4.17.12-stable review

Signed-off-by Sudip Mukherjee <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/spi/spi-s3c64xx.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/spi/spi-s3c64xx.c +2 -2

@@ -1260,8 +1260,6 @@ static int s3c64xx_spi_resume(struct dev
 	if (ret < 0)
 		return ret;
 
-	s3c64xx_spi_hwinit(sdd, sdd->port_id);
-
 	return spi_master_resume(master);
 }
 #endif /* CONFIG_PM_SLEEP */

@@ -1299,6 +1297,8 @@ static int s3c64xx_spi_runtime_resume(st
 	if (ret != 0)
 		goto err_disable_src_clk;
 
+	s3c64xx_spi_hwinit(sdd, sdd->port_id);
+
 	return 0;
 
 err_disable_src_clk:

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #2 lore raw

PATCH 2/336 Input: elan_i2c - add ACPI ID for lenovo ideapad 330

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Donald Shanty III <[email protected]>

commit 938f45008d8bc391593c97508bc798cc95a52b9b upstream.

This allows Elan driver to bind to the touchpad found in Lenovo Ideapad 330 series laptops.

Signed-off-by Donald Shanty III <[email protected]>

Signed-off-by Dmitry Torokhov <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/input/mouse/elan_i2c_core.c |    1 +
 1 file changed, 1 insertion(+)

drivers/input/mouse/elan_i2c_core.c +1 -0

@@ -1264,6 +1264,7 @@ static const struct acpi_device_id elan_
 	{ "ELAN0611", 0 },
 	{ "ELAN0612", 0 },
 	{ "ELAN0618", 0 },
+	{ "ELAN061D", 0 },
 	{ "ELAN1000", 0 },
 	{ }
 };

Greg Kroah-Hartman

author maintainer

2018-08-01 17:36 UTC #3 lore raw

PATCH 3/336 Input: i8042 - add Lenovo LaVie Z to the i8042 reset list

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <[email protected]>

commit 384cf4285b34e08917e3e66603382f2b0c4f6e1b upstream.

The Lenovo LaVie Z laptop requires i8042 to be reset in order to consistently detect its Elantech touchpad. The nomux and kbdreset quirks are not sufficient.

It's possible the other LaVie Z models from NEC require this as well.

Signed-off-by Chen-Yu Tsai <[email protected]>

Signed-off-by Dmitry Torokhov <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/input/serio/i8042-x86ia64io.h |    7 +++++++
 1 file changed, 7 insertions(+)

drivers/input/serio/i8042-x86ia64io.h +7 -0

@@ -527,6 +527,13 @@ static const struct dmi_system_id __init
 			DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
 		},
 	},
+	{
+		/* Lenovo LaVie Z */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
+		},
+	},
 	{ }
 };

Greg Kroah-Hartman

author maintainer

2018-08-01 17:37 UTC #4 lore raw

PATCH 4/336 Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: KT Liao <[email protected]>

commit 6f88a6439da5d94de334a341503bc2c7f4a7ea7f upstream.

Add ELAN0622 to ACPI mapping table to support Elan touchpad found in Ideapad 330-15AST.

Signed-off-by KT Liao <[email protected]>

Reported-by Anant Shende <[email protected]>

Signed-off-by Dmitry Torokhov <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/input/mouse/elan_i2c_core.c |    1 +
 1 file changed, 1 insertion(+)

drivers/input/mouse/elan_i2c_core.c +1 -0

@@ -1265,6 +1265,7 @@ static const struct acpi_device_id elan_
 	{ "ELAN0612", 0 },
 	{ "ELAN0618", 0 },
 	{ "ELAN061D", 0 },
+	{ "ELAN0622", 0 },
 	{ "ELAN1000", 0 },
 	{ }
 };

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #5 lore raw

PATCH 5/336 mm: disallow mappings that conflict for devm_memremap_pages()

Link http://lkml.kernel.org/r/152909478401.50143.312364396244072931.stgit@djiang5-desk3.ch.intel.com open here

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dave Jiang <[email protected]>

commit 15d36fecd0bdc7510b70a0e5ec6671140b3fce0c upstream.

When pmem namespaces created are smaller than section size, this can cause an issue during removal and gpf was observed:

  general protection fault: 0000 1 SMP PTI
  CPU: 36 PID: 3941 Comm: ndctl Tainted: G W 4.14.28-1.el7uek.x86_64 #2
  task: ffff88acda150000 task.stack: ffffc900233a4000
  RIP: 0010:__put_page+0x56/0x79
  Call Trace:
    devm_memremap_pages_release+0x155/0x23a
    release_nodes+0x21e/0x260
    devres_release_all+0x3c/0x48
    device_release_driver_internal+0x15c/0x207
    device_release_driver+0x12/0x14
    unbind_store+0xba/0xd8
    drv_attr_store+0x27/0x31
    sysfs_kf_write+0x3f/0x46
    kernfs_fop_write+0x10f/0x18b
    __vfs_write+0x3a/0x16d
    vfs_write+0xb2/0x1a1
    SyS_write+0x55/0xb9
    do_syscall_64+0x79/0x1ae
    entry_SYSCALL_64_after_hwframe+0x3d/0x0

Add code to check whether we have a mapping already in the same section and prevent additional mappings from being created if that is the case.

Signed-off-by Dave Jiang <[email protected]>

Cc Dan Williams <[email protected]>

Cc Robert Elliott <[email protected]>

Cc Jeff Moyer <[email protected]>

Cc Matthew Wilcox <[email protected]>

Cc <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/memremap.c |   18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

kernel/memremap.c +17 -1

@@ -348,10 +348,27 @@ void *devm_memremap_pages(struct device
 	unsigned long pfn, pgoff, order;
 	pgprot_t pgprot = PAGE_KERNEL;
 	int error, nid, is_ram;
+	struct dev_pagemap *conflict_pgmap;
 
 	align_start = res->start & ~(SECTION_SIZE - 1);
 	align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
 		- align_start;
+	align_end = align_start + align_size - 1;
+
+	conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_start), NULL);
+	if (conflict_pgmap) {
+		dev_WARN(dev, "Conflicting mapping in same section\n");
+		put_dev_pagemap(conflict_pgmap);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_end), NULL);
+	if (conflict_pgmap) {
+		dev_WARN(dev, "Conflicting mapping in same section\n");
+		put_dev_pagemap(conflict_pgmap);
+		return ERR_PTR(-ENOMEM);
+	}
+
 	is_ram = region_intersects(align_start, align_size,
 		IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE);

@@ -371,7 +388,6 @@ void *devm_memremap_pages(struct device
 
 	mutex_lock(&pgmap_lock);
 	error = 0;
-	align_end = align_start + align_size - 1;
 
 	foreach_order_pgoff(res, order, pgoff) {
 		error = __radix_tree_insert(&pgmap_radix,

Greg Kroah-Hartman

author maintainer

2018-08-01 17:39 UTC #6 lore raw

PATCH 7/336 delayacct: fix crash in delayacct_blkio_end() after delayacct init failure

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <[email protected]>

commit b512719f771a82180211c9a315b8a7f628832b3d upstream.

While forking, if delayacct init fails due to memory shortage, it continues expecting all delayacct users to check task->delays pointer against NULL before dereferencing it, which all of them used to do.

Commit c96f5471ce7d ("delayacct: Account blkio completion on the correct task"), while updating delayacct_blkio_end() to take the target task instead of always using %current, made the function test NULL on %current->delays and then continue to operated on @p->delays. If %current succeeded init while @p didn't, it leads to the following crash.

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
 IP: __delayacct_blkio_end+0xc/0x40
 PGD 8000001fd07e1067 P4D 8000001fd07e1067 PUD 1fcffbb067 PMD 0
 Oops: 0000 [#1] SMP PTI
 CPU: 4 PID: 25774 Comm: QIOThread0 Not tainted 4.16.0-9_fbk1_rc2_1180_g6b593215b4d7 #9
 RIP: 0010:__delayacct_blkio_end+0xc/0x40
 Call Trace:
  try_to_wake_up+0x2c0/0x600
  autoremove_wake_function+0xe/0x30
  __wake_up_common+0x74/0x120
  wake_up_page_bit+0x9c/0xe0
  mpage_end_io+0x27/0x70
  blk_update_request+0x78/0x2c0
  scsi_end_request+0x2c/0x1e0
  scsi_io_completion+0x20b/0x5f0
  blk_mq_complete_request+0xa2/0x100
  ata_scsi_qc_complete+0x79/0x400
  ata_qc_complete_multiple+0x86/0xd0
  ahci_handle_port_interrupt+0xc9/0x5c0
  ahci_handle_port_intr+0x54/0xb0
  ahci_single_level_irq_intr+0x3b/0x60
  __handle_irq_event_percpu+0x43/0x190
  handle_irq_event_percpu+0x20/0x50
  handle_irq_event+0x2a/0x50
  handle_edge_irq+0x80/0x1c0
  handle_irq+0xaf/0x120
  do_IRQ+0x41/0xc0
  common_interrupt+0xf/0xf

Fix it by updating delayacct_blkio_end() check @p->delays instead.

Link http://lkml.kernel.org/r/[email protected] open here

Fixes c96f5471ce7d ("delayacct: Account blkio completion on the correct task")

Signed-off-by Tejun Heo <[email protected]>

Reported-by Dave Jones <[email protected]>

Debugged-by Dave Jones <[email protected]>

Reviewed-by Andrew Morton <[email protected]>

Cc Josh Snyder <[email protected]>

Cc <[email protected]> [4.15+]

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/delayacct.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

include/linux/delayacct.h +1 -1

@@ -124,7 +124,7 @@ static inline void delayacct_blkio_start
 
 static inline void delayacct_blkio_end(struct task_struct *p)
 {
-	if (current->delays)
+	if (p->delays)
 		__delayacct_blkio_end(p);
 	delayacct_clear_flag(DELAYACCT_PF_BLKIO);
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #7 lore raw

PATCH 8/336 tracing: Fix double free of event_trigger_data

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Steven Rostedt (VMware) <[email protected]>

commit 1863c387259b629e4ebfb255495f67cd06aa229b upstream.

Running the following:

 # cd /sys/kernel/debug/tracing
 # echo 500000 > buffer_size_kb
[ Or some other number that takes up most of memory ]
 # echo snapshot > events/sched/sched_switch/trigger

Triggers the following bug:

 ------------[ cut here ]------------
 kernel BUG at mm/slub.c:296!
 invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
 CPU: 6 PID: 6878 Comm: bash Not tainted 4.18.0-rc6-test+ #1066
 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016
 RIP: 0010:kfree+0x16c/0x180
 Code: 05 41 0f b6 72 51 5b 5d 41 5c 4c 89 d7 e9 ac b3 f8 ff 48 89 d9 48 89 da 41 b8 01 00 00 00 5b 5d 41 5c 4c 89 d6 e9 f4 f3 ff ff <0f> 0b 0f 0b 48 8b 3d d9 d8 f9 00 e9 c1 fe ff ff 0f 1f 40 00 0f 1f
 RSP: 0018:ffffb654436d3d88 EFLAGS: 00010246
 RAX: ffff91a9d50f3d80 RBX: ffff91a9d50f3d80 RCX: ffff91a9d50f3d80
 RDX: 00000000000006a4 RSI: ffff91a9de5a60e0 RDI: ffff91a9d9803500
 RBP: ffffffff8d267c80 R08: 00000000000260e0 R09: ffffffff8c1a56be
 R10: fffff0d404543cc0 R11: 0000000000000389 R12: ffffffff8c1a56be
 R13: ffff91a9d9930e18 R14: ffff91a98c0c2890 R15: ffffffff8d267d00
 FS:  00007f363ea64700(0000) GS:ffff91a9de580000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 000055c1cacc8e10 CR3: 00000000d9b46003 CR4: 00000000001606e0
 Call Trace:
  event_trigger_callback+0xee/0x1d0
  event_trigger_write+0xfc/0x1a0
  __vfs_write+0x33/0x190
  ? handle_mm_fault+0x115/0x230
  ? _cond_resched+0x16/0x40
  vfs_write+0xb0/0x190
  ksys_write+0x52/0xc0
  do_syscall_64+0x5a/0x160
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
 RIP: 0033:0x7f363e16ab50
 Code: 73 01 c3 48 8b 0d 38 83 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 79 db 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e e3 01 00 48 89 04 24
 RSP: 002b:00007fff9a4c6378 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
 RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f363e16ab50
 RDX: 0000000000000009 RSI: 000055c1cacc8e10 RDI: 0000000000000001
 RBP: 000055c1cacc8e10 R08: 00007f363e435740 R09: 00007f363ea64700
 R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000009
 R13: 0000000000000001 R14: 00007f363e4345e0 R15: 00007f363e4303c0
 Modules linked in: ip6table_filter ip6_tables snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq snd_seq_device i915 snd_pcm snd_timer i2c_i801 snd soundcore i2c_algo_bit drm_kms_helper
86_pkg_temp_thermal video kvm_intel kvm irqbypass wmi e1000e
 ---[ end trace d301afa879ddfa25 ]---

The cause is because the register_snapshot_trigger() call failed to allocate the snapshot buffer, and then called unregister_trigger() which freed the data that was passed to it. Then on return to the function that called register_snapshot_trigger(), as it sees it failed to register, it frees the trigger_data again and causes a double free.

By calling event_trigger_init() on the trigger_data (which only ups the reference counter for it), and then event_trigger_free() afterward, the trigger_data would not get freed by the registering trigger function as it would only up and lower the ref count for it. If the register trigger function fails, then the event_trigger_free() called after it will free the trigger data normally.

Link http://lkml.kernel.org/r/[email protected] open here

Fixes 93e31ffbf417 ("tracing: Add 'snapshot' event trigger command")

Reported-by Masami Hiramatsu <[email protected]>

Reviewed-by Masami Hiramatsu <[email protected]>

Signed-off-by Steven Rostedt (VMware) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/trace/trace_events_trigger.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

kernel/trace/trace_events_trigger.c +8 -4

@@ -681,6 +681,8 @@ event_trigger_callback(struct event_comm
 		goto out_free;
 
  out_reg:
+	/* Up the trigger_data count to make sure reg doesn't free it on failure */
+	event_trigger_init(trigger_ops, trigger_data);
 	ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
 	/*
 	 * The above returns on success the # of functions enabled,

@@ -688,11 +690,13 @@ event_trigger_callback(struct event_comm
 	 * Consider no functions a failure too.
 	 */
 	if (!ret) {
+		cmd_ops->unreg(glob, trigger_ops, trigger_data, file);
 		ret = -ENOENT;
-		goto out_free;
-	} else if (ret < 0)
-		goto out_free;
-	ret = 0;
+	} else if (ret > 0)
+		ret = 0;
+
+	/* Down the counter of trigger_data or free it if not used anymore */
+	event_trigger_free(trigger_ops, trigger_data);
  out:
 	return ret;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:38 UTC #8 lore raw

PATCH 9/336 tracing: Fix possible double free in event_enable_trigger_func()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Steven Rostedt (VMware) <[email protected]>

commit 15cc78644d0075e76d59476a4467e7143860f660 upstream.

There was a case that triggered a double free in event_trigger_callback() due to the called reg() function freeing the trigger_data and then it getting freed again by the error return by the caller. The solution there was to up the trigger_data ref count.

Code inspection found that event_enable_trigger_func() has the same issue, but is not as easy to trigger (requires harder to trigger failures). It needs to be solved slightly different as it needs more to clean up when the reg() function fails.

Link http://lkml.kernel.org/r/[email protected] open here

Fixes 7862ad1846e99 ("tracing: Add 'enable_event' and 'disable_event' event trigger commands")

Reivewed-by Masami Hiramatsu <[email protected]>

Signed-off-by Steven Rostedt (VMware) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/trace/trace_events_trigger.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

kernel/trace/trace_events_trigger.c +5 -1

@@ -1422,6 +1422,9 @@ int event_enable_trigger_func(struct eve
 		goto out;
 	}
 
+	/* Up the trigger_data count to make sure nothing frees it on failure */
+	event_trigger_init(trigger_ops, trigger_data);
+
 	if (trigger) {
 		number = strsep(&trigger, ":");

@@ -1472,6 +1475,7 @@ int event_enable_trigger_func(struct eve
 		goto out_disable;
 	/* Just return zero, not the number of enabled functions */
 	ret = 0;
+	event_trigger_free(trigger_ops, trigger_data);
  out:
 	return ret;

@@ -1482,7 +1486,7 @@ int event_enable_trigger_func(struct eve
  out_free:
 	if (cmd_ops->set_filter)
 		cmd_ops->set_filter(NULL, trigger_data, NULL);
-	kfree(trigger_data);
+	event_trigger_free(trigger_ops, trigger_data);
 	kfree(enable_data);
 	goto out;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #9 lore raw

PATCH 10/336 kthread, tracing: Dont expose half-written comm when creating kthreads

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Snild Dolkow <[email protected]>

commit 3e536e222f2930534c252c1cc7ae799c725c5ff9 upstream.

There is a window for racing when printing directly to task->comm, allowing other threads to see a non-terminated string. The vsnprintf function fills the buffer, counts the truncated chars, then finally writes the \0 at the end.

creator other
vsnprintf:
fill (not terminated)
count the rest trace_sched_waking(p):
... memcpy(comm, p->comm, TASK_COMM_LEN)
write \0

The consequences depend on how 'other' uses the string. In our case, it was copied into the tracing system's saved cmdlines, a buffer of adjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be):

	crash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk'
	0xffffffd5b3818640:     "irq/497-pwr_evenkworker/u16:12"

...and a strcpy out of there would cause stack corruption:

	[224761.522292] Kernel panic - not syncing: stack-protector:
	    Kernel stack is corrupted in: ffffff9bf9783c78

	crash-arm64> kbt | grep 'comm\|trace_print_context'
	#6  0xffffff9bf9783c78 in trace_print_context+0x18c(+396)
	      comm (char [16]) =  "irq/497-pwr_even"

	crash-arm64> rd 0xffffffd4d0e17d14 8
	ffffffd4d0e17d14:  2f71726900000000 5f7277702d373934   ....irq/497-pwr_
	ffffffd4d0e17d24:  726f776b6e657665 3a3631752f72656b   evenkworker/u16:
	ffffffd4d0e17d34:  f9780248ff003231 cede60e0ffffff9b   12..H.x......`..
	ffffffd4d0e17d44:  cede60c8ffffffd4 00000fffffffffd4   .....`..........

The workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was likely needed because of this same bug.

Solved by vsnprintf:ing to a local buffer, then using set_task_comm(). This way, there won't be a window where comm is not terminated.

Link http://lkml.kernel.org/r/[email protected] open here

Fixes bc0c38d139ec7 ("ftrace: latency tracer infrastructure")

Reviewed-by Steven Rostedt (VMware) <[email protected]>

Signed-off-by Snild Dolkow <[email protected]>

Signed-off-by Steven Rostedt (VMware) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/kthread.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

kernel/kthread.c +7 -1

@@ -319,8 +319,14 @@ struct task_struct *__kthread_create_on_
 	task = create->result;
 	if (!IS_ERR(task)) {
 		static const struct sched_param param = { .sched_priority = 0 };
+		char name[TASK_COMM_LEN];
 
-		vsnprintf(task->comm, sizeof(task->comm), namefmt, args);
+		/*
+		 * task is already visible to other tasks, so updating
+		 * COMM must be protected.
+		 */
+		vsnprintf(name, sizeof(name), namefmt, args);
+		set_task_comm(task, name);
 		/*
 		 * root may have changed our (kthreadd's) priority or CPU mask.
 		 * The kernel thread should not inherit these properties.

Greg Kroah-Hartman

author maintainer

2018-08-01 17:37 UTC #10 lore raw

PATCH 11/336 tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Artem Savkov <[email protected]>

commit 57ea2a34adf40f3a6e88409aafcf803b8945619a upstream.

If enable_trace_kprobe fails to enable the probe in enable_k(ret)probe it returns an error, but does not unset the tp flags it set previously. This results in a probe being considered enabled and failures like being unable to remove the probe through kprobe_events file since probes_open() expects every probe to be disabled.

Link http://lkml.kernel.org/r/[email protected] open here

Cc Ingo Molnar <[email protected]>

Fixes 41a7dd420c57 ("tracing/kprobes: Support ftrace_event_file base multibuffer")

Acked-by Masami Hiramatsu <[email protected]>

Reviewed-by Josh Poimboeuf <[email protected]>

Signed-off-by Artem Savkov <[email protected]>

Signed-off-by Steven Rostedt (VMware) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/trace/trace_kprobe.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

kernel/trace/trace_kprobe.c +11 -2

@@ -400,11 +400,10 @@ static struct trace_kprobe *find_trace_k
 static int
 enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
 {
+	struct event_file_link *link;
 	int ret = 0;
 
 	if (file) {
-		struct event_file_link *link;
-
 		link = kmalloc(sizeof(*link), GFP_KERNEL);
 		if (!link) {
 			ret = -ENOMEM;

@@ -424,6 +423,16 @@ enable_trace_kprobe(struct trace_kprobe
 		else
 			ret = enable_kprobe(&tk->rp.kp);
 	}
+
+	if (ret) {
+		if (file) {
+			list_del_rcu(&link->list);
+			kfree(link);
+			tk->tp.flags &= ~TP_FLAG_TRACE;
+		} else {
+			tk->tp.flags &= ~TP_FLAG_PROFILE;
+		}
+	}
  out:
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 17:39 UTC #11 lore raw

PATCH 12/336 tracing: Quiet gcc warning about maybe unused link variable

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Steven Rostedt (VMware) <[email protected]>

commit 2519c1bbe38d7acacc9aacba303ca6f97482ed53 upstream.

Commit 57ea2a34adf4 ("tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure") added an if statement that depends on another if statement that gcc doesn't see will initialize the "link" variable and gives the warning:

"warning: 'link' may be used uninitialized in this function"

It is really a false positive, but to quiet the warning, and also to make sure that it never actually is used uninitialized, initialize the "link" variable to NULL and add an if (!WARN_ON_ONCE(!link)) where the compiler thinks it could be used uninitialized.

Fixes 57ea2a34adf4 ("tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure")

Reported-by kbuild test robot <[email protected]>

Signed-off-by Steven Rostedt (VMware) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/trace/trace_kprobe.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

kernel/trace/trace_kprobe.c +4 -2

@@ -400,7 +400,7 @@ static struct trace_kprobe *find_trace_k
 static int
 enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
 {
-	struct event_file_link *link;
+	struct event_file_link *link = NULL;
 	int ret = 0;
 
 	if (file) {

@@ -426,7 +426,9 @@ enable_trace_kprobe(struct trace_kprobe
 
 	if (ret) {
 		if (file) {
-			list_del_rcu(&link->list);
+			/* Notice the if is true on not WARN() */
+			if (!WARN_ON_ONCE(!link))
+				list_del_rcu(&link->list);
 			kfree(link);
 			tk->tp.flags &= ~TP_FLAG_TRACE;
 		} else {

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #12 lore raw

PATCH 13/336 arm64: fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Weiner <[email protected]>

commit 7b0eb6b41a08fa1fa0d04b1c53becd62b5fbfaee upstream.

Arnd reports the following arm64 randconfig build error with the PSI patches that add another page flag:

/git/arm-soc/arch/arm64/mm/init.c: In function 'mem_init':
/git/arm-soc/include/linux/compiler.h:357:38: error: call to '__compiletime_assert_618' declared with attribute error: BUILD_BUG_ON
failed: sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT)

The additional page flag causes other information stored in page->flags to get bumped into their own struct page member:

  #if SECTIONS_WIDTH+ZONES_WIDTH+NODES_SHIFT+LAST_CPUPID_SHIFT <=
  BITS_PER_LONG - NR_PAGEFLAGS
  #define LAST_CPUPID_WIDTH LAST_CPUPID_SHIFT
  #else
  #define LAST_CPUPID_WIDTH 0
  #endif

  #if defined(CONFIG_NUMA_BALANCING) && LAST_CPUPID_WIDTH == 0
  #define LAST_CPUPID_NOT_IN_PAGE_FLAGS
  #endif

which in turn causes the struct page size to exceed the size set in STRUCT_PAGE_MAX_SHIFT. This value is an an estimate used to size the VMEMMAP page array according to address space and struct page size.

However, the check is performed - and triggers here - on a !VMEMMAP config, which consumes an additional 22 page bits for the sparse section id. When VMEMMAP is enabled, those bits are returned, cpupid doesn't need its own member, and the page passes the VMEMMAP check.

Restrict that check to the situation it was meant to check: that we are sizing the VMEMMAP page array correctly.

Says Arnd:

Further experiments show that the build error already existed before, but was only triggered with larger values of CONFIG_NR_CPU and/or CONFIG_NODES_SHIFT that might be used in actual configurations but not in randconfig builds.

With longer CPU and node masks, I could recreate the problem with kernels as old as linux-4.7 when arm64 NUMA support got added.

Reported-by Arnd Bergmann <[email protected]>

Tested-by Arnd Bergmann <[email protected]>

Fixes 1a2db300348b ("arm64, numa: Add NUMA support for arm64 platforms.")

Fixes 3e1907d5bf5a ("arm64: mm: move vmemmap region right below the linear region")

Signed-off-by Johannes Weiner <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm64/mm/init.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

arch/arm64/mm/init.c +3 -1

@@ -611,11 +611,13 @@ void __init mem_init(void)
 	BUILD_BUG_ON(TASK_SIZE_32			> TASK_SIZE_64);
 #endif
 
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
 	/*
 	 * Make sure we chose the upper bound of sizeof(struct page)
-	 * correctly.
+	 * correctly when sizing the VMEMMAP array.
 	 */
 	BUILD_BUG_ON(sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT));
+#endif
 
 	if (PAGE_SIZE >= 16384 && get_num_physpages() <= 128) {
 		extern int sysctl_overcommit_memory;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:38 UTC #13 lore raw

PATCH 14/336 drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Clint Taylor <[email protected]>

commit 0ca9488193e61ec5f31a631d8147f74525629e8a upstream.

On GLK NUC platforms the HDMI retiming buffer needs additional disabled time to correctly sync to a faster incoming signal.

When measured on a scope the highspeed lines of the HDMI clock turn off
for ~400uS during a normal resolution change. The HDMI retimer on the GLK NUC appears to require at least a full frame of quiet time before a
new faster clock can be correctly sync'd. Wait 100ms due to msleep inaccuracies while waiting for a completed frame. Add a quirk to the driver for GLK boards that use ITE66317 HDMI retimers.

V2: Add more devices to the quirk list
V3: Delay increased to 100ms, check to confirm crtc type is HDMI.
V4: crtc type check extended to include _DDI and whitespace fixes
v5: Fix white spaces, remove the macro for delay. Revert the crtc type
check introduced in v4.

Cc: Imre Deak <[email protected]>
Cc: <[email protected]> # v4.14+
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105887

Signed-off-by Clint Taylor <[email protected]>

Tested-by Daniel Scheller <[email protected]>

Signed-off-by Radhakrishna Sripada <[email protected]>

Signed-off-by Imre Deak <[email protected]>

Reviewed-by Imre Deak <[email protected]>

(cherry picked from commit 90c3e2198777aaa355b6994a31a79c636c8d4306)

Signed-off-by Rodrigo Vivi <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/i915/i915_drv.h      |    1 +
 drivers/gpu/drm/i915/intel_ddi.c     |   13 +++++++++++--
 drivers/gpu/drm/i915/intel_display.c |   21 ++++++++++++++++++++-
 drivers/gpu/drm/i915/intel_drv.h     |    3 +--
 4 files changed, 33 insertions(+), 5 deletions(-)

drivers/gpu/drm/i915/i915_drv.h +1 -0

@@ -804,6 +804,7 @@ enum intel_sbi_destination {
 #define QUIRK_BACKLIGHT_PRESENT (1<<3)
 #define QUIRK_PIN_SWIZZLED_PAGES (1<<5)
 #define QUIRK_INCREASE_T12_DELAY (1<<6)
+#define QUIRK_INCREASE_DDI_DISABLED_TIME (1<<7)
 
 struct intel_fbdev;
 struct intel_fbc_work;

drivers/gpu/drm/i915/intel_ddi.c +11 -2

@@ -1605,15 +1605,24 @@ void intel_ddi_enable_transcoder_func(co
 	I915_WRITE(TRANS_DDI_FUNC_CTL(cpu_transcoder), temp);
 }
 
-void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv,
-				       enum transcoder cpu_transcoder)
+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state)
 {
+	struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
+	struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+	enum transcoder cpu_transcoder = crtc_state->cpu_transcoder;
 	i915_reg_t reg = TRANS_DDI_FUNC_CTL(cpu_transcoder);
 	uint32_t val = I915_READ(reg);
 
 	val &= ~(TRANS_DDI_FUNC_ENABLE | TRANS_DDI_PORT_MASK | TRANS_DDI_DP_VC_PAYLOAD_ALLOC);
 	val |= TRANS_DDI_PORT_NONE;
 	I915_WRITE(reg, val);
+
+	if (dev_priv->quirks & QUIRK_INCREASE_DDI_DISABLED_TIME &&
+	    intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI)) {
+		DRM_DEBUG_KMS("Quirk Increase DDI disabled time\n");
+		/* Quirk time at 100ms for reliable operation */
+		msleep(100);
+	}
 }
 
 int intel_ddi_toggle_hdcp_signalling(struct intel_encoder *intel_encoder,

drivers/gpu/drm/i915/intel_display.c +20 -1

@@ -5685,7 +5685,7 @@ static void haswell_crtc_disable(struct
 		intel_ddi_set_vc_payload_alloc(intel_crtc->config, false);
 
 	if (!transcoder_is_dsi(cpu_transcoder))
-		intel_ddi_disable_transcoder_func(dev_priv, cpu_transcoder);
+		intel_ddi_disable_transcoder_func(old_crtc_state);
 
 	if (INTEL_GEN(dev_priv) >= 9)
 		skylake_scaler_disable(intel_crtc);

@@ -14388,6 +14388,18 @@ static void quirk_increase_t12_delay(str
 	DRM_INFO("Applying T12 delay quirk\n");
 }
 
+/*
+ * GeminiLake NUC HDMI outputs require additional off time
+ * this allows the onboard retimer to correctly sync to signal
+ */
+static void quirk_increase_ddi_disabled_time(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = to_i915(dev);
+
+	dev_priv->quirks |= QUIRK_INCREASE_DDI_DISABLED_TIME;
+	DRM_INFO("Applying Increase DDI Disabled quirk\n");
+}
+
 struct intel_quirk {
 	int device;
 	int subsystem_vendor;

@@ -14474,6 +14486,13 @@ static struct intel_quirk intel_quirks[]
 
 	/* Toshiba Satellite P50-C-18C */
 	{ 0x191B, 0x1179, 0xF840, quirk_increase_t12_delay },
+
+	/* GeminiLake NUC */
+	{ 0x3185, 0x8086, 0x2072, quirk_increase_ddi_disabled_time },
+	{ 0x3184, 0x8086, 0x2072, quirk_increase_ddi_disabled_time },
+	/* ASRock ITX*/
+	{ 0x3185, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
+	{ 0x3184, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
 };
 
 static void intel_init_quirks(struct drm_device *dev)

drivers/gpu/drm/i915/intel_drv.h +1 -2

@@ -1368,8 +1368,7 @@ void hsw_fdi_link_train(struct intel_crt
 void intel_ddi_init(struct drm_i915_private *dev_priv, enum port port);
 bool intel_ddi_get_hw_state(struct intel_encoder *encoder, enum pipe *pipe);
 void intel_ddi_enable_transcoder_func(const struct intel_crtc_state *crtc_state);
-void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv,
-				       enum transcoder cpu_transcoder);
+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state);
 void intel_ddi_enable_pipe_clock(const struct intel_crtc_state *crtc_state);
 void intel_ddi_disable_pipe_clock(const  struct intel_crtc_state *crtc_state);
 struct intel_encoder *

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #14 lore raw

PATCH 15/336 mlxsw: spectrum_switchdev: Fix port_vlan refcounting

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Petr Machata <[email protected]>

[ Upstream commit 9e25826ffc942e985b8595b2f1cf2065d3880514 ]

Switchdev notifications for addition of SWITCHDEV_OBJ_ID_PORT_VLAN are distributed not only on clean addition, but also when flags on an existing VLAN are changed. mlxsw_sp_bridge_port_vlan_add() calls mlxsw_sp_port_vlan_get() to get at the port_vlan in question, which implicitly references the object. This then leads to discrepancies in reference counting when the VLAN is removed. spectrum.c warns about the problem when the module is removed:

[13578.493090] WARNING: CPU: 0 PID: 2454 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2973 mlxsw_sp_port_remove+0xfd/0x110 [mlxsw_spectrum]
[...]
[13578.627106] Call Trace:
[13578.629617]  mlxsw_sp_fini+0x2a/0xe0 [mlxsw_spectrum]
[13578.634748]  mlxsw_core_bus_device_unregister+0x3e/0x130 [mlxsw_core]
[13578.641290]  mlxsw_pci_remove+0x13/0x40 [mlxsw_pci]
[13578.646238]  pci_device_remove+0x31/0xb0
[13578.650244]  device_release_driver_internal+0x14f/0x220
[13578.655562]  driver_detach+0x32/0x70
[13578.659183]  bus_remove_driver+0x47/0xa0
[13578.663134]  pci_unregister_driver+0x1e/0x80
[13578.667486]  mlxsw_sp_module_exit+0xc/0x3fa [mlxsw_spectrum]
[13578.673207]  __x64_sys_delete_module+0x13b/0x1e0
[13578.677888]  ? exit_to_usermode_loop+0x78/0x80
[13578.682374]  do_syscall_64+0x39/0xe0
[13578.685976]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix by putting the port_vlan when mlxsw_sp_port_vlan_bridge_join() determines it's a flag-only change.

Fixes b3529af6bb0d ("spectrum: Reference count VLAN entries")

Signed-off-by Petr Machata <[email protected]>

Acked-by Jiri Pirko <[email protected]>

Signed-off-by Ido Schimmel <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +3 -1

@@ -1013,8 +1013,10 @@ mlxsw_sp_port_vlan_bridge_join(struct ml
 	int err;
 
 	/* No need to continue if only VLAN flags were changed */
-	if (mlxsw_sp_port_vlan->bridge_port)
+	if (mlxsw_sp_port_vlan->bridge_port) {
+		mlxsw_sp_port_vlan_put(mlxsw_sp_port_vlan);
 		return 0;
+	}
 
 	err = mlxsw_sp_port_vlan_fid_join(mlxsw_sp_port_vlan, bridge_port);
 	if (err)

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #15 lore raw

PATCH 16/336 kcov: ensure irq code sees a valid area

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mark Rutland <[email protected]>

[ Upstream commit c9484b986ef03492357fddd50afbdd02929cfa72 ]

Patch series "kcov: fix unexpected faults".

These patches fix a few issues where KCOV code could trigger recursive faults, discovered while debugging a patch enabling KCOV for arch/arm:

* On CONFIG_PREEMPT kernels, there's a small race window where __sanitizer_cov_trace_pc() can see a bogus kcov_area.

* Lazy faulting of the vmalloc area can cause mutual recursion between fault handling code and __sanitizer_cov_trace_pc().

* During the context switch, switching the mm can cause the kcov_area to be transiently unmapped.

These are prerequisites for enabling KCOV on arm, but the issues themsevles are generic -- we just happen to avoid them by chance rather than design on x86-64 and arm64.

This patch (of 3):

For kernels built with CONFIG_PREEMPT, some C code may execute before or after the interrupt handler, while the hardirq count is zero. In these cases, in_task() can return true.

A task can be interrupted in the middle of a KCOV_DISABLE ioctl while it resets the task's kcov data via kcov_task_init(). Instrumented code executed during this period will call __sanitizer_cov_trace_pc(), and as in_task() returns true, will inspect t->kcov_mode before trying to write to t->kcov_area.

In kcov_init_task() we update t->kcov_{mode,area,size} with plain stores, which may be re-ordered, torn, etc. Thus __sanitizer_cov_trace_pc() may see bogus values for any of these fields, and may attempt to write to memory which is not mapped.

Let's avoid this by using WRITE_ONCE() to set t->kcov_mode, with a barrier() to ensure this is ordered before we clear t->kov_{area,size}. This ensures that any code execute while kcov_init_task() is preempted will either see valid values for t->kcov_{area,size}, or will see that t->kcov_mode is KCOV_MODE_DISABLED, and bail out without touching t->kcov_area.

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Mark Rutland <[email protected]>

Acked-by Andrey Ryabinin <[email protected]>

Cc Dmitry Vyukov <[email protected]>

Cc Ingo Molnar <[email protected]>

Cc Peter Zijlstra <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/kcov.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

kernel/kcov.c +2 -1

@@ -241,7 +241,8 @@ static void kcov_put(struct kcov *kcov)
 
 void kcov_task_init(struct task_struct *t)
 {
-	t->kcov_mode = KCOV_MODE_DISABLED;
+	WRITE_ONCE(t->kcov_mode, KCOV_MODE_DISABLED);
+	barrier();
 	t->kcov_size = 0;
 	t->kcov_area = NULL;
 	t->kcov = NULL;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #16 lore raw

PATCH 17/336 mm: check for SIGKILL inside dup_mmap() loop

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tetsuo Handa <[email protected]>

[ Upstream commit 655c79bb40a0870adcd0871057d01de11625882b ]

As a theoretical problem, dup_mmap() of an mm_struct with 60000+ vmas can loop while potentially allocating memory, with mm->mmap_sem held for write by current thread. This is bad if current thread was selected as an OOM victim, for current thread will continue allocations using memory reserves while OOM reaper is unable to reclaim memory.

As an actually observable problem, it is not difficult to make OOM reaper unable to reclaim memory if the OOM victim is blocked at i_mmap_lock_write() in this loop. Unfortunately, since nobody can explain whether it is safe to use killable wait there, let's check for SIGKILL before trying to allocate memory. Even without an OOM event, there is no point with continuing the loop from the beginning if current thread is killed.

I tested with debug printk(). This patch should be safe because we already fail if security_vm_enough_memory_mm() or kmem_cache_alloc(GFP_KERNEL) fails and exit_mmap() handles it.

***** Aborting dup_mmap() due to SIGKILL ***** ***** Aborting dup_mmap() due to SIGKILL ***** ***** Aborting dup_mmap() due to SIGKILL ***** ***** Aborting dup_mmap() due to SIGKILL ***** ***** Aborting exit_mmap() due to NULL mmap *****

[[email protected]: add comment]

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Tetsuo Handa <[email protected]>

Cc Alexander Viro <[email protected]>

Cc Rik van Riel <[email protected]>

Cc Michal Hocko <[email protected]>

Cc Kirill A. Shutemov <[email protected]>

Cc David Rientjes <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/fork.c |    8 ++++++++
 1 file changed, 8 insertions(+)

kernel/fork.c +8 -0

@@ -440,6 +440,14 @@ static __latent_entropy int dup_mmap(str
 			continue;
 		}
 		charge = 0;
+		/*
+		 * Don't duplicate many vmas if we've been oom-killed (for
+		 * example)
+		 */
+		if (fatal_signal_pending(current)) {
+			retval = -EINTR;
+			goto out;
+		}
 		if (mpnt->vm_flags & VM_ACCOUNT) {
 			unsigned long len = vma_pages(mpnt);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #17 lore raw

PATCH 18/336 drm/amd/powerplay: Set higher SCLK&MCLK frequency than dpm7 in OD (v2)

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kenneth Feng <[email protected]>

[ Upstream commit 5c16f36f6f003b4415237acca59384a074cd8030 ]

Fix the issue that SCLK&MCLK can't be set higher than dpm7 when OD is enabled in SMU7.

v2: fix warning (Alex)

Signed-off-by Kenneth Feng <[email protected]>

Acked-by Rex Zhu<[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +5 -2

@@ -3715,14 +3715,17 @@ static int smu7_trim_dpm_states(struct p
 static int smu7_generate_dpm_level_enable_mask(
 		struct pp_hwmgr *hwmgr, const void *input)
 {
-	int result;
+	int result = 0;
 	const struct phm_set_power_state_input *states =
 			(const struct phm_set_power_state_input *)input;
 	struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
 	const struct smu7_power_state *smu7_ps =
 			cast_const_phw_smu7_power_state(states->pnew_state);
 
-	result = smu7_trim_dpm_states(hwmgr, smu7_ps);
+	/*skip the trim if od is enabled*/
+	if (!hwmgr->od_enabled)
+		result = smu7_trim_dpm_states(hwmgr, smu7_ps);
+
 	if (result)
 		return result;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #18 lore raw

PATCH 19/336 xen/netfront: raise max number of slots in xennet_get_responses()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Juergen Gross <[email protected]>

[ Upstream commit 57f230ab04d2910a06d17d988f1c4d7586a59113 ]

The max number of slots used in xennet_get_responses() is set to MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD).

In old kernel-xen MAX_SKB_FRAGS was 18, while nowadays it is 17. This difference is resulting in frequent messages "too many slots" and a reduced network throughput for some workloads (factor 10 below that of a kernel-xen based guest).

Replacing MAX_SKB_FRAGS by XEN_NETIF_NR_SLOTS_MIN for calculation of the max number of slots to use solves that problem (tests showed no more messages "too many slots" and throughput was as high as with the kernel-xen based guest system).

Replace MAX_SKB_FRAGS-2 by XEN_NETIF_NR_SLOTS_MIN-1 in netfront_tx_slot_available() for making it clearer what is really being tested without actually modifying the tested value.

Signed-off-by Juergen Gross <[email protected]>

Reviewed-by Boris Ostrovsky <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/xen-netfront.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/net/xen-netfront.c +2 -2

@@ -239,7 +239,7 @@ static void rx_refill_timeout(struct tim
 static int netfront_tx_slot_available(struct netfront_queue *queue)
 {
 	return (queue->tx.req_prod_pvt - queue->tx.rsp_cons) <
-		(NET_TX_RING_SIZE - MAX_SKB_FRAGS - 2);
+		(NET_TX_RING_SIZE - XEN_NETIF_NR_SLOTS_MIN - 1);
 }
 
 static void xennet_maybe_wake_tx(struct netfront_queue *queue)

@@ -790,7 +790,7 @@ static int xennet_get_responses(struct n
 	RING_IDX cons = queue->rx.rsp_cons;
 	struct sk_buff *skb = xennet_get_rx_skb(queue, cons);
 	grant_ref_t ref = xennet_get_rx_ref(queue, cons);
-	int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD);
+	int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD);
 	int slots = 1;
 	int err = 0;
 	unsigned long ret;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #19 lore raw

PATCH 20/336 hv_netvsc: fix network namespace issues with VF support

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stephen Hemminger <[email protected]>

[ Upstream commit 7bf7bb37f16a80465ee3bd7c6c966f96f5a075a6 ]

When finding the parent netvsc device, the search needs to be across all netvsc device instances (independent of network namespace).

