summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2022-11-25media: add nv12_8l128 and nv12_10be_8l128 video format.Ming Qian
add contiguous nv12 tiled format nv12_8l128 and nv12_10be_8l128 Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: v4l: Use memset_after() helperXiu Jianfeng
The CLEAR_AFTER_FIELD defined here is functionally the same as memset_after() helper, so replace it with memset_after() to simplify the code, no functional change in this patch. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: rcar-vin: Add support for Gen3 UDS (Up Down Scaler)Niklas Söderlund
Add support for the UDS (Up Down Scaler) found in some Gen3 SoCs. Not all Gen3 SoCs have scalers, and for those that do it's only available to the master node of each VIN group. The setup for which SoCs and nodes have access to a scaler are dealt with at probe time and then function transparently reusing the schema from the already present Gen2 scaler. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: rcar-vin: Store scaler in a function pointerNiklas Söderlund
The scaler implementation is different between the VIN generations, and not all SoCs have a scaler. Currently only Gen2 scalers are supported. Prepare to add support for more scalers by storing the setup in a function pointer initialized at probe time. While at it move call site to after, instead of before, the generic capture setup, this have no effect on the Gen2 scaler but will be leveraged by the Gen3 scaler. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: rcar-vin: Do not cache remote rectangleNiklas Söderlund
Prepare for scaling support in the media controller part of the driver by not caching the remote rectangle. Mimic the omap3isp and look it up each time it's needed. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25mmc: mmc_test: Fix removal of debugfs fileYe Bin
In __mmc_test_register_dbgfs_file(), we need to assign 'file', as it's being used when removing the debugfs files when the mmc_test module is removed. Fixes: a04c50aaa916 ("mmc: core: no need to check return value of debugfs_create functions") Signed-off-by: Ye Bin <yebin10@huawei.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Cc: stable@vger.kernel.org [Ulf: Re-wrote the commit msg] Link: https://lore.kernel.org/r/20221123095506.1965691-1-yebin@huaweicloud.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2022-11-25Merge branch '100GbE' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-11-23 (ice) This series contains updates to ice driver only. Karol adjusts check of PTP hardware to wait longer but check more often. Brett removes use of driver defined link speed; instead using the values from ethtool.h, utilizing static tables for indexing. Ben adds tracking of stats in order to accumulate reported statistics that were previously reset by hardware. Marcin fixes issues setting RXDID when queues are asymmetric. Anatolii re-introduces use of define over magic number; ICE_RLAN_BASE_S. --- v3: - Dropped, previous, patch 2 v2: Patch 5 - Convert some allocations to non-managed - Remove combined error checking; add error checks for each call - Remove excess NULL checks - Remove unnecessary NULL sets and newlines ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: thunderbolt: Use kmap_local_page() instead of kmap_atomic()Anirudh Venkataramanan
kmap_atomic() is being deprecated in favor of kmap_local_page(). Replace kmap_atomic() and kunmap_atomic() with kmap_local_page() and kunmap_local() respectively. Note that kmap_atomic() disables preemption and page-fault processing, but kmap_local_page() doesn't. When converting uses of kmap_atomic(), one has to check if the code being executed between the map/unmap implicitly depends on page-faults and/or preemption being disabled. If yes, then code to disable page-faults and/or preemption should also be added for functional correctness. That however doesn't appear to be the case here, so just kmap_local_page() is used. Also note that the page being mapped is not allocated by the driver, and so the driver doesn't know if the page is in normal memory. This is the reason kmap_local_page() is used as opposed to page_address(). I don't have hardware, so this change has only been compile tested. Cc: Michael Jamet <michael.jamet@intel.com> Cc: Mika Westerberg <mika.westerberg@linux.intel.com> Cc: Yehezkel Bernat <YehezkelShB@gmail.com> Cc: Ira Weiny <ira.weiny@intel.com> Cc: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25sunvnet: Use kmap_local_page() instead of kmap_atomic()Anirudh Venkataramanan
