This is the 5.4.299 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmjAWV4ACgkQONu9yGCS
 aT7E+Q//fo2+RnB0lUyOGiXkg1al0NhTy5NpO5REWwz0eAU8LS5PwbgkqpgAHeTl
 oTN/Vc8zXu0SIsEnQQIPq0nr1uTSAj/XiFKAoWq4D3tJUS2pvzTV95TTUXqhNc3H
 rGESzEZNyfHwTBHGT5v+KjD70QiPrIfldgpNqSQVnabqPHl6+NcdjXIQFmUhHWKZ
 fKV9U3g21wA4hDcWeeMf4gpwALu4Try4W7zazkhQ3Ys0OvWghWOMQZBCojzHHkaM
 imTiO7QNM6SfqCUk6YF1Tx3ME1spiD1modjzf2GdeerMx4ViK2zZuVlxObgrRlz8
 YjLNqhW1HLIpMwloWbPglYx8oyDvqXgW0MR7ubb2foCc+nsqNfpilKeRSSEgGIzO
 iV+Rxh+/I/JedThzok++i2o5LIR3gnL3I6nbKxvzgKqeAw21u5RxUOfrlVSUOzdC
 pO9zMtkbJWsiGsJuplKNEP8EHGh2aQbxRmPeKlSgMOVO+Mjj3pnEOqx0nUriIolk
 Om7NkzBnDIv4ck+b+JCtBQaf/X8OFtFYaoW84HpaSauvVchxU072t4RwOaVIfvU5
 6YGlpUcguNxRbTZ6pMDKaKvLdlnzAsPv+1GvNHA5aVN2vuz1GesTHsm0dzRegLyf
 wW7sakrIpKqqJZReBA5LOCrLlUE2518TCf8pZUlvQRn0M4Pmmqg=
 =eFKc
 -----END PGP SIGNATURE-----

Merge 5.4.299 into android11-5.4-lts

Changes in 5.4.299
	powerpc: boot: Remove leading zero in label in udelay()
	wifi: cfg80211: fix use-after-free in cmp_bss()
	netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
	Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
	xirc2ps_cs: fix register access when enabling FullDuplex
	mISDN: Fix memory leak in dsp_hwec_enable()
	icmp: fix icmp_ndo_send address translation for reply direction
	i40e: Fix potential invalid access when MAC list is empty
	net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
	wifi: cw1200: cap SSID length in cw1200_do_join()
	wifi: libertas: cap SSID len in lbs_associate()
	net: thunder_bgx: add a missing of_node_put
	net: thunder_bgx: decrement cleanup index before use
	ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
	ax25: properly unshare skbs in ax25_kiss_rcv()
	net: atm: fix memory leak in atm_register_sysfs when device_register fail
	ppp: fix memory leak in pad_compress_skb
	ALSA: usb-audio: Add mute TLV for playback volumes on some devices
	pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
	wifi: mwifiex: Initialize the chan_stats array to zero
	drm/amdgpu: drop hw access in non-DC audio fini
	batman-adv: fix OOB read/write in network-coding decode
	e1000e: fix heap overflow in e1000_set_eeprom
	mm/khugepaged: fix ->anon_vma race
	scsi: lpfc: Fix buffer free/clear order in deferred receive path
	mm/slub: avoid accessing metadata when pointer is invalid in object_err()
	cpufreq/sched: Explicitly synchronize limits_changed flag handling
	KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
	iio: chemical: pms7003: use aligned_s64 for timestamp
	iio: light: opt3001: fix deadlock due to concurrent flag access
	gpio: pca953x: fix IRQ storm on system wake up
	ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
	dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
	net: dsa: microchip: update tag_ksz masks for KSZ9477 family
	net: dsa: microchip: linearize skb for tail-tagging switches
	vmxnet3: update MTU after device quiesce
	randstruct: gcc-plugin: Remove bogus void member
	randstruct: gcc-plugin: Fix attribute addition
	ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
	pcmcia: Add error handling for add_interval() in do_validate_mem()
	spi: spi-fsl-lpspi: Fix transmissions when using CONT
	spi: spi-fsl-lpspi: Set correct chip-select polarity bit
	spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
	cifs: fix integer overflow in match_server()
	dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
	Linux 5.4.299

Change-Id: I3dd8287459f00994b5550e295dc9137e49bf96bb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman 2025-09-10 05:55:28 +00:00
commit 8b500987d7
46 changed files with 249 additions and 131 deletions

View file

@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 5
PATCHLEVEL = 4
SUBLEVEL = 298
SUBLEVEL = 299
EXTRAVERSION =
NAME = Kleptomaniac Octopus

View file

@ -41,12 +41,12 @@ udelay:
srwi r4,r4,16
cmpwi 0,r4,1 /* 601 ? */
bne .Ludelay_not_601
00: li r0,86 /* Instructions / microsecond? */
0: li r0,86 /* Instructions / microsecond? */
mtctr r0
10: addi r0,r0,0 /* NOP */
bdnz 10b
subic. r3,r3,1
bne 00b
bne 0b
blr
.Ludelay_not_601:

