1. 17 10月, 2021 12 次提交
  2. 16 10月, 2021 8 次提交
  3. 15 10月, 2021 16 次提交
    • L
      Merge tag 'gpio-fixes-for-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux · 8fe31e09
      Linus Torvalds 提交于
      Pull gpio fixes from Bartosz Golaszewski:
      
       - fix module autoloading on gpio-74x164 after a revert of OF modaliases
      
       - fix problems with the bias setting in gpio-pca953x
      
       - fix a use-after-free bug in gpio-mockup by using software nodes
      
      * tag 'gpio-fixes-for-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
        gpio: mockup: Convert to use software nodes
        gpio: pca953x: Improve bias setting
        gpio: 74x164: Add SPI device ID table
      8fe31e09
    • L
      Merge tag 'spi-fix-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 985f6ab9
      Linus Torvalds 提交于
      Pull spi fixes from Mark Brown:
       "A few small fixes.
      
        Mostly driver specific but there's one in the core which fixes a
        deadlock when adding devices on spi-mux that's triggered because
        spi-mux is a SPI device which is itself a SPI controller and so can
        instantiate devices when registered.
      
        We were using a global lock to protect against reusing chip selects
        but they're a per controller thing so moving the lock per controller
        resolves that"
      
      * tag 'spi-fix-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi-mux: Fix false-positive lockdep splats
        spi: Fix deadlock when adding SPI controllers on SPI buses
        spi: bcm-qspi: clear MSPI spifie interrupt during probe
        spi: spi-nxp-fspi: don't depend on a specific node name erratum workaround
        spi: mediatek: skip delays if they are 0
        spi: atmel: Fix PDC transfer setup bug
        spi: spidev: Add SPI ID table
        spi: Use 'flash' node name instead of 'spi-flash' in example
      985f6ab9
    • L
      Merge tag 'regulator-fix-v5.15-rc5' of... · ccb6a666
      Linus Torvalds 提交于
      Merge tag 'regulator-fix-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
      
      Pull regulator fix from Mark Brown:
       "Just a trivial fix to the MAINTAINERS file for an update missed during
        conversion of the DT bindings to YAML format"
      
      * tag 'regulator-fix-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        MAINTAINERS: rectify entry for SY8106A REGULATOR DRIVER
      ccb6a666
    • L
      Merge tag 'mtd/fixes-for-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux · 9e795d94
      Linus Torvalds 提交于
      Pull mtd fix from Miquel Raynal:
       "Raw NAND controller driver fix:
      
         - Qcom: Update code word value for raw reads (QPIC v2+)"
      
      * tag 'mtd/fixes-for-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
        mtd: rawnand: qcom: Update code word value for raw read
      9e795d94
    • L
      Merge tag 'drm-fixes-2021-10-15-1' of git://anongit.freedesktop.org/drm/drm · 591a495d
      Linus Torvalds 提交于
      Pull drm fixes from Dave Airlie:
       "It has a few scattered msm and i915 fixes, a few core fixes and a
        mediatek feature revert.
      
        I've had to pick a bunch of patches into this, as the drm-misc-fixes
        tree had a bunch of vc4 patches I wasn't comfortable with sending to
        you at least as part of this, they were delayed due to your reverts.
        If it's really useful as fixes I'll do a separate pull.
      
        Summary:
      
        Core:
         - clamp fbdev size
         - edid cap blocks read to avoid out of bounds
      
        panel:
         - fix missing crc32 dependency
      
        msm:
         - Fix a new crash on dev file close if the dev file was opened when
           GPU is not loaded (such as missing fw in initrd)
         - Switch to single drm_sched_entity per priority level per drm_file
           to unbreak multi-context userspace
         - Serialize GMU access to fix GMU OOB errors
         - Various error path fixes
         - A couple integer overflow fixes
         - Fix mdp5 cursor plane WARNs
      
        i915:
         - Fix ACPI object leak
         - Fix context leak in user proto-context creation
         - Fix missing i915_sw_fence_fini call
      
        hyperv:
         - hide hw pointer
      
        nouveau:
         - fix engine selection bit
      
        r128:
         - fix UML build
      
        rcar-du:
         - unconncted LVDS regression fix
      
        mediatek:
         - revert CMDQ refinement patches"
      
