February 2018 - Linux-stable-mirror

[PATCH] platform/x86: dell-laptop: Allocate buffer on heap rather than globally

by Mario Limonciello

There is no longer a need for the buffer to be defined in first 4GB physical address space. Furthermore there may be race conditions with multiple different functions working on a module wide buffer causing incorrect results. This commit has been backported from: commit 9862b43624 upstream Fixes: 549b4930f057658dc50d8010e66219233119a4d8 Suggested-by: Pali Rohar <pali.rohar(a)gmail.com> Signed-off-by: Mario Limonciello <mario.limonciello(a)dell.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> --- drivers/platform/x86/dell-laptop.c | 188 ++++++++++++++++++++----------------- 1 file changed, 103 insertions(+), 85 deletions(-) diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c index cd4725e..c1b9e11 100644 --- a/drivers/platform/x86/dell-laptop.c +++ b/drivers/platform/x86/dell-laptop.c @@ -78,7 +78,6 @@ static struct platform_driver platform_driver = { } }; -static struct calling_interface_buffer *buffer; static struct platform_device *platform_device; static struct backlight_device *dell_backlight_device; static struct rfkill *wifi_rfkill; @@ -286,7 +285,8 @@ static const struct dmi_system_id dell_quirks[] __initconst = { { } }; -void dell_set_arguments(u32 arg0, u32 arg1, u32 arg2, u32 arg3) +static void dell_fill_request(struct calling_interface_buffer *buffer, + u32 arg0, u32 arg1, u32 arg2, u32 arg3) { memset(buffer, 0, sizeof(struct calling_interface_buffer)); buffer->input[0] = arg0; @@ -295,7 +295,8 @@ void dell_set_arguments(u32 arg0, u32 arg1, u32 arg2, u32 arg3) buffer->input[3] = arg3; } -int dell_send_request(u16 class, u16 select) +static int dell_send_request(struct calling_interface_buffer *buffer, + u16 class, u16 select) { int ret; @@ -432,21 +433,22 @@ static int dell_rfkill_set(void *data, bool blocked) int disable = blocked ? 1 : 0; unsigned long radio = (unsigned long)data; int hwswitch_bit = (unsigned long)data - 1; + struct calling_interface_buffer buffer; int hwswitch; int status; int ret; - dell_set_arguments(0, 0, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); + dell_fill_request(&buffer, 0, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); if (ret) return ret; - status = buffer->output[1]; + status = buffer.output[1]; - dell_set_arguments(0x2, 0, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); + dell_fill_request(&buffer, 0x2, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); if (ret) return ret; - hwswitch = buffer->output[1]; + hwswitch = buffer.output[1]; /* If the hardware switch controls this radio, and the hardware switch is disabled, always disable the radio */ @@ -454,8 +456,8 @@ static int dell_rfkill_set(void *data, bool blocked) (status & BIT(0)) && !(status & BIT(16))) disable = 1; - dell_set_arguments(1 | (radio<<8) | (disable << 16), 0, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); + dell_fill_request(&buffer, 1 | (radio<<8) | (disable << 16), 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); return ret; } @@ -464,9 +466,11 @@ static void dell_rfkill_update_sw_state(struct rfkill *rfkill, int radio, { if (status & BIT(0)) { /* Has hw-switch, sync sw_state to BIOS */ + struct calling_interface_buffer buffer; int block = rfkill_blocked(rfkill); - dell_set_arguments(1 | (radio << 8) | (block << 16), 0, 0, 0); - dell_send_request(CLASS_INFO, SELECT_RFKILL); + dell_fill_request(&buffer, + 1 | (radio << 8) | (block << 16), 0, 0, 0); + dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); } else { /* No hw-switch, sync BIOS state to sw_state */ rfkill_set_sw_state(rfkill, !!