This converts the GPIO mouse to use descriptors and fwnode properties. The
polarity settings go out the window since GPIO descriptor already know
about polarity so this should be configured in device tree or ACPI or
similar.
Set scanning interval by default to 50ms if not found as a property on the
device.
Acked-by: Hans-Christian Noren Egtvedt <egtvedt@samfundet.no>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This adds DT bindings for simple mice attached to GPIO lines. As the
properties are very general and pertains to all mice I can think of, we use
very generic names for the 4-7 GPIO lines, "up", "down" etc.
Acked-by: Hans-Christian Noren Egtvedt <egtvedt@samfundet.no>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Use more appropriate names for the "platform data" which is now just a
simple state container for the GPIO mouse.
Acked-by: Hans-Christian Noren Egtvedt <egtvedt@samfundet.no>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This is not used much: git grep gpio_mouse_platform_data shows
that absolutely nothing in the kernel defines this platform
data.
It could be argued that the driver should be deleted. But that
is a bit harsh I think since it seems generally useful. So
this patch starts a series which repurposes it to be used with
hardware nodes from device tree or ACPI.
This first patch simply localize the platform data header and
allocates a dummy platform data.
Yes: this patch leaves the driver in a pretty useless state,
but since nothing is instantiating this driver, it doesn't
make it more useless than it already is. Later patches makes
use of the driver.
Acked-by: Hans-Christian Noren Egtvedt <egtvedt@samfundet.no>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The array rmi_f54_report_type_names is local to the source and does
not need to be in global scope, so make it static. Also make the array
const char * const.
Cleans up sparse warning:
symbol 'rmi_f54_report_type_names' was not declared. Should it be static?
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit 57b8ff070f ("driver core: add devm_device_add_group() and
friends") has added the managed version for creating sysfs group files.
Use devm_device_add_group instead of sysfs_create_group and remove the
action that cleans the sysfs file when exiting the driver.
Signed-off-by: Andi Shyti <andi@etezian.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit 57b8ff070f ("driver core: add devm_device_add_group() and
friends") has added the managed version for creating sysfs group files.
Use devm_device_add_group instead of sysfs_create_group and remove the
relative sysfs_remove_group and goto label.
Signed-off-by: Andi Shyti <andi@etezian.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit 57b8ff070f ("driver core: add devm_device_add_group() and
friends") has added the managed version for creating sysfs group files.
Use devm_device_add_group instead of sysfs_create_group and remove the
relative sysfs_remove_group.
Signed-off-by: Andi Shyti <andi@etezian.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit 57b8ff070f ("driver core: add devm_device_add_group() and
friends") has added the managed version for creating sysfs group files.
Use devm_device_add_group instead of sysfs_create_group and remove the
action that cleans the sysfs file when exiting the driver.
Signed-off-by: Andi Shyti <andi@etezian.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit 57b8ff070f ("driver core: add devm_device_add_group() and
friends") has added the managed version for creating sysfs group files.
Use devm_device_add_group instead of sysfs_create_group and remove the
action that cleans the sysfs file when exiting the driver.
Signed-off-by: Andi Shyti <andi@etezian.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit 57b8ff070f ("driver core: add devm_device_add_group() and
friends") has added the managed version for creating sysfs group files.
Use devm_device_add_group instead of sysfs_create_group and remove the
action that cleans the sysfs file when exiting the driver.
Signed-off-by: Andi Shyti <andi@etezian.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit 57b8ff070f ("driver core: add devm_device_add_group() and
friends") has added the managed version for creating sysfs group files.
Use devm_device_add_group instead of sysfs_create_group and remove the
action that cleans the sysfs file when exiting the driver.
Signed-off-by: Andi Shyti <andi@etezian.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
On x86 we historically used falling edge interrupts in the driver
because that's how first Chrome devices were configured. They also
did not use ACPI to enumerate I2C devices (because back then there
was no kernel support for that), so trigger was hard-coded in the
driver. However the controller behavior is much more reliable if
we use level triggers, and that is how we configured ARM devices,
and how want to configure newer x86 devices as well. All newer
x86 boxes have their I2C devices enumerated in ACPI.
