From 69f1804a9ab602701217a8c23d371f8f36f8b57a Mon Sep 17 00:00:00 2001 From: Alexander Usyskin Date: Mon, 9 May 2016 00:07:46 -0400 Subject: mei: don't use wake_up_interruptible for wr_ctrl wr_ctrl waiters are none interruptible, so should be waken up with call to wake_up and not to wake_up_interruptible. This fixes commit: 7ff4bdd ("mei: fix waiting for wr_ctrl for corner cases.") Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index eed254d..641c1a5 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -730,7 +730,7 @@ static void mei_cl_wake_all(struct mei_cl *cl) /* synchronized under device mutex */ if (waitqueue_active(&cl->wait)) { cl_dbg(dev, cl, "Waking up ctrl write clients!\n"); - wake_up_interruptible(&cl->wait); + wake_up(&cl->wait); } } -- cgit v0.10.2 From 7bc364097a89a0a9a5e5e4989d6b3e6fb2027a9e Mon Sep 17 00:00:00 2001 From: Johannes Thumshirn Date: Tue, 10 May 2016 12:39:44 +0200 Subject: mcb: Acquire reference to device in probe mcb_probe() does not aqcuire a reference to the probed device but drops one when removing the device. As it is actually using the device, it should grab a reference via get_device(). This could lead to a panic found with a rmmod/modprobe stress test Signed-off-by: Johannes Thumshirn Reported-by: Andreas Werner Tested-by: Andreas Werner Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c index b73c6e7..f5923c2 100644 --- a/drivers/mcb/mcb-core.c +++ b/drivers/mcb/mcb-core.c @@ -66,6 +66,7 @@ static int mcb_probe(struct device *dev) if (!found_id) return -ENODEV; + get_device(dev); return mdrv->probe(mdev, found_id); } -- cgit v0.10.2 From 4d2ec8575357d4afc965564e2e910a72fe608d39 Mon Sep 17 00:00:00 2001 From: Johannes Thumshirn Date: Tue, 10 May 2016 12:39:45 +0200 Subject: mcb: Acquire reference to carrier module in core Acquire a reference to the carrier's kernel module in bus code, so it can't be removed from the kernel while it still has a bus and thus possibly devices attached to it. Signed-off-by: Johannes Thumshirn Reported-by: Andreas Werner Tested-by: Andreas Werner Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c index f5923c2..6f2c852 100644 --- a/drivers/mcb/mcb-core.c +++ b/drivers/mcb/mcb-core.c @@ -61,22 +61,36 @@ static int mcb_probe(struct device *dev) struct mcb_driver *mdrv = to_mcb_driver(dev->driver); struct mcb_device *mdev = to_mcb_device(dev); const struct mcb_device_id *found_id; + struct module *carrier_mod; + int ret; found_id = mcb_match_id(mdrv->id_table, mdev); if (!found_id) return -ENODEV; + carrier_mod = mdev->dev.parent->driver->owner; + if (!try_module_get(carrier_mod)) + return -EINVAL; + get_device(dev); - return mdrv->probe(mdev, found_id); + ret = mdrv->probe(mdev, found_id); + if (ret) + module_put(carrier_mod); + + return ret; } static int mcb_remove(struct device *dev) { struct mcb_driver *mdrv = to_mcb_driver(dev->driver); struct mcb_device *mdev = to_mcb_device(dev); + struct module *carrier_mod; mdrv->remove(mdev); + carrier_mod = mdev->dev.parent->driver->owner; + module_put(carrier_mod); + put_device(&mdev->dev); return 0; -- cgit v0.10.2 From 62e6d1e59c77316768a663d1328390b4cd33801f Mon Sep 17 00:00:00 2001 From: Roger Quadros Date: Wed, 15 Jun 2016 11:12:05 +0300 Subject: extcon: palmas: Fix boot up state of VBUS when using GPIO detection If USB cable is connected prior to boot, we don't get any interrupts so we must manually check the VBUS state and report it during probe. If we don't