Skip to content

Commit 9cfd9c4

Browse files
torvaldstorvalds
committed
Merge tag 'char-misc-5.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc driver fixes from Greg KH: "Here are some small char/misc/whatever driver fixes for 5.10-rc4. Nothing huge, lots of small fixes for reported issues: - habanalabs driver fixes - speakup driver fixes - uio driver fixes - virtio driver fix - other tiny driver fixes Full details are in the shortlog. All of these have been in linux-next for a full week with no reported issues" * tag 'char-misc-5.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: uio: Fix use-after-free in uio_unregister_device() firmware: xilinx: fix out-of-bounds access nitro_enclaves: Fixup type and simplify logic of the poll mask setup speakup ttyio: Do not schedule() in ttyio_in_nowait speakup: Fix clearing selection in safe context speakup: Fix var_id_t values and thus keymap virtio: virtio_console: fix DMA memory allocation for rproc serial habanalabs/gaudi: mask WDT error in QMAN habanalabs/gaudi: move coresight mmu config habanalabs: fix kernel pointer type mei: protect mei_cl_mtu from null dereference
2 parents 281b3ec + 092561f commit 9cfd9c4

20 files changed

Lines changed: 95 additions & 99 deletions

File tree

‎drivers/accessibility/speakup/main.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,6 @@ static void speakup_cut(struct vc_data *vc)
357357
mark_cut_flag = 0;
358358
synth_printf("%s\n", spk_msg_get(MSG_CUT));
359359

360-
speakup_clear_selection();
361360
ret = speakup_set_selection(tty);
362361

363362
switch (ret) {

‎drivers/accessibility/speakup/selection.c‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,6 @@ struct speakup_selection_work {
2222
struct tty_struct *tty;
2323
};
2424

25-
void speakup_clear_selection(void)
26-
{
27-
console_lock();
28-
clear_selection();
29-
console_unlock();
30-
}
31-
3225
static void __speakup_set_selection(struct work_struct *work)
3326
{
3427
struct speakup_selection_work *ssw =
@@ -51,6 +44,10 @@ static void __speakup_set_selection(struct work_struct *work)
5144
goto unref;
5245
}
5346

47+
console_lock();
48+
clear_selection();
49+
console_unlock();
50+
5451
set_selection_kernel(&sel, tty);
5552

5653
unref:

‎drivers/accessibility/speakup/speakup.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,6 @@ void spk_do_flush(void);
7070
void speakup_start_ttys(void);
7171
void synth_buffer_add(u16 ch);
7272
void synth_buffer_clear(void);
73-
void speakup_clear_selection(void);
7473
int speakup_set_selection(struct tty_struct *tty);
7574
void speakup_cancel_selection(void);
7675
int speakup_paste_selection(struct tty_struct *tty);

‎drivers/accessibility/speakup/spk_ttyio.c‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -298,11 +298,13 @@ static unsigned char ttyio_in(int timeout)
298298
struct spk_ldisc_data *ldisc_data = speakup_tty->disc_data;
299299
char rv;
300300

301-
if (wait_for_completion_timeout(&ldisc_data->completion,
301+
if (!timeout) {
302+
if (!try_wait_for_completion(&ldisc_data->completion))
303+
return 0xff;
304+
} else if (wait_for_completion_timeout(&ldisc_data->completion,
302305
usecs_to_jiffies(timeout)) == 0) {
303-
if (timeout)
304-
pr_warn("spk_ttyio: timeout (%d) while waiting for input\n",
305-
timeout);
306+
pr_warn("spk_ttyio: timeout (%d) while waiting for input\n",
307+
timeout);
306308
return 0xff;
307309
}
308310

‎drivers/accessibility/speakup/spk_types.h‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ enum {
3232
E_NEW_DEFAULT,
3333
};
3434

35+
/*
36+
* Note: add new members at the end, speakupmap.h depends on the values of the
37+
* enum starting from SPELL_DELAY (see inc_dec_var)
38+
*/
3539
enum var_id_t {
3640
VERSION = 0, SYNTH, SILENT, SYNTH_DIRECT,
3741
KEYMAP, CHARS,
@@ -42,9 +46,9 @@ enum var_id_t {
4246
SAY_CONTROL, SAY_WORD_CTL, NO_INTERRUPT, KEY_ECHO,
4347
SPELL_DELAY, PUNC_LEVEL, READING_PUNC,
4448
ATTRIB_BLEEP, BLEEPS,
45-
RATE, PITCH, INFLECTION, VOL, TONE, PUNCT, VOICE, FREQUENCY, LANG,
49+
RATE, PITCH, VOL, TONE, PUNCT, VOICE, FREQUENCY, LANG,
4650
DIRECT, PAUSE,
47-
CAPS_START, CAPS_STOP, CHARTAB,
51+
CAPS_START, CAPS_STOP, CHARTAB, INFLECTION,
4852
MAXVARS
4953
};
5054