(status & BIT(radio + 16))); @@ -483,21 +487,22 @@ static void dell_rfkill_update_hw_state(struct rfkill *rfkill, int radio, static void dell_rfkill_query(struct rfkill *rfkill, void *data) { int radio = ((unsigned long)data & 0xF); + struct calling_interface_buffer buffer; int hwswitch; int status; int ret; - dell_set_arguments(0, 0, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); - status = buffer->output[1]; + dell_fill_request(&buffer, 0, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); + status = buffer.output[1]; if (ret != 0 || !(status & BIT(0))) { return; } - dell_set_arguments(0, 0x2, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); - hwswitch = buffer->output[1]; + dell_fill_request(&buffer, 0, 0x2, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); + hwswitch = buffer.output[1]; if (ret != 0) return; @@ -514,22 +519,23 @@ static struct dentry *dell_laptop_dir; static int dell_debugfs_show(struct seq_file *s, void *data) { + struct calling_interface_buffer buffer; int hwswitch_state; int hwswitch_ret; int status; int ret; - dell_set_arguments(0, 0, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); + dell_fill_request(&buffer, 0, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); if (ret) return ret; - status = buffer->output[1]; + status = buffer.output[1]; - dell_set_arguments(0, 0x2, 0, 0); - hwswitch_ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); + dell_fill_request(&buffer, 0, 0x2, 0, 0); + hwswitch_ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); if (hwswitch_ret) return hwswitch_ret; - hwswitch_state = buffer->output[1]; + hwswitch_state = buffer.output[1]; seq_printf(s, "return:\t%d\n", ret); seq_printf(s, "status:\t0x%X\n", status); @@ -610,22 +616,23 @@ static const struct file_operations dell_debugfs_fops = { static void dell_update_rfkill(struct work_struct *ignored) { + struct calling_interface_buffer buffer; int hwswitch = 0; int status; int ret; - dell_set_arguments(0, 0, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); - status = buffer->output[1]; + dell_fill_request(&buffer, 0, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); + status = buffer.output[1]; if (ret != 0) return; - dell_set_arguments(0, 0x2, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); + dell_fill_request(&buffer, 0, 0x2, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); if (ret == 0 && (status & BIT(0))) - hwswitch = buffer->output[1]; + hwswitch = buffer.output[1]; if (wifi_rfkill) { dell_rfkill_update_hw_state(wifi_rfkill, 1, status, hwswitch); @@ -683,6 +690,7 @@ static struct notifier_block dell_laptop_rbtn_notifier = { static int __init dell_setup_rfkill(void) { + struct calling_interface_buffer buffer; int status, ret, whitelisted; const char *product; @@ -698,9 +706,9 @@ static int __init dell_setup_rfkill(void) if (!force_rfkill && !whitelisted) return 0; - dell_set_arguments(0, 0, 0, 0); - ret = dell_send_request(CLASS_INFO, SELECT_RFKILL); - status = buffer->output[1]; + dell_fill_request(&buffer, 0, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); + status = buffer.output[1]; /* dell wireless info smbios call is not supported */ if (ret != 0) @@ -853,6 +861,7 @@ static void dell_cleanup_rfkill(void) static int dell_send_intensity(struct backlight_device *bd) { + struct calling_interface_buffer buffer; struct calling_interface_token *token; int ret; @@ -860,17 +869,21 @@ static int dell_send_intensity(struct backlight_device *bd) if (!token) return -ENODEV; - dell_set_arguments(token->location, bd->props.brightness, 0, 0); + dell_fill_request(&buffer, + token->location, bd->props.brightness, 0, 0); if (power_supply_is_system_supplied() > 0) - ret = dell_send_request(CLASS_TOKEN_WRITE, SELECT_TOKEN_AC); + ret = dell_send_request(&buffer, + CLASS_TOKEN_WRITE, SELECT_TOKEN_AC); else - ret = dell_send_request(CLASS_TOKEN_WRITE, SELECT_TOKEN_BAT); + ret = dell_send_request(&buffer, + CLASS_TOKEN_WRITE, SELECT_TOKEN_BAT); return ret; } static int dell_get_intensity(struct backlight_device *bd) { + struct calling_interface_buffer buffer; struct calling_interface_token *token; int ret; @@ -878,14 +891,17 @@ static int dell_get_intensity(struct backlight_device *bd) if (!token) return -ENODEV; - dell_set_arguments(token->location, 0, 0, 0); + dell_fill_request(&buffer, token->location, 0, 0, 0); if (power_supply_is_system_supplied() > 0) - ret = dell_send_request(CLASS_TOKEN_READ, SELECT_TOKEN_AC); + ret = dell_send_request(&buffer, + CLASS_TOKEN_READ, SELECT_TOKEN_AC); else - ret = dell_send_request(CLASS_TOKEN_READ, SELECT_TOKEN_BAT); + ret = dell_send_request(&buffer, + CLASS_TOKEN_READ, SELECT_TOKEN_BAT); if (ret == 0) - ret = buffer->output[1]; + ret = buffer.output[1]; + return ret; } @@ -1149,31 +1165,33 @@ static DEFINE_MUTEX(kbd_led_mutex); static int kbd_get_info(struct kbd_info *info) { + struct calling_interface_buffer buffer; u8 units; int ret; - dell_set_arguments(0, 0, 0, 0); - ret = dell_send_request(CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT); + dell_fill_request(&buffer, 0, 0, 0, 0); + ret = dell_send_request(&buffer, + CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT); if (ret) return ret; - info->modes = buffer->output[1] & 0xFFFF; - info->type = (buffer->output[1] >> 24) & 0xFF; - info->triggers = buffer->output[2] & 0xFF; - units = (buffer->output[2] >> 8) & 0xFF; - info->levels = (buffer->output[2] >> 16) & 0xFF; + info->modes = buffer.output[1] & 0xFFFF; + info->type = (buffer.output[1] >> 24) & 0xFF; + info->triggers = buffer.output[2] & 0xFF; + units = (buffer.output[2] >> 8) & 0xFF; + info->levels = (buffer.output[2] >> 16) & 0xFF; if (quirks && quirks->kbd_led_levels_off_1 && info->levels) info->levels--; if (units & BIT(0)) - info->seconds = (buffer->output[3] >> 0) & 0xFF; + info->seconds = (buffer.output[3] >> 0) & 0xFF; if (units & BIT(1)) - info->minutes = (buffer->output[3] >> 8) & 0xFF; + info->minutes = (buffer.output[3] >> 8) & 0xFF; if (units & BIT(2)) - info->hours = (buffer->output[3] >> 16) & 0xFF; + info->hours = (buffer.output[3] >> 16) & 0xFF; if (units & BIT(3)) - info->days = (buffer->output[3] >> 24) & 0xFF; + info->days = (buffer.output[3] >> 24) & 0xFF; return ret; } @@ -1233,31 +1251,34 @@ static int kbd_set_level(struct kbd_state *state, u8 level) static int kbd_get_state(struct kbd_state *state) { + struct calling_interface_buffer buffer; int ret; - dell_set_arguments(0x1, 0, 0, 0); - ret = dell_send_request(CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT); + dell_fill_request(&buffer, 0, 0, 0, 0); + ret = dell_send_request(&buffer, + CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT); if (ret) return ret; - state->mode_bit = ffs(buffer->output[1] & 0xFFFF); + state->mode_bit = ffs(buffer.output[1] & 0xFFFF); if (state->mode_bit != 0) state->mode_bit--; - state->triggers = (buffer->output[1] >> 16) & 0xFF; - state->timeout_value = (buffer->output[1] >> 24) & 0x3F; - state->timeout_unit = (buffer->output[1] >> 30) & 0x3; - state->als_setting = buffer->output[2] & 0xFF; - state->als_value = (buffer->output[2] >> 8) & 0xFF; - state->level = (buffer->output[2] >> 16) & 0xFF; - state->timeout_value_ac = (buffer->output[2] >> 24) & 0x3F; - state->timeout_unit_ac = (buffer->output[2] >> 30) & 0x3; + state->triggers = (buffer.output[1] >> 16) & 0xFF; + state->timeout_value = (buffer.output[1] >> 24) & 0x3F; + state->timeout_unit = (buffer.output[1] >> 30) & 0x3; + state->als_setting = buffer.output[2] & 0xFF; + state->als_value = (buffer.output[2] >> 8) & 0xFF; + state->level = (buffer.output[2] >> 16) & 