Commit Graph

862781 Commits

Author SHA1 Message Date
Algea Cao
59ac9596a3 drm/rockchip: Set picture aspect to none when show kernel logo
Crtc mode will include picture aspect and generate umode's flags
will include picture aspect mask when show kernel logo. After hwc
start, DRM_CLIENT_CAP_ASPECT_RATIO will be set to 0, and the umode
hwc got will not include picture aspect. That will cause two modes
mismatch, leading to a resolution reconfiguration and cause display
err.

Signed-off-by: Algea Cao <algea.cao@rock-chips.com>
Change-Id: I4e3ad1263d9d462567d14ae4c77d7b1aa05ddb1c
2021-01-08 17:49:04 +08:00
Cai YiWei
eebb8c213f media: rockchip: isp/ispp set core clk to low freq if no stream output
Change-Id: I5d8dcfd27c8be4a0520d9bf5e18057f5376d98ef
Signed-off-by: Cai YiWei <cyw@rock-chips.com>
2021-01-08 17:27:13 +08:00
Jianqun Xu
a21959e676 dma-buf: add buf proc debug node
Usage: cat /sys/kernel/debug/dma_buf/dmaprocs

mediaserver (PID 662) size: 99044
DMA Buffers:
Name            Exp_name             Size (KB)       Time Alive (sec)
(null)          rockchipdrm          452             15
(null)          rockchipdrm          68              13
(null)          rockchipdrm          5988            15

ispserver (PID 649) size: 44528
DMA Buffers:
Name            Exp_name             Size (KB)       Time Alive (sec)
(null)          videobuf2_vmalloc    12              16
(null)          videobuf2_dma_sg     316             14
(null)          videobuf2_vmalloc    4               16

Change-Id: Icf46e9d585847ef6dafbddcd24e589046e3ff015
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
2021-01-08 14:40:19 +08:00
Ding Wei
5d95879ae9 arm64: dts: rockchip: rk3568: add rcb-iova info for rkvdec
tips:
rockchip,rcb-iova=<iova_start iova_size>

Change-Id: I091a2af99573e1d5e677d0dad4b5dae5d4bd551d
Signed-off-by: Ding Wei <leo.ding@rock-chips.com>
2021-01-08 14:26:51 +08:00
Ding Wei
008cf6f695 video: rockchip: mpp: rkvdec2: support sram for rcb buffer
rcb buffer consists of sram and dma, sram is in the front.
rcb buffer: sram + dma
rcb_size = sram_size + dma_size

Change-Id: I4b0f1e7fb5f541b3fb1a84d7eeba5c473f7c07c5
Signed-off-by: Ding Wei <leo.ding@rock-chips.com>
2021-01-08 12:52:37 +08:00
Cai YiWei
e5bf9b2cfb ARM: dts: rv1126: isp add iommu node
isp iommu on/off by rkisp_mmu's status

Change-Id: I0b156b9beea30c9c47a4fff4779b471dd464117b
Signed-off-by: Cai YiWei <cyw@rock-chips.com>
2021-01-07 19:35:46 +08:00
Cai YiWei
505e09028a media: rockchip: isp/ispp add dma contiguous attrs
if device add reserved memory area and enable iommu,
pages can alloc from contiguous memory region, this
need DMA_ATTR_FORCE_CONTIGUOUS attrs.

Change-Id: I12e00467a1f7e4c6661397663835c328351715b9
Signed-off-by: Cai YiWei <cyw@rock-chips.com>
2021-01-07 19:34:49 +08:00
Cai YiWei
46e7d9882b media: videobuf2-dma-sg: support contiguous page by dma attrs
device maybe support alloc dma from contiguous memory area,
but dma sg page isn't contiguous default, add dma_attrs
(DMA_ATTR_FORCE_CONTIGUOUS) to alloc contiguous pages.

Change-Id: I909385ff3165f604ed498c71bc18f573064d3595
Signed-off-by: Cai YiWei <cyw@rock-chips.com>
2021-01-07 19:34:49 +08:00
Cai YiWei
2ef2357f15 media: rockchip: isp: fix dmatx width err for yuv422 format
Change-Id: I2b6c9e2fbb0f46cdddfc57b068d43bb08d0bb169
Signed-off-by: Cai YiWei <cyw@rock-chips.com>
2021-01-07 19:34:49 +08:00
Finley Xiao
7bfc54efa9 MALI: bifrost: Add private data for governor
This adds support to get simple_ondemand governor data from devicetree.

Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
Change-Id: I6d44ba467d52bde191fb1b87bce02dc503055262
2021-01-07 19:29:58 +08:00
Finley Xiao
1543446b83 arm64: dts: rockchip: rk3568: Add 'nvmem-cells' property for cpu and gpu
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
Change-Id: I507d1851a0f6a200988fe22ce5e144cfd2ce7819
2021-01-07 19:24:54 +08:00
Finley Xiao
37110ebe35 arm64: dts: rockchip: rk3568: Add system monitor node
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
Change-Id: Ic540ff25ce443919372fe6a2a074d60e479c7209
2021-01-07 19:24:44 +08:00
Ding Wei
e544f5dd27 arm64: dts: rockchip: add rkvdec sram node for rk3568
Change-Id: I2c6ab9a203116591bdd33dc8c81eddacc70710eb
Signed-off-by: Ding Wei <leo.ding@rock-chips.com>
2021-01-07 19:11:40 +08:00
Ziyuan Xu
86cc3029d7 drivers: rkflash: fixes compile error when !CONFIG_MTD
In file included from drivers/rkflash/sfc_nand_mtd.c:6:0:
./include/linux/mtd/cfi.h:76:2: warning: #warning No CONFIG_MTD_CFI_Ix selected. No NOR chip support can work. [-Wcpp]
error, forbidden warning:cfi.h:76
 #warning No CONFIG_MTD_CFI_Ix selected. No NOR chip support can work.
  ^~~~~~~
scripts/Makefile.build:333: recipe for target 'drivers/rkflash/sfc_nand_mtd.o' failed
make[2]: *** [drivers/rkflash/sfc_nand_mtd.o] Error 1
make[2]: *** Waiting for unfinished jobs....
In file included from drivers/rkflash/sfc_nor_mtd.c:6:0:
./include/linux/mtd/cfi.h:76:2: warning: #warning No CONFIG_MTD_CFI_Ix selected. No NOR chip support can work. [-Wcpp]
error, forbidden warning:cfi.h:76

Change-Id: I900d20adbd86c8293a9496ffba4bd722a46bfeae
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
2021-01-07 19:09:33 +08:00
Ren Jianing
2bd6e6bb10 usb: gadget: f_fs: fix ep req_match error for composite device
This patch add direction index for eps_revmap, which can avoid matching
to the requests for other functions.

For example, if we config ep1in for uac and ep1out for adb, the requests
for ep1in will be matching to ffs without this patch.

Signed-off-by: Ren Jianing <jianing.ren@rock-chips.com>
Change-Id: Ic7a52fca35503656bbc306c9f0014dfdea61392b
2021-01-07 16:12:39 +08:00
Hu Kejun
5717d1681f media: rockchip: isp: fix lsc lut error in start/stop test
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
Change-Id: I2d317b15f92f7a157da04ab770cd9dc8a243bf05
2021-01-07 15:47:39 +08:00
Shawn Lin
a57c7fa1c7 PCI: rockchip: dw: Fix suspend support for rk356x
Migrate to noirq phase and only call rk_pcie_reset_grant_ctrl()
when using in RK1808 platforms.

Change-Id: I629dc121457614b17bcf9a1e1d93e09859a4cb26
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
2021-01-07 15:11:46 +08:00
Jianqun Xu
3b1adb0d79 ARM: mm: fix virtual kernel memory layout display format
Before this patch:
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xf0800000 - 0xff800000   ( 240 MB)
[    0.000000]     lowmem  : 0xb0000000 - 0xf0000000   (1024 MB)
[    0.000000]     pkmap   : 0xafe00000 - 0xb0000000   (   2 MB)
[    0.000000]     modules : 0xaf000000 - 0xafe00000   (  14 MB)
[    0.000000]       .text : 0x(ptrval) - 0x(ptrval)   (9184 kB)
[    0.000000]       .init : 0x(ptrval) - 0x(ptrval)   (1024 kB)
[    0.000000]       .data : 0x(ptrval) - 0x(ptrval)   ( 331 kB)
[    0.000000]        .bss : 0x(ptrval) - 0x(ptrval)   ( 896 kB)

