summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2023-10-30drm/ssd130x: Fix possible uninitialized usage of crtc_state variableJavier Martinez Canillas
Avoid a possible uninitialized use of the crtc_state variable in function ssd132x_primary_plane_atomic_check() and avoid the following Smatch warn: drivers/gpu/drm/solomon/ssd130x.c:921 ssd132x_primary_plane_atomic_check() error: uninitialized symbol 'crtc_state'. Fixes: fdd591e00a9c ("drm/ssd130x: Add support for the SSD132x OLED controller family") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/dri-devel/7dd6ca45-8263-44fe-a318-2fd9d761425d@moroto.mountain/ Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Acked-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231020225338.1686974-1-javierm@redhat.com (cherry picked from commit 9e4db199e66d427c50458f4d72734cc4f0b92948) Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2023-10-30Revert "staging: octeon: remove typedef in enum cvmx_spi_mode_t"Greg Kroah-Hartman
This reverts commit 7bebd832177670e6cce1783cf144f989cd3cf4b5. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck <linux@roeck-us.net> Cc: Oliver Crumrine <ozlinux@hotmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-30Revert "staging: octeon: remove typedef in enum cvmx_helper_interface_mode_t"Greg Kroah-Hartman
This reverts commit a13f7e45823cd29af716ed6be1f53a344e0b9268. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck <linux@roeck-us.net> Cc: Oliver Crumrine <ozlinux@hotmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-30Revert "staging: octeon: remove typedef in enum cvmx_pow_wait_t"Greg Kroah-Hartman
This reverts commit 28fae776c69bdac005fa77a7e0daa64725d0f4f8. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck <linux@roeck-us.net> Cc: Oliver Crumrine <ozlinux@hotmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-30Revert "staging: octeon: remove typedef in struct cvmx_pko_lock_t"Greg Kroah-Hartman
This reverts commit 8d26aa90458f82b952dcaa64e7c4afed9c862d68. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck <linux@roeck-us.net> Cc: Oliver Crumrine <ozlinux@hotmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-30Revert "staging: octeon: remove typedef in enum cvmx_pko_status_t"Greg Kroah-Hartman
This reverts commit 4fffe4733cfb08a4c08eca722a8eb819b842c043. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck <linux@roeck-us.net> Cc: Oliver Crumrine <ozlinux@hotmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-30Revert "staging: octeon: remove typedef in structs cvmx_pip_port_status_t ↵Greg Kroah-Hartman
and cvmx_pko_port_status_t" This reverts commit b33a296d831189d8a8eedee360e889509b9c81e6. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck <linux@roeck-us.net> Cc: Oliver Crumrine <ozlinux@hotmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-29hwmon: (aquacomputer_d5next) Check if temp sensors of legacy devices are ↵Aleksa Savic
connected Return -ENODATA if a temp sensor of a legacy device does not contain a reading. Originally-from: Leonard Anderweit <leonard.anderweit@gmail.com> Signed-off-by: Aleksa Savic <savicaleksa83@gmail.com> Link: https://lore.kernel.org/r/20231016083559.139341-2-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2023-10-29hwmon: (aquacomputer_d5next) Add support for Aquacomputer High Flow USB and ↵Aleksa Savic
MPS Flow Extend aquacomputer_d5next driver to expose various hardware sensors of the Aquacomputer High Flow USB flow sensor, which communicates through a proprietary USB HID protocol. This commit also adds support for the sensors of the MPS Flow devices, as they have the same USB product ID and sensor layouts. Implemented by Leonard Anderweit [1]. Internal and external temp sensor readings are available, along with the flow sensor. Additionally, serial number and firmware version are exposed through debugfs. [1] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/pull/90 Originally-from: Leonard Anderweit <leonard.anderweit@gmail.com> Signed-off-by: Aleksa Savic <savicaleksa83@gmail.com> Link: https://lore.kernel.org/r/20231016083559.139341-3-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2023-10-29hwmon: Add driver for ltc2991Antoniu Miclaus
