From: Suganath Prabu S <suganath-prabu.subramani(a)broadcom.com>
Although SAS3 & SAS3.5 IT HBA controllers support
64-bit DMA addressing, as per hardware design,
if DMA able range contains all 64-bits set (0xFFFFFFFF-FFFFFFFF) then
it results in a firmware fault.
e.g. SGE's start address is 0xFFFFFFFF-FFFF000 and
data length is 0x1000 bytes. when HBA tries to DMA the data
at 0xFFFFFFFF-FFFFFFFF location then HBA will
fault the firmware.
Fix:
Driver will set 63-bit DMA mask to ensure the above address
will not be used.
Cc: <stable(a)vger.kernel.org> # 4.4.186, # 4.9.186 # 4.14.136
Signed-off-by: Suganath Prabu S <suganath-prabu.subramani(a)broadcom.com>
---
RESEND: Resending this patch to include 4.14.136 stable kernel.
This Patch is for stable kernels 4.4.186, 4.9.186 and 4.14.136.
Original patch is applied to 5.3/scsi-fixes.
commit ID: df9a606184bfdb5ae3ca9d226184e9489f5c24f7
drivers/scsi/mpt3sas/mpt3sas_base.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 9b53672..7af7a08 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -1686,9 +1686,11 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
{
struct sysinfo s;
u64 consistent_dma_mask;
+ /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */
+ int dma_mask = (ioc->hba_mpi_version_belonged > MPI2_VERSION) ? 63 : 64;
if (ioc->dma_mask)
- consistent_dma_mask = DMA_BIT_MASK(64);
+ consistent_dma_mask = DMA_BIT_MASK(dma_mask);
else
consistent_dma_mask = DMA_BIT_MASK(32);
@@ -1696,11 +1698,11 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
const uint64_t required_mask =
dma_get_required_mask(&pdev->dev);
if ((required_mask > DMA_BIT_MASK(32)) &&
- !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
+ !pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_mask)) &&
!pci_set_consistent_dma_mask(pdev, consistent_dma_mask)) {
ioc->base_add_sg_single = &_base_add_sg_single_64;
ioc->sge_size = sizeof(Mpi2SGESimple64_t);
- ioc->dma_mask = 64;
+ ioc->dma_mask = dma_mask;
goto out;
}
}
@@ -1726,7 +1728,7 @@ static int
_base_change_consistent_dma_mask(struct MPT3SAS_ADAPTER *ioc,
struct pci_dev *pdev)
{
- if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+ if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(ioc->dma_mask))) {
if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)))
return -ENODEV;
}
@@ -3325,7 +3327,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
total_sz += sz;
} while (ioc->rdpq_array_enable && (++i < ioc->reply_queue_count));
- if (ioc->dma_mask == 64) {
+ if (ioc->dma_mask > 32) {
if (_base_change_consistent_dma_mask(ioc, ioc->pdev) != 0) {
pr_warn(MPT3SAS_FMT
"no suitable consistent DMA mask for %s\n",
--
2.16.3
This is the start of the stable review cycle for the 4.14.139 release.
There are 69 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri 16 Aug 2019 04:55:34 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.139-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.139-rc1
Luca Coelho <luciano.coelho(a)intel.com>
iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support
Luca Coelho <luciano.coelho(a)intel.com>
iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
iwlwifi: mvm: fix an out-of-bound access
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
iwlwifi: don't unmap as page memory that was mapped as single
Brian Norris <briannorris(a)chromium.org>
mwifiex: fix 802.11n/WPA detection
Wanpeng Li <wanpengli(a)tencent.com>
KVM: Fix leak vCPU's VMCS value into other pCPU
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFSv4: Fix an Oops in nfs4_do_setattr
Trond Myklebust <trond.myklebust(a)primarydata.com>
NFSv4: Only pass the delegation to setattr if we're sending a truncate
Steve French <stfrench(a)microsoft.com>
smb3: send CAP_DFS capability during session setup
Pavel Shilovsky <pshilov(a)microsoft.com>
SMB3: Fix deadlock in validate negotiate hits reconnect
Brian Norris <briannorris(a)chromium.org>
mac80211: don't WARN on short WMM parameters from AP
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457)
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda - Don't override global PCM hw info flag
Wenwen Wang <wenwen(a)cs.uga.edu>
ALSA: firewire: fix a memory leak bug
Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com>
drm/i915: Fix wrong escape clock divisor init for GLK
Guenter Roeck <linux(a)roeck-us.net>
hwmon: (nct7802) Fix wrong detection of in4 presence
Tomas Bortoli <tomasbortoli(a)gmail.com>
can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
Tomas Bortoli <tomasbortoli(a)gmail.com>
can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
Roderick Colenbrander <roderick(a)gaikai.com>
HID: sony: Fix race condition between rumble and device remove.
