OSDN Git Service
Blagovest Kolenichev [Thu, 21 Sep 2017 21:00:18 +0000 (14:00 -0700)]
Merge android-4.4@
29d0b65 (v4.4.88) into msm-4.4
* refs/heads/tmp-
29d0b65
Linux 4.4.88
xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
NFS: Fix 2 use after free issues in the I/O code
ARM: 8692/1: mm: abort uaccess retries upon fatal signal
Bluetooth: Properly check L2CAP config option output buffer length
ALSA: msnd: Optimize / harden DSP and MIDI loops
locktorture: Fix potential memory leak with rw lock test
btrfs: resume qgroup rescan on rw remount
drm/bridge: adv7511: Re-write the i2c address before EDID probing
drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event()
drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context
drm/bridge: adv7511: Fix mutex deadlock when interrupts are disabled
drm: adv7511: really enable interrupts for EDID detection
scsi: sg: recheck MMAP_IO request length with lock held
scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
cs5536: add support for IDE controller variant
workqueue: Fix flag collision
drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
mwifiex: correct channel stat buffer overflows
dlm: avoid double-free on error path in dlm_device_{register,unregister}
Bluetooth: Add support of 13d3:3494 RTL8723BE device
rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
Input: trackpoint - assume 3 buttons when buttons detection fails
ath10k: fix memory leak in rx ring buffer allocation
intel_th: pci: Add Cannon Lake PCH-LP support
intel_th: pci: Add Cannon Lake PCH-H support
driver core: bus: Fix a potential double free
staging/rts5208: fix incorrect shift to extract upper nybble
USB: core: Avoid race of async_completed() w/ usbdev_release()
usb:xhci:Fix regression when ATI chipsets detected
usb: Add device quirk for Logitech HD Pro Webcam C920-C
USB: serial: option: add support for D-Link DWM-157 C1
usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
ANDROID: sdcardfs: Add missing break
ANDROID: Sdcardfs: Move gid derivation under flag
ANDROID: mnt: Fix freeing of mount data
drivers: cpufreq: checks to avoid kernel crash in cpufreq_interactive
ANDROID: Use sk_uid to replace uid get from socket file
ANDROID: nf: xt_qtaguid: fix handling for cases where tunnels are used.
Revert "ANDROID: Use sk_uid to replace uid get from socket file"
ANDROID: fiq_debugger: Fix minor bug in code
Conflicts:
drivers/cpufreq/cpufreq_interactive.c
drivers/net/wireless/ath/ath10k/core.c
drivers/staging/android/fiq_debugger/fiq_debugger.c
net/netfilter/xt_qtaguid.c
Change-Id: I49c67ff84d4bee0799691cc1ee0a023e2dd13e66
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Blagovest Kolenichev [Thu, 21 Sep 2017 20:19:38 +0000 (13:19 -0700)]
Merge android-4.4@
a8935c9 (v4.4.87) into msm-4.4
* refs/heads/tmp-
a8935c9:
Linux 4.4.87
crypto: algif_skcipher - only call put_page on referenced and used pages
epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
kvm: arm/arm64: Force reading uncached stage2 PGD
kvm: arm/arm64: Fix race in resetting stage2 PGD
drm/ttm: Fix accounting error when fail to get pages for pool
xfrm: policy: check policy direction value
wl1251: add a missing spin_lock_init()
CIFS: remove endian related sparse warning
CIFS: Fix maximum SMB2 header size
alpha: uapi: Add support for __SANE_USERSPACE_TYPES__
cpuset: Fix incorrect memory_pressure control file mapping
cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs
ceph: fix readpage from fscache
i2c: ismt: Return EMSGSIZE for block reads with bogus length
i2c: ismt: Don't duplicate the receive length for block reads
irqchip: mips-gic: SYNC after enabling GIC region
ANDROID: cpufreq-dt: Set sane defaults for schedutil rate limits
BACKPORT: cpufreq: schedutil: Use policy-dependent transition delays
FROMLIST: binder: fix an ret value override
FROMLIST: binder: fix memory corruption in binder_transaction binder
Linux 4.4.86
drm/i915: fix compiler warning in drivers/gpu/drm/i915/intel_uncore.c
scsi: sg: reset 'res_in_use' after unlinking reserved array
scsi: sg: protect accesses to 'reserved' page array
arm64: fpsimd: Prevent registers leaking across exec
x86/io: Add "memory" clobber to insb/insw/insl/outsb/outsw/outsl
arm64: mm: abort uaccess retries upon fatal signal
lpfc: Fix Device discovery failures during switch reboot test.
p54: memset(0) whole array
lightnvm: initialize ppa_addr in dev_to_generic_addr()
gcov: support GCC 7.1
gcov: add support for gcc version >= 6
i2c: jz4780: drop superfluous init
btrfs: remove duplicate const specifier
ALSA: au88x0: Fix zero clear of stream->resources
scsi: isci: avoid array subscript warning
sched: WALT: fix window mis-alignment
sched: EAS: kill incorrect nohz idle cpu kick
sched: EAS: fix incorrect energy delta calculation due to rounding error
sched: EAS/WALT: take into account of waking task's load
cpufreq: sched: WALT: don't apply capacity margin twice
sched: WALT: fix potential overflow
sched: EAS: schedfreq: fix CPU util over estimation
sched: EAS/WALT: use cr_avg instead of prev_runnable_sum
sched: WALT: fix broken cumulative runnable average accounting
sched: deadline: WALT: account cumulative runnable avg
FROMLIST: android: binder: Add page usage in binder stats
FROMLIST: android: binder: Add shrinker tracepoints
FROMLIST: android: binder: Add global lru shrinker to binder
FROMLIST: android: binder: Move buffer out of area shared with user space
FROMLIST: android: binder: Add allocator selftest
FROMLIST: android: binder: Refactor prev and next buffer into a helper function
android: android-base.config: enable IP6_NF_MATCH_RPFILTER
UPSTREAM: cpufreq: schedutil: Use unsigned int for iowait boost
UPSTREAM: cpufreq: schedutil: Make iowait boost more energy efficient
Conflicts:
drivers/cpufreq/cpufreq-dt.c
kernel/sched/deadline.c
kernel/sched/fair.c
kernel/sched/sched.h
Change-Id: Iee31db3fd1a0d1650ebf3d6de307a4e4637120b4
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Linux Build Service Account [Mon, 18 Sep 2017 08:31:44 +0000 (01:31 -0700)]
Merge "wil6210: refresh FW capabilities during interface up"
Linux Build Service Account [Sat, 16 Sep 2017 01:12:40 +0000 (18:12 -0700)]
Merge "usb: gadget: f_fs: Do not free IPC log buffer when free instance"
Linux Build Service Account [Sat, 16 Sep 2017 01:12:38 +0000 (18:12 -0700)]
Merge "ath10k: synchronize WLAN ON/OFF cmd during system suspend"
Linux Build Service Account [Sat, 16 Sep 2017 01:12:37 +0000 (18:12 -0700)]
Merge "cfg80211: Include length of kek in rekey data"
Linux Build Service Account [Fri, 15 Sep 2017 16:14:13 +0000 (09:14 -0700)]
Merge "nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS"
Linux Build Service Account [Fri, 15 Sep 2017 16:14:12 +0000 (09:14 -0700)]
Merge "msm: kgsl: Do not crash on context detach timeout failure"
Vidyullatha Kanchanapally [Thu, 25 May 2017 14:50:41 +0000 (20:20 +0530)]
cfg80211: Include length of kek in rekey data
With support for new AKM suites (example FILS-SHA256), the KEK length
can now be more than NL80211_KEK_LEN and the KCK length can be zero.
Add changes in cfg80211 to specify the length of KEK, and make KCK
optional. Make NL80211_REKEY_DATA_KEK as NLA_BINARY to enforce a maximum
length check.
Also add macro CFG80211_REKEY_DATA_KEK_LEN to indicate support for
including KEK length in rekey data.
CRs-Fixed:
2087759
Change-Id: Ica8dbb8614e0a9c3905e125b4a5254e43821984e
Signed-off-by: Vidyullatha Kanchanapally <vidyullatha@codeaurora.org>
Sarada Prasanna Garnayak [Wed, 6 Sep 2017 16:46:24 +0000 (22:16 +0530)]
ath10k: synchronize WLAN ON/OFF cmd during system suspend
During system suspend/resume or WLAN interface up/down
by the network subsystem the ath10k SNOC WLAN driver
configure WLAN enable/disable cmd with the WLAN firmware
over QMI interface. The WLAN enable/disable cmd configuration
with the WLAN firmware during system suspend is preventing
the system suspend.
