Commit graph

932,869 commits

Author SHA1 Message Date
Colin Ian King
b9574ce1d0 iwlegacy: fix spelling mistake "acumulative" -> "accumulative"
Fix spelling mistakes in rx stats text. I missed these from an earlier
round of fixing the same spelling mistake.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:54:36 +03:00
Tamás Szűcs
938c7c80c7 mwifiex: add support for SD8987 chipset
This patch adds support for Marvell 88W8987 chipset with SDIO interface.
Register offsets and supported feature flags are updated. The corresponding
firmware image file shall be "mrvl/sd8987_uapsta.bin".

Signed-off-by: Tamás Szűcs <tszucs@protonmail.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:53:13 +03:00
Petr Štetiar
6b583201fa mwl8k: Fix rate_idx underflow
It was reported on OpenWrt bug tracking system[1], that several users
are affected by the endless reboot of their routers if they configure
5GHz interface with channel 44 or 48.

The reboot loop is caused by the following excessive number of WARN_ON
messages:

 WARNING: CPU: 0 PID: 0 at backports-4.19.23-1/net/mac80211/rx.c:4516
                             ieee80211_rx_napi+0x1fc/0xa54 [mac80211]

as the messages are being correctly emitted by the following guard:

 case RX_ENC_LEGACY:
      if (WARN_ON(status->rate_idx >= sband->n_bitrates))

as the rate_idx is in this case erroneously set to 251 (0xfb). This fix
simply converts previously used magic number to proper constant and
guards against substraction which is leading to the currently observed
underflow.

1. https://bugs.openwrt.org/index.php?do=details&task_id=2218

Fixes: 854783444b ("mwl8k: properly set receive status rate index on 5 GHz receive")
Cc: <stable@vger.kernel.org>
Tested-by: Eubert Bao <bunnier@gmail.com>
Reported-by: Eubert Bao <bunnier@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:52:45 +03:00
YueHaibing
09ac2694b0 at76c50x-usb: Don't register led_trigger if usb_register_driver failed
Syzkaller report this:

[ 1213.468581] BUG: unable to handle kernel paging request at fffffbfff83bf338
[ 1213.469530] #PF error: [normal kernel read fault]
[ 1213.469530] PGD 237fe4067 P4D 237fe4067 PUD 237e60067 PMD 1c868b067 PTE 0
[ 1213.473514] Oops: 0000 [#1] SMP KASAN PTI
[ 1213.473514] CPU: 0 PID: 6321 Comm: syz-executor.0 Tainted: G         C        5.1.0-rc3+ #8
[ 1213.473514] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 1213.473514] RIP: 0010:strcmp+0x31/0xa0
[ 1213.473514] Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d
[ 1213.473514] RSP: 0018:ffff8881f2b7f950 EFLAGS: 00010246
[ 1213.473514] RAX: 1ffffffff83bf338 RBX: ffff8881ea6f7240 RCX: ffffffff825350c6
[ 1213.473514] RDX: 0000000000000000 RSI: ffffffffc1ee19c0 RDI: ffffffffc1df99c0
[ 1213.473514] RBP: ffffffffc1df99c1 R08: 0000000000000001 R09: 0000000000000004
[ 1213.473514] R10: 0000000000000000 R11: ffff8881de353f00 R12: ffff8881ee727900
[ 1213.473514] R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffffc1eeaaf0
[ 1213.473514] FS:  00007fa66fa01700(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000
[ 1213.473514] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1213.473514] CR2: fffffbfff83bf338 CR3: 00000001ebb9e005 CR4: 00000000007606f0
[ 1213.473514] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1213.473514] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1213.473514] PKRU: 55555554
[ 1213.473514] Call Trace:
[ 1213.473514]  led_trigger_register+0x112/0x3f0
[ 1213.473514]  led_trigger_register_simple+0x7a/0x110
[ 1213.473514]  ? 0xffffffffc1c10000
[ 1213.473514]  at76_mod_init+0x77/0x1000 [at76c50x_usb]
[ 1213.473514]  do_one_initcall+0xbc/0x47d
[ 1213.473514]  ? perf_trace_initcall_level+0x3a0/0x3a0
[ 1213.473514]  ? kasan_unpoison_shadow+0x30/0x40
[ 1213.473514]  ? kasan_unpoison_shadow+0x30/0x40
[ 1213.473514]  do_init_module+0x1b5/0x547
[ 1213.473514]  load_module+0x6405/0x8c10
[ 1213.473514]  ? module_frob_arch_sections+0x20/0x20
[ 1213.473514]  ? kernel_read_file+0x1e6/0x5d0
[ 1213.473514]  ? find_held_lock+0x32/0x1c0
[ 1213.473514]  ? cap_capable+0x1ae/0x210
[ 1213.473514]  ? __do_sys_finit_module+0x162/0x190
[ 1213.473514]  __do_sys_finit_module+0x162/0x190
[ 1213.473514]  ? __ia32_sys_init_module+0xa0/0xa0
[ 1213.473514]  ? __mutex_unlock_slowpath+0xdc/0x690
[ 1213.473514]  ? wait_for_completion+0x370/0x370
[ 1213.473514]  ? vfs_write+0x204/0x4a0
[ 1213.473514]  ? do_syscall_64+0x18/0x450
[ 1213.473514]  do_syscall_64+0x9f/0x450
[ 1213.473514]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1213.473514] RIP: 0033:0x462e99
[ 1213.473514] Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1213.473514] RSP: 002b:00007fa66fa00c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 1213.473514] RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
[ 1213.473514] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003
[ 1213.473514] RBP: 00007fa66fa00c70 R08: 0000000000000000 R09: 0000000000000000
[ 1213.473514] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa66fa016bc
[ 1213.473514] R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004

