Skip to content
Snippets Groups Projects
  1. Jun 07, 2019
  2. Jun 06, 2019
    • Maxime Chevallier's avatar
      net: mvpp2: Use strscpy to handle stat strings · d37acd5a
      Maxime Chevallier authored
      
      Use a safe strscpy call to copy the ethtool stat strings into the
      relevant buffers, instead of a memcpy that will be accessing
      out-of-bound data.
      
      Fixes: 118d6298 ("net: mvpp2: add ethtool GOP statistics")
      Signed-off-by: default avatarMaxime Chevallier <maxime.chevallier@bootlin.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d37acd5a
    • Max Gurtovoy's avatar
      nvme-rdma: use dynamic dma mapping per command · 62f99b62
      Max Gurtovoy authored
      
      Commit 87fd1253 ("nvme-rdma: remove redundant reference between
      ib_device and tagset") caused a kernel panic when disconnecting from an
      inaccessible controller (disconnect during re-connection).
      
      --
      nvme nvme0: Removing ctrl: NQN "testnqn1"
      nvme_rdma: nvme_rdma_exit_request: hctx 0 queue_idx 1
      BUG: unable to handle kernel paging request at 0000000080000228
      PGD 0 P4D 0
      Oops: 0000 [#1] SMP PTI
      ...
      Call Trace:
       blk_mq_exit_hctx+0x5c/0xf0
       blk_mq_exit_queue+0xd4/0x100
       blk_cleanup_queue+0x9a/0xc0
       nvme_rdma_destroy_io_queues+0x52/0x60 [nvme_rdma]
       nvme_rdma_shutdown_ctrl+0x3e/0x80 [nvme_rdma]
       nvme_do_delete_ctrl+0x53/0x80 [nvme_core]
       nvme_sysfs_delete+0x45/0x60 [nvme_core]
       kernfs_fop_write+0x105/0x180
       vfs_write+0xad/0x1a0
       ksys_write+0x5a/0xd0
       do_syscall_64+0x55/0x110
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      RIP: 0033:0x7fa215417154
      --
      
      The reason for this crash is accessing an already freed ib_device for
      performing dma_unmap during exit_request commands. The root cause for
      that is that during re-connection all the queues are destroyed and
      re-created (and the ib_device is reference counted by the queues and
      freed as well) but the tagset stays alive and all the DMA mappings (that
      we perform in init_request) kept in the request context. The original
      commit fixed a different bug that was introduced during bonding (aka nic
      teaming) tests that for some scenarios change the underlying ib_device
      and caused memory leakage and possible segmentation fault. This commit
      is a complementary commit that also changes the wrong DMA mappings that
      were saved in the request context and making the request sqe dma
      mappings dynamic with the command lifetime (i.e. mapped in .queue_rq and
      unmapped in .complete). It also fixes the above crash of accessing freed
      ib_device during destruction of the tagset.
      
      Fixes: 87fd1253 ("nvme-rdma: remove redundant reference between ib_device and tagset")
      Reported-by: default avatarJim Harris <james.r.harris@intel.com>
      Suggested-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Tested-by: default avatarJim Harris <james.r.harris@intel.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarMax Gurtovoy <maxg@mellanox.com>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      62f99b62
    • Jaesoo Lee's avatar
      nvme: Fix u32 overflow in the number of namespace list calculation · c8e8c77b
      Jaesoo Lee authored
      
      The Number of Namespaces (nn) field in the identify controller data structure is
      defined as u32 and the maximum allowed value in NVMe specification is
      0xFFFFFFFEUL. This change fixes the possible overflow of the DIV_ROUND_UP()
      operation used in nvme_scan_ns_list() by casting the nn to u64.
      
      Signed-off-by: default avatarJaesoo Lee <jalee@purestorage.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      c8e8c77b
    • John David Anglin's avatar
      parisc: Use lpa instruction to load physical addresses in driver code · 116d7533
      John David Anglin authored
      
      Most I/O in the kernel is done using the kernel offset mapping.
      However, there is one API that uses aliased kernel address ranges:
      
      > The final category of APIs is for I/O to deliberately aliased address
      > ranges inside the kernel.  Such aliases are set up by use of the
      > vmap/vmalloc API.  Since kernel I/O goes via physical pages, the I/O
      > subsystem assumes that the user mapping and kernel offset mapping are
      > the only aliases.  This isn't true for vmap aliases, so anything in
      > the kernel trying to do I/O to vmap areas must manually manage
      > coherency.  It must do this by flushing the vmap range before doing
      > I/O and invalidating it after the I/O returns.
      
      For this reason, we should use the hardware lpa instruction to load the
      physical address of kernel virtual addresses in the driver code.
      
      I believe we only use the vmap/vmalloc API with old PA 1.x processors
      which don't have a sba, so we don't hit this problem.
      
      Tested on c3750, c8000 and rp3440.
      
      Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      116d7533
    • John David Anglin's avatar
      parisc: Use implicit space register selection for loading the coherence index of I/O pdirs · 63923d2c
      John David Anglin authored
      
      We only support I/O to kernel space. Using %sr1 to load the coherence
      index may be racy unless interrupts are disabled. This patch changes the
      code used to load the coherence index to use implicit space register
      selection. This saves one instruction and eliminates the race.
      
      Tested on rp3440, c8000 and c3750.
      
      Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      63923d2c
    • Dan Carpenter's avatar
      drm/komeda: Potential error pointer dereference · 6d10dc61
      Dan Carpenter authored and Liviu Dudau's avatar Liviu Dudau committed
      
      We need to check whether drm_atomic_get_crtc_state() returns an error
      pointer before dereferencing "crtc_st".
      