      * tag 'drm-fixes-2021-10-15-1' of git://anongit.freedesktop.org/drm/drm: (34 commits)
        drm/panel: olimex-lcd-olinuxino: select CRC32
        drm/r128: fix build for UML
        drm/nouveau/fifo: Reinstate the correct engine bit programming
        drm/hyperv: Fix double mouse pointers
        drm/fbdev: Clamp fbdev surface size if too large
        drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read
        drm/i915: Free the returned object of acpi_evaluate_dsm()
        drm/i915: Fix bug in user proto-context creation that leaked contexts
        drm: rcar-du: Don't create encoder for unconnected LVDS outputs
        drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
        drm/msm/dsi: Fix an error code in msm_dsi_modeset_init()
        drm/msm/dsi: dsi_phy_14nm: Take ready-bit into account in poll_for_ready
        drm/msm/dsi/phy: fix clock names in 28nm_8960 phy
        drm/msm/dpu: Fix address of SM8150 PINGPONG5 IRQ register
        drm/msm: Do not run snapshot on non-DPU devices
        drm/msm/a3xx: fix error handling in a3xx_gpu_init()
        drm/msm/a4xx: fix error handling in a4xx_gpu_init()
        drm/msm: Fix null pointer dereference on pointer edp
        drm/msm/mdp5: fix cursor-related warnings
        drm/msm: Avoid potential overflow in timeout_to_jiffies()
        ...
      591a495d
    • L
      Merge tag 'ntfs3_for_5.15' of git://github.com/Paragon-Software-Group/linux-ntfs3 · 86a44e90
      Linus Torvalds 提交于
      Pull ntfs3 fixes from Konstantin Komarov:
       "Use the new api for mounting as requested by Christoph.
      
        Also fixed:
      
         - some memory leaks and panic
      
         - xfstests (tested on x86_64) generic/016 generic/021 generic/022
           generic/041 generic/274 generic/423
      
         - some typos, wrong returned error codes, dead code, etc"
      
      * tag 'ntfs3_for_5.15' of git://github.com/Paragon-Software-Group/linux-ntfs3: (70 commits)
        fs/ntfs3: Check for NULL pointers in ni_try_remove_attr_list
        fs/ntfs3: Refactor ntfs_read_mft
        fs/ntfs3: Refactor ni_parse_reparse
        fs/ntfs3: Refactor ntfs_create_inode
        fs/ntfs3: Refactor ntfs_readlink_hlp
        fs/ntfs3: Rework ntfs_utf16_to_nls
        fs/ntfs3: Fix memory leak if fill_super failed
        fs/ntfs3: Keep prealloc for all types of files
        fs/ntfs3: Remove unnecessary functions
        fs/ntfs3: Forbid FALLOC_FL_PUNCH_HOLE for normal files
        fs/ntfs3: Refactoring of ntfs_set_ea
        fs/ntfs3: Remove locked argument in ntfs_set_ea
        fs/ntfs3: Use available posix_acl_release instead of ntfs_posix_acl_release
        fs/ntfs3: Check for NULL if ATTR_EA_INFO is incorrect
        fs/ntfs3: Refactoring of ntfs_init_from_boot
        fs/ntfs3: Reject mount if boot's cluster size < media sector size
        fs/ntfs3: Refactoring lock in ntfs_init_acl
        fs/ntfs3: Change posix_acl_equiv_mode to posix_acl_update_mode
        fs/ntfs3: Pass flags to ntfs_set_ea in ntfs_set_acl_ex
        fs/ntfs3: Refactor ntfs_get_acl_ex for better readability
        ...
      86a44e90
    • V
      drm/panel: olimex-lcd-olinuxino: select CRC32 · a14bc107
      Vegard Nossum 提交于
      Fix the following build/link error by adding a dependency on the CRC32
      routines:
      
        ld: drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.o: in function `lcd_olinuxino_probe':
        panel-olimex-lcd-olinuxino.c:(.text+0x303): undefined reference to `crc32_le'
      
      Fixes: 17fd7a9d ("drm/panel: Add support for Olimex LCD-OLinuXino panel")
      Cc: Arnd Bergmann <arnd@arndb.de>
      Signed-off-by: NVegard Nossum <vegard.nossum@oracle.com>
      Signed-off-by: NSam Ravnborg <sam@ravnborg.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20211012115242.10325-1-vegard.nossum@oracle.comSigned-off-by: NDave Airlie <airlied@redhat.com>
      a14bc107
    • R
      drm/r128: fix build for UML · 1a361b41
      Randy Dunlap 提交于
      Fix a build error on CONFIG_UML, which does not support (provide)
      wbinvd(). UML can use the generic mb() instead.
      
