summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-02-05iwlwifi: mvm: advertise BIGTK client support if availableJohannes Berg
If the firmware has support, then advertise it to the stack and send the key down. Since we re-check the protection in the host anyway, we don't really need to do anything on RX except that we should drop frames that the firmware _knows_ are replay errors, since beacon filtering might otherwise result in replays being possible. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210205110447.f5a3d53301b3.I23e84c9bb0b039d9106a07e9d6847776757f9029@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05Drivers: hv: vmbus: Resolve race condition in vmbus_onoffer_rescind()Andrea Parri (Microsoft)
An erroneous or malicious host could send multiple rescind messages for a same channel. In vmbus_onoffer_rescind(), the guest maps the channel ID to obtain a pointer to the channel object and it eventually releases such object and associated data. The host could time rescind messages and lead to an use-after-free. Add a new flag to the channel structure to make sure that only one instance of vmbus_onoffer_rescind() can get the reference to the channel object. Reported-by: Juan Vazquez <juvazq@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20201209070827.29335-6-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind()Andrea Parri (Microsoft)
When channel->device_obj is non-NULL, vmbus_onoffer_rescind() could invoke put_device(), that will eventually release the device and free the channel object (cf. vmbus_device_release()). However, a pointer to the object is dereferenced again later to load the primary_channel. The use-after-free can be avoided by noticing that this load/check is redundant if device_obj is non-NULL: primary_channel must be NULL if device_obj is non-NULL, cf. vmbus_add_channel_work(). Fixes: 54a66265d6754b ("Drivers: hv: vmbus: Fix rescind handling") Reported-by: Juan Vazquez <juvazq@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20201209070827.29335-5-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05Drivers: hv: vmbus: Copy the hv_message in vmbus_on_msg_dpc()Andrea Parri (Microsoft)
Since the message is in memory shared with the host, an erroneous or a malicious Hyper-V could 'corrupt' the message while vmbus_on_msg_dpc() or individual message handlers are executing. To prevent it, copy the message into private memory. Reported-by: Juan Vazquez <juvazq@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20201209070827.29335-4-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05Drivers: hv: vmbus: Reduce number of references to message in vmbus_on_msg_dpc()Andrea Parri (Microsoft)
Simplify the function by removing various references to the hv_message 'msg', introduce local variables 'msgtype' and 'payload_size'. Suggested-by: Juan Vazquez <juvazq@microsoft.com> Suggested-by: Michael Kelley <mikelley@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20201209070827.29335-3-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05Drivers: hv: vmbus: Initialize memory to be sent to the hostAndrea Parri (Microsoft)
__vmbus_open() and vmbus_teardown_gpadl() do not inizialite the memory for the vmbus_channel_open_channel and the vmbus_channel_gpadl_teardown objects they allocate respectively. These objects contain padding bytes and fields that are left uninitialized and that are later sent to the host, potentially leaking guest data. Zero initialize such fields to avoid leaking sensitive information to the host. Reported-by: Juan Vazquez <juvazq@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20201209070827.29335-2-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05hv_utils: Add validation for untrusted Hyper-V valuesAndres Beltran
For additional robustness in the face of Hyper-V errors or malicious behavior, validate all values that originate from packets that Hyper-V has sent to the guest in the host-to-guest ring buffer. Ensure that invalid values cannot cause indexing off the end of the icversion_data array in vmbus_prep_negotiate_resp(). Signed-off-by: Andres Beltran <lkmlabelt@gmail.com> Co-developed-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20201109100704.9152-1-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring bufferAndres Beltran
Pointers to ring-buffer packets sent by Hyper-V are used within the guest VM. Hyper-V can send packets with erroneous values or modify packet fields after they are processed by the guest. To defend against these scenarios, return a copy of the incoming VMBus packet after validating its length and offset fields in hv_pkt_iter_first(). In this way, the packet can no longer be modified by the host. Signed-off-by: Andres Beltran <lkmlabelt@gmail.com> Co-developed-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: netdev@vger.kernel.org Cc: linux-scsi@vger.kernel.org Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20201208045311.10244-1-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05iwlwifi: always allow maximum A-MSDU on newer devicesJohannes Berg
On devices starting from 9000 series, always allow maximum A-MSDU sizes regardless of the amsdu_size module parameter, which really hasn't meant that for a long time but just controls the receive buffer size. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.ebf6efb380a9.I237be6ec70bee6ec52a2f379ee1f15b1196488d0@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: debugfs: check length precisely in inject_packetJohannes Berg
