Notify to the user that although he closed the FD, the device is
still in use because there are live CS and/or memory mappings (mmaps).
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
After any reset (soft or hard) the device (the engines/QMANs) should
be idle. If they are not idle, fail the reset. If it is soft-reset,
the driver will try to do hard-reset automatically. If it is hard-reset,
the driver will make the device non-operational.
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
The device is actually released only after the refcnt of the hpriv
structure is 0, which means all its contexts were closed.
If we reset the device while a context is still open, there are
possibilities for unexpected behavior and crashes. For example, if the
process has a mapping of a register block that is now currently being
reset, and the process writes/reads to that block during the reset,
the device can get stuck.
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
In order to support command submissions that are done directly from
user space, the driver must perform soft reset once user closes its FD.
In case the soft reset fails or device is not idle, a hard reset should
be performed.
Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
currently we support only 2 asids in all asics.
asid 0 for driver, and asic 1 for user.
no need to setup 1024 asids configurations at init phase.
Signed-off-by: farah kassabri <fkassabri@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Detailed description for this pull request:
1. Update extcon provider driver
- Add the support of charging interrupt to detect charger connector
for extcon-max8997.c
- Detect OTG when USB_ID pin is connected to ground for extcon-sm5502.c
- Add the support for VBUS detection for extcon-qcom-spmi-misc.c
and replace qcom,pm8941-misc binding document with yaml style.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEEsSpuqBtbWtRe4rLGnM3fLN7rz1MFAmBupE8WHGN3MDAuY2hv
aUBzYW1zdW5nLmNvbQAKCRCczd8s3uvPUySWD/9+0DGK4TeGN65gLaSwvfsRTqh9
tehp8kmjhbH0xWeL93wY+ME+wNjFbclSC85/zX3/OwevM+xjwTD5qscTSfamDAWa
I9SErOmlOlR4mKJiTHvT7b2l7veUeOKyjy4GKyddLhCiC7zVb5rjT7pihGsNTnKf
dVJziiY3rb7eB34KqZwGexX6lmzAk68WwHBlxbj66J9CV1uxk6mmvLzX23tJmUjR
id+hHIrrvwEMe1FNNATq8BS/BKniDpllHKE0+3NMmbhUqXSyIaLVpH0PmdIMgg69
yllBc53VUjK/2m1YJICkNGXPLi9GojvFxyWf0sq9Jbcd/Q/P7m2wfe7OV3t7/1L2
kuRL2xNcM+NKqVTdzfnrxIpgRTdHYi7BjVplEOrmHpC+ehZMBIVS861kh2TF1J7j
n7LJ9FzdNcyGC26jeN/r13+0hrezxicN4nfXnG8iKGglHOjhHKD1NTWSD2Rrzt7m
mBQ9yPq2hZGrGNEaslB3c6xxwFOsdMgPl3c9vmsW5BFwmLwzrFcOkXm6Yrotn7yU
MOL9ATQ8mAEGuuKZHq3AfUVRnSapQM7ZgAralVaa+LD5j6vlDu1DRFvHRnilbNab
Ao9zFNA6TNwd6EduSv32GsCPhPlYxlQQ3h2HoaoAvm1UXY3bhsFObW2oJap9WtQe
iYw4FInGNjS/ESIkZg==
=13Nh
-----END PGP SIGNATURE-----
Merge tag 'extcon-next-for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into char-misc-next
Chanwoo writes:
Update extcon next for v5.13
Detailed description for this pull request:
1. Update extcon provider driver
- Add the support of charging interrupt to detect charger connector
for extcon-max8997.c
- Detect OTG when USB_ID pin is connected to ground for extcon-sm5502.c
- Add the support for VBUS detection for extcon-qcom-spmi-misc.c
and replace qcom,pm8941-misc binding document with yaml style.
* tag 'extcon-next-for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon:
extcon: qcom-spmi: Add support for VBUS detection
bindings: pm8941-misc: Add support for VBUS detection
bindings: pm8941-misc: Convert bindings to YAML
extcon: sm5502: Detect OTG when USB_ID is connected to ground
extcon: max8997: Add CHGINS and CHGRM interrupt handling
FPGA Manager:
- Russ' first change improves port_enable reliability
- Russ' second change adds a new device ID for a DFL device
- Geert's change updates the examples in binding with dt overlay sugar
syntax
All patches have been reviewed on the mailing list, and have been in the
last linux-next releases (as part of my for-next branch) without issues.
