Since commit 9bcf15f75cac ("iio: adc: axp288: Fix TS-pin handling") we
preserve the bias current set by the firmware at boot. This fixes issues
we were seeing on various models, but it seems our old hardcoded 80ųA bias
current was working around a firmware bug on at least one model laptop.
In order to both have our cake and eat it, this commit adds a dmi based
list of models where we need to override the firmware set bias current and
adds the one model we now know needs this to it: The Lenovo Ideapad 100S
(11 inch version).
Cc: stable(a)vger.kernel.org
Fixes: 9bcf15f75cac ("iio: adc: axp288: Fix TS-pin handling")
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203829
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
drivers/iio/adc/axp288_adc.c | 32 ++++++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 31d51bcc5f2c..85d08e68b34f 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -7,6 +7,7 @@
* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
+#include <linux/dmi.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/device.h>
@@ -25,6 +26,11 @@
#define AXP288_ADC_EN_MASK 0xF0
#define AXP288_ADC_TS_ENABLE 0x01
+#define AXP288_ADC_TS_BIAS_MASK GENMASK(5, 4)
+#define AXP288_ADC_TS_BIAS_20UA (0 << 4)
+#define AXP288_ADC_TS_BIAS_40UA (1 << 4)
+#define AXP288_ADC_TS_BIAS_60UA (2 << 4)
+#define AXP288_ADC_TS_BIAS_80UA (3 << 4)
#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0)
#define AXP288_ADC_TS_CURRENT_OFF (0 << 0)
#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0)
@@ -177,10 +183,36 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
return ret;
}
+/*
+ * We rely on the machine's firmware to correctly setup the TS pin bias current
+ * at boot. This lists systems with broken fw where we need to set it ourselves.
+ */
+static const struct dmi_system_id axp288_adc_ts_bias_override[] = {
+ {
+ /* Lenovo Ideapad 100S (11 inch) */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad 100S-11IBY"),
+ },
+ .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA,
+ },
+ {}
+};
+
static int axp288_adc_initialize(struct axp288_adc_info *info)
{
+ const struct dmi_system_id *bias_override;
int ret, adc_enable_val;
+ bias_override = dmi_first_match(axp288_adc_ts_bias_override);
+ if (bias_override) {
+ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+ AXP288_ADC_TS_BIAS_MASK,
+ (uintptr_t)bias_override->driver_data);
+ if (ret)
+ return ret;
+ }
+
/*
* Determine if the TS pin is enabled and set the TS current-source
* accordingly.
--
2.23.0
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From cb8acabbe33b110157955a7425ee876fb81e6bbc Mon Sep 17 00:00:00 2001
From: Damien Le Moal <damien.lemoal(a)wdc.com>
Date: Wed, 28 Aug 2019 13:40:20 +0900
Subject: [PATCH] block: mq-deadline: Fix queue restart handling
Commit 7211aef86f79 ("block: mq-deadline: Fix write completion
handling") added a call to blk_mq_sched_mark_restart_hctx() in
dd_dispatch_request() to make sure that write request dispatching does
not stall when all target zones are locked. This fix left a subtle race
when a write completion happens during a dispatch execution on another
CPU:
CPU 0: Dispatch CPU1: write completion
dd_dispatch_request()
lock(&dd->lock);
...
lock(&dd->zone_lock); dd_finish_request()
rq = find request lock(&dd->zone_lock);
unlock(&dd->zone_lock);
zone write unlock
unlock(&dd->zone_lock);
...
__blk_mq_free_request
check restart flag (not set)
-> queue not run
...
if (!rq && have writes)
blk_mq_sched_mark_restart_hctx()
unlock(&dd->lock)
Since the dispatch context finishes after the write request completion
handling, marking the queue as needing a restart is not seen from
__blk_mq_free_request() and blk_mq_sched_restart() not executed leading
to the dispatch stall under 100% write workloads.
Fix this by moving the call to blk_mq_sched_mark_restart_hctx() from
dd_dispatch_request() into dd_finish_request() under the zone lock to
ensure full mutual exclusion between write request dispatch selection
and zone unlock on write request completion.