When we check the length, we only check that the advertised data length fits into the data we have, but currently not that it actually matches correctly. This should be harmless, but if the first two bytes are zero, then the iwl_rx_packet_payload_len() ends up negative, and that might later cause issues if unsigned variables are used, as this is not something that's normally expected. Change the validation here to precisely validate the lengths match, to avoid such issues. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.5184dfc2a445.I0631d2e4f6ffb93cf06618edb035c45bd6d1d7b9@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: simplify TX power settingJohannes Berg
There's no need to double this code, just put it into the common code that's called in all the cases. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.1f75d426ebe4.I58f6612f7e168c655bdef206a53e5bc117c84cf5@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: tx: move handing sync/async host command to transMordechay Goodstein
Handling host commands in a sync way is not directly related to PCIe transport, and can serve as common logic for any transport, so move it to trans layer. Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.fde99af4e0f7.I4cab95919eb35cc5bfb26d32dcf5e15419d0e0ef@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: add explicit check for non-data frames in get Tx rateKrishnanand Prabhu
In roaming flows and during reassociation, its possible that data frames such as EAPOLs for 4 way handshake/ 802.1x authentication are initially set to higher MCS rate. Though these are pruned down to a lower legacy rate before sending to the FW, driver also emits a kernel warning - intended for non-data frames. Add checks to avoid such warnings for data frames, while also enhancing the debug data printed. Signed-off-by: Krishnanand Prabhu <krishnanand.prabhu@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.d9ded010c4ce.Ie1d5a33d7175c0bcb35c10b5729748646671da31@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: debugfs for phy-integration-verDror Moshe
Add debugfs file to print the PHY integration version. File name is: phy_integration_ver Signed-off-by: Dror Moshe <drorx.moshe@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.f5127d919656.Ib714f444390b39cbbf7eb143c5440cc890385981@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: parse phy integration string from FW TLVDror Moshe
Parse phy integration string from FW TLV. Signed-off-by: Dror Moshe <drorx.moshe@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.0c790e930484.I23ef2cb9c871e6adc4aab6be378f3811cb531155@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: csa: do not abort CSA before disconnectShaul Triebitz
While disconnecting from the AP due to bad channel switch params (e.g. too long Tx block), do not send the firmware 'CSA abort' before disconnecting. That causes canceling the immediate quiet and can cause transmitting data before the disconnection happens. Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.b9af359a675f.I996fc7eb3d94e9539f8b117017c428448c42c7ad@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: don't send commands during suspend\resume transitionHaim Dreyfuss
D3_CONFIG_CMD and D0I3_END_CMD should be the last\first command upon suspend\resume correspondingly, otherwise, FW will raise an assert (0x342). There are firmware notifications that cause the driver to send a command back to the firmware. If such a notification is sent to the driver while the the driver prepares the firmware for D3, operation, what is likely to happen is that the handling of the notification will try to get the mutex and will wait unil the driver finished configuring the firmware for D3. Then the handling notification will get the mutex and handle the notification which will lead to the aforementioned ASSERT 342. To avoid this, we need to prevent any command to be sent to the firmware between the D3_CONFIG_CMD and the D0I3_END_CMD. Check this in the utility layer that sends the host commands and in the transport layer as well. Flag the D3_CONFIG_CMD and the D0I3_END_CMD commands as commands that must be sent even if the firmware has already been configured for D3 operation. Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117164916.1935a993b471.I3192c93c030576ca16773c01b009c4d93610d6ea@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: don't check system_pm_mode without mutex heldEmmanuel Grumbach
When we want to stop TX'ing because we are suspending, we have two options: either we check system_pm_mode or we check the mvm's status that has a bit for the suspend flow. The latter is better because test_bit is atomic. Also add a call to synchronize_net after we set the bit to make sure that all the new Tx see the bit before we actually complete the suspend flow. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.243c88781302.I5c0379c5a7e5d49410569e7fcd2fff7a419c6dea@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: remove TRANS_PM_OPSEmmanuel Grumbach
Those were needed for a slave bus that is not longer supported. Remove code that is mainly useless stubs. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.8f8a735f39dd.If5716eaae0df5e6295a2af927bf3ab0ee074f0a0@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: dbg: dump paged memory from index 1Mordechay Goodstein