Signed-off-by: Moritz Fischer <mdf@kernel.org>
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQRORt0E5Sb/c/mZMgkXxQAtim5VSwUCYG5feQAKCRAXxQAtim5V
S1v3AQDR8dK1Bfoa8h8QHM+Xhb8UNkoC70Fbl/znQrTbRPimtAEAkgmKgElijBdL
zE+zMFa0OUnkBCHW2IQZXfuu+qI9GQw=
=P0ck
-----END PGP SIGNATURE-----
Merge tag 'fpga-late-for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga into char-misc-next
Moritz writes:
Second set of FPGA Manager changes for 5.13-rc1
FPGA Manager:
- Russ' first change improves port_enable reliability
- Russ' second change adds a new device ID for a DFL device
- Geert's change updates the examples in binding with dt overlay sugar
syntax
All patches have been reviewed on the mailing list, and have been in the
last linux-next releases (as part of my for-next branch) without issues.
Signed-off-by: Moritz Fischer <mdf@kernel.org>
* tag 'fpga-late-for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga:
fpga: dfl: pci: add DID for D5005 PAC cards
dt-bindings: fpga: fpga-region: Convert to sugar syntax
fpga: dfl: afu: harden port enable logic
fpga: Add support for Xilinx DFX AXI Shutdown manager
dt-bindings: fpga: Add compatible value for Xilinx DFX AXI shutdown manager
fpga: xilinx-pr-decoupler: Simplify code by using dev_err_probe()
fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER
VBUS can be detected via a dedicated PMIC pin. Add support
for reporting the VBUS status.
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
Signed-off-by: Kavya Nunna <knunna@codeaurora.org>
Signed-off-by: Guru Das Srinagesh <gurus@codeaurora.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Add interrupt support for reporting VBUS detection status that can be
detected via a dedicated PMIC pin.
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
Signed-off-by: Guru Das Srinagesh <gurus@codeaurora.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Convert bindings from txt to YAML.
Signed-off-by: Guru Das Srinagesh <gurus@codeaurora.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
In it's curent state this driver ignores OTG adapters with ID pin
connected to ground. This commit adds a check to set extcon into
host mode when such OTG adapter is connected.
Signed-off-by: Nikita Travkin <nikitos.tr@gmail.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
This allows the MAX8997 charger to set the current limit depending on
the detected extcon charger type.
Signed-off-by: Timon Baetz <timon.baetz@protonmail.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
The sparse tool complains as follows:
drivers/hwtracing/coresight/coresight-etm-perf.c:61:25: warning:
symbol 'format_attr_contextid' was not declared. Should it be static?
This symbol is not used outside of coresight-etm-perf.c, so this
commit marks it static.
Link: https://lore.kernel.org/r/20210308123250.2417947-1-weiyongjun1@huawei.com
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20210407160007.418053-3-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