Let's see if platform code (ACPI, DT) described interrupt and
specified particular trigger type, and if so, let's use it instead
of always clobbering trigger with IRQF_TRIGGER_FALLING. We will
still use this trigger type as a fallback if platform code left
interrupt trigger unconfigured.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196761
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Change control of TOUCHSCREEN_USB_EASYTOUCH prompt string from
EMBEDDED to EXPERT to match the rest of this Kconfig file.
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
A 2us delay is too small for the bus to settle after writing to the
register. Extend to 10us which gives more reliable results.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Remove the special SA1111 MMIO accessors from the SA1111 PS/2 driver
as their definition will be removed shortly. The SA1111 accessors are
barrierless, so use the _relaxed variants.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Use the provided sa1111_get_irq() to fetch the IRQ resources for the
SA1111 PS/2 driver.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-----BEGIN PGP SIGNATURE-----
iQIcBAABCAAGBQJZkp3BAAoJEFGvii+H/Hdhtl8QAITZ/6R+aRQC8eFilvo9/9qv
HTJVvEOZBa5afupmxQlNwuzFW5Zdou21Cl3Y0360hbRE0L3uOFGPBS4iBNIc9FLj
cMFw4yuSVI98rLXZlmfSrRS/ZZuMbih0uu9/By7WDbgPOv86C8SrLt4DJln0ujjg
4GmXbEzJlrULDvQQofaXtfVpfjTORjeiscgYVF4wv7rPYu9+4+wn3aXBi51I2gLb
pkztJ0eAhyIAVxgPGldfa+1y4B1R3edJMfpFztHMVBaIg1aOkqcNC8Cs2MZpqxml
jI3QpYFDw3q0iQ3UF8G1omcmGOItv2Jr2BGvJuyTApAe0mS47jlI+2djWlEWgHEd
P3qhInsYX85xL4AYRUxnYxW7qmTq99DffvjHa2YzHMNw1c2q29ops+sVxvrsuHyw
WBjBzKOXdzbDPdiVuaexP1jP/TPxw+V9l8hgkuqavONKwIN3aLeIRET1fZvO3eTG
TeQgP37wJSC9uK4mSzcx32K9q1+XCYZCyPU9XZS+08Hq7Lxi3chqdfhRX6AUBCxW
DiR1lOU1uIK8uZJHOpUDWuOiWIOWeWmkR82CXo88WivWiPW0MHXrfPPZMfxsOAa9
/PAbobKpSXPZpD3mh1lm7x8f1mhgevZ9jlYVTu5LcVMnNSsLQP0r3p5ytGj7sMuz
ltd2v7liFJ4CWOwpQPZu
=j+Q1
-----END PGP SIGNATURE-----
Merge tag 'ib-mfd-input-rtc-v4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next
Merge "Immutable branch between MFD, Input and RTC due for the v3.14
merge window" to have dm355evm_msp.h header moved into right place.
-----BEGIN PGP SIGNATURE-----
iQIcBAABCAAGBQJZrVgvAAoJEFGvii+H/Hdhw9AP/04kewyz1WwobD+0SZsujELP
768c92WNmMqux8OsRVUpjqcCsepi+W8ppM2tmV9jJ+rwb9SeT+cOxnaUPrlHMuK+
zQyc4F4PRlyxfrFZ0tr/VrTHvhsmdmhEux34zMrdKggeShwHAkEQhNUFTEo3efKs
J32H2BuDTcbnbiqz1Lg00NzIFOEhvpSsplgUQtz7NnG1y8T9U0kLupoXkNquIAj9
SAP9LTNyUlPqlQ0Ku0S77Zr8R9K202T9xi1RGGoscYiM3421WJA/+4S9RTqfAVje
atAOfS+nNnaxkeBYJT/wZ71zINdbhj0NKsGa/aah4hGIpbvuwouWPy+8PqyugKYy
M6uBpjo1uk1gu+kYruzNXYmKLH+F8W8bTMNiovJ2bx4qP08FlB/4X+BCL9Hy00/Z
btOz1cBTEjY2aUND84b2qZLkmGbH4VTGFS3TAr0TqsM2hQH8ThxP2f+tM7Hseupl
SvaahUYXiqTNexErLQD/Oya6QKZgoJvUmboGGO65BQmdXeHXoA3hZBltp7+aEBb4
IYG3eWwY5Shj3jpB16jDAioC43B4hHiLUWDGJtquFuscXJr5WkfeKMBg7PrY46Rh
reHsYAMhLVmOUBe77NyAEyVjQcBtpHlpkETvsCjM3tP/GqWlHLR+1jhech3Ip3LA
X7ODA7pC9iGSY2ePTiCj
=nb+l
-----END PGP SIGNATURE-----
Merge tag 'ib-mfd-many-v4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next
Merge "Immutable branch between MFD and many other subsystems due for
the v4.14 merge window" to get the TWL headers moved to the right place.