With this patch:
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xf0800000 - 0xff800000   ( 240 MB)
[    0.000000]     lowmem  : 0xb0000000 - 0xf0000000   (1024 MB)
[    0.000000]     pkmap   : 0xafe00000 - 0xb0000000   (   2 MB)
[    0.000000]     modules : 0xaf000000 - 0xafe00000   (  14 MB)
[    0.000000]       .text : 0xb0008000 - 0xb0900000   (9184 kB)
[    0.000000]       .init : 0xb0c00000 - 0xb0d00000   (1024 kB)
[    0.000000]       .data : 0xb0d00000 - 0xb0d52d4c   ( 332 kB)
[    0.000000]        .bss : 0xb0d52d4c - 0xb0e329b0   ( 896 kB)

Change-Id: I3c77ff89dc5320213f4ff1e0a89b3c688f1d0638
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
2021-01-07 15:03:45 +08:00
Jianqun Xu
7a669a6418 mm: cma: add CmaAllocated/CmaReleased info for meminfo node
Show the CMA pages used by cma_alloc in meminfo node.

Tested on RV1126 EVB DDR3:
CmaTotal:         270336 kB
CmaAllocated:      44408 kB
CmaReleased:      225928 kB
CmaFree:               0 kB

The CmaTotal = CmaAllocated + CmaReleased, and the CmaFree is pages
under cma area unused by system.

The CmaAllocated can be calculated by CMA_DEBUGFS.
Tested on RV1126 EVB DDR3:
cat /sys/kernel/debug/cma/*/used
10756
346

The results from cma used is in page count, 1 page = 4kByte
CmaAllocated = 44408kB = 10756 + 346 pages

Change-Id: Ib79001367562c968e6432816b158cba551978173
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
2021-01-07 14:16:12 +08:00
Andy Yan
adb17e773c drm/rockchip: vop2: Register format_modifiers
Userspace can check format_modifiers to know if
we support afbc or other format.

Change-Id: I6c74876551877e5bef1d98d2d85d4c3d84e2104b
Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
2021-01-07 14:05:21 +08:00
Wyon Bi
22e1c3dbb7 drm/bridge: analogix_dp: Fix voltage_swing/pre_emphasis level calculation
Fixes: d7ad116fb3 ("drm/rockchip: analogix_dp: Add support for rk3568")
Signed-off-by: Wyon Bi <bivvy.bi@rock-chips.com>
Change-Id: I6da4a8c0c4b5486bac6bb054aee6535118e81f60
2021-01-07 11:42:15 +08:00
Cai YiWei
ebb99ecd46 media: rockchip: ispp: add virtual video for iqtool
Change-Id: I33229d46cb476e8ab036883238815821fe6119d2
Signed-off-by: Cai YiWei <cyw@rock-chips.com>
2021-01-07 11:36:59 +08:00
zhangqing
c6be2b1160 arm64: dts: rockchip: rk3568: modify gpu clk
GPU clk using SCMI,replace <&cru CLK_GPU> with <&scmi_clk 1>

Signed-off-by: zhangqing <zhangqing@rock-chips.com>
Change-Id: I12d263b29caa8dd5b635a5d6bbf86677ed12414d
2021-01-07 11:30:22 +08:00
Elaine Zhang
d8f8857b7e clk: rockchip: rk3568: add READ_ONLY flag for clk_gpu
clk_gpu is not allow to set rate, just read only.

Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Change-Id: I59b31b059cfe941104765c066a0c678b1ca50312
2021-01-07 11:29:55 +08:00
zhangqing
36f64d7150 arm64: dts: rockchip: rk3568: modify cpu clk
CPU clk using SCMI,replace <&cru ARMCLK> with <&scmi_clk 0>

Signed-off-by: zhangqing <zhangqing@rock-chips.com>
Change-Id: I321493604d95690ca2a2b4040dfcf8acd9f77697
2021-01-07 11:29:45 +08:00
XiaoDong Huang
bd22b8ce75 arm64: dts: rockchip: rk3568: Make some changes for scmi
1. Use DDR 1M+60K~1M+64K instead of sram to be share memory.
2. Delete property "shmem" in scmi_clk node.
3. Change smc-id to 0x82000010.

