1. 25 Jun, 2020 40 commits
    • Qais Yousef's avatar
      usb/ohci-platform: Fix a warning when hibernating · c83258a7
      Qais Yousef authored
      [ Upstream commit 1cb3b009 ]
      
      The following warning was observed when attempting to suspend to disk
      using a USB flash as a swap device.
      
      [  111.779649] ------------[ cut here ]------------
      [  111.788382] URB (____ptrval____) submitted while active
      [  111.796646] WARNING: CPU: 3 PID: 365 at drivers/usb/core/urb.c:363 usb_submit_urb+0x3d8/0x590
      [  111.805417] Modules linked in:
      [  111.808584] CPU: 3 PID: 365 Comm: kworker/3:2 Not tainted 5.6.0-rc6-00002-gdfd1731f9a3e-dirty #545
      [  111.817796] Hardware name: ARM Juno development board (r2) (DT)
      [  111.823896] Workqueue: usb_hub_wq hub_event
      [  111.828217] pstate: 60000005 (nZCv daif -PAN -UAO)
      [  111.833156] pc : usb_submit_urb+0x3d8/0x590
      [  111.837471] lr : usb_submit_urb+0x3d8/0x590
      [  111.841783] sp : ffff800018de38b0
      [  111.845205] x29: ffff800018de38b0 x28: 0000000000000003
      [  111.850682] x27: ffff000970530b20 x26: ffff8000133fd000
      [  111.856159] x25: ffff8000133fd000 x24: ffff800018de3b38
      [  111.861635] x23: 0000000000000004 x22: 0000000000000c00
      [  111.867112] x21: 0000000000000000 x20: 00000000fffffff0
      [  111.872589] x19: ffff0009704e7a00 x18: ffffffffffffffff
      [  111.878065] x17: 00000000a7c8f4bc x16: 000000002af33de8
      [  111.883542] x15: ffff8000133fda88 x14: 0720072007200720
      [  111.889019] x13: 0720072007200720 x12: 0720072007200720
      [  111.894496] x11: 0000000000000000 x10: 00000000a5286134
      [  111.899973] x9 : 0000000000000002 x8 : ffff000970c837a0
      [  111.905449] x7 : 0000000000000000 x6 : ffff800018de3570
      [  111.910926] x5 : 0000000000000001 x4 : 0000000000000003
      [  111.916401] x3 : 0000000000000000 x2 : ffff800013427118
      [  111.921879] x1 : 9d4e965b4b7d7c00 x0 : 0000000000000000
      [  111.927356] Call trace:
      [  111.929892]  usb_submit_urb+0x3d8/0x590
      [  111.933852]  hub_activate+0x108/0x7f0
      [  111.937633]  hub_resume+0xac/0x148
      [  111.941149]  usb_resume_interface.isra.10+0x60/0x138
      [  111.946265]  usb_resume_both+0xe4/0x140
      [  111.950225]  usb_runtime_resume+0x24/0x30
      [  111.954365]  __rpm_callback+0xdc/0x138
      [  111.958236]  rpm_callback+0x34/0x98
      [  111.961841]  rpm_resume+0x4a8/0x720
      [  111.965445]  rpm_resume+0x50c/0x720
      [  111.969049]  __pm_runtime_resume+0x4c/0xb8
      [  111.973276]  usb_autopm_get_interface+0x28/0x60
      [  111.977948]  hub_event+0x80/0x16d8
      [  111.981466]  process_one_work+0x2a4/0x748
      [  111.985604]  worker_thread+0x48/0x498
      [  111.989387]  kthread+0x13c/0x140
      [  111.992725]  ret_from_fork+0x10/0x18
      [  111.996415] irq event stamp: 354
      [  111.999756] hardirqs last  enabled at (353): [<ffff80001019ea1c>] console_unlock+0x504/0x5b8
      [  112.008441] hardirqs last disabled at (354): [<ffff8000100a95d0>] do_debug_exception+0x1a8/0x258
      [  112.017479] softirqs last  enabled at (350): [<ffff8000100818a4>] __do_softirq+0x4bc/0x568
      [  112.025984] softirqs last disabled at (343): [<ffff8000101145a4>] irq_exit+0x144/0x150
      [  112.034129] ---[ end trace dc96030b9cf6c8a3 ]---
      
      The problem was tracked down to a missing call to
      pm_runtime_set_active() on resume in ohci-platform.
      
      Link: https://lore.kernel.org/lkml/20200323143857.db5zphxhq4hz3hmd@e107158-lin.cambridge.arm.com/Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarQais Yousef <qais.yousef@arm.com>
      CC: Tony Prisk <linux@prisktech.co.nz>
      CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      CC: Mathias Nyman <mathias.nyman@intel.com>
      CC: Oliver Neukum <oneukum@suse.de>
      CC: linux-arm-kernel@lists.infradead.org
      CC: linux-usb@vger.kernel.org
      CC: linux-kernel@vger.kernel.org
      Link: https://lore.kernel.org/r/20200518154931.6144-1-qais.yousef@arm.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c83258a7
    • Alex Williamson's avatar
      vfio-pci: Mask cap zero · e9aaff2b
      Alex Williamson authored
      [ Upstream commit bc138db1 ]
      
      The PCI Code and ID Assignment Specification changed capability ID 0
      from reserved to a NULL capability in the v1.1 revision.  The NULL
      capability is defined to include only the 16-bit capability header,
      ie. only the ID and next pointer.  Unfortunately vfio-pci creates a
      map of config space, where ID 0 is used to reserve the standard type
      0 header.  Finding an actual capability with this ID therefore results
      in a bogus range marked in that map and conflicts with subsequent
      capabilities.  As this seems to be a dummy capability anyway and we
      already support dropping capabilities, let's hide this one rather than
      delving into the potentially subtle dependencies within our map.
      
      Seen on an NVIDIA Tesla T4.
      Reviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e9aaff2b
    • Geoff Levand's avatar
      powerpc/ps3: Fix kexec shutdown hang · 020d0e37
      Geoff Levand authored
      [ Upstream commit 12655446 ]
      
      The ps3_mm_region_destroy() and ps3_mm_vas_destroy() routines
      are called very late in the shutdown via kexec's mmu_cleanup_all
      routine.  By the time mmu_cleanup_all runs it is too late to use
      udbg_printf, and calling it will cause PS3 systems to hang.
      
      Remove all debugging statements from ps3_mm_region_destroy() and
      ps3_mm_vas_destroy() and replace any error reporting with calls
      to lv1_panic.
      
      With this change builds with 'DEBUG' defined will not cause kexec
      reboots to hang, and builds with 'DEBUG' defined or not will end
      in lv1_panic if an error is encountered.
      Signed-off-by: default avatarGeoff Levand <geoff@infradead.org>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/7325c4af2b4c989c19d6a26b90b1fec9c0615ddf.1589049250.git.geoff@infradead.orgSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      020d0e37
    • Nicholas Piggin's avatar
      powerpc/pseries/ras: Fix FWNMI_VALID off by one · 45a4f5d3
      Nicholas Piggin authored
      [ Upstream commit deb70f7a ]
      
      This was discovered developing qemu fwnmi sreset support. This
      off-by-one bug means the last 16 bytes of the rtas area can not
      be used for a 16 byte save area.
      
