summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-09-06iwlwifi: LTR updatesAlex Malamud3-2/+41
New FW versions introduces LTR feature enablement by default. For such FW versions, driver (mvm/xvt) should not send host command to enable LTR feature, also it should be possible to override LTR configuration through the debugfs. 1. Send LTR feature enablement command only for FW versions which does not advertises SET_LTR_GEN2 capability. 2. Implement ltr_config file in debugfs for LTR configuration override. Signed-off-by: Alex Malamud <alex.malamud@intel.com>
2019-09-06iwlwifi: remove the code under IWLWIFI_PCIE_RTPMEmmanuel Grumbach3-89/+0
This flag should never be set unless integration work with the platform is done. We don't support any platforms officially and don't plan to do so in the near future, so we can remove this option entirely in order to avoid having it enabled by mistake. This has been marked with "depends on EXPERT", so there shouldn't be many systems running with it set. And, if there are systems, they should not be using this flag. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: trans: remove suspending flagEmmanuel Grumbach2-15/+0
This is set but never read. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: remove CMD_HIGH_PRIOEmmanuel Grumbach1-8/+4
This flag is never set on any host command. Remove it. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: remove last leftovers of d0i3Emmanuel Grumbach3-17/+0
We're now left with a status bit that is never set and a few other leftovers. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: remove iwl_mvm_update_d0i3_power_modeEmmanuel Grumbach2-74/+11
Also change the signature of the power functions that won't receive d0i3=true anymore. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: remove d0i3_ap_sta_idEmmanuel Grumbach3-11/+0
This variable read, but never set. Remove it. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: iwl_mvm_wowlan_config_key_params is for wowlan onlyEmmanuel Grumbach2-61/+15
Now that d0i3 is dead, this function can't be called from d0i3 flows. Change its signature and make it static. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: remove the d0i3 entry/exit flowEmmanuel Grumbach4-508/+2
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: remove the tx defer for d0i3Emmanuel Grumbach3-111/+1
This is not needed anymore Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: remove all the d0i3 referencesEmmanuel Grumbach13-465/+11
As part of the d0i3 removal. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: start to remove the code for d0i3Emmanuel Grumbach1-18/+0
For runtime PM to work with d0i3 code, a lot of integration work needs to be done with the platform (e.g. the out-of-band wake up interrupt) and we currently don't have any platforms where this integration happened. So, this code has been pretty much stale for a while and when someone enables it, it just breaks things. Therefore, to simplify the code base and make sure no one enables this by mistake, we will remove the whole code. This is only the very start, much more work is needed. Remove the places where we check iwl_mvm_is_d0i3_supported but leave all the refs, those will be removed in a different patch. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: add the skb length to a printShaul Triebitz1-2/+3
When printing a TX, add to the print the length of the frame. That will help with BSEP (buffer status report poll) tests. Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: fix scan config command sizeBeker Ayala1-1/+1
Use the actual length of channels array and not the max capable length. Signed-off-by: Beker Ayala <ayala.beker@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: add ldbg config cmd debug printShahar S Matityahu1-0/+1
add support to print ldbg command in mvm and xvt mode Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: dbg: support debug recording suspend resume commandShahar S Matityahu6-55/+87
Support the new DBGC_SUSPEND_RESUME command to change the recording state. Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: dbg: move debug recording stop from trans to op modeShahar S Matityahu6-11/+7
The op mode should stop the debug recording and not the transport layer. Rename iwl_fwrt_stop_device into iwl_fw_dbg_stop_sync and move the debug stop recording to it. Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: dbg: move monitor recording functionality from header fileShahar S Matityahu2-85/+89