View file

@ -10394,11 +10394,18 @@ int kvm_arch_irq_bypass_add_producer(struct irq_bypass_consumer *cons,
{
struct kvm_kernel_irqfd *irqfd =
container_of(cons, struct kvm_kernel_irqfd, consumer);
struct kvm *kvm = irqfd->kvm;
int ret;
spin_lock_irq(&kvm->irqfds.lock);
irqfd->producer = prod;
return kvm_x86_ops->update_pi_irte(irqfd->kvm,
ret = kvm_x86_ops->update_pi_irte(irqfd->kvm,
prod->irq, irqfd->gsi, 1);
spin_unlock_irq(&kvm->irqfds.lock);
return ret;
}
void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
@ -10407,9 +10414,9 @@ void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
int ret;
struct kvm_kernel_irqfd *irqfd =
container_of(cons, struct kvm_kernel_irqfd, consumer);
struct kvm *kvm = irqfd->kvm;
WARN_ON(irqfd->producer != prod);
irqfd->producer = NULL;
/*
* When producer of consumer is unregistered, we change back to
@ -10417,10 +10424,15 @@ void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
* when the irq is masked/disabled or the consumer side (KVM
* int this case doesn't want to receive the interrupts.
*/
spin_lock_irq(&kvm->irqfds.lock);
irqfd->producer = NULL;
ret = kvm_x86_ops->update_pi_irte(irqfd->kvm, prod->irq, irqfd->gsi, 0);
if (ret)
printk(KERN_INFO "irq bypass consumer (token %p) unregistration"
" fails: %d\n", irqfd->consumer.token, ret);
spin_unlock_irq(&kvm->irqfds.lock);
}
int kvm_arch_update_irqfd_routing(struct kvm *kvm, unsigned int host_irq,

View file

@ -421,15 +421,11 @@ static struct virt_dma_desc *mtk_cqdma_find_active_desc(struct dma_chan *c,
{
struct mtk_cqdma_vchan *cvc = to_cqdma_vchan(c);
struct virt_dma_desc *vd;
unsigned long flags;
spin_lock_irqsave(&cvc->pc->lock, flags);
list_for_each_entry(vd, &cvc->pc->queue, node)
if (vd->tx.cookie == cookie) {
spin_unlock_irqrestore(&cvc->pc->lock, flags);
return vd;
}
spin_unlock_irqrestore(&cvc->pc->lock, flags);
list_for_each_entry(vd, &cvc->vc.desc_issued, node)
if (vd->tx.cookie == cookie)
@ -453,9 +449,11 @@ static enum dma_status mtk_cqdma_tx_status(struct dma_chan *c,
if (ret == DMA_COMPLETE || !txstate)
return ret;
spin_lock_irqsave(&cvc->vc.lock, flags);
spin_lock_irqsave(&cvc->pc->lock, flags);
spin_lock(&cvc->vc.lock);
vd = mtk_cqdma_find_active_desc(c, cookie);
spin_unlock_irqrestore(&cvc->vc.lock, flags);
spin_unlock(&cvc->vc.lock);
spin_unlock_irqrestore(&cvc->pc->lock, flags);
if (vd) {
cvd = to_cqdma_vdesc(vd);

View file

@ -1199,6 +1199,9 @@ static int pca953x_suspend(struct device *dev)
struct pca953x_chip *chip = dev_get_drvdata(dev);
mutex_lock(&chip->i2c_lock);
/* Disable IRQ to prevent early triggering while regmap "cache only" is on */
if (chip->client->irq > 0)
disable_irq(chip->client->irq);
regcache_cache_only(chip->regmap, true);
mutex_unlock(&chip->i2c_lock);
@ -1224,6 +1227,8 @@ static int pca953x_resume(struct device *dev)
}
mutex_lock(&chip->i2c_lock);
if (chip->client->irq > 0)
enable_irq(chip->client->irq);
regcache_cache_only(chip->regmap, false);
regcache_mark_dirty(chip->regmap);
ret = pca953x_regcache_sync(dev);

View file

@ -1445,17 +1445,12 @@ static int dce_v10_0_audio_init(struct amdgpu_device *adev)
static void dce_v10_0_audio_fini(struct amdgpu_device *adev)
{
int i;
if (!amdgpu_audio)
return;
if (!adev->mode_info.audio.enabled)
return;
for (i = 0; i < adev->mode_info.audio.num_pins; i++)
dce_v10_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false);
adev->mode_info.audio.enabled = false;
}

View file

@ -1487,17 +1487,12 @@ static int dce_v11_0_audio_init(struct amdgpu_device *adev)
static void dce_v11_0_audio_fini(struct amdgpu_device *adev)
{
int i;
if (!amdgpu_audio)
return;
if (!adev->mode_info.audio.enabled)
return;
for (i = 0; i < adev->mode_info.audio.num_pins; i++)
dce_v11_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false);
adev->mode_info.audio.enabled = false;
}

