aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2022-02-09dt-bindings: clock: intel,stratix10: convert to dtschemaKrzysztof Kozlowski2-20/+35
Convert the Intel Stratix 10 clock controller bindings to DT schema format. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2022-02-09dt-bindings: intel: document Agilex based board compatiblesKrzysztof Kozlowski1-0/+26
Add new compatible for Agilex based boards. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2022-02-09dt-bindings: altera: document Stratix 10 based board compatiblesKrzysztof Kozlowski1-0/+6
Add new compatible for Stratix 10 based boards. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2022-02-09dt-bindings: altera: document VT compatiblesKrzysztof Kozlowski1-0/+5
Add new compatible for SoCFPGA VT boards/designs. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2022-02-09dt-bindings: altera: document Arria 10 based board compatiblesKrzysztof Kozlowski1-0/+3
Add new compatible for Arria 10 based boards. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2022-02-09dt-bindings: altera: document Arria 5 based board compatiblesKrzysztof Kozlowski1-0/+2
Add new compatible for Arria 5 based boards. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2022-02-09dt-bindings: altera: document existing Cyclone 5 board compatiblesKrzysztof Kozlowski1-6/+24
Several Cyclone 5 SoCFPGA based boards have additional board compatibles which are not documented in the bindings. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2022-02-09PCI: endpoint: Fix alignment fault error in copy testsHou Zhiqiang1-1/+11
The copy test uses the memcpy() to copy data between IO memory spaces. This can trigger an alignment fault error (pasted the error logs below) because memcpy() may use unaligned accesses on a mapped memory that is just IO, which does not support unaligned memory accesses. Fix it by using the correct memcpy API to copy from/to IO memory. Alignment fault error logs: Unable to handle kernel paging request at virtual address ffff8000101cd3c1 Mem abort info: ESR = 0x96000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000021 CM = 0, WnR = 0 swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081773000 [ffff8000101cd3c1] pgd=1000000082410003, p4d=1000000082410003, pud=1000000082411003, pmd=1000000082412003, pte=0068004000001f13 Internal error: Oops: 96000021 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6 Comm: kworker/0:0H Not tainted 5.15.0-rc1-next-20210914-dirty #2 Hardware name: LS1012A RDB Board (DT) Workqueue: kpcitest pci_epf_test_cmd_handler pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x168/0x230 lr : pci_epf_test_cmd_handler+0x6f0/0xa68 sp : ffff80001003bce0 x29: ffff80001003bce0 x28: ffff800010135000 x27: ffff8000101e5000 x26: ffff8000101cd000 x25: ffff6cda941cf6c8 x24: 0000000000000000 x23: ffff6cda863f2000 x22: ffff6cda9096c800 x21: ffff800010135000 x20: ffff6cda941cf680 x19: ffffaf39fd999000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffaf39fd2b6000 x14: 0000000000000000 x13: 15f5c8fa2f984d57 x12: 604d132b60275454 x11: 065cee5e5fb428b6 x10: aae662eb17d0cf3e x9 : 1d97c9a1b4ddef37 x8 : 7541b65edebf928c x7 : e71937c4fc595de0 x6 : b8a0e09562430d1c x5 : ffff8000101e5401 x4 : ffff8000101cd401 x3 : ffff8000101e5380 x2 : fffffffffffffff1 x1 : ffff8000101cd3c0 x0 : ffff8000101e5000 Call trace: __memcpy+0x168/0x230 process_one_work+0x1ec/0x370 worker_thread+0x44/0x478 kthread+0x154/0x160 ret_from_fork+0x10/0x20 Code: a984346c a9c4342c f1010042 54fffee8 (a97c3c8e) ---[ end trace 568c28c7b6336335 ]--- Link: https://lore.kernel.org/r/20211217094708.28678-1-Zhiqiang.Hou@nxp.com Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Reviewed-by: Kishon Vijay Abraham I <kishon@ti.com>
2022-02-09drm/mediatek: mtk_dsi: Avoid EPROBE_DEFER loop with external bridgeAngeloGioacchino Del Regno1-83/+84