The recording functions are quite big to be inline and the driver should expose only the stop and restart functions that are allowed to be used rather then the internal helper functions. Move the functions from the header file. Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: remove unnecessary forward declarationsJohannes Berg1-8/+0
These static functions are only used after their definition, so we don't need the forward declarations. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: Block 26-tone RU OFDMA transmissionsIlan Peer3-0/+61
In case that there are OBSS that do not know how to properly interpret 26-tone RU OFDMA transmissions, instruct the FW not to use such transmissions. The check is currently only performed upon association. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: mvm: remove redundant condition in iwl_mvm_set_hw_rfkill_stateEmmanuel Grumbach1-2/+1
If mvm->fwrt.cur_fw_img != IWL_UCODE_INIT, then rfkill_safe_init_done must be true since rfkill_safe_init_done is set to true before we start to load the runtime image. Remove the redundant condition. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: Send DQA enable command only if TVL is onIlia Lin1-3/+5
The newer targets don't support the DQA enablement command and will return error status, while older targets need it. The feature is defined by the corresponding TLV. Send the command only if the TLV is enabled. Signed-off-by: Ilia Lin <ilia.lin@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06iwlwifi: bump FW API to 49 for 22000 seriesLuca Coelho1-1/+1
Start supporting API version 49 for 22000 series. Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-09-06Documentation/process/embargoed-hardware-issues: Microsoft ambassadorSasha Levin1-1/+1
Add Sasha Levin as Microsoft's process ambassador. Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Link: https://lore.kernel.org/r/20190906095852.23568-1-sashal@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-06soc: qcom: geni: Provide parameter error checkingLee Jones1-0/+6
When booting with ACPI, the Geni Serial Engine is not set as the I2C/SPI parent and thus, the wrapper (parent device) is unassigned. This causes the kernel to crash with a null dereference error. Link: https://lore.kernel.org/r/20190905082555.15020-1-lee.jones@linaro.org Fixes: 8bc529b25354 ("soc: qcom: geni: Add support for ACPI") Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org> Reviewed-by: Stephen Boyd <sboyd@kernel.org> Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2019-09-06Merge tag 'mt76-for-kvalo-2019-09-05' of https://github.com/nbd168/wirelessKalle Valo98-1518/+1870
mt76 patches for 5.4 * beacon tx fix for mt76x02 * sparse/checkpatch warning fixes * DFS pattern detector for mt7615 (DFS channels not enabled yet) * CSA support for mt7615 * mt7615 cleanup/fixes * mt7615 rate control improvements * usb fixes * mt7615 powersave buffering fix * new device support for mt76x0 * support for more ciphers in mt7615 * watchdog time fixes * smart carrier sense on mt7615 * survey support on mt7615 * multiple interfaces on mt76x02u * calibration data fix for mt7615 * fix for sending BAR after disassoc
2019-09-06iommu/amd: Fix race in increase_address_space()Joerg Roedel1-5/+11
After the conversion to lock-less dma-api call the increase_address_space() function can be called without any locking. Multiple CPUs could potentially race for increasing the address space, leading to invalid domain->mode settings and invalid page-tables. This has been happening in the wild under high IO load and memory pressure. Fix the race by locking this operation. The function is called infrequently so that this does not introduce a performance regression in the dma-api path again. Reported-by: Qian Cai <cai@lca.pw> Fixes: 256e4621c21a ('iommu/amd: Make use of the generic IOVA allocator') Signed-off-by: Joerg Roedel <jroedel@suse.de>
2019-09-06iommu/amd: Flush old domains in kdump kernelStuart Hayes1-0/+24
When devices are attached to the amd_iommu in a kdump kernel, the old device table entries (DTEs), which were copied from the crashed kernel, will be overwritten with a new domain number. When the new DTE is written, the IOMMU is told to flush the DTE from its internal cache--but it is not told to flush the translation cache entries for the old domain number. Without this patch, AMD systems using the tg3 network driver fail when kdump tries to save the vmcore to a network system, showing network timeouts and (sometimes) IOMMU errors in the kernel log. This patch will flush IOMMU translation cache entries for the old domain when a DTE gets overwritten with a new domain number. Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com> Fixes: 3ac3e5ee5ed5 ('iommu/amd: Copy old trans table from old kernel') Signed-off-by: Joerg Roedel <jroedel@suse.de>