Leonard Crestez <leonard.crestez(a)nxp.com>
perf/core: Fix creating kernel counters for PMUs that override event->cpu
Peter Zijlstra <peterz(a)infradead.org>
tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
Wenwen Wang <wenwen(a)cs.uga.edu>
test_firmware: fix a memory leak bug
Hannes Reinecke <hare(a)suse.de>
scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG
Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
scsi: ibmvfc: fix WARN_ON during event pool release
Junxiao Bi <junxiao.bi(a)oracle.com>
scsi: megaraid_sas: fix panic on loading firmware crashdump
Arnd Bergmann <arnd(a)arndb.de>
ARM: davinci: fix sleep.S build error on ARMv4
Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com>
ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id()
Arnd Bergmann <arnd(a)arndb.de>
drbd: dynamically allocate shash descriptor
Arnaldo Carvalho de Melo <acme(a)redhat.com>
perf probe: Avoid calling freeing routine multiple times for same pointer
Jiri Olsa <jolsa(a)kernel.org>
perf tools: Fix proper buffer size for feature processing
Charles Keepax <ckeepax(a)opensource.cirrus.com>
ALSA: compress: Be more restrictive about when a drain is allowed
Charles Keepax <ckeepax(a)opensource.cirrus.com>
ALSA: compress: Don't allow paritial drain operations on capture streams
Charles Keepax <ckeepax(a)opensource.cirrus.com>
ALSA: compress: Prevent bypasses of set_params
Charles Keepax <ckeepax(a)opensource.cirrus.com>
ALSA: compress: Fix regression on compressed capture streams
Julian Wiedmann <jwi(a)linux.ibm.com>
s390/qdio: add sanity checks to the fast-requeue path
Wen Yang <wen.yang99(a)zte.com.cn>
cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
Qian Cai <cai(a)lca.pw>
drm: silence variable 'conn' set but not used
Björn Gerhart <gerhart(a)posteo.de>
hwmon: (nct6775) Fix register address and added missed tolerance for nct6106
Brian Norris <briannorris(a)chromium.org>
mac80211: don't warn about CW params when not using them
Thomas Tai <thomas.tai(a)oracle.com>
iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND
Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
scripts/sphinx-pre-install: fix script for RHEL/CentOS
Laura Garcia Liebana <nevola(a)gmail.com>
netfilter: nft_hash: fix symhash with modulus one
Miaohe Lin <linmiaohe(a)huawei.com>
netfilter: Fix rpfilter dropping vrf packets by mistake
Farhan Ali <alifm(a)linux.ibm.com>
vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn
Florian Westphal <fw(a)strlen.de>
netfilter: nfnetlink: avoid deadlock due to synchronous request_module
Stephane Grosjean <s.grosjean(a)peak-system.com>
can: peak_usb: fix potential double kfree_skb()
Nikita Yushchenko <nikita.yoush(a)cogentembedded.com>
can: rcar_canfd: fix possible IRQ storm on high load
Suzuki K Poulose <suzuki.poulose(a)arm.com>
usb: yurex: Fix use-after-free in yurex_delete
