14 Nov, 2018

1 commit

  • commit 5bf59773aaf36dd62117dc83d50e1bbf9ef432da upstream.

    Use the new of_get_compatible_child() helper to lookup the nfc child
    node instead of using of_find_compatible_node(), which searches the
    entire tree from a given start node and thus can return an unrelated
    (i.e. non-child) node.

    This also addresses a potential use-after-free (e.g. after probe
    deferral) as the tree-wide helper drops a reference to its first
    argument (i.e. the parent node).

    Fixes: e097dc624f78 ("NFC: nfcmrvl: add UART driver")
    Fixes: d8e018c0b321 ("NFC: nfcmrvl: update device tree bindings for Marvell NFC")
    Cc: stable # 4.2
    Cc: Vincent Cuissard
    Cc: Samuel Ortiz
    Signed-off-by: Johan Hovold
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     

02 Jul, 2018

1 commit


28 Jun, 2018

1 commit

  • The USB completion callback does not disable interrupts while acquiring
    the lock. We want to remove the local_irq_disable() invocation from
    __usb_hcd_giveback_urb() and therefore it is required for the callback
    handler to disable the interrupts while acquiring the lock.
    The callback may be invoked either in IRQ or BH context depending on the
    USB host controller.
    Use the _irqsave() variant of the locking primitives.

    Cc: Samuel Ortiz
    Cc: linux-wireless@vger.kernel.org
    Signed-off-by: Sebastian Andrzej Siewior
    Signed-off-by: Greg Kroah-Hartman

    Sebastian Andrzej Siewior
     

25 Jun, 2018

1 commit

  • pn533_recv_response() is an urb completion handler, so it must use
    GFP_ATOMIC. pn533_usb_send_frame() OTOH runs from a regular sleeping
    context, so the pn533_submit_urb_for_response() there (and only there)
    can use the regular GFP_KERNEL flags.

    BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1514134
    Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from ...")
    Cc: Michael Thalmeier
    Signed-off-by: Hans de Goede
    Signed-off-by: Greg Kroah-Hartman

    Hans de Goede
     

13 Jun, 2018

1 commit

  • The devm_kmalloc() function has a 2-factor argument form,
    devm_kmalloc_array(). This patch replaces cases of:

    devm_kmalloc(handle, a * b, gfp)

    with:
    devm_kmalloc_array(handle, a * b, gfp)

    as well as handling cases of:

    devm_kmalloc(handle, a * b * c, gfp)

    with:

    devm_kmalloc(handle, array3_size(a, b, c), gfp)

    as it's slightly less ugly than:

    devm_kmalloc_array(handle, array_size(a, b), c, gfp)

    This does, however, attempt to ignore constant size factors like:

    devm_kmalloc(handle, 4 * 1024, gfp)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    Some manual whitespace fixes were needed in this patch, as Coccinelle
    really liked to write "=devm_kmalloc..." instead of "= devm_kmalloc...".

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    expression HANDLE;
    type TYPE;
    expression THING, E;
    @@

    (
    devm_kmalloc(HANDLE,
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    devm_kmalloc(HANDLE,
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression HANDLE;
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    devm_kmalloc(HANDLE,
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    expression HANDLE;
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(TYPE) * (COUNT_ID)
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(TYPE) * COUNT_ID
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(TYPE) * (COUNT_CONST)
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(TYPE) * COUNT_CONST
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(THING) * (COUNT_ID)
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(THING) * COUNT_ID
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(THING) * (COUNT_CONST)
    + COUNT_CONST, sizeof(THING)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(THING) * COUNT_CONST
    + COUNT_CONST, sizeof(THING)
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    expression HANDLE;
    identifier SIZE, COUNT;
    @@

    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - SIZE * COUNT
    + COUNT, SIZE
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression HANDLE;
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    devm_kmalloc(HANDLE,
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression HANDLE;
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    devm_kmalloc(HANDLE,
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    devm_kmalloc(HANDLE,
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    expression HANDLE;
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    devm_kmalloc(HANDLE,
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products,
    // when they're not all constants...
    @@
    expression HANDLE;
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    devm_kmalloc(HANDLE, C1 * C2 * C3, ...)
    |
    devm_kmalloc(HANDLE,
    - (E1) * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - (E1) * (E2) * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - (E1) * (E2) * (E3)
    + array3_size(E1, E2, E3)
    , ...)
    |
    devm_kmalloc(HANDLE,
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants,
    // keeping sizeof() as the second factor argument.
    @@
    expression HANDLE;
    expression THING, E1, E2;
    type TYPE;
    constant C1, C2, C3;
    @@

    (
    devm_kmalloc(HANDLE, sizeof(THING) * C2, ...)
    |
    devm_kmalloc(HANDLE, sizeof(TYPE) * C2, ...)
    |
    devm_kmalloc(HANDLE, C1 * C2 * C3, ...)
    |
    devm_kmalloc(HANDLE, C1 * C2, ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(TYPE) * (E2)
    + E2, sizeof(TYPE)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(TYPE) * E2
    + E2, sizeof(TYPE)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(THING) * (E2)
    + E2, sizeof(THING)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - sizeof(THING) * E2
    + E2, sizeof(THING)
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - (E1) * E2
    + E1, E2
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - (E1) * (E2)
    + E1, E2
    , ...)
    |
    - devm_kmalloc
    + devm_kmalloc_array
    (HANDLE,
    - E1 * E2
    + E1, E2
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

31 May, 2018

1 commit

  • It's amazing that this driver ever worked, but now that x86 doesn't
    allow USB data to be sent off of the stack, it really does not work at
    all. Fix this up by properly allocating the data for the small
    "commands" that get sent to the device off of the stack.