Register PM event notifier for the ath10k SNOC platform
driver and synchronize the WLAN HIF power down/up
configuration, WLAN enable/disable cmd configuration
with WLAN firmware according to the system power state.
CRs-Fixed:
2110607
Change-Id: I5eeda967ae11c21ab5164c18b3e0a3bf668c916a
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
Linux Build Service Account [Fri, 15 Sep 2017 08:10:53 +0000 (01:10 -0700)]
Merge "msm: kgsl: Fixing an uninitialized variable in _gpuobj_map_useraddr()"
Vidyullatha Kanchanapally [Wed, 2 Aug 2017 11:01:40 +0000 (16:31 +0530)]
nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS
Use NL80211_CMD_UPDATE_CONNECT_PARAMS to update new ERP information,
Association IEs and the Authentication type to driver / firmware which
will be used in subsequent roamings.
CRs-Fixed:
2087764
Change-Id: Ic296b66a39b9ceb8de992a9f37112439389946a2
Signed-off-by: Vidyullatha Kanchanapally <vidyullatha@codeaurora.org>
Linux Build Service Account [Fri, 15 Sep 2017 00:08:03 +0000 (17:08 -0700)]
Merge "soc: qcom: pil: set device dma mask as 32 bit"
Linux Build Service Account [Fri, 15 Sep 2017 00:08:01 +0000 (17:08 -0700)]
Merge "msm: ais: Synchronize camera open/close calls"
Linux Build Service Account [Fri, 15 Sep 2017 00:08:00 +0000 (17:08 -0700)]
Merge "USB: dwc3-msm: Protect enabling phy irqs with mutex"
Greg Kroah-Hartman [Thu, 14 Sep 2017 16:48:29 +0000 (09:48 -0700)]
Merge 4.4.88 into android-4.4
Changes in 4.4.88
usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
USB: serial: option: add support for D-Link DWM-157 C1
usb: Add device quirk for Logitech HD Pro Webcam C920-C
usb:xhci:Fix regression when ATI chipsets detected
USB: core: Avoid race of async_completed() w/ usbdev_release()
staging/rts5208: fix incorrect shift to extract upper nybble
driver core: bus: Fix a potential double free
intel_th: pci: Add Cannon Lake PCH-H support
intel_th: pci: Add Cannon Lake PCH-LP support
ath10k: fix memory leak in rx ring buffer allocation
Input: trackpoint - assume 3 buttons when buttons detection fails
rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
Bluetooth: Add support of 13d3:3494 RTL8723BE device
dlm: avoid double-free on error path in dlm_device_{register,unregister}
mwifiex: correct channel stat buffer overflows
drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
workqueue: Fix flag collision
cs5536: add support for IDE controller variant
scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
scsi: sg: recheck MMAP_IO request length with lock held
drm: adv7511: really enable interrupts for EDID detection
drm/bridge: adv7511: Fix mutex deadlock when interrupts are disabled
drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context
drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event()
drm/bridge: adv7511: Re-write the i2c address before EDID probing
btrfs: resume qgroup rescan on rw remount
locktorture: Fix potential memory leak with rw lock test
ALSA: msnd: Optimize / harden DSP and MIDI loops
Bluetooth: Properly check L2CAP config option output buffer length
ARM: 8692/1: mm: abort uaccess retries upon fatal signal
NFS: Fix 2 use after free issues in the I/O code
xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
Linux 4.4.88
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Linux Build Service Account [Thu, 14 Sep 2017 14:38:08 +0000 (07:38 -0700)]
Merge "scsi: ufs: Get TX and RX FSM states for debug purpose"
Linux Build Service Account [Thu, 14 Sep 2017 14:38:07 +0000 (07:38 -0700)]
Merge "USB: composite: Use snprintf instead of sprintf"
Linux Build Service Account [Thu, 14 Sep 2017 14:38:03 +0000 (07:38 -0700)]
Merge "mmc: core: Correct the checks while setting clock scaling frequencies"
Linux Build Service Account [Thu, 14 Sep 2017 14:38:02 +0000 (07:38 -0700)]
Merge "mmc: block: Add error handling in mmc_blk_cmdq_part_switch"
Linux Build Service Account [Thu, 14 Sep 2017 14:38:01 +0000 (07:38 -0700)]
Merge "power: qpnp-fg-gen3: Get the raw MSOC directly from FG register"
Sankalp Sharma [Wed, 13 Sep 2017 12:31:10 +0000 (18:01 +0530)]
msm: ais: Synchronize camera open/close calls
Synchronize camera_v4l2_open and camera_v4l2_close to avoid use
after free.
Change-Id: I4055f00ff30408cc0469015b3e49d877632726bf
CRs-fixed:
2048964
Signed-off-by: Rahul Sharma <sharah@codeaurora.org>
Vijayavardhan Vennapusa [Fri, 8 Sep 2017 07:21:25 +0000 (12:51 +0530)]
USB: dwc3-msm: Protect enabling phy irqs with mutex
Currently driver is enabling hsphy_irq and ssphy_irq at the end
of dwc3_msm_suspend() without any spinlock/mutex protection. But
if it happens that hsphy_irq or ssphy_irq gets fired right after
enablement of irqs, there is a chance that we might see warnings
related to unbalanced irq enable. This could happen due to flag
is not yet set to indicate phy irqs enabled in suspend(). This
might cause phy irq left enabled after resume and could cause
crash due to unclocked access in host mode. Fix the unbalance irq
enable by having mutex protection and also extend mutex protection
for dwc3_msm_suspend() and dwc3_msm_resume().
Change-Id: I8c2d26f82feb235add64305c1d0e5b686993e9e9
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Arun KS [Tue, 12 Sep 2017 09:46:01 +0000 (15:16 +0530)]
soc: qcom: pil: set device dma mask as 32 bit
APPS interact with MPSS through 32 bit register interface.
Set dma mask for 32 bit so that mba and mdt memory are allocated
from 32 bit physical address range.
Change-Id: I623f00097d464b1bdd8f609e2d6c9a126f4bea4d
Signed-off-by: Arun KS <arunks@codeaurora.org>
Sayali Lokhande [Wed, 9 Aug 2017 10:08:28 +0000 (15:38 +0530)]
mmc: block: Add error handling in mmc_blk_cmdq_part_switch
mmc_blk_cmdq_part_switch always returned 0 even in case of
failures as errors are not handled in this function.
We need to un-halt cmdq in case it's in halt state when
mmc_switch fails. This change adds error handling code and
returns error in case of any failure.
Change-Id: Icd7ec4b7b53fc56d39dbcea195ae44bf08de17e5
Signed-off-by: Sayali Lokhande <sayalil@codeaurora.org>
Sayali Lokhande [Tue, 12 Sep 2017 09:14:46 +0000 (14:44 +0530)]
scsi: ufs: Get TX and RX FSM states for debug purpose
In case of any UFS error or aborts, read TX and RX
FSM states which can be used for debugging purpose.
Change-Id: I24a989a9e1b07ba904ec639e26736a01769f0593
Signed-off-by: Sayali Lokhande <sayalil@codeaurora.org>
Linux Build Service Account [Thu, 14 Sep 2017 01:59:43 +0000 (18:59 -0700)]
Merge "msm: vidc: Do a proper clean-up in case of session abort"
Linux Build Service Account [Thu, 14 Sep 2017 01:59:42 +0000 (18:59 -0700)]
Merge "msm: ipa: Add new API to check for ipa uC readiness"
Linux Build Service Account [Thu, 14 Sep 2017 01:59:41 +0000 (18:59 -0700)]
Merge "msm: mdss: disable HDMI block before HDMI core off"
Linux Build Service Account [Thu, 14 Sep 2017 01:59:40 +0000 (18:59 -0700)]
Merge "msm: camera: isp: Check null pointer for VFE0 base"
Greg Kroah-Hartman [Wed, 13 Sep 2017 21:10:05 +0000 (14:10 -0700)]
Linux 4.4.88
Richard Wareing [Tue, 12 Sep 2017 23:09:35 +0000 (09:09 +1000)]
xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
commit
b31ff3cdf540110da4572e3e29bd172087af65cc upstream.
If using a kernel with CONFIG_XFS_RT=y and we set the RHINHERIT flag on
a directory in a filesystem that does not have a realtime device and
create a new file in that directory, it gets marked as a real time file.
When data is written and a fsync is issued, the filesystem attempts to
flush a non-existent rt device during the fsync process.