kmap_atomic() is being deprecated in favor of kmap_local_page(). Replace kmap_atomic() and kunmap_atomic() with kmap_local_page() and kunmap_local() respectively. Note that kmap_atomic() disables preemption and page-fault processing, but kmap_local_page() doesn't. When converting uses of kmap_atomic(), one has to check if the code being executed between the map/unmap implicitly depends on page-faults and/or preemption being disabled. If yes, then code to disable page-faults and/or preemption should also be added for functional correctness. That however doesn't appear to be the case here, so just kmap_local_page() is used. Also note that the page being mapped is not allocated by the driver, and so the driver doesn't know if the page is in normal memory. This is the reason kmap_local_page() is used as opposed to page_address(). I don't have hardware, so this change has only been compile tested. Cc: Ira Weiny <ira.weiny@intel.com> Cc: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25cassini: Use memcpy_from_page() instead of k[un]map_atomic()Anirudh Venkataramanan
kmap_atomic() is being deprecated in favor of kmap_local_page(). Replace the map-memcpy-unmap usage pattern (done using k[un]map_atomic()) with memcpy_from_page(), which internally uses kmap_local_page() and kunmap_local(). This renders the variable 'vaddr' unnecessary, and so remove this too. Note that kmap_atomic() disables preemption and page-fault processing, but kmap_local_page() doesn't. When converting uses of kmap_atomic(), one has to check if the code being executed between the map/unmap implicitly depends on page-faults and/or preemption being disabled. If yes, then code to disable page-faults and/or preemption should also be added for functional correctness. That however doesn't appear to be the case here, so just memcpy_from_page() is used. Also note that the page being mapped is not allocated by the driver, and so the driver doesn't know if the page is in normal memory. This is the reason kmap_local_page() is used (via memcpy_from_page()) as opposed to page_address(). I don't have hardware, so this change has only been compile tested. Cc: Ira Weiny <ira.weiny@intel.com> Cc: Fabio M. De Francesco <fmdefrancesco@gmail.com> Suggested-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25cassini: Use page_address() instead of kmap_atomic()Anirudh Venkataramanan
Pages for Rx buffers are allocated in cas_page_alloc() using either GFP_ATOMIC or GFP_KERNEL. Memory allocated with GFP_KERNEL/GFP_ATOMIC can't come from highmem and so there's no need to kmap() them. Just use page_address() instead. This makes the variable 'addr' unnecessary, so remove it too. Note that kmap_atomic() disables preemption and page-fault processing, but page_address() doesn't. When removing uses of kmap_atomic(), one has to check if the code being executed between the map/unmap implicitly depends on page-faults and/or preemption being disabled. If yes, then code to disable page-faults and/or preemption should also be added for functional correctness. That however doesn't appear to be the case here, so just page_address() is used. I don't have hardware, so this change has only been compile tested. Cc: Ira Weiny <ira.weiny@intel.com> Cc: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25sfc: Use kmap_local_page() instead of kmap_atomic()Anirudh Venkataramanan
kmap_atomic() is being deprecated in favor of kmap_local_page(). Replace kmap_atomic() and kunmap_atomic() with kmap_local_page() and kunmap_local() respectively. Note that kmap_atomic() disables preemption and page-fault processing, but kmap_local_page() doesn't. When converting uses of kmap_atomic(), one has to check if the code being executed between the map/unmap implicitly depends on page-faults and/or preemption being disabled. If yes, then code to disable page-faults and/or preemption should also be added for functional correctness. That however doesn't appear to be the case here, so just kmap_local_page() is used. Also note that the page being mapped is not allocated by the driver, and so the driver doesn't know if the page is in normal memory. This is the reason kmap_local_page() is used as opposed to page_address(). I don't have hardware, so this change has only been compile tested. Cc: Ira Weiny <ira.weiny@intel.com> Cc: Fabio M. De Francesco <fmdefrancesco@gmail.com> Cc: Edward Cree <ecree.xilinx@gmail.com> Cc: Martin Habets <habetsm.xilinx@gmail.com> Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com> Acked-by: Martin Habets <habetsm.xilinx@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25ch_ktls: Use memcpy_from_page() instead of k[un]map_atomic()Anirudh Venkataramanan