Change-Id: I97f25dec6b61fb749b1ef79ef9875abe48fa662e
Signed-off-by: XiaoDong Huang <derrick.huang@rock-chips.com>
2021-01-07 11:27:37 +08:00
Greg Kroah-Hartman
c0fc50e6a0 Merge 4.19.165 into android-4.19-stable
Changes in 4.19.165
	md/raid10: initialize r10_bio->read_slot before use.
	fscrypt: add fscrypt_is_nokey_name()
	ext4: prevent creating duplicate encrypted filenames
	f2fs: prevent creating duplicate encrypted filenames
	ubifs: prevent creating duplicate encrypted filenames
	vfio/pci: Move dummy_resources_list init in vfio_pci_probe()
	ext4: don't remount read-only with errors=continue on reboot
	uapi: move constants from <linux/kernel.h> to <linux/const.h>
	KVM: SVM: relax conditions for allowing MSR_IA32_SPEC_CTRL accesses
	KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits
	powerpc/bitops: Fix possible undefined behaviour with fls() and fls64()
	xen/gntdev.c: Mark pages as dirty
	null_blk: Fix zone size initialization
	of: fix linker-section match-table corruption
	Bluetooth: hci_h5: close serdev device and free hu in h5_close
	reiserfs: add check for an invalid ih_entry_count
	misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells()
	media: gp8psk: initialize stats at power control logic
	ALSA: seq: Use bool for snd_seq_queue internal flags
	ALSA: rawmidi: Access runtime->avail always in spinlock
	fcntl: Fix potential deadlock in send_sig{io, urg}()
	rtc: sun6i: Fix memleak in sun6i_rtc_clk_init
	module: set MODULE_STATE_GOING state when a module fails to load
	quota: Don't overflow quota file offsets
	powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe()
	NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode
	module: delay kobject uevent until after module init call
	ALSA: pcm: Clear the full allocated memory at hw_params
	dm verity: skip verity work if I/O error when system is shutting down
	Linux 4.19.165

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I211fed33aec407a84504c9031ad723890263d943
2021-01-06 15:16:13 +01:00
Greg Kroah-Hartman
4143d79831 Linux 4.19.165
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20210105090818.518271884@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:02 +01:00
Hyeongseok Kim
63d881957e dm verity: skip verity work if I/O error when system is shutting down
[ Upstream commit 252bd12563 ]

If emergency system shutdown is called, like by thermal shutdown,
a dm device could be alive when the block device couldn't process
I/O requests anymore. In this state, the handling of I/O errors
by new dm I/O requests or by those already in-flight can lead to
a verity corruption state, which is a misjudgment.

So, skip verity work in response to I/O error when system is shutting
down.

Signed-off-by: Hyeongseok Kim <hyeongseok@gmail.com>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:45:01 +01:00
Takashi Iwai
5ec9c5d260 ALSA: pcm: Clear the full allocated memory at hw_params
[ Upstream commit 618de0f4ef ]

The PCM hw_params core function tries to clear up the PCM buffer
before actually using for avoiding the information leak from the
previous usages or the usage before a new allocation.  It performs the
memset() with runtime->dma_bytes, but this might still leave some
remaining bytes untouched; namely, the PCM buffer size is aligned in
page size for mmap, hence runtime->dma_bytes doesn't necessarily cover
all PCM buffer pages, and the remaining bytes are exposed via mmap.

This patch changes the memory clearance to cover the all buffer pages
if the stream is supposed to be mmap-ready (that guarantees that the
buffer size is aligned in page size).

Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Link: https://lore.kernel.org/r/20201218145625.2045-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:45:01 +01:00
Jessica Yu
7492543050 module: delay kobject uevent until after module init call
[ Upstream commit 38dc717e97 ]

Apparently there has been a longstanding race between udev/systemd and
the module loader. Currently, the module loader sends a uevent right
after sysfs initialization, but before the module calls its init
function. However, some udev rules expect that the module has
initialized already upon receiving the uevent.

This race has been triggered recently (see link in references) in some
systemd mount unit files. For instance, the configfs module creates the
/sys/kernel/config mount point in its init function, however the module
loader issues the uevent before this happens. sys-kernel-config.mount
expects to be able to mount /sys/kernel/config upon receipt of the
module loading uevent, but if the configfs module has not called its
init function yet, then this directory will not exist and the mount unit
fails. A similar situation exists for sys-fs-fuse-connections.mount, as
the fuse sysfs mount point is created during the fuse module's init
function. If udev is faster than module initialization then the mount
unit would fail in a similar fashion.

To fix this race, delay the module KOBJ_ADD uevent until after the
module has finished calling its init routine.