If usb_register failed, no need to call led_trigger_register_simple.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 1264b95146 ("at76c50x-usb: add driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:52:14 +03:00
Alexey Khoroshilov
d1717282af mwl8k: fix error handling in mwl8k_post_cmd()
If pci_map_single() fails in mwl8k_post_cmd(),
it returns -ENOMEM immediately, while cleanup is required.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:51:46 +03:00
Larry Finger
b25105e126 b43: Remove empty function lpphy_papd_cal()
In commit d825db346270e ("b43: shut up clang -Wuninitialized variable
warning"), the message noted that function lpphy_papd_cal() was empty
and had an old TODO regarding its implementation. As the reverse
engineering project that created the LP-PHY version of this driver
has not been active for some time, it is safe to remove this empty
function.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:51:16 +03:00
Dan Carpenter
b4c35c1722 mwifiex: prevent an array overflow
The "rate_index" is only used as an index into the phist_data->rx_rate[]
array in the mwifiex_hist_data_set() function.  That array has
MWIFIEX_MAX_AC_RX_RATES (74) elements and it's used to generate some
debugfs information.  The "rate_index" variable comes from the network
skb->data[] and it is a u8 so it's in the 0-255 range.  We need to cap
it to prevent an array overflow.

Fixes: cbf6e05527 ("mwifiex: add rx histogram statistics support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:50:21 +03:00
Gustavo A. R. Silva
0c7beb2db9 zd1211rw: use struct_size() helper
Make use of the struct_size() helper instead of an open-coded version
in order to avoid any potential type mistakes, in particular in the
context in which this code is being used.

So, replace code of the following form:

sizeof(struct usb_req_write_regs) + count * sizeof(struct reg_data)

with:

struct_size(req, reg_writes, count)

This code was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:49:50 +03:00
Gustavo A. R. Silva
ae187ba915 mwifiex: use struct_size() in kzalloc()
One of the more common cases of allocation size calculations is finding
the size of a structure that has a zero-sized array at the end, along
with memory for some number of elements for that array. For example:

struct foo {
    int stuff;
    struct boo entry[];
};

size = sizeof(struct foo) + count * sizeof(struct boo);
instance = kzalloc(size, GFP_KERNEL)

Instead of leaving these open-coded and prone to type mistakes, we can
now use the new struct_size() helper:

instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL)

Notice that, in this case, variable regd_size is not necessary,
hence it is removed.