0xFF; + state->timeout_value_ac = (buffer.output[2] >> 24) & 0x3F; + state->timeout_unit_ac = (buffer.output[2] >> 30) & 0x3; return ret; } static int kbd_set_state(struct kbd_state *state) { + struct calling_interface_buffer buffer; int ret; u32 input1; u32 input2; @@ -1270,8 +1291,9 @@ static int kbd_set_state(struct kbd_state *state) input2 |= (state->level & 0xFF) << 16; input2 |= (state->timeout_value_ac & 0x3F) << 24; input2 |= (state->timeout_unit_ac & 0x3) << 30; - dell_set_arguments(0x2, input1, input2, 0); - ret = dell_send_request(CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT); + dell_fill_request(&buffer, 0x2, input1, input2, 0); + ret = dell_send_request(&buffer, + CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT); return ret; } @@ -1298,6 +1320,7 @@ static int kbd_set_state_safe(struct kbd_state *state, struct kbd_state *old) static int kbd_set_token_bit(u8 bit) { + struct calling_interface_buffer buffer; struct calling_interface_token *token; int ret; @@ -1308,14 +1331,15 @@ static int kbd_set_token_bit(u8 bit) if (!token) return -EINVAL; - dell_set_arguments(token->location, token->value, 0, 0); - ret = dell_send_request(CLASS_TOKEN_WRITE, SELECT_TOKEN_STD); + dell_fill_request(&buffer, token->location, token->value, 0, 0); + ret = dell_send_request(&buffer, CLASS_TOKEN_WRITE, SELECT_TOKEN_STD); return ret; } static int kbd_get_token_bit(u8 bit) { + struct calling_interface_buffer buffer; struct calling_interface_token *token; int ret; int val; @@ -1327,9 +1351,9 @@ static int kbd_get_token_bit(u8 bit) if (!token) return -EINVAL; - dell_set_arguments(token->location, 0, 0, 0); - ret = dell_send_request(CLASS_TOKEN_READ, SELECT_TOKEN_STD); - val = buffer->output[1]; + dell_fill_request(&buffer, token->location, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_TOKEN_READ, SELECT_TOKEN_STD); + val = buffer.output[1]; if (ret) return ret; @@ -2046,6 +2070,7 @@ static struct notifier_block dell_laptop_notifier = { int dell_micmute_led_set(int state) { + struct calling_interface_buffer buffer; struct calling_interface_token *token; if (state == 0) @@ -2058,8 +2083,8 @@ int dell_micmute_led_set(int state) if (!token) return -ENODEV; - dell_set_arguments(token->location, token->value, 0, 0); - dell_send_request(CLASS_TOKEN_WRITE, SELECT_TOKEN_STD); + dell_fill_request(&buffer, token->location, token->value, 0, 0); + dell_send_request(&buffer, CLASS_TOKEN_WRITE, SELECT_TOKEN_STD); return state; } @@ -2090,13 +2115,6 @@ static int __init dell_init(void) if (ret) goto fail_platform_device2; - buffer = kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL); - if (!buffer) { - ret = -ENOMEM; - goto fail_buffer; - } - - ret = dell_setup_rfkill(); if (ret) { @@ -2121,10 +2139,13 @@ static int __init dell_init(void) token = dell_smbios_find_token(BRIGHTNESS_TOKEN); if (token) { - dell_set_arguments(token->location, 0, 0, 0); - ret = dell_send_request(CLASS_TOKEN_READ, SELECT_TOKEN_AC); + struct calling_interface_buffer buffer; + + dell_fill_request(&buffer, token->location, 0, 0, 0); + ret = dell_send_request(&buffer, + CLASS_TOKEN_READ, SELECT_TOKEN_AC); if (ret) - max_intensity = buffer->output[3]; + max_intensity = buffer.output[3]; } if (max_intensity) { @@ -2158,8 +2179,6 @@ static int __init dell_init(void) fail_get_brightness: backlight_device_unregister(dell_backlight_device); fail_backlight: - kfree(buffer); -fail_buffer: dell_cleanup_rfkill(); fail_rfkill: platform_device_del(platform_device); @@ -2179,7 +2198,6 @@ static void __exit dell_exit(void) touchpad_led_exit(); kbd_led_exit(); backlight_device_unregister(dell_backlight_device); - kfree(buffer); dell_cleanup_rfkill(); if (platform_device) { platform_device_unregister(platform_device); -- 2.7.4

