summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-03-23Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Merge in overtime fixes, no conflicts. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23llc: fix netdevice reference leaks in llc_ui_bind()Eric Dumazet
Whenever llc_ui_bind() and/or llc_ui_autobind() took a reference on a netdevice but subsequently fail, they must properly release their reference or risk the infamous message from unregister_netdevice() at device dismantle. unregister_netdevice: waiting for eth0 to become free. Usage count = 3 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: 赵子轩 <beraphin@gmail.com> Reported-by: Stoyan Manolov <smanolov@suse.de> Link: https://lore.kernel.org/r/20220323004147.1990845-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via ethtoolSondhauß, Jan
cpsw_ethtool_begin directly returns the result of pm_runtime_get_sync when successful. pm_runtime_get_sync returns -error code on failure and 0 on successful resume but also 1 when the device is already active. So the common case for cpsw_ethtool_begin is to return 1. That leads to inconsistent calls to pm_runtime_put in the call-chain so that pm_runtime_put is called one too many times and as result leaving the cpsw dev behind suspended. The suspended cpsw dev leads to an access violation later on by different parts of the cpsw driver. Fix this by calling the return-friendly pm_runtime_resume_and_get function. Fixes: d43c65b05b84 ("ethtool: runtime-resume netdev parent in ethnl_ops_begin") Signed-off-by: Jan Sondhauss <jan.sondhauss@wago.com> Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com> Link: https://lore.kernel.org/r/20220323084725.65864-1-jan.sondhauss@wago.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23Merge branch 'ice-avoid-sleeping-scheduling-in-atomic-contexts'Jakub Kicinski
Alexander Lobakin says: ==================== ice: avoid sleeping/scheduling in atomic contexts The `ice_misc_intr() + ice_send_event_to_aux()` infamous pair failed once again. Fix yet another (hopefully last one) 'scheduling while atomic' splat and finally plug the hole to gracefully return prematurely when invoked in wrong context instead of panicking. ==================== Link: https://lore.kernel.org/r/20220323124353.2762181-1-alexandr.lobakin@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23ice: don't allow to run ice_send_event_to_aux() in atomic ctxAlexander Lobakin
ice_send_event_to_aux() eventually descends to mutex_lock() (-> might_sched()), so it must not be called under non-task context. However, at least two fixes have happened already for the bug splats occurred due to this function being called from atomic context. To make the emergency landings softer, bail out early when executed in non-task context emitting a warn splat only once. This way we trade some events being potentially lost for system stability and avoid any related hangs and crashes. Fixes: 348048e724a0e ("ice: Implement iidc operations") Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com> Tested-by: Michal Kubiak <michal.kubiak@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23ice: fix 'scheduling while atomic' on aux critical err interruptAlexander Lobakin
There's a kernel BUG splat on processing aux critical error interrupts in ice_misc_intr(): [ 2100.917085] BUG: scheduling while atomic: swapper/15/0/0x00010000 ... [ 2101.060770] Call Trace: [ 2101.063229] <IRQ> [ 2101.065252] dump_stack+0x41/0x60 [ 2101.068587] __schedule_bug.cold.100+0x4c/0x58 [ 2101.073060] __schedule+0x6a4/0x830 [ 2101.076570] schedule+0x35/0xa0 [ 2101.079727] schedule_preempt_disabled+0xa/0x10 [ 2101.084284] __mutex_lock.isra.7+0x310/0x420 [ 2101.088580] ? ice_misc_intr+0x201/0x2e0 [ice] [ 2101.093078] ice_send_event_to_aux+0x25/0x70 [ice] [ 2101.097921] ice_misc_intr+0x220/0x2e0 [ice] [ 2101.102232] __handle_irq_event_percpu+0x40/0x180 [ 2101.106965] handle_irq_event_percpu+0x30/0x80 [ 2101.111434] handle_irq_event+0x36/0x53 [ 2101.115292] handle_edge_irq+0x82/0x190 [ 2101.119148] handle_irq+0x1c/0x30 [ 2101.122480] do_IRQ+0x49/0xd0 [ 2101.125465] common_interrupt+0xf/0xf [ 2101.129146] </IRQ> ... As Andrew correctly mentioned previously[0], the following call ladder happens: ice_misc_intr() <- hardirq