This results in a crash dereferencing a null buftarg pointer in
xfs_blkdev_issue_flush():
BUG: unable to handle kernel NULL pointer dereference at
0000000000000008
IP: xfs_blkdev_issue_flush+0xd/0x20
.....
Call Trace:
xfs_file_fsync+0x188/0x1c0
vfs_fsync_range+0x3b/0xa0
do_fsync+0x3d/0x70
SyS_fsync+0x10/0x20
do_syscall_64+0x4d/0xb0
entry_SYSCALL64_slow_path+0x25/0x25
Setting RT inode flags does not require special privileges so any
unprivileged user can cause this oops to occur. To reproduce, confirm
kernel is compiled with CONFIG_XFS_RT=y and run:
# mkfs.xfs -f /dev/pmem0
# mount /dev/pmem0 /mnt/test
# mkdir /mnt/test/foo
# xfs_io -c 'chattr +t' /mnt/test/foo
# xfs_io -f -c 'pwrite 0 5m' -c fsync /mnt/test/foo/bar
Or just run xfstests with MKFS_OPTIONS="-d rtinherit=1" and wait.
Kernels built with CONFIG_XFS_RT=n are not exposed to this bug.
Fixes:
f538d4da8d52 ("[XFS] write barrier support")
Signed-off-by: Richard Wareing <rwareing@fb.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Trond Myklebust [Sat, 9 Sep 2017 01:28:11 +0000 (21:28 -0400)]
NFS: Fix 2 use after free issues in the I/O code
commit
196639ebbe63a037fe9a80669140bd292d8bcd80 upstream.
The writeback code wants to send a commit after processing the pages,
which is why we want to delay releasing the struct path until after
that's done.
Also, the layout code expects that we do not free the inode before
we've put the layout segments in pnfs_writehdr_free() and
pnfs_readhdr_free()
Fixes:
919e3bd9a875 ("NFS: Ensure we commit after writeback is complete")
Fixes:
4714fb51fd03 ("nfs: remove pgio_header refcount, related cleanup")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mark Rutland [Tue, 22 Aug 2017 10:36:17 +0000 (11:36 +0100)]
ARM: 8692/1: mm: abort uaccess retries upon fatal signal
commit
746a272e44141af24a02f6c9b0f65f4c4598ed42 upstream.
When there's a fatal signal pending, arm's do_page_fault()
implementation returns 0. The intent is that we'll return to the
faulting userspace instruction, delivering the signal on the way.
However, if we take a fatal signal during fixing up a uaccess, this
results in a return to the faulting kernel instruction, which will be
instantly retried, resulting in the same fault being taken forever. As
the task never reaches userspace, the signal is not delivered, and the
task is left unkillable. While the task is stuck in this state, it can
inhibit the forward progress of the system.
To avoid this, we must ensure that when a fatal signal is pending, we
apply any necessary fixup for a faulting kernel instruction. Thus we
will return to an error path, and it is up to that code to make forward
progress towards delivering the fatal signal.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Steve Capper <steve.capper@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ben Seri [Sat, 9 Sep 2017 21:15:59 +0000 (23:15 +0200)]
Bluetooth: Properly check L2CAP config option output buffer length
commit
e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 upstream.
Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Takashi Iwai [Thu, 6 Jul 2017 10:34:40 +0000 (12:34 +0200)]
ALSA: msnd: Optimize / harden DSP and MIDI loops
commit
20e2b791796bd68816fa115f12be5320de2b8021 upstream.
The ISA msnd drivers have loops fetching the ring-buffer head, tail
and size values inside the loops. Such codes are inefficient and
fragile.
This patch optimizes it, and also adds the sanity check to avoid the
endless loops.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196131
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196133
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: grygorii tertychnyi <gtertych@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Yang Shi [Thu, 10 Nov 2016 21:06:39 +0000 (13:06 -0800)]
locktorture: Fix potential memory leak with rw lock test
commit
f4dbba591945dc301c302672adefba9e2ec08dc5 upstream.
When running locktorture module with the below commands with kmemleak enabled:
$ modprobe locktorture torture_type=rw_lock_irq
$ rmmod locktorture
The below kmemleak got caught:
root@10:~# echo scan > /sys/kernel/debug/kmemleak
[ 323.197029] kmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
root@10:~# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffffffc07592d500 (size 128):
comm "modprobe", pid 368, jiffies
4294924118 (age 205.824s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 c3 7b 02 00 00 00 00 00 .........{......
00 00 00 00 00 00 00 00 d7 9b 02 00 00 00 00 00 ................
backtrace:
[<
ffffff80081e5a88>] create_object+0x110/0x288
[<
ffffff80086c6078>] kmemleak_alloc+0x58/0xa0
[<
ffffff80081d5acc>] __kmalloc+0x234/0x318
[<
ffffff80006fa130>] 0xffffff80006fa130
[<
ffffff8008083ae4>] do_one_initcall+0x44/0x138
[<
ffffff800817e28c>] do_init_module+0x68/0x1cc
[<
ffffff800811c848>] load_module+0x1a68/0x22e0
[<
ffffff800811d340>] SyS_finit_module+0xe0/0xf0
[<
ffffff80080836f0>] el0_svc_naked+0x24/0x28
[<
ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffffffc07592d480 (size 128):
comm "modprobe", pid 368, jiffies
4294924118 (age 205.824s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 3b 6f 01 00 00 00 00 00 ........;o......
00 00 00 00 00 00 00 00 23 6a 01 00 00 00 00 00 ........#j......
backtrace:
[<
ffffff80081e5a88>] create_object+0x110/0x288
[<
ffffff80086c6078>] kmemleak_alloc+0x58/0xa0
[<
ffffff80081d5acc>] __kmalloc+0x234/0x318
[<
ffffff80006fa22c>] 0xffffff80006fa22c
[<
ffffff8008083ae4>] do_one_initcall+0x44/0x138
[<
ffffff800817e28c>] do_init_module+0x68/0x1cc
[<
ffffff800811c848>] load_module+0x1a68/0x22e0
[<
ffffff800811d340>] SyS_finit_module+0xe0/0xf0
[<
ffffff80080836f0>] el0_svc_naked+0x24/0x28
[<
ffffffffffffffff>] 0xffffffffffffffff
It is because cxt.lwsa and cxt.lrsa don't get freed in module_exit, so free
them in lock_torture_cleanup() and free writer_tasks if reader_tasks is
failed at memory allocation.
Signed-off-by: Yang Shi <yang.shi@linaro.org>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
Cc: 石洋 <yang.s@alibaba-inc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Aleksa Sarai [Tue, 4 Jul 2017 11:49:06 +0000 (21:49 +1000)]
btrfs: resume qgroup rescan on rw remount
commit
6c6b5a39c4bf3dbd8cf629c9f5450e983c19dbb9 upstream.
Several distributions mount the "proper root" as ro during initrd and
then remount it as rw before pivot_root(2). Thus, if a rescan had been
aborted by a previous shutdown, the rescan would never be resumed.
This issue would manifest itself as several btrfs ioctl(2)s causing the
entire machine to hang when btrfs_qgroup_wait_for_completion was hit
(due to the fs_info->qgroup_rescan_running flag being set but the rescan
itself not being resumed). Notably, Docker's btrfs storage driver makes
regular use of BTRFS_QUOTA_CTL_DISABLE and BTRFS_IOC_QUOTA_RESCAN_WAIT
(causing this problem to be manifested on boot for some machines).
Cc: Jeff Mahoney <jeffm@suse.com>
Fixes:
b382a324b60f ("Btrfs: fix qgroup rescan resume on mount")
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Tested-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
John Stultz [Tue, 17 Jan 2017 00:52:52 +0000 (16:52 -0800)]
drm/bridge: adv7511: Re-write the i2c address before EDID probing
commit
3587c856675c45809010c2cee5b21096f6e8e938 upstream.
I've found that by just turning the chip on and off via the
POWER_DOWN register, I end up getting i2c_transfer errors on
HiKey.
Investigating further, it turns out that some of the register
state in hardware is getting lost, as the device registers are
reset when the chip is powered down.
Thus this patch simply re-writes the i2c address to the
ADV7511_REG_EDID_I2C_ADDR register to ensure its properly set
before we try to read the EDID data.
Cc: David Airlie <airlied@linux.ie>
Cc: Archit Taneja <architt@codeaurora.org>
Cc: Wolfram Sang <wsa+renesas@sang-engineering.com>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1484614372-15342-7-git-send-email-john.stultz@linaro.org
Signed-off-by: Thong Ho <thong.ho.px@rvc.renesas.com>
Signed-off-by: Nhan Nguyen <nhan.nguyen.yb@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
John Stultz [Tue, 17 Jan 2017 00:52:48 +0000 (16:52 -0800)]
drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event()
commit
6d5104c5a6b56385426e15047050584794bb6254 upstream.
