linux-stable.git/drivers, branch v5.10.76

pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()

2021-10-27T07:56:56+00:00

commit c370bb474016ab9edfdabd7c08a88dd13a71ddbd upstream.

When resuming from low power, the driver attempts to restore the
configuration of some pins. This is done by a call to:
  stm32_pinctrl_restore_gpio_regs(struct stm32_pinctrl *pctl, u32 pin)
where 'pin' must be a valid pin value (i.e. matching some 'groups->pin').
Fix the current implementation which uses some wrong 'pin' value.

Fixes: e2f3cf18c3e2 ("pinctrl: stm32: add suspend/resume management")
Signed-off-by: Fabien Dessenne 
Link: https://lore.kernel.org/r/20211008122517.617633-1-fabien.dessenne@foss.st.com
Signed-off-by: Linus Walleij 
Signed-off-by: Greg Kroah-Hartman

e1000e: Separate TGP board type from SPT

2021-10-27T07:56:56+00:00

[ Upstream commit 280db5d420090a24e4e41f9ddcbf37920a598572 ]

We have the same LAN controller on different PCHs. Separate TGP board
type from SPT which will allow for specific fixes to be applied for
TGP platforms.

Suggested-by: Kai-Heng Feng 
Signed-off-by: Sasha Neftin 
Reviewed-by: Paul Menzel 
Tested-by: Mark Pearson 
Tested-by: Nechama Kraus 
Signed-off-by: Tony Nguyen 
Signed-off-by: Sasha Levin

net: mdiobus: Fix memory leak in __mdiobus_register

2021-10-27T07:56:56+00:00

commit ab609f25d19858513919369ff3d9a63c02cd9e2e upstream.

Once device_register() failed, we should call put_device() to
decrement reference count for cleanup. Or it will cause memory
leak.

BUG: memory leak
unreferenced object 0xffff888114032e00 (size 256):
  comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff  ................
    08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff  .........ve.....
  backtrace:
    [] kmalloc include/linux/slab.h:591 [inline]
    [] kzalloc include/linux/slab.h:721 [inline]
    [] device_private_init drivers/base/core.c:3203 [inline]
    [] device_add+0x89b/0xdf0 drivers/base/core.c:3253
    [] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
    [] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
    [] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
    [] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
    [] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
    [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [] call_driver_probe drivers/base/dd.c:517 [inline]
    [] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
    [] really_probe drivers/base/dd.c:558 [inline]
    [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
    [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
    [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
    [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [] __device_attach+0x122/0x260 drivers/base/dd.c:969
    [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
    [] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
    [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238

BUG: memory leak
unreferenced object 0xffff888116f06900 (size 32):
  comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
  hex dump (first 32 bytes):
    75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00  usb-001:003.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kstrdup+0x36/0x70 mm/util.c:60
    [] kstrdup_const+0x53/0x80 mm/util.c:83
    [] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
    [] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
    [] dev_set_name+0x63/0x90 drivers/base/core.c:3147
    [] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
    [] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
    [] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
    [] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
    [] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
    [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [] call_driver_probe drivers/base/dd.c:517 [inline]
    [] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
    [] really_probe drivers/base/dd.c:558 [inline]
    [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
    [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
    [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
    [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [] __device_attach+0x122/0x260 drivers/base/dd.c:969

Reported-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com
Signed-off-by: Yanfei Xu 
Reviewed-by: Andrew Lunn 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

s390/pci: fix zpci_zdev_put() on reserve

2021-10-27T07:56:56+00:00

commit a46044a92add6a400f4dada7b943b30221f7cc80 upstream.

Since commit 2a671f77ee49 ("s390/pci: fix use after free of zpci_dev")
the reference count of a zpci_dev is incremented between
pcibios_add_device() and pcibios_release_device() which was supposed to
prevent the zpci_dev from being freed while the common PCI code has
access to it. It was missed however that the handling of zPCI
availability events assumed that once zpci_zdev_put() was called no
later availability event would still see the device. With the previously
mentioned commit however this assumption no longer holds and we must
make sure that we only drop the initial long-lived reference the zPCI
subsystem holds exactly once.

Do so by introducing a zpci_device_reserved() function that handles when
a device is reserved. Here we make sure the zpci_dev will not be
considered for further events by removing it from the zpci_list.

This also means that the device actually stays in the
ZPCI_FN_STATE_RESERVED state between the time we know it has been
reserved and the final reference going away. We thus need to consider it
a real state instead of just a conceptual state after the removal. The
final cleanup of PCI resources, removal from zbus, and destruction of
the IOMMU stays in zpci_release_device() to make sure holders of the
reference do see valid data until the release.

Fixes: 2a671f77ee49 ("s390/pci: fix use after free of zpci_dev")
Cc: stable@vger.kernel.org
Signed-off-by: Niklas Schnelle 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Greg Kroah-Hartman

scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()

2021-10-27T07:56:56+00:00

commit 50b6cb3516365cb69753b006be2b61c966b70588 upstream.