Find parent device of VF using upper_dev_get routine which searches only adjacent list.

Fixes e8ff40d4bff1 ("hv_netvsc: improve VF device matching")

Signed-off-by Stephen Hemminger <[email protected]>

netns aware byref

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/hyperv/hyperv_net.h |    2 +
 drivers/net/hyperv/netvsc_drv.c |   45 ++++++++++++++++++----------------------
 2 files changed, 23 insertions(+), 24 deletions(-)

drivers/net/hyperv/hyperv_net.h +2 -0

@@ -738,6 +738,8 @@ struct net_device_context {
 	struct hv_device *device_ctx;
 	/* netvsc_device */
 	struct netvsc_device __rcu *nvdev;
+	/* list of netvsc net_devices */
+	struct list_head list;
 	/* reconfigure work */
 	struct delayed_work dwork;
 	/* last reconfig time */

drivers/net/hyperv/netvsc_drv.c +21 ~~-24~~

86 lines not on this page · raw message

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #20 lore raw

PATCH 21/336 skip LAYOUTRETURN if layout is invalid

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Olga Kornievskaia <[email protected]>

[ Upstream commit 93b7f7ad2018d2037559b1d0892417864c78b371 ]

Currently, when IO to DS fails, client returns the layout and retries against the MDS. However, then on umounting (inode eviction) it returns the layout again.

This is because pnfs_return_layout() was changed in
commit d78471d32bb6 ("pnfs/blocklayout: set PNFS_LAYOUTRETURN_ON_ERROR") to always set NFS_LAYOUT_RETURN_REQUESTED so even if we returned the layout, it will be returned again. Instead, let's also check if we have already marked the layout invalid.

Signed-off-by Olga Kornievskaia <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/pnfs.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

fs/nfs/pnfs.c +4 -2

@@ -1144,7 +1144,7 @@ _pnfs_return_layout(struct inode *ino)
 	LIST_HEAD(tmp_list);
 	nfs4_stateid stateid;
 	int status = 0;
-	bool send;
+	bool send, valid_layout;
 
 	dprintk("NFS: %s for inode %lu\n", __func__, ino->i_ino);

@@ -1165,6 +1165,7 @@ _pnfs_return_layout(struct inode *ino)
 			goto out_put_layout_hdr;
 		spin_lock(&ino->i_lock);
 	}
+	valid_layout = pnfs_layout_is_valid(lo);
 	pnfs_clear_layoutcommit(ino, &tmp_list);
 	pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL, 0);

@@ -1178,7 +1179,8 @@ _pnfs_return_layout(struct inode *ino)
 	}
 
 	/* Don't send a LAYOUTRETURN if list was initially empty */
-	if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) {
+	if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||
+			!valid_layout) {
 		spin_unlock(&ino->i_lock);
 		dprintk("NFS: %s no layout segments to return\n", __func__);
 		goto out_put_layout_hdr;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #21 lore raw

PATCH 22/336 ixgbe: Fix setting of TC configuration for macvlan case

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Duyck <[email protected]>

[ Upstream commit 646bb57ce86e4d7b0bd9d33244450ae009411e48 ]

When we were enabling macvlan interfaces we weren't correctly configuring things until ixgbe_setup_tc was called a second time either by tweaking the number of queues or increasing the macvlan count past 15.

The issue came down to the fact that num_rx_pools is not populated until after the queues and interrupts are reinitialized.

Instead of trying to set it sooner we can just move the call to setup at least 1 traffic class to the SR-IOV/VMDq setup function so that we just set it for this one case. We already had a spot that was configuring the queues for TC 0 in the code here anyway so it makes sense to also set the number of TCs here as well.

Fixes 49cfbeb7a95c ("ixgbe: Fix handling of macvlan Tx offload")

Signed-off-by Alexander Duyck <[email protected]>

Tested-by Andrew Bowers <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c  |    8 ++++++++
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c |    8 --------
 2 files changed, 8 insertions(+), 8 deletions(-)

drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c +8 -0

@@ -618,6 +618,14 @@ static bool ixgbe_set_sriov_queues(struc
 	}
 
 #endif
+	/* To support macvlan offload we have to use num_tc to
+	 * restrict the queues that can be used by the device.
+	 * By doing this we can avoid reporting a false number of
+	 * queues.
+	 */
+	if (vmdq_i > 1)
+		netdev_set_num_tc(adapter->netdev, 1);
+
 	/* populate TC0 for use by pool 0 */
 	netdev_set_tc_queue(adapter->netdev, 0,
 			    adapter->num_rx_queues_per_pool, 0);

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +0 -8

@@ -8875,14 +8875,6 @@ int ixgbe_setup_tc(struct net_device *de
 	} else {
 		netdev_reset_tc(dev);
 
-		/* To support macvlan offload we have to use num_tc to
-		 * restrict the queues that can be used by the device.
-		 * By doing this we can avoid reporting a false number of
-		 * queues.
-		 */
-		if (!tc && adapter->num_rx_pools > 1)
-			netdev_set_num_tc(dev, 1);
-
 		if (adapter->hw.mac.type == ixgbe_mac_82598EB)
 			adapter->hw.fc.requested_mode = adapter->last_lfc_mode;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:45 UTC #22 lore raw

PATCH 23/336 ALSA: emu10k1: add error handling for snd_ctl_add

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhouyang Jia <[email protected]>

[ Upstream commit 6d531e7b972cb62ded011c2dfcc2d9f72ea6c421 ]

When snd_ctl_add fails, the lack of error-handling code may cause unexpected results.

This patch adds error-handling code after calling snd_ctl_add.

Signed-off-by Zhouyang Jia <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/pci/emu10k1/emupcm.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

sound/pci/emu10k1/emupcm.c +3 -1

@@ -1858,7 +1858,9 @@ int snd_emu10k1_pcm_efx(struct snd_emu10
 	if (!kctl)
 		return -ENOMEM;
 	kctl->id.device = device;
-	snd_ctl_add(emu->card, kctl);
+	err = snd_ctl_add(emu->card, kctl);
+	if (err < 0)
+		return err;
 
 	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024);

Greg Kroah-Hartman

author maintainer

2018-08-01 17:38 UTC #23 lore raw

PATCH 24/336 ALSA: fm801: add error handling for snd_ctl_add

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhouyang Jia <[email protected]>

[ Upstream commit ef1ffbe7889e99f5b5cccb41c89e5c94f50f3218 ]

When snd_ctl_add fails, the lack of error-handling code may cause unexpected results.

This patch adds error-handling code after calling snd_ctl_add.

Signed-off-by Zhouyang Jia <[email protected]>

Acked-by Andy Shevchenko <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/pci/fm801.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

sound/pci/fm801.c +12 -4

@@ -1068,11 +1068,19 @@ static int snd_fm801_mixer(struct fm801
 		if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97_sec)) < 0)
 			return err;
 	}
-	for (i = 0; i < FM801_CONTROLS; i++)
-		snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls[i], chip));
+	for (i = 0; i < FM801_CONTROLS; i++) {
+		err = snd_ctl_add(chip->card,
+			snd_ctl_new1(&snd_fm801_controls[i], chip));
+		if (err < 0)
+			return err;
+	}
 	if (chip->multichannel) {
-		for (i = 0; i < FM801_CONTROLS_MULTI; i++)
-			snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
+		for (i = 0; i < FM801_CONTROLS_MULTI; i++) {
+			err = snd_ctl_add(chip->card,
+				snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
+			if (err < 0)
+				return err;
+		}
 	}
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 17:35 UTC #24 lore raw

PATCH 25/336 NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <[email protected]>

[ Upstream commit f9312a541050007ec59eb0106273a0a10718cd83 ]

If the server returns NFS4ERR_SEQ_FALSE_RETRY or NFS4ERR_RETRY_UNCACHED_REP, then it thinks we're trying to replay an existing request. If so, then let's just bump the sequence ID and retry the operation.

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/nfs4proc.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

fs/nfs/nfs4proc.c +7 -4

@@ -746,6 +746,13 @@ static int nfs41_sequence_process(struct
 			slot->slot_nr,
 			slot->seq_nr);
 		goto out_retry;
+	case -NFS4ERR_RETRY_UNCACHED_REP:
+	case -NFS4ERR_SEQ_FALSE_RETRY:
+		/*
+		 * The server thinks we tried to replay a request.
+		 * Retry the call after bumping the sequence ID.
+		 */
+		goto retry_new_seq;
 	case -NFS4ERR_BADSLOT:
 		/*
 		 * The slot id we used was probably retired. Try again

@@ -770,10 +777,6 @@ static int nfs41_sequence_process(struct
 			goto retry_nowait;
 		}
 		goto session_recover;
-	case -NFS4ERR_SEQ_FALSE_RETRY:
-		if (interrupted)
-			goto retry_new_seq;
-		goto session_recover;
 	default:
 		/* Just update the slot sequence no. */
 		slot->seq_done = 1;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:32 UTC #25 lore raw

PATCH 26/336 nfsd: fix error handling in nfs4_set_delegation()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrew Elble <[email protected]>

[ Upstream commit 692ad280bff3e81721ab138b9455948ab5289acf ]

I noticed a memory corruption crash in nfsd in
4.17-rc1. This patch corrects the issue.

Fix to return error if the delegation couldn't be hashed or there was a recall in progress. Use the existing error path instead of destroy_delegation() for readability.

Signed-off-by Andrew Elble <[email protected]>

Fixes 353601e7d323c ("nfsd: create a separate lease for each delegation")

Signed-off-by J. Bruce Fields <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfsd/nfs4state.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

fs/nfsd/nfs4state.c +4 -1

@@ -4378,8 +4378,11 @@ nfs4_set_delegation(struct nfs4_client *
 	spin_unlock(&state_lock);
 
 	if (status)
-		destroy_unhashed_deleg(dp);
+		goto out_unlock;
+
 	return dp;
+out_unlock:
+	vfs_setlease(fp->fi_deleg_file, F_UNLCK, NULL, (void **)&dp);
 out_clnt_odstate:
 	put_clnt_odstate(dp->dl_clnt_odstate);
 out_stid:

Greg Kroah-Hartman

author maintainer

2018-08-01 17:39 UTC #26 lore raw

PATCH 27/336 nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Scott Mayhew <[email protected]>

[ Upstream commit 3171822fdcdd6e6d536047c425af6dc7a92dc585 ]

When running a fuzz tester against a KASAN-enabled kernel, the following splat periodically occurs.

The problem occurs when the test sends a GETDEVICEINFO request with a malformed xdr array (size but no data) for gdia_notify_types and the array size is > 0x3fffffff, which results in an overflow in the value of nbytes which is passed to read_buf().

If the array size is 0x40000000, 0x80000000, or 0xc0000000, then after the overflow occurs, the value of nbytes 0, and when that happens the pointer returned by read_buf() points to the end of the xdr data (i.e. argp->end) when really it should be returning NULL.

Fix this by returning NFS4ERR_BAD_XDR if the array size is > 1000 (this value is arbitrary, but it's the same threshold used by nfsd4_decode_bitmap()... in could really be any value >= 1 since it's expected to get at most a single bitmap in gdia_notify_types).

[  119.256854] ==================================================================
[  119.257611] BUG: KASAN: use-after-free in nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
[  119.258422] Read of size 4 at addr ffff880113ada000 by task nfsd/538

[  119.259146] CPU: 0 PID: 538 Comm: nfsd Not tainted 4.17.0+ #1
[  119.259662] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.fc25 04/01/2014
[  119.261202] Call Trace:
[  119.262265]  dump_stack+0x71/0xab
[  119.263371]  print_address_description+0x6a/0x270
[  119.264609]  kasan_report+0x258/0x380
[  119.265854]  ? nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
[  119.267291]  nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
[  119.268549]  ? nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd]
[  119.269873]  ? nfsd4_decode_sequence+0x490/0x490 [nfsd]
[  119.271095]  nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd]
[  119.272393]  ? nfsd4_release_compoundargs+0x1b0/0x1b0 [nfsd]
[  119.273658]  nfsd_dispatch+0x183/0x850 [nfsd]
[  119.274918]  svc_process+0x161c/0x31a0 [sunrpc]
[  119.276172]  ? svc_printk+0x190/0x190 [sunrpc]
[  119.277386]  ? svc_xprt_release+0x451/0x680 [sunrpc]
[  119.278622]  nfsd+0x2b9/0x430 [nfsd]
[  119.279771]  ? nfsd_destroy+0x1c0/0x1c0 [nfsd]
[  119.281157]  kthread+0x2db/0x390
[  119.282347]  ? kthread_create_worker_on_cpu+0xc0/0xc0
[  119.283756]  ret_from_fork+0x35/0x40

[  119.286041] Allocated by task 436:
[  119.287525]  kasan_kmalloc+0xa0/0xd0
[  119.288685]  kmem_cache_alloc+0xe9/0x1f0
[  119.289900]  get_empty_filp+0x7b/0x410
[  119.291037]  path_openat+0xca/0x4220
[  119.292242]  do_filp_open+0x182/0x280
[  119.293411]  do_sys_open+0x216/0x360
[  119.294555]  do_syscall_64+0xa0/0x2f0
[  119.295721]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

[  119.298068] Freed by task 436:
[  119.299271]  __kasan_slab_free+0x130/0x180
[  119.300557]  kmem_cache_free+0x78/0x210
[  119.301823]  rcu_process_callbacks+0x35b/0xbd0
[  119.303162]  __do_softirq+0x192/0x5ea

[  119.305443] The buggy address belongs to the object at ffff880113ada000
                which belongs to the cache filp of size 256
[  119.308556] The buggy address is located 0 bytes inside of
                256-byte region [ffff880113ada000, ffff880113ada100)
[  119.311376] The buggy address belongs to the page:
[  119.312728] page:ffffea00044eb680 count:1 mapcount:0 mapping:0000000000000000 index:0xffff880113ada780
[  119.314428] flags: 0x17ffe000000100(slab)
[  119.315740] raw: 0017ffe000000100 0000000000000000 ffff880113ada780 00000001000c0001
[  119.317379] raw: ffffea0004553c60 ffffea00045c11e0 ffff88011b167e00 0000000000000000
[  119.319050] page dumped because: kasan: bad access detected

[  119.321652] Memory state around the buggy address:
[  119.322993]  ffff880113ad9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  119.324515]  ffff880113ad9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  119.326087] >ffff880113ada000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.327547]                    ^
[  119.328730]  ffff880113ada080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.330218]  ffff880113ada100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[  119.331740] ==================================================================

Signed-off-by Scott Mayhew <[email protected]>

Signed-off-by J. Bruce Fields <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfsd/nfs4xdr.c |    2 ++
 1 file changed, 2 insertions(+)

fs/nfsd/nfs4xdr.c +2 -0

@@ -1585,6 +1585,8 @@ nfsd4_decode_getdeviceinfo(struct nfsd4_
 	gdev->gd_maxcount = be32_to_cpup(p++);
 	num = be32_to_cpup(p++);
 	if (num) {
+		if (num > 1000)
+			goto xdr_error;
 		READ_BUF(4 * num);
 		gdev->gd_notify_types = be32_to_cpup(p++);
 		for (i = 1; i < num; i++) {

Greg Kroah-Hartman

author maintainer

2018-08-01 17:35 UTC #27 lore raw

PATCH 28/336 vfio: platform: Fix reset module leak in error path

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email protected]>

[ Upstream commit 28a68387888997e8a7fa57940ea5d55f2e16b594 ]

If the IOMMU group setup fails, the reset module is not released.

Fixes b5add544d677d363 ("vfio, platform: make reset driver a requirement by default")

Signed-off-by Geert Uytterhoeven <[email protected]>

Reviewed-by Eric Auger <[email protected]>

Reviewed-by Simon Horman <[email protected]>

Acked-by Eric Auger <[email protected]>

Signed-off-by Alex Williamson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/vfio/platform/vfio_platform_common.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

drivers/vfio/platform/vfio_platform_common.c +10 -5

@@ -681,18 +681,23 @@ int vfio_platform_probe_common(struct vf
 	group = vfio_iommu_group_get(dev);
 	if (!group) {
 		pr_err("VFIO: No IOMMU group for device %s\n", vdev->name);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto put_reset;
 	}
 
 	ret = vfio_add_group_dev(dev, &vfio_platform_ops, vdev);
-	if (ret) {
-		vfio_iommu_group_put(group, dev);
-		return ret;
-	}
+	if (ret)
+		goto put_iommu;
 
 	mutex_init(&vdev->igate);
 
 	return 0;
+
+put_iommu:
+	vfio_iommu_group_put(group, dev);
+put_reset:
+	vfio_platform_put_reset(vdev);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(vfio_platform_probe_common);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #28 lore raw

PATCH 29/336 vfio/mdev: Check globally for duplicate devices

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Williamson <[email protected]>

[ Upstream commit 002fe996f67f4f46d8917b14cfb6e4313c20685a ]

When we create an mdev device, we check for duplicates against the parent device and return -EEXIST if found, but the mdev device namespace is global since we'll link all devices from the bus. We do catch this later in sysfs_do_create_link_sd() to return -EEXIST, but with it comes a kernel warning and stack trace for trying to create duplicate sysfs links, which makes it an undesirable response.

Therefore we should really be looking for duplicates across all mdev parent devices, or as implemented here, against our mdev device list. Using mdev_list to prevent duplicates means that we can remove mdev_parent.lock, but in order not to serialize mdev device creation and removal globally, we add mdev_device.active which allows UUIDs to be reserved such that we can drop the mdev_list_lock before the mdev device is fully in place.

Two behavioral notes; first, mdev_parent.lock had the side-effect of serializing mdev create and remove ops per parent device. This was an implementation detail, not an intentional guarantee provided to the mdev vendor drivers. Vendor drivers can trivially provide this serialization internally if necessary. Second, review comments note the new -EAGAIN behavior when the device, and in particular the remove attribute, becomes visible in sysfs. If a remove is triggered prior to completion of mdev_device_create() the user will see a -EAGAIN error. While the errno is different, receiving an error during this period is not, the previous implementation returned -ENODEV for the same condition. Furthermore, the consistency to the user is improved in the case where mdev_device_remove_ops() returns error. Previously concurrent calls to mdev_device_remove() could see the device disappear with -ENODEV and return in the case of error. Now a user would see -EAGAIN while the device is in this transitory state.

Reviewed-by Kirti Wankhede <[email protected]>

Reviewed-by Cornelia Huck <[email protected]>

Acked-by Halil Pasic <[email protected]>

Acked-by Zhenyu Wang <[email protected]>

Signed-off-by Alex Williamson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 Documentation/vfio-mediated-device.txt |    5 +
 drivers/vfio/mdev/mdev_core.c          |  102 +++++++++++----------------------
 drivers/vfio/mdev/mdev_private.h       |    2 
 3 files changed, 42 insertions(+), 67 deletions(-)

Documentation/vfio-mediated-device.txt +5 -0

@@ -145,6 +145,11 @@ The functions in the mdev_parent_ops str
 * create: allocate basic resources in a driver for a mediated device
 * remove: free resources in a driver when a mediated device is destroyed
 
+(Note that mdev-core provides no implicit serialization of create/remove
+callbacks per mdev parent device, per mdev type, or any other categorization.
+Vendor drivers are expected to be fully asynchronous in this respect or
+provide their own internal resource protection.)
+
 The callbacks in the mdev_parent_ops structure are as follows:
 
 * open: open callback of mediated device

drivers/vfio/mdev/mdev_core.c +36 ~~-66~~

190 lines not on this page · raw message

drivers/vfio/mdev/mdev_private.h +1 -1

@@ -20,7 +20,6 @@ struct mdev_parent {
 	struct device *dev;
 	const struct mdev_parent_ops *ops;
 	struct kref ref;
-	struct mutex lock;
 	struct list_head next;
 	struct kset *mdev_types_kset;
 	struct list_head type_list;

@@ -34,6 +33,7 @@ struct mdev_device {
 	struct kref ref;
 	struct list_head next;
 	struct kobject *type_kobj;
+	bool active;
 };
 
 #define to_mdev_device(dev)	container_of(dev, struct mdev_device, dev)

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #29 lore raw

PATCH 30/336 vfio/type1: Fix task tracking for QEMU vCPU hotplug

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Williamson <[email protected]>

[ Upstream commit 48d8476b41eed63567dd2f0ad125c895b9ac648a ]

MAP_DMA ioctls might be called from various threads within a process, for example when using QEMU, the vCPU threads are often generating these calls and we therefore take a reference to that vCPU task. However, QEMU also supports vCPU hotplug on some machines and the task that called MAP_DMA may have exited by the time UNMAP_DMA is called, resulting in the mm_struct pointer being NULL and thus a failure to match against the existing mapping.

To resolve this, we instead take a reference to the thread group_leader, which has the same mm_struct and resource limits, but is less likely exit, at least in the QEMU case. A difficulty here is guaranteeing that the capabilities of the group_leader match that of the calling thread, which we resolve by tracking CAP_IPC_LOCK at the time of calling rather than at an indeterminate time in the future. Potentially this also results in better efficiency as this is now recorded once per MAP_DMA ioctl.

Reported-by Xu Yandong <[email protected]>

Signed-off-by Alex Williamson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/vfio/vfio_iommu_type1.c |   73 +++++++++++++++++++++++++---------------
 1 file changed, 47 insertions(+), 26 deletions(-)

drivers/vfio/vfio_iommu_type1.c +47 ~~-26~~

@@ -83,6 +83,7 @@ struct vfio_dma {
 	size_t			size;		/* Map size (bytes) */
 	int			prot;		/* IOMMU_READ/WRITE */
 	bool			iommu_mapped;
+	bool			lock_cap;	/* capable(CAP_IPC_LOCK) */
 	struct task_struct	*task;
 	struct rb_root		pfn_list;	/* Ex-user pinned pfn list */
 };

@@ -253,29 +254,25 @@ static int vfio_iova_put_vfio_pfn(struct
 	return ret;
 }
 
-static int vfio_lock_acct(struct task_struct *task, long npage, bool *lock_cap)
+static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async)
 {
 	struct mm_struct *mm;
-	bool is_current;
 	int ret;
 
 	if (!npage)
 		return 0;
 
-	is_current = (task->mm == current->mm);
-
-	mm = is_current ? task->mm : get_task_mm(task);
+	mm = async ? get_task_mm(dma->task) : dma->task->mm;
 	if (!mm)
 		return -ESRCH; /* process exited */
 
 	ret = down_write_killable(&mm->mmap_sem);
 	if (!ret) {
 		if (npage > 0) {
-			if (lock_cap ? !*lock_cap :
-			    !has_capability(task, CAP_IPC_LOCK)) {
+			if (!dma->lock_cap) {
 				unsigned long limit;
 
-				limit = task_rlimit(task,
+				limit = task_rlimit(dma->task,
 						RLIMIT_MEMLOCK) >> PAGE_SHIFT;
 
 				if (mm->locked_vm + npage > limit)

@@ -289,7 +286,7 @@ static int vfio_lock_acct(struct task_st
 		up_write(&mm->mmap_sem);
 	}
 
-	if (!is_current)
+	if (async)
 		mmput(mm);
 
 	return ret;

@@ -398,7 +395,7 @@ static int vaddr_get_pfn(struct mm_struc
  */
 static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr,
 				  long npage, unsigned long *pfn_base,
-				  bool lock_cap, unsigned long limit)
+				  unsigned long limit)
 {
 	unsigned long pfn = 0;
 	long ret, pinned = 0, lock_acct = 0;

@@ -421,7 +418,7 @@ static long vfio_pin_pages_remote(struct
 	 * pages are already counted against the user.
 	 */
 	if (!rsvd && !vfio_find_vpfn(dma, iova)) {
-		if (!lock_cap && current->mm->locked_vm + 1 > limit) {
+		if (!dma->lock_cap && current->mm->locked_vm + 1 > limit) {
 			put_pfn(*pfn_base, dma->prot);
 			pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", __func__,
 					limit << PAGE_SHIFT);

@@ -447,7 +444,7 @@ static long vfio_pin_pages_remote(struct
 		}
 
 		if (!rsvd && !vfio_find_vpfn(dma, iova)) {
-			if (!lock_cap &&
+			if (!dma->lock_cap &&
 			    current->mm->locked_vm + lock_acct + 1 > limit) {
 				put_pfn(pfn, dma->prot);
 				pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n",

@@ -460,7 +457,7 @@ static long vfio_pin_pages_remote(struct
 	}
 
 out:
-	ret = vfio_lock_acct(current, lock_acct, &lock_cap);
+	ret = vfio_lock_acct(dma, lock_acct, false);
 
 unpin_out:
 	if (ret) {

@@ -491,7 +488,7 @@ static long vfio_unpin_pages_remote(stru
 	}
 
 	if (do_accounting)
-		vfio_lock_acct(dma->task, locked - unlocked, NULL);
+		vfio_lock_acct(dma, locked - unlocked, true);
 
 	return unlocked;
 }

@@ -508,7 +505,7 @@ static int vfio_pin_page_external(struct
 
 	ret = vaddr_get_pfn(mm, vaddr, dma->prot, pfn_base);
 	if (!ret && do_accounting && !is_invalid_reserved_pfn(*pfn_base)) {
-		ret = vfio_lock_acct(dma->task, 1, NULL);
+		ret = vfio_lock_acct(dma, 1, true);
 		if (ret) {
 			put_pfn(*pfn_base, dma->prot);
 			if (ret == -ENOMEM)

@@ -535,7 +532,7 @@ static int vfio_unpin_page_external(stru
 	unlocked = vfio_iova_put_vfio_pfn(dma, vpfn);
 
 	if (do_accounting)
-		vfio_lock_acct(dma->task, -unlocked, NULL);
+		vfio_lock_acct(dma, -unlocked, true);
 
 	return unlocked;
 }

@@ -827,7 +824,7 @@ static long vfio_unmap_unpin(struct vfio
 		unlocked += vfio_sync_unpin(dma, domain, &unmapped_region_list);
 
 	if (do_accounting) {
-		vfio_lock_acct(dma->task, -unlocked, NULL);
+		vfio_lock_acct(dma, -unlocked, true);
 		return 0;
 	}
 	return unlocked;

@@ -1042,14 +1039,12 @@ static int vfio_pin_map_dma(struct vfio_
 	size_t size = map_size;
 	long npage;
 	unsigned long pfn, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
-	bool lock_cap = capable(CAP_IPC_LOCK);
 	int ret = 0;
 
 	while (size) {
 		/* Pin a contiguous chunk of memory */
 		npage = vfio_pin_pages_remote(dma, vaddr + dma->size,
-					      size >> PAGE_SHIFT, &pfn,
-					      lock_cap, limit);
+					      size >> PAGE_SHIFT, &pfn, limit);
 		if (npage <= 0) {
 			WARN_ON(!npage);
 			ret = (int)npage;

@@ -1124,8 +1119,36 @@ static int vfio_dma_do_map(struct vfio_i
 	dma->iova = iova;
 	dma->vaddr = vaddr;
 	dma->prot = prot;
-	get_task_struct(current);
-	dma->task = current;
+
+	/*
+	 * We need to be able to both add to a task's locked memory and test
+	 * against the locked memory limit and we need to be able to do both
+	 * outside of this call path as pinning can be asynchronous via the
+	 * external interfaces for mdev devices.  RLIMIT_MEMLOCK requires a
+	 * task_struct and VM locked pages requires an mm_struct, however
+	 * holding an indefinite mm reference is not recommended, therefore we
+	 * only hold a reference to a task.  We could hold a reference to
+	 * current, however QEMU uses this call path through vCPU threads,
+	 * which can be killed resulting in a NULL mm and failure in the unmap
+	 * path when called via a different thread.  Avoid this problem by
+	 * using the group_leader as threads within the same group require
+	 * both CLONE_THREAD and CLONE_VM and will therefore use the same
+	 * mm_struct.
+	 *
+	 * Previously we also used the task for testing CAP_IPC_LOCK at the
+	 * time of pinning and accounting, however has_capability() makes use
+	 * of real_cred, a copy-on-write field, so we can't guarantee that it
+	 * matches group_leader, or in fact that it might not change by the
+	 * time it's evaluated.  If a process were to call MAP_DMA with
+	 * CAP_IPC_LOCK but later drop it, it doesn't make sense that they
+	 * possibly see different results for an iommu_mapped vfio_dma vs
+	 * externally mapped.  Therefore track CAP_IPC_LOCK in vfio_dma at the
+	 * time of calling MAP_DMA.
+	 */
+	get_task_struct(current->group_leader);
+	dma->task = current->group_leader;
+	dma->lock_cap = capable(CAP_IPC_LOCK);
+
 	dma->pfn_list = RB_ROOT;
 
 	/* Insert zero-sized and grow as we map chunks of it */

@@ -1160,7 +1183,6 @@ static int vfio_iommu_replay(struct vfio
 	struct vfio_domain *d;
 	struct rb_node *n;
 	unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
-	bool lock_cap = capable(CAP_IPC_LOCK);
 	int ret;
 
 	/* Arbitrarily pick the first domain in the list for lookups */

@@ -1207,8 +1229,7 @@ static int vfio_iommu_replay(struct vfio
 
 				npage = vfio_pin_pages_remote(dma, vaddr,
 							      n >> PAGE_SHIFT,
-							      &pfn, lock_cap,
-							      limit);
+							      &pfn, limit);
 				if (npage <= 0) {
 					WARN_ON(!npage);
 					ret = (int)npage;

@@ -1485,7 +1506,7 @@ static void vfio_iommu_unmap_unpin_reacc
 			if (!is_invalid_reserved_pfn(vpfn->pfn))
 				locked++;
 		}
-		vfio_lock_acct(dma->task, locked - unlocked, NULL);
+		vfio_lock_acct(dma, locked - unlocked, true);
 	}
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 17:36 UTC #30 lore raw

PATCH 31/336 kernel/hung_task.c: show all hung tasks before panic

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tetsuo Handa <[email protected]>

[ Upstream commit 401c636a0eeb0d51862fce222da1bf08e3a0ffd0 ]

When we get a hung task it can often be valuable to see _all_ the hung tasks on the system before calling panic().

Quoting from https://syzkaller.appspot.com/text?tag=CrashReport&id=5316056503549952
----------------------------------------

INFO: task syz-executor0:6540 blocked for more than 120 seconds.
      Not tainted 4.16.0+ #13
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0   D23560  6540   4521 0x80000004
Call Trace:
 context_switch kernel/sched/core.c:2848 [inline]
 __schedule+0x8fb/0x1ef0 kernel/sched/core.c:3490
 schedule+0xf5/0x430 kernel/sched/core.c:3549
 schedule_preempt_disabled+0x10/0x20 kernel/sched/core.c:3607
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0xb7f/0x1810 kernel/locking/mutex.c:893
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
 lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355
 __blkdev_driver_ioctl block/ioctl.c:303 [inline]
 blkdev_ioctl+0x1759/0x1e00 block/ioctl.c:601
 ioctl_by_bdev+0xa5/0x110 fs/block_dev.c:2060
 isofs_get_last_session fs/isofs/inode.c:567 [inline]
 isofs_fill_super+0x2ba9/0x3bc0 fs/isofs/inode.c:660
 mount_bdev+0x2b7/0x370 fs/super.c:1119
 isofs_mount+0x34/0x40 fs/isofs/inode.c:1560
 mount_fs+0x66/0x2d0 fs/super.c:1222
 vfs_kern_mount.part.26+0xc6/0x4a0 fs/namespace.c:1037
 vfs_kern_mount fs/namespace.c:2514 [inline]
 do_new_mount fs/namespace.c:2517 [inline]
 do_mount+0xea4/0x2b90 fs/namespace.c:2847
 ksys_mount+0xab/0x120 fs/namespace.c:3063
 SYSC_mount fs/namespace.c:3077 [inline]
 SyS_mount+0x39/0x50 fs/namespace.c:3074
 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
(...snipped...)
Showing all locks held in the system:

(...snipped...)
2 locks held by syz-executor0/6540:
#0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: alloc_super fs/super.c:211 [inline]
#0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: sget_userns+0x3b2/0xe60 fs/super.c:502 /* down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING); */ #1: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */
(...snipped...)
3 locks held by syz-executor7/6541:
#0: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */ #1: 000000007bf3d3f9 (&bdev->bd_mutex){+.+.}, at: blkdev_reread_part+0x1e/0x40 block/ioctl.c:192
#2: 00000000566d4c39 (&type->s_umount_key#50){.+.+}, at: __get_super.part.10+0x1d3/0x280 fs/super.c:663 /* down_read(&sb->s_umount); */
----------------------------------------

When reporting an AB-BA deadlock like shown above, it would be nice if trace of PID=6541 is printed as well as trace of PID=6540 before calling panic().

Showing hung tasks up to /proc/sys/kernel/hung_task_warnings could delay calling panic() but normally there should not be so many hung tasks.

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Tetsuo Handa <[email protected]>

Acked-by Paul E. McKenney <[email protected]>

Acked-by Dmitry Vyukov <[email protected]>

Cc Vegard Nossum <[email protected]>

Cc Mandeep Singh Baines <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/hung_task.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

kernel/hung_task.c +7 -4

@@ -44,6 +44,7 @@ int __read_mostly sysctl_hung_task_warni
 
 static int __read_mostly did_panic;
 static bool hung_task_show_lock;
+static bool hung_task_call_panic;
 
 static struct task_struct *watchdog_task;

@@ -127,10 +128,8 @@ static void check_hung_task(struct task_
 	touch_nmi_watchdog();
 
 	if (sysctl_hung_task_panic) {
-		if (hung_task_show_lock)
-			debug_show_all_locks();
-		trigger_all_cpu_backtrace();
-		panic("hung_task: blocked tasks");
+		hung_task_show_lock = true;
+		hung_task_call_panic = true;
 	}
 }

@@ -193,6 +192,10 @@ static void check_hung_uninterruptible_t
 	rcu_read_unlock();
 	if (hung_task_show_lock)
 		debug_show_all_locks();
+	if (hung_task_call_panic) {
+		trigger_all_cpu_backtrace();
+		panic("hung_task: blocked tasks");
+	}
 }
 
 static long hung_timeout_jiffies(unsigned long last_checked,

Greg Kroah-Hartman

author maintainer

2018-08-01 17:39 UTC #31 lore raw

PATCH 32/336 mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the same cacheline

Link https://lkml.kernel.org/r/20180528114019.GF9904@yexl-desktop open here

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aaron Lu <[email protected]>

[ Upstream commit e81bf9793b1861d74953ef041b4f6c7faecc2dbd ]

The LKP robot found a 27% will-it-scale/page_fault3 performance regression regarding commit e27be240df53("mm: memcg: make sure memory.events is uptodate when waking pollers").

What the test does is:
1 mkstemp() a 128M file on a tmpfs;
2 start $nr_cpu processes, each to loop the following:
2.1 mmap() this file in shared write mode;
2.2 write 0 to this file in a PAGE_SIZE step till the end of the file; 2.3 unmap() this file and repeat this process.
3 After 5 minutes, check how many loops they managed to complete, the
higher the better.

The commit itself looks innocent enough as it merely changed some event counting mechanism and this test didn't trigger those events at all. Perf shows increased cycles spent on accessing root_mem_cgroup->stat_cpu in count_memcg_event_mm()(called by handle_mm_fault()) and in __mod_memcg_state() called by page_add_file_rmap(). So it's likely due to the changed layout of 'struct mem_cgroup' that either make stat_cpu falling into a constantly modifying cacheline or some hot fields stop being in the same cacheline.

I verified this by moving memory_events[] back to where it was:

: --- a/include/linux/memcontrol.h
: +++ b/include/linux/memcontrol.h
: @@ -205,7 +205,6 @@ struct mem_cgroup {
: int oom_kill_disable;
:
: /* memory.events */
: - atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
: struct cgroup_file events_file;
:
: /* protect arrays of thresholds */
: @@ -238,6 +237,7 @@ struct mem_cgroup {

:  	struct mem_cgroup_stat_cpu __percpu *stat_cpu;
:  	atomic_long_t		stat[MEMCG_NR_STAT];
:  	atomic_long_t		events[NR_VM_EVENT_ITEMS];

: + atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
:
: unsigned long socket_pressure;

And performance restored.

Later investigation found that as long as the following 3 fields moving_account, move_lock_task and stat_cpu are in the same cacheline, performance will be good. To avoid future performance surprise by other commits changing the layout of 'struct mem_cgroup', this patch makes sure the 3 fields stay in the same cacheline.

One concern of this approach is, moving_account and move_lock_task could be modified when a process changes memory cgroup while stat_cpu is a always read field, it might hurt to place them in the same cacheline. I assume it is rare for a process to change memory cgroup so this should be OK.

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Aaron Lu <[email protected]>

Reported-by kernel test robot <[email protected]>

Cc Johannes Weiner <[email protected]>

Cc Michal Hocko <[email protected]>

Cc Tejun Heo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/memcontrol.h |   23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

include/linux/memcontrol.h +19 -4

@@ -158,6 +158,15 @@ enum memcg_kmem_state {
 	KMEM_ONLINE,
 };
 
+#if defined(CONFIG_SMP)
+struct memcg_padding {
+	char x[0];
+} ____cacheline_internodealigned_in_smp;
+#define MEMCG_PADDING(name)      struct memcg_padding name;
+#else
+#define MEMCG_PADDING(name)
+#endif
+
 /*
  * The memory controller data structure. The memory controller controls both
  * page cache and RSS per cgroup. We would eventually like to provide

@@ -205,7 +214,6 @@ struct mem_cgroup {
 	int		oom_kill_disable;
 
 	/* memory.events */
-	atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
 	struct cgroup_file events_file;
 
 	/* protect arrays of thresholds */

@@ -225,19 +233,26 @@ struct mem_cgroup {
 	 * mem_cgroup ? And what type of charges should we move ?
 	 */
 	unsigned long move_charge_at_immigrate;
+	/* taken only while moving_account > 0 */
+	spinlock_t		move_lock;
+	unsigned long		move_lock_flags;
+
+	MEMCG_PADDING(_pad1_);
+
 	/*
 	 * set > 0 if pages under this cgroup are moving to other cgroup.
 	 */
 	atomic_t		moving_account;
-	/* taken only while moving_account > 0 */
-	spinlock_t		move_lock;
 	struct task_struct	*move_lock_task;
-	unsigned long		move_lock_flags;
 
 	/* memory.stat */
 	struct mem_cgroup_stat_cpu __percpu *stat_cpu;
+
+	MEMCG_PADDING(_pad2_);
+
 	atomic_long_t		stat[MEMCG_NR_STAT];
 	atomic_long_t		events[NR_VM_EVENT_ITEMS];
+	atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
 
 	unsigned long		socket_pressure;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:37 UTC #32 lore raw

PATCH 33/336 mm: /proc/pid/pagemap: hide swap entries from unprivileged users

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Huang Ying <[email protected]>

[ Upstream commit ab6ecf247a9321e3180e021a6a60164dee53ab2e ]

In commit ab676b7d6fbf ("pagemap: do not leak physical addresses to non-privileged userspace"), the /proc/PID/pagemap is restricted to be readable only by CAP_SYS_ADMIN to address some security issue.

In commit 1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users"), the restriction is relieved to make /proc/PID/pagemap readable, but hide the physical addresses for non-privileged users.

But the swap entries are readable for non-privileged users too. This has some security issues. For example, for page under migrating, the swap entry has physical address information. So, in this patch, the swap entries are hided for non-privileged users too.

Link http://lkml.kernel.org/r/[email protected] open here

Fixes 1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users")

Signed-off-by "Huang, Ying" <[email protected]>

Reviewed-by Naoya Horiguchi <[email protected]>

Reviewed-by Konstantin Khlebnikov <[email protected]>

Acked-by Michal Hocko <[email protected]>

Cc Konstantin Khlebnikov <[email protected]>

Cc Andrei Vagin <[email protected]>

Cc Jerome Glisse <[email protected]>

Cc Daniel Colascione <[email protected]>

Cc Zi Yan <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/proc/task_mmu.c |   26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

fs/proc/task_mmu.c +16 ~~-10~~

@@ -1259,8 +1259,9 @@ static pagemap_entry_t pte_to_pagemap_en
 		if (pte_swp_soft_dirty(pte))
 			flags |= PM_SOFT_DIRTY;
 		entry = pte_to_swp_entry(pte);
-		frame = swp_type(entry) |
-			(swp_offset(entry) << MAX_SWAPFILES_SHIFT);
+		if (pm->show_pfn)
+			frame = swp_type(entry) |
+				(swp_offset(entry) << MAX_SWAPFILES_SHIFT);
 		flags |= PM_SWAP;
 		if (is_migration_entry(entry))
 			page = migration_entry_to_page(entry);

@@ -1311,11 +1312,14 @@ static int pagemap_pmd_range(pmd_t *pmdp
 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
 		else if (is_swap_pmd(pmd)) {
 			swp_entry_t entry = pmd_to_swp_entry(pmd);
-			unsigned long offset = swp_offset(entry);
+			unsigned long offset;
 
-			offset += (addr & ~PMD_MASK) >> PAGE_SHIFT;
-			frame = swp_type(entry) |
-				(offset << MAX_SWAPFILES_SHIFT);
+			if (pm->show_pfn) {
+				offset = swp_offset(entry) +
+					((addr & ~PMD_MASK) >> PAGE_SHIFT);
+				frame = swp_type(entry) |
+					(offset << MAX_SWAPFILES_SHIFT);
+			}
 			flags |= PM_SWAP;
 			if (pmd_swp_soft_dirty(pmd))
 				flags |= PM_SOFT_DIRTY;

@@ -1333,10 +1337,12 @@ static int pagemap_pmd_range(pmd_t *pmdp
 			err = add_to_pagemap(addr, &pme, pm);
 			if (err)
 				break;
-			if (pm->show_pfn && (flags & PM_PRESENT))
-				frame++;
-			else if (flags & PM_SWAP)
-				frame += (1 << MAX_SWAPFILES_SHIFT);
+			if (pm->show_pfn) {
+				if (flags & PM_PRESENT)
+					frame++;
+				else if (flags & PM_SWAP)
+					frame += (1 << MAX_SWAPFILES_SHIFT);
+			}
 		}
 		spin_unlock(ptl);
 		return err;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #33 lore raw

PATCH 34/336 mm: vmalloc: avoid racy handling of debugobjects in vunmap

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chintan Pandya <[email protected]>

[ Upstream commit f3c01d2f3ade6790db67f80fef60df84424f8964 ]

Currently, __vunmap flow is,
1) Release the VM area
2) Free the debug objects corresponding to that vm area.

