summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2020-03-27net/mlx5: Add support for RDMA TX steeringMichael Guralnik
Add new RDMA TX flow steering namespace. Flow steering rules in this namespace are used to filter transmitted RDMA traffic. Link: https://lore.kernel.org/r/20200324061425.1570190-2-leon@kernel.org Signed-off-by: Michael Guralnik <michaelgur@mellanox.com> Reviewed-by: Maor Gottlieb <maorg@mellanox.com> Reviewed-by: Mark Bloch <markb@mellanox.com> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27block: simplify queue allocationChristoph Hellwig
Current make_request based drivers use either blk_alloc_queue_node or blk_alloc_queue to allocate a queue, and then set up the make_request_fn function pointer and a few parameters using the blk_queue_make_request helper. Simplify this by passing the make_request pointer to blk_alloc_queue, and while at it merge the _node variant into the main helper by always passing a node_id, and remove the superfluous gfp_mask parameter. A lower-level __blk_alloc_queue is kept for the blk-mq case. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-27bcache: pass the make_request methods to blk_queue_make_requestChristoph Hellwig
bcache is the only driver not actually passing its make_request methods to blk_queue_make_request, but instead just sets them up manually a little later. Make bcache follow the common way of setting up make_request based queues. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-27null_blk: use blk_mq_init_queue_dataChristoph Hellwig
Use the new blk_mq_init_queue_data instead of open coding the queue allocation and initialization. Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-27Merge tag 'drm-fixes-2020-03-27' of git://anongit.freedesktop.org/drm/drmLinus Torvalds
Pull drm fixes from Dave Airlie: "Pretty quiet: some minor sg mapping fixes for 3 drivers, and a single oops fix for the scheduler. I'm hoping nobody tries to send me a fixes pull today but I'll keep an eye out of the weekend. radeon/amdgpu/dma-buf: - sg list fixes scheduler: - oops fix" * tag 'drm-fixes-2020-03-27' of git://anongit.freedesktop.org/drm/drm: drm/scheduler: fix rare NULL ptr race drm/radeon: fix scatter-gather mapping with user pages drm/amdgpu: fix scatter-gather mapping with user pages drm/prime: use dma length macro when mapping sg
2020-03-27IB/hfi1: Call kobject_put() when kobject_init_and_add() failsKaike Wan
When kobject_init_and_add() returns an error in the function hfi1_create_port_files(), the function kobject_put() is not called for the corresponding kobject, which potentially leads to memory leak. This patch fixes the issue by calling kobject_put() even if kobject_init_and_add() fails. Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200326163813.21129.44280.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Kaike Wan <kaike.wan@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27IB/hfi1: Fix memory leaks in sysfs registration and unregistrationKaike Wan
When the hfi1 driver is unloaded, kmemleak will report the following issue: unreferenced object 0xffff8888461a4c08 (size 8): comm "kworker/0:0", pid 5, jiffies 4298601264 (age 2047.134s) hex dump (first 8 bytes): 73 64 6d 61 30 00 ff ff sdma0... backtrace: [<00000000311a6ef5>] kvasprintf+0x62/0xd0 [<00000000ade94d9f>] kobject_set_name_vargs+0x1c/0x90 [<0000000060657dbb>] kobject_init_and_add+0x5d/0xb0 [<00000000346fe72b>] 0xffffffffa0c5ecba [<000000006cfc5819>] 0xffffffffa0c866b9 [<0000000031c65580>] 0xffffffffa0c38e87 [<00000000e9739b3f>] local_pci_probe+0x41/0x80 [<000000006c69911d>] work_for_cpu_fn+0x16/0x20 [<00000000601267b5>] process_one_work+0x171/0x380 [<0000000049a0eefa>] worker_thread+0x1d1/0x3f0 [<00000000909cf2b9>] kthread+0xf8/0x130 [<0000000058f5f874>] ret_from_fork+0x35/0x40 This patch fixes the issue by: - Releasing dd->per_sdma[i].kobject in hfi1_unregister_sysfs(). - This will fix the memory leak. - Calling kobject_put() to unwind operations only for those entries in dd->per_sdma[] whose operations have succeeded (including the current one that has just failed) in hfi1_verbs_register_sysfs(). Cc: <stable@vger.kernel.org> Fixes: 0cb2aa690c7e ("IB/hfi1: Add sysfs interface for affinity setup") Link: https://lore.kernel.org/r/20200326163807.21129.27371.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Kaike Wan <kaike.wan@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27IB/mlx5: Move to fully dynamic UAR mode once user space supports itYishai Hadas