Fixes: 7211aef86f79 ("block: mq-deadline: Fix write completion handling")
Cc: stable(a)vger.kernel.org
Reported-by: Hans Holmberg <Hans.Holmberg(a)wdc.com>
Reviewed-by: Hans Holmberg <hans.holmberg(a)wdc.com>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Damien Le Moal <damien.lemoal(a)wdc.com>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 2a2a2e82832e..35e84bc0ec8c 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -377,13 +377,6 @@ static struct request *__dd_dispatch_request(struct deadline_data *dd)
* hardware queue, but we may return a request that is for a
* different hardware queue. This is because mq-deadline has shared
* state for all hardware queues, in terms of sorting, FIFOs, etc.
- *
- * For a zoned block device, __dd_dispatch_request() may return NULL
- * if all the queued write requests are directed at zones that are already
- * locked due to on-going write requests. In this case, make sure to mark
- * the queue as needing a restart to ensure that the queue is run again
- * and the pending writes dispatched once the target zones for the ongoing
- * write requests are unlocked in dd_finish_request().
*/
static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
{
@@ -392,9 +385,6 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
spin_lock(&dd->lock);
rq = __dd_dispatch_request(dd);
- if (!rq && blk_queue_is_zoned(hctx->queue) &&
- !list_empty(&dd->fifo_list[WRITE]))
- blk_mq_sched_mark_restart_hctx(hctx);
spin_unlock(&dd->lock);
return rq;
@@ -561,6 +551,13 @@ static void dd_prepare_request(struct request *rq, struct bio *bio)
* spinlock so that the zone is never unlocked while deadline_fifo_request()
* or deadline_next_request() are executing. This function is called for
* all requests, whether or not these requests complete successfully.
+ *
+ * For a zoned block device, __dd_dispatch_request() may have stopped
+ * dispatching requests if all the queued requests are write requests directed
+ * at zones that are already locked due to on-going write requests. To ensure
+ * write request dispatch progress in this case, mark the queue as needing a
+ * restart to ensure that the queue is run again after completion of the
+ * request and zones being unlocked.
*/
static void dd_finish_request(struct request *rq)
{
@@ -572,6 +569,8 @@ static void dd_finish_request(struct request *rq)
spin_lock_irqsave(&dd->zone_lock, flags);
blk_req_zone_write_unlock(rq);
+ if (!list_empty(&dd->fifo_list[WRITE]))
+ blk_mq_sched_mark_restart_hctx(rq->mq_hctx);
spin_unlock_irqrestore(&dd->zone_lock, flags);
}
}
From: Will Deacon <will(a)kernel.org>
Closing /dev/pts/ptmx removes the corresponding pty under /dev/pts/
without synchronizing against concurrent path walkers. This can lead to
'dcache_readdir()' tripping over a 'struct dentry' with a NULL 'd_inode'
field:
| BUG: kernel NULL pointer dereference, address: 0000000000000000
| #PF: supervisor read access in kernel mode
| #PF: error_code(0x0000) - not-present page
| PGD 0 P4D 0
| SMP PTI
| CPU: 9 PID: 179 Comm: ptmx Not tainted 5.4.0-rc1+ #5
| RIP: 0010:dcache_readdir+0xe1/0x150
| Code: 48 83 f8 01 74 a2 48 83 f8 02 74 eb 4d 8d a7 90 00 00 00 45 31 f6 eb 42 48 8b 43 30 48 8b 4d 08 48 89 ef 8b 53 24 48 8b 73 28 <44> 0f b7 08 4c 8b 55 00 4c 8b 40 40 66 41 c1 e9 0c 41 83 e1 0f e8
| RSP: 0018:ffffa7df8044be58 EFLAGS: 00010286
| RAX: 0000000000000000 RBX: ffff9511c78f3ec0 RCX: 0000000000000002
| RDX: 0000000000000001 RSI: ffff9511c78f3ef8 RDI: ffffa7df8044bed0
| RBP: ffffa7df8044bed0 R08: 0000000000000000 R09: 00000000004bc478
| R10: ffff9511c877c6a8 R11: ffff9511c8dde600 R12: ffff9511c878c460
| R13: ffff9511c878c3c0 R14: 0000000000000000 R15: ffff9511c9442cc0
| FS: 00007fc5ea2e1700(0000) GS:ffff9511ca280000(0000) knlGS:0000000000000000
| CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
| CR2: 0000000000000000 CR3: 0000000047d68002 CR4: 0000000000760ea0
| DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
| DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
| PKRU: 55555554
| Call Trace:
| iterate_dir+0x137/0x190