    We do this for one command by having a whole urb just for ack messages,
    as they can be submitted in interrupt context, so we can not use
    usb_bulk_msg(). But the poweron command can sleep (and does), so use
    usb_bulk_msg() for that transfer.

    Reported-by: Carlos Manuel Santos
    Cc: Samuel Ortiz
    Cc: Stephen Hemminger
    Cc: stable
    Reviewed-by: Johan Hovold
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

22 Nov, 2017

3 commits

  • This converts all remaining setup_timer() calls that use a nested field
    to reach a struct timer_list. Coccinelle does not have an easy way to
    match multiple fields, so a new script is needed to change the matches of
    "&_E->_timer" into "&_E->_field1._timer" in all the rules.

    spatch --very-quiet --all-includes --include-headers \
    -I ./arch/x86/include -I ./arch/x86/include/generated \
    -I ./include -I ./arch/x86/include/uapi \
    -I ./arch/x86/include/generated/uapi -I ./include/uapi \
    -I ./include/generated/uapi --include ./include/linux/kconfig.h \
    --dir . \
    --cocci-file ~/src/data/timer_setup-2fields.cocci

    @fix_address_of depends@
    expression e;
    @@

    setup_timer(
    -&(e)
    +&e
    , ...)

    // Update any raw setup_timer() usages that have a NULL callback, but
    // would otherwise match change_timer_function_usage, since the latter
    // will update all function assignments done in the face of a NULL
    // function initialization in setup_timer().
    @change_timer_function_usage_NULL@
    expression _E;
    identifier _field1;
    identifier _timer;
    type _cast_data;
    @@

    (
    -setup_timer(&_E->_field1._timer, NULL, _E);
    +timer_setup(&_E->_field1._timer, NULL, 0);
    |
    -setup_timer(&_E->_field1._timer, NULL, (_cast_data)_E);
    +timer_setup(&_E->_field1._timer, NULL, 0);
    |
    -setup_timer(&_E._field1._timer, NULL, &_E);
    +timer_setup(&_E._field1._timer, NULL, 0);
    |
    -setup_timer(&_E._field1._timer, NULL, (_cast_data)&_E);
    +timer_setup(&_E._field1._timer, NULL, 0);
    )

    @change_timer_function_usage@
    expression _E;
    identifier _field1;
    identifier _timer;
    struct timer_list _stl;
    identifier _callback;
    type _cast_func, _cast_data;
    @@

    (
    -setup_timer(&_E->_field1._timer, _callback, _E);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, &_callback, _E);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, _callback, (_cast_data)_E);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, &_callback, (_cast_data)_E);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, (_cast_func)_callback, _E);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, (_cast_func)&_callback, _E);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, (_cast_func)_callback, (_cast_data)_E);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, (_cast_func)&_callback, (_cast_data)_E);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, _callback, (_cast_data)_E);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, _callback, (_cast_data)&_E);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, &_callback, (_cast_data)_E);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, &_callback, (_cast_data)&_E);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, (_cast_func)_callback, (_cast_data)_E);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, (_cast_func)_callback, (_cast_data)&_E);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, (_cast_func)&_callback, (_cast_data)_E);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, (_cast_func)&_callback, (_cast_data)&_E);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    _E->_field1._timer@_stl.function = _callback;
    |
    _E->_field1._timer@_stl.function = &_callback;
    |
    _E->_field1._timer@_stl.function = (_cast_func)_callback;
    |
    _E->_field1._timer@_stl.function = (_cast_func)&_callback;
    |
    _E._field1._timer@_stl.function = _callback;
    |
    _E._field1._timer@_stl.function = &_callback;
    |
    _E._field1._timer@_stl.function = (_cast_func)_callback;
    |
    _E._field1._timer@_stl.function = (_cast_func)&_callback;
    )

    // callback(unsigned long arg)
    @change_callback_handle_cast
    depends on change_timer_function_usage@
    identifier change_timer_function_usage._callback;
    identifier change_timer_function_usage._field1;
    identifier change_timer_function_usage._timer;
    type _origtype;
    identifier _origarg;
    type _handletype;
    identifier _handle;
    @@

    void _callback(
    -_origtype _origarg
    +struct timer_list *t
    )
    {
    (
    ... when != _origarg
    _handletype *_handle =
    -(_handletype *)_origarg;
    +from_timer(_handle, t, _field1._timer);
    ... when != _origarg
    |
    ... when != _origarg
    _handletype *_handle =
    -(void *)_origarg;
    +from_timer(_handle, t, _field1._timer);
    ... when != _origarg
    |
    ... when != _origarg
    _handletype *_handle;
    ... when != _handle
    _handle =
    -(_handletype *)_origarg;
    +from_timer(_handle, t, _field1._timer);
    ... when != _origarg
    |
    ... when != _origarg
    _handletype *_handle;
    ... when != _handle
    _handle =
    -(void *)_origarg;
    +from_timer(_handle, t, _field1._timer);
    ... when != _origarg
    )
    }

    // callback(unsigned long arg) without existing variable
    @change_callback_handle_cast_no_arg
    depends on change_timer_function_usage &&
    !change_callback_handle_cast@
    identifier change_timer_function_usage._callback;
    identifier change_timer_function_usage._field1;
    identifier change_timer_function_usage._timer;
    type _origtype;
    identifier _origarg;
    type _handletype;
    @@

    void _callback(
    -_origtype _origarg
    +struct timer_list *t
    )
    {
    + _handletype *_origarg = from_timer(_origarg, t, _field1._timer);
    +
    ... when != _origarg
    - (_handletype *)_origarg
    + _origarg
    ... when != _origarg
    }

