summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-08-25USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()Brooke Basile
Some values extracted by ncm_unwrap_ntb() could possibly lead to several different out of bounds reads of memory. Specifically the values passed to netdev_alloc_skb_ip_align() need to be checked so that memory is not overflowed. Resolve this by applying bounds checking to a number of different indexes and lengths of the structure parsing logic. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Brooke Basile <brookebasile@gmail.com> Acked-by: Felipe Balbi <balbi@kernel.org> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-25USB: gadget: u_f: add overflow checks to VLA macrosBrooke Basile
size can potentially hold an overflowed value if its assigned expression is left unchecked, leading to a smaller than needed allocation when vla_group_size() is used by callers to allocate memory. To fix this, add a test for saturation before declaring variables and an overflow check to (n) * sizeof(type). If the expression results in overflow, vla_group_size() will return SIZE_MAX. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Suggested-by: Kees Cook <keescook@chromium.org> Signed-off-by: Brooke Basile <brookebasile@gmail.com> Acked-by: Felipe Balbi <balbi@kernel.org> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-25gtp: add GTPA_LINK info to msg sent to userspaceNicolas Dichtel
During a dump, this attribute is essential, it enables the userspace to know on which interface the context is linked to. Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Tested-by: Gabriel Ganne <gabriel.ganne@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-25io_uring: revert consumed iov_iter bytes on errorJens Axboe
Some consumers of the iov_iter will return an error, but still have bytes consumed in the iterator. This is an issue for -EAGAIN, since we rely on a sane iov_iter state across retries. Fix this by ensuring that we revert consumed bytes, if any, if the file operations have consumed any bytes from iterator. This is similar to what generic_file_read_iter() does, and is always safe as we have the previous bytes count handy already. Fixes: ff6165b2d7f6 ("io_uring: retain iov_iter state over io_read/io_write calls") Reported-by: Dmitry Shulyak <yashulyak@gmail.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-08-25drivers/dma/dma-jz4780: Fix race condition between probe and irq handlerMadhuparna Bhowmik
In probe, IRQ is requested before zchan->id is initialized which can be read in the irq handler. Hence, shift request irq after other initializations complete. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com> Reviewed-by: Paul Cercueil <paul@crapouillou.net> Link: https://lore.kernel.org/r/20200821034423.12713-1-madhuparnabhowmik10@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2020-08-25dmaengine: dw-edma: Fix scatter-gather address calculationGustavo Pimentel
Fix the source and destination physical address calculation of a peripheral device on scatter-gather implementation. This issue manifested during tests using a 64 bits architecture system. The abnormal behavior wasn't visible before due to all previous tests were done using 32 bits architecture system, that masked his effect. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Cc: stable@vger.kernel.org Signed-off-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com> Link: https://lore.kernel.org/r/8d3ab7e2ba96563fe3495b32f60077fffb85307d.1597327623.git.gustavo.pimentel@synopsys.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2020-08-25dmaengine: ti: k3-udma: Fix the TR initialization for prep_slave_sgPeter Ujfalusi
The TR which needs to be initialized for the next sg entry is indexed by tr_idx and not by the running i counter. In case any sub element in the SG needs more than one TR, the code would corrupt an already configured TR. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Link: https://lore.kernel.org/r/20200824120108.9178-1-peter.ujfalusi@ti.com Fixes: 6cf668a4ef829 ("dmaengine: ti: k3-udma: Use the TR counter helper for slave_sg and cyclic") Signed-off-by: Vinod Koul <vkoul@kernel.org>
