- Linux-stable-mirror - lists.linaro.org

[PATCH] staging: vt6655: Remove vif check from vnt_interrupt

by Malcolm Priestley

A check for vif is made in vnt_interrupt_work. There is a small chance of leaving interrupt disabled while vif is NULL and the work hasn't been scheduled. Signed-off-by: Malcolm Priestley <tvboxspy(a)gmail.com> CC: stable(a)vger.kernel.org # v4.2+ --- drivers/staging/vt6655/device_main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c index 83f1a1cf9182..c6bb4aaf9bd0 100644 --- a/drivers/staging/vt6655/device_main.c +++ b/drivers/staging/vt6655/device_main.c @@ -1137,8 +1137,7 @@ static irqreturn_t vnt_interrupt(int irq, void *arg) { struct vnt_private *priv = arg; - if (priv->vif) - schedule_work(&priv->interrupt_work); + schedule_work(&priv->interrupt_work); MACvIntDisable(priv->PortOffset); -- 2.20.1

6 years, 5 months

1
0
0 0

[PATCH AUTOSEL 3.18 01/41] i2c: sis630: correct format strings

by Sasha Levin

From: Louis Taylor <louis(a)kragniz.eu> [ Upstream commit 60f7691c624b41a05bfc3493d9b0519e7951b7ef ] When compiling with -Wformat, clang warns: drivers/i2c/busses/i2c-sis630.c:482:4: warning: format specifies type 'unsigned short' but the argument has type 'int' [-Wformat] smbus_base + SMB_STS, ^~~~~~~~~~~~~~~~~~~~ drivers/i2c/busses/i2c-sis630.c:483:4: warning: format specifies type 'unsigned short' but the argument has type 'int' [-Wformat] smbus_base + SMB_STS + SIS630_SMB_IOREGION - 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/i2c/busses/i2c-sis630.c:531:37: warning: format specifies type 'unsigned short' but the argument has type 'int' [-Wformat] "SMBus SIS630 adapter at %04hx", smbus_base + SMB_STS); ~~~~~ ^~~~~~~~~~~~~~~~~~~~ This patch fixes the format strings to use the format type for int. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Signed-off-by: Louis Taylor <louis(a)kragniz.eu> Reviewed-by: Nick Desaulniers <ndesaulniers(a)google.com> Reviewed-by: Jean Delvare <jdelvare(a)suse.de> Signed-off-by: Wolfram Sang <wsa(a)the-dreams.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/i2c/busses/i2c-sis630.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c index 1e6805b5cef2..a57aa4fe51a4 100644 --- a/drivers/i2c/busses/i2c-sis630.c +++ b/drivers/i2c/busses/i2c-sis630.c @@ -478,7 +478,7 @@ static int sis630_setup(struct pci_dev *sis630_dev) if (!request_region(smbus_base + SMB_STS, SIS630_SMB_IOREGION, sis630_driver.name)) { dev_err(&sis630_dev->dev, - "I/O Region 0x%04hx-0x%04hx for SMBus already in use.\n", + "I/O Region 0x%04x-0x%04x for SMBus already in use.\n", smbus_base + SMB_STS, smbus_base + SMB_STS + SIS630_SMB_IOREGION - 1); retval = -EBUSY; @@ -528,7 +528,7 @@ static int sis630_probe(struct pci_dev *dev, const struct pci_device_id *id) sis630_adapter.dev.parent = &dev->dev; snprintf(sis630_adapter.name, sizeof(sis630_adapter.name), - "SMBus SIS630 adapter at %04hx", smbus_base + SMB_STS); + "SMBus SIS630 adapter at %04x", smbus_base + SMB_STS); return i2c_add_adapter(&sis630_adapter); } -- 2.19.1

6 years, 5 months

1
40
0 0

[PATCH AUTOSEL 4.4 01/63] CIFS: fix POSIX lock leak and invalid ptr deref

by Sasha Levin

From: Aurelien Aptel <aaptel(a)suse.com> [ Upstream commit bc31d0cdcfbadb6258b45db97e93b1c83822ba33 ] We have a customer reporting crashes in lock_get_status() with many "Leaked POSIX lock" messages preceeding the crash. Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... POSIX: fl_owner=ffff8900e7b79380 fl_flags=0x1 fl_type=0x1 fl_pid=20709 Leaked POSIX lock on dev=0x0:0x4b ino... Leaked locks on dev=0x0:0x4b ino=0xf911400000029: POSIX: fl_owner=ffff89f41c870e00 fl_flags=0x1 fl_type=0x1 fl_pid=19592 stack segment: 0000 [#1] SMP Modules linked in: binfmt_misc msr tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag rpcsec_gss_krb5 arc4 ecb auth_rpcgss nfsv4 md4 nfs nls_utf8 lockd grace cifs sunrpc ccm dns_resolver fscache af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock xfs libcrc32c sb_edac edac_core crct10dif_pclmul crc32_pclmul ghash_clmulni_intel drbg ansi_cprng vmw_balloon aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd joydev pcspkr vmxnet3 i2c_piix4 vmw_vmci shpchp fjes processor button ac btrfs xor raid6_pq sr_mod cdrom ata_generic sd_mod ata_piix vmwgfx crc32c_intel drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm serio_raw ahci libahci drm libata vmw_pvscsi sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod autofs4 Supported: Yes CPU: 6 PID: 28250 Comm: lsof Not tainted 4.4.156-94.64-default #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 task: ffff88a345f28740 ti: ffff88c74005c000 task.ti: ffff88c74005c000 RIP: 0010:[<ffffffff8125dcab>] [<ffffffff8125dcab>] lock_get_status+0x9b/0x3b0 RSP: 0018:ffff88c74005fd90 EFLAGS: 00010202 RAX: ffff89bde83e20ae RBX: ffff89e870003d18 RCX: 0000000049534f50 RDX: ffffffff81a3541f RSI: ffffffff81a3544e RDI: ffff89bde83e20ae RBP: 0026252423222120 R08: 0000000020584953 R09: 000000000000ffff R10: 0000000000000000 R11: ffff88c74005fc70 R12: ffff89e5ca7b1340 R13: 00000000000050e5 R14: ffff89e870003d30 R15: ffff89e5ca7b1340 FS: 00007fafd64be800(0000) GS:ffff89f41fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001c80018 CR3: 000000a522048000 CR4: 0000000000360670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 0000000000000208 ffffffff81a3d6b6 ffff89e870003d30 ffff89e870003d18 ffff89e5ca7b1340 ffff89f41738d7c0 ffff89e870003d30 ffff89e5ca7b1340 ffffffff8125e08f 0000000000000000 ffff89bc22b67d00 ffff88c74005ff28 Call Trace: [<ffffffff8125e08f>] locks_show+0x2f/0x70 [<ffffffff81230ad1>] seq_read+0x251/0x3a0 [<ffffffff81275bbc>] proc_reg_read+0x3c/0x70 [<ffffffff8120e456>] __vfs_read+0x26/0x140 [<ffffffff8120e9da>] vfs_read+0x7a/0x120 [<ffffffff8120faf2>] SyS_read+0x42/0xa0 [<ffffffff8161cbc3>] entry_SYSCALL_64_fastpath+0x1e/0xb7 When Linux closes a FD (close(), close-on-exec, dup2(), ...) it calls filp_close() which also removes all posix locks. The lock struct is initialized like so in filp_close() and passed down to cifs ... lock.fl_type = F_UNLCK; lock.fl_flags = FL_POSIX | FL_CLOSE; lock.fl_start = 0; lock.fl_end = OFFSET_MAX; ... Note the FL_CLOSE flag, which hints the VFS code that this unlocking is done for closing the fd. filp_close() locks_remove_posix(filp, id); vfs_lock_file(filp, F_SETLK, &lock, NULL); return filp->f_op->lock(filp, cmd, fl) => cifs_lock() rc = cifs_setlk(file, flock, type, wait_flag, posix_lck, lock, unlock, xid); rc = server->ops->mand_unlock_range(cfile, flock, xid); if (flock->fl_flags & FL_POSIX && !rc) rc = locks_lock_file_wait(file, flock) Notice how we don't call locks_lock_file_wait() which does the generic VFS lock/unlock/wait work on the inode if rc != 0. If we are closing the handle, the SMB server is supposed to remove any locks associated with it. Similarly, cifs.ko frees and wakes up any lock and lock waiter when closing the file: cifs_close() cifsFileInfo_put(file->private_data) /* * Delete any outstanding lock records. We'll lose them when the file * is closed anyway. */ down_write(&cifsi->lock_sem); list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { list_del(&li->llist); cifs_del_lock_waiters(li); kfree(li); } list_del(&cifs_file->llist->llist); kfree(cifs_file->llist); up_write(&cifsi->lock_sem); So we can safely ignore unlocking failures in cifs_lock() if they happen with the FL_CLOSE flag hint set as both the server and the client take care of it during the actual closing. This is not a proper fix for the unlocking failure but it's safe and it seems to prevent the lock leakages and crashes the customer experiences. Signed-off-by: Aurelien Aptel <aaptel(a)suse.com> Signed-off-by: NeilBrown <neil(a)brown.name> Signed-off-by: Steve French <stfrench(a)microsoft.com> Acked-by: Pavel Shilovsky <pshilov(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/cifs/file.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 0305e3866216..23a8374fa97f 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -1574,8 +1574,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type, rc = server->ops->mand_unlock_range(cfile, flock, xid); out: - if (flock->fl_flags & FL_POSIX && !rc) + if (flock->fl_flags & FL_POSIX) { + /* + * If this is a request to remove all locks because we + * are closing the file, it doesn't matter if the + * unlocking failed as both cifs.ko and the SMB server + * remove the lock on file close + */ + if (rc) { + cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc); + if (!(flock->fl_flags & FL_CLOSE)) + return rc; + } rc = locks_lock_file_wait(file, flock); + } return rc; } -- 2.19.1