kmap_atomic() is being deprecated in favor of kmap_local_page(). Replace the map-memcpy-unmap usage pattern (done using k[un]map_atomic()) with memcpy_from_page(), which internally uses kmap_local_page() and kunmap_local(). This renders the variables 'data' and 'vaddr' unnecessary, and so remove these too. Note that kmap_atomic() disables preemption and page-fault processing, but kmap_local_page() doesn't. When converting uses of kmap_atomic(), one has to check if the code being executed between the map/unmap implicitly depends on page-faults and/or preemption being disabled. If yes, then code to disable page-faults and/or preemption should also be added for functional correctness. That however doesn't appear to be the case here, so just memcpy_from_page() is used. Also note that the page being mapped is not allocated by the driver, and so the driver doesn't know if the page is in normal memory. This is the reason kmap_local_page() is used (via memcpy_from_page()) as opposed to page_address(). I don't have hardware, so this change has only been compile tested. Cc: Ayush Sawal <ayush.sawal@chelsio.com> Cc: Ira Weiny <ira.weiny@intel.com> Cc: Fabio M. De Francesco <fmdefrancesco@gmail.com> Suggested-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com> Acked-by: Ayush Sawal <ayush.sawal@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25pinctrl: loongson2: Fix some const correctnessLinus Walleij
The kernel robot using sparse is complaining like this: drivers/pinctrl/pinctrl-loongson2.c:212:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void *[noderef] __iomem reg @@ (...) I think the problem is simply that the register base is defined as void * __iomem instead of void __iomem * and this is because of the way const correctness works with pointer infix order. Fix it up. I think. Reported-by: kernel test robot <lkp@intel.com> Cc: zhanghongchen <zhanghongchen@loongson.cn> Cc: Yinbo Zhu <zhuyinbo@loongson.cn> Fixes: f73f88acbc18 ("pinctrl: pinctrl-loongson2: add pinctrl driver support") Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2022-11-25net: lan966x: Add support for XDP_REDIRECTHoratiu Vultur
Extend lan966x XDP support with the action XDP_REDIRECT. This is similar with the XDP_TX, so a lot of functionality can be reused. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: lan966x: Add support for XDP_TXHoratiu Vultur
Extend lan966x XDP support with the action XDP_TX. In this case when the received buffer needs to execute XDP_TX, the buffer will be moved to the TX buffers. So a new RX buffer will be allocated. When the TX finish with the frame, it would give back the buffer to the page pool. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: lan966x: Update dma_dir of page_pool_paramsHoratiu Vultur
To add support for XDP_TX it is required to be able to write to the DMA area therefore it is required that the pages will be mapped using DMA_BIDIRECTIONAL flag. Therefore check if there are any xdp programs on the interfaces and in that case set DMA_BIDRECTIONAL otherwise use DMA_FROM_DEVICE. Therefore when a new XDP program is added it is required to redo the page_pool. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: lan966x: Update rxq memory modelHoratiu Vultur
By default the rxq memory model is MEM_TYPE_PAGE_SHARED but to be able to reuse pages on the TX side, when the XDP action XDP_TX it is required to update the memory model to PAGE_POOL. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: lan966x: Add len field to lan966x_tx_dcb_bufHoratiu Vultur
Currently when a frame was transmitted, it is required to unamp the frame that was transmitted. The length of the frame was taken from the transmitted skb. In the future we might not have an skb, therefore store the length skb directly in the lan966x_tx_dcb_buf and use this one to unamp the frame. While at this, also arrange the members in lan966x_tx_dcb_buf not to have any holes. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: lan966x: Introduce helper functionsHoratiu Vultur
Introduce lan966x_fdma_tx_setup_dcb and lan966x_fdma_tx_start functions and use of them inside lan966x_fdma_xmit. There is no functional change in here. They are introduced to be used when XDP_TX/REDIRECT actions are introduced. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: lan966x: Add XDP_PACKET_HEADROOMHoratiu Vultur