2020-08-25dmaengine: pl330: Fix burst length if burst size is smaller than bus widthMarek Szyprowski
Move the burst len fixup after setting the generic value for it. This finally enables the fixup introduced by commit 137bd11090d8 ("dmaengine: pl330: Align DMA memcpy operations to MFIFO width"), which otherwise was overwritten by the generic value. Reported-by: kernel test robot <lkp@intel.com> Fixes: 137bd11090d8 ("dmaengine: pl330: Align DMA memcpy operations to MFIFO width") Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Link: https://lore.kernel.org/r/20200825064617.16193-1-m.szyprowski@samsung.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2020-08-25Revert "ALSA: hda: Add support for Loongson 7A1000 controller"Tiezhu Yang
This reverts commit 61eee4a7fc40 ("ALSA: hda: Add support for Loongson 7A1000 controller") to fix the following error on the Loongson LS7A platform: rcu: INFO: rcu_preempt self-detected stall on CPU <SNIP> NMI backtrace for cpu 0 CPU: 0 PID: 68 Comm: kworker/0:2 Not tainted 5.8.0+ #3 Hardware name: , BIOS Workqueue: events azx_probe_work [snd_hda_intel] <SNIP> Call Trace: [<ffffffff80211a64>] show_stack+0x9c/0x130 [<ffffffff8065a740>] dump_stack+0xb0/0xf0 [<ffffffff80665774>] nmi_cpu_backtrace+0x134/0x140 [<ffffffff80665910>] nmi_trigger_cpumask_backtrace+0x190/0x200 [<ffffffff802b1abc>] rcu_dump_cpu_stacks+0x12c/0x190 [<ffffffff802b08cc>] rcu_sched_clock_irq+0xa2c/0xfc8 [<ffffffff802b91d4>] update_process_times+0x2c/0xb8 [<ffffffff802cad80>] tick_sched_timer+0x40/0xb8 [<ffffffff802ba5f0>] __hrtimer_run_queues+0x118/0x1d0 [<ffffffff802bab74>] hrtimer_interrupt+0x12c/0x2d8 [<ffffffff8021547c>] c0_compare_interrupt+0x74/0xa0 [<ffffffff80296bd0>] __handle_irq_event_percpu+0xa8/0x198 [<ffffffff80296cf0>] handle_irq_event_percpu+0x30/0x90 [<ffffffff8029d958>] handle_percpu_irq+0x88/0xb8 [<ffffffff80296124>] generic_handle_irq+0x44/0x60 [<ffffffff80b3cfd0>] do_IRQ+0x18/0x28 [<ffffffff8067ace4>] plat_irq_dispatch+0x64/0x100 [<ffffffff80209a20>] handle_int+0x140/0x14c [<ffffffff802402e8>] irq_exit+0xf8/0x100 Because AZX_DRIVER_GENERIC can not work well for Loongson LS7A HDA controller, it needs some workarounds which are not merged into the upstream kernel at this time, so it should revert this patch now. Fixes: 61eee4a7fc40 ("ALSA: hda: Add support for Loongson 7A1000 controller") Cc: <stable@vger.kernel.org> # 5.9-rc1+ Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Link: https://lore.kernel.org/r/1598348388-2518-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-08-25irqchip/ingenic: Leave parent IRQ unmasked on suspendPaul Cercueil
All the wakeup sources we possibly want will go through the interrupt controller, so the parent IRQ must not be masked during suspend, or there won't be any way to wake up the system. Signed-off-by: Paul Cercueil <paul@crapouillou.net> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20200819180602.136969-1-paul@crapouillou.net
2020-08-25irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by ↵qiuguorui1
mistake In the current code, when the eoi callback of the exti clears the pending bit of the current interrupt, it will first read the values of fpr and rpr, then logically OR the corresponding bit of the interrupt number, and finally write back to fpr and rpr. We found through experiments that if two exti interrupts, we call them int1/int2, arrive almost at the same time. in our scenario, the time difference is 30 microseconds, assuming int1 is triggered first. there will be an extreme scenario: both int's pending bit are set to 1, the irq handle of int1 is executed first, and eoi handle is then executed, at this moment, all pending bits are cleared, but the int 2 has not finally been reported to the cpu yet, which eventually lost int2. According to stm32's TRM description about rpr and fpr: Writing a 1 to this bit will trigger a rising edge event on event x, Writing 0 has no effect. Therefore, when clearing the pending bit, we only need to clear the pending bit of the irq. Fixes: 927abfc4461e7 ("irqchip/stm32: Add stm32mp1 support with hierarchy domain") Signed-off-by: qiuguorui1 <qiuguorui1@huawei.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Cc: stable@vger.kernel.org # v4.18+ Link: https://lore.kernel.org/r/20200820031629.15582-1-qiuguorui1@huawei.com