View file

@ -1358,17 +1358,12 @@ static int dce_v6_0_audio_init(struct amdgpu_device *adev)
static void dce_v6_0_audio_fini(struct amdgpu_device *adev)
{
int i;
if (!amdgpu_audio)
return;
if (!adev->mode_info.audio.enabled)
return;
for (i = 0; i < adev->mode_info.audio.num_pins; i++)
dce_v6_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false);
adev->mode_info.audio.enabled = false;
}

View file

@ -1408,17 +1408,12 @@ static int dce_v8_0_audio_init(struct amdgpu_device *adev)
static void dce_v8_0_audio_fini(struct amdgpu_device *adev)
{
int i;
if (!amdgpu_audio)
return;
if (!adev->mode_info.audio.enabled)
return;
for (i = 0; i < adev->mode_info.audio.num_pins; i++)
dce_v8_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false);
adev->mode_info.audio.enabled = false;
}

View file

@ -5,7 +5,6 @@
* Copyright (c) Tomasz Duszynski <tduszyns@gmail.com>
*/
#include <asm/unaligned.h>
#include <linux/completion.h>
#include <linux/device.h>
#include <linux/errno.h>
@ -19,6 +18,8 @@
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/serdev.h>
#include <linux/types.h>
#include <asm/unaligned.h>
#define PMS7003_DRIVER_NAME "pms7003"
@ -76,7 +77,7 @@ struct pms7003_state {
/* Used to construct scan to push to the IIO buffer */
struct {
u16 data[3]; /* PM1, PM2P5, PM10 */
s64 ts;
aligned_s64 ts;
} scan;
};

View file

@ -691,8 +691,9 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
struct opt3001 *opt = iio_priv(iio);
int ret;
bool wake_result_ready_queue = false;
bool ok_to_ignore_lock = opt->ok_to_ignore_lock;
if (!opt->ok_to_ignore_lock)
if (!ok_to_ignore_lock)
mutex_lock(&opt->lock);
ret = i2c_smbus_read_word_swapped(opt->client, OPT3001_CONFIGURATION);
@ -729,7 +730,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
}
out:
if (!opt->ok_to_ignore_lock)
if (!ok_to_ignore_lock)
mutex_unlock(&opt->lock);
if (wake_result_ready_queue)

View file

@ -51,14 +51,14 @@ void dsp_hwec_enable(struct dsp *dsp, const char *arg)
goto _do;
{
char *dup, *tok, *name, *val;
char *dup, *next, *tok, *name, *val;
int tmp;
dup = kstrdup(arg, GFP_ATOMIC);
dup = next = kstrdup(arg, GFP_ATOMIC);
if (!dup)
return;
while ((tok = strsep(&dup, ","))) {
while ((tok = strsep(&next, ","))) {
if (!strlen(tok))
continue;
name = strsep(&tok, "=");

View file

@ -1497,13 +1497,17 @@ static int bgx_init_of_phy(struct bgx *bgx)
* this cortina phy, for which there is no driver
* support, ignore it.
*/
if (phy_np &&
!of_device_is_compatible(phy_np, "cortina,cs4223-slice")) {
/* Wait until the phy drivers are available */
pd = of_phy_find_device(phy_np);
if (!pd)
goto defer;
bgx->lmac[lmac].phydev = pd;
if (phy_np) {
if (!of_device_is_compatible(phy_np, "cortina,cs4223-slice")) {
/* Wait until the phy drivers are available */
pd = of_phy_find_device(phy_np);
if (!pd) {
of_node_put(phy_np);
goto defer;
}
bgx->lmac[lmac].phydev = pd;
}
of_node_put(phy_np);
}
lmac++;
@ -1519,11 +1523,11 @@ defer:
* for phy devices we may have already found.
*/
while (lmac) {
lmac--;
if (bgx->lmac[lmac].phydev) {
put_device(&bgx->lmac[lmac].phydev->mdio.dev);
bgx->lmac[lmac].phydev = NULL;
}
lmac--;
}
of_node_put(node);
return -EPROBE_DEFER;

View file

@ -552,12 +552,12 @@ static int e1000_set_eeprom(struct net_device *netdev,
{
struct e1000_adapter *adapter = netdev_priv(netdev);
struct e1000_hw *hw = &adapter->hw;
size_t total_len, max_len;
u16 *eeprom_buff;
void *ptr;
int max_len;
int ret_val = 0;
int first_word;
int last_word;
int ret_val = 0;
void *ptr;
u16 i;
if (eeprom->len == 0)
@ -572,6 +572,10 @@ static int e1000_set_eeprom(struct net_device *netdev,
max_len = hw->nvm.word_size * 2;
if (check_add_overflow(eeprom->offset, eeprom->len, &total_len) ||
total_len > max_len)
return -EFBIG;
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
eeprom_buff = kmalloc(max_len, GFP_KERNEL);