This leave some race window open.
1) Release the VM area
1.5) Some other client gets the same vm area 1.6) This client allocates new debug objects on the same
vm area
2) Free the debug objects corresponding to this vm area.

Here, we actually free 'other' client's debug objects.

Fix this by freeing the debug objects first and then releasing the VM area.

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Chintan Pandya <[email protected]>

Reviewed-by Andrew Morton <[email protected]>

Cc Ard Biesheuvel <[email protected]>

Cc Byungchul Park <[email protected]>

Cc Catalin Marinas <[email protected]>

Cc Florian Fainelli <[email protected]>

Cc Johannes Weiner <[email protected]>

Cc Laura Abbott <[email protected]>

Cc Vlastimil Babka <[email protected]>

Cc Wei Yang <[email protected]>

Cc Yisheng Xie <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 mm/vmalloc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

mm/vmalloc.c +2 -1

@@ -1519,7 +1519,7 @@ static void __vunmap(const void *addr, i
 			addr))
 		return;
 
-	area = remove_vm_area(addr);
+	area = find_vmap_area((unsigned long)addr)->vm;
 	if (unlikely(!area)) {
 		WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
 				addr);

@@ -1529,6 +1529,7 @@ static void __vunmap(const void *addr, i
 	debug_check_no_locks_freed(addr, get_vm_area_size(area));
 	debug_check_no_obj_freed(addr, get_vm_area_size(area));
 
+	remove_vm_area(addr);
 	if (deallocate_pages) {
 		int i;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #34 lore raw

PATCH 35/336 mm/slub.c: add __printf verification to slab_err()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mathieu Malaterre <[email protected]>

[ Upstream commit a38965bf941b7c2af50de09c96bc5f03e136caef ]

__printf is useful to verify format and arguments. Remove the following warning (with W=1):

mm/slub.c:721:2: warning: function might be possible candidate for `gnu_printf' format attribute [-Wsuggest-attribute=format]

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Mathieu Malaterre <[email protected]>

Reviewed-by Andrew Morton <[email protected]>

Cc Christoph Lameter <[email protected]>

Cc Pekka Enberg <[email protected]>

Cc David Rientjes <[email protected]>

Cc Joonsoo Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 mm/slub.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

mm/slub.c +1 -1

@@ -711,7 +711,7 @@ void object_err(struct kmem_cache *s, st
 	print_trailer(s, page, object);
 }
 
-static void slab_err(struct kmem_cache *s, struct page *page,
+static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page,
 			const char *fmt, ...)
 {
 	va_list args;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #35 lore raw

PATCH 36/336 rtc: ensure rtc_set_alarm fails when alarms are not supported

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <[email protected]>

[ Upstream commit abfdff44bc38e9e2ef7929f633fb8462632299d4 ]

When using RTC_ALM_SET or RTC_WKALM_SET with rtc_wkalrm.enabled not set, rtc_timer_enqueue() is not called and rtc_set_alarm() may succeed but the subsequent RTC_AIE_ON ioctl will fail. RTC_ALM_READ would also fail in that case.

Ensure rtc_set_alarm() fails when alarms are not supported to avoid letting programs think the alarms are working for a particular RTC when they are not.

Signed-off-by Alexandre Belloni <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/rtc/interface.c |    5 +++++
 1 file changed, 5 insertions(+)

drivers/rtc/interface.c +5 -0

@@ -441,6 +441,11 @@ int rtc_set_alarm(struct rtc_device *rtc
 {
 	int err;
 
+	if (!rtc->ops)
+		return -ENODEV;
+	else if (!rtc->ops->set_alarm)
+		return -EINVAL;
+
 	err = rtc_valid_tm(&alarm->time);
 	if (err != 0)
 		return err;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:34 UTC #36 lore raw

PATCH 37/336 rxrpc: Fix terminal retransmission connection ID to include the channel

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Howells <[email protected]>

[ Upstream commit fb1967a69f756073362b8f19347f863f227320ad ]

When retransmitting the final ACK or ABORT packet for a call, the cid field in the packet header is set to the connection's cid, but this is incorrect as it also needs to include the channel number on that connection that the call was made on.

Fix this by OR'ing in the channel number.

Note that this fixes the bug that:

	commit 1a025028d400b23477341aa7ec2ce55f8b39b554
	rxrpc: Fix handling of call quietly cancelled out on server

works around. I'm not intending to revert that as it will help protect against problems that might occur on the server.

Fixes 3136ef49a14c ("rxrpc: Delay terminal ACK transmission on a client call")

Signed-off-by David Howells <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/rxrpc/conn_event.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

net/rxrpc/conn_event.c +1 -1

@@ -70,7 +70,7 @@ static void rxrpc_conn_retransmit_call(s
 	iov[2].iov_len	= sizeof(ack_info);
 
 	pkt.whdr.epoch		= htonl(conn->proto.epoch);
-	pkt.whdr.cid		= htonl(conn->proto.cid);
+	pkt.whdr.cid		= htonl(conn->proto.cid | channel);
 	pkt.whdr.callNumber	= htonl(call_id);
 	pkt.whdr.seq		= 0;
 	pkt.whdr.type		= chan->last_type;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:39 UTC #37 lore raw

PATCH 38/336 net: hns3: Fix for VF mailbox cannot receiving PF response

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xi Wang <[email protected]>

[ Upstream commit 1819e40908ee76c7219287224c22c772556c927e ]

When the VF frequently switches the CMDQ interrupt, if the CMDQ_SRC is not cleared, the VF will not receive the new PF response after the interrupt is re-enabled, the corresponding log is as follows:

[  317.482222] hns3 0000:00:03.0: VF could not get mbx resp(=0) from PF
in 500 tries
[  317.483137] hns3 0000:00:03.0: VF request to get tqp info from PF

failed -5

This patch fixes this problem by clearing CMDQ_SRC before enabling interrupt and syncing pending IRQ handlers after disabling interrupt.

Fixes e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")

Signed-off-by Xi Wang <[email protected]>

Signed-off-by Peng Li <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +3 -0

@@ -1441,6 +1441,8 @@ static int hclgevf_misc_irq_init(struct
 		return ret;
 	}
 
+	hclgevf_clear_event_cause(hdev, 0);
+
 	/* enable misc. vector(vector 0) */
 	hclgevf_enable_vector(&hdev->misc_vector, true);

@@ -1451,6 +1453,7 @@ static void hclgevf_misc_irq_uninit(stru
 {
 	/* disable misc vector(vector 0) */
 	hclgevf_enable_vector(&hdev->misc_vector, false);
+	synchronize_irq(hdev->misc_vector.vector_irq);
 	free_irq(hdev->misc_vector.vector_irq, hdev);
 	hclgevf_free_vector(hdev, 0);
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 18:33 UTC #38 lore raw

PATCH 39/336 perf tools: Fix pmu events parsing rule

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiri Olsa <[email protected]>

[ Upstream commit ceac7b79df7bd67ef9aaf464b0179a2686aff4ee ]

Currently all the event parsing fails end up
in the event_pmu rule, and display misleading
help like:

  $ perf stat -e inst kill
  event syntax error: 'inst'
                       \___ Cannot find PMU `inst'. Missing kernel support?
  ...

The reason is that the event_pmu is too strong
and match also single string. Changing it to
force the '/' separators to be part of the rule,
and getting the proper error now:

  $ perf stat -e inst kill
  event syntax error: 'inst'
                       \___ parser error
  Run 'perf list' for a list of valid events
  ...

Signed-off-by Jiri Olsa <[email protected]>

Tested-by Arnaldo Carvalho de Melo <[email protected]>

Cc Adrian Hunter <[email protected]>

Cc Alexander Shishkin <[email protected]>

Cc David Ahern <[email protected]>

Cc Namhyung Kim <[email protected]>

Cc Peter Zijlstra <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 tools/perf/util/parse-events.y |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

tools/perf/util/parse-events.y +13 -1

@@ -73,6 +73,7 @@ static void inc_group_count(struct list_
 %type <num> value_sym
 %type <head> event_config
 %type <head> opt_event_config
+%type <head> opt_pmu_config
 %type <term> event_term
 %type <head> event_pmu
 %type <head> event_legacy_symbol

@@ -224,7 +225,7 @@ event_def: event_pmu |
 	   event_bpf_file
 
 event_pmu:
-PE_NAME opt_event_config
+PE_NAME opt_pmu_config
 {
 	struct list_head *list, *orig_terms, *terms;

@@ -495,6 +496,17 @@ opt_event_config:
 {
 	$$ = NULL;
 }
+
+opt_pmu_config:
+'/' event_config '/'
+{
+	$$ = $2;
+}
+|
+'/' '/'
+{
+	$$ = NULL;
+}
 
 start_terms: event_config
 {

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #39 lore raw

PATCH 40/336 netfilter: ipset: forbid family for hash:mac sets

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florent Fourcot <[email protected]>

[ Upstream commit cbdebe481a14b42c45aa9f4ceb5ff19b55de2c57 ]

Userspace ipset command forbids family option for hash:mac type:

ipset create test hash:mac family inet4
ipset v6.30: Unknown argument: `family'

However, this check is not done in kernel itself. When someone use external netlink applications (pyroute2 python library for example), one can create hash:mac with invalid family and inconsistant results from userspace (ipset command cannot read set content anymore).

This patch enforce the logic in kernel, and forbids insertion of hash:mac with a family set.

Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no impact on other hash:* sets

Signed-off-by Florent Fourcot <[email protected]>

Signed-off-by Victorien Molle <[email protected]>

Signed-off-by Jozsef Kadlecsik <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/netfilter/ipset/ip_set_hash_gen.h |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

net/netfilter/ipset/ip_set_hash_gen.h +4 -1

@@ -1234,7 +1234,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *
 	pr_debug("Create set %s with family %s\n",
 		 set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6");
 
-#ifndef IP_SET_PROTO_UNDEF
+#ifdef IP_SET_PROTO_UNDEF
+	if (set->family != NFPROTO_UNSPEC)
+		return -IPSET_ERR_INVALID_FAMILY;
+#else
 	if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
 		return -IPSET_ERR_INVALID_FAMILY;
 #endif

Greg Kroah-Hartman

author maintainer

2018-08-01 17:38 UTC #40 lore raw

PATCH 41/336 netfilter: ipset: List timing out entries with "timeout 1" instead of zero

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jozsef Kadlecsik <[email protected]>

[ Upstream commit bd975e691486ba52790ba23cc9b4fecab7bc0d31 ]

When listing sets with timeout support, there's a probability that just timing out entries with "0" timeout value is listed/saved. However when restoring the saved list, the zero timeout value means permanent elelements.

The new behaviour is that timing out entries are listed with "timeout 1" instead of zero.

Fixes netfilter bugzilla #1258.

Signed-off-by Jozsef Kadlecsik <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/netfilter/ipset/ip_set_timeout.h |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

include/linux/netfilter/ipset/ip_set_timeout.h +8 -2

@@ -65,8 +65,14 @@ ip_set_timeout_set(unsigned long *timeou
 static inline u32
 ip_set_timeout_get(const unsigned long *timeout)
 {
-	return *timeout == IPSET_ELEM_PERMANENT ? 0 :
-		jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
+	u32 t;
+
+	if (*timeout == IPSET_ELEM_PERMANENT)
+		return 0;
+
+	t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
+	/* Zero value in userspace means no timeout */
+	return t == 0 ? 1 : t;
 }
 
 #endif	/* __KERNEL__ */

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #41 lore raw

PATCH 42/336 irqchip/ls-scfg-msi: Map MSIs in the iommu

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Laurentiu Tudor <[email protected]>

[ Upstream commit 0cdd431c337e99177e68597f3de34bedd3a20a74 ]

Add the required iommu_dma_map_msi_msg() when composing the MSI message, otherwise the interrupts will not work.

Signed-off-by Laurentiu Tudor <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/irqchip/irq-ls-scfg-msi.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/irqchip/irq-ls-scfg-msi.c +3 -0

@@ -21,6 +21,7 @@
 #include <linux/of_pci.h>
 #include <linux/of_platform.h>
 #include <linux/spinlock.h>
+#include <linux/dma-iommu.h>
 
 #define MSI_IRQS_PER_MSIR	32
 #define MSI_MSIR_OFFSET		4

@@ -94,6 +95,8 @@ static void ls_scfg_msi_compose_msg(stru
 
 	if (msi_affinity_flag)
 		msg->data |= cpumask_first(data->common->affinity);
+
+	iommu_dma_map_msi_msg(data->irq, msg);
 }
 
 static int ls_scfg_msi_set_affinity(struct irq_data *irq_data,

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #42 lore raw

PATCH 43/336 watchdog: da9063: Fix updating timeout value

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marco Felsch <[email protected]>

[ Upstream commit 44ee54aabfdb3b35866ed909bde3ab01e9679385 ]

The DA9063 watchdog has only one register field to store the timeout value and to enable the watchdog. The watchdog gets enabled if the value is not zero. There is no issue if the watchdog is already running but it leads into problems if the watchdog is disabled.

If the watchdog is disabled and only the timeout value should be prepared the watchdog gets enabled too. Add a check to get the current watchdog state and update the watchdog timeout value on hw-side only if the watchdog is already active.

Fixes 5e9c16e37608 ("watchdog: Add DA9063 PMIC watchdog driver.")

Signed-off-by Marco Felsch <[email protected]>

Reviewed-by Guenter Roeck <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

Signed-off-by Wim Van Sebroeck <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/watchdog/da9063_wdt.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

drivers/watchdog/da9063_wdt.c +15 -2

@@ -99,10 +99,23 @@ static int da9063_wdt_set_timeout(struct
 {
 	struct da9063 *da9063 = watchdog_get_drvdata(wdd);
 	unsigned int selector;
-	int ret;
+	int ret = 0;
 
 	selector = da9063_wdt_timeout_to_sel(timeout);
-	ret = _da9063_wdt_set_timeout(da9063, selector);
+
+	/*
+	 * There are two cases when a set_timeout() will be called:
+	 * 1. The watchdog is off and someone wants to set the timeout for the
+	 *    further use.
+	 * 2. The watchdog is already running and a new timeout value should be
+	 *    set.
+	 *
+	 * The watchdog can't store a timeout value not equal zero without
+	 * enabling the watchdog, so the timeout must be buffered by the driver.
+	 */
+	if (watchdog_active(wdd))
+		ret = _da9063_wdt_set_timeout(da9063, selector);
+
 	if (ret)
 		dev_err(da9063->dev, "Failed to set watchdog timeout (err = %d)\n",
 			ret);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #43 lore raw

PATCH 44/336 media: arch: sh: migor: Fix TW9910 PDN gpio

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jacopo Mondi <[email protected]>

[ Upstream commit 2b787b66bcb03ec3bd97e950464e0452f459e2ca ]

The TW9910 PDN gpio (power down) is listed as active high in the chip manual. It turns out it is actually active low as when set to physical level 0 it actually turns the video decoder power off.

Without this patch applied:
tw9910 0-0045: Product ID error 1f:2

With this patch applied:
tw9910 0-0045: tw9910 Product ID b:0

Fixes commit "186c446f4b840bd77b79d3dc951ca436cb8abe79"

Signed-off-by Jacopo Mondi <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/sh/boards/mach-migor/setup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/sh/boards/mach-migor/setup.c +1 -1

@@ -359,7 +359,7 @@ static struct gpiod_lookup_table ov7725_
 static struct gpiod_lookup_table tw9910_gpios = {
 	.dev_id		= "0-0045",
 	.table		= {
-		GPIO_LOOKUP("sh7722_pfc", GPIO_PTT2, "pdn", GPIO_ACTIVE_HIGH),
+		GPIO_LOOKUP("sh7722_pfc", GPIO_PTT2, "pdn", GPIO_ACTIVE_LOW),
 		GPIO_LOOKUP("sh7722_pfc", GPIO_PTT3, "rstb", GPIO_ACTIVE_LOW),
 	},
 };

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #44 lore raw

PATCH 45/336 printk: drop in_nmi check from printk_safe_flush_on_panic()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sergey Senozhatsky <[email protected]>

[ Upstream commit 554755be08fba31c74f66b82a485e5513205af84 ]

Drop the in_nmi() check from printk_safe_flush_on_panic() and attempt to re-init (IOW unlock) locked logbuf spinlock from panic CPU regardless of its context.

Otherwise, theoretically, we can deadlock on logbuf trying to flush per-CPU buffers:

a) Panic CPU is running in non-NMI context
b) Panic CPU sends out shutdown IPI via reboot vector
c) Panic CPU fails to stop all remote CPUs
d) Panic CPU sends out shutdown IPI via NMI vector One of the CPUs that we bring down via NMI vector can hold logbuf spin lock (theoretically).

Link http://lkml.kernel.org/r/[email protected] open here

To: Steven Rostedt <[email protected]>

Cc Peter Zijlstra <[email protected]>

Signed-off-by Sergey Senozhatsky <[email protected]>

Signed-off-by Petr Mladek <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/printk/printk_safe.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

kernel/printk/printk_safe.c +1 -1

@@ -281,7 +281,7 @@ void printk_safe_flush_on_panic(void)
 	 * Make sure that we could access the main ring buffer.
 	 * Do not risk a double release when more CPUs are up.
 	 */
-	if (in_nmi() && raw_spin_is_locked(&logbuf_lock)) {
+	if (raw_spin_is_locked(&logbuf_lock)) {
 		if (num_online_cpus() > 1)
 			return;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #45 lore raw

PATCH 46/336 bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64,i64}

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wang YanQing <[email protected]>

[ Upstream commit 68565a1af9f7012e6f2fe2bdd612f67d2d830c28 ]

The names for BPF_ALU64 | BPF_ARSH are emit_a32_arsh_*,
the names for BPF_ALU64 | BPF_LSH are emit_a32_lsh_*, but
the names for BPF_ALU64 | BPF_RSH are emit_a32_lsr_*.

For consistence reason, let's rename emit_a32_lsr_* to emit_a32_rsh_*.

This patch also corrects a wrong comment.

Fixes 39c13c204bb1 ("arm: eBPF JIT compiler")

Signed-off-by Wang YanQing <[email protected]>

Cc Shubham Bansal <[email protected]>

Cc linux-arm-kernel at lists.infradead.org

Cc linux at armlinux.org.uk

Signed-off-by Daniel Borkmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/net/bpf_jit_32.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

arch/arm/net/bpf_jit_32.c +5 -5

@@ -708,7 +708,7 @@ static inline void emit_a32_arsh_r64(con
 }
 
 /* dst = dst >> src */
-static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk,
+static inline void emit_a32_rsh_r64(const u8 dst[], const u8 src[], bool dstk,
 				     bool sstk, struct jit_ctx *ctx) {
 	const u8 *tmp = bpf2a32[TMP_REG_1];
 	const u8 *tmp2 = bpf2a32[TMP_REG_2];

@@ -724,7 +724,7 @@ static inline void emit_a32_lsr_r64(cons
 		emit(ARM_LDR_I(rm, ARM_SP, STACK_VAR(dst_hi)), ctx);
 	}
 
-	/* Do LSH operation */
+	/* Do RSH operation */
 	emit(ARM_RSB_I(ARM_IP, rt, 32), ctx);
 	emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx);
 	emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx);

@@ -774,7 +774,7 @@ static inline void emit_a32_lsh_i64(cons
 }
 
 /* dst = dst >> val */
-static inline void emit_a32_lsr_i64(const u8 dst[], bool dstk,
+static inline void emit_a32_rsh_i64(const u8 dst[], bool dstk,
 				    const u32 val, struct jit_ctx *ctx) {
 	const u8 *tmp = bpf2a32[TMP_REG_1];
 	const u8 *tmp2 = bpf2a32[TMP_REG_2];

@@ -1330,7 +1330,7 @@ static int build_insn(const struct bpf_i
 	case BPF_ALU64 | BPF_RSH | BPF_K:
 		if (unlikely(imm > 63))
 			return -EINVAL;
-		emit_a32_lsr_i64(dst, dstk, imm, ctx);
+		emit_a32_rsh_i64(dst, dstk, imm, ctx);
 		break;
 	/* dst = dst << src */
 	case BPF_ALU64 | BPF_LSH | BPF_X:

@@ -1338,7 +1338,7 @@ static int build_insn(const struct bpf_i
 		break;
 	/* dst = dst >> src */
 	case BPF_ALU64 | BPF_RSH | BPF_X:
-		emit_a32_lsr_r64(dst, src, dstk, sstk, ctx);
+		emit_a32_rsh_r64(dst, src, dstk, sstk, ctx);
 		break;
 	/* dst = dst >> src (signed) */
 	case BPF_ALU64 | BPF_ARSH | BPF_X:

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #46 lore raw

PATCH 47/336 ceph: fix alignment of rasize

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chengguang Xu <[email protected]>

[ Upstream commit c36ed50de2ad1649ce0369a4a6fc2cc11b20dfb7 ]

On currently logic:
when I specify rasize=0~1 then it will be 4096. when I specify rasize=2~4097 then it will be 8192.

Make it the same as rsize & wsize.

Signed-off-by Chengguang Xu <[email protected]>

Reviewed-by "Yan, Zheng" <[email protected]>

Signed-off-by Ilya Dryomov <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/ceph/super.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

fs/ceph/super.c +1 -1

@@ -268,7 +268,7 @@ static int parse_fsopt_token(char *c, vo
 	case Opt_rasize:
 		if (intval < 0)
 			return -EINVAL;
-		fsopt->rasize = ALIGN(intval + PAGE_SIZE - 1, PAGE_SIZE);
+		fsopt->rasize = ALIGN(intval, PAGE_SIZE);
 		break;
 	case Opt_caps_wanted_delay_min:
 		if (intval < 1)

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #47 lore raw

PATCH 48/336 ceph: fix use-after-free in ceph_statfs()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Luis Henriques <[email protected]>

[ Upstream commit 73fb0949cf246b212ff63d692a0ec88db954bb35 ]

KASAN found an UAF in ceph_statfs. This was a one-off bug but looking at the code it looks like the monmap access needs to be protected as it can be modified while we're accessing it. Fix this by protecting the access with the monc->mutex.

  BUG: KASAN: use-after-free in ceph_statfs+0x21d/0x2c0
  Read of size 8 at addr ffff88006844f2e0 by task trinity-c5/304

  CPU: 0 PID: 304 Comm: trinity-c5 Not tainted 4.17.0-rc6+ #172
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
  Call Trace:
   dump_stack+0xa5/0x11b
   ? show_regs_print_info+0x5/0x5
   ? kmsg_dump_rewind+0x118/0x118
   ? ceph_statfs+0x21d/0x2c0
   print_address_description+0x73/0x2b0
   ? ceph_statfs+0x21d/0x2c0
   kasan_report+0x243/0x360
   ceph_statfs+0x21d/0x2c0
   ? ceph_umount_begin+0x80/0x80
   ? kmem_cache_alloc+0xdf/0x1a0
   statfs_by_dentry+0x79/0xb0
   vfs_statfs+0x28/0x110
   user_statfs+0x8c/0xe0
   ? vfs_statfs+0x110/0x110
   ? __fdget_raw+0x10/0x10
   __se_sys_statfs+0x5d/0xa0
   ? user_statfs+0xe0/0xe0
   ? mutex_unlock+0x1d/0x40
   ? __x64_sys_statfs+0x20/0x30
   do_syscall_64+0xee/0x290
   ? syscall_return_slowpath+0x1c0/0x1c0
   ? page_fault+0x1e/0x30
   ? syscall_return_slowpath+0x13c/0x1c0
   ? prepare_exit_to_usermode+0xdb/0x140
   ? syscall_trace_enter+0x330/0x330
   ? __put_user_4+0x1c/0x30
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

  Allocated by task 130:
   __kmalloc+0x124/0x210
   ceph_monmap_decode+0x1c1/0x400
   dispatch+0x113/0xd20
   ceph_con_workfn+0xa7e/0x44e0
   process_one_work+0x5f0/0xa30
   worker_thread+0x184/0xa70
   kthread+0x1a0/0x1c0
   ret_from_fork+0x35/0x40

  Freed by task 130:
   kfree+0xb8/0x210
   dispatch+0x15a/0xd20
   ceph_con_workfn+0xa7e/0x44e0
   process_one_work+0x5f0/0xa30
   worker_thread+0x184/0xa70
   kthread+0x1a0/0x1c0
   ret_from_fork+0x35/0x40

Signed-off-by Luis Henriques <[email protected]>

Reviewed-by "Yan, Zheng" <[email protected]>

Signed-off-by Ilya Dryomov <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/ceph/super.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

fs/ceph/super.c +7 -4

@@ -45,7 +45,7 @@ static void ceph_put_super(struct super_
 static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
 	struct ceph_fs_client *fsc = ceph_inode_to_client(d_inode(dentry));
-	struct ceph_monmap *monmap = fsc->client->monc.monmap;
+	struct ceph_mon_client *monc = &fsc->client->monc;
 	struct ceph_statfs st;
 	u64 fsid;
 	int err;

@@ -58,7 +58,7 @@ static int ceph_statfs(struct dentry *de
 	}
 
 	dout("statfs\n");
-	err = ceph_monc_do_statfs(&fsc->client->monc, data_pool, &st);
+	err = ceph_monc_do_statfs(monc, data_pool, &st);
 	if (err < 0)
 		return err;

@@ -94,8 +94,11 @@ static int ceph_statfs(struct dentry *de
 	buf->f_namelen = NAME_MAX;
 
 	/* Must convert the fsid, for consistent values across arches */
-	fsid = le64_to_cpu(*(__le64 *)(&monmap->fsid)) ^
-	       le64_to_cpu(*((__le64 *)&monmap->fsid + 1));
+	mutex_lock(&monc->mutex);
+	fsid = le64_to_cpu(*(__le64 *)(&monc->monmap->fsid)) ^
+	       le64_to_cpu(*((__le64 *)&monc->monmap->fsid + 1));
+	mutex_unlock(&monc->mutex);
+
 	buf->f_fsid.val[0] = fsid & 0xffffffff;
 	buf->f_fsid.val[1] = fsid >> 32;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:34 UTC #48 lore raw

PATCH 49/336 e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benjamin Poirier <[email protected]>

[ Upstream commit fff200caf6f9179dd9a7fc67acd659e614c3f72f ]

There have been multiple reports of crashes that look like
kernel: RIP: 0010:[<ffffffff8110303f>] timecounter_read+0xf/0x50 [...]

kernel: Call Trace:
kernel:  [<ffffffffa0806b0f>] e1000e_phc_gettime+0x2f/0x60 [e1000e]
kernel:  [<ffffffffa0806c5d>] e1000e_systim_overflow_work+0x1d/0x80 [e1000e]
kernel:  [<ffffffff810992c5>] process_one_work+0x155/0x440
kernel:  [<ffffffff81099e16>] worker_thread+0x116/0x4b0
kernel:  [<ffffffff8109f422>] kthread+0xd2/0xf0
kernel:  [<ffffffff8163184f>] ret_from_fork+0x3f/0x70

These can be traced back to the fact that e1000e_systim_reset() skips the timecounter_init() call if e1000e_get_base_timinca() returns -EINVAL, which leads to a null deref in timecounter_read().

Commit 83129b37ef35 ("e1000e: fix systim issues", v4.2-rc1) reworked e1000e_get_base_timinca() in such a way that it can return -EINVAL for e1000_pch_spt if the SYSCFI bit is not set in TSYNCRXCTL.

Some experimentation has shown that on I219 (e1000_pch_spt, "MAC: 12") adapters, the E1000_TSYNCRXCTL_SYSCFI flag is unstable; TSYNCRXCTL reads sometimes don't have the SYSCFI bit set. Retrying the read shortly after finds the bit to be set. This was observed at boot (probe) but also link up and link down.

Moreover, the phc (PTP Hardware Clock) seems to operate normally even after reads where SYSCFI=0. Therefore, remove this register read and unconditionally set the clock parameters.

Reported-by Achim Mildenberger <[email protected]>

Message-Id: <20180425065243.g5mqewg5irkwgwgv@f2>
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1075876

Fixes 83129b37ef35 ("e1000e: fix systim issues")

Signed-off-by Benjamin Poirier <[email protected]>

Tested-by Aaron Brown <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/intel/e1000e/netdev.c |   15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

drivers/net/ethernet/intel/e1000e/netdev.c +6 -9

@@ -3546,15 +3546,12 @@ s32 e1000e_get_base_timinca(struct e1000
 		}
 		break;
 	case e1000_pch_spt:
-		if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) {
-			/* Stable 24MHz frequency */
-			incperiod = INCPERIOD_24MHZ;
-			incvalue = INCVALUE_24MHZ;
-			shift = INCVALUE_SHIFT_24MHZ;
-			adapter->cc.shift = shift;
-			break;
-		}
-		return -EINVAL;
+		/* Stable 24MHz frequency */
+		incperiod = INCPERIOD_24MHZ;
+		incvalue = INCVALUE_24MHZ;
+		shift = INCVALUE_SHIFT_24MHZ;
+		adapter->cc.shift = shift;
+		break;
 	case e1000_pch_cnp:
 		if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) {
 			/* Stable 24MHz frequency */

Greg Kroah-Hartman

author maintainer

2018-08-01 17:37 UTC #49 lore raw

PATCH 50/336 infiniband: fix a possible use-after-free bug

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cong Wang <[email protected]>

[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ]

ucma_process_join() will free the new allocated "mc" struct, if there is any error after that, especially the copy_to_user().

But in parallel, ucma_leave_multicast() could find this "mc" through idr_find() before ucma_process_join() frees it, since it is already published.

So "mc" could be used in ucma_leave_multicast() after it is been allocated and freed in ucma_process_join(), since we don't refcnt it.

Fix this by separating "publish" from ID allocation, so that we can get an ID first and publish it later after copy_to_user().

Fixes c8f6a362bf3e ("RDMA/cma: Add multicast communication support")

Reported-by Noam Rathaus <[email protected]>

Signed-off-by Cong Wang <[email protected]>

Signed-off-by Jason Gunthorpe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/core/ucma.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

drivers/infiniband/core/ucma.c +5 -1

@@ -235,7 +235,7 @@ static struct ucma_multicast* ucma_alloc
 		return NULL;
 
 	mutex_lock(&mut);
-	mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
+	mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL);
 	mutex_unlock(&mut);
 	if (mc->id < 0)
 		goto error;

@@ -1421,6 +1421,10 @@ static ssize_t ucma_process_join(struct
 		goto err3;
 	}
 
+	mutex_lock(&mut);
+	idr_replace(&multicast_idr, mc, mc->id);
+	mutex_unlock(&mut);
+
 	mutex_unlock(&file->mut);
 	ucma_put_ctx(ctx);
 	return 0;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #50 lore raw

PATCH 51/336 powerpc/lib: Adjust .balign inside string functions for PPC32

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <[email protected]>

[ Upstream commit 1128bb7813a896bd608fb622eee3c26aaf33b473 ]

commit 87a156fb18fe1 ("Align hot loops of some string functions") degraded the performance of string functions by adding useless nops

A simple benchmark on an 8xx calling 100000x a memchr() that matches the first byte runs in 41668 TB ticks before this patch and in 35986 TB ticks after this patch. So this gives an improvement of approx 10%

Another benchmark doing the same with a memchr() matching the 128th byte runs in 1011365 TB ticks before this patch and 1005682 TB ticks after this patch, so regardless on the number of loops, removing those useless nops improves the test by 5683 TB ticks.

Fixes 87a156fb18fe1 ("Align hot loops of some string functions")

Signed-off-by Christophe Leroy <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/include/asm/cache.h |    3 +++
 arch/powerpc/lib/string.S        |    7 ++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

arch/powerpc/include/asm/cache.h +3 -0

@@ -9,11 +9,14 @@
 #if defined(CONFIG_PPC_8xx) || defined(CONFIG_403GCX)
 #define L1_CACHE_SHIFT		4
 #define MAX_COPY_PREFETCH	1
+#define IFETCH_ALIGN_SHIFT	2
 #elif defined(CONFIG_PPC_E500MC)
 #define L1_CACHE_SHIFT		6
 #define MAX_COPY_PREFETCH	4
+#define IFETCH_ALIGN_SHIFT	3
 #elif defined(CONFIG_PPC32)
 #define MAX_COPY_PREFETCH	4
+#define IFETCH_ALIGN_SHIFT	3	/* 603 fetches 2 insn at a time */
 #if defined(CONFIG_PPC_47x)
 #define L1_CACHE_SHIFT		7
 #else

arch/powerpc/lib/string.S +4 -3

@@ -12,6 +12,7 @@
 #include <asm/errno.h>
 #include <asm/ppc_asm.h>
 #include <asm/export.h>
+#include <asm/cache.h>
 
 	.text

@@ -23,7 +24,7 @@ _GLOBAL(strncpy)
 	mtctr	r5
 	addi	r6,r3,-1
 	addi	r4,r4,-1
-	.balign 16
+	.balign IFETCH_ALIGN_BYTES
 1:	lbzu	r0,1(r4)
 	cmpwi	0,r0,0
 	stbu	r0,1(r6)

@@ -43,7 +44,7 @@ _GLOBAL(strncmp)
 	mtctr	r5
 	addi	r5,r3,-1
 	addi	r4,r4,-1
-	.balign 16
+	.balign IFETCH_ALIGN_BYTES
 1:	lbzu	r3,1(r5)
 	cmpwi	1,r3,0
 	lbzu	r0,1(r4)

@@ -77,7 +78,7 @@ _GLOBAL(memchr)
 	beq-	2f
 	mtctr	r5
 	addi	r3,r3,-1
-	.balign 16
+	.balign IFETCH_ALIGN_BYTES
 1:	lbzu	r0,1(r3)
 	cmpw	0,r0,r4
 	bdnzf	2,1b

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #51 lore raw

PATCH 52/336 powerpc/64s: Add barrier_nospec

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michal Suchanek <[email protected]>

[ Upstream commit a6b3964ad71a61bb7c61d80a60bea7d42187b2eb ]

A no-op form of ori (or immediate of 0 into r31 and the result stored in r31) has been re-tasked as a speculation barrier. The instruction only acts as a barrier on newer machines with appropriate firmware support. On older CPUs it remains a harmless no-op.

Implement barrier_nospec using this instruction.

mpe: The semantics of the instruction are believed to be that it prevents execution of subsequent instructions until preceding branches have been fully resolved and are no longer executing speculatively. There is no further documentation available at this time.

Signed-off-by Michal Suchanek <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/include/asm/barrier.h |   15 +++++++++++++++
 1 file changed, 15 insertions(+)

arch/powerpc/include/asm/barrier.h +15 -0

@@ -76,6 +76,21 @@ do {									\
 	___p1;								\
 })
 
+#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * Prevent execution of subsequent instructions until preceding branches have
+ * been fully resolved and are no longer executing speculatively.
+ */
+#define barrier_nospec_asm ori 31,31,0
+
+// This also acts as a compiler barrier due to the memory clobber.
+#define barrier_nospec() asm (stringify_in_c(barrier_nospec_asm) ::: "memory")
+
+#else /* !CONFIG_PPC_BOOK3S_64 */
+#define barrier_nospec_asm
+#define barrier_nospec()
+#endif
+
 #include <asm-generic/barrier.h>
 
 #endif /* _ASM_POWERPC_BARRIER_H */

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #52 lore raw

PATCH 53/336 powerpc/eeh: Fix use-after-release of EEH driver

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sam Bobroff <[email protected]>

[ Upstream commit 46d4be41b987a6b2d25a2ebdd94cafb44e21d6c5 ]

Correct two cases where eeh_pcid_get() is used to reference the driver's module but the reference is dropped before the driver pointer is used.

In eeh_rmv_device() also refactor a little so that only two calls to eeh_pcid_put() are needed, rather than three and the reference isn't taken at all if it wasn't needed.

Signed-off-by Sam Bobroff <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/kernel/eeh_driver.c |   28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

arch/powerpc/kernel/eeh_driver.c +16 ~~-12~~

@@ -458,9 +458,11 @@ static void *eeh_add_virt_device(void *d
 
 	driver = eeh_pcid_get(dev);
 	if (driver) {
-		eeh_pcid_put(dev);
-		if (driver->err_handler)
+		if (driver->err_handler) {
+			eeh_pcid_put(dev);
 			return NULL;
+		}
+		eeh_pcid_put(dev);
 	}
 
 #ifdef CONFIG_PCI_IOV

@@ -497,17 +499,19 @@ static void *eeh_rmv_device(void *data,
 	if (eeh_dev_removed(edev))
 		return NULL;
 
-	driver = eeh_pcid_get(dev);
-	if (driver) {
-		eeh_pcid_put(dev);
-		if (removed &&
-		    eeh_pe_passed(edev->pe))
-			return NULL;
-		if (removed &&
-		    driver->err_handler &&
-		    driver->err_handler->error_detected &&
-		    driver->err_handler->slot_reset)
+	if (removed) {
+		if (eeh_pe_passed(edev->pe))
 			return NULL;
+		driver = eeh_pcid_get(dev);
+		if (driver) {
+			if (driver->err_handler &&
+			    driver->err_handler->error_detected &&
+			    driver->err_handler->slot_reset) {
+				eeh_pcid_put(dev);
+				return NULL;
+			}
+			eeh_pcid_put(dev);
+		}
 	}
 
 	/* Remove it from PCI subsystem */

Greg Kroah-Hartman

author maintainer

2018-08-01 17:34 UTC #53 lore raw

PATCH 54/336 hvc_opal: dont set tb_ticks_per_usec in udbg_init_opal_common()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stewart Smith <[email protected]>

[ Upstream commit 447808bf500a7cc92173266a59f8a494e132b122 ]

time_init() will set up tb_ticks_per_usec based on reality. time_init() is called *after* udbg_init_opal_common() during boot.

from arch/powerpc/kernel/time.c:
unsigned long tb_ticks_per_usec = 100; /* sane default */

Currently, all powernv systems have a timebase frequency of 512mhz (512000000/1000000 == 0x200) - although there's nothing written down anywhere that I can find saying that we couldn't make that different based on the requirements in the ISA.

So, we've been (accidentally) thwacking the (currently) correct (for powernv at least) value for tb_ticks_per_usec earlier than we otherwise would have.

The "sane default" seems to be adequate for our purposes between udbg_init_opal_common() and time_init() being called, and if it isn't, then we should probably be setting it somewhere that isn't hvc_opal.c!

Signed-off-by Stewart Smith <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/tty/hvc/hvc_opal.c |    1 -
 1 file changed, 1 deletion(-)

drivers/tty/hvc/hvc_opal.c +0 -1

@@ -318,7 +318,6 @@ static void udbg_init_opal_common(void)
 	udbg_putc = udbg_opal_putc;
 	udbg_getc = udbg_opal_getc;
 	udbg_getc_poll = udbg_opal_getc_poll;
-	tb_ticks_per_usec = 0x200; /* Make udelay not suck */
 }
 
 void __init hvc_opal_init_early(void)

Greg Kroah-Hartman

author maintainer

2018-08-01 17:36 UTC #54 lore raw

PATCH 55/336 powerpc/64s: Fix compiler store ordering to SLB shadow area

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nicholas Piggin <[email protected]>

[ Upstream commit 926bc2f100c24d4842b3064b5af44ae964c1d81c ]

The stores to update the SLB shadow area must be made as they appear in the C code, so that the hypervisor does not see an entry with mismatched vsid and esid. Use WRITE_ONCE for this.

GCC has been observed to elide the first store to esid in the update, which means that if the hypervisor interrupts the guest after storing to vsid, it could see an entry with old esid and new vsid, which may possibly result in memory corruption.

Signed-off-by Nicholas Piggin <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/mm/slb.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

arch/powerpc/mm/slb.c +4 -4

@@ -63,14 +63,14 @@ static inline void slb_shadow_update(uns
 	 * updating it.  No write barriers are needed here, provided
 	 * we only update the current CPU's SLB shadow buffer.
 	 */
-	p->save_area[index].esid = 0;
-	p->save_area[index].vsid = cpu_to_be64(mk_vsid_data(ea, ssize, flags));
-	p->save_area[index].esid = cpu_to_be64(mk_esid_data(ea, ssize, index));
+	WRITE_ONCE(p->save_area[index].esid, 0);
+	WRITE_ONCE(p->save_area[index].vsid, cpu_to_be64(mk_vsid_data(ea, ssize, flags)));
+	WRITE_ONCE(p->save_area[index].esid, cpu_to_be64(mk_esid_data(ea, ssize, index)));
 }
 
 static inline void slb_shadow_clear(enum slb_index index)
 {
-	get_slb_shadow()->save_area[index].esid = 0;
+	WRITE_ONCE(get_slb_shadow()->save_area[index].esid, 0);
 }
 
 static inline void create_shadowed_slbe(unsigned long ea, int ssize,

Greg Kroah-Hartman

author maintainer

2018-08-01 17:37 UTC #55 lore raw

PATCH 56/336 clk-si544: Properly round requested frequency to nearest match

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mike Looijmans <[email protected]>

[ Upstream commit 4d3f36c5e9ca0f947eed71660239c529c501141a ]

The si544 driver had a rounding problem that using the result of clk_round_rate may set the clock to yet another rate, for example:
clk_round_rate(195000000) = 194999999
clk_round_rate(194999999) = 194999998

Clients would expect that after clk_set_rate(clk, freq2=clk_round_rate(clk, freq)) the chip will be running at exactly freq2.

The problem was in the calculation of the feedback divider, it was always rounded down instead of to the nearest possible VCO value.

After this change, the following holds true for any supported frequency:
actual_freq = clk_round_rate(clk, freq);
clk_set_rate(clk, actual_freq);
clk_round_rate(clk, actual_freq) == actual_freq && clk_get_rate(clk) == actual_freq

Signed-off-by Mike Looijmans <[email protected]>

Fixes 953cc3e81170 ("clk: Add driver for the si544 clock generator chip")

Signed-off-by Stephen Boyd <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/clk/clk-si544.c |    1 +
 1 file changed, 1 insertion(+)

drivers/clk/clk-si544.c +1 -0

@@ -207,6 +207,7 @@ static int si544_calc_muldiv(struct clk_
 
 	/* And the fractional bits using the remainder */
 	vco = (u64)tmp << 32;
+	vco += FXO / 2; /* Round to nearest multiple */
 	do_div(vco, FXO);
 	settings->fb_div_frac = vco;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #56 lore raw

PATCH 57/336 clk: ingenic: jz4770: Modify C1CLK clock to disable CPU clock stop on idle

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul Cercueil <[email protected]>

[ Upstream commit 45ba63a29fd9b8a461110185e3abc5b4c90b806a ]

When the main processor goes idle, by default its clock is stopped. However, this also stops the clock of the co-processor.