| ksys_getdents64+0x97/0x130
| ? iterate_dir+0x190/0x190
| __x64_sys_getdents64+0x11/0x20
| do_syscall_64+0x43/0x110
| entry_SYSCALL_64_after_hwframe+0x44/0xa9
In this case, one CPU is deleting the dentry and clearing the inode
pointer via:
devpts_pty_kill()
-> dput()
-> dentry_kill()
-> __dentry_kill()
-> dentry_unlink_inode()
whilst the other is traversing the directory an obtaining a reference
to the dentry being deleted via:
sys_getdents64()
-> iterate_dir()
-> dcache_readdir()
-> next_positive()
Prevent the race by acquiring the inode lock of the parent in
'devpts_pty_kill()' so that path walkers are held off until the dentry
has been completely torn down.
Will's fix didn't link to the commit it fixes so I tracked it down.
devpts_pty_kill() used to take inode_lock() before removing a pts
device. The inode_lock() got removed in
8ead9dd54716 ("devpts: more pty driver interface cleanups"). The
reasoning behind the removal seemed to be that the inode_lock() was only
needed because d_find_alias(inode) had to be called before that commit
to find the dentry that was supposed to be removed. Linus then changed
the pty driver to stash away the dentry and subsequently got rid of the
inode_lock(). However, it seems that the inode_lock() is needed to
protect against the race outlined above. So add it back.
Note that this bug had been brought up before in November 2018 before
(cf. [1]). But a fix never got merged because a proper commit wasn't
sent. The issue came back up when Will and I talked about it at Kernel
Recipes in Paris. So here is a fix which prevents the issue. I very much
vote we get this merged asap, since as an unprivileged user I can do:
unshare -U --map-root --mount
mount -t devpts devpts
./<run_reproducer_below
/* Reproducer */
Note that the reproducer will take a little while. Will reported usually
around 10s. For me it took a few minutes.
#ifndef _GNU_SOURCE
#define _GNU_SOURCE 1
#endif
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
static void *readdir_thread(void *arg)
{
DIR *d = arg;
struct dirent *dent;
for (;;) {
errno = 0;
dent = readdir(d);
if (!dent) {
if (errno)
perror("readdir");
break;
}
rewinddir(d);
}
return NULL;
}
int main(void)
{
DIR *d;
pthread_t t;
int ret = 0;
d = opendir("/dev/pts");
if (!d) {
ret = errno;
perror("opendir");
exit(EXIT_FAILURE);
}
ret = pthread_create(&t, NULL, readdir_thread, d);
if (ret) {
errno = ret;
perror("pthread_create");
exit(EXIT_FAILURE);
}
for (;;) {
int dfd;
int fd;
dfd = dirfd(d);
if (dfd < 0) {
perror("dirfd");
break;
}
fd = openat(dirfd(d), "ptmx", O_RDONLY | O_NONBLOCK | O_CLOEXEC);
if (fd < 0) {
perror("openat");
break;
}
close(fd);
}
pthread_join(t, NULL);
closedir(d);
exit(EXIT_SUCCESS);
}
/* References */
[1]: https://lore.kernel.org/r/20181109143744.GA12128@hc
Fixes: 8ead9dd54716 ("devpts: more pty driver interface cleanups")
Cc: <stable(a)vger.kernel.org>
Cc: Jan Glauber <jglauber(a)marvell.com>
Cc: Alexander Viro <viro(a)zeniv.linux.org.uk>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
Reviewed-by: Christian Brauner <christian.brauner(a)ubuntu.com>
[christian.brauner(a)ubuntu.com: dig into history and add context and reproducer to commit message]
Signed-off-by: Christian Brauner <christian.brauner(a)ubuntu.com>
---
fs/devpts/inode.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 42e5a766d33c..4b4546347aac 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -617,13 +617,18 @@ void *devpts_get_priv(struct dentry *dentry)
*/
void devpts_pty_kill(struct dentry *dentry)
{
- WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC);
+ struct super_block *sb = dentry->d_sb;
+ struct dentry *parent = sb->s_root;
+ WARN_ON_ONCE(sb->s_magic != DEVPTS_SUPER_MAGIC);
+
+ inode_lock(parent->d_inode);
dentry->d_fsdata = NULL;
drop_nlink(dentry->d_inode);
fsnotify_unlink(d_inode(dentry->d_parent), dentry);
d_drop(dentry);
dput(dentry); /* d_alloc_name() in devpts_pty_new() */
+ inode_unlock(parent->d_inode);
}
static int __init init_devpts_fs(void)
--
2.23.0
This is the start of the stable review cycle for the 4.4.195 release.