6 years, 5 months

1
62
0 0

[PATCH AUTOSEL 4.14 001/123] CIFS: fix POSIX lock leak and invalid ptr deref

by Sasha Levin

From: Aurelien Aptel <aaptel(a)suse.com> [ Upstream commit bc31d0cdcfbadb6258b45db97e93b1c83822ba33 ] We have a customer reporting crashes in lock_get_status() with many "Leaked POSIX lock" messages preceeding the crash. Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... POSIX: fl_owner=ffff8900e7b79380 fl_flags=0x1 fl_type=0x1 fl_pid=20709 Leaked POSIX lock on dev=0x0:0x4b ino... Leaked locks on dev=0x0:0x4b ino=0xf911400000029: POSIX: fl_owner=ffff89f41c870e00 fl_flags=0x1 fl_type=0x1 fl_pid=19592 stack segment: 0000 [#1] SMP Modules linked in: binfmt_misc msr tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag rpcsec_gss_krb5 arc4 ecb auth_rpcgss nfsv4 md4 nfs nls_utf8 lockd grace cifs sunrpc ccm dns_resolver fscache af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock xfs libcrc32c sb_edac edac_core crct10dif_pclmul crc32_pclmul ghash_clmulni_intel drbg ansi_cprng vmw_balloon aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd joydev pcspkr vmxnet3 i2c_piix4 vmw_vmci shpchp fjes processor button ac btrfs xor raid6_pq sr_mod cdrom ata_generic sd_mod ata_piix vmwgfx crc32c_intel drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm serio_raw ahci libahci drm libata vmw_pvscsi sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod autofs4 Supported: Yes CPU: 6 PID: 28250 Comm: lsof Not tainted 4.4.156-94.64-default #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 task: ffff88a345f28740 ti: ffff88c74005c000 task.ti: ffff88c74005c000 RIP: 0010:[<ffffffff8125dcab>] [<ffffffff8125dcab>] lock_get_status+0x9b/0x3b0 RSP: 0018:ffff88c74005fd90 EFLAGS: 00010202 RAX: ffff89bde83e20ae RBX: ffff89e870003d18 RCX: 0000000049534f50 RDX: ffffffff81a3541f RSI: ffffffff81a3544e RDI: ffff89bde83e20ae RBP: 0026252423222120 R08: 0000000020584953 R09: 000000000000ffff R10: 0000000000000000 R11: ffff88c74005fc70 R12: ffff89e5ca7b1340 R13: 00000000000050e5 R14: ffff89e870003d30 R15: ffff89e5ca7b1340 FS: 00007fafd64be800(0000) GS:ffff89f41fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001c80018 CR3: 000000a522048000 CR4: 0000000000360670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 0000000000000208 ffffffff81a3d6b6 ffff89e870003d30 ffff89e870003d18 ffff89e5ca7b1340 ffff89f41738d7c0 ffff89e870003d30 ffff89e5ca7b1340 ffffffff8125e08f 0000000000000000 ffff89bc22b67d00 ffff88c74005ff28 Call Trace: [<ffffffff8125e08f>] locks_show+0x2f/0x70 [<ffffffff81230ad1>] seq_read+0x251/0x3a0 [<ffffffff81275bbc>] proc_reg_read+0x3c/0x70 [<ffffffff8120e456>] __vfs_read+0x26/0x140 [<ffffffff8120e9da>] vfs_read+0x7a/0x120 [<ffffffff8120faf2>] SyS_read+0x42/0xa0 [<ffffffff8161cbc3>] entry_SYSCALL_64_fastpath+0x1e/0xb7 When Linux closes a FD (close(), close-on-exec, dup2(), ...) it calls filp_close() which also removes all posix locks. The lock struct is initialized like so in filp_close() and passed down to cifs ... lock.fl_type = F_UNLCK; lock.fl_flags = FL_POSIX | FL_CLOSE; lock.fl_start = 0; lock.fl_end = OFFSET_MAX; ... Note the FL_CLOSE flag, which hints the VFS code that this unlocking is done for closing the fd. filp_close() locks_remove_posix(filp, id); vfs_lock_file(filp, F_SETLK, &lock, NULL); return filp->f_op->lock(filp, cmd, fl) => cifs_lock() rc = cifs_setlk(file, flock, type, wait_flag, posix_lck, lock, unlock, xid); rc = server->ops->mand_unlock_range(cfile, flock, xid); if (flock->fl_flags & FL_POSIX && !rc) rc = locks_lock_file_wait(file, flock) Notice how we don't call locks_lock_file_wait() which does the generic VFS lock/unlock/wait work on the inode if rc != 0. If we are closing the handle, the SMB server is supposed to remove any locks associated with it. Similarly, cifs.ko frees and wakes up any lock and lock waiter when closing the file: cifs_close() cifsFileInfo_put(file->private_data) /* * Delete any outstanding lock records. We'll lose them when the file * is closed anyway. */ down_write(&cifsi->lock_sem); list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { list_del(&li->llist); cifs_del_lock_waiters(li); kfree(li); } list_del(&cifs_file->llist->llist); kfree(cifs_file->llist); up_write(&cifsi->lock_sem); So we can safely ignore unlocking failures in cifs_lock() if they happen with the FL_CLOSE flag hint set as both the server and the client take care of it during the actual closing. This is not a proper fix for the unlocking failure but it's safe and it seems to prevent the lock leakages and crashes the customer experiences. Signed-off-by: Aurelien Aptel <aaptel(a)suse.com> Signed-off-by: NeilBrown <neil(a)brown.name> Signed-off-by: Steve French <stfrench(a)microsoft.com> Acked-by: Pavel Shilovsky <pshilov(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/cifs/file.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 72d6f4db9bdc..cd69c1e9750f 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -1631,8 +1631,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type, rc = server->ops->mand_unlock_range(cfile, flock, xid); out: - if (flock->fl_flags & FL_POSIX && !rc) + if (flock->fl_flags & FL_POSIX) { + /* + * If this is a request to remove all locks because we + * are closing the file, it doesn't matter if the + * unlocking failed as both cifs.ko and the SMB server + * remove the lock on file close + */ + if (rc) { + cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc); + if (!(flock->fl_flags & FL_CLOSE)) + return rc; + } rc = locks_lock_file_wait(file, flock); + } return rc; } -- 2.19.1

6 years, 5 months

1
122
0 0

[PATCH AUTOSEL 4.19 001/192] CIFS: fix POSIX lock leak and invalid ptr deref

by Sasha Levin

From: Aurelien Aptel <aaptel(a)suse.com> [ Upstream commit bc31d0cdcfbadb6258b45db97e93b1c83822ba33 ] We have a customer reporting crashes in lock_get_status() with many "Leaked POSIX lock" messages preceeding the crash. Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x56 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... Leaked POSIX lock on dev=0x0:0x53 ... POSIX: fl_owner=ffff8900e7b79380 fl_flags=0x1 fl_type=0x1 fl_pid=20709 Leaked POSIX lock on dev=0x0:0x4b ino... Leaked locks on dev=0x0:0x4b ino=0xf911400000029: POSIX: fl_owner=ffff89f41c870e00 fl_flags=0x1 fl_type=0x1 fl_pid=19592 stack segment: 0000 [#1] SMP Modules linked in: binfmt_misc msr tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag rpcsec_gss_krb5 arc4 ecb auth_rpcgss nfsv4 md4 nfs nls_utf8 lockd grace cifs sunrpc ccm dns_resolver fscache af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock xfs libcrc32c sb_edac edac_core crct10dif_pclmul crc32_pclmul ghash_clmulni_intel drbg ansi_cprng vmw_balloon aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd joydev pcspkr vmxnet3 i2c_piix4 vmw_vmci shpchp fjes processor button ac btrfs xor raid6_pq sr_mod cdrom ata_generic sd_mod ata_piix vmwgfx crc32c_intel drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm serio_raw ahci libahci drm libata vmw_pvscsi sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod autofs4 Supported: Yes CPU: 6 PID: 28250 Comm: lsof Not tainted 4.4.156-94.64-default #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 task: ffff88a345f28740 ti: ffff88c74005c000 task.ti: ffff88c74005c000 RIP: 0010:[<ffffffff8125dcab>] [<ffffffff8125dcab>] lock_get_status+0x9b/0x3b0 RSP: 0018:ffff88c74005fd90 EFLAGS: 00010202 RAX: ffff89bde83e20ae RBX: ffff89e870003d18 RCX: 0000000049534f50 RDX: ffffffff81a3541f RSI: ffffffff81a3544e RDI: ffff89bde83e20ae RBP: 0026252423222120 R08: 0000000020584953 R09: 000000000000ffff R10: 0000000000000000 R11: ffff88c74005fc70 R12: ffff89e5ca7b1340 R13: 00000000000050e5 R14: ffff89e870003d30 R15: ffff89e5ca7b1340 FS: 00007fafd64be800(0000) GS:ffff89f41fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001c80018 CR3: 000000a522048000 CR4: 0000000000360670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 0000000000000208 ffffffff81a3d6b6 ffff89e870003d30 ffff89e870003d18 ffff89e5ca7b1340 ffff89f41738d7c0 ffff89e870003d30 ffff89e5ca7b1340 ffffffff8125e08f 0000000000000000 ffff89bc22b67d00 ffff88c74005ff28 Call Trace: [<ffffffff8125e08f>] locks_show+0x2f/0x70 [<ffffffff81230ad1>] seq_read+0x251/0x3a0 [<ffffffff81275bbc>] proc_reg_read+0x3c/0x70 [<ffffffff8120e456>] __vfs_read+0x26/0x140 [<ffffffff8120e9da>] vfs_read+0x7a/0x120 [<ffffffff8120faf2>] SyS_read+0x42/0xa0 [<ffffffff8161cbc3>] entry_SYSCALL_64_fastpath+0x1e/0xb7 When Linux closes a FD (close(), close-on-exec, dup2(), ...) it calls filp_close() which also removes all posix locks. The lock struct is initialized like so in filp_close() and passed down to cifs ... lock.fl_type = F_UNLCK; lock.fl_flags = FL_POSIX | FL_CLOSE; lock.fl_start = 0; lock.fl_end = OFFSET_MAX; ... Note the FL_CLOSE flag, which hints the VFS code that this unlocking is done for closing the fd. filp_close() locks_remove_posix(filp, id); vfs_lock_file(filp, F_SETLK, &lock, NULL); return filp->f_op->lock(filp, cmd, fl) => cifs_lock() rc = cifs_setlk(file, flock, type, wait_flag, posix_lck, lock, unlock, xid); rc = server->ops->mand_unlock_range(cfile, flock, xid); if (flock->fl_flags & FL_POSIX && !rc) rc = locks_lock_file_wait(file, flock) Notice how we don't call locks_lock_file_wait() which does the generic VFS lock/unlock/wait work on the inode if rc != 0. If we are closing the handle, the SMB server is supposed to remove any locks associated with it. Similarly, cifs.ko frees and wakes up any lock and lock waiter when closing the file: cifs_close() cifsFileInfo_put(file->private_data) /* * Delete any outstanding lock records. We'll lose them when the file * is closed anyway. */ down_write(&cifsi->lock_sem); list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { list_del(&li->llist); cifs_del_lock_waiters(li); kfree(li); } list_del(&cifs_file->llist->llist); kfree(cifs_file->llist); up_write(&cifsi->lock_sem); So we can safely ignore unlocking failures in cifs_lock() if they happen with the FL_CLOSE flag hint set as both the server and the client take care of it during the actual closing. This is not a proper fix for the unlocking failure but it's safe and it seems to prevent the lock leakages and crashes the customer experiences. Signed-off-by: Aurelien Aptel <aaptel(a)suse.com> Signed-off-by: NeilBrown <neil(a)brown.name> Signed-off-by: Steve French <stfrench(a)microsoft.com> Acked-by: Pavel Shilovsky <pshilov(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/cifs/file.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 08761a6a039d..d847132ab027 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -1631,8 +1631,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type, rc = server->ops->mand_unlock_range(cfile, flock, xid); out: - if (flock->fl_flags & FL_POSIX && !rc) + if (flock->fl_flags & FL_POSIX) { + /* + * If this is a request to remove all locks because we + * are closing the file, it doesn't matter if the + * unlocking failed as both cifs.ko and the SMB server + * remove the lock on file close + */ + if (rc) { + cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc); + if (!(flock->fl_flags & FL_CLOSE)) + return rc; + } rc = locks_lock_file_wait(file, flock); + } return rc; } -- 2.19.1

6 years, 5 months

1
191
0 0

[PATCH] scsi: sd: Quiesce warning if device does not report optimal I/O size

by Martin K. Petersen

Commit a83da8a4509d ("scsi: sd: Optimal I/O size should be a multiple of physical block size") split one conditional into several separate statements in an effort to provide more accurate warning messages when a device reports a nonsensical value. However, this reorganization accidentally dropped the precondition of the reported value being larger than zero. This lead to a warning getting emitted on devices that do not report an optimal I/O size at all. Remain silent if a device does not report an optimal I/O size. Fixes: a83da8a4509d ("scsi: sd: Optimal I/O size should be a multiple of physical block size") Reported-by: Hussam Al-Tayeb <ht990332(a)gmx.com> Cc: Randy Dunlap <rdunlap(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> --- drivers/scsi/sd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 9d8e15d03d2b..87d542de2db7 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -3074,6 +3074,9 @@ static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp, unsigned int opt_xfer_bytes = logical_to_bytes(sdp, sdkp->opt_xfer_blocks); + if (sdkp->opt_xfer_blocks == 0) + return false; + if (sdkp->opt_xfer_blocks > dev_max) { sd_first_printk(KERN_WARNING, sdkp, "Optimal transfer size %u logical blocks " \ -- 2.21.0