    // Avoid already converted callbacks.
    @match_callback_converted
    depends on change_timer_function_usage &&
    !change_callback_handle_cast &&
    !change_callback_handle_cast_no_arg@
    identifier change_timer_function_usage._callback;
    identifier t;
    @@

    void _callback(struct timer_list *t)
    { ... }

    // callback(struct something *handle)
    @change_callback_handle_arg
    depends on change_timer_function_usage &&
    !match_callback_converted &&
    !change_callback_handle_cast &&
    !change_callback_handle_cast_no_arg@
    identifier change_timer_function_usage._callback;
    identifier change_timer_function_usage._field1;
    identifier change_timer_function_usage._timer;
    type _handletype;
    identifier _handle;
    @@

    void _callback(
    -_handletype *_handle
    +struct timer_list *t
    )
    {
    + _handletype *_handle = from_timer(_handle, t, _field1._timer);
    ...
    }

    // If change_callback_handle_arg ran on an empty function, remove
    // the added handler.
    @unchange_callback_handle_arg
    depends on change_timer_function_usage &&
    change_callback_handle_arg@
    identifier change_timer_function_usage._callback;
    identifier change_timer_function_usage._field1;
    identifier change_timer_function_usage._timer;
    type _handletype;
    identifier _handle;
    identifier t;
    @@

    void _callback(struct timer_list *t)
    {
    - _handletype *_handle = from_timer(_handle, t, _field1._timer);
    }

    // We only want to refactor the setup_timer() data argument if we've found
    // the matching callback. This undoes changes in change_timer_function_usage.
    @unchange_timer_function_usage
    depends on change_timer_function_usage &&
    !change_callback_handle_cast &&
    !change_callback_handle_cast_no_arg &&
    !change_callback_handle_arg@
    expression change_timer_function_usage._E;
    identifier change_timer_function_usage._field1;
    identifier change_timer_function_usage._timer;
    identifier change_timer_function_usage._callback;
    type change_timer_function_usage._cast_data;
    @@

    (
    -timer_setup(&_E->_field1._timer, _callback, 0);
    +setup_timer(&_E->_field1._timer, _callback, (_cast_data)_E);
    |
    -timer_setup(&_E._field1._timer, _callback, 0);
    +setup_timer(&_E._field1._timer, _callback, (_cast_data)&_E);
    )

    // If we fixed a callback from a .function assignment, fix the
    // assignment cast now.
    @change_timer_function_assignment
    depends on change_timer_function_usage &&
    (change_callback_handle_cast ||
    change_callback_handle_cast_no_arg ||
    change_callback_handle_arg)@
    expression change_timer_function_usage._E;
    identifier change_timer_function_usage._field1;
    identifier change_timer_function_usage._timer;
    identifier change_timer_function_usage._callback;
    type _cast_func;
    typedef TIMER_FUNC_TYPE;
    @@

    (
    _E->_field1._timer.function =
    -_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E->_field1._timer.function =
    -&_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E->_field1._timer.function =
    -(_cast_func)_callback;
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E->_field1._timer.function =
    -(_cast_func)&_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E._field1._timer.function =
    -_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E._field1._timer.function =
    -&_callback;
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E._field1._timer.function =
    -(_cast_func)_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E._field1._timer.function =
    -(_cast_func)&_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    )

    // Sometimes timer functions are called directly. Replace matched args.
    @change_timer_function_calls
    depends on change_timer_function_usage &&
    (change_callback_handle_cast ||
    change_callback_handle_cast_no_arg ||
    change_callback_handle_arg)@
    expression _E;
    identifier change_timer_function_usage._field1;
    identifier change_timer_function_usage._timer;
    identifier change_timer_function_usage._callback;
    type _cast_data;
    @@

    _callback(
    (
    -(_cast_data)_E
    +&_E->_field1._timer
    |
    -(_cast_data)&_E
    +&_E._field1._timer
    |
    -_E
    +&_E->_field1._timer
    )
    )

    // If a timer has been configured without a data argument, it can be
    // converted without regard to the callback argument, since it is unused.
    @match_timer_function_unused_data@
    expression _E;
    identifier _field1;
    identifier _timer;
    identifier _callback;
    @@

    (
    -setup_timer(&_E->_field1._timer, _callback, 0);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, _callback, 0L);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E->_field1._timer, _callback, 0UL);
    +timer_setup(&_E->_field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, _callback, 0);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, _callback, 0L);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_E._field1._timer, _callback, 0UL);
    +timer_setup(&_E._field1._timer, _callback, 0);
    |
    -setup_timer(&_field1._timer, _callback, 0);
    +timer_setup(&_field1._timer, _callback, 0);
    |
    -setup_timer(&_field1._timer, _callback, 0L);
    +timer_setup(&_field1._timer, _callback, 0);
    |
    -setup_timer(&_field1._timer, _callback, 0UL);
    +timer_setup(&_field1._timer, _callback, 0);
    |
    -setup_timer(_field1._timer, _callback, 0);
    +timer_setup(_field1._timer, _callback, 0);
    |
    -setup_timer(_field1._timer, _callback, 0L);
    +timer_setup(_field1._timer, _callback, 0);
    |
    -setup_timer(_field1._timer, _callback, 0UL);
    +timer_setup(_field1._timer, _callback, 0);
    )

    @change_callback_unused_data
    depends on match_timer_function_unused_data@
    identifier match_timer_function_unused_data._callback;
    type _origtype;
    identifier _origarg;
    @@

    void _callback(
    -_origtype _origarg
    +struct timer_list *unused
    )
    {
    ... when != _origarg
    }

    Signed-off-by: Kees Cook

    Kees Cook
     
  • This converts all remaining cases of the old setup_timer() API into using
    timer_setup(), where the callback argument is the structure already
    holding the struct timer_list. These should have no behavioral changes,
    since they just change which pointer is passed into the callback with
    the same available pointers after conversion. It handles the following
    examples, in addition to some other variations.