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: host: xhci-rcar: Fix timeout in xhci_suspend()
Thomas Richter <tmricht(a)linux.ibm.com>
perf record: Fix module size on s390
Adrian Hunter <adrian.hunter(a)intel.com>
perf db-export: Fix thread__exec_comm()
Thomas Richter <tmricht(a)linux.ibm.com>
perf annotate: Fix s390 gap between kernel end and module start
Joerg Roedel <jroedel(a)suse.de>
mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
Joerg Roedel <jroedel(a)suse.de>
x86/mm: Sync also unmappings in vmalloc_sync_all()
Joerg Roedel <jroedel(a)suse.de>
x86/mm: Check for pfn instead of page in vmalloc_sync_one()
Ben Hutchings <ben(a)decadent.org.uk>
tcp: Clear sk_send_head after purging the write queue
Gary R Hook <gary.hook(a)amd.com>
crypto: ccp - Add support for valid authsize values less than 16
Gary R Hook <gary.hook(a)amd.com>
crypto: ccp - Validate buffer lengths for copy operations
Nick Desaulniers <ndesaulniers(a)google.com>
lkdtm: support llvm-objcopy
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: synaptics - enable RMI mode for HP Spectre X360
Mikulas Patocka <mpatocka(a)redhat.com>
loop: set PF_MEMALLOC_NOIO for the worker thread
Kevin Hao <haokexin(a)gmail.com>
mmc: cavium: Add the missing dma unmap when the dma has finished.
Kevin Hao <haokexin(a)gmail.com>
mmc: cavium: Set the correct dma max segment size for mmc_host
Wenwen Wang <wenwen(a)cs.uga.edu>
sound: fix a memory leak bug
Oliver Neukum <oneukum(a)suse.com>
usb: iowarrior: fix deadlock on disconnect
Gavin Li <git(a)thegavinli.com>
usb: usbfs: fix double-free of usb memory upon submiturb error
Gary R Hook <gary.hook(a)amd.com>
crypto: ccp - Ignore tag length when decrypting GCM ciphertext
Gary R Hook <gary.hook(a)amd.com>
crypto: ccp - Fix oops by properly managing allocated structures
Joe Perches <joe(a)perches.com>
iio: adc: max9611: Fix misuse of GENMASK macro
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-davinci/sleep.S | 1 +
arch/powerpc/kvm/powerpc.c | 5 +
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/kvm/svm.c | 6 ++
arch/x86/kvm/vmx.c | 6 ++
arch/x86/kvm/x86.c | 16 +++
arch/x86/mm/fault.c | 15 ++-
drivers/acpi/arm64/iort.c | 4 +-
drivers/block/drbd/drbd_receiver.c | 14 ++-
drivers/block/loop.c | 2 +-
drivers/cpufreq/pasemi-cpufreq.c | 23 ++---
drivers/crypto/ccp/ccp-crypto-aes-galois.c | 14 +++
drivers/crypto/ccp/ccp-ops.c | 139 +++++++++++++++++++--------
drivers/firmware/Kconfig | 5 +-
drivers/firmware/iscsi_ibft.c | 4 +
drivers/gpu/drm/drm_framebuffer.c | 2 +-
drivers/gpu/drm/i915/intel_dsi_pll.c | 4 +-
drivers/hid/hid-sony.c | 15 ++-
drivers/hwmon/nct6775.c | 3 +-
drivers/hwmon/nct7802.c | 6 +-
drivers/iio/adc/max9611.c | 2 +-
drivers/input/mouse/synaptics.c | 1 +
drivers/misc/Makefile | 3 +-
drivers/mmc/host/cavium.c | 4 +-
drivers/net/can/rcar/rcar_canfd.c | 9 +-