- Updates:
- Yaml conversion for mvebu-utmi binding, bcm-ns-usb2 and
bcm-ns-usb3 bindings
- Mediatek dsi and hdmi phy updates
- TI j721e-wiz updates for AM64
- Cadence-torrent phy updates for SGMII/QSGMII
- New support:
- usb3-dp phy for Qualcomm SM8250
- UTMI phy for Armada CP110
- USB phy for Qualcomm SC7280
- Binding and driver for Sparx5 ethernet serdes
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmBtqI0ACgkQfBQHDyUj
g0f09hAAn1C0rmyPFjycPTWwnbom52AFMvG95jZJvUK8QDxBDOuhnv0qcZa7pdgt
ulSMLK2AhEExyqtUFf6TSZDZJXHioriGJh54D3qqBGtFHnc/60eTQfVHbp6H8ulr
G/NmyXeB4nUdco8Lw38Fs6RQufSwQTWLLaPHPCEGTFZr3g0gh7RfaHyHF8CpOGNI
Dd+IiPs+TMfB3MKaY3im45WP4e1sYQiPkMs8XQpu04Fvz2CELUxk1qK7GDviISIt
tkU5G87Syu5oCNaKm1sus817yIbLTIU0pPYq6c/JDpPL3l9vavbsZ3HrOkMD7XOQ
tpDcOkepU3srDkv8GIClfdJdzu8lOhmYbE4ktvlBtKLSf6XFC17whamHu9eYcrqH
6x9PFDRm7hloAjxLuiEQInsNndW7mF0BUwCfEW7iOZ+Mzh06HqkHSSLF0gpFoYFj
YUC0fKubqP/IHV32G1iQ+61ftjcAx7WOcZn2VJXHxiomjPJrRr5plIlTkOT8pcIW
R7nDcxN8f0LRpuXx+pFjqWpTK/lvG0cO3DxNpaeTF7kfy5hYyvOtw6MconDR7qJa
f1PQGhO49IYBjSwDdxgu6MtevhOt62NVRXuNs5mjqPEzLVrjvHshAOdo2Xwd8mjz
47wWR9LUAXc1/S+H+gHpn1Chl7p+8HbgE1VdbrJ7limuF6E6fFQ=
=T8Jv
-----END PGP SIGNATURE-----
Merge tag 'phy-for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy into char-misc-next
Vinod writes:
phy-for-5.13
- Updates:
- Yaml conversion for mvebu-utmi binding, bcm-ns-usb2 and
bcm-ns-usb3 bindings
- Mediatek dsi and hdmi phy updates
- TI j721e-wiz updates for AM64
- Cadence-torrent phy updates for SGMII/QSGMII
- New support:
- usb3-dp phy for Qualcomm SM8250
- UTMI phy for Armada CP110
- USB phy for Qualcomm SC7280
- Binding and driver for Sparx5 ethernet serdes
* tag 'phy-for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (75 commits)
phy: fix resource_size.cocci warnings
phy: Sparx5 Eth SerDes: Use direct register operations
phy: hisilicon: Use the correct HiSilicon copyright
phy: marvell: phy-mvebu-cp11i-utmi needs USB_COMMON
phy: qcom-qmp: add support for sm8250-usb3-dp phy
phy: qcom-qmp: rename common registers
phy: qcom-qmp: move DP functions to callbacks
dt-bindings: phy: qcom,qmp-usb3-dp: Add support for SM8250
dt-bindings: phy: qcom,qmp-usb3-dp-phy: move usb3 compatibles back to qcom,qmp-phy.yaml
phy: ti: j721e-wiz: Configure 'p_standard_mode' only for DP/QSGMII
dt-bindings: phy: fix dt_binding_check warning in mediatek, ufs-phy.yaml
phy: zynqmp: Handle the clock enable/disable properly
dt-bindings: phy: bcm-ns-usb3-phy: convert to yaml
dt-bindings: phy: bcm-ns-usb2-phy: convert to yaml
phy: microchip: PHY_SPARX5_SERDES should depend on ARCH_SPARX5
phy: cadence-torrent: Add delay for PIPE clock to be stable
phy: cadence-torrent: Explicitly request exclusive reset control
phy: cadence-torrent: Do not configure SERDES if it's already configured
phy: cadence-torrent: Group reset APIs and clock APIs
phy: ti: j721e-wiz: Do not configure wiz if its already configured
...
