This is a note to let you know that I've just added the patch titled
dpaa_eth: remove duplicate increment of the tx_errors counter
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dpaa_eth-remove-duplicate-increment-of-the-tx_errors-counter.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:38:30 CEST 2018
From: Camelia Groza <camelia.groza(a)nxp.com>
Date: Wed, 14 Mar 2018 08:37:32 -0500
Subject: dpaa_eth: remove duplicate increment of the tx_errors counter
From: Camelia Groza <camelia.groza(a)nxp.com>
[ Upstream commit 82d141cd19d088ee41feafde4a6f86eeb40d93c5 ]
The tx_errors counter is incremented by the dpaa_xmit caller.
Signed-off-by: Camelia Groza <camelia.groza(a)nxp.com>
Signed-off-by: Madalin Bucur <madalin.bucur(a)nxp.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2022,7 +2022,6 @@ static inline int dpaa_xmit(struct dpaa_
}
if (unlikely(err < 0)) {
- percpu_stats->tx_errors++;
percpu_stats->tx_fifo_errors++;
return err;
}
Patches currently in stable-queue which might be from camelia.groza(a)nxp.com are
queue-4.14/dpaa_eth-remove-duplicate-increment-of-the-tx_errors-counter.patch
queue-4.14/dpaa_eth-remove-duplicate-initialization.patch
queue-4.14/dpaa_eth-increment-the-rx-dropped-counter-when-needed.patch
This is a note to let you know that I've just added the patch titled
dpaa_eth: increment the RX dropped counter when needed
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dpaa_eth-increment-the-rx-dropped-counter-when-needed.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:38:30 CEST 2018
From: Camelia Groza <camelia.groza(a)nxp.com>
Date: Wed, 14 Mar 2018 08:37:31 -0500
Subject: dpaa_eth: increment the RX dropped counter when needed
From: Camelia Groza <camelia.groza(a)nxp.com>
[ Upstream commit e4d1b37c17d000a3da9368a3e260fb9ea4927c25 ]
Signed-off-by: Camelia Groza <camelia.groza(a)nxp.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2324,8 +2324,10 @@ static enum qman_cb_dqrr_result rx_defau
skb_len = skb->len;
- if (unlikely(netif_receive_skb(skb) == NET_RX_DROP))
+ if (unlikely(netif_receive_skb(skb) == NET_RX_DROP)) {
+ percpu_stats->rx_dropped++;
return qman_cb_dqrr_consume;
+ }
percpu_stats->rx_packets++;
percpu_stats->rx_bytes += skb_len;
Patches currently in stable-queue which might be from camelia.groza(a)nxp.com are
queue-4.14/dpaa_eth-remove-duplicate-increment-of-the-tx_errors-counter.patch
queue-4.14/dpaa_eth-remove-duplicate-initialization.patch
queue-4.14/dpaa_eth-increment-the-rx-dropped-counter-when-needed.patch
This is a note to let you know that I've just added the patch titled
dpaa_eth: fix error in dpaa_remove()
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dpaa_eth-fix-error-in-dpaa_remove.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:38:30 CEST 2018
From: Madalin Bucur <madalin.bucur(a)nxp.com>
Date: Wed, 14 Mar 2018 08:37:29 -0500
Subject: dpaa_eth: fix error in dpaa_remove()
From: Madalin Bucur <madalin.bucur(a)nxp.com>
[ Upstream commit 88075256ee817041d68c2387f29065b5cb2b342a ]
The recent changes that make the driver probing compatible with DSA
were not propagated in the dpa_remove() function, breaking the
module unload function. Using the proper device to address the issue.
