4.19.3-stable review
Subsystems (15)
Greg Kroah-Hartman
maintainercover 4.19.3-stable review
This is the start of the stable review cycle for the 4.19.3 release. There are 205 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Nov 21 16:24:55 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.3-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.3-rc1
Stefano Stabellini <[email protected]>
CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM
Ville Syrjälä <[email protected]>
drm/i915: Fix hpd handling for pins with two encoders
Lyude Paul <[email protected]>
drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST
Lyude Paul <[email protected]>
drm/i915: Fix possible race in intel_dp_add_mst_connector()
Chris Wilson <[email protected]>
drm/i915/execlists: Force write serialisation into context image vs execution
Chris Wilson <[email protected]>
drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5
Chris Wilson <[email protected]>
drm/i915: Mark pin flags as u64
Ville Syrjälä <[email protected]>
drm/i915: Don't oops during modeset shutdown after lpe audio deinit
Chris Wilson <[email protected]>
drm/i915: Compare user's 64b GTT offset even on 32b
Ville Syrjälä <[email protected]>
drm/i915: Fix ilk+ watermarks when disabling pipes
Ville Syrjälä <[email protected]>
drm/i915: Fix error handling for the NV12 fb dimensions check
Chris Wilson <[email protected]>
drm/i915: Mark up GTT sizes as u64
Clint Taylor <[email protected]>
drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values
Manasi Navare <[email protected]>
drm/i915/icl: Fix the macros for DFLEXDPMLE register bits
Dhinakaran Pandiyan <[email protected]>
drm/i915/dp: Restrict link retrain workaround to external monitors
Dhinakaran Pandiyan <[email protected]>
drm/i915/dp: Fix link retraining comment in intel_dp_long_pulse()
Chris Wilson <[email protected]>
drm/i915: Large page offsets for pread/pwrite
Lyude Paul <[email protected]>
drm/i915: Skip vcpi allocation for MSTB ports that are gone
Lyude Paul <[email protected]>
drm/i915: Don't unset intel_connector->mst_port
Ville Syrjälä <[email protected]>
drm/i915: Restore vblank interrupts earlier
Ville Syrjälä <[email protected]>
drm/i915: Use the correct crtc when sanitizing plane mapping
Manasi Navare <[email protected]>
drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit panel's native mode
Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003)
Lyude Paul <[email protected]>
drm/atomic_helper: Disallow new modesets on unregistered connectors
Stanislav Lisovskiy <[email protected]>
drm/dp_mst: Check if primary mstb is null
Lucas Stach <[email protected]>
drm/etnaviv: fix bogus fence complete check in timeout handler
Akshu Agrawal <[email protected]>
drm/amd/powerplay: Enable/Disable NBPSTATE on On/OFF of UVD
Lyude Paul <[email protected]>
drm/nouveau: Fix nv50_mstc->best_encoder()
Lyude Paul <[email protected]>
drm/nouveau: Check backlight IDs are >= 0, not > 0
Lyude Paul <[email protected]>
drm/amdgpu: Suppress keypresses from ACPI_VIDEO events
Alex Deucher <[email protected]>
drm/amdgpu: add missing CHIP_HAINAN in amdgpu_ucode_get_load_type
Rex Zhu <[email protected]>
drm/amdgpu: Fix typo in amdgpu_vmid_mgr_init
Marc Zyngier <[email protected]>
drm/rockchip: Allow driver to be shutdown on reboot/kexec
Uwe Kleine-König <[email protected]>
scripts/spdxcheck.py: make python3 compliant
Roman Gushchin <[email protected]>
mm: don't reclaim inodes with many attached pages
Ard Biesheuvel <[email protected]>
efi/arm/libstub: Pack FDT after populating it
Vasily Averin <[email protected]>
mm/swapfile.c: use kvzalloc for swap_info_struct allocation
Mike Kravetz <[email protected]>
hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!
Arnd Bergmann <[email protected]>
lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn
Eric Biggers <[email protected]>
crypto: user - fix leaking uninitialized memory to userspace
Diego Viola <[email protected]>
libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD
Andreas Gruenbacher <[email protected]>
gfs2: Fix metadata read-ahead during truncate (2)
Andreas Gruenbacher <[email protected]>
gfs2: Put bitmap buffers in put_super
Ondrej Mosnacek <[email protected]>
selinux: check length properly in SCTP bind hook
Miklos Szeredi <[email protected]>
fuse: fix possibly missed wake-up after abort
Miklos Szeredi <[email protected]>
fuse: fix leaked notify reply
Lukas Czerner <[email protected]>
fuse: fix use-after-free in fuse_direct_IO()
Maciej W. Rozycki <[email protected]>
rtc: hctosys: Add missing range error reporting
Scott Mayhew <[email protected]>
nfsd: COPY and CLONE operations require the saved filehandle to be set
Trond Myklebust <[email protected]>
NFSv4: Don't exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING
Frank Sorenson <[email protected]>
sunrpc: correct the computation for page_ptr when truncating
Christophe Leroy <[email protected]>
kdb: print real address of pointers instead of hashed addresses
Christophe Leroy <[email protected]>
kdb: use correct pointer when 'btc' calls 'btt'
Ulf Hansson <[email protected]>
ARM: cpuidle: Don't register the driver when back-end init returns -ENXIO
Dmitry V. Levin <[email protected]>
uapi: fix linux/kfd_ioctl.h userspace compilation errors
Benjamin Coddington <[email protected]>
mnt: fix __detach_mounts infinite loop
Eric W. Biederman <[email protected]>
mount: Prevent MNT_DETACH from disconnecting locked mounts
Eric W. Biederman <[email protected]>
mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
Eric W. Biederman <[email protected]>
mount: Retest MNT_LOCKED in do_umount
Vasily Averin <[email protected]>
ext4: fix buffer leak in __ext4_read_dirblock() on error path
Vasily Averin <[email protected]>
ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path
Vasily Averin <[email protected]>
ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
Vasily Averin <[email protected]>
ext4: release bs.bh before re-using in ext4_xattr_block_find()
Vasily Averin <[email protected]>
ext4: fix buffer leak in ext4_xattr_get_block() on error path
Vasily Averin <[email protected]>
ext4: fix possible leak of s_journal_flag_rwsem in error path
Theodore Ts'o <[email protected]>
ext4: fix possible leak of sbi->s_group_desc_leak in error path
Theodore Ts'o <[email protected]>
ext4: avoid possible double brelse() in add_new_gdb() on error path
Vasily Averin <[email protected]>
ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing
Vasily Averin <[email protected]>
ext4: avoid buffer leak in ext4_orphan_add() after prior errors
Vasily Averin <[email protected]>
ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty()
Vasily Averin <[email protected]>
ext4: fix possible inode leak in the retry loop of ext4_resize_fs()
Vasily Averin <[email protected]>
ext4: missing !bh check in ext4_xattr_inode_write()
Vasily Averin <[email protected]>
ext4: avoid potential extra brelse in setup_new_flex_group_blocks()
Vasily Averin <[email protected]>
ext4: add missing brelse() add_new_gdb_meta_bg()'s error path
Vasily Averin <[email protected]>
ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path
Vasily Averin <[email protected]>
ext4: add missing brelse() update_backups()'s error path
Michael Kelley <[email protected]>
clockevents/drivers/i8253: Add support for PIT shutdown quirk
Shaokun Zhang <[email protected]>
btrfs: tree-checker: Fix misleading group system information
Filipe Manana <[email protected]>
Btrfs: fix data corruption due to cloning of eof block
Filipe Manana <[email protected]>
Btrfs: fix infinite loop on inode eviction after deduplication of eof block
Robbie Ko <[email protected]>
Btrfs: fix cur_offset in the error case for nocow
Filipe Manana <[email protected]>
Btrfs: fix missing data checksums after a ranged fsync (msync)
Lu Fengqi <[email protected]>
btrfs: fix pinned underflow after transaction aborted
Mathieu Malaterre <[email protected]>
watchdog/core: Add missing prototypes for weak functions
H. Peter Anvin (Intel) <[email protected]>
arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
H. Peter Anvin <[email protected]>
termios, tty/tty_baudrate.c: fix buffer overrun
Michael Kelley <[email protected]>
x86/hyper-v: Enable PIT shutdown quirk
Steven Rostedt (VMware) <[email protected]>
x86/cpu/vmware: Do not trace vmware_sched_clock()
John Garry <[email protected]>
of, numa: Validate some distance map rules
Adrian Hunter <[email protected]>
perf intel-pt: Insert callchain context into synthesized callchains
Adrian Hunter <[email protected]>
perf intel-pt/bts: Calculate cpumode for synthesized samples
David S. Miller <[email protected]>
perf callchain: Honour the ordering of PERF_CONTEXT_{USER,KERNEL,etc}Thomas Richter <[email protected]>
perf stat: Handle different PMU names with common prefix
Leo Yan <[email protected]>
perf cs-etm: Correct CPU mode for samples
Dmitry Osipenko <[email protected]>
hwmon: (core) Fix double-free in __hwmon_device_register()
