1. 24 Jun, 2018 4 commits
    • Ganapathi Bhat's avatar
      mwifiex: handle race during mwifiex_usb_disconnect · f8c095f6
      Ganapathi Bhat authored
      Race condition is observed during rmmod of mwifiex_usb:
      
      1. The rmmod thread will call mwifiex_usb_disconnect(), download
         SHUTDOWN command and do wait_event_interruptible_timeout(),
         waiting for response.
      
      2. The main thread will handle the response and will do a
         wake_up_interruptible(), unblocking rmmod thread.
      
      3. On getting unblocked, rmmod thread  will make rx_cmd.urb = NULL in
         mwifiex_usb_free().
      
      4. The main thread will try to resubmit rx_cmd.urb in
         mwifiex_usb_submit_rx_urb(), which is NULL.
      
      To fix this, move mwifiex_usb_free() from mwifiex_usb_disconnect
      to mwifiex_unregister_dev(). Function mwifiex_unregister_dev() is
      called after flushing the command and RX work queues.
      Suggested-by: default avatarBrian Norris <briannorris@chromium.org>
      Signed-off-by: default avatarGanapathi Bhat <gbhat@marvell.com>
      Reviewed-by: default avatarBrian Norris <briannorris@chromium.org>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      f8c095f6
    • Ganapathi Bhat's avatar
      Revert "mwifiex: handle race during mwifiex_usb_disconnect" · 7e58e741
      Ganapathi Bhat authored
      This reverts commit b817047a.
      
      We have a better fix for this issue, which will be sent on top
      of this revert.
      Signed-off-by: default avatarGanapathi Bhat <gbhat@marvell.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      7e58e741
    • Michael Trimarchi's avatar
      brcmfmac: stop watchdog before detach and free everything · 373c83a8
      Michael Trimarchi authored
      Using built-in in kernel image without a firmware in filesystem
      or in the kernel image can lead to a kernel NULL pointer deference.
      Watchdog need to be stopped in brcmf_sdio_remove
      
      The system is going down NOW!
      [ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8
      Sent SIGTERM to all processes
      [ 1348.121412] Mem abort info:
      [ 1348.126962]   ESR = 0x96000004
      [ 1348.130023]   Exception class = DABT (current EL), IL = 32 bits
      [ 1348.135948]   SET = 0, FnV = 0
      [ 1348.138997]   EA = 0, S1PTW = 0
      [ 1348.142154] Data abort info:
      [ 1348.145045]   ISV = 0, ISS = 0x00000004
      [ 1348.148884]   CM = 0, WnR = 0
      [ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
      [ 1348.158475] [00000000000002f8] pgd=0000000000000000
      [ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP
      [ 1348.168927] Modules linked in: ipv6
      [ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18
      [ 1348.180757] Hardware name: Amarula A64-Relic (DT)
      [ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO)
      [ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20
      [ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290
      [ 1348.200253] sp : ffff00000b85be30
      [ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000
      [ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638
      [ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800
      [ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660
      [ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00
      [ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001
      [ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8
      [ 1348.240711] x15: 0000000000000000 x14: 0000000000000400
      [ 1348.246018] x13: 0000000000000400 x12: 0000000000000001
      [ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10
      [ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870
      [ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55
      [ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000
      [ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100
      [ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000
      Signed-off-by: default avatarMichael Trimarchi <michael@amarulasolutions.com>
      Acked-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
      Tested-by: default avatarAndy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      373c83a8
    • Ping-Ke Shih's avatar
      rtlwifi: Fix kernel Oops "Fw download fail!!" · 12dfa2f6
      Ping-Ke Shih authored
      When connecting to AP, mac80211 asks driver to enter and leave PS quickly,
      but driver deinit doesn't wait for delayed work complete when entering PS,
      then driver reinit procedure and delay work are running simultaneously.
      This will cause unpredictable kernel oops or crash like
      