Add support for LTC2991 Octal I2C Voltage, Current, and Temperature Monitor. The LTC2991 is used to monitor system temperatures, voltages and currents. Through the I2C serial interface, the eight monitors can individually measure supply voltages and can be paired for differential measurements of current sense resistors or temperature sensing transistors. Additional measurements include internal temperature and internal VCC. Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com> Link: https://lore.kernel.org/r/20231026103413.27800-2-antoniu.miclaus@analog.com [groeck: Fixed up documentation warning] Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2023-10-29i2c: s3c2410: make i2c_s3c_irq_nextbyte() voidJason Yan
Fix the following coccicheck warning: drivers/i2c/busses/i2c-s3c2410.c:391:5-8: Unneeded variable: "ret". Return "0" on line 552 Signed-off-by: Jason Yan <yanaijie@huawei.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2023-10-29i2c: qcom-geni: add ACPI device id for sc8180xShawn Guo
It adds ACPI device id for sc8180x platform, so that the devices can be probed for ACPI boot. Signed-off-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2023-10-29i2c: sun6i-p2wi: Prevent potential division by zeroAxel Lin
Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The variable set here is later used as a divisor. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2023-10-29i2c: mux: demux-pinctrl: Convert to use sysfs_emit_at() APIye xingchen
Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen <ye.xingchen@zte.com.cn> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> [wsa: proper subject prefix] Signed-off-by: Wolfram Sang <wsa@kernel.org>
2023-10-29watchdog: mlx-wdt: Parameter desctiption warning fixMichael Shych
Add parameter desription to fix warning. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202310241044.lvqeOGli-lkp@intel.com Signed-off-by: Michael Shych <michaelsh@nvidia.com> Signed-off-by: Vadim Pasternak <vadimp@nvidia.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231026082558.12142-1-michaelsh@nvidia.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: aspeed: Add support for aspeed,reset-mask DT propertyZev Weiss
This property allows the device-tree to specify how the Aspeed watchdog timer's reset mask register(s) should be set, so that peripherals can be individually exempted from (or opted in to) being reset when the watchdog timer expires. Signed-off-by: Zev Weiss <zev@bewilderbeest.net> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20230922104231.1434-6-zev@bewilderbeest.net Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: apple: Deactivate on suspendJanne Grunau
The watchdog remains active after putting the system into suspend. Add PM callbacks to deactivate the watchdog on suspend an re-activate it on resume. Signed-off-by: Janne Grunau <j@jannau.net> Reviewed-by: Eric Curtin <ecurtin@redhat.com> Reviewed-by: Neal Gompa <neal@gompa.dev> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231016-apple-watchdog-suspend-v2-1-7ffff8042dbc@jannau.net Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29wdog: imx7ulp: Enable wdog int_en bit for watchdog any resetJacky Bai
The wdog INT_EN bit in CS register should be set to '1' to trigger WDOG_ANY external reset on i.MX93. Signed-off-by: Jacky Bai <ping.bai@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231010081909.2899101-1-ping.bai@nxp.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29drivers: watchdog: marvell_gti: Program the max_hw_heartbeat_msGeorge Cherian
Program the max_hw_heartbeat_ms value so that the watchdog_pretimeout worker is activated. This kernel worker thread makes sure to ping the watchdog in case the userspace is unable to do so. This kernel worker ping will be done only till the full watchdog timeout there by maintaining the watchdog functionality in case of a real hang. Signed-off-by: George Cherian <george.cherian@marvell.com> Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231009044037.514570-2-bbhushan2@marvell.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29drivers: watchdog: marvell_gti: fix zero pretimeout handlingBharat Bhushan
When pretimeout is set to 0 then do not reprogram timer with zero timeout, this will reset device immediately. Also disable interrupt to stop pretimeout notification. Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231009044037.514570-1-bbhushan2@marvell.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: marvell_gti: Replace of_platform.h with explicit includesRob Herring