This code was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:45:14 +03:00
Siva Rebbagondla
0a60014b76 rsi: miscallaneous changes for 9116 and common
Below changes are done:
* Device 80MHz clock should be disabled for 9116 in 20MHz band.
* Default edca parameters should be used initially before
  connection.
* Default TA aggregation is 3 for 9116.
* Bootup parameters should be loaded first when channel is
  changed.
* 4 byte register writes are possible for 9116.

Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:44:29 +03:00
Siva Rebbagondla
17ff2c794f rsi: reset device changes for 9116
Device reset register(watchdog timer related) addresses and
values are different for 9116.

Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:44:29 +03:00
Siva Rebbagondla
1533f976c6 rsi: send new tx command frame wlan9116 features
For 9116 device, we have introduced w9116 features frame, which shall be
send when radio capabilities confirm is received.

Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:44:28 +03:00
Siva Rebbagondla
f911c86166 rsi: new bootup parameters for 9116
Bootup parameters are different for 9116 device. Check added for device
model where-ever bootup parameters are being send.

Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:44:27 +03:00
Siva Rebbagondla
9ba4562ac1 rsi: change in device init frame sequence for 9116
Initial frame exchange sequence has been changed for 9116 chip. Getting MAC
address using EEPROM read frame will be once common device configuration is
done and RESET_MAC frame is sending after bootup parameters confirmation is
received, which are different from RS9113 device

Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:44:26 +03:00
Siva Rebbagondla
e5a1ecc97e rsi: add firmware loading for 9116 device
New firmware files and firmware loading method are added for 9116.

Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:44:25 +03:00
Siva Rebbagondla
3ac61578fb rsi: move common part of firmware load to separate function
Till software bootloader ready state, communication with device is common
for 9113 and 9116. Hence moved that part of firmware loading to separate
function rsi_prepare_fw_load(). Also LMAC_VER_OFFSET is different for 9113
and 9116, so renamed existing macro to LMAC_VER_OFFSET_9113

Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:44:24 +03:00
Siva Rebbagondla
54fdb318c1 rsi: add new device model for 9116
9116 device id entry is added in both SDIO and USB interfaces.
New enumberation value taken for the device model. Based on the
device model detected run time, few device specific operations
needs to be performed.

adding rsi_dev_model to get device type in run time, as we can use
same driver for 9113 and 9116 except few firmware load changes.

Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:44:23 +03:00
Stanislaw Gruszka
9ea3812f01 rt2x00mmio: remove legacy comment
Remove comment about fields that were removed.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:43:09 +03:00
Stanislaw Gruszka
d954f9e3fb rt2x00: remove not used entry field
Remove not used any longer queue_entry field and flag.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:43:08 +03:00
Stanislaw Gruszka
eb662b1dc6 rt2x00: remove last_nostatus_check
We do not any longer check txstatus timeout from tasklet, so do not need
this optimization.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:43:07 +03:00
Stanislaw Gruszka
e5ceab9df4 rt2800mmio: use timer and work for handling tx statuses timeouts
Sometimes we can get into situation when there are pending statuses,
but we do not get INT_SOURCE_CSR_TX_FIFO_STATUS. Handle this situation
by arming timeout timer and read statuses (it will fix case when
we just do not have irq) and queue work to handle case we missed
statues from hardware FIFO.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:43:06 +03:00
Stanislaw Gruszka
2c7ba758cc rt2800mmio: fetch tx status changes
Prepare to use rt2800mmio_fetch_txstatus() in concurrent manner and drop
return value since is not longer needed.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:43:05 +03:00
Stanislaw Gruszka
6efa798764 rt2800: move txstatus pending routine
Move rt2800usb_txstatus_pending routine to rt2800lib. It will be reused
by rt2800mmio code.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:43:04 +03:00
Stanislaw Gruszka
f61131505e rt2800: new flush implementation for SoC devices
Use new flush_queue() callback for SoC devices, what was already done for
PCIe devices.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:43:04 +03:00
Stanislaw Gruszka
889bb866ba rt2800: partially restore old mmio txstatus behaviour
Do not disable txstatus interrupt and add quota of processed tx statuses in
one tasklet. Quota is needed to allow to fed device with new frames during
processing of tx statuses.