There are 99 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 05 Oct 2019 03:37:47 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.195-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.195-rc1
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix race setting up and completing qgroup rescan workers
Nikolay Borisov <nborisov(a)suse.com>
btrfs: Relinquish CPUs in btrfs_compare_trees
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix use-after-free when using the tree modification log
Mark Salyzyn <salyzyn(a)android.com>
ovl: filter of trusted xattr results in audit
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Fix oplock handling for SMB 2.1+ protocols
Chris Brandt <chris.brandt(a)renesas.com>
i2c: riic: Clear NACK in tend isr
Laurent Vivier <lvivier(a)redhat.com>
hwrng: core - don't wait on add_early_randomness()
Chao Yu <yuchao0(a)huawei.com>
quota: fix wrong condition in is_quota_modification()
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix punch hole for inline_data file systems
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
/dev/mem: Bail out upon SIGKILL.
Denis Kenzior <denkenz(a)gmail.com>
cfg80211: Purge frame registrations on iftype change
Xiao Ni <xni(a)redhat.com>
md/raid6: Set R5_ReadError when there is read failure on parity disk
Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com>
alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP
Luis Araneda <luaraneda(a)gmail.com>
ARM: zynq: Use memcpy_toio instead of memcpy on smp bring-up
Amadeusz Sławiński <amadeuszx.slawinski(a)intel.com>
ASoC: Intel: Fix use of potentially uninitialized variable
Hans de Goede <hdegoede(a)redhat.com>
media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Manually calculate reserved bits when loading PDPTRS
Jan Dakinevich <jan.dakinevich(a)virtuozzo.com>
KVM: x86: set ctxt->have_exception in x86_decode_insn()
Jan Dakinevich <jan.dakinevich(a)virtuozzo.com>
KVM: x86: always stop emulation on page fault
Helge Deller <deller(a)gmx.de>
parisc: Disable HP HSC-PCI Cards to prevent kernel crash
Vasily Averin <vvs(a)virtuozzo.com>
fuse: fix missing unlock_page in fuse_writepage()
Vincent Whitchurch <vincent.whitchurch(a)axis.com>
printk: Do not lose last line in kmsg buffer dump
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: firewire-tascam: check intermediate state of clock status and retry
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: firewire-tascam: handle error code when getting current source of clock
Sakari Ailus <sakari.ailus(a)linux.intel.com>
media: omap3isp: Set device on omap3isp subdevs
Qu Wenruo <wqu(a)suse.com>
btrfs: extent-tree: Make sure we only allocate extents from block groups with the same type
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93
Tomas Bortoli <tomasbortoli(a)gmail.com>
media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
Kevin Easton <kevin(a)guarana.org>
libertas: Add missing sentinel at end of if_usb.c fw_table
Al Cooper <alcooperx(a)gmail.com>
mmc: sdhci: Fix incorrect switch to HS mode
Peter Ujfalusi <peter.ujfalusi(a)ti.com>
ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set
Masami Hiramatsu <mhiramat(a)kernel.org>
kprobes: Prohibit probing on BUG() and WARN() address