    Casting from unsigned long:

    void my_callback(unsigned long data)
    {
    struct something *ptr = (struct something *)data;
    ...
    }
    ...
    setup_timer(&ptr->my_timer, my_callback, ptr);

    and forced object casts:

    void my_callback(struct something *ptr)
    {
    ...
    }
    ...
    setup_timer(&ptr->my_timer, my_callback, (unsigned long)ptr);

    become:

    void my_callback(struct timer_list *t)
    {
    struct something *ptr = from_timer(ptr, t, my_timer);
    ...
    }
    ...
    timer_setup(&ptr->my_timer, my_callback, 0);

    Direct function assignments:

    void my_callback(unsigned long data)
    {
    struct something *ptr = (struct something *)data;
    ...
    }
    ...
    ptr->my_timer.function = my_callback;

    have a temporary cast added, along with converting the args:

    void my_callback(struct timer_list *t)
    {
    struct something *ptr = from_timer(ptr, t, my_timer);
    ...
    }
    ...
    ptr->my_timer.function = (TIMER_FUNC_TYPE)my_callback;

    And finally, callbacks without a data assignment:

    void my_callback(unsigned long data)
    {
    ...
    }
    ...
    setup_timer(&ptr->my_timer, my_callback, 0);

    have their argument renamed to verify they're unused during conversion:

    void my_callback(struct timer_list *unused)
    {
    ...
    }
    ...
    timer_setup(&ptr->my_timer, my_callback, 0);

    The conversion is done with the following Coccinelle script:

    spatch --very-quiet --all-includes --include-headers \
    -I ./arch/x86/include -I ./arch/x86/include/generated \
    -I ./include -I ./arch/x86/include/uapi \
    -I ./arch/x86/include/generated/uapi -I ./include/uapi \
    -I ./include/generated/uapi --include ./include/linux/kconfig.h \
    --dir . \
    --cocci-file ~/src/data/timer_setup.cocci

    @fix_address_of@
    expression e;
    @@

    setup_timer(
    -&(e)
    +&e
    , ...)

    // Update any raw setup_timer() usages that have a NULL callback, but
    // would otherwise match change_timer_function_usage, since the latter
    // will update all function assignments done in the face of a NULL
    // function initialization in setup_timer().
    @change_timer_function_usage_NULL@
    expression _E;
    identifier _timer;
    type _cast_data;
    @@

    (
    -setup_timer(&_E->_timer, NULL, _E);
    +timer_setup(&_E->_timer, NULL, 0);
    |
    -setup_timer(&_E->_timer, NULL, (_cast_data)_E);
    +timer_setup(&_E->_timer, NULL, 0);
    |
    -setup_timer(&_E._timer, NULL, &_E);
    +timer_setup(&_E._timer, NULL, 0);
    |
    -setup_timer(&_E._timer, NULL, (_cast_data)&_E);
    +timer_setup(&_E._timer, NULL, 0);
    )

    @change_timer_function_usage@
    expression _E;
    identifier _timer;
    struct timer_list _stl;
    identifier _callback;
    type _cast_func, _cast_data;
    @@

    (
    -setup_timer(&_E->_timer, _callback, _E);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, &_callback, _E);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, _callback, (_cast_data)_E);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, &_callback, (_cast_data)_E);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, (_cast_func)_callback, _E);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, (_cast_func)&_callback, _E);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, (_cast_func)_callback, (_cast_data)_E);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, (_cast_func)&_callback, (_cast_data)_E);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E._timer, _callback, (_cast_data)_E);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, _callback, (_cast_data)&_E);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, &_callback, (_cast_data)_E);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, &_callback, (_cast_data)&_E);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, (_cast_func)_callback, (_cast_data)_E);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, (_cast_func)_callback, (_cast_data)&_E);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, (_cast_func)&_callback, (_cast_data)_E);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, (_cast_func)&_callback, (_cast_data)&_E);
    +timer_setup(&_E._timer, _callback, 0);
    |
    _E->_timer@_stl.function = _callback;
    |
    _E->_timer@_stl.function = &_callback;
    |
    _E->_timer@_stl.function = (_cast_func)_callback;
    |
    _E->_timer@_stl.function = (_cast_func)&_callback;
    |
    _E._timer@_stl.function = _callback;
    |
    _E._timer@_stl.function = &_callback;
    |
    _E._timer@_stl.function = (_cast_func)_callback;
    |
    _E._timer@_stl.function = (_cast_func)&_callback;
    )

    // callback(unsigned long arg)
    @change_callback_handle_cast
    depends on change_timer_function_usage@
    identifier change_timer_function_usage._callback;
    identifier change_timer_function_usage._timer;
    type _origtype;
    identifier _origarg;
    type _handletype;
    identifier _handle;
    @@

    void _callback(
    -_origtype _origarg
    +struct timer_list *t
    )
    {
    (
    ... when != _origarg
    _handletype *_handle =
    -(_handletype *)_origarg;
    +from_timer(_handle, t, _timer);
    ... when != _origarg
    |
    ... when != _origarg
    _handletype *_handle =
    -(void *)_origarg;
    +from_timer(_handle, t, _timer);
    ... when != _origarg
    |
    ... when != _origarg
    _handletype *_handle;
    ... when != _handle
    _handle =
    -(_handletype *)_origarg;
    +from_timer(_handle, t, _timer);
    ... when != _origarg
    |
    ... when != _origarg
    _handletype *_handle;
    ... when != _handle
    _handle =
    -(void *)_origarg;
    +from_timer(_handle, t, _timer);
    ... when != _origarg
    )
    }