do it then USB controller will never know that peripheral cable was connected till the user unplugs and replugs the cable. Fixes: b7aad8e2685b ("extcon: palmas: Add the support for VBUS detection by using GPIO") Cc: stable@vger.kernel.org Signed-off-by: Roger Quadros Signed-off-by: Chanwoo Choi diff --git a/drivers/extcon/extcon-palmas.c b/drivers/extcon/extcon-palmas.c index 8b3226d..caff46c 100644 --- a/drivers/extcon/extcon-palmas.c +++ b/drivers/extcon/extcon-palmas.c @@ -360,6 +360,8 @@ static int palmas_usb_probe(struct platform_device *pdev) palmas_enable_irq(palmas_usb); /* perform initial detection */ + if (palmas_usb->enable_gpio_vbus_detection) + palmas_vbus_irq_handler(palmas_usb->gpio_vbus_irq, palmas_usb); palmas_gpio_id_detect(&palmas_usb->wq_detectid.work); device_set_wakeup_capable(&pdev->dev, true); return 0; -- cgit v0.10.2 From ec48a1d981fe90ecb5bcfaaf1ae2c69d842cbbbc Mon Sep 17 00:00:00 2001 From: Suzuki K Poulose Date: Tue, 14 Jun 2016 11:17:12 -0600 Subject: coresight: Fix NULL pointer dereference in _coresight_build_path _coresight_build_path assumes that all the connections of a csdev has the child_dev initialised. This may not be true if the particular component is not supported by the kernel config(e.g TPIU) but is present in the DT. In which case, building a path can cause a crash like this : Unable to handle kernel NULL pointer dereference at virtual address 00000010 pgd = ffffffc9750dd000 [00000010] *pgd=00000009f5e90003, *pud=00000009f5e90003, *pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: CPU: 4 PID: 1348 Comm: bash Not tainted 4.6.0-next-20160517 #1646 Hardware name: ARM Juno development board (r0) (DT) task: ffffffc97517a280 ti: ffffffc9762c4000 task.ti: ffffffc9762c4000 PC is at _coresight_build_path+0x18/0xe4 LR is at _coresight_build_path+0xc0/0xe4 pc : [] lr : [] pstate: 20000145 sp : ffffffc9762c7ba0 [] _coresight_build_path+0x18/0xe4 [] _coresight_build_path+0xc0/0xe4 [] _coresight_build_path+0xc0/0xe4 [] _coresight_build_path+0xc0/0xe4 [] _coresight_build_path+0xc0/0xe4 [] _coresight_build_path+0xc0/0xe4 [] coresight_build_path+0x40/0x68 [] coresight_enable+0x74/0x1bc [] enable_source_store+0x3c/0x6c [] dev_attr_store+0x18/0x28 [] sysfs_kf_write+0x40/0x50 [] kernfs_fop_write+0x140/0x1cc [] __vfs_write+0x28/0x110 [] vfs_write+0xa0/0x174 [] SyS_write+0x44/0xa0 [] el0_svc_naked+0x24/0x28 Cc: Mathieu Poirier Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c index 5443d03..0fdaaf4 100644 --- a/drivers/hwtracing/coresight/coresight.c +++ b/drivers/hwtracing/coresight/coresight.c @@ -385,7 +385,6 @@ static int _coresight_build_path(struct coresight_device *csdev, int i; bool found = false; struct coresight_node *node; - struct coresight_connection *conn; /* An activated sink has been found. Enqueue the element */ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || @@ -394,8 +393,9 @@ static int _coresight_build_path(struct coresight_device *csdev, /* Not a sink - recursively explore each port found on this element */ for (i = 0; i < csdev->nr_outport; i++) { - conn = &csdev->conns[i]; - if (_coresight_build_path(conn->child_dev, path) == 0) { + struct coresight_device *child_dev = csdev->conns[i].child_dev; + + if (child_dev && _coresight_build_path(child_dev, path) == 0) { found = true; break; } -- cgit v0.10.2 From 8e215298a15d5b93c6fa22895c406da538769bca Mon Sep 17 00:00:00 2001 From: Suzuki K Poulose Date: Tue, 14 Jun 2016 11:17:13 -0600 Subject: coresight: Fix tmc_read_unprepare_etr At the end of the trace capture, we free the allocated memory, resetting the drvdata->buf to NULL, to indicate that trace data was collected and the next trace session should allocate the memory in tmc_enable_etr_sink_sysfs. The tmc_enable_etr_sink_sysfs, we only allocate memory if drvdata->vaddr is not NULL (which is not performed at the end of previous session). This can cause, drvdata->vaddr getting assigned NULL and later we do memset() which causes a crash as below : Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = ffffffc9747f0000 [00000000] *pgd=00000009f402e003, *pud=00000009f402e003, *pmd=0000000000000000 Internal error: Oops: 96000046 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1592 Comm: bash Not tainted 4.7.0-rc1+ #1712 Hardware name: ARM Juno development board (r0) (DT) task: ffffffc078fe0080 ti: ffffffc974178000 task.ti: ffffffc974178000 PC is at __memset+0x1ac/0x200 LR is at tmc_enable_etr_sink+0xf8/0x304 pc : [] lr : [] pstate: 400001c5 sp : ffffffc97417bc00 x29: ffffffc97417bc00 x28: ffffffc974178000 Call trace: Exception stack(0xffffffc97417ba40 to 0xffffffc97417bb60) ba40: 0000000000000001 ffffffc974a5d098 ffffffc97417bc00 ffffff80083a002c ba60: ffffffc974a5d118 0000000000000000 0000000000000000 0000000000000000 ba80: 0000000000000001 0000000000000000 ffffff800859bdec 0000000000000040 baa0: ffffff8008b45b58 00000000000001c0 ffffffc97417baf0 ffffff80080eddb4 bac0: 0000000000000003 ffffffc078fe0080 ffffffc078fe0960 ffffffc078fe0940 bae0: 0000000000000000 0000000000000000 00000000007fffc0 0000000000000004 bb00: 0000000000000000 0000000000000040 000000000000003f 0000000000000000 bb20: 0000000000000000 0000000000000000 0000000000000000 0000000000000001 bb40: ffffffc078fe0960 0000000000000018 ffffffffffffffff 0008669628000000 [] __memset+0x1ac/0x200 [] coresight_enable_path+0xa8/0x1dc [] coresight_enable+0x88/0x1b8 [] enable_source_store+0x3c/0x6c [] dev_attr_store+0x18/0x28 [] sysfs_kf_write+0x54/0x64 [] kernfs_fop_write+0x148/0x1d8 [] __vfs_write+0x28/0x110 [] vfs_write+0xa0/0x198 [] SyS_write+0x44/0xa0 [] el0_svc_naked+0x24/0x28 Code: 91010108 54ffff4a 8b040108 cb050042 (d50b7428) This patch fixes the issue by clearing the drvdata->vaddr while we free the allocated buffer at the end of a session, so that we allocate the memory again. Cc: mathieu.poirier@linaro.org Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c index 847d1b5..3369d7a 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etr.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c @@ -315,7 +315,7 @@ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata) */ vaddr = drvdata->vaddr; paddr = drvdata->paddr; - drvdata->buf = NULL; + drvdata->buf = drvdata->vaddr = NULL; } drvdata->reading = false; -- cgit v0.10.2 From f3b8172fe15fbed0d0d33d99780e122213e00684 Mon Sep 17 00:00:00 2001 From: Suzuki K Poulose Date: Tue, 14 Jun 2016 11:17:14 -0600 Subject: coresight: Fix erroneous memset in tmc_read_unprepare_etr At the end of a trace collection, we try to clear the entire buffer and enable the ETR back if it was already enabled. But, we would have adjusted the drvdata->buf to point to the beginning of the trace data in the trace buffer @drvdata->vaddr. So, the following code which clears the buffer is dangerous and can cause crashes, like below : memset(drvdata->buf, 0, drvdata->size); Unable to handle kernel paging request at virtual