Here, if the C1CLK clock is enabled, we disable this functionality.

Signed-off-by Paul Cercueil <[email protected]>

Signed-off-by Stephen Boyd <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/clk/ingenic/jz4770-cgu.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/clk/ingenic/jz4770-cgu.c +2 -1

@@ -194,9 +194,10 @@ static const struct ingenic_cgu_clk_info
 		.div = { CGU_REG_CPCCR, 16, 1, 4, 22, -1, -1 },
 	},
 	[JZ4770_CLK_C1CLK] = {
-		"c1clk", CGU_CLK_DIV,
+		"c1clk", CGU_CLK_DIV | CGU_CLK_GATE,
 		.parents = { JZ4770_CLK_PLL0, },
 		.div = { CGU_REG_CPCCR, 12, 1, 4, 22, -1, -1 },
+		.gate = { CGU_REG_OPCR, 31, true }, // disable CCLK stop on idle
 	},
 	[JZ4770_CLK_PCLK] = {
 		"pclk", CGU_CLK_DIV,

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #57 lore raw

PATCH 58/336 net: hns3: Fix for phy not link up problem after resetting

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yunsheng Lin <[email protected]>

[ Upstream commit 9617f66867b09b326cc932416be2431c5b91c8d8 ]

When resetting, phy_state_machine may be accessing the phy through firmware if the phy is not stopped or disconnected, which will cause firemware timeout problem because the firmware is busy processing the reset request.

This patch fixes it by disabling the phy when resetting.

Fixes b940aeae0ed6 ("net: hns3: never send command queue message to IMP when reset")

Signed-off-by Peng Li <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +3 -4

@@ -3787,9 +3787,6 @@ static int hclge_ae_start(struct hnae3_h
 	/* reset tqp stats */
 	hclge_reset_tqp_stats(handle);
 
-	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
-		return 0;
-
 	ret = hclge_mac_start_phy(hdev);
 	if (ret)
 		return ret;

@@ -3806,8 +3803,10 @@ static void hclge_ae_stop(struct hnae3_h
 	del_timer_sync(&hdev->service_timer);
 	cancel_work_sync(&hdev->service_task);
 
-	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
+	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) {
+		hclge_mac_stop_phy(hdev);
 		return;
+	}
 
 	for (i = 0; i < vport->alloc_tqps; i++)
 		hclge_tqp_enable(hdev, i, 0, false);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #58 lore raw

PATCH 59/336 net: hns3: Fix for service_task not running problem after resetting

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yunsheng Lin <[email protected]>

[ Upstream commit f5be79673fc4c925708c99ec37d77e0a2c3cd30b ]

When hclge_ae_stop is called during resetting, it will cancel the service_task by calling cancel_work_sync, which may cause the service_task to exit without clearing HCLGE_STATE_SERVICE_SCHED bit. If this happens, the service_task will never run again.

This patch fixes this problem by clearing it after calling cancel_work_sync in hclge_ae_stop.

Fixes 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")

Signed-off-by Peng Li <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c   |    1 +
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c |    1 +
 2 files changed, 2 insertions(+)

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -0

@@ -3802,6 +3802,7 @@ static void hclge_ae_stop(struct hnae3_h
 
 	del_timer_sync(&hdev->service_timer);
 	cancel_work_sync(&hdev->service_task);
+	clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state);
 
 	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) {
 		hclge_mac_stop_phy(hdev);

drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +1 -0

@@ -1323,6 +1323,7 @@ static void hclgevf_ae_stop(struct hnae3
 	hclgevf_reset_tqp_stats(handle);
 	del_timer_sync(&hdev->service_timer);
 	cancel_work_sync(&hdev->service_task);
+	clear_bit(HCLGEVF_STATE_SERVICE_SCHED, &hdev->state);
 	hclgevf_update_link_status(hdev, 0);
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #59 lore raw

PATCH 60/336 RDMA/mad: Convert BUG_ONs to error flows

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Leon Romanovsky <[email protected]>

[ Upstream commit 2468b82d69e3a53d024f28d79ba0fdb8bf43dfbf ]

Let's perform checks in-place instead of BUG_ONs.

Signed-off-by Leon Romanovsky <[email protected]>

Signed-off-by Doug Ledford <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/core/mad.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

drivers/infiniband/core/mad.c +7 -4

@@ -1557,7 +1557,8 @@ static int add_oui_reg_req(struct ib_mad
 			    mad_reg_req->oui, 3)) {
 			method = &(*vendor_table)->vendor_class[
 						vclass]->method_table[i];
-			BUG_ON(!*method);
+			if (!*method)
+				goto error3;
 			goto check_in_use;
 		}
 	}

@@ -1567,10 +1568,12 @@ static int add_oui_reg_req(struct ib_mad
 				vclass]->oui[i])) {
 			method = &(*vendor_table)->vendor_class[
 				vclass]->method_table[i];
-			BUG_ON(*method);
 			/* Allocate method table for this OUI */
-			if ((ret = allocate_method_table(method)))
-				goto error3;
+			if (!*method) {
+				ret = allocate_method_table(method);
+				if (ret)
+					goto error3;
+			}
 			memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
 			       mad_reg_req->oui, 3);
 			goto check_in_use;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #60 lore raw

PATCH 64/336 netfilter: nf_tables: check msg_type before nft_trans_set(trans)

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexey Kodanev <[email protected]>

[ Upstream commit 9c7f96fd77b0dbe1fe7ed1f9c462c45dc48a1076 ]

The patch moves the "trans->msg_type == NFT_MSG_NEWSET" check before using nft_trans_set(trans). Otherwise we can get out of bounds read.

For example, KASAN reported the one when running 0001_cache_handling_0 nft test. In this case "trans->msg_type" was NFT_MSG_NEWTABLE:

[75517.177808] BUG: KASAN: slab-out-of-bounds in nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75517.279094] Read of size 8 at addr ffff881bdb643fc8 by task nft/7356
...
[75517.375605] CPU: 26 PID: 7356 Comm: nft Tainted: G  E   4.17.0-rc7.1.x86_64 #1
[75517.489587] Hardware name: Oracle Corporation SUN SERVER X4-2
[75517.618129] Call Trace:
[75517.648821]  dump_stack+0xd1/0x13b
[75517.691040]  ? show_regs_print_info+0x5/0x5
[75517.742519]  ? kmsg_dump_rewind_nolock+0xf5/0xf5
[75517.799300]  ? lock_acquire+0x143/0x310
[75517.846738]  print_address_description+0x85/0x3a0
[75517.904547]  kasan_report+0x18d/0x4b0
[75517.949892]  ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75518.019153]  ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75518.088420]  ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75518.157689]  nft_set_lookup_global+0x22f/0x270 [nf_tables]
[75518.224869]  nf_tables_newsetelem+0x1a5/0x5d0 [nf_tables]
[75518.291024]  ? nft_add_set_elem+0x2280/0x2280 [nf_tables]
[75518.357154]  ? nla_parse+0x1a5/0x300
[75518.401455]  ? kasan_kmalloc+0xa6/0xd0
[75518.447842]  nfnetlink_rcv+0xc43/0x1bdf [nfnetlink]
[75518.507743]  ? nfnetlink_rcv+0x7a5/0x1bdf [nfnetlink]
[75518.569745]  ? nfnl_err_reset+0x3c0/0x3c0 [nfnetlink]
[75518.631711]  ? lock_acquire+0x143/0x310
[75518.679133]  ? netlink_deliver_tap+0x9b/0x1070
[75518.733840]  ? kasan_unpoison_shadow+0x31/0x40
[75518.788542]  netlink_unicast+0x45d/0x680
[75518.837111]  ? __isolate_free_page+0x890/0x890
[75518.891913]  ? netlink_attachskb+0x6b0/0x6b0
[75518.944542]  netlink_sendmsg+0x6fa/0xd30
[75518.993107]  ? netlink_unicast+0x680/0x680
[75519.043758]  ? netlink_unicast+0x680/0x680
[75519.094402]  sock_sendmsg+0xd9/0x160
[75519.138810]  ___sys_sendmsg+0x64d/0x980
[75519.186234]  ? copy_msghdr_from_user+0x350/0x350
[75519.243118]  ? lock_downgrade+0x650/0x650
[75519.292738]  ? do_raw_spin_unlock+0x5d/0x250
[75519.345456]  ? _raw_spin_unlock+0x24/0x30
[75519.395065]  ? __handle_mm_fault+0xbde/0x3410
[75519.448830]  ? sock_setsockopt+0x3d2/0x1940
[75519.500516]  ? __lock_acquire.isra.25+0xdc/0x19d0
[75519.558448]  ? lock_downgrade+0x650/0x650
[75519.608057]  ? __audit_syscall_entry+0x317/0x720
[75519.664960]  ? __fget_light+0x58/0x250
[75519.711325]  ? __sys_sendmsg+0xde/0x170
[75519.758850]  __sys_sendmsg+0xde/0x170
[75519.804193]  ? __ia32_sys_shutdown+0x90/0x90
[75519.856725]  ? syscall_trace_enter+0x897/0x10e0
[75519.912354]  ? trace_event_raw_event_sys_enter+0x920/0x920
[75519.979432]  ? __audit_syscall_entry+0x720/0x720
[75520.036118]  do_syscall_64+0xa3/0x3d0
[75520.081248]  ? prepare_exit_to_usermode+0x47/0x1d0
[75520.139904]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[75520.201680] RIP: 0033:0x7fc153320ba0
[75520.245772] RSP: 002b:00007ffe294c3638 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[75520.337708] RAX: ffffffffffffffda RBX: 00007ffe294c4820 RCX: 00007fc153320ba0
[75520.424547] RDX: 0000000000000000 RSI: 00007ffe294c46b0 RDI: 0000000000000003
[75520.511386] RBP: 00007ffe294c47b0 R08: 0000000000000004 R09: 0000000002114090
[75520.598225] R10: 00007ffe294c30a0 R11: 0000000000000246 R12: 00007ffe294c3660
[75520.684961] R13: 0000000000000001 R14: 00007ffe294c3650 R15: 0000000000000001

[75520.790946] Allocated by task 7356:
[75520.833994]  kasan_kmalloc+0xa6/0xd0
[75520.878088]  __kmalloc+0x189/0x450
[75520.920107]  nft_trans_alloc_gfp+0x20/0x190 [nf_tables]
[75520.983961]  nf_tables_newtable+0xcd0/0x1bd0 [nf_tables]
[75521.048857]  nfnetlink_rcv+0xc43/0x1bdf [nfnetlink]
[75521.108655]  netlink_unicast+0x45d/0x680
[75521.157013]  netlink_sendmsg+0x6fa/0xd30
[75521.205271]  sock_sendmsg+0xd9/0x160
[75521.249365]  ___sys_sendmsg+0x64d/0x980
[75521.296686]  __sys_sendmsg+0xde/0x170
[75521.341822]  do_syscall_64+0xa3/0x3d0
[75521.386957]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

[75521.467867] Freed by task 23454:
[75521.507804]  __kasan_slab_free+0x132/0x180
[75521.558137]  kfree+0x14d/0x4d0
[75521.596005]  free_rt_sched_group+0x153/0x280
[75521.648410]  sched_autogroup_create_attach+0x19a/0x520
[75521.711330]  ksys_setsid+0x2ba/0x400
[75521.755529]  __ia32_sys_setsid+0xa/0x10
[75521.802850]  do_syscall_64+0xa3/0x3d0
[75521.848090]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

[75521.929000] The buggy address belongs to the object at ffff881bdb643f80
 which belongs to the cache kmalloc-96 of size 96
[75522.079797] The buggy address is located 72 bytes inside of
 96-byte region [ffff881bdb643f80, ffff881bdb643fe0)
[75522.221234] The buggy address belongs to the page:
[75522.280100] page:ffffea006f6d90c0 count:1 mapcount:0 mapping:0000000000000000 index:0x0
[75522.377443] flags: 0x2fffff80000100(slab)
[75522.426956] raw: 002fffff80000100 0000000000000000 0000000000000000 0000000180200020
[75522.521275] raw: ffffea006e6fafc0 0000000c0000000c ffff881bf180f400 0000000000000000
[75522.615601] page dumped because: kasan: bad access detected

Fixes 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets")

Signed-off-by Alexey Kodanev <[email protected]>

Acked-by Florian Westphal <[email protected]>

Signed-off-by Pablo Neira Ayuso <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/netfilter/nf_tables_api.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

net/netfilter/nf_tables_api.c +6 -5

@@ -2728,12 +2728,13 @@ static struct nft_set *nf_tables_set_loo
 	u32 id = ntohl(nla_get_be32(nla));
 
 	list_for_each_entry(trans, &net->nft.commit_list, list) {
-		struct nft_set *set = nft_trans_set(trans);
+		if (trans->msg_type == NFT_MSG_NEWSET) {
+			struct nft_set *set = nft_trans_set(trans);
 
-		if (trans->msg_type == NFT_MSG_NEWSET &&
-		    id == nft_trans_set_id(trans) &&
-		    nft_active_genmask(set, genmask))
-			return set;
+			if (id == nft_trans_set_id(trans) &&
+			    nft_active_genmask(set, genmask))
+				return set;
+		}
 	}
 	return ERR_PTR(-ENOENT);
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 17:38 UTC #61 lore raw

PATCH 65/336 pnfs: Dont release the sequence slot until weve processed layoutget on open

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <[email protected]>

[ Upstream commit ae55e59da0e401893b3c52b575fc18a00623d0a1 ]

If the server recalls the layout that was just handed out, we risk hitting a race as described in RFC5661 Section 2.10.6.3 unless we ensure that we release the sequence slot after processing the LAYOUTGET operation that was sent as part of the OPEN compound.

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/nfs4proc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

fs/nfs/nfs4proc.c +2 -1

@@ -2807,7 +2807,7 @@ static int _nfs4_open_and_get_state(stru
 	if (ret != 0)
 		goto out;
 
-	state = nfs4_opendata_to_nfs4_state(opendata);
+	state = _nfs4_opendata_to_nfs4_state(opendata);
 	ret = PTR_ERR(state);
 	if (IS_ERR(state))
 		goto out;

@@ -2843,6 +2843,7 @@ static int _nfs4_open_and_get_state(stru
 			nfs4_schedule_stateid_recovery(server, state);
 	}
 out:
+	nfs4_sequence_free_slot(&opendata->o_res.seq_res);
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #62 lore raw

PATCH 66/336 NFS: Fix up nfs_post_op_update_inode() to force ctime updates

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <[email protected]>

[ Upstream commit d554168f87a55b35b7c59921a0dc45b6ba17d08d ]

We do not want to ignore ctime updates that originate from functions such as link().

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/nfs/inode.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

fs/nfs/inode.c +2 -1

@@ -1629,7 +1629,8 @@ int nfs_post_op_update_inode(struct inod
 	nfs_fattr_set_barrier(fattr);
 	status = nfs_post_op_update_inode_locked(inode, fattr,
 			NFS_INO_INVALID_CHANGE
-			| NFS_INO_INVALID_CTIME);
+			| NFS_INO_INVALID_CTIME
+			| NFS_INO_REVAL_FORCED);
 	spin_unlock(&inode->i_lock);
 
 	return status;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #63 lore raw

PATCH 67/336 disable loading f2fs module on PAGE_SIZE > 4KB

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anatoly Pugachev <[email protected]>

[ Upstream commit 4071e67cffcc5c2a007116a02437471351f550eb ]

The following patch disables loading of f2fs module on architectures which have PAGE_SIZE > 4096 , since it is impossible to mount f2fs on such architectures , log messages are:

mount: /mnt: wrong fs type, bad option, bad superblock on /dev/vdiskb1, missing codepage or helper program, or other error. /dev/vdiskb1: F2FS filesystem, UUID=1d8b9ca4-2389-4910-af3b-10998969f09c, volume name ""

May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid
page_cache_size (8192), supports only 4KB
May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS
filesystem in 1th superblock
May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid
page_cache_size (8192), supports only 4KB
May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS
filesystem in 2th superblock
May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid

page_cache_size (8192), supports only 4KB

which was introduced by git commit 5c9b469295fb6b10d98923eab5e79c4edb80ed20

tested on git kernel 4.17.0-rc6-00309-gec30dcf7f425

with patch applied:

modprobe: ERROR: could not insert 'f2fs': Invalid argument

May 28 01:40:28 v215 kernel: F2FS not supported on PAGE_SIZE(8192) != 4096

Signed-off-by Anatoly Pugachev <[email protected]>

Reviewed-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/super.c |    6 ++++++
 1 file changed, 6 insertions(+)

fs/f2fs/super.c +6 -0

@@ -3063,6 +3063,12 @@ static int __init init_f2fs_fs(void)
 {
 	int err;
 
+	if (PAGE_SIZE != F2FS_BLKSIZE) {
+		printk("F2FS not supported on PAGE_SIZE(%lu) != %d\n",
+				PAGE_SIZE, F2FS_BLKSIZE);
+		return -EINVAL;
+	}
+
 	f2fs_build_trace_ios();
 
 	err = init_inodecache();

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #64 lore raw

PATCH 68/336 f2fs: fix error path of move_data_page

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email protected]>

[ Upstream commit 14a28559f43ac7c0b98dd1b0e73ec9ec8ab4fc45 ]

This patch fixes error path of move_data_page:
- clear cold data flag if it fails to write page.
- redirty page for non-ENOMEM case.

Signed-off-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/gc.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

fs/f2fs/gc.c +8 -3

@@ -778,9 +778,14 @@ retry:
 		set_cold_data(page);
 
 		err = do_write_data_page(&fio);
-		if (err == -ENOMEM && is_dirty) {
-			congestion_wait(BLK_RW_ASYNC, HZ/50);
-			goto retry;
+		if (err) {
+			clear_cold_data(page);
+			if (err == -ENOMEM) {
+				congestion_wait(BLK_RW_ASYNC, HZ/50);
+				goto retry;
+			}
+			if (is_dirty)
+				set_page_dirty(page);
 		}
 	}
 out:

Greg Kroah-Hartman

author maintainer

2018-08-01 17:37 UTC #65 lore raw

PATCH 69/336 f2fs: dont drop dentry pages after fs shutdown

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email protected]>

[ Upstream commit 1174abfd8309f4c47d454734233aa3b694560e10 ]

As description in commit "f2fs: don't drop any page on f2fs_cp_error() case":

"We still provide readdir() after shtudown, so we should keep pages to avoid additional IOs."

In order to provider lastest directory structure, let's keep dentry pages in cache after fs shutdown.

Signed-off-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/data.c |    6 ++++++
 1 file changed, 6 insertions(+)

fs/f2fs/data.c +6 -0

@@ -1745,6 +1745,12 @@ static int __write_data_page(struct page
 	/* we should bypass data pages to proceed the kworkder jobs */
 	if (unlikely(f2fs_cp_error(sbi))) {
 		mapping_set_error(page->mapping, -EIO);
+		/*
+		 * don't drop any dirty dentry pages for keeping lastest
+		 * directory structure.
+		 */
+		if (S_ISDIR(inode->i_mode))
+			goto redirty_out;
 		goto out;
 	}

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #66 lore raw

PATCH 70/336 f2fs: fix to dont trigger writeback during recovery

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email protected]>

[ Upstream commit 64c74a7ab505ea40d1b3e5d02735ecab08ae1b14 ]

- f2fs_fill_super
- recover_fsync_data
- recover_data
- del_fsync_inode
- iput
- iput_final
- write_inode_now
- f2fs_write_inode
- f2fs_balance_fs
- f2fs_balance_fs_bg
- sync_dirty_inodes

With data_flush mount option, during recovery, in order to avoid entering above writeback flow, let's detect recovery status and do skip in f2fs_balance_fs_bg.

Signed-off-by Chao Yu <[email protected]>

Signed-off-by Yunlei He <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/segment.c |    3 +++
 1 file changed, 3 insertions(+)

fs/f2fs/segment.c +3 -0

@@ -478,6 +478,9 @@ void f2fs_balance_fs(struct f2fs_sb_info
 
 void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi)
 {
+	if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING)))
+		return;
+
 	/* try to shrink extent cache when there is no enough memory */
 	if (!available_free_memory(sbi, EXTENT_CACHE))
 		f2fs_shrink_extent_tree(sbi, EXTENT_CACHE_SHRINK_NUMBER);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #67 lore raw

PATCH 71/336 f2fs: fix to wait page writeback during revoking atomic write

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email protected]>

[ Upstream commit e5e5732d8120654159254c16834bc8663d8be124 ]

After revoking atomic write, related LBA can be reused by others, so we need to wait page writeback before reusing the LBA, in order to avoid interference between old atomic written in-flight IO and new IO.

Signed-off-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/segment.c |    2 ++
 1 file changed, 2 insertions(+)

fs/f2fs/segment.c +2 -0

@@ -230,6 +230,8 @@ static int __revoke_inmem_pages(struct i
 
 		lock_page(page);
 
+		f2fs_wait_on_page_writeback(page, DATA, true);
+
 		if (recover) {
 			struct dnode_of_data dn;
 			struct node_info ni;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:32 UTC #68 lore raw

PATCH 72/336 f2fs: Fix deadlock in shutdown ioctl

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sahitya Tummala <[email protected]>

[ Upstream commit 60b2b4ee2bc01dd052f99fa9d65da2232102ef8e ]

f2fs_ioc_shutdown() ioctl gets stuck in the below path when issued with F2FS_GOING_DOWN_FULLSYNC option.

__switch_to+0x90/0xc4
percpu_down_write+0x8c/0xc0
freeze_super+0xec/0x1e4
freeze_bdev+0xc4/0xcc
f2fs_ioctl+0xc0c/0x1ce0
f2fs_compat_ioctl+0x98/0x1f0

Signed-off-by Sahitya Tummala <[email protected]>

Reviewed-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/file.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

fs/f2fs/file.c +7 -4

@@ -1851,9 +1851,11 @@ static int f2fs_ioc_shutdown(struct file
 	if (get_user(in, (__u32 __user *)arg))
 		return -EFAULT;
 
-	ret = mnt_want_write_file(filp);
-	if (ret)
-		return ret;
+	if (in != F2FS_GOING_DOWN_FULLSYNC) {
+		ret = mnt_want_write_file(filp);
+		if (ret)
+			return ret;
+	}
 
 	switch (in) {
 	case F2FS_GOING_DOWN_FULLSYNC:

@@ -1894,7 +1896,8 @@ static int f2fs_ioc_shutdown(struct file
 
 	f2fs_update_time(sbi, REQ_TIME);
 out:
-	mnt_drop_write_file(filp);
+	if (in != F2FS_GOING_DOWN_FULLSYNC)
+		mnt_drop_write_file(filp);
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #69 lore raw

PATCH 73/336 f2fs: fix missing clear FI_NO_PREALLOC in some error case

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yunlei He <[email protected]>

[ Upstream commit cba41be08cb182476fec4d318a8a8f2f8361a901 ]

This patch fix missing clear FI_NO_PREALLOC in some error case

Signed-off-by Yunlei He <[email protected]>

Reviewed-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/file.c |    2 ++
 1 file changed, 2 insertions(+)

fs/f2fs/file.c +2 -0

@@ -2927,6 +2927,8 @@ static ssize_t f2fs_file_write_iter(stru
 						iov_iter_count(from)) ||
 					f2fs_has_inline_data(inode) ||
 					f2fs_force_buffered_io(inode, WRITE)) {
+						clear_inode_flag(inode,
+								FI_NO_PREALLOC);
 						inode_unlock(inode);
 						return -EAGAIN;
 				}

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #70 lore raw

PATCH 74/336 f2fs: fix to detect failure of dquot_initialize

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email protected]>

[ Upstream commit c22aecd75919511abea872b201751e0be1add898 ]

dquot_initialize() can fail due to any exception inside quota subsystem, f2fs needs to be aware of it, and return correct return value to caller.

Signed-off-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/file.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

fs/f2fs/file.c +3 -1

@@ -2571,7 +2571,9 @@ static int f2fs_ioc_setproject(struct fi
 	}
 	f2fs_put_page(ipage, 1);
 
-	dquot_initialize(inode);
+	err = dquot_initialize(inode);
+	if (err)
+		goto out_unlock;
 
 	transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
 	if (!IS_ERR(transfer_to[PRJQUOTA])) {

Greg Kroah-Hartman

author maintainer

2018-08-01 16:46 UTC #71 lore raw

PATCH 75/336 f2fs: fix race in between GC and atomic open

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email protected]>

[ Upstream commit 27319ba4044c0c67d62ae39e53c0118c89f0a029 ]

Thread GC thread
- f2fs_ioc_start_atomic_write
- get_dirty_pages
- filemap_write_and_wait_range
- f2fs_gc
- do_garbage_collect
- gc_data_segment
- move_data_page
- f2fs_is_atomic_file
- set_page_dirty
- set_inode_flag(, FI_ATOMIC_FILE)

Dirty data page can still be generated by GC in race condition as above call stack.

This patch adds fi->dio_rwsem[WRITE] in f2fs_ioc_start_atomic_write to avoid such race.

Signed-off-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/f2fs/file.c |    3 +++
 1 file changed, 3 insertions(+)

fs/f2fs/file.c +3 -0

@@ -1670,6 +1670,8 @@ static int f2fs_ioc_start_atomic_write(s
 
 	inode_lock(inode);
 
+	down_write(&F2FS_I(inode)->dio_rwsem[WRITE]);
+
 	if (f2fs_is_atomic_file(inode))
 		goto out;

@@ -1699,6 +1701,7 @@ inc_stat:
 	stat_inc_atomic_write(inode);
 	stat_update_max_atomic_write(inode);
 out:
+	up_write(&F2FS_I(inode)->dio_rwsem[WRITE]);
 	inode_unlock(inode);
 	mnt_drop_write_file(filp);
 	return ret;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:34 UTC #72 lore raw

PATCH 76/336 block, bfq: remove wrong lock in bfq_requests_merged

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Filippo Muzzini <[email protected]>

[ Upstream commit a12bffebc0c9d6a5851f062aaea3aa7c4adc6042 ]

In bfq_requests_merged(), there is a deadlock because the lock on bfqq->bfqd->lock is held by the calling function, but the code of this function tries to grab the lock again.

This deadlock is currently hidden by another bug (fixed by next commit for this source file), which causes the body of bfq_requests_merged() to be never executed.

This commit removes the deadlock by removing the lock/unlock pair.

Signed-off-by Filippo Muzzini <[email protected]>

Signed-off-by Paolo Valente <[email protected]>

Signed-off-by Jens Axboe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 block/bfq-iosched.c |    2 --
 1 file changed, 2 deletions(-)

block/bfq-iosched.c +0 -2

@@ -1898,7 +1898,6 @@ static void bfq_requests_merged(struct r
 
 	if (!RB_EMPTY_NODE(&rq->rb_node))
 		goto end;
-	spin_lock_irq(&bfqq->bfqd->lock);
 
 	/*
 	 * If next and rq belong to the same bfq_queue and next is older

@@ -1923,7 +1922,6 @@ static void bfq_requests_merged(struct r
 	bfq_remove_request(q, next);
 	bfqg_stats_update_io_remove(bfqq_group(bfqq), next->cmd_flags);
 
-	spin_unlock_irq(&bfqq->bfqd->lock);
 end:
 	bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags);
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 17:35 UTC #73 lore raw

PATCH 77/336 usbip: usbip_detach: Fix memory, udev context and udev leak

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <[email protected]>

[ Upstream commit d179f99a651685b19333360e6558110da2fe9bd7 ]

detach_port() fails to call usbip_vhci_driver_close() from its error path after usbip_vhci_detach_device() returns failure, leaking memory allocated in usbip_vhci_driver_open() and holding udev_context and udev references. Fix it to call usbip_vhci_driver_close().

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 tools/usb/usbip/src/usbip_detach.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

tools/usb/usbip/src/usbip_detach.c +6 -3

@@ -43,7 +43,7 @@ void usbip_detach_usage(void)
 
 static int detach_port(char *port)
 {
-	int ret;
+	int ret = 0;
 	uint8_t portnum;
 	char path[PATH_MAX+1];

@@ -73,9 +73,12 @@ static int detach_port(char *port)
 	}
 
 	ret = usbip_vhci_detach_device(portnum);
-	if (ret < 0)
-		return -1;
+	if (ret < 0) {
+		ret = -1;
+		goto call_driver_close;
+	}
 
+call_driver_close:
 	usbip_vhci_driver_close();
 
 	return ret;

Greg Kroah-Hartman

author maintainer

2018-08-01 18:24 UTC #74 lore raw

PATCH 78/336 usbip: dynamically allocate idev by nports found in sysfs

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Grzeschik <[email protected]>

[ Upstream commit de19ca6fd72c7dd45ad82403e7b3fe9c74ef6767 ]

As the amount of available ports varies by the kernels build configuration. To remove the limitation of the fixed 128 ports we allocate the amount of idevs by using the number we get from the kernel.

Signed-off-by Michael Grzeschik <[email protected]>

Acked-by Shuah Khan (Samsung OSG) <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 tools/usb/usbip/libsrc/vhci_driver.c |   32 +++++++++++++++++++-------------
 tools/usb/usbip/libsrc/vhci_driver.h |    3 +--
 2 files changed, 20 insertions(+), 15 deletions(-)

tools/usb/usbip/libsrc/vhci_driver.c +19 ~~-13~~

@@ -135,11 +135,11 @@ static int refresh_imported_device_list(
 	return 0;
 }
 
-static int get_nports(void)
+static int get_nports(struct udev_device *hc_device)
 {
 	const char *attr_nports;
 
-	attr_nports = udev_device_get_sysattr_value(vhci_driver->hc_device, "nports");
+	attr_nports = udev_device_get_sysattr_value(hc_device, "nports");
 	if (!attr_nports) {
 		err("udev_device_get_sysattr_value nports failed");
 		return -1;

@@ -242,35 +242,41 @@ static int read_record(int rhport, char
 
 int usbip_vhci_driver_open(void)
 {
+	int nports;
+	struct udev_device *hc_device;
+
 	udev_context = udev_new();
 	if (!udev_context) {
 		err("udev_new failed");
 		return -1;
 	}
 
-	vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver));
-
 	/* will be freed in usbip_driver_close() */
-	vhci_driver->hc_device =
+	hc_device =
 		udev_device_new_from_subsystem_sysname(udev_context,
 						       USBIP_VHCI_BUS_TYPE,
 						       USBIP_VHCI_DEVICE_NAME);
-	if (!vhci_driver->hc_device) {
+	if (!hc_device) {
 		err("udev_device_new_from_subsystem_sysname failed");
 		goto err;
 	}
 
-	vhci_driver->nports = get_nports();
-	dbg("available ports: %d", vhci_driver->nports);
-
-	if (vhci_driver->nports <= 0) {
+	nports = get_nports(hc_device);
+	if (nports <= 0) {
 		err("no available ports");
 		goto err;
-	} else if (vhci_driver->nports > MAXNPORT) {
-		err("port number exceeds %d", MAXNPORT);
+	}
+	dbg("available ports: %d", nports);
+
+	vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver) +
+			nports * sizeof(struct usbip_imported_device));
+	if (!vhci_driver) {
+		err("vhci_driver allocation failed");
 		goto err;
 	}
 
+	vhci_driver->nports = nports;
+	vhci_driver->hc_device = hc_device;
 	vhci_driver->ncontrollers = get_ncontrollers();
 	dbg("available controllers: %d", vhci_driver->ncontrollers);

@@ -285,7 +291,7 @@ int usbip_vhci_driver_open(void)
 	return 0;
 
 err:
-	udev_device_unref(vhci_driver->hc_device);
+	udev_device_unref(hc_device);
 
 	if (vhci_driver)
 		free(vhci_driver);

tools/usb/usbip/libsrc/vhci_driver.h +1 -2

@@ -13,7 +13,6 @@
 
 #define USBIP_VHCI_BUS_TYPE "platform"
 #define USBIP_VHCI_DEVICE_NAME "vhci_hcd.0"
-#define MAXNPORT 128
 
 enum hub_speed {
 	HUB_SPEED_HIGH = 0,

@@ -41,7 +40,7 @@ struct usbip_vhci_driver {
 
 	int ncontrollers;
 	int nports;
-	struct usbip_imported_device idev[MAXNPORT];
+	struct usbip_imported_device idev[];
 };

Greg Kroah-Hartman

author maintainer

2018-08-01 18:38 UTC #75 lore raw

PATCH 79/336 perf/x86/intel/uncore: Correct fixed counter index check in generic code

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kan Liang <[email protected]>

[ Upstream commit 4749f8196452eeb73cf2086a6a9705bae479d33d ]

There is no index which is bigger than UNCORE_PMC_IDX_FIXED. The only exception is client IMC uncore, which has been specially handled. For generic code, it is not correct to use >= to check fixed counter. The code quality issue will bring problem when a new counter index is introduced.

Signed-off-by Kan Liang <[email protected]>

Signed-off-by Peter Zijlstra (Intel) <[email protected]>

Reviewed-by Thomas Gleixner <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/events/intel/uncore.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/x86/events/intel/uncore.c +1 -1

@@ -218,7 +218,7 @@ void uncore_perf_event_update(struct int
 	u64 prev_count, new_count, delta;
 	int shift;
 
-	if (event->hw.idx >= UNCORE_PMC_IDX_FIXED)
+	if (event->hw.idx == UNCORE_PMC_IDX_FIXED)
 		shift = 64 - uncore_fixed_ctr_bits(box);
 	else
 		shift = 64 - uncore_perf_ctr_bits(box);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:35 UTC #76 lore raw

PATCH 80/336 perf/x86/intel/uncore: Correct fixed counter index check for NHM

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kan Liang <[email protected]>

[ Upstream commit d71f11c076c420c4e2fceb4faefa144e055e0935 ]

For Nehalem and Westmere, there is only one fixed counter for W-Box. There is no index which is bigger than UNCORE_PMC_IDX_FIXED. It is not correct to use >= to check fixed counter.
The code quality issue will bring problem when new counter index is introduced.

Signed-off-by Kan Liang <[email protected]>

Signed-off-by Peter Zijlstra (Intel) <[email protected]>

Reviewed-by Thomas Gleixner <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/events/intel/uncore_nhmex.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/x86/events/intel/uncore_nhmex.c +1 -1

@@ -246,7 +246,7 @@ static void nhmex_uncore_msr_enable_even
 {
 	struct hw_perf_event *hwc = &event->hw;
 
-	if (hwc->idx >= UNCORE_PMC_IDX_FIXED)
+	if (hwc->idx == UNCORE_PMC_IDX_FIXED)
 		wrmsrl(hwc->config_base, NHMEX_PMON_CTL_EN_BIT0);
 	else if (box->pmu->type->event_mask & NHMEX_PMON_CTL_EN_BIT0)
 		wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT22);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:35 UTC #77 lore raw

PATCH 82/336 selftests: memfd: return Kselftest Skip code for skipped tests

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <[email protected]>

[ Upstream commit b27f0259e8cea74c627327c063742a83613dd460 ]

When memfd test is skipped because of unmet dependencies and/or unsupported configuration, it returns non-zero value which is treated as a fail by the Kselftest framework. This leads to false negative result even when the test could not be run.

Change it to return kselftest skip code when a test gets skipped to clearly report that the test could not be run.

Added an explicit check for root user at the start of memfd hugetlbfs test and return skip code if a non-root user attempts to run it.

In addition, return skip code when not enough huge pages are available to run the test.

Kselftest framework SKIP code is 4 and the framework prints appropriate messages to indicate that the test is skipped.

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Reviewed-by Mike Kravetz <[email protected]>

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 tools/testing/selftests/memfd/run_tests.sh |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

tools/testing/selftests/memfd/run_tests.sh +9 -5

@@ -1,6 +1,9 @@
 #!/bin/bash
 # please run as root
 
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
 #
 # Normal tests requiring no special resources
 #

@@ -29,12 +32,13 @@ if [ -n "$freepgs" ] && [ $freepgs -lt $
 	nr_hugepgs=`cat /proc/sys/vm/nr_hugepages`
 	hpages_needed=`expr $hpages_test - $freepgs`
 
+	if [ $UID != 0 ]; then
+		echo "Please run memfd with hugetlbfs test as root"
+		exit $ksft_skip
+	fi
+
 	echo 3 > /proc/sys/vm/drop_caches
 	echo $(( $hpages_needed + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages
-	if [ $? -ne 0 ]; then
-		echo "Please run this test as root"
-		exit 1
-	fi
 	while read name size unit; do
 		if [ "$name" = "HugePages_Free:" ]; then
 			freepgs=$size

@@ -53,7 +57,7 @@ if [ $freepgs -lt $hpages_test ]; then
 	fi
 	printf "Not enough huge pages available (%d < %d)\n" \
 		$freepgs $needpgs
-	exit 1
+	exit $ksft_skip
 fi
 
 #

Greg Kroah-Hartman

author maintainer

2018-08-01 18:37 UTC #78 lore raw

PATCH 83/336 selftests: kvm: return Kselftest Skip code for skipped tests

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <[email protected]>

[ Upstream commit ab0e9c4b91ca902b1cae593b3dec9c4c7a724f9f ]

When kvm test is skipped because of unmet dependencies and/or unsupported configuration, it exits with error which is treated as a fail by the Kselftest framework. This leads to false negative result even when the test could not be run.

Change it to return kselftest skip code when a test gets skipped to clearly report that the test could not be run.

Change it to use ksft_exit_skip() when the test is skipped. In addition, refine test_assert() message to include strerror() string and add explicit check for EACCES to cleary identify when test doesn't run when access is denied to resources required e.g: open /dev/kvm failed, rc: -1 errno: 13

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Acked-by Paolo Bonzini <[email protected]>

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 tools/testing/selftests/kvm/lib/assert.c          |    9 +++++++--
 tools/testing/selftests/kvm/vmx_tsc_adjust_test.c |    2 ++
 2 files changed, 9 insertions(+), 2 deletions(-)

tools/testing/selftests/kvm/lib/assert.c +7 -2

@@ -13,6 +13,8 @@
 #include <execinfo.h>
 #include <sys/syscall.h>
 
+#include "../../kselftest.h"
+
 /* Dumps the current stack trace to stderr. */
 static void __attribute__((noinline)) test_dump_stack(void);
 static void test_dump_stack(void)

@@ -70,8 +72,9 @@ test_assert(bool exp, const char *exp_st
 
 		fprintf(stderr, "==== Test Assertion Failure ====\n"
 			"  %s:%u: %s\n"
-			"  pid=%d tid=%d\n",
-			file, line, exp_str, getpid(), gettid());
+			"  pid=%d tid=%d - %s\n",
+			file, line, exp_str, getpid(), gettid(),
+			strerror(errno));
 		test_dump_stack();
 		if (fmt) {
 			fputs("  ", stderr);

@@ -80,6 +83,8 @@ test_assert(bool exp, const char *exp_st
 		}
 		va_end(ap);
 
+		if (errno == EACCES)
+			ksft_exit_skip("Access denied - Exiting.\n");
 		exit(254);
 	}

tools/testing/selftests/kvm/vmx_tsc_adjust_test.c +2 -0

@@ -28,6 +28,8 @@
 #include <string.h>
 #include <sys/ioctl.h>
 
+#include "../kselftest.h"
+
 #ifndef MSR_IA32_TSC_ADJUST
 #define MSR_IA32_TSC_ADJUST 0x3b
 #endif

Greg Kroah-Hartman

author maintainer

2018-08-01 18:33 UTC #79 lore raw

PATCH 84/336 selftests: intel_pstate: return Kselftest Skip code for skipped tests

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <[email protected]>

[ Upstream commit 5c30a038fb8ec8cdff011e6b5d5d51eb415381d4 ]

When intel_pstate test is skipped because of unmet dependencies and/or unsupported configuration, it returns 0 which is treated as a pass by the Kselftest framework. This leads to false positive result even when the test could not be run.

Change it to return kselftest skip code when a test gets skipped to clearly report that the test could not be run.

Kselftest framework SKIP code is 4 and the framework prints appropriate messages to indicate that the test is skipped.

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 tools/testing/selftests/intel_pstate/run.sh |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

tools/testing/selftests/intel_pstate/run.sh +4 -1

@@ -30,9 +30,12 @@
 
 EVALUATE_ONLY=0
 
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
 if ! uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ | grep -q x86; then
 	echo "$0 # Skipped: Test can only run on x86 architectures."
-	exit 0
+	exit $ksft_skip
 fi
 
 max_cpus=$(($(nproc)-1))

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #80 lore raw

PATCH 85/336 selftests: filesystems: return Kselftest Skip code for skipped tests

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Shuah Khan (Samsung OSG)" <[email protected]>

[ Upstream commit 7357dcf2ef2811156fdf223a9a27f73528934e1f ]

When devpts_pts test is skipped because of unmet dependencies and/or unsupported configuration, it exits with error which is treated as a fail by the Kselftest framework. This leads to false negative result even when the test could not be run.

In another case, it returns pass for a skipped test reporting a false postive.

Change it to return kselftest skip code when a test gets skipped to clearly report that the test could not be run.

Change it to use ksft_exit_skip() when test is skipped.

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Acked-by Christian Brauner <[email protected]>

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 tools/testing/selftests/filesystems/devpts_pts.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

tools/testing/selftests/filesystems/devpts_pts.c +7 -4

@@ -11,6 +11,7 @@
 #include <sys/ioctl.h>
 #include <sys/mount.h>
 #include <sys/wait.h>
+#include "../kselftest.h"
 
 static bool terminal_dup2(int duplicate, int original)
 {

@@ -125,10 +126,12 @@ static int do_tiocgptpeer(char *ptmx, ch
 		if (errno == EINVAL) {
 			fprintf(stderr, "TIOCGPTPEER is not supported. "
 					"Skipping test.\n");
-			fret = EXIT_SUCCESS;
+			fret = KSFT_SKIP;
+		} else {
+			fprintf(stderr,
+				"Failed to perform TIOCGPTPEER ioctl\n");
+			fret = EXIT_FAILURE;
 		}
-
-		fprintf(stderr, "Failed to perform TIOCGPTPEER ioctl\n");
 		goto do_cleanup;
 	}

@@ -281,7 +284,7 @@ int main(int argc, char *argv[])
 	if (!isatty(STDIN_FILENO)) {
 		fprintf(stderr, "Standard input file desciptor is not attached "
 				"to a terminal. Skipping test\n");
-		exit(EXIT_FAILURE);
+		exit(KSFT_SKIP);
 	}
 
 	ret = unshare(CLONE_NEWNS);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:31 UTC #81 lore raw

PATCH 86/336 selftests/filesystems: devpts_pts included wrong header

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anders Roxell <[email protected]>

[ Upstream commit dd4b16b4f9b1b7d9f4a185cb8222e42f3a5daf00 ]

We were picking up the wrong header should use asm/ioctls.h form the kernel and not the header from the system (sys/ioctl.h). In the current code we added the correct include and we added the kernel headers path to the CFLAGS.