DRM bridge drivers are now attaching their DSI device at probe time, which requires us to register our DSI host in order to let the bridge to probe: this recently started producing an endless -EPROBE_DEFER loop on some machines that are using external bridges, like the parade-ps8640, found on the ACER Chromebook R13. Now that the DSI hosts/devices probe sequence is documented, we can do adjustments to the mtk_dsi driver as to both fix now and make sure to avoid this situation in the future: for this, following what is documented in drm_bridge.c, move the mtk_dsi component_add() to the mtk_dsi_ops.attach callback and delete it in the detach callback; keeping in mind that we are registering a drm_bridge for our DSI, which is only used/attached if the DSI Host is bound, it wouldn't make sense to keep adding our bridge at probe time (as it would be useless to have it if mtk_dsi_ops.attach() fails!), so also move that one to the dsi host attach function (and remove it in detach). Cc: <stable@vger.kernel.org> # 5.15.x Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Reviewed-by: Jagan Teki <jagan@amarulasolutions.com> Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2022-02-09dt-bindings: display: mediatek: add ethdr definition for mt8195Nancy.Lin1-0/+147
Add vdosys1 ETHDR definition. Signed-off-by: Nancy.Lin <nancy.lin@mediatek.com> Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2022-02-09dt-bindings: display: mediatek: add vdosys1 MERGE property for mt8195Nancy.Lin1-0/+4
MT8195 vdosys1 merge1 to merge4 have HW mute function. Add MERGE additional mute property description. Signed-off-by: Nancy.Lin <nancy.lin@mediatek.com> Acked-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2022-02-09ASoC: dt-bindings: davinci-mcasp: convert McASP bindings to yaml schemaJayesh Choudhary3-86/+202
Convert the bindings for McASP controllers for TI SoCs from txt to YAML schema. Adds additional properties 'clocks', 'clock-names', 'power-domains', '#sound-dai-cells' and 'port' which were missing from the txt file. Removes properties 'sram-size-playback' and 'sram-size-capture' since they are not used. Adds 'dmas' and 'dma-names' in the example which were missing from the txt file. Changes 'interrupts' and 'interrupt-names' from optional to required properties. Changes 'op-modes', 'serial-dir' to optional properties as they are not needed if the McASP is used only as GPIO. Changes 'tdm-slots' to required property only for I2S operation mode. Adds the yaml file in the 'MAINTAINERS' under the heading 'TEXAS INSTRUMENTS ASoC DRIVERS' Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Rob Herring <robh@kernel.org> Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com> Link: https://lore.kernel.org/r/20220209063008.2928-1-j-choudhary@ti.com Signed-off-by: Mark Brown <broonie@kernel.org>
2022-02-09ASoC: SOF: Intel: hdac_ext_stream: consistent prefixes for variables/membersPierre-Louis Bossart9-178/+179
The existing code maximizes confusion by using 'stream' and 'hstream' variables of different types, e.g: struct hdac_stream *stream; struct hdac_ext_stream *stream; struct hdac_stream *hstream; struct hdac_ext_stream *hstream; This confusion is partly inherited from legacy code but SOF contributors added their own creative spin, e.g. struct hdac_ext_stream *link_dev; struct hdac_ext_stream *dsp_stream; struct hdac_ext_stream hda_stream; and my personal favorite: stream = &hda_stream->hda_stream; This patch suggests a consistent naming across all Intel code related to HDAudio stream management. The convention is - by hierarchical order: struct sof_intel_hda_stream *hda_stream; struct hdac_ext_stream *hext_stream; struct hdac_stream *hstream; No functionality change - just renaming of variables/members. Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com> Reviewed-by: Rander Wang <rander.wang@intel.com> Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://lore.kernel.org/r/20220209063104.9971-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2022-02-09MAINTAINERS: update cros_ec_codec maintainersTzung-Bi Shih2-0/+2
Updates cros_ec_codec maintainers. Signed-off-by: Tzung-Bi Shih <tzungbi@google.com> Acked-By: Cheng-Yi Chiang <cychiang@chromium.org> Acked-By: Benson Leung <bleung@chromium.org> Link: https://lore.kernel.org/r/20220208031242.227563-1-tzungbi@google.com Signed-off-by: Mark Brown <broonie@kernel.org>
2022-02-09memory: of: parse max-freq propertyKrzysztof Kozlowski1-2/+4
Passing the memory timings maximum frequency as an unit address was a workaround and instead 'max-freq' is preferred. Look for 'max-freq' first and then fallback to 'reg'. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Reviewed-by: Alim Akhtar <alim.ahtar@samsung.com> Reviewed-by: Dmitry Osipenko <digetx@gmail.com> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20220206135807.211767-8-krzysztof.kozlowski@canonical.com