      ../drivers/gpu/drm/r128/ati_pcigart.c: In function ‘drm_ati_pcigart_init’:
      ../drivers/gpu/drm/r128/ati_pcigart.c:218:2: error: implicit declaration of function ‘wbinvd’ [-Werror=implicit-function-declaration]
        wbinvd();
        ^~~~~~
      
      Fixes: 68f5d3f3 ("um: add PCI over virtio emulation driver")
      Signed-off-by: NRandy Dunlap <rdunlap@infradead.org>
      Cc: David Airlie <airlied@linux.ie>
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Cc: dri-devel@lists.freedesktop.org
      Cc: Jeff Dike <jdike@addtoit.com>
      Cc: Richard Weinberger <richard@nod.at>
      Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
      Cc: linux-um@lists.infradead.org
      Cc: Sam Ravnborg <sam@ravnborg.org>
      Signed-off-by: NSam Ravnborg <sam@ravnborg.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20211011080006.31081-1-rdunlap@infradead.orgSigned-off-by: NDave Airlie <airlied@redhat.com>
      1a361b41
    • M
      drm/nouveau/fifo: Reinstate the correct engine bit programming · d1d94b01
      Marek Vasut 提交于
      Commit 64f7c698 ("drm/nouveau/fifo: add engine_id hook") replaced
      fifo/chang84.c g84_fifo_chan_engine() call with an indirect call of
      fifo/g84.c g84_fifo_engine_id(). The G84_FIFO_ENGN_* values returned
      from the later g84_fifo_engine_id() are incremented by 1 compared to
      the previous g84_fifo_chan_engine() return values.
      
      This is fine either way for most of the code, except this one line
      where an engine bit programmed into the hardware is derived from the
      return value. Decrement the return value accordingly, otherwise the
      wrong engine bit is programmed into the hardware and that leads to
      the following failure:
      nouveau 0000:01:00.0: gr: 00000030 [ILLEGAL_MTHD ILLEGAL_CLASS] ch 1 [003fbce000 DRM] subc 3 class 0000 mthd 085c data 00000420
      
      On the following hardware:
      lspci -s 01:00.0
      01:00.0 VGA compatible controller: NVIDIA Corporation GT216GLM [Quadro FX 880M] (rev a2)
      lspci -ns 01:00.0
      01:00.0 0300: 10de:0a3c (rev a2)
      
      Fixes: 64f7c698 ("drm/nouveau/fifo: add engine_id hook")
      Signed-off-by: NMarek Vasut <marex@denx.de>
      Cc: <stable@vger.kernel.org> # 5.12+
      Cc: Ben Skeggs <bskeggs@redhat.com>
      Cc: Karol Herbst <kherbst@redhat.com>
      Cc: Lyude Paul <lyude@redhat.com>
      Reviewed-by: NKarol Herbst <kherbst@redhat.com>
      Reviewed-by: NBen Skeggs <bskeggs@redhat.com>
      Signed-off-by: NKarol Herbst <kherbst@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20211007214117.231472-1-marex@denx.deSigned-off-by: NDave Airlie <airlied@redhat.com>
      d1d94b01
    • D
      drm/hyperv: Fix double mouse pointers · b253c302
      Dexuan Cui 提交于
      Hyper-V supports a hardware cursor feature. It is not used by Linux VM,
      but the Hyper-V host still draws a point as an extra mouse pointer,
      which is unwanted, especially when Xorg is running.
      
      The hyperv_fb driver uses synthvid_send_ptr() to hide the unwanted pointer.
      When the hyperv_drm driver was developed, the function synthvid_send_ptr()
      was not copied from the hyperv_fb driver. Fix the issue by adding the
      function into hyperv_drm.
      
