Skip to content
Snippets Groups Projects
  1. Mar 21, 2020
  2. Mar 20, 2020
    • Kevin Hao's avatar
      i2c: dev: Fix the race between the release of i2c_dev and cdev · 1413ef63
      Kevin Hao authored
      
      The struct cdev is embedded in the struct i2c_dev. In the current code,
      we would free the i2c_dev struct directly in put_i2c_dev(), but the
      cdev is manged by a kobject, and the release of it is not predictable.
      So it is very possible that the i2c_dev is freed before the cdev is
      entirely released. We can easily get the following call trace with
      CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_DEBUG_OBJECTS_TIMERS enabled.
        ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x38
        WARNING: CPU: 19 PID: 1 at lib/debugobjects.c:325 debug_print_object+0xb0/0xf0
        Modules linked in:
        CPU: 19 PID: 1 Comm: swapper/0 Tainted: G        W         5.2.20-yocto-standard+ #120
        Hardware name: Marvell OcteonTX CN96XX board (DT)
        pstate: 80c00089 (Nzcv daIf +PAN +UAO)
        pc : debug_print_object+0xb0/0xf0
        lr : debug_print_object+0xb0/0xf0
        sp : ffff00001292f7d0
        x29: ffff00001292f7d0 x28: ffff800b82151788
        x27: 0000000000000001 x26: ffff800b892c0000
        x25: ffff0000124a2558 x24: 0000000000000000
        x23: ffff00001107a1d8 x22: ffff0000116b5088
        x21: ffff800bdc6afca8 x20: ffff000012471ae8
        x19: ffff00001168f2c8 x18: 0000000000000010
        x17: 00000000fd6f304b x16: 00000000ee79de43
        x15: ffff800bc0e80568 x14: 79616c6564203a74
        x13: 6e6968207473696c x12: 5f72656d6974203a
        x11: ffff0000113f0018 x10: 0000000000000000
        x9 : 000000000000001f x8 : 0000000000000000
        x7 : ffff0000101294cc x6 : 0000000000000000
        x5 : 0000000000000000 x4 : 0000000000000001
        x3 : 00000000ffffffff x2 : 0000000000000000
        x1 : 387fc15c8ec0f200 x0 : 0000000000000000
        Call trace:
         debug_print_object+0xb0/0xf0
         __debug_check_no_obj_freed+0x19c/0x228
         debug_check_no_obj_freed+0x1c/0x28
         kfree+0x250/0x440
         put_i2c_dev+0x68/0x78
         i2cdev_detach_adapter+0x60/0xc8
         i2cdev_notifier_call+0x3c/0x70
         notifier_call_chain+0x8c/0xe8
         blocking_notifier_call_chain+0x64/0x88
         device_del+0x74/0x380
         device_unregister+0x54/0x78
         i2c_del_adapter+0x278/0x2d0
         unittest_i2c_bus_remove+0x3c/0x80
         platform_drv_remove+0x30/0x50
         device_release_driver_internal+0xf4/0x1c0
         driver_detach+0x58/0xa0
         bus_remove_driver+0x84/0xd8
         driver_unregister+0x34/0x60
         platform_driver_unregister+0x20/0x30
         of_unittest_overlay+0x8d4/0xbe0
         of_unittest+0xae8/0xb3c
         do_one_initcall+0xac/0x450
         do_initcall_level+0x208/0x224
         kernel_init_freeable+0x2d8/0x36c
         kernel_init+0x18/0x108
         ret_from_fork+0x10/0x1c
        irq event stamp: 3934661
        hardirqs last  enabled at (3934661): [<ffff00001009fa04>] debug_exception_exit+0x4c/0x58
        hardirqs last disabled at (3934660): [<ffff00001009fb14>] debug_exception_enter+0xa4/0xe0
        softirqs last  enabled at (3934654): [<ffff000010081d94>] __do_softirq+0x46c/0x628
        softirqs last disabled at (3934649): [<ffff0000100b4a1c>] irq_exit+0x104/0x118
      
      This is a common issue when using cdev embedded in a struct.
      Fortunately, we already have a mechanism to solve this kind of issue.
      Please see commit 233ed09d ("chardev: add helper function to
      register char devs with a struct device") for more detail.
      
      In this patch, we choose to embed the struct device into the i2c_dev,
      and use the API provided by the commit 233ed09d to make sure that
      the release of i2c_dev and cdev are in sequence.
      