View file

@ -320,8 +320,8 @@ static void i40e_client_add_instance(struct i40e_pf *pf)
return;
}
mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
struct netdev_hw_addr, list);
mac = list_first_entry_or_null(&cdev->lan_info.netdev->dev_addrs.list,
struct netdev_hw_addr, list);
if (mac)
ether_addr_copy(cdev->lan_info.lanmac, mac->addr);
else

View file

@ -1173,6 +1173,13 @@ static int mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)
bool gso = false;
int tx_num;
if (skb_vlan_tag_present(skb) &&
!eth_proto_is_802_3(eth_hdr(skb)->h_proto)) {
skb = __vlan_hwaccel_push_inside(skb);
if (!skb)
goto dropped;
}
/* normally we can rely on the stack not calling this more than once,
* however we have 2 queues running on the same ring so we need to lock
* the ring access
@ -1218,8 +1225,9 @@ static int mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)
drop:
spin_unlock(&eth->page_lock);
stats->tx_dropped++;
dev_kfree_skb_any(skb);
dropped:
stats->tx_dropped++;
return NETDEV_TX_OK;
}

View file

@ -1584,7 +1584,7 @@ do_reset(struct net_device *dev, int full)
msleep(40); /* wait 40 msec to let it complete */
}
if (full_duplex)
PutByte(XIRCREG1_ECR, GetByte(XIRCREG1_ECR | FullDuplex));
PutByte(XIRCREG1_ECR, GetByte(XIRCREG1_ECR) | FullDuplex);
} else { /* No MII */
SelectPage(0);
value = GetByte(XIRCREG_ESR); /* read the ESR */

View file

@ -1528,7 +1528,6 @@ pad_compress_skb(struct ppp *ppp, struct sk_buff *skb)
*/
if (net_ratelimit())
netdev_err(ppp->dev, "ppp: compressor dropped pkt\n");
kfree_skb(skb);
consume_skb(new_skb);
new_skb = NULL;
}
@ -1630,9 +1629,10 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
"down - pkt dropped.\n");
goto drop;
}
skb = pad_compress_skb(ppp, skb);
if (!skb)
new_skb = pad_compress_skb(ppp, skb);
if (!new_skb)
goto drop;
skb = new_skb;
}
/*

View file

@ -2998,8 +2998,6 @@ vmxnet3_change_mtu(struct net_device *netdev, int new_mtu)
struct vmxnet3_adapter *adapter = netdev_priv(netdev);
int err = 0;
netdev->mtu = new_mtu;
/*
* Reset_work may be in the middle of resetting the device, wait for its
* completion.
@ -3013,6 +3011,7 @@ vmxnet3_change_mtu(struct net_device *netdev, int new_mtu)
/* we need to re-create the rx queue based on the new mtu */
vmxnet3_rq_destroy_all(adapter);
netdev->mtu = new_mtu;
vmxnet3_adjust_rx_ring_size(adapter);
err = vmxnet3_rq_create_all(adapter);
if (err) {
@ -3029,6 +3028,8 @@ vmxnet3_change_mtu(struct net_device *netdev, int new_mtu)
"Closing it\n", err);
goto out;
}
} else {
netdev->mtu = new_mtu;
}
out:

View file

@ -1102,10 +1102,13 @@ static int lbs_associate(struct lbs_private *priv,
/* add SSID TLV */
rcu_read_lock();
ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
if (ssid_eid)
pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
else
if (ssid_eid) {
u32 ssid_len = min(ssid_eid[1], IEEE80211_MAX_SSID_LEN);
pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_len);
} else {
lbs_deb_assoc("no SSID\n");
}
rcu_read_unlock();
/* add DS param TLV */

View file

@ -4273,8 +4273,9 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
* additional active scan request for hidden SSIDs on passive channels.
*/
adapter->num_in_chan_stats = 2 * (n_channels_bg + n_channels_a);
adapter->chan_stats = vmalloc(array_size(sizeof(*adapter->chan_stats),
adapter->num_in_chan_stats));
adapter->chan_stats = kcalloc(adapter->num_in_chan_stats,
sizeof(*adapter->chan_stats),
GFP_KERNEL);
if (!adapter->chan_stats)
return -ENOMEM;

View file

@ -635,7 +635,7 @@ static int _mwifiex_fw_dpc(const struct firmware *firmware, void *context)
goto done;
err_add_intf:
vfree(adapter->chan_stats);
kfree(adapter->chan_stats);
err_init_chan_scan:
wiphy_unregister(adapter->wiphy);
wiphy_free(adapter->wiphy);
@ -1448,7 +1448,7 @@ static void mwifiex_uninit_sw(struct mwifiex_adapter *adapter)
wiphy_free(adapter->wiphy);
adapter->wiphy = NULL;
vfree(adapter->chan_stats);
kfree(adapter->chan_stats);
mwifiex_free_cmd_buffers(adapter);
}

View file

@ -1289,7 +1289,7 @@ static void cw1200_do_join(struct cw1200_common *priv)
rcu_read_lock();
ssidie = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
if (ssidie) {
join.ssid_len = ssidie[1];
join.ssid_len = min(ssidie[1], IEEE80211_MAX_SSID_LEN);
memcpy(join.ssid, &ssidie[2], join.ssid_len);
}
rcu_read_unlock();