2020-08-25irqchip: Revert modular support for drivers using IRQCHIP_PLATFORM_DRIVER ↵Marc Zyngier
helperse It has become obvious that switching a number of irqchip drivers to being platform drivers without considering the platform was a mistake. We have multiple reports of end-point drivers not probing because the irqchip driver isn't there yet, breaking the expectations of the users. This patch reverts: 920ecb8c35cb ("irqchip/mtk-cirq: Convert to a platform driver") f97dbf48ca43 ("irqchip/mtk-sysirq: Convert to a platform driver") 5be57099d445 ("irqchip/qcom-pdc: Switch to using IRQCHIP_PLATFORM_DRIVER helper macros") 95bf9305d2e3 ("irqchip/qcom-pdc: Allow QCOM_PDC to be loadable as a permanent module") and leave QCOM PDC, MTK sysrq and cirq drivers as built-in, special purpose drivers for the time being until we have worked out a better solution. Reported-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> Reported-by: Frank Wunderlich <linux@fw-web.de> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/93debe6a0308b66d3f307af67ba7ec2c@kernel.org
2020-08-25dt-bindings: mmc: Add missing description for clk_in/out_sd1Michal Simek
The commit a8fdb80f4d47 ("arm64: zynqmp: Add ZynqMP SDHCI compatible string") added clock-output-names for both SDHCIs before DT binding yaml conversion. But only clk_in/out_sd0 clock names have been covered by DT binding which ends up with dt yaml checking warnings as: From schema: .../Documentation/devicetree/bindings/mmc/arasan,sdhci.yaml ... mmc@ff170000: clock-output-names:0: 'clk_out_sd0' was expected ... mmc@ff170000: clock-output-names:1: 'clk_in_sd0' was expected Fixes: 16ecd8f33c6e ("dt-bindings: mmc: convert arasan sdhci bindings to yaml") Signed-off-by: Michal Simek <michal.simek@xilinx.com> Reviewed-by: Manish Narani <manish.narani@xilinx.com> Link: https://lore.kernel.org/r/aef586778921c93377ec2f31c86e151b6e93f6c7.1598257520.git.michal.simek@xilinx.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2020-08-25drm/omap: fix incorrect lock stateTomi Valkeinen
After commit 92cc68e35863c1c61c449efa2b2daef6e9926048 ("drm/vblank: Use spin_(un)lock_irq() in drm_crtc_vblank_on()") omapdrm locking is broken: WARNING: inconsistent lock state 5.8.0-rc2-00483-g92cc68e35863 #13 Tainted: G W -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. swapper/0/0 [HC1[1]:SC0[0]:HE0:SE1] takes: ea98222c (&dev->event_lock#2){?.+.}-{2:2}, at: drm_handle_vblank+0x4c/0x520 [drm] {HARDIRQ-ON-W} state was registered at: trace_hardirqs_on+0x9c/0x1ec _raw_spin_unlock_irq+0x20/0x58 omap_crtc_atomic_enable+0x54/0xa0 [omapdrm] drm_atomic_helper_commit_modeset_enables+0x218/0x270 [drm_kms_helper] omap_atomic_commit_tail+0x48/0xc4 [omapdrm] commit_tail+0x9c/0x190 [drm_kms_helper] drm_atomic_helper_commit+0x154/0x188 [drm_kms_helper] drm_client_modeset_commit_atomic+0x228/0x268 [drm] drm_client_modeset_commit_locked+0x60/0x1d0 [drm] drm_client_modeset_commit+0x24/0x40 [drm] drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0xa8 [drm_kms_helper] drm_fb_helper_set_par+0x2c/0x5c [drm_kms_helper] drm_fb_helper_hotplug_event.part.0+0xa0/0xbc [drm_kms_helper] drm_kms_helper_hotplug_event+0x24/0x30 [drm_kms_helper] output_poll_execute+0x1a8/0x1c0 [drm_kms_helper] process_one_work+0x268/0x800 worker_thread+0x30/0x4e0 kthread+0x164/0x190 ret_from_fork+0x14/0x20 The reason for this is that omapdrm calls drm_crtc_vblank_on() while holding event_lock taken with spin_lock_irq(). It is not clear why drm_crtc_vblank_on() and drm_crtc_vblank_get() are called while holding event_lock. I don't see any problem with moving those calls outside the lock, which is what this patch does. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200819103021.440288-1-tomi.valkeinen@ti.com Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2020-08-25Merge tag 'v5.9-rc2' into drm-misc-fixesMaarten Lankhorst
Backmerge requested by Tomi for a fix to omap inconsistent locking state issue, and because we need at least v5.9-rc2 now. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