6 years, 10 months

3
7
0 0

[PATCH 4.9 00/39] 4.9.85-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.85 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Feb 28 20:16:31 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.85-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.85-rc1 Dan Williams <dan.j.williams(a)intel.com> x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface Dan Williams <dan.j.williams(a)intel.com> mm: fail get_vaddr_frames() for filesystem-dax mappings Jan H. Schönherr <jschoenh(a)amazon.de> mm: Fix devm_memremap_pages() collision handling Dan Williams <dan.j.williams(a)intel.com> libnvdimm, dax: fix 1GB-aligned namespaces vs physical misalignment Dan Williams <dan.j.williams(a)intel.com> IB/core: disable memory registration of filesystem-dax vmas Dan Williams <dan.j.williams(a)intel.com> v4l2: disable filesystem-dax mapping support Dan Williams <dan.j.williams(a)intel.com> mm: introduce get_user_pages_longterm Dan Williams <dan.j.williams(a)intel.com> device-dax: implement ->split() to catch invalid munmap attempts Dan Williams <dan.j.williams(a)intel.com> libnvdimm: fix integer overflow static analysis warning Jan Kara <jack(a)suse.cz> fs/dax.c: fix inefficiency in dax_writeback_mapping_range() Ross Zwisler <ross.zwisler(a)linux.intel.com> mm: avoid spurious 'bad pmd' warning messages Eric Biggers <ebiggers(a)google.com> X.509: fix NULL dereference when restricting key with unsupported_sig Eric Biggers <ebiggers(a)google.com> binder: add missing binder_unlock() Kai-Heng Feng <kai.heng.feng(a)canonical.com> drm/amdgpu: add new device to use atpx quirk Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: add atpx quirk handling (v2) Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Add dpm quirk for Jet PRO (v2) Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path Jack Pham <jackp(a)codeaurora.org> usb: gadget: f_fs: Process all descriptors during bind Bin Liu <b-liu(a)ti.com> Revert "usb: musb: host: don't start next rx urb if current one failed" Karsten Koop <kkoop(a)ld-didactic.de> usb: ldusb: add PIDs for new CASSY devices supported by this driver Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Set maxpacket size for ep0 IN Kai-Heng Feng <kai.heng.feng(a)canonical.com> drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA Jack Stocker <jackstocker.93(a)gmail.com> Add delay-init quirk for Corsair K70 RGB keyboards Michael Weiser <michael.weiser(a)gmx.de> arm64: Disable unhandled signal log messages by default AMAN DEEP <aman.deep(a)samsung.com> usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() Shigeru Yoshida <shigeru.yoshida(a)windriver.com> ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() Casey Leedom <leedom(a)chelsio.com> PCI/cxgb4: Extend T3 PCI quirk to T4+ devices Shanker Donthineni <shankerd(a)codeaurora.org> irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() Arnd Bergmann <arnd(a)arndb.de> x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() Lars-Peter Clausen <lars(a)metafoo.de> iio: adis_lib: Initialize trigger before requesting interrupt Stefan Windfeldt-Prytz <stefan.windfeldt(a)axis.com> iio: buffer: check if a buffer has been set up when poll is called Leon Romanovsky <leonro(a)mellanox.com> RDMA/uverbs: Protect from command mask overflow Eric Biggers <ebiggers(a)google.com> PKCS#7: fix certificate chain verification Eric Biggers <ebiggers(a)google.com> X.509: fix BUG_ON() when hash algorithm is unsupported Arnd Bergmann <arnd(a)arndb.de> cfg80211: fix cfg80211_beacon_dup Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com> scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info Max Filippov <jcmvbkbc(a)gmail.com> xtensa: fix high memory/reserved memory collision Paolo Abeni <pabeni(a)redhat.com> netfilter: drop outermost socket lock in getsockopt() ------------- Diffstat: Makefile | 4 +- arch/arm64/kernel/traps.c | 2 +- arch/x86/entry/entry_64.S | 13 +++++ arch/x86/oprofile/nmi_int.c | 2 +- arch/xtensa/mm/init.c | 70 +++++++++++++++++++++--- crypto/asymmetric_keys/pkcs7_verify.c | 2 +- crypto/asymmetric_keys/public_key.c | 4 +- crypto/asymmetric_keys/restrict.c | 7 ++- drivers/android/binder.c | 4 +- drivers/dax/dax.c | 12 ++++ drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 58 +++++++++++++++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 - drivers/gpu/drm/amd/amdgpu/si_dpm.c | 5 ++ drivers/gpu/drm/drm_edid.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/iio/imu/adis_trigger.c | 7 ++- drivers/iio/industrialio-buffer.c | 2 +- drivers/infiniband/core/umem.c | 2 +- drivers/infiniband/core/uverbs_main.c | 27 ++++++--- drivers/irqchip/irq-gic-v3.c | 2 +- drivers/media/v4l2-core/videobuf-dma-sg.c | 5 +- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 10 ---- drivers/nvdimm/bus.c | 11 ++-- drivers/nvdimm/pfn_devs.c | 15 ++++- drivers/pci/quirks.c | 39 +++++++------ drivers/scsi/ibmvscsi/ibmvfc.h | 2 +- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/gadget.c | 2 + drivers/usb/gadget/function/f_fs.c | 6 +- drivers/usb/host/ohci-hcd.c | 10 +++- drivers/usb/host/ohci-hub.c | 4 +- drivers/usb/host/ohci-q.c | 17 +++--- drivers/usb/misc/ldusb.c | 6 ++ drivers/usb/musb/musb_host.c | 8 +-- drivers/usb/renesas_usbhs/fifo.c | 5 ++ fs/dax.c | 1 + include/linux/dax.h | 5 -- include/linux/fs.h | 20 +++++++ include/linux/kernel.h | 1 + include/linux/mm.h | 13 +++++ kernel/memremap.c | 13 +++-- mm/frame_vector.c | 12 ++++ mm/gup.c | 64 ++++++++++++++++++++++ mm/memory.c | 40 ++++++++++---- net/ipv4/ip_sockglue.c | 7 +-- net/ipv6/ipv6_sockglue.c | 10 +--- net/mac80211/cfg.c | 2 +- 48 files changed, 433 insertions(+), 132 deletions(-)

