1. 05 Oct, 2019 40 commits
    • Yufen Yu's avatar
      md/raid1: fail run raid1 array when active disk less than one · f1db7562
      Yufen Yu authored
      [ Upstream commit 07f1a685 ]
      
      When run test case:
        mdadm -CR /dev/md1 -l 1 -n 4 /dev/sd[a-d] --assume-clean --bitmap=internal
        mdadm -S /dev/md1
        mdadm -A /dev/md1 /dev/sd[b-c] --run --force
      
        mdadm --zero /dev/sda
        mdadm /dev/md1 -a /dev/sda
      
        echo offline > /sys/block/sdc/device/state
        echo offline > /sys/block/sdb/device/state
        sleep 5
        mdadm -S /dev/md1
      
        echo running > /sys/block/sdb/device/state
        echo running > /sys/block/sdc/device/state
        mdadm -A /dev/md1 /dev/sd[a-c] --run --force
      
      mdadm run fail with kernel message as follow:
      [  172.986064] md: kicking non-fresh sdb from array!
      [  173.004210] md: kicking non-fresh sdc from array!
      [  173.022383] md/raid1:md1: active with 0 out of 4 mirrors
      [  173.022406] md1: failed to create bitmap (-5)
      
      In fact, when active disk in raid1 array less than one, we
      need to return fail in raid1_run().
      Reviewed-by: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarYufen Yu <yuyufen@huawei.com>
      Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      f1db7562
    • Wang Shenran's avatar
      hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap' · 76cf93f0
      Wang Shenran authored
      [ Upstream commit 6e4d91aa ]
      
      At boot time, the acpi_power_meter driver logs the following error level
      message: "Ignoring unsafe software power cap". Having read about it from
      a few sources, it seems that the error message can be quite misleading.
      
      While the message can imply that Linux is ignoring the fact that the
      system is operating in potentially dangerous conditions, the truth is
      the driver found an ACPI_PMC object that supports software power
      capping. The driver simply decides not to use it, perhaps because it
      doesn't support the object.
      
      The best solution is probably changing the log level from error to warning.
      All sources I have found, regarding the error, have downplayed its
      significance. There is not much of a reason for it to be on error level,
      while causing potential confusions or misinterpretations.
      Signed-off-by: default avatarWang Shenran <shenran268@gmail.com>
      Link: https://lore.kernel.org/r/20190724080110.6952-1-shenran268@gmail.comSigned-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      76cf93f0
    • Kent Overstreet's avatar
      closures: fix a race on wakeup from closure_sync · f0956418
      Kent Overstreet authored
      [ Upstream commit a22a9602 ]
      
      The race was when a thread using closure_sync() notices cl->s->done == 1
      before the thread calling closure_put() calls wake_up_process(). Then,
      it's possible for that thread to return and exit just before
      wake_up_process() is called - so we're trying to wake up a process that
      no longer exists.
      
      rcu_read_lock() is sufficient to protect against this, as there's an rcu
      barrier somewhere in the process teardown path.
      Signed-off-by: default avatarKent Overstreet <kent.overstreet@gmail.com>
      Acked-by: default avatarColy Li <colyli@suse.de>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      f0956418
    • Wenwen Wang's avatar
      ACPI / PCI: fix acpi_pci_irq_enable() memory leak · 9fcfdff6
      Wenwen Wang authored
      [ Upstream commit 29b49958 ]
      
      In acpi_pci_irq_enable(), 'entry' is allocated by kzalloc() in
      acpi_pci_irq_check_entry() (invoked from acpi_pci_irq_lookup()). However,
      it is not deallocated if acpi_pci_irq_valid() returns false, leading to a
      memory leak. To fix this issue, free 'entry' before returning 0.
      
      Fixes: e237a551 ("x86/ACPI/PCI: Recognize that Interrupt Line 255 means "not connected"")
      Signed-off-by: default avatarWenwen Wang <wenwen@cs.uga.edu>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      9fcfdff6
    • Wenwen Wang's avatar
      ACPI: custom_method: fix memory leaks · e4467fb6
      Wenwen Wang authored
      [ Upstream commit 03d1571d ]
      
      In cm_write(), 'buf' is allocated through kzalloc(). In the following
      execution, if an error occurs, 'buf' is not deallocated, leading to memory
      leaks. To fix this issue, free 'buf' before returning the error.
      
      Fixes: 526b4af4 ("ACPI: Split out custom_method functionality into an own driver")
      Signed-off-by: default avatarWenwen Wang <wenwen@cs.uga.edu>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e4467fb6
    • Marek Szyprowski's avatar
      ARM: dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks · 6fceb241
      Marek Szyprowski authored
      [ Upstream commit 5b0eeeaa ]
      
      Commit aff138bf ("ARM: dts: exynos: Add TMU nodes regulator supply
      for Peach boards") assigned LDO10 to Exynos Thermal Measurement Unit,
      but it turned out that it supplies also some other critical parts and
      board freezes/crashes when it is turned off.
      
      The mentioned commit made Exynos TMU a consumer of that regulator and in
      typical case Exynos TMU driver keeps it enabled from early boot. However
      there are such configurations (example is multi_v7_defconfig), in which
      some of the regulators are compiled as modules and are not available
      from early boot. In such case it may happen that LDO10 is turned off by
      regulator core, because it has no consumers yet (in this case consumer
      drivers cannot get it, because the supply regulators for it are not yet
      available). This in turn causes the board to crash. This patch restores
      'always-on' property for the LDO10 regulator.
      
      Fixes: aff138bf ("ARM: dts: exynos: Add TMU nodes regulator supply for Peach boards")
      Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarKrzysztof Kozlowski <krzk@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      6fceb241
    • Tzvetomir Stoyanov's avatar
      libtraceevent: Change users plugin directory · e4b4280d
      Tzvetomir Stoyanov authored
      [ Upstream commit e97fd138 ]
      
      To be compliant with XDG user directory layout, the user's plugin
      directory is changed from ~/.traceevent/plugins to
      ~/.local/lib/traceevent/plugins/
      Suggested-by: default avatarPatrick McLean <chutzpah@gentoo.org>
      Signed-off-by: default avatarTzvetomir Stoyanov <tstoyanov@vmware.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Patrick McLean <chutzpah@gentoo.org>
      Cc: linux-trace-devel@vger.kernel.org
      Link: https://lore.kernel.org/linux-trace-devel/20190313144206.41e75cf8@patrickm/
      Link: http://lore.kernel.org/linux-trace-devel/20190801074959.22023-4-tz.stoyanov@gmail.com
      Link: http://lore.kernel.org/lkml/20190805204355.344622683@goodmis.orgSigned-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e4b4280d
    • Eric Dumazet's avatar
      iommu/iova: Avoid false sharing on fq_timer_on · c55659cd
      Eric Dumazet authored
      [ Upstream commit 0d87308c ]
      
      In commit 14bd9a60 ("iommu/iova: Separate atomic variables
      to improve performance") Jinyu Qi identified that the atomic_cmpxchg()
      in queue_iova() was causing a performance loss and moved critical fields
      so that the false sharing would not impact them.
      