6 years, 5 months

3
2
0 0

[PATCH for-rc 0/5] IB/hfi1: Fixes for 5.1 rc cycle

by Dennis Dalessandro

Here is a set of small fixes that we would like to land in the rc cycle for 5.1. One of them is marked as stable. The first patch fixes an unnecessary stack trace due to incorrect WQ flags. The next three fix issues uncovered due to TID RDMA which was brought in for 5.1. The last one is a bug in VNIC. --- Kaike Wan (4): IB/hfi1: Failed to drain send queue when QP is put into error state IB/hfi1: Clear the IOWAIT pending bits when QP is put into error state IB/hfi1: Eliminate opcode tests on mr deref IB/hfi1: Fix the allocation of RSM table Mike Marciniszyn (1): IB/hfi1: Fix WQ_MEM_RECLAIM warning drivers/infiniband/hw/hfi1/chip.c | 26 +++++++++++++++++++------- drivers/infiniband/hw/hfi1/init.c | 3 ++- drivers/infiniband/hw/hfi1/qp.c | 4 +++- drivers/infiniband/hw/hfi1/rc.c | 4 ++-- 4 files changed, 26 insertions(+), 11 deletions(-) -- -Denny

6 years, 5 months

2
2
0 0

Re: [PATCH] ASoC: intel: Fix crash at suspend/resume after failed codec registration

by Guenter Roeck

On Wed, Mar 27, 2019 at 02:00:54PM +0000, Sasha Levin wrote: > Hi, > > [This is an automated email] > > This commit has been processed because it contains a -stable tag. > The stable tag indicates that it's relevant for the following trees: all > > The bot has tested the following trees: v5.0.4, v4.19.31, v4.14.108, v4.9.165, v4.4.177, v3.18.137. > > v5.0.4: Build OK! > v4.19.31: Build OK! > v4.14.108: Failed to apply! Possible dependencies: > 6840962b0a19 ("ASoC: intel: atom: replace platform to component") > > v4.9.165: Failed to apply! Possible dependencies: > 6840962b0a19 ("ASoC: intel: atom: replace platform to component") > 80cc4df8b46e ("ASoC: Intel: make snd_soc_platform_driver const") > > v4.4.177: Failed to apply! Possible dependencies: > 6840962b0a19 ("ASoC: intel: atom: replace platform to component") > 80cc4df8b46e ("ASoC: Intel: make snd_soc_platform_driver const") > > v3.18.137: Failed to apply! Possible dependencies: > 026da220c512 ("ASoC: Intel: Add Cherrytrail & Braswell machine driver cht_bsw_rt5672") > 0505700104cd ("ASoC: Intel: Add support for decoupled mode in skl driver") > 0fbc7d732020 ("ASoC: Intel: sst: Add makefile and kconfig changes") > 17119a465706 ("ASoC: Intel: Add Cherrytrail & Braswell machine driver cht_bsw_max98090_ti") > 24c8d14192cc ("ASoC: Intel: mrfld: add DSP core controls") > 29e1812d7611 ("ASoC: Intel: mrfld - remove unnecessary check for pointer") > 369a9f5f397f ("ASoC: Intel: fix machine driver warnings") > 3af36706ff6c ("ASoC: Intel: Skylake: Add topology core init and handlers") > 4fa805738e49 ("ASoC: Intel: mrfld: add the gain controls") > 54e6beccc671 ("ASoC: Intel: add support for platform suspend") > 6840962b0a19 ("ASoC: intel: atom: replace platform to component") > 80cc4df8b46e ("ASoC: Intel: make snd_soc_platform_driver const") > 85c85e5d6d57 ("ASoC: broadwell: Register jacks at the card level") > 996cc8494d66 ("ASoC: Intel: add BYTCR machine driver with RT5640") > a40e693c7f5e ("ASoC: Intel: Add Skylake HDA platform driver") > b663a8c5c9c0 ("ASoC: Intel: Skylake: Initialize and load DSP controls") > c1e99c913be4 ("ASoC: Intel: Add jack detection for Broadwell") > d8c2dab8381d ("ASoC: Intel: Add Skylake HDA audio driver") > e18acdc04ab2 ("ASoC: Intel: Add Cherrytrail & Braswell machine driver cht_bsw_rt5645") > e4f5ccd050e5 ("ASoC: Intel: mrfld: add the DSP DAPM widgets") > e56c72d5f201 ("ASoC: Intel: create boards folder and move sst boards files in") > eb965e3686f5 ("ASoC: Intel: Add makefile support for SKL driver") > > > How should we proceed with this patch? > This needs a backport to older kernel versions to take the missing commit 6840962b0a19 into account. I'll be happy to provide that after this patch is available in mainline (afaics that is not yet the case). Guenter

6 years, 5 months

1
0
0 0

patch "tty: pty: Fix race condition between release_one_tty and pty_write" added to tty-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty: pty: Fix race condition between release_one_tty and pty_write to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the tty-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From b9ca5f8560af244489b4a1bc1ae88b341f24bc95 Mon Sep 17 00:00:00 2001 From: Sahara <keun-o.park(a)darkmatter.ae> Date: Mon, 11 Feb 2019 11:09:15 +0400 Subject: tty: pty: Fix race condition between release_one_tty and pty_write Especially when a linked tty is used such as pty, the linked tty port's buf works have not been cancelled while master tty port's buf work has been cancelled. Since release_one_tty and flush_to_ldisc run in workqueue threads separately, when pty_cleanup happens and link tty port is freed, flush_to_ldisc tries to access freed port and port->itty, eventually it causes a panic. This patch utilizes the magic value with holding the tty_mutex to check if the tty->link is valid. Fixes: 2b022ab7542d ("pty: cancel pty slave port buf's work in tty_release") Signed-off-by: Sahara <keun-o.park(a)darkmatter.ae> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/pty.c | 7 +++++++ drivers/tty/tty_io.c | 3 +++ 2 files changed, 10 insertions(+) diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c index 00099a8439d2..ef72031ab5b9 100644 --- a/drivers/tty/pty.c +++ b/drivers/tty/pty.c @@ -116,6 +116,12 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) if (tty->stopped) return 0; + mutex_lock(&tty_mutex); + if (to->magic != TTY_MAGIC) { + mutex_unlock(&tty_mutex); + return -EIO; + } + if (c > 0) { spin_lock_irqsave(&to->port->lock, flags); /* Stuff the data into the input queue of the other end */ @@ -125,6 +131,7 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) tty_flip_buffer_push(to->port); spin_unlock_irqrestore(&to->port->lock, flags); } + mutex_unlock(&tty_mutex); return c; } diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 5fa250157025..c27777f3b8c4 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -1448,10 +1448,13 @@ static void release_one_tty(struct work_struct *work) struct tty_driver *driver = tty->driver; struct module *owner = driver->owner; + mutex_lock(&tty_mutex); if (tty->ops->cleanup) tty->ops->cleanup(tty); tty->magic = 0; + mutex_unlock(&tty_mutex); + tty_driver_kref_put(driver); module_put(owner); -- 2.21.0

6 years, 5 months

1
0
0 0

patch "tty: vt.c: Fix TIOCL_BLANKSCREEN console blanking if blankinterval ==" added to tty-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty: vt.c: Fix TIOCL_BLANKSCREEN console blanking if blankinterval == to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the tty-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 75ddbc1fb11efac87b611d48e9802f6fe2bb2163 Mon Sep 17 00:00:00 2001 From: Yifeng Li <tomli(a)tomli.me> Date: Tue, 5 Mar 2019 07:02:49 +0800 Subject: tty: vt.c: Fix TIOCL_BLANKSCREEN console blanking if blankinterval == 0 Previously, in the userspace, it was possible to use the "setterm" command from util-linux to blank the VT console by default, using the following command. According to the man page, > The force option keeps the screen blank even if a key is pressed. It was implemented by calling TIOCL_BLANKSCREEN. case BLANKSCREEN: ioctlarg = TIOCL_BLANKSCREEN; if (ioctl(STDIN_FILENO, TIOCLINUX, &ioctlarg)) warn(_("cannot force blank")); break; However, after Linux 4.12, this command ceased to work anymore, which is unexpected. By inspecting the kernel source, it shows that the issue was triggered by the side-effect from commit a4199f5eb809 ("tty: Disable default console blanking interval"). The console blanking is implemented by function do_blank_screen() in vt.c: "blank_state" will be initialized to "blank_normal_wait" in con_init() if AND ONLY IF ("blankinterval" > 0). If "blankinterval" is 0, "blank_state" will be "blank_off" (== 0), and a call to do_blank_screen() will always abort, even if a forced blanking is required from the user by calling TIOCL_BLANKSCREEN, the console won't be blanked. This behavior is unexpected from a user's point-of-view, since it's not mentioned in any documentation. The setterm man page suggests it will always work, and the kernel comments in uapi/linux/tiocl.h says > /* keep screen blank even if a key is pressed */ > #define TIOCL_BLANKSCREEN 14 To fix it, we simply remove the "blank_state != blank_off" check, as pointed out by Nicolas Pitre, this check doesn't logically make sense and it's safe to remove. Suggested-by: Nicolas Pitre <nicolas.pitre(a)linaro.org> Fixes: a4199f5eb809 ("tty: Disable default console blanking interval") Signed-off-by: Yifeng Li <tomli(a)tomli.me> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/vt/vt.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index d34984aa646d..721edee50234 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4178,8 +4178,6 @@ void do_blank_screen(int entering_gfx) return; } - if (blank_state != blank_normal_wait) - return; blank_state = blank_off; /* don't blank graphics */ -- 2.21.0