Patch fixes about 15% performance degradation on some scenarios caused by
0b0d556e0e ("rt2800mmio: use txdone/txstatus routines from lib").

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:43:03 +03:00
Aditya Pakki
d5414c2355 rsi: Fix NULL pointer dereference in kmalloc
kmalloc can fail in rsi_register_rates_channels but memcpy still attempts
to write to channels. The patch replaces these calls with kmemdup and
passes the error upstream.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:42:26 +03:00
Tomislav Požega
9490c56024 rt2x00: code-style fix in rt2800usb.c
Remove space leftovers.

Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:41:42 +03:00
Stanislaw Gruszka
61a4e5ff0d rt2x00: do not print error when queue is full
For unknown reasons printk() on some context can cause CPU hung on
embedded MT7620 AP/router MIPS platforms. What can result on wifi
disconnects.

This patch move queue full messages to debug level what is consistent
with other mac80211 drivers which drop packet silently if tx queue is
full. This make MT7620 OpenWRT routers more stable, what was reported
by various users.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:40:54 +03:00
Stanislaw Gruszka
e383c70474 rt2x00: check number of EPROTO errors
Some USB host devices/drivers on some conditions can always return
EPROTO error on submitted URBs. That can cause infinity loop in the
rt2x00 driver.

Since we can have single EPROTO errors we can not mark as device as
removed to avoid infinity loop. However we can count consecutive
EPROTO errors and mark device as removed if get lot of it.
I choose number 10 as threshold.

Reported-and-tested-by: Randy Oostdyk <linux-kernel@oostdyk.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:40:53 +03:00
Stanislaw Gruszka
bb3b18c925 rt2x00: use ratelimited variants dev_warn/dev_err
As reported by Randy we can overwhelm logs on some USB error conditions.
To avoid that use dev_warn_ratelimited() and dev_err_ratelimitd().

Reported-and-tested-by: Randy Oostdyk <linux-kernel@oostdyk.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:40:52 +03:00
Kangjie Lu
0ed2a00534 net: cw1200: fix a NULL pointer dereference
In case create_singlethread_workqueue fails, the fix free the
hardware and returns NULL to avoid NULL pointer dereference.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:40:09 +03:00
YueHaibing
b2c01aab96 ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
Syzkaller report this:

kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 0 PID: 4492 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
RIP: 0010:sysfs_remove_file_ns+0x27/0x70 fs/sysfs/file.c:468
Code: 00 00 00 41 54 55 48 89 fd 53 49 89 d4 48 89 f3 e8 ee 76 9c ff 48 8d 7d 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 2d 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 8b 6d
RSP: 0018:ffff8881e9d9fc00 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffffff900367e0 RCX: ffffffff81a95952
RDX: 0000000000000006 RSI: ffffc90001405000 RDI: 0000000000000030
RBP: 0000000000000000 R08: fffffbfff1fa22ed R09: fffffbfff1fa22ed
R10: 0000000000000001 R11: fffffbfff1fa22ec R12: 0000000000000000
R13: ffffffffc1abdac0 R14: 1ffff1103d3b3f8b R15: 0000000000000000
FS:  00007fe409dc1700(0000) GS:ffff8881f1200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d721000 CR3: 00000001e98b6005 CR4: 00000000007606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 sysfs_remove_file include/linux/sysfs.h:519 [inline]
 driver_remove_file+0x40/0x50 drivers/base/driver.c:122
 pcmcia_remove_newid_file drivers/pcmcia/ds.c:163 [inline]
 pcmcia_unregister_driver+0x7d/0x2b0 drivers/pcmcia/ds.c:209
 ssb_modexit+0xa/0x1b [ssb]
 __do_sys_delete_module kernel/module.c:1018 [inline]
 __se_sys_delete_module kernel/module.c:961 [inline]
 __x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961
 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462e99
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe409dc0c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe409dc16bc
R13: 00000000004bccaa R14: 00000000006f6bc8 R15: 00000000ffffffff
Modules linked in: ssb(-) 3c59x nvme_core macvlan tap pata_hpt3x3 rt2x00pci null_blk tsc40 pm_notifier_error_inject notifier_error_inject mdio cdc_wdm nf_reject_ipv4 ath9k_common ath9k_hw ath pppox ppp_generic slhc ehci_platform wl12xx wlcore tps6507x_ts ioc4 nf_synproxy_core ide_gd_mod ax25 can_dev iwlwifi can_raw atm tm2_touchkey can_gw can sundance adp5588_keys rt2800mmio rt2800lib rt2x00mmio rt2x00lib eeprom_93cx6 pn533 lru_cache elants_i2c ip_set nfnetlink gameport tipc hampshire nhc_ipv6 nhc_hop nhc_udp nhc_fragment nhc_routing nhc_mobility nhc_dest 6lowpan silead brcmutil nfc mt76_usb mt76 mac80211 iptable_security iptable_raw iptable_mangle iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_gre sit hsr veth vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon vcan bridge stp llc ip6_gre ip6_tunnel tunnel6 tun joydev mousedev serio_raw ide_pci_generic piix floppy ide_core sch_fq_codel ip_tables x_tables ipv6
 [last unloaded: 3c59x]
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace 3913cbf8011e1c05 ]---