      It's not a serious bug, and QEMU implementation has to retain a
      workaround for old kernels, but it's good to tighten it.
      Signed-off-by: default avatarNicholas Piggin <npiggin@gmail.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Acked-by: default avatarMahesh Salgaonkar <mahesh@linux.ibm.com>
      Link: https://lore.kernel.org/r/20200508043408.886394-7-npiggin@gmail.comSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      45a4f5d3
    • Feng Tang's avatar
      ipmi: use vzalloc instead of kmalloc for user creation · 1d9c47a3
      Feng Tang authored
      [ Upstream commit 7c47a219 ]
      
      We met mulitple times of failure of staring bmc-watchdog,
      due to the runtime memory allocation failure of order 4.
      
           bmc-watchdog: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1
           CPU: 1 PID: 2571 Comm: bmc-watchdog Not tainted 5.5.0-00045-g7d6bb61d6188c #1
           Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.00.01.0015.110720180833 11/07/2018
           Call Trace:
            dump_stack+0x66/0x8b
            warn_alloc+0xfe/0x160
            __alloc_pages_slowpath+0xd3e/0xd80
            __alloc_pages_nodemask+0x2f0/0x340
            kmalloc_order+0x18/0x70
            kmalloc_order_trace+0x1d/0xb0
            ipmi_create_user+0x55/0x2c0 [ipmi_msghandler]
            ipmi_open+0x72/0x110 [ipmi_devintf]
            chrdev_open+0xcb/0x1e0
            do_dentry_open+0x1ce/0x380
            path_openat+0x305/0x14f0
            do_filp_open+0x9b/0x110
            do_sys_open+0x1bd/0x250
            do_syscall_64+0x5b/0x1f0
            entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Using vzalloc/vfree for creating ipmi_user heals the
      problem
      
      Thanks to Stephen Rothwell for finding the vmalloc.h
      inclusion issue.
      Signed-off-by: default avatarFeng Tang <feng.tang@intel.com>
      Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      1d9c47a3
    • Cristian Klein's avatar
      HID: Add quirks for Trust Panora Graphic Tablet · 5a5b485c
      Cristian Klein authored
      [ Upstream commit fb68ada8 ]
      
      The Trust Panora Graphic Tablet has two interfaces. Interface zero reports pen
      movement, pen pressure and pen buttons. Interface one reports tablet buttons
      and tablet scroll. Both use the mouse protocol.
      
      Without these quirks, libinput gets confused about what device it talks to.
      
      For completeness, here is the usbhid-dump:
      
      ```
      $ sudo usbhid-dump -d 145f:0212
      003:013:001:DESCRIPTOR         1588949402.559961
       05 0D 09 01 A1 01 85 07 A1 02 09 00 75 08 95 07
       81 02 C0 C0 09 0E A1 01 85 05 09 23 A1 02 09 52
       09 53 25 0A 75 08 95 02 B1 02 C0 C0 05 0C 09 36
       A1 00 85 06 05 09 19 01 29 20 15 00 25 01 95 20
       75 01 81 02 C0
      
      003:013:000:DESCRIPTOR         1588949402.563942
       05 01 09 02 A1 01 85 08 09 01 A1 00 05 09 19 01
       29 03 15 00 25 01 95 03 75 01 81 02 95 05 81 01
       05 01 09 30 09 31 09 38 09 00 15 81 25 7F 75 08
       95 04 81 06 C0 C0 05 01 09 02 A1 01 85 09 09 01
       A1 00 05 09 19 01 29 03 15 00 25 01 95 03 75 01
       81 02 95 05 81 01 05 01 09 30 09 31 26 FF 7F 95
       02 75 10 81 02 05 0D 09 30 26 FF 03 95 01 75 10
       81 02 C0 C0 05 01 09 00 A1 01 85 04 A1 00 26 FF
       00 09 00 75 08 95 07 B1 02 C0 C0
      ```
      Signed-off-by: default avatarCristian Klein <cristian.klein@elastisys.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5a5b485c
    • Gregory CLEMENT's avatar
      tty: n_gsm: Fix waking up upper tty layer when room available · d1ceda6f
      Gregory CLEMENT authored
      [ Upstream commit 01dbb362 ]
      
      Warn the upper layer when n_gms is ready to receive data
      again. Without this the associated virtual tty remains blocked
      indefinitely.
      
      Fixes: e1eaea46 ("tty: n_gsm line discipline")
      Signed-off-by: default avatarGregory CLEMENT <gregory.clement@bootlin.com>
      Link: https://lore.kernel.org/r/20200512115323.1447922-4-gregory.clement@bootlin.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      d1ceda6f
    • Gregory CLEMENT's avatar
      tty: n_gsm: Fix SOF skipping · 56e3912e
      Gregory CLEMENT authored
      [ Upstream commit 84d6f81c ]
      
      For at least some modems like the TELIT LE910, skipping SOF makes
      transfers blocking indefinitely after a short amount of data
      transferred.
      
      Given the small improvement provided by skipping the SOF (just one
      byte on about 100 bytes), it seems better to completely remove this
      "feature" than make it optional.
      
      Fixes: e1eaea46 ("tty: n_gsm line discipline")
      Signed-off-by: default avatarGregory CLEMENT <gregory.clement@bootlin.com>
      Link: https://lore.kernel.org/r/20200512115323.1447922-3-gregory.clement@bootlin.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      56e3912e
    • Michael Ellerman's avatar
      powerpc/64: Don't initialise init_task->thread.regs · 615e2d0b
      Michael Ellerman authored
      [ Upstream commit 7ffa8b7d ]
      
      Aneesh increased the size of struct pt_regs by 16 bytes and started
      seeing this WARN_ON:
      
        smp: Bringing up secondary CPUs ...
        ------------[ cut here ]------------
        WARNING: CPU: 0 PID: 0 at arch/powerpc/kernel/process.c:455 giveup_all+0xb4/0x110
        Modules linked in:
        CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-rc2-gcc-8.2.0-1.g8f6a41f-default+ #318
        NIP:  c00000000001a2b4 LR: c00000000001a29c CTR: c0000000031d0000
        REGS: c0000000026d3980 TRAP: 0700   Not tainted  (5.7.0-rc2-gcc-8.2.0-1.g8f6a41f-default+)
        MSR:  800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 48048224  XER: 00000000
        CFAR: c000000000019cc8 IRQMASK: 1
        GPR00: c00000000001a264 c0000000026d3c20 c0000000026d7200 800000000280b033
        GPR04: 0000000000000001 0000000000000000 0000000000000077 30206d7372203164
        GPR08: 0000000000002000 0000000002002000 800000000280b033 3230303030303030
        GPR12: 0000000000008800 c0000000031d0000 0000000000800050 0000000002000066
        GPR16: 000000000309a1a0 000000000309a4b0 000000000309a2d8 000000000309a890
        GPR20: 00000000030d0098 c00000000264da40 00000000fd620000 c0000000ff798080
        GPR24: c00000000264edf0 c0000001007469f0 00000000fd620000 c0000000020e5e90
        GPR28: c00000000264edf0 c00000000264d200 000000001db60000 c00000000264d200
        NIP [c00000000001a2b4] giveup_all+0xb4/0x110
        LR [c00000000001a29c] giveup_all+0x9c/0x110
        Call Trace:
        [c0000000026d3c20] [c00000000001a264] giveup_all+0x64/0x110 (unreliable)
        [c0000000026d3c90] [c00000000001ae34] __switch_to+0x104/0x480
        [c0000000026d3cf0] [c000000000e0b8a0] __schedule+0x320/0x970
        [c0000000026d3dd0] [c000000000e0c518] schedule_idle+0x38/0x70
        [c0000000026d3df0] [c00000000019c7c8] do_idle+0x248/0x3f0
        [c0000000026d3e70] [c00000000019cbb8] cpu_startup_entry+0x38/0x40
        [c0000000026d3ea0] [c000000000011bb0] rest_init+0xe0/0xf8
        [c0000000026d3ed0] [c000000002004820] start_kernel+0x990/0x9e0
        [c0000000026d3f90] [c00000000000c49c] start_here_common+0x1c/0x400
      
      Which was unexpected. The warning is checking the thread.regs->msr
      value of the task we are switching from:
      
        usermsr = tsk->thread.regs->msr;
        ...
        WARN_ON((usermsr & MSR_VSX) && !((usermsr & MSR_FP) && (usermsr & MSR_VEC)));
      
      ie. if MSR_VSX is set then both of MSR_FP and MSR_VEC are also set.
      