Peter Ujfalusi <peter.ujfalusi(a)ti.com>
dmaengine: ti: edma: Do not reset reserved paRAM slots
Yufen Yu <yuyufen(a)huawei.com>
md/raid1: fail run raid1 array when active disk less than one
Wang Shenran <shenran268(a)gmail.com>
hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap'
Wenwen Wang <wenwen(a)cs.uga.edu>
ACPI: custom_method: fix memory leaks
Tzvetomir Stoyanov <tstoyanov(a)vmware.com>
libtraceevent: Change users plugin directory
Al Stone <ahs3(a)redhat.com>
ACPI / CPPC: do not require the _PSD method
Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
media: ov9650: add a sanity check
Maciej S. Szmigiero <mail(a)maciej.szmigiero.name>
media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate()
Wenwen Wang <wenwen(a)cs.uga.edu>
media: cpia2_usb: fix memory leaks
Wenwen Wang <wenwen(a)cs.uga.edu>
media: saa7146: add cleanup in hexium_attach()
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: hdpvr: add terminating 0 at end of string
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: radio/si470x: kill urb on error
Arnd Bergmann <arnd(a)arndb.de>
net: lpc-enet: fix printk format strings
Sakari Ailus <sakari.ailus(a)linux.intel.com>
media: omap3isp: Don't set streaming state on random subdevs
Arnd Bergmann <arnd(a)arndb.de>
dmaengine: iop-adma: use correct printk format strings
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: gspca: zero usb_buf on error
Xiaofei Tan <tanxiaofei(a)huawei.com>
efi: cper: print AER info of PCIe fatal error
Guoqing Jiang <jgq516(a)gmail.com>
md: don't set In_sync if array is frozen
Guoqing Jiang <jgq516(a)gmail.com>
md: don't call spare_active in md_reap_sync_thread if all member devices can't work
chenzefeng <chenzefeng2(a)huawei.com>
ia64:unwind: fix double free for mod->arch.init_unw_table
Ard van Breemen <ard(a)kwaak.net>
ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid
Vinod Koul <vkoul(a)kernel.org>
base: soc: Export soc_device_register/unregister APIs
Oliver Neukum <oneukum(a)suse.com>
media: iguanair: add sanity checks
Jia-Ju Bai <baijiaju1990(a)gmail.com>
ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in build_adc_controls()
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda - Show the fatal CORB/RIRB error more clearly
Thomas Gleixner <tglx(a)linutronix.de>
x86/apic: Soft disable APIC before initializing it
Grzegorz Halat <ghalat(a)redhat.com>
x86/reboot: Always use NMI fallback when shutdown via reboot vector IPI fails
Juri Lelli <juri.lelli(a)redhat.com>
sched/core: Fix CPU controller for !RT_GROUP_SCHED
Vincent Guittot <vincent.guittot(a)linaro.org>
sched/fair: Fix imbalance due to CPU affinity
Luke Nowakowski-Krijger <lnowakow(a)eng.ucsd.edu>
media: hdpvr: Add device num check and handling
Arnd Bergmann <arnd(a)arndb.de>
media: dib0700: fix link error for dibx000_i2c_set_speed
Nick Stoughton <nstoughton(a)logitech.com>
leds: leds-lp5562 allow firmware files up to the maximum length
Stefan Wahren <wahrenst(a)gmx.net>
dmaengine: bcm2835: Print error in case setting DMA mask fails
Oleksandr Suvorov <oleksandr.suvorov(a)toradex.com>
ASoC: sgtl5000: Fix charge pump source assignment
Chris Wilson <chris(a)chris-wilson.co.uk>
ALSA: hda: Flush interrupts on disabling