Arnd Bergmann <[email protected]>
mtd: docg3: don't set conflicting BCH_CONST_PARAMS option
Boris Brezillon <[email protected]>
mtd: nand: Fix nanddev_neraseblocks()
Christophe JAILLET <[email protected]>
mtd: spi-nor: cadence-quadspi: Return error code in cqspi_direct_read_execute()
Jarod Wilson <[email protected]>
bonding/802.3ad: fix link_failure_count tracking
Ard Biesheuvel <[email protected]>
ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm
Vasily Khoruzhick <[email protected]>
netfilter: conntrack: fix calculation of next bucket number in early_drop
Michal Hocko <[email protected]>
memory_hotplug: cond_resched in __remove_pages
Andrea Arcangeli <[email protected]>
mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
Wengang Wang <[email protected]>
ocfs2: free up write context when direct IO failed
Changwei Ge <[email protected]>
ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
Marc Zyngier <[email protected]>
soc: ti: QMSS: Fix usage of irq_set_affinity_hint
Christophe Leroy <[email protected]>
Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for CONFIG_SWAP"
Ming Lei <[email protected]>
SCSI: fix queue cleanup race before queue initialization is done
Quinn Tran <[email protected]>
scsi: qla2xxx: Initialize port speed to avoid setting lower speed
Greg Edwards <[email protected]>
vhost/scsi: truncate T10 PI iov_iter to prot_bytes
John Garry <[email protected]>
crypto: hisilicon - Fix reference after free of memories on error path
John Garry <[email protected]>
crypto: hisilicon - Fix NULL dereference for same dst and src
Gustavo A. R. Silva <[email protected]>
reset: hisilicon: fix potential NULL pointer dereference
Dan Williams <[email protected]>
acpi, nfit: Fix ARS overflow continuation
Vishal Verma <[email protected]>
acpi/nfit, x86/mce: Validate a MCE's address before using it
Vishal Verma <[email protected]>
acpi/nfit, x86/mce: Handle only uncorrectable machine checks
Mikulas Patocka <[email protected]>
mach64: fix image corruption due to reading accelerator registers
Mikulas Patocka <[email protected]>
mach64: fix display corruption on big endian machines
Dmitry Osipenko <[email protected]>
thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs
Yan, Zheng <[email protected]>
Revert "ceph: fix dentry leak in splice_dentry()"
Ilya Dryomov <[email protected]>
libceph: bump CEPH_MSG_MAX_DATA_LEN
Enric Balletbo i Serra <[email protected]>
clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call
Ziyuan Xu <[email protected]>
clk: rockchip: fix wrong mmc sample phase shift for rk3328
Icenowy Zheng <[email protected]>
clk: sunxi-ng: h6: fix bus clocks' divider position
Ronald Wahl <[email protected]>
clk: at91: Fix division by zero in PLL recalc_rate()
Krzysztof Kozlowski <[email protected]>
clk: s2mps11: Fix matching when built as module and DT node contains compatible
Richard Weinberger <[email protected]>
um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP
Max Filippov <[email protected]>
xtensa: fix boot parameters address translation
Max Filippov <[email protected]>
xtensa: make sure bFLT stack is 16 byte aligned
Max Filippov <[email protected]>
xtensa: add NOTES section to the linker script
Huacai Chen <[email protected]>
MIPS: Loongson-3: Fix BRIDGE irq delivery problem
Huacai Chen <[email protected]>
MIPS: Loongson-3: Fix CPU UART irq delivery problem
Minchan Kim <[email protected]>
zram: close udev startup race condition as default groups
Jerome Brunet <[email protected]>
clk: meson: axg: mark fdiv2 and fdiv3 as critical
Christian Hewitt <[email protected]>
clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL
Aaro Koskinen <[email protected]>
arm64: dts: stratix10: fix multicast filtering
Thor Thayer <[email protected]>
arm64: dts: stratix10: Support Ethernet Jumbo frame
Johan Hovold <[email protected]>
drm/msm: fix OF child-node lookup
Miklos Szeredi <[email protected]>
fuse: set FR_SENT while locked
Miklos Szeredi <[email protected]>
fuse: fix blocked_waitq wakeup
Kirill Tkhai <[email protected]>
fuse: Fix use-after-free in fuse_dev_do_write()
Kirill Tkhai <[email protected]>
fuse: Fix use-after-free in fuse_dev_do_read()
Amir Goldstein <[email protected]>
vfs: fix FIGETBSZ ioctl on an overlayfs file
Himanshu Madhani <[email protected]>
scsi: qla2xxx: Fix driver hang when FC-NVMe LUNs are configured
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix duplicate switch database entries
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix NVMe Target discovery
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix NVMe session hang on unload
Giridhar Malavali <[email protected]>
scsi: qla2xxx: Fix for double free of SRB structure
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix re-using LoopID when handle is in use
Quinn Tran <[email protected]>
scsi: qla2xxx: Reject bsg request if chip is down.
Quinn Tran <[email protected]>
scsi: qla2xxx: shutdown chip if reset fail
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix early srb free on abort
Quinn Tran <[email protected]>
scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix process response queue for ISP26XX and above
Himanshu Madhani <[email protected]>
scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
Yoshihiro Shimoda <[email protected]>
serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
Miklos Szeredi <[email protected]>
ovl: automatically enable redirect_dir on metacopy=on
Miklos Szeredi <[email protected]>
ovl: check whiteout in ovl_create_over_whiteout()
Amir Goldstein <[email protected]>
ovl: fix recursive oi->lock in ovl_link()
Amir Goldstein <[email protected]>
ovl: fix error handling in ovl_verify_set_fh()
Young_X <[email protected]>
cdrom: fix improper type cast, which can leat to information leak.
Hugues Fruchet <[email protected]>
media: ov5640: fix restore of last mode set
Dan Carpenter <[email protected]>
drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create()
Dominique Martinet <[email protected]>
9p: clear dangling pointers in p9stat_free
Hugues Fruchet <[email protected]>
media: ov5640: fix mode change regression
Sébastien Szymanski <[email protected]>
ARM: dts: imx6ull: keep IMX6UL_ prefix for signals on both i.MX6UL and i.MX6ULL
Jan Kara <[email protected]>
udf: Prevent write-unsupported filesystem to be remounted read-write
Dominique Martinet <[email protected]>
9p locks: fix glock.client_id leak in do_lock
Colin Ian King <[email protected]>
staging: most: video: fix registration of an empty comp core_component
Andrey Grodzovsky <[email protected]>
drm/amdgpu: Fix SDMA TO after GPU reset v3
Kieran Bingham <[email protected]>
drm: rcar-du: Update Gen3 output limitations
Alexandru Ardelean <[email protected]>
staging:iio:ad7606: fix voltage scales
Breno Leitao <[email protected]>
powerpc/selftests: Wait all threads to join
Marco Felsch <[email protected]>
media: tvp5150: fix width alignment during set_selection()
Phil Elwell <[email protected]>
sc16is7xx: Fix for multi-channel stall
John Garry <[email protected]>
serial: 8250_of: Fix for lack of interrupt support
Gao Xiang <[email protected]>
staging: erofs: fix a missing endian conversion
Huacai Chen <[email protected]>
MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS
Rashmica Gupta <[email protected]>
powerpc/memtrace: Remove memory in chunks
Joel Stanley <[email protected]>
powerpc/boot: Ensure _zimage_start is a weak symbol
Dengcheng Zhu <[email protected]>
MIPS: kexec: Mark CPU offline before disabling local IRQ
Lucas Stach <[email protected]>
media: coda: don't overwrite h.264 profile_idc on decoder instance
Nicholas Mc Guire <[email protected]>
media: pci: cx23885: handle adding to list failure
John Garry <[email protected]>
drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer
SivapiriyanKumarasamy <[email protected]>
drm/amd/display: fix gamma not being applied
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Raise dispclk value for dce120 by 15%
Tomi Valkeinen <[email protected]>
drm/omap: fix memory barrier bug in DMM driver
Christophe Leroy <[email protected]>
powerpc/mm: Don't report hugepage tables as memory leaks when using kmemleak
Sean Paul <[email protected]>
drm/msm: dpu: Allow planes to extend past active display
Stephen Boyd <[email protected]>
drm/msm/disp/dpu: Use proper define for drm_encoder_init() 'encoder_type'
Anders Roxell <[email protected]>
drm/msm/gpu: fix parameters in function msm_gpu_crashstate_capture
Daniel Axtens <[email protected]>
powerpc/nohash: fix undefined behaviour when testing page size support
Fabio Estevam <[email protected]>
ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL
Colin Ian King <[email protected]>
drm/amdgpu/powerplay: fix missing break in switch statements
Gustavo A. R. Silva <[email protected]>
drm/nouveau/secboot/acr: fix memory leak
Masami Hiramatsu <[email protected]>
tracing/kprobes: Check the probe on unloaded module correctly
Miles Chen <[email protected]>