In chasing down a previous issue with EDID probing from calling
drm_helper_hpd_irq_event() from irq context, Laurent noticed
that the DRM documentation suggests that
drm_kms_helper_hotplug_event() should be used instead.
Thus this patch replaces drm_helper_hpd_irq_event() with
drm_kms_helper_hotplug_event(), which requires we update the
connector.status entry and only call _hotplug_event() when the
status changes.
Cc: David Airlie <airlied@linux.ie>
Cc: Archit Taneja <architt@codeaurora.org>
Cc: Wolfram Sang <wsa+renesas@sang-engineering.com>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1484614372-15342-3-git-send-email-john.stultz@linaro.org
Signed-off-by: Thong Ho <thong.ho.px@rvc.renesas.com>
Signed-off-by: Nhan Nguyen <nhan.nguyen.yb@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
John Stultz [Tue, 17 Jan 2017 00:52:47 +0000 (16:52 -0800)]
drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context
commit
518cb7057a59b9441336d2e88a396d52b6ab0cce upstream.
I was recently seeing issues with EDID probing, where
the logic to wait for the EDID read bit to be set by the
IRQ wasn't happening and the code would time out and fail.
Digging deeper, I found this was due to the fact that
IRQs were disabled as we were running in IRQ context from
the HPD signal.
Thus this patch changes the logic to handle the HPD signal
via a work_struct so we can be out of irq context.
With this patch, the EDID probing on hotplug does not time
out.
Cc: David Airlie <airlied@linux.ie>
Cc: Archit Taneja <architt@codeaurora.org>
Cc: Wolfram Sang <wsa+renesas@sang-engineering.com>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1484614372-15342-2-git-send-email-john.stultz@linaro.org
Signed-off-by: Thong Ho <thong.ho.px@rvc.renesas.com>
Signed-off-by: Nhan Nguyen <nhan.nguyen.yb@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Archit Taneja [Wed, 15 Jun 2016 10:50:45 +0000 (16:20 +0530)]
drm/bridge: adv7511: Fix mutex deadlock when interrupts are disabled
commit
f0bfcc22d9822947b0ad3095e8363eab5261864c upstream.
When the adv7511 i2c client doesn't have an interrupt line, we observe a
deadlock on caused by trying to lock drm device's mode_config.mutex twice
in the same context.
Here is the sequence that causes it:
ioctl DRM_IOCTL_MODE_GETCONNECTOR from userspace
drm_mode_getconnector (acquires mode_config mutex)
connector->fill_modes()
drm_helper_probe_single_connector_modes
connector_funcs->get_modes
adv7511_encoder_get_modes
adv7511_get_edid_block
adv7511_irq_process
drm_helper_hpd_irq_event (acquires mode_config mutex again)
In adv7511_irq_process, don't call drm_helper_hpd_irq_event when not
called from the interrupt handler. It doesn't serve any purpose there
anyway.
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Thong Ho <thong.ho.px@rvc.renesas.com>
Signed-off-by: Nhan Nguyen <nhan.nguyen.yb@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Wolfram Sang [Mon, 4 Jan 2016 02:33:45 +0000 (03:33 +0100)]
drm: adv7511: really enable interrupts for EDID detection
commit
d0be8584b01160eb6f49e77f8e9c1da286bb4ffb upstream.
The interrupts for EDID_READY or DDC_ERROR were never enabled in this
driver, so reading EDID always timed out when chip was powered down and
interrupts were used. Fix this and also remove clearing the interrupt
flags, they are cleared in POWER_DOWN mode anyhow (unlike the interrupt
enable flags) according to docs and my tests.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Tested-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Thong Ho <thong.ho.px@rvc.renesas.com>
Signed-off-by: Nhan Nguyen <nhan.nguyen.yb@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Todd Poynor [Wed, 16 Aug 2017 04:48:43 +0000 (21:48 -0700)]
scsi: sg: recheck MMAP_IO request length with lock held
commit
8d26f491116feaa0b16de370b6a7ba40a40fa0b4 upstream.
Commit
1bc0eb044615 ("scsi: sg: protect accesses to 'reserved' page
array") adds needed concurrency protection for the "reserve" buffer.
Some checks that are initially made outside the lock are replicated once
the lock is taken to ensure the checks and resulting decisions are made
using consistent state.
The check that a request with flag SG_FLAG_MMAP_IO set fits in the
reserve buffer also needs to be performed again under the lock to ensure
the reserve buffer length compared against matches the value in effect
when the request is linked to the reserve buffer. An -ENOMEM should be
returned in this case, instead of switching over to an indirect buffer
as for non-MMAP_IO requests.
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Todd Poynor [Wed, 16 Aug 2017 05:41:08 +0000 (22:41 -0700)]
scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
commit
6a8dadcca81fceff9976e8828cceb072873b7bd5 upstream.
Take f_mutex around mmap() processing to protect against races with the
SG_SET_RESERVED_SIZE ioctl. Ensure the reserve buffer length remains
consistent during the mapping operation, and set the "mmap called" flag
to prevent further changes to the reserved buffer size as an atomic
operation with the mapping.
[mkp: fixed whitespace]
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Andrey Korolyov [Thu, 10 Aug 2017 10:21:14 +0000 (13:21 +0300)]
cs5536: add support for IDE controller variant
commit
591b6bb605785c12a21e8b07a08a277065b655a5 upstream.
Several legacy devices such as Geode-based Cisco ASA appliances
and DB800 development board do possess CS5536 IDE controller
with different PCI id than existing one. Using pata_generic is
not always feasible as at least DB800 requires MSR quirk from
pata_cs5536 to be used with vendor firmware.
Signed-off-by: Andrey Korolyov <andrey@xdel.ru>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ben Hutchings [Sun, 3 Sep 2017 00:18:41 +0000 (01:18 +0100)]
workqueue: Fix flag collision
commit
fbf1c41fc0f4d3574ac2377245efd666c1fa3075 upstream.
Commit
0a94efb5acbb ("workqueue: implicit ordered attribute should be
overridable") introduced a __WQ_ORDERED_EXPLICIT flag but gave it the
same value as __WQ_LEGACY. I don't believe these were intended to
mean the same thing, so renumber __WQ_ORDERED_EXPLICIT.
Fixes:
0a94efb5acbb ("workqueue: implicit ordered attribute should be ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ilia Mirkin [Thu, 10 Aug 2017 16:13:40 +0000 (12:13 -0400)]
drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
commit
bc60c90f472b6e762ea96ef384072145adc8d4af upstream.
It appears that MSI does not work on either G5 PPC nor on a E5500-based
platform, where other hardware is reported to work fine with MSI.
Both tests were conducted with NV4x hardware, so perhaps other (or even
this) hardware can be made to work. It's still possible to force-enable
with config=NvMSI=1 on load.
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Brian Norris [Fri, 30 Jun 2017 01:23:54 +0000 (18:23 -0700)]
mwifiex: correct channel stat buffer overflows
commit
4b5dde2d6234ff5bc68e97e6901d1f2a0a7f3749 upstream.
mwifiex records information about various channels as it receives scan
information. It does this by appending to a buffer that was sized
to the max number of supported channels on any band, but there are
numerous problems:
(a) scans can return info from more than one band (e.g., both 2.4 and 5
GHz), so the determined "max" is not large enough
(b) some firmware appears to return multiple results for a given
channel, so the max *really* isn't large enough
(c) there is no bounds checking when stashing these stats, so problems
(a) and (b) can easily lead to buffer overflows
Let's patch this by setting a slightly-more-correct max (that accounts
for a combination of both 2.4G and 5G bands) and adding a bounds check
when writing to our statistics buffer.
Due to problem (b), we still might not properly report all known survey
information (e.g., with "iw <dev> survey dump"), since duplicate results
(or otherwise "larger than expected" results) will cause some
truncation. But that's a problem for a future bugfix.
(And because of this known deficiency, only log the excess at the WARN
level, since that isn't visible by default in this driver and would
otherwise be a bit too noisy.)
Fixes:
bf35443314ac ("mwifiex: channel statistics support for mwifiex")
Cc: Avinash Patil <patila@marvell.com>
Cc: Xinming Hu <huxm@marvell.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Edwin Török [Thu, 3 Aug 2017 09:30:06 +0000 (10:30 +0100)]
dlm: avoid double-free on error path in dlm_device_{register,unregister}
commit
55acdd926f6b21a5cdba23da98a48aedf19ac9c3 upstream.