      Signed-off-by: default avatarKevin Hao <haokexin@gmail.com>
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      1413ef63
  3. Mar 13, 2020
  4. Mar 10, 2020
  5. Feb 26, 2020
  6. Feb 21, 2020
    • Rafael J. Wysocki's avatar
      ACPI: PM: s2idle: Check fixed wakeup events in acpi_s2idle_wake() · 63fb9623
      Rafael J. Wysocki authored
      
      Commit fdde0ff8 ("ACPI: PM: s2idle: Prevent spurious SCIs from
      waking up the system") overlooked the fact that fixed events can wake
      up the system too and broke RTC wakeup from suspend-to-idle as a
      result.
      
      Fix this issue by checking the fixed events in acpi_s2idle_wake() in
      addition to checking wakeup GPEs and break out of the suspend-to-idle
      loop if the status bits of any enabled fixed events are set then.
      
      Fixes: fdde0ff8 ("ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system")
      Reported-and-tested-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      63fb9623
    • Guenter Roeck's avatar
      hwmon: (w83627ehf) Fix crash seen with W83627DHG-P · e61d2392
      Guenter Roeck authored
      
      Loading the driver on a system with W83627DHG-P crashes as follows.
      
      w83627ehf: Found W83627DHG-P chip at 0x290
      BUG: kernel NULL pointer dereference, address: 0000000000000000
      PGD 0 P4D 0
      Oops: 0000 [#1] SMP NOPTI
      CPU: 0 PID: 604 Comm: sensors Not tainted 5.6.0-rc2-00055-gca7e1fd1026c #29
      Hardware name:  /D425KT, BIOS MWPNT10N.86A.0132.2013.0726.1534 07/26/2013
      RIP: 0010:w83627ehf_read_string+0x27/0x70 [w83627ehf]
      Code: [... ]
      RSP: 0018:ffffb95980657df8 EFLAGS: 00010293
      RAX: 0000000000000000 RBX: ffff96caaa7f5218 RCX: 0000000000000000
      RDX: 0000000000000015 RSI: 0000000000000001 RDI: ffff96caa736ec08
      RBP: 0000000000000000 R08: ffffb95980657e20 R09: 0000000000000001
      R10: ffff96caaa635cc0 R11: 0000000000000000 R12: ffff96caa9f7cf00
      R13: ffff96caa9ec3d00 R14: ffff96caa9ec3d28 R15: ffff96caa9ec3d40
      FS:  00007fbc7c4e2740(0000) GS:ffff96caabc00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000000 CR3: 0000000129d58000 CR4: 00000000000006f0
      Call Trace:
       ? cp_new_stat+0x12d/0x160
       hwmon_attr_show_string+0x37/0x70 [hwmon]
       dev_attr_show+0x14/0x50
       sysfs_kf_seq_show+0xb5/0x1b0
       seq_read+0xcf/0x460
       vfs_read+0x9b/0x150
       ksys_read+0x5f/0xe0
       do_syscall_64+0x48/0x190
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      ...
      
      Temperature labels are not always present. Adjust sysfs attribute
      visibility accordingly.
      
      Reported-by: default avatarMeelis Roos <mroos@linux.ee>
      Suggested-by: default avatarDr. David Alan Gilbert <linux@treblig.org>
      Reviewed-by: default avatarDr. David Alan Gilbert <linux@treblig.org>
      Cc: Meelis Roos <mroos@linux.ee>
      Cc: Dr. David Alan Gilbert <linux@treblig.org>
      Fixes: 266cd583 ("hwmon: (w83627ehf) convert to with_info interface")
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      e61d2392
    • Logan Gunthorpe's avatar
      nvme-multipath: Fix memory leak with ana_log_buf · 3b783090
      Logan Gunthorpe authored
      
      kmemleak reports a memory leak with the ana_log_buf allocated by
      nvme_mpath_init():
      