In ssb_modinit, it does not fail SSB init when ssb_host_pcmcia_init failed,
however in ssb_modexit, ssb_host_pcmcia_exit calls pcmcia_unregister_driver
unconditionally, which may tigger a NULL pointer dereference issue as above.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 399500da18 ("ssb: pick PCMCIA host code support from b43 driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:39:34 +03:00
YueHaibing
3b6edcb3ff ray_cs: use remove_proc_subtree to simplify procfs code
Use remove_proc_subtree to remove the whole subtree

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:38:52 +03:00
YueHaibing
444efbde32 ray_cs: Check return value of pcmcia_register_driver
init_ray_cs does not check value of pcmcia_register_driver,
if it fails, there maybe cause a NULL pointer dereference in
exit_ray_cs.

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:38:26 +03:00
Gustavo A. R. Silva
d442af2e1b rndis_wlan: use struct_size() helper
Make use of the struct_size() helper instead of an open-coded version
in order to avoid any potential type mistakes, in particular in the
context in which this code is being used.

So, replace code of the following form:

sizeof(*pmkids) + max_pmkids * sizeof(pmkids->bssid_info[0])

with:

struct_size(pmkids, bssid_info, num_pmkids)

This code was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-25 19:37:44 +03:00
Linus Torvalds
f6f3e74745 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
 "This fixes a bug in xts and lrw where they may sleep in an atomic
  context"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: lrw - Fix atomic sleep when walking skcipher
  crypto: xts - Fix atomic sleep when walking skcipher
2019-04-25 09:15:03 -07:00
Stephen Boyd
d3dfc16f8f Clock fixes for rk3328 and rk3288 and a new sub-type for an upcoming
soc where mux and divider are not necessarily in the same register
 anymore.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAly/jNMQHGhlaWtvQHNu
 dGVjaC5kZQAKCRDzpnnJnNEdgbyKCAC0+NF8e3Ov9HwW5BizuEcp8GoN5zzFJjwl
 20gJRtCxQODTG3zih36B3KbOzzeqsb3q3UG7yqhvgkT9LSI0bjX9YR2hXtM2YkQK
 1f9LAS0rX5KNrRfE8hAoJcrCBzCm3eWDPK7IUdvr3DIxL45/0624jzkAkIzjqLPf
 BQENu8sGn65Lp9n9vvPh5q+jriPoOQH0rrG+hDdeSf5fOu1pVfRgq1OrKfL+CUBB
 97nfXMWj0tFVjhQHxv+aGtJoNUCl00R42JgmKvwPI+8uDYS0gXqQmTM4//7uGr1s
 u3A9NUqqTJtmXEuCk8Nipwlvla0aXldk71SeLZMRUlVTmO0cJH7N
 =tPPg
 -----END PGP SIGNATURE-----

Merge tag 'v5.2-rockchip-clk-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip

Pull Rockchip clk driver updates from Heiko Stuebner:

 - Fixes for rk3328 and rk3288
 - New sub-type for an upcoming SoC where mux and divider
   are not necessarily in the same register anymore