2019-09-06x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large ↵Steve Wahl1-16/+19
to fix kexec relocation errors The last change to this Makefile caused relocation errors when loading a kdump kernel. Restore -mcmodel=large (not -mcmodel=kernel), -ffreestanding, and -fno-zero-initialized-bsss, without reverting to the former practice of resetting KBUILD_CFLAGS. Purgatory.ro is a standalone binary that is not linked against the rest of the kernel. Its image is copied into an array that is linked to the kernel, and from there kexec relocates it wherever it desires. With the previous change to compiler flags, the error "kexec: Overflow in relocation type 11 value 0x11fffd000" was encountered when trying to load the crash kernel. This is from kexec code trying to relocate the purgatory.ro object. From the error message, relocation type 11 is R_X86_64_32S. The x86_64 ABI says: "The R_X86_64_32 and R_X86_64_32S relocations truncate the computed value to 32-bits. The linker must verify that the generated value for the R_X86_64_32 (R_X86_64_32S) relocation zero-extends (sign-extends) to the original 64-bit value." This type of relocation doesn't work when kexec chooses to place the purgatory binary in memory that is not reachable with 32 bit addresses. The compiler flag -mcmodel=kernel allows those type of relocations to be emitted, so revert to using -mcmodel=large as was done before. Also restore the -ffreestanding and -fno-zero-initialized-bss flags because they are appropriate for a stand alone piece of object code which doesn't explicitly zero the bss, and one other report has said undefined symbols are encountered without -ffreestanding. These identical compiler flag changes need to happen for every object that becomes part of the purgatory.ro object, so gather them together first into PURGATORY_CFLAGS_REMOVE and PURGATORY_CFLAGS, and then apply them to each of the objects that have C source. Do not apply any of these flags to kexec-purgatory.o, which is not part of the standalone object but part of the kernel proper. Tested-by: Vaibhav Rustagi <vaibhavrustagi@google.com> Tested-by: Andreas Smas <andreas@lonelycoder.com> Signed-off-by: Steve Wahl <steve.wahl@hpe.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Cc: Borislav Petkov <bp@alien8.de> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: None Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: clang-built-linux@googlegroups.com Cc: dimitri.sivanich@hpe.com Cc: mike.travis@hpe.com Cc: russ.anderson@hpe.com Fixes: b059f801a937 ("x86/purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS") Link: https://lkml.kernel.org/r/20190905202346.GA26595@swahl-linux Signed-off-by: Ingo Molnar <mingo@kernel.org>
2019-09-06Merge tag 'drm-misc-fixes-2019-09-05' of ↵Dave Airlie4-9/+187
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.3 final: - Make ingenic panel type DPI insteado f unknown. - Fixes for command line parser modes. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/606d87b2-1840-c893-eb30-d6c471c9e50a@linux.intel.com
2019-09-06Merge branch 'vmwgfx-fixes-5.3' of ↵Dave Airlie1-5/+3
git://people.freedesktop.org/~thomash/linux into drm-fixes Single vmwgfx double free fix. Signed-off-by: Dave Airlie <airlied@redhat.com>
2019-09-06perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initializationMark-PK Tsai1-2/+2
If we disable the compiler's auto-initialization feature, if -fplugin-arg-structleak_plugin-byref or -ftrivial-auto-var-init=pattern are disabled, arch_hw_breakpoint may be used before initialization after: 9a4903dde2c86 ("perf/hw_breakpoint: Split attribute parse and commit") On our ARM platform, the struct step_ctrl in arch_hw_breakpoint, which used to be zero-initialized by kzalloc(), may be used in arch_install_hw_breakpoint() without initialization. Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Alix Wu <alix.wu@mediatek.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: YJ Chiang <yj.chiang@mediatek.com> Link: https://lkml.kernel.org/r/20190906060115.9460-1-mark-pk.tsai@mediatek.com [ Minor edits. ] Signed-off-by: Ingo Molnar <mingo@kernel.org>
2019-09-06net/mlx5e: Add port buffer's congestion countersAya Levin2-1/+150