FIFO_MODE() is a macro expression with a '<<' operator, which gcc points
out could be misread as a '<':
drivers/input/misc/adxl34x.c: In function 'adxl34x_probe':
drivers/input/misc/adxl34x.c:799:36: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]
While utility of this warning is being disputed (Chief Penguin: "This
warning is clearly pure garbage.") FIFO_MODE() extracts range of values,
with 0 being FIFO_BYPASS, and not something that is logically boolean.
This converts the test to an explicit comparison with FIFO_BYPASS,
making it clearer to gcc and the reader what is intended.
Fixes: e27c729219 ("Input: add driver for ADXL345/346 Digital Accelerometers")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Similar to other Gigabyte laptops, the touchpad on P57 requires a
keyboard reset to detect Elantech touchpad correctly.
BugLink: https://bugs.launchpad.net/bugs/1594214
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
We should only see devices with interrupt endpoints. Ignore any other
endpoints that we find, so we don't send try to send them interrupt URBs
and trigger a WARN down in the USB stack.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: <stable@vger.kernel.org> # c01b5e7464 Input: xpad - don't depend on endpoint order
Signed-off-by: Cameron Gutman <aicommander@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Instead of stopping the touchscreen we were starting it in suspend, and
disabling it in resume.
Fixes: c899afedf1 ("Input: ucb1400_ts - convert to threaded IRQ")
Reported-by: Anton Volkov <avolkov@ispras.ru>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
reg_addr->reg_report_rate is supposed to exist in M06, not M09.
The driver is written to skip avoids access to non-existing registers
when the register address is NO_REGISTER (0xff). But
reg_addr->reg_report_rate is initialized to 0x00 by devm_kzalloc() (in
edt_ft5x06_ts_probe()) and not changed thereafter. So the checks do
not work and an access to register 0x00 is done.
Fix by setting reg_addr->reg_report_rate to NO_REGISTER.
Also fix the only place where reg_report_rate is checked against zero
instead of NO_REGISTER.
Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Don't populate the arrays debounce_packet on the stack, instead make
them static. Makes the object code smaller by over 870 bytes:
Before:
text data bss dec hex filename
30553 9152 0 39705 9b19 drivers/input/mouse/elantech.o
After:
text data bss dec hex filename
29521 9312 0 38833 97b1 drivers/input/mouse/elantech.o
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Don't populate the const array header on the stack, instead make it
static. Makes the object code smaller by over 180 bytes:
Before:
text data bss dec hex filename
6003 1536 0 7539 1d73 surface3_spi.o
After:
text data bss dec hex filename
5726 1632 0 7358 1cbe surface3_spi.o
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
On some x86 tablets with a Goodix touchscreen, the Windows logo on the
front is a capacitive home button. Touching this button results in a touch
with bit 4 of the first byte set, while only the lower 4 bits (0-3) are
used to indicate the number of touches.
Report a KEY_LEFTMETA press when this happens.
Note that the hardware might support more than one button, in which
case the "id" byte of coor_data would identify the button in question.
This is not implemented as we don't have access to hardware with
multiple buttons.
Signed-off-by: Sergei A. Trusov <sergei.a.trusov@ya.ru>
Acked-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Provide a simple driver for PWM controllable vibrators.