View file

@ -62,6 +62,9 @@ static struct resource *__iodyn_find_io_region(struct pcmcia_socket *s,
unsigned long min = base;
int ret;
if (!res)
return NULL;
data.mask = align - 1;
data.offset = base & data.mask;

View file

@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s,
if (validate && !s->fake_cis) {
/* move it to the validated data set */
add_interval(&s_data->mem_db_valid, base, size);
ret = add_interval(&s_data->mem_db_valid, base, size);
if (ret)
return ret;
sub_interval(&s_data->mem_db, base, size);
}

View file

@ -1172,7 +1172,7 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
struct lpfc_nvmet_tgtport *tgtp;
struct lpfc_nvmet_rcv_ctx *ctxp =
container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer;
struct rqb_dmabuf *nvmebuf;
struct lpfc_hba *phba = ctxp->phba;
unsigned long iflag;
@ -1180,13 +1180,18 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
ctxp->oxid, ctxp->size, raw_smp_processor_id());
spin_lock_irqsave(&ctxp->ctxlock, iflag);
nvmebuf = ctxp->rqb_buffer;
if (!nvmebuf) {
spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
lpfc_printf_log(phba, KERN_INFO, LOG_NVME_IOERR,
"6425 Defer rcv: no buffer oxid x%x: "
"flg %x ste %x\n",
ctxp->oxid, ctxp->flag, ctxp->state);
return;
}
ctxp->rqb_buffer = NULL;
spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
tgtp = phba->targetport->private;
if (tgtp)
@ -1194,9 +1199,6 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
/* Free the nvmebuf since a new buffer already replaced it */
nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
spin_lock_irqsave(&ctxp->ctxlock, iflag);
ctxp->rqb_buffer = NULL;
spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
}
static void

View file

@ -3,8 +3,9 @@
// Freescale i.MX7ULP LPSPI driver
//
// Copyright 2016 Freescale Semiconductor, Inc.
// Copyright 2018 NXP Semiconductors
// Copyright 2018, 2023, 2025 NXP
#include <linux/bitfield.h>
#include <linux/clk.h>
#include <linux/completion.h>
#include <linux/delay.h>
@ -74,7 +75,7 @@
#define DER_TDDE BIT(0)
#define CFGR1_PCSCFG BIT(27)
#define CFGR1_PINCFG (BIT(24)|BIT(25))
#define CFGR1_PCSPOL BIT(8)
#define CFGR1_PCSPOL_MASK GENMASK(11, 8)
#define CFGR1_NOSTALL BIT(3)
#define CFGR1_MASTER BIT(0)
#define FSR_TXCOUNT (0xFF)
@ -415,7 +416,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
else
temp = CFGR1_PINCFG;
if (fsl_lpspi->config.mode & SPI_CS_HIGH)
temp |= CFGR1_PCSPOL;
temp |= FIELD_PREP(CFGR1_PCSPOL_MASK,
BIT(fsl_lpspi->config.chip_select));
writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
temp = readl(fsl_lpspi->base + IMX7ULP_CR);
@ -719,12 +722,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller,
fsl_lpspi_write_tx_fifo(fsl_lpspi);
ret = fsl_lpspi_wait_for_completion(controller);
if (ret)
return ret;
fsl_lpspi_reset(fsl_lpspi);
return 0;
return ret;
}
static int fsl_lpspi_transfer_one(struct spi_controller *controller,
@ -772,7 +773,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id)
if (temp_SR & SR_MBF ||
readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) {
writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR);
fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE);
fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE));
return IRQ_HANDLED;
}

View file

@ -2144,6 +2144,11 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
__func__);
goto cifs_parse_mount_err;
}
if (option < SMB_ECHO_INTERVAL_MIN ||
option > SMB_ECHO_INTERVAL_MAX) {
cifs_dbg(VFS, "echo interval is out of bounds\n");
goto cifs_parse_mount_err;
}
vol->echo_interval = option;
break;
case Opt_snapshot:

View file

@ -89,9 +89,20 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
if (!cpufreq_this_cpu_can_update(sg_policy->policy))
return false;
if (unlikely(sg_policy->limits_changed)) {
sg_policy->limits_changed = false;
if (unlikely(READ_ONCE(sg_policy->limits_changed))) {
WRITE_ONCE(sg_policy->limits_changed, false);
sg_policy->need_freq_update = true;
/*
* The above limits_changed update must occur before the reads
* of policy limits in cpufreq_driver_resolve_freq() or a policy
* limits update might be missed, so use a memory barrier to
* ensure it.
*
* This pairs with the write memory barrier in sugov_limits().
*/
smp_mb();
return true;
}
@ -450,7 +461,7 @@ static inline bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu) { return false; }
static inline void ignore_dl_rate_limit(struct sugov_cpu *sg_cpu, struct sugov_policy *sg_policy)
{
if (cpu_bw_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->bw_dl)
sg_policy->limits_changed = true;
WRITE_ONCE(sg_policy->limits_changed, true);
}
static void sugov_update_single(struct update_util_data *hook, u64 time,
@ -900,7 +911,16 @@ static void sugov_limits(struct cpufreq_policy *policy)
mutex_unlock(&sg_policy->work_lock);
}
sg_policy->limits_changed = true;
/*
* The limits_changed update below must take place before the updates
* of policy limits in cpufreq_set_policy() or a policy limits update
* might be missed, so use a memory barrier to ensure it.
*
* This pairs with the memory barrier in sugov_should_update_freq().
*/
smp_wmb();
WRITE_ONCE(sg_policy->limits_changed, true);
}
struct cpufreq_governor schedutil_gov = {

