In gb_interface_create, &intf->mode_switch_completion is bound with
gb_interface_mode_switch_work. Then it will be started by
gb_interface_request_mode_switch. Here is the relevant code.
if (!queue_work(system_long_wq, &intf->mode_switch_work)) {
...
}
If we call gb_interface_release to make cleanup, there may be an
unfinished work. This function will call kfree to free the object
"intf". However, if gb_interface_mode_switch_work is scheduled to
run after kfree, it may cause use-after-free error as
gb_interface_mode_switch_work will use the object "intf".
The possible execution flow that may lead to the issue is as follows:
CPU0 CPU1
| gb_interface_create
| gb_interface_request_mode_switch
gb_interface_release |
kfree(intf) (free) |
| gb_interface_mode_switch_work
| mutex_lock(&intf->mutex) (use)
Fix it by canceling the work before kfree.
Signed-off-by: Sicong Huang <congei42@163.com>
Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In register_device, the return value of ida_simple_get is unchecked,
in witch ida_simple_get will use an invalid index value.
To address this issue, index should be checked after ida_simple_get. When
the index value is abnormal, a warning message should be printed, the port
should be dropped, and the value should be recorded.
Fixes: 9a69645dde ("ppdev: fix registering same device name")
Signed-off-by: Huai-Yuan Liu <qq810974084@gmail.com>
Link: https://lore.kernel.org/r/20240412083840.234085-1-qq810974084@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Correct function comments to prevent kernel-doc warnings
found when using "W=1".
msu.c:77: warning: Function parameter or member 'msc' not described in 'msc_window'
msu.c:122: warning: bad line:
msu.c:760: warning: No description found for return value of 'msc_configure'
msu.c:1309: warning: Function parameter or member 'nr_pages' not described in 'msc_buffer_alloc'
msu.c:1309: warning: Function parameter or member 'nr_wins' not described in 'msc_buffer_alloc'
msu.c:1309: warning: Excess function parameter 'size' description in 'msc_buffer_alloc'
msu.c:1376: warning: No description found for return value of 'msc_buffer_free_unless_used'
msu.c:1444: warning: No description found for return value of 'msc_win_to_user'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240429130119.1518073-10-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Per filesystems/sysfs.rst, show() should only use sysfs_emit()
or sysfs_emit_at() when formatting the value to be returned to user space.
coccinelle complains that there are still a couple of functions that use
snprintf(). Convert them to sysfs_emit().
sprintf() will be converted as weel if they have.
Generally, this patch is generated by
make coccicheck M=<path/to/file> MODE=patch \
COCCI=scripts/coccinelle/api/device_attr_show.cocci
No functional change intended
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240429130119.1518073-8-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240429130119.1518073-6-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Package messages from ftrace source with SyS-T Structured Binary Data
(later SBD) header and 64-bit ID. This provides modification-free
compatibility between ftrace and SyS-T arguments structure by applying
0xFFFF mask on message ID.
This happens due to the fact that SBD and ftrace structures have the
same principle of data storage: <header><args binary blob>.
The headers are bit-to-bit compatible and both contain event/catalog ID
with the exception, that ftrace header contains more fields within 64
bits which needs to be masked during encoding process, since SBD
standard doesn't support mask of ID field.
0 15 16 23 24 31 32 39 40 63
ftrace: <event_id> <flags> <preempt> <-pid-> <---->
SBD: <------- msg_id ------------------------------>
Signed-off-by: Mikhail Lappo <miklelappo@gmail.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240429130119.1518073-5-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Currently kernel HW tracing infrastrtucture and specifically its SyS-T
part treats all source data in the same way. Treating and encoding
different trace data sources differently might allow decoding software
to make use of e.g. ftrace event ids by converting them to a SyS-T
message catalog.
The solution is to keep source type stored within stm_source_data
structure to allow different handling by stm output/protocol.
Currently we only differentiate between STM_USER and STM_FTRACE sources.
Signed-off-by: Mikhail Lappo <miklelappo@gmail.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240429130119.1518073-3-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jonathan writes:
IIO: 2nd set of new device support, features and cleanup for 6.10 (take 2)
The usual mixed bag from towards the end of the cycle.
Changes since take 1. Fixed the fixes tag and indeed fixed a rebase I
messed up on the same fix.
New devices support
===================
invensense,icm42600
- Support the ICM-42686-P a high range device going up to 32g and 4000 dps
New features
============
adi,ad7944
- Add support for chain mode in which many ADCs may be daisy chained and
read out via a single long read.
adi,ad9467/backend library
- Add bus tuning related interfaces.
adi,axi-adc
- Add control for the AXI clock - seems always enabled early in boot for other
reasons, but the driver should not rely on that..