Updates for v5.13-rc1 are:
Core:
- Ability to add quirks for masters
- static checker cleanup for bus code
Drivers:
- DMI quirks for Intel controllers
- static checker cleanup for drivers
- add auto enumeration support qcom controller
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmBtpLAACgkQfBQHDyUj
g0d16BAApeM21dkUO8oqqsN+zp9AVHaPVlpiRHPjtTHioY89d19v4usBhGfGVmgg
aPzLEgvkknJ8f3lOeUy5GPNhXhOrLvbjK+9kUu6Hs7q/sYakyrkCbOHMxvrvEU2t
5eRkNGRdc/LRN9fzF5dsH724xBRqJLCC2DBtDHAz1OYX+/U4ZB+Jlexu8jaZSIDb
6rdXJ7DJ0qDriWYmS+GNpGLadIaK1/5KJt/xbdEMVrULf35GglPPL3/AIg+XiMD3
BnveVx31Y8ypOsN6haBAdW1jua5xODQWnLlmwtt0BBq2b4h95gJ1s11OlYzrsFoq
3w+0nKIhqDuFo3tDSpLWXGyUmSJ5awZ4NWnMU5Pw7kJd0IQ5U/v5QS8F8wnKByaZ
Y1b3p8WgtKqCY0fnGmyR3/6tgdNVFm0Z3sMZKf9w3P3d8URN+P1Vfqx/ayPM5nfQ
zsbTeEoSgtftKjmMsNzYKkUlltPRlizWdwfjYCFveMiFvuRJKWRxm9qIBYAj3ZgJ
d+En5PNtJmOL9WRu9Do8hBKcUjUk/QS74X3KBh+1qvpSGQc+uc5h8hZIpCO3ulPT
LccBwVKEIROTXwkJFcuVnyn07rb9RlsmvUfzgeExAFzNIhNtjKDLcM/G8WyEgYgT
zIBCXw7bgUNySbsUeRj2egNDB0SWB3aoXBKYsi73UjXFJQbsn04=
=TGhO
-----END PGP SIGNATURE-----
Merge tag 'soundwire-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-next
Vinod writes:
soundwire updates for 5.13-rc1
Updates for v5.13-rc1 are:
Core:
- Ability to add quirks for masters
- static checker cleanup for bus code
Drivers:
- DMI quirks for Intel controllers
- static checker cleanup for drivers
- add auto enumeration support qcom controller
* tag 'soundwire-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: (45 commits)
soundwire: intel_init: test link->cdns
soundwire: qcom: handle return correctly in qcom_swrm_transport_params
soundwire: qcom: cleanup internal port config indexing
soundwire: qcom: wait for fifo space to be available before read/write
soundwire: qcom: add static port map support
soundwire: qcom: update port map allocation bit mask
soundwire: add static port mapping support
soundwire: stream: fix memory leak in stream config error path
soundwire: qcom: use signed variable for error return
soundwire: qcom: wait for enumeration to be complete in probe
soundwire: qcom: add auto enumeration support
soundwire: export sdw_compare_devid, sdw_extract_slave_id and sdw_slave_add
soundwire: qcom: add support to new interrupts
soundwire: qcom: update register read/write routine
soundwire: qcom: start the clock during initialization
soundwire: qcom: set continue execution flag for ignored commands
soundwire: qcom: add support to missing transport params
dt-bindings: soundwire: qcom: clarify data port bus parameters
soundwire: cadence: only prepare attached devices on clock stop
soundwire: generic_allocation: fix confusion between group and packing
...
Use direct register operations instead of a table of register
information to lower the stack usage.
Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com>
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/r/20210329141309.612459-2-steen.hegelund@microchip.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
When USB and USB_COMMON are not enabled, phy-mvebu-cp110-utmi
suffers a build error due to a missing interface that is provided
by CONFIG_USB_COMMON, so make the driver depend on USB_COMMON.
ld: drivers/phy/marvell/phy-mvebu-cp110-utmi.o: in function `mvebu_cp110_utmi_phy_probe':
phy-mvebu-cp110-utmi.c:(.text+0x152): undefined reference to `of_usb_get_dr_mode_by_phy'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Kostya Porotchkin <kostap@marvell.com>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Cc: Vinod Koul <vkoul@kernel.org>
Cc: linux-phy@lists.infradead.org
Link: https://lore.kernel.org/r/20210401210045.23525-1-rdunlap@infradead.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
intel_link_probe() could return error and dev_get_drvdata() will return
null in such case. So we have to test link->cdns after
link->cdns = dev_get_drvdata(&ldev->auxdev.dev);
Otherwise, we will meet the "kernel NULL pointer dereference" error.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210406010101.11442-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Looks like return from reg_write is set but not checked.
Fix this by adding error return path.
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1503591 ("UNUSED_VALUE")
Fixes: 128eaf937a ("soundwire: qcom: add support to missing transport params")
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210401091502.15825-1-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Internally used portconfig array for storing port bandwidth
params starts from offset zero. However port zero is not really
used and we also copy the bus parameters to offset zero.
So basically we endup with a code which has to subtract 1 from port
number to get to port parameters.
This is bit confusing to the reader so, make this bit more obvious by only
copying the parameters to offset 1 instead of zero. This will avoid doing
-1 every time when we try to get port params.