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 8 +-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 29 ++++--
drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 2 +
drivers/net/wireless/marvell/mwifiex/main.h | 1 +
drivers/net/wireless/marvell/mwifiex/scan.c | 3 +-
drivers/s390/cio/qdio_main.c | 12 +--
drivers/s390/cio/vfio_ccw_cp.c | 4 +-
drivers/scsi/device_handler/scsi_dh_alua.c | 7 +-
drivers/scsi/ibmvscsi/ibmvfc.c | 2 +-
drivers/scsi/megaraid/megaraid_sas_base.c | 3 +
drivers/tty/tty_ldsem.c | 5 +-
drivers/usb/core/devio.c | 2 -
drivers/usb/host/xhci-rcar.c | 9 +-
drivers/usb/misc/iowarrior.c | 7 +-
drivers/usb/misc/yurex.c | 2 +-
fs/cifs/smb2pdu.c | 7 +-
fs/nfs/nfs4proc.c | 12 ++-
include/linux/ccp.h | 2 +
include/linux/kvm_host.h | 1 +
include/net/tcp.h | 3 +
include/sound/compress_driver.h | 5 +-
kernel/events/core.c | 2 +-
lib/test_firmware.c | 5 +-
mm/vmalloc.c | 9 ++
net/ipv4/netfilter/ipt_rpfilter.c | 1 +
net/ipv6/netfilter/ip6t_rpfilter.c | 8 +-
net/mac80211/driver-ops.c | 13 ++-
net/mac80211/mlme.c | 10 ++
net/netfilter/nfnetlink.c | 2 +-
net/netfilter/nft_hash.c | 2 +-
scripts/sphinx-pre-install | 2 +-
sound/core/compress_offload.c | 60 +++++++++---
sound/firewire/packets-buffer.c | 2 +-
sound/pci/hda/hda_controller.c | 13 ++-
sound/pci/hda/hda_controller.h | 2 +-
sound/pci/hda/hda_intel.c | 63 +++++++++++-
sound/sound_core.c | 3 +-
tools/perf/arch/s390/util/machine.c | 31 +++++-
tools/perf/builtin-probe.c | 10 ++
tools/perf/util/header.c | 2 +-
tools/perf/util/machine.c | 3 +-
tools/perf/util/machine.h | 2 +-
tools/perf/util/symbol.c | 7 +-
tools/perf/util/symbol.h | 1 +
tools/perf/util/thread.c | 12 ++-
virt/kvm/kvm_main.c | 25 ++++-
74 files changed, 558 insertions(+), 170 deletions(-)
After _gadget_stop_activity is executed, we can consider the hardware
operation for gadget has finished, and the udc can be stopped and enter
low power mode. So, any later hardware operations (from usb_ep_ops APIs
or usb_gadget_ops APIs) should be considered invalid, any deinitializatons
has been covered at _gadget_stop_activity.
I meet this problem when I plug out usb cable from PC using mass_storage
gadget, my callstack like: vbus interrupt->.vbus_session->
composite_disconnect ->pm_runtime_put_sync(&_gadget->dev),
the composite_disconnect will call fsg_disable, but fsg_disable calls
usb_ep_disable using async way, there are register accesses for
usb_ep_disable. So sometimes, I get system hang due to visit register
without clock, sometimes not.
The Linux Kernel USB maintainer Alan Stern suggests this kinds of solution.
See: http://marc.info/?l=linux-usb&m=138541769810983&w=2.
Cc: <stable(a)vger.kernel.org> #v4.9+
Signed-off-by: Peter Chen <peter.chen(a)nxp.com>
---
This patch is at NXP internal tree long time, and no issues have found.
Submit to mainline kenrel.