6 years, 5 months

1
0
0 0

patch "tty/vt: fix write/write race in ioctl(KDSKBSENT) handler" added to tty-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty/vt: fix write/write race in ioctl(KDSKBSENT) handler to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the tty-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 46ca3f735f345c9d87383dd3a09fa5d43870770e Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich <slyfox(a)gentoo.org> Date: Sun, 10 Mar 2019 21:24:15 +0000 Subject: tty/vt: fix write/write race in ioctl(KDSKBSENT) handler The bug manifests as an attempt to access deallocated memory: BUG: unable to handle kernel paging request at ffff9c8735448000 #PF error: [PROT] [WRITE] PGD 288a05067 P4D 288a05067 PUD 288a07067 PMD 7f60c2063 PTE 80000007f5448161 Oops: 0003 [#1] PREEMPT SMP CPU: 6 PID: 388 Comm: loadkeys Tainted: G C 5.0.0-rc6-00153-g5ded5871030e #91 Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M-D3H, BIOS F12 11/14/2013 RIP: 0010:__memmove+0x81/0x1a0 Code: 4c 89 4f 10 4c 89 47 18 48 8d 7f 20 73 d4 48 83 c2 20 e9 a2 00 00 00 66 90 48 89 d1 4c 8b 5c 16 f8 4c 8d 54 17 f8 48 c1 e9 03 <f3> 48 a5 4d 89 1a e9 0c 01 00 00 0f 1f 40 00 48 89 d1 4c 8b 1e 49 RSP: 0018:ffffa1b9002d7d08 EFLAGS: 00010203 RAX: ffff9c873541af43 RBX: ffff9c873541af43 RCX: 00000c6f105cd6bf RDX: 0000637882e986b6 RSI: ffff9c8735447ffb RDI: ffff9c8735447ffb RBP: ffff9c8739cd3800 R08: ffff9c873b802f00 R09: 00000000fffff73b R10: ffffffffb82b35f1 R11: 00505b1b004d5b1b R12: 0000000000000000 R13: ffff9c873541af3d R14: 000000000000000b R15: 000000000000000c FS: 00007f450c390580(0000) GS:ffff9c873f180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9c8735448000 CR3: 00000007e213c002 CR4: 00000000000606e0 Call Trace: vt_do_kdgkb_ioctl+0x34d/0x440 vt_ioctl+0xba3/0x1190 ? __bpf_prog_run32+0x39/0x60 ? mem_cgroup_commit_charge+0x7b/0x4e0 tty_ioctl+0x23f/0x920 ? preempt_count_sub+0x98/0xe0 ? __seccomp_filter+0x67/0x600 do_vfs_ioctl+0xa2/0x6a0 ? syscall_trace_enter+0x192/0x2d0 ksys_ioctl+0x3a/0x70 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x54/0xe0 entry_SYSCALL_64_after_hwframe+0x49/0xbe The bug manifests on systemd systems with multiple vtcon devices: # cat /sys/devices/virtual/vtconsole/vtcon0/name (S) dummy device # cat /sys/devices/virtual/vtconsole/vtcon1/name (M) frame buffer device There systemd runs 'loadkeys' tool in tapallel for each vtcon instance. This causes two parallel ioctl(KDSKBSENT) calls to race into adding the same entry into 'func_table' array at: drivers/tty/vt/keyboard.c:vt_do_kdgkb_ioctl() The function has no locking around writes to 'func_table'. The simplest reproducer is to have initrams with the following init on a 8-CPU machine x86_64: #!/bin/sh loadkeys -q windowkeys ru4 & loadkeys -q windowkeys ru4 & loadkeys -q windowkeys ru4 & loadkeys -q windowkeys ru4 & loadkeys -q windowkeys ru4 & loadkeys -q windowkeys ru4 & loadkeys -q windowkeys ru4 & loadkeys -q windowkeys ru4 & wait The change adds lock on write path only. Reads are still racy. CC: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> CC: Jiri Slaby <jslaby(a)suse.com> Link: https://lkml.org/lkml/2019/2/17/256 Signed-off-by: Sergei Trofimovich <slyfox(a)gentoo.org> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/vt/keyboard.c | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 88312c6c92cc..0617e87ab343 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -123,6 +123,7 @@ static const int NR_TYPES = ARRAY_SIZE(max_vals); static struct input_handler kbd_handler; static DEFINE_SPINLOCK(kbd_event_lock); static DEFINE_SPINLOCK(led_lock); +static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */ static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */ static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */ static bool dead_key_next; @@ -1990,11 +1991,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) char *p; u_char *q; u_char __user *up; - int sz; + int sz, fnw_sz; int delta; char *first_free, *fj, *fnw; int i, j, k; int ret; + unsigned long flags; if (!capable(CAP_SYS_TTY_CONFIG)) perm = 0; @@ -2037,7 +2039,14 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) goto reterr; } + fnw = NULL; + fnw_sz = 0; + /* race aginst other writers */ + again: + spin_lock_irqsave(&func_buf_lock, flags); q = func_table[i]; + + /* fj pointer to next entry after 'q' */ first_free = funcbufptr + (funcbufsize - funcbufleft); for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) ; @@ -2045,10 +2054,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) fj = func_table[j]; else fj = first_free; - + /* buffer usage increase by new entry */ delta = (q ? -strlen(q) : 1) + strlen(kbs->kb_string); + if (delta <= funcbufleft) { /* it fits in current buf */ if (j < MAX_NR_FUNC) { + /* make enough space for new entry at 'fj' */ memmove(fj + delta, fj, first_free - fj); for (k = j; k < MAX_NR_FUNC; k++) if (func_table[k]) @@ -2061,20 +2072,28 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) sz = 256; while (sz < funcbufsize - funcbufleft + delta) sz <<= 1; - fnw = kmalloc(sz, GFP_KERNEL); - if(!fnw) { - ret = -ENOMEM; - goto reterr; + if (fnw_sz != sz) { + spin_unlock_irqrestore(&func_buf_lock, flags); + kfree(fnw); + fnw = kmalloc(sz, GFP_KERNEL); + fnw_sz = sz; + if (!fnw) { + ret = -ENOMEM; + goto reterr; + } + goto again; } if (!q) func_table[i] = fj; + /* copy data before insertion point to new location */ if (fj > funcbufptr) memmove(fnw, funcbufptr, fj - funcbufptr); for (k = 0; k < j; k++) if (func_table[k]) func_table[k] = fnw + (func_table[k] - funcbufptr); + /* copy data after insertion point to new location */ if (first_free > fj) { memmove(fnw + (fj - funcbufptr) + delta, fj, first_free - fj); for (k = j; k < MAX_NR_FUNC; k++) @@ -2087,7 +2106,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) funcbufleft = funcbufleft - delta + sz - funcbufsize; funcbufsize = sz; } + /* finally insert item itself */ strcpy(func_table[i], kbs->kb_string); + spin_unlock_irqrestore(&func_buf_lock, flags); break; } ret = 0; -- 2.21.0

6 years, 5 months

1
0
0 0

patch "Disable kgdboc failed by echo space to" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled Disable kgdboc failed by echo space to to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From 3ec8002951ea173e24b466df1ea98c56b7920e63 Mon Sep 17 00:00:00 2001 From: Wentao Wang <witallwang(a)gmail.com> Date: Wed, 20 Mar 2019 15:30:39 +0000 Subject: Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Echo "" to /sys/module/kgdboc/parameters/kgdboc will fail with "No such device” error. This is caused by function "configure_kgdboc" who init err to ENODEV when the config is empty (legal input) the code go out with ENODEV returned. Fixes: 2dd453168643 ("kgdboc: Fix restrict error") Signed-off-by: Wentao Wang <witallwang(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Acked-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/kgdboc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c index 6fb312e7af71..bfe5e9e034ec 100644 --- a/drivers/tty/serial/kgdboc.c +++ b/drivers/tty/serial/kgdboc.c @@ -148,8 +148,10 @@ static int configure_kgdboc(void) char *cptr = config; struct console *cons; - if (!strlen(config) || isspace(config[0])) + if (!strlen(config) || isspace(config[0])) { + err = 0; goto noconfig; + } kgdboc_io_ops.is_console = 0; kgdb_tty_driver = NULL; -- 2.21.0

6 years, 5 months

1
0
0 0

patch "tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From 69646d7a3689fbe1a65ae90397d22ac3f1b8d40f Mon Sep 17 00:00:00 2001 From: Razvan Stefanescu <razvan.stefanescu(a)microchip.com> Date: Tue, 19 Mar 2019 15:20:35 +0200 Subject: tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped In half-duplex operation, RX should be started after TX completes. If DMA is used, there is a case when the DMA transfer completes but the TX FIFO is not emptied, so the RX cannot be restarted just yet. Use a boolean variable to store this state and rearm TX interrupt mask to be signaled again that the transfer finished. In interrupt transmit handler this variable is used to start RX. A warning message is generated if RX is activated before TX fifo is cleared. Fixes: b389f173aaa1 ("tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done") Signed-off-by: Razvan Stefanescu <razvan.stefanescu(a)microchip.com> Acked-by: Richard Genoud <richard.genoud(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/atmel_serial.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c index 55ca3416113f..0b4f36905321 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -166,6 +166,8 @@ struct atmel_uart_port { unsigned int pending_status; spinlock_t lock_suspended; + bool hd_start_rx; /* can start RX during half-duplex operation */ + /* ISO7816 */ unsigned int fidi_min; unsigned int fidi_max; @@ -933,8 +935,13 @@ static void atmel_complete_tx_dma(void *arg) if (!uart_circ_empty(xmit)) atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); else if (atmel_uart_is_half_duplex(port)) { - /* DMA done, stop TX, start RX for RS485 */ - atmel_start_rx(port); + /* + * DMA done, re-enable TXEMPTY and signal that we can stop + * TX and start RX for RS485 + */ + atmel_port->hd_start_rx = true; + atmel_uart_writel(port, ATMEL_US_IER, + atmel_port->tx_done_mask); } spin_unlock_irqrestore(&port->lock, flags); @@ -1382,9 +1389,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending) struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); if (pending & atmel_port->tx_done_mask) { - /* Either PDC or interrupt transmission */ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); + + /* Start RX if flag was set and FIFO is empty */ + if (atmel_port->hd_start_rx) { + if (!(atmel_uart_readl(port, ATMEL_US_CSR) + & ATMEL_US_TXEMPTY)) + dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n"); + + atmel_port->hd_start_rx = false; + atmel_start_rx(port); + return; + } + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); } } -- 2.21.0

6 years, 5 months

1
0
0 0

patch "tty/serial: atmel: Add is_half_duplex helper" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty/serial: atmel: Add is_half_duplex helper to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From f3040983132bf3477acd45d2452a906e67c2fec9 Mon Sep 17 00:00:00 2001 From: Razvan Stefanescu <razvan.stefanescu(a)microchip.com> Date: Tue, 19 Mar 2019 15:20:34 +0200 Subject: tty/serial: atmel: Add is_half_duplex helper Use a helper function to check that a port needs to use half duplex communication, replacing several occurrences of multi-line bit checking. Fixes: b389f173aaa1 ("tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Razvan Stefanescu <razvan.stefanescu(a)microchip.com> Acked-by: Richard Genoud <richard.genoud(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/atmel_serial.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c index 41b728d223d1..55ca3416113f 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -231,6 +231,13 @@ static inline void atmel_uart_write_char(struct uart_port *port, u8 value) __raw_writeb(value, port->membase + ATMEL_US_THR); } +static inline int atmel_uart_is_half_duplex(struct uart_port *port) +{ + return ((port->rs485.flags & SER_RS485_ENABLED) && + !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || + (port->iso7816.flags & SER_ISO7816_ENABLED); +} + #ifdef CONFIG_SERIAL_ATMEL_PDC static bool atmel_use_pdc_rx(struct uart_port *port) { @@ -608,10 +615,9 @@ static void atmel_stop_tx(struct uart_port *port) /* Disable interrupts */ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); - if (((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || - port->iso7816.flags & SER_ISO7816_ENABLED) + if (atmel_uart_is_half_duplex(port)) atmel_start_rx(port); + } /* @@ -628,9 +634,7 @@ static void atmel_start_tx(struct uart_port *port) return; if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port)) - if (((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || - port->iso7816.flags & SER_ISO7816_ENABLED) + if (atmel_uart_is_half_duplex(port)) atmel_stop_rx(port); if (atmel_use_pdc_tx(port)) @@ -928,9 +932,7 @@ static void atmel_complete_tx_dma(void *arg) */ if (!uart_circ_empty(xmit)) atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); - else if (((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || - port->iso7816.flags & SER_ISO7816_ENABLED) { + else if (atmel_uart_is_half_duplex(port)) { /* DMA done, stop TX, start RX for RS485 */ atmel_start_rx(port); } @@ -1512,9 +1514,7 @@ static void atmel_tx_pdc(struct uart_port *port) atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask); } else { - if (((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || - port->iso7816.flags & SER_ISO7816_ENABLED) { + if (atmel_uart_is_half_duplex(port)) { /* DMA done, stop TX, start RX for RS485 */ atmel_start_rx(port); } -- 2.21.0

6 years, 5 months

1
0
0 0

patch "Disable kgdboc failed by echo space to" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled Disable kgdboc failed by echo space to to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From d70fc79f67c7030fa35d2e1617a02eae6cafb454 Mon Sep 17 00:00:00 2001 From: Wentao Wang <witallwang(a)gmail.com> Date: Wed, 20 Mar 2019 15:30:39 +0000 Subject: Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Echo "" to /sys/module/kgdboc/parameters/kgdboc will fail with "No such device” error. This is caused by function "configure_kgdboc" who init err to ENODEV when the config is empty (legal input) the code go out with ENODEV returned. Fixes: 2dd453168643 ("kgdboc: Fix restrict error") Signed-off-by: Wentao Wang <witallwang(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Acked-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/kgdboc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c index 6fb312e7af71..bfe5e9e034ec 100644 --- a/drivers/tty/serial/kgdboc.c +++ b/drivers/tty/serial/kgdboc.c @@ -148,8 +148,10 @@ static int configure_kgdboc(void) char *cptr = config; struct console *cons; - if (!strlen(config) || isspace(config[0])) + if (!strlen(config) || isspace(config[0])) { + err = 0; goto noconfig; + } kgdboc_io_ops.is_console = 0; kgdb_tty_driver = NULL; -- 2.21.0