tty: check name length in tty_find_polling_driver()
Sam Bobroff <[email protected]>
powerpc/eeh: Fix possible null deref in eeh_dump_dev_log()
Joel Stanley <[email protected]>
powerpc/Makefile: Fix PPC_BOOK3S_64 ASFLAGS
Randy Dunlap <[email protected]>
Input: wm97xx-ts - fix exit path
Su Sung Chung <[email protected]>
drm/amd/display: fix bug of accessing invalid memory
Christophe Leroy <[email protected]>
powerpc/mm: fix always true/false warning in slice.c
Michael Ellerman <[email protected]>
powerpc/mm: Fix page table dump to work on Radix
Nicholas Piggin <[email protected]>
powerpc/64/module: REL32 relocation range check
Christophe Leroy <[email protected]>
powerpc/traps: restore recoverability of machine_check interrupts
-------------
Diffstat:
Documentation/filesystems/overlayfs.txt | 6 ++ Makefile | 4 +- arch/alpha/include/asm/termios.h | 8 +- arch/alpha/include/uapi/asm/ioctls.h | 5 + arch/alpha/include/uapi/asm/termbits.h | 17 +++ arch/arm/boot/dts/imx6ull-pinfunc.h | 18 +++- arch/arm/configs/imx_v6_v7_defconfig | 1 + arch/arm/mm/proc-v7.S | 2 +- arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 9 ++ .../boot/dts/altera/socfpga_stratix10_socdk.dts | 2 +- arch/mips/include/asm/mach-loongson64/irq.h | 2 +- arch/mips/kernel/crash.c | 3 + arch/mips/kernel/machine_kexec.c | 3 + arch/mips/loongson64/loongson-3/irq.c | 56 ++-------- arch/mips/pci/pci-legacy.c | 4 + arch/powerpc/Makefile | 6 +- arch/powerpc/boot/crt0.S | 4 +- arch/powerpc/include/asm/mmu-8xx.h | 34 ++---- arch/powerpc/kernel/eeh.c | 5 + arch/powerpc/kernel/head_8xx.S | 45 ++++---- arch/powerpc/kernel/module_64.c | 9 +- arch/powerpc/kernel/traps.c | 9 +- arch/powerpc/mm/8xx_mmu.c | 2 +- arch/powerpc/mm/dump_linuxpagetables.c | 12 ++- arch/powerpc/mm/hugetlbpage.c | 3 + arch/powerpc/mm/slice.c | 21 ++-- arch/powerpc/mm/tlb_nohash.c | 3 + arch/powerpc/platforms/powernv/memtrace.c | 21 +++- arch/x86/include/asm/mce.h | 2 + arch/x86/kernel/cpu/mcheck/mce.c | 6 +- arch/x86/kernel/cpu/mshyperv.c | 11 ++ arch/x86/kernel/cpu/vmware.c | 2 +- arch/x86/um/shared/sysdep/ptrace_32.h | 10 -- arch/xtensa/boot/Makefile | 2 +- arch/xtensa/include/asm/processor.h | 6 +- arch/xtensa/kernel/head.S | 7 +- arch/xtensa/kernel/vmlinux.lds.S | 1 + block/blk-core.c | 5 +- crypto/crypto_user.c | 18 ++-- drivers/acpi/nfit/core.c | 4 +- drivers/acpi/nfit/mce.c | 8 +- drivers/ata/libata-core.c | 2 +- drivers/block/zram/zram_drv.c | 26 ++--- drivers/cdrom/cdrom.c | 2 +- drivers/clk/at91/clk-pll.c | 3 + drivers/clk/clk-s2mps11.c | 30 ++++++ drivers/clk/hisilicon/reset.c | 5 +- drivers/clk/meson/axg.c | 13 +++ drivers/clk/meson/gxbb.c | 12 +++ drivers/clk/rockchip/clk-ddr.c | 4 - drivers/clk/rockchip/clk-rk3328.c | 8 +- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 8 +- drivers/clocksource/i8253.c | 14 ++- drivers/cpuidle/cpuidle-arm.c | 22 ++-- drivers/crypto/hisilicon/sec/sec_algs.c | 31 +++--- drivers/firmware/efi/libstub/fdt.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 17 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 3 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 19 +++- drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c | 3 + .../drm/amd/display/modules/color/color_gamma.c | 8 +- drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c | 5 +- drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 2 + drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c | 2 + .../gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c | 2 + .../gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c | 2 + .../gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c | 2 + drivers/gpu/drm/drm_atomic_helper.c | 21 +++- drivers/gpu/drm/drm_dp_mst_topology.c | 3 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 14 ++- drivers/gpu/drm/etnaviv/etnaviv_sched.c | 2 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 + drivers/gpu/drm/i915/gvt/gtt.h | 1 - drivers/gpu/drm/i915/i915_gem.c | 12 +-- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 +- drivers/gpu/drm/i915/i915_gem_gtt.c | 2 +- drivers/gpu/drm/i915/i915_gem_gtt.h | 36 ++++--- drivers/gpu/drm/i915/i915_reg.h | 8 +- drivers/gpu/drm/i915/intel_audio.c | 17 +++ drivers/gpu/drm/i915/intel_display.c | 120 +++++++++++---------- drivers/gpu/drm/i915/intel_dp.c | 50 ++++++--- drivers/gpu/drm/i915/intel_dp_link_training.c | 26 ++--- drivers/gpu/drm/i915/intel_dp_mst.c | 49 ++++----- drivers/gpu/drm/i915/intel_hotplug.c | 70 ++++++++---- drivers/gpu/drm/i915/intel_lpe_audio.c | 4 +- drivers/gpu/drm/i915/intel_lrc.c | 14 ++- drivers/gpu/drm/i915/intel_ringbuffer.c | 38 ++++++- drivers/gpu/drm/i915/selftests/huge_pages.c | 2 +- drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 6 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 5 +- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 3 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 34 +++--- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 1 - drivers/gpu/drm/msm/msm_drv.h | 2 + drivers/gpu/drm/msm/msm_gpu.c | 4 +- drivers/gpu/drm/nouveau/dispnv50/disp.c | 14 +-- drivers/gpu/drm/nouveau/nouveau_backlight.c | 4 +- .../gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c | 1 + drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 11 ++ drivers/gpu/drm/rcar-du/rcar_du_kms.c | 14 ++- drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 6 ++ drivers/hwmon/hwmon.c | 8 +- drivers/input/touchscreen/wm97xx-core.c | 3 +- drivers/media/i2c/ov5640.c | 33 ++++-- drivers/media/i2c/tvp5150.c | 14 ++- drivers/media/pci/cx23885/altera-ci.c | 10 ++ drivers/media/platform/coda/coda-common.c | 3 +- drivers/mtd/devices/Kconfig | 2 +- drivers/mtd/spi-nor/cadence-quadspi.c | 2 +- drivers/net/bonding/bond_main.c | 4 +- drivers/of/of_numa.c | 9 +- drivers/rtc/hctosys.c | 4 +- drivers/scsi/qla2xxx/qla_bsg.c | 2 +- drivers/scsi/qla2xxx/qla_gs.c | 9 +- drivers/scsi/qla2xxx/qla_init.c | 40 +++---- drivers/scsi/qla2xxx/qla_iocb.c | 17 --- drivers/scsi/qla2xxx/qla_mbx.c | 5 +- drivers/scsi/qla2xxx/qla_nvme.c | 5 +- drivers/scsi/qla2xxx/qla_os.c | 4 +- drivers/scsi/qla2xxx/qla_target.c | 3 +- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 - drivers/scsi/scsi_lib.c | 8 ++ drivers/soc/ti/knav_qmss.h | 4 +- drivers/soc/ti/knav_qmss_acc.c | 10 +- drivers/soc/ti/knav_qmss_queue.c | 22 ++-- drivers/staging/erofs/unzip_vle.c | 8 +- drivers/staging/iio/adc/ad7606.c | 7 +- drivers/staging/most/video/video.c | 4 +- drivers/thermal/thermal_core.c | 3 +- drivers/tty/serial/8250/8250_of.c | 22 ++-- drivers/tty/serial/sc16is7xx.c | 19 ++-- drivers/tty/serial/sh-sci.c | 4 +- drivers/tty/tty_baudrate.c | 4 +- drivers/tty/tty_io.c | 2 +- drivers/vhost/scsi.c | 4 +- drivers/video/fbdev/aty/mach64_accel.c | 28 +++-- fs/9p/vfs_file.c | 16 ++- fs/btrfs/disk-io.c | 12 ++- fs/btrfs/inode.c | 5 +- fs/btrfs/ioctl.c | 14 ++- fs/btrfs/tree-checker.c | 2 +- fs/btrfs/tree-log.c | 17 +++ fs/ceph/inode.c | 8 +- fs/ext4/inode.c | 5 +- fs/ext4/namei.c | 5 +- fs/ext4/resize.c | 28 ++--- fs/ext4/super.c | 17 +-- fs/ext4/xattr.c | 21 +++- fs/fuse/dev.c | 41 +++++-- fs/fuse/file.c | 4 +- fs/gfs2/bmap.c | 14 ++- fs/gfs2/rgrp.c | 3 +- fs/inode.c | 7 +- fs/ioctl.c | 3 + fs/namespace.c | 28 +++-- fs/nfs/nfs4state.c | 8 +- fs/nfsd/nfs4proc.c | 3 + fs/ocfs2/aops.c | 12 ++- fs/ocfs2/cluster/masklog.h | 9 ++ fs/ocfs2/dir.c | 3 +- fs/overlayfs/dir.c | 8 ++ fs/overlayfs/namei.c | 4 +- fs/overlayfs/super.c | 36 +++++-- fs/udf/super.c | 30 +++--- fs/udf/udf_sb.h | 2 + include/linux/ceph/libceph.h | 8 +- include/linux/i8253.h | 1 + include/linux/mtd/nand.h | 5 +- include/linux/nmi.h | 2 + include/uapi/linux/kfd_ioctl.h | 8 +- include/xen/xen-ops.h | 2 +- kernel/debug/kdb/kdb_bt.c | 4 +- kernel/debug/kdb/kdb_main.c | 14 +-- kernel/debug/kdb/kdb_support.c | 12 +-- kernel/trace/trace_kprobe.c | 39 ++++--- lib/ubsan.c | 3 +- mm/hugetlb.c | 23 +++- mm/memory_hotplug.c | 1 + mm/mempolicy.c | 32 +++++- mm/swapfile.c | 6 +- net/9p/protocol.c | 5 + net/netfilter/nf_conntrack_core.c | 13 ++- net/sunrpc/xdr.c | 5 +- scripts/spdxcheck.py | 1 - security/selinux/hooks.c | 3 + tools/perf/util/cs-etm.c | 39 +++++-- tools/perf/util/intel-bts.c | 17 ++- tools/perf/util/intel-pt.c | 28 +++-- tools/perf/util/machine.c | 35 +++++- tools/perf/util/pmu.c | 2 +- tools/perf/util/thread-stack.c | 44 ++++++-- tools/perf/util/thread-stack.h | 2 +- tools/testing/selftests/powerpc/tm/tm-tmspr.c | 27 +++-- 198 files changed, 1542 insertions(+), 785 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/205 powerpc/traps: restore recoverability of machine_check interrupts
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit daf00ae71dad8aa05965713c62558aeebf2df48e ]
commit b96672dd840f ("powerpc: Machine check interrupt is a non- maskable interrupt") added a call to nmi_enter() at the beginning of machine check restart exception handler. Due to that, in_interrupt() always returns true regardless of the state before entering the exception, and die() panics even when the system was not already in interrupt.