Cleanups and minor or late breaking fixes
=========================================
Micrsoft/ACPI mount matrix handling.
- Replace several implementations of the Microsoft defined ROTM ACPI
method with a single one.
multiple drivers
- Don't call the result of wait_for_completion() timeout as it's
more accurate as time_left.
adi,ad7266
- Stop setting the iio_dev->masklength as it's done by the IIO core and
should not be set from drivers.
adi,ad799x
- Some checkpatch type fixes.
adi,ad9839
- Ensure compelte MU_CNT1 is written during lock phase.
adi,axi-dac
- Fix inverted parameter.
adi,adis16475
- Drop documentation of non existent sysfs files.
avago,apds9306
- Fix an off by one error that overly restricts the range of persistence
and adaptive thresholds that the driver accepts.
freescale,mxs-lradc
- Stop setting the iio_dev->masklength as it's done by the IIO core and
should not be set from drivers.
invensense,timestamp library
- Fix timestamp vs interupt alignment and aovid soms glitches that
occured when switching sampling frequency.
microchip,mcp3564
- Make use of device_for_each_child_node_scoped() to allow early release
without manual fwnode_handle_put().
microchip,mcp9600
- Allow for negative temperatures.
microchip,pac1934
- Avoid an out of bounds array index.
richtek,rtq6056
- Use iio_device_claim_direct_scoped() to automate lock release and simplify
the code.
sensortek,stk3110
- Drop a likely incorrect ACPI ID. No known users of this ID and it's
not a valid ACPI ID.
ti,ads1015
- Make use of device_for_each_child_node_scoped() to allow early release
without manual fwnode_handle_put().
* tag 'iio-for-6.10b-take2' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (41 commits)
iio: temperature: mcp9600: Fix temperature reading for negative values
iio: adc: PAC1934: fix accessing out of bounds array index
iio: invensense: fix timestamp glitches when switching frequency
iio: invensense: fix interrupt timestamp alignment
iio: dac: ad9739a: write complete MU_CNT1 register during lock
iio: pressure: zpa2326: use 'time_left' variable with wait_for_completion_interruptible_timeout()
iio: adc: twl6030-gpadc: use 'time_left' variable with wait_for_completion_interruptible_timeout()
iio: adc: stm32-dfsdm-adc: use 'time_left' variable with wait_for_completion_interruptible_timeout()
iio: adc: stm32-adc: use 'time_left' variable with wait_for_completion_interruptible_timeout()
iio: adc: intel_mrfld_adc: use 'time_left' variable with wait_for_completion_interruptible_timeout()
iio: adc: fsl-imx25-gcq: use 'time_left' variable with wait_for_completion_interruptible_timeout()
iio: adc: exynos_adc: use 'time_left' variable with wait_for_completion_timeout()
iio: adc: ad_sigma_delta: use 'time_left' variable with wait_for_completion_timeout()
iio: adc: ti-ads1015: use device_for_each_child_node_scoped()
iio: adc: ad799x: Prefer to use octal permission
iio: adc: ad799x: add blank line to avoid warning messages
iio: adc: ad799x: change 'unsigned' to 'unsigned int' declaration
iio: adc: mcp3564: Use device_for_each_child_node_scoped()
iio: adc: ad9467: support digital interface calibration
iio: adc: adi-axi-adc: support digital interface calibration
...
Georgi writes:
interconnect changes for 6.10
This pull request contains the interconnect changes for the 6.10-rc1 merge
window. It contains some small driver changes listed below:
Driver changes:
- Cleanup sm6115 QoS port numbering.
- Fix incorrect port value in qcm2290 driver.
Signed-off-by: Georgi Djakov <djakov@kernel.org>
* tag 'icc-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc:
interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
interconnect: qcom: sm6115: Unspaghettify SNoC QoS port numbering
When a sensor is running and there is a FIFO frequency change due to
another sensor turned on/off, there are glitches on timestamp. Fix that
by using only interrupt timestamp when there is the corresponding sensor
data in the FIFO.
Delete FIFO period handling and simplify internal functions.
Update integration inside inv_mpu6050 and inv_icm42600 drivers.
Fixes: 0ecc363cce ("iio: make invensense timestamp module generic")
Cc: Stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Link: https://lore.kernel.org/r/20240426094835.138389-1-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().
Trivially convert the slimbus drivers from always returning zero in the
remove callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20240430091657.35428-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20240430084921.33387-8-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Suzuki writes:
coresight: hwtracing subsystem updates for v6.10
CoreSight/hwtracing updates for the next release includes:
- ACPI power management support for CoreSight legacy components, via migration
from AMBA to platform device
- Fixes for ETE register save/restore during CPU Idle.