Signed-off-by: Madalin Bucur <madalin.bucur(a)nxp.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2860,7 +2860,7 @@ static int dpaa_remove(struct platform_d
struct device *dev;
int err;
- dev = &pdev->dev;
+ dev = pdev->dev.parent;
net_dev = dev_get_drvdata(dev);
priv = netdev_priv(net_dev);
Patches currently in stable-queue which might be from madalin.bucur(a)nxp.com are
queue-4.14/dpaa_eth-remove-duplicate-increment-of-the-tx_errors-counter.patch
queue-4.14/soc-fsl-qbman-fix-issue-in-qman_delete_cgr_safe.patch
queue-4.14/dpaa_eth-fix-error-in-dpaa_remove.patch
This is a note to let you know that I've just added the patch titled
devlink: Remove redundant free on error path
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
devlink-remove-redundant-free-on-error-path.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:38:30 CEST 2018
From: Arkadi Sharshevsky <arkadis(a)mellanox.com>
Date: Sun, 18 Mar 2018 17:37:22 +0200
Subject: devlink: Remove redundant free on error path
From: Arkadi Sharshevsky <arkadis(a)mellanox.com>
[ Upstream commit 7fe4d6dcbcb43fe0282d4213fc52be178bb30e91 ]
The current code performs unneeded free. Remove the redundant skb freeing
during the error path.
Fixes: 1555d204e743 ("devlink: Support for pipeline debug (dpipe)")
Signed-off-by: Arkadi Sharshevsky <arkadis(a)mellanox.com>
Acked-by: Jiri Pirko <jiri(a)mellanox.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/core/devlink.c | 16 ++++------------
1 file changed, 4 insertions(+), 12 deletions(-)
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1776,7 +1776,7 @@ send_done:
if (!nlh) {
err = devlink_dpipe_send_and_alloc_skb(&skb, info);
if (err)
- goto err_skb_send_alloc;
+ return err;
goto send_done;
}
@@ -1785,7 +1785,6 @@ send_done:
nla_put_failure:
err = -EMSGSIZE;
err_table_put:
-err_skb_send_alloc:
genlmsg_cancel(skb, hdr);
nlmsg_free(skb);
return err;
@@ -2051,7 +2050,7 @@ static int devlink_dpipe_entries_fill(st
table->counters_enabled,
&dump_ctx);
if (err)
- goto err_entries_dump;
+ return err;
send_done:
nlh = nlmsg_put(dump_ctx.skb, info->snd_portid, info->snd_seq,
@@ -2059,16 +2058,10 @@ send_done:
if (!nlh) {
err = devlink_dpipe_send_and_alloc_skb(&dump_ctx.skb, info);
if (err)
- goto err_skb_send_alloc;
+ return err;
goto send_done;
}
return genlmsg_reply(dump_ctx.skb, info);
-
-err_entries_dump:
-err_skb_send_alloc:
- genlmsg_cancel(dump_ctx.skb, dump_ctx.hdr);
- nlmsg_free(dump_ctx.skb);
- return err;
}
static int devlink_nl_cmd_dpipe_entries_get(struct sk_buff *skb,
@@ -2207,7 +2200,7 @@ send_done:
if (!nlh) {
err = devlink_dpipe_send_and_alloc_skb(&skb, info);
if (err)
- goto err_skb_send_alloc;
+ return err;
goto send_done;
}
return genlmsg_reply(skb, info);
@@ -2215,7 +2208,6 @@ send_done:
nla_put_failure:
err = -EMSGSIZE;
err_table_put:
-err_skb_send_alloc:
genlmsg_cancel(skb, hdr);
nlmsg_free(skb);
return err;
Patches currently in stable-queue which might be from arkadis(a)mellanox.com are
queue-4.14/devlink-remove-redundant-free-on-error-path.patch
queue-4.14/team-fix-double-free-in-error-path.patch
This is a note to let you know that I've just added the patch titled
dccp: check sk for closed state in dccp_sendmsg()
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
dccp-check-sk-for-closed-state-in-dccp_sendmsg.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:38:30 CEST 2018
From: Alexey Kodanev <alexey.kodanev(a)oracle.com>
Date: Tue, 6 Mar 2018 22:57:01 +0300
Subject: dccp: check sk for closed state in dccp_sendmsg()
From: Alexey Kodanev <alexey.kodanev(a)oracle.com>
[ Upstream commit 67f93df79aeefc3add4e4b31a752600f834236e2 ]
dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL,
therefore if DCCP socket is disconnected and dccp_sendmsg() is
called after it, it will cause a NULL pointer dereference in
dccp_write_xmit().
This crash and the reproducer was reported by syzbot. Looks like
it is reproduced if commit 69c64866ce07 ("dccp: CVE-2017-8824:
use-after-free in DCCP code") is applied.