* tag 'v5.2-rockchip-clk-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  clk: rockchip: undo several noc and special clocks as critical on rk3288
  clk: rockchip: add a COMPOSITE_DIV_OFFSET clock-type
  clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
  clk: rockchip: Limit use of USB PHY clock to USB on rk3288
  clk: rockchip: Fix video codec clocks on rk3288
  clk: rockchip: Make rkpwm a critical clock on rk3288
  clk: rockchip: fix wrong clock definitions for rk3328
2019-04-25 08:56:23 -07:00
Barret Rhoden
7bc04c5c2c ext4: fix use-after-free race with debug_want_extra_isize
When remounting with debug_want_extra_isize, we were not performing the
same checks that we do during a normal mount.  That allowed us to set a
value for s_want_extra_isize that reached outside the s_inode_size.

Fixes: e2b911c535 ("ext4: clean up feature test macros with predicate functions")
Reported-by: syzbot+f584efa0ac7213c226b7@syzkaller.appspotmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Barret Rhoden <brho@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
2019-04-25 11:55:50 -04:00
Pan Bian
8c380ab4b7 ext4: avoid drop reference to iloc.bh twice
The reference to iloc.bh has been dropped in ext4_mark_iloc_dirty.
However, the reference is dropped again if error occurs during
ext4_handle_dirty_metadata, which may result in use-after-free bugs.

Fixes: fb265c9cb49e("ext4: add ext4_sb_bread() to disambiguate ENOMEM cases")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: stable@kernel.org
2019-04-25 11:44:15 -04:00
Stephen Boyd
d635c3512d i.MX7UPL clock changes for 5.2:
- Remove SNVS clock from i.MX7UPL clock driver and bindings, as the
    clock will be visible on M4 core only, and never be accessed by
    Cortex-A cores.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJcvThaAAoJEFBXWFqHsHzOoR0H/0AjB+fmbMoeGEpo0pZjPFyw
 RbQ/+UavX0Yy4z4LJmYw3y3n7/cLvyv8Edg/BRXCvgX6dmjHa6sOSW3rZSD7BWUp
 Jg6m/NCkaq4GRFOfXrs+vzmjtEECyq5j6EV9QG8w3ZBEU733FkcQgMTsOmK9u7kF
 fxUfz7PReS6ZPk276gTMwWaNOl1R6W8eaHjiK0F1LQIcZfPRcsPtFRFkriQ27m/7
 MOJ5Wjpf5804qis3p8gDIc/Z+wPaf5QF0exNKL/55INjVeSwCw81TAqTpFWrkrgj
 lF2DTXgBHVO9S03I5/d5CNFCYdlP7EbgRD5CoH7mWrqEiBnvUUAxhe5zlm4etno=
 =4yV1
 -----END PGP SIGNATURE-----

Merge tag 'clk-imx7ulp-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into clk-imx

Pull i.MX7UPL clk changes from Shawn Guo:

 - Remove SNVS clock from i.MX7UPL clock driver and bindings, as the
   clock will be visible on M4 core only, and never be accessed by
   Cortex-A cores

* tag 'clk-imx7ulp-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  dt-bindings: clock: imx7ulp: remove SNVS clock
  clk: imx7ulp: remove snvs clock
2019-04-25 08:31:32 -07:00
Stephen Boyd
363de1d63e i.MX5 clock changes for 5.2:
- A couple of patches from Jonathan Neuschäfer to improve i.MX5 clock
    driver for i.MX50 support.
  - Rename file clk-imx51-imx53.c to clk-imx5.c, as it covers support for
    all i.MX5 series SoCs including i.MX50.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJcvTXlAAoJEFBXWFqHsHzO9oAH+wQtUGOJw7Yiu/UcjGQmoWRJ
 0MRLknDBlVBTKSqZLVoFsm2xRyCkdHA7QB3OaCui4I40pdwoCOxDFHUOc2PTwBk2
 kr0tHiiYoYXF6oZioD5tCh2zLHNuCIYy+TLzwG4jVavUCQAnQE8jzE59kiEvxBVg
 9dvVxRjiIcHg0azm/oRsD+HQYwZ0ALMkLcAtbP1GGgsHeoSbaPJsYQCmj+9jDP8t
 OKwgtum7DeYFlelCMF70BubA3NmAFz3uKrgh1lXRGSM5nm2aMmuNyypFIN6c7E53
 ELWfXvRLfncl5uipeIc5Km5r0L+AwBQmH9aOyzd3i4Ys2z3Kp5atSEhuqbDWnDI=
 =udGf
 -----END PGP SIGNATURE-----