2020-08-25drm/i915: Fix cmd parser desc matching with masksMika Kuoppala
Our variety of defined gpu commands have the actual command id field and possibly length and flags applied. We did start to apply the mask during initialization of the cmd descriptors but forgot to also apply it on comparisons. Fix comparisons in order to properly deny access with associated commands. v2: fix lri with correct mask (Chris) References: 926abff21a8f ("drm/i915/cmdparser: Ignore Length operands during command matching") Reported-by: Nicolai Stange <nstange@suse.de> Cc: stable@vger.kernel.org # v5.4+ Cc: Miroslav Benes <mbenes@suse.cz> Cc: Takashi Iwai <tiwai@suse.de> Cc: Tyler Hicks <tyhicks@canonical.com> Cc: Jon Bloomfield <jon.bloomfield@intel.com> Cc: Chris Wilson <chris.p.wilson@intel.com> Signed-off-by: Mika Kuoppala <mika.kuoppala@linux.intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Link: https://patchwork.freedesktop.org/patch/msgid/20200817195926.12671-1-mika.kuoppala@linux.intel.com (cherry picked from commit 3b4efa148da36f158cce3f662e831af2834b8e0f) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2020-08-25i2c: iproc: Fix shifting 31 bitsRay Jui
Fix undefined behaviour in the iProc I2C driver by using 'BIT' marcro. Reported-by: Wolfram Sang <wsa@kernel.org> Signed-off-by: Ray Jui <ray.jui@broadcom.com> Acked-by: Florian Fainelli <f.fainelli@gmail.com> [wsa: in commit msg, don't say 'checkpatch' but name the issue] Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-08-25i2c: rcar: in slave mode, clear NACK earlierWolfram Sang
Currently, a NACK in slave mode is set/cleared when SCL is held low by the IP core right before the bit is about to be pushed out. This is too late for clearing and then a NACK from the previous byte is still used for the current one. Now, let's clear the NACK right after we detected the STOP condition following the NACK. Fixes: de20d1857dd6 ("i2c: rcar: add slave support") Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-08-25ALSA: hda/tegra: Program WAKEEN register for TegraMohan Kumar
The WAKEEN bits are used to indicate which bits in the STATESTS register may cause wake event during the codec state change request. Configure the WAKEEN register for the Tegra to detect the wake events. Signed-off-by: Mohan Kumar <mkumard@nvidia.com> Acked-by: Sameer Pujar <spujar@nvidia.com> Link: https://lore.kernel.org/r/20200825052415.20626-3-mkumard@nvidia.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-08-25ALSA: hda: Fix 2 channel swapping for TegraMohan Kumar
The Tegra HDA codec HW implementation has an issue related to not swapping the 2 channel Audio Sample Packet(ASP) channel mapping. Whatever the FL and FR mapping specified the left channel always comes out of left speaker and right channel on right speaker. So add condition to disallow the swapping of FL,FR during the playback. Signed-off-by: Mohan Kumar <mkumard@nvidia.com> Acked-by: Sameer Pujar <spujar@nvidia.com> Link: https://lore.kernel.org/r/20200825052415.20626-2-mkumard@nvidia.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-08-25ALSA: ca0106: fix error code handlingTong Zhang
snd_ca0106_spi_write() returns 1 on error, snd_ca0106_pcm_power_dac() is returning the error code directly, and the caller is expecting an negative error code Signed-off-by: Tong Zhang <ztong0001@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200824224541.1260307-1-ztong0001@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-08-25i2c: acpi: Remove dead code, i.e. i2c_acpi_match_device()Andy Shevchenko
We have no users of i2c_acpi_match_device() anymore and seems will not have them in the future, thus remove dead code. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-08-25i2c: core: Don't fail PRP0001 enumeration when no ID table existAndy Shevchenko