Add 3 counters per priority to ethtool using PPCNT: 1) rx_prio[p]_buf_discard - the number of packets discarded by device due to lack of per host receive buffers 2) rx_prio[p]_cong_discard - the number of packets discarded by device due to per host congestion 3) rx_prio[p]_marked - the number of packets ECN marked by device due to per host congestion Signed-off-by: Aya Levin <ayal@mellanox.com> Reviewed-by: Moshe Shemesh <moshe@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5: Expose HW capability bits for port buffer per priority congestion ↵Aya Levin2-5/+25
counters Map capability bit indicating that HCA supports port buffer's congestion counters. Also map registers with the corresponding counters. Signed-off-by: Aya Levin <ayal@mellanox.com> Reviewed-by: Moshe Shemesh <moshe@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5: DR, Remove redundant dev_name print from err logSaeed Mahameed1-10/+5
mlx5_core_err already prints the name of the device. Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5: DR, Fix error return code in dr_domain_init_resources()Wei Yongjun1-0/+3
Fix to return negative error code -ENOMEM from the error handling case instead of 0, as done elsewhere in this function. Fixes: 4ec9e7b02697 ("net/mlx5: DR, Expose steering domain functionality") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5: DR, Remove useless set memory to zero use memset()Wei Yongjun1-1/+0
The memory return by kzalloc() has already be set to zero, so remove useless memset(0). Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5e: Remove unnecessary clear_bit()sMaxim Mikityanskiy1-2/+0
Don't clear MLX5E_SQ_STATE_ENABLED on error in mlx5e_open_txqsq and mlx5e_open_icosq, because it's not set there, and is 0 by default. Fixes: acc6c5953af1 ("net/mlx5e: Split open/close channels to stages") Fixes: 9d18b5144a0a ("net/mlx5e: Split open/close ICOSQ into stages") Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5e: kTLS, Remove unused function parameterTariq Toukan1-4/+2
SKB parameter is no longer used in tx_post_resync_dump(), remove it. Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Reviewed-by: Eran Ben Elisha <eranbe@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5: Use PTR_ERR_OR_ZERO rather than its implementationzhong jiang1-4/+1
PTR_ERR_OR_ZERO contains if(IS_ERR(...)) + PTR_ERR. It is better to use it directly. hence just replace it. Signed-off-by: zhong jiang <zhongjiang@huawei.com> Acked-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5: fix missing assignment of variable errColin Ian King1-1/+1
The error return from a call to mlx5_flow_namespace_set_peer is not being assigned to variable err and hence the error check following the call is currently not working. Fix this by assigning ret as intended. Addresses-Coverity: ("Logically dead code") Fixes: 8463daf17e80 ("net/mlx5: Add support to use SMFS in switchdev mode") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5: fix spelling mistake "offlaods" -> "offloads"Colin Ian King1-1/+1
There is a spelling mistake in a NL_SET_ERR_MSG_MOD error message. Fix it. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5e: Remove leftover declarationRoi Dayan1-1/+0
This function was removed in the cited commit below. Fixes: 13e509a4c194 ("net/mlx5e: Remove leftover code from the PF netdev being uplink rep") Signed-off-by: Roi Dayan <roid@mellanox.com> Reviewed-by: Vlad Buslov <vladbu@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5e: Use ipv6_stub to avoid dependency with ipv6 being a moduleSaeed Mahameed3-12/+14
mlx5 is dependent on IPv6 tristate since we use ipv6's nd_tbl directly, alternatively we can use ipv6_stub->nd_tbl and remove the dependency. Reported-by: Walter Harms <wharms@bfs.de> Reviewed-by: Mark Bloch <markb@mellanox.com> Reviewed-by: Vlad Buslov <vladbu@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5: Kconfig: Fix MLX5_CORE dependency with PCI_HYPERV_INTERFACEMao Wenan1-0/+1
When MLX5_CORE=y and PCI_HYPERV_INTERFACE=m, below errors are found: drivers/net/ethernet/mellanox/mlx5/core/en_main.o: In function `mlx5e_nic_enable': en_main.c:(.text+0xb649): undefined reference to `mlx5e_hv_vhca_stats_create' drivers/net/ethernet/mellanox/mlx5/core/en_main.o: In function `mlx5e_nic_disable': en_main.c:(.text+0xb8c4): undefined reference to `mlx5e_hv_vhca_stats_destroy' Fix this by making MLX5_CORE imply PCI_HYPERV_INTERFACE. Fixes: cef35af34d6d ("net/mlx5e: Add mlx5e HV VHCA stats agent") Signed-off-by: Mao Wenan <maowenan@huawei.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06net/mlx5e: Fix static checker warning of potential pointer math issueEran Ben Elisha1-5/+4