Merge tag 'clk-imx5-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into clk-imx

Pull i.MX5 clk changes from Shawn Guo:

 - A couple of patches from Jonathan Neuschäfer to improve i.MX5 clock
   driver for i.MX50 support
 - Rename file clk-imx51-imx53.c to clk-imx5.c, as it covers support for
   all i.MX5 series SoCs including i.MX50

* tag 'clk-imx5-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  clk: imx: rename clk-imx51-imx53.c to clk-imx5.c
  clk: imx5: Fix i.MX50 ESDHC clock registers
  clk: imx5: Fix i.MX50 mainbus clock registers
2019-04-25 08:30:39 -07:00
Stephen Boyd
5d27e1cda1 i.MX common clock changes for 5.2:
- Clean up unused imx_get_clk_hw_fixed() inline function.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJcvTR3AAoJEFBXWFqHsHzOz5AH/1wh1BJcl50QpHrry5p3DS/X
 wp/TE1P5QV1IrnuwXPl9qmbGXxs/5wdtjdENOKhFSTo0I6E8ClDWaBROoGsjXXRG
 NWLEriX8GXfd4RjZ/9cp3bRy6XcEyC95R9sGADFzoO/bJ3IozVbvCEuxlKJsyutK
 sdDv39bKeh3Z7Woj8oGvQ3kxmj7pNWmp547N2ChVXBUxD0W56GMI29t729v6tQ4M
 d6xn40kVbSOTGLkctRcKraG4eOJAj6BR5+nfPr708MULFLQCCXZUQ+NXcy3xwxJH
 Atl5ImN5mXrO4DlPjOe+i4AvdV34NpVsbUS91JVZUJX6IBdgUGsFXVe9DEkRpyg=
 =Du5p
 -----END PGP SIGNATURE-----

Merge tag 'clk-imx-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into clk-imx

Pull i.MX clk changes from Shawn Guo:

 - Clean up unused imx_get_clk_hw_fixed() inline function

* tag 'clk-imx-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  clk: imx: Remove unused imx_get_clk_hw_fixed
2019-04-25 08:30:19 -07:00
Matthew Wilcox
b9b0f34531 uverbs: Convert idr to XArray
The word 'idr' is scattered throughout the API, so I haven't changed it,
but the 'idr' variable is now an XArray.

Signed-off-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2019-04-25 12:27:11 -03:00
Kalle Valo
b99561c513 Third batch of patches intended for v5.2
* Bump the 20000-series FW API version supported;
 * Work on the new debugging infra continues;
 * One clean-up to prevent a bogus warning with clang;
 * A small cleanup in the PCI ID list;
 * Work on new hardware continues;
 * RTT confidence indication support for FTM;
 * An improvement in HE rate-scaling;
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEF3LNfgb2BPWm68smoUecoho8xfoFAly5eWAACgkQoUecoho8
 xfqEIRAAlMWOsctlnqlA2oxuf4V/tAvI3rHPiPHbdrBGCM13muIihP/FXXFgDQTY
 k55o2Ugg5RTwitdhL3jU//meF+a755FvEqAD8BK1SfySid7frWvNMXIK8kWWp6Cw
 VzwG3gfZ0hV21P8gYdfg+HLwfiBHDKNGUAj08pA3jXAxA+tG6VrXNNGuHe5Jy3pK
 JxGNSQUtdHZPx6UVI5Em3Al+bfLmhXRlDDlZQl1amPY5+zHEvBJLSi9Mmf8UShle
 YDnFDUA3co6BDvuOaOM7j5buvb7sj+pEMQMTfhcnLtqo5cSF1eEbYHw0aZKYG9rl
 Ueej9moQoTNZWoy9DJVGrMWZd86XEmplgCEfrl7ricGVuOq73GWneeU7uuUnnMZr
 5SiS6o54WalYE0sY8RfhDWRWgAdN1chGmtrPsq+iIfOoEfnTzIqfKW4sG0MqIVHP
 UNyx8aBM0ebjfa1s6xSVBwEEZYCCdOHl1O56UVcvnHzB+c82xj2nadO7ebOnBKBf
 CQnUKCNWbE1HbLiAJdGWYHTWGdMkswDMYl8Zqf0Q2KZ2uCpmWHbjgSyVqkkUnYR1
 5vF+2kMJfNhjw5aBnnP4W5ZQSjIpp+Rtvnui9WiSYinXbfZ+b3EfJwx/2hKKq7d2
 y5lCCeX5hGKVp7P5fIOuN7shmvNrdyywawcRWwtlWmVpwHtkUKQ=
 =JJSw
 -----END PGP SIGNATURE-----

