Commit Graph

1106994 Commits

Author SHA1 Message Date
Peter Ujfalusi
c2d1aec3f5
ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes()
Move the size checks prior to allocating memory as these checks do not need
the data to be allocated and in case of an error we would not need to free
the allocation.

The max size must not be less than the size of
struct sof_ipc_ctrl_data + struct sof_abi_hdr as the ABI header needs to
be present under all circumstances.
The check was incorrectly used or between the two size checks.

Fixes: b5cee8feb1 ("ASoC: SOF: topology: Make control parsing IPC agnostic")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220610084735.19397-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:40 +01:00
Peter Ujfalusi
bbfef046c6
ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow
Update the comment for the cl_dsp_init() to clarify what is done by the
function and use the chip->init_core_mask instead of BIT(0) when
unstalling/running the init core.

Complements: 2a68ff8461 ("ASoC: SOF: Intel: hda: Revisit IMR boot sequence")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20220609085949.29062-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:39 +01:00
Peter Ujfalusi
c31691e0d1
ASoC: SOF: Intel: hda-loader: Make sure that the fw load sequence is followed
The hda_dsp_enable_core() is powering up _and_ unstall the core in one
call while the first step of the firmware loading  must not unstall the
core.
The core can be unstalled only after the set cpb_cfp and the configuration
of the IPC register for the ROM_CONTROL message.

Complements: 2a68ff8461 ("ASoC: SOF: Intel: hda: Revisit IMR boot sequence")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20220609085949.29062-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:38 +01:00
Peter Ujfalusi
08f8a93198
ASoC: SOF: Intel: hda-dsp: Expose hda_dsp_core_power_up()
The hda_dsp_core_power_up() needs to be exposed so that it can be used in
hda-loader.c to correct the boot flow.
The first step must not unstall the core, it should only power up the
core(s).

Add sanity check for the core_mask while exposing it to be safe.

Complements: 2a68ff8461 ("ASoC: SOF: Intel: hda: Revisit IMR boot sequence")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20220609085949.29062-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:37 +01:00
Kuninori Morimoto
ed0073bd0f
ASoC: ak4613: cares Simple-Audio-Card case for TDM
Renesas is the only user of ak4613 on upstream for now, and
commit f28dbaa958 ("ASoC: ak4613: add TDM256 support")
added TDM256 support. Renesas tested part of it, because of
board connection.

It was assuming ak4613 is probed via Audio-Graph-Card, but it
might be probed via Simple-Audio-Card either.
It will indicates WARNING in such case. This patch fixup it.

Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/87h74v29f7.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:36 +01:00
Pierre-Louis Bossart
40737057b4
ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect
The .set_jack_detect() codec component callback is invoked during card
registration, which happens when the machine driver is probed.

The issue is that this callback can race with the bus suspend/resume,
and IO timeouts can happen. This can be reproduced very easily if the
machine driver is 'blacklisted' and manually probed after the bus
suspends. The bus and codec need to be re-initialized using pm_runtime
helpers.

Previous contributions tried to make sure accesses to the bus during
the .set_jack_detect() component callback only happen when the bus is
active. This was done by changing the regcache status on a component
remove. This is however a layering violation, the regcache status
should only be modified on device probe, suspend and resume. The
component probe/remove should not modify how the device regcache is
handled. This solution also didn't handle all the possible race
conditions, and the RT700 headset codec was not handled.

This patch tries to resume the codec device before handling the jack
initializations. In case the codec has not yet been initialized,
pm_runtime may not be enabled yet, so we don't squelch the -EACCES
error code and only stop the jack information. When the codec reports
as attached, the jack initialization will proceed as usual.

BugLink: https://github.com/thesofproject/linux/issues/3643
Fixes: 7ad4d237e7 ('ASoC: rt711-sdca: Add RT711 SDCA vendor-specific driver')
Fixes: 899b12542b ('ASoC: rt711: add snd_soc_component remove callback')
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220606203752.144159-8-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:35 +01:00
Pierre-Louis Bossart
ba98d7d8b6
ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe
The workqueues are initialized in the io_init functions, which isn't
quite right. In some tests, this leads to warnings throw from
__queue_delayed_work()

WARN_ON_FUNCTION_MISMATCH(timer->function, delayed_work_timer_fn);

Move all the initializations to the probe functions.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220606203752.144159-7-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:34 +01:00
Pierre-Louis Bossart
0484271ab0
ASoC: rt7*-sdw: harden jack_detect_handler
Realtek headset codec drivers typically check if the card is
instantiated before proceeding with the jack detection.

The rt700, rt711 and rt711-sdca are however missing a check on the
card pointer, which can lead to NULL dereferences encountered in
driver bind/unbind tests.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220606203752.144159-6-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:33 +01:00
Pierre-Louis Bossart
08bb5dc6ce
ASoC: rt711: fix calibrate mutex initialization
Follow the same flow as rt711-sdca and initialize all mutexes at probe
time.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220606203752.144159-5-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:32 +01:00
Pierre-Louis Bossart
fe154c4ff3
ASoC: Intel: sof_sdw: handle errors on card registration
If the card registration fails, typically because of deferred probes,
the device properties added for headset codecs are not removed, which
leads to kernel oopses in driver bind/unbind tests.

We already clean-up the device properties when the card is removed,
this code can be moved as a helper and called upon card registration
errors.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220606203752.144159-4-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:31 +01:00
Pierre-Louis Bossart
ed0a7fb29c
ASoC: rt711-sdca-sdw: fix calibrate mutex initialization
In codec driver bind/unbind test, the following warning is thrown:

DEBUG_LOCKS_WARN_ON(lock->magic != lock)
...
[  699.182495]  rt711_sdca_jack_init+0x1b/0x1d0 [snd_soc_rt711_sdca]
[  699.182498]  rt711_sdca_set_jack_detect+0x3b/0x90 [snd_soc_rt711_sdca]
[  699.182500]  snd_soc_component_set_jack+0x24/0x50 [snd_soc_core]

A quick check in the code shows that the 'calibrate_mutex' used by
this driver are not initialized at probe time. Moving the
initialization to the probe removes the issue.