ice_send_event_to_aux() device_lock() mutex_lock() might_sleep() might_resched() <- oops Add a new PF state bit which indicates that an aux critical error occurred and serve it in ice_service_task() in process context. The new ice_pf::oicr_err_reg is read-write in both hardirq and process contexts, but only 3 bits of non-critical data probably aren't worth explicit synchronizing (and they're even in the same byte [31:24]). [0] https://lore.kernel.org/all/YeSRUVmrdmlUXHDn@lunn.ch Fixes: 348048e724a0e ("ice: Implement iidc operations") Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com> Tested-by: Michal Kubiak <michal.kubiak@intel.com> Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23net/sched: fix incorrect vlan_push_eth dest fieldLouis Peens
Seems like a potential copy-paste bug slipped in here, the second memcpy should of course be populating src and not dest. Fixes: ab95465cde23 ("net/sched: add vlan push_eth and pop_eth action to the hardware IR") Signed-off-by: Louis Peens <louis.peens@corigine.com> Link: https://lore.kernel.org/r/20220323092506.21639-1-louis.peens@corigine.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23net: bridge: mst: Restrict info size queries to bridge portsTobias Waldekranz
Ensure that no bridge masters are ever considered for MST info dumping. MST states are only supported on bridge ports, not bridge masters - which br_mst_info_size relies on. Fixes: 122c29486e1f ("net: bridge: mst: Support setting and reporting MST port states") Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com> Link: https://lore.kernel.org/r/20220322133001.16181-1-tobias@waldekranz.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23net: marvell: prestera: add missing destroy_workqueue() in ↵Yang Yingliang
prestera_module_init() Add the missing destroy_workqueue() before return from prestera_module_init() in the error handling case. Fixes: 4394fbcb78cf ("net: marvell: prestera: handle fib notifications") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20220322090236.1439649-1-yangyingliang@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23drivers: net: xgene: Fix regression in CRC strippingStephane Graber
All packets on ingress (except for jumbo) are terminated with a 4-bytes CRC checksum. It's the responsability of the driver to strip those 4 bytes. Unfortunately a change dating back to March 2017 re-shuffled some code and made the CRC stripping code effectively dead. This change re-orders that part a bit such that the datalen is immediately altered if needed. Fixes: 4902a92270fb ("drivers: net: xgene: Add workaround for errata 10GE_8/ENET_11") Cc: stable@vger.kernel.org Signed-off-by: Stephane Graber <stgraber@ubuntu.com> Tested-by: Stephane Graber <stgraber@ubuntu.com> Link: https://lore.kernel.org/r/20220322224205.752795-1-stgraber@ubuntu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-23cacheflush.h: Add forward declaration for struct folioHerbert Xu
The struct folio is not declared in cacheflush.h so we need to provide a forward declaration as otherwise users of this header file may get warnings. Reported-by: Guenter Roeck <linux@roeck-us.net> Fixes: 522a0032af00 ("Add linux/cacheflush.h") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-03-23Merge tag 'nand/for-5.18' into mtd/nextMiquel Raynal
Raw NAND core changes: * Rework of_get_nand_bus_width() * Remove of_get_nand_on_flash_bbt() wrapper * Protect access to rawnand devices while in suspend * bindings: Document the wp-gpios property Rax NAND controller driver changes: * atmel: Fix refcount issue in atmel_nand_controller_init * nandsim: - Add NS_PAGE_BYTE_SHIFT macro to replace the repeat pattern - Merge repeat codes in ns_switch_state - Replace overflow check with kzalloc to single kcalloc * rockchip: Fix platform_get_irq.cocci warning * stm32_fmc2: Add NAND Write Protect support * pl353: Set the nand chip node as the flash node * brcmnand: Fix sparse warnings in bcma_nand * omap_elm: Remove redundant variable 'errors' * gpmi: - Support fast edo timings for mx28 - Validate controller clock rate - Fix controller timings setting * brcmnand: - Add BCMA shim - BCMA controller uses command shift of 0 - Allow platform data instantation - Add platform data structure for BCMA - Allow working without interrupts - Move OF operations out of brcmnand_init_cs() - Avoid pdev in brcmnand_init_cs() - Allow SoC to provide I/O operations - Assign soc as early as possible Onenand changes: * Check for error irq Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2022-03-23mm/mlock: fix two bugs in user_shm_lock()Miaohe Lin