When commit c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case as well") fixed the enumeration of I²C devices on ACPI enabled platforms when driver has no ID table, it missed the PRP0001 support. i2c_device_match() and i2c_acpi_match_device() differently match driver against given device. Use acpi_driver_match_device(), that is used in the former, in i2c_device_probe() and don't fail PRP0001 enumeration when no ID table exist. Fixes: c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case as well") BugLink: https://stackoverflow.com/q/63519678/2511795 Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-08-24bpf, sysctl: Let bpf_stats_handler take a kernel pointer bufferTobias Klauser
Commit 32927393dc1c ("sysctl: pass kernel pointers to ->proc_handler") changed ctl_table.proc_handler to take a kernel pointer. Adjust the signature of bpf_stats_handler to match ctl_table.proc_handler which fixes the following sparse warning: kernel/sysctl.c:226:49: warning: incorrect type in argument 3 (different address spaces) kernel/sysctl.c:226:49: expected void * kernel/sysctl.c:226:49: got void [noderef] __user *buffer kernel/sysctl.c:2640:35: warning: incorrect type in initializer (incompatible argument 3 (different address spaces)) kernel/sysctl.c:2640:35: expected int ( [usertype] *proc_handler )( ... ) kernel/sysctl.c:2640:35: got int ( * )( ... ) Fixes: 32927393dc1c ("sysctl: pass kernel pointers to ->proc_handler") Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Cc: Christoph Hellwig <hch@lst.de> Link: https://lore.kernel.org/bpf/20200824142047.22043-1-tklauser@distanz.ch
2020-08-24selftests/bpf: Fix test_progs-flavor run getting number of testsJesper Dangaard Brouer
Commit 643e7233aa94 ("selftests/bpf: Test_progs option for getting number of tests") introduced ability to getting number of tests, which is targeted towards scripting. As demonstrate in the commit the number can be use as a shell variable for further scripting. The test_progs program support "flavor", which is detected by the binary have a "-flavor" in the executable name. One example is test_progs-no_alu32, which load bpf-progs compiled with disabled alu32, located in dir 'no_alu32/'. The problem is that invoking a "flavor" binary prints to stdout e.g.: "Switching to flavor 'no_alu32' subdirectory..." Thus, intermixing with the number of tests, making it unusable for scripting. Fix the issue by only printing "flavor" info when verbose -v option is used. Fixes: 643e7233aa94 ("selftests/bpf: Test_progs option for getting number of tests") Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/159827024012.923543.7104106594870150597.stgit@firesoul
2020-08-24bpf: Fix a buffer out-of-bound access when filling raw_tp link_infoYonghong Song
Commit f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link") added link query for raw_tp. One of fields in link_info is to fill a user buffer with tp_name. The Scurrent checking only declares "ulen && !ubuf" as invalid. So "!ulen && ubuf" will be valid. Later on, we do "copy_to_user(ubuf, tp_name, ulen - 1)" which may overwrite user memory incorrectly. This patch fixed the problem by disallowing "!ulen && ubuf" case as well. Fixes: f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link") Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Andrii Nakryiko <andriin@fb.com> Link: https://lore.kernel.org/bpf/20200821191054.714731-1-yhs@fb.com
2020-08-24scsi: scsi_debug: Remove superfluous close zone in resp_open_zone()Niklas Cassel
resp_open_zone() always calls zbc_open_zone() with parameter explicit set to true. If zbc_open_zone() is called with parameter explicit set to true, and the current zone state is implicit open, it will call zbc_close_zone() on the zone before proceeding. Therefore, there is no need for resp_open_zone() to call zbc_close_zone() on an implicitly open zone before calling zbc_open_zone(). Remove superfluous close zone in resp_open_zone(). Link: https://lore.kernel.org/r/20200821130007.39938-1-niklas.cassel@wdc.com Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com> Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-08-24scsi: libcxgbi: Fix a use after free in cxgbi_conn_xmit_pdu()Dan Carpenter
We accidentally move this logging printk after the free, but that leads to a use after free. Link: https://lore.kernel.org/r/20200824085933.GD208317@mwanda Fixes: e33c2482289b ("scsi: cxgb4i: Add support for iSCSI segmentation offload") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-08-24scsi: qedf: Fix null ptr reference in qedf_stag_change_workYe Bin