References: https://github.com/systemd/systemd/issues/17586
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-By: Nicolas Morey-Chaisemartin <nmoreychaisemartin@suse.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:45:01 +01:00
Trond Myklebust
05a0aec678 NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode
[ Upstream commit b6d49ecd10 ]

When returning the layout in nfs4_evict_inode(), we need to ensure that
the layout is actually done being freed before we can proceed to free the
inode itself.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:45:01 +01:00
Qinglang Miao
f2dc273475 powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe()
[ Upstream commit ffa1797040 ]

I noticed that iounmap() of msgr_block_addr before return from
mpic_msgr_probe() in the error handling case is missing. So use
devm_ioremap() instead of just ioremap() when remapping the message
register block, so the mapping will be automatically released on
probe failure.

Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201028091551.136400-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:45:01 +01:00
Jan Kara
75f1bd7955 quota: Don't overflow quota file offsets
[ Upstream commit 10f04d40a9 ]

The on-disk quota format supports quota files with upto 2^32 blocks. Be
careful when computing quota file offsets in the quota files from block
numbers as they can overflow 32-bit types. Since quota files larger than
4GB would require ~26 millions of quota users, this is mostly a
theoretical concern now but better be careful, fuzzers would find the
problem sooner or later anyway...

Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:45:01 +01:00
Miroslav Benes
bea7f4d1ff module: set MODULE_STATE_GOING state when a module fails to load
[ Upstream commit 5e8ed280da ]

If a module fails to load due to an error in prepare_coming_module(),
the following error handling in load_module() runs with
MODULE_STATE_COMING in module's state. Fix it by correctly setting
MODULE_STATE_GOING under "bug_cleanup" label.

Signed-off-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:45:01 +01:00
Dinghao Liu
4cb33d97b0 rtc: sun6i: Fix memleak in sun6i_rtc_clk_init
[ Upstream commit 28d211919e ]

When clk_hw_register_fixed_rate_with_accuracy() fails,
clk_data should be freed. It's the same for the subsequent
two error paths, but we should also unregister the already
registered clocks in them.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201020061226.6572-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:45:01 +01:00
Boqun Feng
8e63266b0d fcntl: Fix potential deadlock in send_sig{io, urg}()
commit 8d1ddb5e79 upstream.

Syzbot reports a potential deadlock found by the newly added recursive
read deadlock detection in lockdep:

[...] ========================================================
[...] WARNING: possible irq lock inversion dependency detected
[...] 5.9.0-rc2-syzkaller #0 Not tainted
[...] --------------------------------------------------------
[...] syz-executor.1/10214 just changed the state of lock:
[...] ffff88811f506338 (&f->f_owner.lock){.+..}-{2:2}, at: send_sigurg+0x1d/0x200
[...] but this lock was taken by another, HARDIRQ-safe lock in the past:
[...]  (&dev->event_lock){-...}-{2:2}
[...]
[...]
[...] and interrupts could create inverse lock ordering between them.
[...]
[...]
[...] other info that might help us debug this:
[...] Chain exists of:
[...]   &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock
[...]
[...]  Possible interrupt unsafe locking scenario:
[...]
[...]        CPU0                    CPU1
[...]        ----                    ----
[...]   lock(&f->f_owner.lock);
[...]                                local_irq_disable();
[...]                                lock(&dev->event_lock);
[...]                                lock(&new->fa_lock);
[...]   <Interrupt>
[...]     lock(&dev->event_lock);
[...]
[...]  *** DEADLOCK ***

The corresponding deadlock case is as followed:

	CPU 0		CPU 1		CPU 2
	read_lock(&fown->lock);
			spin_lock_irqsave(&dev->event_lock, ...)
					write_lock_irq(&filp->f_owner.lock); // wait for the lock
			read_lock(&fown-lock); // have to wait until the writer release
					       // due to the fairness
	<interrupted>
	spin_lock_irqsave(&dev->event_lock); // wait for the lock

The lock dependency on CPU 1 happens if there exists a call sequence:

	input_inject_event():
	  spin_lock_irqsave(&dev->event_lock,...);
	  input_handle_event():
	    input_pass_values():
	      input_to_handler():
	        handler->event(): // evdev_event()
	          evdev_pass_values():
	            spin_lock(&client->buffer_lock);
	            __pass_event():
	              kill_fasync():
	                kill_fasync_rcu():
	                  read_lock(&fa->fa_lock);
	                  send_sigio():
	                    read_lock(&fown->lock);

To fix this, make the reader in send_sigurg() and send_sigio() use
read_lock_irqsave() and read_lock_irqrestore().