user_shm_lock forgets to set allowed to 0 when get_ucounts fails. So the later user_shm_unlock might do the extra dec_rlimit_ucounts. Also in the RLIM_INFINITY case, user_shm_lock will success regardless of the value of memlock where memblock == LONG_MAX && !capable(CAP_IPC_LOCK) should fail. Fix all of these by changing the code to leave lock_limit at ULONG_MAX aka RLIM_INFINITY, leave "allowed" initialized to 0 and remove the special case of RLIM_INFINITY as nothing can be greater than ULONG_MAX. Credit goes to Eric W. Biederman for proposing simplifying the code and thus catching the later bug. Fixes: d7c9e99aee48 ("Reimplement RLIMIT_MEMLOCK on top of ucounts") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Cc: stable@vger.kernel.org v1: https://lkml.kernel.org/r/20220310132417.41189-1-linmiaohe@huawei.com v2: https://lkml.kernel.org/r/20220314064039.62972-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20220322080918.59861-1-linmiaohe@huawei.com Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
2022-03-23ptrace: Remove duplicated include in ptrace.cYang Li
Fix following includecheck warning: ./arch/m68k/kernel/ptrace.c: linux/ptrace.h is included more than once. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Fixes: 153474ba1a4a ("ptrace: Create ptrace_report_syscall_{entry,exit} in ptrace.h") Link: https://lkml.kernel.org/r/20220315235148.54253-1-yang.lee@linux.alibaba.com Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
2022-03-23gfs2: Minor retry logic cleanupAndreas Gruenbacher
Clean up the retry logic in the read and write functions somewhat. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2022-03-23gfs2: Disable page faults during lockless buffered readsAndreas Gruenbacher
During lockless buffered reads, filemap_read() holds page cache page references while trying to copy data to the user-space buffer. The calling process isn't holding the inode glock, but the page references it holds prevent those pages from being removed from the page cache, and that prevents the underlying inode glock from being moved to another node. Thus, we can end up in the same kinds of distributed deadlock situations as with normal (non-lockless) buffered reads. Fix that by disabling page faults during lockless reads as well. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2022-03-23gfs2: Fix should_fault_in_pages() logicAndreas Gruenbacher
Fix the fault-in window size logic: * Use a maximum window size of 1 MiB instead of BIO_MAX_VECS * PAGE_SIZE. The previous window size was always one page because the pages variable was accidentally being defined and then redefined in should_fault_in_pages(). * The nr_dirtied heuristic for guessing when there might be memory pressure often results in very small window sizes. Don't let nr_dirtied drop below 8 pages (as btrfs does). * Compute the window size in units of bytes, not pages. * Account for page overlap (unaligned iterators). Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2022-03-23fs: do not pass __GFP_HIGHMEM to bio_alloc in do_mpage_readpageChristoph Hellwig
The mpage bio alloc cleanup accidentally removed clearing ~GFP_KERNEL bits from the mask passed to bio_alloc. Fix this up in a slightly less obsfucated way that mirrors what iomap does in its readpage code. Fixes: 77c436de01c0 ("mpage: pass the operation to bio_alloc") Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Christoph Hellwig <hch@lst.de> Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Link: https://lore.kernel.org/r/20220323153952.1418560-1-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-03-23dt-bindings: mfd: syscon: Add microchip,lan966x-cpu-syscon compatibleMichael Walle
Add the Microchip LAN966x CPU system registers compatible. Signed-off-by: Michael Walle <michael@walle.cc> Acked-by: Krzysztof Kozlowski <krzk@kernel.org> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220313003122.19155-1-michael@walle.cc