‎drivers/char/virtio_console.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -435,12 +435,12 @@ static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size
435435
/*
436436
* Allocate DMA memory from ancestor. When a virtio
437437
* device is created by remoteproc, the DMA memory is
438-
* associated with the grandparent device:
439-
* vdev => rproc => platform-dev.
438+
* associated with the parent device:
439+
* virtioY => remoteprocX#vdevYbuffer.
440440
*/
441-
if (!vdev->dev.parent || !vdev->dev.parent->parent)
441+
buf->dev = vdev->dev.parent;
442+
if (!buf->dev)
442443
goto free_buf;
443-
buf->dev = vdev->dev.parent->parent;
444444

445445
/* Increase device refcnt to avoid freeing it */
446446
get_device(buf->dev);

‎drivers/firmware/xilinx/zynqmp.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,9 @@ static int zynqmp_pm_feature(u32 api_id)
147147
return 0;
148148

149149
/* Return value if feature is already checked */
150+
if (api_id > ARRAY_SIZE(zynqmp_pm_features))
151+
return PM_FEATURE_INVALID;
152+
150153
if (zynqmp_pm_features[api_id] != PM_FEATURE_UNCHECKED)
151154
return zynqmp_pm_features[api_id];
152155

‎drivers/misc/habanalabs/common/command_buffer.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -142,11 +142,10 @@ static void cb_fini(struct hl_device *hdev, struct hl_cb *cb)
142142
{
143143
if (cb->is_internal)
144144
gen_pool_free(hdev->internal_cb_pool,
145-
cb->kernel_address, cb->size);
145+
(uintptr_t)cb->kernel_address, cb->size);
146146
else
147147
hdev->asic_funcs->asic_dma_free_coherent(hdev, cb->size,
148-
(void *) (uintptr_t) cb->kernel_address,
149-
cb->bus_address);
148+
cb->kernel_address, cb->bus_address);
150149

151150
kfree(cb);
152151
}
@@ -230,7 +229,7 @@ static struct hl_cb *hl_cb_alloc(struct hl_device *hdev, u32 cb_size,
230229
return NULL;
231230
}
232231

233-
cb->kernel_address = (u64) (uintptr_t) p;
232+
cb->kernel_address = p;
234233
cb->size = cb_size;
235234

236235
return cb;
@@ -509,7 +508,7 @@ int hl_cb_mmap(struct hl_fpriv *hpriv, struct vm_area_struct *vma)
509508

510509
vma->vm_private_data = cb;
511510

512-
rc = hdev->asic_funcs->cb_mmap(hdev, vma, (void *) cb->kernel_address,
511+
rc = hdev->asic_funcs->cb_mmap(hdev, vma, cb->kernel_address,
513512
cb->bus_address, cb->size);
514513
if (rc) {
515514
spin_lock(&cb->lock);

‎drivers/misc/habanalabs/common/habanalabs.h‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -452,7 +452,7 @@ struct hl_cb {
452452
struct list_head pool_list;
453453
struct list_head va_block_list;
454454
u64 id;
455-
u64 kernel_address;
455+
void *kernel_address;
456456
dma_addr_t bus_address;
457457
u32 mmap_size;
458458
u32 size;
@@ -515,7 +515,7 @@ struct hl_hw_queue {
515515
struct hl_hw_sob hw_sob[HL_RSVD_SOBS];
516516
struct hl_cs_job **shadow_queue;
517517
enum hl_queue_type queue_type;
518-
u64 kernel_address;
518+
void *kernel_address;
519519
dma_addr_t bus_address;
520520
u32 pi;
521521
atomic_t ci;
@@ -544,7 +544,7 @@ struct hl_hw_queue {
544544
*/
545545
struct hl_cq {
546546
struct hl_device *hdev;
547-
u64 kernel_address;
547+
void *kernel_address;
548548
dma_addr_t bus_address;
549549
u32 cq_idx;
550550
u32 hw_queue_id;
@@ -562,7 +562,7 @@ struct hl_cq {
562562
*/
563563
struct hl_eq {
564564
struct hl_device *hdev;
565-
u64 kernel_address;
565+
void *kernel_address;
566566
dma_addr_t bus_address;
567567
u32 ci;
568568
};
@@ -757,7 +757,7 @@ struct hl_asic_funcs {
757757
u32 (*get_dma_desc_list_size)(struct hl_device *hdev,
758758
struct sg_table *sgt);
759759
void (*add_end_of_cb_packets)(struct hl_device *hdev,
760-
u64 kernel_address, u32 len,
760+
void *kernel_address, u32 len,
761761
u64 cq_addr, u32 cq_val, u32 msix_num,
762762
bool eb);
763763
void (*update_eq_ci)(struct hl_device *hdev, u32 val);
@@ -1382,13 +1382,13 @@ void hl_wreg(struct hl_device *hdev, u32 reg, u32 val);
13821382
for (;;) { \
13831383
/* Verify we read updates done by other cores or by device */ \
13841384
mb(); \
1385-
(val) = *((u32 *) (uintptr_t) (addr)); \
1385+
(val) = *((u32 *)(addr)); \
13861386
if (mem_written_by_device) \
13871387
(val) = le32_to_cpu(*(__le32 *) &(val)); \
13881388
if (cond) \
13891389
break; \
13901390
if (timeout_us && ktime_compare(ktime_get(), __timeout) > 0) { \
1391-
(val) = *((u32 *) (uintptr_t) (addr)); \
1391+
(val) = *((u32 *)(addr)); \
13921392
if (mem_written_by_device) \
13931393
(val) = le32_to_cpu(*(__le32 *) &(val)); \
13941394
break; \