Reported-by: syzbot+22e87cdf94021b984aa6@syzkaller.appspotmail.com
Reported-by: syzbot+c5e32344981ad9f33750@syzkaller.appspotmail.com
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:00 +01:00
Takashi Iwai
64b2a977e1 ALSA: rawmidi: Access runtime->avail always in spinlock
commit 88a06d6fd6 upstream.

The runtime->avail field may be accessed concurrently while some
places refer to it without taking the runtime->lock spinlock, as
detected by KCSAN.  Usually this isn't a big problem, but for
consistency and safety, we should take the spinlock at each place
referencing this field.

Reported-by: syzbot+a23a6f1215c84756577c@syzkaller.appspotmail.com
Reported-by: syzbot+3d367d1df1d2b67f5c19@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201206083527.21163-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:00 +01:00
Takashi Iwai
2c8ccc3052 ALSA: seq: Use bool for snd_seq_queue internal flags
commit 4ebd470370 upstream.

The snd_seq_queue struct contains various flags in the bit fields.
Those are categorized to two different use cases, both of which are
protected by different spinlocks.  That implies that there are still
potential risks of the bad operations for bit fields by concurrent
accesses.

For addressing the problem, this patch rearranges those flags to be
a standard bool instead of a bit field.

Reported-by: syzbot+63cbe31877bb80ef58f5@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201206083456.21110-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:00 +01:00
Mauro Carvalho Chehab
fd4f2a5151 media: gp8psk: initialize stats at power control logic
commit d0ac1a26ed upstream.

As reported on:
	https://lore.kernel.org/linux-media/20190627222020.45909-1-willemdebruijn.kernel@gmail.com/

if gp8psk_usb_in_op() returns an error, the status var is not
initialized. Yet, this var is used later on, in order to
identify:
	- if the device was already started;
	- if firmware has loaded;
	- if the LNBf was powered on.

Using status = 0 seems to ensure that everything will be
properly powered up.

So, instead of the proposed solution, let's just set
status = 0.

Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:00 +01:00
Anant Thazhemadam
074b61ff21 misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells()
commit 31dcb6c30a upstream.

A kernel-infoleak was reported by syzbot, which was caused because
dbells was left uninitialized.
Using kzalloc() instead of kmalloc() fixes this issue.

Reported-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
Tested-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201122224534.333471-1-anant.thazhemadam@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:00 +01:00
Rustam Kovhaev
b8590c82b3 reiserfs: add check for an invalid ih_entry_count
commit d24396c529 upstream.

when directory item has an invalid value set for ih_entry_count it might
trigger use-after-free or out-of-bounds read in bin_search_in_dir_item()

ih_entry_count * IH_SIZE for directory item should not be larger than
ih_item_len

Link: https://lore.kernel.org/r/20201101140958.3650143-1-rkovhaev@gmail.com
Reported-and-tested-by: syzbot+83b6f7cf9922cae5c4d7@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=83b6f7cf9922cae5c4d7
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:00 +01:00
Anant Thazhemadam
88520a2071 Bluetooth: hci_h5: close serdev device and free hu in h5_close
commit 70f259a3f4 upstream.

When h5_close() gets called, the memory allocated for the hu gets
freed only if hu->serdev doesn't exist. This leads to a memory leak.
So when h5_close() is requested, close the serdev device instance and
free the memory allocated to the hu entirely instead.

Fixes: https://syzkaller.appspot.com/bug?extid=6ce141c55b2f7aafd1c4
Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:00 +01:00
Johan Hovold
2f6668bfe3 of: fix linker-section match-table corruption
commit 5812b32e01 upstream.

Specify type alignment when declaring linker-section match-table entries
to prevent gcc from increasing alignment and corrupting the various
tables with padding (e.g. timers, irqchips, clocks, reserved memory).

This is specifically needed on x86 where gcc (typically) aligns larger
objects like struct of_device_id with static extent on 32-byte
boundaries which at best prevents matching on anything but the first
entry. Specifying alignment when declaring variables suppresses this
optimisation.