The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it was merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other and pull in various other headers. In preparation to fix this, adjust the includes for what is actually needed. of_platform.h isn't needed, but of.h was implicitly included by it (via of_device.h). Signed-off-by: Rob Herring <robh@kernel.org> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231010205636.1584480-1-robh@kernel.org Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: imx_sc_wdt: continue if the wdog already enabledJacky Bai
if the wdog is already enabled, and try to enabled it again, we should ignore the error and continue, rather than return error. Signed-off-by: Jacky Bai <ping.bai@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231010074626.2787383-1-ping.bai@nxp.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: st_lpc: Use device_get_match_data()Rob Herring
Use preferred device_get_match_data() instead of of_match_device() to get the driver match data. With this, adjust the includes to explicitly include the correct headers. Signed-off-by: Rob Herring <robh@kernel.org> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231009211356.3242037-18-robh@kernel.org Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: wdat_wdt: Add timeout value as a param in ping methodXing Tong Wu
According to the WDAT spec that states about WATCHDOG_ACTION_SET_COUNTDOWN_PERIOD: "This action is required if WATCHDOG_ACTION_RESET does not explicitly write a new countdown value to a register during a reset." And that implies, WATCHDOG_ACTION_RESET may write a countdown value, thus may come with a WATCHDOG_INSTRUCTION_WRITE_COUNTDOWN, thus need the timeout value as parameter or would otherwise write 0. The watchdog for SIONCT6126 need a entry WATCHDOG_INSTRUCTION_WRITE_COUNTDOWN for WATCHDOG_ACTION_RESET action, I send this patch to support it. Signed-off-by: Xing Tong Wu <xingtong.wu@siemens.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20231007082125.4699-1-xingtong_wu@163.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: gpio_wdt: Make use of device propertiesAndy Shevchenko
Convert the module to be property provider agnostic and allow it to be used on non-OF platforms. Include mod_devicetable.h explicitly to replace the dropped of.h which included mod_devicetable.h indirectly. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20230925123543.2945710-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29sbsa_gwdt: Calculate timeout with 64-bit mathDarren Hart
Commit abd3ac7902fb ("watchdog: sbsa: Support architecture version 1") introduced new timer math for watchdog revision 1 with the 48 bit offset register. The gwdt->clk and timeout are u32, but the argument being calculated is u64. Without a cast, the compiler performs u32 operations, truncating intermediate steps, resulting in incorrect values. A watchdog revision 1 implementation with a gwdt->clk of 1GHz and a timeout of 600s writes 3647256576 to the one shot watchdog instead of 300000000000, resulting in the watchdog firing in 3.6s instead of 600s. Force u64 math by casting the first argument (gwdt->clk) as a u64. Make the order of operations explicit with parenthesis. Fixes: abd3ac7902fb ("watchdog: sbsa: Support architecture version 1") Reported-by: Vanshidhar Konda <vanshikonda@os.amperecomputing.com> Signed-off-by: Darren Hart <darren@os.amperecomputing.com> Cc: Wim Van Sebroeck <wim@linux-watchdog.org> Cc: Guenter Roeck <linux@roeck-us.net> Cc: linux-watchdog@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: <stable@vger.kernel.org> # 5.14.x Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/7d1713c5ffab19b0f3de796d82df19e8b1f340de.1695286124.git.darren@os.amperecomputing.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: ixp4xx: Make sure restart always worksLinus Walleij
The IXP4xx watchdog in early "A0" silicon is unreliable and cannot be registered, however for some systems such as the USRobotics USR8200 the watchdog is the only restart option, so implement a "dummy" watchdog that can only support restart in this case. Fixes: 1aea522809e6 ("watchdog: ixp4xx: Implement restart") Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20230926-ixp4xx-wdt-restart-v2-1-15cf4639b423@linaro.org Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: it87_wdt: add IT8613 IDWerner Fischer