      However, avoiding the false sharing in the first place seems easy.
      We should attempt the atomic_cmpxchg() no more than 100 times
      per second. Adding an atomic_read() will keep the cache
      line mostly shared.
      
      This false sharing came with commit 9a005a80
      ("iommu/iova: Add flush timer").
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Fixes: 9a005a80 ('iommu/iova: Add flush timer')
      Cc: Jinyu Qi <jinyuqi@huawei.com>
      Cc: Joerg Roedel <jroedel@suse.de>
      Acked-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c55659cd
    • Dan Williams's avatar
      libata/ahci: Drop PCS quirk for Denverton and beyond · 223b0481
      Dan Williams authored
      [ Upstream commit c312ef17 ]
      
      The Linux ahci driver has historically implemented a configuration fixup
      for platforms / platform-firmware that fails to enable the ports prior
      to OS hand-off at boot. The fixup was originally implemented way back
      before ahci moved from drivers/scsi/ to drivers/ata/, and was updated in
      2007 via commit 49f29090 "ahci: update PCS programming". The quirk
      sets a port-enable bitmap in the PCS register at offset 0x92.
      
      This quirk could be applied generically up until the arrival of the
      Denverton (DNV) platform. The DNV AHCI controller architecture supports
      more than 6 ports and along with that the PCS register location and
      format were updated to allow for more possible ports in the bitmap. DNV
      AHCI expands the register to 32-bits and moves it to offset 0x94.
      
      As it stands there are no known problem reports with existing Linux
      trying to set bits at offset 0x92 which indicates that the quirk is not
      applicable. Likely it is not applicable on a wider range of platforms,
      but it is difficult to discern which platforms if any still depend on
      the quirk.
      
      Rather than try to fix the PCS quirk to consider the DNV register layout
      instead require explicit opt-in. The assumption is that the OS driver
      need not touch this register, and platforms can be added with a new
      boad_ahci_pcs7 board-id when / if problematic platforms are found in the
      future. The logic in ahci_intel_pcs_quirk() looks for all Intel AHCI
      instances with "legacy" board-ids and otherwise skips the quirk if the
      board was matched by class-code.
      Reported-by: default avatarStephen Douthit <stephend@silicom-usa.com>
      Cc: Christoph Hellwig <hch@infradead.org>
      Reviewed-by: default avatarStephen Douthit <stephend@silicom-usa.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      223b0481
    • Qian Cai's avatar
      iommu/amd: Silence warnings under memory pressure · de888e02
      Qian Cai authored
      [ Upstream commit 3d708895 ]
      
      When running heavy memory pressure workloads, the system is throwing
      endless warnings,
      
      smartpqi 0000:23:00.0: AMD-Vi: IOMMU mapping error in map_sg (io-pages:
      5 reason: -12)
      Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40
      07/10/2019
      swapper/10: page allocation failure: order:0, mode:0xa20(GFP_ATOMIC),
      nodemask=(null),cpuset=/,mems_allowed=0,4
      Call Trace:
       <IRQ>
       dump_stack+0x62/0x9a
       warn_alloc.cold.43+0x8a/0x148
       __alloc_pages_nodemask+0x1a5c/0x1bb0
       get_zeroed_page+0x16/0x20
       iommu_map_page+0x477/0x540
       map_sg+0x1ce/0x2f0
       scsi_dma_map+0xc6/0x160
       pqi_raid_submit_scsi_cmd_with_io_request+0x1c3/0x470 [smartpqi]
       do_IRQ+0x81/0x170
       common_interrupt+0xf/0xf
       </IRQ>
      
      because the allocation could fail from iommu_map_page(), and the volume
      of this call could be huge which may generate a lot of serial console
      output and cosumes all CPUs.
      
      Fix it by silencing the warning in this call site, and there is still a
      dev_err() later to notify the failure.
      Signed-off-by: default avatarQian Cai <cai@lca.pw>
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      de888e02
    • Takashi Sakamoto's avatar
      ALSA: firewire-motu: add support for MOTU 4pre · 6241c0ac
      Takashi Sakamoto authored
      [ Upstream commit 6af86bdb ]
      
      MOTU 4pre was launched in 2012 by MOTU, Inc. This commit allows userspace
      applications can transmit and receive PCM frames and MIDI messages for
      this model via ALSA PCM interface and RawMidi/Sequencer interfaces.
      
      The device supports MOTU protocol version 3. Unlike the other devices, the
      device is simply designed. The size of data block is fixed to 10 quadlets
      during available sampling rates (44.1 - 96.0 kHz). Each data block
      includes 1 source packet header, 2 data chunks for messages, 8 data chunks
      for PCM samples and 2 data chunks for padding to quadlet alignment. The
      device has no MIDI, optical, BNC and AES/EBU interfaces.
      
      Like support for the other MOTU devices, the quality of playback sound
      is not enough good with periodical noise yet.
      
      $ python2 crpp < ~/git/am-config-rom/motu/motu-4pre.img
                     ROM header and bus information block
                     -----------------------------------------------------------------
      400  041078cc  bus_info_length 4, crc_length 16, crc 30924
      404  31333934  bus_name "1394"
      408  20ff7000  irmc 0, cmc 0, isc 1, bmc 0, cyc_clk_acc 255, max_rec 7 (256)
      40c  0001f200  company_id 0001f2     |
      410  000a41c5  device_id 00000a41c5  | EUI-64 0001f200000a41c5
      
                     root directory
                     -----------------------------------------------------------------
      414  0004ef04  directory_length 4, crc 61188
      418  030001f2  vendor
      41c  0c0083c0  node capabilities per IEEE 1394
      420  d1000002  --> unit directory at 428
      424  8d000005  --> eui-64 leaf at 438
      
                     unit directory at 428
                     -----------------------------------------------------------------
      428  0003ceda  directory_length 3, crc 52954
      42c  120001f2  specifier id
      430  13000045  version
      434  17103800  model
      
                     eui-64 leaf at 438
                     -----------------------------------------------------------------
      438  0002d248  leaf_length 2, crc 53832
      43c  0001f200  company_id 0001f2     |
      440  000a41c5  device_id 00000a41c5  | EUI-64 0001f200000a41c5
      Signed-off-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      6241c0ac
    • Anton Eidelman's avatar
      nvme-multipath: fix ana log nsid lookup when nsid is not found · ad58ce6c
      Anton Eidelman authored
      [ Upstream commit e01f91df ]
      
      ANA log parsing invokes nvme_update_ana_state() per ANA group desc.
      This updates the state of namespaces with nsids in desc->nsids[].
      
