1. 24 Jul, 2020 7 commits
    • Evgeny Novikov's avatar
      usb: gadget: net2272: skip BAR1 on error handling paths in probe · ae90cc82
      Evgeny Novikov authored
      net2272_rdk1_probe() skips "i == 1" (BAR1) during allocation of
      resources. The patch does this on error hanling paths as well.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarEvgeny Novikov <novikov@ispras.ru>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      ae90cc82
    • Chunfeng Yun's avatar
      usb: gadget: bdc: use readl_poll_timeout() to simplify code · 75ae051e
      Chunfeng Yun authored
      Use readl_poll_timeout() to poll register status
      
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarStephen Boyd <swboyd@chromium.org>
      Signed-off-by: default avatarChunfeng Yun <chunfeng.yun@mediatek.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      75ae051e
    • Marek Szyprowski's avatar
      usb: dwc2: Fix error path in gadget registration · 33a06f13
      Marek Szyprowski authored
      When gadget registration fails, one should not call usb_del_gadget_udc().
      Ensure this by setting gadget->udc to NULL. Also in case of a failure
      there is no need to disable low-level hardware, so return immiedetly
      instead of jumping to error_init label.
      
      This fixes the following kernel NULL ptr dereference on gadget failure
      (can be easily triggered with g_mass_storage without any module
      parameters):
      
      dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1
      dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024
      dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM
      Mass Storage Function, version: 2009/09/11
      LUN: removable file: (no medium)
      no file given for LUN0
      g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22
      8<--- cut here ---
      Unable to handle kernel NULL pointer dereference at virtual address 00000104
      pgd = (ptrval)
      [00000104] *pgd=00000000
      Internal error: Oops: 805 [#1] PREEMPT SMP ARM
      Modules linked in:
      CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.8.0-rc5 #3133
      Hardware name: Samsung Exynos (Flattened Device Tree)
      Workqueue: events deferred_probe_work_func
      PC is at usb_del_gadget_udc+0x38/0xc4
      LR is at __mutex_lock+0x31c/0xb18
      ...
      Process kworker/0:1 (pid: 12, stack limit = 0x(ptrval))
      Stack: (0xef121db0 to 0xef122000)
      ...
      [<c076bf3c>] (usb_del_gadget_udc) from [<c0726bec>] (dwc2_hsotg_remove+0x10/0x20)
      [<c0726bec>] (dwc2_hsotg_remove) from [<c0711208>] (dwc2_driver_probe+0x57c/0x69c)
      [<c0711208>] (dwc2_driver_probe) from [<c06247c0>] (platform_drv_probe+0x6c/0xa4)
      [<c06247c0>] (platform_drv_probe) from [<c0621df4>] (really_probe+0x200/0x48c)
      [<c0621df4>] (really_probe) from [<c06221e8>] (driver_probe_device+0x78/0x1fc)
      [<c06221e8>] (driver_probe_device) from [<c061fcd4>] (bus_for_each_drv+0x74/0xb8)
      [<c061fcd4>] (bus_for_each_drv) from [<c0621b54>] (__device_attach+0xd4/0x16c)
      [<c0621b54>] (__device_attach) from [<c0620c98>] (bus_probe_device+0x88/0x90)
      [<c0620c98>] (bus_probe_device) from [<c06211b0>] (deferred_probe_work_func+0x3c/0xd0)
      [<c06211b0>] (deferred_probe_work_func) from [<c0149280>] (process_one_work+0x234/0x7dc)
      [<c0149280>] (process_one_work) from [<c014986c>] (worker_thread+0x44/0x51c)
      [<c014986c>] (worker_thread) from [<c0150b1c>] (kthread+0x158/0x1a0)
      [<c0150b1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
      Exception stack(0xef121fb0 to 0xef121ff8)
      ...
      ---[ end trace 9724c2fc7cc9c982 ]---
      
      While fixing this also fix the double call to dwc2_lowlevel_hw_disable()
      if dr_mode is set to USB_DR_MODE_PERIPHERAL. In such case low-level
      hardware is already disabled before calling usb_add_gadget_udc(). That
      function correctly preserves low-level hardware state, there is no need
      for the second unconditional dwc2_lowlevel_hw_disable() call.
      