6 years, 10 months

4
40
0 0

[PATCH 3.18 00/13] 3.18.97-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 3.18.97 release. There are 13 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Feb 28 20:15:12 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.97-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 3.18.97-rc1 Eric Biggers <ebiggers(a)google.com> ASN.1: fix out-of-bounds read when parsing indefinite length item Jack Pham <jackp(a)codeaurora.org> usb: gadget: f_fs: Process all descriptors during bind Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Set maxpacket size for ep0 IN Michael Weiser <michael.weiser(a)gmx.de> arm64: Disable unhandled signal log messages by default Shanker Donthineni <shankerd(a)codeaurora.org> irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() Arnd Bergmann <arnd(a)arndb.de> x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() Lars-Peter Clausen <lars(a)metafoo.de> iio: adis_lib: Initialize trigger before requesting interrupt Stefan Windfeldt-Prytz <stefan.windfeldt(a)axis.com> iio: buffer: check if a buffer has been set up when poll is called Arnd Bergmann <arnd(a)arndb.de> cfg80211: fix cfg80211_beacon_dup Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com> scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info Max Filippov <jcmvbkbc(a)gmail.com> xtensa: fix high memory/reserved memory collision Johan Hovold <johan(a)kernel.org> PCI: keystone: Fix interrupt-controller-node lookup Paolo Abeni <pabeni(a)redhat.com> netfilter: drop outermost socket lock in getsockopt() ------------- Diffstat: Makefile | 4 +-- arch/arm64/kernel/traps.c | 2 +- arch/x86/oprofile/nmi_int.c | 2 +- arch/xtensa/mm/init.c | 70 ++++++++++++++++++++++++++++++++++---- drivers/iio/imu/adis_trigger.c | 7 ++-- drivers/iio/industrialio-buffer.c | 2 +- drivers/irqchip/irq-gic-v3.c | 2 +- drivers/pci/host/pci-keystone.c | 9 +++-- drivers/scsi/ibmvscsi/ibmvfc.h | 2 +- drivers/usb/dwc3/gadget.c | 2 ++ drivers/usb/gadget/function/f_fs.c | 6 ++-- lib/asn1_decoder.c | 43 ++++++++++++----------- net/ipv4/ip_sockglue.c | 7 +--- net/ipv6/ipv6_sockglue.c | 10 ++---- net/mac80211/cfg.c | 2 +- 15 files changed, 113 insertions(+), 57 deletions(-)

6 years, 10 months

3
16
0 0

[PATCH v2] ashmem: Fix lockdep issue during llseek

by Joel Fernandes

ashmem_mutex create a chain of dependencies like so: (1) mmap syscall -> mmap_sem -> (acquired) ashmem_mmap ashmem_mutex (try to acquire) (block) (2) llseek syscall -> ashmem_llseek -> ashmem_mutex -> (acquired) inode_lock -> inode->i_rwsem (try to acquire) (block) (3) getdents -> iterate_dir -> inode_lock -> inode->i_rwsem (acquired) copy_to_user -> mmap_sem (try to acquire) There is a lock ordering created between mmap_sem and inode->i_rwsem causing a lockdep splat [2] during a syzcaller test, this patch fixes the issue by unlocking the mutex earlier. Functionally that's Ok since we don't need to protect vfs_llseek. [1] https://patchwork.kernel.org/patch/10185031/ [2] https://lkml.org/lkml/2018/1/10/48 Cc: Todd Kjos <tkjos(a)google.com> Cc: Arve Hjonnevag <arve(a)android.com> Cc: Greg Hackmann <ghackmann(a)google.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: stable(a)vger.kernel.org Reported-by: syzbot+8ec30bb7bf1a981a2012(a)syzkaller.appspotmail.com Signed-off-by: Joel Fernandes <joelaf(a)google.com> --- Changes since first version: Don't relock after vfs call since its not needed. Only reason we lock is to protect races with asma->file. https://patchwork.kernel.org/patch/10185031/ drivers/staging/android/ashmem.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index bbdc53b686dd..b330e86b3a49 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -326,24 +326,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin) mutex_lock(&ashmem_mutex); if (asma->size == 0) { - ret = -EINVAL; - goto out; + mutex_unlock(&ashmem_mutex); + return -EINVAL; } if (!asma->file) { - ret = -EBADF; - goto out; + mutex_unlock(&ashmem_mutex); + return -EBADF; } + mutex_unlock(&ashmem_mutex); + ret = vfs_llseek(asma->file, offset, origin); if (ret < 0) - goto out; + return ret; /** Copy f_pos from backing file, since f_ops->llseek() sets it */ file->f_pos = asma->file->f_pos; - -out: - mutex_unlock(&ashmem_mutex); return ret; } -- 2.16.1.291.g4437f3f132-goog