View file

@ -1476,7 +1476,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
* has higher cost too. It would also probably require locking
* the anon_vma.
*/
if (vma->anon_vma)
if (READ_ONCE(vma->anon_vma))
continue;
addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
if (addr & ~HPAGE_PMD_MASK)
@ -1498,6 +1498,18 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
if (!khugepaged_test_exit(mm)) {
struct mmu_notifier_range range;
/*
* Re-check whether we have an ->anon_vma, because
* collapse_and_free_pmd() requires that either no
* ->anon_vma exists or the anon_vma is locked.
* We already checked ->anon_vma above, but that check
* is racy because ->anon_vma can be populated under the
* mmap_sem in read mode.
*/
if (vma->anon_vma) {
up_write(&mm->mmap_sem);
continue;
}
mmu_notifier_range_init(&range,
MMU_NOTIFY_CLEAR, 0,
NULL, mm, addr,

View file

@ -719,7 +719,12 @@ void object_err(struct kmem_cache *s, struct page *page,
u8 *object, char *reason)
{
slab_bug(s, "%s", reason);
print_trailer(s, page, object);
if (!object || !check_valid_pointer(s, page, object)) {
print_page_info(page);
pr_err("Invalid pointer 0x%p\n", object);
} else {
print_trailer(s, page, object);
}
}
static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page,

View file

@ -114,7 +114,9 @@ struct atm_dev *atm_dev_register(const char *type, struct device *parent,
if (atm_proc_dev_register(dev) < 0) {
pr_err("atm_proc_dev_register failed for dev %s\n", type);
goto out_fail;
mutex_unlock(&atm_dev_mutex);
kfree(dev);
return NULL;
}
if (atm_register_sysfs(dev, parent) < 0) {
@ -130,7 +132,7 @@ out:
return dev;
out_fail:
kfree(dev);
put_device(&dev->class_dev);
dev = NULL;
goto out;
}

View file

@ -433,6 +433,10 @@ free:
int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
struct packet_type *ptype, struct net_device *orig_dev)
{
skb = skb_share_check(skb, GFP_ATOMIC);
if (!skb)
return NET_RX_DROP;
skb_orphan(skb);
if (!net_eq(dev_net(dev), &init_net)) {

View file

@ -1694,7 +1694,12 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
coding_len = ntohs(coded_packet_tmp.coded_len);
if (coding_len > skb->len)
/* ensure dst buffer is large enough (payload only) */
if (coding_len + h_size > skb->len)
return NULL;
/* ensure src buffer is large enough (payload only) */
if (coding_len + h_size > nc_packet->skb->len)
return NULL;
/* Here the magic is reversed:

View file

@ -1226,7 +1226,10 @@ static int l2cap_sock_release(struct socket *sock)
if (!sk)
return 0;
lock_sock_nested(sk, L2CAP_NESTING_PARENT);
l2cap_sock_cleanup_listen(sk);
release_sock(sk);
bt_sock_unlink(&l2cap_sk_list, sk);
err = l2cap_sock_shutdown(sock, 2);

View file

@ -115,7 +115,12 @@ static struct sk_buff *ksz8795_xmit(struct sk_buff *skb, struct net_device *dev)
static struct sk_buff *ksz8795_rcv(struct sk_buff *skb, struct net_device *dev,
struct packet_type *pt)
{
u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
u8 *tag;
if (skb_linearize(skb))
return NULL;
tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
return ksz_common_rcv(skb, dev, tag[0] & 7, KSZ_EGRESS_TAG_LEN);
}
@ -149,8 +154,9 @@ MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_KSZ8795);
#define KSZ9477_INGRESS_TAG_LEN 2
#define KSZ9477_PTP_TAG_LEN 4
#define KSZ9477_PTP_TAG_INDICATION 0x80
#define KSZ9477_PTP_TAG_INDICATION BIT(7)
#define KSZ9477_TAIL_TAG_EG_PORT_M GENMASK(2, 0)
#define KSZ9477_TAIL_TAG_OVERRIDE BIT(9)
#define KSZ9477_TAIL_TAG_LOOKUP BIT(10)
@ -183,10 +189,16 @@ static struct sk_buff *ksz9477_xmit(struct sk_buff *skb,
static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev,
struct packet_type *pt)
{
/* Tag decoding */
u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
unsigned int port = tag[0] & 7;
unsigned int len = KSZ_EGRESS_TAG_LEN;
unsigned int port;
u8 *tag;
if (skb_linearize(skb))
return NULL;
/* Tag decoding */
tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
/* Extra 4-bytes PTP timestamp */
if (tag[0] & KSZ9477_PTP_TAG_INDICATION)