Merge tag 'iwlwifi-next-for-kalle-2019-04-18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next

Third batch of patches intended for v5.2

* Bump the 20000-series FW API version supported;
* Work on the new debugging infra continues;
* One clean-up to prevent a bogus warning with clang;
* A small cleanup in the PCI ID list;
* Work on new hardware continues;
* RTT confidence indication support for FTM;
* An improvement in HE rate-scaling;
2019-04-25 18:26:23 +03:00
Dmitry Osipenko
b88c9f4129 clk: Add missing stubs for a few functions
Compilation fails if any of undeclared clk_set_*() functions are in use
and CONFIG_HAVE_CLK=n.

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2019-04-25 08:19:15 -07:00
Dmitry Osipenko
449c695d97 clk: tegra124: Remove lock-enable bit from PLLM
According to the Tegra124 TRM documentation, PLLM_MISC2 register doesn't
have the lock-enable bit as well as any other PLLM-related register. Hence
PLLM re-locking can't be initiated by software. The incorrect bit setting
should have been harmless since that bit is undefined according to TRM.

Tested-by: Steev Klimaszewski <steev@kali.org>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-By: Peter De Schrijver <pdeschrijver@nvidia.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2019-04-25 08:17:20 -07:00
Dmitry Osipenko
40db569d67 clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
There are wrongly set parenthesis in the code that are resulting in a
wrong configuration being programmed for PLLM. The original fix was made
by Danny Huang in the downstream kernel. The patch was tested on Nyan Big
Tegra124 chromebook, PLLM rate changing works correctly now and system
doesn't lock up after changing the PLLM rate due to EMC scaling.

Cc: <stable@vger.kernel.org>
Tested-by: Steev Klimaszewski <steev@kali.org>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-By: Peter De Schrijver <pdeschrijver@nvidia.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2019-04-25 08:17:07 -07:00
Christoph Hellwig
cc6be13159 mtip32xx: remove trim support
The trim support in mtip32xx has been "temporarily" disabled for 6
years, which is 3/4 of the time the driver even exists in the tree.

Remove it as it obviously is dead code now.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-04-25 09:11:53 -06:00
Laurent Pinchart
7afa8db323 media: vsp1: Add support for missing 16-bit RGB555 formats
Add support for the V4L2_PIX_FMT_RGBA555, V4L2_PIX_FMT_RGBX555,
V4L2_PIX_FMT_ABGR555, V4L2_PIX_FMT_XBGR555, V4L2_PIX_FMT_BGRA555 and
V4L2_PIX_FMT_BGRX555 formats to the VSP driver.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-04-25 11:07:05 -04:00
Laurent Pinchart
4735c16b8b media: vsp1: Add support for missing 16-bit RGB444 formats
Add support for the V4L2_PIX_FMT_RGBA444, V4L2_PIX_FMT_RGBX444,
V4L2_PIX_FMT_ABGR444, V4L2_PIX_FMT_XBGR444, V4L2_PIX_FMT_BGRA444 and
V4L2_PIX_FMT_BGRX444 formats to the VSP driver.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-04-25 11:06:35 -04:00