      Fixes: 9e560309 ("drm/komeda: Add komeda_plane/plane_helper_funcs")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatar"james qian wang (Arm Technology China)" <james.qian.wang@arm.com>
      Signed-off-by: default avatarLiviu Dudau <liviu.dudau@arm.com>
      6d10dc61
    • YueHaibing's avatar
      drm/komeda: remove set but not used variable 'kcrtc' · 7cb8bec2
      YueHaibing authored and Liviu Dudau's avatar Liviu Dudau committed
      
      Fixes gcc '-Wunused-but-set-variable' warning:
      
      drivers/gpu/drm/arm/display/komeda/komeda_plane.c: In function komeda_plane_atomic_check:
      drivers/gpu/drm/arm/display/komeda/komeda_plane.c:49:22: warning: variable kcrtc set but not used [-Wunused-but-set-variable]
      
      It is never used since introduction in
      commit 9e560309 ("drm/komeda: Add komeda_plane/plane_helper_funcs")
      
      Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
      Reviewed-by: default avatarJames Qian Wang (Arm Technology China) <james.qian.wang@arm.com>
      Signed-off-by: default avatarLiviu Dudau <liviu.dudau@arm.com>
      7cb8bec2
    • Robert Hancock's avatar
      hwmon: (pmbus/core) Treat parameters as paged if on multiple pages · 4a60570d
      Robert Hancock authored
      
      Some chips have attributes which exist on more than one page but the
      attribute is not presently marked as paged. This causes the attributes
      to be generated with the same label, which makes it impossible for
      userspace to tell them apart.
      
      Marking all such attributes as paged would result in the page suffix
      being added regardless of whether they were present on more than one
      page or not, which might break existing setups. Therefore, we add a
      second check which treats the attribute as paged, even if not marked as
      such, if it is present on multiple pages.
      
      Fixes: b4ce237b ("hwmon: (pmbus) Introduce infrastructure to detect sensors and limit registers")
      Signed-off-by: default avatarRobert Hancock <hancock@sedsystems.ca>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      4a60570d
    • Adamski, Krzysztof (Nokia - PL/Wroclaw)'s avatar
      hwmon: (pmbus/core) mutex_lock write in pmbus_set_samples · 38463721
      
      update_lock is a mutex intended to protect write operations. It was not
      taken, however, when _pmbus_write_word_data is called from
      pmbus_set_samples() function which may cause problems especially when
      some PMBUS_VIRT_* operation is implemented as a read-modify-write cycle.
      
      This patch makes sure the lock is held during the operation.
      
      Fixes: 49c4455d ("hwmon: (pmbus) Introduce PMBUS_VIRT_*_SAMPLES registers")
      Signed-off-by: default avatarKrzysztof Adamski <krzysztof.adamski@nokia.com>
      Reviewed-by: default avatarAlexander Sverdlin <alexander.sverdlin@nokia.com>
      [groeck: Declared and initialized missing 'data' variable]
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      38463721
    • Eduardo Valentin's avatar
      hwmon: (core) add thermal sensors only if dev->of_node is present · c41dd48e
      Eduardo Valentin authored
      
      Drivers may register to hwmon and request for also registering
      with the thermal subsystem (HWMON_C_REGISTER_TZ). However,
      some of these driver, e.g. marvell phy, may be probed from
      Device Tree or being dynamically allocated, and in the later
      case, it will not have a dev->of_node entry.
      
      Registering with hwmon without the dev->of_node may result in
      different outcomes depending on the device tree, which may
      be a bit misleading. If the device tree blob has no 'thermal-zones'
      node, the *hwmon_device_register*() family functions are going
      to gracefully succeed, because of-thermal,
      *thermal_zone_of_sensor_register() return -ENODEV in this case,
      and the hwmon error path handles this error code as success to
      cover for the case where CONFIG_THERMAL_OF is not set.
      However, if the device tree blob has the 'thermal-zones'
      entry, the *hwmon_device_register*() will always fail on callers
      with no dev->of_node, propagating -EINVAL.
      
      If dev->of_node is not present, calling of-thermal does not
      make sense. For this reason, this patch checks first if the
      device has a of_node before going over the process of registering
      with the thermal subsystem of-thermal interface. And in this case,
      when a caller of *hwmon_device_register*() with HWMON_C_REGISTER_TZ
      and no dev->of_node will still register with hwmon, but not with
      the thermal subsystem. If all the hwmon part bits are in place,
      the registration will succeed.
      
      Fixes: d560168b ("hwmon: (core) New hwmon registration API")
      Cc: Jean Delvare <jdelvare@suse.com>
      Cc: Guenter Roeck <linux@roeck-us.net>
      Cc: linux-hwmon@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarEduardo Valentin <eduval@amazon.com>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      c41dd48e
    • Nikita Danilov's avatar
      net: aquantia: fix wol configuration not applied sometimes · 930b9a05
      Nikita Danilov authored
      
      WoL magic packet configuration sometimes does not work due to
      couple of leakages found.
      
      Mainly there was a regression introduced during readx_poll refactoring.
      
      Next, fw request waiting time was too small. Sometimes that
      caused sleep proxy config function to return with an error
      and to skip WoL configuration.
      At last, WoL data were passed to FW from not clean buffer.
      That could cause FW to accept garbage as a random configuration data.
      
      Fixes: 6a7f2277 ("net: aquantia: replace AQ_HW_WAIT_FOR with readx_poll_timeout_atomic")
      Signed-off-by: default avatarNikita Danilov <nikita.danilov@aquantia.com>
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      930b9a05
  3. Jun 05, 2019
Loading