We skip index 0 that holds CSS section which isn't relevant for paged memory. Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.ad2df68fccbc.I381f931c6e7606c21935ec6667619b209224e408@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwl-trans: iwlwifi: move sync NMI logic to transMordechay Goodstein
The code is not directly related to PCIe transport, and it will help moving sync/async commands logic out of PCIe in the next patches. Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.271f59887fd1.I8ff41236f4e11a25df83d76c982a2a30ba2b9903@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: pcie: properly implement NAPIJohannes Berg
Instead of pretending to have NAPI and then relying entirely on interrupts anyway, properly implement NAPI and schedule the poll when we get an interrupt, re-enabling the interrupt only after the poll completed. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.a5951ac4fc06.I9c84a147288fcfb1b019572c6758f2d92949f5d7@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: add support for new flush queue responseMordechay Goodstein
In the new api all the flush in the FW is done before we get the response and in the response we only get the updated read pointer and all queued packets don't get anymore rx_tx per packet to free the queued packet, so driver needs to free all queued packets on flushed queue at once after flush response. Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.4bd0eca8c0ef.I1601aad2eb2cc83f6f73b8ca52be57bb9fd626ab@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: handle CCA-EXT delay firmware notificationJohannes Berg
If there are frequent CCA delays due to the extension channel as detected by the firmware, and we're on 2.4 GHz, then handle this by disconnecting (with a reconnect hint). When we disconnect, we'll also update our capabilities to use only 20 MHz on the next connection (if it's on 2.4 GHz) as to avoid the use of the extension channel that has too much noise. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.4de9c363b0b5.I709b7e6f73a7537c53f22d7418927691259de8a8@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: scan: fix scheduled scan restart handlingJohannes Berg
When restarting firmware with an ongoing scheduled scan, we don't (and shouldn't) mark it as aborted as mac80211 will be restarting it, and so no event should go out to userspace. The appropriate comment regarding this wasn't moved to this place, so add it. However, we _do_ need to clean up our internal state, since mac80211 will restart the scan, and we'll otherwise get to the WARN_ON() a few lines below for no reason whatsoever. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.4ddc9b017268.Ie869b628ae56a5d776eba0e7b7f05f42fc566f2e@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: remove debugfs injection limitationsJohannes Berg
For testing features where the firmware may send some notifications it can often be a lot easier to do that from a test script. Remove most injection limitations from debugfs to be able to do this. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.9aff3c6b4607.I03b0ae7df094734451445ffcb7f9f0274969f1c0@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: check more notification sizesJohannes Berg
Some notifications aren't handled by the general RX handler code, due to multi-queue. Add size checks for them explicitly. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.1370c776cb31.Ic536bd1aee5368969fbf65db85b9b9b5dc9c6034@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05iwlwifi: mvm: add notification size checksJohannes Berg
We shouldn't trust the firmware with the sizes (or contents) of notifications, accessing too much data could cause page faults if the data doesn't fit into the allocated space. This applies more on older NICs where multiple notifications can be in a single RX buffer. Add a general framework for checking a minimum size of any notification in the RX handlers and use it for most. Some RX handlers were already checking and I've moved the checks, some more complex checks I left and made them _NO_SIZE for the RX handlers. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210117130510.3e155d5e5f90.I2121fa4ac7cd7eb98970d84b793796646afa3eed@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2021-02-05x86/sgx: Drop racy follow_pfn() checkDaniel Vetter
PTE insertion is fundamentally racy, and this check doesn't do anything useful. Quoting Sean: "Yeah, it can be whacked. The original, never-upstreamed code asserted that the resolved PFN matched the PFN being installed by the fault handler as a sanity check on the SGX driver's EPC management. The WARN assertion got dropped for whatever reason, leaving that useless chunk." Jason stumbled over this as a new user of follow_pfn(), and I'm trying to get rid of unsafe callers of that function so it can be locked down further. This is independent prep work for the referenced patch series: https://lore.kernel.org/dri-devel/20201127164131.2244124-1-daniel.vetter@ffwll.ch/ Fixes: 947c6e11fa43 ("x86/sgx: Add ptrace() support for the SGX driver") Reported-by: Jason Gunthorpe <jgg@ziepe.ca> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Link: https://lkml.kernel.org/r/20210204184519.2809313-1-daniel.vetter@ffwll.ch