After commit ea2f0f77538c ("scsi: core: Cap scsi_host cmd_per_lun at
can_queue"), a 416-CPU VM running on Hyper-V hangs during boot because the
hv_storvsc driver sets scsi_driver.can_queue to an integer value that
exceeds SHRT_MAX, and hence scsi_add_host_with_dma() sets
shost->cmd_per_lun to a negative "short" value.

Use min_t(int, ...) to work around the issue.

Link: https://lore.kernel.org/r/20211008043546.6006-1-decui@microsoft.com
Fixes: ea2f0f77538c ("scsi: core: Cap scsi_host cmd_per_lun at can_queue")
Cc: stable@vger.kernel.org
Reviewed-by: Haiyang Zhang 
Reviewed-by: Ming Lei 
Reviewed-by: John Garry 
Signed-off-by: Dexuan Cui 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

net: hns3: fix for miscalculation of rx unused desc

2021-10-27T07:56:55+00:00

[ Upstream commit 9f9f0f19994b42b3e5e8735d41b9c5136828a76c ]

rx unused desc is the desc that need attatching new buffer
before refilling to hw to receive new packet, the number of
desc need attatching new buffer is calculated using next_to_use
and next_to_clean. when next_to_use == next_to_clean, currently
hns3 driver assumes that all the desc has the buffer attatched,
but 'next_to_use == next_to_clean' also means all the desc need
attatching new buffer if hw has comsumed all the desc and the
driver has not attatched any buffer to the desc yet.

This patch adds 'refill' in desc_cb to indicate whether a new
buffer has been refilled to a desc.

Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Yunsheng Lin 
Signed-off-by: Guangbin Huang 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()

2021-10-27T07:56:55+00:00

[ Upstream commit 7fb223d0ad801f633c78cbe42b1d1b55f5d163ad ]

Commit 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of
qla2x00_process_els()"), intended to change:

        bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN

to:

        bsg_job->request->msgcode != FC_BSG_RPT_ELS

but changed it to:

        bsg_job->request->msgcode == FC_BSG_RPT_ELS

instead.

Change the == to a != to avoid leaking the fcport structure or freeing
unallocated memory.

Link: https://lore.kernel.org/r/20211012191834.90306-2-jgu@purestorage.com
Fixes: 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()")
Reviewed-by: Bart Van Assche 
Signed-off-by: Joy Gu 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: iscsi: Fix set_param() handling

2021-10-27T07:56:55+00:00

[ Upstream commit 187a580c9e7895978dcd1e627b9c9e7e3d13ca96 ]

In commit 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and
sync thread") we meant to add a check where before we call ->set_param() we
make sure the iscsi_cls_connection is bound. The problem is that between
versions 4 and 5 of the patch the deletion of the unchecked set_param()
call was dropped so we ended up with 2 calls. As a result we can still hit
a crash where we access the unbound connection on the first call.

This patch removes that first call.

Fixes: 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and sync thread")
Link: https://lore.kernel.org/r/20211010161904.60471-1-michael.christie@oracle.com
Reviewed-by: Lee Duncan 
Reviewed-by: Li Feng 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

Input: snvs_pwrkey - add clk handling

2021-10-27T07:56:55+00:00

[ Upstream commit d997cc1715df7b6c3df798881fb9941acf0079f8 ]

On i.MX7S and i.MX8M* (but not i.MX6*) the pwrkey device has an
associated clock. Accessing the registers requires that this clock is
enabled. Binding the driver on at least i.MX7S and i.MX8MP while not
having the clock enabled results in a complete hang of the machine.
(This usually only happens if snvs_pwrkey is built as a module and the
rtc-snvs driver isn't already bound because at bootup the required clk
is on and only gets disabled when the clk framework disables unused clks
late during boot.)

This completes the fix in commit 135be16d3505 ("ARM: dts: imx7s: add
snvs clock to pwrkey").

Signed-off-by: Uwe Kleine-König 
Link: https://lore.kernel.org/r/20211013062848.2667192-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

platform/x86: intel_scu_ipc: Update timeout value in comment

2021-10-27T07:56:55+00:00

[ Upstream commit a0c5814b9933f25ecb6de169483c5b88cf632bca ]

The comment decribing the IPC timeout hadn't been updated when the
actual timeout was changed from 3 to 5 seconds in
commit a7d53dbbc70a ("platform/x86: intel_scu_ipc: Increase virtual
timeout from 3 to 5 seconds") .

Since the value is anyway updated to 10s now, take this opportunity to
update the value in the comment too.

Signed-off-by: Prashant Malani 
Cc: Benson Leung 
Reviewed-by: Mika Westerberg 
Link: https://lore.kernel.org/r/20210928101932.2543937-4-pmalani@chromium.org
Signed-off-by: Hans de Goede 
Signed-off-by: Sasha Levin