OSDN Git Service
Linux Build Service Account [Thu, 3 Jan 2019 15:43:36 +0000 (07:43 -0800)]
Merge "Merge android-4.4.169 (
dfca92b) into msm-4.4"
Linux Build Service Account [Thu, 3 Jan 2019 06:29:03 +0000 (22:29 -0800)]
Merge "msm: early_domain: return directly if early domain disabled"
Linux Build Service Account [Wed, 2 Jan 2019 22:29:15 +0000 (14:29 -0800)]
Merge "usb: gadget: f_hid: add dev to configfs"
Linux Build Service Account [Wed, 2 Jan 2019 13:43:28 +0000 (05:43 -0800)]
Merge "dwc3: gadget: Take copy of dwc->gadget_driver before releasing lock"
Ajay Agarwal [Thu, 27 Dec 2018 05:17:44 +0000 (10:47 +0530)]
defconfig: msm: Enable UAC1 driver on 8996 Auto
Enable UAC1 function driver on 8996 Auto target to support
audio over USB with virtual ALSA card creation.
Change-Id: Icead0b5f37b822e08f1c0714e62b275db60174a3
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Linux Build Service Account [Tue, 1 Jan 2019 15:05:40 +0000 (07:05 -0800)]
Merge "Revert "rtc: alarm: Add power-on alarm feature""
Linux Build Service Account [Tue, 1 Jan 2019 15:05:39 +0000 (07:05 -0800)]
Merge "msm: ais: Update request from kernel to lk"
Linux Build Service Account [Mon, 31 Dec 2018 03:52:40 +0000 (19:52 -0800)]
Merge "usb: diag_ipc_bridge: Fix kref_put handling in case of transfers"
Linux Build Service Account [Sun, 30 Dec 2018 04:51:35 +0000 (20:51 -0800)]
Merge "defconfig: msm: Enable earlydomain handoff support"
Linux Build Service Account [Sun, 30 Dec 2018 04:51:27 +0000 (20:51 -0800)]
Merge "usb: gadget: f_uac1: Add support for UAC1 function"
Mao Jinlong [Fri, 27 Oct 2017 03:15:55 +0000 (11:15 +0800)]
Revert "rtc: alarm: Add power-on alarm feature"
This reverts commit
2e1a4aefef66db901f9a906b79e30187f10dbecb.
Power off alarm is not set via alarmtimer now. Remove the changes
of power off alarm's previous design.
Change-Id: I0f60bec0d94c93c4f2a89ae86a1b0a0d04aa9e48
Signed-off-by: Mao Jinlong <jinlmao@codeaurora.org>
Andy Sun [Thu, 27 Dec 2018 07:32:37 +0000 (15:32 +0800)]
msm: early_domain: return directly if early domain disabled
If early_domain_enabled is false, ed_core_data won't be allocated memory,
accessing early_domain_request will cause kernel Oops.
Change-Id: I8a64c574141a7647e699710b566cc5997d372478
Signed-off-by: Andy Sun <bins@codeaurora.org>
Johannes Berg [Thu, 23 Jun 2016 20:28:54 +0000 (22:28 +0200)]
usb: gadget: f_hid: add dev to configfs
Even if the /dev/hidg* chardev is automatically created, one
has to guess which one belongs to which function. In the case
of multiple HID functions, or maybe even multiple peripherals,
this becomes difficult.
Add the dev (with major and minor number) to configfs to allow
looking up (or even creating) the right device node for each
function. This file is read-only.
Change-Id: If11a531a4b65cbcfb5c5456712c5f965fd4eb4c2
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
ed6fe1f50f0c0fdea674dfa739af50011034bdfa
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Linux Build Service Account [Wed, 26 Dec 2018 10:52:51 +0000 (02:52 -0800)]
Merge "usb: gadget: u_audio: Check return value from config_ep_by_speed()"
Linux Build Service Account [Wed, 26 Dec 2018 10:52:51 +0000 (02:52 -0800)]
Merge "usb: gadget: u_audio: protect stream runtime fields with stream spinlock"
Linux Build Service Account [Wed, 26 Dec 2018 10:52:46 +0000 (02:52 -0800)]
Merge "usb: gadget: u_audio: remove caching of stream buffer parameters"
Ajay Agarwal [Mon, 24 Dec 2018 10:35:50 +0000 (16:05 +0530)]
usb: diag_ipc_bridge: Fix kref_put handling in case of transfers
Currently the driver puts kref in the read/write completion
callback irrespective of whether the transaction was successful
or not. This is fine for diag transfers because the read/write
function is not waiting for completion.
But in case of IPC transfers, the read/write function waits for
completion. If the transfer fails for some reason, then it will
do a kref_put as well, along with the completion callback. This
leads to double put of kref counter leading to null pointer
dereference from diag_bridge_disconnect(on cable disconnect).
Fix this by doing kref_put in the completion callback only if the
URB is submitted successfully. Else do it from the error handling
in read/write functions.
Change-Id: I50645cac757293dd0b1df9afb356281b2922401b
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Vivek Kumar [Mon, 24 Dec 2018 11:32:54 +0000 (17:02 +0530)]
defconfig: msm: Enable earlydomain handoff support
Enable early domain handoff support for msm-auto
perf defconfig
Change-Id: I4364928a05299367906996d01782ea7fced099ba
Signed-off-by: Vivek Kumar <vivekuma@codeaurora.org>
Srinivasarao P [Mon, 24 Dec 2018 06:52:31 +0000 (12:22 +0530)]
Merge android-4.4.169 (
dfca92b) into msm-4.4
* refs/heads/tmp-
dfca92b
Linux 4.4.169
ALSA: isa/wavefront: prevent some out of bound writes
rtc: snvs: Add timeouts to avoid kernel lockups
rtc: snvs: add a missing write sync
i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
i2c: axxia: properly handle master timeout
cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling
mv88e6060: disable hardware level MAC learning
libata: whitelist all SAMSUNG MZ7KM* solid-state disks
Input: omap-keypad - fix keyboard debounce configuration
clk: mmp: Off by one in mmp_clk_add()
ide: pmac: add of_node_put()
drivers/tty: add missing of_node_put()
drivers/sbus/char: add of_node_put()
sbus: char: add of_node_put()
SUNRPC: Fix a potential race in xprt_connect()
bonding: fix 802.3ad state sent to partner when unbinding slave
ARC: io.h: Implement reads{x}()/writes{x}()
drm/msm: Grab a vblank reference when waiting for commit_done
x86/earlyprintk/efi: Fix infinite loop on some screen widths
scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload
scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
mac80211_hwsim: fix module init error paths for netlink
mac80211: Fix condition validating WMM IE
mac80211: don't WARN on bad WMM parameters from buggy APs
f2fs: fix a panic caused by NULL flush_cmd_control
Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
powerpc/msi: Fix NULL pointer access in teardown code
tracing: Fix memory leak of instance function hash filters
tracing: Fix memory leak in set_trigger_filter()
MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
aio: fix spectre gadget in lookup_ioctx
pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
powerpc/boot: Fix random libfdt related build errors
timer/debug: Change /proc/timer_list from 0444 to 0400
lib/interval_tree_test.c: allow users to limit scope of endpoint
lib/rbtree-test: lower default params
lib/rbtree_test.c: make input module parameters
lib/interval_tree_test.c: allow full tree search
lib/interval_tree_test.c: make test options module parameters
ANDROID: Revert fs/squashfs back to linux-4.4.y
Conflicts:
drivers/gpu/drm/msm/msm_atomic.c
Change-Id: Iecec05c300fb06c0bcdd44a797795e854ea0d0fd
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Greg Kroah-Hartman [Fri, 21 Dec 2018 13:28:48 +0000 (14:28 +0100)]
Merge 4.4.169 into android-4.4
Changes in 4.4.169
lib/interval_tree_test.c: make test options module parameters
lib/interval_tree_test.c: allow full tree search
lib/rbtree_test.c: make input module parameters
lib/rbtree-test: lower default params
lib/interval_tree_test.c: allow users to limit scope of endpoint
timer/debug: Change /proc/timer_list from 0444 to 0400
powerpc/boot: Fix random libfdt related build errors
pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
aio: fix spectre gadget in lookup_ioctx
MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
tracing: Fix memory leak in set_trigger_filter()
tracing: Fix memory leak of instance function hash filters
powerpc/msi: Fix NULL pointer access in teardown code
Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
f2fs: fix a panic caused by NULL flush_cmd_control
mac80211: don't WARN on bad WMM parameters from buggy APs
mac80211: Fix condition validating WMM IE
mac80211_hwsim: fix module init error paths for netlink
scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload
x86/earlyprintk/efi: Fix infinite loop on some screen widths
drm/msm: Grab a vblank reference when waiting for commit_done
ARC: io.h: Implement reads{x}()/writes{x}()
bonding: fix 802.3ad state sent to partner when unbinding slave
SUNRPC: Fix a potential race in xprt_connect()
sbus: char: add of_node_put()
drivers/sbus/char: add of_node_put()
drivers/tty: add missing of_node_put()
ide: pmac: add of_node_put()
clk: mmp: Off by one in mmp_clk_add()
Input: omap-keypad - fix keyboard debounce configuration
libata: whitelist all SAMSUNG MZ7KM* solid-state disks
mv88e6060: disable hardware level MAC learning
ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling
cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
i2c: axxia: properly handle master timeout
i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
rtc: snvs: add a missing write sync
rtc: snvs: Add timeouts to avoid kernel lockups
ALSA: isa/wavefront: prevent some out of bound writes
Linux 4.4.169
Change-Id: Ic1bde8f64625c7787feb8e7411b15e70a2f76981
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Greg Kroah-Hartman [Fri, 21 Dec 2018 13:09:54 +0000 (14:09 +0100)]
Linux 4.4.169
Dan Carpenter [Wed, 4 May 2016 06:27:37 +0000 (09:27 +0300)]
ALSA: isa/wavefront: prevent some out of bound writes
[ Upstream commit
84d7a4470dbac0dd9389050100b54a1625d04264 ]
"header->number" can be up to USHRT_MAX and it comes from the ioctl so
it needs to be capped.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Trent Piepho [Wed, 16 May 2018 23:45:51 +0000 (16:45 -0700)]
rtc: snvs: Add timeouts to avoid kernel lockups
[ Upstream commit
cd7f3a249dbed2858e6c2f30e5be7f1f7a709ee2 ]
In order to read correctly from asynchronously updated RTC registers,
it's necessary to read repeatedly until their values do not change from
read to read. It's also necessary to wait for three RTC clock ticks for
certain operations. There are no timeouts in this code and these
operations could possibly loop forever.