Update the page_pool params to allocate XDP_PACKET_HEADROOM space as headroom for all received frames. This is needed for when the XDP_TX and XDP_REDIRECT are implemented. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25ptp: idt82p33: remove PEROUT_ENABLE_OUTPUT_MASKMin Li
PEROUT_ENABLE_OUTPUT_MASK was there to allow us to enable/disable all the perout pins. But it is not standard procedure, we will have to discard it. Signed-off-by: Min Li <min.li.xe@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25ptp: idt82p33: Add PTP_CLK_REQ_EXTTS supportMin Li
82P33 family of chips can trigger TOD read/write by external signal from one of the IN12/13/14 pins, which are set user space programs by calling PTP_PIN_SETFUNC through ptp_ioctl Signed-off-by: Min Li <min.li.xe@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()Baisong Zhong
Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfMGTzMg@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@huawei.com Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver") Reported-by: Wei Chen <harperchen1110@gmail.com> Signed-off-by: Baisong Zhong <zhongbaisong@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-core: Fix ignored return value in dvb_register_frontend()Chen Zhongjin
In dvb_register_frontend(), dvb_register_device() is possible to fail but its return value is ignored. It will cause use-after-free when module is removed, because in dvb_unregister_frontend() it tries to unregister a not registered device. BUG: KASAN: use-after-free in dvb_remove_device+0x18b/0x1f0 [dvb_core] Read of size 4 at addr ffff88800dff4824 by task rmmod/428 CPU: 3 PID: 428 Comm: rmmod Call Trace: <TASK> ... dvb_remove_device+0x18b/0x1f0 [dvb_core] dvb_unregister_frontend+0x7b/0x130 [dvb_core] vidtv_bridge_remove+0x6e/0x160 [dvb_vidtv_bridge] ... Fix this by catching return value of dvb_register_device(). However the fe->refcount can't be put to zero immediately, because there are still modules calling dvb_frontend_detach() when dvb_register_frontend() fails. Link: https://lore.kernel.org/linux-media/20221108033005.169095-1-chenzhongjin@huawei.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-usb: dib0700_devices: Remove unused struct dibx090p_adcYuan Can
After commit 5e9c85d98337("[media] dib8096: enhancement"), no one use struct dibx090p_adc, so remove it. Link: https://lore.kernel.org/linux-media/20220927133827.99097-1-yuancan@huawei.com Signed-off-by: Yuan Can <yuancan@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dib0700: remove orphan dvb_usb_dib0700_ir_proto declarationGaosheng Cui
The dvb_usb_dib0700_ir_proto has been removed by commit 0ffd1ab34a00 ("V4L/DVB: dib0700: properly implement IR change_protocol"), so remove the orphan declaration. Link: https://lore.kernel.org/linux-media/20220920015902.785337-1-cuigaosheng1@huawei.com Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-usb: fix memory leak in dvb_usb_adapter_init()Mazin Al Haddad
Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapter->priv in case of an error. Currently if an error occurs, it will exit before incrementing "num_adapters_initalized", which is used as a reference counter to free all adap->priv in "dvb_usb_adapter_exit()". There are multiple error paths that can exit from before incrementing the counter. Including the error handling paths for "dvb_usb_adapter_stream_init()", "dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()" within "dvb_usb_adapter_init()". This means that in case of an error in any of these functions the current iteration is not accounted for and the current iteration's adap->priv is not freed. Fix this by freeing the current iteration's adap->priv in the "stream_init_err:" label in the error path. The rest of the (accounted for) adap->priv objects are freed in dvb_usb_adapter_exit() as expected using the num_adapters_initalized variable. Syzbot report: BUG: memory leak unreferenced object 0xffff8881172f1a00 (size 512): comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff844af012>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline] [<ffffffff844af012>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline] [<ffffffff844af012>] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308 [<ffffffff830db21d>] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883 [<ffffffff82d3fdc7>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 [<ffffffff8274af6a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782 [<ffffffff8274b786>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899 [<ffffffff82747c87>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [<ffffffff8274b352>] __device_attach+0x122/0x260 drivers/base/dd.c:970 [<ffffffff827498f6>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [<ffffffff82745cdb>] device_add+0x5fb/0xdf0 drivers/base/core.c:3405 [<ffffffff82d3d202>] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170 [<ffffffff82d4dbfc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<ffffffff82d3f49c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.com Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvbdev: adopts refcnt to avoid UAFLin Ma