      rtl8723be: error H2C cmd because of Fw download fail!!!
      WARNING: CPU: 3 PID: 159 at drivers/net/wireless/realtek/rtlwifi/
      	 rtl8723be/fw.c:227 rtl8723be_fill_h2c_cmd+0x182/0x510 [rtl8723be]
      CPU: 3 PID: 159 Comm: kworker/3:2 Tainted: G       O     4.16.13-2-ARCH #1
      Hardware name: ASUSTeK COMPUTER INC. X556UF/X556UF, BIOS X556UF.406
      	       10/21/2016
      Workqueue: rtl8723be_pci rtl_c2hcmd_wq_callback [rtlwifi]
      RIP: 0010:rtl8723be_fill_h2c_cmd+0x182/0x510 [rtl8723be]
      RSP: 0018:ffffa6ab01e1bd70 EFLAGS: 00010282
      RAX: 0000000000000000 RBX: ffffa26069071520 RCX: 0000000000000001
      RDX: 0000000080000001 RSI: ffffffff8be70e9c RDI: 00000000ffffffff
      RBP: 0000000000000000 R08: 0000000000000048 R09: 0000000000000348
      R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
      R13: ffffa26069071520 R14: 0000000000000000 R15: ffffa2607d205f70
      FS:  0000000000000000(0000) GS:ffffa26081d80000(0000) knlGS:000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00000443b39d3000 CR3: 000000037700a005 CR4: 00000000003606e0
      Call Trace:
       ? halbtc_send_bt_mp_operation.constprop.17+0xd5/0xe0 [btcoexist]
       ? ex_btc8723b1ant_bt_info_notify+0x3b8/0x820 [btcoexist]
       ? rtl_c2hcmd_launcher+0xab/0x110 [rtlwifi]
       ? process_one_work+0x1d1/0x3b0
       ? worker_thread+0x2b/0x3d0
       ? process_one_work+0x3b0/0x3b0
       ? kthread+0x112/0x130
       ? kthread_create_on_node+0x60/0x60
       ? ret_from_fork+0x35/0x40
      Code: 00 76 b4 e9 e2 fe ff ff 4c 89 ee 4c 89 e7 e8 56 22 86 ca e9 5e ...
      
      This patch ensures all delayed works done before entering PS to satisfy
      our expectation, so use cancel_delayed_work_sync() instead. An exception
      is delayed work ips_nic_off_wq because running task may be itself, so add
      a parameter ips_wq to deinit function to handle this case.
      
      This issue is reported and fixed in below threads:
      https://github.com/lwfinger/rtlwifi_new/issues/367
      https://github.com/lwfinger/rtlwifi_new/issues/366
      
      Tested-by: Evgeny Kapun <abacabadabacaba@gmail.com> # 8723DE
      Tested-by: Shivam Kakkar <shivam543@gmail.com> # 8723BE on 4.18-rc1
      Signed-off-by: default avatarPing-Ke Shih <pkshih@realtek.com>
      Fixes: cceb0a59 ("rtlwifi: Add work queue for c2h cmd.")
      Cc: Stable <stable@vger.kernel.org> # 4.11+
      Reviewed-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      12dfa2f6
  2. 18 Jun, 2018 2 commits
  3. 16 Jun, 2018 8 commits
    • Linus Torvalds's avatar
      Linux 4.18-rc1 · ce397d21
      Linus Torvalds authored
      ce397d21
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20180616' of git://git.kernel.dk/linux-block · 265c5596
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A collection of fixes that should go into -rc1. This contains:
      
         - bsg_open vs bsg_unregister race fix (Anatoliy)
      
         - NVMe pull request from Christoph, with fixes for regressions in
           this window, FC connect/reconnect path code unification, and a
           trace point addition.
      
         - timeout fix (Christoph)
      
         - remove a few unused functions (Christoph)
      
         - blk-mq tag_set reinit fix (Roman)"
      