Move to fully dynamic UAR mode once user space supports it. In this case we prevent any legacy mode of UARs on the allocated context and prevent redundant allocation of the static ones. Link: https://lore.kernel.org/r/20200324060143.1569116-6-leon@kernel.org Signed-off-by: Yishai Hadas <yishaih@mellanox.com> Reviewed-by: Michael Guralnik <michaelgur@mellanox.com> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27IB/mlx5: Limit the scope of struct mlx5_bfreg_info to mlx5_ibLeon Romanovsky
struct mlx5_bfreg_info is used by mlx5_ib only but is exposed to both RDMA and netdev parts of mlx5 driver. Move that struct to mlx5_ib namespace, clean vertical space alignment and convert lib_uar_4k from bool to bitfield. Link: https://lore.kernel.org/r/20200324060143.1569116-5-leon@kernel.org Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27IB/mlx5: Extend QP creation to get uar page index from user spaceYishai Hadas
Extend QP creation to get uar page index from user space, this mode can be used with the UAR dynamic mode APIs to allocate/destroy a UAR object. As part of enabling this option blocked the weird/un-supported cross channel option which uses index 0 hard-coded. This QP flag wasn't exposed to user space as part of any formal upstream release, the dynamic option can allow having valid UAR page index instead. Link: https://lore.kernel.org/r/20200324060143.1569116-4-leon@kernel.org Signed-off-by: Yishai Hadas <yishaih@mellanox.com> Reviewed-by: Michael Guralnik <michaelgur@mellanox.com> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27IB/mlx5: Extend CQ creation to get uar page index from user spaceYishai Hadas
Extend CQ creation to get uar page index from user space, this mode can be used with the UAR dynamic mode APIs to allocate/destroy a UAR object. Link: https://lore.kernel.org/r/20200324060143.1569116-3-leon@kernel.org Signed-off-by: Yishai Hadas <yishaih@mellanox.com> Reviewed-by: Michael Guralnik <michaelgur@mellanox.com> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27IB/mlx5: Expose UAR object and its alloc/destroy commandsYishai Hadas
Expose UAR object and its alloc/destroy commands to be used over the ioctl interface by user space applications. This API supports both BF & NC modes and enables a dynamic allocation of UARs once really needed. As the number of driver objects were limited by the core ones when the merged tree is prepared, had to decrease the number of core objects to enable the new UAR object usage. Link: https://lore.kernel.org/r/20200324060143.1569116-2-leon@kernel.org Signed-off-by: Yishai Hadas <yishaih@mellanox.com> Reviewed-by: Michael Guralnik <michaelgur@mellanox.com> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27Merge branch 'spi-5.7' into spi-nextMark Brown
2020-03-27spi: efm32: Convert to use GPIO descriptorsLinus Walleij
This switches the EFM32 driver over to use the GPIO descriptor handling in the core. The GPIO handling in this driver is pretty simplistic so this should just work. Drop the GPIO headers and insert the implicitly included <linux/of.h> header. Signed-off-by: Linus Walleij <linus.walleij-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org> Cc: Uwe Kleine-König <u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ@public.gmane.org> Link: https://lore.kernel.org/r/20200317094914.331932-1-linus.walleij@linaro.org Signed-off-by: Mark Brown <broonie@kernel.org>
2020-03-27IB/hfi1: Get rid of a warningMauro Carvalho Chehab
The right markup for a variable is @foo, and not @foo[]. Using a wrong markup caused this warning: ./drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.h:243: WARNING: Inline strong start-string without end-string. Link: https://lore.kernel.org/r/9dce702510505556d75a13d9641e09218a4b4a65.1584456635.git.mchehab+huawei@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-27block: move the ->devnode callback to struct block_device_operationsChristoph Hellwig
There really isn't any good reason to stash a method directly into struct gendisk. Move it together with the other block device operations. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-27USB: cdc-acm: restore capability check orderMatthias Reichl