‎drivers/misc/habanalabs/common/hw_queue.c‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ static void ext_and_hw_queue_submit_bd(struct hl_device *hdev,
7575
{
7676
struct hl_bd *bd;
7777

78-
bd = (struct hl_bd *) (uintptr_t) q->kernel_address;
78+
bd = q->kernel_address;
7979
bd += hl_pi_2_offset(q->pi);
8080
bd->ctl = cpu_to_le32(ctl);
8181
bd->len = cpu_to_le32(len);
@@ -335,8 +335,7 @@ static void int_queue_schedule_job(struct hl_cs_job *job)
335335
bd.len = cpu_to_le32(job->job_cb_size);
336336
bd.ptr = cpu_to_le64((u64) (uintptr_t) job->user_cb);
337337

338-
pi = (__le64 *) (uintptr_t) (q->kernel_address +
339-
((q->pi & (q->int_queue_len - 1)) * sizeof(bd)));
338+
pi = q->kernel_address + (q->pi & (q->int_queue_len - 1)) * sizeof(bd);
340339

341340
q->pi++;
342341
q->pi &= ((q->int_queue_len << 1) - 1);
@@ -630,7 +629,7 @@ static int ext_and_cpu_queue_init(struct hl_device *hdev, struct hl_hw_queue *q,
630629
if (!p)
631630
return -ENOMEM;
632631

633-
q->kernel_address = (u64) (uintptr_t) p;
632+
q->kernel_address = p;
634633

635634
q->shadow_queue = kmalloc_array(HL_QUEUE_LENGTH,
636635
sizeof(*q->shadow_queue),
@@ -653,11 +652,11 @@ static int ext_and_cpu_queue_init(struct hl_device *hdev, struct hl_hw_queue *q,
653652
if (is_cpu_queue)
654653
hdev->asic_funcs->cpu_accessible_dma_pool_free(hdev,
655654
HL_QUEUE_SIZE_IN_BYTES,
656-
(void *) (uintptr_t) q->kernel_address);
655+
q->kernel_address);
657656
else
658657
hdev->asic_funcs->asic_dma_free_coherent(hdev,
659658
HL_QUEUE_SIZE_IN_BYTES,
660-
(void *) (uintptr_t) q->kernel_address,
659+
q->kernel_address,
661660
q->bus_address);
662661

663662
return rc;
@@ -676,7 +675,7 @@ static int int_queue_init(struct hl_device *hdev, struct hl_hw_queue *q)
676675
return -EFAULT;
677676
}
678677

679-
q->kernel_address = (u64) (uintptr_t) p;
678+
q->kernel_address = p;
680679
q->pi = 0;
681680
atomic_set(&q->ci, 0);
682681

@@ -704,7 +703,7 @@ static int hw_queue_init(struct hl_device *hdev, struct hl_hw_queue *q)
704703
if (!p)
705704
return -ENOMEM;
706705

707-
q->kernel_address = (u64) (uintptr_t) p;
706+
q->kernel_address = p;
708707

709708
/* Make sure read/write pointers are initialized to start of queue */
710709
atomic_set(&q->ci, 0);
@@ -839,11 +838,11 @@ static void queue_fini(struct hl_device *hdev, struct hl_hw_queue *q)
839838
if (q->queue_type == QUEUE_TYPE_CPU)
840839
hdev->asic_funcs->cpu_accessible_dma_pool_free(hdev,
841840
HL_QUEUE_SIZE_IN_BYTES,
842-
(void *) (uintptr_t) q->kernel_address);
841+
q->kernel_address);
843842
else
844843
hdev->asic_funcs->asic_dma_free_coherent(hdev,
845844
HL_QUEUE_SIZE_IN_BYTES,
846-
(void *) (uintptr_t) q->kernel_address,
845+
q->kernel_address,
847846
q->bus_address);
848847
}
849848

0 commit comments

Comments
 (0)