Ori Nimron <orinimron123(a)gmail.com>
nfc: enforce CAP_NET_RAW for raw sockets
Ori Nimron <orinimron123(a)gmail.com>
ieee802154: enforce CAP_NET_RAW for raw sockets
Ori Nimron <orinimron123(a)gmail.com>
ax25: enforce CAP_NET_RAW for raw sockets
Ori Nimron <orinimron123(a)gmail.com>
appletalk: enforce CAP_NET_RAW for raw sockets
Ori Nimron <orinimron123(a)gmail.com>
mISDN: enforce CAP_NET_RAW for raw sockets
Oliver Neukum <oneukum(a)suse.com>
usbnet: sanity checking of packet sizes and device mtu
Bjørn Mork <bjorn(a)mork.no>
usbnet: ignore endpoints with invalid wMaxPacketSize
Stephen Hemminger <stephen(a)networkplumber.org>
skge: fix checksum byte order
Eric Dumazet <edumazet(a)google.com>
sch_netem: fix a divide by zero in tabledist()
Li RongQing <lirongqing(a)baidu.com>
openvswitch: change type of UPCALL_PID attribute to NLA_UNSPEC
Peter Mamonov <pmamonov(a)gmail.com>
net/phy: fix DP83865 10 Mbps HDX loopback disable function
Bjørn Mork <bjorn(a)mork.no>
cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
arcnet: provide a buffer big enough to actually receive packets
Jian-Hong Pan <jian-hong(a)endlessm.com>
Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices
Chris Wilson <chris(a)chris-wilson.co.uk>
drm: Flush output polling on shutdown
Chao Yu <yuchao0(a)huawei.com>
f2fs: fix to do sanity check on segment bitmap of LFS curseg
Chao Yu <yuchao0(a)huawei.com>
Revert "f2fs: avoid out-of-range memory access"
Surbhi Palande <f2fsnewbie(a)gmail.com>
f2fs: check all the data segments against all node ones
Marc Zyngier <maz(a)kernel.org>
irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices
Waiman Long <longman(a)redhat.com>
locking/lockdep: Add debug_locks check in __lock_downgrade()
Yu Wang <yyuwang(a)codeaurora.org>
mac80211: handle deauthentication/disassociation from TDLS peer
Arkadiusz Miskiewicz <a.miskiewicz(a)gmail.com>
mac80211: Print text for disassociation reason
Shih-Yuan Lee (FourDollars) <fourdollars(a)debian.org>
ALSA: hda - Add laptop imic fixup for ASUS M9V laptop
Takashi Iwai <tiwai(a)suse.de>
ASoC: fsl: Fix of-node refcount unbalance in fsl_ssi_probe_from_dt()
Mao Wenan <maowenan(a)huawei.com>
net: rds: Fix NULL ptr use in rds_tcp_kill_sock
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
crypto: talitos - fix missing break in switch statement
Tokunori Ikegami <ikegami.t(a)gmail.com>
mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword()
Alan Stern <stern(a)rowland.harvard.edu>
HID: hidraw: Fix invalid read in hidraw_ioctl
Alan Stern <stern(a)rowland.harvard.edu>
HID: logitech: Fix general protection fault caused by Logitech driver
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
HID: lg: make transfer buffers DMA capable
Alan Stern <stern(a)rowland.harvard.edu>
HID: prodikeys: Fix general protection fault during probe
Marcel Holtmann <marcel(a)holtmann.org>
Revert "Bluetooth: validate BLE connection interval updates"
-------------
Diffstat:
Makefile | 4 +--
arch/arm/mach-zynq/platsmp.c | 2 +-
arch/ia64/kernel/module.c | 8 +++--
arch/x86/kernel/apic/apic.c | 8 +++++
arch/x86/kernel/smp.c | 46 ++++++++++++++++-----------
arch/x86/kvm/emulate.c | 2 ++
arch/x86/kvm/x86.c | 21 +++++++++---
drivers/acpi/cppc_acpi.c | 6 ++--