commit b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") introduced a regression by changing the order of capability and close settings change checks. When running with CAP_SYS_ADMIN setting the close settings to the values already set resulted in -EOPNOTSUPP. Fix this by changing the check order back to how it was before. Fixes: b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") Cc: Anthony Mallet <anthony.mallet@laas.fr> Cc: stable <stable@vger.kernel.org> Cc: Oliver Neukum <oneukum@suse.com> Signed-off-by: Matthias Reichl <hias@horus.com> Link: https://lore.kernel.org/r/20200327150350.3657-1-hias@horus.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-27Revert "driver core: Set fw_devlink to "permissive" behavior by default"Greg Kroah-Hartman
This reverts commit c442a0d18744d4a5857d513f171d68ed6a54df5b as it breaks some of the Raspberry Pi devices. Marek writes: This patch has just landed in linux-next 20200326. Sadly it breaks booting of the Raspberry Pi3b and Pi4 boards, either in 32bit or 64bit mode. There is no warning nor panic message, just a silent freeze. The last message shown on the earlycon is: [    0.893217] Serial: 8250/16550 driver, 1 ports, IRQ sharing enabled so revert it for now and let's try again and add it to linux-next after 5.7-rc1 is out so that we can try to get more debugging/testing happening. Reported-by: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Rob Herring <robh+dt@kernel.org> Cc: Frank Rowand <frowand.list@gmail.com> Cc: Saravana Kannan <saravanak@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-27serial: 8250: Optimize irq enable after console writeLukas Wunner
Commit 7f9803072ff6 ("serial: 8250: Support console on software emulated rs485 ports") amended serial8250_console_write() with rs485 support, but positioned the invocation of ->rs485_stop_tx() after re-enablement of interrupts. The irq handler and ->console_write() are serialized with the port spinlock, so no problem there, but due to the rs485 delay, the irq handler may unnecessarily spin for a while. Avoid that by moving ->rs485_stop_tx() before re-enablement of interrupts, which also mirrors the order at the beginning of serial8250_console_write(). Signed-off-by: Lukas Wunner <lukas@wunner.de> Link: https://lore.kernel.org/r/019839cb1f61b01210b6ff9ac9f9079ca77f8411.1585319447.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-27serial: 8250: Fix rs485 delay after console writeLukas Wunner
Due to a silly copy-paste mistake, commit 7f9803072ff6 ("serial: 8250: Support console on software emulated rs485 ports") erroneously pauses for the duration of delay_rts_before_send after writing to the console, instead of delay_rts_after_send. Mea culpa. Fixes: 7f9803072ff6 ("serial: 8250: Support console on software emulated rs485 ports") Signed-off-by: Lukas Wunner <lukas@wunner.de> Link: https://lore.kernel.org/r/9dd67f33c90d23f7fafa3b81b1e812ddabf9ca24.1585319447.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-27PCI: dwc: pci-dra7xx: Fix MSI IRQ handlingVignesh Raghavendra
Due to an issue with PCIe wrapper logic built for the DWC PCIe IP on dra7xx, the driver needs to ensure that there are no pending MSI IRQ vector set (i.e PCIE_MSI_INTR0_STATUS reads 0 at least once) before exiting IRQ handler otherwise the dra7xx PCIe wrapper will not register new MSI IRQs even though PCIE_MSI_INTR0_STATUS reports IRQs are pending. Therefore it's no longer possible to use default IRQ handler provided by DWC library. Add an irqchip implementation inside pci-dra7xx.c and install new MSI IRQ handler to handle the above errata. This fixes a bug, where PCIe wifi cards with 4 DMA queues like Intel 8260 used to throw following error and stall during ping/iperf3 tests. [ 97.776310] iwlwifi 0000:01:00.0: Queue 9 stuck for 2500 ms. Tested-by: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