Can be reproduced when running dlm_controld (tested on 4.4.x, 4.12.4):
# seq 1 100 | xargs -P0 -n1 dlm_tool join
# seq 1 100 | xargs -P0 -n1 dlm_tool leave
misc_register fails due to duplicate sysfs entry, which causes
dlm_device_register to free ls->ls_device.name.
In dlm_device_deregister the name was freed again, causing memory
corruption.
According to the comment in dlm_device_deregister the name should've been
set to NULL when registration fails,
so this patch does that.
sysfs: cannot create duplicate filename '/dev/char/10:1'
------------[ cut here ]------------
warning: cpu: 1 pid: 4450 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x56/0x70
modules linked in: msr rfcomm dlm ccm bnep dm_crypt uvcvideo
videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core videodev
btusb media btrtl btbcm btintel bluetooth ecdh_generic intel_rapl
x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm
snd_hda_codec_hdmi irqbypass crct10dif_pclmul crc32_pclmul
ghash_clmulni_intel thinkpad_acpi pcbc nvram snd_seq_midi
snd_seq_midi_event aesni_intel snd_hda_codec_realtek snd_hda_codec_generic
snd_rawmidi aes_x86_64 crypto_simd glue_helper snd_hda_intel snd_hda_codec
cryptd intel_cstate arc4 snd_hda_core snd_seq snd_seq_device snd_hwdep
iwldvm intel_rapl_perf mac80211 joydev input_leds iwlwifi serio_raw
cfg80211 snd_pcm shpchp snd_timer snd mac_hid mei_me lpc_ich mei soundcore
sunrpc parport_pc ppdev lp parport autofs4 i915 psmouse
e1000e ahci libahci i2c_algo_bit sdhci_pci ptp drm_kms_helper sdhci
pps_core syscopyarea sysfillrect sysimgblt fb_sys_fops drm wmi video
cpu: 1 pid: 4450 comm: dlm_test.exe not tainted 4.12.4-041204-generic
hardware name: lenovo 232425u/232425u, bios g2et82ww (2.02 ) 09/11/2012
task:
ffff96b0cbabe140 task.stack:
ffffb199027d0000
rip: 0010:sysfs_warn_dup+0x56/0x70
rsp: 0018:
ffffb199027d3c58 eflags:
00010282
rax:
0000000000000038 rbx:
ffff96b0e2c49158 rcx:
0000000000000006
rdx:
0000000000000000 rsi:
0000000000000086 rdi:
ffff96b15e24dcc0
rbp:
ffffb199027d3c70 r08:
0000000000000001 r09:
0000000000000721
r10:
ffffb199027d3c00 r11:
0000000000000721 r12:
ffffb199027d3cd1
r13:
ffff96b1592088f0 r14:
0000000000000001 r15:
ffffffffffffffef
fs:
00007f78069c0700(0000) gs:
ffff96b15e240000(0000)
knlgs:
0000000000000000
cs: 0010 ds: 0000 es: 0000 cr0:
0000000080050033
cr2:
000000178625ed28 cr3:
0000000091d3e000 cr4:
00000000001406e0
call trace:
sysfs_do_create_link_sd.isra.2+0x9e/0xb0
sysfs_create_link+0x25/0x40
device_add+0x5a9/0x640
device_create_groups_vargs+0xe0/0xf0
device_create_with_groups+0x3f/0x60
? snprintf+0x45/0x70
misc_register+0x140/0x180
device_write+0x6a8/0x790 [dlm]
__vfs_write+0x37/0x160
? apparmor_file_permission+0x1a/0x20
? security_file_permission+0x3b/0xc0
vfs_write+0xb5/0x1a0
sys_write+0x55/0xc0
? sys_fcntl+0x5d/0xb0
entry_syscall_64_fastpath+0x1e/0xa9
rip: 0033:0x7f78083454bd
rsp: 002b:
00007f78069bbd30 eflags:
00000293 orig_rax:
0000000000000001
rax:
ffffffffffffffda rbx:
0000000000000006 rcx:
00007f78083454bd
rdx:
000000000000009c rsi:
00007f78069bee00 rdi:
0000000000000005
rbp:
00007f77f8000a20 r08:
000000000000fcf0 r09:
0000000000000032
r10:
0000000000000024 r11:
0000000000000293 r12:
00007f78069bde00
r13:
00007f78069bee00 r14:
000000000000000a r15:
00007f78069bbd70
code: 85 c0 48 89 c3 74 12 b9 00 10 00 00 48 89 c2 31 f6 4c 89 ef e8 2c c8
ff ff 4c 89 e2 48 89 de 48 c7 c7 b0 8e 0c a8 e8 41 e8 ed ff <0f> ff 48 89
df e8 00 d5 f4 ff 5b 41 5c 41 5d 5d c3 66 0f 1f 84
---[ end trace
40412246357cc9e0 ]---
dlm:
59f24629-ae39-44e2-9030-
397ebc2eda26: leaving the lockspace group...
bug: unable to handle kernel null pointer dereference at
0000000000000001
ip: [<
ffffffff811a3b4a>] kmem_cache_alloc+0x7a/0x140
pgd 0
oops: 0000 [#1] smp
modules linked in: dlm 8021q garp mrp stp llc openvswitch nf_defrag_ipv6
nf_conntrack libcrc32c iptable_filter dm_multipath crc32_pclmul dm_mod
aesni_intel psmouse aes_x86_64 sg ablk_helper cryptd lrw gf128mul
glue_helper i2c_piix4 nls_utf8 tpm_tis tpm isofs nfsd auth_rpcgss
oid_registry nfs_acl lockd grace sunrpc xen_wdt ip_tables x_tables autofs4
hid_generic usbhid hid sr_mod cdrom sd_mod ata_generic pata_acpi 8139too
serio_raw ata_piix 8139cp mii uhci_hcd ehci_pci ehci_hcd libata
scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh_alua scsi_mod ipv6
cpu: 0 pid: 394 comm: systemd-udevd tainted: g w 4.4.0+0 #1
hardware name: xen hvm domu, bios 4.7.2-2.2 05/11/2017
task:
ffff880002410000 ti:
ffff88000243c000 task.ti:
ffff88000243c000
rip: e030:[<
ffffffff811a3b4a>] [<
ffffffff811a3b4a>]
kmem_cache_alloc+0x7a/0x140
rsp: e02b:
ffff88000243fd90 eflags:
00010202
rax:
0000000000000000 rbx:
ffff8800029864d0 rcx:
000000000007b36c
rdx:
000000000007b36b rsi:
00000000024000c0 rdi:
ffff880036801c00
rbp:
ffff88000243fdc0 r08:
0000000000018880 r09:
0000000000000054
r10:
000000000000004a r11:
ffff880034ace6c0 r12:
00000000024000c0
r13:
ffff880036801c00 r14:
0000000000000001 r15:
ffffffff8118dcc2
fs:
00007f0ab77548c0(0000) gs:
ffff880036e00000(0000) knlgs:
0000000000000000
cs: e033 ds: 0000 es: 0000 cr0:
0000000080050033
cr2:
0000000000000001 cr3:
000000000332d000 cr4:
0000000000040660
stack:
ffffffff8118dc90 ffff8800029864d0 0000000000000000 ffff88003430b0b0
ffff880034b78320 ffff88003430b0b0 ffff88000243fdf8 ffffffff8118dcc2
ffff8800349c6700 ffff8800029864d0 000000000000000b 00007f0ab7754b90
call trace:
[<
ffffffff8118dc90>] ? anon_vma_fork+0x60/0x140
[<
ffffffff8118dcc2>] anon_vma_fork+0x92/0x140
[<
ffffffff8107033e>] copy_process+0xcae/0x1a80
[<
ffffffff8107128b>] _do_fork+0x8b/0x2d0
[<
ffffffff81071579>] sys_clone+0x19/0x20
[<
ffffffff815a30ae>] entry_syscall_64_fastpath+0x12/0x71
] code: f6 75 1c 4c 89 fa 44 89 e6 4c 89 ef e8 a7 e4 00 00 41 f7 c4 00 80
00 00 49 89 c6 74 47 eb 32 49 63 45 20 48 8d 4a 01 4d 8b 45 00 <49> 8b 1c
06 4c 89 f0 65 49 0f c7 08 0f 94 c0 84 c0 74 ac 49 63
rip [<
ffffffff811a3b4a>] kmem_cache_alloc+0x7a/0x140
rsp <
ffff88000243fd90>
cr2:
0000000000000001
--[ end trace
70cb9fd1b164a0e8 ]--
Signed-off-by: Edwin Török <edvin.torok@citrix.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Dmitry Tunin [Tue, 8 Aug 2017 11:09:02 +0000 (14:09 +0300)]
Bluetooth: Add support of 13d3:3494 RTL8723BE device
commit
a81d72d2002d6a932bd83022cbf8c442b1b97512 upstream.