This patch adds watchdog support for the ITE IT8613 watchdog. IT8613 watchdog works in the same way as the other watchdogs supported by it87_wdt. Before this patch, IT8613 watchdog is not supported. After a modprobe, dmesg reports: it87_wdt: Unknown Chip found, Chip 8613 Revision 000c With this patch, modprobe it87_wdt recognizes the watchdog as the dmesg output shows: it87_wdt: Chip IT8613 revision 12 initialized. timeout=60 sec (nowayout=0 testmode=0) Watchdog tests on a LES v4 have been successful, the watchdog works as expected with this patch [1]. [1] https://www.thomas-krenn.com/en/wiki/Watchdog#LES_v4 Signed-off-by: Werner Fischer <devlists@wefi.net> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/3bc0a1c2d768b23a0cd6e9f5fa0c0b5577427668.camel@wefi.net Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29watchdog: marvell_gti_wdt: Fix error code in probe()Dan Carpenter
This error path accidentally returns success. Return -EINVAL instead. Fixes: ef9e7fe2c890 ("Watchdog: Add marvell GTI watchdog driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Bharat Bhushan <bbhushan2@marvell.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/af326fd7-ac71-43a1-b7de-81779b61d242@moroto.mountain Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2023-10-29Input: walkera0701 - use module_parport_driver macro to simplify the codeLi Zetao
Use the module_parport_driver macro to simplify the code, which is the same as declaring with module_init() and module_exit(). Signed-off-by: Li Zetao <lizetao1@huawei.com> Link: https://lore.kernel.org/r/20230815080107.1089401-1-lizetao1@huawei.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2023-10-29Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()Dan Carpenter
The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mountain Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2023-10-28ubi: block: Fix use-after-free in ubiblock_cleanupZhaoLong Wang
The following BUG is reported when a ubiblock is removed: ================================================================== BUG: KASAN: slab-use-after-free in ubiblock_cleanup+0x88/0xa0 [ubi] Read of size 4 at addr ffff88810c8f3804 by task ubiblock/1716 CPU: 5 PID: 1716 Comm: ubiblock Not tainted 6.6.0-rc2+ #135 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x37/0x50 print_report+0xd0/0x620 kasan_report+0xb6/0xf0 ubiblock_cleanup+0x88/0xa0 [ubi] ubiblock_remove+0x121/0x190 [ubi] vol_cdev_ioctl+0x355/0x630 [ubi] __x64_sys_ioctl+0xc7/0x100 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7f08d7445577 Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 8 RSP: 002b:00007ffde05a3018 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f08d7445577 RDX: 0000000000000000 RSI: 0000000000004f08 RDI: 0000000000000003 RBP: 0000000000816010 R08: 00000000008163a7 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000206 R12: 0000000000000003 R13: 00007ffde05a3130 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 1715: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x7f/0x90 __alloc_disk_node+0x40/0x2b0 __blk_mq_alloc_disk+0x3e/0xb0 ubiblock_create+0x2ba/0x620 [ubi] vol_cdev_ioctl+0x581/0x630 [ubi] __x64_sys_ioctl+0xc7/0x100 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 0: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 __kasan_slab_free+0x10e/0x190 __kmem_cache_free+0x96/0x220 bdev_free_inode+0xa4/0xf0 rcu_core+0x496/0xec0 __do_softirq+0xeb/0x384 The buggy address belongs to the object at ffff88810c8f3800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 4 bytes inside of freed 1024-byte region [ffff88810c8f3800, ffff88810c8f3c00) The buggy address belongs to the physical page: page:00000000d03de848 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c8f0 head:00000000d03de848 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000840(slab|head|node=0|zone=2) page_type: 0xffffffff() raw: 0200000000000840 ffff888100042dc0 ffffea0004244400 dead000000000002 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88810c8f3700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88810c8f3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88810c8f3800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88810c8f3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88810c8f3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fix it by using a local variable to record the gendisk ID. Fixes: 77567b25ab9f ("ubi: use blk_mq_alloc_disk and blk_cleanup_disk") Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Add control in 'UBI_IOCATT' ioctl to reserve PEBs for filling ↵Zhihao Cheng