      Fixes: 207324a3 ("usb: dwc2: Postponed gadget registration to the udc class driver")
      Acked-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      33a06f13
    • Michał Mirosław's avatar
      usb: gadget: udc: atmel: implement .pullup callback · abac8a85
      Michał Mirosław authored
      Implement udc->pullup callback, so that udc_connect/disconnect work.
      This is needed for composite gadget, as it assumes udc_disconnect()
      actually works and calls its ->disconnect callback.
      Acked-by: default avatarCristian Birsan <cristian.birsan@microchip.com>
      Acked-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
      Signed-off-by: default avatarMichał Mirosław <mirq-linux@rere.qmqm.pl>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      abac8a85
    • Marek Szyprowski's avatar
      usb: gadget: udc: Flush pending work also in error path · 37d9453b
      Marek Szyprowski authored
      When binding an UDC driver to the pending gadget fails in
      check_pending_gadget_drivers(), the usb_add_gadget_udc_release() function
      ends without waiting for the usb_gadget_state_work to finish, what in
      turn might cause the whole struct usb_gadget being freed by the caller
      before the usb_gadget_state_work being executed.
      
      This can be observed on some boards with USB Mass Storage gadget
      compiled-in and kernel booted without the needed module parameters:
      
      dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1
      dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024
      dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM
      Mass Storage Function, version: 2009/09/11
      LUN: removable file: (no medium)
      no file given for LUN0
      g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22
      dwc2: probe of 12480000.hsotg failed with error -22
      8<--- cut here ---
      Unable to handle kernel NULL pointer dereference at virtual address 00000004
      pgd = (ptrval)
      [00000004] *pgd=00000000
      Internal error: Oops: 5 [#1] PREEMPT SMP ARM
      Modules linked in:
      CPU: 1 PID: 88 Comm: kworker/1:2 Not tainted 5.8.0-rc5-next-20200715-00062-gc5bb489ae825-dirty #8792
      Hardware name: Samsung Exynos (Flattened Device Tree)
      Workqueue:  0x0 (rcu_gp)
      PC is at process_one_work+0x44/0x7dc
      ...
      Process kworker/1:2 (pid: 88, stack limit = 0x(ptrval))
      Stack: (0xed9f1f00 to 0xed9f2000)
      ...
      [<c0148590>] (process_one_work) from [<c0148d6c>] (worker_thread+0x44/0x51c)
      [<c0148d6c>] (worker_thread) from [<c01500c0>] (kthread+0x158/0x1a0)
      [<c01500c0>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
      Exception stack(0xed9f1fb0 to 0xed9f1ff8)
      ...
      ---[ end trace 5033c1326a62e5f3 ]---
      note: kworker/1:2[88] exited with preempt_count 1
      
      Fix this by flushing pending work in error path.
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      37d9453b
    • Peter Chen's avatar
      usb: cdns3: gadget: improve the set_configuration handling · f4cfe5ce
      Peter Chen authored
      - Delete the duplicated EP_CMD_ERDY and EP_CMD_REQ_CMPL setting
      - Prepare the next setup before setting EP_CMD_ERDY and EP_CMD_REQ_CMPL,
      it could avoid a bug that DMA hang at EP0 OUT for DEV_VER_NXP_V1
      - Delete the duplicated cdns3_set_hw_configuration calling at
      cdns3_req_ep0_set_configuration, the composite.c will handle
      this request, and call .ep0_queue back, and at .ep_queue it will
      call cdns3_set_hw_configuration.
      - Move cdns3_allow_enable_l1 into cdns3_set_hw_configuration since
      it is part of this function.
      Signed-off-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      f4cfe5ce
    • Dan Robertson's avatar
      usb: dwc3: meson-g12a: fix shared reset control use · 7a410953
      Dan Robertson authored
      The reset is a shared reset line, but reset_control_reset is still used
      and reset_control_deassert is not guaranteed to have been called before
      the first reset_control_assert call. When suspending the following
      warning may be seen:
      