      Fixes: 76c56a5a ("drm/hyperv: Add DRM driver for hyperv synthetic video device")
      Signed-off-by: NDexuan Cui <decui@microsoft.com>
      Reviewed-by: NHaiyang Zhang <haiyangz@microsoft.com>
      Reviewed-by: NDeepak Rawat <drawat.floss@gmail.com>
      Signed-off-by: NThomas Zimmermann <tzimmermann@suse.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210916193644.45650-1-decui@microsoft.comSigned-off-by: NDave Airlie <airlied@redhat.com>
      b253c302
    • T
      drm/fbdev: Clamp fbdev surface size if too large · b693e429
      Thomas Zimmermann 提交于
      Clamp the fbdev surface size of the available maximumi height to avoid
      failing to init console emulation. An example error is shown below.
      
        bad framebuffer height 2304, should be >= 768 && <= 768
        [drm] Initialized simpledrm 1.0.0 20200625 for simple-framebuffer.0 on minor 0
        simple-framebuffer simple-framebuffer.0: [drm] *ERROR* fbdev: Failed to setup generic emulation (ret=-22)
      
      This is especially a problem with drivers that have very small screen
      sizes and cannot over-allocate at all.
      
      v2:
      	* reduce warning level (Ville)
      Signed-off-by: NThomas Zimmermann <tzimmermann@suse.de>
      Fixes: 11e8f5fd ("drm: Add simpledrm driver")
      Reviewed-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
      Reported-by: NAmanoel Dawod <kernel@amanoeldawod.com>
      Reported-by: NZoltán Kővágó <dirty.ice.hu@gmail.com>
      Reported-by: NMichael Stapelberg <michael+lkml@stapelberg.ch>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Maxime Ripard <maxime@cerno.tech>
      Cc: dri-devel@lists.freedesktop.org
      Cc: <stable@vger.kernel.org> # v5.14+
      Link: https://patchwork.freedesktop.org/patch/msgid/20211005070355.7680-1-tzimmermann@suse.deSigned-off-by: NDave Airlie <airlied@redhat.com>
      b693e429
    • D
      drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read · 97794170
      Douglas Anderson 提交于
      In commit e11f5bd8 ("drm: Add support for DP 1.4 Compliance edid
      corruption test") the function connector_bad_edid() started assuming
      that the memory for the EDID passed to it was big enough to hold
      `edid[0x7e] + 1` blocks of data (1 extra for the base block). It
      completely ignored the fact that the function was passed `num_blocks`
      which indicated how much memory had been allocated for the EDID.
      
      Let's fix this by adding a bounds check.
      
      This is important for handling the case where there's an error in the
      first block of the EDID. In that case we will call
      connector_bad_edid() without having re-allocated memory based on
      `edid[0x7e]`.
      
      Fixes: e11f5bd8 ("drm: Add support for DP 1.4 Compliance edid corruption test")
      Reported-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Signed-off-by: NDouglas Anderson <dianders@chromium.org>
      Reviewed-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20211005192905.v2.1.Ib059f9c23c2611cb5a9d760e7d0a700c1295928d@changeidSigned-off-by: NDave Airlie <airlied@redhat.com>
      97794170
    • D
      Merge tag 'mediatek-drm-fixes-5.15' of... · 6011106d
      Dave Airlie 提交于
      Merge tag 'mediatek-drm-fixes-5.15' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes
      
      Mediatek DRM Fixes for Linux 5.15
      
      1. Revert series "CMDQ refinement of Mediatek DRM driver"
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      
      From: Chun-Kuang Hu <chunkuang.hu@kernel.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20211013235044.5488-1-chunkuang.hu@kernel.org
      6011106d
    • P
      ARM: imx: register reset controller from a platform driver · a1467faa
      Philipp Zabel 提交于
      Starting with commit 6b2117ad ("of: property: fw_devlink: Add
      support for "resets" and "pwms""), the imx-drm driver fails to load
      due to forever dormant devlinks to the reset-controller node. This
      node was never associated with a struct device.
      
      Add a platform device to allow fw_devnode to activate the devlinks.
      