T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 2.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3494 Rev= 2.00
S: Manufacturer=Realtek
S: Product=Bluetooth Radio
S: SerialNumber=
00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Malcolm Priestley [Sun, 30 Jul 2017 08:02:19 +0000 (09:02 +0100)]
rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
commit
fc81bab5eeb103711925d7510157cf5cd2b153f4 upstream.
_rtl_pci_find_adapter fail path will jump to label fail3 for
unsupported adapter types.
However, on course for fail3 there will be call rtl_deinit_core
before rtl_init_core.
For the inclusion of checking pci_iounmap this fail can be moved to
fail2.
Fixes
[ 4.492963] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 4.493067] IP: rtl_deinit_core+0x31/0x90 [rtlwifi]
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Oscar Campos [Wed, 19 Jul 2017 00:20:36 +0000 (17:20 -0700)]
Input: trackpoint - assume 3 buttons when buttons detection fails
commit
293b915fd9bebf33cdc906516fb28d54649a25ac upstream.
Trackpoint buttons detection fails on ThinkPad 570 and 470 series,
this makes the middle button of the trackpoint to not being recogized.
As I don't believe there is any trackpoint with less than 3 buttons this
patch just assumes three buttons when the extended button information
read fails.
Signed-off-by: Oscar Campos <oscar.campos@member.fsf.org>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rakesh Pillai [Wed, 2 Aug 2017 10:33:37 +0000 (16:03 +0530)]
ath10k: fix memory leak in rx ring buffer allocation
commit
f35a7f91f66af528b3ee1921de16bea31d347ab0 upstream.
The rx ring buffers are added to a hash table if
firmware support full rx reorder. If the full rx
reorder support flag is not set before allocating
the rx ring buffers, none of the buffers are added
to the hash table.
There is a race condition between rx ring refill and
rx buffer replenish from napi poll. The interrupts are
enabled in hif start, before the rx ring is refilled during init.
We replenish buffers from napi poll due to the interrupts which
get enabled after hif start. Hence before the entire rx ring is
refilled during the init, the napi poll replenishes a few buffers
in steps of 100 buffers per attempt. During this rx ring replenish
from napi poll, the rx reorder flag has not been set due to which
the replenished buffers are not added to the hash table
Set the rx full reorder support flag before we allocate
the rx ring buffer to avoid the memory leak.
Signed-off-by: Rakesh Pillai <pillair@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Cc: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Alexander Shishkin [Thu, 30 Jun 2016 13:11:31 +0000 (16:11 +0300)]
intel_th: pci: Add Cannon Lake PCH-LP support
commit
efb3669e14fe17d0ec4ecf57d0365039fe726f59 upstream.
This adds Intel(R) Trace Hub PCI ID for Cannon Lake PCH-LP.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Alexander Shishkin [Thu, 30 Jun 2016 13:11:13 +0000 (16:11 +0300)]
intel_th: pci: Add Cannon Lake PCH-H support
commit
84331e1390b6378a5129a3678c87a42c6f697d29 upstream.
This adds Intel(R) Trace Hub PCI ID for Cannon Lake PCH-H.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Christophe JAILLET [Tue, 29 Aug 2017 19:23:49 +0000 (21:23 +0200)]
driver core: bus: Fix a potential double free
commit
0f9b011d3321ca1079c7a46c18cb1956fbdb7bcb upstream.
The .release function of driver_ktype is 'driver_release()'.
This function frees the container_of this kobject.
So, this memory must not be freed explicitly in the error handling path of
'bus_add_driver()'. Otherwise a double free will occur.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Colin Ian King [Fri, 18 Aug 2017 13:34:16 +0000 (14:34 +0100)]
staging/rts5208: fix incorrect shift to extract upper nybble
commit
34ff1bf4920471cff66775dc39537b15c5f0feff upstream.
The mask of sns_key_info1 suggests the upper nybble is being extracted
however the following shift of 8 bits is too large and always results in
0. Fix this by shifting only by 4 bits to correctly get the upper nybble.
Detected by CoverityScan, CID#142891 ("Operands don't affect result")
Fixes:
fa590c222fba ("staging: rts5208: add support for rts5208 and rts5288")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Douglas Anderson [Thu, 10 Aug 2017 22:42:22 +0000 (15:42 -0700)]
USB: core: Avoid race of async_completed() w/ usbdev_release()
commit
ed62ca2f4f51c17841ea39d98c0c409cb53a3e10 upstream.
While running reboot tests w/ a specific set of USB devices (and
slub_debug enabled), I found that once every few hours my device would
be crashed with a stack that looked like this:
[ 14.012445] BUG: spinlock bad magic on CPU#0, modprobe/2091
[ 14.012460] lock: 0xffffffc0cb055978, .magic:
ffffffc0, .owner: cryption contexts: %lu/%lu
[ 14.012460] /
1025536097, .owner_cpu: 0
[ 14.012466] CPU: 0 PID: 2091 Comm: modprobe Not tainted 4.4.79 #352
[ 14.012468] Hardware name: Google Kevin (DT)
[ 14.012471] Call trace:
[ 14.012483] [<....>] dump_backtrace+0x0/0x160
[ 14.012487] [<....>] show_stack+0x20/0x28
[ 14.012494] [<....>] dump_stack+0xb4/0xf0
[ 14.012500] [<....>] spin_dump+0x8c/0x98
[ 14.012504] [<....>] spin_bug+0x30/0x3c
[ 14.012508] [<....>] do_raw_spin_lock+0x40/0x164
[ 14.012515] [<....>] _raw_spin_lock_irqsave+0x64/0x74
[ 14.012521] [<....>] __wake_up+0x2c/0x60
[ 14.012528] [<....>] async_completed+0x2d0/0x300
[ 14.012534] [<....>] __usb_hcd_giveback_urb+0xc4/0x138
[ 14.012538] [<....>] usb_hcd_giveback_urb+0x54/0xf0
[ 14.012544] [<....>] xhci_irq+0x1314/0x1348
[ 14.012548] [<....>] usb_hcd_irq+0x40/0x50
[ 14.012553] [<....>] handle_irq_event_percpu+0x1b4/0x3f0
[ 14.012556] [<....>] handle_irq_event+0x4c/0x7c
[ 14.012561] [<....>] handle_fasteoi_irq+0x158/0x1c8
[ 14.012564] [<....>] generic_handle_irq+0x30/0x44
[ 14.012568] [<....>] __handle_domain_irq+0x90/0xbc
[ 14.012572] [<....>] gic_handle_irq+0xcc/0x18c
Investigation using kgdb() found that the wait queue that was passed
into wake_up() had been freed (it was filled with slub_debug poison).
I analyzed and instrumented the code and reproduced. My current
belief is that this is happening:
1. async_completed() is called (from IRQ). Moves "as" onto the
completed list.
2. On another CPU, proc_reapurbnonblock_compat() calls
async_getcompleted(). Blocks on spinlock.
3. async_completed() releases the lock; keeps running; gets blocked
midway through wake_up().
4. proc_reapurbnonblock_compat() => async_getcompleted() gets the
lock; removes "as" from completed list and frees it.
5. usbdev_release() is called. Frees "ps".
6. async_completed() finally continues running wake_up(). ...but
wake_up() has a pointer to the freed "ps".
The instrumentation that led me to believe this was based on adding
some trace_printk() calls in a select few functions and then using
kdb's "ftdump" at crash time. The trace follows (NOTE: in the trace
below I cheated a little bit and added a udelay(1000) in
async_completed() after releasing the spinlock because I wanted it to
trigger quicker):
<...>-2104 0d.h2 13759034us!: async_completed at start: as=
ffffffc0cc638200
mtpd-2055 3.... 13759356us : async_getcompleted before spin_lock_irqsave
mtpd-2055 3d..1 13759362us : async_getcompleted after list_del_init: as=
ffffffc0cc638200
mtpd-2055 3.... 13759371us+: proc_reapurbnonblock_compat: free_async(
ffffffc0cc638200)
mtpd-2055 3.... 13759422us+: async_getcompleted before spin_lock_irqsave
mtpd-2055 3.... 13759479us : usbdev_release at start: ps=
ffffffc0cc042080
mtpd-2055 3.... 13759487us : async_getcompleted before spin_lock_irqsave
mtpd-2055 3.... 13759497us!: usbdev_release after kfree(ps): ps=
ffffffc0cc042080
<...>-2104 0d.h2 13760294us : async_completed before wake_up(): as=
ffffffc0cc638200
To fix this problem we can just move the wake_up() under the ps->lock.