2021-02-05x86/asm: Fixup TASK_SIZE_MAX commentAlexey Dobriyan
Comment says "by preventing anything executable" which is not true. Even PROT_NONE mapping can't be installed at (1<<47 - 4096). mmap(0x7ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM [ bp: Fixup to the moved location in page_64_types.h. ] Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Andy Lutomirski <luto@kernel.org> Link: https://lkml.kernel.org/r/20200305181719.GA5490@avx2
2021-02-05usb: dwc2: Fix endpoint direction check in ep_from_windexHeiko Stuebner
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve the endpoint for the index provided in the wIndex request param. In a test-case with a rndis gadget running and sending a malformed packet to it like: dev.ctrl_transfer( 0x82, # bmRequestType 0x00, # bRequest 0x0000, # wValue 0x0001, # wIndex 0x00 # wLength ) it is possible to cause a crash: [ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS [ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088 ... [ 218.313189] Call trace: [ 218.330217] ep_from_windex+0x3c/0x54 [ 218.348565] usb_gadget_giveback_request+0x10/0x20 [ 218.368056] dwc2_hsotg_complete_request+0x144/0x184 This happens because ep_from_windex wants to compare the endpoint direction even if index_to_ep() didn't return an endpoint due to the direction not matching. The fix is easy insofar that the actual direction check is already happening when calling index_to_ep() which will return NULL if there is no endpoint for the targeted direction, so the offending check can go away completely. Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support") Cc: stable@vger.kernel.org Reported-by: Gerhard Klostermeier <gerhard.klostermeier@syss.de> Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com> Link: https://lore.kernel.org/r/20210127103919.58215-1-heiko@sntech.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05usb: musb: jz4740: Add missing CR to error stringsPaul Cercueil
If you pass a string that is not terminated with a carriage return to dev_err(), it will eventually be printed with a carriage return, but not right away, since the kernel will wait for a pr_cont(). Signed-off-by: Paul Cercueil <paul@crapouillou.net> Link: https://lore.kernel.org/r/20210123142502.16980-4-paul@crapouillou.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05usb: musb: dma: Remove unused variablePaul Cercueil
Remove unused-but-set devctl variable. Signed-off-by: Paul Cercueil <paul@crapouillou.net> Link: https://lore.kernel.org/r/20210123142502.16980-3-paul@crapouillou.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05usb: musb: Fix NULL check on struct musb_request fieldPaul Cercueil
The 'request' variable is a pointer to the 'request' field of the struct musb_request 'req' pointer. It only worked until now because the 'request' field is the first one in the musb_request structure, but as soon as that changes, the check will be invalid. Fix it preventively by doing the NULL-check on the 'req' pointer instead. Suggested-by: Maarten ter Huurne <maarten@treewalker.org> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Paul Cercueil <paul@crapouillou.net> Link: https://lore.kernel.org/r/20210123142502.16980-2-paul@crapouillou.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05usb: musb: Fix runtime PM race in musb_queue_resume_workPaul Cercueil
musb_queue_resume_work() would call the provided callback if the runtime PM status was 'active'. Otherwise, it would enqueue the request if the hardware was still suspended (musb->is_runtime_suspended is true). This causes a race with the runtime PM handlers, as it is possible to be in the case where the runtime PM status is not yet 'active', but the hardware has been awaken (PM resume function has been called). When hitting the race, the resume work was not enqueued, which probably triggered other bugs further down the stack. For instance, a telnet connection on Ingenic SoCs would result in a 50/50 chance of a segmentation fault somewhere in the musb code. Rework the code so that either we call the callback directly if (musb->is_runtime_suspended == 0), or enqueue the query otherwise. Fixes: ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue") Cc: stable@vger.kernel.org # v4.9+ Tested-by: Tony Lindgren <tony@atomide.com> Reviewed-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Paul Cercueil <paul@crapouillou.net> Link: https://lore.kernel.org/r/20210123142502.16980-1-paul@crapouillou.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05usb: dwc3: fix clock issue during resume in OTG modeGary Bisson
Commit fe8abf332b8f ("usb: dwc3: support clocks and resets for DWC3 core") introduced clock support and a new function named dwc3_core_init_for_resume() which enables the clock before calling dwc3_core_init() during resume as clocks get disabled during suspend. Unfortunately in this commit the DWC3_GCTL_PRTCAP_OTG case was forgotten and therefore during resume, a platform could call dwc3_core_init() without re-enabling the clocks first, preventing to resume properly. So update the resume path to call dwc3_core_init_for_resume() as it should. Fixes: fe8abf332b8f ("usb: dwc3: support clocks and resets for DWC3 core") Cc: stable@vger.kernel.org Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com> Link: https://lore.kernel.org/r/20210125161934.527820-1-gary.bisson@boundarydevices.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05xhci: ext-caps: Use software node API with the propertiesHeikki Krogerus