2022-02-09dt-bindings: memory: lpddr3: deprecate passing timings frequency as unit addressKrzysztof Kozlowski2-13/+15
The timings node maximum frequency was passed as an unit address, which is actually a workaround. Such workaround and unit address are not needed at all, because the device memory node (parent) can contain multiple timing nodes without unit addresses but with suffix used for nodenames, e.g. timings-1. LPDDR2 bindings already use such version, so unify the LPDDR3 with them. Suggested-by: Dmitry Osipenko <digetx@gmail.com> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Reviewed-by: Dmitry Osipenko <digetx@gmail.com> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20220206135807.211767-7-krzysztof.kozlowski@canonical.com
2022-02-09dt-bindings: memory: lpddr3: deprecate manufacturer IDKrzysztof Kozlowski1-1/+3
The memory manufacturer should be described in vendor part of compatible, so there is no need to duplicate it in a separate property. Similarly is done in LPDDR2 bindings. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20220206135807.211767-6-krzysztof.kozlowski@canonical.com
2022-02-09dt-bindings: memory: lpddr3: adjust IO width to specKrzysztof Kozlowski1-2/+0
According to JEDEC Standard No. 209-3 (table 3.4.1 "Mode Register Assignment and Definition in LPDDR3 SDRAM"), the LPDDR3 supports only 16- and 32-bit IO width. Drop the unsupported others. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20220206135807.211767-5-krzysztof.kozlowski@canonical.com
2022-02-09dt-bindings: memory: lpddr3: convert to dtschemaKrzysztof Kozlowski3-109/+266
Convert the LPDDR3 memory bindings to DT schema format. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Reviewed-by: Dmitry Osipenko <digetx@gmail.com> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20220206135807.211767-4-krzysztof.kozlowski@canonical.com
2022-02-09dt-bindings: memory: lpddr3-timings: convert to dtschemaKrzysztof Kozlowski2-58/+153
Convert the LPDDR3 memory timings bindings to DT schema format. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Reviewed-by: Dmitry Osipenko <digetx@gmail.com> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20220206135807.211767-3-krzysztof.kozlowski@canonical.com
2022-02-09dt-bindings: memory: lpddr2-timings: convert to dtschemaKrzysztof Kozlowski3-56/+137
Convert the LPDDR2 memory timings bindings to DT schema format. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Reviewed-by: Dmitry Osipenko <digetx@gmail.com> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20220206135807.211767-2-krzysztof.kozlowski@canonical.com
2022-02-09Drivers: hv: utils: Make use of the helper macro LIST_HEAD()Cai Huoqing1-1/+1
Replace "struct list_head head = LIST_HEAD_INIT(head)" with "LIST_HEAD(head)" to simplify the code. Signed-off-by: Cai Huoqing <cai.huoqing@linux.dev> Link: https://lore.kernel.org/r/20220209032251.37362-1-cai.huoqing@linux.dev Signed-off-by: Wei Liu <wei.liu@kernel.org>
2022-02-09spi: make remove callback a void functionMark Brown631-2696/+4881
Merge series from Uwe Kleine-König <u.kleine-koenig@pengutronix.de>: this series goal is to change the spi remove callback's return value to void. After numerous patches nearly all drivers already return 0 unconditionally. The four first patches in this series convert the remaining three drivers to return 0, the final patch changes the remove prototype and converts all implementers. base-commit: 26291c54e111ff6ba87a164d85d4a4e134b7315c
2022-02-09NFSD: Deprecate NFS_OFFSET_MAXChuck Lever3-10/+2
NFS_OFFSET_MAX was introduced way back in Linux v2.3.y before there was a kernel-wide OFFSET_MAX value. As a clean up, replace the last few uses of it with its generic equivalent, and get rid of it. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2022-02-09NFSD: Fix offset type in I/O trace pointsChuck Lever1-7/+7
NFSv3 and NFSv4 use u64 offset values on the wire. Record these values verbatim without the implicit type case to loff_t. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2022-02-09NFSD: COMMIT operations must not return NFS?ERR_INVALChuck Lever3-25/+38