This patch calls nmi_exit() before calling die() in order to restore the interrupt state we had before calling nmi_enter()
--- arch/powerpc/kernel/traps.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/powerpc/kernel/traps.c +7 -2
@@ -767,12 +767,17 @@ void machine_check_exception(struct pt_rif (check_io_access (regs)) goto bail; -die ("Machine check" , regs,SIGBUS ); -/* Must die if the interrupt is not recoverable */ if (!(regs->msr &MSR_RI ))nmi_panic (regs,"Unrecoverable Machine check" ); +if (!nested) +nmi_exit (); + +die ("Machine check" , regs,SIGBUS ); + +return ; + bail:if (!nested)nmi_exit ();
Greg Kroah-Hartman
maintainerPATCH 2/205 powerpc/64/module: REL32 relocation range check
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <[email protected]>
[ Upstream commit b851ba02a6f3075f0f99c60c4bc30a4af80cf428 ]
The recent module relocation overflow crash demonstrated that we have no range checking on REL32 relative relocations. This patch implements a basic check, the same kernel that previously oopsed and rebooted now continues with some of these errors when loading the module:
module_64: x_tables: REL32 527703503449812 out of range!
Possibly other relocations (ADDR32, REL16, TOC16, etc.) should also have overflow checks.
--- arch/powerpc/kernel/module_64.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
arch/powerpc/kernel/module_64.c +8 -1
@@ -680,7 +680,14 @@ int apply_relocate_add(Elf64_Shdr *sechdcase R_PPC64_REL32 :/* 32 bits relative (used by relative exception tables) */ - *(u32 *)location = value - (unsigned long )location; +/* Convert value to relative */ + value -= (unsigned long )location; +if (value +0x80000000 >0xffffffff ) { +pr_err ("%s: REL32 %li out of range!\n" , + me->name, (long int )value); +return -ENOEXEC ; + } + *(u32 *)location = value;break ;case R_PPC64_TOCSAVE :
Greg Kroah-Hartman
maintainerPATCH 3/205 powerpc/mm: Fix page table dump to work on Radix
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 0d923962ab69c27cca664a2d535e90ef655110ca ]
When we're running on Book3S with the Radix MMU enabled the page table dump currently prints the wrong addresses because it uses the wrong start address.
Fix it to use PAGE_OFFSET rather than KERN_VIRT_START.
--- arch/powerpc/mm/dump_linuxpagetables.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/powerpc/mm/dump_linuxpagetables.c +9 -3
@@ -418,12 +418,13 @@ static void walk_pagetables(struct pg_stunsigned int i;unsigned long addr; + addr = st->start_address; +/* * Traverse the linux pagetable structure and dump pages that are in * the hash pagetable. */ -for (i =0 ; i <PTRS_PER_PGD ; i++, pgd++) { - addr =KERN_VIRT_START + i *PGDIR_SIZE ; +for (i =0 ; i <PTRS_PER_PGD ; i++, pgd++, addr +=PGDIR_SIZE ) {if (!pgd_none (*pgd) && !pgd_huge (*pgd))/* pgd exists */ walk_pud (st, pgd, addr);
@@ -472,9 +473,14 @@ static int ptdump_show(struct seq_file * {struct pg_state st = { .seq = m, - .start_address =KERN_VIRT_START , .marker = address_markers, }; + +if (radix_enabled ()) + st.start_address =PAGE_OFFSET ; +else + st.start_address =KERN_VIRT_START ; +/* Traverse kernel page tables */ walk_pagetables (&st);note_page (&st,0 ,0 ,0 );
Greg Kroah-Hartman
maintainerPATCH 4/205 powerpc/mm: fix always true/false warning in slice.c
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 37e9c674e7e6f445e12cb1151017bd4bacdd1e2d ]
This patch fixes the following warnings (obtained with make W=1).
arch/powerpc/mm/slice.c: In function 'slice_range_to_mask':arch/powerpc/mm/slice.c:73:12: error: comparison is always true due to limited range of data type [-Werror=type-limits]
if (start < SLICE_LOW_TOP) {
^
arch/powerpc/mm/slice.c:81:20: error: comparison is always false due to limited range of data type [-Werror=type-limits]
if ((start + len) > SLICE_LOW_TOP) {
^
arch/powerpc/mm/slice.c: In function 'slice_mask_for_free':
arch/powerpc/mm/slice.c:136:17: error: comparison is always true due to limited range of data type [-Werror=type-limits]
if (high_limit <= SLICE_LOW_TOP)
^
arch/powerpc/mm/slice.c: In function 'slice_check_range_fits':
arch/powerpc/mm/slice.c:185:12: error: comparison is always true due to limited range of data type [-Werror=type-limits]
if (start < SLICE_LOW_TOP) {
^
arch/powerpc/mm/slice.c:195:39: error: comparison is always false due to limited range of data type [-Werror=type-limits]
if (SLICE_NUM_HIGH && ((start + len) > SLICE_LOW_TOP)) {
^
arch/powerpc/mm/slice.c: In function 'slice_scan_available':
arch/powerpc/mm/slice.c:306:11: error: comparison is always true due to limited range of data type [-Werror=type-limits]
if (addr < SLICE_LOW_TOP) {
^
arch/powerpc/mm/slice.c: In function 'get_slice_psize':
arch/powerpc/mm/slice.c:709:11: error: comparison is always true due to limited range of data type [-Werror=type-limits]
if (addr < SLICE_LOW_TOP) {
^--- arch/powerpc/mm/slice.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
arch/powerpc/mm/slice.c +14 -7
@@ -61,6 +61,13 @@ static void slice_print_mask(const char#endif +static inline bool slice_addr_is_low (unsigned long addr) +{ +u64 tmp = (u64 )addr; + +return tmp <SLICE_LOW_TOP ; +} +static void slice_range_to_mask (unsigned long start,unsigned long len,struct slice_mask *ret) {
@@ -70,7 +77,7 @@ static void slice_range_to_mask(unsignedif (SLICE_NUM_HIGH )bitmap_zero (ret->high_slices,SLICE_NUM_HIGH ); -if (start <SLICE_LOW_TOP ) { +if (slice_addr_is_low (start)) {unsigned long mend =min (end, (unsigned long )(SLICE_LOW_TOP -1 ));
@@ -78,7 +85,7 @@ static void slice_range_to_mask(unsigned - (1u <<GET_LOW_SLICE_INDEX (start)); } -if ((start + len) >SLICE_LOW_TOP ) { +if (SLICE_NUM_HIGH && !slice_addr_is_low (end)) {unsigned long start_index =GET_HIGH_SLICE_INDEX (start);unsigned long align_end =ALIGN (end, (1UL <<SLICE_HIGH_SHIFT ));unsigned long count =GET_HIGH_SLICE_INDEX (align_end) - start_index;
@@ -133,7 +140,7 @@ static void slice_mask_for_free(struct mif (!slice_low_has_vma (mm, i)) ret->low_slices |=1u << i; -if (high_limit <=SLICE_LOW_TOP ) +if (slice_addr_is_low (high_limit -1 ))return ;for (i =0 ; i <GET_HIGH_SLICE_INDEX (high_limit); i++)
@@ -182,7 +189,7 @@ static bool slice_check_range_fits(strucunsigned long end = start + len -1 ;u64 low_slices =0 ; -if (start <SLICE_LOW_TOP ) { +if (slice_addr_is_low (start)) {unsigned long mend =min (end, (unsigned long )(SLICE_LOW_TOP -1 ));
@@ -192,7 +199,7 @@ static bool slice_check_range_fits(strucif ((low_slices & available->low_slices) != low_slices)return false; -if (SLICE_NUM_HIGH && ((start + len) >SLICE_LOW_TOP )) { +if (SLICE_NUM_HIGH && !slice_addr_is_low (end)) {unsigned long start_index =GET_HIGH_SLICE_INDEX (start);unsigned long align_end =ALIGN (end, (1UL <<SLICE_HIGH_SHIFT ));unsigned long count =GET_HIGH_SLICE_INDEX (align_end) - start_index;
@@ -303,7 +310,7 @@ static bool slice_scan_available(unsigne int end, unsigned long *boundary_addr) { unsigned long slice; -if (addr <SLICE_LOW_TOP ) { +if (slice_addr_is_low (addr)) { slice =GET_LOW_SLICE_INDEX (addr); *boundary_addr = (slice + end) <<SLICE_LOW_SHIFT ;return !!(available->low_slices & (1u << slice));
@@ -706,7 +713,7 @@ unsigned int get_slice_psize(struct mm_sVM_BUG_ON (radix_enabled ()); -if (addr <SLICE_LOW_TOP ) { +if (slice_addr_is_low (addr)) { psizes = mm->context.low_slices_psize; index =GET_LOW_SLICE_INDEX (addr); }else {
Greg Kroah-Hartman
maintainerPATCH 5/205 drm/amd/display: fix bug of accessing invalid memory
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Sung Chung <[email protected]>
[ Upstream commit 43c3ff27a47d83d153c4adc088243ba594582bf5 ]
[Why]
A loop inside of build_evenly_distributed_points function that traverse through the array of points become an infinite loop when m_GammaUpdates does not get assigned to any value.