BugLink: https://github.com/thesofproject/linux/issues/3644
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220606203752.144159-3-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:31 +01:00
Pierre-Louis Bossart
ac63716da3
ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove
When binding/unbinding codec drivers, the following warnings are
thrown:

[ 107.266879] rt715-sdca sdw:3:025d:0714:01: Unbalanced pm_runtime_enable!
[  306.879700] rt711-sdca sdw:0:025d:0711:01: Unbalanced pm_runtime_enable!

Add a remove callback for all Realtek/Maxim SoundWire codecs and remove this
warning.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220606203752.144159-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2022-06-24 16:21:30 +01:00
Arnd Bergmann
60192dd85c Memory controller drivers - fixes for v5.19
Broken in current cycle:
 1. OMAP GPMC: fix Kconfig dependency for OMAP_GPMC, so it will not be visible
    for everyone (driver is specific to OMAP).
 
 Broken before:
 1. Mediatek SMI: fix missing put_device() in error paths.
 2. Exynos DMC: fix OF node leaks in error paths.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmK1cpcQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD1y/aD/4m8QVoJVc+LhFXihIAYj+HJfoWhjGARrB4
 ZHi8e8mSiqj9TJ04eCeQutMthqlKSHXG8NfMabUngoW6/RvVDuBkEWFzZAwNRz2T
 D6xKu0/6pG+OzweLiw24A+WtGa3qCOpJOtk+KfmfYxc2AVcNExQs1ZIkx1n9AIuc
 YkIG0NgQa3oSnAWAIvUlGlS8nx07Z2iB3tJNoDg1BeriDhGJ7tVVmKQYNlNkm+zu
 vG3y8Win7mj70wZxPsWsYVNAxikDhrD6sz1UrflRng2wpTTVw8SqcTid8C7Zq65k
 tLbezCTEWblo1nWk2I7JqBG8hosIlRLYH4+sRNg+SfrMuvQtdu2DboMiRK38p2hH
 0jdGq0snTobhCoJYnLHxtBsehtyqKM9w/YiklYNoKaHBias10UpX8C8811bpnjtP
 oxDJyL5W/HRAXBgGH/Wbgbu0KDM5cA98d8dcAp40Ez1WyZgpexIYtdBpuk+DrGY8
 j5jfpS+vYVZ1G7uYKi9Y2RsiPvqq3AgCKnvXk1GQmkjrx4cNoRCInL0+iIjM6xYb
 slhTVKlDBmEPQM2qUQmxFltS7+ump92/4RcsBlOpTCRjiD8kkoZln3y9L2pe9oEg
 LIuP5rWmsUfptrgMjhw2jhF769SoDKyx08MEpapZq8VlopvxyMPOeyzPolEU72hE
 Qa4g5PiK5Q==
 =EoXD
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmK11nQACgkQmmx57+YA
 GNl1yQ/+OqDC3mY2+8i3msrLFcCJwZUxmGZ6PtYyMJtVA/BzUGevwmUSsotMqmAl
 32LOYhHc1GFrP7pmOMIoW4yCvSLVAoNPIfHC7Qsq8mnkuujTk/tvybR598bqsXL8
 s+ognqPS6kMEw7X1PkR0CnSYB5MgVCWg2IuzzQQzpAWo7pUY4vC7K5gxrKJ1Qhkv
 T/3sq6KQ+Oozzsp6T/ZVNyLkEMtx2CIUM4XYXV6H2hx+8wWGgnBG/KWbxtr6lWaS
 mIJgfk0SiG/qgTjIXNDdLIfHLcE/GMMN+DAc52MSCGMVk6qmk7NVznCtng7/rAwh
 cWNS+5HBAbBOcXqtJUaNwXh4hC1T9qnwGfSNzF1aUTTzMgObdEKo9lD98W4UUglN
 D3RkX6KCWWqfmk6XUgjlkf6xMlzRvBtfzwhf+7jhEaRvXzIaQeveOoNpH0myWGmc
 k1qfPr5+Z7YAzHMQ5MeqJ7ZqHdr5pPc6TwQmWZNigQIw+yiXHrQE5I7znl/Efe+/
 Q9XaQg1km7vYF8g0TGxnQpPLJywM57X5t2ToV1wSjgYEsys7b9+mlEnTG9w6MwVU
 u3a2ZPTjyoOMwhNJ5IzmdEh3cdQQBJ/e4IWluu+e67Wjw3XIKiy5ah9NRbuCqDk2
 WeSZaiXQRABAW7uSYY1xZzcFoI6ZnH/Fk6Rkoi1nzrH6AdMibbQ=
 =WaIY
 -----END PGP SIGNATURE-----

Merge tag 'memory-controller-drv-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes

Memory controller drivers - fixes for v5.19

Broken in current cycle:
1. OMAP GPMC: fix Kconfig dependency for OMAP_GPMC, so it will not be visible
   for everyone (driver is specific to OMAP).

Broken before:
1. Mediatek SMI: fix missing put_device() in error paths.
2. Exynos DMC: fix OF node leaks in error paths.

* tag 'memory-controller-drv-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
  memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
  memory: mtk-smi: add missing put_device() call in mtk_smi_device_link_common
  memory: omap-gpmc: OMAP_GPMC should depend on ARCH_OMAP2PLUS || ARCH_KEYSTONE || ARCH_K3