2022-03-23tracing: Have trace event string test handle zero length stringsSteven Rostedt (Google)
If a trace event has in its TP_printk(): "%*.s", len, len ? __get_str(string) : NULL It is perfectly valid if len is zero and passing in the NULL. Unfortunately, the runtime string check at time of reading the trace sees the NULL and flags it as a bad string and produces a WARN_ON(). Handle this case by passing into the test function if the format has an asterisk (star) and if so, if the length is zero, then mark it as safe. Link: https://lore.kernel.org/all/YjsWzuw5FbWPrdqq@bfoster/ Cc: stable@vger.kernel.org Reported-by: Brian Foster <bfoster@redhat.com> Tested-by: Brian Foster <bfoster@redhat.com> Fixes: 9a6944fee68e2 ("tracing: Add a verifier to check string pointers for trace events") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2022-03-23mfd: bd9576: fix typos in commentsJulia Lawall
Various spelling mistakes in comments. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Reviewed-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220314115354.144023-29-Julia.Lawall@inria.fr
2022-03-23mfd: Use platform_get_irq() to get the interruptMinghao Chi (CGEL ZTE)
It is not recommened to use platform_get_resource(pdev, IORESOURCE_IRQ) for requesting IRQ's resources any more, as they can be not ready yet in case of DT-booting. platform_get_irq() instead is a recommended way for getting IRQ even if it was not retrieved earlier. It also makes code simpler because we're getting "int" value right away and no conversion from resource to int is required. The print function dev_err() is redundant because platform_get_irq() already prints an error. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Minghao Chi (CGEL ZTE) <chi.minghao@zte.com.cn> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220309035607.2080884-1-chi.minghao@zte.com.cn
2022-03-23mfd: db8500-prcmu: Remove unused inline functionYueHaibing
commit b0e846248de5 ("mfd: db8500-prcmu: Remove dead code for a non-existing config") left behind this, remove it. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220311125518.31064-1-yuehaibing@huawei.com
2022-03-23mfd: arizona-spi: Add Android board ACPI table handlingHans de Goede
x86/ACPI boards with an arizona WM5102 codec ship with either Windows or Android as factory installed OS. The ACPI fwnode for the codec on Android boards misses 2 things compared to the Windows boards (this is hardcoded in the Android board kernels): 1. There is no CLKE ACPI method to enabe the 32 KHz clock the codec needs for jack-detection. 2. The GPIOs used by the codec are not listed in the fwnode for the codec. The ACPI tables on x86/ACPI boards shipped with Android being incomplete happens a lot. The special drivers/platform/x86/x86-android-tablets.c module contains DMI based per model handling to compensate for this. This module will enable the 32KHz clock through the pinctrl framework to fix 1. and it will also register a gpio-lookup table for all GPIOs needed by the codec + machine driver, including the GPIOs coming from the codec itself. Add an arizona_spi_acpi_android_probe() function which waits for the x86-android-tablets to have set things up before continue with probing the arizona WM5102 codec. Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220307173844.199135-2-hdegoede@redhat.com
2022-03-23mfd: arizona-spi: Split Windows ACPI init code into its own functionHans de Goede
x86/ACPI boards with an arizona WM5102 codec ship with either Windows or Android as factory installed OS. The ACPI fwnode describing the codec differs depending on the factory OS, and the current arizona_spi_acpi_probe() function is tailored for use with the Windows board ACPI tables. Split out the Windows board ACPI tables specific bits into a new arizona_spi_acpi_windows_probe() function in preparation for also adding support for the Android board ACPI tables. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220307173844.199135-1-hdegoede@redhat.com
2022-03-23mfd: asic3: Add missing iounmap() on error asic3_mfd_probeMiaoqian Lin
Add the missing iounmap() before return from asic3_mfd_probe in the error handling case. Fixes: 64e8867ba809 ("mfd: tmio_mmc hardware abstraction for CNF area") Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220307072947.5369-1-linmq006@gmail.com