      Dumping tsk->thread.regs->msr we see that it's: 0x1db60000
      
      Which is not a normal looking MSR, in fact the only valid bit is
      MSR_VSX, all the other bits are reserved in the current definition of
      the MSR.
      
      We can see from the oops that it was swapper/0 that we were switching
      from when we hit the warning, ie. init_task. So its thread.regs points
      to the base (high addresses) in init_stack.
      
      Dumping the content of init_task->thread.regs, with the members of
      pt_regs annotated (the 16 bytes larger version), we see:
      
        0000000000000000 c000000002780080    gpr[0]     gpr[1]
        0000000000000000 c000000002666008    gpr[2]     gpr[3]
        c0000000026d3ed0 0000000000000078    gpr[4]     gpr[5]
        c000000000011b68 c000000002780080    gpr[6]     gpr[7]
        0000000000000000 0000000000000000    gpr[8]     gpr[9]
        c0000000026d3f90 0000800000002200    gpr[10]    gpr[11]
        c000000002004820 c0000000026d7200    gpr[12]    gpr[13]
        000000001db60000 c0000000010aabe8    gpr[14]    gpr[15]
        c0000000010aabe8 c0000000010aabe8    gpr[16]    gpr[17]
        c00000000294d598 0000000000000000    gpr[18]    gpr[19]
        0000000000000000 0000000000001ff8    gpr[20]    gpr[21]
        0000000000000000 c00000000206d608    gpr[22]    gpr[23]
        c00000000278e0cc 0000000000000000    gpr[24]    gpr[25]
        000000002fff0000 c000000000000000    gpr[26]    gpr[27]
        0000000002000000 0000000000000028    gpr[28]    gpr[29]
        000000001db60000 0000000004750000    gpr[30]    gpr[31]
        0000000002000000 000000001db60000    nip        msr
        0000000000000000 0000000000000000    orig_r3    ctr
        c00000000000c49c 0000000000000000    link       xer
        0000000000000000 0000000000000000    ccr        softe
        0000000000000000 0000000000000000    trap       dar
        0000000000000000 0000000000000000    dsisr      result
        0000000000000000 0000000000000000    ppr        kuap
        0000000000000000 0000000000000000    pad[2]     pad[3]
      
      This looks suspiciously like stack frames, not a pt_regs. If we look
      closely we can see return addresses from the stack trace above,
      c000000002004820 (start_kernel) and c00000000000c49c (start_here_common).
      
      init_task->thread.regs is setup at build time in processor.h:
      
        #define INIT_THREAD  { \
        	.ksp = INIT_SP, \
        	.regs = (struct pt_regs *)INIT_SP - 1, /* XXX bogus, I think */ \
      
      The early boot code where we setup the initial stack is:
      
        LOAD_REG_ADDR(r3,init_thread_union)
      
        /* set up a stack pointer */
        LOAD_REG_IMMEDIATE(r1,THREAD_SIZE)
        add	r1,r3,r1
        li	r0,0
        stdu	r0,-STACK_FRAME_OVERHEAD(r1)
      
      Which creates a stack frame of size 112 bytes (STACK_FRAME_OVERHEAD).
      Which is far too small to contain a pt_regs.
      
      So the result is init_task->thread.regs is pointing at some stack
      frames on the init stack, not at a pt_regs.
      
      We have gotten away with this for so long because with pt_regs at its
      current size the MSR happens to point into the first frame, at a
      location that is not written to by the early asm. With the 16 byte
      expansion the MSR falls into the second frame, which is used by the
      compiler, and collides with a saved register that tends to be
      non-zero.
      
      As far as I can see this has been wrong since the original merge of
      64-bit ppc support, back in 2002.
      
      Conceptually swapper should have no regs, it never entered from
      userspace, and in fact that's what we do on 32-bit. It's also
      presumably what the "bogus" comment is referring to.
      
      So I think the right fix is to just not-initialise regs at all. I'm
      slightly worried this will break some code that isn't prepared for a
      NULL regs, but we'll have to see.
      
      Remove the comment in head_64.S which refers to us setting up the
      regs (even though we never did), and is otherwise not really accurate
      any more.
      Reported-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/20200428123130.73078-1-mpe@ellerman.id.auSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      615e2d0b
    • Rob Herring's avatar
      PCI: Fix pci_register_host_bridge() device_register() error handling · 5d78c4a3
      Rob Herring authored
      [ Upstream commit 1b54ae83 ]
      
      If device_register() has an error, we should bail out of
      pci_register_host_bridge() rather than continuing on.
      
      Fixes: 37d6a0a6 ("PCI: Add pci_register_host_bridge() interface")
      Link: https://lore.kernel.org/r/20200513223859.11295-1-robh@kernel.orgSigned-off-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      Reviewed-by: default avatarLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Reviewed-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5d78c4a3
    • Tero Kristo's avatar
      clk: ti: composite: fix memory leak · aee22d36
      Tero Kristo authored
      [ Upstream commit c7c1cbbc ]
      
      The parent_names is never released for a component clock definition,
      causing some memory leak. Fix by releasing it once it is no longer
      needed.
      Reported-by: default avatarTomi Valkeinen <tomi.valkeinen@ti.com>
      Signed-off-by: default avatarTero Kristo <t-kristo@ti.com>
      Link: https://lkml.kernel.org/r/20200429131341.4697-2-t-kristo@ti.comAcked-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      aee22d36
    • Arnd Bergmann's avatar
      dlm: remove BUG() before panic() · 68728008
      Arnd Bergmann authored
      [ Upstream commit fe204591 ]
      
      Building a kernel with clang sometimes fails with an objtool error in dlm:
      
      fs/dlm/lock.o: warning: objtool: revert_lock_pc()+0xbd: can't find jump dest instruction at .text+0xd7fc
      
      The problem is that BUG() never returns and the compiler knows
      that anything after it is unreachable, however the panic still
      emits some code that does not get fully eliminated.
      
      Having both BUG() and panic() is really pointless as the BUG()
      kills the current process and the subsequent panic() never hits.
      In most cases, we probably don't really want either and should
      replace the DLM_ASSERT() statements with WARN_ON(), as has
      been done for some of them.
      
      Remove the BUG() here so the user at least sees the panic message
      and we can reliably build randconfig kernels.
      
      Fixes: e7fd4179 ("[DLM] The core of the DLM for GFS2/CLVM")
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: clang-built-linux@googlegroups.com
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid Teigland <teigland@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      68728008
    • Dafna Hirschfeld's avatar
      pinctrl: rockchip: fix memleak in rockchip_dt_node_to_map · c13d4627
      Dafna Hirschfeld authored
      [ Upstream commit d7faa8ff ]
      
      In function rockchip_dt_node_to_map, a new_map variable is
      allocated by:
      
      new_map = devm_kcalloc(pctldev->dev, map_num, sizeof(*new_map),
      		       GFP_KERNEL);
      
      This uses devres and attaches new_map to the pinctrl driver.
      This cause a leak since new_map is not released when the probed
      driver is removed. Fix it by using kcalloc to allocate new_map
      and free it in `rockchip_dt_free_map`
      Signed-off-by: default avatarDafna Hirschfeld <dafna.hirschfeld@collabora.com>
      Reviewed-by: default avatarHeiko Stuebner <heiko@sntech.de>
      Link: https://lore.kernel.org/r/20200506100903.15420-1-dafna.hirschfeld@collabora.comSigned-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c13d4627
    • Suganath Prabu S's avatar
      scsi: mpt3sas: Fix double free warnings · fc3dce34
      Suganath Prabu S authored
      [ Upstream commit cbbfdb2a ]
      
      Fix following warning from Smatch static analyser:
      
      drivers/scsi/mpt3sas/mpt3sas_base.c:5256 _base_allocate_memory_pools()
      warn: 'ioc->hpr_lookup' double freed
      
      drivers/scsi/mpt3sas/mpt3sas_base.c:5256 _base_allocate_memory_pools()
      warn: 'ioc->internal_lookup' double freed
      