      unreferenced object 0xffff888120e94000 (size 8208):
        comm "nvme", pid 6884, jiffies 4295020435 (age 78786.312s)
          hex dump (first 32 bytes):
            00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
            01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
          backtrace:
            [<00000000e2360188>] kmalloc_order+0x97/0xc0
            [<0000000079b18dd4>] kmalloc_order_trace+0x24/0x100
            [<00000000f50c0406>] __kmalloc+0x24c/0x2d0
            [<00000000f31a10b9>] nvme_mpath_init+0x23c/0x2b0
            [<000000005802589e>] nvme_init_identify+0x75f/0x1600
            [<0000000058ef911b>] nvme_loop_configure_admin_queue+0x26d/0x280
            [<00000000673774b9>] nvme_loop_create_ctrl+0x2a7/0x710
            [<00000000f1c7a233>] nvmf_dev_write+0xc66/0x10b9
            [<000000004199f8d0>] __vfs_write+0x50/0xa0
            [<0000000065466fef>] vfs_write+0xf3/0x280
            [<00000000b0db9a8b>] ksys_write+0xc6/0x160
            [<0000000082156b91>] __x64_sys_write+0x43/0x50
            [<00000000c34fbb6d>] do_syscall_64+0x77/0x2f0
            [<00000000bbc574c9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      nvme_mpath_init() is called by nvme_init_identify() which is called in
      multiple places (nvme_reset_work(), nvme_passthru_end(), etc). This
      means nvme_mpath_init() may be called multiple times before
      nvme_mpath_uninit() (which is only called on nvme_free_ctrl()).
      
      When nvme_mpath_init() is called multiple times, it overwrites the
      ana_log_buf pointer with a new allocation, thus leaking the previous
      allocation.
      
      To fix this, free ana_log_buf before allocating a new one.
      
      Fixes: 0d0b660f ("nvme: add ANA support")
      Cc: <stable@vger.kernel.org>
      Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarLogan Gunthorpe <logang@deltatee.com>
      Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
      3b783090
    • Vasundhara Volam's avatar
      bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs. · 8743db4a
      Vasundhara Volam authored
      
      If crashed kernel does not shutdown the NIC properly, PCIe FLR
      is required in the kdump kernel in order to initialize all the
      functions properly.
      
      Fixes: d629522e ("bnxt_en: Reduce memory usage when running in kdump kernel.")
      Signed-off-by: default avatarVasundhara Volam <vasundhara-v.volam@broadcom.com>
      Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8743db4a
    • Vasundhara Volam's avatar
      bnxt_en: Improve device shutdown method. · 5567ae4a
      Vasundhara Volam authored
      
      Especially when bnxt_shutdown() is called during kexec, we need to
      disable MSIX and disable Bus Master to completely quiesce the device.
      Make these 2 calls unconditionally in the shutdown method.
      
      Fixes: c20dc142 ("bnxt_en: Disable bus master during PCI shutdown and driver unload.")
      Signed-off-by: default avatarVasundhara Volam <vasundhara-v.volam@broadcom.com>
      Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5567ae4a
  7. Feb 20, 2020
    • Tim Harvey's avatar
      net: thunderx: workaround BGX TX Underflow issue · 971617c3
      Tim Harvey authored
      
      While it is not yet understood why a TX underflow can easily occur
      for SGMII interfaces resulting in a TX wedge. It has been found that
      disabling/re-enabling the LMAC resolves the issue.
      
      Signed-off-by: default avatarTim Harvey <tharvey@gateworks.com>
      Reviewed-by: default avatarRobert Jones <rjones@gateworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      971617c3
    • Shannon Nelson's avatar
      ionic: fix fw_status read · 68b759a7
      Shannon Nelson authored
      
      The fw_status field is only 8 bits, so fix the read.  Also,
      we only want to look at the one status bit, to allow for future
      use of the other bits, and watch for a bad PCI read.
      
      Fixes: 97ca4865 ("ionic: add heartbeat check")
      Signed-off-by: default avatarShannon Nelson <snelson@pensando.io>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      68b759a7
    • Alexandre Belloni's avatar
      net: macb: Properly handle phylink on at91rm9200 · ac2fcfa9
      Alexandre Belloni authored
      
      at91ether_init was handling the phy mode and speed but since the switch to
      phylink, the NCFGR register got overwritten by macb_mac_config(). The issue
      is that the RM9200_RMII bit and the MACB_CLK_DIV32 field are cleared
      but never restored as they conflict with the PAE, GBE and PCSSEL bits.
      
      Add new capability to differentiate between EMAC and the other versions of
      the IP and use it to set and avoid clearing the relevant bits.
      
      Also, this fixes a NULL pointer dereference in macb_mac_link_up as the EMAC
      doesn't use any rings/bufffers/queues.
      