To avoid kernel hangs, put in timeouts.
The iMX7d can be configured to stop the SRTC on a tamper event, which
will lockup the kernel inside this driver as described above.
These hangs can happen when running under qemu, which doesn't emulate
the SNVS RTC, though currently the driver will refuse to load on qemu
due to a timeout in the driver probe method.
It could also happen if the SRTC block where somehow placed into reset
or the slow speed clock that drives the SRTC counter (but not the CPU)
were to stop.
The symptoms on a two core iMX7d are a work queue hang on
rtc_timer_do_work(), which eventually blocks a systemd fsnotify
operation that triggers a work queue flush, causing systemd to hang and
thus causing all services that should be started by systemd, like a
console getty, to fail to start or stop.
Also optimize the wait code to wait less. It only needs to wait for the
clock to advance three ticks, not to see it change three times.
Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Fabio Estevam <fabio.estevam@nxp.com>
Cc: Shawn Guo <shawn.guo@linaro.org>
Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Signed-off-by: Trent Piepho <tpiepho@impinj.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Guy Shapiro [Sun, 29 Jan 2017 09:57:19 +0000 (11:57 +0200)]
rtc: snvs: add a missing write sync
[ Upstream commit
7bb633b1a9812a6b9f3e49d0cf17f60a633914e5 ]
The clear of the LPTA_EN flag should be synced before writing to the
alarm register. Omitting this synchronization creates a race when
trying to change existing alarm.
Signed-off-by: Guy Shapiro <guy.shapiro@mobi-wize.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Hans de Goede [Wed, 21 Nov 2018 09:19:55 +0000 (10:19 +0100)]
i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
[ Upstream commit
0544ee4b1ad574aec3b6379af5f5cdee42840971 ]
Some AMD based HP laptops have a SMB0001 ACPI device node which does not
define any methods.
This leads to the following error in dmesg:
[ 5.222731] cmi: probe of SMB0001:00 failed with error -5
This commit makes acpi_smbus_cmi_add() return -ENODEV instead in this case
silencing the error. In case of a failure of the i2c_add_adapter() call
this commit now propagates the error from that call instead of -EIO.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Adamski, Krzysztof (Nokia - PL/Wroclaw) [Fri, 16 Nov 2018 13:24:41 +0000 (13:24 +0000)]
i2c: axxia: properly handle master timeout
[ Upstream commit
6c7f25cae54b840302e4f1b371dbf318fbf09ab2 ]
According to Intel (R) Axxia TM Lionfish Communication Processor
Peripheral Subsystem Hardware Reference Manual, the AXXIA I2C module
have a programmable Master Wait Timer, which among others, checks the
time between commands send in manual mode. When a timeout (25ms) passes,
TSS bit is set in Master Interrupt Status register and a Stop command is
issued by the hardware.
The axxia_i2c_xfer(), does not properly handle this situation, however.
For each message a separate axxia_i2c_xfer_msg() is called and this
function incorrectly assumes that any interrupt might happen only when
waiting for completion. This is mostly correct but there is one
exception - a master timeout can trigger if enough time has passed
between individual transfers. It will, by definition, happen between
transfers when the interrupts are disabled by the code. If that happens,
the hardware issues Stop command.
The interrupt indicating timeout will not be triggered as soon as we
enable them since the Master Interrupt Status is cleared when master
mode is entered again (which happens before enabling irqs) meaning this
error is lost and the transfer is continued even though the Stop was
issued on the bus. The subsequent operations completes without error but
a bogus value (0xFF in case of read) is read as the client device is
confused because aborted transfer. No error is returned from
master_xfer() making caller believe that a valid value was read.
To fix the problem, the TSS bit (indicating timeout) in Master Interrupt
Status register is checked before each transfer. If it is set, there was
a timeout before this transfer and (as described above) the hardware
already issued Stop command so the transaction should be aborted thus
-ETIMEOUT is returned from the master_xfer() callback. In order to be
sure no timeout was issued we can't just read the status just before
starting new transaction as there will always be a small window of time
(few CPU cycles at best) where this might still happen. For this reason
we have to temporally disable the timer before checking for TSS bit.
Disabling it will, however, clear the TSS bit so in order to preserve
that information, we have to read it in ISR so we have to ensure that
the TSS interrupt is not masked between transfers of one transaction.
There is no need to call bus recovery or controller reinitialization if
that happens so it's skipped.
Signed-off-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Steve French [Sat, 3 Nov 2018 20:02:44 +0000 (15:02 -0500)]
cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
[ Upstream commit
6e785302dad32228819d8066e5376acd15d0e6ba ]
Missing a dependency. Shouldn't show cifs posix extensions
in Kconfig if CONFIG_CIFS_ALLOW_INSECURE_DIALECTS (ie SMB1
protocol) is disabled.
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Chris Cole [Fri, 23 Nov 2018 11:20:45 +0000 (12:20 +0100)]
ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling
[ Upstream commit
a1208f6a822ac29933e772ef1f637c5d67838da9 ]
This patch addresses possible memory corruption when
v7_dma_inv_range(start_address, end_address) address parameters are not
aligned to whole cache lines. This function issues "invalidate" cache
management operations to all cache lines from start_address (inclusive)
to end_address (exclusive). When start_address and/or end_address are
not aligned, the start and/or end cache lines are first issued "clean &
invalidate" operation. The assumption is this is done to ensure that any
dirty data addresses outside the address range (but part of the first or
last cache lines) are cleaned/flushed so that data is not lost, which
could happen if just an invalidate is issued.
The problem is that these first/last partial cache lines are issued
"clean & invalidate" and then "invalidate". This second "invalidate" is
not required and worse can cause "lost" writes to addresses outside the
address range but part of the cache line. If another component writes to
its part of the cache line between the "clean & invalidate" and
"invalidate" operations, the write can get lost. This fix is to remove
the extra "invalidate" operation when unaligned addressed are used.
A kernel module is available that has a stress test to reproduce the
issue and a unit test of the updated v7_dma_inv_range(). It can be
downloaded from
http://ftp.sageembedded.com/outgoing/linux/cache-test-
20181107.tgz.
v7_dma_inv_range() is call by dmac_[un]map_area(addr, len, direction)
when the direction is DMA_FROM_DEVICE. One can (I believe) successfully
argue that DMA from a device to main memory should use buffers aligned
to cache line size, because the "clean & invalidate" might overwrite
data that the device just wrote using DMA. But if a driver does use
unaligned buffers, at least this fix will prevent memory corruption
outside the buffer.
Signed-off-by: Chris Cole <chris@sageembedded.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Anderson Luiz Alves [Fri, 30 Nov 2018 23:58:36 +0000 (21:58 -0200)]
mv88e6060: disable hardware level MAC learning
[ Upstream commit
a74515604a7b171f2702bdcbd1e231225fb456d0 ]
Disable hardware level MAC learning because it breaks station roaming.
When enabled it drops all frames that arrive from a MAC address
that is on a different port at learning table.
Signed-off-by: Anderson Luiz Alves <alacn1@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Juha-Matti Tilli [Sun, 2 Dec 2018 10:47:08 +0000 (12:47 +0200)]
libata: whitelist all SAMSUNG MZ7KM* solid-state disks
[ Upstream commit
fd6f32f78645db32b6b95a42e45da2ddd6de0e67 ]
These devices support read zero after trim (RZAT), as they advertise to
the OS. However, the OS doesn't believe the SSDs unless they are
explicitly whitelisted.
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Tony Lindgren [Mon, 3 Dec 2018 19:24:30 +0000 (11:24 -0800)]
Input: omap-keypad - fix keyboard debounce configuration
[ Upstream commit
6c3516fed7b61a3527459ccfa67fab130d910610 ]
I noticed that the Android v3.0.8 kernel on droid4 is using different
keypad values from the mainline kernel and does not have issues with
keys occasionally being stuck until pressed again. Turns out there was
an earlier patch posted to fix this as "Input: omap-keypad: errata i689:
Correct debounce time", but it was never reposted to fix use macros
for timing calculations.
This updated version is using macros, and also fixes the use of the
input clock rate to use 32768KiHz instead of 32000KiHz. And we want to
use the known good Android kernel values of 3 and 6 instead of 2 and 6
in the earlier patch.