There should be no issues there that I'm aware of.
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Sandeep Singh [Thu, 24 Aug 2017 04:27:15 +0000 (09:57 +0530)]
usb:xhci:Fix regression when ATI chipsets detected
commit
e6b422b88b46353cf596e0db6dc0e39d50d90d6e upstream.
The following commit cause a regression on ATI chipsets.
'commit
e788787ef4f9 ("usb:xhci:Add quirk for Certain
failing HP keyboard on reset after resume")'
This causes pinfo->smbus_dev to be wrongly set to NULL on
systems with the ATI chipset that this function checks for first.
Added conditional check for AMD chipsets to avoid the overwriting
pinfo->smbus_dev.
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Fixes:
e788787ef4f9 ("usb:xhci:Add quirk for Certain
failing HP keyboard on reset after resume")
cc: Nehal Shah <Nehal-bakulchandra.Shah@amd.com>
Signed-off-by: Sandeep Singh <Sandeep.Singh@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Dmitry Fleytman [Fri, 25 Aug 2017 07:38:35 +0000 (10:38 +0300)]
usb: Add device quirk for Logitech HD Pro Webcam C920-C
commit
a1279ef74eeeb5f627f091c71d80dd7ac766c99d upstream.
Commit
e0429362ab15
("usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e")
introduced quirk to workaround an issue with some Logitech webcams.
Apparently model C920-C has the same issue so applying
the same quirk as well.
See aforementioned commit message for detailed explanation of the problem.
Signed-off-by: Dmitry Fleytman <dmitry@daynix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Maciej S. Szmigiero [Tue, 29 Aug 2017 19:50:03 +0000 (21:50 +0200)]
USB: serial: option: add support for D-Link DWM-157 C1
commit
169e86546f5712179709de23cd64bbb15f199fab upstream.
This commit adds support (an ID, really) for D-Link DWM-157 hardware
version C1 USB modem to option driver.
According to manufacturer-provided Windows INF file the device has four
serial ports:
"D-Link HSPA+DataCard Diagnostics Interface" (interface 2; modem port),
"D-Link HSPA+DataCard NMEA Device" (interface 3),
"D-Link HSPA+DataCard Speech Port" (interface 4),
"D-Link HSPA+DataCard Debug Port" (interface 5).
usb-devices output:
T: Bus=05 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2001 ProdID=7d0e Rev=03.00
S: Manufacturer=D-Link,Inc
S: Product=D-Link DWM-157
C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option
I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Kai-Heng Feng [Wed, 16 Aug 2017 02:53:20 +0000 (10:53 +0800)]
usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
commit
de3af5bf259d7a0bfaac70441c8568ab5998d80c upstream.
Corsair Strafe RGB keyboard has trouble to initialize:
[ 1.679455] usb 3-6: new full-speed USB device number 4 using xhci_hcd
[ 6.871136] usb 3-6: unable to read config index 0 descriptor/all
[ 6.871138] usb 3-6: can't read configurations, error -110
[ 6.991019] usb 3-6: new full-speed USB device number 5 using xhci_hcd
[ 12.246642] usb 3-6: unable to read config index 0 descriptor/all
[ 12.246644] usb 3-6: can't read configurations, error -110
[ 12.366555] usb 3-6: new full-speed USB device number 6 using xhci_hcd
[ 17.622145] usb 3-6: unable to read config index 0 descriptor/all
[ 17.622147] usb 3-6: can't read configurations, error -110
[ 17.742093] usb 3-6: new full-speed USB device number 7 using xhci_hcd
[ 22.997715] usb 3-6: unable to read config index 0 descriptor/all
[ 22.997716] usb 3-6: can't read configurations, error -110
Although it may work after several times unpluging/pluging:
[ 68.195240] usb 3-6: new full-speed USB device number 11 using xhci_hcd
[ 68.337459] usb 3-6: New USB device found, idVendor=1b1c, idProduct=1b20
[ 68.337463] usb 3-6: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 68.337466] usb 3-6: Product: Corsair STRAFE RGB Gaming Keyboard
[ 68.337468] usb 3-6: Manufacturer: Corsair
[ 68.337470] usb 3-6: SerialNumber:
0F013021AEB8046755A93ED3F5001941
Tried three quirks: USB_QUIRK_DELAY_INIT, USB_QUIRK_NO_LPM and
USB_QUIRK_DEVICE_QUALIFIER, user confirmed that USB_QUIRK_DELAY_INIT alone
can workaround this issue. Hence add the quirk for Corsair Strafe RGB.
BugLink: https://bugs.launchpad.net/bugs/1678477
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Skylar Chang [Tue, 12 Sep 2017 18:48:06 +0000 (11:48 -0700)]
msm: ipa: Add new API to check for ipa uC readiness
Adding new API for IPA clients to check for IPA
uC ready before bringing up IPA uC offload data path.
CRs-Fixed:
2030217
Change-Id: I0328658cba829cacc89b7c0b8edf7e52aa16e45c
Signed-off-by: Sunil Paidimarri <hisunil@codeaurora.org>
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
Linux Build Service Account [Wed, 13 Sep 2017 17:58:19 +0000 (10:58 -0700)]
Merge "msm: mdss: dp: fix wdog_bite while disconnecting DP cable"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:18 +0000 (10:58 -0700)]
Merge "msm: mdss: hdmi: correctly validate the cec msg frame size"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:17 +0000 (10:58 -0700)]
Merge "msm: ais: isp: Reducing ISPIF stop waiting time"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:15 +0000 (10:58 -0700)]
Merge "msm: mdss: hdmi: fix no audio over HDMI on device bootup"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:14 +0000 (10:58 -0700)]
Merge "msm: mdss: Increase the max layer count to 13"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:13 +0000 (10:58 -0700)]
Merge "adv7481: return error when PLL lock fails"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:13 +0000 (10:58 -0700)]
Merge "ARM: dts: msm: Early init changes for vendor image on msm8996"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:12 +0000 (10:58 -0700)]
Merge "mmc: host: Update the USE_PIO_FOR_EMMC_TUNING quirk value"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:10 +0000 (10:58 -0700)]
Merge "cgroup/cpuset: remove circular dependency deadlock"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:09 +0000 (10:58 -0700)]
Merge "power: smblib: correct PD voting when inactive"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:08 +0000 (10:58 -0700)]
Merge "adv7481: Add support for CSI 4 lane for ADV7481"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:08 +0000 (10:58 -0700)]
Merge "msm: camera: fix off-by-one overflow in msm_isp_get_bufq"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:07 +0000 (10:58 -0700)]
Merge "msm: ais: sensor: flash: add conditional check for ioctl"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:06 +0000 (10:58 -0700)]
Merge "msm: ais: Return -NOTTY on invalid ioctl command"
Linux Build Service Account [Wed, 13 Sep 2017 17:58:05 +0000 (10:58 -0700)]
Merge "msm: mdss: hdmi: configure hdcp feature support"
Yuan Zhao [Mon, 17 Jul 2017 04:48:36 +0000 (12:48 +0800)]
msm: mdss: disable HDMI block before HDMI core off
Switching HDMI display mode many times, could find
sometimes color distortion or no signal display.
If disable HDMI block before setting HDMI core off,
that could be fixed.
Change-Id: Ib0e8002f59e017a81298d4a5a39736a7516e3435
Signed-off-by: Yuan Zhao <yzhao@codeaurora.org>
Vijayavardhan Vennapusa [Wed, 13 Sep 2017 10:11:20 +0000 (15:41 +0530)]
USB: composite: Use snprintf instead of sprintf
composite driver is using sprintf() function to expose value to
userspace. This sprintf() is banned function and instead required
to use snprintf() function. Hence replace sprintf() with snprintf()
function to fix static analysis tool error.
Change-Id: I85f38fe3f2121f6a0cb76b7178a3e699ba1dc7f2
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Prateek Sood [Fri, 8 Sep 2017 07:40:55 +0000 (13:10 +0530)]
cgroup/cpuset: remove circular dependency deadlock
Remove circular dependency deadlock in a scenario where hotplug of CPU is
being done while there is updation in cgroup and cpuset triggered from
userspace.