Link: https://lore.kernel.org/r/20220624081819.33617-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-06-24 17:21:23 +02:00
Arnd Bergmann
416e95a479 Samsung fixes for v5.19
Both fixes are for issues present before v5.19 merge window:
 1. Correct UART clocks on Exynos7885.  Although the initial, fixed
    DTS commit is from v5.18, the issue will be exposed with a upcoming fix
    to Exynos7885 clock driver, so we need to correct the DTS earlier.
 2. Fix theoretical OF node leak in Exynos machine code.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmK1b10QHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD10UYD/4ycN/GFy89kBKOURfTvdCdu/UMgS52GR1/
 q7xM+4ozv/18DRkh/b8OsxVNGekrKmHMFtKrdszLY4ITeNrVqt+vQe3ZIOT0SxDS
 xyBenMUSzoNjYAPGTf1MofBovUM+4FEIK7kzhRiXqcplTS3kqkF5UKwNMmL4JQWJ
 JGvtOkByzhjH8jjUopEaw44gfbbmXKWm/4Ukst2B4vUb9Bk2hhboT+L0MUWImBO1
 31xOUOlzAEtjpwrcBGJ96AHQTzCcYuHWcwtJfBrB/3bbdAwvnjqqrCwO7Heoe8qM
 lkOLQfXxZzKLYY6rsa8Zz/2Rgh0+0esMBXD/nBsbv0vf/MTQixIO49HfUBhvZnWJ
 MNN1OlYpt9+tEiWZ/Xq2Od6ks5cByZGfOuRYkjXO0HjNYFE7RFmrXaLvsELLhx9Y
 GbdzbFvZVHYsmBOszTL+DQPGh3pgH0PN+kU0pbtx97LLwTqytllTFErzorZ9jppM
 nJP9xkiv3+244DIsWZQT0wth4U8BdzF0pTYiQSqF+Eitn4I3/QSuKqvR2X8cdQ7/
 xIUlf9ZucIa/5X/RbR9WdX3pX5NzSAfebaUyGKgo5qUu3M0KIZBZIsXU6MT5LPvH
 H/lLneDH5zQxVWL03MGzCpccROtNR7BG+yM+3ePCwOJ+iXRxDjyLYH2MnoJ4spXu
 AkYG4biWsQ==
 =gDkB
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmK11jgACgkQmmx57+YA
 GNlcDhAArzMQck12DDz+ymkEoWlNPHyoy03MjkpkzGri0714jvDLK8a0CsitP00J
 PhXdIf8zb4qlsoyPvJYsXYE0fY/UYZGK9Ttsb7fOSWlBpvD/l1c2hpxHvmMAa00F
 NEymrR1NeuR1PIbooVKh5vy1H/jQR7cid/1aK497zS73oDoT3st7/M1Lm4PN2ain
 9J5GZz256xWYE0ZTvxj6zEi+HzUyuokXdPe6MgUE9+66QWGMODMlyEUU6AhlHOf2
 P3ib2xXYujteMVkTY+4FNEQN2B9wKjzZdPSpmxLinEotCiKfwzZSzkAxycWweFQV
 yDw2c90YrkZ7TilA4QeFjcdyHPwWP4chBTmGpgnr6lhiv0NU5HebMlYKTkyzu1P5
 dGHLQWqInIGlgzXBjgle16GMBoil81L2mDUEo0fOut+3M42tSU9IYGAGup5VKPpZ
 wONQcQyyK3/tK+34wsk+BuwI+L7VPstUazIn4QeOup7ohQcrBWkKWvRd+yUrr/YF
 6FQMvTs5I7gLEoj/uF9i3lmilLNnDfQDXFNCSWN8sT+TCh0LMyOc1N06k4A0Z2YI
 taBCpRgiLDqiuYsmnnq3YfPR7rwE9lXc+qTeLUnmiBgPaHsqXY1qnSWZkEGOk8x8
 vPtyldK6K64Fvw2ZCUdF+U2GTiuJOOGl86knjf5Ux7V4RnsfioM=
 =h/OV
 -----END PGP SIGNATURE-----

Merge tag 'samsung-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/fixes

Samsung fixes for v5.19

Both fixes are for issues present before v5.19 merge window:
1. Correct UART clocks on Exynos7885.  Although the initial, fixed
   DTS commit is from v5.18, the issue will be exposed with a upcoming fix
   to Exynos7885 clock driver, so we need to correct the DTS earlier.
2. Fix theoretical OF node leak in Exynos machine code.

* tag 'samsung-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  ARM: exynos: Fix refcount leak in exynos_map_pmu
  arm64: dts: exynos: Correct UART clocks on Exynos7885

Link: https://lore.kernel.org/r/20220624080423.31427-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-06-24 17:20:24 +02:00
Arnd Bergmann
b262b3b571 This pull request contains Broadcom ARM-SoC Device Tree fixes for 5.19,
please pull the following:
 