Reported-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Dan Carpenter [Mon, 3 Dec 2018 14:51:43 +0000 (17:51 +0300)]
clk: mmp: Off by one in mmp_clk_add()
[ Upstream commit
2e85c57493e391b93445c1e0d530b36b95becc64 ]
The > comparison should be >= or we write one element beyond the end of
the unit->clk_table[] array.
(The unit->clk_table[] array is allocated in the mmp_clk_init() function
and it has unit->nr_clks elements).
Fixes:
4661fda10f8b ("clk: mmp: add basic support functions for DT support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Yangtao Li [Tue, 20 Nov 2018 13:02:49 +0000 (08:02 -0500)]
ide: pmac: add of_node_put()
[ Upstream commit
a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5 ]
use of_node_put() to release the refcount.
Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Yangtao Li [Wed, 21 Nov 2018 15:22:54 +0000 (10:22 -0500)]
drivers/tty: add missing of_node_put()
[ Upstream commit
dac097c4546e4c5b16dd303a1e97c1d319c8ab3e ]
of_find_node_by_path() acquires a reference to the node
returned by it and that reference needs to be dropped by its caller.
This place is not doing this, so fix it.
Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Yangtao Li [Tue, 20 Nov 2018 13:38:26 +0000 (08:38 -0500)]
drivers/sbus/char: add of_node_put()
[ Upstream commit
6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100 ]
use of_node_put() to release the refcount.
Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Yangtao Li [Tue, 20 Nov 2018 13:30:40 +0000 (08:30 -0500)]
sbus: char: add of_node_put()
[ Upstream commit
87d81a23e24f24ebe014891e8bdf3ff8785031e8 ]
use of_node_put() to release the refcount.
Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Trond Myklebust [Sun, 2 Dec 2018 04:18:00 +0000 (23:18 -0500)]
SUNRPC: Fix a potential race in xprt_connect()
[ Upstream commit
0a9a4304f3614e25d9de9b63502ca633c01c0d70 ]
If an asynchronous connection attempt completes while another task is
in xprt_connect(), then the call to rpc_sleep_on() could end up
racing with the call to xprt_wake_pending_tasks().
So add a second test of the connection state after we've put the
task to sleep and set the XPRT_CONNECTING flag, when we know that there
can be no asynchronous connection attempts still in progress.
Fixes:
0b9e79431377d ("SUNRPC: Move the test for XPRT_CONNECTING into...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Toni Peltonen [Tue, 27 Nov 2018 14:56:57 +0000 (16:56 +0200)]
bonding: fix 802.3ad state sent to partner when unbinding slave
[ Upstream commit
3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4 ]
Previously when unbinding a slave the 802.3ad implementation only told
partner that the port is not suitable for aggregation by setting the port
aggregation state from aggregatable to individual. This is not enough. If the
physical layer still stays up and we only unbinded this port from the bond there
is nothing in the aggregation status alone to prevent the partner from sending
traffic towards us. To ensure that the partner doesn't consider this
port at all anymore we should also disable collecting and distributing to
signal that this actor is going away. Also clear AD_STATE_SYNCHRONIZATION to
ensure partner exits collecting + distributing state.
I have tested this behaviour againts Arista EOS switches with mlx5 cards
(physical link stays up even when interface is down) and simulated
the same situation virtually Linux <-> Linux with two network namespaces
running two veth device pairs. In both cases setting aggregation to
individual doesn't alone prevent traffic from being to sent towards this
port given that the link stays up in partners end. Partner still keeps
it's end in collecting + distributing state and continues until timeout is
reached. In most cases this means we are losing the traffic partner sends
towards our port while we wait for timeout. This is most visible with slow
periodic time (LACP rate slow).
Other open source implementations like Open VSwitch and libreswitch, and
vendor implementations like Arista EOS, seem to disable collecting +
distributing to when doing similar port disabling/detaching/removing change.
With this patch kernel implementation would behave the same way and ensure
partner doesn't consider our actor viable anymore.
Signed-off-by: Toni Peltonen <peltzi@peltzi.fi>
Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Acked-by: Jonathan Toppins <jtoppins@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Jose Abreu [Fri, 30 Nov 2018 09:47:31 +0000 (09:47 +0000)]
ARC: io.h: Implement reads{x}()/writes{x}()
[ Upstream commit
10d443431dc2bb733cf7add99b453e3fb9047a2e ]
Some ARC CPU's do not support unaligned loads/stores. Currently, generic
implementation of reads{b/w/l}()/writes{b/w/l}() is being used with ARC.
This can lead to misfunction of some drivers as generic functions do a
plain dereference of a pointer that can be unaligned.
Let's use {get/put}_unaligned() helpers instead of plain dereference of
pointer in order to fix. The helpers allow to get and store data from an
unaligned address whilst preserving the CPU internal alignment.
According to [1], the use of these helpers are costly in terms of
performance so we added an initial check for a buffer already aligned so
that the usage of the helpers can be avoided, when possible.
[1] Documentation/unaligned-memory-access.txt
Cc: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Joao Pinto <jpinto@synopsys.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Tested-by: Vitor Soares <soares@synopsys.com>
Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Sean Paul [Wed, 3 Oct 2018 20:22:31 +0000 (16:22 -0400)]
drm/msm: Grab a vblank reference when waiting for commit_done
[ Upstream commit
3b712e43e3876b42b38321ecf790a1f5fe59c834 ]
Similar to the atomic helpers, we should enable vblank while we're
waiting for the commit to finish. DPU needs this, MDP5 seems to work
fine without it.
Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
YiFei Zhu [Thu, 29 Nov 2018 17:12:30 +0000 (18:12 +0100)]
x86/earlyprintk/efi: Fix infinite loop on some screen widths
[ Upstream commit
79c2206d369b87b19ac29cb47601059b6bf5c291 ]
An affected screen resolution is 1366 x 768, which width is not
divisible by 8, the default font width. On such screens, when longer
lines are earlyprintk'ed, overflow-to-next-line can never trigger,
due to the left-most x-coordinate of the next character always less
than the screen width. Earlyprintk will infinite loop in trying to
print the rest of the string but unable to, due to the line being
full.
This patch makes the trigger consider the right-most x-coordinate,
instead of left-most, as the value to compare against the screen
width threshold.
Signed-off-by: YiFei Zhu <zhuyifei1999@gmail.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
Cc: Bhupesh Sharma <bhsharma@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Eric Snowberg <eric.snowberg@oracle.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Joe Perches <joe@perches.com>
Cc: Jon Hunter <jonathanh@nvidia.com>
Cc: Julien Thierry <julien.thierry@arm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Cc: Sedat Dilek <sedat.dilek@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/20181129171230.18699-12-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Cathy Avery [Tue, 27 Nov 2018 19:28:53 +0000 (14:28 -0500)]
scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload
[ Upstream commit
02f425f811cefcc4d325d7a72272651e622dc97e ]
Currently pvscsi_remove calls free_irq more than once as
pvscsi_release_resources and __pvscsi_shutdown both call
pvscsi_shutdown_intr. This results in a 'Trying to free already-free IRQ'
warning and stack trace. To solve the problem pvscsi_shutdown_intr has been
moved out of pvscsi_release_resources.
Signed-off-by: Cathy Avery <cavery@redhat.com>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Fred Herard [Wed, 21 Nov 2018 01:22:45 +0000 (20:22 -0500)]
scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
[ Upstream commit
5db6dd14b31397e8cccaaddab2ff44ebec1acf25 ]
This commit addresses NULL pointer dereference in iscsi_eh_session_reset.
Reference should not be made to session->leadconn when session->state is
set to ISCSI_STATE_TERMINATE.
Signed-off-by: Fred Herard <fred.herard@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Alexey Khoroshilov [Fri, 5 Oct 2018 20:22:06 +0000 (23:22 +0300)]
mac80211_hwsim: fix module init error paths for netlink
[ Upstream commit
05cc09de4c017663a217630682041066f2f9a5cd ]
There is no unregister netlink notifier and family on error paths
in init_mac80211_hwsim(). Also there is an error path where
hwsim_class is not destroyed.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Fixes:
62759361eb49 ("mac80211-hwsim: Provide multicast event for HWSIM_CMD_NEW_RADIO")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Ilan Peer [Tue, 3 Apr 2018 08:35:22 +0000 (11:35 +0300)]
mac80211: Fix condition validating WMM IE
[ Upstream commit
911a26484c33e10de6237228ca1d7293548e9f49 ]
Commit
c470bdc1aaf3 ("mac80211: don't WARN on bad WMM parameters from
buggy APs") handled cases where an AP reports a zeroed WMM
IE. However, the condition that checks the validity accessed the wrong
index in the ieee80211_tx_queue_params array, thus wrongly deducing
that the parameters are invalid. Fix it.
Fixes:
c470bdc1aaf3 ("mac80211: don't WARN on bad WMM parameters from buggy APs")
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Emmanuel Grumbach [Mon, 26 Mar 2018 13:21:04 +0000 (16:21 +0300)]
mac80211: don't WARN on bad WMM parameters from buggy APs
[ Upstream commit
c470bdc1aaf36669e04ba65faf1092b2d1c6cabe ]
Apparently, some APs are buggy enough to send a zeroed
WMM IE. Don't WARN on this since this is not caused by a bug
on the client's system.
This aligns the condition of the WARNING in drv_conf_tx
with the validity check in ieee80211_sta_wmm_params.
We will now pick the default values whenever we get
a zeroed WMM IE.