2022-03-23MAINTAINERS: Rectify entry for ROHM MULTIFUNCTION BD9571MWV-M PMIC DEVICE ↵Lukas Bulwahn
DRIVERS Commit 983b62975e90 ("dt-bindings: mfd: bd9571mwv: Convert to json-schema") converts bd9571mwv.txt to rohm,bd9571mwv.yaml, but missed to adjust its reference in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Repair this file reference in ROHM MULTIFUNCTION BD9571MWV-M PMIC DEVICE DRIVERS. Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220308085136.30753-1-lukas.bulwahn@gmail.com
2022-03-23mfd: intel-lpss: Provide an SSP type to the driverAndy Shevchenko
The SPI driver wants to know the exact type of the controller. Provide this information to it, hence it allows to fix the Intel Cannon Lake and others in the future. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220301205056.79810-1-andriy.shevchenko@linux.intel.com
2022-03-23dt-bindings: mfd: brcm,cru: Rename pinctrl nodeRafał Miłecki
This matches pinctrl.yaml requirement and fixes: Documentation/devicetree/bindings/mfd/brcm,cru.example.dt.yaml: pin-controller@1c0: $nodename:0: 'pin-controller@1c0' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$' From schema: Documentation/devicetree/bindings/pinctrl/brcm,ns-pinmux.yaml Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220216112928.5330-1-zajec5@gmail.com
2022-03-23dt-bindings: Add compatibles for undocumented trivial sysconsRob Herring
'intel,lgm-syscon', 'marvell,armada-3700-usb2-host-misc', 'mediatek,mt8135-pctl-a-syscfg', and 'mediatek,mt8135-pctl-b-syscfg' are all used in DT binding examples and/or dts files, but are not documented. Add them to syscon.yaml as they are all trivial cases. Signed-off-by: Rob Herring <robh@kernel.org> Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20220228221537.1700071-1-robh@kernel.org
2022-03-23mfd: atmel-flexcom: Fix compilation warningClaudiu Beznea
Fix "unused variable 'atmel_flexcom_pm_ops' [-Wunused-const-variable]" compilation warning by using __maybe_unused on PM ops. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com> Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20211207111515.814653-1-claudiu.beznea@microchip.com
2022-03-23livepatch: Reorder to use before freeing a pointerTom Rix
Clang static analysis reports this issue livepatch-shadow-fix1.c:113:2: warning: Use of memory after it is freed pr_info("%s: dummy @ %p, prevented leak @ %p\n", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The pointer is freed in the previous statement. Reorder the pr_info to report before the free. Similar issue in livepatch-shadow-fix2.c Note that it is a false positive. pr_info() just prints the address. The freed memory is not accessed. Well, the static analyzer could not know this easily. Signed-off-by: Tom Rix <trix@redhat.com> Reviewed-by: Petr Mladek <pmladek@suse.com> Acked-by: David Vernet <void@manifault.com> Acked-by: Joe Lawrence <joe.lawrence@redhat.com> [pmladek@suse.com: Note about that it was false positive.] Signed-off-by: Petr Mladek <pmladek@suse.com> Link: https://lore.kernel.org/r/20220320015143.2208591-1-trix@redhat.com
2022-03-23io_uring: don't recycle provided buffer if punted to async workerJens Axboe
We only really need to recycle the buffer when going async for a file type that has an indefinite reponse time (eg non-file/bdev). And for files that to arm poll, the async worker will arm poll anyway and the buffer will get recycled there. In that latter case, we're not holding ctx->uring_lock. Ensure we take the issue_flags into account and acquire it if we need to. Fixes: b1c62645758e ("io_uring: recycle provided buffers if request goes async") Reported-by: Stefan Roesch <shr@fb.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-03-23io_uring: fix assuming triggered poll waitqueue is the single pollJens Axboe