      Both ctrl->namespaces list and desc->nsids[] array are sorted by nsid.
      Hence nvme_update_ana_state() performs a single walk over ctrl->namespaces:
      - if current namespace matches the current desc->nsids[n],
        this namespace is updated, and n is incremented.
      - the process stops when it encounters the end of either
        ctrl->namespaces end or desc->nsids[]
      
      In case desc->nsids[n] does not match any of ctrl->namespaces,
      the remaining nsids following desc->nsids[n] will not be updated.
      Such situation was considered abnormal and generated WARN_ON_ONCE.
      
      However ANA log MAY contain nsids not (yet) found in ctrl->namespaces.
      For example, lets consider the following scenario:
      - nvme0 exposes namespaces with nsids = [2, 3] to the host
      - a new namespace nsid = 1 is added dynamically
      - also, a ANA topology change is triggered
      - NS_CHANGED aen is generated and triggers scan_work
      - before scan_work discovers nsid=1 and creates a namespace, a NOTICE_ANA
        aen was issues and ana_work receives ANA log with nsids=[1, 2, 3]
      
      Result: ana_work fails to update ANA state on existing namespaces [2, 3]
      
      Solution:
      Change the way nvme_update_ana_state() namespace list walk
      checks the current namespace against desc->nsids[n] as follows:
      a) ns->head->ns_id < desc->nsids[n]: keep walking ctrl->namespaces.
      b) ns->head->ns_id == desc->nsids[n]: match, update the namespace
      c) ns->head->ns_id >= desc->nsids[n]: skip to desc->nsids[n+1]
      
      This enables correct operation in the scenario described above.
      This also allows ANA log to contain nsids currently invisible
      to the host, i.e. inactive nsids.
      Signed-off-by: default avatarAnton Eidelman <anton@lightbitslabs.com>
      Reviewed-by: default avatarJames Smart <james.smart@broadcom.com>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      ad58ce6c
    • Tom Wu's avatar
      nvmet: fix data units read and written counters in SMART log · 9edc229b
      Tom Wu authored
      [ Upstream commit 3bec2e37 ]
      
      In nvme spec 1.3 there is a definition for data write/read counters
      from SMART log, (See section 5.14.1.2):
      	This value is reported in thousands (i.e., a value of 1
      	corresponds to 1000 units of 512 bytes read) and is rounded up.
      
      However, in nvme target where value is reported with actual units,
      but not thousands of units as the spec requires.
      Signed-off-by: default avatarTom Wu <tomwu@mellanox.com>
      Reviewed-by: default avatarIsrael Rukshin <israelr@mellanox.com>
      Reviewed-by: default avatarMax Gurtovoy <maxg@mellanox.com>
      Reviewed-by: default avatarChaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      9edc229b
    • Song Liu's avatar
      x86/mm/pti: Handle unaligned address gracefully in pti_clone_pagetable() · 7bbb7a9d
      Song Liu authored
      [ Upstream commit 825d0b73 ]
      
      pti_clone_pmds() assumes that the supplied address is either:
      
       - properly PUD/PMD aligned
      or
       - the address is actually mapped which means that independently
         of the mapping level (PUD/PMD/PTE) the next higher mapping
         exists.
      
      If that's not the case the unaligned address can be incremented by PUD or
      PMD size incorrectly. All callers supply mapped and/or aligned addresses,
      but for the sake of robustness it's better to handle that case properly and
      to emit a warning.
      
      [ tglx: Rewrote changelog and added WARN_ON_ONCE() ]
      Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarIngo Molnar <mingo@kernel.org>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908282352470.1938@nanos.tec.linutronix.deSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      7bbb7a9d
    • Shengjiu Wang's avatar
      ASoC: fsl_ssi: Fix clock control issue in master mode · 5201b4ff
      Shengjiu Wang authored
      [ Upstream commit 696d0522 ]
      
      The test case is
      arecord -Dhw:0 -d 10 -f S16_LE -r 48000 -c 2 temp.wav &
      aplay -Dhw:0 -d 30 -f S16_LE -r 48000 -c 2 test.wav
      
      There will be error after end of arecord:
      aplay: pcm_write:2051: write error: Input/output error
      
      Capture and Playback work in parallel in master mode, one
      substream stops, the other substream is impacted, the
      reason is that clock is disabled wrongly.
      
      The clock's reference count is not increased when second
      substream starts, the hw_param() function returns in the
      beginning because first substream is enabled, then in end
      of first substream, the hw_free() disables the clock.
      
      This patch is to move the clock enablement to the place
      before checking of the device enablement in hw_param().
      Signed-off-by: default avatarShengjiu Wang <shengjiu.wang@nxp.com>
      Link: https://lore.kernel.org/r/1567012817-12625-1-git-send-email-shengjiu.wang@nxp.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5201b4ff
    • Thomas Gleixner's avatar
      x86/mm/pti: Do not invoke PTI functions when PTI is disabled · 4b7d9c2a
      Thomas Gleixner authored
      [ Upstream commit 990784b5 ]
      
      When PTI is disabled at boot time either because the CPU is not affected or
      PTI has been disabled on the command line, the boot code still calls into
      pti_finalize() which then unconditionally invokes:
      
           pti_clone_entry_text()
           pti_clone_kernel_text()
      
      pti_clone_kernel_text() was called unconditionally before the 32bit support
      was added and 32bit added the call to pti_clone_entry_text().
      
      The call has no side effects as cloning the page tables into the available
      second one, which was allocated for PTI does not create damage. But it does
      not make sense either and in case that this functionality would be extended
      later this might actually lead to hard to diagnose issues.
      
      Neither function should be called when PTI is runtime disabled. Make the
      invocation conditional.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
      Acked-by: default avatarIngo Molnar <mingo@kernel.org>
      Acked-by: default avatarSong Liu <songliubraving@fb.com>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Link: https://lkml.kernel.org/r/20190828143124.063353972@linutronix.deSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      4b7d9c2a
    • Mark Rutland's avatar
      arm64: kpti: ensure patched kernel text is fetched from PoU · eb2485e3
      Mark Rutland authored
      [ Upstream commit f32c7a8e ]
      
      While the MMUs is disabled, I-cache speculation can result in
      instructions being fetched from the PoC. During boot we may patch
      instructions (e.g. for alternatives and jump labels), and these may be
      dirty at the PoU (and stale at the PoC).
      
      Thus, while the MMU is disabled in the KPTI pagetable fixup code we may
      load stale instructions into the I-cache, potentially leading to
      subsequent crashes when executing regions of code which have been
      modified at runtime.
      
      Similarly to commit:
      
        8ec41987 ("arm64: mm: ensure patched kernel text is fetched from PoU")
      
      ... we can invalidate the I-cache after enabling the MMU to prevent such
      issues.
      