[How]
In DMColor, clear m_gammaIsValid bit just before writting all Zeromem for m_GammaUpdates, to prevent calling build_evenly_distributed_points before m_GammaUpdates gets assigned to some value.
--- drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/modules/color/color_gamma.c +6 -2
@@ -1069,10 +1069,14 @@ static void build_evenly_distributed_poi struct dividers dividers) {struct gamma_pixel *p = points; -struct gamma_pixel *p_last = p + numberof_points -1 ; +struct gamma_pixel *p_last;uint32_t i =0 ; +// This function should not gets called with 0 as a parameter +ASSERT (numberof_points >0 ); + p_last = p + numberof_points -1 ; + do { struct fixed31_32 value = dc_fixpt_from_fraction(i, numberof_points - 1);
@@ -1083,7 +1087,7 @@ static void build_evenly_distributed_poi ++p; ++i; - }while (i != numberof_points); + }while (i < numberof_points); p->r =dc_fixpt_div (p_last->r, dividers.divider1); p->g =dc_fixpt_div (p_last->g, dividers.divider1);
Greg Kroah-Hartman
maintainerPATCH 6/205 Input: wm97xx-ts - fix exit path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit a3f7c3fcf60868c1e90671df5d0cf9be5900a09b ]
Loading then unloading wm97xx-ts.ko when CONFIG_AC97_BUS=m causes a WARNING: from drivers/base/driver.c:
Unexpected driver unregister!
WARNING: CPU: 0 PID: 1709 at ../drivers/base/driver.c:193 driver_unregister+0x30/0x40
Fix this by only calling driver_unregister() with the same condition that driver_register() is called.
--- drivers/input/touchscreen/wm97xx-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/input/touchscreen/wm97xx-core.c +2 -1
@@ -929,7 +929,8 @@ static int __init wm97xx_init(void) static void __exit wm97xx_exit(void) { -driver_unregister (&wm97xx_driver); +if (IS_BUILTIN (CONFIG_AC97_BUS )) +driver_unregister (&wm97xx_driver);platform_driver_unregister (&wm97xx_mfd_driver); }
Greg Kroah-Hartman
maintainerPATCH 7/205 powerpc/Makefile: Fix PPC_BOOK3S_64 ASFLAGS
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Stanley <[email protected]>
[ Upstream commit 960e30029863db95ec79a71009272d4661db5991 ]
Ever since commit 15a3204d24a3 ("powerpc/64s: Set assembler machine type to POWER4") we force -mpower4 to be passed to the assembler irrespective of the CFLAGS used (for Book3s 64).
When building a powerpc64 kernel with clang, clang will not add -many to the assembler flags, so any instructions that the compiler has generated that are not available on power4 will cause an error:
/usr/bin/as -a64 -mppc64 -mlittle-endian -mpower8 \ -I ./arch/powerpc/include -I ./arch/powerpc/include/generated \ -I ./include -I ./arch/powerpc/include/uapi \ -I ./arch/powerpc/include/generated/uapi -I ./include/uapi \ -I ./include/generated/uapi -I arch/powerpc -I arch/powerpc \ -maltivec -mpower4 -o init/do_mounts.o /tmp/do_mounts-3b0a3d.s /tmp/do_mounts-51ce54.s:748: Error: unrecognized opcode: `isel'
GCC does include -many, so the GCC driven gas call will succeed:
as -v -I ./arch/powerpc/include -I ./arch/powerpc/include/generated -I ./include -I ./arch/powerpc/include/uapi
-I ./arch/powerpc/include/generated/uapi -I ./include/uapi -I ./include/generated/uapi -I arch/powerpc -I arch/powerpc
-a64 -mpower8 -many -mlittle -maltivec -mpower4 -o init/do_mounts.o
Note that isel is power7 and above for IBM CPUs. GCC only generates it for Power9 and above, but the above test was run against the clang generated assembly.
Peter Bergner explains:
When using -many -mpower4, gas will first try and find a matching power4 mnemonic and failing that, it will then allow any valid mnemonic that gas knows about. GCC's use of -many predates me though.
IIRC, Alan looked at trying to remove it, but I forget why he didn't. Could be either a gcc or gas issue at the time. I'm not sure whether issue still exists or not. He and I have modified how gas works internally a fair amount since he tried removing gcc use of -many.
I will also note that when using -many, gas will choose the first mnemonic that matches in the mnemonic table and we have (mostly) sorted the table so that server mnemonics show up earlier in the table than other mnemonics, so they'll be seen/chosen first.
By explicitly setting -many we can build with Clang and GCC while retaining the -mpower4 option.
--- arch/powerpc/Makefile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/powerpc/Makefile +5 -1
@@ -238,7 +238,11 @@ cpu-as-$(CONFIG_4xx) += -Wa,-m405 cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec) cpu-as-$(CONFIG_E200) += -Wa,-me200 cpu-as-$(CONFIG_E500) += -Wa,-me500 -cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4 + +# When using '-many -mpower4' gas will first try and find a matching power4 +# mnemonic and failing that it will allow any valid mnemonic that GAS knows +# about. GCC will pass -many to GAS when assembling, clang does not. +cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4 -Wa,-many cpu-as-$(CONFIG_PPC_E500MC) += $(call as-option,-Wa$(comma)-me500mc) KBUILD_AFLAGS += $(cpu-as-y)
Greg Kroah-Hartman
maintainerPATCH 8/205 powerpc/eeh: Fix possible null deref in eeh_dump_dev_log()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Bobroff <[email protected]>
[ Upstream commit f9bc28aedfb5bbd572d2d365f3095c1becd7209b ]
If an error occurs during an unplug operation, it's possible for eeh_dump_dev_log() to be called when edev->pdn is null, which currently leads to dereferencing a null pointer.
Handle this by skipping the error log for those devices.
--- arch/powerpc/kernel/eeh.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/kernel/eeh.c +5 -0
@@ -169,6 +169,11 @@ static size_t eeh_dump_dev_log(struct eeint n =0 , l =0 ;char buffer[128 ]; +if (!pdn) { +pr_warn ("EEH: Note: No error log for absent device.\n" ); +return 0 ; + } + n +=scnprintf (buf+n, len-n,"%04x:%02x:%02x.%01x\n" , pdn->phb->global_number, pdn->busno,PCI_SLOT (pdn->devfn),PCI_FUNC (pdn->devfn));
Greg Kroah-Hartman
maintainerPATCH 9/205 tty: check name length in tty_find_polling_driver()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miles Chen <[email protected]>
[ Upstream commit 33a1a7be198657c8ca26ad406c4d2a89b7162bcc ]
The issue is found by a fuzzing test.
If tty_find_polling_driver() recevies an incorrect input such as ',,' or '0b', the len becomes 0 and strncmp() always return 0. In this case, a null p->ops->poll_init() is called and it causes a kernel panic.
Fix this by checking name length against zero in tty_find_polling_driver().