This replaces the platform_device_add_properties() call with the safer device_create_managed_software_node() that does exactly the same, but can also guarantee that the lifetime of the node that is created for the device is tied to the lifetime of device itself. Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/20210204141711.53775-7-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05usb: dwc3: host: Use software node API with the propertiesHeikki Krogerus
This replaces the platform_device_add_properties() call with the safer device_create_managed_software_node() that does exactly the same, but can also guarantee that the lifetime of the node that is created for the device is tied to the lifetime of device itself. Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/20210204141711.53775-6-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05software node: Provide replacement for device_add_properties()Heikki Krogerus
At the moment the function device_del() is calling device_remove_properties() unconditionally. That will result into the reference count of the software node attached to the device being decremented, and in most cases it will hit 0 at that point. So in practice device_del() will unregister the software node attached to the device, even if that was not the intention of the caller. Right now software nodes can not be reused or shared because of that. So device_del() can not unregister the software nodes unconditionally like that. Unfortunately some of the users of device_add_properties() are now relying on this behaviour. Because of that, and also in general, we do need a function that can offer similar behaviour where the lifetime of the software node is bound to the lifetime of the device. But it just has to be a separate function so the behaviour is optional. We can not remove the device_remove_properties() call from device_del() before we have that new function, and before we have replaced device_add_properties() calls with it in all the places that require that behaviour. This adds function device_create_managed_software_node() that can be used for exactly that purpose. Software nodes created with it are declared "managed", and separate handling for those nodes is added to the software node code. The reference count of the "managed" nodes is decremented when the device they are attached to is removed. This will not affect the other nodes that are not declared "managed". The function device_create_managed_software_node() has also one additional feature that device_add_properties() does not have. It allows the software nodes created with it to be part of a node hierarchy by taking also an optional parent node as parameter. Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/20210204141711.53775-2-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05Merge tag ↵Greg Kroah-Hartman
'tag-ib-usb-typec-chrome-platform-cros-ec-typec-clear-pd-discovery-events-for-5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux into usb-next Benson writes: clear-pd-discovery-events This pair of patches fixes an issue where cros_ec_typec creates stale cable nodes on detach because of uncleared pd discovery status events. * tag 'tag-ib-usb-typec-chrome-platform-cros-ec-typec-clear-pd-discovery-events-for-5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec_typec: Clear Type C disc events platform/chrome: cros_ec: Import Type C control command
2021-02-05kallsyms: fix nonconverging kallsyms table with lldArnd Bergmann
ARM randconfig builds with lld sometimes show a build failure from kallsyms: Inconsistent kallsyms data Try make KALLSYMS_EXTRA_PASS=1 as a workaround The problem is the veneers/thunks getting added by the linker extend the symbol table, which in turn leads to more veneers being needed, so it may take a few extra iterations to converge. This bug has been fixed multiple times before, but comes back every time a new symbol name is used. lld uses a different set of identifiers from ld.bfd, so the additional ones need to be added as well. I looked through the sources and found that arm64 and mips define similar prefixes, so I'm adding those as well, aside from the ones I observed. I'm not sure about powerpc64, which seems to already be handled through a section match, but if it comes back, the "__long_branch_" and "__plt_" prefixes would have to get added as well. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
2021-02-05kbuild: fix duplicated flags in DEBUG_CFLAGSMasahiro Yamada
Sedat Dilek noticed duplicated flags in DEBUG_CFLAGS when building deb-pkg with CONFIG_DEBUG_INFO. For example, 'make CC=clang bindeb-pkg' reproduces the issue. Kbuild recurses to the top Makefile for some targets such as package builds. With commit 121c5d08d53c ("kbuild: Only add -fno-var-tracking-assignments for old GCC versions") applied, DEBUG_CFLAGS is now reset only when CONFIG_CC_IS_GCC=y. Fix it to reset DEBUG_CFLAGS all the time. Fixes: 121c5d08d53c ("kbuild: Only add -fno-var-tracking-assignments for old GCC versions") Reported-by: Sedat Dilek <sedat.dilek@gmail.com> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Tested-by: Sedat Dilek <sedat.dilek@gmail.com> Reviewed-by: Mark Wielaard <mark@klomp.org> Reviewed-by: Nathan Chancellor <nathan@kernel.org>