Process A => kthreadd => Process B => Process C => Process A
Process A
cpu_subsys_offline();
cpu_down();
_cpu_down();
mutex_lock(&cpuhotplug.lock); //held
__cpu_notify();
workqueue_cpu_down_callback();
queue_work_on(system_highpri_wq);
__queue_work();
insert_work();
wake_up_worker(); //pool->nr_running = 0
flush_work();
wait_for_completion();
worker_thread();
need_more_worker(); // returns true
manage_workers();
maybe_create_worker();
create_worker();
kthread_create_on_node();
wake_up_process(kthreadd_task);
kthreadd
kthreadd();
kernel_thread();
do_fork();
copy_process();
percpu_down_read(&cgroup_threadgroup_rwsem);
__rwsem_down_read_failed_common(); //waiting
Process B
kernfs_fop_write();
cgroup_file_write();
cgroup_tasks_write();
percpu_down_write(&cgroup_threadgroup_rwsem); //held
cgroup_attach_task();
cgroup_migrate();
cgroup_taskset_migrate();
cpuset_can_attach();
mutex_lock(&cpuset_mutex); //waiting
Process C
kernfs_fop_write();
cgroup_file_write();
cpuset_write_resmask();
mutex_lock(&cpuset_mutex); //held
update_cpumask();
update_cpumasks_hier();
rebuild_sched_domains_locked();
get_online_cpus();
mutex_lock(&cpuhotplug.lock); //waiting
Eliminate this dependecy by reordering locking of cpuset_mutex
and cpuhotplug.lock.
Change-Id: Ifd76373d717c53b531623a3be76b7d32e0d959fd
Signed-off-by: Prateek Sood <prsood@codeaurora.org>
Linux Build Service Account [Wed, 13 Sep 2017 07:17:51 +0000 (00:17 -0700)]
Merge "power: qcom: smb135x: change OTG regulator ops to static"
Linux Build Service Account [Wed, 13 Sep 2017 07:17:51 +0000 (00:17 -0700)]
Merge "power: qpnp-fg-gen3: adjust ki coefficient for full soc dynamically"
Linux Build Service Account [Wed, 13 Sep 2017 07:17:50 +0000 (00:17 -0700)]
Merge "usb: gadget: u_ether: Add NULL check in helper APIs"
Linux Build Service Account [Wed, 13 Sep 2017 07:17:49 +0000 (00:17 -0700)]
Merge "usb: gadget: Update default class subclass and protocol for rndis"
Rahul Sharma [Tue, 5 Sep 2017 11:14:07 +0000 (16:44 +0530)]
msm: ais: isp: Reducing ISPIF stop waiting time
Initial ISPIF waiting was one second which causes
hang for one second in case of sensor removal hence
wait is reduced to 200ms.
Change-Id: I531a880435983fe2e1e4f0f7616c6a6b1632dac8
Signed-off-by: Rahul Sharma <sharah@codeaurora.org>
Krishna Chaitanya Devarakonda [Mon, 4 Sep 2017 10:13:55 +0000 (15:43 +0530)]
msm: mdss: Increase the max layer count to 13
The maximum number of layers could be 13 including the
cursor layer. Increasing the maximum layer count to
accommodate cursor layer.
Change-Id: I907feb14fbd2d2ab5de66b4dee83d90d94c59595
Signed-off-by: Krishna Chaitanya Devarakonda <kdevarak@codeaurora.org>
Jaiju Yesudasan [Mon, 31 Jul 2017 10:37:38 +0000 (16:07 +0530)]
adv7481: return error when PLL lock fails
Return error instead of default width and height when PLL lock fails.
Suggested-by: Suprith Malligere <c_suprit@qti.qualcomm.com>
Change-Id: I80880e9d1f6bcd5d6df87f74d005f9c79f91f096
Signed-off-by: Jaiju Yesudasan <cjaijuy@codeaurora.org>
Jaiju Yesudasan [Mon, 31 Jul 2017 10:51:58 +0000 (16:21 +0530)]
adv7481: Add support for CSI 4 lane for ADV7481
Enable CSI 4 lane in adv7481 to support 1080p and 60fps.
Suggested-by: Suprith Malligere <c_suprit@qti.qualcomm.com>
Change-Id: I053602fc73fe300cff780dfe75c546ff3768ee3c
Signed-off-by: Jaiju Yesudasan <cjaijuy@codeaurora.org>
Gaoxiang Chen [Wed, 17 May 2017 07:14:36 +0000 (15:14 +0800)]
msm: camera: fix off-by-one overflow in msm_isp_get_bufq
In msm_isp_get_bufq, if bufq_index == buf_mgr->num_buf_q,
it will pass the check, leading to off-by-one overflow
(exceed the length of array by one element).
CRs-Fixed:
2031677
Change-Id: I7ea465897e2c37de6ca0155c3e225f1444b3cf13
Signed-off-by: Gaoxiang Chen <gaochen@codeaurora.org>
Hareesh Gundu [Thu, 24 Aug 2017 17:41:09 +0000 (23:11 +0530)]
msm: kgsl: Do not crash on context detach timeout failure
If context wait for global timeouts in detach path there is
no use to process its pending commands. Hence to handle context
detach timeout failure,invalidate the context and remove all
the pending commands from that context. So that other context
commands proceed successfully after the context detach timeout
fault recovery.
Change-Id: Ie4ff0ed5d08312d345b248a2404ce085552b0b09
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Anthony Mah [Tue, 22 Aug 2017 23:36:35 +0000 (16:36 -0700)]
ARM: dts: msm: Early init changes for vendor image on msm8996
For use with A/B partition feature, remove early mount of system
image. Change fs mgr flags from verify to slotselect.
System image is to be mounted in the lk when enabling A/B.
Change-Id: I4fc2ac5f5bd22dea2fd6ff832cd31d1f3697b4d4
Signed-off-by: Anthony Mah <amah@codeaurora.org>
Linux Build Service Account [Tue, 12 Sep 2017 21:41:59 +0000 (14:41 -0700)]
Merge "Merge android-4.4@
610af85 (v4.4.85) into msm-4.4"
Linux Build Service Account [Tue, 12 Sep 2017 21:41:58 +0000 (14:41 -0700)]
Merge "msm: kgsl: Protect the bind object against bad dereference"
Linux Build Service Account [Tue, 12 Sep 2017 21:41:48 +0000 (14:41 -0700)]
Merge "msm: ipa: ipa_usb: teth_prot and ttype validation"
Harry Yang [Tue, 12 Sep 2017 18:15:04 +0000 (11:15 -0700)]
power: smblib: correct PD voting when inactive
Currently, when becoming inactive, PD leaves the HDC and input
limited interrupt enabled.
Correct it by disabling it.
Change-Id: I62a1d837f6126951cb428a982fe1d8876f1d5bdc
Signed-off-by: Harry Yang <harryy@codeaurora.org>
Rahul Sharma [Tue, 12 Sep 2017 05:31:57 +0000 (11:01 +0530)]
msm: ais: sensor: flash: add conditional check for ioctl
Add conditional check when sending VIDIOC_MSM_FLASH_CFG
in 32-bit process.
Change-Id: Ia4255aba26c634018163e2cc3c1170f71b1eb661
CRs-Fixed:
2092793
Signed-off-by: Rahul Sharma <sharah@codeaurora.org>
Veerabhadrarao Badiganti [Tue, 12 Sep 2017 09:32:01 +0000 (15:02 +0530)]
mmc: core: Correct the checks while setting clock scaling frequencies
Correct the checks while setting the max scaling frequency supported
by the card. With the present checks, even for HS card max frequency
would set as max frequency of HS200 card.
Change-Id: Ie8b42229ef189e591f49b227d043f6186aa7e205
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
Veerabhadrarao Badiganti [Tue, 12 Sep 2017 11:54:09 +0000 (17:24 +0530)]
mmc: sdhci-msm: Don't enable PWRSAVE_DLL for all latest sdhc hosts
SDHC core with 14lpp tech DLL should not enable PWRSAVE_DLL since
such controller's internal gating cannot meet following MCLK requirement:
when MCLK is gated OFF, it is not gated for less than 0.5us and MCLK must
be switched on for at-least 1us before DATA starts coming.
Since all the latest versions of sdhc host has this 14lpp tech DLL
Don't set PWRSAVE_DLL bit accordingly.
Change-Id: I7cccc79a79b32a33e74212fc5f41408c2e07b5cb
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>