This has been reported here:
https://bugzilla.kernel.org/show_bug.cgi?id=199161
Fixes:
f409079bb678 ("mac80211: sanity check CW_min/CW_max towards driver")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Yunlei He [Thu, 1 Jun 2017 08:43:51 +0000 (16:43 +0800)]
f2fs: fix a panic caused by NULL flush_cmd_control
commit
d4fdf8ba0e5808ba9ad6b44337783bd9935e0982 upstream.
Mount fs with option noflush_merge, boot failed for illegal address
fcc in function f2fs_issue_flush:
if (!test_opt(sbi, FLUSH_MERGE)) {
ret = submit_flush_wait(sbi);
atomic_inc(&fcc->issued_flush); -> Here, fcc illegal
return ret;
}
Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Brian Norris [Wed, 5 Dec 2018 18:16:57 +0000 (10:16 -0800)]
Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
commit
63238173b2faf3d6b85a416f1c69af6c7be2413f upstream.
This reverts commit
7f3ef5dedb146e3d5063b6845781ad1bb59b92b5.
It causes new warnings [1] on shutdown when running the Google Kevin or
Scarlet (RK3399) boards under Chrome OS. Presumably our usage of DRM is
different than what Marc and Heiko test.
We're looking at a different approach (e.g., [2]) to replace this, but
IMO the revert should be taken first, as it already propagated to
-stable.
[1] Report here:
http://lkml.kernel.org/lkml/
20181205030127.GA200921@google.com
WARNING: CPU: 4 PID: 2035 at drivers/gpu/drm/drm_mode_config.c:477 drm_mode_config_cleanup+0x1c4/0x294
...
Call trace:
drm_mode_config_cleanup+0x1c4/0x294
rockchip_drm_unbind+0x4c/0x8c
component_master_del+0x88/0xb8
rockchip_drm_platform_remove+0x2c/0x44
rockchip_drm_platform_shutdown+0x20/0x2c
platform_drv_shutdown+0x2c/0x38
device_shutdown+0x164/0x1b8
kernel_restart_prepare+0x40/0x48
kernel_restart+0x20/0x68
...
Memory manager not clean during takedown.
WARNING: CPU: 4 PID: 2035 at drivers/gpu/drm/drm_mm.c:950 drm_mm_takedown+0x34/0x44
...
drm_mm_takedown+0x34/0x44
rockchip_drm_unbind+0x64/0x8c
component_master_del+0x88/0xb8
rockchip_drm_platform_remove+0x2c/0x44
rockchip_drm_platform_shutdown+0x20/0x2c
platform_drv_shutdown+0x2c/0x38
device_shutdown+0x164/0x1b8
kernel_restart_prepare+0x40/0x48
kernel_restart+0x20/0x68
...
[2] https://patchwork.kernel.org/patch/
10556151/
https://www.spinics.net/lists/linux-rockchip/msg21342.html
[PATCH] drm/rockchip: shutdown drm subsystem on shutdown
Fixes:
7f3ef5dedb14 ("drm/rockchip: Allow driver to be shutdown on reboot/kexec")
Cc: Jeffy Chen <jeffy.chen@rock-chips.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: Vicente Bergas <vicencb@gmail.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Heiko Stuebner <heiko@sntech.de>
Cc: stable@vger.kernel.org
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20181205181657.177703-1-briannorris@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Radu Rendec [Wed, 28 Nov 2018 03:20:48 +0000 (22:20 -0500)]
powerpc/msi: Fix NULL pointer access in teardown code
commit
78e7b15e17ac175e7eed9e21c6f92d03d3b0a6fa upstream.
The arch_teardown_msi_irqs() function assumes that controller ops
pointers were already checked in arch_setup_msi_irqs(), but this
assumption is wrong: arch_teardown_msi_irqs() can be called even when
arch_setup_msi_irqs() returns an error (-ENOSYS).
This can happen in the following scenario:
- msi_capability_init() calls pci_msi_setup_msi_irqs()
- pci_msi_setup_msi_irqs() returns -ENOSYS
- msi_capability_init() notices the error and calls free_msi_irqs()
- free_msi_irqs() calls pci_msi_teardown_msi_irqs()
This is easier to see when CONFIG_PCI_MSI_IRQ_DOMAIN is not set and
pci_msi_setup_msi_irqs() and pci_msi_teardown_msi_irqs() are just
aliases to arch_setup_msi_irqs() and arch_teardown_msi_irqs().
The call to free_msi_irqs() upon pci_msi_setup_msi_irqs() failure
seems legit, as it does additional cleanup; e.g.
list_del(&entry->list) and kfree(entry) inside free_msi_irqs() do
happen (MSI descriptors are allocated before pci_msi_setup_msi_irqs()
is called and need to be cleaned up if that fails).
Fixes:
6b2fd7efeb88 ("PCI/MSI/PPC: Remove arch_msi_check_device()")
Cc: stable@vger.kernel.org # v3.18+
Signed-off-by: Radu Rendec <radu.rendec@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Steven Rostedt (VMware) [Tue, 11 Dec 2018 04:58:01 +0000 (23:58 -0500)]
tracing: Fix memory leak of instance function hash filters
commit
2840f84f74035e5a535959d5f17269c69fa6edc5 upstream.
The following commands will cause a memory leak:
# cd /sys/kernel/tracing
# mkdir instances/foo
# echo schedule > instance/foo/set_ftrace_filter
# rmdir instances/foo
The reason is that the hashes that hold the filters to set_ftrace_filter and
set_ftrace_notrace are not freed if they contain any data on the instance
and the instance is removed.
Found by kmemleak detector.
Cc: stable@vger.kernel.org
Fixes:
591dffdade9f ("ftrace: Allow for function tracing instance to filter functions")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Steven Rostedt (VMware) [Mon, 10 Dec 2018 02:17:30 +0000 (21:17 -0500)]
tracing: Fix memory leak in set_trigger_filter()
commit
3cec638b3d793b7cacdec5b8072364b41caeb0e1 upstream.
When create_event_filter() fails in set_trigger_filter(), the filter may
still be allocated and needs to be freed. The caller expects the
data->filter to be updated with the new filter, even if the new filter
failed (we could add an error message by setting set_str parameter of
create_event_filter(), but that's another update).
But because the error would just exit, filter was left hanging and
nothing could free it.
Found by kmemleak detector.
Cc: stable@vger.kernel.org
Fixes:
bac5fb97a173a ("tracing: Add and use generic set_trigger_filter() implementation")
Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Aaro Koskinen [Mon, 19 Nov 2018 23:14:00 +0000 (01:14 +0200)]
MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
commit
e8cde625bfe8a714a856e1366bcbb259d7346095 upstream.
Since v2.6.22 or so there has been reports [1] about OMAP MMC being
broken on OMAP15XX based hardware (OMAP5910 and OMAP310). The breakage
seems to have been caused by commit
46a6730e3ff9 ("mmc-omap: Fix
omap to use MMC_POWER_ON") that changed clock enabling to be done
on MMC_POWER_ON. This can happen multiple times in a row, and on 15XX
the hardware doesn't seem to like it and the MMC just stops responding.
Fix by memorizing the power mode and do the init only when necessary.
Before the patch (on Palm TE):
mmc0: new SD card at address b368
mmcblk0: mmc0:b368 SDC 977 MiB
mmci-omap mmci-omap.0: command timeout (CMD18)
mmci-omap mmci-omap.0: command timeout (CMD13)
mmci-omap mmci-omap.0: command timeout (CMD13)
mmci-omap mmci-omap.0: command timeout (CMD12) [x 6]
mmci-omap mmci-omap.0: command timeout (CMD13) [x 6]
mmcblk0: error -110 requesting status
mmci-omap mmci-omap.0: command timeout (CMD8)
mmci-omap mmci-omap.0: command timeout (CMD18)
mmci-omap mmci-omap.0: command timeout (CMD13)
mmci-omap mmci-omap.0: command timeout (CMD13)
mmci-omap mmci-omap.0: command timeout (CMD12) [x 6]
mmci-omap mmci-omap.0: command timeout (CMD13) [x 6]
mmcblk0: error -110 requesting status
mmcblk0: recovery failed!
print_req_error: I/O error, dev mmcblk0, sector 0
Buffer I/O error on dev mmcblk0, logical block 0, async page read
mmcblk0: unable to read partition table
After the patch:
mmc0: new SD card at address b368
mmcblk0: mmc0:b368 SDC 977 MiB
mmcblk0: p1
The patch is based on a fix and analysis done by Ladislav Michl.
Tested on OMAP15XX/OMAP310 (Palm TE), OMAP1710 (Nokia 770)
and OMAP2420 (Nokia N810).
[1] https://marc.info/?t=
123175197000003&r=1&w=2
Fixes:
46a6730e3ff9 ("mmc-omap: Fix omap to use MMC_POWER_ON")
Reported-by: Ladislav Michl <ladis@linux-mips.org>
Reported-by: Andrzej Zaborowski <balrogg@gmail.com>
Tested-by: Ladislav Michl <ladis@linux-mips.org>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jeff Moyer [Tue, 11 Dec 2018 17:37:49 +0000 (12:37 -0500)]
aio: fix spectre gadget in lookup_ioctx
commit
a538e3ff9dabcdf6c3f477a373c629213d1c3066 upstream.
Matthew pointed out that the ioctx_table is susceptible to spectre v1,
because the index can be controlled by an attacker. The below patch
should mitigate the attack for all of the aio system calls.
Cc: stable@vger.kernel.org
Reported-by: Matthew Wilcox <willy@infradead.org>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Chen-Yu Tsai [Tue, 4 Dec 2018 09:04:57 +0000 (17:04 +0800)]
pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
commit
478b6767ad26ab86d9ecc341027dd09a87b1f997 upstream.