syzbot reports a recent regression: BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650 kernel/sched/wait.c:101 Read of size 8 at addr ffff888011e8a130 by task syz-executor413/3618 CPU: 0 PID: 3618 Comm: syz-executor413 Tainted: G W 5.17.0-syzkaller-01402-g8565d64430f8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 __wake_up_common+0x637/0x650 kernel/sched/wait.c:101 __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:138 tty_release+0x657/0x1200 drivers/tty/tty_io.c:1781 __fput+0x286/0x9f0 fs/file_table.c:317 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xaff/0x29d0 kernel/exit.c:806 do_group_exit+0xd2/0x2f0 kernel/exit.c:936 __do_sys_exit_group kernel/exit.c:947 [inline] __se_sys_exit_group kernel/exit.c:945 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:945 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f439a1fac69 which is due to leaving the request on the waitqueue mistakenly. The reproducer is using a tty device, which means we end up arming the same poll queue twice (it uses the same poll waitqueue for both), but in io_poll_wake() we always just clear REQ_F_SINGLE_POLL regardless of which entry triggered. This leaves one waitqueue potentially armed after we're done, which then blows up in tty when the waitqueue is attempted removed. We have no room to store this information, so simply encode it in the wait_queue_entry->private where we store the io_kiocb request pointer. Fixes: 91eac1c69c20 ("io_uring: cache poll/double-poll state with a request flag") Reported-by: syzbot+09ad4050dd3a120bfccd@syzkaller.appspotmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-03-23io_uring: bump poll refs to full 31-bitsJens Axboe
The previous commit: 1bc84c40088 ("io_uring: remove poll entry from list when canceling all") removed a potential overflow condition for the poll references. They are currently limited to 20-bits, even if we have 31-bits available. The upper bit is used to mark for cancelation. Bump the poll ref space to 31-bits, making that kind of situation much harder to trigger in general. We'll separately add overflow checking and handling. Fixes: aa43477b0402 ("io_uring: poll rework") Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-03-23ASoC: rockchip: i2s_tdm: Fixup config for SND_SOC_DAIFMT_DSP_A/BMeng Tang
SND_SOC_DAIFMT_DSP_A: PCM delay 1 bit mode, L data MSB after FRM LRC SND_SOC_DAIFMT_DSP_B: PCM no delay mode, L data MSB during FRM LRC Fixes: 081068fd64140 (ASoC: rockchip: add support for i2s-tdm controller) Signed-off-by: Meng Tang <tangmeng@uniontech.com> Link: https://lore.kernel.org/r/20220318100146.23991-1-tangmeng@uniontech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2022-03-23ARM: configs: multi_v5: Enable Allwinner F1C100Andre Przywara
The Kconfig symbols required for the Allwinner F1C100 (MACH_SUNIV) are currently not selected by any defconfig. sunxi_defconfig only covers the v7 SoCs, but the F1C100s is ARMv5, so we cannot share a single image. Add the required symbols to multi_v5_defconfig, to give people some sane default config when playing around with this chip. This is probably more important as there are surely not many distros out there supporting ARMv5 out of the box. This allows my LicheePi Nano board to boot to a busybox prompt. The zImage size grows by about 50 KB, in detail: text data bss dec hex filename 10510000 4400700 687740 15598440 ee0368 vmlinux-old 10588592 4469096 686812 15744500 f03df4 vmlinux-new 14922908 arch/arm/boot/Image-old 15067388 arch/arm/boot/Image-new 6388016 arch/arm/boot/zImage-old 6440064 arch/arm/boot/zImage-new Signed-off-by: Andre Przywara <andre.przywara@arm.com> Link: https://lore.kernel.org/r/20220317183043.948432-6-andre.przywara@arm.com' Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-03-23Merge branch 'for-5.18/uclogic' into for-linusJiri Kosina
- integration of first part of DIGImend [1] patches in order to vastly improve Linux support of tablets (Nikolai Kondrashov, José Expósito) [1] https://github.com/DIGImend/digimend-kernel-drivers
2022-03-23Merge branch 'for-5.18/sigma-micro' into for-linusJiri Kosina
- driver for SiGma Micro keyboards (Desmond Lim)
2022-03-23Merge branch 'for-5.18/razer' into for-linusJiri Kosina
- driver for Razer Blackwidow keyboards (Jelle van der Waa)
2022-03-23Merge branch 'for-5.18/i2c-hid' into for-linusJiri Kosina
- fixes for handling unnumbered reports fully correctly (Angela Czubak Dmitry Torokhov) - untangling of intermingled code for sending and handling output reports in __i2c_hid_command() (Dmitry Torokhov)
2022-03-23Merge branch 'for-5.18/google' into for-linusJiri Kosina