Fixes ce290a19609d ("selftests: add devpts selftests")

Signed-off-by Anders Roxell <[email protected]>

Acked-by Christian Brauner <[email protected]>

Signed-off-by Shuah Khan (Samsung OSG) <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 tools/testing/selftests/filesystems/Makefile     |    1 +
 tools/testing/selftests/filesystems/devpts_pts.c |    2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

tools/testing/selftests/filesystems/Makefile +1 -0

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 
+CFLAGS += -I../../../../usr/include/
 TEST_GEN_PROGS := devpts_pts
 TEST_GEN_PROGS_EXTENDED := dnotify_test

tools/testing/selftests/filesystems/devpts_pts.c +1 -1

@@ -8,7 +8,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
-#include <sys/ioctl.h>
+#include <asm/ioctls.h>
 #include <sys/mount.h>
 #include <sys/wait.h>
 #include "../kselftest.h"

Greg Kroah-Hartman

author maintainer

2018-08-01 18:22 UTC #82 lore raw

PATCH 87/336 qtnfmac: fix invalid STA state on EAPOL failure

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sergey Matyukevich <[email protected]>

[ Upstream commit 480daa9cb62c14bbd1b87a01cd9bc10cc56dbf32 ]

Driver switches vif sta_state into QTNF_STA_CONNECTING when cfg80211 core initiates connect procedure. Further this state is changed either to QTNF_STA_CONNECTED or to QTNF_STA_DISCONNECTED by BSS_JOIN and BSS_LEAVE events from firmware. However it is possible that no such events will be sent by firmware, e.g. if EAPOL timed out.

In this case vif sta_mode will remain in QTNF_STA_CONNECTING state and all subsequent connection attempts will fail with -EBUSY error code. Fix this by perfroming STA state transition from QTNF_STA_CONNECTING to QTNF_STA_DISCONNECTED in cfg80211 disconnect callback. No need to rely upon firmware events in this case.

Signed-off-by Sergey Matyukevich <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/quantenna/qtnfmac/cfg80211.c |   21 ++++++++++++++-------
 drivers/net/wireless/quantenna/qtnfmac/event.c    |    8 +++-----
 2 files changed, 17 insertions(+), 12 deletions(-)

drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +14 -7

@@ -651,28 +651,35 @@ qtnf_disconnect(struct wiphy *wiphy, str
 {
 	struct qtnf_wmac *mac = wiphy_priv(wiphy);
 	struct qtnf_vif *vif;
-	int ret;
+	int ret = 0;
 
 	vif = qtnf_mac_get_base_vif(mac);
 	if (!vif) {
 		pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
-		return -EFAULT;
+		ret = -EFAULT;
+		goto out;
 	}
 
-	if (vif->wdev.iftype != NL80211_IFTYPE_STATION)
-		return -EOPNOTSUPP;
+	if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
 
 	if (vif->sta_state == QTNF_STA_DISCONNECTED)
-		return 0;
+		goto out;
 
 	ret = qtnf_cmd_send_disconnect(vif, reason_code);
 	if (ret) {
 		pr_err("VIF%u.%u: failed to disconnect\n", mac->macid,
 		       vif->vifid);
-		return ret;
+		goto out;
 	}
 
-	return 0;
+out:
+	if (vif->sta_state == QTNF_STA_CONNECTING)
+		vif->sta_state = QTNF_STA_DISCONNECTED;
+
+	return ret;
 }
 
 static int

drivers/net/wireless/quantenna/qtnfmac/event.c +3 -5

@@ -198,11 +198,9 @@ qtnf_event_handle_bss_leave(struct qtnf_
 		return -EPROTO;
 	}
 
-	if (vif->sta_state != QTNF_STA_CONNECTED) {
-		pr_err("VIF%u.%u: BSS_LEAVE event when STA is not connected\n",
-		       vif->mac->macid, vif->vifid);
-		return -EPROTO;
-	}
+	if (vif->sta_state != QTNF_STA_CONNECTED)
+		pr_warn("VIF%u.%u: BSS_LEAVE event when STA is not connected\n",
+			vif->mac->macid, vif->vifid);
 
 	pr_debug("VIF%u.%u: disconnected\n", vif->mac->macid, vif->vifid);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:24 UTC #83 lore raw

PATCH 88/336 PCI: Fix devm_pci_alloc_host_bridge() memory leak

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jan Kiszka <[email protected]>

[ Upstream commit 3bbce531788719749520f28052cabdef16af6b16 ]

Fix a memory leak by freeing the PCI resource list in devm_pci_release_host_bridge_dev().

Fixes 5c3f18cce083 ("PCI: Add devm_pci_alloc_host_bridge() interface")

Signed-off-by Jan Kiszka <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/pci/probe.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/pci/probe.c +3 -1

@@ -526,12 +526,14 @@ static void devm_pci_release_host_bridge
 
 	if (bridge->release_fn)
 		bridge->release_fn(bridge);
+
+	pci_free_resource_list(&bridge->windows);
 }
 
 static void pci_release_host_bridge_dev(struct device *dev)
 {
 	devm_pci_release_host_bridge_dev(dev);
-	pci_free_host_bridge(to_pci_host_bridge(dev));
+	kfree(to_pci_host_bridge(dev));
 }
 
 struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #84 lore raw

PATCH 89/336 btrfs: balance dirty metadata pages in btrfs_finish_ordered_io

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ethan Lien <[email protected]>

[ Upstream commit e73e81b6d0114d4a303205a952ab2e87c44bd279 ]

[Problem description and how we fix it]
We should balance dirty metadata pages at the end of btrfs_finish_ordered_io, since a small, unmergeable random write can potentially produce dirty metadata which is multiple times larger than the data itself. For example, a small, unmergeable 4KiB write may produce:

16KiB dirty leaf (and possibly 16KiB dirty node) in subvolume tree 16KiB dirty leaf (and possibly 16KiB dirty node) in checksum tree 16KiB dirty leaf (and possibly 16KiB dirty node) in extent tree

Although we do call balance dirty pages in write side, but in the buffered write path, most metadata are dirtied only after we reach the dirty background limit (which by far only counts dirty data pages) and wakeup the flusher thread. If there are many small, unmergeable random writes spread in a large btree, we'll find a burst of dirty pages exceeds the dirty_bytes limit after we wakeup the flusher thread - which is not what we expect. In our machine, it caused out-of-memory problem since a page cannot be dropped if it is marked dirty.

Someone may worry about we may sleep in btrfs_btree_balance_dirty_nodelay, but since we do btrfs_finish_ordered_io in a separate worker, it will not stop the flusher consuming dirty pages. Also, we use different worker for metadata writeback endio, sleep in btrfs_finish_ordered_io help us throttle the size of dirty metadata pages.

[Reproduce steps]
To reproduce the problem, we need to do 4KiB write randomly spread in a large btree. In our 2GiB RAM machine:

1) Create 4 subvolumes.
2) Run fio on each subvolume:

[global]
direct=0
rw=randwrite
ioengine=libaio
bs=4k
iodepth=16
numjobs=1
group_reporting
size=128G
runtime=1800
norandommap
time_based
randrepeat=0

3) Take snapshot on each subvolume and repeat fio on existing files.
4) Repeat step (3) until we get large btrees.
In our case, by observing btrfs_root_item->bytes_used, we have 2GiB of metadata in each subvolume tree and 12GiB of metadata in extent tree.
5) Stop all fio, take snapshot again, and wait until all delayed work is completed.
6) Start all fio. Few seconds later we hit OOM when the flusher starts to work.

It can be reproduced even when using nocow write.

Signed-off-by Ethan Lien <[email protected]>

Reviewed-by David Sterba <[email protected]>

[ add comment ]

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/btrfs/inode.c |    3 +++
 1 file changed, 3 insertions(+)

fs/btrfs/inode.c +3 -0

@@ -3160,6 +3160,9 @@ out:
 	/* once for the tree */
 	btrfs_put_ordered_extent(ordered_extent);
 
+	/* Try to release some metadata so we don't get an OOM but don't wait */
+	btrfs_btree_balance_dirty_nodelay(fs_info);
+
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #85 lore raw

PATCH 90/336 iwlwifi: pcie: fix race in Rx buffer allocator

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shaul Triebitz <[email protected]>

[ Upstream commit 0f22e40053bd5378ad1e3250e65c574fd61c0cd6 ]

Make sure the rx_allocator worker is canceled before running the rx_init routine. rx_init frees and re-allocates all rxb's pages. The rx_allocator worker also allocates pages for the used rxb's. Running rx_init and rx_allocator simultaniously causes a kernel panic. Fix that by canceling the work in rx_init.

Signed-off-by Shaul Triebitz <[email protected]>

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/wireless/intel/iwlwifi/pcie/rx.c +2 -0

@@ -901,6 +901,8 @@ static int _iwl_pcie_rx_init(struct iwl_
 	}
 	def_rxq = trans_pcie->rxq;
 
+	cancel_work_sync(&rba->rx_alloc);
+
 	spin_lock(&rba->lock);
 	atomic_set(&rba->req_pending, 0);
 	atomic_set(&rba->req_ready, 0);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:22 UTC #86 lore raw

PATCH 91/336 iwlwifi: mvm: open BA session only when sta is authorized

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gregory Greenman <[email protected]>

[ Upstream commit d94c5a820d107fdde711ec72c16848876027713d ]

Currently, a BA session is opened when the tx traffic exceeds 10 frames per second. As a result of inter-op problems with some APs, add a condition to open BA session only when station is already authorized.

Fixes 482e48440a0e ("iwlwifi: mvm: change open and close criteria of a BA session")

Signed-off-by Gregory Greenman <[email protected]>

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c |    8 +---
 drivers/net/wireless/intel/iwlwifi/mvm/rs.c       |   38 +++++++++++-----------
 drivers/net/wireless/intel/iwlwifi/mvm/rs.h       |    7 +---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c      |    2 -
 drivers/net/wireless/intel/iwlwifi/mvm/sta.h      |   10 ++---
 5 files changed, 29 insertions(+), 36 deletions(-)

drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +3 -5

@@ -2652,7 +2652,7 @@ static int iwl_mvm_mac_sta_state(struct
 
 	mutex_lock(&mvm->mutex);
 	/* track whether or not the station is associated */
-	mvm_sta->associated = new_state >= IEEE80211_STA_ASSOC;
+	mvm_sta->sta_state = new_state;
 
 	if (old_state == IEEE80211_STA_NOTEXIST &&
 	    new_state == IEEE80211_STA_NONE) {

@@ -2704,8 +2704,7 @@ static int iwl_mvm_mac_sta_state(struct
 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
 		}
 
-		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
-				     true);
+		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
 		ret = iwl_mvm_update_sta(mvm, vif, sta);
 	} else if (old_state == IEEE80211_STA_ASSOC &&
 		   new_state == IEEE80211_STA_AUTHORIZED) {

@@ -2721,8 +2720,7 @@ static int iwl_mvm_mac_sta_state(struct
 		/* enable beacon filtering */
 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
 
-		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
-				     false);
+		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
 
 		ret = 0;
 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&

drivers/net/wireless/intel/iwlwifi/mvm/rs.c +19 ~~-19~~

@@ -3,6 +3,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as

@@ -13,10 +14,6 @@
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  * more details.
  *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
- *
  * The full GNU General Public License is included in this distribution in the
  * file called LICENSE.
  *

@@ -651,9 +648,10 @@ static void rs_tl_turn_on_agg(struct iwl
 	}
 
 	tid_data = &mvmsta->tid_data[tid];
-	if ((tid_data->state == IWL_AGG_OFF) &&
+	if (mvmsta->sta_state >= IEEE80211_STA_AUTHORIZED &&
+	    tid_data->state == IWL_AGG_OFF &&
 	    (lq_sta->tx_agg_tid_en & BIT(tid)) &&
-	    (tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD)) {
+	    tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD) {
 		IWL_DEBUG_RATE(mvm, "try to aggregate tid %d\n", tid);
 		if (rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta) == 0)
 			tid_data->state = IWL_AGG_QUEUED;

@@ -1257,7 +1255,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm
 		       (unsigned long)(lq_sta->last_tx +
 				       (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
 		IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
-		iwl_mvm_rs_rate_init(mvm, sta, info->band, false);
+		iwl_mvm_rs_rate_init(mvm, sta, info->band);
 		return;
 	}
 	lq_sta->last_tx = jiffies;

@@ -2684,9 +2682,9 @@ static void rs_get_initial_rate(struct i
 				struct ieee80211_sta *sta,
 				struct iwl_lq_sta *lq_sta,
 				enum nl80211_band band,
-				struct rs_rate *rate,
-				bool init)
+				struct rs_rate *rate)
 {
+	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 	int i, nentries;
 	unsigned long active_rate;
 	s8 best_rssi = S8_MIN;

@@ -2748,7 +2746,8 @@ static void rs_get_initial_rate(struct i
 		 * bandwidth rate, and after authorization, when the phy context
 		 * is already up-to-date, re-init rs with the correct bw.
 		 */
-		u32 bw = init ? RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
+		u32 bw = mvmsta->sta_state < IEEE80211_STA_AUTHORIZED ?
+				RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
 
 		switch (bw) {
 		case RATE_MCS_CHAN_WIDTH_40:

@@ -2833,9 +2832,9 @@ void rs_update_last_rssi(struct iwl_mvm
 static void rs_initialize_lq(struct iwl_mvm *mvm,
 			     struct ieee80211_sta *sta,
 			     struct iwl_lq_sta *lq_sta,
-			     enum nl80211_band band,
-			     bool init)
+			     enum nl80211_band band)
 {
+	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 	struct iwl_scale_tbl_info *tbl;
 	struct rs_rate *rate;
 	u8 active_tbl = 0;

@@ -2851,7 +2850,7 @@ static void rs_initialize_lq(struct iwl_
 	tbl = &(lq_sta->lq_info[active_tbl]);
 	rate = &tbl->rate;
 
-	rs_get_initial_rate(mvm, sta, lq_sta, band, rate, init);
+	rs_get_initial_rate(mvm, sta, lq_sta, band, rate);
 	rs_init_optimal_rate(mvm, sta, lq_sta);
 
 	WARN_ONCE(rate->ant != ANT_A && rate->ant != ANT_B,

@@ -2864,7 +2863,8 @@ static void rs_initialize_lq(struct iwl_
 	rs_set_expected_tpt_table(lq_sta, tbl);
 	rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
 	/* TODO restore station should remember the lq cmd */
-	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, init);
+	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq,
+			    mvmsta->sta_state < IEEE80211_STA_AUTHORIZED);
 }
 
 static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,

@@ -3117,7 +3117,7 @@ void iwl_mvm_update_frame_stats(struct i
  * Called after adding a new station to initialize rate scaling
  */
 static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-			     enum nl80211_band band, bool init)
+			     enum nl80211_band band)
 {
 	int i, j;
 	struct ieee80211_hw *hw = mvm->hw;

@@ -3196,7 +3196,7 @@ static void rs_drv_rate_init(struct iwl_
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 	iwl_mvm_reset_frame_stats(mvm);
 #endif
-	rs_initialize_lq(mvm, sta, lq_sta, band, init);
+	rs_initialize_lq(mvm, sta, lq_sta, band);
 }
 
 static void rs_drv_rate_update(void *mvm_r,

@@ -3216,7 +3216,7 @@ static void rs_drv_rate_update(void *mvm
 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
 		ieee80211_stop_tx_ba_session(sta, tid);
 
-	iwl_mvm_rs_rate_init(mvm, sta, sband->band, false);
+	iwl_mvm_rs_rate_init(mvm, sta, sband->band);
 }
 
 #ifdef CONFIG_MAC80211_DEBUGFS

@@ -4062,12 +4062,12 @@ static const struct rate_control_ops rs_
 };
 
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-			  enum nl80211_band band, bool init)
+			  enum nl80211_band band)
 {
 	if (iwl_mvm_has_tlc_offload(mvm))
 		rs_fw_rate_init(mvm, sta, band);
 	else
-		rs_drv_rate_init(mvm, sta, band, init);
+		rs_drv_rate_init(mvm, sta, band);
 }
 
 int iwl_mvm_rate_control_register(void)

drivers/net/wireless/intel/iwlwifi/mvm/rs.h +2 -5

@@ -3,6 +3,7 @@
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as

@@ -13,10 +14,6 @@
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  * more details.
  *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
- *
  * The full GNU General Public License is included in this distribution in the
  * file called LICENSE.
  *

@@ -410,7 +407,7 @@ struct iwl_lq_sta {
 
 /* Initialize station's rate scaling information after adding station */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-			  enum nl80211_band band, bool init);
+			  enum nl80211_band band);
 
 /* Notify RS about Tx status */
 void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,

drivers/net/wireless/intel/iwlwifi/mvm/sta.c +1 -1

@@ -214,7 +214,7 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mv
 		cpu_to_le32(agg_size << STA_FLG_MAX_AGG_SIZE_SHIFT);
 	add_sta_cmd.station_flags |=
 		cpu_to_le32(mpdu_dens << STA_FLG_AGG_MPDU_DENS_SHIFT);
-	if (mvm_sta->associated)
+	if (mvm_sta->sta_state >= IEEE80211_STA_ASSOC)
 		add_sta_cmd.assoc_id = cpu_to_le16(sta->aid);
 
 	if (sta->wme) {

drivers/net/wireless/intel/iwlwifi/mvm/sta.h +4 -6

@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as

@@ -18,11 +19,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
  * The full GNU General Public License is included in this distribution
  * in the file called COPYING.
  *

@@ -35,6 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without

@@ -376,6 +373,7 @@ struct iwl_mvm_rxq_dup_data {
  *	tid.
  * @max_agg_bufsize: the maximal size of the AGG buffer for this station
  * @sta_type: station type
+ * @sta_state: station state according to enum %ieee80211_sta_state
  * @bt_reduced_txpower: is reduced tx power enabled for this station
  * @next_status_eosp: the next reclaimed packet is a PS-Poll response and
  *	we need to signal the EOSP

@@ -414,6 +412,7 @@ struct iwl_mvm_sta {
 	u16 tid_disable_agg;
 	u8 max_agg_bufsize;
 	enum iwl_sta_type sta_type;
+	enum ieee80211_sta_state sta_state;
 	bool bt_reduced_txpower;
 	bool next_status_eosp;
 	spinlock_t lock;

@@ -438,7 +437,6 @@ struct iwl_mvm_sta {
 	bool disable_tx;
 	bool tlc_amsdu;
 	bool sleeping;
-	bool associated;
 	u8 agg_tids;
 	u8 sleep_tx_count;
 	u8 avg_energy;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #87 lore raw

PATCH 92/336 Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thierry Escande <[email protected]>

[ Upstream commit 9960521c44a5d828f29636ceac0600603ecbddbf ]

This patch fixes the following warning during boot:

do not call blocking ops when !TASK_RUNNING; state=1 set at

 [<(ptrval)>] qca_setup+0x194/0x750 [hci_uart]
 WARNING: CPU: 2 PID: 1878 at kernel/sched/core.c:6135
 __might_sleep+0x7c/0x88

In qca_set_baudrate(), the current task state is set to TASK_UNINTERRUPTIBLE before going to sleep for 300ms. It was then restored to TASK_INTERRUPTIBLE. This patch sets the current task state back to TASK_RUNNING instead.

Signed-off-by Thierry Escande <[email protected]>

Signed-off-by Marcel Holtmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/bluetooth/hci_qca.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/bluetooth/hci_qca.c +1 -1

@@ -880,7 +880,7 @@ static int qca_set_baudrate(struct hci_d
 	 */
 	set_current_state(TASK_UNINTERRUPTIBLE);
 	schedule_timeout(msecs_to_jiffies(BAUDRATE_SETTLE_TIMEOUT_MS));
-	set_current_state(TASK_INTERRUPTIBLE);
+	set_current_state(TASK_RUNNING);
 
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #88 lore raw

PATCH 93/336 drm/amd/display: Do not program interrupt status on disabled crtc

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mikita Lipski <[email protected]>

[ Upstream commit 4ea7fc09539bd2399c1fa7acea14529406120d9e ]

Prevent interrupt programming of a crtc on which the stream is disabled and it doesn't have an OTG to reference.

Signed-off-by Mikita Lipski <[email protected]>

Reviewed-by Harry Wentland <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c +3 -0

@@ -555,6 +555,9 @@ static inline int dm_irq_state(struct am
 		return 0;
 	}
 
+	if (acrtc->otg_inst == -1)
+		return 0;
+
 	irq_source = dal_irq_type + acrtc->otg_inst;
 
 	st = (state == AMDGPU_IRQ_STATE_ENABLE);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #89 lore raw

PATCH 94/336 drivers/bus: arm-cci: fix build warnings

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

[ Upstream commit 984e9cf1b9eaab08e4f1f082ce49ed2670e99d90 ]

When the arm-cci driver is enabled, but both CONFIG_ARM_CCI5xx_PMU and CONFIG_ARM_CCI400_PMU are not, we get a warning about how parts of the driver are never used:

drivers/perf/arm-cci.c:1454:29: error: 'cci_pmu_models' defined but not used [-Werror=unused-variable] drivers/perf/arm-cci.c:693:16: error: 'cci_pmu_event_show' defined but not used [-Werror=unused-function] drivers/perf/arm-cci.c:685:16: error: 'cci_pmu_format_show' defined but not used [-Werror=unused-function]

Marking all three functions as __maybe_unused avoids the warnings in randconfig builds. I'm doing this lacking any ideas for a better fix.

Fixes 3de6be7a3dd8 ("drivers/bus: Split Arm CCI driver")

Reviewed-by Robin Murphy <[email protected]>

Signed-off-by Arnd Bergmann <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/perf/arm-cci.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/perf/arm-cci.c +3 -3

@@ -120,9 +120,9 @@ enum cci_models {
 
 static void pmu_write_counters(struct cci_pmu *cci_pmu,
 				 unsigned long *mask);
-static ssize_t cci_pmu_format_show(struct device *dev,
+static ssize_t __maybe_unused cci_pmu_format_show(struct device *dev,
 			struct device_attribute *attr, char *buf);
-static ssize_t cci_pmu_event_show(struct device *dev,
+static ssize_t __maybe_unused cci_pmu_event_show(struct device *dev,
 			struct device_attribute *attr, char *buf);
 
 #define CCI_EXT_ATTR_ENTRY(_name, _func, _config) 				\

@@ -1466,7 +1466,7 @@ static int cci_pmu_offline_cpu(unsigned
 	return 0;
 }
 
-static struct cci_pmu_model cci_pmu_models[] = {
+static __maybe_unused struct cci_pmu_model cci_pmu_models[] = {
 #ifdef CONFIG_ARM_CCI400_PMU
 	[CCI400_R0] = {
 		.name = "CCI_400",

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #90 lore raw

PATCH 95/336 Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jian-Hong Pan <[email protected]>

[ Upstream commit 66d9975c5a7c40aa7e4bb0ec0b0c37ba1f190923 ]

Without this patch we cannot turn on the Bluethooth adapter on ASUS E406MA.

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2ff8 ProdID=b011 Rev= 2.00
S:  Manufacturer=Realtek
S:  Product=802.11n WLAN Adapter
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by Jian-Hong Pan <[email protected]>

Signed-off-by Marcel Holtmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/bluetooth/btusb.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/bluetooth/btusb.c +3 -0

@@ -371,6 +371,9 @@ static const struct usb_device_id blackl
 	/* Additional Realtek 8723BU Bluetooth devices */
 	{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 
+	/* Additional Realtek 8723DE Bluetooth devices */
+	{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
+
 	/* Additional Realtek 8821AE Bluetooth devices */
 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 	{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #91 lore raw

PATCH 96/336 ASoC: dpcm: fix BE dai not hw_free and shutdown

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kai Chieh Chuang <[email protected]>

[ Upstream commit 9c0ac70ad24d76b873c1551e27790c7f6a815d5c ]

In case, one BE is used by two FE1/FE2
FE1--->BE-->

FE2----]
when FE1/FE2 call dpcm_be_dai_hw_free() together the BE users will be 2 (> 1), hence cannot be hw_free the be state will leave at, ex. SND_SOC_DPCM_STATE_STOP

later FE1/FE2 call dpcm_be_dai_shutdown(),
will be skip due to wrong state.
leaving the BE not being hw_free and shutdown.

The BE dai will be hw_free later when calling
dpcm_be_dai_shutdown() if still in invalid state.

Signed-off-by KaiChieh Chuang <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/soc/soc-pcm.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

sound/soc/soc-pcm.c +4 -2

@@ -1965,8 +1965,10 @@ int dpcm_be_dai_shutdown(struct snd_soc_
 			continue;
 
 		if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
-		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN))
-			continue;
+		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) {
+			soc_pcm_hw_free(be_substream);
+			be->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE;
+		}
 
 		dev_dbg(be->dev, "ASoC: close BE %s\n",
 			be->dai_link->name);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #92 lore raw

PATCH 97/336 mfd: cros_ec: Fail early if we cannot identify the EC

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vincent Palatin <[email protected]>

[ Upstream commit 0dbbf25561b29ffab5ba6277429760abdf49ceff ]

If we cannot communicate with the EC chip to detect the protocol version and its features, it's very likely useless to continue. Else we will commit all kind of uninformed mistakes (using the wrong protocol, the wrong buffer size, mixing the EC with other chips).

Signed-off-by Vincent Palatin <[email protected]>

Acked-by Benson Leung <[email protected]>

Signed-off-by Enric Balletbo i Serra <[email protected]>

Reviewed-by Gwendal Grignou <[email protected]>

Reviewed-by Andy Shevchenko <[email protected]>

Signed-off-by Lee Jones <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mfd/cros_ec.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

drivers/mfd/cros_ec.c +5 -1

@@ -112,7 +112,11 @@ int cros_ec_register(struct cros_ec_devi
 
 	mutex_init(&ec_dev->lock);
 
-	cros_ec_query_all(ec_dev);
+	err = cros_ec_query_all(ec_dev);
+	if (err) {
+		dev_err(dev, "Cannot identify the EC: error %d\n", err);
+		return err;
+	}
 
 	if (ec_dev->irq) {
 		err = request_threaded_irq(ec_dev->irq, NULL, ec_irq_thread,

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #93 lore raw

PATCH 98/336 mwifiex: handle race during mwifiex_usb_disconnect

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ganapathi Bhat <[email protected]>

[ Upstream commit b817047ae70c0bd67b677b65d0d69d72cd6e9728 ]

Race condition is observed during rmmod of mwifiex_usb:

1. The rmmod thread will call mwifiex_usb_disconnect(), download SHUTDOWN command and do wait_event_interruptible_timeout(), waiting for response.

2. The main thread will handle the response and will do a wake_up_interruptible(), unblocking rmmod thread.

3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in mwifiex_usb_free().

4. The main thread will try to resubmit rx_cmd.urb in mwifiex_usb_submit_rx_urb(), which is NULL.

To fix, wait for main thread to complete before calling mwifiex_usb_free().

Signed-off-by Ganapathi Bhat <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/marvell/mwifiex/usb.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/net/wireless/marvell/mwifiex/usb.c +3 -0

@@ -644,6 +644,9 @@ static void mwifiex_usb_disconnect(struc
 					 MWIFIEX_FUNC_SHUTDOWN);
 	}
 
+	if (adapter->workqueue)
+		flush_workqueue(adapter->workqueue);
+
 	mwifiex_usb_free(card);
 
 	mwifiex_dbg(adapter, FATAL,

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #94 lore raw

PATCH 99/336 wlcore: sdio: check for valid platform device data before suspend

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eyal Reizer <[email protected]>

[ Upstream commit 6e91d48371e79862ea2c05867aaebe4afe55a865 ]

the wl pointer can be null In case only wlcore_sdio is probed while no WiLink module is successfully probed, as in the case of mounting a wl12xx module while using a device tree file configured with wl18xx related settings.
In this case the system was crashing in wl1271_suspend() as platform device data is not set.
Make sure wl the pointer is valid before using it.

Signed-off-by Eyal Reizer <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ti/wlcore/sdio.c |    5 +++++
 1 file changed, 5 insertions(+)

drivers/net/wireless/ti/wlcore/sdio.c +5 -0

@@ -406,6 +406,11 @@ static int wl1271_suspend(struct device
 	mmc_pm_flag_t sdio_flags;
 	int ret = 0;
 
+	if (!wl) {
+		dev_err(dev, "no wilink module was probed\n");
+		goto out;
+	}
+
 	dev_dbg(dev, "wl1271 suspend. wow_enabled: %d\n",
 		wl->wow_enabled);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #95 lore raw

PATCH 100/336 net: hns3: Fixes initalization of RoCE handle and makes it conditional

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lijun Ou <[email protected]>

[ Upstream commit 544a7bcd5cc74734003cf7f12502b26cebfed19f ]

When register a RoCE client with hnae3vf device, it needs to judge the device whether support RoCE vf function. Otherwise, it will lead to calltrace when RoCE is not support vf function and remove roce device.

The calltrace as follows:

[   93.156614] Unable to handle kernel NULL pointer dereference at virtual address 00000015
 <SNIP>
[   93.278784] Call trace:
[   93.278788]  hnae3_match_n_instantiate+0x24/0xd8 [hnae3]
[   93.278790]  hnae3_register_client+0xcc/0x150 [hnae3]
[   93.278801]  hns_roce_hw_v2_init+0x18/0x1000 [hns_roce_hw_v2]
[   93.278805]  do_one_initcall+0x58/0x160
[   93.278807]  do_init_module+0x64/0x1d8
[   93.278809]  load_module+0x135c/0x15c8
[   93.278811]  SyS_finit_module+0x100/0x118
[   93.278816]  __sys_trace_return+0x0/0x4
[   93.278827] Code: aa0003f5 12001c56 aa1e03e0 d503201f (b9402660)

Fixes e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")

Reported-by Xinwei Kong <[email protected]>

Reported-by Zhou Wang <[email protected]>

Signed-off-by Lijun Ou <[email protected]>

Signed-off-by Zhou Wang <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +5 -3

@@ -1493,10 +1493,12 @@ static int hclgevf_init_instance(struct
 			return ret;
 		break;
 	case HNAE3_CLIENT_ROCE:
-		hdev->roce_client = client;
-		hdev->roce.client = client;
+		if (hnae3_dev_roce_supported(hdev)) {
+			hdev->roce_client = client;
+			hdev->roce.client = client;
+		}
 
-		if (hdev->roce_client && hnae3_dev_roce_supported(hdev)) {
+		if (hdev->roce_client && hdev->nic_client) {
 			ret = hclgevf_init_roce_base_info(hdev);
 			if (ret)
 				return ret;

Greg Kroah-Hartman

author maintainer

2018-08-01 18:37 UTC #96 lore raw

PATCH 101/336 net: hns3: Fixes the init of the VALID BD info in the descriptor

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fuyun Liang <[email protected]>

[ Upstream commit 7d0b130cbbfa4651cc1ab9268a2956c1b9d82ff9 ]

RX Buffer Descriptor contains a VALID bit which indicates if the BD is valid and has some data. This field is set by HNS3 hardware to intimate the driver of some valid data present in the BD. nd should be reset by the driver when BD is being used again. In the existing code this bit was not being (re-)initialized properly and hence was causing problems.

Fixes 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")

Signed-off-by Fuyun Liang <[email protected]>

Signed-off-by Peng Li <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +2 -0

@@ -1836,6 +1836,7 @@ static void hns3_replace_buffer(struct h
 	hns3_unmap_buffer(ring, &ring->desc_cb[i]);
 	ring->desc_cb[i] = *res_cb;
 	ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma);
+	ring->desc[i].rx.bd_base_info = 0;
 }
 
 static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i)

@@ -1843,6 +1844,7 @@ static void hns3_reuse_buffer(struct hns
 	ring->desc_cb[i].reuse_flag = 0;
 	ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma
 		+ ring->desc_cb[i].page_offset);
+	ring->desc[i].rx.bd_base_info = 0;
 }
 
 static void hns3_nic_reclaim_one_desc(struct hns3_enet_ring *ring, int *bytes,

Greg Kroah-Hartman

author maintainer

2018-08-01 18:34 UTC #97 lore raw

PATCH 102/336 media: tw686x: Fix incorrect vb2_mem_ops GFP flags

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ezequiel Garcia <[email protected]>

[ Upstream commit 636757ab6c93e19e2f58d3b3af1312e34eaffbab ]

When the driver is configured in the "memcpy" dma-mode, it uses vb2_vmalloc_memops, which is backed by a SLAB allocator and so shouldn't be using GFP_DMA32.

Fix it.

Signed-off-by Ezequiel Garcia <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/pci/tw686x/tw686x-video.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/media/pci/tw686x/tw686x-video.c +2 -1

@@ -1228,7 +1228,8 @@ int tw686x_video_init(struct tw686x_dev
 		vc->vidq.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
 		vc->vidq.min_buffers_needed = 2;
 		vc->vidq.lock = &vc->vb_mutex;
-		vc->vidq.gfp_flags = GFP_DMA32;
+		vc->vidq.gfp_flags = dev->dma_mode != TW686X_DMA_MODE_MEMCPY ?
+				     GFP_DMA32 : 0;
 		vc->vidq.dev = &dev->pci_dev->dev;
 
 		err = vb2_queue_init(&vc->vidq);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #98 lore raw

PATCH 103/336 media: cec-pin-error-inj: avoid a false-positive Spectre detection

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <[email protected]>

[ Upstream commit a3d71f256c8a8b5d51ea0dfd09cd85ce3a09d9e1 ]

The current logic makes Smatch to false-detect a Spectre variant 1 vulnerability. The problem is that it initializes an u32 indirectly from user space input.

After trying to write a fixup, after a while I realized that, in practice, this shouldn't be a problem, as an u32 is initialized from u8, but it took some time to discover it.

So, do some code cleanup to make it clearer for both humans and machines about the valid range for "op".

Fix this warning:

	drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line() warn: potential spectre issue 'pin->error_inj_args'

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/cec/cec-pin-error-inj.c |   23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

drivers/media/cec/cec-pin-error-inj.c +12 ~~-11~~

@@ -81,10 +81,9 @@ bool cec_pin_error_inj_parse_line(struct
 	u64 *error;
 	u8 *args;
 	bool has_op;
-	u32 op;
+	u8 op;
 	u8 mode;
 	u8 pos;
-	u8 v;
 
 	p = skip_spaces(p);
 	token = strsep(&p, delims);

@@ -146,12 +145,18 @@ bool cec_pin_error_inj_parse_line(struct
 	comma = strchr(token, ',');
 	if (comma)
 		*comma++ = '\0';
-	if (!strcmp(token, "any"))
-		op = CEC_ERROR_INJ_OP_ANY;
-	else if (!kstrtou8(token, 0, &v))
-		op = v;
-	else
+	if (!strcmp(token, "any")) {
+		has_op = false;
+		error = pin->error_inj + CEC_ERROR_INJ_OP_ANY;
+		args = pin->error_inj_args[CEC_ERROR_INJ_OP_ANY];
+	} else if (!kstrtou8(token, 0, &op)) {
+		has_op = true;
+		error = pin->error_inj + op;
+		args = pin->error_inj_args[op];
+	} else {
 		return false;
+	}
+
 	mode = CEC_ERROR_INJ_MODE_ONCE;
 	if (comma) {
 		if (!strcmp(comma, "off"))

@@ -166,10 +171,6 @@ bool cec_pin_error_inj_parse_line(struct
 			return false;
 	}
 
-	error = pin->error_inj + op;
-	args = pin->error_inj_args[op];
-	has_op = op <= 0xff;
-
 	token = strsep(&p, delims);
 	if (p) {
 		p = skip_spaces(p);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:19 UTC #99 lore raw

PATCH 104/336 media: videobuf2-core: dont call memop finish when queueing

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans Verkuil <[email protected]>

[ Upstream commit 90b2da89a083e1395cb322521a42397c49ae4500 ]

When a buffer is queued or requeued in vb2_buffer_done, then don't call the finish memop. In this case the buffer is only returned to vb2, not to userspace.

Calling 'finish' here will cause an unbalance when the queue is canceled, since the core will call the same memop again.

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/common/videobuf2/videobuf2-core.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

drivers/media/common/videobuf2/videobuf2-core.c +6 -3

@@ -916,9 +916,12 @@ void vb2_buffer_done(struct vb2_buffer *
 	dprintk(4, "done processing on buffer %d, state: %d\n",
 			vb->index, state);
 
-	/* sync buffers */
-	for (plane = 0; plane < vb->num_planes; ++plane)
-		call_void_memop(vb, finish, vb->planes[plane].mem_priv);
+	if (state != VB2_BUF_STATE_QUEUED &&
+	    state != VB2_BUF_STATE_REQUEUEING) {
+		/* sync buffers */
+		for (plane = 0; plane < vb->num_planes; ++plane)
+			call_void_memop(vb, finish, vb->planes[plane].mem_priv);
+	}
 
 	spin_lock_irqsave(&q->done_lock, flags);
 	if (state == VB2_BUF_STATE_QUEUED ||

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #100 lore raw

PATCH 105/336 Btrfs: dont return ino to ino cache if inode item removal fails

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Omar Sandoval <[email protected]>

[ Upstream commit c08db7d8d295a4f3a10faaca376de011afff7950 ]

In btrfs_evict_inode(), if btrfs_truncate_inode_items() fails, the inode item will still be in the tree but we still return the ino to the ino cache. That will blow up later when someone tries to allocate that ino, so don't return it to the cache.

Fixes 581bb050941b ("Btrfs: Cache free inode numbers in memory")

Reviewed-by Josef Bacik <[email protected]>

Signed-off-by Omar Sandoval <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/btrfs/inode.c |   25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

fs/btrfs/inode.c +13 ~~-12~~

@@ -5426,13 +5426,18 @@ void btrfs_evict_inode(struct inode *ino
 		trans->block_rsv = rsv;
 
 		ret = btrfs_truncate_inode_items(trans, root, inode, 0, 0);
-		if (ret != -ENOSPC && ret != -EAGAIN)
+		if (ret) {
+			trans->block_rsv = &fs_info->trans_block_rsv;
+			btrfs_end_transaction(trans);
+			btrfs_btree_balance_dirty(fs_info);
+			if (ret != -ENOSPC && ret != -EAGAIN) {
+				btrfs_orphan_del(NULL, BTRFS_I(inode));
+				btrfs_free_block_rsv(fs_info, rsv);
+				goto no_delete;
+			}
+		} else {
 			break;
-
-		trans->block_rsv = &fs_info->trans_block_rsv;
-		btrfs_end_transaction(trans);
-		trans = NULL;
-		btrfs_btree_balance_dirty(fs_info);
+		}
 	}
 
 	btrfs_free_block_rsv(fs_info, rsv);

@@ -5441,12 +5446,8 @@ void btrfs_evict_inode(struct inode *ino
 	 * Errors here aren't a big deal, it just means we leave orphan items
 	 * in the tree.  They will be cleaned up on the next mount.
 	 */
-	if (ret == 0) {
-		trans->block_rsv = root->orphan_block_rsv;
-		btrfs_orphan_del(trans, BTRFS_I(inode));
-	} else {
-		btrfs_orphan_del(NULL, BTRFS_I(inode));
-	}
+	trans->block_rsv = root->orphan_block_rsv;
+	btrfs_orphan_del(trans, BTRFS_I(inode));
 
 	trans->block_rsv = &fs_info->trans_block_rsv;
 	if (!(root == fs_info->tree_root ||

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #101 lore raw

PATCH 106/336 Btrfs: dont BUG_ON() in btrfs_truncate_inode_items()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Omar Sandoval <[email protected]>

[ Upstream commit 0552210997badb6a60740a26ff9d976a416510f0 ]

btrfs_free_extent() can fail because of ENOMEM. There's no reason to panic here, we can just abort the transaction.

Fixes f4b9aa8d3b87 ("btrfs_truncate")

Reviewed-by Nikolay Borisov <[email protected]>

Signed-off-by Omar Sandoval <[email protected]>

Reviewed-by David Sterba <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/btrfs/inode.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

fs/btrfs/inode.c +4 -1

@@ -4671,7 +4671,10 @@ delete:
 						extent_num_bytes, 0,
 						btrfs_header_owner(leaf),
 						ino, extent_offset);
-			BUG_ON(ret);
+			if (ret) {
+				btrfs_abort_transaction(trans, ret);
+				break;
+			}
 			if (btrfs_should_throttle_delayed_refs(trans, fs_info))
 				btrfs_async_run_delayed_refs(fs_info,
 					trans->delayed_ref_updates * 2,

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #102 lore raw

PATCH 107/336 btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Sterba <[email protected]>

[ Upstream commit 3d3a2e610ea5e7c6d4f9481ecce5d8e2d8317843 ]

Currently the code assumes that there's an implied barrier by the sequence of code preceding the wakeup, namely the mutex unlock.

As Nikolay pointed out:

I think this is wrong (not your code) but the original assumption that the RELEASE semantics provided by mutex_unlock is sufficient. According to memory-barriers.txt:

Section 'LOCK ACQUISITION FUNCTIONS' states:

(2) RELEASE operation implication:

Memory operations issued before the RELEASE will be completed before the RELEASE operation has completed.

Memory operations issued after the RELEASE *may* be completed before the RELEASE operation has completed.

(I've bolded the may portion)

The example given there:

As an example, consider the following:

    *A = a;
    *B = b;
    ACQUIRE
    *C = c;
    *D = d;
    RELEASE
    *E = e;
    *F = f;

The following sequence of events is acceptable:

    ACQUIRE, {*F,*A}, *E, {*C,*D}, *B, RELEASE

So if we assume that *C is modifying the flag which the waitqueue is checking, and *E is the actual wakeup, then those accesses can be re-ordered...

IMHO this code should be considered broken...

Signed-off-by Greg Kroah-Hartman <[email protected]>

---

To be on the safe side, add the barriers. The synchronization logic around log using the mutexes and several other threads does not make it easy to reason for/against the barrier.

