linux.git/drivers/staging, branch v5.13

Merge tag 'net-5.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2021-06-19T01:55:29+00:00

Pull networking fixes from Jakub Kicinski:
 "Networking fixes for 5.13-rc7, including fixes from wireless, bpf,
  bluetooth, netfilter and can.

  Current release - regressions:

   - mlxsw: spectrum_qdisc: Pass handle, not band number to find_class()
     to fix modifying offloaded qdiscs

   - lantiq: net: fix duplicated skb in rx descriptor ring

   - rtnetlink: fix regression in bridge VLAN configuration, empty info
     is not an error, bot-generated "fix" was not needed

   - libbpf: s/rx/tx/ typo on umem->rx_ring_setup_done to fix umem
     creation

  Current release - new code bugs:

   - ethtool: fix NULL pointer dereference during module EEPROM dump via
     the new netlink API

   - mlx5e: don't update netdev RQs with PTP-RQ, the special purpose
     queue should not be visible to the stack

   - mlx5e: select special PTP queue only for SKBTX_HW_TSTAMP skbs

   - mlx5e: verify dev is present in get devlink port ndo, avoid a panic

  Previous releases - regressions:

   - neighbour: allow NUD_NOARP entries to be force GCed

   - further fixes for fallout from reorg of WiFi locking (staging:
     rtl8723bs, mac80211, cfg80211)

   - skbuff: fix incorrect msg_zerocopy copy notifications

   - mac80211: fix NULL ptr deref for injected rate info

   - Revert "net/mlx5: Arm only EQs with EQEs" it may cause missed IRQs

  Previous releases - always broken:

   - bpf: more speculative execution fixes

   - netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local

   - udp: fix race between close() and udp_abort() resulting in a panic

   - fix out of bounds when parsing TCP options before packets are
     validated (in netfilter: synproxy, tc: sch_cake and mptcp)

   - mptcp: improve operation under memory pressure, add missing
     wake-ups

   - mptcp: fix double-lock/soft lookup in subflow_error_report()

   - bridge: fix races (null pointer deref and UAF) in vlan tunnel
     egress

   - ena: fix DMA mapping function issues in XDP

   - rds: fix memory leak in rds_recvmsg

  Misc:

   - vrf: allow larger MTUs

   - icmp: don't send out ICMP messages with a source address of 0.0.0.0

   - cdc_ncm: switch to eth%d interface naming"

* tag 'net-5.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (139 commits)
  net: ethernet: fix potential use-after-free in ec_bhf_remove
  selftests/net: Add icmp.sh for testing ICMP dummy address responses
  icmp: don't send out ICMP messages with a source address of 0.0.0.0
  net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
  net: ll_temac: Fix TX BD buffer overwrite
  net: ll_temac: Add memory-barriers for TX BD access
  net: ll_temac: Make sure to free skb when it is completely used
  MAINTAINERS: add Guvenc as SMC maintainer
  bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path
  bnxt_en: Fix TQM fastpath ring backing store computation
  bnxt_en: Rediscover PHY capabilities after firmware reset
  cxgb4: fix wrong shift.
  mac80211: handle various extensible elements correctly
  mac80211: reset profile_periodicity/ema_ap
  cfg80211: avoid double free of PMSR request
  cfg80211: make certificate generation more robust
  mac80211: minstrel_ht: fix sample time check
  net: qed: Fix memcpy() overflow of qed_dcbx_params()
  net: cdc_eem: fix tx fixup skb leak
  net: hamradio: fix memory leak in mkiss_close
  ...

staging: ralink-gdma: Remove incorrect author information

2021-06-09T10:07:52+00:00

Lars did not write the ralink-gdma driver. Looks like his name just got
copy&pasted from another similar DMA driver. Remove his name from the
copyright and MODULE_AUTHOR.