      * tag 'for-linus-20180616' of git://git.kernel.dk/linux-block:
        bsg: fix race of bsg_open and bsg_unregister
        block: remov blk_queue_invalidate_tags
        nvme-fabrics: fix and refine state checks in __nvmf_check_ready
        nvme-fabrics: handle the admin-only case properly in nvmf_check_ready
        nvme-fabrics: refactor queue ready check
        blk-mq: remove blk_mq_tagset_iter
        nvme: remove nvme_reinit_tagset
        nvme-fc: fix nulling of queue data on reconnect
        nvme-fc: remove reinit_request routine
        blk-mq: don't time out requests again that are in the timeout handler
        nvme-fc: change controllers first connect to use reconnect path
        nvme: don't rely on the changed namespace list log
        nvmet: free smart-log buffer after use
        nvme-rdma: fix error flow during mapping request data
        nvme: add bio remapping tracepoint
        nvme: fix NULL pointer dereference in nvme_init_subsystem
        blk-mq: reinit q->tag_set_list entry only after grace period
      265c5596
    • Linus Torvalds's avatar
      Merge tag 'docs-broken-links' of git://linuxtv.org/mchehab/experimental · 5e7b9212
      Linus Torvalds authored
      Pull documentation fixes from Mauro Carvalho Chehab:
       "This solves a series of broken links for files under Documentation,
        and improves a script meant to detect such broken links (see
        scripts/documentation-file-ref-check).
      
        The changes on this series are:
      
         - can.rst: fix a footnote reference;
      
         - crypto_engine.rst: Fix two parsing warnings;
      
         - Fix a lot of broken references to Documentation/*;
      
         - improve the scripts/documentation-file-ref-check script, in order
           to help detecting/fixing broken references, preventing
           false-positives.
      
        After this patch series, only 33 broken references to doc files are
        detected by scripts/documentation-file-ref-check"
      
      * tag 'docs-broken-links' of git://linuxtv.org/mchehab/experimental: (26 commits)
        fix a series of Documentation/ broken file name references
        Documentation: rstFlatTable.py: fix a broken reference
        ABI: sysfs-devices-system-cpu: remove a broken reference
        devicetree: fix a series of wrong file references
        devicetree: fix name of pinctrl-bindings.txt
        devicetree: fix some bindings file names
        MAINTAINERS: fix location of DT npcm files
        MAINTAINERS: fix location of some display DT bindings
        kernel-parameters.txt: fix pointers to sound parameters
        bindings: nvmem/zii: Fix location of nvmem.txt
        docs: Fix more broken references
        scripts/documentation-file-ref-check: check tools/*/Documentation
        scripts/documentation-file-ref-check: get rid of false-positives
        scripts/documentation-file-ref-check: hint: dash or underline
        scripts/documentation-file-ref-check: add a fix logic for DT
        scripts/documentation-file-ref-check: accept more wildcards at filenames
        scripts/documentation-file-ref-check: fix help message
        media: max2175: fix location of driver's companion documentation
        media: v4l: fix broken video4linux docs locations
        media: dvb: point to the location of the old README.dvb-usb file
        ...
      5e7b9212
    • Linus Torvalds's avatar
      Merge tag 'fsnotify_for_v4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · dbb2816f
      Linus Torvalds authored
      Pull fsnotify updates from Jan Kara:
       "fsnotify cleanups unifying handling of different watch types.
      
        This is the shortened fsnotify series from Amir with the last five
        patches pulled out. Amir has modified those patches to not change
        struct inode but obviously it's too late for those to go into this
        merge window"
      
      * tag 'fsnotify_for_v4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        fsnotify: add fsnotify_add_inode_mark() wrappers
        fanotify: generalize fanotify_should_send_event()
        fsnotify: generalize send_to_group()
        fsnotify: generalize iteration of marks by object type
        fsnotify: introduce marks iteration helpers
        fsnotify: remove redundant arguments to handle_event()
        fsnotify: use type id to identify connector object type
      dbb2816f
    • Linus Torvalds's avatar
      Merge tag 'fbdev-v4.18' of git://github.com/bzolnier/linux · 644f2639
      Linus Torvalds authored
      Pull fbdev updates from Bartlomiej Zolnierkiewicz:
       "There is nothing really major here, few small fixes, some cleanups and
        dead drivers removal:
      
         - mark omapfb drivers as orphans in MAINTAINERS file (Tomi Valkeinen)
      
         - add missing module license tags to omap/omapfb driver (Arnd
           Bergmann)
      
         - add missing GPIOLIB dependendy to omap2/omapfb driver (Arnd
           Bergmann)
      
         - convert savagefb, aty128fb & radeonfb drivers to use msleep & co.
           (Jia-Ju Bai)
      
         - allow COMPILE_TEST build for viafb driver (media part was reviewed
           by media subsystem Maintainer)
      
         - remove unused MERAM support from sh_mobile_lcdcfb and shmob-drm
           drivers (drm parts were acked by shmob-drm driver Maintainer)
      
         - remove unused auo_k190xfb drivers
      
         - misc cleanups (Souptick Joarder, Wolfram Sang, Markus Elfring, Andy
           Shevchenko, Colin Ian King)"
      
      * tag 'fbdev-v4.18' of git://github.com/bzolnier/linux: (26 commits)
        fb_omap2: add gpiolib dependency
        video/omap: add module license tags
        MAINTAINERS: make omapfb orphan
        video: fbdev: pxafb: match_string() conversion fixup
        video: fbdev: nvidia: fix spelling mistake: "scaleing" -> "scaling"
        video: fbdev: fix spelling mistake: "frambuffer" -> "framebuffer"
        video: fbdev: pxafb: Convert to use match_string() helper
        video: fbdev: via: allow COMPILE_TEST build
        video: fbdev: remove unused sh_mobile_meram driver
        drm: shmobile: remove unused MERAM support
        video: fbdev: sh_mobile_lcdcfb: remove unused MERAM support
        video: fbdev: remove unused auo_k190xfb drivers
        video: omap: Improve a size determination in omapfb_do_probe()
        video: sm501fb: Improve a size determination in sm501fb_probe()
        video: fbdev-MMP: Improve a size determination in path_init()
        video: fbdev-MMP: Delete an error message for a failed memory allocation in two functions
        video: auo_k190x: Delete an error message for a failed memory allocation in auok190x_common_probe()
        video: sh_mobile_lcdcfb: Delete an error message for a failed memory allocation in two functions
        video: sh_mobile_meram: Delete an error message for a failed memory allocation in sh_mobile_meram_probe()
        video: fbdev: sh_mobile_meram: Drop SUPERH platform dependency
        ...
      644f2639
    • Linus Torvalds's avatar
      Merge branch 'afs-proc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 35773c93
      Linus Torvalds authored
      Pull AFS updates from Al Viro:
       "Assorted AFS stuff - ended up in vfs.git since most of that consists
        of David's AFS-related followups to Christoph's procfs series"
      
      * 'afs-proc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        afs: Optimise callback breaking by not repeating volume lookup
        afs: Display manually added cells in dynamic root mount
        afs: Enable IPv6 DNS lookups
        afs: Show all of a server's addresses in /proc/fs/afs/servers
        afs: Handle CONFIG_PROC_FS=n
        proc: Make inline name size calculation automatic
        afs: Implement network namespacing
        afs: Mark afs_net::ws_cell as __rcu and set using rcu functions
        afs: Fix a Sparse warning in xdr_decode_AFSFetchStatus()
        proc: Add a way to make network proc files writable
        afs: Rearrange fs/afs/proc.c to remove remaining predeclarations.
        afs: Rearrange fs/afs/proc.c to move the show routines up
        afs: Rearrange fs/afs/proc.c by moving fops and open functions down
        afs: Move /proc management functions to the end of the file
      35773c93
    • Linus Torvalds's avatar
      Merge branch 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 29d6849d
      Linus Torvalds authored
      Pull compat updates from Al Viro:
       "Some biarch patches - getting rid of assorted (mis)uses of
        compat_alloc_user_space().
      
        Not much in that area this cycle..."
      
      * 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        orangefs: simplify compat ioctl handling
        signalfd: lift sigmask copyin and size checks to callers of do_signalfd4()
        vmsplice(): lift importing iovec into vmsplice(2) and compat counterpart
      29d6849d
    • Linus Torvalds's avatar
      Merge branch 'work.aio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · a5b729ea
      Linus Torvalds authored
      Pull aio fixes from Al Viro:
       "Assorted AIO followups and fixes"
      
      * 'work.aio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        eventpoll: switch to ->poll_mask
        aio: only return events requested in poll_mask() for IOCB_CMD_POLL
        eventfd: only return events requested in poll_mask()
        aio: mark __aio_sigset::sigmask const
      a5b729ea
  4. 15 Jun, 2018 26 commits