2020-03-27Merge tag 'scmi-updates-5.7' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/drivers ARM SCMI/SCPI updates for v5.7 1. Abstraction of the scmi transport type from the core protocol driver which enables addition of other transports like SMC/HVC, SPCI and virtio apart from the existing mailbox 2. Miscellaneous fix for minor formatting issues with the kernel-doc style comments 3. Replacement of zero-length array with flexible-array member which is part of tree-wide cleanup * tag 'scmi-updates-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: misc: vexpress: Replace zero-length array with flexible-array member firmware: arm_scpi: Replace zero-length array with flexible-array member firmware: arm_scmi/perf: Replace zero-length array with flexible-array member firmware: arm_scmi: Replace zero-length array with flexible-array member firmware: arm_scmi: Make scmi core independent of the transport type firmware: arm_scmi: Move macros and helpers to common.h firmware: arm_scmi: Update doc style comments Link: https://lore.kernel.org/r/20200304175247.GA5402@bogus Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2020-03-27Merge tag 'tee-cleanup-for-5.7' of ↵Arnd Bergmann
https://git.linaro.org/people/jens.wiklander/linux-tee into arm/drivers Cleanup shared memory handing in TEE subsystem The highlights are: - Removing redundant or unused fields in struct tee_shm - Only assign userspace shm IDs for shared memory objects originating from user space * tag 'tee-cleanup-for-5.7' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: tee_shm_op_mmap(): use TEE_SHM_USER_MAPPED tee: remove redundant teedev in struct tee_shm tee: don't assign shm id for private shms tee: remove unused tee_shm_priv_alloc() tee: remove linked list of struct tee_shm Link: https://lore.kernel.org/r/20200228140925.GA12393@jade Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2020-03-27Merge tag 'soc-fsl-next-v5.7' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/leo/linux into arm/drivers NXP/FSL SoC driver updates for v5.7 DPAA2 DPIO driver performance optimization - Add and use QMAN multiple enqueue interface - Use function pointer indirection to replace checks in hotpath QUICC Engine drivers - Fix sparse warnings and exposed endian issues * tag 'soc-fsl-next-v5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/leo/linux: soc: fsl: qe: fix sparse warnings for ucc_slow.c soc: fsl: qe: ucc_slow: remove 0 assignment for kzalloc'ed structure soc: fsl: qe: fix sparse warnings for ucc_fast.c soc: fsl: qe: fix sparse warnings for qe_ic.c soc: fsl: qe: fix sparse warnings for ucc.c soc: fsl: qe: fix sparse warning for qe_common.c soc: fsl: qe: fix sparse warnings for qe.c soc: fsl: dpio: fix dereference of pointer p before null check soc: fsl: dpio: Replace QMAN array mode with ring mode enqueue soc: fsl: dpio: QMAN performance improvement with function pointer indirection soc: fsl: dpio: Adding QMAN multiple enqueue interface Link: https://lore.kernel.org/r/20200326001257.22696-1-leoyang.li@nxp.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2020-03-27drm/vc4: Fix HDMI mode validationNicolas Saenz Julienne
Current mode validation impedes setting up some video modes which should be supported otherwise. Namely 1920x1200@60Hz. Fix this by lowering the minimum HDMI state machine clock to pixel clock ratio allowed. Fixes: 32e823c63e90 ("drm/vc4: Reject HDMI modes with too high of clocks.") Reported-by: Stefan Wahren <stefan.wahren@i2se.com> Suggested-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> Signed-off-by: Maxime Ripard <maxime@cerno.tech> Link: https://patchwork.freedesktop.org/patch/msgid/20200326122001.22215-1-nsaenzjulienne@suse.de
2020-03-27mmc: cavium-octeon: remove nonsense variable coercionTang Bin
In this function, the variable 'base' is already 'void __iomem *base', and the return function 'devm_platform_ioremap_resource()' also returns this type, so the mandatory definition here is redundant. Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com> Link: https://lore.kernel.org/r/20200327043639.6564-1-tangbin@cmss.chinamobile.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2020-03-27mmc: mediatek: fix SDIO irq issueyong mao
SDIO irq is not triggered by low level, but by falling edge in our previous IC. This mechanism only have one chance to catch the SDIO irq if a SDIO irq comes within the multiple block transmission. This SDIO irq may be easily lost, because falling edge appears only once within 2 clock after data transmission is completed. SDIO irq recheck mechanism will make sure all irqs can be processed correctly. Signed-off-by: Yong Mao <yong.mao@mediatek.com> Link: https://lore.kernel.org/r/1585299097-6897-2-git-send-email-yong.mao@mediatek.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2020-03-27vt: vt_ioctl: fix use-after-free in vt_in_use()Eric Biggers