      The KPTI pagetable fixup code itself should be clean to the PoC per the
      boot protocol, so no maintenance is required for this code.
      Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Reviewed-by: default avatarJames Morse <james.morse@arm.com>
      Signed-off-by: default avatarWill Deacon <will@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      eb2485e3
    • Neil Horman's avatar
      x86/apic/vector: Warn when vector space exhaustion breaks affinity · b6194965
      Neil Horman authored
      [ Upstream commit 743dac49 ]
      
      On x86, CPUs are limited in the number of interrupts they can have affined
      to them as they only support 256 interrupt vectors per CPU. 32 vectors are
      reserved for the CPU and the kernel reserves another 22 for internal
      purposes. That leaves 202 vectors for assignement to devices.
      
      When an interrupt is set up or the affinity is changed by the kernel or the
      administrator, the vector assignment code attempts to honor the requested
      affinity mask. If the vector space on the CPUs in that affinity mask is
      exhausted the code falls back to a wider set of CPUs and assigns a vector
      on a CPU outside of the requested affinity mask silently.
      
      While the effective affinity is reflected in the corresponding
      /proc/irq/$N/effective_affinity* files the silent breakage of the requested
      affinity can lead to unexpected behaviour for administrators.
      
      Add a pr_warn() when this happens so that adminstrators get at least
      informed about it in the syslog.
      
      [ tglx: Massaged changelog and made the pr_warn() more informative ]
      
      Reported-by: djuran@redhat.com
      Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Tested-by: djuran@redhat.com
      Link: https://lkml.kernel.org/r/20190822143421.9535-1-nhorman@tuxdriver.comSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      b6194965
    • Douglas RAILLARD's avatar
      sched/cpufreq: Align trace event behavior of fast switching · 01e8f487
      Douglas RAILLARD authored
      [ Upstream commit 77c84dd1 ]
      
      Fast switching path only emits an event for the CPU of interest, whereas the
      regular path emits an event for all the CPUs that had their frequency changed,
      i.e. all the CPUs sharing the same policy.
      
      With the current behavior, looking at cpu_frequency event for a given CPU that
      is using the fast switching path will not give the correct frequency signal.
      Signed-off-by: default avatarDouglas RAILLARD <douglas.raillard@arm.com>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      01e8f487
    • Al Stone's avatar
      ACPI / CPPC: do not require the _PSD method · 2919fa03
      Al Stone authored
      [ Upstream commit 4c4cdc4c ]
      
      According to the ACPI 6.3 specification, the _PSD method is optional
      when using CPPC.  The underlying assumption is that each CPU can change
      frequency independently from all other CPUs; _PSD is provided to tell
      the OS that some processors can NOT do that.
      
      However, the acpi_get_psd() function returns ENODEV if there is no _PSD
      method present, or an ACPI error status if an error occurs when evaluating
      _PSD, if present.  This makes _PSD mandatory when using CPPC, in violation
      of the specification, and only on Linux.
      
      This has forced some firmware writers to provide a dummy _PSD, even though
      it is irrelevant, but only because Linux requires it; other OSPMs follow
      the spec.  We really do not want to have OS specific ACPI tables, though.
      
      So, correct acpi_get_psd() so that it does not return an error if there
      is no _PSD method present, but does return a failure when the method can
      not be executed properly.  This allows _PSD to be optional as it should
      be.
      Signed-off-by: default avatarAl Stone <ahs3@redhat.com>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      2919fa03
    • Katsuhiro Suzuki's avatar
      ASoC: es8316: fix headphone mixer volume table · b7992213
      Katsuhiro Suzuki authored
      [ Upstream commit f972d02f ]
      
      This patch fix setting table of Headphone mixer volume.
      Current code uses 4 ... 7 values but these values are prohibited.
      
      Correct settings are the following:
        0000 -12dB
        0001 -10.5dB
        0010 -9dB
        0011 -7.5dB
        0100 -6dB
        1000 -4.5dB
        1001 -3dB
        1010 -1.5dB
        1011 0dB
      Signed-off-by: default avatarKatsuhiro Suzuki <katsuhiro@katsuster.net>
      Reviewed-by: default avatarDaniel Drake <drake@endlessm.com>
      Link: https://lore.kernel.org/r/20190826153900.25969-1-katsuhiro@katsuster.netSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      b7992213
    • Mauro Carvalho Chehab's avatar
      media: ov9650: add a sanity check · dd25f76c
      Mauro Carvalho Chehab authored
      [ Upstream commit 093347ab ]
      
      As pointed by cppcheck:
      
      	[drivers/media/i2c/ov9650.c:706]: (error) Shifting by a negative value is undefined behaviour
      	[drivers/media/i2c/ov9650.c:707]: (error) Shifting by a negative value is undefined behaviour
      	[drivers/media/i2c/ov9650.c:721]: (error) Shifting by a negative value is undefined behaviour
      
      Prevent mangling with gains with invalid values.
      
      As pointed by Sylvester, this should never happen in practice,
      as min value of V4L2_CID_GAIN control is 16 (gain is always >= 16
      and m is always >= 0), but it is too hard for a static analyzer
      to get this, as the logic with validates control min/max is
      elsewhere inside V4L2 core.
      Reviewed-by: default avatarSylwester Nawrocki <s.nawrocki@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      dd25f76c
    • Benjamin Peterson's avatar
      perf trace beauty ioctl: Fix off-by-one error in cmd->string table · 342a0bee
      Benjamin Peterson authored
      [ Upstream commit b92675f4 ]
      
      While tracing a program that calls isatty(3), I noticed that strace
      reported TCGETS for the request argument of the underlying ioctl(2)
      syscall while perf trace reported TCSETS. strace is corrrect. The bug in
      perf was due to the tty ioctl beauty table starting at 0x5400 rather
      than 0x5401.
      
      Committer testing:
      
        Using augmented_raw_syscalls.o and settings to make 'perf trace'
        use strace formatting, i.e. with this in ~/.perfconfig
      
        # cat ~/.perfconfig
        [trace]
      	add_events = /home/acme/git/linux/tools/perf/examples/bpf/augmented_raw_syscalls.c
      	show_zeros = yes
      	show_duration = no
      	no_inherit = yes
      	show_timestamp = no
      	show_arg_names = no
      	args_alignment = 40
      	show_prefix = yes
      
        # strace -e ioctl stty > /dev/null
        ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
        ioctl(1, TIOCGWINSZ, 0x7fff8a9b0860)    = -1 ENOTTY (Inappropriate ioctl for device)
        ioctl(1, TCGETS, 0x7fff8a9b0540)        = -1 ENOTTY (Inappropriate ioctl for device)
        +++ exited with 0 +++
        #
      
      Before:
      
        # perf trace -e ioctl stty > /dev/null
        ioctl(0, TCSETS, 0x7fff2cf79f20)        = 0
        ioctl(1, TIOCSWINSZ, 0x7fff2cf79f40)    = -1 ENOTTY (Inappropriate ioctl for device)
        ioctl(1, TCSETS, 0x7fff2cf79c20)        = -1 ENOTTY (Inappropriate ioctl for device)
        #
      