$echo ,, > /sys/module/kgdboc/parameters/kgdboc
[ 20.804451] WARNING: CPU: 1 PID: 104 at drivers/tty/serial/serial_core.c:457 uart_get_baud_rate+0xe8/0x190 [ 20.804917] Modules linked in: [ 20.805317] CPU: 1 PID: 104 Comm: sh Not tainted 4.19.0-rc7ajb #8 [ 20.805469] Hardware name: linux,dummy-virt (DT) [ 20.805732] pstate: 20000005 (nzCv daif -PAN -UAO) [ 20.805895] pc : uart_get_baud_rate+0xe8/0x190 [ 20.806042] lr : uart_get_baud_rate+0xc0/0x190 [ 20.806476] sp : ffffffc06acff940 [ 20.806676] x29: ffffffc06acff940 x28: 0000000000002580 [ 20.806977] x27: 0000000000009600 x26: 0000000000009600 [ 20.807231] x25: ffffffc06acffad0 x24: 00000000ffffeff0 [ 20.807576] x23: 0000000000000001 x22: 0000000000000000 [ 20.807807] x21: 0000000000000001 x20: 0000000000000000 [ 20.808049] x19: ffffffc06acffac8 x18: 0000000000000000 [ 20.808277] x17: 0000000000000000 x16: 0000000000000000 [ 20.808520] x15: ffffffffffffffff x14: ffffffff00000000 [ 20.808757] x13: ffffffffffffffff x12: 0000000000000001 [ 20.809011] x11: 0101010101010101 x10: ffffff880d59ff5f [ 20.809292] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3 [ 20.809549] x7 : 0000000000000000 x6 : ffffff880d59ff5f [ 20.809803] x5 : 0000000080008001 x4 : 0000000000000003 [ 20.810056] x3 : ffffff900853e6b4 x2 : dfffff9000000000 [ 20.810693] x1 : ffffffc06acffad0 x0 : 0000000000000cb0 [ 20.811005] Call trace: [ 20.811214] uart_get_baud_rate+0xe8/0x190 [ 20.811479] serial8250_do_set_termios+0xe0/0x6f4 [ 20.811719] serial8250_set_termios+0x48/0x54 [ 20.811928] uart_set_options+0x138/0x1bc [ 20.812129] uart_poll_init+0x114/0x16c [ 20.812330] tty_find_polling_driver+0x158/0x200 [ 20.812545] configure_kgdboc+0xbc/0x1bc [ 20.812745] param_set_kgdboc_var+0xb8/0x150 [ 20.812960] param_attr_store+0xbc/0x150 [ 20.813160] module_attr_store+0x40/0x58 [ 20.813364] sysfs_kf_write+0x8c/0xa8 [ 20.813563] kernfs_fop_write+0x154/0x290 [ 20.813764] vfs_write+0xf0/0x278 [ 20.813951] __arm64_sys_write+0x84/0xf4 [ 20.814400] el0_svc_common+0xf4/0x1dc [ 20.814616] el0_svc_handler+0x98/0xbc [ 20.814804] el0_svc+0x8/0xc [ 20.822005] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 20.826913] Mem abort info: [ 20.827103] ESR = 0x84000006 [ 20.827352] Exception class = IABT (current EL), IL = 16 bits [ 20.827655] SET = 0, FnV = 0 [ 20.827855] EA = 0, S1PTW = 0 [ 20.828135] user pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____) [ 20.828484] [0000000000000000] pgd=00000000aadee003, pud=00000000aadee003, pmd=0000000000000000 [ 20.829195] Internal error: Oops: 84000006 [#1] SMP [ 20.829564] Modules linked in: [ 20.829890] CPU: 1 PID: 104 Comm: sh Tainted: G W 4.19.0-rc7ajb #8 [ 20.830545] Hardware name: linux,dummy-virt (DT) [ 20.830829] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 20.831174] pc : (null) [ 20.831457] lr : serial8250_do_set_termios+0x358/0x6f4 [ 20.831727] sp : ffffffc06acff9b0 [ 20.831936] x29: ffffffc06acff9b0 x28: ffffff9008d7c000 [ 20.832267] x27: ffffff900969e16f x26: 0000000000000000 [ 20.832589] x25: ffffff900969dfb0 x24: 0000000000000000 [ 20.832906] x23: ffffffc06acffad0 x22: ffffff900969e160 [ 20.833232] x21: 0000000000000000 x20: ffffffc06acffac8 [ 20.833559] x19: ffffff900969df90 x18: 0000000000000000 [ 20.833878] x17: 0000000000000000 x16: 0000000000000000 [ 20.834491] x15: ffffffffffffffff x14: ffffffff00000000 [ 20.834821] x13: ffffffffffffffff x12: 0000000000000001 [ 20.835143] x11: 0101010101010101 x10: ffffff880d59ff5f [ 20.835467] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3 [ 20.835790] x7 : 0000000000000000 x6 : ffffff880d59ff5f [ 20.836111] x5 : c06419717c314100 x4 : 0000000000000007 [ 20.836419] x3 : 0000000000000000 x2 : 0000000000000000 [ 20.836732] x1 : 0000000000000001 x0 : ffffff900969df90 [ 20.837100] Process sh (pid: 104, stack limit = 0x(____ptrval____)) [ 20.837396] Call trace: [ 20.837566] (null) [ 20.837816] serial8250_set_termios+0x48/0x54 [ 20.838089] uart_set_options+0x138/0x1bc [ 20.838570] uart_poll_init+0x114/0x16c [ 20.838834] tty_find_polling_driver+0x158/0x200 [ 20.839119] configure_kgdboc+0xbc/0x1bc [ 20.839380] param_set_kgdboc_var+0xb8/0x150 [ 20.839658] param_attr_store+0xbc/0x150 [ 20.839920] module_attr_store+0x40/0x58 [ 20.840183] sysfs_kf_write+0x8c/0xa8 [ 20.840183] sysfs_kf_write+0x8c/0xa8 [ 20.840440] kernfs_fop_write+0x154/0x290 [ 20.840702] vfs_write+0xf0/0x278 [ 20.840942] __arm64_sys_write+0x84/0xf4 [ 20.841209] el0_svc_common+0xf4/0x1dc [ 20.841471] el0_svc_handler+0x98/0xbc [ 20.841713] el0_svc+0x8/0xc [ 20.842057] Code: bad PC value [ 20.842764] ---[ end trace a8835d7de79aaadf ]--- [ 20.843134] Kernel panic - not syncing: Fatal exception [ 20.843515] SMP: stopping secondary CPUs [ 20.844289] Kernel Offset: disabled [ 20.844634] CPU features: 0x0,21806002 [ 20.844857] Memory Limit: none [ 20.845172] ---[ end Kernel panic - not syncing: Fatal exception ]---
--- drivers/tty/tty_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/tty_io.c +1 -1
@@ -408,7 +408,7 @@ struct tty_driver *tty_find_polling_drivmutex_lock (&tty_mutex);/* Search through the tty devices to look for a match */ list_for_each_entry (p, &tty_drivers, tty_drivers) { -if (strncmp (name, p->name, len) !=0 ) +if (!len ||strncmp (name, p->name, len) !=0 )continue ; stp = str;if (*stp ==',' )
Greg Kroah-Hartman
maintainerPATCH 10/205 tracing/kprobes: Check the probe on unloaded module correctly
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <[email protected]>
[ Upstream commit 59158ec4aef7d44be51a6f3e7e17fc64c32604eb ]
Current kprobe event doesn't checks correctly whether the given event is on unloaded module or not. It just checks the event has ":" in the name.
That is not enough because if we define a probe on non-exist symbol on loaded module, it allows to define that (with warning message)
To ensure it correctly, this searches the module name on loaded module list and only if there is not, it allows to define it. (this event will be available when the target module is loaded)
--- kernel/trace/trace_kprobe.c | 39 ++++++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 13 deletions(-)
kernel/trace/trace_kprobe.c +26 -13
@@ -61,9 +61,23 @@ static nokprobe_inline bool trace_kprobereturn strncmp (mod->name, name, len) ==0 && name[len] ==':' ; } -static nokprobe_inline bool trace_kprobe_is_on_module(struct trace_kprobe *tk) +static nokprobe_inline bool trace_kprobe_module_exist(struct trace_kprobe *tk) { -return !!strchr (trace_kprobe_symbol (tk),':' ); +char *p; +bool ret; + +if (!tk->symbol) +return false; + p =strchr (tk->symbol,':' ); +if (!p) +return true; + *p ='\0' ; +mutex_lock (&module_mutex); + ret = !!find_module (tk->symbol); +mutex_unlock (&module_mutex); + *p =':' ; + +return ret; }static nokprobe_inline unsigned long trace_kprobe_nhit (struct trace_kprobe *tk)
@@ -554,19 +568,13 @@ static int __register_trace_kprobe(strucelse ret =register_kprobe (&tk->rp.kp); -if (ret ==0 ) +if (ret ==0 ) { tk->tp.flags |=TP_FLAG_REGISTERED ; -else { -if (ret == -ENOENT &&trace_kprobe_is_on_module (tk)) { -pr_warn ("This probe might be able to register after target module is loaded. Continue.\n" ); - ret =0 ; - }else if (ret == -EILSEQ ) { -pr_warn ("Probing address(0x%p) is not an instruction boundary.\n" , - tk->rp.kp.addr); - ret = -EINVAL ; - } + }else if (ret == -EILSEQ ) { +pr_warn ("Probing address(0x%p) is not an instruction boundary.\n" , + tk->rp.kp.addr); + ret = -EINVAL ; } -return ret; }
@@ -629,6 +637,11 @@ static int register_trace_kprobe(struct/* Register k*probe */ ret =__register_trace_kprobe (tk); +if (ret == -ENOENT && !trace_kprobe_module_exist (tk)) { +pr_warn ("This probe might be able to register after target module is loaded. Continue.\n" ); + ret =0 ; + } +if (ret <0 )unregister_kprobe_event (tk);else
Greg Kroah-Hartman
maintainerPATCH 11/205 drm/nouveau/secboot/acr: fix memory leak
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Gustavo A. R. Silva" <[email protected]>
[ Upstream commit 74a07c0a59fa372b069d879971ba4d9e341979cf ]
In case memory resources for *bl_desc* were allocated, release them before return.
Addresses-Coverity-ID: 1472021 ("Resource leak")
--- drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c +1 -0
@@ -801,6 +801,7 @@ acr_r352_load(struct nvkm_acr *_acr, str bl = acr->hsbl_unload_blob; }else {nvkm_error (_acr->subdev,"invalid secure boot blob!\n" ); +kfree (bl_desc);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 12/205 drm/amdgpu/powerplay: fix missing break in switch statements
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 14b284832e7dea6f54f0adfd7bed105548b94e57 ]
There are several switch statements that are missing break statements. Add missing breaks to handle any fall-throughs corner cases.