      Link: https://lore.kernel.org/r/20200508110738.30732-1-suganath-prabu.subramani@broadcom.comReported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarSuganath Prabu S <suganath-prabu.subramani@broadcom.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      fc3dce34
    • Dmitry Osipenko's avatar
      power: supply: smb347-charger: IRQSTAT_D is volatile · 99545a11
      Dmitry Osipenko authored
      [ Upstream commit c32ea07a ]
      
      Fix failure when USB cable is connected:
      smb347 2-006a: reading IRQSTAT_D failed
      
      Fixes: 1502cfe1 ("smb347-charger: Fix battery status reporting logic for charger faults")
      Tested-by: default avatarDavid Heidelberg <david@ixit.cz>
      Signed-off-by: default avatarDmitry Osipenko <digetx@gmail.com>
      Signed-off-by: default avatarDavid Heidelberg <david@ixit.cz>
      Signed-off-by: default avatarSebastian Reichel <sebastian.reichel@collabora.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      99545a11
    • Christophe JAILLET's avatar
      power: supply: lp8788: Fix an error handling path in 'lp8788_charger_probe()' · 39e09268
      Christophe JAILLET authored
      [ Upstream commit 934ed384 ]
      
      In the probe function, in case of error, resources allocated in
      'lp8788_setup_adc_channel()' must be released.
      
      This can be achieved easily by using the devm_ variant of
      'iio_channel_get()'.
      This has the extra benefit to simplify the remove function and to axe the
      'lp8788_release_adc_channel()' function which is now useless.
      
      Fixes: 98a27664 ("power_supply: Add new lp8788 charger driver")
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarSebastian Reichel <sebastian.reichel@collabora.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      39e09268
    • Viacheslav Dubeyko's avatar
      scsi: qla2xxx: Fix warning after FC target reset · 9d10dbdc
      Viacheslav Dubeyko authored
      [ Upstream commit f839544c ]
      
      Currently, FC target reset finishes with the warning message:
      
      [84010.596893] ------------[ cut here ]------------
      [84010.596917] WARNING: CPU: 238 PID: 279973 at ../drivers/scsi/qla2xxx/qla_target.c:6644 qlt_enable_vha+0x1d0/0x260 [qla2xxx]
      [84010.596918] Modules linked in: vrf af_packet 8021q garp mrp stp llc netlink_diag target_tatlin_tblock(OEX) dm_ec(OEX) ttln_rdma(OEX) dm_frontend(OEX) nvme_rdma nvmet tcm_qla2xxx iscsi_target_mod target_core_mod at24 nvmem_core pnv_php ipmi_watchdog ipmi_ssif vmx_crypto gf128mul crct10dif_vpmsum qla2xxx rpcrdma nvme_fc powernv_flash(X) nvme_fabrics uio_pdrv_genirq mtd rtc_opal(X) ibmpowernv(X) opal_prd(X) uio scsi_transport_fc i2c_opal(X) ses enclosure ipmi_poweroff ast i2c_algo_bit ttm bmc_mcu(OEX) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm drm_panel_orientation_quirks agpgart nfsd auth_rpcgss nfs_acl ipmi_powernv(X) lockd ipmi_devintf ipmi_msghandler grace dummy ext4 crc16 jbd2 mbcache sd_mod rdma_ucm ib_iser rdma_cm ib_umad iw_cm ib_ipoib libiscsi scsi_transport_iscsi ib_cm
      [84010.596975]  configfs mlx5_ib ib_uverbs ib_core mlx5_core crc32c_vpmsum xhci_pci xhci_hcd mpt3sas(OEX) tg3 usbcore mlxfw tls raid_class libphy scsi_transport_sas devlink ptp pps_core nvme nvme_core sunrpc dm_mirror dm_region_hash dm_log sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod autofs4
      [84010.597001] Supported: Yes, External
      [84010.597004] CPU: 238 PID: 279973 Comm: bash Tainted: G           OE      4.12.14-197.29-default #1 SLE15-SP1
      [84010.597006] task: c000000a104c0000 task.stack: c000000b52188000
      [84010.597007] NIP: d00000001ffd7f78 LR: d00000001ffd7f6c CTR: c0000000001676c0
      [84010.597008] REGS: c000000b5218b910 TRAP: 0700   Tainted: G           OE       (4.12.14-197.29-default)
      [84010.597008] MSR: 900000010282b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]>
      [84010.597015]   CR: 48242424  XER: 00000000
      [84010.597016] CFAR: d00000001ff45d08 SOFTE: 1
                     GPR00: d00000001ffd7f6c c000000b5218bb90 d00000002001b228 0000000000000102
                     GPR04: 0000000000000001 0000000000000001 00013d91ed0a5e2d 0000000000000000
                     GPR08: c000000007793300 0000000000000000 0000000000000000 c000000a086e7818
                     GPR12: 0000000000002200 c000000007793300 0000000000000000 000000012bc937c0
                     GPR16: 000000012bbf7ed0 0000000000000000 000000012bc3dd10 0000000000000000
                     GPR20: 000000012bc4db28 0000010036442810 000000012bc97828 000000012bc96c70
                     GPR24: 00000100365b1550 0000000000000000 00000100363f3d80 c000000be20d3080
                     GPR28: c000000bda7eae00 c000000be20db7e8 c000000be20d3778 c000000be20db7e8
      [84010.597042] NIP [d00000001ffd7f78] qlt_enable_vha+0x1d0/0x260 [qla2xxx]
      [84010.597051] LR [d00000001ffd7f6c] qlt_enable_vha+0x1c4/0x260 [qla2xxx]
      [84010.597051] Call Trace:
      [84010.597061] [c000000b5218bb90] [d00000001ffd7f6c] qlt_enable_vha+0x1c4/0x260 [qla2xxx] (unreliable)
      [84010.597064] [c000000b5218bc20] [d000000009820b6c] tcm_qla2xxx_tpg_enable_store+0xc4/0x130 [tcm_qla2xxx]
      [84010.597067] [c000000b5218bcb0] [d0000000185d0e68] configfs_write_file+0xd0/0x190 [configfs]
      [84010.597072] [c000000b5218bd00] [c0000000003d0edc] __vfs_write+0x3c/0x1e0
      [84010.597074] [c000000b5218bd90] [c0000000003d2ea8] vfs_write+0xd8/0x220
      [84010.597076] [c000000b5218bde0] [c0000000003d4ddc] SyS_write+0x6c/0x110
      [84010.597079] [c000000b5218be30] [c00000000000b188] system_call+0x3c/0x130
      [84010.597080] Instruction dump:
      [84010.597082] 7d0050a8 7d084b78 7d0051ad 40c2fff4 7fa3eb78 4bf73965 60000000 7fa3eb78
      [84010.597086] 4bf6dcd9 60000000 2fa30000 419eff40 <0fe00000> 4bffff38 e95f0058 a12a0180
      [84010.597090] ---[ end trace e32abaf6e6fee826 ]---
      
      To reproduce:
      
      echo 0x7fffffff > /sys/module/qla2xxx/parameters/logging
      modprobe target_core_mod
      modprobe tcm_qla2xxx
      mkdir /sys/kernel/config/target/qla2xxx
      mkdir /sys/kernel/config/target/qla2xxx/<port-name>
      mkdir /sys/kernel/config/target/qla2xxx/<port-name>/tpgt_1
      echo 1 > /sys/kernel/config/target/qla2xxx/<port-name>/tpgt_1/enable
      echo 0 > /sys/kernel/config/target/qla2xxx/<port-name>/tpgt_1/enable
      echo 1 > /sys/kernel/config/target/qla2xxx/<port-name>/tpgt_1/enable
      