pools This patch imports a new field 'need_resv_pool' in struct 'ubi_attach_req' to control whether or not reserving free PEBs for filling pool/wl_pool. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Add module parameter to control reserving filling pool PEBsZhihao Cheng
Adding 6th module parameter in 'mtd=xxx' to control whether or not reserving PEBs for filling pool/wl_pool. Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Fix lapsed wear leveling for first 64 PEBsZhihao Cheng
The anchor PEB must be picked from first 64 PEBs, these PEBs could have large erase counter greater than other PEBs especially when free space is nearly running out. The ubi_update_fastmap will be called as long as pool/wl_pool is empty, old anchor PEB is erased when updating fastmap. Given an UBI device with N PEBs, free PEBs is nearly running out and pool will be filled with 1 PEB every time ubi_update_fastmap invoked. So t=N/POOL_SIZE[1]/64 means that in worst case the erase counter of first 64 PEBs is t times greater than other PEBs in theory. After running fsstress for 24h, the erase counter statistics for two UBI devices shown as follow(CONFIG_MTD_UBI_WL_THRESHOLD=128): Device A(1024 PEBs, pool=50, wl_pool=25): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 0 0 0 0 10000 .. 99999: 960 29224 29282 29362 100000 .. inf: 64 117897 117934 117940 --------------------------------------------------------- Total : 1024 29224 34822 117940 Device B(8192 PEBs, pool=256, wl_pool=128): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 8128 2253 2321 2387 10000 .. 99999: 64 35387 35387 35388 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 8192 2253 2579 35388 The key point is reducing fastmap updating frequency by enlarging POOL_SIZE, so let UBI reserve ubi->fm_pool.max_size PEBs during attaching. Then POOL_SIZE will become ubi->fm_pool.max_size/2 even in free space running out case. Given an UBI device with 8192 PEBs(16384\8192\4096 is common large-capacity flash), t=8192/128/64=1. The fastmap updating will happen in either wl_pool or pool is empty, so setting fm_pool_rsv_cnt as ubi->fm_pool.max_size can fill wl_pool in full state. After pool reservation, running fsstress for 24h: Device A(1024 PEBs, pool=50, wl_pool=25): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 0 0 0 0 10000 .. 99999: 1024 33801 33997 34056 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 1024 33801 33997 34056 Device B(8192 PEBs, pool=256, wl_pool=128): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 8192 2205 2397 2460 10000 .. 99999: 0 0 0 0 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 8192 2205 2397 2460 The difference of erase counter between first 64 PEBs and others is under WL_FREE_MAX_DIFF(2*UBI_WL_THRESHOLD=2*128=256). Device A: 34056 - 33801 = 255 Device B: 2460 - 2205 = 255 Next patch will add a switch to control whether UBI needs to reserve PEBs for filling pool. Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Get wl PEB even ec beyonds the 'max' if free PEBs are run outZhihao Cheng
This is the part 2 to fix cyclically reusing single fastmap data PEBs. Consider one situation, if there are four free PEBs for fm_anchor, pool, wl_pool and fastmap data PEB with erase counter 100, 100, 100, 5096 (ubi->beb_rsvd_pebs is 0). PEB with erase counter 5096 is always picked for fastmap data according to the realization of find_wl_entry(), since fastmap data PEB is not scheduled for wl, finally there are two PEBs (fm data) with great erase counter than other PEBS. Get wl PEB even its erase counter exceeds the 'max' in find_wl_entry() when free PEBs are run out after filling pools and fm data. Then the PEB with biggest erase conter is taken as wl PEB, it can be scheduled for wl. Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: may_reserve_for_fm: Don't reserve PEB if fm_anchor existsZhihao Cheng