      Fixes: 6b2117ad ("of: property: fw_devlink: Add support for "resets" and "pwms"")
      Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
      Tested-by: NFabio Estevam <festevam@gmail.com>
      Reviewed-by: NSaravana Kannan <saravanak@google.com>
      Signed-off-by: NShawn Guo <shawnguo@kernel.org>
      a1467faa
    • D
      Merge tag 'drm-intel-fixes-2021-10-14' of... · 1483f0a4
      Dave Airlie 提交于
      Merge tag 'drm-intel-fixes-2021-10-14' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      drm/i915 fixes for v5.15-rc6:
      - Fix ACPI object leak
      - Fix context leak in user proto-context creation
      - Fix missing i915_sw_fence_fini call
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      From: Jani Nikula <jani.nikula@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/87zgrbvgls.fsf@intel.com
      1483f0a4
    • L
      Merge tag 'net-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · ec681c53
      Linus Torvalds 提交于
      Pull networking fixes from Jakub Kicinski:
       "Quite calm.
      
        The noisy DSA driver (embedded switches) changes, and adjustment to
        IPv6 IOAM behavior add to diffstat's bottom line but are not scary.
      
        Current release - regressions:
      
         - af_unix: rename UNIX-DGRAM to UNIX to maintain backwards
           compatibility
      
         - procfs: revert "add seq_puts() statement for dev_mcast", minor
           format change broke user space
      
        Current release - new code bugs:
      
         - dsa: fix bridge_num not getting cleared after ports leaving the
           bridge, resource leak
      
         - dsa: tag_dsa: send packets with TX fwd offload from VLAN-unaware
           bridges using VID 0, prevent packet drops if pvid is removed
      
         - dsa: mv88e6xxx: keep the pvid at 0 when VLAN-unaware, prevent HW
           getting confused about station to VLAN mapping
      
        Previous releases - regressions:
      
         - virtio-net: fix for skb_over_panic inside big mode
      
         - phy: do not shutdown PHYs in READY state
      
         - dsa: mv88e6xxx: don't use PHY_DETECT on internal PHY's, fix link
           LED staying lit after ifdown
      
         - mptcp: fix possible infinite wait on recvmsg(MSG_WAITALL)
      
         - mqprio: Correct stats in mqprio_dump_class_stats()
      
         - ice: fix deadlock for Tx timestamp tracking flush
      
         - stmmac: fix feature detection on old hardware
      
        Previous releases - always broken:
      
         - sctp: account stream padding length for reconf chunk
      
         - icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe()
      
         - isdn: cpai: check ctr->cnr to avoid array index out of bound
      
         - isdn: mISDN: fix sleeping function called from invalid context
      
         - nfc: nci: fix potential UAF of rf_conn_info object
      
         - dsa: microchip: prevent ksz_mib_read_work from kicking back in
           after it's canceled in .remove and crashing
      
         - dsa: mv88e6xxx: isolate the ATU databases of standalone and bridged
           ports
      
         - dsa: sja1105, ocelot: break circular dependency between switch and
           tag drivers
      
         - dsa: felix: improve timestamping in presence of packe loss
      
         - mlxsw: thermal: fix out-of-bounds memory accesses
      
        Misc:
      
         - ipv6: ioam: move the check for undefined bits to improve
           interoperability"
      
      * tag 'net-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (60 commits)
        icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe
        MAINTAINERS: Update the devicetree documentation path of imx fec driver
        sctp: account stream padding length for reconf chunk
        mlxsw: thermal: Fix out-of-bounds memory accesses
        ethernet: s2io: fix setting mac address during resume
        NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
        NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
        nfc: fix error handling of nfc_proto_register()
        Revert "net: procfs: add seq_puts() statement for dev_mcast"
        net: encx24j600: check error in devm_regmap_init_encx24j600
        net: korina: select CRC32
        net: arc: select CRC32
        net: dsa: felix: break at first CPU port during init and teardown
        net: dsa: tag_ocelot_8021q: fix inability to inject STP BPDUs into BLOCKING ports
        net: dsa: felix: purge skb from TX timestamping queue if it cannot be sent
        net: dsa: tag_ocelot_8021q: break circular dependency with ocelot switch lib
        net: dsa: tag_ocelot: break circular dependency with ocelot switch lib driver
        net: mscc: ocelot: cross-check the sequence id from the timestamp FIFO with the skb PTP header
        net: mscc: ocelot: deny TX timestamping of non-PTP packets
        net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb
        ...
      ec681c53
  4. 14 10月, 2021 4 次提交
    • X
      icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe · 1fcd7945
      Xin Long 提交于
      In icmp_build_probe(), the icmp_ext_echo_iio parsing should be done
      step by step and skb_header_pointer() return value should always be
      checked, this patch fixes 3 places in there:
      
        - On case ICMP_EXT_ECHO_CTYPE_NAME, it should only copy ident.name
          from skb by skb_header_pointer(), its len is ident_len. Besides,
          the return value of skb_header_pointer() should always be checked.
      