6 years, 5 months

1
0
0 0

patch "tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From 244976a371b709789e54be977349a2a6f3ec0ba3 Mon Sep 17 00:00:00 2001 From: Razvan Stefanescu <razvan.stefanescu(a)microchip.com> Date: Tue, 19 Mar 2019 15:20:35 +0200 Subject: tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped In half-duplex operation, RX should be started after TX completes. If DMA is used, there is a case when the DMA transfer completes but the TX FIFO is not emptied, so the RX cannot be restarted just yet. Use a boolean variable to store this state and rearm TX interrupt mask to be signaled again that the transfer finished. In interrupt transmit handler this variable is used to start RX. A warning message is generated if RX is activated before TX fifo is cleared. Fixes: b389f173aaa1 ("tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done") Signed-off-by: Razvan Stefanescu <razvan.stefanescu(a)microchip.com> Acked-by: Richard Genoud <richard.genoud(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/atmel_serial.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c index b4b89a16a41b..5b2f859c327c 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -166,6 +166,8 @@ struct atmel_uart_port { unsigned int pending_status; spinlock_t lock_suspended; + bool hd_start_rx; /* can start RX during half-duplex operation */ + /* ISO7816 */ unsigned int fidi_min; unsigned int fidi_max; @@ -933,8 +935,13 @@ static void atmel_complete_tx_dma(void *arg) if (!uart_circ_empty(xmit)) atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); else if (atmel_uart_is_half_duplex(port)) { - /* DMA done, stop TX, start RX for RS485 */ - atmel_start_rx(port); + /* + * DMA done, re-enable TXEMPTY and signal that we can stop + * TX and start RX for RS485 + */ + atmel_port->hd_start_rx = true; + atmel_uart_writel(port, ATMEL_US_IER, + atmel_port->tx_done_mask); } spin_unlock_irqrestore(&port->lock, flags); @@ -1378,9 +1385,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending) struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); if (pending & atmel_port->tx_done_mask) { - /* Either PDC or interrupt transmission */ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); + + /* Start RX if flag was set and FIFO is empty */ + if (atmel_port->hd_start_rx) { + if (!(atmel_uart_readl(port, ATMEL_US_CSR) + & ATMEL_US_TXEMPTY)) + dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n"); + + atmel_port->hd_start_rx = false; + atmel_start_rx(port); + return; + } + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); } } -- 2.21.0

6 years, 5 months

1
0
0 0

patch "tty/serial: atmel: Add is_half_duplex helper" added to tty-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty/serial: atmel: Add is_half_duplex helper to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From c5d006f66f0f5d8ed729d1284bdecefe113cc95e Mon Sep 17 00:00:00 2001 From: Razvan Stefanescu <razvan.stefanescu(a)microchip.com> Date: Tue, 19 Mar 2019 15:20:34 +0200 Subject: tty/serial: atmel: Add is_half_duplex helper Use a helper function to check that a port needs to use half duplex communication, replacing several occurrences of multi-line bit checking. Fixes: b389f173aaa1 ("tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Razvan Stefanescu <razvan.stefanescu(a)microchip.com> Acked-by: Richard Genoud <richard.genoud(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/atmel_serial.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c index 05147fe24343..b4b89a16a41b 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -231,6 +231,13 @@ static inline void atmel_uart_write_char(struct uart_port *port, u8 value) __raw_writeb(value, port->membase + ATMEL_US_THR); } +static inline int atmel_uart_is_half_duplex(struct uart_port *port) +{ + return ((port->rs485.flags & SER_RS485_ENABLED) && + !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || + (port->iso7816.flags & SER_ISO7816_ENABLED); +} + #ifdef CONFIG_SERIAL_ATMEL_PDC static bool atmel_use_pdc_rx(struct uart_port *port) { @@ -608,10 +615,9 @@ static void atmel_stop_tx(struct uart_port *port) /* Disable interrupts */ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); - if (((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || - port->iso7816.flags & SER_ISO7816_ENABLED) + if (atmel_uart_is_half_duplex(port)) atmel_start_rx(port); + } /* @@ -628,9 +634,7 @@ static void atmel_start_tx(struct uart_port *port) return; if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port)) - if (((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || - port->iso7816.flags & SER_ISO7816_ENABLED) + if (atmel_uart_is_half_duplex(port)) atmel_stop_rx(port); if (atmel_use_pdc_tx(port)) @@ -928,9 +932,7 @@ static void atmel_complete_tx_dma(void *arg) */ if (!uart_circ_empty(xmit)) atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); - else if (((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || - port->iso7816.flags & SER_ISO7816_ENABLED) { + else if (atmel_uart_is_half_duplex(port)) { /* DMA done, stop TX, start RX for RS485 */ atmel_start_rx(port); } @@ -1508,9 +1510,7 @@ static void atmel_tx_pdc(struct uart_port *port) atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask); } else { - if (((port->rs485.flags & SER_RS485_ENABLED) && - !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || - port->iso7816.flags & SER_ISO7816_ENABLED) { + if (atmel_uart_is_half_duplex(port)) { /* DMA done, stop TX, start RX for RS485 */ atmel_start_rx(port); } -- 2.21.0

6 years, 5 months

1
0
0 0

patch "usb: cdc-acm: fix race during wakeup blocking TX traffic" added to usb-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: cdc-acm: fix race during wakeup blocking TX traffic to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From 93e1c8a638308980309e009cc40b5a57ef87caf1 Mon Sep 17 00:00:00 2001 From: Romain Izard <romain.izard.pro(a)gmail.com> Date: Fri, 22 Mar 2019 16:53:02 +0100 Subject: usb: cdc-acm: fix race during wakeup blocking TX traffic When the kernel is compiled with preemption enabled, the URB completion handler can run in parallel with the work responsible for waking up the tty layer. If the URB handler sets the EVENT_TTY_WAKEUP bit during the call to tty_port_tty_wakeup() to signal that there is room for additional input, it will be cleared at the end of this call. As a result, TX traffic on the upper layer will be blocked. This can be seen with a kernel configured with CONFIG_PREEMPT, and a fast modem connected with PPP running over a USB CDC-ACM port. Use test_and_clear_bit() instead, which ensures that each wakeup requested by the URB completion code will trigger a call to tty_port_tty_wakeup(). Fixes: 1aba579f3cf5 cdc-acm: handle read pipe errors Signed-off-by: Romain Izard <romain.izard.pro(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Acked-by: Oliver Neukum <oneukum(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/cdc-acm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 739f8960811a..ec666eb4b7b4 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -558,10 +558,8 @@ static void acm_softint(struct work_struct *work) clear_bit(EVENT_RX_STALL, &acm->flags); } - if (test_bit(EVENT_TTY_WAKEUP, &acm->flags)) { + if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags)) tty_port_tty_wakeup(&acm->port); - clear_bit(EVENT_TTY_WAKEUP, &acm->flags); - } } /* -- 2.21.0

6 years, 5 months

1
0
0 0

Linux 5.0.5

by Greg KH

I'm announcing the release of the 5.0.5 kernel. All users of the 5.0 kernel series must upgrade. The updated 5.0.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.0.y and can be browsed at the normal kernel.org git web browser: http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/mips/include/asm/jump_label.h | 8 - arch/mips/kernel/vmlinux.lds.S | 12 +- arch/mips/loongson64/lemote-2f/irq.c | 2 arch/powerpc/include/asm/vdso_datapage.h | 8 - arch/powerpc/kernel/security.c | 23 +--- arch/powerpc/kernel/vdso64/gettimeofday.S | 4 arch/x86/include/asm/unwind.h | 6 + arch/x86/kernel/unwind_frame.c | 25 ++++ arch/x86/kernel/unwind_orc.c | 17 +++ drivers/block/loop.c | 2 drivers/bluetooth/h4_recv.h | 4 drivers/bluetooth/hci_h4.c | 4 drivers/bluetooth/hci_ldisc.c | 24 ++-- drivers/clocksource/timer-riscv.c | 5 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 2 drivers/gpu/drm/vkms/vkms_crtc.c | 1 drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 -- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 2 drivers/infiniband/core/cma.c | 13 ++ drivers/iommu/amd_iommu.c | 7 + drivers/iommu/iova.c | 5 drivers/irqchip/irq-gic-v3-its.c | 2 drivers/media/usb/uvc/uvc_ctrl.c | 2 drivers/media/v4l2-core/v4l2-ctrls.c | 2 drivers/mmc/host/alcor.c | 25 +++- drivers/mmc/host/mxcmmc.c | 16 --- drivers/mmc/host/pxamci.c | 2 drivers/mmc/host/renesas_sdhi_core.c | 8 + drivers/net/ethernet/mellanox/mlx5/core/qp.c | 66 +++++++------ drivers/scsi/ibmvscsi/ibmvscsi.c | 23 +++- drivers/scsi/qla2xxx/qla_init.c | 7 + drivers/scsi/scsi_lib.c | 6 - fs/aio.c | 72 +++++--------- fs/cifs/smb2pdu.c | 11 +- fs/ext4/ext4_jbd2.h | 2 fs/ext4/file.c | 2 fs/ext4/indirect.c | 12 +- fs/f2fs/segment.c | 43 ++++++-- fs/udf/truncate.c | 3 include/linux/ceph/libceph.h | 2 include/linux/fs.h | 8 + kernel/futex.c | 4 kernel/locking/lockdep.c | 3 net/bluetooth/hci_sock.c | 3 net/bridge/netfilter/ebtables.c | 131 +++++++------------------- net/ceph/ceph_common.c | 18 +++ net/ceph/mon_client.c | 9 + sound/ac97/bus.c | 2 sound/firewire/motu/motu.c | 20 +-- sound/pci/hda/hda_codec.c | 57 ++++++++++- sound/pci/hda/hda_intel.c | 14 +- tools/objtool/check.c | 3 tools/perf/util/probe-event.c | 6 - 54 files changed, 469 insertions(+), 303 deletions(-) Adrian Hunter (1): perf probe: Fix getting the kernel map Alexander Shiyan (1): mmc: mxcmmc: "Revert mmc: mxcmmc: handle highmem pages" Archer Yan (1): MIPS: Fix kernel crash for R6 in jump label branch function Arnd Bergmann (1): mmc: pxamci: fix enum type confusion Atish Patra (1): clocksource/drivers/riscv: Fix clocksource mask Bart Van Assche (1): scsi: core: Avoid that a kernel warning appears during system resume Chao Yu (1): f2fs: fix to avoid deadlock of atomic file operations Chen Jie (1): futex: Ensure that futex address is aligned in handle_futex_death() Christian König (1): drm/amdgpu: fix invalid use of change_bit Daniel Drake (1): mmc: alcor: fix DMA reads Deepak Rawat (1): drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's Dongli Zhang (1): loop: access lo_backing_file only when the loop device is Lo_bound Florian Westphal (1): netfilter: ebtables: remove BUGPRINT messages Greg Kroah-Hartman (1): Linux 5.0.5 Hans Verkuil (1): media: v4l2-ctrls.c/uvc: zero v4l2_event Hui Wang (2): ALSA: hda - Don't trigger jackpoll_work in azx_resume ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec Ilya Dryomov (1): libceph: wait for latest osdmap in ceph_monc_blacklist_add() Jan Kara (1): udf: Fix crash on IO error during truncate Jann Horn (2): x86/unwind: Handle NULL pointer calls better in frame unwinder x86/unwind: Add hardcoded ORC entry for NULL Jaroslav Kysela (1): ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist Jeremy Cline (1): Bluetooth: hci_ldisc: Initialize hci_dev before open() Jiufei Xue (1): ext4: fix NULL pointer dereference while journal is aborted Josh Poimboeuf (1): objtool: Move objtool_file struct off the stack Kefeng Wang (1): Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() Linus Torvalds (1): aio: simplify - and fix - fget/fput for io_submit() Lukas Czerner (1): ext4: fix data corruption caused by unaligned direct AIO Michael Ellerman (2): powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 powerpc/security: Fix spectre_v2 reporting Myungho Jung (3): Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() Bluetooth: Fix decrementing reference count twice in releasing socket RDMA/cma: Rollback source IP address if failing to acquire device Quinn Tran (1): scsi: qla2xxx: Fix FC-AL connection target discovery Rasmus Villemoes (1): irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp Robert Richter (1): iommu/iova: Fix tracking of recently failed iova address Ronnie Sahlberg (1): cifs: allow guest mounts to work for smb3.11 Stanislaw Gruszka (1): iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE Steve French (1): SMB3: Fix SMB3.1.1 guest mounts to Samba Takashi Iwai (2): ALSA: ac97: Fix of-node refcount unbalance ALSA: hda - Record the current power state before suspend/resume calls Takashi Sakamoto (1): ALSA: firewire-motu: use 'version' field of unit directory to identify model Tetsuo Handa (1): drm/vkms: Fix flush_work() without INIT_WORK(). Thomas Zimmermann (1): drm/vmwgfx: Don't double-free the mode stored in par->set_mode Tyrel Datwyler (2): scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton scsi: ibmvscsi: Fix empty event pool access during host removal Waiman Long (1): locking/lockdep: Add debug_locks check in __lock_downgrade() Wolfram Sang (1): mmc: renesas_sdhi: limit block count to 16 bit for old revisions Yasha Cherikovsky (1): MIPS: Ensure ELF appended dtb is relocated Yifeng Li (1): mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. Yishai Hadas (1): net/mlx5: Fix DCT creation bad flow zhangyi (F) (1): ext4: brelse all indirect buffer in ext4_ind_remove_space()