2022-03-23Merge branch 'for-5.18/core' into for-linusJiri Kosina
- rework of generic input handling which ultimately makes the processing of tablet events more generic and reliable (Benjamin Tissoires)
2022-03-23Merge branch 'for-5.18/apple' into for-linusJiri Kosina
- Apple magic keyboard support improvements for newer models (José Expósito) - Apple T2 Macs support improvements (Aun-Ali Zaidi, Paul Pawlowski)
2022-03-23Merge branch 'for-5.18/amd-sfh' into for-linusJiri Kosina
- dead code elimination (Christophe JAILLET)
2022-03-23nvme-pci: add quirks for Samsung X5 SSDsMonish Kumar R
Add quirks to not fail the initialization and to have quick resume latency after cold/warm reboot. Signed-off-by: Monish Kumar R <monish.kumar.r@intel.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2022-03-23nvme-pci: expose use_threaded_interrupts read-only in sysfsXin Hao
Allow reading /sys/module/nvme/parameters/use_threaded_interrupts to see if the use_threaded_interrupts module parameter is in use. Signed-off-by: Xin Hao <xhao@linux.alibaba.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2022-03-23nvme: fix the read-only state for zoned namespaces with unsupposed featuresPankaj Raghav
commit 2f4c9ba23b88 ("nvme: export zoned namespaces without Zone Append support read-only") marks zoned namespaces without append support read-only. It does iso by setting NVME_NS_FORCE_RO in ns->flags in nvme_update_zone_info and checking for that flag later in nvme_update_disk_info to mark the disk as read-only. But commit 73d90386b559 ("nvme: cleanup zone information initialization") rearranged nvme_update_disk_info to be called before nvme_update_zone_info and thus not marking the disk as read-only. The call order cannot be just reverted because nvme_update_zone_info sets certain queue parameters such as zone_write_granularity that depend on the prior call to nvme_update_disk_info. Remove the call to set_disk_ro in nvme_update_disk_info. and call set_disk_ro after nvme_update_zone_info and nvme_update_disk_info to set the permission for ZNS drives correctly. The same applies to the multipath disk path. Fixes: 73d90386b559 ("nvme: cleanup zone information initialization") Signed-off-by: Pankaj Raghav <p.raghav@samsung.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2022-03-22net: geneve: add missing netlink policy and size for ↵Eyal Birger
IFLA_GENEVE_INNER_PROTO_INHERIT Add missing netlink attribute policy and size calculation. Also enable strict validation from this new attribute onwards. Fixes: 435fe1c0c1f7 ("net: geneve: support IPv4/IPv6 as inner protocol") Signed-off-by: Eyal Birger <eyal.birger@gmail.com> Link: https://lore.kernel.org/r/20220322043954.3042468-1-eyal.birger@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-22net: dsa: fix missing host-filtered multicast addressesVladimir Oltean
DSA ports are stacked devices, so they use dev_mc_add() to sync their address list to their lower interface (DSA master). But they are also hardware devices, so they program those addresses to hardware using the __dev_mc_add() sync and unsync callbacks. Unfortunately both cannot work at the same time, and it seems that the multicast addresses which are already present on the DSA master, like 33:33:00:00:00:01 (added by addrconf.c as in6addr_linklocal_allnodes) are synced to the master via dev_mc_sync(), but not to hardware by __dev_mc_sync(). This happens because both the dev_mc_sync() -> __hw_addr_sync_one() code path, as well as __dev_mc_sync() -> __hw_addr_sync_dev(), operate on the same variable: ha->sync_cnt, in a way that causes the "sync" method (dsa_slave_sync_mc) to no longer be called. To fix the issue we need to work with the API in the way in which it was intended to be used, and therefore, call dev_uc_add() and friends for each individual hardware address, from the sync and unsync callbacks. Fixes: 5e8a1e03aa4d ("net: dsa: install secondary unicast and multicast addresses as host FDB/MDB") Link: https://lore.kernel.org/netdev/20220321163213.lrn5sk7m6grighbl@skbuf/ Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Link: https://lore.kernel.org/r/20220322003701.2056895-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit (git 2.34.1) at 2025-09-15 00:53:02 +0000