send()' when calling 'zfcp_qdio_send()' we try to remove the request object from our internal hash table again to prevent keeping a stale memory reference. This removal might still - very much theoretically - fail. To store some evidence of when this happens add a new trace record for this case; tag: 'fsrsrmf'. We reuse the 'ZFCP_DBF_HBA_RES' trace ID for this, but mark all fields other then the request ID with ~0, to make fairly obvious that these are invalid values. This faking has to be done because we don't have a valid request object at this point, and can not safely access any of the memory of the old object - we just failed to find it in our hash table, so it might be gone already. Here is an example of a decoded trace record: Timestamp : 2023-02-17-13:09:12:748140 Area : HBA Subarea : 1 Level : - Exception : 000003ff7ff500c2 CPU ID : 0011 Caller : 0x0 Record ID : 1 Tag : fsrsrmf Request ID : 0x0000000080126ab6 Request status : 0xffffffff FSF cmnd : 0xffffffff FSF sequence no: 0xffffffff FSF issued : 2042-09-18-01:53:47:370495 FSF stat : 0xffffffff FSF stat qual : ffffffff ffffffff ffffffff ffffffff Prot stat : 0xffffffff Prot stat qual : ffffffff ffffffff ffffffff ffffffff Port handle : 0xffffffff LUN handle : 0xffffffff This provides at least some basic evidence that this event happened, and what object was affected. Link: https://lore.kernel.org/r/99b8246b2d71b63fa4f9c56333e2037502f7f5af.1677000450.git.bblock@linux.ibm.com Signed-off-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Steffen Maier <maier@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: zfcp: Change the type of all fsf request id fields and variables to u64Benjamin Block
We use different integer types throughout zfcp to store the FSF request ID and related values; some places use 'unsigned long' and others 'u64'. On s390x these are effectively the same type, but this might cause confusions and is generally inconsistent. The specification for the used hardware specifies this value as a 64-bit number, and ultimately we use this value to communicate with the hardware, so it makes sense to change the type of all these variables to 'u64' where we can. The only exception being when we store it in the 'host_scribble' field of a 'struct scsi_cmnd'; for this case we add a build time check to make sure they are compatible. Link: https://lore.kernel.org/r/9c9cbe5acc2b419a22dce2fed847e3db91b60201.1677000450.git.bblock@linux.ibm.com Signed-off-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Steffen Maier <maier@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: zfcp: Make the type for accessing request hashtable buckets size_tBenjamin Block
The appropriate type for array indices is 'size_t' and the current implementation in 'zfcp_reqlist.h' mixes 'int' and 'unsigned int' in different places to access the hashtable buckets of our internal request hash table. To prevent any confusion, change all places to 'size_t'. Link: https://lore.kernel.org/r/64afe93f6263c6b07815937826cd7d5fc4f1a674.1677000450.git.bblock@linux.ibm.com Signed-off-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Steffen Maier <maier@linux.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: ufs: core: Simplify ufshcd_execute_start_stop()Bart Van Assche
Use scsi_execute_cmd() instead of open-coding it. Link: https://lore.kernel.org/r/20230210193258.4004923-4-bvanassche@acm.org Cc: Mike Christie <michael.christie@oracle.com> Cc: John Garry <john.g.garry@oracle.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Asutosh Das <quic_asutoshd@quicinc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: ufs: core: Rely on the block layer for setting RQF_PMBart Van Assche
Do not set RQF_PM explicitly since scsi_alloc_request() sets it indirectly if BLK_MQ_REQ_PM is set. The call chain for the code that sets RQF_PM is as follows: scsi_alloc_request() blk_mq_alloc_request() __blk_mq_alloc_requests() blk_mq_rq_ctx_init() if (data->flags & BLK_MQ_REQ_PM) data->rq_flags |= RQF_PM; Link: https://lore.kernel.org/r/20230210193258.4004923-3-bvanassche@acm.org Cc: Mike Christie <michael.christie@oracle.com> Cc: John Garry <john.g.garry@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: core: Extend struct scsi_exec_argsBart Van Assche
Allow SCSI LLDs to specify SCMD_* flags. Link: https://lore.kernel.org/r/20230210193258.4004923-2-bvanassche@acm.org Cc: Mike Christie <michael.christie@oracle.com> Cc: John Garry <john.g.garry@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: lpfc: Fix double word in commentsBo Liu
Remove the repeated word "the" in comments. [mkp: fixed additional typos in the changed lines] Link: https://lore.kernel.org/r/20230217083046.4090-1-liubo03@inspur.com Signed-off-by: Bo Liu <liubo03@inspur.com> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: core: Remove the /proc/scsi/${proc_name} directory earlierBart Van Assche
Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. This fixes a bug introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core"). Fix the following kernel warning: proc_dir_entry 'scsi/scsi_debug' already registered WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0 Call Trace: proc_mkdir+0xb5/0xe0 scsi_proc_hostdir_add+0xb5/0x170 scsi_host_alloc+0x683/0x6c0 sdebug_driver_probe+0x6b/0x2d0 [scsi_debug] really_probe+0x159/0x540 __driver_probe_device+0xdc/0x230 driver_probe_device+0x4f/0x120 __device_attach_driver+0xef/0x180 bus_for_each_drv+0xe5/0x130 __device_attach+0x127/0x290 device_initial_probe+0x17/0x20 bus_probe_device+0x110/0x130 device_add+0x673/0xc80 device_register+0x1e/0x30 sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug] scsi_debug_init+0x64f/0x1000 [scsi_debug] do_one_initcall+0xd7/0x470 do_init_module+0xe7/0x330 load_module+0x122a/0x12c0 __do_sys_finit_module+0x124/0x1a0 __x64_sys_finit_module+0x46/0x50 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Link: https://lore.kernel.org/r/20230210205200.36973-3-bvanassche@acm.org Cc: Alan Stern <stern@rowland.harvard.edu> Cc: Yi Zhang <yi.zhang@redhat.com> Cc: stable@vger.kernel.org Fixes: 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core") Reported-by: Yi Zhang <yi.zhang@redhat.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: core: Fix a source code commentBart Van Assche
Fix an incorrect reference to the scsi_remove_host() function in a source code comment. Link: https://lore.kernel.org/r/20230210205200.36973-2-bvanassche@acm.org Fixes: b49493f99690 ("Fix a memory leak in scsi_host_dev_release()") Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: cxgbi: Remove unneeded version.h includeJesper Juhl
Remove unneeded version.h include pointed out by 'make versioncheck'. Link: https://lore.kernel.org/r/820137c2-decc-3d78-f170-7f1c0571fbb7@gmail.com Signed-off-by: Jesper Juhl <jesperjuhl76@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: qedi: Remove unneeded version.h includeJesper Juhl
Remove unneeded version.h include pointed out by 'make versioncheck'. Link: https://lore.kernel.org/r/820137c2-decc-3d78-f170-7f1c0571fbb7@gmail.com Signed-off-by: Jesper Juhl <jesperjuhl76@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: mpi3mr: Remove unneeded version.h includeJesper Juhl
Remove unneeded version.h include pointed out by 'make versioncheck'. Link: https://lore.kernel.org/r/820137c2-decc-3d78-f170-7f1c0571fbb7@gmail.com Signed-off-by: Jesper Juhl <jesperjuhl76@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: mpi3mr: Fix missing mrioc->evtack_cmds initializationShin'ichiro Kawasaki
Commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") introduced an array mrioc->evtack_cmds but initialization of the array elements was missed. They are just zero cleared. The function mpi3mr_complete_evt_ack() refers host_tag field of the elements. Due to the zero value of the host_tag field, the function calls clear_bit() for mrico->evtack_cmds_bitmap with wrong bit index. This results in memory access to invalid address and "BUG: KASAN: use-after-free". This BUG was observed at eHBA-9600 firmware update to version 8.3.1.0. To fix it, add the missing initialization of mrioc->evtack_cmds. Link: https://lore.kernel.org/r/20230214005019.1897251-5-shinichiro.kawasaki@wdc.com Cc: stable@vger.kernel.org Fixes: c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: mpi3mr: Use number of bits to manage bitmap sizesShin'ichiro Kawasaki
To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bitmaps are allocated using unsigned long as unit. This gap causes memory access beyond the bitmap sizes and results in "BUG: KASAN: slab-out-of-bounds". The BUG was observed at firmware download to eHBA-9600. Call trace indicated that the out-of-bounds access happened in find_first_zero_bit() called from mpi3mr_send_event_ack() for miroc->evtack_cmds_bitmap. To fix the BUG, do not use bytes to manage bitmap sizes. Instead, use number of bits, and call bitmap helper functions which take number of bits as arguments. For memory allocation, call bitmap_zalloc() instead of kzalloc() and krealloc(). For memory free, call bitmap_free() instead of kfree(). For zero clear, call bitmap_clear() instead of memset(). Remove three fields for bitmap byte sizes in struct scmd_priv which are no longer required. Replace the field dev_handle_bitmap_sz with dev_handle_bitmap_bits to keep number of bits of removepend_bitmap across resize. Link: https://lore.kernel.org/r/20230214005019.1897251-4-shinichiro.kawasaki@wdc.com Fixes: c5758fc72b92 ("scsi: mpi3mr: Gracefully handle online FW update operation") Fixes: e844adb1fbdc ("scsi: mpi3mr: Implement SCSI error handler hooks") Fixes: c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmiShin'ichiro Kawasaki
In the function mpi3mr_get_all_tgt_info(), devmap_info points to alltgt_info->dmi then there is no need to memcpy() data from devmap_info to alltgt_info->dmi. Remove the unnecessary memcpy(). This also allows to remove the local variable 'rval' and the goto label 'out'. Link: https://lore.kernel.org/r/20230214005019.1897251-3-shinichiro.kawasaki@wdc.com Cc: stable@vger.kernel.org Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands") Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()Shin'ichiro Kawasaki