Since, well, forever, the Linux NFS server's nfsd_commit() function has returned nfserr_inval when the passed-in byte range arguments were non-sensical. However, according to RFC 1813 section 3.3.21, NFSv3 COMMIT requests are permitted to return only the following non-zero status codes: NFS3ERR_IO NFS3ERR_STALE NFS3ERR_BADHANDLE NFS3ERR_SERVERFAULT NFS3ERR_INVAL is not included in that list. Likewise, NFS4ERR_INVAL is not listed in the COMMIT row of Table 6 in RFC 8881. RFC 7530 does permit COMMIT to return NFS4ERR_INVAL, but does not specify when it can or should be used. Instead of dropping or failing a COMMIT request in a byte range that is not supported, turn it into a valid request by treating one or both arguments as zero. Offset zero means start-of-file, count zero means until-end-of-file, so we only ever extend the commit range. NFS servers are always allowed to commit more and sooner than requested. The range check is no longer bounded by NFS_OFFSET_MAX, but rather by the value that is returned in the maxfilesize field of the NFSv3 FSINFO procedure or the NFSv4 maxfilesize file attribute. Note that this change results in a new pynfs failure: CMT4 st_commit.testCommitOverflow : RUNNING CMT4 st_commit.testCommitOverflow : FAILURE COMMIT with offset + count overflow should return NFS4ERR_INVAL, instead got NFS4_OK IMO the test is not correct as written: RFC 8881 does not allow the COMMIT operation to return NFS4ERR_INVAL. Reported-by: Dan Aloni <dan.aloni@vastdata.com> Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Reviewed-by: Bruce Fields <bfields@fieldses.org>
2022-02-09NFSD: Clamp WRITE offsetsChuck Lever2-2/+8
Ensure that a client cannot specify a WRITE range that falls in a byte range outside what the kernel's internal types (such as loff_t, which is signed) can represent. The kiocb iterators, invoked in nfsd_vfs_write(), should properly limit write operations to within the underlying file system's s_maxbytes. Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2022-02-09NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizesChuck Lever1-1/+1
iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger than s64_max without corrupting the value. Silently capping the value results in storing a different value than the client passed in which is unexpected behavior, so remove the min_t() check in decode_sattr3(). Note that RFC 1813 permits only the WRITE procedure to return NFS3ERR_FBIG. We believe that NFSv3 reference implementations also return NFS3ERR_FBIG when ia_size is too large. Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2022-02-09NFSD: Fix ia_size underflowChuck Lever1-0/+4
iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr(). Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2022-02-09NFSD: Fix the behavior of READ near OFFSET_MAXChuck Lever3-10/+14
Dan Aloni reports: > Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to > the RPC read layers") on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a result, in a test where the server has a file of size > 0x7fffffffffffffff, and the client tries to read from the offset > 0x7ffffffffffff000, the read causes loff_t overflow in the server > and it returns an NFS code of EINVAL to the client. The client as > a result indefinitely retries the request. The Linux NFS client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that status code for a READ. Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This behavior appears to be consistent with Solaris NFS servers. Note that NFSv3 and NFSv4 use u64 offset values on the wire. These must be converted to loff_t internally before use -- an implicit type cast is not adequate for this purpose. Otherwise VFS checks against sb->s_maxbytes do not work properly. Reported-by: Dan Aloni <dan.aloni@vastdata.com> Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2022-02-09nvme-tcp: fix bogus request completion when failing to send AERSagi Grimberg1-1/+9
AER is not backed by a real request, hence we should not incorrectly assume that when failing to send a nvme command, it is a normal request but rather check if this is an aer and if so complete the aer (similar to the normal completion path). Cc: stable@vger.kernel.org Signed-off-by: Sagi Grimberg <sagi@grimberg.me> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Christoph Hellwig <hch@lst.de>
2022-02-09nvme: add nvme_complete_req tracepoint for batched completionBean Huo1-0/+1