This is the part 1 to fix cyclically reusing single fastmap data PEBs. After running fsstress on UBIFS for a while, UBI (16384 blocks, fastmap takes 2 blocks) has an erase block(PEB: 8031) with big erase counter greater than any other pebs: ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 532 84 92 99 100 .. 999: 15787 100 147 229 1000 .. 9999: 64 4699 4765 4826 10000 .. 99999: 0 0 0 0 100000 .. inf: 1 272935 272935 272935 --------------------------------------------------------- Total : 16384 84 180 272935 Not like fm_anchor, there is no candidate PEBs for fastmap data area, so old fastmap data pebs will be reused after all free pebs are filled into pool/wl_pool: ubi_update_fastmap for (i = 1; i < new_fm->used_blocks; i++) erase_block(ubi, old_fm->e[i]->pnum) new_fm->e[i] = old_fm->e[i] According to wear leveling algorithm, UBI selects one small erase counter PEB from ubi->used and one big erase counter PEB from wl_pool, the reused fastmap data PEB is not in these trees. UBI won't schedule this PEB for wl even it is in ubi->used because wl algorithm expects small erase counter for used PEB. Don't reserve PEB for fastmap in may_reserve_for_fm() if fm_anchor already exists. Otherwise, when UBI is running out of free PEBs, the only one free PEB (pnum < 64) will be skipped and fastmap data will be written on the same old PEB. Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Remove unneeded break condition while filling poolsZhihao Cheng
Change pool filling stop condition. Commit d09e9a2bddba ("ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty") reserves fastmap data PEBs after filling 1 PEB in wl_pool. Now wait_free_pebs_for_pool() makes enough free PEBs before filling pool, there will still be at least 1 PEB in pool and 1 PEB in wl_pool after doing ubi_refill_pools(). Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Wait until there are enough free PEBs before filling poolsZhihao Cheng
Wait until there are enough free PEBs before filling pool/wl_pool, sometimes erase_worker is not scheduled in time, which causes two situations: A. There are few PEBs filled in pool, which makes ubi_update_fastmap is frequently called and leads first 64 PEBs are erased more times than other PEBs. So waiting free PEBs before filling pool reduces fastmap updating frequency and prolongs flash service life. B. In situation that space is nearly running out, ubi_refill_pools() cannot make sure pool and wl_pool are filled with free PEBs, caused by the delay of erase_worker. After this patch applied, there must exist free PEBs in pool after one call of ubi_update_fastmap. Besides, this patch is a preparetion for fixing large erase counter in fastmap data block and fixing lapsed wear leveling for first 64 PEBs. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Use free pebs reserved for bad block handlingZhihao Cheng
If new bad PEBs occur, UBI firstly consumes ubi->beb_rsvd_pebs, and then ubi->avail_pebs, finally UBI becomes read-only if above two items are 0, which means that the amount of PEBs for user volumes is not effected. Besides, UBI reserves count of free PBEs is ubi->beb_rsvd_pebs while filling wl pool or getting free PEBs, but ubi->avail_pebs is not reserved. So ubi->beb_rsvd_pebs and ubi->avail_pebs have nothing to do with the usage of free PEBs, UBI can use all free PEBs. Commit 78d6d497a648 ("UBI: Move fastmap specific functions out of wl.c") has removed beb_rsvd_pebs checking while filling pool. Now, don't reserve ubi->beb_rsvd_pebs while filling wl_pool. This will fill more PEBs in pool and also reduce fastmap updating frequency. Also remove beb_rsvd_pebs checking in ubi_wl_get_fm_peb. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: Replace erase_block() with sync_erase()Zhihao Cheng
Since erase_block() has same logic with sync_erase(), just replace it with sync_erase(), also rename 'sync_erase()' to 'ubi_sync_erase()'. Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmapZhihao Cheng
Function ubi_update_fastmap could be called in IO context, for example: ubifs_writepage do_writepage ubifs_jnl_write_data write_head ubifs_wbuf_write_nolock ubifs_leb_write ubi_leb_write ubi_eba_write_leb try_write_vid_and_data ubi_wl_get_peb ubi_update_fastmap erase_block So it's better to allocate memory with GFP_NOFS mode, in case waiting page writeback(dead loop). Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flashZhihao Cheng
Just like sync_erase() does, getting erase counter from wl_entry is faster than reading from flash. Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28ubi: fastmap: Fix missed ec updating after erasing old fastmap data blockZhihao Cheng