      WARNING: CPU: 1 PID: 5530 at drivers/reset/core.c:355 reset_control_assert+0x184/0x19c
      Hardware name: Hardkernel ODROID-N2 (DT)
      [..]
      pc : reset_control_assert+0x184/0x19c
      lr : dwc3_meson_g12a_suspend+0x68/0x7c
      [..]
      Call trace:
       reset_control_assert+0x184/0x19c
       dwc3_meson_g12a_suspend+0x68/0x7c
       platform_pm_suspend+0x28/0x54
       __device_suspend+0x590/0xabc
       dpm_suspend+0x104/0x404
       dpm_suspend_start+0x84/0x1bc
       suspend_devices_and_enter+0xc4/0x4fc
       pm_suspend+0x198/0x2d4
      
      Fixes: 6d9fa35a ("usb: dwc3: meson-g12a: get the reset as shared")
      Signed-off-by: default avatarDan Robertson <dan@dlrobertson.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      7a410953
  2. 23 Jul, 2020 2 commits
  3. 22 Jul, 2020 1 commit
  4. 21 Jul, 2020 14 commits
  5. 20 Jul, 2020 1 commit
  6. 19 Jul, 2020 10 commits
    • Linus Torvalds's avatar
      Linux 5.8-rc6 · ba47d845
      Linus Torvalds authored
      ba47d845
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-2020-07-19' of... · 92188b41
      Linus Torvalds authored
      Merge tag 'perf-tools-fixes-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into master
      
      Pull perf tooling fixes from Arnaldo Carvalho de Melo:
      
       - Update hashmap.h from libbpf and kvm.h from x86's kernel UAPI.
      
       - Set opt->set in libsubcmd's OPT_CALLBACK_SET(). This fixes
         'perf record --switch-output-event event-name' usage"
      
      * tag 'perf-tools-fixes-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        tools arch kvm: Sync kvm headers with the kernel sources
        perf tools: Sync hashmap.h with libbpf's
        libsubcmd: Fix OPT_CALLBACK_SET()
      92188b41
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2020-07-19' of... · efb9666e
      Linus Torvalds authored
      Merge tag 'x86-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull x86 fixes from Thomas Gleixner:
       "A pile of fixes for x86:
      
         - Fix the I/O bitmap invalidation on XEN PV, which was overlooked in
           the recent ioperm/iopl rework. This caused the TSS and XEN's I/O
           bitmap to get out of sync.
      
         - Use the proper vectors for HYPERV.
      
         - Make disabling of stack protector for the entry code work with GCC
           builds which enable stack protector by default. Removing the option
           is not sufficient, it needs an explicit -fno-stack-protector to
           shut it off.
      
         - Mark check_user_regs() noinstr as it is called from noinstr code.
           The missing annotation causes it to be placed in the text section
           which makes it instrumentable.
      
         - Add the missing interrupt disable in exc_alignment_check()
      
         - Fixup a XEN_PV build dependency in the 32bit entry code
      
         - A few fixes to make the Clang integrated assembler happy
      
         - Move EFI stub build to the right place for out of tree builds
      
         - Make prepare_exit_to_usermode() static. It's not longer called from
           ASM code"
      