The function mpi3mr_get_all_tgt_info() has four issues: 1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64). 2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices. 3) It copies num_device by calling memcpy(). Substitution is enough. 4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds". Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the correct length to sg_copy_from_buffer(). Link: https://lore.kernel.org/r/20230214005019.1897251-2-shinichiro.kawasaki@wdc.com Cc: stable@vger.kernel.org Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands") Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: mpi3mr: Fix an issue found by KASANTomas Henzl
Write only correct size (32 instead of 64 bytes). Link: https://lore.kernel.org/r/20230213193752.6859-1-thenzl@redhat.com Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Signed-off-by: Tomas Henzl <thenzl@redhat.com> Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: mpi3mr: Replace 1-element array with flex-arrayKees Cook
Nothing else defined MPI3_NVME_ENCAP_CMD_MAX, so the "command" buffer was being defined as a fake flexible array of size 1. Replace this with a proper flex array. Avoids this GCC 13 warning under -fstrict-flex-arrays=3: In function 'fortify_memset_chk', inlined from 'mpi3mr_build_nvme_sgl' at ../drivers/scsi/mpi3mr/mpi3mr_app.c:693:2, inlined from 'mpi3mr_bsg_process_mpt_cmds.constprop' at ../drivers/scsi/mpi3mr/mpi3mr_app.c:1214:8: ../include/linux/fortify-string.h:430:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] 430 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Link: https://lore.kernel.org/r/20230204183715.never.937-kees@kernel.org Cc: Sumit Saxena <sumit.saxena@broadcom.com> Cc: Himanshu Madhani <himanshu.madhani@oracle.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Cc: kernel test robot <lkp@intel.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: ipr: Work around fortify-string warningArnd Bergmann
The ipr_log_vpd_compact() function triggers a fortified memcpy() warning about a potential string overflow with all versions of clang: In file included from drivers/scsi/ipr.c:43: In file included from include/linux/string.h:254: include/linux/fortify-string.h:520:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] __write_overflow_field(p_size_field, size); ^ include/linux/fortify-string.h:520:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] 2 errors generated. I don't see anything actually wrong with the function, but this is the only instance I can reproduce of the fortification going wrong in the kernel at the moment, so the easiest solution may be to rewrite the function into something that does not trigger the warning. Instead of having a combined buffer for vendor/device/serial strings, use three separate local variables and just truncate the whitespace individually. Link: https://lore.kernel.org/r/20230214132831.2118392-1-arnd@kernel.org Cc: Kees Cook <keescook@chromium.org> Fixes: 8cf093e275d0 ("[SCSI] ipr: Improved dual adapter errors") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: ipr: Make ipr_probe_ioa_part2() return voidDeepak R Varma
Convert function ipr_probe_ioa_part2() to return void instead of int since the current implementation always returns 0 to the caller. The transformation also eliminates the dead code when calling ipr_probe_ioa_part2() function. Issue identified using returnvar Coccinelle semantic patch. Link: https://lore.kernel.org/r/Y7rvQyMOGcPKPTv8@ubun2204.myguest.virtualbox.org Signed-off-by: Deepak R Varma <drv@mailo.com> Acked-by: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-02-21scsi: sd: Update DIX config every time sd_revalidate_disk() is calledXingui Yang
If a controller has DIX is enabled and an attached disk is formatted using a protection type supported by the controller, a block integrity profile is registered to enable protected transfers. If the disk is subsequently reformatted to disable PI, and the controller does not support DIX Type 0, this can lead to failures such as this: [142829.032340] hisi_sas_v3_hw 0000:b4:04.0: erroneous completion iptt=2375 task=00000000bea0970c dev id=5 direct-attached phy4 addr=51c20dbaf642a000 CQ hdr: 0x1023 0x50947 0x0 0x20000 Error info: 0x0 0x0 0x4 0x0 [142829.073883] sas: Enter sas_scsi_recover_host busy: 1 failed: 1 [142829.079783] sas: sas_scsi_find_task: aborting task 0x00000000bea0970c [142829.102342] sas: Internal abort: task to dev 51c20dbaf642a000 response: 0x0 status 0x5 [142829.110319] sas: sas_eh_handle_sas_errors: task 0x00000000bea0970c is done [142829.117275] sd 7:0:5:0: [sdc] tag#2375 UNKNOWN(0x2003) Result: hostbyte=0x05 driverbyte=DRIVER_OK cmd_age=0s [142829.127171] sd 7:0:5:0: [sdc] tag#2375 CDB: opcode=0x2a 2a 00 00 00 00 00 00 00 08 00 [142829.135059] I/O error, dev sdc, sector 0 op 0x1:(WRITE) flags 0x18800 phys_seg 1 prio class 2 This is because the block layer integrity profile is currently only set up the first time a disk is discovered. To address this, remove the first_scan check when configuring protection information during revalidate. Also unregister the block integrity profile if DIX is not supported with a given protection type. [mkp: commit description + printk dedup] Link: https://lore.kernel.org/r/20230221081026.24736-1-yangxingui@huawei.com Signed-off-by: Xingui Yang <yangxingui@huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
generated by cgit (git 2.34.1) at 2025-09-12 20:54:30 +0000