    // callback(unsigned long arg) without existing variable
    @change_callback_handle_cast_no_arg
    depends on change_timer_function_usage &&
    !change_callback_handle_cast@
    identifier change_timer_function_usage._callback;
    identifier change_timer_function_usage._timer;
    type _origtype;
    identifier _origarg;
    type _handletype;
    @@

    void _callback(
    -_origtype _origarg
    +struct timer_list *t
    )
    {
    + _handletype *_origarg = from_timer(_origarg, t, _timer);
    +
    ... when != _origarg
    - (_handletype *)_origarg
    + _origarg
    ... when != _origarg
    }

    // Avoid already converted callbacks.
    @match_callback_converted
    depends on change_timer_function_usage &&
    !change_callback_handle_cast &&
    !change_callback_handle_cast_no_arg@
    identifier change_timer_function_usage._callback;
    identifier t;
    @@

    void _callback(struct timer_list *t)
    { ... }

    // callback(struct something *handle)
    @change_callback_handle_arg
    depends on change_timer_function_usage &&
    !match_callback_converted &&
    !change_callback_handle_cast &&
    !change_callback_handle_cast_no_arg@
    identifier change_timer_function_usage._callback;
    identifier change_timer_function_usage._timer;
    type _handletype;
    identifier _handle;
    @@

    void _callback(
    -_handletype *_handle
    +struct timer_list *t
    )
    {
    + _handletype *_handle = from_timer(_handle, t, _timer);
    ...
    }

    // If change_callback_handle_arg ran on an empty function, remove
    // the added handler.
    @unchange_callback_handle_arg
    depends on change_timer_function_usage &&
    change_callback_handle_arg@
    identifier change_timer_function_usage._callback;
    identifier change_timer_function_usage._timer;
    type _handletype;
    identifier _handle;
    identifier t;
    @@

    void _callback(struct timer_list *t)
    {
    - _handletype *_handle = from_timer(_handle, t, _timer);
    }

    // We only want to refactor the setup_timer() data argument if we've found
    // the matching callback. This undoes changes in change_timer_function_usage.
    @unchange_timer_function_usage
    depends on change_timer_function_usage &&
    !change_callback_handle_cast &&
    !change_callback_handle_cast_no_arg &&
    !change_callback_handle_arg@
    expression change_timer_function_usage._E;
    identifier change_timer_function_usage._timer;
    identifier change_timer_function_usage._callback;
    type change_timer_function_usage._cast_data;
    @@

    (
    -timer_setup(&_E->_timer, _callback, 0);
    +setup_timer(&_E->_timer, _callback, (_cast_data)_E);
    |
    -timer_setup(&_E._timer, _callback, 0);
    +setup_timer(&_E._timer, _callback, (_cast_data)&_E);
    )

    // If we fixed a callback from a .function assignment, fix the
    // assignment cast now.
    @change_timer_function_assignment
    depends on change_timer_function_usage &&
    (change_callback_handle_cast ||
    change_callback_handle_cast_no_arg ||
    change_callback_handle_arg)@
    expression change_timer_function_usage._E;
    identifier change_timer_function_usage._timer;
    identifier change_timer_function_usage._callback;
    type _cast_func;
    typedef TIMER_FUNC_TYPE;
    @@

    (
    _E->_timer.function =
    -_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E->_timer.function =
    -&_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E->_timer.function =
    -(_cast_func)_callback;
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E->_timer.function =
    -(_cast_func)&_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E._timer.function =
    -_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E._timer.function =
    -&_callback;
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E._timer.function =
    -(_cast_func)_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    |
    _E._timer.function =
    -(_cast_func)&_callback
    +(TIMER_FUNC_TYPE)_callback
    ;
    )

    // Sometimes timer functions are called directly. Replace matched args.
    @change_timer_function_calls
    depends on change_timer_function_usage &&
    (change_callback_handle_cast ||
    change_callback_handle_cast_no_arg ||
    change_callback_handle_arg)@
    expression _E;
    identifier change_timer_function_usage._timer;
    identifier change_timer_function_usage._callback;
    type _cast_data;
    @@

    _callback(
    (
    -(_cast_data)_E
    +&_E->_timer
    |
    -(_cast_data)&_E
    +&_E._timer
    |
    -_E
    +&_E->_timer
    )
    )

    // If a timer has been configured without a data argument, it can be
    // converted without regard to the callback argument, since it is unused.
    @match_timer_function_unused_data@
    expression _E;
    identifier _timer;
    identifier _callback;
    @@

    (
    -setup_timer(&_E->_timer, _callback, 0);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, _callback, 0L);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E->_timer, _callback, 0UL);
    +timer_setup(&_E->_timer, _callback, 0);
    |
    -setup_timer(&_E._timer, _callback, 0);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, _callback, 0L);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_E._timer, _callback, 0UL);
    +timer_setup(&_E._timer, _callback, 0);
    |
    -setup_timer(&_timer, _callback, 0);
    +timer_setup(&_timer, _callback, 0);
    |
    -setup_timer(&_timer, _callback, 0L);
    +timer_setup(&_timer, _callback, 0);
    |
    -setup_timer(&_timer, _callback, 0UL);
    +timer_setup(&_timer, _callback, 0);
    |
    -setup_timer(_timer, _callback, 0);
    +timer_setup(_timer, _callback, 0);
    |
    -setup_timer(_timer, _callback, 0L);
    +timer_setup(_timer, _callback, 0);
    |
    -setup_timer(_timer, _callback, 0UL);
    +timer_setup(_timer, _callback, 0);
    )

    @change_callback_unused_data
    depends on match_timer_function_unused_data@
    identifier match_timer_function_unused_data._callback;
    type _origtype;
    identifier _origarg;
    @@

    void _callback(
    -_origtype _origarg
    +struct timer_list *unused
    )
    {
    ... when != _origarg
    }