 - Stefan fixes the Raspberry Pi 400 GPIO expander line names to match
   that of the downstream Raspberry Pi Linux tree
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmKwqTgACgkQh9CWnEQH
 BwTZGQ//dWucnJtFfJ+JBG5avZ8cpHieqIhHpSVd0P6MljnHDcBcesOczL0euN/j
 1EMVwC6Q/2yAa6L7JLB8iGAVH3yR4ly95SHBtCJ1of5hXv2dOtBqTgyoi5xsYnlh
 u1t5DufNoTBFiER8D6aCQKGXXlyG+j9xH0ddu3TY+qcNfcXYDbq5l01IsF922lED
 3xZXz6K7p19/f9WJrcmdOEv4dKu+Pa6ctRYsrm1aaSRa36NXPDT2CH5qm4eh5+VO
 W8ub+roB3fLjIHY7Dx5Cs3YGCq7DbBvUQ4G1Uty4J/8KkOhPSIhAxxbVrYIBltby
 ZrouRUVdsdoec5aG0usxYeWK2eITNBHGvEPKzEdx2nZ370ir55UodWfq1u+0c03R
 zY1TI0BSThkhVvpAxCyt4qUPqHf4rgyxP5+FA8VMumnIefD7uQDIKhdkWi5PrwwA
 GlSi6P1fhWnVRjzGRSPvVm1sS92Y048/Aay2CKlgSINuCC0rNMblGFej14r1mUGU
 fGjR29IXTPMnB+gHhUgRa6q6l+cbpnxaUQq825+VC9fdFZgifu4i38lTn5m+BDIE
 heygDDkOou+G9As6Yvj5l/PO+3rQ0MmH7L50ni6QzEoat7loABPDf87cJZvW0+tb
 Ug308VwTYCnVHJ+kr+xbMwuQWchklSZkuKt+AsMr+FS+uC8X/4g=
 =v1YD
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmK11hYACgkQmmx57+YA
 GNl84BAApJD18S5ioNVObHGuAoLd3alOC4DppiAVBconQt7DRiUKSXwoULQ9wcc3
 Bq2rvws085iEkVd+4tnND6/Xe8XBpQhBpwc0iS6e88SEQP54myti+FZzmoVJiQ6S
 DOMOdnpPT4TLKDacRRICIHKGSClEoA5cdjGXtIyqC8sw/KlR0kMZ8Hlzo1wXhRVJ
 FlVDrFzwvVWAxOPju2VvwM+FXlidDXXTJzll7rrl+vF8eGKaZIOPabEZWOtimFYG
 UAOza1bmrWVkPFpImY8acmyKR105r+rN7d14rS8vpiuJg4xyfF2ZyksYjvcvEmN/
 dTg8xMX1BY5aQdghorQKRjw28fs6qn1c+0Mhd9ZvBecvkj9gKHS773rik8JQG/5q
 AZBN0RuJFjLx2rLvNhZ/Vf+g7d1Yd/qRLen1EcfQlaMhMbXR5j1ge6jpyIUhw9dO
 B4MXXqD99W8gYAZyb1KBTvwTCy6J0el8Xg294TK63Z+W/lm8Nfab2mu6ROCDg1ud
 kKttoQTMojVCD5umzs4iJu4ud3jFIXqJfcRCc4IgAN2WEYtp/0P1n9hdE6AkTR9w
 /rX+yCo2RcFhyipSfS3SxU9nIQ9rV2G9NjTjYQRd3RlbfrQwSKXFpJgGarN6XmFE
 ndFRuYlGfbRHxgSzHiUbLDm32z/7oX7CEUntBtce2LQB2U4/s1I=
 =Ca7Z
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-5.19/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes

This pull request contains Broadcom ARM-SoC Device Tree fixes for 5.19,
please pull the following:

- Stefan fixes the Raspberry Pi 400 GPIO expander line names to match
  that of the downstream Raspberry Pi Linux tree

* tag 'arm-soc/for-5.19/devicetree-fixes' of https://github.com/Broadcom/stblinux:
  ARM: dts: bcm2711-rpi-400: Fix GPIO line names

Link: https://lore.kernel.org/r/20220620170745.2485199-1-f.fainelli@gmail.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-06-24 17:19:50 +02:00
Arnd Bergmann
db6b92459f Devicetree fixes for TI K3 platforms for v5.19
Critical fixes for the following:
 * Boot failure on J721s2 (overlap GIC memory map)
 * AM64 boot fails on highspeed cards (SoC characterization updates)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+KKGk1TrgjIXoxo03bWEnRc2JJ0FAmKtPPkACgkQ3bWEnRc2
 JJ2d6w/8CezDMzREHCqzBQ3f0QVTUyrNwNUERANi6FT9PbDRt/kymqrpmo/dfzzs
 XzBnDClqo57l7+tB937SBLI4vcjc178GnVJCdOvr84NLgMhCjE3eAvEYz0QpJN5d
 wVJ4i33H7TtlRzzH3HRECBNHIuqXUjdPzWwqI1ibtgOGyIH80TgpEz/ugsBy10TF
 Kg6waIGQpJhqHGjBVLu9NfkXspRdXx5cmf6CrP/eMVuSfRUlSGRWgz9UH08XMpXD
 HniNFBPjJpxc5Cqra1SaH2jAKe3d+KER8Jao+xZx3dF1aZBHUHte9MbMvJ/05TNQ
 05i7JPusIimZbKWWtRE8nziHkPWfXwR3cX96zUbyzofuVq3Xwg4xr/YTvnsad7aJ
 t0ibwSOm4MS8jJmKXuAkP65ryoHFxCnxREWd0y2OAbVB0cnFpooKZG+FGwaWSGJd
 St7habwZ4gmzoqCCkPiOhKUmTLjg5wfDeWDWaI3GEOCrJzVARoycKhPsLZ4bVvY1
 0fW9YfAwyNU1GXCjUpR4wnMlJNrIZPLH0DNrRUc7xvQM0WyZzt2KPGdSZbQGzCn9
 DcRbWCMPLL9LIbpO44lUqxLpmr9DTGm73b7X7tp1j7GIhAVaqNOAQfYtsM9UsHN6
 mu525uqH4HR4Nd5HUMKAoxJPIgW1p3Xusvk9+Rz7zei2AimMw2U=
 =SYvk
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmK11foACgkQmmx57+YA
 GNms2g/9HA6LiOuk/cnbEL97pRu5UpZ61HNMQoHjEMveRIFMzC04dPNCBDyqRwM9
 VgDBt14raRHBWybh5HfBYI/0sM3wLUErxNsCiKS3O8N4ImcpJzjD8oHaEscYDGaR
 PLEOETY/qS54eAyOWWXcsZ+nc4cIj66pMXCg5H17jC0bO4cctljvkiKPoFqv5mNc
 1XvQMZG07KVK4sA11voo03BGTlsXWJSSFn1Ho6oFb1a8HFMzOZ+1DRXssR4uOvxi
 WeJJX4f1B8f/NJE49l1mmp1b0jiZsS84LAwQfR197qxwipGa/oGEcnFVzVZ0eNPm
 RlGeabh+06ntPBGK9PUFGNrBq9bmhaxA00ZEl0a5ECdvYdb4So5wfZJpFbT6Oj+K
 sKWJgGS0lcz56j1myZneGWP3cM/sS7RFqchLhrExtEDdTwrDMq/IRgmCtDEQ4AKK
 vYzbRCSXe3x8L+nhdNtxy9hlWGGTf6qA/X3xRTnWbrUqbyu3y5iEruE6t6pchG2l
 FFgBsrAT/u8/6PeOtyJoQ32UEVu5E0iflCNGF3ipa4NddVfmW9PnDKNngJpbuHC3
 ZR4M0di+KK+O94yeSkl6qqR9Y8aTE7FmbVBh025+1wccUiq+EVudflgwwooA5Rnw
 pFIlbzxchqmDJ325wklDD9RZTvzAZXy4vRpZ42TsORShRhuFU8Y=
 =Rpx7
 -----END PGP SIGNATURE-----