Reported-by: syzbot+f99ab3887ab65d70f816(a)syzkaller.appspotmail.com
Signed-off-by: Alexey Kodanev <alexey.kodanev(a)oracle.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/dccp/proto.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -789,6 +789,11 @@ int dccp_sendmsg(struct sock *sk, struct
if (skb == NULL)
goto out_release;
+ if (sk->sk_state == DCCP_CLOSED) {
+ rc = -ENOTCONN;
+ goto out_discard;
+ }
+
skb_reserve(skb, sk->sk_prot->max_header);
rc = memcpy_from_msg(skb_put(skb, len), msg, len);
if (rc != 0)
Patches currently in stable-queue which might be from alexey.kodanev(a)oracle.com are
queue-4.14/sch_netem-fix-skb-leak-in-netem_enqueue.patch
queue-4.14/macvlan-filter-out-unsupported-feature-flags.patch
queue-4.14/dccp-check-sk-for-closed-state-in-dccp_sendmsg.patch
This is the start of the stable review cycle for the 4.4.125 release.
There are 43 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Mar 29 16:27:00 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.125-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.125-rc1
Daniel Borkmann <daniel(a)iogearbox.net>
bpf, x64: increase number of passes
Chenbo Feng <fengc(a)google.com>
bpf: skip unnecessary capability check
Daniel Borkmann <daniel(a)iogearbox.net>
kbuild: disable clang's default use of -fmerge-all-constants
Nadav Amit <namit(a)vmware.com>
staging: lustre: ptlrpc: kfree used instead of kvfree
Dan Carpenter <dan.carpenter(a)oracle.com>
perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
Andy Lutomirski <luto(a)kernel.org>
x86/entry/64: Don't use IST entry for #BP stack
H.J. Lu <hjl.tools(a)gmail.com>
x86/boot/64: Verify alignment of the LOAD segment
H.J. Lu <hjl.tools(a)gmail.com>
x86/build/64: Force the linker to use 2MB page size
Linus Torvalds <torvalds(a)linux-foundation.org>
kvm/x86: fix icebp instruction handling
Linus Torvalds <torvalds(a)linux-foundation.org>
tty: vt: fix up tabstops properly
Andri Yngvason <andri.yngvason(a)marel.com>
can: cc770: Fix use after free in cc770_tx_interrupt()
Andri Yngvason <andri.yngvason(a)marel.com>
can: cc770: Fix queue stall & dropped RTR reply
Andri Yngvason <andri.yngvason(a)marel.com>
can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: ncpfs: memory corruption in ncp_read_kernel()
Jagdish Gediya <jagdish.gediya(a)nxp.com>
mtd: nand: fsl_ifc: Fix nand waitfunc return value
Masami Hiramatsu <mhiramat(a)kernel.org>
tracing: probeevent: Fix to support minus offset from symbol
Larry Finger <Larry.Finger(a)lwfinger.net>
rtlwifi: rtl8723be: Fix loss of signal
Arend Van Spriel <arend.vanspriel(a)broadcom.com>
brcmfmac: fix P2P_DEVICE ethernet address generation
Dan Williams <dan.j.williams(a)intel.com>
acpi, numa: fix pxm to online numa node associations
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
drm: udl: Properly check framebuffer mmap offsets
Michel Dänzer <michel.daenzer(a)amd.com>
drm/radeon: Don't turn off DP sink when disconnected
Thomas Hellstrom <thellstrom(a)vmware.com>
drm/vmwgfx: Fix a destoy-while-held mutex problem.
