Skip to content
  1. Jan 20, 2023
  2. Jan 19, 2023
  3. Jan 04, 2023
    • Cristian Marussi's avatar
      firmware: arm_scmi: Fix virtio channels cleanup on shutdown · e325285d
      Cristian Marussi authored
      When unloading the SCMI core stack module, configured to use the virtio
      SCMI transport, LOCKDEP reports the splat down below about unsafe locks
      dependencies.
      
      In order to avoid this possible unsafe locking scenario call upfront
      virtio_break_device() before getting hold of vioch->lock.
      
      =====================================================
       WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
       6.1.0-00067-g6b934395ba07-dirty #4 Not tainted
       -----------------------------------------------------
       rmmod/307 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
       ffff000080c510e0 (&dev->vqs_list_lock){+.+.}-{3:3}, at: virtio_break_device+0x28/0x68
      
       and this task is already holding:
       ffff00008288ada0 (&channels[i].lock){-.-.}-{3:3}, at: virtio_chan_free+0x60/0x168 [scmi_module]
      
       which would create a new lock dependency:
        (&channels[i].lock){-.-.}-{3:3} -> (&dev->vqs_list_lock){+.+.}-{3:3}
      
       but this new dependency connects a HARDIRQ-irq-safe lock:
        (&channels[i].lock){-.-.}-{3:3}
      
       ... which became HARDIRQ-irq-safe at:
         lock_acquire+0x128/0x398
         _raw_spin_lock_irqsave+0x78/0x140
         scmi_vio_complete_cb+0xb4/0x3b8 [scmi_module]
         vring_interrupt+0x84/0x120
         vm_interrupt+0x94/0xe8
         __handle_irq_event_percpu+0xb4/0x3d8
         handle_irq_event_percpu+0x20/0x68
         handle_irq_event+0x50/0xb0
         handle_fasteoi_irq+0xac/0x138
         generic_handle_domain_irq+0x34/0x50
         gic_handle_irq+0xa0/0xd8
         call_on_irq_stack+0x2c/0x54
         do_interrupt_handler+0x8c/0x90
         el1_interrupt+0x40/0x78
         el1h_64_irq_handler+0x18/0x28
         el1h_64_irq+0x64/0x68
         _raw_write_unlock_irq+0x48/0x80
         ep_start_scan+0xf0/0x128
         do_epoll_wait+0x390/0x858
         do_compat_epoll_pwait.part.34+0x1c/0xb8
         __arm64_sys_epoll_pwait+0x80/0xd0
         invoke_syscall+0x4c/0x110
         el0_svc_common.constprop.3+0x98/0x120
         do_el0_svc+0x34/0xd0
         el0_svc+0x40/0x98
         el0t_64_sync_handler+0x98/0xc0
         el0t_64_sync+0x170/0x174
      
       to a HARDIRQ-irq-unsafe lock:
        (&dev->vqs_list_lock){+.+.}-{3:3}
      
       ... which became HARDIRQ-irq-unsafe at:
       ...
         lock_acquire+0x128/0x398
         _raw_spin_lock+0x58/0x70
         __vring_new_virtqueue+0x130/0x1c0
         vring_create_virtqueue+0xc4/0x2b8
         vm_find_vqs+0x20c/0x430
         init_vq+0x308/0x390
         virtblk_probe+0x114/0x9b0
         virtio_dev_probe+0x1a4/0x248
         really_probe+0xc8/0x3a8
         __driver_probe_device+0x84/0x190
         driver_probe_device+0x44/0x110
         __driver_attach+0x104/0x1e8
         bus_for_each_dev+0x7c/0xd0
         driver_attach+0x2c/0x38
         bus_add_driver+0x1e4/0x258
         driver_register+0x6c/0x128
         register_virtio_driver+0x2c/0x48
         virtio_blk_init+0x70/0xac
         do_one_initcall+0x84/0x420
         kernel_init_freeable+0x2d0/0x340
         kernel_init+0x2c/0x138
         ret_from_fork+0x10/0x20
      
       other info that might help us debug this:
      
        Possible interrupt unsafe locking scenario:
      
              CPU0                    CPU1
              ----                    ----
         lock(&dev->vqs_list_lock);
                                      local_irq_disable();
                                      lock(&channels[i].lock);
                                      lock(&dev->vqs_list_lock);
         <Interrupt>
           lock(&channels[i].lock);
      
        *** DEADLOCK ***
      ================
      
      Fixes: 42e90eb5
      
       ("firmware: arm_scmi: Add a virtio channel refcount")
      Signed-off-by: default avatarCristian Marussi <cristian.marussi@arm.com>
      Link: https://lore.kernel.org/r/20221222183823.518856-6-cristian.marussi@arm.com
      Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
      e325285d
    • Cristian Marussi's avatar
      firmware: arm_scmi: Harden shared memory access in fetch_notification · 9bae076c
      Cristian Marussi authored
      A misbheaving SCMI platform firmware could reply with out-of-spec
      notifications, shorter than the mimimum size comprising a header.
      