Pin PH11 is used on various A83T board to detect a change in the OTG
port's ID pin, as in when an OTG host cable is plugged in.
The incorrect offset meant the gpiochip/irqchip was activating the wrong
pin for interrupts.
Fixes:
4730f33f0d82 ("pinctrl: sunxi: add allwinner A83T PIO controller support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Guenter Roeck [Sat, 15 Dec 2018 15:30:39 +0000 (07:30 -0800)]
powerpc/boot: Fix random libfdt related build errors
[ Upstream commit
64c3f648c25d108f346fdc96c15180c6b7d250e9 ]
Once in a while I see build errors similar to the following
when building images from a clean tree.
Building powerpc:virtex-ml507:44x/virtex5_defconfig ... failed
------------
Error log:
arch/powerpc/boot/treeboot-akebono.c:37:20: fatal error:
libfdt.h: No such file or directory
Building powerpc:bamboo:smpdev:44x/bamboo_defconfig ... failed
------------
Error log:
arch/powerpc/boot/treeboot-akebono.c:37:20: fatal error:
libfdt.h: No such file or directory
arch/powerpc/boot/treeboot-currituck.c:35:20: fatal error:
libfdt.h: No such file or directory
Rebuilds will succeed.
Turns out that several source files in arch/powerpc/boot/ include
libfdt.h, but Makefile dependencies are incomplete. Let's fix that.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[groeck: Backport to v4.4.y]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Ingo Molnar [Mon, 13 Nov 2017 06:15:41 +0000 (07:15 +0100)]
timer/debug: Change /proc/timer_list from 0444 to 0400
[ Upstream commit
8e7df2b5b7f245c9bd11064712db5cb69044a362 ]
While it uses %pK, there's still few reasons to read this file
as non-root.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Davidlohr Bueso [Mon, 10 Jul 2017 22:51:49 +0000 (15:51 -0700)]
lib/interval_tree_test.c: allow users to limit scope of endpoint
[ Upstream commit
a8ec14d4f6aa8e245efacc992c8ee6ea0464ce2a ]
Add a 'max_endpoint' parameter such that users may easily limit the size
of the intervals that are randomly generated.
Link: http://lkml.kernel.org/r/20170518174936.20265-4-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Davidlohr Bueso [Fri, 17 Nov 2017 23:28:27 +0000 (15:28 -0800)]
lib/rbtree-test: lower default params
[ Upstream commit
0b548e33e6cb2bff240fdaf1783783be15c29080 ]
Fengguang reported soft lockups while running the rbtree and interval
tree test modules. The logic for these tests all occur in init phase,
and we currently are pounding with the default values for number of
nodes and number of iterations of each test. Reduce the latter by two
orders of magnitude. This does not influence the value of the tests in
that one thousand times by default is enough to get the picture.
Link: http://lkml.kernel.org/r/20171109161715.xai2dtwqw2frhkcm@linux-n805
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Davidlohr Bueso [Fri, 8 Sep 2017 23:14:46 +0000 (16:14 -0700)]
lib/rbtree_test.c: make input module parameters
[ Upstream commit
223f8911eace60c787f8767c25148b80ece9732a ]
Allows for more flexible debugging.
Link: http://lkml.kernel.org/r/20170719014603.19029-5-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Davidlohr Bueso [Mon, 10 Jul 2017 22:51:52 +0000 (15:51 -0700)]
lib/interval_tree_test.c: allow full tree search
[ Upstream commit
c46ecce431ebe6b1a9551d1f530eb432dae5c39b ]
... such that a user can specify visiting all the nodes in the tree
(intersects with the world). This is a nice opposite from the very
basic default query which is a single point.
Link: http://lkml.kernel.org/r/20170518174936.20265-5-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Davidlohr Bueso [Mon, 10 Jul 2017 22:51:46 +0000 (15:51 -0700)]
lib/interval_tree_test.c: make test options module parameters
[ Upstream commit
a54dae0338b7f01eb0f9c7571fb9b74f791d1c6b ]
Allows for more flexible debugging.
Link: http://lkml.kernel.org/r/20170518174936.20265-3-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Srinivasarao P [Fri, 21 Dec 2018 07:33:14 +0000 (13:03 +0530)]
Merge android-4.4.168 (
66a37fc) into msm-4.4
* refs/heads/tmp-
66a37fc
Linux 4.4.168
selftests: Move networking/timestamping from Documentation
rocker: fix rocker_tlv_put_* functions for KASAN
staging: speakup: Replace strncpy with memcpy
matroxfb: fix size of memcpy
media: dvb-frontends: fix i2c access helpers for KASAN
proc: do not access cmdline nor environ from file-backed areas
proc: don't use FOLL_FORCE for reading cmdline and environment
mm: replace access_remote_vm() write parameter with gup_flags
mm: replace __access_remote_vm() write parameter with gup_flags
mm: replace get_user_pages() write/force parameters with gup_flags
mm: replace get_vaddr_frames() write/force parameters with gup_flags
mm: replace get_user_pages_locked() write/force parameters with gup_flags
mm: replace get_user_pages_unlocked() write/force parameters with gup_flags
mm/nommu.c: Switch __get_user_pages_unlocked() to use __get_user_pages()
mm: remove write/force parameters from __get_user_pages_unlocked()
mm: remove write/force parameters from __get_user_pages_locked()
sr: pass down correctly sized SCSI sense buffer
swiotlb: clean up reporting
hugetlbfs: fix bug in pgoff overflow checking
hugetlbfs: check for pgoff value overflow
hugetlbfs: fix offset overflow in hugetlbfs mmap
mm/hugetlb.c: don't call region_abort if region_chg fails
posix-timers: Sanitize overrun handling
wil6210: missing length check in wmi_set_ie
bpf: Prevent memory disambiguation attack
bpf/verifier: Pass instruction index to check_mem_access() and check_xadd()
bpf/verifier: Add spi variable to check_stack_write()
bpf: support 8-byte metafield access
KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD
x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP
x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL
KVM: SVM: Move spec control call after restore of GS
x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest
x86/bugs, KVM: Support the combination of guest and host IBRS
x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec
x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end}
x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec
x86: fix SMAP in 32-bit environments
x86: reorganize SMAP handling in user space accesses
KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL
KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL
KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES
KVM/x86: Add IBPB support
KVM: VMX: make MSR bitmaps per-VCPU
KVM: VMX: introduce alloc_loaded_vmcs
KVM: nVMX: Eliminate vmcs02 pool
KVM: nVMX: mark vmcs12 pages dirty on L2 exit
KVM: nVMX: fix msr bitmaps to prevent L2 from accessing L0 x2APIC
ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
pstore: Convert console write to use ->write_buf
ocfs2: fix potential use after free
debugobjects: avoid recursive calls with kmemleak
hfsplus: do not free node before using
hfs: do not free node before using
ocfs2: fix deadlock caused by ocfs2_defrag_extent()
fscache, cachefiles: remove redundant variable 'cache'
fscache: fix race between enablement and dropping of object
xen: xlate_mmu: add missing header to fix 'W=1' warning
drm/ast: fixed reading monitor EDID not stable issue
net: hisilicon: remove unexpected free_netdev
ixgbe: recognize 1000BaseLX SFP modules as 1Gbps
net: thunderx: fix NULL pointer dereference in nic_remove
KVM: x86: fix empty-body warnings
USB: omap_udc: fix USB gadget functionality on Palm Tungsten E
USB: omap_udc: fix omap_udc_start() on 15xx machines
USB: omap_udc: fix crashes on probe error and module removal
USB: omap_udc: use devm_request_irq()
bpf: fix check of allowed specifiers in bpf_trace_printk
exportfs: do not read dentry after free
ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE
ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE
Btrfs: send, fix infinite loop due to directory rename dependencies
hwmon: (w83795) temp4_type has writable permission
ASoC: dapm: Recalculate audio map forcely when card instantiated
hwmon: (ina2xx) Fix current value calculation
s390/cpum_cf: Reject request for sampling in event initialization
sysv: return 'err' instead of 0 in __sysv_write_inode
ARM: OMAP1: ams-delta: Fix possible use of uninitialized field
ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup
neighbour: Avoid writing before skb->head in neigh_hh_output()
tun: forbid iface creation with rtnl ops
tcp: fix NULL ref in tail loss probe
rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices
net: Prevent invalid access to skb->prev in __qdisc_drop_all
net: phy: don't allow __set_phy_supported to add unsupported modes
net: 8139cp: fix a BUG triggered by changing mtu with network traffic
ipv6: Check available headroom in ip6_xmit() even without options
ANDROID: uid_sys_stats: Copy task_struct comm field to bigger buffer
Conflicts:
arch/x86/include/asm/uaccess_32.h
sound/core/pcm_native.c
Change-Id: I1d20594091279ae84c58669dd8ad5fa5e31989ab
[fixed compilation issue in kgsl.c]
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Linux Build Service Account [Fri, 21 Dec 2018 05:01:35 +0000 (21:01 -0800)]
Merge "msm: ais: Fix for OOB security CR"
Linux Build Service Account [Fri, 21 Dec 2018 05:01:34 +0000 (21:01 -0800)]
Merge "soc: qcom: glink: Initialize local state while fetching ctx"
Linux Build Service Account [Fri, 21 Dec 2018 05:01:33 +0000 (21:01 -0800)]
Merge "Revert "ARM: dts: msm: Enabled dt entry for bmi160 and iam20680""
Ajay Agarwal [Tue, 27 Nov 2018 14:18:19 +0000 (19:48 +0530)]
usb: gadget: f_uac1: Add support for UAC1 function
Add support for the UAC1 function with the configfs framework
along with following other changes:
- Add dynamic updation of AudioStreaming interface numbers in
the AudioControl interface descriptor.