After running fsstress on ubifs for a long time, UBI(16384 blocks, fastmap takes 2 blocks) has an erase block with different erase counters displayed from two views: From ubiscan view: PEB 8031 has erase counter 31581 ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 16383 290 315 781 1000 .. 9999: 0 0 0 0 10000 .. 99999: 1 31581 31581 31581 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 16384 290 317 31581 From detailed_erase_block_info view: PEB 8031 has erase counter 7 physical_block_number erase_count 8030 421 8031 7 # mem info is different from disk info 8032 434 8033 425 8034 431 Following process missed updating erase counter in wl_entry(in memory): ubi_update_fastmap for (i = 1; i < new_fm->used_blocks; i++) // update fastmap data if (!tmp_e) if (old_fm && old_fm->e[i]) erase_block(ubi, old_fm->e[i]->pnum) ret = ubi_io_sync_erase(ubi, pnum, 0) ec = be64_to_cpu(ec_hdr->ec) ec += ret ec_hdr->ec = cpu_to_be64(ec) ubi_io_write_ec_hdr(ubi, pnum, ec_hdr) // ec is updated on flash // ec is not updated in old_fm->e[i] (in memory) Fix it by passing wl_enter into erase_block() and updating erase counter in erase_block(). Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28Merge branch 'pci/misc'Bjorn Helgaas
- Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device so dwc3 can claim it instead (Vicki Pfau) - Make pci_assign_unassigned_resources() non-init because sparc uses it after init-time (Randy Dunlap) - Remove logic_outb(), _outw(), outl() duplicate declarations (John Sanpe) - Remove unnecessary UTF-8 in Kconfig help text that confuses menuconfig (Liu Song) - Fix double free in __pci_epc_create() (Dan Carpenter) - Simplify pcie_capability_clear_and_set_word() cases that could be pcie_capability_clear_word() (Ilpo Järvinen) * pci/misc: PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() PCI: endpoint: Fix double free in __pci_epc_create() PCI: Replace unnecessary UTF-8 in Kconfig logic_pio: Remove logic_outb(), _outw(), outl() duplicate declarations PCI: Make pci_assign_unassigned_resources() non-init PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
2023-10-28Merge branch 'pci/field-get'Bjorn Helgaas
- Use FIELD_GET()/FIELD_PREP() when possible throughout drivers/pci/ (Ilpo Järvinen, Bjorn Helgaas) - Rework DPC control programming for clarity (Ilpo Järvinen) * pci/field-get: PCI/portdrv: Use FIELD_GET() PCI/VC: Use FIELD_GET() PCI/PTM: Use FIELD_GET() PCI/PME: Use FIELD_GET() PCI/ATS: Use FIELD_GET() PCI/ATS: Show PASID Capability register width in bitmasks PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk PCI: Use FIELD_GET() PCI/MSI: Use FIELD_GET/PREP() PCI/DPC: Use defines with DPC reason fields PCI/DPC: Use defined fields with DPC_CTL register PCI/DPC: Use FIELD_GET() PCI: hotplug: Use FIELD_GET/PREP() PCI: dwc: Use FIELD_GET/PREP() PCI: cadence: Use FIELD_GET() PCI: Use FIELD_GET() to extract Link Width PCI: mvebu: Use FIELD_PREP() with Link Width PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields # Conflicts: # drivers/pci/controller/dwc/pcie-tegra194.c
2023-10-28Merge branch 'pci/config-errs'Bjorn Helgaas
- Simplify config accessor error checking (Ilpo Järvinen) * pci/config-errs: scsi: ipr: Do PCI error checks on own line PCI: xgene: Do PCI error check on own line & keep return value PCI: Do error check on own line to split long "if" conditions atm: iphase: Do PCI error checks on own line sh: pci: Do PCI error check on own line alpha: Streamline convoluted PCI error handling
2023-10-28Merge branch 'pci/controller/xilinx-xdma'Bjorn Helgaas
- Move Xilinx IRQ definitions to a common header shared by pcie-xilinx-cpm and xilinx-xdma (Thippeswamy Havalige) - Add Xilinx XDMA driver and DT schema (Thippeswamy Havalige) * pci/controller/xilinx-xdma: PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver dt-bindings: PCI: xilinx-xdma: Add schemas for Xilinx XDMA PCIe Root Port Bridge PCI: xilinx-cpm: Move IRQ definitions to a common header
2023-10-28Merge branch 'pci/controller/xilinx-ecam'Bjorn Helgaas
- Drop xilinx-nwl updates of bridge bus number fields, since PCI core already does that (Thippeswamy Havalige) - Update xilinx-nwl driver and ECAM size in devicetree example to allow up to 256 buses (Thippeswamy Havalige) * pci/controller/xilinx-ecam: PCI: xilinx-nwl: Modify ECAM size to enable support for 256 buses PCI: xilinx-nwl: Rename the NWL_ECAM_VALUE_DEFAULT macro dt-bindings: PCI: xilinx-nwl: Modify ECAM size in the DT example PCI: xilinx-nwl: Remove redundant code that sets Type 1 header fields
2023-10-28Merge branch 'pci/controller/vmd'Bjorn Helgaas
- Fix space/tab whitespace issue (Xinghui Li) * pci/controller/vmd: PCI: vmd: Fix inconsistent indentation in vmd_resume()