CC Nikolay Borisov <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Reviewed-by Nikolay Borisov <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/btrfs/tree-log.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

fs/btrfs/tree-log.c +8 -2

@@ -3116,8 +3116,11 @@ out_wake_log_root:
 	mutex_unlock(&log_root_tree->log_mutex);
 
 	/*
-	 * The barrier before waitqueue_active is implied by mutex_unlock
+	 * The barrier before waitqueue_active is needed so all the updates
+	 * above are seen by the woken threads. It might not be necessary, but
+	 * proving that seems to be hard.
 	 */
+	smp_mb();
 	if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
 		wake_up(&log_root_tree->log_commit_wait[index2]);
 out:

@@ -3128,8 +3131,11 @@ out:
 	mutex_unlock(&root->log_mutex);
 
 	/*
-	 * The barrier before waitqueue_active is implied by mutex_unlock
+	 * The barrier before waitqueue_active is needed so all the updates
+	 * above are seen by the woken threads. It might not be necessary, but
+	 * proving that seems to be hard.
 	 */
+	smp_mb();
 	if (waitqueue_active(&root->log_commit_wait[index1]))
 		wake_up(&root->log_commit_wait[index1]);
 	return ret;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #103 lore raw

PATCH 108/336 btrfs: qgroup: Finish rescan when hit the last leaf of extent tree

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email protected]>

[ Upstream commit ff3d27a048d926b3920ccdb75d98788c567cae0d ]

Under the following case, qgroup rescan can double account cowed tree blocks:

In this case, extent tree only has one tree block.

| transid=5 last committed=4
| btrfs_qgroup_rescan_worker()
| |- btrfs_start_transaction()
| |  transid = 5
| |- qgroup_rescan_leaf()
|    |- btrfs_search_slot_for_read() on extent tree
|       Get the only extent tree block from commit root (transid = 4).
|       Scan it, set qgroup_rescan_progress to the last
|       EXTENT/META_ITEM + 1
|       now qgroup_rescan_progress = A + 1.
|
| fs tree get CoWed, new tree block is at A + 16K
| transid 5 get committed
-
| transid=6 last committed=5
| btrfs_qgroup_rescan_worker()
| btrfs_qgroup_rescan_worker()
| |- btrfs_start_transaction()
| |  transid = 5
| |- qgroup_rescan_leaf()
|    |- btrfs_search_slot_for_read() on extent tree
|       Get the only extent tree block from commit root (transid = 5).
|       scan it using qgroup_rescan_progress (A + 1).
|       found new tree block beyong A, and it's fs tree block,
|       account it to increase qgroup numbers.

In above case, tree block A, and tree block A + 16K get accounted twice, while qgroup rescan should stop when it already reach the last leaf, other than continue using its qgroup_rescan_progress.

Such case could happen by just looping btrfs/017 and with some possibility it can hit such double qgroup accounting problem.

Fix it by checking the path to determine if we should finish qgroup rescan, other than relying on next loop to exit.

Reported-by Nikolay Borisov <[email protected]>

Signed-off-by Qu Wenruo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/btrfs/qgroup.c |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

fs/btrfs/qgroup.c +19 -0

@@ -2580,6 +2580,21 @@ out:
 }
 
 /*
+ * Check if the leaf is the last leaf. Which means all node pointers
+ * are at their last position.
+ */
+static bool is_last_leaf(struct btrfs_path *path)
+{
+	int i;
+
+	for (i = 1; i < BTRFS_MAX_LEVEL && path->nodes[i]; i++) {
+		if (path->slots[i] != btrfs_header_nritems(path->nodes[i]) - 1)
+			return false;
+	}
+	return true;
+}
+
+/*
  * returns < 0 on error, 0 when more leafs are to be scanned.
  * returns 1 when done.
  */

@@ -2592,6 +2607,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info
 	struct ulist *roots = NULL;
 	struct seq_list tree_mod_seq_elem = SEQ_LIST_INIT(tree_mod_seq_elem);
 	u64 num_bytes;
+	bool done;
 	int slot;
 	int ret;

@@ -2620,6 +2636,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info
 		mutex_unlock(&fs_info->qgroup_rescan_lock);
 		return ret;
 	}
+	done = is_last_leaf(path);
 
 	btrfs_item_key_to_cpu(path->nodes[0], &found,
 			      btrfs_header_nritems(path->nodes[0]) - 1);

@@ -2666,6 +2683,8 @@ out:
 	}
 	btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem);
 
+	if (done && !ret)
+		ret = 1;
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #104 lore raw

PATCH 109/336 x86/microcode: Make the late update update_lock a raw lock for RT

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Scott Wood <[email protected]>

[ Upstream commit ff987fcf011d20c53b3a613edf6e2055ea48e26e ]

__reload_late() is called from stop_machine context and thus cannot acquire a non-raw spinlock on PREEMPT_RT.

Signed-off-by Scott Wood <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Acked-by Thomas Gleixner <[email protected]>

Cc Ashok Raj <[email protected]>

Cc Clark Williams <[email protected]>

Cc Pei Zhang <[email protected]>

Cc x86-ml <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/kernel/cpu/microcode/core.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

arch/x86/kernel/cpu/microcode/core.c +3 -3

@@ -70,7 +70,7 @@ static DEFINE_MUTEX(microcode_mutex);
 /*
  * Serialize late loading so that CPUs get updated one-by-one.
  */
-static DEFINE_SPINLOCK(update_lock);
+static DEFINE_RAW_SPINLOCK(update_lock);
 
 struct ucode_cpu_info		ucode_cpu_info[NR_CPUS];

@@ -560,9 +560,9 @@ static int __reload_late(void *info)
 	if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC))
 		return -1;
 
-	spin_lock(&update_lock);
+	raw_spin_lock(&update_lock);
 	apply_microcode_local(&err);
-	spin_unlock(&update_lock);
+	raw_spin_unlock(&update_lock);
 
 	/* siblings return UCODE_OK because their engine got updated already */
 	if (err > UCODE_NFOUND) {

Greg Kroah-Hartman

author maintainer

2018-08-01 18:28 UTC #105 lore raw

PATCH 110/336 PM / wakeup: Make s2idle_lock a RAW_SPINLOCK

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <[email protected]>

[ Upstream commit 62fc00a6611a0014c85763f9def1fc07c15d1302 ]

The `s2idle_lock' is acquired during suspend while interrupts are disabled even on RT. The lock is acquired for short sections only. Make it a RAW lock which avoids "sleeping while atomic" warnings on RT.

Signed-off-by Sebastian Andrzej Siewior <[email protected]>

Signed-off-by Rafael J. Wysocki <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/power/suspend.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

kernel/power/suspend.c +7 -7

@@ -60,7 +60,7 @@ static const struct platform_s2idle_ops
 static DECLARE_WAIT_QUEUE_HEAD(s2idle_wait_head);
 
 enum s2idle_states __read_mostly s2idle_state;
-static DEFINE_SPINLOCK(s2idle_lock);
+static DEFINE_RAW_SPINLOCK(s2idle_lock);
 
 void s2idle_set_ops(const struct platform_s2idle_ops *ops)
 {

@@ -78,12 +78,12 @@ static void s2idle_enter(void)
 {
 	trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, true);
 
-	spin_lock_irq(&s2idle_lock);
+	raw_spin_lock_irq(&s2idle_lock);
 	if (pm_wakeup_pending())
 		goto out;
 
 	s2idle_state = S2IDLE_STATE_ENTER;
-	spin_unlock_irq(&s2idle_lock);
+	raw_spin_unlock_irq(&s2idle_lock);
 
 	get_online_cpus();
 	cpuidle_resume();

@@ -97,11 +97,11 @@ static void s2idle_enter(void)
 	cpuidle_pause();
 	put_online_cpus();
 
-	spin_lock_irq(&s2idle_lock);
+	raw_spin_lock_irq(&s2idle_lock);
 
  out:
 	s2idle_state = S2IDLE_STATE_NONE;
-	spin_unlock_irq(&s2idle_lock);
+	raw_spin_unlock_irq(&s2idle_lock);
 
 	trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, false);
 }

@@ -156,12 +156,12 @@ void s2idle_wake(void)
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&s2idle_lock, flags);
+	raw_spin_lock_irqsave(&s2idle_lock, flags);
 	if (s2idle_state > S2IDLE_STATE_NONE) {
 		s2idle_state = S2IDLE_STATE_WAKE;
 		wake_up(&s2idle_wait_head);
 	}
-	spin_unlock_irqrestore(&s2idle_lock, flags);
+	raw_spin_unlock_irqrestore(&s2idle_lock, flags);
 }
 EXPORT_SYMBOL_GPL(s2idle_wake);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #106 lore raw

PATCH 111/336 PCI: Prevent sysfs disable of device while driver is attached

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <[email protected]>

[ Upstream commit 6f5cdfa802733dcb561bf664cc89d203f2fd958f ]

Manipulating the enable_cnt behind the back of the driver will wreak complete havoc with the kernel state, so disallow it.

Signed-off-by Christoph Hellwig <[email protected]>

Reviewed-by Johannes Thumshirn <[email protected]>

Acked-by Keith Busch <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/pci/pci-sysfs.c |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

drivers/pci/pci-sysfs.c +9 -6

@@ -288,13 +288,16 @@ static ssize_t enable_store(struct devic
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
-	if (!val) {
-		if (pci_is_enabled(pdev))
-			pci_disable_device(pdev);
-		else
-			result = -EIO;
-	} else
+	device_lock(dev);
+	if (dev->driver)
+		result = -EBUSY;
+	else if (val)
 		result = pci_enable_device(pdev);
+	else if (pci_is_enabled(pdev))
+		pci_disable_device(pdev);
+	else
+		result = -EIO;
+	device_unlock(dev);
 
 	return result < 0 ? result : count;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #107 lore raw

PATCH 112/336 soc: qcom: qmi: fix a buffer sizing bug

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Elder <[email protected]>

[ Upstream commit 7df5ff258bd27900d516fea88da10d05602bf8c7 ]

In qmi_handle_init(), a buffer is allocated for to hold messages received through the handle's socket. Any "normal" messages (expected by the caller) will have a header prepended, so the buffer size is adjusted to accomodate that.

The buffer must also be of sufficient size to receive control messages, so the size is increased if necessary to ensure these will fit.

Unfortunately the calculation is done wrong, making it possible for the calculated buffer size to be too small to hold a "normal" message. Specifically, if:

recv_buf_size > sizeof(struct qrtr_ctrl_pkt) - sizeof(struct qmi_header)
AND
recv_buf_size < sizeof(struct qrtr_ctrl_pkt)

the current logic will use sizeof(struct qrtr_ctrl_pkt) as the receive buffer size, which is not enough to hold the maximum "normal" message plus its header. Currently this problem occurs for (13 < recv_buf_size < 20).

This patch corrects this.

Signed-off-by Alex Elder <[email protected]>

Signed-off-by Andy Gross <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/soc/qcom/qmi_interface.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/soc/qcom/qmi_interface.c +3 -2

@@ -639,10 +639,11 @@ int qmi_handle_init(struct qmi_handle *q
 	if (ops)
 		qmi->ops = *ops;
 
+	/* Make room for the header */
+	recv_buf_size += sizeof(struct qmi_header);
+	/* Must also be sufficient to hold a control packet */
 	if (recv_buf_size < sizeof(struct qrtr_ctrl_pkt))
 		recv_buf_size = sizeof(struct qrtr_ctrl_pkt);
-	else
-		recv_buf_size += sizeof(struct qmi_header);
 
 	qmi->recv_buf_size = recv_buf_size;
 	qmi->recv_buf = kzalloc(recv_buf_size, GFP_KERNEL);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:31 UTC #108 lore raw

PATCH 113/336 soc: qcom: smem: fix qcom_smem_set_global_partition()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Elder <[email protected]>

[ Upstream commit 8fa1a21409da6abfe890f66532f9fcd8d2c25a3d ]

If there is at least one entry in the partition table, but no global entry, the qcom_smem_set_global_partition() should return an error just like it does if there are no partition table entries.

It turns out the function still returns an error in this case, but it waits to do so until it has mistakenly treated the last entry in the table as if it were the global entry found.

Fix the function to return immediately if no global entry is found in the table.

Signed-off-by Alex Elder <[email protected]>

Signed-off-by Andy Gross <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/soc/qcom/smem.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

drivers/soc/qcom/smem.c +6 -3

@@ -695,9 +695,10 @@ static u32 qcom_smem_get_item_count(stru
 static int qcom_smem_set_global_partition(struct qcom_smem *smem)
 {
 	struct smem_partition_header *header;
-	struct smem_ptable_entry *entry = NULL;
+	struct smem_ptable_entry *entry;
 	struct smem_ptable *ptable;
 	u32 host0, host1, size;
+	bool found = false;
 	int i;
 
 	ptable = qcom_smem_get_ptable(smem);

@@ -709,11 +710,13 @@ static int qcom_smem_set_global_partitio
 		host0 = le16_to_cpu(entry->host0);
 		host1 = le16_to_cpu(entry->host1);
 
-		if (host0 == SMEM_GLOBAL_HOST && host0 == host1)
+		if (host0 == SMEM_GLOBAL_HOST && host0 == host1) {
+			found = true;
 			break;
+		}
 	}
 
-	if (!entry) {
+	if (!found) {
 		dev_err(smem->dev, "Missing entry for global partition\n");
 		return -EINVAL;
 	}

Greg Kroah-Hartman

author maintainer

2018-08-01 18:37 UTC #109 lore raw

PATCH 114/336 soc: qcom: smem: byte swap values properly

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Elder <[email protected]>

[ Upstream commit 04a512fea333369cc0b550f3b90df0d638e34d00 ]

Two places report an error when a partition header is found to not contain the right canary value. The error messages do not properly byte swap the host ids. Fix this, and adjust the format specificier to match the 16-bit unsigned data type.

Move the error handling for a bad canary value to the end of qcom_smem_alloc_private(). This avoids some long lines, and reduces the distraction of handling this unexpected problem.

Signed-off-by Alex Elder <[email protected]>

Signed-off-by Andy Gross <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/soc/qcom/smem.c |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

drivers/soc/qcom/smem.c +9 -9

@@ -362,13 +362,8 @@ static int qcom_smem_alloc_private(struc
 	cached = phdr_to_last_cached_entry(phdr);
 
 	while (hdr < end) {
-		if (hdr->canary != SMEM_PRIVATE_CANARY) {
-			dev_err(smem->dev,
-				"Found invalid canary in hosts %d:%d partition\n",
-				phdr->host0, phdr->host1);
-			return -EINVAL;
-		}
-
+		if (hdr->canary != SMEM_PRIVATE_CANARY)
+			goto bad_canary;
 		if (le16_to_cpu(hdr->item) == item)
 			return -EEXIST;

@@ -397,6 +392,11 @@ static int qcom_smem_alloc_private(struc
 	le32_add_cpu(&phdr->offset_free_uncached, alloc_size);
 
 	return 0;
+bad_canary:
+	dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
+		le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
+
+	return -EINVAL;
 }
 
 static int qcom_smem_alloc_global(struct qcom_smem *smem,

@@ -560,8 +560,8 @@ static void *qcom_smem_get_private(struc
 	return ERR_PTR(-ENOENT);
 
 invalid_canary:
-	dev_err(smem->dev, "Found invalid canary in hosts %d:%d partition\n",
-			phdr->host0, phdr->host1);
+	dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
+			le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
 
 	return ERR_PTR(-EINVAL);
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #110 lore raw

PATCH 115/336 nvme-rdma: stop admin queue before freeing it

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jianchao Wang <[email protected]>

[ Upstream commit 2e050f00a0f0e07467050cb4afae0234941e5bf3 ]

For any failure after nvme_rdma_start_queue in nvme_rdma_configure_admin_queue, the admin queue will be freed with the NVME_RDMA_Q_LIVE flag still set. Once nvme_rdma_stop_queue is invoked, that will cause a use-after-free.

BUG: KASAN: use-after-free in rdma_disconnect+0x1f/0xe0 [rdma_cm]

To fix it, call nvme_rdma_stop_queue for all the failed cases after nvme_rdma_start_queue.

Signed-off-by Jianchao Wang <[email protected]>

Reviewed-by Max Gurtovoy <[email protected]>

Signed-off-by Christoph Hellwig <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/nvme/host/rdma.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

drivers/nvme/host/rdma.c +6 -4

@@ -778,7 +778,7 @@ static int nvme_rdma_configure_admin_que
 	if (error) {
 		dev_err(ctrl->ctrl.device,
 			"prop_get NVME_REG_CAP failed\n");
-		goto out_cleanup_queue;
+		goto out_stop_queue;
 	}
 
 	ctrl->ctrl.sqsize =

@@ -786,23 +786,25 @@ static int nvme_rdma_configure_admin_que
 
 	error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
 	if (error)
-		goto out_cleanup_queue;
+		goto out_stop_queue;
 
 	ctrl->ctrl.max_hw_sectors =
 		(ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9);
 
 	error = nvme_init_identify(&ctrl->ctrl);
 	if (error)
-		goto out_cleanup_queue;
+		goto out_stop_queue;
 
 	error = nvme_rdma_alloc_qe(ctrl->queues[0].device->dev,
 			&ctrl->async_event_sqe, sizeof(struct nvme_command),
 			DMA_TO_DEVICE);
 	if (error)
-		goto out_cleanup_queue;
+		goto out_stop_queue;
 
 	return 0;
 
+out_stop_queue:
+	nvme_rdma_stop_queue(&ctrl->queues[0]);
 out_cleanup_queue:
 	if (new)
 		blk_cleanup_queue(ctrl->ctrl.admin_q);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:30 UTC #111 lore raw

PATCH 116/336 nvme-pci: Fix AER reset handling

Link https://bugzilla.kernel.org/show_bug.cgi?id=199757

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Keith Busch <[email protected]>

[ Upstream commit 72cd4cc28e234ed7189ee508ed65ab60c80a97c8 ]

The nvme timeout handling doesn't do anything if the pci channel is offline, which is the case when recovering from PCI error event, so it was a bad idea to sync the controller reset in this state. This patch flushes the reset work in the error_resume callback instead when the channel is back to online. This keeps AER handling serialized and can recover from timeouts.

Fixes cc1d5e749a2e ("nvme/pci: Sync controller reset for AER slot_reset")

Reported-by Alex Gagniuc <[email protected]>

Tested-by Alex Gagniuc <[email protected]>

Signed-off-by Keith Busch <[email protected]>

Signed-off-by Christoph Hellwig <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/nvme/host/pci.c |   14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

drivers/nvme/host/pci.c +5 -9

@@ -2679,19 +2679,15 @@ static pci_ers_result_t nvme_slot_reset(
 
 	dev_info(dev->ctrl.device, "restart after slot reset\n");
 	pci_restore_state(pdev);
-	nvme_reset_ctrl_sync(&dev->ctrl);
-
-	switch (dev->ctrl.state) {
-	case NVME_CTRL_LIVE:
-	case NVME_CTRL_ADMIN_ONLY:
-		return PCI_ERS_RESULT_RECOVERED;
-	default:
-		return PCI_ERS_RESULT_DISCONNECT;
-	}
+	nvme_reset_ctrl(&dev->ctrl);
+	return PCI_ERS_RESULT_RECOVERED;
 }
 
 static void nvme_error_resume(struct pci_dev *pdev)
 {
+	struct nvme_dev *dev = pci_get_drvdata(pdev);
+
+	flush_work(&dev->ctrl.reset_work);
 	pci_cleanup_aer_uncorrect_error_status(pdev);
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 18:21 UTC #112 lore raw

PATCH 117/336 ath: Add regulatory mapping for FCC3_ETSIC

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 01fb2994a98dc72c8818c274f7b5983d5dd885c7 ]

The regdomain code is used to select the correct the correct conformance test limits (CTL) for a country. If the regdomain code isn't available and it is still programmed in the EEPROM then it will cause an error and stop the initialization with:

Invalid EEPROM contents

The current CTL mappings for this regdomain code are:

* 2.4GHz: ETSI
* 5GHz: FCC

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd_common.h |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/wireless/ath/regd_common.h +2 -0

@@ -35,6 +35,7 @@ enum EnumRd {
 	FRANCE_RES = 0x31,
 	FCC3_FCCA = 0x3A,
 	FCC3_WORLD = 0x3B,
+	FCC3_ETSIC = 0x3F,
 
 	ETSI1_WORLD = 0x37,
 	ETSI3_ETSIA = 0x32,

@@ -168,6 +169,7 @@ static struct reg_dmn_pair_mapping regDo
 	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
 	{FCC3_FCCA, CTL_FCC, CTL_FCC},
 	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
+	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
 	{FCC4_FCCA, CTL_FCC, CTL_FCC},
 	{FCC5_FCCA, CTL_FCC, CTL_FCC},
 	{FCC6_FCCA, CTL_FCC, CTL_FCC},

Greg Kroah-Hartman

author maintainer

2018-08-01 18:25 UTC #113 lore raw

PATCH 118/336 ath: Add regulatory mapping for ETSI8_WORLD

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 45faf6e096da8bb80e1ddf8c08a26a9601d9469e ]

Invalid EEPROM contents

The current CTL mappings for this regdomain code are:

* 2.4GHz: ETSI
* 5GHz: ETSI

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd_common.h |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/wireless/ath/regd_common.h +2 -0

@@ -45,6 +45,7 @@ enum EnumRd {
 	ETSI4_ETSIC = 0x38,
 	ETSI5_WORLD = 0x39,
 	ETSI6_WORLD = 0x34,
+	ETSI8_WORLD = 0x3D,
 	ETSI_RESERVED = 0x33,
 
 	MKK1_MKKA = 0x40,

@@ -181,6 +182,7 @@ static struct reg_dmn_pair_mapping regDo
 	{ETSI4_WORLD, CTL_ETSI, CTL_ETSI},
 	{ETSI5_WORLD, CTL_ETSI, CTL_ETSI},
 	{ETSI6_WORLD, CTL_ETSI, CTL_ETSI},
+	{ETSI8_WORLD, CTL_ETSI, CTL_ETSI},
 
 	/* XXX: For ETSI3_ETSIA, Was NO_CTL meant for the 2 GHz band ? */
 	{ETSI3_ETSIA, CTL_ETSI, CTL_ETSI},

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #114 lore raw

PATCH 119/336 ath: Add regulatory mapping for APL13_WORLD

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 9ba8df0c52b3e6baa436374b429d3d73bd09a320 ]

Invalid EEPROM contents

The current CTL mappings for this regdomain code are:

* 2.4GHz: ETSI
* 5GHz: ETSI

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd_common.h |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/wireless/ath/regd_common.h +2 -0

@@ -69,6 +69,7 @@ enum EnumRd {
 	APL1_ETSIC = 0x55,
 	APL2_ETSIC = 0x56,
 	APL5_WORLD = 0x58,
+	APL13_WORLD = 0x5A,
 	APL6_WORLD = 0x5B,
 	APL7_FCCA = 0x5C,
 	APL8_WORLD = 0x5D,

@@ -195,6 +196,7 @@ static struct reg_dmn_pair_mapping regDo
 	{APL3_WORLD, CTL_FCC, CTL_ETSI},
 	{APL4_WORLD, CTL_FCC, CTL_ETSI},
 	{APL5_WORLD, CTL_FCC, CTL_ETSI},
+	{APL13_WORLD, CTL_ETSI, CTL_ETSI},
 	{APL6_WORLD, CTL_ETSI, CTL_ETSI},
 	{APL8_WORLD, CTL_ETSI, CTL_ETSI},
 	{APL9_WORLD, CTL_ETSI, CTL_ETSI},

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #115 lore raw

PATCH 120/336 ath: Add regulatory mapping for APL2_FCCA

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 4f183687e3fad3ce0e06e38976cad81bc4541990 ]

Invalid EEPROM contents

The current CTL mappings for this regdomain code are:

* 2.4GHz: FCC
* 5GHz: FCC

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd_common.h |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/wireless/ath/regd_common.h +2 -0

@@ -61,6 +61,7 @@ enum EnumRd {
 	MKK1_MKKA1 = 0x4A,
 	MKK1_MKKA2 = 0x4B,
 	MKK1_MKKC = 0x4C,
+	APL2_FCCA = 0x4D,
 
 	APL3_FCCA = 0x50,
 	APL1_WORLD = 0x52,

@@ -193,6 +194,7 @@ static struct reg_dmn_pair_mapping regDo
 	{FCC1_FCCA, CTL_FCC, CTL_FCC},
 	{APL1_WORLD, CTL_FCC, CTL_ETSI},
 	{APL2_WORLD, CTL_FCC, CTL_ETSI},
+	{APL2_FCCA, CTL_FCC, CTL_FCC},
 	{APL3_WORLD, CTL_FCC, CTL_ETSI},
 	{APL4_WORLD, CTL_FCC, CTL_ETSI},
 	{APL5_WORLD, CTL_FCC, CTL_ETSI},

Greg Kroah-Hartman

author maintainer

2018-08-01 18:22 UTC #116 lore raw

PATCH 121/336 ath: Add regulatory mapping for Uganda

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 1ea3986ad2bc72081c69f3fbc1e5e0eeb3c44f17 ]

The country code is used by the ath to detect the ISO 3166-1 alpha-2 name and to select the correct conformance test limits (CTL) for a country. If the country isn't available and it is still programmed in the EEPROM then it will cause an error and stop the initialization with:

Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: ETSI
* 5GHz: FCC

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

drivers/net/wireless/ath/regd.h +1 -0

@@ -175,6 +175,7 @@ enum CountryCode {
 	CTRY_TUNISIA = 788,
 	CTRY_TURKEY = 792,
 	CTRY_UAE = 784,
+	CTRY_UGANDA = 800,
 	CTRY_UKRAINE = 804,
 	CTRY_UNITED_KINGDOM = 826,
 	CTRY_UNITED_STATES = 840,

drivers/net/wireless/ath/regd_common.h +1 -0

@@ -467,6 +467,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
 	{CTRY_TUNISIA, ETSI3_WORLD, "TN"},
 	{CTRY_TURKEY, ETSI3_WORLD, "TR"},
+	{CTRY_UGANDA, FCC3_WORLD, "UG"},
 	{CTRY_UKRAINE, NULL1_WORLD, "UA"},
 	{CTRY_UAE, NULL1_WORLD, "AE"},
 	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},

Greg Kroah-Hartman

author maintainer

2018-08-01 18:34 UTC #117 lore raw

PATCH 122/336 ath: Add regulatory mapping for Tanzania

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 667ddac5745fb9fddfe8f7fd2523070f50bd4442 ]

Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: ETSI
* 5GHz: FCC

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

drivers/net/wireless/ath/regd.h +1 -0

@@ -170,6 +170,7 @@ enum CountryCode {
 	CTRY_SWITZERLAND = 756,
 	CTRY_SYRIA = 760,
 	CTRY_TAIWAN = 158,
+	CTRY_TANZANIA = 834,
 	CTRY_THAILAND = 764,
 	CTRY_TRINIDAD_Y_TOBAGO = 780,
 	CTRY_TUNISIA = 788,

drivers/net/wireless/ath/regd_common.h +1 -0

@@ -463,6 +463,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_SWITZERLAND, ETSI1_WORLD, "CH"},
 	{CTRY_SYRIA, NULL1_WORLD, "SY"},
 	{CTRY_TAIWAN, APL3_FCCA, "TW"},
+	{CTRY_TANZANIA, APL1_WORLD, "TZ"},
 	{CTRY_THAILAND, FCC3_WORLD, "TH"},
 	{CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
 	{CTRY_TUNISIA, ETSI3_WORLD, "TN"},

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #118 lore raw

PATCH 123/336 ath: Add regulatory mapping for Serbia

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 2a3169a54bb53717928392a04fb84deb765b51f1 ]

Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: ETSI
* 5GHz: ETSI

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

drivers/net/wireless/ath/regd.h +1 -0

@@ -159,6 +159,7 @@ enum CountryCode {
 	CTRY_ROMANIA = 642,
 	CTRY_RUSSIA = 643,
 	CTRY_SAUDI_ARABIA = 682,
+	CTRY_SERBIA = 688,
 	CTRY_SERBIA_MONTENEGRO = 891,
 	CTRY_SINGAPORE = 702,
 	CTRY_SLOVAKIA = 703,

drivers/net/wireless/ath/regd_common.h +1 -0

@@ -452,6 +452,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_ROMANIA, NULL1_WORLD, "RO"},
 	{CTRY_RUSSIA, NULL1_WORLD, "RU"},
 	{CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"},
+	{CTRY_SERBIA, ETSI1_WORLD, "RS"},
 	{CTRY_SERBIA_MONTENEGRO, ETSI1_WORLD, "CS"},
 	{CTRY_SINGAPORE, APL6_WORLD, "SG"},
 	{CTRY_SLOVAKIA, ETSI1_WORLD, "SK"},

Greg Kroah-Hartman

author maintainer

2018-08-01 18:21 UTC #119 lore raw

PATCH 124/336 ath: Add regulatory mapping for Bermuda

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 9c790f2d234f65697e3b0948adbfdf36dbe63dd7 ]

Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: FCC
* 5GHz: FCC

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

drivers/net/wireless/ath/regd.h +1 -0

@@ -74,6 +74,7 @@ enum CountryCode {
 	CTRY_BELARUS = 112,
 	CTRY_BELGIUM = 56,
 	CTRY_BELIZE = 84,
+	CTRY_BERMUDA = 60,
 	CTRY_BOLIVIA = 68,
 	CTRY_BOSNIA_HERZ = 70,
 	CTRY_BRAZIL = 76,

drivers/net/wireless/ath/regd_common.h +1 -0

@@ -313,6 +313,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_BELGIUM, ETSI1_WORLD, "BE"},
 	{CTRY_BELGIUM2, ETSI4_WORLD, "BL"},
 	{CTRY_BELIZE, APL1_ETSIC, "BZ"},
+	{CTRY_BERMUDA, FCC3_FCCA, "BM"},
 	{CTRY_BOLIVIA, APL1_ETSIC, "BO"},
 	{CTRY_BOSNIA_HERZ, ETSI1_WORLD, "BA"},
 	{CTRY_BRAZIL, FCC3_WORLD, "BR"},

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #120 lore raw

PATCH 125/336 ath: Add regulatory mapping for Bahamas

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

[ Upstream commit 699e2302c286a14afe7b7394151ce6c4e1790cc1 ]

Invalid EEPROM contents

The current CTL mappings for this country are:

* 2.4GHz: ETSI
* 5GHz: FCC

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/regd.h        |    1 +
 drivers/net/wireless/ath/regd_common.h |    1 +
 2 files changed, 2 insertions(+)

drivers/net/wireless/ath/regd.h +1 -0

@@ -68,6 +68,7 @@ enum CountryCode {
 	CTRY_AUSTRALIA = 36,
 	CTRY_AUSTRIA = 40,
 	CTRY_AZERBAIJAN = 31,
+	CTRY_BAHAMAS = 44,
 	CTRY_BAHRAIN = 48,
 	CTRY_BANGLADESH = 50,
 	CTRY_BARBADOS = 52,

drivers/net/wireless/ath/regd_common.h +1 -0

@@ -306,6 +306,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_AUSTRALIA2, FCC6_WORLD, "AU"},
 	{CTRY_AUSTRIA, ETSI1_WORLD, "AT"},
 	{CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"},
+	{CTRY_BAHAMAS, FCC3_WORLD, "BS"},
 	{CTRY_BAHRAIN, APL6_WORLD, "BH"},
 	{CTRY_BANGLADESH, NULL1_WORLD, "BD"},
 	{CTRY_BARBADOS, FCC2_WORLD, "BB"},

Greg Kroah-Hartman

author maintainer

2018-08-01 17:45 UTC #121 lore raw

PATCH 126/336 sched/cpufreq: Modify aggregate utilization to always include blocked FAIR utilization

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Patrick Bellasi <[email protected]>

[ Upstream commit 8ecf04e11283a28ca88b8b8049ac93c3a99fcd2c ]

Since the refactoring introduced by:

commit 8f111bc357aa ("cpufreq/schedutil: Rewrite CPUFREQ_RT support")

we aggregate FAIR utilization only if this class has runnable tasks.

This was mainly due to avoid the risk to stay on an high frequency just because of the blocked utilization of a CPU not being properly decayed while the CPU was idle.

However, since:

commit 31e77c93e432 ("sched/fair: Update blocked load when newly idle")

the FAIR blocked utilization is properly decayed also for IDLE CPUs.

This allows us to use the FAIR blocked utilization as a safe mechanism to gracefully reduce the frequency only if no FAIR tasks show up on a CPU for a reasonable period of time.

Moreover, we also reduce the frequency drops of CPUs running periodic tasks which, depending on the task periodicity and the time required for a frequency switch, was increasing the chances to introduce some undesirable performance variations.

Reported-by Vincent Guittot <[email protected]>

Tested-by Vincent Guittot <[email protected]>

Signed-off-by Patrick Bellasi <[email protected]>

Signed-off-by Peter Zijlstra (Intel) <[email protected]>

Reviewed-by Thomas Gleixner <[email protected]>

Acked-by Viresh Kumar <[email protected]>

Acked-by Vincent Guittot <[email protected]>

Cc Dietmar Eggemann <[email protected]>

Cc Joel Fernandes <[email protected]>

Cc Juri Lelli <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Morten Rasmussen <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Rafael J . Wysocki <[email protected]>

Cc Steve Muckle <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/sched/cpufreq_schedutil.c |   17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

kernel/sched/cpufreq_schedutil.c +8 -9

@@ -183,22 +183,21 @@ static void sugov_get_util(struct sugov_
 static unsigned long sugov_aggregate_util(struct sugov_cpu *sg_cpu)
 {
 	struct rq *rq = cpu_rq(sg_cpu->cpu);
-	unsigned long util;
 
-	if (rq->rt.rt_nr_running) {
-		util = sg_cpu->max;
-	} else {
-		util = sg_cpu->util_dl;
-		if (rq->cfs.h_nr_running)
-			util += sg_cpu->util_cfs;
-	}
+	if (rq->rt.rt_nr_running)
+		return sg_cpu->max;
 
 	/*
+	 * Utilization required by DEADLINE must always be granted while, for
+	 * FAIR, we use blocked utilization of IDLE CPUs as a mechanism to
+	 * gracefully reduce the frequency when no tasks show up for longer
+	 * periods of time.
+	 *
 	 * Ideally we would like to set util_dl as min/guaranteed freq and
 	 * util_cfs + util_dl as requested freq. However, cpufreq is not yet
 	 * ready for such an interface. So, we only do the latter for now.
 	 */
-	return min(util, sg_cpu->max);
+	return min(sg_cpu->max, (sg_cpu->util_dl + sg_cpu->util_cfs));
 }
 
 static void sugov_set_iowait_boost(struct sugov_cpu *sg_cpu, u64 time, unsigned int flags)

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #122 lore raw

PATCH 133/336 spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email protected]>

[ Upstream commit 0921e11e1e12802ae0a3c19cb02e33354ca51967 ]

According to section 59.2.4 MSIOF Receive Mode Register 1 (SIRMDR1) in the R-Car Gen3 datasheet Rev.1.00, the value of the SIRMDR1.SYNCAC bit must match the value of the SITMDR1.SYNCAC bit. However, sh_msiof_spi_setup() changes only the latter.

Fix this by updating the SIRMDR1 register like the SITMDR1 register, taking into account register bits that exist in SITMDR1 only.

Reported-by Renesas BSP team via Yoshihiro Shimoda <[email protected]>

Fixes 7ff0b53c4051145d ("spi: sh-msiof: Avoid writing to registers from spi_master.setup()")

Signed-off-by Geert Uytterhoeven <[email protected]>

Reviewed-by Simon Horman <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/spi/spi-sh-msiof.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/spi/spi-sh-msiof.c +4 -2

@@ -564,14 +564,16 @@ static int sh_msiof_spi_setup(struct spi
 
 	/* Configure native chip select mode/polarity early */
 	clr = MDR1_SYNCMD_MASK;
-	set = MDR1_TRMD | TMDR1_PCON | MDR1_SYNCMD_SPI;
+	set = MDR1_SYNCMD_SPI;
 	if (spi->mode & SPI_CS_HIGH)
 		clr |= BIT(MDR1_SYNCAC_SHIFT);
 	else
 		set |= BIT(MDR1_SYNCAC_SHIFT);
 	pm_runtime_get_sync(&p->pdev->dev);
 	tmp = sh_msiof_read(p, TMDR1) & ~clr;
-	sh_msiof_write(p, TMDR1, tmp | set);
+	sh_msiof_write(p, TMDR1, tmp | set | MDR1_TRMD | TMDR1_PCON);
+	tmp = sh_msiof_read(p, RMDR1) & ~clr;
+	sh_msiof_write(p, RMDR1, tmp | set);
 	pm_runtime_put(&p->pdev->dev);
 	p->native_cs_high = spi->mode & SPI_CS_HIGH;
 	p->native_cs_inited = true;

Greg Kroah-Hartman

author maintainer

2018-08-01 18:37 UTC #123 lore raw

PATCH 134/336 powerpc/8xx: fix invalid register expression in head_8xx.S

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <[email protected]>

[ Upstream commit e4ccb1dae6bdef228d729c076c38161ef6e7ca34 ]

New binutils generate the following warning

AS arch/powerpc/kernel/head_8xx.o
arch/powerpc/kernel/head_8xx.S: Assembler messages:
arch/powerpc/kernel/head_8xx.S:916: Warning: invalid register expression

This patch fixes it.

Signed-off-by Christophe Leroy <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/kernel/head_8xx.S |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/powerpc/kernel/head_8xx.S +1 -1

@@ -913,7 +913,7 @@ start_here:
 	tovirt(r6,r6)
 	lis	r5, abatron_pteptrs@h
 	ori	r5, r5, abatron_pteptrs@l
-	stw	r5, 0xf0(r0)	/* Must match your Abatron config file */
+	stw	r5, 0xf0(0)	/* Must match your Abatron config file */
 	tophys(r5,r5)
 	stw	r6, 0(r5)

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #124 lore raw

PATCH 135/336 pinctrl: at91-pio4: add missing of_node_put

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Julia Lawall <[email protected]>

[ Upstream commit 21816364715f508c10da1e087e352bc1e326614f ]

The device node iterators perform an of_node_get on each iteration, so a jump out of the loop requires an of_node_put.

The semantic patch that fixes this problem is as follows
(http://coccinelle.lip6.fr):

// <smpl>
@@
expression root,e;
local idexpression child;
iterator name for_each_child_of_node;
@@

for_each_child_of_node(root, child) {
... when != of_node_put(child)

       when != e = child

+ of_node_put(child);
? break;
...
}
... when != child
// </smpl>

Signed-off-by Julia Lawall <[email protected]>

Acked-by Ludovic Desroches <[email protected]>

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/pinctrl/pinctrl-at91-pio4.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/pinctrl/pinctrl-at91-pio4.c +3 -1

@@ -576,8 +576,10 @@ static int atmel_pctl_dt_node_to_map(str
 		for_each_child_of_node(np_config, np) {
 			ret = atmel_pctl_dt_subnode_to_map(pctldev, np, map,
 						    &reserved_maps, num_maps);
-			if (ret < 0)
+			if (ret < 0) {
+				of_node_put(np);
 				break;
+			}
 		}
 	}

Greg Kroah-Hartman

author maintainer

2018-08-01 18:29 UTC #125 lore raw

PATCH 136/336 pinctrl: msm: fix gpio-hog related boot issues

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Lamparter <[email protected]>

[ Upstream commit a86caa9ba5d70696ceb35d1d39caa20d8b641387 ]

Sven Eckelmann reported an issue with the current IPQ4019 pinctrl. Setting up any gpio-hog in the device-tree for his device would "kill the bootup completely":

| [    0.477838] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe
| [    0.499828] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferring probe
| [    1.298883] requesting hog GPIO enable USB2 power (chip 1000000.pinctrl, offset 58) failed, -517
| [    1.299609] gpiochip_add_data: GPIOs 0..99 (1000000.pinctrl) failed to register
| [    1.308589] ipq4019-pinctrl 1000000.pinctrl: Failed register gpiochip
| [    1.316586] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe
| [    1.322415] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferri

This was also verified on a RT-AC58U (IPQ4018) which would no longer boot, if a gpio-hog was specified. (Tried forcing the USB LED PIN (GPIO0) to high.).

The problem is that Pinctrl+GPIO registration is currently peformed in the following order in pinctrl-msm.c:
1. pinctrl_register()
2. gpiochip_add()
3. gpiochip_add_pin_range()

The actual error code -517 == -EPROBE_DEFER is coming from pinctrl_get_device_gpio_range(), which is called through:

        gpiochip_add
            of_gpiochip_add
                of_gpiochip_scan_gpios
                    gpiod_hog
                        gpiochip_request_own_desc
                            __gpiod_request
                                chip->request
                                    gpiochip_generic_request
                                       pinctrl_gpio_request
                                          pinctrl_get_device_gpio_range

pinctrl_get_device_gpio_range() is unable to find any valid pin ranges, since nothing has been added to the pinctrldev_list yet. so the range can't be found, and the operation fails with -EPROBE_DEFER.

This patch fixes the issue by adding the "gpio-ranges" property to the pinctrl device node of all upstream Qcom SoC. The pin ranges are then added by the gpio core.

In order to remain compatible with older, existing DTs (and ACPI) a check for the "gpio-ranges" property has been added to msm_gpio_init(). This prevents the driver of adding the same entry to the pinctrldev_list twice.

Reported-by Sven Eckelmann <[email protected]>

Tested-by Sven Eckelmann <[email protected]> [ipq4019]

Signed-off-by Christian Lamparter <[email protected]>

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/pinctrl/qcom/pinctrl-msm.c |   23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

drivers/pinctrl/qcom/pinctrl-msm.c +18 -5

@@ -890,11 +890,24 @@ static int msm_gpio_init(struct msm_pinc
 		return ret;
 	}
 
-	ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), 0, 0, chip->ngpio);
-	if (ret) {
-		dev_err(pctrl->dev, "Failed to add pin range\n");
-		gpiochip_remove(&pctrl->chip);
-		return ret;
+	/*
+	 * For DeviceTree-supported systems, the gpio core checks the
+	 * pinctrl's device node for the "gpio-ranges" property.
+	 * If it is present, it takes care of adding the pin ranges
+	 * for the driver. In this case the driver can skip ahead.
+	 *
+	 * In order to remain compatible with older, existing DeviceTree
+	 * files which don't set the "gpio-ranges" property or systems that
+	 * utilize ACPI the driver has to call gpiochip_add_pin_range().
+	 */
+	if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) {
+		ret = gpiochip_add_pin_range(&pctrl->chip,
+			dev_name(pctrl->dev), 0, 0, chip->ngpio);
+		if (ret) {
+			dev_err(pctrl->dev, "Failed to add pin range\n");
+			gpiochip_remove(&pctrl->chip);
+			return ret;
+		}
 	}
 
 	ret = gpiochip_irqchip_add(chip,

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #126 lore raw

PATCH 137/336 bpf: fix multi-function JITed dump obtained via syscall

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sandipan Das <[email protected]>

[ Upstream commit 4d56a76ead2fcd856e677cdc9445ad331a409b8c ]

Currently, for multi-function programs, we cannot get the JITed instructions using the bpf system call's BPF_OBJ_GET_INFO_BY_FD command. Because of this, userspace tools such as bpftool fail to identify a multi-function program as being JITed or not.