Add NVMe request completion trace in nvme_complete_batch_req() because nvme:nvme_complete_req tracepoint is missing in case of request batched completion. Signed-off-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2022-02-09irqchip/stm32-exti: Add STM32MP13 supportAlexandre Torgue1-0/+50
Enhance stm32-exti driver to support STM32MP13 SoC. This SoC uses the same hardware version than STM32MP15. Only EXTI line mapping is changed and following EXTI lines are supported: GPIO, RTC, I2C[1-5], UxART[1-8], USBH_EHCI, USBH_OHCI, USB_OTG, LPTIM[1-5], ETH[1-2]. Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20220202140005.860-3-alexandre.torgue@foss.st.com
2022-02-09dt-bindings: interrupt-controller: stm32-exti: document st,stm32mp13-extiAlexandre Torgue1-0/+1
Support of STM32MP13 SoC implies to create a new compatible in order to manage EXTI/GIC mapping changes. Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20220202140005.860-2-alexandre.torgue@foss.st.com
2022-02-09gpio: tpmx86: Move PM device over to irq domainMarc Zyngier1-1/+2
Move the reference to the device over to the irq domain. Signed-off-by: Marc Zyngier <maz@kernel.org> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-10-maz@kernel.org
2022-02-09gpio: rcar: Move PM device over to irq domainMarc Zyngier1-1/+1
Move the reference to the device over to the irq domain. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-9-maz@kernel.org
2022-02-09gpio: omap: Move PM device over to irq domainMarc Zyngier1-3/+4
Move the reference to the device over to the irq domain. Signed-off-by: Marc Zyngier <maz@kernel.org> Tested-by: Tony Lindgren <tony@atomide.com> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-8-maz@kernel.org
2022-02-09gpio: mt7621: Kill parent_device usageMarc Zyngier1-1/+0
This gpio controller sets the parent_device field, but doesn't have any runtime PM functionality. Get rid of it. Signed-off-by: Marc Zyngier <maz@kernel.org> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-7-maz@kernel.org
2022-02-09irqchip/imx-intmux: Move PM device over to irq domainMarc Zyngier1-5/+3
Move the reference to the device over to the irq domain. This allows the irq_chip structure to be directly used instead of taking a copy for each instance. Signed-off-by: Marc Zyngier <maz@kernel.org> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-6-maz@kernel.org
2022-02-09irqchip/renesas-irqc: Move PM device over to irq domainMarc Zyngier1-1/+2
Move the reference to the device over to the irq domain. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-5-maz@kernel.org
2022-02-09irqchip/renesas-intc-irqpin: Move PM device over to irq domainMarc Zyngier1-1/+2
Move the reference to the device over to the irq domain. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-4-maz@kernel.org
2022-02-09irqchip/gic: Move PM device over to irq domainMarc Zyngier1-6/+6
Move the reference to the GIC device over to the irq domain. This allows for some localised cleanup. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-3-maz@kernel.org
2022-02-09genirq: Allow the PM device to originate from irq domainMarc Zyngier2-5/+28
As a preparation to moving the reference to the device used for runtime power management, add a new 'dev' field to the irqdomain structure for that exact purpose. The irq_chip_pm_{get,put}() helpers are made aware of the dual location via a new private helper. No functional change intended. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Tony Lindgren <tony@atomide.com> Acked-by: Bartosz Golaszewski <brgl@bgdev.pl> Link: https://lore.kernel.org/r/20220201120310.878267-2-maz@kernel.org
2022-02-09Merge branch 'vlan-QinQ-leak-fix'David S. Miller3-8/+16
Xin Long says: ==================== vlan: fix a netdev refcnt leak for QinQ This issue can be simply reproduced by: # ip link add dummy0 type dummy # ip link add link dummy0 name dummy0.1 type vlan id 1 # ip link add link dummy0.1 name dummy0.1.2 type vlan id 2 # rmmod 8021q unregister_netdevice: waiting for dummy0.1 to become free. Usage count = 1 So as to fix it, adjust vlan_dev_uninit() in Patch 1/1 so that it won't be called twice for the same device, then do the fix in vlan_dev_uninit() in Patch 2/2. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2022-02-09vlan: move dev_put into vlan_dev_uninitXin Long1-3/+5