- Add superspeed support.
- Stop playback on func disable so that pending request's
completion is called before request has been freed in unbind.
- Fix minor compilation issue.
Change-Id: I5f60680c5795d77cf37f6db37cf5a8c8d3648b4b
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Hemant Kumar [Wed, 19 Sep 2018 18:34:48 +0000 (11:34 -0700)]
usb: gadget: u_audio: Check return value from config_ep_by_speed()
In case config_ep_by_speed() returns error, endpoint descriptors
would not get populated. This results into NULL pointer dereference
when ep desc is accessed later. Fix this by bailing out set_alt if
config_ep_by_speed() API returns error.
Change-Id: Iaf9a0001973753988ff200edad3ed8587b6a4181
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Vladimir Zapolskiy [Thu, 21 Jun 2018 15:22:52 +0000 (17:22 +0200)]
usb: gadget: u_audio: protect stream runtime fields with stream spinlock
The change protects almost the whole body of u_audio_iso_complete()
function by PCM stream lock, this is mainly sufficient to avoid a race
between USB request completion and stream termination, the change
prevents a possibility of invalid memory access in interrupt context
by memcpy():
Unable to handle kernel paging request at virtual address
00004e80
pgd =
c0004000
[
00004e80] *pgd=
00000000
Internal error: Oops: 817 [#1] PREEMPT SMP ARM
CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G C 3.14.54+ #117
task:
da180b80 ti:
da192000 task.ti:
da192000
PC is at memcpy+0x50/0x330
LR is at 0xcdd92b0e
pc : [<
c029ef30>] lr : [<
cdd92b0e>] psr:
20000193
sp :
da193ce4 ip :
dd86ae26 fp :
0000b180
r10:
daf81680 r9 :
00000000 r8 :
d58a01ea
r7 :
2c0b43e4 r6 :
acdfb08b r5 :
01a271cf r4 :
87389377
r3 :
69469782 r2 :
00000020 r1 :
daf82fe0 r0 :
00004e80
Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Control:
10c5387d Table:
2b70804a DAC:
00000015
Process ksoftirqd/0 (pid: 3, stack limit = 0xda192238)
Also added a check for potential !runtime condition, commonly it is
done by PCM_RUNTIME_CHECK(substream) in the beginning, however this
does not completely prevent from oopses in u_audio_iso_complete(),
because the proper protection scheme must be implemented in PCM
library functions.
An example of *not fixed* oops due to substream->runtime->*
dereference by snd_pcm_running(substream) from
snd_pcm_period_elapsed(), where substream->runtime is gone while
waiting the substream lock:
Unable to handle kernel paging request at virtual address
6b6b6b6b
pgd =
db7e4000
[
6b6b6b6b] *pgd=
00000000
CPU: 0 PID: 193 Comm: klogd Tainted: G C 3.14.54+ #118
task:
db5ac500 ti:
db60c000 task.ti:
db60c000
PC is at snd_pcm_period_elapsed+0x48/0xd8 [snd_pcm]
LR is at snd_pcm_period_elapsed+0x40/0xd8 [snd_pcm]
pc : [<>] lr : [<>] psr:
60000193
Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
Control:
10c5387d Table:
2b7e404a DAC:
00000015
Process klogd (pid: 193, stack limit = 0xdb60c238)
[<>] (snd_pcm_period_elapsed [snd_pcm]) from [<>] (udc_irq+0x500/0xbbc)
[<>] (udc_irq) from [<>] (ci_irq+0x280/0x304)
[<>] (ci_irq) from [<>] (handle_irq_event_percpu+0xa4/0x40c)
[<>] (handle_irq_event_percpu) from [<>] (handle_irq_event+0x3c/0x5c)
[<>] (handle_irq_event) from [<>] (handle_fasteoi_irq+0xc4/0x110)
[<>] (handle_fasteoi_irq) from [<>] (generic_handle_irq+0x20/0x30)
[<>] (generic_handle_irq) from [<>] (handle_IRQ+0x80/0xc0)
[<>] (handle_IRQ) from [<>] (gic_handle_irq+0x3c/0x60)
[<>] (gic_handle_irq) from [<>] (__irq_svc+0x44/0x78)
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[erosca: W/o this patch, with minimal instrumentation [1], I can
consistently reproduce BUG: KASAN: use-after-free [2]]
[1] Instrumentation to reproduce issue [2]:
diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index
a72295c953bb..
bd0b308024fe 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -16,6 +16,7 @@
#include <sound/core.h>
#include <sound/pcm.h>
#include <sound/pcm_params.h>
+#include <linux/delay.h>
#include "u_audio.h"
@@ -147,6 +148,8 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
spin_unlock_irqrestore(&prm->lock, flags);
+ udelay(500); //delay here to increase probability of parallel activities
+
/* Pack USB load in ALSA ring buffer */
pending = prm->dma_bytes - hw_ptr;
[2] After applying [1], below BUG occurs on Rcar-H3-Salvator-X board:
==================================================================
BUG: KASAN: use-after-free in u_audio_iso_complete+0x24c/0x520 [u_audio]
Read of size 8 at addr
ffff8006cafcc248 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G WC 4.14.47+ #160
Hardware name: Renesas Salvator-X board based on r8a7795 ES2.0+ (DT)
Call trace:
[<
ffff2000080925ac>] dump_backtrace+0x0/0x364
[<
ffff200008092924>] show_stack+0x14/0x1c
[<
ffff200008f8dbcc>] dump_stack+0x108/0x174
[<
ffff2000083c71b8>] print_address_description+0x7c/0x32c
[<
ffff2000083c78e8>] kasan_report+0x324/0x354
[<
ffff2000083c6114>] __asan_load8+0x24/0x94
[<
ffff2000021d1b34>] u_audio_iso_complete+0x24c/0x520 [u_audio]
[<
ffff20000152fe50>] usb_gadget_giveback_request+0x480/0x4d0 [udc_core]
[<
ffff200001860ab8>] usbhsg_queue_done+0x100/0x130 [renesas_usbhs]
[<
ffff20000185f814>] usbhsf_pkt_handler+0x1a4/0x298 [renesas_usbhs]
[<
ffff20000185fb38>] usbhsf_irq_ready+0x128/0x178 [renesas_usbhs]
[<
ffff200001859cc8>] usbhs_interrupt+0x440/0x490 [renesas_usbhs]
[<
ffff2000081a0288>] __handle_irq_event_percpu+0x594/0xa58
[<
ffff2000081a07d0>] handle_irq_event_percpu+0x84/0x12c
[<
ffff2000081a0928>] handle_irq_event+0xb0/0x10c
[<
ffff2000081a8384>] handle_fasteoi_irq+0x1e0/0x2ec
[<
ffff20000819e5f8>] generic_handle_irq+0x2c/0x44
[<
ffff20000819f0d0>] __handle_domain_irq+0x190/0x194
[<
ffff20000808177c>] gic_handle_irq+0x80/0xac
Exception stack(0xffff200009e97c80 to 0xffff200009e97dc0)
7c80:
0000000000000000 0000000000000000 0000000000000003 ffff200008179298
7ca0:
ffff20000ae1c180 dfff200000000000 0000000000000000 ffff2000081f9a88
7cc0:
ffff200009eb5960 ffff200009e97cf0 0000000000001600 ffff0400041b064b
7ce0:
0000000000000000 0000000000000002 0000000200000001 0000000000000001
7d00:
ffff20000842197c 0000ffff958c4970 0000000000000000 ffff8006da0d5b80
7d20:
ffff8006d4678498 0000000000000000 000000126bde0a8b ffff8006d4678480
7d40:
0000000000000000 000000126bdbea64 ffff200008fd0000 ffff8006fffff980
7d60:
00000000495f0018 ffff200009e97dc0 ffff200008b6c4ec ffff200009e97dc0
7d80:
ffff200008b6c4f0 0000000020000145 ffff8006da0d5b80 ffff8006d4678498
7da0:
ffffffffffffffff ffff8006d4678498 ffff200009e97dc0 ffff200008b6c4f0
[<
ffff200008084034>] el1_irq+0xb4/0x12c
[<
ffff200008b6c4f0>] cpuidle_enter_state+0x818/0x844
[<
ffff200008b6c59c>] cpuidle_enter+0x18/0x20
[<
ffff20000815f2e4>] call_cpuidle+0x98/0x9c
[<
ffff20000815f674>] do_idle+0x214/0x264
[<
ffff20000815facc>] cpu_startup_entry+0x20/0x24
[<
ffff200008fb09d8>] rest_init+0x30c/0x320
[<
ffff2000095f1338>] start_kernel+0x570/0x5b0
---<-snip->---
Change-Id: I1cfbc0de5590fefa2ad069b10df4e6cabc932546
Fixes:
132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver")
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
56bc61587daadef67712068f251c4ef2e3932d94
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Vladimir Zapolskiy [Thu, 21 Jun 2018 15:22:50 +0000 (17:22 +0200)]
usb: gadget: u_audio: remove cached period bytes value
Substream period size potentially can be changed in runtime, however
this is not accounted in the data copying routine, the change replaces
the cached value with an actual value from substream runtime.