      After:
      
        # perf trace -e ioctl stty > /dev/null
        ioctl(0, TCGETS, 0x7ffed0763920)        = 0
        ioctl(1, TIOCGWINSZ, 0x7ffed0763940)    = -1 ENOTTY (Inappropriate ioctl for device)
        ioctl(1, TCGETS, 0x7ffed0763620)        = -1 ENOTTY (Inappropriate ioctl for device)
        #
      Signed-off-by: default avatarBenjamin Peterson <benjamin@python.org>
      Tested-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Fixes: 1cc47f2d ("perf trace beauty ioctl: Improve 'cmd' beautifier")
      Link: http://lkml.kernel.org/r/20190823033625.18814-1-benjamin@python.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      342a0bee
    • Maciej S. Szmigiero's avatar
      media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate() · 57409ea7
      Maciej S. Szmigiero authored
      [ Upstream commit 9d802222 ]
      
      saa7134_i2c_eeprom_md7134_gate() function and the associated comment uses
      an inverted i2c gate open / closed terminology.
      Let's fix this.
      Signed-off-by: default avatarMaciej S. Szmigiero <mail@maciej.szmigiero.name>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      [hverkuil-cisco@xs4all.nl: fix alignment checkpatch warning]
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      57409ea7
    • Wenwen Wang's avatar
      media: cpia2_usb: fix memory leaks · 78550c5c
      Wenwen Wang authored
      [ Upstream commit 1c770f0f ]
      
      In submit_urbs(), 'cam->sbuf[i].data' is allocated through kmalloc_array().
      However, it is not deallocated if the following allocation for urbs fails.
      To fix this issue, free 'cam->sbuf[i].data' if usb_alloc_urb() fails.
      Signed-off-by: default avatarWenwen Wang <wenwen@cs.uga.edu>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      78550c5c
    • Wenwen Wang's avatar
      media: saa7146: add cleanup in hexium_attach() · d796c6c1
      Wenwen Wang authored
      [ Upstream commit 42e64117 ]
      
      If saa7146_register_device() fails, no cleanup is executed, leading to
      memory/resource leaks. To fix this issue, perform necessary cleanup work
      before returning the error.
      Signed-off-by: default avatarWenwen Wang <wenwen@cs.uga.edu>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      d796c6c1
    • Hans Verkuil's avatar
      media: cec-notifier: clear cec_adap in cec_notifier_unregister · ab20f38c
      Hans Verkuil authored
      [ Upstream commit 14d55116 ]
      
      If cec_notifier_cec_adap_unregister() is called before
      cec_unregister_adapter() then everything is OK (and this is the
      case today). But if it is the other way around, then
      cec_notifier_unregister() is called first, and that doesn't
      set n->cec_adap to NULL.
      
      So if e.g. cec_notifier_set_phys_addr() is called after
      cec_notifier_unregister() but before cec_unregister_adapter()
      then n->cec_adap points to an unregistered and likely deleted
      cec adapter. So just set n->cec_adap->notifier and n->cec_adap
      to NULL for rubustness.
      
      Eventually cec_notifier_unregister will disappear and this will
      be simplified substantially.
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      ab20f38c
    • Kamil Konieczny's avatar
      PM / devfreq: exynos-bus: Correct clock enable sequence · d51268d7
      Kamil Konieczny authored
      [ Upstream commit 2c2b20e0 ]
      
      Regulators should be enabled before clocks to avoid h/w hang. This
      require change in exynos_bus_probe() to move exynos_bus_parse_of()
      after exynos_bus_parent_parse_of() and change in error handling.
      Similar change is needed in exynos_bus_exit() where clock should be
      disabled before regulators.
      Signed-off-by: default avatarKamil Konieczny <k.konieczny@partner.samsung.com>
      Acked-by: default avatarChanwoo Choi <cw00.choi@samsung.com>
      Signed-off-by: default avatarMyungJoo Ham <myungjoo.ham@samsung.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      d51268d7
    • Leonard Crestez's avatar
      PM / devfreq: passive: Use non-devm notifiers · 7e19b7e0
      Leonard Crestez authored
      [ Upstream commit 0ef7c7cc ]
      
      The devfreq passive governor registers and unregisters devfreq
      transition notifiers on DEVFREQ_GOV_START/GOV_STOP using devm wrappers.
      
      If devfreq itself is registered with devm then a warning is triggered on
      rmmod from devm_devfreq_unregister_notifier. Call stack looks like this:
      
      	devm_devfreq_unregister_notifier+0x30/0x40
      	devfreq_passive_event_handler+0x4c/0x88
      	devfreq_remove_device.part.8+0x6c/0x9c
      	devm_devfreq_dev_release+0x18/0x20
      	release_nodes+0x1b0/0x220
      	devres_release_all+0x78/0x84
      	device_release_driver_internal+0x100/0x1c0
      	driver_detach+0x4c/0x90
      	bus_remove_driver+0x7c/0xd0
      	driver_unregister+0x2c/0x58
      	platform_driver_unregister+0x10/0x18
      	imx_devfreq_platdrv_exit+0x14/0xd40 [imx_devfreq]
      
      This happens because devres_release_all will first remove all the nodes
      into a separate todo list so the nested devres_release from
      devm_devfreq_unregister_notifier won't find anything.
      
      Fix the warning by calling the non-devm APIS for frequency notification.
      Using devm wrappers is not actually useful for a governor anyway: it
      relies on the devfreq core to correctly match the GOV_START/GOV_STOP
      notifications.
      
      Fixes: 99613311 ("PM / devfreq: Add new passive governor")
      Signed-off-by: default avatarLeonard Crestez <leonard.crestez@nxp.com>
      Acked-by: default avatarChanwoo Choi <cw00.choi@samsung.com>
      Signed-off-by: default avatarMyungJoo Ham <myungjoo.ham@samsung.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      7e19b7e0
    • Yazen Ghannam's avatar
      EDAC/amd64: Decode syndrome before translating address · f9de170e
      Yazen Ghannam authored
      [ Upstream commit 8a2eaab7 ]
      
      AMD Family 17h systems currently require address translation in order to
      report the system address of a DRAM ECC error. This is currently done
      before decoding the syndrome information. The syndrome information does
      not depend on the address translation, so the proper EDAC csrow/channel
      reporting can function without the address. However, the syndrome
      information will not be decoded if the address translation fails.
      
      Decode the syndrome information before doing the address translation.
      The syndrome information is architecturally defined in MCA_SYND and can
      be considered robust. The address translation is system-specific and may
      fail on newer systems without proper updates to the translation
      algorithm.
      