With the JIT enabled and the test program running, this can be verified as follows:

  # cat /proc/sys/net/core/bpf_jit_enable
  1

Before applying this patch:

  # bpftool prog list
  1: kprobe  name foo  tag b811aab41a39ad3d  gpl
          loaded_at 2018-05-16T11:43:38+0530  uid 0
          xlated 216B  not jited  memlock 65536B
  ...

  # bpftool prog dump jited id 1
  no instructions returned

After applying this patch:

  # bpftool prog list
  1: kprobe  name foo  tag b811aab41a39ad3d  gpl
          loaded_at 2018-05-16T12:13:01+0530  uid 0
          xlated 216B  jited 308B  memlock 65536B
  ...

  # bpftool prog dump jited id 1
     0:   nop
     4:   nop
     8:   mflr    r0
     c:   std     r0,16(r1)
    10:   stdu    r1,-112(r1)
    14:   std     r31,104(r1)
    18:   addi    r31,r1,48
    1c:   li      r3,10
  ...

Signed-off-by Sandipan Das <[email protected]>

Signed-off-by Daniel Borkmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/bpf/syscall.c |   37 ++++++++++++++++++++++++++++++++++---
 1 file changed, 34 insertions(+), 3 deletions(-)

kernel/bpf/syscall.c +34 -3

@@ -1946,13 +1946,44 @@ static int bpf_prog_get_info_by_fd(struc
 	 * for offload.
 	 */
 	ulen = info.jited_prog_len;
-	info.jited_prog_len = prog->jited_len;
+	if (prog->aux->func_cnt) {
+		u32 i;
+
+		info.jited_prog_len = 0;
+		for (i = 0; i < prog->aux->func_cnt; i++)
+			info.jited_prog_len += prog->aux->func[i]->jited_len;
+	} else {
+		info.jited_prog_len = prog->jited_len;
+	}
+
 	if (info.jited_prog_len && ulen) {
 		if (bpf_dump_raw_ok()) {
 			uinsns = u64_to_user_ptr(info.jited_prog_insns);
 			ulen = min_t(u32, info.jited_prog_len, ulen);
-			if (copy_to_user(uinsns, prog->bpf_func, ulen))
-				return -EFAULT;
+
+			/* for multi-function programs, copy the JITed
+			 * instructions for all the functions
+			 */
+			if (prog->aux->func_cnt) {
+				u32 len, free, i;
+				u8 *img;
+
+				free = ulen;
+				for (i = 0; i < prog->aux->func_cnt; i++) {
+					len = prog->aux->func[i]->jited_len;
+					len = min_t(u32, len, free);
+					img = (u8 *) prog->aux->func[i]->bpf_func;
+					if (copy_to_user(uinsns, img, len))
+						return -EFAULT;
+					uinsns += len;
+					free -= len;
+					if (!free)
+						break;
+				}
+			} else {
+				if (copy_to_user(uinsns, prog->bpf_func, ulen))
+					return -EFAULT;
+			}
 		} else {
 			info.jited_prog_insns = 0;
 		}

Greg Kroah-Hartman

author maintainer

2018-08-01 18:26 UTC #127 lore raw

PATCH 138/336 bpf: powerpc64: pad function address loads with NOPs

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sandipan Das <[email protected]>

[ Upstream commit 4ea69b2fd623dee2bbc77d3b6b7d8c0924e2026a ]

For multi-function programs, loading the address of a callee function to a register requires emitting instructions whose count varies from one to five depending on the nature of the address.

Since we come to know of the callee's address only before the extra pass, the number of instructions required to load this address may vary from what was previously generated. This can make the JITed image grow or shrink.

To avoid this, we should generate a constant five-instruction when loading function addresses by padding the optimized load sequence with NOPs.

Signed-off-by Sandipan Das <[email protected]>

Signed-off-by Daniel Borkmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/net/bpf_jit_comp64.c |   34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

arch/powerpc/net/bpf_jit_comp64.c +23 ~~-11~~

@@ -202,25 +202,37 @@ static void bpf_jit_build_epilogue(u32 *
 
 static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func)
 {
+	unsigned int i, ctx_idx = ctx->idx;
+
+	/* Load function address into r12 */
+	PPC_LI64(12, func);
+
+	/* For bpf-to-bpf function calls, the callee's address is unknown
+	 * until the last extra pass. As seen above, we use PPC_LI64() to
+	 * load the callee's address, but this may optimize the number of
+	 * instructions required based on the nature of the address.
+	 *
+	 * Since we don't want the number of instructions emitted to change,
+	 * we pad the optimized PPC_LI64() call with NOPs to guarantee that
+	 * we always have a five-instruction sequence, which is the maximum
+	 * that PPC_LI64() can emit.
+	 */
+	for (i = ctx->idx - ctx_idx; i < 5; i++)
+		PPC_NOP();
+
 #ifdef PPC64_ELF_ABI_v1
-	/* func points to the function descriptor */
-	PPC_LI64(b2p[TMP_REG_2], func);
-	/* Load actual entry point from function descriptor */
-	PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0);
-	/* ... and move it to LR */
-	PPC_MTLR(b2p[TMP_REG_1]);
 	/*
 	 * Load TOC from function descriptor at offset 8.
 	 * We can clobber r2 since we get called through a
 	 * function pointer (so caller will save/restore r2)
 	 * and since we don't use a TOC ourself.
 	 */
-	PPC_BPF_LL(2, b2p[TMP_REG_2], 8);
-#else
-	/* We can clobber r12 */
-	PPC_FUNC_ADDR(12, func);
-	PPC_MTLR(12);
+	PPC_BPF_LL(2, 12, 8);
+	/* Load actual entry point from function descriptor */
+	PPC_BPF_LL(12, 12, 0);
 #endif
+
+	PPC_MTLR(12);
 	PPC_BLRL();
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #128 lore raw

PATCH 139/336 PCI: pciehp: Request control of native hotplug only if supported

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mika Westerberg <[email protected]>

[ Upstream commit 408fec36a1ab3d14273c2116b449ef1e9be3cb8b ]

Currently we request control of native PCIe hotplug unconditionally. Native PCIe hotplug events are handled by the pciehp driver, and if it is not enabled those events will be lost.

Request control of native PCIe hotplug only if the pciehp driver is enabled, so we will actually handle native PCIe hotplug events.

Signed-off-by Mika Westerberg <[email protected]>

Reviewed-by Rafael J. Wysocki <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/acpi/pci_root.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/acpi/pci_root.c +3 -1

@@ -472,9 +472,11 @@ static void negotiate_os_control(struct
 	}
 
 	control = OSC_PCI_EXPRESS_CAPABILITY_CONTROL
-		| OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
 		| OSC_PCI_EXPRESS_PME_CONTROL;
 
+	if (IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
+		control |= OSC_PCI_EXPRESS_NATIVE_HP_CONTROL;
+
 	if (pci_aer_available()) {
 		if (aer_acpi_firmware_first())
 			dev_info(&device->dev,

Greg Kroah-Hartman

author maintainer

2018-08-01 18:25 UTC #129 lore raw

PATCH 141/336 mwifiex: correct histogram data with appropriate index

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xinming Hu <[email protected]>

[ Upstream commit 30bfce0b63fa68c14ae1613eb9d259fa18644074 ]

Correct snr/nr/rssi data index to avoid possible buffer underflow.

Signed-off-by Xinming Hu <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/marvell/mwifiex/util.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

drivers/net/wireless/marvell/mwifiex/util.c +5 -3

@@ -708,12 +708,14 @@ void mwifiex_hist_data_set(struct mwifie
 			   s8 nflr)
 {
 	struct mwifiex_histogram_data *phist_data = priv->hist_data;
+	s8 nf   = -nflr;
+	s8 rssi = snr - nflr;
 
 	atomic_inc(&phist_data->num_samples);
 	atomic_inc(&phist_data->rx_rate[rx_rate]);
-	atomic_inc(&phist_data->snr[snr]);
-	atomic_inc(&phist_data->noise_flr[128 + nflr]);
-	atomic_inc(&phist_data->sig_str[nflr - snr]);
+	atomic_inc(&phist_data->snr[snr + 128]);
+	atomic_inc(&phist_data->noise_flr[nf + 128]);
+	atomic_inc(&phist_data->sig_str[rssi + 128]);
 }
 
 /* function to reset histogram data during init/reset */

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #130 lore raw

PATCH 142/336 mt76x2: apply coverage class on slot time too

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <[email protected]>

[ Upstream commit 0d45d3fe42efc76b6c4f5a62f8d110c7a2e6f83f ]

According to 802.11-2007 17.3.8.6 (slot time), the slot time should be increased by 3 us * coverage class. Taking into account coverage class in slot time configuration allows to increase by an order of magnitude the throughput on a 4Km link in a noisy environment

Tested-by Luca Bisti <[email protected]>

Tested-by Gaetano Catalli <[email protected]>

Signed-off-by Lorenzo Bianconi <[email protected]>

Acked-by Felix Fietkau <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/mediatek/mt76/mt76x2_init.c |    3 +++
 drivers/net/wireless/mediatek/mt76/mt76x2_main.c |    3 +--
 2 files changed, 4 insertions(+), 2 deletions(-)

drivers/net/wireless/mediatek/mt76/mt76x2_init.c +3 -0

@@ -482,7 +482,10 @@ void mt76x2_set_tx_ackto(struct mt76x2_d
 {
 	u8 ackto, sifs, slottime = dev->slottime;
 
+	/* As defined by IEEE 802.11-2007 17.3.8.6 */
 	slottime += 3 * dev->coverage_class;
+	mt76_rmw_field(dev, MT_BKOFF_SLOT_CFG,
+		       MT_BKOFF_SLOT_CFG_SLOTTIME, slottime);
 
 	sifs = mt76_get_field(dev, MT_XIFS_TIME_CFG,
 			      MT_XIFS_TIME_CFG_OFDM_SIFS);

drivers/net/wireless/mediatek/mt76/mt76x2_main.c +1 -2

@@ -247,8 +247,7 @@ mt76x2_bss_info_changed(struct ieee80211
 		int slottime = info->use_short_slot ? 9 : 20;
 
 		dev->slottime = slottime;
-		mt76_rmw_field(dev, MT_BKOFF_SLOT_CFG,
-			       MT_BKOFF_SLOT_CFG_SLOTTIME, slottime);
+		mt76x2_set_tx_ackto(dev);
 	}
 
 	mutex_unlock(&dev->mutex);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:47 UTC #131 lore raw

PATCH 143/336 ima: based on policy verify firmware signatures (pre-allocated buffer)

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <[email protected]>

[ Upstream commit fd90bc559bfba743ae8de87ff23b92a5e4668062 ]

Don't differentiate, for now, between kernel_read_file_id READING_FIRMWARE and READING_FIRMWARE_PREALLOC_BUFFER enumerations.

Fixes a098ecd firmware: support loading into a pre-allocated buffer (since 4.8)

Signed-off-by Mimi Zohar <[email protected]>

Cc Luis R. Rodriguez <[email protected]>

Cc David Howells <[email protected]>

Cc Kees Cook <[email protected]>

Cc Serge E. Hallyn <[email protected]>

Cc Stephen Boyd <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 security/integrity/ima/ima_main.c |    1 +
 1 file changed, 1 insertion(+)

security/integrity/ima/ima_main.c +1 -0

@@ -449,6 +449,7 @@ int ima_read_file(struct file *file, enu
 
 static int read_idmap[READING_MAX_ID] = {
 	[READING_FIRMWARE] = FIRMWARE_CHECK,
+	[READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK,
 	[READING_MODULE] = MODULE_CHECK,
 	[READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,
 	[READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,

Greg Kroah-Hartman

author maintainer

2018-08-01 18:33 UTC #132 lore raw

PATCH 144/336 watchdog: renesas-wdt: Add support for the R8A77965 WDT

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wolfram Sang <[email protected]>

[ Upstream commit b1eb8fedc01499132ced4b2a44b3ab3855c4e681 ]

Document support for the Watchdog Timer (WDT) Controller in the Renesas R-Car M3-N (R8A77965) SoC. No driver update is needed.

Signed-off-by Takeshi Kihara <[email protected]>

[wsa: rebased to v4.17-rc3]

Signed-off-by Wolfram Sang <[email protected]>

Reviewed-by Geert Uytterhoeven <[email protected]>

Reviewed-by Guenter Roeck <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

Signed-off-by Wim Van Sebroeck <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 Documentation/devicetree/bindings/watchdog/renesas-wdt.txt |    1 +
 1 file changed, 1 insertion(+)

Documentation/devicetree/bindings/watchdog/renesas-wdt.txt +1 -0

@@ -7,6 +7,7 @@ Required properties:
 	         - "renesas,r7s72100-wdt" (RZ/A1)
 	         - "renesas,r8a7795-wdt" (R-Car H3)
 	         - "renesas,r8a7796-wdt" (R-Car M3-W)
+		 - "renesas,r8a77965-wdt" (R-Car M3-N)
 	         - "renesas,r8a77970-wdt" (R-Car V3M)
 	         - "renesas,r8a77995-wdt" (R-Car D3)

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #133 lore raw

PATCH 145/336 drivers/perf: arm-ccn: dont log to dmesg in event_init

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mark Rutland <[email protected]>

[ Upstream commit 1898eb61fbc9703efee886d3abec27a388cf28c3 ]

The ARM CCN PMU driver uses dev_warn() to complain about parameters in the user-provided perf_event_attr. This means that under normal operation (e.g. a single invocation of the perf tool), a number of messages warnings may be logged to dmesg.

Tools may issue multiple syscalls to probe for feature support, and multiple applications (from multiple users) can attempt to open events simultaneously, so this is not very helpful, even if a user happens to have access to dmesg. Worse, this can push important information out of the dmesg ring buffer, and can significantly slow down syscall fuzzers, vastly increasing the time it takes to find critical bugs.

Demote the dev_warn() instances to dev_dbg(), as is the case for all other PMU drivers under drivers/perf/. Users who wish to debug PMU event initialisation can enable dynamic debug to receive these messages.

Signed-off-by Mark Rutland <[email protected]>

Cc Pawel Moll <[email protected]>

Cc Will Deacon <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/perf/arm-ccn.c |   20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

drivers/perf/arm-ccn.c +10 ~~-10~~

@@ -736,7 +736,7 @@ static int arm_ccn_pmu_event_init(struct
 	ccn = pmu_to_arm_ccn(event->pmu);
 
 	if (hw->sample_period) {
-		dev_warn(ccn->dev, "Sampling not supported!\n");
+		dev_dbg(ccn->dev, "Sampling not supported!\n");
 		return -EOPNOTSUPP;
 	}

@@ -744,12 +744,12 @@ static int arm_ccn_pmu_event_init(struct
 			event->attr.exclude_kernel || event->attr.exclude_hv ||
 			event->attr.exclude_idle || event->attr.exclude_host ||
 			event->attr.exclude_guest) {
-		dev_warn(ccn->dev, "Can't exclude execution levels!\n");
+		dev_dbg(ccn->dev, "Can't exclude execution levels!\n");
 		return -EINVAL;
 	}
 
 	if (event->cpu < 0) {
-		dev_warn(ccn->dev, "Can't provide per-task data!\n");
+		dev_dbg(ccn->dev, "Can't provide per-task data!\n");
 		return -EOPNOTSUPP;
 	}
 	/*

@@ -771,13 +771,13 @@ static int arm_ccn_pmu_event_init(struct
 	switch (type) {
 	case CCN_TYPE_MN:
 		if (node_xp != ccn->mn_id) {
-			dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
+			dev_dbg(ccn->dev, "Invalid MN ID %d!\n", node_xp);
 			return -EINVAL;
 		}
 		break;
 	case CCN_TYPE_XP:
 		if (node_xp >= ccn->num_xps) {
-			dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
+			dev_dbg(ccn->dev, "Invalid XP ID %d!\n", node_xp);
 			return -EINVAL;
 		}
 		break;

@@ -785,11 +785,11 @@ static int arm_ccn_pmu_event_init(struct
 		break;
 	default:
 		if (node_xp >= ccn->num_nodes) {
-			dev_warn(ccn->dev, "Invalid node ID %d!\n", node_xp);
+			dev_dbg(ccn->dev, "Invalid node ID %d!\n", node_xp);
 			return -EINVAL;
 		}
 		if (!arm_ccn_pmu_type_eq(type, ccn->node[node_xp].type)) {
-			dev_warn(ccn->dev, "Invalid type 0x%x for node %d!\n",
+			dev_dbg(ccn->dev, "Invalid type 0x%x for node %d!\n",
 					type, node_xp);
 			return -EINVAL;
 		}

@@ -808,19 +808,19 @@ static int arm_ccn_pmu_event_init(struct
 		if (event_id != e->event)
 			continue;
 		if (e->num_ports && port >= e->num_ports) {
-			dev_warn(ccn->dev, "Invalid port %d for node/XP %d!\n",
+			dev_dbg(ccn->dev, "Invalid port %d for node/XP %d!\n",
 					port, node_xp);
 			return -EINVAL;
 		}
 		if (e->num_vcs && vc >= e->num_vcs) {
-			dev_warn(ccn->dev, "Invalid vc %d for node/XP %d!\n",
+			dev_dbg(ccn->dev, "Invalid vc %d for node/XP %d!\n",
 					vc, node_xp);
 			return -EINVAL;
 		}
 		valid = 1;
 	}
 	if (!valid) {
-		dev_warn(ccn->dev, "Invalid event 0x%x for node/XP %d!\n",
+		dev_dbg(ccn->dev, "Invalid event 0x%x for node/XP %d!\n",
 				event_id, node_xp);
 		return -EINVAL;
 	}

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #134 lore raw

PATCH 146/336 spi: Add missing pm_runtime_put_noidle() after failed get

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <[email protected]>

[ Upstream commit 7e48e23a1f4a50f93ac1073f1326e0a73829b631 ]

If pm_runtime_get_sync() fails we should call pm_runtime_put_noidle(). This is probably not a critical fix as we should only hit this when things are broken elsewhere.

Signed-off-by Tony Lindgren <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/spi/spi.c |    1 +
 1 file changed, 1 insertion(+)

drivers/spi/spi.c +1 -0

@@ -1222,6 +1222,7 @@ static void __spi_pump_messages(struct s
 	if (!was_busy && ctlr->auto_runtime_pm) {
 		ret = pm_runtime_get_sync(ctlr->dev.parent);
 		if (ret < 0) {
+			pm_runtime_put_noidle(ctlr->dev.parent);
 			dev_err(&ctlr->dev, "Failed to power device: %d\n",
 				ret);
 			mutex_unlock(&ctlr->io_mutex);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:20 UTC #135 lore raw

PATCH 147/336 net: hns3: Fix for CMDQ and Misc. interrupt init order problem

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yunsheng Lin <[email protected]>

[ Upstream commit eddf04626d1d6d0bcd01ac6a287e49f5ddb90a26 ]

When vf module is loading, the cmd queue initialization should happen before misc interrupt initialization, otherwise the misc interrupt handle will cause using uninitialized cmd queue problem. There is also the same issue when vf module is unloading.

This patch fixes it by adjusting the location of some function.

Fixes e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")

Signed-off-by Peng Li <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c |   16 +++++++-------
 1 file changed, 8 insertions(+), 8 deletions(-)

drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +8 -8

@@ -1631,6 +1631,10 @@ static int hclgevf_init_hdev(struct hclg
 
 	hclgevf_state_init(hdev);
 
+	ret = hclgevf_cmd_init(hdev);
+	if (ret)
+		goto err_cmd_init;
+
 	ret = hclgevf_misc_irq_init(hdev);
 	if (ret) {
 		dev_err(&pdev->dev, "failed(%d) to init Misc IRQ(vector0)\n",

@@ -1638,10 +1642,6 @@ static int hclgevf_init_hdev(struct hclg
 		goto err_misc_irq_init;
 	}
 
-	ret = hclgevf_cmd_init(hdev);
-	if (ret)
-		goto err_cmd_init;
-
 	ret = hclgevf_configure(hdev);
 	if (ret) {
 		dev_err(&pdev->dev, "failed(%d) to fetch configuration\n", ret);

@@ -1689,10 +1689,10 @@ static int hclgevf_init_hdev(struct hclg
 	return 0;
 
 err_config:
-	hclgevf_cmd_uninit(hdev);
-err_cmd_init:
 	hclgevf_misc_irq_uninit(hdev);
 err_misc_irq_init:
+	hclgevf_cmd_uninit(hdev);
+err_cmd_init:
 	hclgevf_state_uninit(hdev);
 	hclgevf_uninit_msi(hdev);
 err_irq_init:

@@ -1702,9 +1702,9 @@ err_irq_init:
 
 static void hclgevf_uninit_hdev(struct hclgevf_dev *hdev)
 {
-	hclgevf_cmd_uninit(hdev);
-	hclgevf_misc_irq_uninit(hdev);
 	hclgevf_state_uninit(hdev);
+	hclgevf_misc_irq_uninit(hdev);
+	hclgevf_cmd_uninit(hdev);
 	hclgevf_uninit_msi(hdev);
 	hclgevf_pci_uninit(hdev);
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #136 lore raw

PATCH 148/336 net: hns3: Fix the missing client list node initialization

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xi Wang <[email protected]>

[ Upstream commit 13562d1f5e2fbe2cf33b23a00abca3f71264c4ac ]

This patch fixes the missing initialization of the client list node in the hnae3_register_client() function.

Fixes 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")

Signed-off-by Xi Wang <[email protected]>

Signed-off-by Peng Li <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +2 -0

@@ -3602,6 +3602,8 @@ static int __init hns3_init_module(void)
 
 	client.ops = &client_ops;
 
+	INIT_LIST_HEAD(&client.node);
+
 	ret = hnae3_register_client(&client);
 	if (ret)
 		return ret;

Greg Kroah-Hartman

author maintainer

2018-08-01 18:32 UTC #137 lore raw

PATCH 149/336 net: hns3: Fix for hns3 module is loaded multiple times problem

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xi Wang <[email protected]>

[ Upstream commit 3c7624d8fc0b893b644b945ab904c629ebc9611e ]

If the hns3 driver has been built into kernel and then loaded with the same driver which built as KLM, it may trigger an error like below:

[   20.009555] hns3: Hisilicon Ethernet Network Driver for Hip08 Family - version
[   20.016789] hns3: Copyright (c) 2017 Huawei Corporation.
[   20.022100] Error: Driver 'hns3' is already registered, aborting...
[   23.517397] Unable to handle kernel NULL pointer dereference at virtual address 00000000
...
[   23.691583] Process insmod (pid: 1982, stack limit = 0x00000000cd5f21cb)
[   23.698270] Call trace:
[   23.700705]  __list_del_entry_valid+0x2c/0xd8
[   23.705049]  hnae3_unregister_client+0x68/0xa8
[   23.709487]  hns3_init_module+0x98/0x1000 [hns3]
[   23.714093]  do_one_initcall+0x5c/0x170
[   23.717918]  do_init_module+0x64/0x1f4
[   23.721654]  load_module+0x1d14/0x24b0
[   23.725390]  SyS_init_module+0x158/0x208
[   23.729300]  el0_svc_naked+0x30/0x34

This patch fixes it by adding module version info.

Fixes 38caee9d3ee8 ("net: hns3: Add support of the HNAE3 framework")

Signed-off-by Xi Wang <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hnae3.c               |    1 +
 drivers/net/ethernet/hisilicon/hns3/hnae3.h               |    2 ++
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c           |    1 +
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.h           |    2 ++
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h   |    2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h |    2 +-
 6 files changed, 8 insertions(+), 2 deletions(-)

drivers/net/ethernet/hisilicon/hns3/hnae3.c +1 -0

@@ -283,3 +283,4 @@ EXPORT_SYMBOL(hnae3_unregister_ae_dev);
 MODULE_AUTHOR("Huawei Tech. Co., Ltd.");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("HNAE3(Hisilicon Network Acceleration Engine) Framework");
+MODULE_VERSION(HNAE3_MOD_VERSION);

drivers/net/ethernet/hisilicon/hns3/hnae3.h +2 -0

@@ -36,6 +36,8 @@
 #include <linux/pci.h>
 #include <linux/types.h>
 
+#define HNAE3_MOD_VERSION "1.0"
+
 /* Device IDs */
 #define HNAE3_DEV_ID_GE				0xA220
 #define HNAE3_DEV_ID_25GE			0xA221

drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +1 -0

@@ -3631,3 +3631,4 @@ MODULE_DESCRIPTION("HNS3: Hisilicon Ethe
 MODULE_AUTHOR("Huawei Tech. Co., Ltd.");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("pci:hns-nic");
+MODULE_VERSION(HNS3_MOD_VERSION);

drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +2 -0

@@ -14,6 +14,8 @@
 
 #include "hnae3.h"
 
+#define HNS3_MOD_VERSION "1.0"
+
 extern const char hns3_driver_version[];
 
 enum hns3_nic_state {

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +1 -1

@@ -15,7 +15,7 @@
 #include "hclge_cmd.h"
 #include "hnae3.h"
 
-#define HCLGE_MOD_VERSION "v1.0"
+#define HCLGE_MOD_VERSION "1.0"
 #define HCLGE_DRIVER_NAME "hclge"
 
 #define HCLGE_INVALID_VPORT 0xffff

drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +1 -1

@@ -9,7 +9,7 @@
 #include "hclgevf_cmd.h"
 #include "hnae3.h"
 
-#define HCLGEVF_MOD_VERSION "v1.0"
+#define HCLGEVF_MOD_VERSION "1.0"
 #define HCLGEVF_DRIVER_NAME "hclgevf"
 
 #define HCLGEVF_ROCEE_VECTOR_NUM	0

Greg Kroah-Hartman

author maintainer

2018-08-01 18:28 UTC #138 lore raw

PATCH 150/336 fscrypt: use unbound workqueue for decryption

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Biggers <[email protected]>

[ Upstream commit 36dd26e0c8d42699eeba87431246c07c28075bae ]

Improve fscrypt read performance by switching the decryption workqueue from bound to unbound. With the bound workqueue, when multiple bios completed on the same CPU, they were decrypted on that same CPU. But with the unbound queue, they are now decrypted in parallel on any CPU.

Although fscrypt read performance can be tough to measure due to the many sources of variation, this change is most beneficial when decryption is slow, e.g. on CPUs without AES instructions. For example, I timed tarring up encrypted directories on f2fs. On x86 with AES-NI instructions disabled, the unbound workqueue improved performance by about 25-35%, using 1 to NUM_CPUs jobs with 4 or 8 CPUs available. But with AES-NI enabled, performance was unchanged to within ~2%.

I also did the same test on a quad-core ARM CPU using xts-speck128-neon encryption. There performance was usually about 10% better with the unbound workqueue, bringing it closer to the unencrypted speed.

The unbound workqueue may be worse in some cases due to worse locality, but I think it's still the better default. dm-crypt uses an unbound workqueue by default too, so this change makes fscrypt match.

Signed-off-by Eric Biggers <[email protected]>

Signed-off-by Theodore Ts'o <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/crypto/crypto.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

fs/crypto/crypto.c +10 -1

@@ -427,8 +427,17 @@ fail:
  */
 static int __init fscrypt_init(void)
 {
+	/*
+	 * Use an unbound workqueue to allow bios to be decrypted in parallel
+	 * even when they happen to complete on the same CPU.  This sacrifices
+	 * locality, but it's worthwhile since decryption is CPU-intensive.
+	 *
+	 * Also use a high-priority workqueue to prioritize decryption work,
+	 * which blocks reads from completing, over regular application tasks.
+	 */
 	fscrypt_read_workqueue = alloc_workqueue("fscrypt_read_queue",
-							WQ_HIGHPRI, 0);
+						 WQ_UNBOUND | WQ_HIGHPRI,
+						 num_online_cpus());
 	if (!fscrypt_read_workqueue)
 		goto fail;

Greg Kroah-Hartman

author maintainer

2018-08-01 18:22 UTC #139 lore raw

PATCH 151/336 net: mvpp2: Add missing VLAN tag detection

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maxime Chevallier <[email protected]>

[ Upstream commit 62c8a069b510d905039abd4097434f190a316941 ]

Marvell PPv2 Header Parser sets some bits in the 'result_info' field in each lookup iteration, to identify different packet attributes such as DSA / VLAN tag, protocol infos, etc. This is used in further classification stages in the controller.

It's the DSA tag detection entry that is in charge of detecting when there is a single VLAN tag.

This commits adds the missing update of the result_info in this case.

Signed-off-by Maxime Chevallier <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/marvell/mvpp2.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/net/ethernet/marvell/mvpp2.c +3 -0

@@ -2109,6 +2109,9 @@ static void mvpp2_prs_dsa_tag_set(struct
 				mvpp2_prs_sram_ai_update(&pe, 0,
 							MVPP2_PRS_SRAM_AI_MASK);
 
+			/* Set result info bits to 'single vlan' */
+			mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_VLAN_SINGLE,
+						 MVPP2_PRS_RI_VLAN_MASK);
 			/* If packet is tagged continue check vid filtering */
 			mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_VID);
 		} else {

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #140 lore raw

PATCH 152/336 scsi: ufs: ufshcd: fix possible unclocked register access

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Subhash Jadavani <[email protected]>

[ Upstream commit b334456ec2021b1addc19806990115e69ec4ac32 ]

Vendor specific setup_clocks ops may depend on clocks managed by ufshcd driver so if the vendor specific setup_clocks callback is called when the required clocks are turned off, it results into unclocked register access.

This change make sure that required clocks are enabled before vendor specific setup_clocks callback is called.

Signed-off-by Subhash Jadavani <[email protected]>

Signed-off-by Venkat Gopalakrishnan <[email protected]>

Signed-off-by Can Guo <[email protected]>

Signed-off-by Asutosh Das <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/scsi/ufs/ufshcd.c |   26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

drivers/scsi/ufs/ufshcd.c +20 -6

@@ -6799,9 +6799,16 @@ static int __ufshcd_setup_clocks(struct
 	if (list_empty(head))
 		goto out;
 
-	ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE);
-	if (ret)
-		return ret;
+	/*
+	 * vendor specific setup_clocks ops may depend on clocks managed by
+	 * this standard driver hence call the vendor specific setup_clocks
+	 * before disabling the clocks managed here.
+	 */
+	if (!on) {
+		ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE);
+		if (ret)
+			return ret;
+	}
 
 	list_for_each_entry(clki, head, list) {
 		if (!IS_ERR_OR_NULL(clki->clk)) {

@@ -6825,9 +6832,16 @@ static int __ufshcd_setup_clocks(struct
 		}
 	}
 
-	ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE);
-	if (ret)
-		return ret;
+	/*
+	 * vendor specific setup_clocks ops may depend on clocks managed by
+	 * this standard driver hence call the vendor specific setup_clocks
+	 * after enabling the clocks managed here.
+	 */
+	if (on) {
+		ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE);
+		if (ret)
+			return ret;
+	}
 
 out:
 	if (ret) {

Greg Kroah-Hartman

author maintainer

2018-08-01 18:27 UTC #141 lore raw

PATCH 153/336 scsi: ufs: fix exception event handling

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maya Erez <[email protected]>

[ Upstream commit 2e3611e9546c2ed4def152a51dfd34e8dddae7a5 ]

The device can set the exception event bit in one of the response UPIU, for example to notify the need for urgent BKOPs operation. In such a case, the host driver calls ufshcd_exception_event_handler to handle this notification. When trying to check the exception event status (for finding the cause for the exception event), the device may be busy with additional SCSI commands handling and may not respond within the 100ms timeout.

To prevent that, we need to block SCSI commands during handling of exception events and allow retransmissions of the query requests, in case of timeout.

Signed-off-by Subhash Jadavani <[email protected]>

Signed-off-by Maya Erez <[email protected]>

Signed-off-by Can Guo <[email protected]>

Signed-off-by Asutosh Das <[email protected]>

Reviewed-by Subhash Jadavani <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/scsi/ufs/ufshcd.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/scsi/ufs/ufshcd.c +2 -0

@@ -4969,6 +4969,7 @@ static void ufshcd_exception_event_handl
 	hba = container_of(work, struct ufs_hba, eeh_work);
 
 	pm_runtime_get_sync(hba->dev);
+	scsi_block_requests(hba->host);
 	err = ufshcd_get_ee_status(hba, &status);
 	if (err) {
 		dev_err(hba->dev, "%s: failed to get exception status %d\n",

@@ -4982,6 +4983,7 @@ static void ufshcd_exception_event_handl
 		ufshcd_bkops_exception_event_handler(hba);
 
 out:
+	scsi_unblock_requests(hba->host);
 	pm_runtime_put_sync(hba->dev);
 	return;
 }

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #142 lore raw

PATCH 154/336 scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jens Remus <[email protected]>

[ Upstream commit 9e156c54ace310ce7fb1cd960e62416947f3d47c ]

Otherwise iterating with list_for_each() over the adapter->erp_ready_head and adapter->erp_running_head lists can lead to an infinite loop. See commit "zfcp: fix infinite iteration on erp_ready_head list".

The run-time check is only performed for debug kernels which have the kernel lock validator enabled. Following is an example of the warning that is reported, if the ERP lock is not held when calling zfcp_dbf_rec_trig():

WARNING: CPU: 0 PID: 604 at drivers/s390/scsi/zfcp_dbf.c:288 zfcp_dbf_rec_trig+0x172/0x188
Modules linked in: ...
CPU: 0 PID: 604 Comm: kworker/u128:3 Not tainted 4.16.0-... #1
Hardware name: IBM 2964 N96 702 (z/VM 6.4.0)
Workqueue: zfcp_q_0.0.1906 zfcp_scsi_rport_work
Krnl PSW : 00000000330fdbf9 00000000367e9728 (zfcp_dbf_rec_trig+0x172/0x188)
           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
Krnl GPRS: 00000000c57a5d99 3288200000000000 0000000000000000 000000006cc82740
           00000000009d09d6 0000000000000000 00000000000000ff 0000000000000000
           0000000000000000 0000000000e1b5fe 000000006de01d38 0000000076130958
           000000006cc82548 000000006de01a98 00000000009d09d6 000000006a6d3c80
Krnl Code: 00000000009d0ad2: eb7ff0b80004        lmg        %r7,%r15,184(%r15)
           00000000009d0ad8: c0f4000d7dd0        brcl       15,b80678
          #00000000009d0ade: a7f40001            brc        15,9d0ae0
          >00000000009d0ae2: a7f4ff7d            brc        15,9d09dc
           00000000009d0ae6: e340f0f00004        lg         %r4,240(%r15)
           00000000009d0aec: eb7ff0b80004        lmg        %r7,%r15,184(%r15)
           00000000009d0af2: 07f4                bcr        15,%r4
           00000000009d0af4: 0707                bcr        0,%r7
Call Trace:
([<00000000009d09d6>] zfcp_dbf_rec_trig+0x66/0x188)
 [<00000000009dd740>] zfcp_scsi_rport_work+0x98/0x190
 [<0000000000169b34>] process_one_work+0x3d4/0x6f8
 [<000000000016a08a>] worker_thread+0x232/0x418
 [<000000000017219e>] kthread+0x166/0x178
 [<0000000000b815ea>] kernel_thread_starter+0x6/0xc
 [<0000000000b815e4>] kernel_thread_starter+0x0/0xc
2 locks held by kworker/u128:3/604:
 #0:  ((wq_completion)name){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8
 #1:  ((work_completion)(&port->rport_work)){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8
Last Breaking-Event-Address:
 [<00000000009d0ade>] zfcp_dbf_rec_trig+0x16e/0x188
---[ end trace b2f4020572e2c124 ]---

Signed-off-by Jens Remus <[email protected]>

Reviewed-by Benjamin Block <[email protected]>

Reviewed-by Steffen Maier <[email protected]>

Signed-off-by Steffen Maier <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/s390/scsi/zfcp_dbf.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/s390/scsi/zfcp_dbf.c +2 -0

@@ -285,6 +285,8 @@ void zfcp_dbf_rec_trig(char *tag, struct
 	struct list_head *entry;
 	unsigned long flags;
 
+	lockdep_assert_held(&adapter->erp_lock);
+
 	if (unlikely(!debug_level_enabled(dbf->rec, level)))
 		return;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #143 lore raw

PATCH 155/336 drm/nouveau: remove fence wait code from deferred client work handler

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

[ Upstream commit 11e451e74050d9e9030581ce40337838acfcea5b ]

Fences attached to deferred client work items now originate from channels belonging to the client, meaning we can be certain they've been signalled before we destroy a client.

This closes a race that could happen if the dma_fence_wait_timeout() call didn't succeed. When the fence was later signalled, a use-after-free was possible.

Signed-off-by Ben Skeggs <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/nouveau/nouveau_drm.c |   30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

drivers/gpu/drm/nouveau/nouveau_drm.c +14 ~~-16~~

@@ -116,24 +116,22 @@ nouveau_name(struct drm_device *dev)
 }
 
 static inline bool
-nouveau_cli_work_ready(struct dma_fence *fence, bool wait)
+nouveau_cli_work_ready(struct dma_fence *fence)
 {
-	if (!dma_fence_is_signaled(fence)) {
-		if (!wait)
-			return false;
-		WARN_ON(dma_fence_wait_timeout(fence, false, 2 * HZ) <= 0);
-	}
+	if (!dma_fence_is_signaled(fence))
+		return false;
 	dma_fence_put(fence);
 	return true;
 }
 
 static void
-nouveau_cli_work_flush(struct nouveau_cli *cli, bool wait)
+nouveau_cli_work(struct work_struct *w)
 {
+	struct nouveau_cli *cli = container_of(w, typeof(*cli), work);
 	struct nouveau_cli_work *work, *wtmp;
 	mutex_lock(&cli->lock);
 	list_for_each_entry_safe(work, wtmp, &cli->worker, head) {
-		if (!work->fence || nouveau_cli_work_ready(work->fence, wait)) {
+		if (!work->fence || nouveau_cli_work_ready(work->fence)) {
 			list_del(&work->head);
 			work->func(work);
 		}

@@ -162,16 +160,16 @@ nouveau_cli_work_queue(struct nouveau_cl
 }
 
 static void
-nouveau_cli_work(struct work_struct *w)
-{
-	struct nouveau_cli *cli = container_of(w, typeof(*cli), work);
-	nouveau_cli_work_flush(cli, false);
-}
-
-static void
 nouveau_cli_fini(struct nouveau_cli *cli)
 {
-	nouveau_cli_work_flush(cli, true);
+	/* All our channels are dead now, which means all the fences they
+	 * own are signalled, and all callback functions have been called.
+	 *
+	 * So, after flushing the workqueue, there should be nothing left.
+	 */
+	flush_work(&cli->work);
+	WARN_ON(!list_empty(&cli->worker));
+
 	usif_client_fini(cli);
 	nouveau_vmm_fini(&cli->vmm);
 	nvif_mmu_fini(&cli->mmu);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:27 UTC #144 lore raw

PATCH 156/336 drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

[ Upstream commit 19ca10d82e33bcfe92412c461fc3534ec1e14747 ]

We previously only did this for push buffers, but an upcoming patch will need to attach fences to all VMAs to resolve another issue.

Signed-off-by Ben Skeggs <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/nouveau/nouveau_dma.c |   10 +---------
 drivers/gpu/drm/nouveau/nouveau_dma.h |    5 ++---
 drivers/gpu/drm/nouveau/nouveau_gem.c |   19 ++++++++++++++++---
 3 files changed, 19 insertions(+), 15 deletions(-)

drivers/gpu/drm/nouveau/nouveau_dma.c +1 -9

@@ -80,18 +80,10 @@ READ_GET(struct nouveau_channel *chan, u
 }
 
 void
-nv50_dma_push(struct nouveau_channel *chan, struct nouveau_bo *bo,
-	      int delta, int length)
+nv50_dma_push(struct nouveau_channel *chan, u64 offset, int length)
 {
-	struct nouveau_cli *cli = (void *)chan->user.client;
 	struct nouveau_bo *pb = chan->push.buffer;
-	struct nouveau_vma *vma;
 	int ip = (chan->dma.ib_put * 2) + chan->dma.ib_base;
-	u64 offset;
-
-	vma = nouveau_vma_find(bo, &cli->vmm);
-	BUG_ON(!vma);
-	offset = vma->addr + delta;
 
 	BUG_ON(chan->dma.ib_free < 1);

drivers/gpu/drm/nouveau/nouveau_dma.h +2 -3

@@ -31,8 +31,7 @@
 #include "nouveau_chan.h"
 
 int nouveau_dma_wait(struct nouveau_channel *, int slots, int size);
-void nv50_dma_push(struct nouveau_channel *, struct nouveau_bo *,
-		   int delta, int length);
+void nv50_dma_push(struct nouveau_channel *, u64 addr, int length);
 
 /*
  * There's a hw race condition where you can't jump to your PUT offset,

@@ -151,7 +150,7 @@ FIRE_RING(struct nouveau_channel *chan)
 	chan->accel_done = true;
 
 	if (chan->dma.ib_max) {
-		nv50_dma_push(chan, chan->push.buffer, chan->dma.put << 2,
+		nv50_dma_push(chan, chan->push.addr + (chan->dma.put << 2),
 			      (chan->dma.cur - chan->dma.put) << 2);
 	} else {
 		WRITE_PUT(chan->dma.cur);

drivers/gpu/drm/nouveau/nouveau_gem.c +16 -3

@@ -432,7 +432,20 @@ retry:
 			}
 		}
 
-		b->user_priv = (uint64_t)(unsigned long)nvbo;
+		if (cli->vmm.vmm.object.oclass >= NVIF_CLASS_VMM_NV50) {
+			struct nouveau_vmm *vmm = &cli->vmm;
+			struct nouveau_vma *vma = nouveau_vma_find(nvbo, vmm);
+			if (!vma) {
+				NV_PRINTK(err, cli, "vma not found!\n");
+				ret = -EINVAL;
+				break;
+			}
+
+			b->user_priv = (uint64_t)(unsigned long)vma;
+		} else {
+			b->user_priv = (uint64_t)(unsigned long)nvbo;
+		}
+
 		nvbo->reserved_by = file_priv;
 		nvbo->pbbo_index = i;
 		if ((b->valid_domains & NOUVEAU_GEM_DOMAIN_VRAM) &&

@@ -763,10 +776,10 @@ nouveau_gem_ioctl_pushbuf(struct drm_dev
 		}
 
 		for (i = 0; i < req->nr_push; i++) {
-			struct nouveau_bo *nvbo = (void *)(unsigned long)
+			struct nouveau_vma *vma = (void *)(unsigned long)
 				bo[push[i].bo_index].user_priv;
 
-			nv50_dma_push(chan, nvbo, push[i].offset,
+			nv50_dma_push(chan, vma->addr + push[i].offset,
 				      push[i].length);
 		}
 	} else

Greg Kroah-Hartman

author maintainer

2018-08-01 18:35 UTC #145 lore raw

PATCH 157/336 drm/nouveau/fifo/gk104-: poll for runlist update completion

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

[ Upstream commit 4f2fc25c0f8bcc8db1b8a7b21e88c3d7f35c5acb ]

Newer HW doesn't appear to send this event, which will cause long delays in runlist updates if they don't complete immediately.