      SYSTEM START
      kernel: pid 327:drivers/scsi/qla2xxx/qla_init.c:2174 qla2x00_initialize_adapter(): vha->flags.online 0x0
      <...>
      kernel: pid 327:drivers/scsi/qla2xxx/qla_os.c:3444 qla2x00_probe_one(): vha->flags.online 0x1
      
      echo 1 > /sys/kernel/config/target/qla2xxx/21:00:00:24:ff:86:a6:2a/tpgt_1/enable
      kernel: pid 348:drivers/scsi/qla2xxx/qla_init.c:6641 qla2x00_abort_isp_cleanup(): vha->flags.online 0x0, ISP_ABORT_NEEDED 0x0
      <...>
      kernel: pid 348:drivers/scsi/qla2xxx/qla_init.c:6998 qla2x00_restart_isp(): vha->flags.online 0x0
      
      echo 0 > /sys/kernel/config/target/qla2xxx/21:00:00:24:ff:86:a6:2a/tpgt_1/enable
      kernel: pid 348:drivers/scsi/qla2xxx/qla_init.c:6641 qla2x00_abort_isp_cleanup(): vha->flags.online 0x0, ISP_ABORT_NEEDED 0x0
      <...>
      kernel: pid 1404:drivers/scsi/qla2xxx/qla_os.c:1107 qla2x00_wait_for_hba_online(): base_vha->flags.online 0x0
      
      echo 1 > /sys/kernel/config/target/qla2xxx/21:00:00:24:ff:86:a6:2a/tpgt_1/enable
      kernel: pid 1404:drivers/scsi/qla2xxx/qla_os.c:1107 qla2x00_wait_for_hba_online(): base_vha->flags.online 0x0
      kernel: -----------[ cut here ]-----------
      kernel: WARNING: CPU: 1 PID: 1404 at drivers/scsi/qla2xxx/qla_target.c:6654 qlt_enable_vha+0x1e0/0x280 [qla2xxx]
      
      The issue happens because no real ISP reset is executed.  The
      qla2x00_abort_isp(scsi_qla_host_t *vha) function expects that
      vha->flags.online will be not zero for ISP reset procedure.  This patch
      sets vha->flags.online to 1 before calling ->abort_isp() for starting the
      ISP reset.
      
      Link: https://lore.kernel.org/r/1d7b21bf9f7676643239eb3d60eaca7cfa505cf0.camel@yadro.comReviewed-by: default avatarRoman Bolshakov <r.bolshakov@yadro.com>
      Signed-off-by: default avatarViacheslav Dubeyko <v.dubeiko@yadro.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      9d10dbdc
    • Kai-Heng Feng's avatar
      PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges · 34d2c84c
      Kai-Heng Feng authored
      [ Upstream commit 66ff14e5 ]
      
      7d715a6c ("PCI: add PCI Express ASPM support") added the ability for
      Linux to enable ASPM, but for some undocumented reason, it didn't enable
      ASPM on links where the downstream component is a PCIe-to-PCI/PCI-X Bridge.
      
      Remove this exclusion so we can enable ASPM on these links.
      
      The Dell OptiPlex 7080 mentioned in the bugzilla has a TI XIO2001
      PCIe-to-PCI Bridge.  Enabling ASPM on the link leading to it allows the
      Intel SoC to enter deeper Package C-states, which is a significant power
      savings.
      
      [bhelgaas: commit log]
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207571
      Link: https://lore.kernel.org/r/20200505173423.26968-1-kai.heng.feng@canonical.comSigned-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      Reviewed-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      34d2c84c
    • Andrew Murray's avatar
      PCI: rcar: Fix incorrect programming of OB windows · 2b024866
      Andrew Murray authored
      [ Upstream commit 2b9f2174 ]
      
      The outbound windows (PCIEPAUR(x), PCIEPALR(x)) describe a mapping between
      a CPU address (which is determined by the window number 'x') and a
      programmed PCI address - Thus allowing the controller to translate CPU
      accesses into PCI accesses.
      
      However the existing code incorrectly writes the CPU address - lets fix
      this by writing the PCI address instead.
      
      For memory transactions, existing DT users describe a 1:1 identity mapping
      and thus this change should have no effect. However the same isn't true for
      I/O.
      
      Link: https://lore.kernel.org/r/20191004132941.6660-1-andrew.murray@arm.com
      Fixes: c25da477 ("PCI: rcar: Add Renesas R-Car PCIe driver")
      Tested-by: default avatarMarek Vasut <marek.vasut+renesas@gmail.com>
      Signed-off-by: default avatarAndrew Murray <andrew.murray@arm.com>
      Signed-off-by: default avatarLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Reviewed-by: default avatarMarek Vasut <marek.vasut+renesas@gmail.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      2b024866
    • Kuppuswamy Sathyanarayanan's avatar
      drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a... · cd74de67
      Kuppuswamy Sathyanarayanan authored
      drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish
      
      [ Upstream commit 388bcc6e ]
      
      If platform bus driver registration is failed then, accessing
      platform bus spin lock (&drv->driver.bus->p->klist_drivers.k_lock)
      in __platform_driver_probe() without verifying the return value
      __platform_driver_register() can lead to NULL pointer exception.
      
      So check the return value before attempting the spin lock.
      
      One such example is below:
      
      For a custom usecase, I have intentionally failed the platform bus
      registration and I expected all the platform device/driver
      registrations to fail gracefully. But I came across this panic
      issue.
      
      [    1.331067] BUG: kernel NULL pointer dereference, address: 00000000000000c8
      [    1.331118] #PF: supervisor write access in kernel mode
      [    1.331163] #PF: error_code(0x0002) - not-present page
      [    1.331208] PGD 0 P4D 0
      [    1.331233] Oops: 0002 [#1] PREEMPT SMP
      [    1.331268] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G        W         5.6.0-00049-g670d35fb0144 #165
      [    1.331341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
      [    1.331406] RIP: 0010:_raw_spin_lock+0x15/0x30
      [    1.331588] RSP: 0000:ffffc9000001be70 EFLAGS: 00010246
      [    1.331632] RAX: 0000000000000000 RBX: 00000000000000c8 RCX: 0000000000000001
      [    1.331696] RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000000
      [    1.331754] RBP: 00000000ffffffed R08: 0000000000000501 R09: 0000000000000001
      [    1.331817] R10: ffff88817abcc520 R11: 0000000000000670 R12: 00000000ffffffed
      [    1.331881] R13: ffffffff82dbc268 R14: ffffffff832f070a R15: 0000000000000000
      [    1.331945] FS:  0000000000000000(0000) GS:ffff88817bd80000(0000) knlGS:0000000000000000
      [    1.332008] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [    1.332062] CR2: 00000000000000c8 CR3: 000000000681e001 CR4: 00000000003606e0
      [    1.332126] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [    1.332189] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [    1.332252] Call Trace:
      [    1.332281]  __platform_driver_probe+0x92/0xee
      [    1.332323]  ? rtc_dev_init+0x2b/0x2b
      [    1.332358]  cmos_init+0x37/0x67
      [    1.332396]  do_one_initcall+0x7d/0x168
      [    1.332428]  kernel_init_freeable+0x16c/0x1c9
      [    1.332473]  ? rest_init+0xc0/0xc0
      [    1.332508]  kernel_init+0x5/0x100
      [    1.332543]  ret_from_fork+0x1f/0x30
      [    1.332579] CR2: 00000000000000c8
      [    1.332616] ---[ end trace 3bd87f12e9010b87 ]---
      [    1.333549] note: swapper/0[1] exited with preempt_count 1
      [    1.333592] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
      [    1.333736] Kernel Offset: disabled
      
      Note, this can only be triggered if a driver errors out from this call,
      which should never happen.  If it does, the driver needs to be fixed.
      Signed-off-by: default avatarKuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
      Link: https://lore.kernel.org/r/20200408214003.3356-1-sathyanarayanan.kuppuswamy@linux.intel.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      cd74de67
    • John Stultz's avatar
      serial: amba-pl011: Make sure we initialize the port.lock spinlock · 5d2195b7
      John Stultz authored
      [ Upstream commit 8508f4cb ]
      