drivers/acpi/custom_method.c | 5 ++-
drivers/base/soc.c | 2 ++
drivers/bluetooth/btusb.c | 3 ++
drivers/char/hw_random/core.c | 2 +-
drivers/char/mem.c | 21 ++++++++++++
drivers/crypto/talitos.c | 1 +
drivers/dma/bcm2835-dma.c | 4 ++-
drivers/dma/edma.c | 9 ++++--
drivers/dma/iop-adma.c | 18 +++++------
drivers/firmware/efi/cper.c | 15 +++++++++
drivers/gpu/drm/drm_probe_helper.c | 9 +++++-
drivers/hid/hid-lg.c | 22 +++++++++----
drivers/hid/hid-lg4ff.c | 1 -
drivers/hid/hid-prodikeys.c | 12 +++++--
drivers/hid/hidraw.c | 2 +-
drivers/hwmon/acpi_power_meter.c | 4 +--
drivers/i2c/busses/i2c-riic.c | 1 +
drivers/irqchip/irq-gic-v3-its.c | 9 +++---
drivers/isdn/mISDN/socket.c | 2 ++
drivers/leds/leds-lp5562.c | 6 +++-
drivers/md/md.c | 14 ++++++--
drivers/md/raid1.c | 13 +++++++-
drivers/md/raid5.c | 4 ++-
drivers/media/i2c/ov9650.c | 5 +++
drivers/media/pci/saa7134/saa7134-i2c.c | 12 ++++---
drivers/media/pci/saa7146/hexium_gemini.c | 3 ++
drivers/media/platform/omap3isp/isp.c | 8 +++++
drivers/media/platform/omap3isp/ispccdc.c | 1 +
drivers/media/platform/omap3isp/ispccp2.c | 1 +
drivers/media/platform/omap3isp/ispcsi2.c | 1 +
drivers/media/platform/omap3isp/isppreview.c | 1 +
drivers/media/platform/omap3isp/ispresizer.c | 1 +
drivers/media/platform/omap3isp/ispstat.c | 2 ++
drivers/media/radio/si470x/radio-si470x-usb.c | 5 ++-
drivers/media/rc/iguanair.c | 15 ++++-----
drivers/media/usb/cpia2/cpia2_usb.c | 4 +++
drivers/media/usb/dvb-usb/dib0700_devices.c | 8 +++++
drivers/media/usb/gspca/konica.c | 5 +++
drivers/media/usb/gspca/nw80x.c | 5 +++
drivers/media/usb/gspca/ov519.c | 10 ++++++
drivers/media/usb/gspca/ov534.c | 5 +++
drivers/media/usb/gspca/ov534_9.c | 1 +
drivers/media/usb/gspca/se401.c | 5 +++
drivers/media/usb/gspca/sn9c20x.c | 12 +++++++
drivers/media/usb/gspca/sonixb.c | 5 +++
drivers/media/usb/gspca/sonixj.c | 5 +++
drivers/media/usb/gspca/spca1528.c | 5 +++
drivers/media/usb/gspca/sq930x.c | 5 +++
drivers/media/usb/gspca/sunplus.c | 5 +++
drivers/media/usb/gspca/vc032x.c | 5 +++
drivers/media/usb/gspca/w996Xcf.c | 5 +++
drivers/media/usb/hdpvr/hdpvr-core.c | 13 +++++++-
drivers/media/usb/ttusb-dec/ttusb_dec.c | 2 +-
drivers/mmc/host/sdhci.c | 4 ++-
drivers/mtd/chips/cfi_cmdset_0002.c | 18 +++++++----
drivers/net/arcnet/arcnet.c | 31 ++++++++++--------
drivers/net/ethernet/marvell/skge.c | 2 +-
drivers/net/ethernet/nxp/lpc_eth.c | 13 ++++----
drivers/net/phy/national.c | 9 ++++--
drivers/net/usb/cdc_ncm.c | 6 +++-
drivers/net/usb/usbnet.c | 8 +++++
drivers/net/wireless/libertas/if_usb.c | 3 +-
drivers/parisc/dino.c | 24 ++++++++++++++
fs/btrfs/ctree.c | 5 ++-
fs/btrfs/extent-tree.c | 8 +++++
fs/btrfs/qgroup.c | 33 +++++++++++--------
fs/cifs/smb2ops.c | 5 +++
fs/ext4/inode.c | 9 ++++++
fs/f2fs/segment.c | 44 ++++++++++++++++++++++---
fs/f2fs/super.c | 4 +--
fs/fuse/file.c | 1 +
fs/overlayfs/inode.c | 3 +-
include/linux/bug.h | 5 +++
include/linux/quotaops.h | 2 +-
kernel/kprobes.c | 3 +-
kernel/locking/lockdep.c | 3 ++
kernel/printk/printk.c | 2 +-
kernel/sched/core.c | 4 ---
kernel/sched/fair.c | 5 +--
kernel/time/alarmtimer.c | 4 +--
net/appletalk/ddp.c | 5 +++
net/ax25/af_ax25.c | 2 ++
net/bluetooth/hci_event.c | 5 ---
net/bluetooth/l2cap_core.c | 9 +-----