RM doesn't use these events anywhere, and an NVGPU commit message notes that polling is the preferred method even on HW that supports the event.

Signed-off-by Ben Skeggs <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c +4 -4

@@ -155,10 +155,10 @@ gk104_fifo_runlist_commit(struct gk104_f
 				    (target << 28));
 	nvkm_wr32(device, 0x002274, (runl << 20) | nr);
 
-	if (wait_event_timeout(fifo->runlist[runl].wait,
-			       !(nvkm_rd32(device, 0x002284 + (runl * 0x08))
-				       & 0x00100000),
-			       msecs_to_jiffies(2000)) == 0)
+	if (nvkm_msec(device, 2000,
+		if (!(nvkm_rd32(device, 0x002284 + (runl * 0x08)) & 0x00100000))
+			break;
+	) < 0)
 		nvkm_error(subdev, "runlist %d update timeout\n", runl);
 unlock:
 	mutex_unlock(&subdev->mutex);

Greg Kroah-Hartman

author maintainer

2018-08-01 18:26 UTC #146 lore raw

PATCH 158/336 Bluetooth: btusb: add ID for LiteOn 04ca:301a

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vic Wei <[email protected]>

[ Upstream commit d666fc5479ad76a1bcbe6476d4997cea714bab2d ]

Contains a QCA6174A chipset, with USB BT. Let's support loading firmware on it.

Quoted 1 line

From usb-devices:

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=04ca ProdID=301a Rev= 0.01

C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

Signed-off-by Vic Wei <[email protected]>

Signed-off-by Matthias Kaehlcke <[email protected]>

Signed-off-by Marcel Holtmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/bluetooth/btusb.c |    1 +
 1 file changed, 1 insertion(+)

drivers/bluetooth/btusb.c +1 -0

@@ -276,6 +276,7 @@ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
+	{ USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME },
 
 	/* Broadcom BCM2035 */
 	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },

Greg Kroah-Hartman

author maintainer

2018-08-01 18:34 UTC #147 lore raw

PATCH 159/336 rtc: tps6586x: fix possible race condition

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <[email protected]>

[ Upstream commit 63d22063073b0ab46d1e06fe633fb5de8f5c58e1 ]

The probe function is not allowed to fail after the RTC is registered because the following may happen:

CPU0: CPU1:
sys_load_module()
do_init_module()
do_one_initcall()
cmos_do_probe()

    rtc_device_register()
     __register_chrdev()
     cdev->owner = struct module*
                                     open("/dev/rtc0")
    rtc_device_unregister()
  module_put()
  free_module()
   module_free(mod->module_core)
   /* struct module *module is now
      freed */
                                      chrdev_open()
                                       spin_lock(cdev_lock)
                                       cdev_get()
                                        try_module_get()
                                         module_is_live()
                                         /* dereferences already
                                            freed struct module* */

Signed-off-by Alexandre Belloni <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/rtc/rtc-tps6586x.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

drivers/rtc/rtc-tps6586x.c +11 -3

@@ -276,14 +276,15 @@ static int tps6586x_rtc_probe(struct pla
 	device_init_wakeup(&pdev->dev, 1);
 
 	platform_set_drvdata(pdev, rtc);
-	rtc->rtc = devm_rtc_device_register(&pdev->dev, dev_name(&pdev->dev),
-				       &tps6586x_rtc_ops, THIS_MODULE);
+	rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
 	if (IS_ERR(rtc->rtc)) {
 		ret = PTR_ERR(rtc->rtc);
-		dev_err(&pdev->dev, "RTC device register: ret %d\n", ret);
+		dev_err(&pdev->dev, "RTC allocate device: ret %d\n", ret);
 		goto fail_rtc_register;
 	}
 
+	rtc->rtc->ops = &tps6586x_rtc_ops;
+
 	ret = devm_request_threaded_irq(&pdev->dev, rtc->irq, NULL,
 				tps6586x_rtc_irq,
 				IRQF_ONESHOT,

@@ -294,6 +295,13 @@ static int tps6586x_rtc_probe(struct pla
 		goto fail_rtc_register;
 	}
 	disable_irq(rtc->irq);
+
+	ret = rtc_register_device(rtc->rtc);
+	if (ret) {
+		dev_err(&pdev->dev, "RTC device register: ret %d\n", ret);
+		goto fail_rtc_register;
+	}
+
 	return 0;
 
 fail_rtc_register:

Greg Kroah-Hartman

author maintainer

2018-08-01 18:27 UTC #148 lore raw

PATCH 160/336 rtc: vr41xx: fix possible race condition

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <[email protected]>

[ Upstream commit 9a99247c9c1d1c95c6e8153d013979aac6111c6e ]

The probe function is not allowed to fail after the RTC is registered because the following may happen:

CPU0: CPU1:
sys_load_module()
do_init_module()
do_one_initcall()
cmos_do_probe()

    rtc_device_register()
     __register_chrdev()
     cdev->owner = struct module*
                                     open("/dev/rtc0")
    rtc_device_unregister()
  module_put()
  free_module()
   module_free(mod->module_core)
   /* struct module *module is now
      freed */
                                      chrdev_open()
                                       spin_lock(cdev_lock)
                                       cdev_get()
                                        try_module_get()
                                         module_is_live()
                                         /* dereferences already
                                            freed struct module* */

Signed-off-by Alexandre Belloni <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/rtc/rtc-vr41xx.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

drivers/rtc/rtc-vr41xx.c +7 -2

@@ -292,13 +292,14 @@ static int rtc_probe(struct platform_dev
 		goto err_rtc1_iounmap;
 	}
 
-	rtc = devm_rtc_device_register(&pdev->dev, rtc_name, &vr41xx_rtc_ops,
-					THIS_MODULE);
+	rtc = devm_rtc_allocate_device(&pdev->dev);
 	if (IS_ERR(rtc)) {
 		retval = PTR_ERR(rtc);
 		goto err_iounmap_all;
 	}
 
+	rtc->ops = &vr41xx_rtc_ops;
+
 	rtc->max_user_freq = MAX_PERIODIC_RATE;
 
 	spin_lock_irq(&rtc_lock);

@@ -340,6 +341,10 @@ static int rtc_probe(struct platform_dev
 
 	dev_info(&pdev->dev, "Real Time Clock of NEC VR4100 series\n");
 
+	retval = rtc_register_device(rtc);
+	if (retval)
+		goto err_iounmap_all;
+
 	return 0;
 
 err_iounmap_all:

Greg Kroah-Hartman

author maintainer

2018-08-01 18:13 UTC #149 lore raw

PATCH 161/336 rtc: tps65910: fix possible race condition

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <[email protected]>

[ Upstream commit e6000a438e534ee0afd9e83b67f4e23a26dd1067 ]

The IRQ is requested before the struct rtc is allocated and registered, but this struct is used in the IRQ handler. This may lead to a NULL pointer dereference.

Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc before requesting the IRQ.

Signed-off-by Alexandre Belloni <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/rtc/rtc-tps65910.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

drivers/rtc/rtc-tps65910.c +8 -4

@@ -380,6 +380,10 @@ static int tps65910_rtc_probe(struct pla
 	if (!tps_rtc)
 		return -ENOMEM;
 
+	tps_rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
+	if (IS_ERR(tps_rtc->rtc))
+		return PTR_ERR(tps_rtc->rtc);
+
 	/* Clear pending interrupts */
 	ret = regmap_read(tps65910->regmap, TPS65910_RTC_STATUS, &rtc_reg);
 	if (ret < 0)

@@ -421,10 +425,10 @@ static int tps65910_rtc_probe(struct pla
 	tps_rtc->irq = irq;
 	device_set_wakeup_capable(&pdev->dev, 1);
 
-	tps_rtc->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
-		&tps65910_rtc_ops, THIS_MODULE);
-	if (IS_ERR(tps_rtc->rtc)) {
-		ret = PTR_ERR(tps_rtc->rtc);
+	tps_rtc->rtc->ops = &tps65910_rtc_ops;
+
+	ret = rtc_register_device(tps_rtc->rtc);
+	if (ret) {
 		dev_err(&pdev->dev, "RTC device register: err %d\n", ret);
 		return ret;
 	}

Greg Kroah-Hartman

author maintainer

2018-08-01 18:01 UTC #150 lore raw

PATCH 162/336 ALSA: emu10k1: Rate-limit error messages about page errors

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

[ Upstream commit 11d42c81036324697d367600bfc16f6dd37636fd ]

The error messages at sanity checks of memory pages tend to repeat too many times once when it hits, and without the rate limit, it may flood and become unreadable. Replace such messages with the *_ratelimited() variant.

Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1093027

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/pci/emu10k1/memory.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

sound/pci/emu10k1/memory.c +3 -3

@@ -248,13 +248,13 @@ __found_pages:
 static int is_valid_page(struct snd_emu10k1 *emu, dma_addr_t addr)
 {
 	if (addr & ~emu->dma_mask) {
-		dev_err(emu->card->dev,
+		dev_err_ratelimited(emu->card->dev,
 			"max memory size is 0x%lx (addr = 0x%lx)!!\n",
 			emu->dma_mask, (unsigned long)addr);
 		return 0;
 	}
 	if (addr & (EMUPAGESIZE-1)) {
-		dev_err(emu->card->dev, "page is not aligned\n");
+		dev_err_ratelimited(emu->card->dev, "page is not aligned\n");
 		return 0;
 	}
 	return 1;

@@ -345,7 +345,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10
 		else
 			addr = snd_pcm_sgbuf_get_addr(substream, ofs);
 		if (! is_valid_page(emu, addr)) {
-			dev_err(emu->card->dev,
+			dev_err_ratelimited(emu->card->dev,
 				"emu: failure page = %d\n", idx);
 			mutex_unlock(&hdr->block_mutex);
 			return NULL;

Greg Kroah-Hartman

author maintainer

2018-08-01 17:59 UTC #151 lore raw

PATCH 163/336 regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anson Huang <[email protected]>

[ Upstream commit 0b01fd3d40fe6402e5fa3b491ef23109feb1aaa5 ]

If is_enabled() is not defined, regulator core will assume this regulator is already enabled, then it can NOT be really enabled after disabled.

Based on Li Jun's patch from the NXP kernel tree.

Signed-off-by Anson Huang <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/regulator/pfuze100-regulator.c |    1 +
 1 file changed, 1 insertion(+)

drivers/regulator/pfuze100-regulator.c +1 -0

@@ -158,6 +158,7 @@ static const struct regulator_ops pfuze1
 static const struct regulator_ops pfuze100_swb_regulator_ops = {
 	.enable = regulator_enable_regmap,
 	.disable = regulator_disable_regmap,
+	.is_enabled = regulator_is_enabled_regmap,
 	.list_voltage = regulator_list_voltage_table,
 	.map_voltage = regulator_map_voltage_ascend,
 	.set_voltage_sel = regulator_set_voltage_sel_regmap,

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #152 lore raw

PATCH 164/336 md/raid1: add error handling of read error from FailFast device

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gioh Kim <[email protected]>

[ Upstream commit b33d10624fdc15cdf1495f3f00481afccec76783 ]

Current handle_read_error() function calls fix_read_error() only if md device is RW and rdev does not include FailFast flag. It does not handle a read error from a RW device including FailFast flag.

I am not sure it is intended. But I found that write IO error sets rdev faulty. The md module should handle the read IO error and write IO error equally. So I think read IO error should set rdev faulty.

Signed-off-by Gioh Kim <[email protected]>

Reviewed-by Jack Wang <[email protected]>

Signed-off-by Shaohua Li <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/md/raid1.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/md/raid1.c +2 -0

@@ -2474,6 +2474,8 @@ static void handle_read_error(struct r1c
 		fix_read_error(conf, r1_bio->read_disk,
 			       r1_bio->sector, r1_bio->sectors);
 		unfreeze_array(conf);
+	} else if (mddev->ro == 0 && test_bit(FailFast, &rdev->flags)) {
+		md_error(mddev, rdev);
 	} else {
 		r1_bio->bios[r1_bio->read_disk] = IO_BLOCKED;
 	}

Greg Kroah-Hartman

author maintainer

2018-08-01 18:02 UTC #153 lore raw

PATCH 165/336 md: fix NULL dereference of mddev->pers in remove_and_add_spares()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yufen Yu <[email protected]>

[ Upstream commit c42a0e2675721e1444f56e6132a07b7b1ec169ac ]

We met NULL pointer BUG as follow:

[  151.760358] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060
[  151.761340] PGD 80000001011eb067 P4D 80000001011eb067 PUD 1011ea067 PMD 0
[  151.762039] Oops: 0000 [#1] SMP PTI
[  151.762406] Modules linked in:
[  151.762723] CPU: 2 PID: 3561 Comm: mdadm-test Kdump: loaded Not tainted 4.17.0-rc1+ #238
[  151.763542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
[  151.764432] RIP: 0010:remove_and_add_spares.part.56+0x13c/0x3a0
[  151.765061] RSP: 0018:ffffc90001d7fcd8 EFLAGS: 00010246
[  151.765590] RAX: 0000000000000000 RBX: ffff88013601d600 RCX: 0000000000000000
[  151.766306] RDX: 0000000000000000 RSI: ffff88013601d600 RDI: ffff880136187000
[  151.767014] RBP: ffff880136187018 R08: 0000000000000003 R09: 0000000000000051
[  151.767728] R10: ffffc90001d7fed8 R11: 0000000000000000 R12: ffff88013601d600
[  151.768447] R13: ffff8801298b1300 R14: ffff880136187000 R15: 0000000000000000
[  151.769160] FS:  00007f2624276700(0000) GS:ffff88013ae80000(0000) knlGS:0000000000000000
[  151.769971] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  151.770554] CR2: 0000000000000060 CR3: 0000000111aac000 CR4: 00000000000006e0
[  151.771272] Call Trace:
[  151.771542]  md_ioctl+0x1df2/0x1e10
[  151.771906]  ? __switch_to+0x129/0x440
[  151.772295]  ? __schedule+0x244/0x850
[  151.772672]  blkdev_ioctl+0x4bd/0x970
[  151.773048]  block_ioctl+0x39/0x40
[  151.773402]  do_vfs_ioctl+0xa4/0x610
[  151.773770]  ? dput.part.23+0x87/0x100
[  151.774151]  ksys_ioctl+0x70/0x80
[  151.774493]  __x64_sys_ioctl+0x16/0x20
[  151.774877]  do_syscall_64+0x5b/0x180
[  151.775258]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

For raid6, when two disk of the array are offline, two spare disks can be added into the array. Before spare disks recovery completing, system reboot and mdadm thinks it is ok to restart the degraded array by md_ioctl(). Since disks in raid6 is not only_parity(), raid5_run() will abort, when there is no PPL feature or not setting 'start_dirty_degraded' parameter. Therefore, mddev->pers is NULL.

But, mddev->raid_disks has been set and it will not be cleared when raid5_run abort. md_ioctl() can execute cmd 'HOT_REMOVE_DISK' to remove a disk by mdadm, which will cause NULL pointer dereference in remove_and_add_spares() finally.

Signed-off-by Yufen Yu <[email protected]>

Signed-off-by Shaohua Li <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/md/md.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/md/md.c +3 -0

@@ -6525,6 +6525,9 @@ static int hot_remove_disk(struct mddev
 	char b[BDEVNAME_SIZE];
 	struct md_rdev *rdev;
 
+	if (!mddev->pers)
+		return -ENODEV;
+
 	rdev = find_rdev(mddev, dev);
 	if (!rdev)
 		return -ENXIO;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #154 lore raw

PATCH 166/336 ixgbevf: fix MAC address changes through ixgbevf_set_mac()

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Emil Tantilov <[email protected]>

[ Upstream commit 6e7d0ba1e59b1a306761a731e67634c0f2efea2a ]

Set hw->mac.perm_addr in ixgbevf_set_mac() in order to avoid losing the custom MAC on reset. This can happen in the following case:

Quoted 2 lines

ip link set $vf address $mac
ethtool -r $vf

Signed-off-by Emil Tantilov <[email protected]>

Tested-by Andrew Bowers <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c |    1 +
 1 file changed, 1 insertion(+)

drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +1 -0

@@ -4187,6 +4187,7 @@ static int ixgbevf_set_mac(struct net_de
 		return -EPERM;
 
 	ether_addr_copy(hw->mac.addr, addr->sa_data);
+	ether_addr_copy(hw->mac.perm_addr, addr->sa_data);
 	ether_addr_copy(netdev->dev_addr, addr->sa_data);
 
 	return 0;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #155 lore raw

PATCH 167/336 gpu: host1x: Acquire a reference to the IOVA cache

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thierry Reding <[email protected]>

[ Upstream commit f40e1590c5270e5559fb95a5a0a7c1f5266a522d ]

The IOVA API uses a memory cache to allocate IOVA nodes from. To make sure that this cache is available, obtain a reference to it and release the reference when the cache is no longer needed.

On 64-bit ARM this is hidden by the fact that the DMA mapping API gets that reference and never releases it. On 32-bit ARM, this is papered over by the Tegra DRM driver (the sole user of the host1x API requiring the cache) acquiring a reference to the IOVA cache for its own purposes. However, there may be additional users of this API in the future, so fix this upfront to avoid surprises.

Fixes 404bfb78daf3 ("gpu: host1x: Add IOMMU support")

Reviewed-by Dmitry Osipenko <[email protected]>

Signed-off-by Thierry Reding <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/host1x/dev.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

drivers/gpu/host1x/dev.c +10 -1

@@ -223,10 +223,14 @@ static int host1x_probe(struct platform_
 		struct iommu_domain_geometry *geometry;
 		unsigned long order;
 
+		err = iova_cache_get();
+		if (err < 0)
+			goto put_group;
+
 		host->domain = iommu_domain_alloc(&platform_bus_type);
 		if (!host->domain) {
 			err = -ENOMEM;
-			goto put_group;
+			goto put_cache;
 		}
 
 		err = iommu_attach_group(host->domain, host->group);

@@ -234,6 +238,7 @@ static int host1x_probe(struct platform_
 			if (err == -ENODEV) {
 				iommu_domain_free(host->domain);
 				host->domain = NULL;
+				iova_cache_put();
 				iommu_group_put(host->group);
 				host->group = NULL;
 				goto skip_iommu;

@@ -308,6 +313,9 @@ fail_detach_device:
 fail_free_domain:
 	if (host->domain)
 		iommu_domain_free(host->domain);
+put_cache:
+	if (host->group)
+		iova_cache_put();
 put_group:
 	iommu_group_put(host->group);

@@ -328,6 +336,7 @@ static int host1x_remove(struct platform
 		put_iova_domain(&host->iova);
 		iommu_detach_group(host->domain, host->group);
 		iommu_domain_free(host->domain);
+		iova_cache_put();
 		iommu_group_put(host->group);
 	}

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #156 lore raw

PATCH 168/336 media: smiapp: fix timeout checking in smiapp_read_nvm

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Colin Ian King <[email protected]>

[ Upstream commit 7a2148dfda8001c983f0effd9afd8a7fa58e99c4 ]

The current code decrements the timeout counter i and the end of each loop i is incremented, so the check for timeout will always be false and hence the timeout mechanism is just a dead code path. Potentially, if the RD_READY bit is not set, we could end up in an infinite loop.

Fix this so the timeout starts from 1000 and decrements to zero, if at the end of the loop i is zero we have a timeout condition.

Detected by CoverityScan, CID#1324008 ("Logically dead code")

Fixes ccfc97bdb5ae ("[media] smiapp: Add driver")

Signed-off-by Colin Ian King <[email protected]>

Signed-off-by Sakari Ailus <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/i2c/smiapp/smiapp-core.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

drivers/media/i2c/smiapp/smiapp-core.c +5 -6

@@ -1001,7 +1001,7 @@ static int smiapp_read_nvm(struct smiapp
 		if (rval)
 			goto out;
 
-		for (i = 0; i < 1000; i++) {
+		for (i = 1000; i > 0; i--) {
 			rval = smiapp_read(
 				sensor,
 				SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS, &s);

@@ -1012,11 +1012,10 @@ static int smiapp_read_nvm(struct smiapp
 			if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY)
 				break;
 
-			if (--i == 0) {
-				rval = -ETIMEDOUT;
-				goto out;
-			}
-
+		}
+		if (!i) {
+			rval = -ETIMEDOUT;
+			goto out;
 		}
 
 		for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) {

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #157 lore raw

PATCH 169/336 PCI/DPC: Clear interrupt status in interrupt handler top half

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oza Pawandeep <[email protected]>

[ Upstream commit 56abbf8ad73c89d0a4c3c84b1449ceaaabd1b8c7 ]

The generic IRQ handling code ensures that an interrupt handler runs with its interrupt masked or disabled. If the interrupt is level-triggered, the interrupt handler must tell its device to stop asserting the interrupt before returning. If it doesn't, we will immediately take the interrupt again when the handler returns and the generic code unmasks the interrupt.

The driver doesn't know whether its interrupt is edge- or level-triggered, so it must clear its interrupt source directly in its interrupt handler.

Previously we cleared the DPC interrupt status in the bottom half, i.e., in deferred work, which can cause an interrupt storm if the DPC interrupt happens to be level-triggered, e.g., if we're using INTx instead of MSI.

Clear the DPC interrupt status bit in the interrupt handler, not in the deferred work.

Signed-off-by Oza Pawandeep <[email protected]>

[bhelgaas: changelog]

Reviewed-by Keith Busch <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/pci/pcie/dpc.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/pci/pcie/dpc.c +4 -1

@@ -113,7 +113,7 @@ static void dpc_work(struct work_struct
 	}
 
 	pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS,
-		PCI_EXP_DPC_STATUS_TRIGGER | PCI_EXP_DPC_STATUS_INTERRUPT);
+			      PCI_EXP_DPC_STATUS_TRIGGER);
 
 	pci_read_config_word(pdev, cap + PCI_EXP_DPC_CTL, &ctl);
 	pci_write_config_word(pdev, cap + PCI_EXP_DPC_CTL,

@@ -223,6 +223,9 @@ static irqreturn_t dpc_irq(int irq, void
 	if (dpc->rp_extensions && reason == 3 && ext_reason == 0)
 		dpc_process_rp_pio_error(dpc);
 
+	pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS,
+			      PCI_EXP_DPC_STATUS_INTERRUPT);
+
 	schedule_work(&dpc->work);
 
 	return IRQ_HANDLED;

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #158 lore raw

PATCH 171/336 net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Grygorii Strashko <[email protected]>

[ Upstream commit c6213eb1aee308e67377fd1890d84f7284caf531 ]

This fixes klockworks warnings: Pointer 'dev' returned from call to function 'bus_find_device' at line 179 may be NULL and will be dereferenced at line 181.

cpsw-phy-sel.c:179: 'dev' is assigned the return value from function 'bus_find_device'. bus.c:342: 'bus_find_device' explicitly returns a NULL value. cpsw-phy-sel.c:181: 'dev' is dereferenced by passing argument 1 to function 'dev_get_drvdata'. device.h:1024: 'dev' is passed to function 'dev_get_drvdata'.
device.h:1026: 'dev' is explicitly dereferenced.

Signed-off-by Grygorii Strashko <[email protected]>

[[email protected]: add an error message, fix return path]

Signed-off-by Sekhar Nori <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/ti/cpsw-phy-sel.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

drivers/net/ethernet/ti/cpsw-phy-sel.c +7 -1

@@ -177,12 +177,18 @@ void cpsw_phy_sel(struct device *dev, ph
 	}
 
 	dev = bus_find_device(&platform_bus_type, NULL, node, match);
-	of_node_put(node);
+	if (!dev) {
+		dev_err(dev, "unable to find platform device for %pOF\n", node);
+		goto out;
+	}
+
 	priv = dev_get_drvdata(dev);
 
 	priv->cpsw_phy_sel(priv, phy_mode, slave);
 
 	put_device(dev);
+out:
+	of_node_put(node);
 }
 EXPORT_SYMBOL_GPL(cpsw_phy_sel);

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #159 lore raw

PATCH 172/336 ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

[ Upstream commit 377a879d9832f4ba69bd6a1fc996bb4181b1e504 ]

retire_capture_urb() may print warning messages when the given URB doesn't align, and this may flood the system log easily. Put the rate limit to the message for avoiding it.

Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1093485

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/usb/pcm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

sound/usb/pcm.c +1 -1

@@ -1311,7 +1311,7 @@ static void retire_capture_urb(struct sn
 		if (bytes % (runtime->sample_bits >> 3) != 0) {
 			int oldbytes = bytes;
 			bytes = frames * stride;
-			dev_warn(&subs->dev->dev,
+			dev_warn_ratelimited(&subs->dev->dev,
 				 "Corrected urb data len. %d->%d\n",
 							oldbytes, bytes);
 		}

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #160 lore raw

PATCH 173/336 net: hns3: Fix for fiber link up problem

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yunsheng Lin <[email protected]>

[ Upstream commit be8d8cdb8ebf3afd841c109dd035fd789a0c7d53 ]

When hclge_ae_start is called, hdev->hw.mac.link may be set to one after up/down multi-times, which does not correspond to the link state of netdev when the netdev is up.

This fixes it by setting hdev->hw.mac.link to zero when hclge_ae_start is called.

Fixes 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")

Signed-off-by Peng Li <[email protected]>

Signed-off-by Salil Mehta <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -1

@@ -3783,6 +3783,7 @@ static int hclge_ae_start(struct hnae3_h
 	hclge_cfg_mac_mode(hdev, true);
 	clear_bit(HCLGE_STATE_DOWN, &hdev->state);
 	mod_timer(&hdev->service_timer, jiffies + HZ);
+	hdev->hw.mac.link = 0;
 
 	/* reset tqp stats */
 	hclge_reset_tqp_stats(handle);

@@ -3819,7 +3820,6 @@ static void hclge_ae_stop(struct hnae3_h
 
 	/* reset tqp stats */
 	hclge_reset_tqp_stats(handle);
-	hclge_update_link_status(hdev);
 }
 
 static int hclge_get_mac_vlan_cmd_status(struct hclge_vport *vport,

Greg Kroah-Hartman

author maintainer

2018-08-01 18:09 UTC #161 lore raw

PATCH 175/336 media: staging: atomisp: Comment out several unused sensor resolutions

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mauro Carvalho Chehab <[email protected]>

[ Upstream commit db01f7ccfa6d4738e366077ce7423d1710b805f3 ]

The register settings for several resolutions aren't used currently. So, comment them out.

Fix those warnings:

In file included from drivers/staging/media/atomisp/i2c/atomisp-gc2235.c:35:0:
drivers/staging/media/atomisp/i2c/gc2235.h:340:32: warning: 'gc2235_960_640_30fps' defined but not used [-Wunused-const-variable=]

 static struct gc2235_reg const gc2235_960_640_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/gc2235.h:287:32: warning: 'gc2235_1296_736_30fps' defined but not used [-Wunused-const-variable=]
 static struct gc2235_reg const gc2235_1296_736_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~~
In file included from drivers/staging/media/atomisp/i2c/atomisp-ov2722.c:35:0:
drivers/staging/media/atomisp/i2c/ov2722.h:999:32: warning: 'ov2722_720p_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_720p_30fps[] = {
                                ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2722.h:787:32: warning: 'ov2722_1M3_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_1M3_30fps[] = {
                                ^~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2722.h:476:32: warning: 'ov2722_VGA_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_VGA_30fps[] = {
                                ^~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2722.h:367:32: warning: 'ov2722_480P_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_480P_30fps[] = {
                                ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2722.h:257:32: warning: 'ov2722_QVGA_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov2722_reg const ov2722_QVGA_30fps[] = {
                                ^~~~~~~~~~~~~~~~~

drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function '__ov2680_set_exposure':
In file included from drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:35:0:
At top level:
drivers/staging/media/atomisp/i2c/ov2680.h:736:33: warning: 'ov2680_1616x1082_30fps' defined but not used [-Wunused-const-variable=]

  static struct ov2680_reg const ov2680_1616x1082_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:649:33: warning: 'ov2680_1456x1096_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_1456x1096_30fps[]= {
                                 ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:606:33: warning: 'ov2680_1296x976_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_1296x976_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:563:33: warning: 'ov2680_720p_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_720p_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:520:33: warning: 'ov2680_800x600_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_800x600_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:475:33: warning: 'ov2680_720x592_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_720x592_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:433:33: warning: 'ov2680_656x496_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_656x496_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:389:33: warning: 'ov2680_QVGA_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_QVGA_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:346:33: warning: 'ov2680_CIF_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_CIF_30fps[] = {
                                 ^~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov2680.h:301:33: warning: 'ov2680_QCIF_30fps' defined but not used [-Wunused-const-variable=]
  static struct ov2680_reg const ov2680_QCIF_30fps[] = {
                                 ^~~~~~~~~~~~~~~~~
In file included from drivers/staging/media/atomisp/i2c/ov5693/atomisp-ov5693.c:36:0:
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:988:32: warning: 'ov5693_1424x1168_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1424x1168_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:954:32: warning: 'ov5693_2592x1944_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_2592x1944_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:889:32: warning: 'ov5693_2592x1456_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_2592x1456_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:862:32: warning: 'ov5693_1940x1096' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1940x1096[] = {
                                ^~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:796:32: warning: 'ov5693_1636p_30fps' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1636p_30fps[] = {
                                ^~~~~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:758:32: warning: 'ov5693_1296x736' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1296x736[] = {
                                ^~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:730:32: warning: 'ov5693_976x556' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_976x556[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:672:32: warning: 'ov5693_736x496' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_736x496[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:643:32: warning: 'ov5693_192x160' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_192x160[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:616:32: warning: 'ov5693_368x304' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_368x304[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:587:32: warning: 'ov5693_336x256' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_336x256[] = {
                                ^~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:540:32: warning: 'ov5693_1296x976' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_1296x976[] = {
                                ^~~~~~~~~~~~~~~
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:509:32: warning: 'ov5693_654x496' defined but not used [-Wunused-const-variable=]
 static struct ov5693_reg const ov5693_654x496[] = {
                                ^~~~~~~~~~~~~~

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sakari Ailus <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/media/atomisp/i2c/gc2235.h        |    9 ++++++++-
 drivers/staging/media/atomisp/i2c/ov2680.h        |    5 ++++-
 drivers/staging/media/atomisp/i2c/ov2722.h        |    6 ++++++
 drivers/staging/media/atomisp/i2c/ov5693/ov5693.h |   18 +++++++++++++++++-
 4 files changed, 35 insertions(+), 3 deletions(-)

drivers/staging/media/atomisp/i2c/gc2235.h +8 -1

@@ -33,6 +33,11 @@
 
 #include "../include/linux/atomisp_platform.h"
 
+/*
+ * FIXME: non-preview resolutions are currently broken
+ */
+#define ENABLE_NON_PREVIEW     0
+
 /* Defines for register writes and register array processing */
 #define I2C_MSG_LENGTH		0x2
 #define I2C_RETRY_COUNT		5

@@ -284,6 +289,7 @@ static struct gc2235_reg const gc2235_in
 /*
  * Register settings for various resolution
  */
+#if ENABLE_NON_PREVIEW
 static struct gc2235_reg const gc2235_1296_736_30fps[] = {
 	{ GC2235_8BIT, 0x8b, 0xa0 },
 	{ GC2235_8BIT, 0x8c, 0x02 },

@@ -387,6 +393,7 @@ static struct gc2235_reg const gc2235_96
 	{ GC2235_8BIT, 0xfe, 0x00 }, /* switch to P0 */
 	{ GC2235_TOK_TERM, 0, 0 }
 };
+#endif
 
 static struct gc2235_reg const gc2235_1600_900_30fps[] = {
 	{ GC2235_8BIT, 0x8b, 0xa0 },

@@ -578,7 +585,7 @@ static struct gc2235_resolution gc2235_r
  * Disable non-preview configurations until the configuration selection is
  * improved.
  */
-#if 0
+#if ENABLE_NON_PREVIEW
 static struct gc2235_resolution gc2235_res_still[] = {
 	{
 		.desc = "gc2235_1600_900_30fps",

drivers/staging/media/atomisp/i2c/ov2680.h +4 -1

@@ -295,6 +295,7 @@ struct ov2680_format {
 	};
 
 
+#if 0 /* None of the definitions below are used currently */
 	/*
 	 * 176x144 30fps  VBlanking 1lane 10Bit (binning)
 	 */

@@ -513,7 +514,6 @@ struct ov2680_format {
 	{OV2680_8BIT, 0x5081, 0x41},
     {OV2680_TOK_TERM, 0, 0}
 	};
-
 	/*
 	* 800x600 30fps  VBlanking 1lane 10Bit (binning)
 	*/

@@ -685,6 +685,7 @@ struct ov2680_format {
     // {OV2680_8BIT, 0x5090, 0x0c},
 	{OV2680_TOK_TERM, 0, 0}
 	};
+#endif
 
 	/*
 	 *1616x916  30fps  VBlanking 1lane 10bit

@@ -734,6 +735,7 @@ struct ov2680_format {
 	/*
 	 * 1612x1212 30fps VBlanking 1lane 10Bit
 	 */
+#if 0
 	static struct ov2680_reg const ov2680_1616x1082_30fps[] = {
        {OV2680_8BIT, 0x3086, 0x00},
        {OV2680_8BIT, 0x3501, 0x48},

@@ -773,6 +775,7 @@ struct ov2680_format {
        {OV2680_8BIT, 0x5081, 0x41},
 		{OV2680_TOK_TERM, 0, 0}
         };
+#endif
 	/*
 	 * 1616x1216 30fps VBlanking 1lane 10Bit
 	 */

drivers/staging/media/atomisp/i2c/ov2722.h +6 -0

@@ -254,6 +254,7 @@ struct ov2722_write_ctrl {
 /*
  * Register settings for various resolution
  */
+#if 0
 static struct ov2722_reg const ov2722_QVGA_30fps[] = {
 	{OV2722_8BIT, 0x3718, 0x10},
 	{OV2722_8BIT, 0x3702, 0x0c},

@@ -581,6 +582,7 @@ static struct ov2722_reg const ov2722_VG
 	{OV2722_8BIT, 0x3509, 0x10},
 	{OV2722_TOK_TERM, 0, 0},
 };
+#endif
 
 static struct ov2722_reg const ov2722_1632_1092_30fps[] = {
 	{OV2722_8BIT, 0x3021, 0x03}, /* For stand wait for

@@ -784,6 +786,7 @@ static struct ov2722_reg const ov2722_14
 	{OV2722_8BIT, 0x3509, 0x00},
 	{OV2722_TOK_TERM, 0, 0}
 };
+#if 0
 static struct ov2722_reg const ov2722_1M3_30fps[] = {
 	{OV2722_8BIT, 0x3718, 0x10},
 	{OV2722_8BIT, 0x3702, 0x24},

@@ -890,6 +893,7 @@ static struct ov2722_reg const ov2722_1M
 	{OV2722_8BIT, 0x3509, 0x10},
 	{OV2722_TOK_TERM, 0, 0},
 };
+#endif
 
 static struct ov2722_reg const ov2722_1080p_30fps[] = {
 	{OV2722_8BIT, 0x3021, 0x03}, /* For stand wait for a whole

@@ -996,6 +1000,7 @@ static struct ov2722_reg const ov2722_10
 	{OV2722_TOK_TERM, 0, 0}
 };
 
+#if 0 /* Currently unused */
 static struct ov2722_reg const ov2722_720p_30fps[] = {
 	{OV2722_8BIT, 0x3021, 0x03},
 	{OV2722_8BIT, 0x3718, 0x10},

@@ -1095,6 +1100,7 @@ static struct ov2722_reg const ov2722_72
 	{OV2722_8BIT, 0x3509, 0x00},
 	{OV2722_TOK_TERM, 0, 0},
 };
+#endif
 
 static struct ov2722_resolution ov2722_res_preview[] = {
 	{

drivers/staging/media/atomisp/i2c/ov5693/ov5693.h +17 -1

@@ -31,6 +31,12 @@
 
 #include "../../include/linux/atomisp_platform.h"
 
+/*
+ * FIXME: non-preview resolutions are currently broken
+ */
+#define ENABLE_NON_PREVIEW	0
+
+
 #define OV5693_POWER_UP_RETRY_NUM 5
 
 /* Defines for register writes and register array processing */

@@ -503,6 +509,7 @@ static struct ov5693_reg const ov5693_gl
 	{OV5693_TOK_TERM, 0, 0}
 };
 
+#if ENABLE_NON_PREVIEW
 /*
  * 654x496 30fps 17ms VBlanking 2lane 10Bit (Scaling)
  */

@@ -695,6 +702,7 @@ static struct ov5693_reg const ov5693_73
 	{OV5693_8BIT, 0x0100, 0x01},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 /*
 static struct ov5693_reg const ov5693_736x496[] = {

@@ -727,6 +735,7 @@ static struct ov5693_reg const ov5693_73
 /*
  * 976x556 30fps 8.8ms VBlanking 2lane 10Bit (Scaling)
  */
+#if ENABLE_NON_PREVIEW
 static struct ov5693_reg const ov5693_976x556[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},
 	{OV5693_8BIT, 0x3502, 0x00},

@@ -819,6 +828,7 @@ static struct ov5693_reg const ov5693_16
 	{OV5693_8BIT, 0x0100, 0x01},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 static struct ov5693_reg const ov5693_1616x1216_30fps[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},

@@ -859,6 +869,7 @@ static struct ov5693_reg const ov5693_16
 /*
  * 1940x1096 30fps 8.8ms VBlanking 2lane 10bit (Scaling)
  */
+#if ENABLE_NON_PREVIEW
 static struct ov5693_reg const ov5693_1940x1096[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},
 	{OV5693_8BIT, 0x3502, 0x00},

@@ -916,6 +927,7 @@ static struct ov5693_reg const ov5693_25
 	{OV5693_8BIT, 0x5002, 0x00},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 static struct ov5693_reg const ov5693_2576x1456_30fps[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},

@@ -951,6 +963,7 @@ static struct ov5693_reg const ov5693_25
 /*
  * 2592x1944 30fps 0.6ms VBlanking 2lane 10Bit
  */
+#if ENABLE_NON_PREVIEW
 static struct ov5693_reg const ov5693_2592x1944_30fps[] = {
 	{OV5693_8BIT, 0x3501, 0x7b},
 	{OV5693_8BIT, 0x3502, 0x00},

@@ -977,6 +990,7 @@ static struct ov5693_reg const ov5693_25
 	{OV5693_8BIT, 0x0100, 0x01},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 /*
  * 11:9 Full FOV Output, expected FOV Res: 2346x1920

@@ -985,6 +999,7 @@ static struct ov5693_reg const ov5693_25
  *
  * WA: Left Offset: 8, Hor scal: 64
  */
+#if ENABLE_NON_PREVIEW
 static struct ov5693_reg const ov5693_1424x1168_30fps[] = {
 	{OV5693_8BIT, 0x3501, 0x3b}, /* long exposure[15:8] */
 	{OV5693_8BIT, 0x3502, 0x80}, /* long exposure[7:0] */

@@ -1019,6 +1034,7 @@ static struct ov5693_reg const ov5693_14
 	{OV5693_8BIT, 0x0100, 0x01},
 	{OV5693_TOK_TERM, 0, 0}
 };
+#endif
 
 /*
  * 3:2 Full FOV Output, expected FOV Res: 2560x1706

@@ -1151,7 +1167,7 @@ static struct ov5693_resolution ov5693_r
  * Disable non-preview configurations until the configuration selection is
  * improved.
  */
-#if 0
+#if ENABLE_NON_PREVIEW
 struct ov5693_resolution ov5693_res_still[] = {
 	{
 		.desc = "ov5693_736x496_30fps",

Greg Kroah-Hartman

author maintainer

2018-08-01 18:09 UTC #162 lore raw

PATCH 176/336 arm64: cmpwait: Clear event register before arming exclusive monitor

4.17-stable review patch. If anyone has any objections, please let me know.

------------------

From: Will Deacon <[email protected]>

[ Upstream commit 1cfc63b5ae60fe7e01773f38132f98d8b13a99a0 ]

When waiting for a cacheline to change state in cmpwait, we may immediately wake-up the first time around the outer loop if the event register was already set (for example, because of the event stream).

Avoid these spurious wakeups by explicitly clearing the event register before loading the cacheline and setting the exclusive monitor.

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Catalin Marinas <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm64/include/asm/cmpxchg.h |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

arch/arm64/include/asm/cmpxchg.h +3 -1

@@ -204,7 +204,9 @@ static inline void __cmpwait_case_##name
 	unsigned long tmp;						\
 									\
 	asm volatile(							\
-	"	ldxr" #sz "\t%" #w "[tmp], %[v]\n"		\
+	"	sevl\n"							\
+	"	wfe\n"							\
+	"	ldxr" #sz "\t%" #w "[tmp], %[v]\n"			\
 	"	eor	%" #w "[tmp], %" #w "[tmp], %" #w "[val]\n"	\
 	"	cbnz	%" #w "[tmp], 1f\n"				\
 	"	wfe\n"							\

Greg Kroah-Hartman

author maintainer

2018-08-01 16:48 UTC #163 lore raw

PATCH 177/336 HID: hid-plantronics: Re-resend Update to map button for PTT products