vt_in_use() dereferences console_driver->ttys[i] without proper locking. This is broken because the tty can be closed and freed concurrently. We could fix this by using 'READ_ONCE(console_driver->ttys[i]) != NULL' and skipping the check of tty_struct::count. But, looking at console_driver->ttys[i] isn't really appropriate anyway because even if it is NULL the tty can still be in the process of being closed. Instead, fix it by making vt_in_use() require console_lock() and check whether the vt is allocated and has port refcount > 1. This works since following the patch "vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console" the port refcount is incremented while the vt is open. Reproducer (very unreliable, but it worked for me after a few minutes): #include <fcntl.h> #include <linux/vt.h> int main() { int fd, nproc; struct vt_stat state; char ttyname[16]; fd = open("/dev/tty10", O_RDONLY); for (nproc = 1; nproc < 8; nproc *= 2) fork(); for (;;) { sprintf(ttyname, "/dev/tty%d", rand() % 8); close(open(ttyname, O_RDONLY)); ioctl(fd, VT_GETSTATE, &state); } } KASAN report: BUG: KASAN: use-after-free in vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline] BUG: KASAN: use-after-free in vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657 Read of size 4 at addr ffff888065722468 by task syz-vt2/132 CPU: 0 PID: 132 Comm: syz-vt2 Not tainted 5.6.0-rc5-00130-g089b6d3654916 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline] vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Allocated by task 136: [...] kzalloc include/linux/slab.h:669 [inline] alloc_tty_struct+0x96/0x8a0 drivers/tty/tty_io.c:2982 tty_init_dev+0x23/0x350 drivers/tty/tty_io.c:1334 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 41: [...] kfree+0xbf/0x200 mm/slab.c:3757 free_tty_struct+0x8d/0xb0 drivers/tty/tty_io.c:177 release_one_tty+0x22d/0x2f0 drivers/tty/tty_io.c:1468 process_one_work+0x7f1/0x14b0 kernel/workqueue.c:2264 worker_thread+0x8b/0xc80 kernel/workqueue.c:2410 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable@vger.kernel.org> # v3.4+ Acked-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Eric Biggers <ebiggers@google.com> Link: https://lore.kernel.org/r/20200322034305.210082-3-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-27vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual consoleEric Biggers
The VT_DISALLOCATE ioctl can free a virtual console while tty_release() is still running, causing a use-after-free in con_shutdown(). This occurs because VT_DISALLOCATE considers a virtual console's 'struct vc_data' to be unused as soon as the corresponding tty's refcount hits 0. But actually it may be still being closed. Fix this by making vc_data be reference-counted via the embedded 'struct tty_port'. A newly allocated virtual console has refcount 1. Opening it for the first time increments the refcount to 2. Closing it for the last time decrements the refcount (in tty_operations::cleanup() so that it happens late enough), as does VT_DISALLOCATE. Reproducer: #include <fcntl.h> #include <linux/vt.h> #include <sys/ioctl.h> #include <unistd.h> int main() { if (fork()) { for (;;) close(open("/dev/tty5", O_RDWR)); } else { int fd = open("/dev/tty10", O_RDWR); for (;;) ioctl(fd, VT_DISALLOCATE, 5); } } KASAN report: BUG: KASAN: use-after-free in con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 Write of size 8 at addr ffff88806a4ec108 by task syz_vt/129 CPU: 0 PID: 129 Comm: syz_vt Not tainted 5.6.0-rc2 #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 release_tty+0xa8/0x410 drivers/tty/tty_io.c:1514 tty_release_struct+0x34/0x50 drivers/tty/tty_io.c:1629 tty_release+0x984/0xed0 drivers/tty/tty_io.c:1789 [...] Allocated by task 129: [...] kzalloc include/linux/slab.h:669 [inline] vc_allocate drivers/tty/vt/vt.c:1085 [inline] vc_allocate+0x1ac/0x680 drivers/tty/vt/vt.c:1066 con_install+0x4d/0x3f0 drivers/tty/vt/vt.c:3229 tty_driver_install_tty drivers/tty/tty_io.c:1228 [inline] tty_init_dev+0x94/0x350 