Link: https://lore.kernel.org/r/20200824033436.45570-1-yebin10@huawei.com Acked-by: Saurav Kashyap <skashyap@marvell.com> Signed-off-by: Ye Bin <yebin10@huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-08-24Merge tag 'batadv-net-for-davem-20200824' of git://git.open-mesh.org/linux-mergeDavid S. Miller
Simon Wunderlich says: ==================== Here are some batman-adv bugfixes: - Avoid uninitialized memory access when handling DHCP, by Sven Eckelmann - Fix check for own OGM in OGM receive handler, by Linus Luessing - Fix netif_rx access for non-interrupt context in BLA, by Jussi Kivilinna ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24sfc: fix boolreturn.cocci warning and rename functionEdward Cree
check_fcs() was returning bool as 0/1, which was a sign that the sense of the function was unclear: false was good, which doesn't really match a name like 'check_$thing'. So rename it to ef100_has_fcs_error(), and use proper booleans in the return statements. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Edward Cree <ecree@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24net: ocelot: Add of_node_put() before return statementSumera Priyadarsini
Every iteration of for_each_available_child_of_node() decrements the reference count of the previous node, however when control is transferred from the middle of the loop, as in the case of a return or break or goto, there is no decrement thus ultimately resulting in a memory leak. Fix a potential memory leak in felix.c by inserting of_node_put() before the return statement. Issue found with Coccinelle. Signed-off-by: Sumera Priyadarsini <sylphrenadin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24dt-bindings: net: dsa: Fix typoKurt Kanzenbach
Fix spelling mistake documenation -> documentation. Fixes: 5a18bb14c0f7 ("dt-bindings: net: dsa: Let dsa.txt refer to dsa.yaml") Signed-off-by: Kurt Kanzenbach <kurt@kmk-computers.de> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24firestream: Fix memleak in fs_openDinghao Liu
When make_rate() fails, vcc should be freed just like other error paths in fs_open(). Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24net: arc_emac: Fix memleak in arc_mdio_probeDinghao Liu
When devm_gpiod_get_optional() fails, bus should be freed just like when of_mdiobus_register() fails. Fixes: 1bddd96cba03d ("net: arc_emac: support the phy reset for emac driver") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24NFC: st95hf: Fix memleak in st95hf_in_send_cmdDinghao Liu
When down_killable() fails, skb_resp should be freed just like when st95hf_spi_send() fails. Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24Documentation: laptops: thinkpad-acpi: fix underline length build warningRandy Dunlap
Fix underline length build warning in thinkpad-acpi.rst documentation: Documentation/admin-guide/laptops/thinkpad-acpi.rst:1437: WARNING: Title underline too short. DYTC Lapmode sensor ------------------ Fixes: acf7f4a59114 ("platform/x86: thinkpad_acpi: lap or desk mode interface") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://lore.kernel.org/r/7b2ecef9-dfb7-808a-7c05-4e4f44b363c4@infradead.org Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24Documentation: fix typo for abituguru documentationBrandon Jiang
Typo fix for abituguru,abituguru3 and abituguru-datasheet Signed-off-by: Brandon Jiang <brandon.jiang.a@outlook.com> Link: https://lore.kernel.org/r/DM5PR22MB0892E4FEFCA9ED055B0A8E71AC580@DM5PR22MB0892.namprd22.prod.outlook.com Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24docs: Fix function name trailing double-()sKees Cook
I noticed a double-() in the deprecated.rst rendering today. Fix that one and two others in the Documentation/ tree. Acked-by: "Paul E. McKenney" <paulmck@kernel.org> # For RCU Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20200817233207.4083538-1-keescook@chromium.org Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24devices.txt: fix typo of "ubd" as "udb"Theodore Dubois