It will be used by Motorola Droid 4.
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Don't populate the array seq on the stack, instead make it static.
Makes the object code smaller by over 170 bytes:
Before:
text data bss dec hex filename
13227 3232 0 16459 404b drivers/input/joystick/adi.o
After:
text data bss dec hex filename
12957 3328 0 16285 3f9d drivers/input/joystick/adi.o
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
include/linux/i2c is not for client devices. Move the header file to a
more appropriate location.
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Mark Brown <broonie@kernel.org>
Acked-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Acked-by: Thierry Reding <thierry.reding@gmail.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Pull MIPS fixes from Ralf Baechle:
"The two indirect syscall fixes have sat in linux-next for a few days.
I did check back with a hardware designer to ensure a SYNC is really
what's required for the GIC fix and so the GIC fix didn't make it into
to linux-next in time for this final pull request.
It builds in local build tests and passes Imagination's test system"
* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
irqchip: mips-gic: SYNC after enabling GIC region
MIPS: Remove pt_regs adjustments in indirect syscall handler
MIPS: seccomp: Fix indirect syscall args
Pull x86 fixes from Thomas Gleixner:
- Expand the space for uncompressing as the LZ4 worst case does not fit
into the currently reserved space
- Validate boot parameters more strictly to prevent out of bound access
in the decompressor/boot code
- Fix off by one errors in get_segment_base()
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot: Prevent faulty bootparams.screeninfo from causing harm
x86/boot: Provide more slack space during decompression
x86/ldt: Fix off by one in get_segment_base()
Pull timer fix from Thomas Gleixner:
"A single fix for a thinko in the raw timekeeper update which causes
clock MONOTONIC_RAW to run with erratically increased frequency"
* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
time: Fix ktime_get_raw() incorrect base accumulation
Pull perf fixes from Thomas Gleixner:
- Prevent a potential inconistency in the perf user space access which
might lead to evading sanity checks.
- Prevent perf recording function trace entries twice
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf/ftrace: Fix double traces of perf on ftrace:function
perf/core: Fix potential double-fetch bug
Pull cifs version warning fix from Steve French:
"As requested, additional kernel warning messages to clarify the
default dialect changes"
[ There is still some discussion about exactly which version should be
the new default. Longer-term we have auto-negotiation coming, but
that's not there yet.. - Linus ]
* 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
Fix warning messages when mounting to older servers
A couple of late-arriving fixes before final 4.13:
- A few reverts of DT bindings on Allwinner for their ethernet
driver. Discussion didn't converge, and since bindings are considered
ABI it makes sense to revert instead of having to support two bindings
long-term.
- A fix to enumerate GPIOs properly on Marvell Armada AP806
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJZqfLaAAoJEIwa5zzehBx3magP/Aukku5Lw8s0jyFryZIszZP9
6fxHz4B6pyCbfSGFTBRvltxxMwthXxfmnI2hkw3ISC40wJKKMmA6Bc3RpFNzZEwx
Vmm5LAvbizV5KIgZ8O/DnZNfkq2Fx4rOZSSIOyjfW1N4Jzg4V7JFr+vz+vtiHovr
o9VIeheXOVMLUKtYNP1lCKnoAjMo028qtPprUJ24urjwyd4W7RqGvAUSXZYIHGOi
wCE8fGK18CEkNadWY+EeYnmEGb2nNtlUsqgYwdJzP6D6I0We+KM3Uu9GNjC+hApj
BsrYkxq+BZesSrZz5vz3tvCMbwvZe7sOUNkr7MEEvVxRT7PLlN/4WwVo42nxbWQr
tlN2FTU/fOkfZAoaO9Incn68daDhrcxzms61kVBc7yAt3cBcbzB8rColFF2gQWLo
vgOP60T+MlSq3HAKcmx979bH0AHxvFEUOer83mDwJpdalltC1ZIrCOwnNk3buXU+
V23JMDhWSsaWPRLyOFx0Rdp8yk9K/doiVfhXffYIboDG9ip8Yn39R4bzT9Ep6HkA
NepcuUwbL8SFfTksiOxwxPRq82CN/aPBYh4OmXSlLHLblqYrzFFNcexTp7b3ymsK
1AIhAuzwsj34sstT7CL+7GIuyvN7mASPo2sw3g4LuA1ICh67vsRJ71P2D5qmcP6u
C9wDsDytdDiq2Nu9iGv8
=3QBk
-----END PGP SIGNATURE-----
Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Olof Johansson:
"A couple of late-arriving fixes before final 4.13:
- A few reverts of DT bindings on Allwinner for their ethernet
driver. Discussion didn't converge, and since bindings are
considered ABI it makes sense to revert instead of having to
support two bindings long-term.