Signed-off-by: Lars-Peter Clausen 
Link: https://lore.kernel.org/r/20210607100119.26983-1-lars@metafoo.de
Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: Fix uninitialized variables

2021-06-09T10:06:19+00:00

The sinfo.pertid and sinfo.generation variables are not initialized and
it causes a crash when we use this as a wireless access point.

[  456.873025] ------------[ cut here ]------------
[  456.878198] kernel BUG at mm/slub.c:3968!
[  456.882680] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM

  [ snip ]

[  457.271004] Backtrace:
[  457.273733] [] (kfree) from [] (nl80211_send_station+0x954/0xfc4)
[  457.282481]  r9:eccca0c0 r8:e8edfec0 r7:00000000 r6:00000011 r5:e80a9480 r4:e8edfe00
[  457.291132] [] (nl80211_send_station) from [] (cfg80211_new_sta+0x90/0x1cc)
[  457.300850]  r10:e80a9480 r9:e8edfe00 r8:ea678cca r7:00000a20 r6:00000000 r5:ec46d000
[  457.309586]  r4:ec46d9e0
[  457.312433] [] (cfg80211_new_sta) from [] (rtw_cfg80211_indicate_sta_assoc+0x80/0x9c [r8723bs])
[  457.324095]  r10:00009930 r9:e85b9d80 r8:bf091050 r7:00000000 r6:00000000 r5:0000001c
[  457.332831]  r4:c1606788
[  457.335692] [] (rtw_cfg80211_indicate_sta_assoc [r8723bs]) from [] (rtw_stassoc_event_callback+0x1c8/0x1d4 [r8723bs])
[  457.349489]  r7:ea678cc0 r6:000000a1 r5:f1225f84 r4:f086b000
[  457.355845] [] (rtw_stassoc_event_callback [r8723bs]) from [] (mlme_evt_hdl+0x8c/0xb4 [r8723bs])
[  457.367601]  r7:c1604900 r6:f086c4b8 r5:00000000 r4:f086c000
[  457.373959] [] (mlme_evt_hdl [r8723bs]) from [] (rtw_cmd_thread+0x198/0x3d8 [r8723bs])
[  457.384744]  r5:f086e000 r4:f086c000
[  457.388754] [] (rtw_cmd_thread [r8723bs]) from [] (kthread+0x170/0x174)
[  457.398083]  r10:ed7a57e8 r9:bf0367a4 r8:f086b000 r7:e8ede000 r6:00000000 r5:e9975200
[  457.406828]  r4:e8369900
[  457.409653] [] (kthread) from [] (ret_from_fork+0x14/0x2c)
[  457.417718] Exception stack(0xe8edffb0 to 0xe8edfff8)
[  457.423356] ffa0:                                     00000000 00000000 00000000 00000000
[  457.432492] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  457.441618] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  457.449006]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c014a0a4
[  457.457750]  r4:e9975200
[  457.460574] Code: 1a000003 e5953004 e3130001 1a000000 (e7f001f2)
[  457.467381] ---[ end trace 4acbc8c15e9e6aa7 ]---

Link: https://forum.armbian.com/topic/14727-wifi-ap-kernel-bug-in-kernel-5444/
Fixes: 8689c051a201 ("cfg80211: dynamically allocate per-tid stats for station info")
Fixes: f5ea9120be2e ("nl80211: add generation number to all dumps")
Signed-off-by: Wenli Looi 
Reviewed-by: Dan Carpenter 
Cc: stable 
Link: https://lore.kernel.org/r/20210608064620.74059-1-wlooi@ucalgary.ca
Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: fix monitor netdev register/unregister

2021-05-31T19:27:15+00:00

Due to the locking changes and callbacks happening inside
cfg80211, we need to use cfg80211 versions of the register
and unregister functions if called within cfg80211 methods,
otherwise deadlocks occur.

Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver")
Acked-by: Greg Kroah-Hartman 
Link: https://lore.kernel.org/r/20210426212801.3d902cc9e6f4.Ie0b1e0c545920c61400a4b7d0f384ea61feb645a@changeid
Signed-off-by: Johannes Berg

Merge tag 'iio-fixes-5.13b-take2' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

2021-05-22T07:49:59+00:00

Jonathan writes:

Second set of IIO fixes for the 5.13 cycle

A mixed bag of fixes for various drivers.
Changes since take 1: Fixed a ; in a tag.

adi,ad7124
 - Fix miss balanced regulator enable / disable in error path
 - Fix potential overflow with non sequential channel numbers from dt.
adi,ad7192
 - Avoid disabling clock that was never enabled in error path + remove
 - Avoid nasty corner case if regulator voltage is 0 that would result
   in a good return half way through probe.
adi,ad7746
 - Avoid overwriting num_channels just after setting it correctly.
adi,ad7768
 - Buffer passed to iio_push_to_buffers_with_timestamp() too small and
   not aligned appropriately.
adi,ad7793
 - Missing return code setting in an error path.
adi,ad7923
 - Buffer too small after support for more channels added.
adi,ad5770r
 - Missing fwnode_handle_put in error paths.
fsl,fxa21002c
 - Missing runtime pm put in error path.

* tag 'iio-fixes-5.13b-take2' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
  iio: adc: ad7793: Add missing error code in ad7793_setup()
  iio: adc: ad7923: Fix undersized rx buffer.
  iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp()
  iio: dac: ad5770r: Put fwnode in error case during ->probe()
  iio: gyro: fxas21002c: balance runtime power in error path
  staging: iio: cdc: ad7746: avoid overwrite of num_channels
  iio: adc: ad7192: handle regulator voltage error first
  iio: adc: ad7192: Avoid disabling a clock that was never enabled.
  iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers
  iio: adc: ad7124: Fix missbalanced regulator enable / disable on error.

staging: emxx_udc: fix loop in _nbu2ss_nuke()

2021-05-20T15:18:35+00:00

The _nbu2ss_ep_done() function calls:

	list_del_init(&req->queue);

which means that the loop will never exit.

Fixes: ca3d253eb967 ("Staging: emxx_udc: Iterate list using list_for_each_entry")
Signed-off-by: Dan Carpenter 
Link: https://lore.kernel.org/r/YKUd0sDyjm/lkJfJ@mwanda
Signed-off-by: Greg Kroah-Hartman

staging: iio: cdc: ad7746: avoid overwrite of num_channels

2021-05-13T15:50:08+00:00

AD7745 devices don't have the CIN2 pins and therefore can't handle related
channels. Forcing the number of AD7746 channels may lead to enabling more
channels than what the hardware actually supports.
Avoid num_channels being overwritten after first assignment.

Signed-off-by: Lucas Stankus 
Fixes: 83e416f458d53 ("staging: iio: adc: Replace, rewrite ad7745 from scratch.")
Signed-off-by: Jonathan Cameron 
Cc:

staging: rtl8723bs: avoid bogus gcc warning

2021-05-10T12:26:24+00:00

gcc gets confused by some of the type casts and produces an
apparently senseless warning about an out-of-bound memcpy to
an unrelated array in the same structure:

drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c: In function 'rtw_cfg80211_ap_set_encryption':
cc1: error: writing 8 bytes into a region of size 0 [-Werror=stringop-overflow=]
In file included from drivers/staging/rtl8723bs/include/drv_types.h:32,
                 from drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:10:
drivers/staging/rtl8723bs/include/rtw_security.h:98:15: note: at offset [184, 4264] into destination object 'dot11AuthAlgrthm' of size 4
   98 |         u32   dot11AuthAlgrthm;         /*  802.11 auth, could be open, shared, 8021x and authswitch */
      |               ^~~~~~~~~~~~~~~~
cc1: error: writing 8 bytes into a region of size 0 [-Werror=stringop-overflow=]
drivers/staging/rtl8723bs/include/rtw_security.h:98:15: note: at offset [264, 4344] into destination object 'dot11AuthAlgrthm' of size 4

This is a known gcc bug, and the patch here is only a workaround,
but the approach of using a temporary variable to hold a pointer
to the key also improves readability in addition to avoiding the
warning, so overall this should still help.

Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99673
Signed-off-by: Arnd Bergmann 
Link: https://lore.kernel.org/r/20210422152648.2891996-1-arnd@kernel.org
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'drm-next-2021-04-30' of git://anongit.freedesktop.org/drm/drm

2021-04-30T19:44:02+00:00

Pull more drm updates from Dave Airlie:
 "Looks like I missed a tegra feature request for next, but should still
  be fine since it's pretty self contained.

  Apart from that got a set of i915 and amdgpu fixes as per usual along
  with a few misc fixes.

  tegra:
   - Tegra186 hardware cursor support
   - better capability reporting for different SoC
   - better framebuffer modifier support
   - host1x fixes

  ttm:
   - fix unswappable BO handling

  efifb:
   - check for PCI before using it

  amdgpu:
   - Fixes for Aldebaran
   - Display LTTPR fixes
   - eDP fixes
   - Fixes for Vangogh
   - RAS fixes
   - ASPM support
   - Renoir SMU fixes
   - Modifier fixes
   - Misc code cleanups
   - Freesync fixes

  i915:
   - Several fixes to GLK handling in recent display refactoring
   - Rare watchdog timer race fix
   - Cppcheck redundant condition fix
   - Overlay error code propagation fix
   - Documentation fix
   - gvt: Remove one unused function warning
   - gvt: Fix intel_gvt_init_device() return type
   - gvt: Remove one duplicated register accessible check"

* tag 'drm-next-2021-04-30' of git://anongit.freedesktop.org/drm/drm: (111 commits)
  efifb: Check efifb_pci_dev before using it
  drm/i915: Fix docbook descriptions for i915_gem_shrinker
  drm/i915: fix an error code in intel_overlay_do_put_image()
  drm/i915/display/psr: Fix cppcheck warnings
  drm/i915: Disable LTTPR detection on GLK once again
  drm/i915: Restore lost glk ccs w/a
  drm/i915: Restore lost glk FBC 16bpp w/a
  drm/i915: Take request reference before arming the watchdog timer
  drm/ttm: fix error handling if no BO can be swapped out v4
  drm/i915/gvt: Remove duplicated register accessible check
  drm/amdgpu/gmc9: remove dummy read workaround for newer chips
  drm/amdgpu: Add mem sync flag for IB allocated by SA
  drm/amdgpu: Fix SDMA RAS error reporting on Aldebaran
  drm/amdgpu: Reset RAS error count and status regs
  Revert "drm/amdgpu: workaround the TMR MC address issue (v2)"
  drm/amd/display: 3.2.132
  drm/amd/display: [FW Promotion] Release 0.0.62
  drm/amd/display: add helper for enabling mst stream features
  drm/amd/display: Report Proper Quantization Range in AVI Infoframe
  drm/amd/display: Fix call to pass bpp in 16ths of a bit
  ...

Merge tag 'drm/tegra/for-5.13-rc1' of ssh://git.freedesktop.org/git/tegra/linux into drm-next

2021-04-29T23:57:07+00:00

drm/tegra: Changes for v5.13-rc1

The changes this time around contain a couple of fixes for host1x along
with some improvements for Tegra DRM. Most notably the Tegra DRM driver
now supports the hardware cursor on Tegra186 and later, more correctly
reflects the capabilities of the display pipelines on various Tegra SoC
generations and knows how to deal with the dGPU sector layout by using
framebuffer modifiers.

Signed-off-by: Dave Airlie 

From: Thierry Reding 
Link: https://patchwork.freedesktop.org/patch/msgid/20210401164430.3349105-1-thierry.reding@gmail.com