drivers/usb/chipidea/udc.c | 32 ++++++++++++++++++++++++--------
1 file changed, 24 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 053432d79bf7..8f18e7b6cadf 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -709,12 +709,6 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
struct ci_hdrc *ci = container_of(gadget, struct ci_hdrc, gadget);
unsigned long flags;
- spin_lock_irqsave(&ci->lock, flags);
- ci->gadget.speed = USB_SPEED_UNKNOWN;
- ci->remote_wakeup = 0;
- ci->suspended = 0;
- spin_unlock_irqrestore(&ci->lock, flags);
-
/* flush all endpoints */
gadget_for_each_ep(ep, gadget) {
usb_ep_fifo_flush(ep);
@@ -732,6 +726,12 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
ci->status = NULL;
}
+ spin_lock_irqsave(&ci->lock, flags);
+ ci->gadget.speed = USB_SPEED_UNKNOWN;
+ ci->remote_wakeup = 0;
+ ci->suspended = 0;
+ spin_unlock_irqrestore(&ci->lock, flags);
+
return 0;
}
@@ -1303,6 +1303,10 @@ static int ep_disable(struct usb_ep *ep)
return -EBUSY;
spin_lock_irqsave(hwep->lock, flags);
+ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+ spin_unlock_irqrestore(hwep->lock, flags);
+ return 0;
+ }
/* only internal SW should disable ctrl endpts */
@@ -1392,6 +1396,10 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
return -EINVAL;
spin_lock_irqsave(hwep->lock, flags);
+ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+ spin_unlock_irqrestore(hwep->lock, flags);
+ return 0;
+ }
retval = _ep_queue(ep, req, gfp_flags);
spin_unlock_irqrestore(hwep->lock, flags);
return retval;
@@ -1415,8 +1423,8 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
return -EINVAL;
spin_lock_irqsave(hwep->lock, flags);
-
- hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
+ if (hwep->ci->gadget.speed != USB_SPEED_UNKNOWN)
+ hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
dma_pool_free(hwep->td_pool, node->ptr, node->dma);
@@ -1487,6 +1495,10 @@ static void ep_fifo_flush(struct usb_ep *ep)
}
spin_lock_irqsave(hwep->lock, flags);
+ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+ spin_unlock_irqrestore(hwep->lock, flags);
+ return;
+ }
hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
@@ -1559,6 +1571,10 @@ static int ci_udc_wakeup(struct usb_gadget *_gadget)
int ret = 0;
spin_lock_irqsave(&ci->lock, flags);
+ if (ci->gadget.speed == USB_SPEED_UNKNOWN) {
+ spin_unlock_irqrestore(&ci->lock, flags);
+ return 0;
+ }
if (!ci->remote_wakeup) {
ret = -EOPNOTSUPP;
goto out;
--
2.17.1
As reported in [1], the hisi-lpc driver has certain issues in handling
logical PIO regions, specifically unregistering regions.
This series add a method to unregister a logical PIO region, and fixes up
the driver to use them.
RCU usage in logical PIO code looks to always have been broken, so that
is fixed also. This is not a major fix as the list which RCU protects
would be rarely modified.
At this point, there are still separate ongoing discussions about how to
stop the logical PIO and PCI host bridge code leaking ranges, as in [2],
which I haven't had a chance to look at recently.
Hopefully this series can go through the arm soc tree and the maintainers
have no issue with that. I'm talking specifically about the logical PIO
code, which went through PCI tree on only previous upstreaming.
[1] https://lore.kernel.org/lkml/1560770148-57960-1-git-send-email-john.garry@h…
[2] https://lore.kernel.org/lkml/4b24fd36-e716-7c5e-31cc-13da727802e7@huawei.co…
Changes since v3:
https://lore.kernel.org/lkml/1561566418-22714-1-git-send-email-john.garry@h…
- drop optimisation patch (lib: logic_pio: Enforce LOGIC_PIO_INDIRECT
region ops are set at registration)
Not a fix
- rebase to v5.3-rc2
- cc stable
Change since v2:
- Add hisi_lpc_acpi_remove() stub to fix build for !CONFIG_ACPI
Changes since v1:
- Add more reasoning in RCU fix patch
- Create separate patch to change LOGIC_PIO_CPU_MMIO registration to
accomodate unregistration
John Garry (5):
lib: logic_pio: Fix RCU usage
lib: logic_pio: Avoid possible overlap for unregistering regions
lib: logic_pio: Add logic_pio_unregister_range()
bus: hisi_lpc: Unregister logical PIO range to avoid potential
use-after-free
bus: hisi_lpc: Add .remove method to avoid driver unbind crash
drivers/bus/hisi_lpc.c | 47 +++++++++++++++++++++----
include/linux/logic_pio.h | 1 +
lib/logic_pio.c | 73 +++++++++++++++++++++++++++++----------
3 files changed, 96 insertions(+), 25 deletions(-)
--
2.17.1