6 years, 5 months

1
1
0 0

Linux 4.19.32

by Greg KH

I'm announcing the release of the 4.19.32 kernel. All users of the 4.19 kernel series must upgrade. The updated 4.19.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y and can be browsed at the normal kernel.org git web browser: http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/mips/include/asm/jump_label.h | 8 - arch/mips/kernel/vmlinux.lds.S | 12 +- arch/mips/loongson64/lemote-2f/irq.c | 2 arch/powerpc/include/asm/vdso_datapage.h | 8 - arch/powerpc/kernel/vdso64/gettimeofday.S | 4 arch/x86/include/asm/unwind.h | 6 + arch/x86/kernel/unwind_frame.c | 25 ++++ arch/x86/kernel/unwind_orc.c | 17 +++ drivers/block/loop.c | 2 drivers/bluetooth/h4_recv.h | 4 drivers/bluetooth/hci_h4.c | 4 drivers/bluetooth/hci_ldisc.c | 24 ++-- drivers/gpu/drm/drm_mode_object.c | 5 drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 -- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 2 drivers/infiniband/core/cma.c | 13 ++ drivers/iommu/amd_iommu.c | 7 + drivers/irqchip/irq-gic-v3-its.c | 2 drivers/media/usb/uvc/uvc_ctrl.c | 2 drivers/media/v4l2-core/v4l2-ctrls.c | 2 drivers/mmc/host/mxcmmc.c | 16 --- drivers/mmc/host/pxamci.c | 2 drivers/mmc/host/renesas_sdhi_core.c | 8 + drivers/power/supply/charger-manager.c | 3 drivers/scsi/ibmvscsi/ibmvscsi.c | 23 +++- fs/cifs/smb2pdu.c | 11 +- fs/ext4/ext4_jbd2.h | 2 fs/ext4/file.c | 2 fs/ext4/indirect.c | 12 +- fs/f2fs/segment.c | 43 ++++++-- fs/udf/truncate.c | 3 include/linux/ceph/libceph.h | 2 kernel/futex.c | 4 kernel/locking/lockdep.c | 3 net/bluetooth/hci_sock.c | 3 net/bridge/netfilter/ebtables.c | 131 +++++++------------------- net/ceph/ceph_common.c | 18 +++ net/ceph/mon_client.c | 9 + sound/ac97/bus.c | 2 sound/firewire/motu/motu.c | 20 +-- sound/pci/hda/hda_codec.c | 57 ++++++++++- sound/pci/hda/hda_intel.c | 6 - sound/pci/hda/patch_ca0132.c | 2 sound/x86/intel_hdmi_audio.c | 1 tools/objtool/check.c | 3 tools/perf/util/probe-event.c | 6 - 47 files changed, 353 insertions(+), 202 deletions(-) Adrian Hunter (1): perf probe: Fix getting the kernel map Alexander Shiyan (1): mmc: mxcmmc: "Revert mmc: mxcmmc: handle highmem pages" Archer Yan (1): MIPS: Fix kernel crash for R6 in jump label branch function Arnd Bergmann (2): mmc: pxamci: fix enum type confusion ALSA: hda/ca0132 - make pci_iounmap() call conditional Baolin Wang (1): power: supply: charger-manager: Fix incorrect return value Chao Yu (1): f2fs: fix to avoid deadlock of atomic file operations Chen Jie (1): futex: Ensure that futex address is aligned in handle_futex_death() Chris Wilson (1): drm: Reorder set_property_atomic to avoid returning with an active ww_ctx Deepak Rawat (1): drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's Dongli Zhang (1): loop: access lo_backing_file only when the loop device is Lo_bound Florian Westphal (1): netfilter: ebtables: remove BUGPRINT messages Greg Kroah-Hartman (1): Linux 4.19.32 Hans Verkuil (1): media: v4l2-ctrls.c/uvc: zero v4l2_event Hui Wang (1): ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec Ilya Dryomov (1): libceph: wait for latest osdmap in ceph_monc_blacklist_add() Jan Kara (1): udf: Fix crash on IO error during truncate Jann Horn (2): x86/unwind: Handle NULL pointer calls better in frame unwinder x86/unwind: Add hardcoded ORC entry for NULL Jaroslav Kysela (1): ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist Jeremy Cline (1): Bluetooth: hci_ldisc: Initialize hci_dev before open() Jiufei Xue (1): ext4: fix NULL pointer dereference while journal is aborted Josh Poimboeuf (1): objtool: Move objtool_file struct off the stack Kefeng Wang (1): Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() Lukas Czerner (1): ext4: fix data corruption caused by unaligned direct AIO Michael Ellerman (1): powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 Myungho Jung (3): Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() Bluetooth: Fix decrementing reference count twice in releasing socket RDMA/cma: Rollback source IP address if failing to acquire device Rasmus Villemoes (1): irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp Ronnie Sahlberg (1): cifs: allow guest mounts to work for smb3.11 Stanislaw Gruszka (1): iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE Steve French (1): SMB3: Fix SMB3.1.1 guest mounts to Samba Takashi Iwai (2): ALSA: ac97: Fix of-node refcount unbalance ALSA: hda - Record the current power state before suspend/resume calls Takashi Sakamoto (1): ALSA: firewire-motu: use 'version' field of unit directory to identify model Thomas Zimmermann (1): drm/vmwgfx: Don't double-free the mode stored in par->set_mode Tyrel Datwyler (2): scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton scsi: ibmvscsi: Fix empty event pool access during host removal Ville Syrjälä (1): ALSA: x86: Fix runtime PM for hdmi-lpe-audio Waiman Long (1): locking/lockdep: Add debug_locks check in __lock_downgrade() Wolfram Sang (1): mmc: renesas_sdhi: limit block count to 16 bit for old revisions Yasha Cherikovsky (1): MIPS: Ensure ELF appended dtb is relocated Yifeng Li (1): mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. zhangyi (F) (1): ext4: brelse all indirect buffer in ext4_ind_remove_space()

6 years, 5 months

1
1
0 0

Linux 4.14.109

by Greg KH

I'm announcing the release of the 4.14.109 kernel. All users of the 4.14 kernel series must upgrade. The updated 4.14.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y and can be browsed at the normal kernel.org git web browser: http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/mips/include/asm/jump_label.h | 8 +- arch/mips/kernel/vmlinux.lds.S | 12 +-- arch/mips/loongson64/lemote-2f/irq.c | 2 arch/x86/include/asm/unwind.h | 6 + arch/x86/kernel/unwind_frame.c | 25 +++++- arch/x86/kernel/unwind_orc.c | 17 ++++ drivers/bluetooth/hci_h4.c | 4 + drivers/bluetooth/hci_ldisc.c | 24 +++--- drivers/gpu/drm/drm_mode_object.c | 5 - drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 --- drivers/iommu/amd_iommu.c | 7 + drivers/media/usb/uvc/uvc_ctrl.c | 2 drivers/media/v4l2-core/v4l2-ctrls.c | 2 drivers/mmc/host/pxamci.c | 2 drivers/net/wireless/ath/ath10k/wmi.c | 2 drivers/pci/dwc/pcie-designware-ep.c | 12 ++- drivers/pci/dwc/pcie-designware.h | 1 drivers/pci/endpoint/pci-epc-core.c | 10 -- drivers/pci/endpoint/pci-epf-core.c | 4 - drivers/power/supply/charger-manager.c | 3 drivers/rtc/rtc-lib.c | 6 - drivers/scsi/ibmvscsi/ibmvscsi.c | 23 ++++- drivers/scsi/ufs/ufshcd.c | 14 ++- drivers/usb/core/config.c | 9 +- drivers/video/backlight/pwm_bl.c | 9 +- fs/ext4/ext4_jbd2.h | 2 fs/ext4/file.c | 2 fs/ext4/indirect.c | 12 ++- fs/udf/truncate.c | 3 include/linux/ceph/libceph.h | 2 kernel/futex.c | 4 + kernel/locking/lockdep.c | 3 kernel/sched/cpufreq_schedutil.c | 3 lib/int_sqrt.c | 3 net/bluetooth/hci_sock.c | 3 net/bridge/netfilter/ebtables.c | 131 +++++++++------------------------ net/ceph/ceph_common.c | 18 ++++ net/ceph/mon_client.c | 9 ++ sound/pci/hda/hda_codec.c | 57 +++++++++++++- sound/x86/intel_hdmi_audio.c | 1 tools/objtool/check.c | 3 tools/perf/util/probe-event.c | 6 + 43 files changed, 301 insertions(+), 184 deletions(-) Adrian Hunter (1): perf probe: Fix getting the kernel map Andrey Konovalov (1): USB: core: only clean up what we allocated Archer Yan (1): MIPS: Fix kernel crash for R6 in jump label branch function Arnd Bergmann (2): mmc: pxamci: fix enum type confusion ath10k: avoid possible string overflow Baolin Wang (2): rtc: Fix overflow when converting time64_t to rtc_time power: supply: charger-manager: Fix incorrect return value Chen Jie (1): futex: Ensure that futex address is aligned in handle_futex_death() Chris Wilson (1): drm: Reorder set_property_atomic to avoid returning with an active ww_ctx Enric Balletbo i Serra (1): pwm-backlight: Enable/disable the PWM before/after LCD enable toggle. Florian Westphal (1): netfilter: ebtables: remove BUGPRINT messages Greg Kroah-Hartman (1): Linux 4.14.109 Hans Verkuil (1): media: v4l2-ctrls.c/uvc: zero v4l2_event Hui Wang (1): ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec Ilya Dryomov (1): libceph: wait for latest osdmap in ceph_monc_blacklist_add() Jan Kara (1): udf: Fix crash on IO error during truncate Jann Horn (2): x86/unwind: Handle NULL pointer calls better in frame unwinder x86/unwind: Add hardcoded ORC entry for NULL Jeremy Cline (1): Bluetooth: hci_ldisc: Initialize hci_dev before open() Jiufei Xue (1): ext4: fix NULL pointer dereference while journal is aborted Josh Poimboeuf (1): objtool: Move objtool_file struct off the stack Jules Maselbas (1): sched/cpufreq/schedutil: Fix error path mutex unlock Kefeng Wang (1): Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() Kishon Vijay Abraham I (1): PCI: endpoint: Use EPC's device in dma_alloc_coherent()/dma_free_coherent() Lukas Czerner (1): ext4: fix data corruption caused by unaligned direct AIO Myungho Jung (2): Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() Bluetooth: Fix decrementing reference count twice in releasing socket Niklas Cassel (2): PCI: designware-ep: dw_pcie_ep_set_msi() should only set MMC bits PCI: designware-ep: Read-only registers need DBI_RO_WR_EN to be writable Peter Zijlstra (1): lib/int_sqrt: optimize small argument Stanislaw Gruszka (1): iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE Takashi Iwai (1): ALSA: hda - Record the current power state before suspend/resume calls Thomas Zimmermann (1): drm/vmwgfx: Don't double-free the mode stored in par->set_mode Tyrel Datwyler (2): scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton scsi: ibmvscsi: Fix empty event pool access during host removal Ville Syrjälä (1): ALSA: x86: Fix runtime PM for hdmi-lpe-audio Waiman Long (1): locking/lockdep: Add debug_locks check in __lock_downgrade() Yasha Cherikovsky (1): MIPS: Ensure ELF appended dtb is relocated Yifeng Li (1): mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. kehuanlin (1): scsi: ufs: fix wrong command type of UTRD for UFSHCI v2.1 zhangyi (F) (1): ext4: brelse all indirect buffer in ext4_ind_remove_space()