      * tag 'x86-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/boot: Don't add the EFI stub to targets
        x86/entry: Actually disable stack protector
        x86/ioperm: Fix io bitmap invalidation on Xen PV
        x86: math-emu: Fix up 'cmp' insn for clang ias
        x86/entry: Fix vectors to IDTENTRY_SYSVEC for CONFIG_HYPERV
        x86/entry: Add compatibility with IAS
        x86/entry/common: Make prepare_exit_to_usermode() static
        x86/entry: Mark check_user_regs() noinstr
        x86/traps: Disable interrupts in exc_aligment_check()
        x86/entry/32: Fix XEN_PV build dependency
      efb9666e
    • Linus Torvalds's avatar
      Merge tag 'timers-urgent-2020-07-19' of... · 66e4b636
      Linus Torvalds authored
      Merge tag 'timers-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull timer fixes from Thomas Gleixner:
       "Two fixes for the timer wheel:
      
         - A timer which is already expired at enqueue time can set the
           base->next_expiry value backwards. As a consequence base->clk can
           be set back as well. This can lead to timers expiring early. Add a
           sanity check to prevent this.
      
         - When a timer is queued with an expiry time beyond the wheel
           capacity then it should be queued in the bucket of the last wheel
           level which is expiring last.
      
           The code adjusted the expiry time to the maximum wheel capacity,
           which is only correct when the wheel clock is 0. Aside of that the
           check whether the delta is larger than wheel capacity does not
           check the delta, it checks the expiry value itself. As a result
           timers can expire at random.
      
           Fix this by checking the right variable and adjust expiry time so
           it becomes base->clock plus capacity which places it into the
           outmost bucket in the last wheel level"
      
      * tag 'timers-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        timer: Fix wheel index calculation on last level
        timer: Prevent base->clk from moving backward
      66e4b636
    • Linus Torvalds's avatar
      Merge tag 'sched-urgent-2020-07-19' of... · 43768f7c
      Linus Torvalds authored
      Merge tag 'sched-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull scheduler fixes from Thomas Gleixner:
       "A set of scheduler fixes:
      
         - Plug a load average accounting race which was introduced with a
           recent optimization casing load average to show bogus numbers.
      
         - Fix the rseq CPU id initialization for new tasks. sched_fork() does
           not update the rseq CPU id so the id is the stale id of the parent
           task, which can cause user space data corruption.
      
         - Handle a 0 return value of task_h_load() correctly in the load
           balancer, which does not decrease imbalance and therefore pulls
           until the maximum number of loops is reached, which might be all
           tasks just created by a fork bomb"
      
      * tag 'sched-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/fair: handle case of task_h_load() returning 0
        sched: Fix unreliable rseq cpu_id for new tasks
        sched: Fix loadavg accounting race
      43768f7c
    • Linus Torvalds's avatar
      Merge tag 'irq-urgent-2020-07-19' of... · 9413cd77
      Linus Torvalds authored
      Merge tag 'irq-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull irq fixes from Thomas Gleixner:
       "Two fixes for the interrupt subsystem:
      
         - Make the handling of the firmware node consistent and do not free
           the node after the domain has been created successfully. The core
           code stores a pointer to it which can lead to a use after free or
           double free.
      
           This used to "work" because the pointer was not stored when the
           initial code was written, but at some point later it was required
           to store it. Of course nobody noticed that the existing users break
           that way.
      
         - Handle affinity setting on inactive interrupts correctly when
           hierarchical irq domains are enabled.
      
           When interrupts are inactive with the modern hierarchical irqdomain
           design, the interrupt chips are not necessarily in a state where
           affinity changes can be handled. The legacy irq chip design allowed
           this because interrupts are immediately fully initialized at
           allocation time. X86 has a hacky workaround for this, but other
           implementations do not.
      
           This cased malfunction on GIC-V3. Instead of playing whack a mole
           to find all affected drivers, change the core code to store the
           requested affinity setting and then establish it when the interrupt
           is allocated, which makes the X86 hack go away"
      
      * tag 'irq-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        genirq/affinity: Handle affinity setting on inactive interrupts correctly
        irqdomain/treewide: Keep firmware node unconditionally allocated
      9413cd77
    • Linus Torvalds's avatar
      Merge tag 'usb-5.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb into master · ce20d7bf
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a few small USB fixes, and one thunderbolt fix, for 5.8-rc6.
      