View file

@ -332,14 +332,13 @@ static void inetdev_destroy(struct in_device *in_dev)
static int __init inet_blackhole_dev_init(void)
{
int err = 0;
struct in_device *in_dev;
rtnl_lock();
if (!inetdev_init(blackhole_netdev))
err = -ENOMEM;
in_dev = inetdev_init(blackhole_netdev);
rtnl_unlock();
return err;
return PTR_ERR_OR_ZERO(in_dev);
}
late_initcall(inet_blackhole_dev_init);

View file

@ -790,11 +790,12 @@ void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
struct sk_buff *cloned_skb = NULL;
struct ip_options opts = { 0 };
enum ip_conntrack_info ctinfo;
enum ip_conntrack_dir dir;
struct nf_conn *ct;
__be32 orig_ip;
ct = nf_ct_get(skb_in, &ctinfo);
if (!ct || !(ct->status & IPS_SRC_NAT)) {
if (!ct || !(READ_ONCE(ct->status) & IPS_NAT_MASK)) {
__icmp_send(skb_in, type, code, info, &opts);
return;
}
@ -809,7 +810,8 @@ void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
goto out;
orig_ip = ip_hdr(skb_in)->saddr;
ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip;
dir = CTINFO2DIR(ctinfo);
ip_hdr(skb_in)->saddr = ct->tuplehash[dir].tuple.src.u3.ip;
__icmp_send(skb_in, type, code, info, &opts);
ip_hdr(skb_in)->saddr = orig_ip;
out:

View file

@ -66,11 +66,12 @@ void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)
struct inet6_skb_parm parm = { 0 };
struct sk_buff *cloned_skb = NULL;
enum ip_conntrack_info ctinfo;
enum ip_conntrack_dir dir;
struct in6_addr orig_ip;
struct nf_conn *ct;
ct = nf_ct_get(skb_in, &ctinfo);
if (!ct || !(ct->status & IPS_SRC_NAT)) {
if (!ct || !(READ_ONCE(ct->status) & IPS_NAT_MASK)) {
__icmpv6_send(skb_in, type, code, info, &parm);
return;
}
@ -85,7 +86,8 @@ void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)
goto out;
orig_ip = ipv6_hdr(skb_in)->saddr;
ipv6_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.in6;
dir = CTINFO2DIR(ctinfo);
ipv6_hdr(skb_in)->saddr = ct->tuplehash[dir].tuple.src.u3.in6;
__icmpv6_send(skb_in, type, code, info, &parm);
ipv6_hdr(skb_in)->saddr = orig_ip;
out:

View file

@ -417,7 +417,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
(cur->tuple.src.l3num == NFPROTO_UNSPEC ||
cur->tuple.src.l3num == me->tuple.src.l3num) &&
cur->tuple.dst.protonum == me->tuple.dst.protonum) {
ret = -EEXIST;
ret = -EBUSY;
goto out;
}
}
@ -428,7 +428,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) {
if (nf_ct_tuple_src_mask_cmp(&cur->tuple, &me->tuple,
&mask)) {
ret = -EEXIST;
ret = -EBUSY;
goto out;
}
}

View file

@ -1219,7 +1219,8 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
*/
f = rcu_access_pointer(new->pub.beacon_ies);
kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
if (!new->pub.hidden_beacon_bss)
kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
return false;
}

View file

@ -182,6 +182,38 @@ static inline tree build_const_char_string(int len, const char *str)
return cstr;
}
static inline void __add_type_attr(tree type, const char *attr, tree args)
{
tree oldattr;
if (type == NULL_TREE)
return;
oldattr = lookup_attribute(attr, TYPE_ATTRIBUTES(type));
if (oldattr != NULL_TREE) {
gcc_assert(TREE_VALUE(oldattr) == args || TREE_VALUE(TREE_VALUE(oldattr)) == TREE_VALUE(args));
return;
}
TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
TYPE_ATTRIBUTES(type) = tree_cons(get_identifier(attr), args, TYPE_ATTRIBUTES(type));
}
static inline void add_type_attr(tree type, const char *attr, tree args)
{
tree main_variant = TYPE_MAIN_VARIANT(type);
__add_type_attr(TYPE_CANONICAL(type), attr, args);
__add_type_attr(TYPE_CANONICAL(main_variant), attr, args);
__add_type_attr(main_variant, attr, args);
for (type = TYPE_NEXT_VARIANT(main_variant); type; type = TYPE_NEXT_VARIANT(type)) {
if (!lookup_attribute(attr, TYPE_ATTRIBUTES(type)))
TYPE_ATTRIBUTES(type) = TYPE_ATTRIBUTES(main_variant);
__add_type_attr(TYPE_CANONICAL(type), attr, args);
}
}
#define PASS_INFO(NAME, REF, ID, POS) \
struct register_pass_info NAME##_pass_info = { \
.pass = make_##NAME##_pass(), \