      Valentine reported seeing:
      
      [    3.626638] INFO: trying to register non-static key.
      [    3.626639] the code is fine but needs lockdep annotation.
      [    3.626640] turning off the locking correctness validator.
      [    3.626644] CPU: 7 PID: 51 Comm: kworker/7:1 Not tainted 5.7.0-rc2-00115-g8c2e9790f196 #116
      [    3.626646] Hardware name: HiKey960 (DT)
      [    3.626656] Workqueue: events deferred_probe_work_func
      [    3.632476] sd 0:0:0:0: [sda] Optimal transfer size 8192 bytes not a multiple of physical block size (16384 bytes)
      [    3.640220] Call trace:
      [    3.640225]  dump_backtrace+0x0/0x1b8
      [    3.640227]  show_stack+0x20/0x30
      [    3.640230]  dump_stack+0xec/0x158
      [    3.640234]  register_lock_class+0x598/0x5c0
      [    3.640235]  __lock_acquire+0x80/0x16c0
      [    3.640236]  lock_acquire+0xf4/0x4a0
      [    3.640241]  _raw_spin_lock_irqsave+0x70/0xa8
      [    3.640245]  uart_add_one_port+0x388/0x4b8
      [    3.640248]  pl011_register_port+0x70/0xf0
      [    3.640250]  pl011_probe+0x184/0x1b8
      [    3.640254]  amba_probe+0xdc/0x180
      [    3.640256]  really_probe+0xe0/0x338
      [    3.640257]  driver_probe_device+0x60/0xf8
      [    3.640259]  __device_attach_driver+0x8c/0xd0
      [    3.640260]  bus_for_each_drv+0x84/0xd8
      [    3.640261]  __device_attach+0xe4/0x140
      [    3.640263]  device_initial_probe+0x1c/0x28
      [    3.640265]  bus_probe_device+0xa4/0xb0
      [    3.640266]  deferred_probe_work_func+0x7c/0xb8
      [    3.640269]  process_one_work+0x2c0/0x768
      [    3.640271]  worker_thread+0x4c/0x498
      [    3.640272]  kthread+0x14c/0x158
      [    3.640275]  ret_from_fork+0x10/0x1c
      
      Which seems to be due to the fact that after allocating the uap
      structure, nothing initializes the spinlock.
      
      Its a little confusing, as uart_port_spin_lock_init() is one
      place where the lock is supposed to be initialized, but it has
      an exception for the case where the port is a console.
      
      This makes it seem like a deeper fix is needed to properly
      register the console, but I'm not sure what that entails, and
      Andy suggested that this approach is less invasive.
      
      Thus, this patch resolves the issue by initializing the spinlock
      in the driver, and resolves the resulting warning.
      
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Cc: Russell King <linux@armlinux.org.uk>
      Cc: Jiri Slaby <jslaby@suse.com>
      Cc: linux-serial@vger.kernel.org
      Reported-by: default avatarValentin Schneider <valentin.schneider@arm.com>
      Reviewed-by: default avatarAndy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
      Reviewed-and-tested-by: default avatarValentin Schneider <valentin.schneider@arm.com>
      Link: https://lore.kernel.org/r/20200428184050.6501-1-john.stultz@linaro.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5d2195b7
    • Russell King's avatar
      i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output · 2025b6fc
      Russell King authored
      [ Upstream commit 88b73ee7 ]
      
      The IRQ log output is supposed to appear on a single line.  However,
      commit 3a2dc167 ("i2c: pxa: Update debug function to dump more info
      on error") resulted in it being printed one-entry-per-line, which is
      excessively long.
      
      Fixing this is not a trivial matter; using pr_cont() doesn't work as
      the previous dev_dbg() may not have been compiled in, or may be
      dynamic.
      
      Since the rest of this function output is at error level, and is also
      debug output, promote this to error level as well to avoid this
      problem.
      
      Reduce the number of always zero prefix digits to save screen real-
      estate.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarWolfram Sang <wsa@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      2025b6fc
    • Christophe JAILLET's avatar
      PCI: v3-semi: Fix a memory leak in v3_pci_probe() error handling paths · 7014edf8
      Christophe JAILLET authored
      [ Upstream commit bca71898 ]
      
      If we fails somewhere in 'v3_pci_probe()', we need to free 'host'.
      
      Use the managed version of 'pci_alloc_host_bridge()' to do that easily.
      The use of managed resources is already widely used in this driver.
      
      Link: https://lore.kernel.org/r/20200418081637.1585-1-christophe.jaillet@wanadoo.fr
      Fixes: 68a15eb7 ("PCI: v3-semi: Add V3 Semiconductor PCI host driver")
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      [lorenzo.pieralisi@arm.com: commit log]
      Signed-off-by: default avatarLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Acked-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      7014edf8
    • Matej Dujava's avatar
      staging: sm750fb: add missing case while setting FB_VISUAL · a3b8b0a1
      Matej Dujava authored
      [ Upstream commit fa901333 ]
      
      Switch statement does not contain all cases: 8, 16, 24, 32.
      This patch will add missing one (24)
      
      Fixes: 81dee67e ("staging: sm750fb: add sm750 to staging")
      Signed-off-by: default avatarMatej Dujava <mdujava@kocurkovo.cz>
      Link: https://lore.kernel.org/r/1588277366-19354-2-git-send-email-mdujava@kocurkovo.czSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      a3b8b0a1
    • Thinh Nguyen's avatar
      usb: dwc3: gadget: Properly handle failed kick_transfer · 8aafbcb3
      Thinh Nguyen authored
      [ Upstream commit 8d99087c ]
      
      If dwc3 fails to issue START_TRANSFER/UPDATE_TRANSFER command, then we
      should properly end an active transfer and give back all the started
      requests. However if it's for an isoc endpoint, the failure maybe due to
      bus-expiry status. In this case, don't give back the requests and wait
      for the next retry.
      
      Fixes: 72246da4 ("usb: Introduce DesignWare USB3 DRD Driver")
      Signed-off-by: default avatarThinh Nguyen <thinhn@synopsys.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      8aafbcb3
    • Sudip Mukherjee's avatar
      thermal/drivers/ti-soc-thermal: Avoid dereferencing ERR_PTR · 57ac786b
      Sudip Mukherjee authored
      [ Upstream commit 7440f518 ]
      
      On error the function ti_bandgap_get_sensor_data() returns the error
      code in ERR_PTR() but we only checked if the return value is NULL or
      not. And, so we can dereference an error code inside ERR_PTR.
      While at it, convert a check to IS_ERR_OR_NULL.
      Signed-off-by: default avatarSudip Mukherjee <sudipm.mukherjee@gmail.com>
      Reviewed-by: default avatarAmit Kucheria <amit.kucheria@linaro.org>
      Signed-off-by: default avatarDaniel Lezcano <daniel.lezcano@linaro.org>
      Link: https://lore.kernel.org/r/20200424161944.6044-1-sudipm.mukherjee@gmail.comSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      57ac786b
    • Srinivas Kandagatla's avatar
      slimbus: ngd: get drvdata from correct device · ea02b848
      Srinivas Kandagatla authored
      [ Upstream commit b58c6630 ]
      
      Get drvdata directly from parent instead of ngd dev, as ngd
      dev can probe defer and previously set drvdata will become null.
      Signed-off-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
      Link: https://lore.kernel.org/r/20200417093618.7929-1-srinivas.kandagatla@linaro.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      ea02b848
    • Raghavendra Rao Ananta's avatar
      tty: hvc: Fix data abort due to race in hvc_open · 229e1646
      Raghavendra Rao Ananta authored
      [ Upstream commit e2bd1dcb ]
      
      Potentially, hvc_open() can be called in parallel when two tasks calls
      open() on /dev/hvcX. In such a scenario, if the hp->ops->notifier_add()
      callback in the function fails, where it sets the tty->driver_data to
      NULL, the parallel hvc_open() can see this NULL and cause a memory abort.
      Hence, serialize hvc_open and check if tty->private_data is NULL before
      proceeding ahead.
      