        - On case ICMP_EXT_ECHO_CTYPE_INDEX, move ident_len check ahead of
          skb_header_pointer(), and also do the return value check for
          skb_header_pointer().
      
        - On case ICMP_EXT_ECHO_CTYPE_ADDR, before accessing iio->ident.addr.
          ctype3_hdr.addrlen, skb_header_pointer() should be called first,
          then check its return value and ident_len.
          On subcases ICMP_AFI_IP and ICMP_AFI_IP6, also do check for ident.
          addr.ctype3_hdr.addrlen and skb_header_pointer()'s return value.
          On subcase ICMP_AFI_IP, the len for skb_header_pointer() should be
          "sizeof(iio->extobj_hdr) + sizeof(iio->ident.addr.ctype3_hdr) +
          sizeof(struct in_addr)" or "ident_len".
      
      v1->v2:
        - To make it more clear, call skb_header_pointer() once only for
          iio->indent's parsing as Jakub Suggested.
      v2->v3:
        - The extobj_hdr.length check against sizeof(_iio) should be done
          before calling skb_header_pointer(), as Eric noticed.
      
      Fixes: d329ea5b ("icmp: add response to RFC 8335 PROBE messages")
      Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NXin Long <lucien.xin@gmail.com>
      Reviewed-by: NEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/31628dd76657ea62f5cf78bb55da6b35240831f1.1634205050.git.lucien.xin@gmail.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      1fcd7945
    • C
      MAINTAINERS: Update the devicetree documentation path of imx fec driver · ea142b09
      Cai Huoqing 提交于
      Change the devicetree documentation path
      to "Documentation/devicetree/bindings/net/fsl,fec.yaml"
      since 'fsl-fec.txt' has been converted to 'fsl,fec.yaml' already.
      Signed-off-by: NCai Huoqing <caihuoqing@baidu.com>
      Link: https://lore.kernel.org/r/20211014110214.3254-1-caihuoqing@baidu.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      ea142b09
    • E
      sctp: account stream padding length for reconf chunk · a2d859e3
      Eiichi Tsukata 提交于
      sctp_make_strreset_req() makes repeated calls to sctp_addto_chunk()
      which will automatically account for padding on each call. inreq and
      outreq are already 4 bytes aligned, but the payload is not and doing
      SCTP_PAD4(a + b) (which _sctp_make_chunk() did implicitly here) is
      different from SCTP_PAD4(a) + SCTP_PAD4(b) and not enough. It led to
      possible attempt to use more buffer than it was allocated and triggered
      a BUG_ON.
      
      Cc: Vlad Yasevich <vyasevich@gmail.com>
      Cc: Neil Horman <nhorman@tuxdriver.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Fixes: cc16f00f ("sctp: add support for generating stream reconf ssn reset request chunk")
      Reported-by: NEiichi Tsukata <eiichi.tsukata@nutanix.com>
      Signed-off-by: NEiichi Tsukata <eiichi.tsukata@nutanix.com>
      Signed-off-by: NMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: NMarcelo Ricardo Leitner <mleitner@redhat.com>
      Reviewed-by: NXin Long <lucien.xin@gmail.com>
      Link: https://lore.kernel.org/r/b97c1f8b0c7ff79ac4ed206fc2c49d3612e0850c.1634156849.git.mleitner@redhat.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      a2d859e3
    • I
      mlxsw: thermal: Fix out-of-bounds memory accesses · 332fdf95
      Ido Schimmel 提交于
      Currently, mlxsw allows cooling states to be set above the maximum
      cooling state supported by the driver:
      
       # cat /sys/class/thermal/thermal_zone2/cdev0/type
       mlxsw_fan
       # cat /sys/class/thermal/thermal_zone2/cdev0/max_state
       10
       # echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state
       # echo $?
       0
      
      This results in out-of-bounds memory accesses when thermal state
      transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the
      transition table is accessed with a too large index (state) [1].
      