      Fixes: 7897b071 ("net: macb: convert to phylink")
      Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ac2fcfa9
    • Thomas Gleixner's avatar
      xen: Enable interrupts when calling _cond_resched() · 8645e56a
      Thomas Gleixner authored
      
      xen_maybe_preempt_hcall() is called from the exception entry point
      xen_do_hypervisor_callback with interrupts disabled.
      
      _cond_resched() evades the might_sleep() check in cond_resched() which
      would have caught that and schedule_debug() unfortunately lacks a check
      for irqs_disabled().
      
      Enable interrupts around the call and use cond_resched() to catch future
      issues.
      
      Fixes: fdfd811d ("x86/xen: allow privcmd hypercalls to be preempted")
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Link: https://lore.kernel.org/r/878skypjrh.fsf@nanos.tec.linutronix.de
      
      
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      8645e56a
    • Julian Wiedmann's avatar
      s390/qeth: fix off-by-one in RX copybreak check · 54a61fbc
      Julian Wiedmann authored
      
      The RX copybreak is intended as the _max_ value where the frame's data
      should be copied. So for frame_len == copybreak, don't build an SG skb.
      
      Fixes: 4a71df50 ("qeth: new qeth device driver")
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      54a61fbc
    • Julian Wiedmann's avatar
      s390/qeth: don't warn for napi with 0 budget · 420579db
      Julian Wiedmann authored
      
      Calling napi->poll() with 0 budget is a legitimate use by netpoll.
      
      Fixes: a1c3ed4c ("qeth: NAPI support for l2 and l3 discipline")
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      420579db
    • Alexandra Winter's avatar
      s390/qeth: vnicc Fix EOPNOTSUPP precedence · 6f3846f0
      Alexandra Winter authored
      
      When getting or setting VNICC parameters, the error code EOPNOTSUPP
      should have precedence over EBUSY.
      
      EBUSY is used because vnicc feature and bridgeport feature are mutually
      exclusive, which is a temporary condition.
      Whereas EOPNOTSUPP indicates that the HW does not support all or parts of
      the vnicc feature.
      This issue causes the vnicc sysfs params to show 'blocked by bridgeport'
      for HW that does not support VNICC at all.
      
      Fixes: caa1f0b1 ("s390/qeth: add VNICC enable/disable support")
      Signed-off-by: default avatarAlexandra Winter <wintera@linux.ibm.com>
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6f3846f0
    • Guenter Roeck's avatar
      hwmon: (acpi_power_meter) Fix lockdep splat · badcd454
      Guenter Roeck authored
      
      Damien Le Moal reports a lockdep splat with the acpi_power_meter,
      observed with Linux v5.5 and later.
      
      ======================================================
      WARNING: possible circular locking dependency detected
      5.6.0-rc2+ #629 Not tainted
      ------------------------------------------------------
      python/1397 is trying to acquire lock:
      ffff888619080070 (&resource->lock){+.+.}, at: show_power+0x3c/0xa0 [acpi_power_meter]
      
                     but task is already holding lock:
      ffff88881643f188 (kn->count#119){++++}, at: kernfs_seq_start+0x6a/0x160
      
                     which lock already depends on the new lock.
      
                     the existing dependency chain (in reverse order) is:
      
                     -> #1 (kn->count#119){++++}:
             __kernfs_remove+0x626/0x7e0
             kernfs_remove_by_name_ns+0x41/0x80
             remove_attrs+0xcb/0x3c0 [acpi_power_meter]
             acpi_power_meter_notify+0x1f7/0x310 [acpi_power_meter]
             acpi_ev_notify_dispatch+0x198/0x1f3
             acpi_os_execute_deferred+0x4d/0x70
             process_one_work+0x7c8/0x1340
             worker_thread+0x94/0xc70
             kthread+0x2ed/0x3f0
             ret_from_fork+0x24/0x30
      
                     -> #0 (&resource->lock){+.+.}:
             __lock_acquire+0x20be/0x49b0
             lock_acquire+0x127/0x340
             __mutex_lock+0x15b/0x1350
             show_power+0x3c/0xa0 [acpi_power_meter]
             dev_attr_show+0x3f/0x80
             sysfs_kf_seq_show+0x216/0x410
             seq_read+0x407/0xf90
             vfs_read+0x152/0x2c0
             ksys_read+0xf3/0x1d0
             do_syscall_64+0x95/0x1010
             entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
                     other info that might help us debug this:
      