    Signed-off-by: Kees Cook

    Kees Cook
     
  • This mechanically converts all remaining cases of ancient open-coded timer
    setup with the old setup_timer() API, which is the first step in timer
    conversions. This has no behavioral changes, since it ultimately just
    changes the order of assignment to fields of struct timer_list when
    finding variations of:

    init_timer(&t);
    f.function = timer_callback;
    t.data = timer_callback_arg;

    to be converted into:

    setup_timer(&t, timer_callback, timer_callback_arg);

    The conversion is done with the following Coccinelle script, which
    is an improved version of scripts/cocci/api/setup_timer.cocci, in the
    following ways:
    - assignments-before-init_timer() cases
    - limit the .data case removal to the specific struct timer_list instance
    - handling calls by dereference (timer->field vs timer.field)

    spatch --very-quiet --all-includes --include-headers \
    -I ./arch/x86/include -I ./arch/x86/include/generated \
    -I ./include -I ./arch/x86/include/uapi \
    -I ./arch/x86/include/generated/uapi -I ./include/uapi \
    -I ./include/generated/uapi --include ./include/linux/kconfig.h \
    --dir . \
    --cocci-file ~/src/data/setup_timer.cocci

    @fix_address_of@
    expression e;
    @@

    init_timer(
    -&(e)
    +&e
    , ...)

    // Match the common cases first to avoid Coccinelle parsing loops with
    // "... when" clauses.

    @match_immediate_function_data_after_init_timer@
    expression e, func, da;
    @@

    -init_timer
    +setup_timer
    ( \(&e\|e\)
    +, func, da
    );
    (
    -\(e.function\|e->function\) = func;
    -\(e.data\|e->data\) = da;
    |
    -\(e.data\|e->data\) = da;
    -\(e.function\|e->function\) = func;
    )

    @match_immediate_function_data_before_init_timer@
    expression e, func, da;
    @@

    (
    -\(e.function\|e->function\) = func;
    -\(e.data\|e->data\) = da;
    |
    -\(e.data\|e->data\) = da;
    -\(e.function\|e->function\) = func;
    )
    -init_timer
    +setup_timer
    ( \(&e\|e\)
    +, func, da
    );

    @match_function_and_data_after_init_timer@
    expression e, e2, e3, e4, e5, func, da;
    @@

    -init_timer
    +setup_timer
    ( \(&e\|e\)
    +, func, da
    );
    ... when != func = e2
    when != da = e3
    (
    -e.function = func;
    ... when != da = e4
    -e.data = da;
    |
    -e->function = func;
    ... when != da = e4
    -e->data = da;
    |
    -e.data = da;
    ... when != func = e5
    -e.function = func;
    |
    -e->data = da;
    ... when != func = e5
    -e->function = func;
    )

    @match_function_and_data_before_init_timer@
    expression e, e2, e3, e4, e5, func, da;
    @@
    (
    -e.function = func;
    ... when != da = e4
    -e.data = da;
    |
    -e->function = func;
    ... when != da = e4
    -e->data = da;
    |
    -e.data = da;
    ... when != func = e5
    -e.function = func;
    |
    -e->data = da;
    ... when != func = e5
    -e->function = func;
    )
    ... when != func = e2
    when != da = e3
    -init_timer
    +setup_timer
    ( \(&e\|e\)
    +, func, da
    );

    @r1 exists@
    expression t;
    identifier f;
    position p;
    @@

    f(...) { ... when any
    init_timer@p(\(&t\|t\))
    ... when any
    }

    @r2 exists@
    expression r1.t;
    identifier g != r1.f;
    expression e8;
    @@

    g(...) { ... when any
    \(t.data\|t->data\) = e8
    ... when any
    }

    // It is dangerous to use setup_timer if data field is initialized
    // in another function.
    @script:python depends on r2@
    p << r1.p;
    @@

    cocci.include_match(False)

    @r3@
    expression r1.t, func, e7;
    position r1.p;
    @@

    (
    -init_timer@p(&t);
    +setup_timer(&t, func, 0UL);
    ... when != func = e7
    -t.function = func;
    |
    -t.function = func;
    ... when != func = e7
    -init_timer@p(&t);
    +setup_timer(&t, func, 0UL);
    |
    -init_timer@p(t);
    +setup_timer(t, func, 0UL);
    ... when != func = e7
    -t->function = func;
    |
    -t->function = func;
    ... when != func = e7
    -init_timer@p(t);
    +setup_timer(t, func, 0UL);
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

16 Nov, 2017

2 commits

  • Pull networking updates from David Miller:
    "Highlights:

    1) Maintain the TCP retransmit queue using an rbtree, with 1GB
    windows at 100Gb this really has become necessary. From Eric
    Dumazet.

    2) Multi-program support for cgroup+bpf, from Alexei Starovoitov.

    3) Perform broadcast flooding in hardware in mv88e6xxx, from Andrew
    Lunn.

    4) Add meter action support to openvswitch, from Andy Zhou.

    5) Add a data meta pointer for BPF accessible packets, from Daniel
    Borkmann.

    6) Namespace-ify almost all TCP sysctl knobs, from Eric Dumazet.

    7) Turn on Broadcom Tags in b53 driver, from Florian Fainelli.

    8) More work to move the RTNL mutex down, from Florian Westphal.

    9) Add 'bpftool' utility, to help with bpf program introspection.
    From Jakub Kicinski.

    10) Add new 'cpumap' type for XDP_REDIRECT action, from Jesper
    Dangaard Brouer.

    11) Support 'blocks' of transformations in the packet scheduler which
    can span multiple network devices, from Jiri Pirko.