Similar thing has been recently done with din/dout_port_mask.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20210401092454.21299-1-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
If we write registers very fast we can endup in a situation where some
of the writes will be dropped without any notice.
So wait for the fifo space to be available before reading/writing the
soundwire registers.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20210401090058.24041-1-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
SoundWire device ports are statically mapped to Controller ports during
design. Add support to read these from SoundWire devices.
This controller uses static port map info to setup bandwidth
parameters for those ports.
A generic port allocation is not possible in this cases!
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210315165650.13392-4-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
currently the internal bitmask used for allocating ports starts with offset 0.
This is bit confusing as data port numbers on Qualcomm controller are valid
from 1 to 14. So adjust this bit mask accordingly, this will also help while
adding static port map support.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210315165650.13392-3-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Some of the SoundWire device ports are statically mapped to Controller
ports during design, however there is no way to expose this information
to the controller. Controllers like Qualcomm ones use this info to setup
static bandwidth parameters for those ports.
A generic port allocation is not possible in this cases!
So this patch adds a new member m_port_map to struct sdw_slave to expose
this static map.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210315165650.13392-2-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
When stream config is failed, master runtime will release all
slave runtime in the slave_rt_list, but slave runtime is not
added to the list at this time. This patch frees slave runtime
in the config error path to fix the memory leak.
Fixes: 89e590535f ("soundwire: Add support for SoundWire stream management")
Signed-off-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Keyon Jie <yang.jie@intel.com>
Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
This patch adds the approved PCI Express Device IDs for the
PF and VF for the card for D5005 PAC cards.
Signed-off-by: Russ Weight <russell.h.weight@intel.com>
Signed-off-by: Matthew Gerlach <matthew.gerlach@linux.intel.com>
Signed-off-by: Moritz Fischer <mdf@kernel.org>
Add Synopsys xData IP driver maintainer.
This driver aims to support Synopsys xData IP and is normally distributed
along with Synopsys PCIe EndPoint IP as a PCIe traffic generator (depends
of the use and licensing agreement).
Signed-off-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
Link: https://lore.kernel.org/r/c8fb9af0ba8c86c5cf8afbfc0eb07fc99a642270.1617016509.git.gustavo.pimentel@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For each device, the nosy driver allocates a pcilynx structure.
A use-after-free might happen in the following scenario:
1. Open nosy device for the first time and call ioctl with command
NOSY_IOC_START, then a new client A will be malloced and added to
doubly linked list.
2. Open nosy device for the second time and call ioctl with command
NOSY_IOC_START, then a new client B will be malloced and added to
doubly linked list.
3. Call ioctl with command NOSY_IOC_START for client A, then client A
will be readded to the doubly linked list. Now the doubly linked
list is messed up.
4. Close the first nosy device and nosy_release will be called. In
nosy_release, client A will be unlinked and freed.
5. Close the second nosy device, and client A will be referenced,
resulting in UAF.
The root cause of this bug is that the element in the doubly linked list
is reentered into the list.
Fix this bug by adding a check before inserting a client. If a client
is already in the linked list, don't insert it.