      The issue can be easily reproduced by launching two tasks simultaneously
      that does nothing but open() and close() on /dev/hvcX.
      For example:
      $ ./simple_open_close /dev/hvc0 & ./simple_open_close /dev/hvc0 &
      Signed-off-by: default avatarRaghavendra Rao Ananta <rananta@codeaurora.org>
      Link: https://lore.kernel.org/r/20200428032601.22127-1-rananta@codeaurora.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      229e1646
    • Julian Wiedmann's avatar
      s390/qdio: put thinint indicator after early error · f7199b98
      Julian Wiedmann authored
      [ Upstream commit 75e82bec ]
      
      qdio_establish() calls qdio_setup_thinint() via qdio_setup_irq().
      If the subsequent qdio_establish_thinint() fails, we miss to put the
      DSCI again. Thus the DSCI isn't available for re-use. Given enough of
      such errors, we could end up with having only the shared DSCI available.
      
      Merge qdio_setup_thinint() into qdio_establish_thinint(), and deal with
      such an error internally.
      
      Fixes: 779e6e1c ("[S390] qdio: new qdio driver.")
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
      Reviewed-by: default avatarBenjamin Block <bblock@linux.ibm.com>
      Signed-off-by: default avatarVasily Gorbik <gor@linux.ibm.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      f7199b98
    • Takashi Iwai's avatar
      ALSA: usb-audio: Fix racy list management in output queue · d3a9803b
      Takashi Iwai authored
      [ Upstream commit 5b6cc38f ]
      
      The linked list entry from FIFO is peeked at
      queue_pending_output_urbs() but the actual element pop-out is
      performed outside the spinlock, and it's potentially racy.
      
      Do delete the link at the right place inside the spinlock.
      
      Fixes: 8fdff6a3 ("ALSA: snd-usb: implement new endpoint streaming model")
      Link: https://lore.kernel.org/r/20200424074016.14301-1-tiwai@suse.deSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      d3a9803b
    • Alexander Tsoy's avatar
      ALSA: usb-audio: Improve frames size computation · 2d50acd7
      Alexander Tsoy authored
      [ Upstream commit f0bd62b6 ]
      
      For computation of the the next frame size current value of fs/fps and
      accumulated fractional parts of fs/fps are used, where values are stored
      in Q16.16 format. This is quite natural for computing frame size for
      asynchronous endpoints driven by explicit feedback, since in this case
      fs/fps is a value provided by the feedback endpoint and it's already in
      the Q format. If an error is accumulated over time, the device can
      adjust fs/fps value to prevent buffer overruns/underruns.
      
      But for synchronous endpoints the accuracy provided by these computations
      is not enough. Due to accumulated error the driver periodically produces
      frames with incorrect size (+/- 1 audio sample).
      
      This patch fixes this issue by implementing a different algorithm for
      frame size computation. It is based on accumulating of the remainders
      from division fs/fps and it doesn't accumulate errors over time. This
      new method is enabled for synchronous and adaptive playback endpoints.
      Signed-off-by: default avatarAlexander Tsoy <alexander@tsoy.me>
      Link: https://lore.kernel.org/r/20200424022449.14972-1-alexander@tsoy.meSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      2d50acd7
    • Xiyu Yang's avatar
      staging: gasket: Fix mapping refcnt leak when register/store fails · f35713ba
      Xiyu Yang authored
      [ Upstream commit e3436ce6 ]
      
      gasket_sysfs_register_store() invokes get_mapping(), which returns a
      reference of the specified gasket_sysfs_mapping object to "mapping" with
      increased refcnt.
      
      When gasket_sysfs_register_store() returns, local variable "mapping"
      becomes invalid, so the refcount should be decreased to keep refcount
      balanced.
      
      The reference counting issue happens in one exception handling path of
      gasket_sysfs_register_store(). When gasket_dev is NULL, the function
      forgets to decrease the refcnt increased by get_mapping(), causing a
      refcnt leak.
      
      Fix this issue by calling put_mapping() when gasket_dev is NULL.
      Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
      Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
      Link: https://lore.kernel.org/r/1587618941-13718-1-git-send-email-xiyuyang19@fudan.edu.cnSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      f35713ba
    • Xiyu Yang's avatar
      staging: gasket: Fix mapping refcnt leak when put attribute fails · c42581d2
      Xiyu Yang authored
      [ Upstream commit 57a66838 ]
      
      gasket_sysfs_put_attr() invokes get_mapping(), which returns a reference
      of the specified gasket_sysfs_mapping object to "mapping" with increased
      refcnt.
      
      When gasket_sysfs_put_attr() returns, local variable "mapping" becomes
      invalid, so the refcount should be decreased to keep refcount balanced.
      
      The reference counting issue happens in one path of
      gasket_sysfs_put_attr(). When mapping attribute is unknown, the function
      forgets to decrease the refcnt increased by get_mapping(), causing a
      refcnt leak.
      
      Fix this issue by calling put_mapping() when put attribute fails due to
      unknown attribute.
      Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
      Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
      Link: https://lore.kernel.org/r/1587618895-13660-1-git-send-email-xiyuyang19@fudan.edu.cnSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c42581d2
    • Christoph Hellwig's avatar
      firmware: qcom_scm: fix bogous abuse of dma-direct internals · ce7d4a0e
      Christoph Hellwig authored
      [ Upstream commit 459b1f86 ]
      
      As far as the device is concerned the dma address is the physical
      address.  There is no need to convert it to a physical address,
      especially not using dma-direct internals that are not available
      to drivers and which will interact badly with IOMMUs.  Last but not
      least the commit introducing it claimed to just fix a type issue,
      but actually changed behavior.
      
      Fixes: 6e37ccf7 ("firmware: qcom_scm: Use proper types for dma mappings")
      Reviewed-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Link: https://lore.kernel.org/r/20200414123136.441454-1-hch@lst.deSigned-off-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      ce7d4a0e
    • Jason Yan's avatar
      pinctrl: rza1: Fix wrong array assignment of rza1l_swio_entries · 089e03e1
      Jason Yan authored
      [ Upstream commit 4b4e8e93 ]
      
      The rza1l_swio_entries referred to the wrong array rza1h_swio_pins,
      which was intended to be rza1l_swio_pins. So let's fix it.
      
      This is detected by the following gcc warning:
      
      drivers/pinctrl/pinctrl-rza1.c:401:35: warning: ‘rza1l_swio_pins’
      defined but not used [-Wunused-const-variable=]
       static const struct rza1_swio_pin rza1l_swio_pins[] = {
                                         ^~~~~~~~~~~~~~~
      
      Fixes: 039bc58e ("pinctrl: rza1: Add support for RZ/A1L")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarJason Yan <yanaijie@huawei.com>
      Link: https://lore.kernel.org/r/20200417111604.19143-1-yanaijie@huawei.comSigned-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      089e03e1
    • Chad Dupuis's avatar
      scsi: qedf: Fix crash when MFW calls for protocol stats while function is still probing · af59f7fd
      Chad Dupuis authored
      [ Upstream commit ad40f525 ]
      
      The MFW may make a call to qed and then to qedf for protocol statistics
      while the function is still probing.  If this happens it's possible that
      some members of the struct qedf_ctx may not be fully initialized which can
      result in a NULL pointer dereference or general protection fault.
      
      To prevent this, add a new flag call QEDF_PROBING and set it when the
      __qedf_probe() function is active. Then in the qedf_get_protocol_tlv_data()
      function we can check if the function is still probing and return
      immediantely before any uninitialized structures can be touched.
      