Signed-off-by: Theodore Dubois <tblodt@icloud.com> Link: https://lore.kernel.org/r/20200816233823.86316-1-tblodt@icloud.com Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24Documentation: add riscv entry in list of existing profilesLukas Bulwahn
As long as there are only a few maintainer entry profiles, i.e., three in v5.8, continue to maintain a complete a list of entries in the maintainer handbook. Complete the list by adding the RISC-V ARCHITECTURE maintainer entry profile found in MAINTAINERS. Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Link: https://lore.kernel.org/r/20200815115728.15128-1-lukas.bulwahn@gmail.com Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24MAINTAINERS: mention documentation maintainer entry profileLukas Bulwahn
Since commit 53b7f3aa411b ("Add a maintainer entry profile for documentation"), the documentation "subsystem" has a maintainer entry profile, and it deserves to be mentioned in MAINTAINERS with a suitable P: entry. Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20200815102658.12236-1-lukas.bulwahn@gmail.com Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24Fpga: Documentation: Replace deprecated :c:func: UsagePuranjay Mohan
Replace :c:func: with func() as the previous usage is deprecated. Signed-off-by: Puranjay Mohan <puranjay12@gmail.com> Link: https://lore.kernel.org/r/20200812180224.24810-1-puranjay12@gmail.com Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24IIO: Documentation: Replace deprecated :c:func: UsagePuranjay Mohan
Replace :c:func: with func() as the previous usage is deprecated. Signed-off-by: Puranjay Mohan <puranjay12@gmail.com> Link: https://lore.kernel.org/r/20200812174611.18580-1-puranjay12@gmail.com Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24Documentation/locking/locktypes: fix local_locks documentationMarta Rybczynska
Fix issues with local_locks documentation: - fix function names, local_lock.h has local_unlock_irqrestore(), not local_lock_irqrestore() - fix mapping table, local_unlock_irqrestore() maps to local_irq_restore(), not _save() Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> Acked-by: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/CAApg2=SKxQ3Sqwj6TZnV-0x0cKLXFKDaPvXT4N15MPDMKq724g@mail.gmail.com Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2020-08-24Merge branch 'MAINTAINERS-Remove-self-from-PHY-LIBRARY'David S. Miller
Florian Fainelli says: ==================== MAINTAINERS: Remove self from PHY LIBRARY This patch series aims at allowing myself to keep track of the Ethernet PHY and MDIO bus drivers that I authored or contributed to without being listed as a maintainer in the PHY library anymore. Thank you for the fish, I will still be around. This builds on top of Andrew's series: https://lore.kernel.org/netdev/20200822180611.2576807-1-andrew@lunn.ch/ ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24MAINTAINERS: Remove self from PHY LIBRARYFlorian Fainelli
My last significant achievements to the PHY library was ensuring we would have small bus factor by having Andrew and Heiner added. The world has moved on past 1G, but I have not, so let more competent maintainers take over. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24MAINTAINERS: Add entry for Broadcom Ethernet PHY driversFlorian Fainelli
Add an entry for the Broadcom Ethernet PHY drivers covering the BCM63xx, BCM7xxx, BCM87xx, BCM54140, BCM84881, the venerable broadcom.c driver and the companion library files. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24MAINTAINERS: GENET: Add UniMAC MDIO controller filesFlorian Fainelli
In preparation for removing myself from the PHYLIB entry, add the UniMAC MDIO controller files (DT binding, driver and platform_data header) to the GENET entry. The UniMAC MDIO controller is essential to the GENET operation, therefore it makes sense to group them together. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-24MAINTAINERS: GENET: Add DT binding fileFlorian Fainelli
When the DT binding was added in aab5127d94e6 ("Documentation: add Device tree bindings for Broadcom GENET"), the file was not explicitly listed under the GENET MAINTAINERS section, do that now. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit (git 2.34.1) at 2025-09-12 14:06:42 +0000