- A fix to enumerate GPIOs properly on Marvell Armada AP806"
* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
arm64: dts: marvell: fix number of GPIOs in Armada AP806 description
arm: dts: sunxi: Revert EMAC changes
arm64: dts: allwinner: Revert EMAC changes
dt-bindings: net: Revert sun8i dwmac binding
Fix number of GPIOs in AP806 description for Armada 7K/8K
-----BEGIN PGP SIGNATURE-----
iIEEABECAEEWIQQYqXDMF3cvSLY+g9cLBhiOFHI71QUCWal5XSMcZ3JlZ29yeS5j
bGVtZW50QGZyZWUtZWxlY3Ryb25zLmNvbQAKCRALBhiOFHI71W2pAJ90lo/XfZ3O
y7YizLM864H+4XGl9gCeOfmhngOW/lj1gPAVny35hw/ua00=
=2qOU
-----END PGP SIGNATURE-----
Merge tag 'mvebu-fixes-4.13-3' of git://git.infradead.org/linux-mvebu into fixes
mvebu fixes for 4.13 (part 3)
Fix number of GPIOs in AP806 description for Armada 7K/8K
* tag 'mvebu-fixes-4.13-3' of git://git.infradead.org/linux-mvebu:
arm64: dts: marvell: fix number of GPIOs in Armada AP806 description
Signed-off-by: Olof Johansson <olof@lixom.net>
Pull i2c fixes from Wolfram Sang:
"The ismt driver had a problem with a rarely used transaction type and
the designware driver was made even more robust against non standard
ACPI tables"
* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
i2c: designware: Round down ACPI provided clk to nearest supported clk
i2c: ismt: Return EMSGSIZE for block reads with bogus length
i2c: ismt: Don't duplicate the receive length for block reads
The race was introduced by me in commit 971316f050 ("epoll:
ep_unregister_pollwait() can use the freed pwq->whead"). I did not
realize that nothing can protect eventpoll after ep_poll_callback() sets
->whead = NULL, only whead->lock can save us from the race with
ep_free() or ep_remove().
Move ->whead = NULL to the end of ep_poll_callback() and add the
necessary barriers.
TODO: cleanup the ewake/EPOLLEXCLUSIVE logic, it was confusing even
before this patch.
Hopefully this explains use-after-free reported by syzcaller:
BUG: KASAN: use-after-free in debug_spin_lock_before
...
_raw_spin_lock_irqsave+0x4a/0x60 kernel/locking/spinlock.c:159
ep_poll_callback+0x29f/0xff0 fs/eventpoll.c:1148
this is spin_lock(eventpoll->lock),
...
Freed by task 17774:
...
kfree+0xe8/0x2c0 mm/slub.c:3883
ep_free+0x22c/0x2a0 fs/eventpoll.c:865
Fixes: 971316f050 ("epoll: ep_unregister_pollwait() can use the freed pwq->whead")
Reported-by: 范龙飞 <long7573@126.com>
Cc: stable@vger.kernel.org
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pull networking fixes from David Miller:
1) Fix handling of pinned BPF map nodes in hash of maps, from Daniel
Borkmann.
2) IPSEC ESP error paths leak memory, from Steffen Klassert.
3) We need an RCU grace period before freeing fib6_node objects, from
Wei Wang.
4) Must check skb_put_padto() return value in HSR driver, from FLorian
Fainelli.
5) Fix oops on PHY probe failure in ftgmac100 driver, from Andrew
Jeffery.