Merge tag 'ti-k3-dt-fixes-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into arm/fixes

Devicetree fixes for TI K3 platforms for v5.19

Critical fixes for the following:
* Boot failure on J721s2 (overlap GIC memory map)
* AM64 boot fails on highspeed cards (SoC characterization updates)

* tag 'ti-k3-dt-fixes-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ti/linux:
  arm64: dts: ti: k3-am64-main: Remove support for HS400 speed mode
  arm64: dts: ti: k3-j721s2: Fix overlapping GICD memory region

Link: https://lore.kernel.org/r/20220618031627.xxvscc22c6doaa3t@kahuna
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-06-24 17:19:21 +02:00
Liang He
2c629dd2d1
arm: mach-spear: Add missing of_node_put() in time.c
In spear_setup_of_timer(), of_find_matching_node() will return a
node pointer with refcount incrementd. We should use of_node_put()
in each fail path or when it is not used anymore.

Signed-off-by: Liang He <windhl@126.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Link: https://lore.kernel.org/r/20220616093027.3984903-1-windhl@126.com'
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-06-24 17:18:55 +02:00
Miaoqian Lin
1ba904b6b1 ARM: cns3xxx: Fix refcount leak in cns3xxx_init
of_find_compatible_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.

Fixes: 415f59142d ("ARM: cns3xxx: initial DT support")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Acked-by: Krzysztof Halasa <khalasa@piap.pl>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-06-24 17:18:30 +02:00
Thara Gopinath
17b1362d49 MAINTAINERS: Update email address
Update my email address in the MAINTAINERS file as  the current
one will stop functioning in a while.

Signed-off-by: Thara Gopinath <thara.gopinath@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-06-24 17:18:30 +02:00
Shyam Prasad N
8da33fd11c cifs: avoid deadlocks while updating iface
We use cifs_tcp_ses_lock to protect a lot of things.
Not only does it protect the lists of connections, sessions,
tree connects, open file lists, etc., we also use it to
protect some fields in each of it's entries.

In this case, cifs_mark_ses_for_reconnect takes the
cifs_tcp_ses_lock to traverse the lists, and then calls
cifs_update_iface. However, that can end up calling
cifs_put_tcp_session, which picks up the same lock again.

Avoid this by taking a ref for the session, drop the lock,
and then call update iface.

Also, in cifs_update_iface, avoid nested locking of iface_lock
and chan_lock, as much as possible. When unavoidable, we need
to pick iface_lock first.

Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-06-24 09:17:56 -05:00
Joerg Roedel
c242507c1b MAINTAINERS: Add new IOMMU development mailing list
The IOMMU mailing list will move from lists.linux-foundation.org to
lists.linux.dev. The hard switch of the archive will happen on July
5th, but add the new list now already so that people start using the
list when sending patches. After July 5th the old list will disappear.

Cc: stable@vger.kernel.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Link: https://lore.kernel.org/r/20220624125139.412-1-joro@8bytes.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2022-06-24 15:36:11 +02:00
Xu Yang
b24346a240 usb: chipidea: udc: check request status before setting device address
The complete() function may be called even though request is not
completed. In this case, it's necessary to check request status so
as not to set device address wrongly.

Fixes: 10775eb17b ("usb: chipidea: udc: update gadget states according to ch9")
cc: <stable@vger.kernel.org>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://lore.kernel.org/r/20220623030242.41796-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-24 13:45:23 +02:00
Alan Stern
90bc2af246 USB: gadget: Fix double-free bug in raw_gadget driver
Re-reading a recently merged fix to the raw_gadget driver showed that
it inadvertently introduced a double-free bug in a failure pathway.
If raw_ioctl_init() encounters an error after the driver ID number has
been allocated, it deallocates the ID number before returning.  But
when dev_free() runs later on, it will then try to deallocate the ID
number a second time.

Closely related to this issue is another error in the recent fix: The
ID number is stored in the raw_dev structure before the code checks to
see whether the structure has already been initialized, in which case
the new ID number would overwrite the earlier value.

The solution to both bugs is to keep the new ID number in a local
variable, and store it in the raw_dev structure only after the check
for prior initialization.  No errors can occur after that point, so
the double-free will never happen.

Fixes: f2d8c26068 ("usb: gadget: Fix non-unique driver names in raw-gadget driver")
CC: Andrey Konovalov <andreyknvl@gmail.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/YrMrRw5AyIZghN0v@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-24 13:45:21 +02:00
Takashi Iwai
ae8b163156 ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD
Both Behringer UMC 202 HD and 404 HD need explicit quirks to enable
the implicit feedback mode and start the playback stream primarily.
The former seems fixing the stuttering and the latter is required for
a playback-only case.

Note that the "clock source 41 is not valid" error message still
appears even after this fix, but it should be only once at probe.
The reason of the error is still unknown, but this seems to be mostly
harmless as it's a one-off error and the driver retires the clock
setup and it succeeds afterwards.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215934
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220624101132.14528-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-24 12:12:17 +02:00
Tom Lendacky
87d044096e crypto: ccp - Fix device IRQ counting by using platform_irq_count()
The ccp driver loops through the platform device resources array to get
the IRQ count for the device. With commit a1a2b7125e ("of/platform: Drop
static setup of IRQ resource from DT core"), the IRQ resources are no
longer stored in the platform device resource array. As a result, the IRQ
count is now always zero. This causes the driver to issue a second call to
platform_get_irq(), which fails if the IRQ count is really 1, causing the
loading of the driver to fail.

Replace looping through the resources array to count the number of IRQs
with a call to platform_irq_count().