Here's a 64-bit example where all entries are corrupt as 16 bytes of
padding has been inserted before the first entry:

	ffffffff8266b4b0 D __clk_of_table
	ffffffff8266b4c0 d __of_table_fixed_factor_clk
	ffffffff8266b5a0 d __of_table_fixed_clk
	ffffffff8266b680 d __clk_of_table_sentinel

And here's a 32-bit example where the 8-byte-aligned table happens to be
placed on a 32-byte boundary so that all but the first entry are corrupt
due to the 28 bytes of padding inserted between entries:

	812b3ec0 D __irqchip_of_table
	812b3ec0 d __of_table_irqchip1
	812b3fa0 d __of_table_irqchip2
	812b4080 d __of_table_irqchip3
	812b4160 d irqchip_of_match_end

Verified on x86 using gcc-9.3 and gcc-4.9 (which uses 64-byte
alignment), and on arm using gcc-7.2.

Note that there are no in-tree users of these tables on x86 currently
(even if they are included in the image).

Fixes: 54196ccbe0 ("of: consolidate linker section OF match table declarations")
Fixes: f6e916b820 ("irqchip: add basic infrastructure")
Cc: stable <stable@vger.kernel.org>     # 3.9
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20201123102319.8090-2-johan@kernel.org
[ johan: adjust context to 5.4 ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:45:00 +01:00
Damien Le Moal
1344c5564d null_blk: Fix zone size initialization
commit 0ebcdd702f upstream.

For a null_blk device with zoned mode enabled is currently initialized
with a number of zones equal to the device capacity divided by the zone
size, without considering if the device capacity is a multiple of the
zone size. If the zone size is not a divisor of the capacity, the zones
end up not covering the entire capacity, potentially resulting is out
of bounds accesses to the zone array.

Fix this by adding one last smaller zone with a size equal to the
remainder of the disk capacity divided by the zone size if the capacity
is not a multiple of the zone size. For such smaller last zone, the zone
capacity is also checked so that it does not exceed the smaller zone
size.

Reported-by: Naohiro Aota <naohiro.aota@wdc.com>
Fixes: ca4b2a0119 ("null_blk: add zone support")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:44:59 +01:00
Souptick Joarder
e622fafb4a xen/gntdev.c: Mark pages as dirty
commit 779055842d upstream.

There seems to be a bug in the original code when gntdev_get_page()
is called with writeable=true then the page needs to be marked dirty
before being put.

To address this, a bool writeable is added in gnt_dev_copy_batch, set
it in gntdev_grant_copy_seg() (and drop `writeable` argument to
gntdev_get_page()) and then, based on batch->writeable, use
set_page_dirty_lock().

Fixes: a4cdb556ca (xen/gntdev: add ioctl for grant copy)
Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1599375114-32360-1-git-send-email-jrdr.linux@gmail.com
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
[jinoh: backport accounting for missing
  commit 73b0140bf0 ("mm/gup: change GUP fast to use flags rather than a write 'bool'")]
Signed-off-by: Jinoh Kang <jinoh.kang.kr@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:44:59 +01:00
Christophe Leroy
663fdcecce powerpc/bitops: Fix possible undefined behaviour with fls() and fls64()
[ Upstream commit 1891ef21d9 ]

fls() and fls64() are using __builtin_ctz() and _builtin_ctzll().
On powerpc, those builtins trivially use ctlzw and ctlzd power
instructions.

Allthough those instructions provide the expected result with
input argument 0, __builtin_ctz() and __builtin_ctzll() are
documented as undefined for value 0.

The easiest fix would be to use fls() and fls64() functions
defined in include/asm-generic/bitops/builtin-fls.h and
include/asm-generic/bitops/fls64.h, but GCC output is not optimal:

00000388 <testfls>:
 388:   2c 03 00 00     cmpwi   r3,0
 38c:   41 82 00 10     beq     39c <testfls+0x14>
 390:   7c 63 00 34     cntlzw  r3,r3
 394:   20 63 00 20     subfic  r3,r3,32
 398:   4e 80 00 20     blr
 39c:   38 60 00 00     li      r3,0
 3a0:   4e 80 00 20     blr

000003b0 <testfls64>:
 3b0:   2c 03 00 00     cmpwi   r3,0
 3b4:   40 82 00 1c     bne     3d0 <testfls64+0x20>
 3b8:   2f 84 00 00     cmpwi   cr7,r4,0
 3bc:   38 60 00 00     li      r3,0
 3c0:   4d 9e 00 20     beqlr   cr7
 3c4:   7c 83 00 34     cntlzw  r3,r4
 3c8:   20 63 00 20     subfic  r3,r3,32
 3cc:   4e 80 00 20     blr
 3d0:   7c 63 00 34     cntlzw  r3,r3
 3d4:   20 63 00 40     subfic  r3,r3,64
 3d8:   4e 80 00 20     blr

When the input of fls(x) is a constant, just check x for nullity and
return either 0 or __builtin_clz(x). Otherwise, use cntlzw instruction
directly.