6) Fix infinite loop in UDP queue when using SO_PEEK_OFF, from Eric
Dumazet.
7) Use after free when tcf_chain_destroy() called multiple times, from
Jiri Pirko.
8) Fix KSZ DSA tag layer multiple free of SKBS, from Florian Fainelli.
9) Fix leak of uninitialized memory in sctp_get_sctp_info(),
inet_diag_msg_sctpladdrs_fill() and inet_diag_msg_sctpaddrs_fill().
From Stefano Brivio.
10) L2TP tunnel refcount fixes from Guillaume Nault.
11) Don't leak UDP secpath in udp_set_dev_scratch(), from Yossi
Kauperman.
12) Revert a PHY layer change wrt. handling of PHY_HALTED state in
phy_stop_machine(), it causes regressions for multiple people. From
Florian Fainelli.
13) When packets are sent out of br0 we have to clear the
offload_fwdq_mark value.
14) Several NULL pointer deref fixes in packet schedulers when their
->init() routine fails. From Nikolay Aleksandrov.
15) Aquantium devices cannot checksum offload correctly when the packet
is <= 60 bytes. From Pavel Belous.
16) Fix vnet header access past end of buffer in AF_PACKET, from
Benjamin Poirier.
17) Double free in probe error paths of nfp driver, from Dan Carpenter.
18) QOS capability not checked properly in DCB init paths of mlx5
driver, from Huy Nguyen.
19) Fix conflicts between firmware load failure and health_care timer in
mlx5, also from Huy Nguyen.
20) Fix dangling page pointer when DMA mapping errors occur in mlx5,
from Eran Ben ELisha.
21) ->ndo_setup_tc() in bnxt_en driver doesn't count rings properly,
from Michael Chan.
22) Missing MSIX vector free in bnxt_en, also from Michael Chan.
23) Refcount leak in xfrm layer when using sk_policy, from Lorenzo
Colitti.
24) Fix copy of uninitialized data in qlge driver, from Arnd Bergmann.
25) bpf_setsockopts() erroneously always returns -EINVAL even on
success. Fix from Yuchung Cheng.
26) tipc_rcv() needs to linearize the SKB before parsing the inner
headers, from Parthasarathy Bhuvaragan.
27) Fix deadlock between link status updates and link removal in netvsc
driver, from Stephen Hemminger.
28) Missed locking of page fragment handling in ESP output, from Steffen
Klassert.
29) Fix refcnt leak in ebpf congestion control code, from Sabrina
Dubroca.
30) sxgbe_probe_config_dt() doesn't check devm_kzalloc()'s return value,
from Christophe Jaillet.
31) Fix missing ipv6 rx_dst_cookie update when rx_dst is updated during
early demux, from Paolo Abeni.
32) Several info leaks in xfrm_user layer, from Mathias Krause.
33) Fix out of bounds read in cxgb4 driver, from Stefano Brivio.
34) Properly propagate obsolete state of route upwards in ipv6 so that
upper holders like xfrm can see it. From Xin Long.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (118 commits)
udp: fix secpath leak
bridge: switchdev: Clear forward mark when transmitting packet
mlxsw: spectrum: Forbid linking to devices that have uppers
wl1251: add a missing spin_lock_init()
Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
net: dsa: bcm_sf2: Fix number of CFP entries for BCM7278
kcm: do not attach PF_KCM sockets to avoid deadlock
sch_tbf: fix two null pointer dereferences on init failure
sch_sfq: fix null pointer dereference on init failure
sch_netem: avoid null pointer deref on init failure
sch_fq_codel: avoid double free on init failure
sch_cbq: fix null pointer dereferences on init failure
sch_hfsc: fix null pointer deref and double free on init failure
sch_hhf: fix null pointer dereference on init failure
sch_multiq: fix double free on init failure
sch_htb: fix crash on init failure
net/mlx5e: Fix CQ moderation mode not set properly
net/mlx5e: Fix inline header size for small packets
net/mlx5: E-Switch, Unload the representors in the correct order
net/mlx5e: Properly resolve TC offloaded ipv6 vxlan tunnel source address
...