Fixes: a1a2b7125e ("of/platform: Drop static setup of IRQ resource from DT core")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2022-06-24 17:09:01 +08:00
Peter Gonda
6defa24d3b KVM: SEV: Init target VMCBs in sev_migrate_from
The target VMCBs during an intra-host migration need to correctly setup
for running SEV and SEV-ES guests. Add sev_init_vmcb() function and make
sev_es_init_vmcb() static. sev_init_vmcb() uses the now private function
to init SEV-ES guests VMCBs when needed.

Fixes: 0b020f5af0 ("KVM: SEV: Add support for SEV-ES intra host migration")
Fixes: b56639318b ("KVM: SEV: Add support for SEV intra host migration")
Signed-off-by: Peter Gonda <pgonda@google.com>
Cc: Marc Orr <marcorr@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: kvm@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Message-Id: <20220623173406.744645-1-pgonda@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-06-24 04:10:18 -04:00
Mingwei Zhang
ebdec859fa KVM: x86/svm: add __GFP_ACCOUNT to __sev_dbg_{en,de}crypt_user()
Adding the accounting flag when allocating pages within the SEV function,
since these memory pages should belong to individual VM.

No functional change intended.

Signed-off-by: Mingwei Zhang <mizhang@google.com>
Message-Id: <20220623171858.2083637-1-mizhang@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-06-24 03:58:06 -04:00
Jason Wang
c346dae4f3 virtio: disable notification hardening by default
We try to harden virtio device notifications in 8b4ec69d7e ("virtio:
harden vring IRQ"). It works with the assumption that the driver or
core can properly call virtio_device_ready() at the right
place. Unfortunately, this seems to be not true and uncover various
bugs of the existing drivers, mainly the issue of using
virtio_device_ready() incorrectly.

So let's add a Kconfig option and disable it by default. It gives
us time to fix the drivers and then we can consider re-enabling it.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20220622012940.21441-1-jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2022-06-24 02:49:48 -04:00
Bo Liu
03d9571706 virtio: Remove unnecessary variable assignments
In function vp_modern_probe(), "pci_dev" is initialized with the
value of "mdev->pci_dev", so assigning "pci_dev" to "mdev->pci_dev"
is unnecessary since they store the same value.

Signed-off-by: Bo Liu <liubo03@inspur.com>
Message-Id: <20220617055952.5364-1-liubo03@inspur.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
2022-06-24 02:49:48 -04:00
huangjie.albert
a7722890fd virtio_ring : keep used_wrap_counter in vq->last_used_idx
the used_wrap_counter and the vq->last_used_idx may get
out of sync if they are separate assignment,and interrupt
might use an incorrect value to check for the used index.

for example:OOB access
ksoftirqd may consume the packet and it will call:
virtnet_poll
	-->virtnet_receive
		-->virtqueue_get_buf_ctx
			-->virtqueue_get_buf_ctx_packed
and in virtqueue_get_buf_ctx_packed:

vq->last_used_idx += vq->packed.desc_state[id].num;
if (unlikely(vq->last_used_idx >= vq->packed.vring.num)) {
         vq->last_used_idx -= vq->packed.vring.num;
         vq->packed.used_wrap_counter ^= 1;
}

if at the same time, there comes a vring interrupt,in vring_interrupt:
we will call:
vring_interrupt
	-->more_used
		-->more_used_packed
			-->is_used_desc_packed
in is_used_desc_packed, the last_used_idx maybe >= vq->packed.vring.num.
so this could case a memory out of bounds bug.

this patch is to keep the used_wrap_counter in vq->last_used_idx
so we can get the correct value to check for used index in interrupt.

v3->v4:
- use READ_ONCE/WRITE_ONCE to get/set vq->last_used_idx

v2->v3:
- add inline function to get used_wrap_counter and last_used
- when use vq->last_used_idx, only read once
  if vq->last_used_idx is read twice, the values can be inconsistent.
- use last_used_idx & ~(-(1 << VRING_PACKED_EVENT_F_WRAP_CTR))
  to get the all bits below VRING_PACKED_EVENT_F_WRAP_CTR

v1->v2:
- reuse the VRING_PACKED_EVENT_F_WRAP_CTR
- Remove parameter judgment in is_used_desc_packed,
because it can't be illegal

Signed-off-by: huangjie.albert <huangjie.albert@bytedance.com>
Message-Id: <20220617020411.80367-1-huangjie.albert@bytedance.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-06-24 02:49:48 -04:00
Parav Pandit
0e0348ac3f vduse: Tie vduse mgmtdev and its device
vduse devices are not backed by any real devices such as PCI. Hence it
doesn't have any parent device linked to it.

Kernel driver model in [1] suggests to avoid an empty device
release callback.

Hence tie the mgmtdevice object's life cycle to an allocate dummy struct
device instead of static one.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/core-api/kobject.rst?h=v5.18-rc7#n284

Signed-off-by: Parav Pandit <parav@nvidia.com>
Message-Id: <20220613195223.473966-1-parav@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
2022-06-24 02:49:48 -04:00
Eli Cohen
ace9252446 vdpa/mlx5: Initialize CVQ vringh only once
Currently, CVQ vringh is initialized inside setup_virtqueues() which is
called every time a memory update is done. This is undesirable since it
resets all the context of the vring, including the available and used
indices.

Move the initialization to mlx5_vdpa_set_status() when
VIRTIO_CONFIG_S_DRIVER_OK is set.

Signed-off-by: Eli Cohen <elic@nvidia.com>
Message-Id: <20220613075958.511064-2-elic@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
2022-06-24 02:49:47 -04:00
Eli Cohen
40f2f3e941 vdpa/mlx5: Update Control VQ callback information
The control VQ specific information is stored in the dedicated struct
mlx5_control_vq. When the callback is updated through
mlx5_vdpa_set_vq_cb(), make sure to update the control VQ struct.

Fixes: 5262912ef3 ("vdpa/mlx5: Add support for control VQ and MAC setting")
Signed-off-by: Eli Cohen <elic@nvidia.com>
Message-Id: <20220613075958.511064-1-elic@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com)
2022-06-24 02:49:47 -04:00
Namjae Jeon
b5e5f9dfc9 ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA
FileOffset should not be greater than BeyondFinalZero in FSCTL_ZERO_DATA.
And don't call ksmbd_vfs_zero_data() if length is zero.