        Nothing huge in here, just the normal collection of gadget, dwc2/3,
        serial, and other minor USB driver fixes and id additions. Full
        details are in the shortlog.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'usb-5.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        USB: serial: iuu_phoenix: fix memory corruption
        USB: c67x00: fix use after free in c67x00_giveback_urb
        usb: gadget: function: fix missing spinlock in f_uac1_legacy
        usb: gadget: udc: atmel: fix uninitialized read in debug printk
        usb: gadget: udc: atmel: remove outdated comment in usba_ep_disable()
        usb: dwc2: Fix shutdown callback in platform
        usb: cdns3: trace: fix some endian issues
        usb: cdns3: ep0: fix some endian issues
        usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
        usb: gadget: fix langid kernel-doc warning in usbstring.c
        usb: dwc3: pci: add support for the Intel Jasper Lake
        usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H variant
        usb: chipidea: core: add wakeup support for extcon
        USB: serial: option: add Quectel EG95 LTE modem
        thunderbolt: Fix path indices used in USB3 tunnel discovery
        USB: serial: ch341: add new Product ID for CH340
        USB: serial: option: add GosunCn GM500 series
        USB: serial: cypress_m8: enable Simply Automated UPB PIM
      ce20d7bf
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-5.8-6' of git://git.infradead.org/users/hch/dma-mapping into master · 8c18fc63
      Linus Torvalds authored
      Pull dma-mapping fixes from Christoph Hellwig:
       "Ensure we always have fully addressable memory in the dma coherent
        pool (Nicolas Saenz Julienne)"
      
      * tag 'dma-mapping-5.8-6' of git://git.infradead.org/users/hch/dma-mapping:
        dma-pool: do not allocate pool memory from CMA
        dma-pool: make sure atomic pool suits device
        dma-pool: introduce dma_guess_pool()
        dma-pool: get rid of dma_in_atomic_pool()
        dma-direct: provide function to check physical memory area validity
      8c18fc63
    • Arvind Sankar's avatar
      x86/boot: Don't add the EFI stub to targets · da05b143
      Arvind Sankar authored
      vmlinux-objs-y is added to targets, which currently means that the EFI
      stub gets added to the targets as well. It shouldn't be added since it
      is built elsewhere.
      
      This confuses Makefile.build which interprets the EFI stub as a target
      	$(obj)/$(objtree)/drivers/firmware/efi/libstub/lib.a
      and will create drivers/firmware/efi/libstub/ underneath
      arch/x86/boot/compressed, to hold this supposed target, if building
      out-of-tree. [0]
      
      Fix this by pulling the stub out of vmlinux-objs-y into efi-obj-y.
      
      [0] See scripts/Makefile.build near the end:
          # Create directories for object files if they do not exist
      Signed-off-by: default avatarArvind Sankar <nivedita@alum.mit.edu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      Acked-by: default avatarArd Biesheuvel <ardb@kernel.org>
      Link: https://lkml.kernel.org/r/20200715032631.1562882-1-nivedita@alum.mit.edu
      da05b143
    • Kees Cook's avatar
      x86/entry: Actually disable stack protector · 58ac3154
      Kees Cook authored
      Some builds of GCC enable stack protector by default. Simply removing
      the arguments is not sufficient to disable stack protector, as the stack
      protector for those GCC builds must be explicitly disabled. Remove the
      argument removals and add -fno-stack-protector. Additionally include
      missed x32 argument updates, and adjust whitespace for readability.
      
      Fixes: 20355e5f ("x86/entry: Exclude low level entry code from sanitizing")
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Link: https://lkml.kernel.org/r/202006261333.585319CA6B@keescook
      58ac3154
  7. 18 Jul, 2020 5 commits