Detected by CoverityScan, CID#1457175 ("Missing break in switch")
--- drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 2 ++ drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c | 2 ++ drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c | 2 ++ drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c | 2 ++ drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c | 2 ++ 5 files changed, 10 insertions(+)
drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +2 -0
@@ -2268,11 +2268,13 @@ static uint32_t ci_get_offsetof(uint32_tcase DRAM_LOG_BUFF_SIZE :return offsetof(SMU7_SoftRegisters , DRAM_LOG_BUFF_SIZE); } +break ;case SMU_Discrete_DpmTable:switch (member) {case LowSclkInterruptThreshold:return offsetof(SMU7_Discrete_DpmTable , LowSclkInterruptT); } +break ; }pr_debug ("can't get the offset of type %x member %x\n" , type, member);return 0 ;
drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c +2 -0
@@ -2330,6 +2330,7 @@ static uint32_t fiji_get_offsetof(uint32case DRAM_LOG_BUFF_SIZE :return offsetof(SMU73_SoftRegisters , DRAM_LOG_BUFF_SIZE); } +break ;case SMU_Discrete_DpmTable:switch (member) {case UvdBootLevel:
@@ -2339,6 +2340,7 @@ static uint32_t fiji_get_offsetof(uint32case LowSclkInterruptThreshold:return offsetof(SMU73_Discrete_DpmTable , LowSclkInterruptThreshold); } +break ; }pr_warn ("can't get the offset of type %x member %x\n" , type, member);return 0 ;
drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c +2 -0
@@ -2236,11 +2236,13 @@ static uint32_t iceland_get_offsetof(uincase DRAM_LOG_BUFF_SIZE :return offsetof(SMU71_SoftRegisters , DRAM_LOG_BUFF_SIZE); } +break ;case SMU_Discrete_DpmTable:switch (member) {case LowSclkInterruptThreshold:return offsetof(SMU71_Discrete_DpmTable , LowSclkInterruptThreshold); } +break ; }pr_warn ("can't get the offset of type %x member %x\n" , type, member);return 0 ;
drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c +2 -0
@@ -2618,6 +2618,7 @@ static uint32_t tonga_get_offsetof(uint3case DRAM_LOG_BUFF_SIZE :return offsetof(SMU72_SoftRegisters , DRAM_LOG_BUFF_SIZE); } +break ;case SMU_Discrete_DpmTable:switch (member) {case UvdBootLevel:
@@ -2627,6 +2628,7 @@ static uint32_t tonga_get_offsetof(uint3case LowSclkInterruptThreshold:return offsetof(SMU72_Discrete_DpmTable , LowSclkInterruptThreshold); } +break ; }pr_warn ("can't get the offset of type %x member %x\n" , type, member);return 0 ;
drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c +2 -0
@@ -2184,6 +2184,7 @@ static uint32_t vegam_get_offsetof(uint3case DRAM_LOG_BUFF_SIZE :return offsetof(SMU75_SoftRegisters , DRAM_LOG_BUFF_SIZE); } +break ;case SMU_Discrete_DpmTable:switch (member) {case UvdBootLevel:
@@ -2193,6 +2194,7 @@ static uint32_t vegam_get_offsetof(uint3case LowSclkInterruptThreshold:return offsetof(SMU75_Discrete_DpmTable , LowSclkInterruptThreshold); } +break ; }pr_warn ("can't get the offset of type %x member %x\n" , type, member);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 13/205 ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 35d3cbe84544da74e39e1cec01374092467e3119 ]
Andreas Müller reports:
"Fixes:
| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[220]: Failed to apply ACL on /dev/v4l-subdev0: Operation not supported | Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[224]: Failed to apply ACL on /dev/v4l-subdev1: Operation not supported | Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[215]: Failed to apply ACL on /dev/v4l-subdev10: Operation not supported | Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[228]: Failed to apply ACL on /dev/v4l-subdev2: Operation not supported | Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[232]: Failed to apply ACL on /dev/v4l-subdev5: Operation not supported | Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[217]: Failed to apply ACL on /dev/v4l-subdev11: Operation not supported | Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[214]: Failed to apply ACL on /dev/dri/card1: Operation not supported | Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[216]: Failed to apply ACL on /dev/v4l-subdev8: Operation not supported | Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[226]: Failed to apply ACL on /dev/v4l-subdev9: Operation not supported
and nasty follow-ups: Starting weston from sddm as unpriviledged user fails with some hints on missing access rights."
Select the CONFIG_TMPFS_POSIX_ACL option to fix these issues.
--- arch/arm/configs/imx_v6_v7_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/configs/imx_v6_v7_defconfig +1 -0
@@ -409,6 +409,7 @@ CONFIG_ZISOFS=y CONFIG_UDF_FS=m CONFIG_MSDOS_FS=m CONFIG_VFAT_FS=y +CONFIG_TMPFS_POSIX_ACL=y CONFIG_JFFS2_FS=y CONFIG_UBIFS_FS=y CONFIG_NFS_FS=y
Greg Kroah-Hartman
maintainerPATCH 14/205 powerpc/nohash: fix undefined behaviour when testing page size support
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Axtens <[email protected]>
[ Upstream commit f5e284803a7206d43e26f9ffcae5de9626d95e37 ]
When enumerating page size definitions to check hardware support, we construct a constant which is (1U << (def->shift - 10)).
However, the array of page size definitions is only initalised for various MMU_PAGE_* constants, so it contains a number of 0-initialised elements with def->shift == 0. This means we end up shifting by a very large number, which gives the following UBSan splat:
================================================================================
UBSAN: Undefined behaviour in /home/dja/dev/linux/linux/arch/powerpc/mm/tlb_nohash.c:506:21 shift exponent 4294967286 is too large for 32-bit type 'unsigned int' CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-rc3-00045-ga604f927b012-dirty #6 Call Trace: [c00000000101bc20] [c000000000a13d54] .dump_stack+0xa8/0xec (unreliable) [c00000000101bcb0] [c0000000004f20a8] .ubsan_epilogue+0x18/0x64 [c00000000101bd30] [c0000000004f2b10] .__ubsan_handle_shift_out_of_bounds+0x110/0x1a4 [c00000000101be20] [c000000000d21760] .early_init_mmu+0x1b4/0x5a0 [c00000000101bf10] [c000000000d1ba28] .early_setup+0x100/0x130 [c00000000101bf90] [c000000000000528] start_here_multiplatform+0x68/0x80 ================================================================================
Fix this by first checking if the element exists (shift != 0) before constructing the constant.
--- arch/powerpc/mm/tlb_nohash.c | 3 +++ 1 file changed, 3 insertions(+)
arch/powerpc/mm/tlb_nohash.c +3 -0
@@ -503,6 +503,9 @@ static void setup_page_sizes(void)for (psize =0 ; psize <MMU_PAGE_COUNT ; ++psize) {struct mmu_psize_def *def = &mmu_psize_defs[psize]; +if (!def->shift) +continue ; +if (tlb1ps & (1U << (def->shift -10 ))) { def->flags |=MMU_PAGE_SIZE_DIRECT ;
Greg Kroah-Hartman
maintainerPATCH 15/205 drm/msm/gpu: fix parameters in function msm_gpu_crashstate_capture
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anders Roxell <[email protected]>
[ Upstream commit 6969019f65b43afb6da6a26f1d9e55bbdfeebcd5 ]
When CONFIG_DEV_COREDUMP isn't defined msm_gpu_crashstate_capture
doesn't pass the correct parameters.drivers/gpu/drm/msm/msm_gpu.c: In function ‘recover_worker’:drivers/gpu/drm/msm/msm_gpu.c:479:34: error: passing argument 2 of ‘msm_gpu_crashstate_capture’ from incompatible pointer type [-Werror=incompatible-pointer-types]
msm_gpu_crashstate_capture(gpu, submit, comm, cmd);
^~~~~~
drivers/gpu/drm/msm/msm_gpu.c:388:13: note: expected ‘char *’ but argument is of type ‘struct msm_gem_submit *’
static void msm_gpu_crashstate_capture(struct msm_gpu *gpu, char *comm,
^~~~~~~~~~~~~~~~~~~~~~~~~~drivers/gpu/drm/msm/msm_gpu.c:479:2: error: too many arguments to function ‘msm_gpu_crashstate_capture’
msm_gpu_crashstate_capture(gpu, submit, comm, cmd);
^~~~~~~~~~~~~~~~~~~~~~~~~~drivers/gpu/drm/msm/msm_gpu.c:388:13: note: declared here
static void msm_gpu_crashstate_capture(struct msm_gpu *gpu, char *comm,
In current code the function msm_gpu_crashstate_capture parameters.
--- drivers/gpu/drm/msm/msm_gpu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/msm_gpu.c +2 -2
@@ -367,8 +367,8 @@ static void msm_gpu_crashstate_capture(s msm_gpu_devcoredump_read, msm_gpu_devcoredump_free); }#else -static void msm_gpu_crashstate_capture (struct msm_gpu *gpu,char *comm, -char *cmd) +static void msm_gpu_crashstate_capture (struct msm_gpu *gpu, +struct msm_gem_submit *submit,char *comm,char *cmd) { }#endif
Greg Kroah-Hartman
maintainerPATCH 16/205 drm/msm/disp/dpu: Use proper define for drm_encoder_init() encoder_type
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 2c043eeffea4813b8f569e84b46035a08de5eb47 ]
We got a bug report that this function oopses when trying to do a kasprintf().