6 years, 5 months

1
1
0 0

Linux 4.9.166

by Greg KH

I'm announcing the release of the 4.9.166 kernel. All users of the 4.9 kernel series must upgrade. The updated 4.9.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y and can be browsed at the normal kernel.org git web browser: http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 - arch/arm64/kernel/traps.c | 8 +++- arch/mips/include/asm/jump_label.h | 8 ++-- arch/mips/kernel/vmlinux.lds.S | 12 ++++-- arch/mips/loongson64/lemote-2f/irq.c | 2 - drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 +----- drivers/iommu/amd_iommu.c | 7 +++- drivers/media/usb/uvc/uvc_ctrl.c | 2 - drivers/media/v4l2-core/v4l2-ctrls.c | 2 - drivers/mmc/host/pxamci.c | 2 - drivers/net/wireless/ath/ath10k/wmi.c | 2 - drivers/power/supply/charger-manager.c | 3 - drivers/rtc/rtc-lib.c | 6 +-- drivers/scsi/ufs/ufshcd.c | 14 ++++---- drivers/tty/serial/sprd_serial.c | 6 ++- drivers/usb/core/config.c | 9 +++-- drivers/video/backlight/pwm_bl.c | 9 ++--- fs/dcache.c | 10 ++--- fs/ext4/ext4_jbd2.h | 2 - fs/ext4/file.c | 2 - fs/ext4/indirect.c | 12 ++++-- fs/udf/truncate.c | 3 + include/linux/ceph/libceph.h | 2 + include/net/inet_connection_sock.h | 5 -- kernel/futex.c | 4 ++ kernel/locking/lockdep.c | 3 + lib/int_sqrt.c | 3 + net/bluetooth/hci_sock.c | 3 - net/ceph/ceph_common.c | 18 +++++++++- net/ceph/mon_client.c | 9 +++++ net/dccp/ipv4.c | 8 ---- net/dccp/ipv6.c | 2 - net/ipv4/tcp_input.c | 8 ---- sound/pci/hda/hda_codec.c | 57 +++++++++++++++++++++++++++++++-- tools/objtool/check.c | 3 + 35 files changed, 174 insertions(+), 86 deletions(-) Al Viro (1): Hang/soft lockup in d_invalidate with simultaneous calls Andrey Konovalov (1): USB: core: only clean up what we allocated Archer Yan (1): MIPS: Fix kernel crash for R6 in jump label branch function Arnd Bergmann (2): mmc: pxamci: fix enum type confusion ath10k: avoid possible string overflow Baolin Wang (2): rtc: Fix overflow when converting time64_t to rtc_time power: supply: charger-manager: Fix incorrect return value Chen Jie (1): futex: Ensure that futex address is aligned in handle_futex_death() Enric Balletbo i Serra (1): pwm-backlight: Enable/disable the PWM before/after LCD enable toggle. Eric Dumazet (1): tcp/dccp: drop SYN packets if accept queue is full Greg Kroah-Hartman (1): Linux 4.9.166 Hans Verkuil (1): media: v4l2-ctrls.c/uvc: zero v4l2_event Hui Wang (1): ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec Ilya Dryomov (1): libceph: wait for latest osdmap in ceph_monc_blacklist_add() Jan Kara (1): udf: Fix crash on IO error during truncate Jiufei Xue (1): ext4: fix NULL pointer dereference while journal is aborted Josh Poimboeuf (1): objtool: Move objtool_file struct off the stack Lanqing Liu (1): serial: sprd: clear timeout interrupt only rather than all interrupts Lukas Czerner (1): ext4: fix data corruption caused by unaligned direct AIO Myungho Jung (1): Bluetooth: Fix decrementing reference count twice in releasing socket Peter Zijlstra (1): lib/int_sqrt: optimize small argument Qiao Zhou (1): arm64: traps: disable irq in die() Stanislaw Gruszka (1): iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE Takashi Iwai (1): ALSA: hda - Record the current power state before suspend/resume calls Thomas Zimmermann (1): drm/vmwgfx: Don't double-free the mode stored in par->set_mode Waiman Long (1): locking/lockdep: Add debug_locks check in __lock_downgrade() Wei Qiao (1): serial: sprd: adjust TIMEOUT to a big value Yasha Cherikovsky (1): MIPS: Ensure ELF appended dtb is relocated Yifeng Li (1): mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. kehuanlin (1): scsi: ufs: fix wrong command type of UTRD for UFSHCI v2.1 zhangyi (F) (1): ext4: brelse all indirect buffer in ext4_ind_remove_space()

