summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-05-01romfs: convert to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01reiserfs: convert to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01qnx6: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01qnx4: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01procfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01openpromfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01ocfs2: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01dlmfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01nilfs2: switch to ->free_inode()Al Viro
kill an extern that went stale 9 years ago, while we are at it... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01nfs{,4}: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01minix: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01jffs2: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01isofs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01hpfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01hostfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01hfsplus: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01hfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01gfs2: switch to ->free_inode()Al Viro
... and use GFS2_I() to get the containing gfs2_inode by inode; yes, we can feed the address of the first member of structure to kmem_cache_free(), but let's do it in an obviously safe way. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01freevxfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01fat: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01f2fs: switch to ->free_inode()Al Viro
Acked-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01ext2: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01efs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01debugfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01cifs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01bdev: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01bfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01befs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01affs: switch to ->free_inode()Al Viro
Acked-by: David Sterba <dsterba@suse.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01adfs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-019p: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01erofs: switch to ->free_inode()Al Viro
Acked-by: Gao Xiang <gaoxiang25@huawei.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01spufs: switch to ->free_inode()Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01new inode method: ->free_inode()Al Viro
A lot of ->destroy_inode() instances end with call_rcu() of a callback that does RCU-delayed part of freeing. Introduce a new method for doing just that, with saner signature. Rules: ->destroy_inode ->free_inode f g immediate call of f(), RCU-delayed call of g() f NULL immediate call of f(), no RCU-delayed calls NULL g RCU-delayed call of g() NULL NULL RCU-delayed default freeing IOW, NULL ->free_inode gives the same behaviour as now. Note that NULL, NULL is equivalent to NULL, free_inode_nonrcu; we could mandate the latter form, but that would have very little benefit beyond making rules a bit more symmetric. It would break backwards compatibility, require extra boilerplate and expected semantics for (NULL, NULL) pair would have no use whatsoever... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-05-01udp: fix GRO packet of deathEric Dumazet
syzbot was able to crash host by sending UDP packets with a 0 payload. TCP does not have this issue since we do not aggregate packets without payload. Since dev_gro_receive() sets gso_size based on skb_gro_len(skb) it seems not worth trying to cope with padded packets. BUG: KASAN: slab-out-of-bounds in skb_gro_receive+0xf5f/0x10e0 net/core/skbuff.c:3826 Read of size 16 at addr ffff88808893fff0 by task syz-executor612/7889 CPU: 0 PID: 7889 Comm: syz-executor612 Not tainted 5.1.0-rc7+ #96 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 __asan_report_load16_noabort+0x14/0x20 mm/kasan/generic_report.c:133 skb_gro_receive+0xf5f/0x10e0 net/core/skbuff.c:3826 udp_gro_receive_segment net/ipv4/udp_offload.c:382 [inline] call_gro_receive include/linux/netdevice.h:2349 [inline] udp_gro_receive+0xb61/0xfd0 net/ipv4/udp_offload.c:414 udp4_gro_receive+0x763/0xeb0 net/ipv4/udp_offload.c:478 inet_gro_receive+0xe72/0x1110 net/ipv4/af_inet.c:1510 dev_gro_receive+0x1cd0/0x23c0 net/core/dev.c:5581 napi_gro_frags+0x36b/0xd10 net/core/dev.c:5843 tun_get_user+0x2f24/0x3fb0 drivers/net/tun.c:1981 tun_chr_write_iter+0xbd/0x156 drivers/net/tun.c:2027 call_write_iter include/linux/fs.h:1866 [inline] do_iter_readv_writev+0x5e1/0x8e0 fs/read_write.c:681 do_iter_write fs/read_write.c:957 [inline] do_iter_write+0x184/0x610 fs/read_write.c:938 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1002 do_writev+0x15e/0x370 fs/read_write.c:1037 __do_sys_writev fs/read_write.c:1110 [inline] __se_sys_writev fs/read_write.c:1107 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1107 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x441cc0 Code: 05 48 3d 01 f0 ff ff 0f 83 9d 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 51 93 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 74 09 fc ff c3 48 83 ec 08 e8 ba 2b 00 00 RSP: 002b:00007ffe8c716118 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007ffe8c716150 RCX: 0000000000441cc0 RDX: 0000000000000001 RSI: 00007ffe8c716170 RDI: 00000000000000f0 RBP: 0000000000000000 R08: 000000000000ffff R09: 0000000000a64668 R10: 0000000020000040 R11: 0000000000000246 R12: 000000000000c2d9 R13: 0000000000402b50 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 5143: save_stack+0x45/0xd0 mm/kasan/common.c:75 set_track mm/kasan/common.c:87 [inline] __kasan_kmalloc mm/kasan/common.c:497 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:470 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:505 slab_post_alloc_hook mm/slab.h:437 [inline] slab_alloc mm/slab.c:3393 [inline] kmem_cache_alloc+0x11a/0x6f0 mm/slab.c:3555 mm_alloc+0x1d/0xd0 kernel/fork.c:1030 bprm_mm_init fs/exec.c:363 [inline] __do_execve_file.isra.0+0xaa3/0x23f0 fs/exec.c:1791 do_execveat_common fs/exec.c:1865 [inline] do_execve fs/exec.c:1882 [inline] __do_sys_execve fs/exec.c:1958 [inline] __se_sys_execve fs/exec.c:1953 [inline] __x64_sys_execve+0x8f/0xc0 fs/exec.c:1953 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 5351: save_stack+0x45/0xd0 mm/kasan/common.c:75 set_track mm/kasan/common.c:87 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:459 kasan_slab_free+0xe/0x10 mm/kasan/common.c:467 __cache_free mm/slab.c:3499 [inline] kmem_cache_free+0x86/0x260 mm/slab.c:3765 __mmdrop+0x238/0x320 kernel/fork.c:677 mmdrop include/linux/sched/mm.h:49 [inline] finish_task_switch+0x47b/0x780 kernel/sched/core.c:2746 context_switch kernel/sched/core.c:2880 [inline] __schedule+0x81b/0x1cc0 kernel/sched/core.c:3518 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:3745 retint_kernel+0x1b/0x2d arch_local_irq_restore arch/x86/include/asm/paravirt.h:767 [inline] kmem_cache_free+0xab/0x260 mm/slab.c:3766 anon_vma_chain_free mm/rmap.c:134 [inline] unlink_anon_vmas+0x2ba/0x870 mm/rmap.c:401 free_pgtables+0x1af/0x2f0 mm/memory.c:394 exit_mmap+0x2d1/0x530 mm/mmap.c:3144 __mmput kernel/fork.c:1046 [inline] mmput+0x15f/0x4c0 kernel/fork.c:1067 exec_mmap fs/exec.c:1046 [inline] flush_old_exec+0x8d9/0x1c20 fs/exec.c:1279 load_elf_binary+0x9bc/0x53f0 fs/binfmt_elf.c:864 search_binary_handler fs/exec.c:1656 [inline] search_binary_handler+0x17f/0x570 fs/exec.c:1634 exec_binprm fs/exec.c:1698 [inline] __do_execve_file.isra.0+0x1394/0x23f0 fs/exec.c:1818 do_execveat_common fs/exec.c:1865 [inline] do_execve fs/exec.c:1882 [inline] __do_sys_execve fs/exec.c:1958 [inline] __se_sys_execve fs/exec.c:1953 [inline] __x64_sys_execve+0x8f/0xc0 fs/exec.c:1953 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88808893f7c0 which belongs to the cache mm_struct of size 1496 The buggy address is located 600 bytes to the right of 1496-byte region [ffff88808893f7c0, ffff88808893fd98) The buggy address belongs to the page: page:ffffea0002224f80 count:1 mapcount:0 mapping:ffff88821bc40ac0 index:0xffff88808893f7c0 compound_mapcount: 0 flags: 0x1fffc0000010200(slab|head) raw: 01fffc0000010200 ffffea00025b4f08 ffffea00027b9d08 ffff88821bc40ac0 raw: ffff88808893f7c0 ffff88808893e440 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808893fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88808893ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88808893ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888088940000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888088940080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Paolo Abeni <pabeni@redhat.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-05-02Merge branch 'spi-5.2' into spi-nextMark Brown
2019-05-02Merge branch 'spi-5.1' into spi-linusMark Brown
2019-05-02regulator: hi6xxx: Switch to SPDX identifierAxel Lin
Convert HiSilicon hi6xxx PMIC drivers to SPDX identifier. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02regulator: vexpress: Switch to SPDX identifierAxel Lin
Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02regulator: vexpress: Get rid of struct vexpress_regulatorAxel Lin
The *regdev and *regmap can be replaced by local variables in probe(). Only desc of struct vexpress_regulator is really need, so just use struct regulator_desc directly and remove struct vexpress_regulator. Signed-off-by: Axel Lin <axel.lin@ingics.com> Reviewed-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: rspi: Fix handling of QSPI code when transmit and receiveHoan Nguyen An
Process handling QSPI when transmit/receive at qspi_trigger_transfer_out_in() as follows: Setting the trigger, is the number of bytes in the FIFO buffer to determine when there is an interrupt. Then check if the value of triggering number is 32-bytes or 1-byte, there will be corresponding processing Handling (if (n == QSPI_BUFFER_SIZE) esle) this is unnecessary, leads to the same processing of data transmission or reception, The difference here are with ret = rspi_wait_for_tx_empty(rspi); ret = rspi_wait_for_rx_full(rspi); When the nummber trigger is 32 bytes, we only write into FIFO when the FIFO is completely empty (interrupt transmission), and only receive if FIFO is full of 32 bytes of data. In the case of a nummber trigger that is 1 byte, in principle we still need to process rspi_wait_for_tx_empty/full so that FIFO is empty only with the amount of data we need to write to or equal to the number of bytes we need to receive, There is currently no processing of this. And in the current case with this patch, at this time it only needs at least 1 byte received in FIFO that has interrupt received, or FIFO at least 1bytes free can be written into FIFO, This patch therefore does not affect this processing. So we need to eliminate unnecessary waste processing (if (n == QSPI_BUFFER_SIZE) esle), more precisely in waiting for FIFO status. The same with handling in qspi_transfer_out()/qspi_transfer_in(). Signed-off-by: Hoan Nguyen An <na-hoan@jinso.co.jp> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: atmel-quadspi: fix crash while suspendingClaudiu Beznea