6 years, 10 months

4
4
0 0

[PATCH v2 1/2] xen: fix out-of-bounds irq unbind for MSI message groups

by Amit Shah

When an MSI descriptor was not available, the error path would try to unbind an irq that was never acquired - potentially unbinding an unrelated irq. Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups") Reported-by: Hooman Mirhadi <mirhadih(a)amazon.com> CC: <stable(a)vger.kernel.org> CC: Roger Pau Monné <roger.pau(a)citrix.com> CC: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> CC: Eduardo Valentin <eduval(a)amazon.com> CC: Juergen Gross <jgross(a)suse.com> CC: Thomas Gleixner <tglx(a)linutronix.de> CC: "K. Y. Srinivasan" <kys(a)microsoft.com> CC: Liu Shuo <shuo.a.liu(a)intel.com> CC: Anoob Soman <anoob.soman(a)citrix.com> Signed-off-by: Amit Shah <aams(a)amazon.com> --- drivers/xen/events/events_base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index 1ab4bd1..c86d10e 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -755,8 +755,10 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc, mutex_unlock(&irq_mapping_update_lock); return irq; error_irq: - for (; i >= 0; i--) + while (i > 0) { + i--; __unbind_from_irq(irq + i); + } mutex_unlock(&irq_mapping_update_lock); return ret; } -- 2.7.3.AMZN Amazon Development Center Germany GmbH Berlin - Dresden - Aachen main office: Krausenstr. 38, 10117 Berlin Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger Ust-ID: DE289237879 Eingetragen am Amtsgericht Charlottenburg HRB 149173 B

6 years, 10 months

2
1
0 0

[PATCH 2/2] xen: events: free irqs in error condition

by Amit Shah

In case of errors in irq setup for MSI, free up the allocated irqs. Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups") Reported-by: Hooman Mirhadi <mirhadih(a)amazon.com> CC: <stable(a)vger.kernel.org> CC: Roger Pau Monné <roger.pau(a)citrix.com> CC: David Vrabel <david.vrabel(a)citrix.com> CC: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> CC: Eduardo Valentin <eduval(a)amazon.com> CC: Juergen Gross <jgross(a)suse.com> CC: Thomas Gleixner <tglx(a)linutronix.de> CC: "K. Y. Srinivasan" <kys(a)microsoft.com> CC: Liu Shuo <shuo.a.liu(a)intel.com> CC: Anoob Soman <anoob.soman(a)citrix.com> Signed-off-by: Amit Shah <aams(a)amazon.com> --- drivers/xen/events/events_base.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index b6b8b29..96aa575 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -758,6 +758,7 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc, error_irq: for (; i >= 0; i--) __unbind_from_irq(irq + i); + xen_free_irq(irq); mutex_unlock(&irq_mapping_update_lock); return ret; } -- 2.7.3.AMZN Amazon Development Center Germany GmbH Berlin - Dresden - Aachen main office: Krausenstr. 38, 10117 Berlin Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger Ust-ID: DE289237879 Eingetragen am Amtsgericht Charlottenburg HRB 149173 B

6 years, 10 months

3
4
0 0

[PATCH] thermal: exynos: Propagate error value from tmu_read()

by Marek Szyprowski

tmu_read() in case of Exynos4210 might return error for out of bound values. Current code ignores such value, what leads to reporting critical temperature value. Add proper error code propagation to exynos_get_temp() function. Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com> CC: stable(a)vger.kernel.org # v4.6+ --- This patch is prepared on top of "thermal: exynos: Reading temperature makes sense only when TMU is turned on" patch. Both are required to finally fix thermal support on Exynos4210 based boards. This patch only applies cleanly together with the mentioned "thermal: exynos: Reading temperature makes sense only when TMU is turned on" patch on v4.6+ kernels. --- drivers/thermal/samsung/exynos_tmu.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c index 986cbd01aaaa..74adeb1d2daf 100644 --- a/drivers/thermal/samsung/exynos_tmu.c +++ b/drivers/thermal/samsung/exynos_tmu.c @@ -892,6 +892,7 @@ static void exynos7_tmu_control(struct platform_device *pdev, bool on) static int exynos_get_temp(void *p, int *temp) { struct exynos_tmu_data *data = p; + int value, ret = 0; if (!data || !data->tmu_read || !data->enabled) return -EINVAL; @@ -899,12 +900,16 @@ static int exynos_get_temp(void *p, int *temp) mutex_lock(&data->lock); clk_enable(data->clk); - *temp = code_to_temp(data, data->tmu_read(data)) * MCELSIUS; + value = data->tmu_read(data); + if (value < 0) + ret = value; + else + *temp = code_to_temp(data, value) * MCELSIUS; clk_disable(data->clk); mutex_unlock(&data->lock); - return 0; + return ret; } #ifdef CONFIG_THERMAL_EMULATION -- 2.15.0