      Fixes: 713ad546 ("EDAC, amd64: Define and register UMC error decode function")
      Signed-off-by: default avatarYazen Ghannam <yazen.ghannam@amd.com>
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
      Cc: James Morse <james.morse@arm.com>
      Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
      Cc: Tony Luck <tony.luck@intel.com>
      Link: https://lkml.kernel.org/r/20190821235938.118710-6-Yazen.Ghannam@amd.comSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      f9de170e
    • Yazen Ghannam's avatar
      EDAC/amd64: Recognize DRAM device type ECC capability · 6f80e91a
      Yazen Ghannam authored
      [ Upstream commit f8be8e56 ]
      
      AMD Family 17h systems support x4 and x16 DRAM devices. However, the
      device type is not checked when setting mci.edac_ctl_cap.
      
      Set the appropriate capability flag based on the device type.
      
      Default to x8 DRAM device when neither the x4 or x16 bits are set.
      
       [ bp: reverse cpk_en check to save an indentation level. ]
      
      Fixes: 2d09d8f3 ("EDAC, amd64: Determine EDAC MC capabilities on Fam17h")
      Signed-off-by: default avatarYazen Ghannam <yazen.ghannam@amd.com>
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
      Cc: James Morse <james.morse@arm.com>
      Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
      Cc: Tony Luck <tony.luck@intel.com>
      Link: https://lkml.kernel.org/r/20190821235938.118710-3-Yazen.Ghannam@amd.comSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      6f80e91a
    • Gerald BAEZA's avatar
      libperf: Fix alignment trap with xyarray contents in 'perf stat' · adb97f18
      Gerald BAEZA authored
      [ Upstream commit d9c5c083 ]
      
      Following the patch 'perf stat: Fix --no-scale', an alignment trap
      happens in process_counter_values() on ARMv7 platforms due to the
      attempt to copy non 64 bits aligned double words (pointed by 'count')
      via a NEON vectored instruction ('vld1' with 64 bits alignment
      constraint).
      
      This patch sets a 64 bits alignment constraint on 'contents[]' field in
      'struct xyarray' since the 'count' pointer used above points to such a
      structure.
      Signed-off-by: default avatarGerald Baeza <gerald.baeza@st.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Alexandre Torgue <alexandre.torgue@st.com>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Link: http://lkml.kernel.org/r/1566464769-16374-1-git-send-email-gerald.baeza@st.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      adb97f18
    • Wenwen Wang's avatar
      media: dvb-core: fix a memory leak bug · 4df2427a
      Wenwen Wang authored
      [ Upstream commit fcd5ce4b ]
      
      In dvb_create_media_entity(), 'dvbdev->entity' is allocated through
      kzalloc(). Then, 'dvbdev->pads' is allocated through kcalloc(). However, if
      kcalloc() fails, the allocated 'dvbdev->entity' is not deallocated, leading
      to a memory leak bug. To fix this issue, free 'dvbdev->entity' before
      returning -ENOMEM.
      Signed-off-by: default avatarWenwen Wang <wenwen@cs.uga.edu>
      Signed-off-by: default avatarSean Young <sean@mess.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      4df2427a
    • Thomas Gleixner's avatar
      posix-cpu-timers: Sanitize bogus WARNONS · 8d5fccff
      Thomas Gleixner authored
      [ Upstream commit 692117c1 ]
      
      Warning when p == NULL and then proceeding and dereferencing p does not
      make any sense as the kernel will crash with a NULL pointer dereference
      right away.
      
      Bailing out when p == NULL and returning an error code does not cure the
      underlying problem which caused p to be NULL. Though it might allow to
      do proper debugging.
      
      Same applies to the clock id check in set_process_cpu_timer().
      
      Clean them up and make them return without trying to do further damage.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarFrederic Weisbecker <frederic@kernel.org>
      Link: https://lkml.kernel.org/r/20190819143801.846497772@linutronix.deSigned-off-by: default avatarSasha Levin <sashal@kernel.org>
      8d5fccff
    • Sean Young's avatar
      media: dvb-frontends: use ida for pll number · 9df9652b
      Sean Young authored
      [ Upstream commit c268e7ad ]
      
      KASAN: global-out-of-bounds Read in dvb_pll_attach
      
      Syzbot reported global-out-of-bounds Read in dvb_pll_attach, while
      accessing id[dvb_pll_devcount], because dvb_pll_devcount was 65,
      that is more than size of 'id' which is DVB_PLL_MAX(64).
      
      Rather than increasing dvb_pll_devcount every time, use ida so that
      numbers are allocated correctly. This does mean that no more than
      64 devices can be attached at the same time, but this is more than
      sufficient.
      
      usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the
      software demuxer
      dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0)
      usb 1-1: media controller created
      dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
      tc90522 0-0018: Toshiba TC90522 attached.
      usb 1-1: DVB: registering adapter 0 frontend 0 (Toshiba TC90522 ISDB-T
      module)...
      dvbdev: dvb_create_media_entity: media entity 'Toshiba TC90522 ISDB-T
      module' registered.
      ==================================================================
      BUG: KASAN: global-out-of-bounds in dvb_pll_attach+0x6c5/0x830
      drivers/media/dvb-frontends/dvb-pll.c:798
      Read of size 4 at addr ffffffff89c9e5e0 by task kworker/0:1/12
      
      CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.2.0-rc6+ #13
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
      Google 01/01/2011
      Workqueue: usb_hub_wq hub_event
      Call Trace:
        __dump_stack lib/dump_stack.c:77 [inline]
        dump_stack+0xca/0x13e lib/dump_stack.c:113
        print_address_description+0x67/0x231 mm/kasan/report.c:188
        __kasan_report.cold+0x1a/0x32 mm/kasan/report.c:317
        kasan_report+0xe/0x20 mm/kasan/common.c:614
        dvb_pll_attach+0x6c5/0x830 drivers/media/dvb-frontends/dvb-pll.c:798
        dvb_pll_probe+0xfe/0x174 drivers/media/dvb-frontends/dvb-pll.c:877
        i2c_device_probe+0x790/0xaa0 drivers/i2c/i2c-core-base.c:389
        really_probe+0x281/0x660 drivers/base/dd.c:509
        driver_probe_device+0x104/0x210 drivers/base/dd.c:670
        __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
        bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
        __device_attach+0x217/0x360 drivers/base/dd.c:843
        bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
        device_add+0xae6/0x16f0 drivers/base/core.c:2111
        i2c_new_client_device+0x5b3/0xc40 drivers/i2c/i2c-core-base.c:778
        i2c_new_device+0x19/0x50 drivers/i2c/i2c-core-base.c:821
        dvb_module_probe+0xf9/0x220 drivers/media/dvb-core/dvbdev.c:985
        friio_tuner_attach+0x125/0x1d0 drivers/media/usb/dvb-usb-v2/gl861.c:536
        dvb_usbv2_adapter_frontend_init
      drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:675 [inline]
        dvb_usbv2_adapter_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:804
      [inline]
        dvb_usbv2_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:865 [inline]
        dvb_usbv2_probe.cold+0x24dc/0x255d
      drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:980
        usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
        really_probe+0x281/0x660 drivers/base/dd.c:509
        driver_probe_device+0x104/0x210 drivers/base/dd.c:670
        __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
        bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
        __device_attach+0x217/0x360 drivers/base/dd.c:843
        bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
        device_add+0xae6/0x16f0 drivers/base/core.c:2111
        usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
        generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
        usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
        really_probe+0x281/0x660 drivers/base/dd.c:509
        driver_probe_device+0x104/0x210 drivers/base/dd.c:670
        __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
        bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
        __device_attach+0x217/0x360 drivers/base/dd.c:843
        bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
        device_add+0xae6/0x16f0 drivers/base/core.c:2111
        usb_new_device.cold+0x8c1/0x1016 drivers/usb/core/hub.c:2534
        hub_port_connect drivers/usb/core/hub.c:5089 [inline]
        hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
        port_event drivers/usb/core/hub.c:5350 [inline]
        hub_event+0x1ada/0x3590 drivers/usb/core/hub.c:5432
        process_one_work+0x905/0x1570 kernel/workqueue.c:2269
        process_scheduled_works kernel/workqueue.c:2331 [inline]
        worker_thread+0x7ab/0xe20 kernel/workqueue.c:2417
        kthread+0x30b/0x410 kernel/kthread.c:255
        ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
      