      Link: https://lore.kernel.org/r/20200416084314.18851-9-skashyap@marvell.comSigned-off-by: default avatarChad Dupuis <cdupuis@marvell.com>
      Signed-off-by: default avatarSaurav Kashyap <skashyap@marvell.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      af59f7fd
    • Andy Shevchenko's avatar
      gpio: dwapb: Append MODULE_ALIAS for platform driver · e81df5b3
      Andy Shevchenko authored
      [ Upstream commit c58220cb ]
      
      The commit 3d2613c4
        ("GPIO: gpio-dwapb: Enable platform driver binding to MFD driver")
      introduced a use of the platform driver but missed to add the following line
      to it:
        MODULE_ALIAS("platform:gpio-dwapb");
      
      Add this to get driver loaded automatically if platform device is registered.
      
      Fixes: 3d2613c4 ("GPIO: gpio-dwapb: Enable platform driver binding to MFD driver")
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Tested-by: default avatarSerge Semin <fancer.lancer@gmail.com>
      Reviewed-by: default avatarSerge Semin <fancer.lancer@gmail.com>
      Link: https://lore.kernel.org/r/20200415141534.31240-2-andriy.shevchenko@linux.intel.comSigned-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e81df5b3
    • Vincent Stehlé's avatar
      ARM: dts: sun8i-h2-plus-bananapi-m2-zero: Fix led polarity · 98ea71ef
      Vincent Stehlé authored
      [ Upstream commit 34b6826d ]
      
      The PWR-LED on the bananapi m2 zero board is on when gpio PL10 is low.
      This has been verified on a board and in the schematics [1].
      
      [1]: http://wiki.banana-pi.org/Banana_Pi_BPI-M2_ZERO#Documents
      
      Fixes: 8b8061fc ("ARM: dts: sun8i: h2+: add support for Banana Pi M2 Zero board")
      Signed-off-by: default avatarVincent Stehlé <vincent.stehle@laposte.net>
      Cc: Icenowy Zheng <icenowy@aosc.io>
      Cc: Maxime Ripard <mripard@kernel.org>
      Signed-off-by: default avatarMaxime Ripard <maxime@cerno.tech>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      98ea71ef
    • Nilesh Javali's avatar
      scsi: qedi: Do not flush offload work if ARP not resolved · 2f968772
      Nilesh Javali authored
      [ Upstream commit 927527ae ]
      
      For an unreachable target, offload_work is not initialized and the endpoint
      state is set to OFLDCONN_NONE. This results in a WARN_ON due to the check
      of the work function field being set to zero.
      
      ------------[ cut here ]------------
      WARNING: CPU: 24 PID: 18587 at ../kernel/workqueue.c:3037 __flush_work+0x1c1/0x1d0
      :
      Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 02/01/2020
      RIP: 0010:__flush_work+0x1c1/0x1d0
      Code: ba 6d 00 03 80 c9 f0 eb b6 48 c7 c7 20 ee 6c a4 e8 52 d3 04 00 0f 0b 31 c0 e9 d1 fe ff
      ff 48 c7 c7 20 ee 6c a4 e8 3d d3 04 00 <0f> 0b 31 c0 e9 bc fe ff ff e8 11 f3 f
       00 31 f6
      RSP: 0018:ffffac5a8cd47a80 EFLAGS: 00010282
      RAX: 0000000000000024 RBX: ffff98d68c1fcaf0 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: ffff98ce9fd99898 RDI: ffff98ce9fd99898
      RBP: ffff98d68c1fcbc0 R08: 00000000000006fa R09: 0000000000000001
      R10: ffffac5a8cd47b50 R11: 0000000000000001 R12: 0000000000000000
      R13: 000000000000489b R14: ffff98d68c1fc800 R15: ffff98d692132c00
      FS:  00007f65f7f62280(0000) GS:ffff98ce9fd80000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007ffd2435e880 CR3: 0000000809334003 CR4: 00000000007606e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      PKRU: 55555554
      Call Trace:
       ? class_create_release+0x40/0x40
       ? klist_put+0x2c/0x80
       qedi_ep_disconnect+0xdd/0x400 [qedi]
       iscsi_if_ep_disconnect.isra.20+0x59/0x70 [scsi_transport_iscsi]
       iscsi_if_rx+0x129b/0x1670 [scsi_transport_iscsi]
       ? __netlink_lookup+0xe7/0x160
       netlink_unicast+0x21d/0x300
       netlink_sendmsg+0x30f/0x430
       sock_sendmsg+0x5b/0x60
       ____sys_sendmsg+0x1e2/0x240
       ? copy_msghdr_from_user+0xd9/0x160
       ___sys_sendmsg+0x88/0xd0
       ? ___sys_recvmsg+0xa2/0xe0
       ? hrtimer_try_to_cancel+0x25/0x100
       ? do_nanosleep+0x9c/0x170
       ? __sys_sendmsg+0x5e/0xa0
       __sys_sendmsg+0x5e/0xa0
       do_syscall_64+0x60/0x1f0
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x7f65f6f16107
      Code: 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 80 00 00 00 00 8b 05 aa d2 2b 00 48 63 d2 48
      63 ff 85 c0 75 18 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 59 f3 c3 0f 1f 8
          0 00 00 00 00 53 48 89 f3 48
       RSP: 002b:00007ffd24367ca8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
       RAX: ffffffffffffffda RBX: 000055a7aeaaf110 RCX: 00007f65f6f16107
       RDX: 0000000000000000 RSI: 00007ffd24367cc0 RDI: 0000000000000003
       RBP: 0000000000000070 R08: 0000000000000000 R09: 0000000000000000
       R10: 000000000000075c R11: 0000000000000246 R12: 00007ffd24367cc0
       R13: 000055a7ae560008 R14: 00007ffd24367db0 R15: 0000000000000000
       ---[ end trace 54f499c05d41f8bb ]---
      
      Only flush if the connection endpoint state if different from
      OFLDCONN_NONE.
      
      [mkp: clarified commit desc]
      
      Link: https://lore.kernel.org/r/20200408064332.19377-5-mrangankar@marvell.comReviewed-by: default avatarLee Duncan <lduncan@suse.com>
      Signed-off-by: default avatarNilesh Javali <njavali@marvell.com>
      Signed-off-by: default avatarManish Rangankar <mrangankar@marvell.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      2f968772
    • Hsin-Yi Wang's avatar
      arm64: dts: mt8173: fix unit name warnings · 46d29305
      Hsin-Yi Wang authored
      [ Upstream commit 72b29215 ]
      
      Fixing several unit name warnings:
      
      Warning (unit_address_vs_reg): /oscillator@0: node has a unit name, but no reg property
      Warning (unit_address_vs_reg): /oscillator@1: node has a unit name, but no reg property
      Warning (unit_address_vs_reg): /oscillator@2: node has a unit name, but no reg property
      Warning (unit_address_vs_reg): /thermal-zones/cpu_thermal/trips/trip-point@0: node has a unit name, but no reg property
      Warning (unit_address_vs_reg): /thermal-zones/cpu_thermal/trips/trip-point@1: node has a unit name, but no reg property
      Warning (unit_address_vs_reg): /thermal-zones/cpu_thermal/trips/cpu_crit@0: node has a unit name, but no reg property
      Warning (unit_address_vs_reg): /thermal-zones/cpu_thermal/cooling-maps/map@0: node has a unit name, but no reg property
      Warning (unit_address_vs_reg): /thermal-zones/cpu_thermal/cooling-maps/map@1: node has a unit name, but no reg property
      Warning (unit_address_vs_reg): /reserved-memory/vpu_dma_mem_region: node has a reg or ranges property, but no unit name
      Warning (simple_bus_reg): /soc/pinctrl@10005000: simple-bus unit address format error, expected "1000b000"
      Warning (simple_bus_reg): /soc/interrupt-controller@10220000: simple-bus unit address format error, expected "10221000"
      Signed-off-by: default avatarHsin-Yi Wang <hsinyi@chromium.org>
      Link: https://lore.kernel.org/r/20200210063523.133333-4-hsinyi@chromium.org
      [mb: drop fixes for '_' in property name]
      Signed-off-by: default avatarMatthias Brugger <matthias.bgg@gmail.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      46d29305