The following KASAN report reveals it:
BUG: KASAN: use-after-free in nosy_release+0x1ea/0x210
Write of size 8 at addr ffff888102ad7360 by task poc
CPU: 3 PID: 337 Comm: poc Not tainted 5.12.0-rc5+ #6
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
nosy_release+0x1ea/0x210
__fput+0x1e2/0x840
task_work_run+0xe8/0x180
exit_to_user_mode_prepare+0x114/0x120
syscall_exit_to_user_mode+0x1d/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xae
Allocated by task 337:
nosy_open+0x154/0x4d0
misc_open+0x2ec/0x410
chrdev_open+0x20d/0x5a0
do_dentry_open+0x40f/0xe80
path_openat+0x1cf9/0x37b0
do_filp_open+0x16d/0x390
do_sys_openat2+0x11d/0x360
__x64_sys_open+0xfd/0x1a0
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 337:
kfree+0x8f/0x210
nosy_release+0x158/0x210
__fput+0x1e2/0x840
task_work_run+0xe8/0x180
exit_to_user_mode_prepare+0x114/0x120
syscall_exit_to_user_mode+0x1d/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff888102ad7300 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 96 bytes inside of 128-byte region [ffff888102ad7300, ffff888102ad7380)
[ Modified to use 'list_empty()' inside proper lock - Linus ]
Link: https://lore.kernel.org/lkml/1617433116-5930-1-git-send-email-zheyuma97@gmail.com/
Reported-and-tested-by: 马哲宇 (Zheyu Ma) <zheyuma97@gmail.com>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Cc: Greg Kroah-Hartman <greg@kroah.com>
Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmBoyXQQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpiOXD/4wnXFHOmt5HMHmEXU4bB5b46snh3iCU4QM
w7pqgPMgS8uRZZ16FWpzDwccC2NZDoFRHhFxDrOqdKMO1DQlzk1yfSeKjNs9h2Oe
mJ6JuuaX6bEk2RRmjqqM5aMCazE2+tWtDydveL9OrJO6uiPcZYFPiRDwafDzQo4n
YPhUhPm+dqn/4Li6Fap2ieCeLqXNEUKpA0/Bd9QQV0Q/oZq5oLdJefIk8EMXH/tf
eKH2muZDjOV0FYdG8lPsNAF0c5qJ/aID+jlhyUz8Bkn31lOS96d5rzXoFq+AonsC
gVwLbaMcAibHrDjNxIQGcEU0VSjvvfy9GAfjJ3uSuyjpE4dNMe2fuU/B3rF6xb6E
upEfAik+frvzfFuZx11SZh/JwNBatJh35DVZZczI48YKk+s2MI0q9+lNINLtL6bD
3J287jnZbETU54WCMruiRwjQ3J1YWOj2pfxrPT9J0NZdQ0r7MXsDJecGNu+nL0X3
Ry7IpXUqabCf+4+XrGZ2NG6/kd5D/smatc5FqTkyeih3mw94iprNuWanzBlUZYQV
8ybrVtW37caAd1vyx0/p2I1LV5Y0eNGpSWz/WTDj0FINPCPjLq/VmPsIYgihmvz4
joWEzGnBKqds/CAvSneyz2d9MVlQ1083Az/Vi9g4w0IHG/p3ekQGBPDFBvQyszq9
pNkMpQ9Wxw==
=edGl
-----END PGP SIGNATURE-----
Merge tag 'io_uring-5.12-2021-04-03' of git://git.kernel.dk/linux-block
POull io_uring fix from Jens Axboe:
"Just fixing a silly braino in a previous patch, where we'd end up
failing to compile if CONFIG_BLOCK isn't enabled.
Not that a lot of people do that, but kernel bot spotted it and it's
probably prudent to just flush this out now before -rc6.
Sorry about that, none of my test compile configs have !CONFIG_BLOCK"
* tag 'io_uring-5.12-2021-04-03' of git://git.kernel.dk/linux-block:
io_uring: fix !CONFIG_BLOCK compilation failure
The header file <linux/errno.h> is already included above and can be
removed here.
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Mateusz Holenko <mholenko@antmicro.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>
I have a handful of fixes for 5.12:
* A fix for a stack tracing regression related to "const register asm"
variables, which have unexpected behavior.
* A fix to put_user() that ensures the value to be written is evaluated
before enabling access to userspace memory..
* A fix to align the exception vector table correctly, so we don't rely
on the firmware's handling of unaligned accesses.
* A build fix to make NUMA depend on MMU, which triggers some
randconfigs.