      The buggy address belongs to the variable:
        id+0x100/0x120
      
      Memory state around the buggy address:
        ffffffff89c9e480: fa fa fa fa 00 00 fa fa fa fa fa fa 00 00 00 00
        ffffffff89c9e500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      > ffffffff89c9e580: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
                                                              ^
        ffffffff89c9e600: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
        ffffffff89c9e680: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
      ==================================================================
      
      Reported-by: syzbot+8a8f48672560c8ca59dd@syzkaller.appspotmail.com
      Signed-off-by: default avatarSean Young <sean@mess.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      9df9652b
    • A Sun's avatar
      media: mceusb: fix (eliminate) TX IR signal length limit · 006a6065
      A Sun authored
      [ Upstream commit 9fc3ce31 ]
      
      Fix and eliminate mceusb's IR length limit for IR signals transmitted to
      the MCE IR blaster ports.
      
      An IR signal TX exceeding 306 pulse/space samples presently causes -EINVAL
      return error. There's no such limitation nor error with the MCE device
      hardware. And valid IR signals exist with more than 400 pulse/space for the
      control of certain appliances (eg Panasonic ACXA75C00600 air conditioner).
      
      The scope of this patch is limited to the mceusb driver. There are still
      IR signal TX length and time constraints that related modules of rc core
      (eg LIRC) impose, further up the driver stack.
      
      Changes for mceusb_tx_ir():
      
      Converts and sends LIRC IR pulse/space sequence to MCE device IR
      pulse/space format.
      
      Break long length LIRC sequence into multiple (unlimited number of) parts
      for sending to the MCE device.
      Reduce kernel stack IR buffer size: 128 (was 384)
      Increase MCE IR data packet size: 31 (was 5)
      Zero time LIRC pulse/space no longer copied to MCE IR data.
      Eliminate overwriting the source/input LIRC IR data in txbuf[].
      Eliminate -EINVAL return; return number of IR samples sent (>0) or
      MCE write error code (<0).
      
      New mce_write() and mce_write_callback():
      
      Implements synchronous blocking I/O, with timeout, for writing/sending
      data to the MCE device.
      
      An unlimited multipart IR signal sent to the MCE device faster than real
      time requires flow control absent with the original mce_request_packet()
      and mce_async_callback() asynchronous I/O implementation. Also absent is
      TX error feedback.
      
      mce_write() combines and replaces mce_request_packet() and
      mce_async_callback() with conversion to synchronous I/O.
      mce_write() returns bytes sent (>0) or MCE device write error (<0).
      Debug hex dump TX data before processing.
      
      Rename mce_async_out() -> mce_command_out():
      
      The original name is misleading with underlying synchronous I/O
      implementation. Function renamed to mce_command_out().
      
      Changes in mceusb_handle_command():
      
      Add support for MCE device error case MCE_RSP_TX_TIMEOUT
      "IR TX timeout (TX buffer underrun)"
      
      Changes in mceusb_dev_printdata():
      
      Changes support test and debug of multipart TX IR.
      
      Add buffer boundary information (offset and buffer size) to TX hex dump.
      Correct TX trace bug "Raw IR data, 0 pulse/space samples"
      Add trace for MCE_RSP_TX_TIMEOUT "IR TX timeout (TX buffer underrun)"
      
      Other changes:
      
      The driver's write to USB device architecture change (async to sync I/O)
      is significant so we bump DRIVER_VERSION to "1.95" (from "1.94").
      
      Tests:
      
      $ cat -n irdata1 | head -3
           1  carrier 36000
           2  pulse 6350
           3  space 6350
      $ cat -n irdata1 | tail -3
          76  pulse 6350
          77  space 6350
          78  pulse 6350
      $ ir-ctl -s irdata1
      
      [1549021.073612] mceusb 1-1.3:1.0: requesting 36000 HZ carrier
      [1549021.073635] mceusb 1-1.3:1.0: tx data[0]: 9f 06 01 45 (len=4 sz=4)
      [1549021.073649] mceusb 1-1.3:1.0: Request carrier of 35714 Hz (period 28us)
      [1549021.073848] mceusb 1-1.3:1.0: tx done status = 4 (wait = 100, expire = 100 (1000ms), urb->actual_length = 4, urb->status = 0)
      [1549021.074689] mceusb 1-1.3:1.0: rx data[0]: 9f 06 01 45 (len=4 sz=4)
      [1549021.074701] mceusb 1-1.3:1.0: Got carrier of 35714 Hz (period 28us)
      [1549021.102023] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3)
      [1549021.102036] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03
      [1549021.102219] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0)
      [1549021.131979] mceusb 1-1.3:1.0: tx data[0]: 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 91 ff (len=81 sz=81)
      [1549021.131992] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples
      [1549021.133592] mceusb 1-1.3:1.0: tx done status = 81 (wait = 100, expire = 100 (1000ms), urb->actual_length = 81, urb->status = 0)
      
      Hex dumps limited to 64 bytes.
      0xff is MCE maximum time pulse, 0x7f is MCE maximum time space.
      