Toshi Kani <toshi.kani(a)hpe.com>
x86/mm: implement free pmd/pte page interfaces
Toshi Kani <toshi.kani(a)hpe.com>
mm/vmalloc: add interfaces to free unmapped page table
Hans de Goede <hdegoede(a)redhat.com>
libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
Hans de Goede <hdegoede(a)redhat.com>
libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
Hans de Goede <hdegoede(a)redhat.com>
libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
Ju Hyung Park <qkrwngud825(a)gmail.com>
libata: Enable queued TRIM for Samsung SSD 860
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
libata: disable LPM for Crucial BX100 SSD 500GB drive
Hans de Goede <hdegoede(a)redhat.com>
libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
Eric Biggers <ebiggers(a)google.com>
libata: remove WARN() for DMA or PIO command without data
Eric Biggers <ebiggers(a)google.com>
libata: fix length validation of ATAPI-relayed SCSI commands
Takashi Iwai <tiwai(a)suse.de>
Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
Boris Brezillon <boris.brezillon(a)bootlin.com>
clk: bcm2835: Protect sections updating shared registers
Hans de Goede <hdegoede(a)redhat.com>
ahci: Add PCI-id for the Highpoint Rocketraid 644L card
Hans de Goede <hdegoede(a)redhat.com>
PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
Evgeniy Didin <Evgeniy.Didin(a)synopsys.com>
mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/realtek - Always immediately update mute LED with pin VREF
Takashi Iwai <tiwai(a)suse.de>
ALSA: aloop: Fix access to not-yet-ready substream via cable
Takashi Iwai <tiwai(a)suse.de>
ALSA: aloop: Sync stale timer before release
Kirill Marinushkin <k.marinushkin(a)gmail.com>
ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
Michael Nosthoff <committed(a)heine.so>
iio: st_pressure: st_accel: pass correct platform data to init
NeilBrown <neil(a)brown.name>
MIPS: ralink: Remove ralink_halt()
-------------
Diffstat:
Makefile | 13 ++-
arch/arm64/mm/mmu.c | 10 +++
arch/mips/ralink/reset.c | 7 --
arch/x86/Makefile | 9 ++
arch/x86/boot/compressed/misc.c | 4 +
arch/x86/entry/entry_64.S | 2 +-
arch/x86/include/asm/vmx.h | 1 +
arch/x86/kernel/cpu/perf_event_intel.c | 2 +-
arch/x86/kernel/traps.c | 24 +++--
arch/x86/kvm/vmx.c | 9 +-
arch/x86/mm/pgtable.c | 48 ++++++++++
arch/x86/net/bpf_jit_comp.c | 3 +-
drivers/acpi/numa.c | 10 ++-
drivers/ata/ahci.c | 4 +-
drivers/ata/libata-core.c | 26 +++++-
drivers/ata/libata-scsi.c | 4 +-
drivers/bluetooth/btusb.c | 2 +-
drivers/clk/bcm/clk-bcm2835.c | 4 +
drivers/gpu/drm/radeon/radeon_connectors.c | 31 +++----
drivers/gpu/drm/udl/udl_fb.c | 9 +-
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 28 ++++--
drivers/gpu/drm/vmwgfx/vmwgfx_kms.h | 12 ++-
drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 5 +-
drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 5 +-
drivers/iio/accel/st_accel_core.c | 2 +-
drivers/iio/pressure/st_pressure_core.c | 2 +-
drivers/mmc/host/dw_mmc.c | 6 +-
drivers/mtd/nand/fsl_ifc_nand.c | 5 +-
drivers/net/can/cc770/cc770.c | 100 +++++++++++++--------
drivers/net/can/cc770/cc770.h | 2 +
drivers/net/wireless/brcm80211/brcmfmac/p2p.c | 24 +++--
.../net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 3 +-
drivers/pci/quirks.c | 2 +
drivers/staging/lustre/lustre/ptlrpc/sec.c | 2 +-
drivers/tty/vt/vt.c | 8 +-
fs/ncpfs/ncplib_kernel.c | 4 +
include/asm-generic/pgtable.h | 10 +++
include/uapi/linux/usb/audio.h | 4 +-
kernel/bpf/syscall.c | 2 +-
kernel/trace/trace_kprobe.c | 4 +-
kernel/trace/trace_probe.c | 8 +-
kernel/trace/trace_probe.h | 2 +-
lib/ioremap.c | 6 +-
sound/drivers/aloop.c | 17 +++-
sound/pci/hda/patch_realtek.c | 6 +-
45 files changed, 338 insertions(+), 153 deletions(-)
From: Aniruddha Banerjee <aniruddhab(a)nvidia.com>
The kernel documentation states that the locking of the irq-chip
registers should be handled by the irq-chip driver. In the irq-gic,
the accesses to the irqchip are seemingly not protected and multiple
writes to SPIs from different irq descriptors do RMW requests without
taking the irq-chip lock. When multiple irqs call the request_irq at
the same time, there can be a simultaneous write at the gic
distributor, leading to a race. Acquire the gic_lock when the
irq_type is updated.