View file

@ -95,6 +95,9 @@ static tree handle_randomize_layout_attr(tree *node, tree name, tree args, int f
if (TYPE_P(*node)) {
type = *node;
} else if (TREE_CODE(*node) == FIELD_DECL) {
*no_add_attrs = false;
return NULL_TREE;
} else {
gcc_assert(TREE_CODE(*node) == TYPE_DECL);
type = TREE_TYPE(*node);
@ -377,35 +380,18 @@ static int relayout_struct(tree type)
shuffle(type, (tree *)newtree, shuffle_length);
/*
* set up a bogus anonymous struct field designed to error out on unnamed struct initializers
* as gcc provides no other way to detect such code
*/
list = make_node(FIELD_DECL);
TREE_CHAIN(list) = newtree[0];
TREE_TYPE(list) = void_type_node;
DECL_SIZE(list) = bitsize_zero_node;
DECL_NONADDRESSABLE_P(list) = 1;
DECL_FIELD_BIT_OFFSET(list) = bitsize_zero_node;
DECL_SIZE_UNIT(list) = size_zero_node;
DECL_FIELD_OFFSET(list) = size_zero_node;
DECL_CONTEXT(list) = type;
// to satisfy the constify plugin
TREE_READONLY(list) = 1;
for (i = 0; i < num_fields - 1; i++)
TREE_CHAIN(newtree[i]) = newtree[i+1];
TREE_CHAIN(newtree[num_fields - 1]) = NULL_TREE;
add_type_attr(type, "randomize_performed", NULL_TREE);
add_type_attr(type, "designated_init", NULL_TREE);
if (has_flexarray)
add_type_attr(type, "has_flexarray", NULL_TREE);
main_variant = TYPE_MAIN_VARIANT(type);
for (variant = main_variant; variant; variant = TYPE_NEXT_VARIANT(variant)) {
TYPE_FIELDS(variant) = list;
TYPE_ATTRIBUTES(variant) = copy_list(TYPE_ATTRIBUTES(variant));
TYPE_ATTRIBUTES(variant) = tree_cons(get_identifier("randomize_performed"), NULL_TREE, TYPE_ATTRIBUTES(variant));
TYPE_ATTRIBUTES(variant) = tree_cons(get_identifier("designated_init"), NULL_TREE, TYPE_ATTRIBUTES(variant));
if (has_flexarray)
TYPE_ATTRIBUTES(type) = tree_cons(get_identifier("has_flexarray"), NULL_TREE, TYPE_ATTRIBUTES(type));
}
for (variant = main_variant; variant; variant = TYPE_NEXT_VARIANT(variant))
TYPE_FIELDS(variant) = newtree[0];
/*
* force a re-layout of the main variant
@ -473,10 +459,8 @@ static void randomize_type(tree type)
if (lookup_attribute("randomize_layout", TYPE_ATTRIBUTES(TYPE_MAIN_VARIANT(type))) || is_pure_ops_struct(type))
relayout_struct(type);
for (variant = TYPE_MAIN_VARIANT(type); variant; variant = TYPE_NEXT_VARIANT(variant)) {
TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
TYPE_ATTRIBUTES(type) = tree_cons(get_identifier("randomize_considered"), NULL_TREE, TYPE_ATTRIBUTES(type));
}
add_type_attr(type, "randomize_considered", NULL_TREE);
#ifdef __DEBUG_PLUGIN
fprintf(stderr, "Marking randomize_considered on struct %s\n", ORIG_TYPE_NAME(type));
#ifdef __DEBUG_VERBOSE

View file

@ -1820,6 +1820,7 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid)
static const struct snd_pci_quirk force_connect_list[] = {
SND_PCI_QUIRK(0x103c, 0x83e2, "HP EliteDesk 800 G4", 1),
SND_PCI_QUIRK(0x103c, 0x83ef, "HP MP9 G4 Retail System AMS", 1),
SND_PCI_QUIRK(0x103c, 0x845a, "HP EliteDesk 800 G4 DM 65W", 1),
SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1),
SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1),
SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1),

View file

@ -8390,6 +8390,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x89aa, "HP EliteBook 630 G9", ALC236_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8e1d, "HP ZBook X Gli 16 G12", ALC236_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),

View file

@ -2587,9 +2587,11 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
break;
/* lowest playback value is muted on some devices */
case USB_ID(0x0572, 0x1b09): /* Conexant Systems (Rockwell), Inc. */
case USB_ID(0x0d8c, 0x000c): /* C-Media */
case USB_ID(0x0d8c, 0x0014): /* C-Media */
case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */
case USB_ID(0x2d99, 0x0026): /* HECATE G2 GAMING HEADSET */
if (strstr(kctl->id.name, "Playback"))
cval->min_mute = 1;
break;