       Possible unsafe locking scenario:
      
             CPU0                    CPU1
             ----                    ----
        lock(kn->count#119);
                                     lock(&resource->lock);
                                     lock(kn->count#119);
        lock(&resource->lock);
      
                      *** DEADLOCK ***
      4 locks held by python/1397:
       #0: ffff8890242d64e0 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x9b/0xb0
       #1: ffff889040be74e0 (&p->lock){+.+.}, at: seq_read+0x6b/0xf90
       #2: ffff8890448eb880 (&of->mutex){+.+.}, at: kernfs_seq_start+0x47/0x160
       #3: ffff88881643f188 (kn->count#119){++++}, at: kernfs_seq_start+0x6a/0x160
      
                     stack backtrace:
      CPU: 10 PID: 1397 Comm: python Not tainted 5.6.0-rc2+ #629
      Hardware name: Supermicro Super Server/X11DPL-i, BIOS 3.1 05/21/2019
      Call Trace:
       dump_stack+0x97/0xe0
       check_noncircular+0x32e/0x3e0
       ? print_circular_bug.isra.0+0x1e0/0x1e0
       ? unwind_next_frame+0xb9a/0x1890
       ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
       ? graph_lock+0x79/0x170
       ? __lockdep_reset_lock+0x3c0/0x3c0
       ? mark_lock+0xbc/0x1150
       __lock_acquire+0x20be/0x49b0
       ? mark_held_locks+0xe0/0xe0
       ? stack_trace_save+0x91/0xc0
       lock_acquire+0x127/0x340
       ? show_power+0x3c/0xa0 [acpi_power_meter]
       ? device_remove_bin_file+0x10/0x10
       ? device_remove_bin_file+0x10/0x10
       __mutex_lock+0x15b/0x1350
       ? show_power+0x3c/0xa0 [acpi_power_meter]
       ? show_power+0x3c/0xa0 [acpi_power_meter]
       ? mutex_lock_io_nested+0x11f0/0x11f0
       ? lock_downgrade+0x6a0/0x6a0
       ? kernfs_seq_start+0x47/0x160
       ? lock_acquire+0x127/0x340
       ? kernfs_seq_start+0x6a/0x160
       ? device_remove_bin_file+0x10/0x10
       ? show_power+0x3c/0xa0 [acpi_power_meter]
       show_power+0x3c/0xa0 [acpi_power_meter]
       dev_attr_show+0x3f/0x80
       ? memset+0x20/0x40
       sysfs_kf_seq_show+0x216/0x410
       seq_read+0x407/0xf90
       ? security_file_permission+0x16f/0x2c0
       vfs_read+0x152/0x2c0
      
      Problem is that reading an attribute takes the kernfs lock in the kernfs
      code, then resource->lock in the driver. During an ACPI notification, the
      opposite happens: The resource lock is taken first, followed by the kernfs
      lock when sysfs attributes are removed and re-created. Presumably this is
      now seen due to some locking related changes in kernfs after v5.4, but it
      was likely always a problem.
      
      Fix the problem by not blindly acquiring the lock in the notification
      function. It is only needed to protect the various update functions.
      However, those update functions are called anyway when sysfs attributes
      are read. This means that we can just stop calling those functions from
      the notifier, and the resource lock in the notifier function is no longer
      needed.
      
      That leaves two situations:
      
      First, METER_NOTIFY_CONFIG removes and re-allocates capability strings.
      While it did so under the resource lock, _displaying_ those strings was not
      protected, creating a race condition. To solve this problem, selectively
      protect both removal/creation and reporting of capability attributes with
      the resource lock.
      
      Second, removing and re-creating the attribute files is no longer protected
      by the resource lock. That doesn't matter since access to each individual
      attribute is protected by the kernfs lock. Userspace may get messed up if
      attributes disappear and reappear under its nose, but that is not different
      than today, and there is nothing we can do about it without major driver
      restructuring.
      
      Last but not least, when removing the driver, remove attribute functions
      first, then release capability strings. This avoids yet another race
      condition.
      
      Reported-by: default avatarDamien Le Moal <Damien.LeMoal@wdc.com>
      Cc: Damien Le Moal <Damien.LeMoal@wdc.com>
      Cc: stable@vger.kernel.org # v5.5+
      Tested-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      badcd454
  8. Feb 19, 2020
Loading