As a side effect the change also removes a potential division by zero
in u_audio_iso_complete() function, if there is a race with
uac_pcm_hw_free(), which sets prm->period_size to 0.
Change-Id: I27a98aa61544ba7cfd64be6bc1c2262fe1116598
Fixes:
132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
773e53d50e227b0c03d0bb434c1636f6c49c75b2
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Vladimir Zapolskiy [Thu, 21 Jun 2018 15:22:49 +0000 (17:22 +0200)]
usb: gadget: u_audio: remove caching of stream buffer parameters
There is no necessity to copy PCM stream ring buffer area and size
properties to UAC private data structure, these values can be got
from substream itself.
The change gives more control on substream and avoid stale caching.
Change-Id: I305a3aab7c80efe153cb3e14d060d883d3637ab3
Fixes:
132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
96afb54ece0ee903d23a7ac04ddc461413b972c4
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Joshua Frkuska [Thu, 21 Jun 2018 15:22:48 +0000 (17:22 +0200)]
usb: gadget: u_audio: update hw_ptr in iso_complete after data copied
In u_audio_iso_complete, the runtime hw_ptr is updated before the
data is actually copied over to/from the buffer/dma area. When
ALSA uses this hw_ptr, the data may not actually be available to
be used. This causes trash/stale audio to play/record. This
patch updates the hw_ptr after the data has been copied to avoid
this.
Change-Id: I94736e4ea899ac781076e9c425dda65eed7cc319
Fixes:
132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver")
Signed-off-by: Joshua Frkuska <joshua_frkuska@mentor.com>
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
6b37bd78d30c890e575a1bda22978d1d2a233362
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Eugeniu Rosca [Thu, 21 Jun 2018 15:22:47 +0000 (17:22 +0200)]
usb: gadget: u_audio: fix pcm/card naming in g_audio_setup()
Fix below smatch (
v0.5.0-4443-g69e9094e11c1) warnings:
drivers/usb/gadget/function/u_audio.c:607 g_audio_setup() warn: strcpy() 'pcm_name' of unknown size might be too large for 'pcm->name'
drivers/usb/gadget/function/u_audio.c:614 g_audio_setup() warn: strcpy() 'card_name' of unknown size might be too large for 'card->driver'
drivers/usb/gadget/function/u_audio.c:615 g_audio_setup() warn: strcpy() 'card_name' of unknown size might be too large for 'card->shortname'
Below commits performed a similar 's/strcpy/strlcpy/' rework:
* v2.6.31 commit
8372d4980fbc ("ALSA: ctxfi - Fix PCM device naming")
* v4.14 commit
003d3e70dbeb ("ALSA: ad1848: fix format string overflow warning")
* v4.14 commit
6d8b04de87e1 ("ALSA: cs423x: fix format string overflow warning")
Change-Id: I4d98b36feb40530f3758189d4b0d0643569e6be7
Fixes:
eb9fecb9e69b ("usb: gadget: f_uac2: split out audio core")
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
dfa042fa310caa475667b8c38d852f14439e0b01
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Bhumika Goyal [Sun, 13 Aug 2017 12:43:11 +0000 (18:13 +0530)]
usb: gadget: make snd_pcm_hardware const
Make this const as it is only used during a copy operation.
Done using Coccinelle.
Change-Id: I3db5b880248aeee8f845148093f7d6768db009e6
Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit:
2ab3c34c9c75331143d67042e826bdcde4d6ab37
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Arvind Yadav [Wed, 9 Aug 2017 07:46:51 +0000 (13:16 +0530)]
usb: gadget: f_uac2: constify snd_pcm_ops structures
snd_pcm_ops are not supposed to change at runtime. All functions
working with snd_pcm_ops provided by <sound/pcm.h> work with
const snd_pcm_ops. So mark the non-const structs as const.
Change-Id: Ia05f088487fd410b1567353512e4c3d457aaf96f
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit:
640c0be81b9c33485559e716d914252228361b1c
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Ruslan Bilovol [Sun, 25 Jun 2017 13:23:46 +0000 (16:23 +0300)]
usb: gadget: f_uac1: endianness fixes.
As per USB spec, multiple-bytes fields are stored
in little-endian order. Use CPU<->LE helpers for
such fields.
Change-Id: Iba552e473a39be4adafd641692d5aca12f7adf06
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
42370b821168e6730ec4c7d988aeadc1260c7b4d
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Ajay Agarwal [Tue, 27 Nov 2018 13:49:29 +0000 (19:19 +0530)]
usb: gadget: add f_uac1 variant based on a new u_audio api
This patch adds a new function 'f_uac1'
(f_uac1 with virtual "ALSA card") that
uses recently created u_audio API. Comparing
to legacy f_uac1 function implementation it
doesn't require any real Audio codec to be
present on the device. In f_uac1 audio
streams are simply sinked to and sourced
from a virtual ALSA sound card created
using u_audio API.
Legacy f_uac1 approach is to write audio
samples directly to existing ALSA sound
card
f_uac1 approach is more generic/flexible
one - create an ALSA sound card that
represents USB Audio function and allows to
be used by userspace application that
may choose to do whatever it wants with the
data received from the USB Host and choose
to provide whatever it wants as audio data
to the USB Host.
f_uac1 also has capture support (gadget->host)
thanks to easy implementation via u_audio.
By default, capture interface has 48000kHz/2ch
configuration, same as playback channel has.
f_uac1 descriptors naming convention
uses f_uac2 driver naming convention that
makes it more common and meaningful.
Comparing to f_uac1_legacy, the f_uac1 doesn't
have volume/mute functionality. This is because
the f_uac1 volume/mute feature unit was dummy
implementation since that driver creation (2009)
and never had any real volume control or mute
functionality, so there is no any difference
here.
Since f_uac1 functionality, exposed
interface to userspace (virtual ALSA card),
input parameters are so different comparing
to f_uac1_legacy, that there is no any
reason to keep them in the same file/module,
and separate function was created.
Change-Id: Ib40c144ef0f35ee7d906ce3489f3e7780f3d5e1b
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
0591bc2360152f851e29246884805bb77a2c3b9d
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Ajay Agarwal [Tue, 27 Nov 2018 13:35:32 +0000 (19:05 +0530)]
usb: gadget: function: make current f_uac1 implementation legacy
Before introducing new f_uac1 function (with virtual
ALSA card) make current implementation legacy.
This includes renaming of existing files, some
variables, config options and documentation
Change-Id: Ie3a826f356cc6571ce5967cd0bf8263b630b7249
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
d355339eecd986648420e05f8c958fbc78dbb382
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Ajay Agarwal [Tue, 27 Nov 2018 13:22:44 +0000 (18:52 +0530)]
usb: gadget: split out audio core
Abstract the peripheral side ALSA sound card code into a
component that can be called by various functions, so the
various flavors can be split apart and selectively reused.
Visible changes:
- add uac_params structure to pass audio paramteres for
g_audio_setup
- make ALSA sound card's name configurable
- add [in/out]_ep_maxpsize
- allocate snd_uac_chip structure during g_audio_setup
- add u_audio_[start/stop]_[capture/playback] functions
This change differs from opensource patch in that it does not
modify the UAC2 driver to use u_audio helper file for ALSA
sound card support.
Change-Id: Ia67ec02ed442a67bc359efc2655aa9ba49b79368
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
eb9fecb9e69b0be8c267c55b0bb52a08e8fb6bee
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Ruslan Bilovol [Sat, 17 Jun 2017 21:23:58 +0000 (00:23 +0300)]
usb: gadget: function: f_uac1: implement get_alt()
After commit
7e4da3fcf7c9 ("usb: gadget: composite:
Test get_alt() presence instead of set_alt()") f_uac1
function became broken because it doesn't have
get_alt() callback implementation and composite
framework never set altsetting 1 for audiostreaming
interface. On host site it looks like:
[424339.017711] 21:1:1: usb_set_interface failed (-32)
Since host can't set altsetting 1, it can't start
playing audio.
In order to fix it implemented get_alt along with
minor improvements (error conditions checking)
similar to what existing f_uac2 has.
Change-Id: I0a8371ed74a1b27cbba2261e5dab28c8d4af44b2
Cc: Krzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Git-commit:
1fc4926d92b9515b44f35b339bab5d2ca474a723
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Linux Build Service Account [Thu, 20 Dec 2018 14:51:25 +0000 (06:51 -0800)]
Merge "clk: msm: mmss: Add dev_pm_ops for MMSS PLL for 8996"
Dhoat Harpal [Wed, 17 Jan 2018 18:59:20 +0000 (00:29 +0530)]
soc: qcom: glink: Initialize local state while fetching ctx
Initialization of channel's local state is not done at the time of
fetching context from list of channels. This leads to race condition
if remote close happens during this time. Remote close will check if
local state is not open then delete channel from list. This leads to
use after free scenerio.
Initialize local state at the time of fetching channel context from
list of channels.
CRs-Fixed:
2155992
Change-Id: If113daba129191bd67ef2460eb4e87c2d5614403
Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>
Puneet Yatnal [Thu, 20 Dec 2018 05:05:06 +0000 (10:35 +0530)]
Revert "ARM: dts: msm: Enabled dt entry for bmi160 and iam20680"
BMI160 and IAM20680 sensor driver was used in automotive platform for
dead reckoning solution, reverting the change since QDR no longer
required.
This reverts commit
b7d92272196b67b22a2aeda2080efe268e3609ab.