6 years, 10 months

2
1
0 0

Re: [alsa-devel] Applied "ASoC: topology: Fix logical inversion in set_link_hw_format()" to the asoc tree

by Pierre-Louis Bossart

On 2/27/18 2:38 AM, Mark Brown wrote: > On Mon, Feb 26, 2018 at 06:30:15PM -0800, Pierre-Louis Bossart wrote: >> On 2/26/18 10:34 AM, Kirill Marinushkin wrote: > >>> According to the comment, the existing functionality works correctly "WRT the >>> interface". The suggested commit doesn't fix the behaviour: instead, it reverts >>> the logic to "WRT the codec". But the existing implementation is also valid. > >> Look at all the machine drivers, they always use the mask by looking at the >> codec side. The comment on top means that the SOC side ('the interface') is >> the dual of the codec side. > >> This issue was found during the development of SOF (Sound Open Firmware) >> where we get the reverse of the intended behavior when using the same >> conventions in topology files as in machine drivers. > > Is this perhaps something that the earlier firmware is handling inside > the firmware? For SKL+ the SSP settings come from binary blobs read from ACPI/NHLT tables so I am wondering if this inversion is compensated for in the tools used to generate the blobs.

6 years, 10 months

1
0
0 0

[PATCH v3] thermal: exynos: Reading temperature makes sense only when TMU is turned on

by Marek Szyprowski

When thermal sensor is not yet enabled, reading temperature might return random value. This might even result in stopping system booting when such temperature is higher than the critical value. Fix this by checking if TMU has been actually enabled before reading the temperature. This change fixes booting of Exynos4210-based board with TMU enabled (for example Samsung Trats board), which was broken since v4.4 kernel release. Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Fixes: 9e4249b40340 ("thermal: exynos: Fix first temperature read after registering sensor") CC: stable(a)vger.kernel.org # v4.6+ Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie(a)samsung.com> --- This issue is there since commit 9e4249b40340 ("thermal: exynos: Fix first temperature read after registering sensor"), but this patch applies cleanly only to v4.6+ kernels. --- drivers/thermal/samsung/exynos_tmu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c index ed805c7c5ace..986cbd01aaaa 100644 --- a/drivers/thermal/samsung/exynos_tmu.c +++ b/drivers/thermal/samsung/exynos_tmu.c @@ -185,6 +185,7 @@ * @regulator: pointer to the TMU regulator structure. * @reg_conf: pointer to structure to register with core thermal. * @ntrip: number of supported trip points. + * @enabled: current status of TMU device * @tmu_initialize: SoC specific TMU initialization method * @tmu_control: SoC specific TMU control method * @tmu_read: SoC specific TMU temperature read method @@ -205,6 +206,7 @@ struct exynos_tmu_data { struct regulator *regulator; struct thermal_zone_device *tzd; unsigned int ntrip; + bool enabled; int (*tmu_initialize)(struct platform_device *pdev); void (*tmu_control)(struct platform_device *pdev, bool on); @@ -398,6 +400,7 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on) mutex_lock(&data->lock); clk_enable(data->clk); data->tmu_control(pdev, on); + data->enabled = on; clk_disable(data->clk); mutex_unlock(&data->lock); } @@ -890,7 +893,7 @@ static int exynos_get_temp(void *p, int *temp) { struct exynos_tmu_data *data = p; - if (!data || !data->tmu_read) + if (!data || !data->tmu_read || !data->enabled) return -EINVAL; mutex_lock(&data->lock); -- 2.15.0

6 years, 10 months

1
0
0 0

Re: [PATCH 3.18 00/13] 3.18.97-stable review

by Greg Kroah-Hartman

On Tue, Feb 27, 2018 at 02:17:15AM +0000, Harsh Shandilya wrote: > On Tue 27 Feb, 2018, 1:47 AM Greg Kroah-Hartman, <gregkh(a)linuxfoundation.org> > wrote: > > > This is the start of the stable review cycle for the 3.18.97 release. > > There are 13 patches in this series, all will be posted as a response > > to this one. If anyone has any issues with these being applied, please > > let me know. > > > > Responses should be made by Wed Feb 28 20:15:12 UTC 2018. > > Anything received after that time might be too late. > > > > The whole patch series can be found in one patch at: > > > > https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.97-rc… > > or in the git tree and branch at: > > git:// > > git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git > > linux-3.18.y > > and the diffstat can be found below. > > > > No regressions noticed on the OnePlus 3T. CAF's msm-3.18 tree requires > reverting commit > https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit?id=1278f001ef9… > to avoid conflicting with the patch titled "usb: gadget: f_fs: Process all > descriptors during bind", kernel-common has no merge problems. Thanks for > the update. Thanks for testing this and letting me know. greg k-h

6 years, 10 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2018