Pull input fixes from Dmitry Torokhov:
"Just a couple drivers fixes (Synaptics PS/2, Xpad)"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: xpad - fix PowerA init quirk for some gamepad models
Input: synaptics - fix device info appearing different on reconnect
Three regression fixes that should be addressed before the final
release: a missing mutex call in OSS PCM emulation ioctl, ASoC rt5670
headset detection breakage, and a regression in simple-card parser
code.
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEECxfAB4MH3rD5mfB6bDGAVD0pKaQFAlmn/mwOHHRpd2FpQHN1
c2UuZGUACgkQbDGAVD0pKaQDQw//fFmgiBxYxAiYxKH/ICyhbotY35IdRrYbL2rN
Q+9NNlbeD8cmGTdKJi21vu1Oq9oxwDqn0IqwYNchRQLPUjWhoCnTNbAsPTWcDawY
Qay2MWe7lrgZkCCs3QkC0IZozD/l60CWwByWmWzyQNDHkxR2r/XtFNabPCNyQhj4
WNyCqW9UWe35oA0Ifi9e+X+V8K8JFj1qFSW3i99nd0skAXlhjpwNxUA80198e1Il
IhbyAGhJAIOsnwS2aRdythSN+zBBmjK8ZP64TSKt1rZGtqsBRi/GPKJTLWgBPK0U
ngMlG6T/B3qSag3i+CYxRXwKFusL/R3nr5ad24jE1ZQUKBKVSDTYcDDCwS6BJStI
ZlHxHyCfsTVhcFOcW5wkn5pavT1AYfnXDN8K0dCSWi0Zs+FwhX2DbwghfQQyKMXN
U8p8ZERrtzeFZh/ITtqUSi+sOqi2CEZu/jkjI8KrOWluU8D4oqvAHl+JD1UHXUwA
0N9r0d/TScXSoddrh5PqPkrnJacKniFoUwjPuzrwVTOAo15gmNkspAlrhbwocI1s
d4ruq5dkTtL9571QLHTFYrcDjed7xqToAyKK6D5q8233vKwGa941X+PhUoqpZWI4
MsDqTv+/+6r4JtuzaLhMPn/LG3IyvHr76dbM6yIHbjKy8QZxw7EcQY/t8ZIKvhEB
t6Lmzow=
=oMcz
-----END PGP SIGNATURE-----
Merge tag 'sound-4.13-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Three regression fixes that should be addressed before the final
release: a missing mutex call in OSS PCM emulation ioctl, ASoC rt5670
headset detection breakage, and a regression in simple-card parser
code"
* tag 'sound-4.13-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: simple_card_utils: fix fallback when "label" property isn't present
ALSA: pcm: Fix power lock unbalance via OSS emulation
ASoC: rt5670: Fix GPIO headset detection regression
Pull s390 fixes from Martin Schwidefsky:
"Three more bug fixes for v4.13.
The two memory management related fixes are quite new, they fix kernel
crashes that can be triggered by user space.
The third commit fixes a bug in the vfio ccw translation code"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/mm: fix BUG_ON in crst_table_upgrade
s390/mm: fork vs. 5 level page tabel
vfio: ccw: fix bad ptr math for TIC cda translation
Pull crypto fixes from Herbert Xu:
"This fixes the following issues:
- Regression in chacha20 handling of chunked input
- Crash in algif_skcipher when used with async io
- Potential bogus pointer dereference in lib/mpi"
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: algif_skcipher - only call put_page on referenced and used pages
crypto: testmgr - add chunked test cases for chacha20
crypto: chacha20 - fix handling of chunked input
lib/mpi: kunmap after finishing accessing buffer
After commit dce4551cb2 ("udp: preserve head state for IP_CMSG_PASSSEC")
we preserve the secpath for the whole skb lifecycle, but we also
end up leaking a reference to it.
We must clear the head state on skb reception, if secpath is
present.
Fixes: dce4551cb2 ("udp: preserve head state for IP_CMSG_PASSSEC")
Signed-off-by: Yossi Kuperman <yossiku@mellanox.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