For fls64() on PPC64, do the same but with __builtin_clzll() and
cntlzd instruction. On PPC32, lets take the generic fls64() which
will use our fls(). The result is as expected:

00000388 <testfls>:
 388:   7c 63 00 34     cntlzw  r3,r3
 38c:   20 63 00 20     subfic  r3,r3,32
 390:   4e 80 00 20     blr

000003a0 <testfls64>:
 3a0:   2c 03 00 00     cmpwi   r3,0
 3a4:   40 82 00 10     bne     3b4 <testfls64+0x14>
 3a8:   7c 83 00 34     cntlzw  r3,r4
 3ac:   20 63 00 20     subfic  r3,r3,32
 3b0:   4e 80 00 20     blr
 3b4:   7c 63 00 34     cntlzw  r3,r3
 3b8:   20 63 00 40     subfic  r3,r3,64
 3bc:   4e 80 00 20     blr

Fixes: 2fcff790dc ("powerpc: Use builtin functions for fls()/__fls()/fls64()")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/348c2d3f19ffcff8abe50d52513f989c4581d000.1603375524.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:44:59 +01:00
Paolo Bonzini
a37ec98270 KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits
[ Upstream commit 39485ed95d ]

Until commit e7c587da12 ("x86/speculation: Use synthetic bits for
IBRS/IBPB/STIBP"), KVM was testing both Intel and AMD CPUID bits before
allowing the guest to write MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD.
Testing only Intel bits on VMX processors, or only AMD bits on SVM
processors, fails if the guests are created with the "opposite" vendor
as the host.

While at it, also tweak the host CPU check to use the vendor-agnostic
feature bit X86_FEATURE_IBPB, since we only care about the availability
of the MSR on the host here and not about specific CPUID bits.

Fixes: e7c587da12 ("x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP")
Cc: stable@vger.kernel.org
Reported-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:44:59 +01:00
Paolo Bonzini
88464279c0 KVM: SVM: relax conditions for allowing MSR_IA32_SPEC_CTRL accesses
[ Upstream commit df7e881892 ]

Userspace that does not know about the AMD_IBRS bit might still
allow the guest to protect itself with MSR_IA32_SPEC_CTRL using
the Intel SPEC_CTRL bit.  However, svm.c disallows this and will
cause a #GP in the guest when writing to the MSR.  Fix this by
loosening the test and allowing the Intel CPUID bit, and in fact
allow the AMD_STIBP bit as well since it allows writing to
MSR_IA32_SPEC_CTRL too.

Reported-by: Zhiyi Guo <zhguo@redhat.com>
Analyzed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Analyzed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:44:59 +01:00
Petr Vorel
c1f49fb159 uapi: move constants from <linux/kernel.h> to <linux/const.h>
commit a85cbe6159 upstream.

and include <linux/const.h> in UAPI headers instead of <linux/kernel.h>.

The reason is to avoid indirect <linux/sysinfo.h> include when using
some network headers: <linux/netlink.h> or others -> <linux/kernel.h>
-> <linux/sysinfo.h>.

This indirect include causes on MUSL redefinition of struct sysinfo when
included both <sys/sysinfo.h> and some of UAPI headers:

    In file included from x86_64-buildroot-linux-musl/sysroot/usr/include/linux/kernel.h:5,
                     from x86_64-buildroot-linux-musl/sysroot/usr/include/linux/netlink.h:5,
                     from ../include/tst_netlink.h:14,
                     from tst_crypto.c:13:
    x86_64-buildroot-linux-musl/sysroot/usr/include/linux/sysinfo.h:8:8: error: redefinition of `struct sysinfo'
     struct sysinfo {
            ^~~~~~~
    In file included from ../include/tst_safe_macros.h:15,
                     from ../include/tst_test.h:93,
                     from tst_crypto.c:11:
    x86_64-buildroot-linux-musl/sysroot/usr/include/sys/sysinfo.h:10:8: note: originally defined here

Link: https://lkml.kernel.org/r/20201015190013.8901-1-petr.vorel@gmail.com
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Suggested-by: Rich Felker <dalias@aerifal.cx>
Acked-by: Rich Felker <dalias@libc.org>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Baruch Siach <baruch@tkos.co.il>
Cc: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-06 14:44:59 +01:00