drivers/tty/tty_io.c:1341 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 130: [...] kfree+0xbf/0x1e0 mm/slab.c:3757 vt_disallocate drivers/tty/vt/vt_ioctl.c:300 [inline] vt_ioctl+0x16dc/0x1e30 drivers/tty/vt/vt_ioctl.c:818 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable@vger.kernel.org> # v3.4+ Reported-by: syzbot+522643ab5729b0421998@syzkaller.appspotmail.com Acked-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Eric Biggers <ebiggers@google.com> Link: https://lore.kernel.org/r/20200322034305.210082-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-27clocksource/drivers/hyper-v: Make sched clock return nanoseconds correctlyYubo Xie
The sched clock read functions return the HV clock (100ns granularity) without converting it to nanoseconds. Add the missing conversion. Fixes: bd00cd52d5be ("clocksource/drivers/hyperv: Add Hyper-V specific sched clock function") Signed-off-by: Yubo Xie <yuboxie@microsoft.com> Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com> Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200327021159.31429-1-Tianyu.Lan@microsoft.com
2020-03-27pinctrl: tegra: Add SFIO/GPIO programming on Tegra194Thierry Reding
Prior to Tegra186, the selection of SFIO vs. GPIO modes was done as part of the GPIO controller's register programming. Starting with Tegra186, a pin is configured as GPIO or SFIO with a bit in a configuration register of the pin controller. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-10-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27pinctrl: tegra: Renumber the GG.0 and GG.1 pinsThierry Reding
There is no need to define these at a specific offset since they are the only pins defined for this SoC generation. Begin numbering them at 0. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-9-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27pinctrl: tegra: Do not add default pin range on Tegra194Thierry Reding
On Tegra194, almost all of the pin control programming happens in early boot firmware, so there is no use in having a pin range defined for all the pins. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-8-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27pinctrl: tegra: Pass struct tegra_pmx for pin range checkThierry Reding
Pass the struct tegra_pmx when checking for the pin range in device tree. This makes the call site a bit easier to read and will help keep that readability in a subsequent patch. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-7-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27pinctrl: tegra: Fix "Scmitt" -> "Schmitt" typoThierry Reding
Properly spell "Schmitt" in the kerneldoc for pin group definitions. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-6-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27pinctrl: tegra: Fix whitespace issues for improved readabilityThierry Reding
Fix a few whitespace inconsistencies to make the code easier to read. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-5-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27gpio: tegra186: Add Tegra194 pin ranges for GG.0 and GG.1Thierry Reding
The GG.0 and GG.1 GPIOs serve as CLKREQ and RST pins, respectively, for PCIe controller 5 on Tegra194. When this controller is configured in endpoint mode, these pins need to be used as GPIOs by the PCIe endpoint driver. Typically the mode programming of these pins (GPIO vs. SFIO) is performed by early boot firmware to ensure that the configuration is consistent. However, the GG.0 and GG.1 pins are part of a special power partition that is not enabled during early boot, and hence the early boot firmware cannot program these pins to be GPIOs (they are SFIO by default). Adding them as pin ranges for the pin controller allows the pin controller to be involved when these pins are requested as GPIOs and allows the proper programming to take place. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-4-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27gpio: tegra186: Add support for pin rangesThierry Reding
Add support for Tegra SoC generations to specify a list of pin ranges that map GPIOs to ranges of pins in the pin controller. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-3-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27gpio: Support GPIO controllers without pin-rangesThierry Reding