6 years, 5 months

1
1
0 0

[PATCH] ipmi_si: Fix crash when using hard-coded device

by minyard＠acm.org

From: Corey Minyard <cminyard(a)mvista.com> Backport from 41b766d661bf94a364960862cfc248a78313dbd3 When excuting a command like: modprobe ipmi_si ports=0xffc0e3 type=bt The system would get an oops. The trouble here is that ipmi_si_hardcode_find_bmc() is called before ipmi_si_platform_init(), but initialization of the hard-coded device creates an IPMI platform device, which won't be initialized yet. The real trouble is that hard-coded devices aren't created with any device, and the fixup is done later. So do it right, create the hard-coded devices as normal platform devices. This required adding some new resource types to the IPMI platform code for passing information required by the hard-coded device and adding some code to remove the hard-coded platform devices on module removal. To enforce the "hard-coded devices passed by the user take priority over firmware devices" rule, some special code was added to check and see if a hard-coded device already exists. The backport required some minor fixups and adding the device id table that had been added in another change and was used in this one. Reported-by: Yang Yingliang <yangyingliang(a)huawei.com> Cc: stable(a)vger.kernel.org # v4.15+ Signed-off-by: Corey Minyard <cminyard(a)mvista.com> Tested-by: Yang Yingliang <yangyingliang(a)huawei.com> --- This backport is for 4.19, the backport from the main tree failed. Passes basic tests. drivers/char/ipmi/ipmi_si.h | 4 +- drivers/char/ipmi/ipmi_si_hardcode.c | 236 ++++++++++++++++++++------- drivers/char/ipmi/ipmi_si_intf.c | 22 ++- drivers/char/ipmi/ipmi_si_platform.c | 30 +++- 4 files changed, 218 insertions(+), 74 deletions(-) diff --git a/drivers/char/ipmi/ipmi_si.h b/drivers/char/ipmi/ipmi_si.h index 52f6152d1fcb..7ae52c17618e 100644 --- a/drivers/char/ipmi/ipmi_si.h +++ b/drivers/char/ipmi/ipmi_si.h @@ -25,7 +25,9 @@ void ipmi_irq_finish_setup(struct si_sm_io *io); int ipmi_si_remove_by_dev(struct device *dev); void ipmi_si_remove_by_data(int addr_space, enum si_type si_type, unsigned long addr); -int ipmi_si_hardcode_find_bmc(void); +void ipmi_hardcode_init(void); +void ipmi_si_hardcode_exit(void); +int ipmi_si_hardcode_match(int addr_type, unsigned long addr); void ipmi_si_platform_init(void); void ipmi_si_platform_shutdown(void); diff --git a/drivers/char/ipmi/ipmi_si_hardcode.c b/drivers/char/ipmi/ipmi_si_hardcode.c index 10219f24546b..9ae2405c28bb 100644 --- a/drivers/char/ipmi/ipmi_si_hardcode.c +++ b/drivers/char/ipmi/ipmi_si_hardcode.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0+ #include <linux/moduleparam.h> +#include <linux/platform_device.h> #include "ipmi_si.h" #define PFX "ipmi_hardcode: " @@ -11,23 +12,22 @@ #define SI_MAX_PARMS 4 -static char *si_type[SI_MAX_PARMS]; #define MAX_SI_TYPE_STR 30 -static char si_type_str[MAX_SI_TYPE_STR]; +static char si_type_str[MAX_SI_TYPE_STR] __initdata; static unsigned long addrs[SI_MAX_PARMS]; static unsigned int num_addrs; static unsigned int ports[SI_MAX_PARMS]; static unsigned int num_ports; -static int irqs[SI_MAX_PARMS]; -static unsigned int num_irqs; -static int regspacings[SI_MAX_PARMS]; -static unsigned int num_regspacings; -static int regsizes[SI_MAX_PARMS]; -static unsigned int num_regsizes; -static int regshifts[SI_MAX_PARMS]; -static unsigned int num_regshifts; -static int slave_addrs[SI_MAX_PARMS]; /* Leaving 0 chooses the default value */ -static unsigned int num_slave_addrs; +static int irqs[SI_MAX_PARMS] __initdata; +static unsigned int num_irqs __initdata; +static int regspacings[SI_MAX_PARMS] __initdata; +static unsigned int num_regspacings __initdata; +static int regsizes[SI_MAX_PARMS] __initdata; +static unsigned int num_regsizes __initdata; +static int regshifts[SI_MAX_PARMS] __initdata; +static unsigned int num_regshifts __initdata; +static int slave_addrs[SI_MAX_PARMS] __initdata; +static unsigned int num_slave_addrs __initdata; module_param_string(type, si_type_str, MAX_SI_TYPE_STR, 0); MODULE_PARM_DESC(type, "Defines the type of each interface, each" @@ -72,12 +72,133 @@ MODULE_PARM_DESC(slave_addrs, "Set the default IPMB slave address for" " overridden by this parm. This is an array indexed" " by interface number."); -int ipmi_si_hardcode_find_bmc(void) +static struct platform_device *ipmi_hc_pdevs[SI_MAX_PARMS]; + +static void __init ipmi_hardcode_init_one(const char *si_type_str, + unsigned int i, + unsigned long addr, + unsigned int flags) { - int ret = -ENODEV; - int i; - struct si_sm_io io; + struct platform_device *pdev; + unsigned int num_r = 1, size; + struct resource r[4]; + struct property_entry p[6]; + enum si_type si_type; + unsigned int regspacing, regsize; + int rv; + + memset(p, 0, sizeof(p)); + memset(r, 0, sizeof(r)); + + if (!si_type_str || !*si_type_str || strcmp(si_type_str, "kcs") == 0) { + size = 2; + si_type = SI_KCS; + } else if (strcmp(si_type_str, "smic") == 0) { + size = 2; + si_type = SI_SMIC; + } else if (strcmp(si_type_str, "bt") == 0) { + size = 3; + si_type = SI_BT; + } else if (strcmp(si_type_str, "invalid") == 0) { + /* + * Allow a firmware-specified interface to be + * disabled. + */ + size = 1; + si_type = SI_TYPE_INVALID; + } else { + pr_warn("Interface type specified for interface %d, was invalid: %s\n", + i, si_type_str); + return; + } + + regsize = regsizes[i]; + if (regsize == 0) + regsize = DEFAULT_REGSIZE; + + p[0] = PROPERTY_ENTRY_U8("ipmi-type", si_type); + p[1] = PROPERTY_ENTRY_U8("slave-addr", slave_addrs[i]); + p[2] = PROPERTY_ENTRY_U8("addr-source", SI_HARDCODED); + p[3] = PROPERTY_ENTRY_U8("reg-shift", regshifts[i]); + p[4] = PROPERTY_ENTRY_U8("reg-size", regsize); + /* Last entry must be left NULL to terminate it. */ + + /* + * Register spacing is derived from the resources in + * the IPMI platform code. + */ + regspacing = regspacings[i]; + if (regspacing == 0) + regspacing = regsize; + + r[0].start = addr; + r[0].end = r[0].start + regsize - 1; + r[0].name = "IPMI Address 1"; + r[0].flags = flags; + + if (size > 1) { + r[1].start = r[0].start + regspacing; + r[1].end = r[1].start + regsize - 1; + r[1].name = "IPMI Address 2"; + r[1].flags = flags; + num_r++; + } + + if (size > 2) { + r[2].start = r[1].start + regspacing; + r[2].end = r[2].start + regsize - 1; + r[2].name = "IPMI Address 3"; + r[2].flags = flags; + num_r++; + } + + if (irqs[i]) { + r[num_r].start = irqs[i]; + r[num_r].end = irqs[i]; + r[num_r].name = "IPMI IRQ"; + r[num_r].flags = IORESOURCE_IRQ; + num_r++; + } + + pdev = platform_device_alloc("hardcode-ipmi-si", i); + if (!pdev) { + pr_err("Error allocating IPMI platform device %d\n", i); + return; + } + + rv = platform_device_add_resources(pdev, r, num_r); + if (rv) { + dev_err(&pdev->dev, + "Unable to add hard-code resources: %d\n", rv); + goto err; + } + + rv = platform_device_add_properties(pdev, p); + if (rv) { + dev_err(&pdev->dev, + "Unable to add hard-code properties: %d\n", rv); + goto err; + } + + rv = platform_device_add(pdev); + if (rv) { + dev_err(&pdev->dev, + "Unable to add hard-code device: %d\n", rv); + goto err; + } + + ipmi_hc_pdevs[i] = pdev; + return; + +err: + platform_device_put(pdev); +} + +void __init ipmi_hardcode_init(void) +{ + unsigned int i; char *str; + char *si_type[SI_MAX_PARMS]; /* Parse out the si_type string into its components. */ str = si_type_str; @@ -94,54 +215,45 @@ int ipmi_si_hardcode_find_bmc(void) } } - memset(&io, 0, sizeof(io)); for (i = 0; i < SI_MAX_PARMS; i++) { - if (!ports[i] && !addrs[i]) - continue; - - io.addr_source = SI_HARDCODED; - pr_info(PFX "probing via hardcoded address\n"); - - if (!si_type[i] || strcmp(si_type[i], "kcs") == 0) { - io.si_type = SI_KCS; - } else if (strcmp(si_type[i], "smic") == 0) { - io.si_type = SI_SMIC; - } else if (strcmp(si_type[i], "bt") == 0) { - io.si_type = SI_BT; - } else { - pr_warn(PFX "Interface type specified for interface %d, was invalid: %s\n", - i, si_type[i]); - continue; - } + if (i < num_ports && ports[i]) + ipmi_hardcode_init_one(si_type[i], i, ports[i], + IORESOURCE_IO); + if (i < num_addrs && addrs[i]) + ipmi_hardcode_init_one(si_type[i], i, addrs[i], + IORESOURCE_MEM); + } +} - if (ports[i]) { - /* An I/O port */ - io.addr_data = ports[i]; - io.addr_type = IPMI_IO_ADDR_SPACE; - } else if (addrs[i]) { - /* A memory port */ - io.addr_data = addrs[i]; - io.addr_type = IPMI_MEM_ADDR_SPACE; - } else { - pr_warn(PFX "Interface type specified for interface %d, but port and address were not set or set to zero.\n", - i); - continue; - } +void ipmi_si_hardcode_exit(void) +{ + unsigned int i; - io.addr = NULL; - io.regspacing = regspacings[i]; - if (!io.regspacing) - io.regspacing = DEFAULT_REGSPACING; - io.regsize = regsizes[i]; - if (!io.regsize) - io.regsize = DEFAULT_REGSIZE; - io.regshift = regshifts[i]; - io.irq = irqs[i]; - if (io.irq) - io.irq_setup = ipmi_std_irq_setup; - io.slave_addr = slave_addrs[i]; - - ret = ipmi_si_add_smi(&io); + for (i = 0; i < SI_MAX_PARMS; i++) { + if (ipmi_hc_pdevs[i]) + platform_device_unregister(ipmi_hc_pdevs[i]); } - return ret; +} + +/* + * Returns true of the given address exists as a hardcoded address, + * false if not. + */ +int ipmi_si_hardcode_match(int addr_type, unsigned long addr) +{ + unsigned int i; + + if (addr_type == IPMI_IO_ADDR_SPACE) { + for (i = 0; i < num_ports; i++) { + if (ports[i] == addr) + return 1; + } + } else { + for (i = 0; i < num_addrs; i++) { + if (addrs[i] == addr) + return 1; + } + } + + return 0; } diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c index 82d831b103f9..75e5006f395a 100644 --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -1862,6 +1862,18 @@ int ipmi_si_add_smi(struct si_sm_io *io) int rv = 0; struct smi_info *new_smi, *dup; + /* + * If the user gave us a hard-coded device at the same + * address, they presumably want us to use it and not what is + * in the firmware. + */ + if (io->addr_source != SI_HARDCODED && + ipmi_si_hardcode_match(io->addr_type, io->addr_data)) { + dev_info(io->dev, + "Hard-coded device at this address already exists"); + return -ENODEV; + } + if (!io->io_setup) { if (io->addr_type == IPMI_IO_ADDR_SPACE) { io->io_setup = ipmi_si_port_setup; @@ -2094,7 +2106,7 @@ static int try_smi_init(struct smi_info *new_smi) return rv; } -static int init_ipmi_si(void) +static int __init init_ipmi_si(void) { struct smi_info *e; enum ipmi_addr_src type = SI_INVALID; @@ -2102,12 +2114,9 @@ static int init_ipmi_si(void) if (initialized) return 0; + ipmi_hardcode_init(); pr_info("IPMI System Interface driver.\n"); - /* If the user gave us a device, they presumably want us to use it */ - if (!ipmi_si_hardcode_find_bmc()) - goto do_scan; - ipmi_si_platform_init(); ipmi_si_pci_init(); @@ -2118,7 +2127,6 @@ static int init_ipmi_si(void) with multiple BMCs we assume that there will be several instances of a given type so if we succeed in registering a type then also try to register everything else of the same type */ -do_scan: mutex_lock(&smi_infos_lock); list_for_each_entry(e, &smi_infos, link) { /* Try to register a device if it has an IRQ and we either @@ -2304,6 +2312,8 @@ static void cleanup_ipmi_si(void) list_for_each_entry_safe(e, tmp_e, &smi_infos, link) cleanup_one_si(e); mutex_unlock(&smi_infos_lock); + + ipmi_si_hardcode_exit(); } module_exit(cleanup_ipmi_si); diff --git a/drivers/char/ipmi/ipmi_si_platform.c b/drivers/char/ipmi/ipmi_si_platform.c index bf69927502bd..d32b0dd377c5 100644 --- a/drivers/char/ipmi/ipmi_si_platform.c +++ b/drivers/char/ipmi/ipmi_si_platform.c @@ -126,8 +126,6 @@ ipmi_get_info_from_resources(struct platform_device *pdev, if (res_second->start > io->addr_data) io->regspacing = res_second->start - io->addr_data; } - io->regsize = DEFAULT_REGSIZE; - io->regshift = 0; return res; } @@ -135,7 +133,7 @@ ipmi_get_info_from_resources(struct platform_device *pdev, static int platform_ipmi_probe(struct platform_device *pdev) { struct si_sm_io io; - u8 type, slave_addr, addr_source; + u8 type, slave_addr, addr_source, regsize, regshift; int rv; rv = device_property_read_u8(&pdev->dev, "addr-source", &addr_source); @@ -147,7 +145,7 @@ static int platform_ipmi_probe(struct platform_device *pdev) if (addr_source == SI_SMBIOS) { if (!si_trydmi) return -ENODEV; - } else { + } else if (addr_source != SI_HARDCODED) { if (!si_tryplatform) return -ENODEV; } @@ -167,11 +165,23 @@ static int platform_ipmi_probe(struct platform_device *pdev) case SI_BT: io.si_type = type; break; + case SI_TYPE_INVALID: /* User disabled this in hardcode. */ + return -ENODEV; default: dev_err(&pdev->dev, "ipmi-type property is invalid\n"); return -EINVAL; } + io.regsize = DEFAULT_REGSIZE; + rv = device_property_read_u8(&pdev->dev, "reg-size", &regsize); + if (!rv) + io.regsize = regsize; + + io.regshift = 0; + rv = device_property_read_u8(&pdev->dev, "reg-shift", &regshift); + if (!rv) + io.regshift = regshift; + if (!ipmi_get_info_from_resources(pdev, &io)) return -EINVAL; @@ -191,7 +201,8 @@ static int platform_ipmi_probe(struct platform_device *pdev) io.dev = &pdev->dev; - pr_info("ipmi_si: SMBIOS: %s %#lx regsize %d spacing %d irq %d\n", + pr_info("ipmi_si: %s: %s %#lx regsize %d spacing %d irq %d\n", + ipmi_addr_src_to_str(addr_source), (io.addr_type == IPMI_IO_ADDR_SPACE) ? "io" : "mem", io.addr_data, io.regsize, io.regspacing, io.irq); @@ -356,6 +367,9 @@ static int acpi_ipmi_probe(struct platform_device *pdev) goto err_free; } + io.regsize = DEFAULT_REGSIZE; + io.regshift = 0; + res = ipmi_get_info_from_resources(pdev, &io); if (!res) { rv = -EINVAL; @@ -417,6 +431,11 @@ static int ipmi_remove(struct platform_device *pdev) return ipmi_si_remove_by_dev(&pdev->dev); } +static const struct platform_device_id si_plat_ids[] = { + { "hardcode-ipmi-si", 0 }, + { } +}; + struct platform_driver ipmi_platform_driver = { .driver = { .name = DEVICE_NAME, @@ -425,6 +444,7 @@ struct platform_driver ipmi_platform_driver = { }, .probe = ipmi_probe, .remove = ipmi_remove, + .id_table = si_plat_ids }; void ipmi_si_platform_init(void) -- 2.17.1

6 years, 5 months

2
1
0 0

netfilter: nf_tables: fix set double-free in abort path

by kfm＠plushkava.net

Hi, Please consider the attached for inclusion in the 5.0 queue. The justification should be apparent from reading the referenced bugzilla report. The upstream commit is 40ba1d9b4d19796afc9b7ece872f5f3e8f5e2c13 but I have attached the patch that was originally posted by Pablo because it can be applied to 5.0 without fuzz. -- Kerin Millar <kfm(a)plushkava.net>

6 years, 5 months

2
1
0 0

netfilter: nf_tables: fix set double-free in abort path

by Pablo Neira Ayuso

Hi Greg, I'm receiving several emails for a bit of time now to request to cherry-pick this patch: 40ba1d9b4d19 netfilter: nf_tables: fix set double-free in abort path to kernel 5.0 stable queue. I'd appreciate if you can do so. Thanks!

6 years, 5 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror