summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-01-11scsi: qla2xxx: Fix IOCB resource check warningNilesh Javali
Make qla_get_iocbs_resource() static to fix the warning: >> drivers/scsi/qla2xxx/qla_iocb.c:3820:5: warning: no previous prototype for >> 'qla_get_iocbs_resource' [-Wmissing-prototypes] 3820 | int qla_get_iocbs_resource(struct srb *sp) | ^~~~~~~~~~~~~~~~~~~~~~ Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Remove increment of interface err cntSaurav Kashyap
Residual underrun is not an interface error, hence no need to increment that count. Fixes: dbf1f53cfd23 ("scsi: qla2xxx: Implementation to get and manage host, target stats and initiator port") Cc: stable@vger.kernel.org Signed-off-by: Saurav Kashyap <skashyap@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Fix erroneous link downQuinn Tran
If after an adapter reset the appearance of link is not recovered, the devices are not rediscovered. This is result of a race condition between adapter reset (abort_isp) and the topology scan. During adapter reset, the ABORT_ISP_ACTIVE flag is set. Topology scan usually occurred after adapter reset. In this case, the topology scan came earlier than usual where it ran into problem due to ABORT_ISP_ACTIVE flag was still set. kernel: qla2xxx [0000:13:00.0]-1005:1: Cmd 0x6a aborted with timeout since ISP Abort is pending kernel: qla2xxx [0000:13:00.0]-28a0:1: MBX_GET_PORT_NAME failed, No FL Port. kernel: qla2xxx [0000:13:00.0]-286b:1: qla2x00_configure_loop: exiting normally. local port wwpn 51402ec0123d9a80 id 012300) kernel: qla2xxx [0000:13:00.0]-8017:1: ADAPTER RESET SUCCEEDED nexus=1:0:15. Allow adapter reset to complete before any scan can start. Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran <qutran@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Remove unintended flag clearingQuinn Tran
FCF_ASYNC_SENT flag is used in session management. This flag is cleared in task management path by accident. Remove unintended flag clearing. Fixes: 388a49959ee4 ("scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd") Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran <qutran@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Fix stalled loginQuinn Tran
If a login failed due to low FW resources, the session can stall and will not be connected. Reset session state to allow relogin logic to redrive the connection. Signed-off-by: Quinn Tran <qutran@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Fix exchange oversubscription for management commandsQuinn Tran
Add resource checking for management (non-I/O) commands. Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking") Signed-off-by: Quinn Tran <qutran@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Fix exchange oversubscriptionQuinn Tran
In large environment, it is possible to experience command timeout and escalation of path recovery. Currently the driver does not track the number of exchanges/commands sent to FW. If there is a delay for commands at the head of the queue, then this will create back pressure for commands at the back of the queue. Check for exchange availability before command submission. Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking") Signed-off-by: Quinn Tran <qutran@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requestsArun Easi
The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map error [device address=0x00000002a3ff38d8] [size=1024 bytes] [mapped as single] WARNING: CPU: 0 PID: 2930 at kernel/dma/debug.c:1017 check_unmap+0xf42/0x1990 Call Trace: debug_dma_unmap_page+0xc9/0x100 qla_nvme_ls_unmap+0x141/0x210 [qla2xxx] Remove DMA mapping from the driver altogether, as it is already done by FC layer. This prevents the warning. Fixes: c85ab7d9e27a ("scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests") Cc: stable@vger.kernel.org Signed-off-by: Arun Easi <aeasi@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Fix link failure in NPIV environmentQuinn Tran
User experienced symptoms of adapter failure in NPIV environment. NPIV hosts were allowed to trigger chip reset back to back due to NPIV link state being slow to come online. Fix link failure in NPIV environment by removing NPIV host from directly being able to perform chip reset. kernel: qla2xxx [0000:04:00.1]-6009:261: Loop down - aborting ISP. kernel: qla2xxx [0000:04:00.1]-6009:262: Loop down - aborting ISP. kernel: qla2xxx [0000:04:00.1]-6009:281: Loop down - aborting ISP. kernel: qla2xxx [0000:04:00.1]-6009:285: Loop down - aborting ISP Fixes: 0d6e61bc6a4f ("[SCSI] qla2xxx: Correct various NPIV issues.") Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran <qutran@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: qla2xxx: Check if port is online before sending ELSShreyas Deodhar
CT Ping and ELS cmds fail for NVMe targets. Check if port is online before sending ELS instead of sending login. Cc: stable@vger.kernel.org Signed-off-by: Shreyas Deodhar <sdeodhar@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: ufs: ufs-unisoc: Add support for Unisoc UFS host controllerZhe Wang
Add driver code for Unisoc UFS host controller, along with UFS initialization. Signed-off-by: Zhe Wang <zhe.wang1@unisoc.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2023-01-11scsi: ufs: dt-bindings: Add document for Unisoc UFS host controllerZhe Wang
Add Unisoc ums9620 UFS host controller devicetree document. Signed-off-by: Zhe Wang <zhe.wang1@unisoc.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30Merge patch series "scsi: ufs: core: Always read the descriptors with max ↵Martin K. Petersen
length" Arthur Simchaev <Arthur.Simchaev@wdc.com> says: Read any descriptor with a maximum size of QUERY_DESC_MAX_SIZE. According to the spec the device returns the actual size. Thus can improve code readability and save CPU cycles. While at it, clean up few leftovers around the descriptor size parameter. Link: https://lore.kernel.org/r/1670763911-8695-1-git-send-email-Arthur.Simchaev@wdc.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Remove ufshcd_map_desc_id_to_length()Arthur Simchaev
There shouldn't be any restriction of the descriptor size (not the descriptor id for that matter) up to QUERY_DESC_MAX_SIZE. According to the spec, the caller can use any descriptor size, and it is up to the device to return the actual size. Therefore there shouldn't be any sizes hardcoded in the kernel, nor any need to cache it, hence the ufshcd_map_desc_id_to_length() function is redundant. Always read the descriptors with QUERY_DESC_MAX_SIZE size. Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bean Huo <beanhuo@micron.com> Suggested-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Arthur Simchaev <Arthur.Simchaev@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Remove len parameter from ufshcd_set_active_icc_lvl()Arthur Simchaev
len argument is not used anymore in ufshcd_set_active_icc_lvl() function. Signed-off-by: Arthur Simchaev <Arthur.Simchaev@wdc.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Remove redundant desc_size variable from hbaArthur Simchaev
Always read the descriptor with QUERY_DESC_MAX_SIZE. According to the spec, the device returns the actual size. Signed-off-by: Arthur Simchaev <Arthur.Simchaev@wdc.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Remove redundant wb checkArthur Simchaev
We used to use the extended-feature field in the device descriptor as an indication that the device supported UFS 2.2 or later. Remove that as this check is specifically done few lines above. Signed-off-by: Arthur Simchaev <Arthur.Simchaev@wdc.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Stanley Chu <stanley.chu@mediatek.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30Merge patch series "Prepare for upstreaming Pixel 6 and 7 UFS support"Martin K. Petersen
Bart Van Assche <bvanassche@acm.org> says: The patches in this series are a first step towards integrating support in the upstream kernel for the UFS controller in the Pixel 6 and 7. [mkp: resolve conflict with RPMB series] Link: https://lore.kernel.org/r/20221208234358.252031-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Allow UFS host drivers to override the sg entry sizeEric Biggers
Modify the UFSHCD core to allow 'struct ufshcd_sg_entry' to be variable-length. The default is the standard length, but variants can override ufs_hba::sg_entry_size with a larger value if there are vendor-specific fields following the standard ones. This is needed to support inline encryption with ufs-exynos (FMP). Cc: Eric Biggers <ebiggers@google.com> Reviewed-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Eric Biggers <ebiggers@google.com> [ bvanassche: edited commit message and introduced CONFIG_SCSI_UFS_VARIABLE_SG_ENTRY_SIZE ] Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Pass the clock scaling timeout as an argumentBart Van Assche
Prepare for adding an additional ufshcd_clock_scaling_prepare() call with a different timeout. Reviewed-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Reduce the clock scaling latencyBart Van Assche
Wait at most 20 ms before rechecking the doorbells instead of waiting for a potentially long time between doorbell checks. Reviewed-by: Avri Altman <avri.altman@wdc.com> Reviewed-by: Stanley Chu <stanley.chu@mediatek.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30Merge patch series "scsi: ufs: ufs-qcom: Debug clean ups"Martin K. Petersen
Andrew Halaney <ahalaney@redhat.com> says: This patch series attempts to clean up some debug code paths in the ufs-qcom driver. Link: https://lore.kernel.org/r/20221201230810.1019834-1-ahalaney@redhat.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: ufs-qcom: Use dev_err() where possibleAndrew Halaney
dev_err() statements are better to use than pr_err(), so switch to those. In a similar vein, the check on the dev_req_params pointer here is not needed, the two places this function is called never pass in a NULL pointer, so instead of using dev_err() there just remove it. Signed-off-by: Andrew Halaney <ahalaney@redhat.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Asutosh Das <quic_asutoshd@quicinc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: ufs-qcom: Remove usage of dbg_print_enAndrew Halaney
This bitmask is unconditionally set in the current driver, so all conditionals using it can be considered bit rot. Let's take the current default conditional path everywhere and remove dbg_print_en from the driver. Signed-off-by: Andrew Halaney <ahalaney@redhat.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Asutosh Das <quic_asutoshd@quicinc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: ufs-qcom: Clean up dbg_register_dumpAndrew Halaney
The current implementation has abstractions that don't give any benefits. The print_fn callback (and its only callback implementation, ufs_qcom_dump_regs_wrapper()) was only used by ufs_qcom_print_hw_debug_reg_all() and just multiplies len by 4 before calling ufshcd_dump_regs(). ufs_qcom_print_hw_debug_reg_all() is only called by ufs_qcom_dump_dbg_regs(). There's no real gain in those abstractions, so let's just do the work directly in ufs_qcom_dump_dbg_regs() (the dbg_register_dump callback). Signed-off-by: Andrew Halaney <ahalaney@redhat.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Asutosh Das <quic_asutoshd@quicinc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: ufs-qcom: Drop unnecessary NULL checksAndrew Halaney
This code path is only called through one function, and the HBA struct is already accessed in ufshcd_vops_dbg_register_dump() prior to calling so there is no way for it to be NULL. Likewise, the print_fn callback is always supplied within this driver and is always provided. Signed-off-by: Andrew Halaney <ahalaney@redhat.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Asutosh Das <quic_asutoshd@quicinc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30Merge patch series "UFS Advanced RPMB"Martin K. Petersen
Bean Huo <beanhuo@iokpp.de> says: This series of changes is to add support for UFS advanced RPMB in ufs_bsg. The advanced RPMB application of user space is ufs_utils, the reference code is at: https://github.com/beanhuo/ufs-utils-Micron/blob/ufs_arpmb/ufs_arpmb.c. Changes to ufs_utils will be pushed to: https://github.com/westerndigitalcorporation/ufs-utils Link: https://lore.kernel.org/r/20221201140437.549272-1-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsgBean Huo
Add advanced RPMB support in ufs_bsg: 1. According to the UFS specification, only one RPMB operation can be performed at any time. We can ensure this by using reserved slot and its dev_cmd sync operation protection mechanism. 2. For Advanced RPMB, RPMB metadata is packaged in an EHS (Extra Header Segment) of a command UPIU, and the corresponding reply EHS (from the device) should also be returned to the user space. bsg_job->request and bsg_job->reply allow us to pass and return EHS from/back to userspace. Compared to normal/legacy RPMB, the advantages of advanced RPMB are: 1. The data length in the Advanced RPMB data read/write command can be larger than 4KB. For the legacy RPMB, the data length in a single RPMB data transfer is 256 bytes. 2. All of the advanced RPMB operations will be a single command. For legacy RPMB, take the read write-counter value as an example, you need two commands (first SECURITY PROTOCOL OUT, then second SECURITY PROTOCOL IN). Signed-off-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Pass EHS length into ufshcd_prepare_req_desc_hdr()Bean Huo
We need to fill in the total EHS length in UTP Transfer Request Descriptor. Add this functionality to ufshcd_prepare_req_desc_hdr(). Signed-off-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Advanced RPMB detectionBean Huo
Check UFS Advanced RPMB LU enablement during ufshcd_lu_init(). Signed-off-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: core: Split ufshcd_map_sg()Bean Huo
Take out the "map scatter-gather list to prdt" part of the code in ufshcd_map_sg() and split it into a new function ufshcd_sgl_to_prdt(). Signed-off-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: bsg: Clean up ufs_bsg_request()Bean Huo
Move sg_copy_from_buffer() below its associated case statement. Signed-off-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: bsg: Remove unnecessary length checkupBean Huo
Remove checks on job->request_len and job->reply_len because msgcode checks in a subseqent commit will rule out malicious requests. Signed-off-by: Bean Huo <beanhuo@micron.com> Acked-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: ufs: bsg: Let result in struct ufs_bsg_reply be signed intBean Huo
According to the comments in struct ufs_bsg_reply and its usage, the result should be signed int, not __u32. Signed-off-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30Merge patch series "scsi: libsas: Some coding style fixes and cleanups"Martin K. Petersen
Jason Yan <yanaijie@huawei.com> says: A few coding style fixes and cleanups. There should be no functional changes in this series besides the debug log prints. Link: https://lore.kernel.org/r/20221214133808.1649122-1-yanaijie@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: libsas: Factor out sas_ex_add_dev()Jason Yan
Factor out sas_ex_add_dev() to be consistent with sas_ata_add_dev() and unify the error handling. Cc: John Garry <john.g.garry@oracle.com> Signed-off-by: Jason Yan <yanaijie@huawei.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: libsas: Factor out sas_ata_add_dev()Jason Yan
Factor out sas_ata_add_dev() and put it in sas_ata.c since it is a SATA related interface. Also follow the standard coding style to define an inline empty function when CONFIG_SCSI_SAS_ATA is not enabled. Cc: John Garry <john.g.garry@oracle.com> Signed-off-by: Jason Yan <yanaijie@huawei.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: libsas: Remove useless dev_list delete in sas_ex_discover_end_dev()Jason Yan
The domain device 'child' is allocated in sas_ex_discover_end_dev() and used to be added to the dev_list in this function. After the following two fixes the device is added to the disco_list instead. As a result, the list_del() and locking left behind is now redundant. Fixes: 87c8331fcf72 ("[SCSI] libsas: prevent domain rediscovery competing with ata error handling") Fixes: 92625f9bff38 ("[SCSI] libsas: restore scan order") Cc: John Garry <john.g.garry@oracle.com> Signed-off-by: Jason Yan <yanaijie@huawei.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: libsas: Change the coding style of sas_discover_sata()Jason Yan
The coding style where calling this interface is inconsistent with other interfaces for SATA devices. The standard style for other SATA interfaces is like: #ifdefine CONFIG_SCSI_SAS_ATA void sas_ata_task_abort(struct sas_task *task); #else static inline void sas_ata_task_abort(struct sas_task *task) { } #endif And the callers does not have to do things like "#ifdefine CONFIG_SCSI_SAS_ATA" and may call the interface directly. So follow the standard style here. Cc: John Garry <john.g.garry@oracle.com> Signed-off-by: Jason Yan <yanaijie@huawei.com> Reviewed-by: Jack Wang <jinpu.wang@ionos.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-30scsi: libsas: Move sas_get_ata_command_set() up to save the declarationJason Yan
There is a sas_get_ata_command_set() declaration above sas_get_ata_info() to make it compile. However, this function is defined in the same file. Move it up to save the forward declaration. Also remove the variable 'fis' which is not needed in this function. Cc: John Garry <john.g.garry@oracle.com> Signed-off-by: Jason Yan <yanaijie@huawei.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Jack Wang <jinpu.wang@ionos.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-12-25Linux 6.2-rc1v6.2-rc1Linus Torvalds
2022-12-25treewide: Convert del_timer*() to timer_shutdown*()Steven Rostedt (Google)
Due to several bugs caused by timers being re-armed after they are shutdown and just before they are freed, a new state of timers was added called "shutdown". After a timer is set to this state, then it can no longer be re-armed. The following script was run to find all the trivial locations where del_timer() or del_timer_sync() is called in the same function that the object holding the timer is freed. It also ignores any locations where the timer->function is modified between the del_timer*() and the free(), as that is not considered a "trivial" case. This was created by using a coccinelle script and the following commands: $ cat timer.cocci @@ expression ptr, slab; identifier timer, rfield; @@ ( - del_timer(&ptr->timer); + timer_shutdown(&ptr->timer); | - del_timer_sync(&ptr->timer); + timer_shutdown_sync(&ptr->timer); ) ... when strict when != ptr->timer ( kfree_rcu(ptr, rfield); | kmem_cache_free(slab, ptr); | kfree(ptr); ) $ spatch timer.cocci . > /tmp/t.patch $ patch -p1 < /tmp/t.patch Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/ Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ] Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ] Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-12-23Merge tag 'spi-fix-v6.2-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One driver specific change here which handles the case where a SPI device for some reason tries to change the bus speed during a message on fsl_spi hardware, this should be very unusual" * tag 'spi-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: fsl_spi: Don't change speed while chipselect is active
2022-12-23Merge tag 'regulator-fix-v6.2-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "Two core fixes here, one for a long standing race which some Qualcomm systems have started triggering with their UFS driver and another fixing a problem with supply lookup introduced by the fixes for devm related use after free issues that were introduced in this merge window" * tag 'regulator-fix-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: fix deadlock on regulator enable regulator: core: Fix resolve supply lookup issue
2022-12-23Merge tag 'coccinelle-6.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull coccicheck update from Julia Lawall: "Modernize use of grep in coccicheck: Use 'grep -E' instead of 'egrep'" * tag 'coccinelle-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: scripts: coccicheck: use "grep -E" instead of "egrep"
2022-12-23Merge tag 'hardening-v6.2-rc1-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kernel hardening fixes from Kees Cook: - Fix CFI failure with KASAN (Sami Tolvanen) - Fix LKDTM + CFI under GCC 7 and 8 (Kristina Martsenko) - Limit CONFIG_ZERO_CALL_USED_REGS to Clang > 15.0.6 (Nathan Chancellor) - Ignore "contents" argument in LoadPin's LSM hook handling - Fix paste-o in /sys/kernel/warn_count API docs - Use READ_ONCE() consistently for oops/warn limit reading * tag 'hardening-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: cfi: Fix CFI failure with KASAN exit: Use READ_ONCE() for all oops/warn limit reads security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 lkdtm: cfi: Make PAC test work with GCC 7 and 8 docs: Fix path paste-o for /sys/kernel/warn_count LoadPin: Ignore the "contents" argument of the LSM hooks
2022-12-23Merge tag 'pstore-v6.2-rc1-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore fixes from Kees Cook: - Switch pmsg_lock to an rt_mutex to avoid priority inversion (John Stultz) - Correctly assign mem_type property (Luca Stefani) * tag 'pstore-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore: Properly assign mem_type property pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
2022-12-23Merge tag 'dma-mapping-2022-12-23' of ↵Linus Torvalds
git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: "Fix up the sound code to not pass __GFP_COMP to the non-coherent DMA allocator, as it copes with that just as badly as the coherent allocator, and then add a check to make sure no one passes the flag ever again" * tag 'dma-mapping-2022-12-23' of git://git.infradead.org/users/hch/dma-mapping: dma-mapping: reject GFP_COMP for noncoherent allocations ALSA: memalloc: don't use GFP_COMP for non-coherent dma allocations
2022-12-23Merge tag '9p-for-6.2-rc1' of https://github.com/martinetd/linuxLinus Torvalds
Pull 9p updates from Dominique Martinet: - improve p9_check_errors to check buffer size instead of msize when possible (e.g. not zero-copy) - some more syzbot and KCSAN fixes - minor headers include cleanup * tag '9p-for-6.2-rc1' of https://github.com/martinetd/linux: 9p/client: fix data race on req->status net/9p: fix response size check in p9_check_errors() net/9p: distinguish zero-copy requests 9p/xen: do not memcpy header into req->rc 9p: set req refcount to zero to avoid uninitialized usage 9p/net: Remove unneeded idr.h #include 9p/fs: Remove unneeded idr.h #include
2022-12-23Merge tag 'sound-6.2-rc1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull more sound updates from Takashi Iwai: "A few more updates for 6.2: most of changes are about ASoC device-specific fixes. - Lots of ASoC Intel AVS extensions and refactoring - Quirks for ASoC Intel SOF as well as regression fixes - ASoC Mediatek and Rockchip fixes - Intel HD-audio HDMI workarounds - Usual HD- and USB-audio device-specific quirks" * tag 'sound-6.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (54 commits) ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless ALSA: azt3328: Remove the unused function snd_azf3328_codec_outl() ASoC: lochnagar: Fix unused lochnagar_of_match warning ASoC: Intel: Add HP Stream 8 to bytcr_rt5640.c ASoC: SOF: mediatek: initialize panic_info to zero ASoC: rt5670: Remove unbalanced pm_runtime_put() ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet ASoC: Intel: soc-acpi: update codec addr on 0C11/0C4F product ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: wm8994: Fix potential deadlock ASoC: mediatek: mt8195: add sof be ops to check audio active ASoC: SOF: Revert: "core: unregister clients and machine drivers in .shutdown" ASoC: SOF: Intel: pci-tgl: unblock S5 entry if DMA stop has failed" ALSA: hda/hdmi: fix stream-id config keep-alive for rt suspend ALSA: hda/hdmi: set default audio parameters for KAE silent-stream ALSA: hda/hdmi: fix i915 silent stream programming flow ALSA: hda: Error out if invalid stream is being setup ASoC: dt-bindings: fsl-sai: Reinstate i.MX93 SAI compatible string ASoC: soc-pcm.c: Clear DAIs parameters after stream_active is updated ASoC: codecs: wcd-clsh: Remove the unused function ...