dvb_unregister_device() is known that prone to use-after-free. That is, the cleanup from dvb_unregister_device() releases the dvb_device even if there are pointers stored in file->private_data still refer to it. This patch adds a reference counter into struct dvb_device and delays its deallocation until no pointer refers to the object. Link: https://lore.kernel.org/linux-media/20220807145952.10368-1-linma@zju.edu.cn Signed-off-by: Lin Ma <linma@zju.edu.cn> Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: media/dvb-frontends: fix repeated words in commentswangjianli
Delete the redundant word 'in'. Link: https://lore.kernel.org/linux-media/20220724073242.15279-1-wangjianli@cdjrlc.com Signed-off-by: wangjianli <wangjianli@cdjrlc.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb_ringbuffer : Fix a bug in dvb_ringbuffer.cYongSu Yoo
The function dvb_ringbuffer_pkt_next in /linux-next/drviers/media/dvb-core/dvb_ringbuffer.c, which searches the idx of the next valid packet in the ring buffer of the ca->slot_info[slot].rx_buffer at /linux-next/drivers/media/dvb-core/dvb_ca_en50221.c, has the following problem. In calculating the amounts of the consumed address of the ring buffer, if the read address(rbuf->pread) of the ring buffer is smaller than the idx, the amounts of the searched address should be (idx - rbuf->pread), whereas if the read address(rbuf->pread) of the ring buffer is larger than the idx, the amounts of the consumed address should be (idx - rbuf->pread + rbug->size). But there exists an incorrect logic that the rbug-size was not properly added on (idx - rbug->pread) in the later case. With this commit, we fixed this bug. Link: https://lore.kernel.org/linux-media/20220623103543.4138-1-yongsuyoo0215@gmail.com Signed-off-by: Yongsu Yoo <yongsuyoo0215@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: mantis: Kconfig: add depends on DVB_CORE for MANTIS_CORELecopzer Chen
MANTIS_CORE needs DVB_CORE, set 'depends on' explicitly ERROR: modpost: "dvb_dmx_init" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_unregister_adapter" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_register_frontend" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_ca_en50221_camchange_irq" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_unregister_frontend" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_ca_en50221_camready_irq" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_frontend_detach" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_dmxdev_release" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_dmx_swfilter" [drivers/media/pci/mantis/mantis_core.ko] undefined! Link: https://lore.kernel.org/linux-media/20220516171515.16404-2-lecopzer.chen@mediatek.com Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-core: Fix double free in dvb_register_device()Keita Suzuki
In function dvb_register_device() -> dvb_register_media_device() -> dvb_create_media_entity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvb_media_device_free(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvb_create_media_entity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in media_device_unregister_entity(). Fix this by storing NULL to dvb->entity when it is freed. Link: https://lore.kernel.org/linux-media/20220426052921.2088416-1-keitasuzuki.park@sslab.ics.keio.ac.jp Fixes: fcd5ce4b3936 ("media: dvb-core: fix a memory leak bug") Cc: stable@vger.kernel.org Cc: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvbdev: remove redundant initialization of variable retColin Ian King
Variable ret is being ininitialized with a value that is never read. The ininitializtion is redundant and can be removed. Move the variable to the scope it is required. Link: https://lore.kernel.org/linux-media/20220424154720.1356873-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-frontends: fix leak of memory fwYan Lei
Link: https://lore.kernel.org/linux-media/20220410061925.4107-1-chinayanlei2002@163.com Signed-off-by: Yan Lei <yan_lei@dahuatech.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-frontends: clean up unneeded elseWan Jiabing