-----BEGIN PGP SIGNATURE-----
iQJHBAABCgAxFiEEKzw3R0RoQ7JKlDp6LhMZ81+7GIkFAmBotiMTHHBhbG1lckBk
YWJiZWx0LmNvbQAKCRAuExnzX7sYiXx1EACbRX+q7EKS6LqAjlX4GLSTP2R785HU
seqJx1i7XU3kLDP8SO5zPrF19Ea48U1Psy4fyrQlHZG/8GqpbyoORqyMS6uABvqR
iggkKyx7vJWEenxMgrsBSrVmRjcdqFmwrC6VMm0pCWhX2X5rywf9Xpa3wQ1IBGKt
2f+HG4TjJNN++twgoegUaeG3SpW3CtJwZgR8d5sNES2ElnKBQxXd2mfAYGyRcnVi
x5vQtP7NI0W+PXfvyzUg9it8clG3XVyzifEeUBqh0XzG0xbo/rnICwOqqBC6jTSU
b1NblRZvS+Zi1/GCFnWp/5Lq2kMmVb5Ptcu0SQnHzn/TQAjoGBQ8blqv/rzcwTjU
uI28C/k1EfB1qIPi1dkOx3LsRYuxDFKWDTC3BpTmFykdQpnkgchSEHEbQOrp2Rko
aljsm0PlDhkpIGOwbkhgojPRTfsM+ZVklr/WEq1/uqexG8MDck8AycT5InsyoiyF
5XeFQdwEORSLm1kSEw6zPEoD3o0DO0WDx/KamhSPFSF/t3NWO6IjM1KXhG3VSGdf
EG4pbL82l7GUvRZBmPxZaeT7/YKV46xa73k1tuyC6B/sBllv7c9gl+/zwM/Db5sO
sfLxjOmmRgFxULre9oTwRpimrPKWdduGrmwz9I6aJZNW77UZ/AsFLCw/SYDApP9Y
SiqvSfliS5l1pA==
=DUBG
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Palmer Dabbelt:
"A handful of fixes for 5.12:
- fix a stack tracing regression related to "const register asm"
variables, which have unexpected behavior.
- ensure the value to be written by put_user() is evaluated before
enabling access to userspace memory..
- align the exception vector table correctly, so we don't rely on the
firmware's handling of unaligned accesses.
- build fix to make NUMA depend on MMU, which triggered on some
randconfigs"
* tag 'riscv-for-linus-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: Make NUMA depend on MMU
riscv: remove unneeded semicolon
riscv,entry: fix misaligned base for excp_vect_table
riscv: evaluate put_user() arg before enabling user access
riscv: Drop const annotation for sp
Fix a bug on pseries where spurious wakeups from H_PROD would prevent partition migration
from succeeding.
Fix oopses seen in pcpu_alloc(), caused by parallel faults of the percpu mapping causing
us to corrupt the protection key used for the mapping, and cause a fatal key fault.
Thanks to Aneesh Kumar K.V, Murilo Opsfelder Araujo, Nathan Lynch.
-----BEGIN PGP SIGNATURE-----
iQJHBAABCAAxFiEEJFGtCPCthwEv2Y/bUevqPMjhpYAFAmBoUxUTHG1wZUBlbGxl
cm1hbi5pZC5hdQAKCRBR6+o8yOGlgDJYEAC74efyI/HCqDLCf9Q8Xu4lQbVpqBCX
JG9KJWf97mIj9Dtc1W/Uk6xx1hFxoqDutO9NoS1OkOqa8E/1c++JwHZmUDL1vVRe
V+v4zJiHzm/4Tf4hoJ1RHgHanDz9uPDXi7UWSZfh6I89f8AU51YMN2ZFKxgtDfwE
eQJWd5l63myabJ0kyQR2agJ/AEWC7U/H8q1h1hxoAj60BlWhu2PhpikQtoNok3jQ
Az962IzYrm5Hb9pIetLmgtyrsJmxwRIkmWViwuCujMxxegH335886fniCf8Lk2/W
MsrbSBcCpu/Lt39rVRKbex3cOsXMsHjlWCZRW3wArGrA9c6BW3orjdY61PHYXR81
mf/k9hC4WavgZ04d/hoS8gbFsGB3EJsO3csFuer358yFS+K9jTHfu/5KHKngXZVp
4k6JPwz4APeaDhvngkC20F4qhMQJNRA2Huvuq1VBuIOmzH8eF+/Sg0H5YKpW2Vn5
K2jLgsCa0Pq1pzQdn4hEauYwTdAc7gLpGqFNpphhyhwcS10FeQE6XH8aGXxs8mQK
+P4p4NR6YOsgMp+rrunvF1AWmqgRnZdO41cHCU1xGgX76gFbIg/E+TB1i0cEhcEY
UJIjE8jFsBMRY3A1qlOd979UnhzAshbZS0Wh4LyM8TkgYuiDoLMEXF7uO4lwljFi
nUhTwIEnBJ7NDQ==
=booR
-----END PGP SIGNATURE-----
Merge tag 'powerpc-5.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Michael Ellerman:
"Fix a bug on pseries where spurious wakeups from H_PROD would prevent
partition migration from succeeding.