Cc: stable(a)vger.kernel.org
Signed-off-by: Aniruddha Banerjee <aniruddhab(a)nvidia.com>
---
Change from V1:
* Moved the spinlock from irq-gic to irq-gic common, so that the fix
is valid for GIC v1/v2/v3.
Change from V2:
* Fixup the Signed-off-by line.
Change from V3:
* Change raw_spin_lock to raw_spin_lock_irqsave and spin_unlock to
raw_spin_unlock_irqrestore to protect against a potential deadlock
when an interrupt handler changes the trigger type of any interrupt.
drivers/irqchip/irq-gic-common.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-gic-common.c b/drivers/irqchip/irq-gic-common.c
index 9ae71804b5dd..1c2ca8d51a70 100644
--- a/drivers/irqchip/irq-gic-common.c
+++ b/drivers/irqchip/irq-gic-common.c
@@ -21,6 +21,8 @@
#include "irq-gic-common.h"
+static DEFINE_RAW_SPINLOCK(irq_controller_lock);
+
static const struct gic_kvm_info *gic_kvm_info;
const struct gic_kvm_info *gic_get_kvm_info(void)
@@ -52,11 +54,13 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
u32 confoff = (irq / 16) * 4;
u32 val, oldval;
int ret = 0;
+ unsigned long flags;
/*
* Read current configuration register, and insert the config
* for "irq", depending on "type".
*/
+ raw_spin_lock_irqsave(&irq_controller_lock, flags);
val = oldval = readl_relaxed(base + GIC_DIST_CONFIG + confoff);
if (type & IRQ_TYPE_LEVEL_MASK)
val &= ~confmask;
@@ -64,8 +68,10 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
val |= confmask;
/* If the current configuration is the same, then we are done */
- if (val == oldval)
+ if (val == oldval) {
+ raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
return 0;
+ }
/*
* Write back the new configuration, and possibly re-enable
@@ -83,6 +89,7 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
pr_warn("GIC: PPI%d is secure or misconfigured\n",
irq - 16);
}
+ raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
if (sync_access)
sync_access();
--
2.16.2
The kernel documentation states that the locking of the irq-chip
registers should be handled by the irq-chip driver. In the irq-gic,
the accesses to the irqchip are seemingly not protected and multiple
writes to SPIs from different irq descriptors do RMW requests without
taking the irq-chip lock. When multiple irqs call the request_irq at
the same time, there can be a simultaneous write at the gic
distributor, leading to a race. Acquire the gic_lock when the
irq_type is updated.
Signed-off-by: Aniruddha Banerjee <aniruddhab(a)nvidia.com>
---
Changes from V1:
* Moved the spinlock from irq-gic to irq-gic common, so that the fix
is valid for GIC v1/v2/v3.
Change from V2:
* Fixup the Signed-off-by line.
drivers/irqchip/irq-gic-common.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-gic-common.c b/drivers/irqchip/irq-gic-common.c
index 9ae71804b5dd..73dd39959e6e 100644
--- a/drivers/irqchip/irq-gic-common.c
+++ b/drivers/irqchip/irq-gic-common.c
@@ -21,6 +21,8 @@
#include "irq-gic-common.h"
+static DEFINE_RAW_SPINLOCK(irq_controller_lock);
+
static const struct gic_kvm_info *gic_kvm_info;
const struct gic_kvm_info *gic_get_kvm_info(void)
@@ -57,6 +59,7 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
* Read current configuration register, and insert the config
* for "irq", depending on "type".
*/
+ raw_spin_lock(&irq_controller_lock);
val = oldval = readl_relaxed(base + GIC_DIST_CONFIG + confoff);
if (type & IRQ_TYPE_LEVEL_MASK)
val &= ~confmask;
@@ -64,8 +67,10 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
val |= confmask;
/* If the current configuration is the same, then we are done */
- if (val == oldval)
+ if (val == oldval) {
+ raw_spin_unlock(&irq_controller_lock);
return 0;
+ }
/*
* Write back the new configuration, and possibly re-enable
@@ -83,6 +88,7 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
pr_warn("GIC: PPI%d is secure or misconfigured\n",
irq - 16);
}
+ raw_spin_unlock(&irq_controller_lock);
if (sync_access)
sync_access();
--
2.16.2