net/ieee802154/socket.c | 3 ++
net/mac80211/ieee80211_i.h | 3 ++
net/mac80211/mlme.c | 17 ++++++++--
net/mac80211/tdls.c | 23 ++++++++++++++
net/nfc/llcp_sock.c | 7 ++--
net/openvswitch/datapath.c | 2 +-
net/rds/tcp.c | 8 +++--
net/sched/sch_netem.c | 2 +-
net/wireless/util.c | 1 +
sound/firewire/tascam/tascam-pcm.c | 3 ++
sound/firewire/tascam/tascam-stream.c | 42 ++++++++++++++++--------
sound/hda/hdac_controller.c | 2 ++
sound/i2c/other/ak4xxx-adda.c | 7 ++--
sound/pci/hda/hda_controller.c | 5 ++-
sound/pci/hda/hda_intel.c | 2 +-
sound/pci/hda/patch_analog.c | 1 +
sound/pci/hda/patch_realtek.c | 3 ++
sound/soc/codecs/sgtl5000.c | 15 ++++++---
sound/soc/fsl/fsl_ssi.c | 5 ++-
sound/soc/intel/common/sst-ipc.c | 2 ++
sound/soc/soc-generic-dmaengine-pcm.c | 6 ++++
sound/usb/pcm.c | 1 +
tools/lib/traceevent/Makefile | 6 ++--
tools/lib/traceevent/event-plugin.c | 2 +-
116 files changed, 679 insertions(+), 204 deletions(-)
From: Chris Lew <clew(a)codeaurora.org>
The device release function is set before registering with rpmsg. If
rpmsg registration fails, the framework will call device_put(), which
invokes the release function. The channel create logic does not need to
free rpdev if rpmsg_register_device() fails and release is called.
Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable(a)vger.kernel.org
Tested-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Signed-off-by: Chris Lew <clew(a)codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson(a)linaro.org>
---
Changes since v1:
- None
drivers/rpmsg/qcom_glink_native.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 21fd2ae5f7f1..89e02baea2d0 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1423,15 +1423,13 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid,
ret = rpmsg_register_device(rpdev);
if (ret)
- goto free_rpdev;
+ goto rcid_remove;
channel->rpdev = rpdev;
}
return 0;
-free_rpdev:
- kfree(rpdev);
rcid_remove:
spin_lock_irqsave(&glink->idr_lock, flags);
idr_remove(&glink->rcids, channel->rcid);
--
2.18.0
From: Chris Lew <clew(a)codeaurora.org>
In a remote processor crash scenario, there is no guarantee the remote
processor sent close requests before it went into a bad state. Remove
the reference that is normally handled by the close command in the
so channel resources can be released.
Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable(a)vger.kernel.org
Tested-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Signed-off-by: Chris Lew <clew(a)codeaurora.org>
Reported-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson(a)linaro.org>
---
Changes since v1:
- None
drivers/rpmsg/qcom_glink_native.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 72ed671f5dcd..21fd2ae5f7f1 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1641,6 +1641,10 @@ void qcom_glink_native_remove(struct qcom_glink *glink)
idr_for_each_entry(&glink->lcids, channel, cid)
kref_put(&channel->refcount, qcom_glink_channel_release);
+ /* Release any defunct local channels, waiting for close-req */
+ idr_for_each_entry(&glink->rcids, channel, cid)
+ kref_put(&channel->refcount, qcom_glink_channel_release);
+
idr_destroy(&glink->lcids);
idr_destroy(&glink->rcids);
spin_unlock_irqrestore(&glink->idr_lock, flags);
--
2.18.0