    12) TC flower offload support in cxgb4, from Kumar Sanghvi.

    13) Priority based stream scheduler for SCTP, from Marcelo Ricardo
    Leitner.

    14) Thunderbolt networking driver, from Amir Levy and Mika Westerberg.

    15) Add RED qdisc offloadability, and use it in mlxsw driver. From
    Nogah Frankel.

    16) eBPF based device controller for cgroup v2, from Roman Gushchin.

    17) Add some fundamental tracepoints for TCP, from Song Liu.

    18) Remove garbage collection from ipv6 route layer, this is a
    significant accomplishment. From Wei Wang.

    19) Add multicast route offload support to mlxsw, from Yotam Gigi"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2177 commits)
    tcp: highest_sack fix
    geneve: fix fill_info when link down
    bpf: fix lockdep splat
    net: cdc_ncm: GetNtbFormat endian fix
    openvswitch: meter: fix NULL pointer dereference in ovs_meter_cmd_reply_start
    netem: remove unnecessary 64 bit modulus
    netem: use 64 bit divide by rate
    tcp: Namespace-ify sysctl_tcp_default_congestion_control
    net: Protect iterations over net::fib_notifier_ops in fib_seq_sum()
    ipv6: set all.accept_dad to 0 by default
    uapi: fix linux/tls.h userspace compilation error
    usbnet: ipheth: prevent TX queue timeouts when device not ready
    vhost_net: conditionally enable tx polling
    uapi: fix linux/rxrpc.h userspace compilation errors
    net: stmmac: fix LPI transitioning for dwmac4
    atm: horizon: Fix irq release error
    net-sysfs: trigger netlink notification on ifalias change via sysfs
    openvswitch: Using kfree_rcu() to simplify the code
    openvswitch: Make local function ovs_nsh_key_attr_size() static
    openvswitch: Fix return value check in ovs_meter_cmd_features()
    ...

    Linus Torvalds
     
  • Pull trivial tree updates from Jiri Kosina:
    "The usual rocket-science from trivial tree for 4.15"

    * 'for-linus' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jikos/trivial:
    MAINTAINERS: relinquish kconfig
    MAINTAINERS: Update my email address
    treewide: Fix typos in Kconfig
    kfifo: Fix comments
    init/Kconfig: Fix module signing document location
    misc: ibmasm: Return error on error path
    HID: logitech-hidpp: fix mistake in printk, "feeback" -> "feedback"
    MAINTAINERS: Correct path to uDraw PS3 driver
    tracing: Fix doc mistakes in trace sample
    tracing: Kconfig text fixes for CONFIG_HWLAT_TRACER
    MIPS: Alchemy: Remove reverted CONFIG_NETLINK_MMAP from db1xxx_defconfig
    mm/huge_memory.c: fixup grammar in comment
    lib/xz: Add fall-through comments to a switch statement

    Linus Torvalds
     

06 Nov, 2017

10 commits

  • The structure nci_ops is local to the source and does not need to
    be in global scope, so make it static.

    Cleans up sparse warning:
    symbol 'nci_ops' was not declared. Should it be static?

    Signed-off-by: Colin Ian King
    Signed-off-by: Samuel Ortiz

    Colin Ian King
     
  • Don't populate the read-only array match on the stack, instead make
    it static const. Makes the object code smaller by over 310 bytes:

    Before:
    text data bss dec hex filename
    8304 1084 128 9516 252c drivers/nfc/s3fwrn5/firmware.o

    After:
    text data bss dec hex filename
    7894 1180 128 9202 23f2 drivers/nfc/s3fwrn5/firmware.o

    Signed-off-by: Colin Ian King
    Signed-off-by: Samuel Ortiz

    Colin Ian King
     
  • i2c_device_id are not supposed to change at runtime. All functions
    working with i2c_device_id provided by work with
    const i2c_device_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Samuel Ortiz

    Arvind Yadav
     
  • i2c_device_id are not supposed to change at runtime. All functions
    working with i2c_device_id provided by work with
    const i2c_device_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Samuel Ortiz

    Arvind Yadav
     
  • i2c_device_id are not supposed to change at runtime. All functions
    working with i2c_device_id provided by work with
    const i2c_device_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Samuel Ortiz

    Arvind Yadav
     
  • i2c_device_id are not supposed to change at runtime. All functions
    working with i2c_device_id provided by work with
    const i2c_device_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Samuel Ortiz

    Arvind Yadav
     
  • i2c_device_id are not supposed to change at runtime. All functions
    working with i2c_device_id provided by work with
    const i2c_device_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Samuel Ortiz

    Arvind Yadav
     
  • i2c_device_id are not supposed to change at runtime. All functions
    working with i2c_device_id provided by work with
    const i2c_device_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Samuel Ortiz

    Arvind Yadav
     
  • i2c_device_id are not supposed to change at runtime. All functions
    working with i2c_device_id provided by work with
    const i2c_device_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Samuel Ortiz

    Arvind Yadav
     
  • i2c_device_id are not supposed to change at runtime. All functions
    working with i2c_device_id provided by work with
    const i2c_device_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Samuel Ortiz

    Arvind Yadav
     

02 Nov, 2017

1 commit

  • Many source files in the tree are missing licensing information, which
    makes it harder for compliance tools to determine the correct license.

    By default all files without license information are under the default
    license of the kernel, which is GPL version 2.

    Update the files which contain no license information with the 'GPL-2.0'
    SPDX license identifier. The SPDX identifier is a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne.

    How this work was done:

    Patches were generated and checked against linux-4.14-rc6 for a subset of
    the use cases:
    - file had no licensing information it it.
    - file was a */uapi/* one with no licensing information in it,
    - file was a */uapi/* one with existing licensing information,

    Further patches will be generated in subsequent months to fix up cases
    where non-standard license headers were used, and references to license
    had to be inferred by heuristics based on keywords.