Cc: stable@vger.kernel.org
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-06-23 23:30:46 -05:00
Namjae Jeon
18e39fb960 ksmbd: set the range of bytes to zero without extending file size in FSCTL_ZERO_DATA
generic/091, 263 test failed since commit f66f8b94e7 ("cifs: when
extending a file with falloc we should make files not-sparse").
FSCTL_ZERO_DATA sets the range of bytes to zero without extending file
size. The VFS_FALLOCATE_FL_KEEP_SIZE flag should be used even on
non-sparse files.

Cc: stable@vger.kernel.org
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-06-23 23:30:46 -05:00
Hyunchul Lee
745bbc0995 ksmbd: remove duplicate flag set in smb2_write
The writethrough flag is set again if is_rdma_channel is false.

Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-06-23 23:30:46 -05:00
Dimitris Michailidis
b968080808 selftests/net: pass ipv6_args to udpgso_bench's IPv6 TCP test
udpgso_bench.sh has been running its IPv6 TCP test with IPv4 arguments
since its initial conmit. Looks like a typo.

Fixes: 3a687bef14 ("selftests: udp gso benchmark")
Cc: willemb@google.com
Signed-off-by: Dimitris Michailidis <dmichail@fungible.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20220623000234.61774-1-dmichail@fungible.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-06-23 21:19:03 -07:00
Eric Dumazet
1228b34c8d net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()
syzbot reported uninit-value in tcp_recvmsg() [1]

Issue here is that msg->msg_get_inq should have been cleared,
otherwise tcp_recvmsg() might read garbage and perform
more work than needed, or have undefined behavior.

Given CONFIG_INIT_STACK_ALL_ZERO=y is probably going to be
the default soon, I chose to change __sys_recvfrom() to clear
all fields but msghdr.addr which might be not NULL.

For __copy_msghdr_from_user(), I added an explicit clear
of kmsg->msg_get_inq.

[1]
BUG: KMSAN: uninit-value in tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
inet_recvmsg+0x13a/0x5a0 net/ipv4/af_inet.c:850
sock_recvmsg_nosec net/socket.c:995 [inline]
sock_recvmsg net/socket.c:1013 [inline]
__sys_recvfrom+0x696/0x900 net/socket.c:2176
__do_sys_recvfrom net/socket.c:2194 [inline]
__se_sys_recvfrom net/socket.c:2190 [inline]
__x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Local variable msg created at:
__sys_recvfrom+0x81/0x900 net/socket.c:2154
__do_sys_recvfrom net/socket.c:2194 [inline]
__se_sys_recvfrom net/socket.c:2190 [inline]
__x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190

CPU: 0 PID: 3493 Comm: syz-executor170 Not tainted 5.19.0-rc3-syzkaller-30868-g4b28366af7d9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: f94fd25cb0 ("tcp: pass back data left in socket after receive")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Tested-by: Alexander Potapenko<glider@google.com>
Link: https://lore.kernel.org/r/20220622150220.1091182-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-06-23 20:56:23 -07:00
Krzysztof Kozlowski
ad887a507d net/ncsi: use proper "mellanox" DT vendor prefix
"mlx" Devicetree vendor prefix is not documented and instead "mellanox"
should be used.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20220622115416.7400-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-06-23 20:51:06 -07:00
Liam Howlett
6886da5f49 powerpc/prom_init: Fix kernel config grep
When searching for config options, use the KCONFIG_CONFIG shell variable
so that builds using non-standard config locations work.

Fixes: 26deb04342 ("powerpc: prepare string/mem functions for KASAN")
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20220624011745.4060795-1-Liam.Howlett@oracle.com
2022-06-24 13:47:26 +10:00
Doug Berger
7c97bc0128 net: dsa: bcm_sf2: force pause link settings
The pause settings reported by the PHY should also be applied to the GMII port
status override otherwise the switch will not generate pause frames towards the
link partner despite the advertisement saying otherwise.

Fixes: 246d7f773c ("net: dsa: add Broadcom SF2 switch driver")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20220623030204.1966851-1-f.fainelli@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-06-23 20:46:39 -07:00
Liang He
16d584d2fc net/dsa/hirschmann: Add missing of_node_get() in hellcreek_led_setup()
of_find_node_by_name() will decrease the refcount of its first arg and
we need a of_node_get() to keep refcount balance.

Fixes: 7d9ee2e8ff ("net: dsa: hellcreek: Add PTP status LEDs")
Signed-off-by: Liang He <windhl@126.com>
Link: https://lore.kernel.org/r/20220622040621.4094304-1-windhl@126.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-06-23 20:39:22 -07:00
Christophe Leroy
9864816180 powerpc/book3e: Fix PUD allocation size in map_kernel_page()
Commit 2fb4706057 ("powerpc: add support for folded p4d page tables")
erroneously changed PUD setup to a mix of PMD and PUD. Fix it.

While at it, use PTE_TABLE_SIZE instead of PAGE_SIZE for PTE tables
in order to avoid any confusion.

Fixes: 2fb4706057 ("powerpc: add support for folded p4d page tables")
Cc: stable@vger.kernel.org # v5.8+
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/95ddfd6176d53e6c85e13bd1c358359daa56775f.1655974558.git.christophe.leroy@csgroup.eu
2022-06-24 12:42:45 +10:00
Nathan Lynch
19fc5bb93c powerpc/xive/spapr: correct bitmap allocation size
kasan detects access beyond the end of the xibm->bitmap allocation:

BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140
Read of size 8 at addr c00000001d1d0118 by task swapper/0/1

CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00001-g90df023b36dd #28
Call Trace:
[c00000001d98f770] [c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable)
[c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710
[c00000001d98f880] [c0000000006902c0] kasan_report+0x110/0x354
[c00000001d98f950] [c000000000692324] __asan_load8+0xa4/0xe0
[c00000001d98f970] [c0000000011c6ed0] _find_first_zero_bit+0x40/0x140
[c00000001d98f9b0] [c0000000000dbfbc] xive_spapr_get_ipi+0xcc/0x260
[c00000001d98fa70] [c0000000000d6d28] xive_setup_cpu_ipi+0x1e8/0x450
[c00000001d98fb30] [c000000004032a20] pSeries_smp_probe+0x5c/0x118
[c00000001d98fb60] [c000000004018b44] smp_prepare_cpus+0x944/0x9ac
[c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640
[c00000001d98fd90] [c0000000000131e8] kernel_init+0x28/0x1d0
[c00000001d98fe10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64

Allocated by task 0:
 kasan_save_stack+0x34/0x70
 __kasan_kmalloc+0xb4/0xf0
 __kmalloc+0x268/0x540
 xive_spapr_init+0x4d0/0x77c
 pseries_init_irq+0x40/0x27c
 init_IRQ+0x44/0x84
 start_kernel+0x2a4/0x538
 start_here_common+0x1c/0x20

The buggy address belongs to the object at c00000001d1d0118
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 8-byte region [c00000001d1d0118, c00000001d1d0120)

The buggy address belongs to the physical page:
page:c00c000000074740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xc00000001d1d0558 pfn:0x1d1d
flags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff)
raw: 007ffff000000200 c00000001d0003c8 c00000001d0003c8 c00000001d010480
raw: c00000001d1d0558 0000000001e1000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 c00000001d1d0000: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 c00000001d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
>c00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc fc fc
                            ^
 c00000001d1d0180: fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc
 c00000001d1d0200: fc fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc

This happens because the allocation uses the wrong unit (bits) when it
should pass (BITS_TO_LONGS(count) * sizeof(long)) or equivalent. With small
numbers of bits, the allocated object can be smaller than sizeof(long),
which results in invalid accesses.

Use bitmap_zalloc() to allocate and initialize the irq bitmap, paired with
bitmap_free() for consistency.

Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20220623182509.3985625-1-nathanl@linux.ibm.com
2022-06-24 12:40:38 +10:00
Dan Williams
f50974eee5 memregion: Fix memregion_free() fallback definition
In the CONFIG_MEMREGION=n case, memregion_free() is meant to be a static
inline. 0day reports:

    In file included from drivers/cxl/core/port.c:4:
    include/linux/memregion.h:19:6: warning: no previous prototype for
    function 'memregion_free' [-Wmissing-prototypes]

Mark memregion_free() static.

Fixes: 33dd70752c ("lib: Uplevel the pmem "region" ida to a global allocator")
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://lore.kernel.org/r/165601455171.4042645.3350844271068713515.stgit@dwillia2-xfh
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-06-23 18:42:05 -07:00
Dave Airlie
1e9124df8b Merge tag 'drm-msm-fixes-2022-06-20' of https://gitlab.freedesktop.org/drm/msm into drm-fixes
Fixes for v5.19-rc4

- Workaround for parade DSI bridge power sequencing
- Fix for multi-planar YUV format offsets
- Limiting WB modes to max sspp linewidth
- Fixing the supported rotations to add 180 back for IGT
- Fix to handle pm_runtime_get_sync() errors to avoid unclocked access
  in the bind() path for dpu driver
- Fix the irq_free() without request issue which was a being hit frequently
  in CI.
- Fix to add minimum ICC vote in the msm_mdss pm_resume path to address
  bootup splats
- Fix to avoid dereferencing without checking in WB encoder
- Fix to avoid crash during suspend in DP driver by ensuring interrupt
  mask bits are updated
- Remove unused code from dpu_encoder_virt_atomic_check()
- Fix to remove redundant init of dsc variable
- Fix to ensure mmap offset is initialized to avoid memory corruption
  from unpin/evict
- Fix double runpm disable in probe-defer path
- VMA fenced-unpin fixes
- Fix for WB max-width
- Fix for rare dp resolution change issue

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGvdsOF1-+WfTWyEyu33XPcvxOCU00G-dz7EF2J+fdyUHg@mail.gmail.com
2022-06-24 10:11:27 +10:00
Dave Airlie
08d27daaaa Merge tag 'drm-intel-fixes-2022-06-22' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
drm/i915 fixes for v5.19-rc4:
- Revert low voltage SKU check removal to fix display issues
- Apply PLL DCO fraction workaround for ADL-S
- Don't show engine classes not present in client fdinfo

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87a6a4syrr.fsf@intel.com
2022-06-24 09:58:06 +10:00
Dave Airlie
0a86b0db38 Multiple fixes in sun4i for suspend, DDC, DMA setup; A rework of vc4 to
properly split the driver between hardware capabilities that wasn't done
 properly causing multiple crashes; and a panel quirk for Aya Neo Next
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRcEzekXsqa64kGDp7j7w1vZxhRxQUCYrQLBgAKCRDj7w1vZxhR
 xbnyAQD1yHRWhf+v17f7xpfIPF8lyqymGuUgfntUBQ9wI2YRvQD/YegLrkRiqtov
 BQ4KkWzzxMS6Pa+U86LCIGFYSxD00AA=
 =viZ2
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2022-06-23' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

Multiple fixes in sun4i for suspend, DDC, DMA setup; A rework of vc4 to
properly split the driver between hardware capabilities that wasn't done
properly causing multiple crashes; and a panel quirk for Aya Neo Next

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20220623064152.ubjmnpj7tdejdcw6@houat
2022-06-24 09:45:50 +10:00
Dave Airlie
382cf35f25 Merge tag 'amd-drm-fixes-5.19-2022-06-22' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
amd-drm-fixes-5.19-2022-06-22:

amdgpu:
- Adjust GTT size logic
- eDP fix for RMB
- DCN 3.15 fix
- DP training fix
- Color encoding fix for DCN2+

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220622214106.5984-1-alexander.deucher@amd.com
2022-06-24 09:36:30 +10:00
Stefan Wahren
b0d473185b gpio: mxs: Fix header comment
This driver is about MXS GPIO support. MXC is a different platform.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
2022-06-23 23:18:13 +02:00