- ACPI support TMC for Scatter-Gather mode.
- his_ptt driver update to set the parent device for PMU and documentation fixes
- Qcomm Trace component DT binding fixes
- Miscellaneous cleanups
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
* tag 'coresight-next-v6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (28 commits)
hwtracing: hisi_ptt: Assign parent for event_source device
Documentation: ABI + trace: hisi_ptt: update paths to bus/event_source
coresight: tmc: Enable SG capability on ACPI based SoC-400 TMC ETR devices
coresight: Docs/ABI/testing/sysfs-bus-coresight-devices: Fix spelling errors
coresight: tpiu: Convert to platform remove callback returning void
coresight: tmc: Convert to platform remove callback returning void
coresight: stm: Convert to platform remove callback returning void
coresight: debug: Convert to platform remove callback returning void
coresight: catu: Convert to platform remove callback returning void
coresight: Remove duplicate linux/amba/bus.h header
coresight: stm: Remove duplicate linux/acpi.h header
coresight: etm4x: Fix access to resource selector registers
coresight: etm4x: Safe access for TRCQCLTR
coresight: etm4x: Do not save/restore Data trace control registers
coresight: etm4x: Do not hardcode IOMEM access for register restore
coresight: debug: Move ACPI support from AMBA driver to platform driver
coresight: stm: Move ACPI support from AMBA driver to platform driver
coresight: tmc: Move ACPI support from AMBA driver to platform driver
coresight: tpiu: Move ACPI support from AMBA driver to platform driver
coresight: catu: Move ACPI support from AMBA driver to platform driver
...
Manivannan writes:
MHI Host
========
- Added a new API mhi_power_down_keep_dev() to not destroy the struct dev
associated with the MHI channels during MHI power down. This is useful in
scenarios such as system suspend/hibernation where the probability of
channels coming back is very high. So the PM maintainer suggested not to
destroy the struct dev in those cases.
This API is introduced for fixing the failure reported in the ath11k driver
during resume from system suspend.
NOTE: Due to the API dependency, the patch adding the API is pushed to an
immutable branch (mhi-immutable) and merged into both mhi and ath trees. But
the merge commit is not visible in mhi tree due to git being smart with
'fast-forward'.
- Added an optional sysfs entry to force the MHI devices to enter the Emergency
Download (EDL) mode to download the firmware from host.
- Added EDL mode support for Qcom SDX75/65/55 modems as per the MHI spec v1.2,
Chapter 13.2. This involves writing a cookie to the EDL doorbell registers and
then triggering the device reset from host.
* tag 'mhi-for-6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi:
bus: mhi: host: pci_generic: Add generic edl_trigger to allow devices to enter EDL mode
bus: mhi: host: Add a new API for getting channel doorbell offset
bus: mhi: host: Add sysfs entry to force device to enter EDL
bus: mhi: host: Add mhi_power_down_keep_dev() API to support system suspend/hibernation
Xu writes:
FPGA Manager changes for 6.10-rc1
FPGA MGR core:
- Marco's change adds module owner parameter for all registration APIs.
FPGA test:
- Macro's change uses KUnit devices instead of platform devices.
DFL:
- Peter's change cleans up unused symbols.
Xlinux:
- Charles adds SelectMAP interface reprogramming support.
- Andy's header inclusion cleanup.
Altera:
- Krzysztof & Christophe's cleanup for drivers
* tag 'fpga-for-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga:
fpga: region: add owner module and take its refcount
fpga: dfl: remove unused member pdata from struct dfl_{afu,fme}
fpga: dfl: remove unused function is_dfl_feature_present()
fpga: ice40-spi: Don't use "proxy" headers
fpga: tests: use KUnit devices instead of platform devices
fpga: altera-cvp: Remove an unused field in struct altera_cvp_conf
fpga: altera: drop driver owner assignment
fpga: xilinx-core: add new gpio names for prog and init
fpga: xilinx-selectmap: add new driver
dt-bindings: fpga: xlnx,fpga-selectmap: add DT schema
fpga: xilinx-spi: extract a common driver core
fpga: bridge: add owner module and take its refcount
fpga: manager: add owner module and take its refcount
William writes:
Second set of Counter updates for 6.10
Counter header file is updated to include only headers that are actually
use.
* tag 'counter-updates-for-6.10b' of git://git.kernel.org/pub/scm/linux/kernel/git/wbg/counter:
counter: Don't use "proxy" headers