Cited patch have an issue in WARN_ON_ONCE check, with wrong address ranges are compared. Fix that by changing pointer types from u64* to void*. This will also make code simpler to read. In addition mlx5e_hv_vhca_fill_ring_stats can get void pointer, so remove the unnecessary casting when calling it. Found by static checker: drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c:41 mlx5e_hv_vhca_fill_stats() warn: potential pointer math issue ('buf' is a u64 pointer) Fixes: cef35af34d6d ("net/mlx5e: Add mlx5e HV VHCA stats agent") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2019-09-06keys: Fix missing null pointer check in request_key_auth_describe()Hillf Danton1-0/+6
If a request_key authentication token key gets revoked, there's a window in which request_key_auth_describe() can see it with a NULL payload - but it makes no check for this and something like the following oops may occur: BUG: Kernel NULL pointer dereference at 0x00000038 Faulting instruction address: 0xc0000000004ddf30 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [...] request_key_auth_describe+0x90/0xd0 LR [...] request_key_auth_describe+0x54/0xd0 Call Trace: [...] request_key_auth_describe+0x54/0xd0 (unreliable) [...] proc_keys_show+0x308/0x4c0 [...] seq_read+0x3d0/0x540 [...] proc_reg_read+0x90/0x110 [...] __vfs_read+0x3c/0x70 [...] vfs_read+0xb4/0x1b0 [...] ksys_read+0x7c/0x130 [...] system_call+0x5c/0x70 Fix this by checking for a NULL pointer when describing such a key. Also make the read routine check for a NULL pointer to be on the safe side. [DH: Modified to not take already-held rcu lock and modified to also check in the read routine] Fixes: 04c567d9313e ("[PATCH] Keys: Fix race between two instantiators of a key") Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com> Signed-off-by: Hillf Danton <hdanton@sina.com> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-09-05genirq: Prevent NULL pointer dereference in resend_irqs()Yunfeng Ye1-0/+2
The following crash was observed: Unable to handle kernel NULL pointer dereference at 0000000000000158 Internal error: Oops: 96000004 [#1] SMP pc : resend_irqs+0x68/0xb0 lr : resend_irqs+0x64/0xb0 ... Call trace: resend_irqs+0x68/0xb0 tasklet_action_common.isra.6+0x84/0x138 tasklet_action+0x2c/0x38 __do_softirq+0x120/0x324 run_ksoftirqd+0x44/0x60 smpboot_thread_fn+0x1ac/0x1e8 kthread+0x134/0x138 ret_from_fork+0x10/0x18 The reason for this is that the interrupt resend mechanism happens in soft interrupt context, which is a asynchronous mechanism versus other operations on interrupts. free_irq() does not take resend handling into account. Thus, the irq descriptor might be already freed before the resend tasklet is executed. resend_irqs() does not check the return value of the interrupt descriptor lookup and derefences the return value unconditionally. 1): __setup_irq irq_startup check_irq_resend // activate softirq to handle resend irq 2): irq_domain_free_irqs irq_free_descs free_desc call_rcu(&desc->rcu, delayed_free_desc) 3): __do_softirq tasklet_action resend_irqs desc = irq_to_desc(irq) desc->handle_irq(desc) // desc is NULL --> Ooops Fix this by adding a NULL pointer check in resend_irqs() before derefencing the irq descriptor. Fixes: a4633adcdbc1 ("[PATCH] genirq: add genirq sw IRQ-retrigger") Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com> Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1630ae13-5c8e-901e-de09-e740b6a426a7@huawei.com
2019-09-05Merge tag 'sound-5.3-rc8' of ↵Linus Torvalds4-3/+22
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small HD-audio fixes: - A regression fix for Realtek codecs due to the recent initialization procedure change - A fix for potential endless loop at the quirk table lookup - Quirks for Lenovo, ASUS and HP machines" * tag 'sound-5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL ALSA: hda/realtek - Add quirk for HP Pavilion 15 ALSA: hda/realtek - Fix overridden device-specific initialization ALSA: hda - Fix potential endless loop at applying quirks
2019-09-05Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds3-4/+9
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: - EFI boot fix for signed kernels - an AC flags fix related to UBSAN - Hyper-V infinite loop fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hyper-v: Fix overflow bug in fill_gva_list() x86/uaccess: Don't leak the AC flags into __get_user() argument evaluation x86/boot: Preserve boot_params.secure_boot from sanitizing
generated by cgit v1.2.3 (git 2.39.0) at 2025-10-04 01:47:34 +0300