Wake gpiochip_generic_request() call into the pinctrl helpers only if a GPIO controller had any pin-ranges assigned to it. This allows a driver to unconditionally use this helper if it supports multiple devices of which only a subset have pin-ranges assigned to them. Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20200319122737.3063291-2-thierry.reding@gmail.com Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27Merge branches 'iommu/fixes', 'arm/qcom', 'arm/omap', 'arm/smmu', 'x86/amd', ↵Joerg Roedel
'x86/vt-d', 'virtio' and 'core' into next
2020-03-27pinctrl: mediatek: Use scnprintf() for avoiding potential buffer overflowTakashi Iwai
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20200311090644.20287-1-tiwai@suse.de Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2020-03-27iommu/virtio: Use accessor functions for iommu private dataJoerg Roedel
Make use of dev_iommu_priv_set/get() functions. Signed-off-by: Joerg Roedel <jroedel@suse.de> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Link: https://lore.kernel.org/r/20200326150841.10083-16-joro@8bytes.org
2020-03-27iommu/qcom: Use accessor functions for iommu private dataJoerg Roedel
Make use of dev_iommu_priv_set/get() functions. Signed-off-by: Joerg Roedel <jroedel@suse.de> Link: https://lore.kernel.org/r/20200326150841.10083-15-joro@8bytes.org
2020-03-27iommu/mediatek: Use accessor functions for iommu private dataJoerg Roedel
Make use of dev_iommu_priv_set/get() functions. Signed-off-by: Joerg Roedel <jroedel@suse.de> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Link: https://lore.kernel.org/r/20200326150841.10083-14-joro@8bytes.org
2020-03-27iommu/renesas: Use accessor functions for iommu private dataJoerg Roedel
Make use of dev_iommu_priv_set/get() functions. Signed-off-by: Joerg Roedel <jroedel@suse.de> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Link: https://lore.kernel.org/r/20200326150841.10083-13-joro@8bytes.org
2020-03-27iommu/arm-smmu: Use accessor functions for iommu private dataJoerg Roedel
Make use of dev_iommu_priv_set/get() functions and simplify the code where possible with this change. Signed-off-by: Joerg Roedel <jroedel@suse.de> Tested-by: Will Deacon <will@kernel.org> # arm-smmu Link: https://lore.kernel.org/r/20200326150841.10083-12-joro@8bytes.org
2020-03-27iommu/arm-smmu: Refactor master_cfg/fwspec usageRobin Murphy
In preparation for restructuring iommu_fwspec, refactor the way we access the arm_smmu_master_cfg private data to be less dependent on the current layout. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Joerg Roedel <jroedel@suse.de> Link: https://lore.kernel.org/r/20200326150841.10083-11-joro@8bytes.org
2020-03-27iommu/arm-smmu-v3: Use accessor functions for iommu private dataJoerg Roedel
Make use of dev_iommu_priv_set/get() functions in the code. Signed-off-by: Joerg Roedel <jroedel@suse.de> Tested-by: Hanjun Guo <guohanjun@huawei.com> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Link: https://lore.kernel.org/r/20200326150841.10083-10-joro@8bytes.org
2020-03-27iommu/arm-smmu: Fix uninitilized variable warningJoerg Roedel
Some unrelated changes in the iommu code caused a new warning to appear in the arm-smmu driver: CC drivers/iommu/arm-smmu.o drivers/iommu/arm-smmu.c: In function 'arm_smmu_add_device': drivers/iommu/arm-smmu.c:1441:2: warning: 'smmu' may be used uninitialized in this function [-Wmaybe-uninitialized] arm_smmu_rpm_put(smmu); ^~~~~~~~~~~~~~~~~~~~~~ The warning is a false positive, but initialize the variable to NULL to get rid of it. Signed-off-by: Joerg Roedel <jroedel@suse.de> Tested-by: Will Deacon <will@kernel.org> # arm-smmu Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Link: https://lore.kernel.org/r/20200326150841.10083-8-joro@8bytes.org
2020-03-27iommu: Move iommu_fwspec to struct dev_iommuJoerg Roedel
Move the iommu_fwspec pointer in struct device into struct dev_iommu. This is a step in the effort to reduce the iommu related pointers in struct device to one. Signed-off-by: Joerg Roedel <jroedel@suse.de> Tested-by: Will Deacon <will@kernel.org> # arm-smmu Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20200326150841.10083-7-joro@8bytes.org
generated by cgit (git 2.34.1) at 2025-09-13 07:27:12 +0000