      Fixes: d5141f37
      
       ("firmware: arm_scmi: Add notifications support in transport layer")
      Signed-off-by: default avatarCristian Marussi <cristian.marussi@arm.com>
      Link: https://lore.kernel.org/r/20221222183823.518856-4-cristian.marussi@arm.com
      Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
      9bae076c
    • Cristian Marussi's avatar
      firmware: arm_scmi: Harden shared memory access in fetch_response · ad78b81a
      Cristian Marussi authored
      A misbheaving SCMI platform firmware could reply with out-of-spec messages,
      shorter than the mimimum size comprising a header and a status field.
      
      Harden shmem_fetch_response to properly truncate such a bad messages.
      
      Fixes: 5c8a47a5
      
       ("firmware: arm_scmi: Make scmi core independent of the transport type")
      Signed-off-by: default avatarCristian Marussi <cristian.marussi@arm.com>
      Link: https://lore.kernel.org/r/20221222183823.518856-3-cristian.marussi@arm.com
      Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
      ad78b81a
    • Cristian Marussi's avatar
      firmware: arm_scmi: Clear stale xfer->hdr.status · f6ca5059
      Cristian Marussi authored
      
      
      Stale error status reported from a previous message transaction must be
      cleared before starting a new transaction to avoid being confusingly
      reported in the following SCMI message dump traces.
      
      Signed-off-by: default avatarCristian Marussi <cristian.marussi@arm.com>
      Link: https://lore.kernel.org/r/20221222183823.518856-2-cristian.marussi@arm.com
      Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
      f6ca5059
  4. Dec 26, 2022
    • Linus Torvalds's avatar
      Linux 6.2-rc1 · 1b929c02
      Linus Torvalds authored
      1b929c02
    • Steven Rostedt (Google)'s avatar
      treewide: Convert del_timer*() to timer_shutdown*() · 292a089d
      Steven Rostedt (Google) authored
      
      
      Due to several bugs caused by timers being re-armed after they are
      shutdown and just before they are freed, a new state of timers was added
      called "shutdown".  After a timer is set to this state, then it can no
      longer be re-armed.
      
      The following script was run to find all the trivial locations where
      del_timer() or del_timer_sync() is called in the same function that the
      object holding the timer is freed.  It also ignores any locations where
      the timer->function is modified between the del_timer*() and the free(),
      as that is not considered a "trivial" case.
      
      This was created by using a coccinelle script and the following
      commands:
      
          $ cat timer.cocci
          @@
          expression ptr, slab;
          identifier timer, rfield;
          @@
          (
          -       del_timer(&ptr->timer);
          +       timer_shutdown(&ptr->timer);
          |
          -       del_timer_sync(&ptr->timer);
          +       timer_shutdown_sync(&ptr->timer);
          )
            ... when strict
                when != ptr->timer
          (
                  kfree_rcu(ptr, rfield);
          |
                  kmem_cache_free(slab, ptr);
          |
                  kfree(ptr);
          )
      
          $ spatch timer.cocci . > /tmp/t.patch
          $ patch -p1 < /tmp/t.patch
      
      Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/
      Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
      Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ]
      Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ]
      Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ]
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      292a089d
  5. Dec 24, 2022
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 72a85e2b
      Linus Torvalds authored
      Pull spi fix from Mark Brown:
       "One driver specific change here which handles the case where a SPI
        device for some reason tries to change the bus speed during a message
        on fsl_spi hardware, this should be very unusual"
      
      * tag 'spi-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: fsl_spi: Don't change speed while chipselect is active
      72a85e2b
    • Linus Torvalds's avatar
      Merge tag 'regulator-fix-v6.2-rc1' of... · 0a023cbb
      Linus Torvalds authored
      Merge tag 'regulator-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
      
      Pull regulator fixes from Mark Brown:
       "Two core fixes here, one for a long standing race which some Qualcomm
        systems have started triggering with their UFS driver and another
        fixing a problem with supply lookup introduced by the fixes for devm
        related use after free issues that were introduced in this merge
        window"
      
      * tag 'regulator-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: core: fix deadlock on regulator enable
        regulator: core: Fix resolve supply lookup issue
      0a023cbb
    • Linus Torvalds's avatar
      Merge tag 'coccinelle-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux · 2c91ce92
      Linus Torvalds authored
      Pull coccicheck update from Julia Lawall:
       "Modernize use of grep in coccicheck:
      
        Use 'grep -E' instead of 'egrep'"
      
      * tag 'coccinelle-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
        scripts: coccicheck: use "grep -E" instead of "egrep"
      2c91ce92
    • Linus Torvalds's avatar
      Merge tag 'hardening-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 51094a24
      Linus Torvalds authored
      Pull kernel hardening fixes from Kees Cook:
      