2021-02-05batman-adv: Start new development cycleSimon Wunderlich
This version will contain all the (major or even only minor) changes for Linux 5.12. The version number isn't a semantic version number with major and minor information. It is just encoding the year of the expected publishing as Linux -rc1 and the number of published versions this year (starting at 0). Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
2021-02-04bpf: Refactor BPF_PSEUDO_CALL checking as a helper functionYonghong Song
There is no functionality change. This refactoring intends to facilitate next patch change with BPF_PSEUDO_FUNC. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20210204234827.1628953-1-yhs@fb.com
2021-02-04Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfJakub Kicinski
Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Fix combination of --reap and --update in xt_recent that triggers UAF, from Jozsef Kadlecsik. 2) Fix current year in nft_meta selftest, from Fabian Frederick. 3) Fix possible UAF in the netns destroy path of nftables. 4) Fix incorrect checksum calculation when mangling ports in flowtable, from Sven Auhagen. * git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf: netfilter: flowtable: fix tcp and udp header checksum update netfilter: nftables: fix possible UAF over chains from packet path in netns selftests: netfilter: fix current year netfilter: xt_recent: Fix attempt to update deleted entry ==================== Link: https://lore.kernel.org/r/20210205001727.2125-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-04Merge branch '1GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== 1GbE Intel Wired LAN Driver Updates 2021-02-03 This series contains updates to igc, igb, e1000e, and e1000 drivers. Sasha adds counting of good transmit packets and reporting of NVM version and gPHY version in ethtool firmware version. Replaces the use of strlcpy to the preferred strscpy. Fixes a typo that caused the wrong register to be output. He also removes an unused function pointer, some unneeded defines, and a non-applicable comment. All changes for igc. Gal Hammer fixes a typo which caused the RDBAL register values to be shown instead of TDBAL for igb. Nick Lowe enables RSS support for i211 devices for igb. Tom Rix fixes checkpatch warning by removing h from printk format specifier for igb. Kaixu Xia removes setting of a variable that is overwritten before next use for e1000e. Sudip Mukherjee removes an unneeded assignment for e1000. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: e1000: drop unneeded assignment in e1000_set_itr() e1000e: remove the redundant value assignment in e1000_update_nvm_checksum_spt igb: remove h from printk format specifier igb: Enable RSS for Intel I211 Ethernet Controller igb: fix TDBAL register show incorrect value igc: Fix TDBAL register show incorrect value igc: Remove unused FUNC_1 mask igc: Remove unused local receiver mask igc: Prefer strscpy over strlcpy igc: Expose the gPHY firmware version igc: Expose the NVM version igc: Add Host Good Packets Transmitted Count igc: Remove MULR mask define igc: Remove igc_set_fw_version comment igc: Clean up nvm_operations structure ==================== Link: https://lore.kernel.org/r/20210204004259.3662059-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-04Merge branch ↵Jakub Kicinski
'amend-hv_netvsc-copy-packets-sent-by-hyper-v-out-of-the-receive-buffer' Andrea Parri says: ==================== Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer" Patch #2 also addresses the Smatch complaint reported here: https://lkml.kernel.org/r/YBp2oVIdMe+G%2FliJ@mwanda/ ==================== Link: https://lore.kernel.org/r/20210203113513.558864-1-parri.andrea@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-04hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet infoAndrea Parri (Microsoft)
Fix the typo. Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Fixes: 0ba35fe91ce34f ("hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-04hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUFAndrea Parri (Microsoft)
The recv_buf buffers are allocated in netvsc_device_add(). Later in netvsc_init_buf() the response to NVSP_MSG1_TYPE_SEND_RECV_BUF allows the host to set up a recv_section_size that could be bigger than the (default) value used for that allocation. The host-controlled value could be used by a malicious host to bypass the check on the packet's length in netvsc_receive() and hence to overflow the recv_buf buffer. Move the allocation of the recv_buf buffers into netvsc_init_but(). Reported-by: Juan Vazquez <juvazq@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Fixes: 0ba35fe91ce34f ("hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-04Merge branch 'r8152-adjust-flow-for-power-cut'Jakub Kicinski
Hayes Wang says: ==================== r8152: adjust flow for power cut The two patches are used to adjust the flow about resuming from the state of power cut. For the purpose, some functions have to be updated first. ==================== Link: https://lore.kernel.org/r/1394712342-15778-398-Taiwan-albertk@realtek.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit (git 2.34.1) at 2025-09-23 22:17:48 +0000