atmel_qspi objects are kept in spi_controller objects, so, first get pointer to spi_controller object and then get atmel_qspi object from spi_controller object. Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver") Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com> Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: stm32: return the get_irq errorFabien Dessenne
During probe, return the "get_irq" error value instead of -ENOENT. This allows the driver to be defer probed if needed. Signed-off-by: Fabien Dessenne <fabien.dessenne@st.com> Acked-by: Amelie Delaunay <amelie.delaunay@st.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: tegra114: fix PIO transferSowjanya Komatineni
This patch fixes PIO mode transfer to use PIO bit in SPI_COMMAND1 register. Current driver uses DMA_EN instead of PIO bit. Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: pxa2xx: fix SCR (divisor) calculationFlavio Suligoi
Calculate the divisor for the SCR (Serial Clock Rate), avoiding that the SSP transmission rate can be greater than the device rate. When the division between the SSP clock and the device rate generates a reminder, we have to increment by one the divisor. In this way the resulting SSP clock will never be greater than the device SPI max frequency. For example, with: - ssp_clk = 50 MHz - dev freq = 15 MHz without this patch the SSP clock will be greater than 15 MHz: - 25 MHz for PXA25x_SSP and CE4100_SSP - 16,56 MHz for the others Instead, with this patch, we have in both case an SSP clock of 12.5MHz, so the max rate of the SPI device clock is respected. Signed-off-by: Flavio Suligoi <f.suligoi@asem.it> Reviewed-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Reviewed-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: Clear SPI_CS_HIGH flag from bad_bits for GPIO chip-selectSerge Semin
When GPIO chip-select is used nothing prevents any available SPI controllers to work with both CS-high and traditional CS-low modes. In fact the SPI bus core code already does it, so we don't need to introduce any modification there. But spi_setup() still fails to switch the interface settings if CS-high flag is set for the case of GPIO-driven slave chip-select when the SPI controller doesn't support the hardwired CS-inversion. Lets fix it by clearing the SPI_CS_HIGH flag out from bad_bits (unsupported by controller) when client chip is selected by GPIO. This feature is useful for slave devices, which in accordance with communication protocol can work with both active-high and active-low chip-selects. I am aware of one such device. It is MMC-SPI interface, when at init sequence the driver needs to perform a read operation with low and high chip-select sequentially (requirement of 74 clock cycles with both chipselect, see the mmc_spi driver for details). Signed-off-by: Serge Semin <fancer.lancer@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: ep93xx: Convert to use CS GPIO descriptorsLinus Walleij
This converts the EP93xx SPI master driver to use GPIO descriptors for chip select handling. EP93xx was using platform data to pass in GPIO lines, by converting all board files to use GPIO descriptor tables the core will look up the GPIO lines from the SPI device in the same manner as for device tree. Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: AD ASoC: declare missing of tableDaniel Gomez
Add missing <of_device_id> table for SPI driver relying on SPI device match since compatible is in a DT binding or in a DTS. Before this patch: modinfo sound/soc/codecs/snd-soc-adau1977-spi.ko | grep alias alias: spi:adau1979 alias: spi:adau1978 alias: spi:adau1977 After this patch: modinfo sound/soc/codecs/snd-soc-adau1977-spi.ko | grep alias alias: of:N*T*Cadi,adau1979C* alias: of:N*T*Cadi,adau1979 alias: of:N*T*Cadi,adau1978C* alias: of:N*T*Cadi,adau1978 alias: of:N*T*Cadi,adau1977C* alias: of:N*T*Cadi,adau1977 alias: spi:adau1979 alias: spi:adau1978 alias: spi:adau1977 Reported-by: Javier Martinez Canillas <javier@dowhile0.org> Signed-off-by: Daniel Gomez <dagmcr@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: spi-mem: zynq-qspi: Fix build error on architectures missing readsl/writeslNaga Sureshkumar Relli
Alpha and some of the architectures are missing readsl/writesl functions. so the zynq-qspi driver won't be able to build on these arches. hence use ioread32_rep()/iowrite32_rep() instead of readsl()/writesl(). Signed-off-by: Naga Sureshkumar Relli <naga.sureshkumar.relli@xilinx.com> Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-05-02spi: stm32-qspi: manage the get_irq error caseFabien Dessenne
During probe, check the "get_irq" error value. Signed-off-by: Fabien Dessenne <fabien.dessenne@st.com> Acked-by: Ludovic Barre <ludovic.barre@st.com> Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit (git 2.34.1) at 2025-09-19 13:02:34 +0000