       - Fix CFI failure with KASAN (Sami Tolvanen)
      
       - Fix LKDTM + CFI under GCC 7 and 8 (Kristina Martsenko)
      
       - Limit CONFIG_ZERO_CALL_USED_REGS to Clang > 15.0.6 (Nathan
         Chancellor)
      
       - Ignore "contents" argument in LoadPin's LSM hook handling
      
       - Fix paste-o in /sys/kernel/warn_count API docs
      
       - Use READ_ONCE() consistently for oops/warn limit reading
      
      * tag 'hardening-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        cfi: Fix CFI failure with KASAN
        exit: Use READ_ONCE() for all oops/warn limit reads
        security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6
        lkdtm: cfi: Make PAC test work with GCC 7 and 8
        docs: Fix path paste-o for /sys/kernel/warn_count
        LoadPin: Ignore the "contents" argument of the LSM hooks
      51094a24
    • Linus Torvalds's avatar
      Merge tag 'pstore-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · edb23125
      Linus Torvalds authored
      Pull pstore fixes from Kees Cook:
      
       - Switch pmsg_lock to an rt_mutex to avoid priority inversion (John
         Stultz)
      
       - Correctly assign mem_type property (Luca Stefani)
      
      * tag 'pstore-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        pstore: Properly assign mem_type property
        pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
        pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
      edb23125
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-2022-12-23' of git://git.infradead.org/users/hch/dma-mapping · 59d2c635
      Linus Torvalds authored
      Pull dma-mapping fixes from Christoph Hellwig:
       "Fix up the sound code to not pass __GFP_COMP to the non-coherent DMA
        allocator, as it copes with that just as badly as the coherent
        allocator, and then add a check to make sure no one passes the flag
        ever again"
      
      * tag 'dma-mapping-2022-12-23' of git://git.infradead.org/users/hch/dma-mapping:
        dma-mapping: reject GFP_COMP for noncoherent allocations
        ALSA: memalloc: don't use GFP_COMP for non-coherent dma allocations
      59d2c635
    • Linus Torvalds's avatar
      Merge tag '9p-for-6.2-rc1' of https://github.com/martinetd/linux · e3b862ed
      Linus Torvalds authored
      Pull 9p updates from Dominique Martinet:
      
       - improve p9_check_errors to check buffer size instead of msize when
         possible (e.g. not zero-copy)
      
       - some more syzbot and KCSAN fixes
      
       - minor headers include cleanup
      
      * tag '9p-for-6.2-rc1' of https://github.com/martinetd/linux:
        9p/client: fix data race on req->status
        net/9p: fix response size check in p9_check_errors()
        net/9p: distinguish zero-copy requests
        9p/xen: do not memcpy header into req->rc
        9p: set req refcount to zero to avoid uninitialized usage
        9p/net: Remove unneeded idr.h #include
        9p/fs: Remove unneeded idr.h #include
      e3b862ed
    • Linus Torvalds's avatar
      Merge tag 'sound-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · a27405b2
      Linus Torvalds authored
      Pull more sound updates from Takashi Iwai:
       "A few more updates for 6.2: most of changes are about ASoC
        device-specific fixes.
      
         - Lots of ASoC Intel AVS extensions and refactoring
      
         - Quirks for ASoC Intel SOF as well as regression fixes
      
         - ASoC Mediatek and Rockchip fixes
      
         - Intel HD-audio HDMI workarounds
      
         - Usual HD- and USB-audio device-specific quirks"
      
      * tag 'sound-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (54 commits)
        ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless
        ALSA: azt3328: Remove the unused function snd_azf3328_codec_outl()
        ASoC: lochnagar: Fix unused lochnagar_of_match warning
        ASoC: Intel: Add HP Stream 8 to bytcr_rt5640.c
        ASoC: SOF: mediatek: initialize panic_info to zero
        ASoC: rt5670: Remove unbalanced pm_runtime_put()
        ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet
        ASoC: Intel: soc-acpi: update codec addr on 0C11/0C4F product
        ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
        ASoC: wm8994: Fix potential deadlock
        ASoC: mediatek: mt8195: add sof be ops to check audio active
        ASoC: SOF: Revert: "core: unregister clients and machine drivers in .shutdown"
        ASoC: SOF: Intel: pci-tgl: unblock S5 entry if DMA stop has failed"
        ALSA: hda/hdmi: fix stream-id config keep-alive for rt suspend
        ALSA: hda/hdmi: set default audio parameters for KAE silent-stream
        ALSA: hda/hdmi: fix i915 silent stream programming flow
        ALSA: hda: Error out if invalid stream is being setup
        ASoC: dt-bindings: fsl-sai: Reinstate i.MX93 SAI compatible string
        ASoC: soc-pcm.c: Clear DAIs parameters after stream_active is updated
        ASoC: codecs: wcd-clsh: Remove the unused function
        ...
      a27405b2