Shuang Li reported an QinQ issue by simply doing: # ip link add dummy0 type dummy # ip link add link dummy0 name dummy0.1 type vlan id 1 # ip link add link dummy0.1 name dummy0.1.2 type vlan id 2 # rmmod 8021q unregister_netdevice: waiting for dummy0.1 to become free. Usage count = 1 When rmmods 8021q, all vlan devs are deleted from their real_dev's vlan grp and added into list_kill by unregister_vlan_dev(). dummy0.1 is unregistered before dummy0.1.2, as it's using for_each_netdev() in __rtnl_kill_links(). When unregisters dummy0.1, dummy0.1.2 is not unregistered in the event of NETDEV_UNREGISTER, as it's been deleted from dummy0.1's vlan grp. However, due to dummy0.1.2 still holding dummy0.1, dummy0.1 will keep waiting in netdev_wait_allrefs(), while dummy0.1.2 will never get unregistered and release dummy0.1, as it delays dev_put until calling dev->priv_destructor, vlan_dev_free(). This issue was introduced by Commit 563bcbae3ba2 ("net: vlan: fix a UAF in vlan_dev_real_dev()"), and this patch is to fix it by moving dev_put() into vlan_dev_uninit(), which is called after NETDEV_UNREGISTER event but before netdev_wait_allrefs(). Fixes: 563bcbae3ba2 ("net: vlan: fix a UAF in vlan_dev_real_dev()") Reported-by: Shuang Li <shuali@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-02-09vlan: introduce vlan_dev_free_egress_priorityXin Long3-5/+11
This patch is to introduce vlan_dev_free_egress_priority() to free egress priority for vlan dev, and keep vlan_dev_uninit() static as .ndo_uninit. It makes the code more clear and safer when adding new code in vlan_dev_uninit() in the future. Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-02-09libbpf: Fix compilation warning due to mismatched printf formatAndrii Nakryiko1-1/+2
On ppc64le architecture __s64 is long int and requires %ld. Cast to ssize_t and use %zd to avoid architecture-specific specifiers. Fixes: 4172843ed4a3 ("libbpf: Fix signedness bug in btf_dump_array_data()") Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20220209063909.1268319-1-andrii@kernel.org
2022-02-09ax25: fix UAF bugs of net_device caused by rebinding operationDuoming Zhou1-1/+4
The ax25_kill_by_device() will set s->ax25_dev = NULL and call ax25_disconnect() to change states of ax25_cb and sock, if we call ax25_bind() before ax25_kill_by_device(). However, if we call ax25_bind() again between the window of ax25_kill_by_device() and ax25_dev_device_down(), the values and states changed by ax25_kill_by_device() will be reassigned. Finally, ax25_dev_device_down() will deallocate net_device. If we dereference net_device in syscall functions such as ax25_release(), ax25_sendmsg(), ax25_getsockopt(), ax25_getname() and ax25_info_show(), a UAF bug will occur. One of the possible race conditions is shown below: (USE) | (FREE) ax25_bind() | | ax25_kill_by_device() ax25_bind() | ax25_connect() | ... | ax25_dev_device_down() | ... | dev_put_track(dev, ...) //FREE ax25_release() | ... ax25_send_control() | alloc_skb() //USE | the corresponding fail log is shown below: =============================================================== BUG: KASAN: use-after-free in ax25_send_control+0x43/0x210 ... Call Trace: ... ax25_send_control+0x43/0x210 ax25_release+0x2db/0x3b0 __sock_release+0x6d/0x120 sock_close+0xf/0x20 __fput+0x11f/0x420 ... Allocated by task 1283: ... __kasan_kmalloc+0x81/0xa0 alloc_netdev_mqs+0x5a/0x680 mkiss_open+0x6c/0x380 tty_ldisc_open+0x55/0x90 ... Freed by task 1969: ... kfree+0xa3/0x2c0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 tty_ldisc_kill+0x3e/0x80 ... In order to fix these UAF bugs caused by rebinding operation, this patch adds dev_hold_track() into ax25_bind() and corresponding dev_put_track() into ax25_kill_by_device(). Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-02-09net: usb: smsc95xx: add generic selftest supportOleksij Rempel2-0/+26
Provide generic selftest support. Tested with LAN9500 and LAN9512. Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-02-09net: ethernet: cavium: use div64_u64() instead of do_div()Wang Qing1-2/+2
do_div() does a 64-by-32 division. When the divisor is u64, do_div() truncates it to 32 bits, this means it can test non-zero and be truncated to zero for division. fix do_div.cocci warning: do_div() does a 64-by-32 division, please consider using div64_u64 instead. Signed-off-by: Wang Qing <wangqing@vivo.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.