Clean up unneeded 'else'. Link: https://lore.kernel.org/linux-media/20220408092831.45755-1-wanjiabing@vivo.com Signed-off-by: Wan Jiabing <wanjiabing@vivo.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-core: Enhance shared multi-frontend supportRobert Schlabbach
Drivers for devices with multiple frontends which cannot be used concurrently due to hardware limitations which enforce that restriction by setting the mfe_shared field to 1 exhibit rather unfriendly behavior towards applications: The unavailable frontend devices cannot be opened at all, not even for read-only access to query information. Even worse, any open call is blocked for 5 seconds by default. Allow drivers for such devices to behave like regular busy frontend devices instead, i.e. still allowing concurrent read access to the unavailable frontend and denying concurrent write access with -EBUSY without delay. This patch does not alter the behavior of any existing driver to avoid regressions. Driver developers who wish to take advantage of this must ensure their driver can handle all read-only accesses to the unavailable frontend, and indicate the capability by setting the mfe_shared field to 2 instead of 1. Add a check to dvb-usb-init.c when automatically setting the mfe_shared field that when a driver has already set the field to 2, it is not overwritten. Document the additional capability in the code comment about mfe_shared. Link: https://lore.kernel.org/linux-media/trinity-22c77578-26b0-4867-9ff7-2668e5d22c64-1642799929896@3c-app-gmx-bap04 Signed-off-by: Robert Schlabbach <robert_s@gmx.net> Tested-by: Robert Schlabbach <robert_s@gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb_frontend: add missing DSS switch casesRobert Schlabbach
While the documentation mentions the delivery system DSS as a satellite system, it was missing from all but one switch statement in the DVB frontend code, leading to tuning failures, because the frequency was not correctly handled as being in kHz rather than Hz. Add the missing switch cases so that DSS is handled like the other satellite systems. For the rolloff, assume 0.20 as per one publication found via Internet search. Link: https://lore.kernel.org/linux-media/trinity-5f5afda9-657a-4a91-bf15-842f4f249535-1641958421391@3c-app-gmx-bap21 Signed-off-by: Robert Schlabbach <robert_s@gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-frontends: a8293: fix LNB powerup failure in PCTV 461eChuck Ritola
Fixes a8293 failure to raise LNB voltage in PCTV 461e DVB-S2 Stick affecting multiple users over several years as found here: http://www.linuxquestions.org/questions/linux-hardware-18/pctv-dvb-s2-stick-461e-not-feeding-lnb-4175529374/ https://www.linuxtv.org/wiki/index.php/Pinnacle_PCTV_DVB-S2_Stick_(461e) https://github.com/OpenELEC/OpenELEC.tv/issues/3731 Caused by vIN undervoltage lockout (status register bit 7) when raising LNB to 18V. Addressed by using the higher-precision voltages available on the a8293 to gradually increase (slew) the voltage when voltage increases are requested. Adds volt_slew_nanos_per_mv to a8293_platform_data struct for specifying slew rate. If value is <1 or non-sane (>1600), the original no-slew version for a8293_set_voltage is used. Link: https://lore.kernel.org/linux-media/20211231035326.6759-1-cjritola@gmail.com [mchehab: fixed some coding style issues] Signed-off-by: Chuck Ritola <cjritola@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25pinctrl: pinconf-generic: add missing of_node_put()ZhangPeng
of_node_put() needs to be called when jumping out of the loop, since for_each_available_child_of_node() will increase the refcount of node. Fixes: c7289500e29d ("pinctrl: pinconf-generic: scan also referenced phandle node") Signed-off-by: ZhangPeng <zhangpeng362@huawei.com> Link: https://lore.kernel.org/r/20221125070156.3535855-1-zhangpeng362@huawei.com Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2022-11-25net: microchip: sparx5: Add VCAP filter keys KUNIT testSteen Hegelund
This tests the filtering of keys, either dropping unsupported keys or dropping keys specified in a list. Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: microchip: sparx5: Support for displaying a list of keysetsSteen Hegelund
This will display a list of keyset in case the type_id field in the VCAP rule has been wildcarded. Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: microchip: sparx5: Support for TC protocol allSteen Hegelund
This allows support of TC protocol all for the Sparx5 IS2 VCAP. This is done by creating multiple rules that covers the rule size and traffic types in the IS2. Each rule size (e.g X16 and X6) may have multiple keysets and if there are more than one the type field in the VCAP rule will be wildcarded to support these keysets. Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: microchip: sparx5: Support for copying and modifying rules in the APISteen Hegelund
This adds support for making a copy of a rule and modify keys and actions to differentiate the copy. Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: loopback: use NET_NAME_PREDICTABLE for name_assign_typeRasmus Villemoes
When the name_assign_type attribute was introduced (commit 685343fc3ba6, "net: add name_assign_type netdev attribute"), the loopback device was explicitly mentioned as one which would make use of NET_NAME_PREDICTABLE: The name_assign_type attribute gives hints where the interface name of a given net-device comes from. These values are currently defined: ... NET_NAME_PREDICTABLE: The ifname has been assigned by the kernel in a predictable way that is guaranteed to avoid reuse and always be the same for a given device. Examples include statically created devices like the loopback device [...] Switch to that so that reading /sys/class/net/lo/name_assign_type produces something sensible instead of returning -EINVAL. Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: fec: don't reset irq coalesce settings to defaults on "ip link up"Rasmus Villemoes
Currently, when a FEC device is brought up, the irq coalesce settings are reset to their default values (1000us, 200 frames). That's unexpected, and breaks for example use of an appropriate .link file to make systemd-udev apply the desired settings (https://www.freedesktop.org/software/systemd/man/systemd.link.html), or any other method that would do a one-time setup during early boot. Refactor the code so that fec_restart() instead uses fec_enet_itr_coal_set(), which simply applies the settings that are stored in the private data, and initialize that private data with the default values. Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25octeontx2-pf: Fix pfc_alloc_status array overflowSuman Ghosh
This patch addresses pfc_alloc_status array overflow occurring for send queue index value greater than PFC priority. Queue index can be greater than supported PFC priority for multiple scenarios (e.g. QoS, during non zero SMQ allocation for a PF/VF). In those scenarios the API should return default tx scheduler '0'. This is causing mbox errors as otx2_get_smq_idx returing invalid smq value. Fixes: 99c969a83d82 ("octeontx2-pf: Add egress PFC support") Signed-off-by: Suman Ghosh <sumang@marvell.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25net: stmmac: Set MAC's flow control register to reflect current settingsGoh, Wei Sheng
Currently, pause frame register GMAC_RX_FLOW_CTRL_RFE is not updated correctly when 'ethtool -A <IFACE> autoneg off rx off tx off' command is issued. This fix ensures the flow control change is reflected directly in the GMAC_RX_FLOW_CTRL_RFE register. Fixes: 46f69ded988d ("net: stmmac: Use resolved link config in mac_link_up()") Cc: <stable@vger.kernel.org> # 5.10.x Signed-off-by: Goh, Wei Sheng <wei.sheng.goh@intel.com> Signed-off-by: Noor Azura Ahmad Tarmizi <noor.azura.ahmad.tarmizi@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25aquantia: Do not purge addresses when setting the number of ringsIzabela Bakollari
IPV6 addresses are purged when setting the number of rx/tx rings using ethtool -G. The function aq_set_ringparam calls dev_close, which removes the addresses. As a solution, call an internal function (aq_ndev_close). Fixes: c1af5427954b ("net: aquantia: Ethtool based ring size configuration") Signed-off-by: Izabela Bakollari <ibakolla@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-25clk: imx: rename imx_obtain_fixed_clk_hw() to imx_get_clk_hw_by_name()Dario Binacchi
The imx_obtain_fixed_clk_hw name was wrong and misleading. Renaming it to imx_get_clk_hw_by_name clarifies the purpose of the function, and will allow it to be used not only for fixed rate clocks but also in wider contexts. No functional changes intended. The replacements were made with the following command: grep -rl 'imx_obtain_fixed_clk_hw' ./ | \ xargs sed -i 's/imx_obtain_fixed_clk_hw/imx_get_clk_hw_by_name/g' Tested on a BSH SystemMaster (SMM) S2 board. Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com> Reviewed-by: Abel Vesa <abel.vesa@linaro.org> Signed-off-by: Abel Vesa <abel.vesa@linaro.org> Link: https://lore.kernel.org/r/20221113180839.1625832-1-dario.binacchi@amarulasolutions.com