address ffffff800a145000 pgd = ffffffc974726000 *pgd=00000009f3e91003, *pud=00000009f3e91003, *pmd=0000000000000000 PREEMPT SMP Modules linked in: CPU: 4 PID: 1692 Comm: dd Not tainted 4.7.0-rc2+ #1721 Hardware name: ARM Juno development board (r0) (DT) task: ffffffc9734a0080 ti: ffffffc974460000 task.ti: ffffffc974460000 PC is at __memset+0x1ac/0x200 LR is at tmc_read_unprepare_etr+0x144/0x1bc pc : [] lr : [] pstate: 200001c5 ... [] __memset+0x1ac/0x200 [] tmc_release+0x90/0x94 [] __fput+0xa8/0x1ec [] ____fput+0xc/0x14 [] task_work_run+0xb0/0xe4 [] do_notify_resume+0x64/0x6c [] work_pending+0x10/0x14 Code: 91010108 54ffff4a 8b040108 cb050042 (d50b7428) Since we clear the buffer anyway in the following call to tmc_etr_enable_hw(), remove the erroneous memset(). Fixes: commit de5461970b3e9e1 ("coresight: tmc: allocating memory when needed") Cc: Mathieu Poirier Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c index 3369d7a..688be9e 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etr.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c @@ -300,13 +300,10 @@ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata) if (local_read(&drvdata->mode) == CS_MODE_SYSFS) { /* * The trace run will continue with the same allocated trace - * buffer. As such zero-out the buffer so that we don't end - * up with stale data. - * - * Since the tracer is still enabled drvdata::buf - * can't be NULL. + * buffer. The trace buffer is cleared in tmc_etr_enable_hw(), + * so we don't have to explicitly clear it. Also, since the + * tracer is still enabled drvdata::buf can't be NULL. */ - memset(drvdata->buf, 0, drvdata->size); tmc_etr_enable_hw(drvdata); } else { /* -- cgit v0.10.2 From 5014e904681ddbdf663bb20f134eb053ddccb181 Mon Sep 17 00:00:00 2001 From: Suzuki K Poulose Date: Fri, 6 May 2016 15:35:50 +0100 Subject: coresight: Handle build path error Enabling a component via sysfs (echo 1 > enable_source), would trigger building a path from the enabled sources to the sink. If there is an error in the process (e.g, sink not enabled or the device (CPU corresponding to ETM) is not online), we never report failure, except for leaving a message in the dmesg. Do proper error checking for the build path and return the error. Before: $ echo 0 > /sys/devices/system/cpu/cpu2/online $ echo 1 > /sys/devices/cs_etm/cpu2/enable_source $ echo $? 0 After: $ echo 0 > /sys/devices/system/cpu/cpu2/online $ echo 1 > /sys/devices/cs_etm/cpu2/enable_source -bash: echo: write error: No such device or address Signed-off-by: Suzuki K Poulose Acked-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c index 0fdaaf4..d08d1ab 100644 --- a/drivers/hwtracing/coresight/coresight.c +++ b/drivers/hwtracing/coresight/coresight.c @@ -425,6 +425,7 @@ out: struct list_head *coresight_build_path(struct coresight_device *csdev) { struct list_head *path; + int rc; path = kzalloc(sizeof(struct list_head), GFP_KERNEL); if (!path) @@ -432,9 +433,10 @@ struct list_head *coresight_build_path(struct coresight_device *csdev) INIT_LIST_HEAD(path); - if (_coresight_build_path(csdev, path)) { + rc = _coresight_build_path(csdev, path); + if (rc) { kfree(path); - path = NULL; + return ERR_PTR(rc); } return path; @@ -507,8 +509,9 @@ int coresight_enable(struct coresight_device *csdev) goto out; path = coresight_build_path(csdev); - if (!path) { + if (IS_ERR(path)) { pr_err("building path(s) failed\n"); + ret = PTR_ERR(path); goto out; } -- cgit v0.10.2