      According to the thermal maintainer, it is the responsibility of the
      driver to reject such operations [2].
      
      Therefore, return an error when the state to be set exceeds the maximum
      cooling state supported by the driver.
      
      To avoid dead code, as suggested by the thermal maintainer [3],
      partially revert commit a421ce08 ("mlxsw: core: Extend cooling
      device with cooling levels") that tried to interpret these invalid
      cooling states (above the maximum) in a special way. The cooling levels
      array is not removed in order to prevent the fans going below 20% PWM,
      which would cause them to get stuck at 0% PWM.
      
      [1]
      BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290
      Read of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5
      
      CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122
      Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2FO"/"SA000874", BIOS 4.6.5 03/08/2016
      Workqueue: events_freezable_power_ thermal_zone_device_check
      Call Trace:
       dump_stack_lvl+0x8b/0xb3
       print_address_description.constprop.0+0x1f/0x140
       kasan_report.cold+0x7f/0x11b
       thermal_cooling_device_stats_update+0x271/0x290
       __thermal_cdev_update+0x15e/0x4e0
       thermal_cdev_update+0x9f/0xe0
       step_wise_throttle+0x770/0xee0
       thermal_zone_device_update+0x3f6/0xdf0
       process_one_work+0xa42/0x1770
       worker_thread+0x62f/0x13e0
       kthread+0x3ee/0x4e0
       ret_from_fork+0x1f/0x30
      
      Allocated by task 1:
       kasan_save_stack+0x1b/0x40
       __kasan_kmalloc+0x7c/0x90
       thermal_cooling_device_setup_sysfs+0x153/0x2c0
       __thermal_cooling_device_register.part.0+0x25b/0x9c0
       thermal_cooling_device_register+0xb3/0x100
       mlxsw_thermal_init+0x5c5/0x7e0
       __mlxsw_core_bus_device_register+0xcb3/0x19c0
       mlxsw_core_bus_device_register+0x56/0xb0
       mlxsw_pci_probe+0x54f/0x710
       local_pci_probe+0xc6/0x170
       pci_device_probe+0x2b2/0x4d0
       really_probe+0x293/0xd10
       __driver_probe_device+0x2af/0x440
       driver_probe_device+0x51/0x1e0
       __driver_attach+0x21b/0x530
       bus_for_each_dev+0x14c/0x1d0
       bus_add_driver+0x3ac/0x650
       driver_register+0x241/0x3d0
       mlxsw_sp_module_init+0xa2/0x174
       do_one_initcall+0xee/0x5f0
       kernel_init_freeable+0x45a/0x4de
       kernel_init+0x1f/0x210
       ret_from_fork+0x1f/0x30
      
      The buggy address belongs to the object at ffff8881052f7800
       which belongs to the cache kmalloc-1k of size 1024
      The buggy address is located 1016 bytes inside of
       1024-byte region [ffff8881052f7800, ffff8881052f7c00)
      The buggy address belongs to the page:
      page:0000000052355272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1052f0
      head:0000000052355272 order:3 compound_mapcount:0 compound_pincount:0
      flags: 0x200000000010200(slab|head|node=0|zone=2)
      raw: 0200000000010200 ffffea0005034800 0000000300000003 ffff888100041dc0
      raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff8881052f7a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc
       ffff8881052f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      >ffff8881052f7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                      ^
       ffff8881052f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
       ffff8881052f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      
      [2] https://lore.kernel.org/linux-pm/9aca37cb-1629-5c67-1895-1fdc45c0244e@linaro.org/
      [3] https://lore.kernel.org/linux-pm/af9857f2-578e-de3a-e62b-6baff7e69fd4@linaro.org/
      
      CC: Daniel Lezcano <daniel.lezcano@linaro.org>
      Fixes: a50c1e35 ("mlxsw: core: Implement thermal zone")
      Fixes: a421ce08 ("mlxsw: core: Extend cooling device with cooling levels")
      Signed-off-by: NIdo Schimmel <idosch@nvidia.com>
      Tested-by: NVadim Pasternak <vadimp@nvidia.com>
      Link: https://lore.kernel.org/r/20211012174955.472928-1-idosch@idosch.orgSigned-off-by: NJakub Kicinski <kuba@kernel.org>
      332fdf95