Fix oopses seen in pcpu_alloc(), caused by parallel faults of the
percpu mapping causing us to corrupt the protection key used for the
mapping, and cause a fatal key fault.
Thanks to Aneesh Kumar K.V, Murilo Opsfelder Araujo, and Nathan Lynch"
* tag 'powerpc-5.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc/mm/book3s64: Use the correct storage key value when calling H_PROTECT
powerpc/pseries/mobility: handle premature return from H_JOIN
powerpc/pseries/mobility: use struct for shared state
-----BEGIN PGP SIGNATURE-----
iQFHBAABCAAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmBnkEUTHHdlaS5saXVA
a2VybmVsLm9yZwAKCRB2FHBfkEGgXv4YCADaSmGXyyLdoZQ5dH0oiWdt76aLNnuK
ckBDoiLWYkwOHQndqeQhsIxKBO+wEASSpua0fv1idewAk8zhw553IjCh2KZbtvzA
Mev5WwotBZnY2Hl1jdByqkZ/PS/Kms58qlvW4rcgg831DNLYGvc3soRiQy81GdIv
MVFJFFrZB4QsWcsjEGoN7ZUprG66dRixIBl5r/f426zRcpA/OlIEEKp0zRwYgyJL
rSfpxDAquEUsLgWC01y8g3ZBlpto63ZS28UPPC9McgEW+SK4+OOmMZu7t/ob2wyt
RopbX/meoPitMeruZy3z/jbUezW7Celz3dG2diL3WCX20HHjOmTjm6CM
=rax+
-----END PGP SIGNATURE-----
Merge tag 'hyperv-fixes-signed-20210402' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
Pull Hyper-V fixes from Wei Liu:
"One fix from Lu Yunlong for a double free in hvfb_probe"
* tag 'hyperv-fixes-signed-20210402' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
video: hyperv_fb: Fix a double free in hvfb_probe
Here is a single driver core fix for a reported problem with differed
probing. It has been in linux-next for a while with no reported
problems.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCYGhGpg8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ymgSACeJYD1EfjFSCB0gEmdjU261rWOcT0AoLTRkJW1
vywQNi5XNrbbmsWpxLsF
=wG2r
-----END PGP SIGNATURE-----
Merge tag 'driver-core-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull driver core fix from Greg KH:
"Here is a single driver core fix for a reported problem with differed
probing. It has been in linux-next for a while with no reported
problems"
* tag 'driver-core-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
driver core: clear deferred probe reason on probe retry
Here are a few small driver char/misc changes for 5.12-rc6.
Nothing major here, a few fixes for reported issues:
- interconnect fixes for problems found
- fbcon syzbot-found fix
- extcon fixes
- firmware stratix10 bugfix
- MAINTAINERS file update.
All of these have been in linux-next for a while with no reported
issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCYGhGNA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ylNFgCfRDpMVRjtAhrrdlTJaQRSXqd2vKAAn3Z08ggH
pvXxXEAF4NfSfuWcRehT
=kJts
-----END PGP SIGNATURE-----
Merge tag 'char-misc-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc driver fixes from Greg KH:
"Here are a few small driver char/misc changes for 5.12-rc6.
Nothing major here, a few fixes for reported issues:
- interconnect fixes for problems found
- fbcon syzbot-found fix
- extcon fixes
- firmware stratix10 bugfix
- MAINTAINERS file update.
All of these have been in linux-next for a while with no reported
issues"
* tag 'char-misc-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
drivers: video: fbcon: fix NULL dereference in fbcon_cursor()
mei: allow map and unmap of client dma buffer only for disconnected client
MAINTAINERS: Add linux-phy list and patchwork
interconnect: Fix kerneldoc warning
firmware: stratix10-svc: reset COMMAND_RECONFIG_FLAG_PARTIAL to 0
extcon: Fix error handling in extcon_dev_register
extcon: Add stubs for extcon_register_notifier_all() functions
interconnect: core: fix error return code of icc_link_destroy()
interconnect: qcom: msm8939: remove rpm-ids from non-RPM nodes