      $ cat -n irdata2 | head -3
           1  carrier 36000
           2  pulse 50
           3  space 50
      $ cat -n irdata2 | tail -3
         254  pulse 50
         255  space 50
         256  pulse 50
      $ ir-ctl -s irdata2
      
      [1549306.586998] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3)
      [1549306.587015] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03
      [1549306.587252] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0)
      [1549306.613275] mceusb 1-1.3:1.0: tx data[0]: 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 (len=128 sz=128)
      [1549306.613291] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples
      [1549306.614837] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0)
      [1549306.614861] mceusb 1-1.3:1.0: tx data[0]: 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 (len=128 sz=128)
      [1549306.614869] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples
      [1549306.620199] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0)
      [1549306.620212] mceusb 1-1.3:1.0: tx data[0]: 89 81 01 81 01 81 01 81 01 81 80 (len=11 sz=11)
      [1549306.620221] mceusb 1-1.3:1.0: Raw IR data, 9 pulse/space samples
      [1549306.633294] mceusb 1-1.3:1.0: tx done status = 11 (wait = 98, expire = 100 (1000ms), urb->actual_length = 11, urb->status = 0)
      
      Hex dumps limited to 64 bytes.
      0x81 is MCE minimum time pulse, 0x01 is MCE minimum time space.
      TX IR part 3 sz=11 shows 20msec I/O blocking delay
      (100expire - 98wait = 2jiffies)
      Signed-off-by: default avatarA Sun <as1033x@comcast.net>
      Signed-off-by: default avatarSean Young <sean@mess.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      006a6065
    • Mike Christie's avatar
      nbd: add missing config put · d093d318
      Mike Christie authored
      [ Upstream commit 887e975c ]
      
      Fix bug added with the patch:
      
      commit 8f3ea359
      Author: Josef Bacik <josef@toxicpanda.com>
      Date:   Mon Jul 16 12:11:35 2018 -0400
      
          nbd: handle unexpected replies better
      
      where if the timeout handler runs when the completion path is and we fail
      to grab the mutex in the timeout handler we will leave a config reference
      and cannot free the config later.
      Reviewed-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Signed-off-by: default avatarMike Christie <mchristi@redhat.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      d093d318
    • Wenwen Wang's avatar
      led: triggers: Fix a memory leak bug · e497ec26
      Wenwen Wang authored
      [ Upstream commit 60e2dde1 ]
      
      In led_trigger_set(), 'event' is allocated in kasprintf(). However, it is
      not deallocated in the following execution if the label 'err_activate' or
      'err_add_groups' is entered, leading to memory leaks. To fix this issue,
      free 'event' before returning the error.
      
      Fixes: 52c47742 ("leds: triggers: send uevent when changing triggers")
      Signed-off-by: default avatarWenwen Wang <wenwen@cs.uga.edu>
      Acked-by: default avatarPavel Machek <pavel@ucw.cz>
      Signed-off-by: default avatarJacek Anaszewski <jacek.anaszewski@gmail.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e497ec26
    • Maxime Ripard's avatar
      ASoC: sun4i-i2s: Don't use the oversample to calculate BCLK · 83c2a42b
      Maxime Ripard authored
      [ Upstream commit 7df8f9a2 ]
      
      The BCLK divider should be calculated using the parameters that actually
      make the BCLK rate: the number of channels, the sampling rate and the
      sample width.
      
      We've been using the oversample_rate previously because in the former SoCs,
      the BCLK's parent is MCLK, which in turn is being used to generate the
      oversample rate, so we end up with something like this:
      
      oversample = mclk_rate / sampling_rate
      bclk_div = oversample / word_size / channels
      
      So, bclk_div = mclk_rate / sampling_rate / word_size / channels.
      
      And this is actually better, since the oversampling ratio only plays a role
      because the MCLK is its parent, not because of what BCLK is supposed to be.
      
      Furthermore, that assumption of MCLK being the parent has been broken on
      newer SoCs, so let's use the proper formula, and have the parent rate as an
      argument.
      
      Fixes: 7d299381 ("ASoC: sun4i-i2s: Add support for H3")
      Fixes: 21faaea1 ("ASoC: sun4i-i2s: Add support for A83T")
      Fixes: 66ecce33 ("ASoC: sun4i-i2s: Add compatibility with A64 codec I2S")
      Signed-off-by: default avatarMaxime Ripard <maxime.ripard@bootlin.com>
      Link: https://lore.kernel.org/r/c3595e3a9788c2ef2dcc30aa3c8c4953bb5cc249.1566242458.git-series.maxime.ripard@bootlin.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      83c2a42b
    • Arnaldo Carvalho de Melo's avatar
      tools headers: Fixup bitsperlong per arch includes · 5466c30b
      Arnaldo Carvalho de Melo authored
      [ Upstream commit 42fc2e9e ]
      
      We were getting the file by luck, from one of the paths in -I, fix it to
      get it from the proper place:
      
        $ cd tools/include/uapi/asm/
        [acme@quaco asm]$ grep include bitsperlong.h
        #include "../../arch/x86/include/uapi/asm/bitsperlong.h"
        #include "../../arch/arm64/include/uapi/asm/bitsperlong.h"
        #include "../../arch/powerpc/include/uapi/asm/bitsperlong.h"
        #include "../../arch/s390/include/uapi/asm/bitsperlong.h"
        #include "../../arch/sparc/include/uapi/asm/bitsperlong.h"
        #include "../../arch/mips/include/uapi/asm/bitsperlong.h"
        #include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
        #include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
        #include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
        #include <asm-generic/bitsperlong.h>
        $ ls -la ../../arch/x86/include/uapi/asm/bitsperlong.h
        ls: cannot access '../../arch/x86/include/uapi/asm/bitsperlong.h': No such file or directory
        $ ls -la ../../../arch/*/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 237 ../../../arch/alpha/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 841 ../../../arch/arm64/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 966 ../../../arch/hexagon/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 234 ../../../arch/ia64/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 100 ../../../arch/microblaze/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 244 ../../../arch/mips/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 352 ../../../arch/parisc/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 312 ../../../arch/powerpc/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 353 ../../../arch/riscv/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 292 ../../../arch/s390/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 323 ../../../arch/sparc/include/uapi/asm/bitsperlong.h
        -rw-rw-r--. 1 320 ../../../arch/x86/include/uapi/asm/bitsperlong.h
        $
      
      Found while fixing some other problem, before it was escaping the
      tools/ chroot and using stuff in the kernel sources:
      
          CC       /tmp/build/perf/util/find_bit.o
      In file included from /git/linux/tools/include/../../arch/x86/include/uapi/asm/bitsperlong.h:11,
                       from /git/linux/tools/include/uapi/asm/bitsperlong.h:3,
                       from /git/linux/tools/include/linux/bits.h:6,
                       from /git/linux/tools/include/linux/bitops.h:13,
                       from ../lib/find_bit.c:17:
      
        # cd /git/linux/tools/include/../../arch/x86/include/uapi/asm/
        # pwd
        /git/linux/arch/x86/include/uapi/asm
        #
      
      Now it is getting the one we want it to, i.e. the one inside tools/:
      
          CC       /tmp/build/perf/util/find_bit.o
        In file included from /git/linux/tools/arch/x86/include/uapi/asm/bitsperlong.h:11,
                         from /git/linux/tools/include/linux/bits.h:6,
                         from /git/linux/tools/include/linux/bitops.h:13,
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-8f8cfqywmf6jk8a3ucr0ixhu@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5466c30b