    The analysis to determine which SPDX License Identifier to be applied to
    a file was done in a spreadsheet of side by side results from of the
    output of two independent scanners (ScanCode & Windriver) producing SPDX
    tag:value files created by Philippe Ombredanne. Philippe prepared the
    base worksheet, and did an initial spot review of a few 1000 files.

    The 4.13 kernel was the starting point of the analysis with 60,537 files
    assessed. Kate Stewart did a file by file comparison of the scanner
    results in the spreadsheet to determine which SPDX license identifier(s)
    to be applied to the file. She confirmed any determination that was not
    immediately clear with lawyers working with the Linux Foundation.

    Criteria used to select files for SPDX license identifier tagging was:
    - Files considered eligible had to be source code files.
    - Make and config files were included as candidates if they contained >5
    lines of source
    - File already had some variant of a license header in it (even if
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

12 Oct, 2017

1 commit


02 Jul, 2017

1 commit

  • Samuel Ortiz says:

    ====================
    NFC 4.13 pull request

    This is the NFC pull requesy for 4.13. We have:

    - A conversion to unified device and GPIO APIs for the
    fdp, pn544, and st{21,-nci} drivers.
    - A fix for NFC device IDs allocation.
    - A fix for the nfcmrvl driver firmware download mechanism.
    - A trf7970a DT and GPIO cleanup and clock setting fix.
    - A few fixes for potential overflows in the digital and LLCP code.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

28 Jun, 2017

1 commit


23 Jun, 2017

15 commits

  • NULL checks at line 457: if (!link0 || !link1) {, implies that both
    pointers link0 and link1 might be NULL.
    Function nfcsim_link_free() dereference pointers link0 and link1.
    Add NULL checks before calling nfcsim_link_free() to avoid a
    potential NULL pointer dereference.

    Addresses-Coverity-ID: 1364857
    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: Samuel Ortiz

    Gustavo A. R. Silva
     
  • This reverts commit ab714817d7e891608d31f6996b1e4c43cf2bf342.

    The original commit was designed to handle a bug in the trf7970a NFC
    controller where an extra byte was returned in Read Multiple Blocks (RMB)
    command responses. However, it has become less clear whether it is a bug
    in the trf7970a or in the tag. In addition, it was assumed that the extra
    byte was always returned but it turns out that is not always the case. The
    result is that a byte of good data is trimmed off when the extra byte is
    not present ultimately causing the neard deamon to fail the read.

    Since the trf7970a driver does not have the context to know when to trim
    the byte or not, remove the code from the trf7970a driver all together
    (and move it up to the neard daemon). This has the added benefit of
    simplifying the kernel driver and putting the extra complexity into
    userspace.

    CC: Rob Herring
    CC: devicetree@vger.kernel.org
    Signed-off-by: Mark Greer
    Signed-off-by: Samuel Ortiz

    Mark Greer
     
  • The "or" condition (clk_freq != TRF7970A_27MHZ_CLOCK_FREQUENCY) ||
    (clk_freq != TRF7970A_13MHZ_CLOCK_FREQUE) will always be true because
    clk_freq cannot be equal to two different values at the same time. Use
    the && operator instead of || to fix this.

    Detected by CoverityScan, CID#1430468 ("Constant expression result")

    Fixes: 837eb4d21ecde7 ("NFC: trf7970a: add device tree option for 27MHz clock")
    Signed-off-by: Colin Ian King
    Acked-by: Geoff Lansberry
    Signed-off-by: Samuel Ortiz

    Colin Ian King
     
  • Since OF and ACPI case almost the same get rid of code duplication
    by moving gpiod_get() calls directly to ->probe().

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • In order to make GPIO ACPI library stricter prepare users of
    gpiod_get_index() to correctly behave when there no mapping is
    provided by firmware.

    Here we add explicit mapping between _CRS GpioIo() resources and
    their names used in the driver.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • Use unified device properties API in meaningful way.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • Since we got rid of platform data, the driver may use GPIO descriptor
    directly.

    Looking deeply to the use of the GPIO pin it looks like it should be
    a GPIO based reset control rather than custom GPIO handling. But this
    is out of scope of the change.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • I2C and SPI frameworks followed by IRQ framework do set
    interrupt polarity correctly if it's properly specified in firmware
    (ACPI or DT).

    Get rid of the redundant trick when requesting interrupt.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • Legacy platform data must go away. We are on the safe side here since
    there are no users of it in the kernel.

    If anyone by any odd reason needs it the GPIO lookup tables and
    built-in device properties at your service.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • In order to make GPIO ACPI library stricter prepare users of
    gpiod_get_index() to correctly behave when there no mapping is
    provided by firmware.

    Here we add explicit mapping between _CRS GpioIo() resources and
    their names used in the driver.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • It looks like there are two leftovers, at least one of which can leak
    the resource (IRQ).

    Convert both places to use managed variants of the functions.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • There is no platform code that uses i2c module table.
    Remove it altogether and adjust ->probe() to be ->probe_new().

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • Since OF and ACPI case almost the same get rid of code duplication
    by moving gpiod_get() calls directly to ->probe().

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • In order to make GPIO ACPI library stricter prepare users of
    gpiod_get_index() to correctly behave when there no mapping is
    provided by firmware.

    Here we add explicit mapping between _CRS GpioIo() resources and
    their names used in the driver.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko
     
  • Switch to use managed variant of acpi_dev_add_driver_gpios() to simplify
    error path and fix potentially wrong assignment if ->probe() fails.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: Samuel Ortiz

    Andy Shevchenko