Change-Id: Id5e41b0fa7f0a145c40e01d1cc9a3869f4688b9a
Signed-off-by: Puneet Yatnal <puneet@codeaurora.org>
Linux Build Service Account [Thu, 20 Dec 2018 07:29:14 +0000 (23:29 -0800)]
Merge "perf: Cancel the mux hrtimer during CPU hotplug to avoid migration"
Linux Build Service Account [Thu, 20 Dec 2018 07:29:13 +0000 (23:29 -0800)]
Merge "msm: adsprpc: Maintain the same structures in kernel and user-space"
Taniya Das [Fri, 13 Jul 2018 06:21:02 +0000 (11:51 +0530)]
clk: msm: mmss: Add dev_pm_ops for MMSS PLL for 8996
Support early resume and late suspend for MMPLLs
to support hibernation. Without this change, the mmplls
were not getting restored to a sane state on the
hibernate resume.
Change-Id: I7edb7219149d2e96a9487cdaf19a0bc4b9ec709f
Signed-off-by: Taniya Das <tdas@codeaurora.org>
Signed-off-by: Siddhartha Agrawal <agrawals@codeaurora.org>
Alistair Strachan [Wed, 19 Dec 2018 23:37:41 +0000 (15:37 -0800)]
ANDROID: Revert fs/squashfs back to linux-4.4.y
Bug:
29521202
Test: local build test only
Change-Id: I117e6e733f0ece85fd4d90604efc4d59fa545464
Signed-off-by: Alistair Strachan <astrachan@google.com>
Linux Build Service Account [Wed, 19 Dec 2018 23:20:24 +0000 (15:20 -0800)]
Merge "ASoC: msm: Group mi2s driver support for msm8996"
Greg Kroah-Hartman [Wed, 19 Dec 2018 15:36:52 +0000 (16:36 +0100)]
Merge 4.4.168 into android-4.4
Changes in 4.4.168
ipv6: Check available headroom in ip6_xmit() even without options
net: 8139cp: fix a BUG triggered by changing mtu with network traffic
net: phy: don't allow __set_phy_supported to add unsupported modes
net: Prevent invalid access to skb->prev in __qdisc_drop_all
rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices
tcp: fix NULL ref in tail loss probe
tun: forbid iface creation with rtnl ops
neighbour: Avoid writing before skb->head in neigh_hh_output()
ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup
ARM: OMAP1: ams-delta: Fix possible use of uninitialized field
sysv: return 'err' instead of 0 in __sysv_write_inode
s390/cpum_cf: Reject request for sampling in event initialization
hwmon: (ina2xx) Fix current value calculation
ASoC: dapm: Recalculate audio map forcely when card instantiated
hwmon: (w83795) temp4_type has writable permission
Btrfs: send, fix infinite loop due to directory rename dependencies
ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE
ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE
exportfs: do not read dentry after free
bpf: fix check of allowed specifiers in bpf_trace_printk
USB: omap_udc: use devm_request_irq()
USB: omap_udc: fix crashes on probe error and module removal
USB: omap_udc: fix omap_udc_start() on 15xx machines
USB: omap_udc: fix USB gadget functionality on Palm Tungsten E
KVM: x86: fix empty-body warnings
net: thunderx: fix NULL pointer dereference in nic_remove
ixgbe: recognize 1000BaseLX SFP modules as 1Gbps
net: hisilicon: remove unexpected free_netdev
drm/ast: fixed reading monitor EDID not stable issue
xen: xlate_mmu: add missing header to fix 'W=1' warning
fscache: fix race between enablement and dropping of object
fscache, cachefiles: remove redundant variable 'cache'
ocfs2: fix deadlock caused by ocfs2_defrag_extent()
hfs: do not free node before using
hfsplus: do not free node before using
debugobjects: avoid recursive calls with kmemleak
ocfs2: fix potential use after free
pstore: Convert console write to use ->write_buf
ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
KVM: nVMX: fix msr bitmaps to prevent L2 from accessing L0 x2APIC
KVM: nVMX: mark vmcs12 pages dirty on L2 exit
KVM: nVMX: Eliminate vmcs02 pool
KVM: VMX: introduce alloc_loaded_vmcs
KVM: VMX: make MSR bitmaps per-VCPU
KVM/x86: Add IBPB support
KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES
KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL
KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL
KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
x86: reorganize SMAP handling in user space accesses
x86: fix SMAP in 32-bit environments
x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec
x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end}
x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec
x86/bugs, KVM: Support the combination of guest and host IBRS
x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest
KVM: SVM: Move spec control call after restore of GS
x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL
x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP
KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD
bpf: support 8-byte metafield access
bpf/verifier: Add spi variable to check_stack_write()
bpf/verifier: Pass instruction index to check_mem_access() and check_xadd()
bpf: Prevent memory disambiguation attack
wil6210: missing length check in wmi_set_ie
posix-timers: Sanitize overrun handling
mm/hugetlb.c: don't call region_abort if region_chg fails
hugetlbfs: fix offset overflow in hugetlbfs mmap
hugetlbfs: check for pgoff value overflow
hugetlbfs: fix bug in pgoff overflow checking
swiotlb: clean up reporting
sr: pass down correctly sized SCSI sense buffer
mm: remove write/force parameters from __get_user_pages_locked()
mm: remove write/force parameters from __get_user_pages_unlocked()
mm/nommu.c: Switch __get_user_pages_unlocked() to use __get_user_pages()
mm: replace get_user_pages_unlocked() write/force parameters with gup_flags
mm: replace get_user_pages_locked() write/force parameters with gup_flags
mm: replace get_vaddr_frames() write/force parameters with gup_flags
mm: replace get_user_pages() write/force parameters with gup_flags
mm: replace __access_remote_vm() write parameter with gup_flags
mm: replace access_remote_vm() write parameter with gup_flags
proc: don't use FOLL_FORCE for reading cmdline and environment
proc: do not access cmdline nor environ from file-backed areas
media: dvb-frontends: fix i2c access helpers for KASAN
matroxfb: fix size of memcpy
staging: speakup: Replace strncpy with memcpy
rocker: fix rocker_tlv_put_* functions for KASAN
selftests: Move networking/timestamping from Documentation
Linux 4.4.168
Change-Id: I71a633f645fada4b473abcff660a9ada3103592b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Cong Tang [Tue, 27 Nov 2018 09:20:39 +0000 (17:20 +0800)]
ASoC: msm: Group mi2s driver support for msm8996
Support group mi2s driver for sec/tert/quat mi2s interface in
msm8996.
Change-Id: I656612ca104c80770e316bc4d541d2ae56164e61
Signed-off-by: Cong Tang <congt@codeaurora.org>
Linux Build Service Account [Wed, 19 Dec 2018 00:11:27 +0000 (16:11 -0800)]
Merge "Merge android-4.4.167 (
ad9ce19) into msm-4.4"
Linux Build Service Account [Tue, 18 Dec 2018 17:07:03 +0000 (09:07 -0800)]
Merge "ARM: dts: msm: Update mi2s group port id for msm8996"
Linux Build Service Account [Tue, 18 Dec 2018 17:07:02 +0000 (09:07 -0800)]
Merge "ARM: dts: msm: Add dt node for earlydomain"
E V Ravi [Tue, 18 Dec 2018 09:11:59 +0000 (14:41 +0530)]
msm: ais: Fix for OOB security CR
If the user passes the arbitrary command with _IOC_DIR(cmd) == _IOC_NONE,
"arg" should point to any arbitrary address.
Check for invalid command and return error.
CRs-Fixed:
2299567
Change-Id: Ibd77adfe53ef0777ff4eb96c914e21f43dfd6749
Signed-off-by: E V Ravi <evenka@codeaurora.org>
Linux Build Service Account [Tue, 18 Dec 2018 10:51:50 +0000 (02:51 -0800)]
Merge "drm: msm: sde: reorder call sequence in splash release thread"
Linux Build Service Account [Tue, 18 Dec 2018 10:51:49 +0000 (02:51 -0800)]
Merge "Revert "ARM: dts: msm: Disable runtime PM in host mode for automotive""
Linux Build Service Account [Tue, 18 Dec 2018 10:51:46 +0000 (02:51 -0800)]
Merge "drm: msm: sde: Update splash handoff with new APIs"
E V Ravi [Tue, 18 Dec 2018 08:29:19 +0000 (13:59 +0530)]
msm: ais: Update request from kernel to lk
Updating early shutdown request from kernel to lk
Change-Id: I398e278c683340dbe501f78e0f2aa902c9cdf606
Signed-off-by: E V Ravi <evenka@codeaurora.org>
Vivek Kumar [Mon, 10 Dec 2018 12:49:17 +0000 (18:19 +0530)]
ARM: dts: msm: Add dt node for earlydomain
Add DT node for early domain driver for msm8996 cdp
boards and remove reserved memory node for lk_pool
as it will be populated by bootloader if early domain
is enabled.
Change-Id: Iedcb4b47544a2355e98429a786d246351fdca75e
Signed-off-by: Vivek Kumar <vivekuma@codeaurora.org>
Tharun Kumar Merugu [Mon, 17 Dec 2018 08:32:07 +0000 (14:02 +0530)]
msm: adsprpc: Maintain the same structures in kernel and user-space
Mismatch in structures in user-space and kernel is leading to
unknown ioctl code and leading to failure in FASTRPC_IOCTL_CONTROL call.
Change-Id: I38537f128dc9a2815c1a98ec4ee59b2265c9159c
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
Greg Kroah-Hartman [Mon, 17 Dec 2018 20:55:18 +0000 (21:55 +0100)]
Linux 4.4.168