PC is at string+0x2c/0x60
LR is at vsnprintf+0x28c/0x4ec
pc : [<ffffff80088d35d8>] lr : [<ffffff80088d5fc4>] pstate: a0c00049
sp : ffffff80095fb540
x29: ffffff80095fb540 x28: ffffff8008ad42bc
x27: 00000000ffffffd8 x26: 0000000000000000
x25: ffffff8008c216c8 x24: 0000000000000000
x23: 0000000000000000 x22: ffffff80095fb720
x21: 0000000000000000 x20: ffffff80095fb720
x19: ffffff80095fb6f0 x18: 000000000000000a
x17: 00000000b42ba473 x16: ffffff800805bbe8
x15: 00000000000a157d x14: 000000000000000c
x13: 0000000000000000 x12: 0000ffff0000000f
x11: 0000000000000003 x10: 0000000000000001
x9 : 0000000000000040 x8 : 000000000000001c
x7 : ffffffffffffffff x6 : 0000000000000000
x5 : 0000000000000228 x4 : 0000000000000000
x3 : ffff0a00ffffff04 x2 : 0000000000007961
x1 : 0000000000000000 x0 : 0000000000000000
Process kworker/3:1 (pid: 61, stack limit = 0xffffff80095f8000)
Call trace: Exception stack(0xffffff80095fb400 to 0xffffff80095fb540)
b400: 0000000000000000 0000000000000000 0000000000007961 ffff0a00ffffff04
b420: 0000000000000000 0000000000000228 0000000000000000 ffffffffffffffff
b440: 000000000000001c 0000000000000040 0000000000000001 0000000000000003
b460: 0000ffff0000000f 0000000000000000 000000000000000c 00000000000a157d
b480: ffffff800805bbe8 00000000b42ba473 000000000000000a ffffff80095fb6f0
b4a0: ffffff80095fb720 0000000000000000 ffffff80095fb720 0000000000000000
b4c0: 0000000000000000 ffffff8008c216c8 0000000000000000 00000000ffffffd8
b4e0: ffffff8008ad42bc ffffff80095fb540 ffffff80088d5fc4 ffffff80095fb540
b500: ffffff80088d35d8 00000000a0c00049 ffffff80095fb550 ffffff80080d06a4
b520: ffffffffffffffff ffffff80088d5e0c ffffff80095fb540 ffffff80088d35d8
[<ffffff80088d35d8>] string+0x2c/0x60 [<ffffff80088d5fc4>] vsnprintf+0x28c/0x4ec [<ffffff80083973b8>] kvasprintf+0x68/0x100 [<ffffff800839755c>] kasprintf+0x60/0x80 [<ffffff800849cc24>] drm_encoder_init+0x134/0x164 [<ffffff80084d9a7c>] dpu_encoder_init+0x60/0x94 [<ffffff80084eced0>] _dpu_kms_drm_obj_init+0xa0/0x424 [<ffffff80084ed870>] dpu_kms_hw_init+0x61c/0x6bc [<ffffff80084f7614>] msm_drm_bind+0x380/0x67c [<ffffff80085114e4>] try_to_bring_up_master+0x228/0x264 [<ffffff80085116e8>] component_master_add_with_match+0x90/0xc0 [<ffffff80084f722c>] msm_pdev_probe+0x260/0x2c8 [<ffffff800851a910>] platform_drv_probe+0x58/0xa8 [<ffffff80085185c8>] driver_probe_device+0x2d8/0x40c [<ffffff8008518928>] __device_attach_driver+0xd4/0x10c [<ffffff800851644c>] bus_for_each_drv+0xb4/0xd0 [<ffffff8008518230>] __device_attach+0xd0/0x160 [<ffffff8008518984>] device_initial_probe+0x24/0x30 [<ffffff800851744c>] bus_probe_device+0x38/0x98 [<ffffff8008517aac>] deferred_probe_work_func+0x144/0x148 [<ffffff80080c8654>] process_one_work+0x218/0x3bc [<ffffff80080c883c>] process_scheduled_works+0x44/0x48 [<ffffff80080c95bc>] worker_thread+0x288/0x32c [<ffffff80080cea30>] kthread+0x134/0x13c [<ffffff8008084750>] ret_from_fork+0x10/0x18 Code: 910003fd 2a0403e6 eb0400ff 54000060 (38646845)
Looking at the code I see that drm_encoder_init() is called from the DPU code with 'DRM_MODE_CONNECTOR_DSI' passed in as the 'encoder_type' argument (follow from _dpu_kms_initialize_dsi()). That corresponds to the integer 16. That is then indexed into drm_encoder_enum_list in drm_encoder_init() to look up the name of the encoder. If you're still following along, that's an encoder not a connector! We really want to use DRM_MODE_ENCODER_DSI (integer 6) instead of DRM_MODE_CONNECTOR_DSI here, or we'll go out of bounds of the encoder array. Pass the right thing and everything is fine.
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +1 -1
@@ -450,7 +450,7 @@ static void _dpu_kms_initialize_dsi(struint i, rc;/*TODO: Support two independent DSI connectors */ - encoder =dpu_encoder_init (dev,DRM_MODE_CONNECTOR_DSI ); + encoder =dpu_encoder_init (dev,DRM_MODE_ENCODER_DSI );if (IS_ERR_OR_NULL (encoder)) {DPU_ERROR ("encoder init failed for dsi display\n" );return ;
Greg Kroah-Hartman
maintainerPATCH 17/205 drm/msm: dpu: Allow planes to extend past active display
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Paul <[email protected]>
[ Upstream commit 96fc56a775c1e44c0e3c0119f2cd3d77431c4569 ]
The atomic_check is a bit too aggressive with respect to planes which leave the active area. This caused a bunch of log spew when the cursor got to the edge of the screen and stopped it from going all the way.
This patch removes the conservative bounds checks from atomic and clips the dst rect such that we properly display planes which go off the screen.
Changes in v2:
- Apply the clip to src as well (taking into account scaling) Changes in v3:
- Use drm_atomic_helper_check_plane_state() to clip src/dst
--- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 3 -- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 38 +++++++++++++++++------------ drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 1 drivers/gpu/drm/msm/msm_drv.h | 2 + 4 files changed, 26 insertions(+), 18 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +1 -2
@@ -1535,8 +1535,7 @@ static int dpu_crtc_atomic_check(struct cnt++; dst =drm_plane_state_dest (pstate); -if (!drm_rect_intersect (&clip, &dst) || - !drm_rect_equals (&clip, &dst)) { +if (!drm_rect_intersect (&clip, &dst)) {DPU_ERROR ("invalid vertical/horizontal destination\n" ); DPU_ERROR("display: " DRM_RECT_FMT " plane: " DRM_RECT_FMT "\n", DRM_RECT_ARG(&crtc_rect),
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +23 -15
@@ -1254,7 +1254,7 @@ static int dpu_plane_sspp_atomic_update(const struct dpu_format *fmt;struct drm_crtc *crtc;struct drm_framebuffer *fb; -struct drm_rect src, dst; +int ret, min_scale;if (!plane) {DPU_ERROR ("invalid plane\n" );
@@ -1293,21 +1293,29 @@ static int dpu_plane_sspp_atomic_update( pdpu->is_rt_pipe = (dpu_crtc_get_client_type (crtc) !=NRT_CLIENT );_dpu_plane_set_qos_ctrl (plane, false,DPU_PLANE_QOS_PANIC_CTRL ); - src.x1 = state->src_x >>16 ; - src.y1 = state->src_y >>16 ; - src.x2 = src.x1 + (state->src_w >>16 ); - src.y2 = src.y1 + (state->src_h >>16 ); - - dst =drm_plane_state_dest (state); - -DPU_DEBUG_PLANE (pdpu,"FB[%u] " DRM_RECT_FMT "->crtc%u " DRM_RECT_FMT -", %4.4s ubwc %d\n" , fb->base.id,DRM_RECT_ARG (&src), - crtc->base.id,DRM_RECT_ARG (&dst), - (char *)&fmt->base.pixel_format, -DPU_FORMAT_IS_UBWC (fmt)); + min_scale =FRAC_16_16 (1 , pdpu->pipe_sblk->maxdwnscale); + ret =drm_atomic_helper_check_plane_state (state, crtc->state, min_scale, + pdpu->pipe_sblk->maxupscale <<16 , + true, false); +if (ret) { +DPU_ERROR_PLANE (pdpu,"Check plane state failed (%d)\n" , ret); +return ret; + } + +DPU_DEBUG_PLANE (pdpu,"FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT +", %4.4s ubwc %d\n" , fb->base.id,DRM_RECT_FP_ARG (&state->src), + crtc->base.id,DRM_RECT_ARG (&state->dst), + (char *)&fmt->base.pixel_format,DPU_FORMAT_IS_UBWC (fmt)); + + pdpu->pipe_cfg.src_rect = state->src; + +/* state->src is 16.16, src_rect is not */ + pdpu->pipe_cfg.src_rect.x1 >>=16 ; + pdpu->pipe_cfg.src_rect.x2 >>=16 ; + pdpu->pipe_cfg.src_rect.y1 >>=16 ; + pdpu->pipe_cfg.src_rect.y2 >>=16 ; - pdpu->pipe_cfg.src_rect = src; - pdpu->pipe_cfg.dst_rect = dst; + pdpu->pipe_cfg.dst_rect = state->dst;_dpu_plane_setup_scaler (pdpu, pstate, fmt, false);
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +0 -1
@@ -259,7 +259,6 @@ static void mdp5_plane_cleanup_fb(structmsm_framebuffer_cleanup (fb, kms->aspace); } -#define FRAC_16_16 (mult, div) (((mult) << 16) / (div))static int mdp5_plane_atomic_check_with_state (struct drm_crtc_state *crtc_state,struct drm_plane_state *state) {
drivers/gpu/drm/msm/msm_drv.h +2 -0
@@ -62,6 +62,8 @@ struct msm_gem_vma;#define MAX_BRIDGES 8#define MAX_CONNECTORS 8 +#define FRAC_16_16 (mult, div) (((mult) << 16) / (div)) +struct msm_file_private {rwlock_t queuelock;struct list_head submitqueues;
Greg Kroah-Hartman
maintainerPATCH 18/205 powerpc/mm: Dont report hugepage tables as memory leaks when using kmemleak
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 803d690e68f0c5230183f1a42c7d50a41d16e380 ]
When a process allocates a hugepage, the following leak is reported by kmemleak. This is a false positive which is due to the pointer to the table being stored in the PGD as physical memory address and not virtual memory pointer.
unreferenced object 0xc30f8200 (size 512):
comm "mmap", pid 374, jiffies 4872494 (age 627.630s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<e32b68da>] huge_pte_alloc+0xdc/0x1f8
[<9e0df1e1>] hugetlb_fault+0x560/0x8f8
[<7938ec6c>] follow_hugetlb_page+0x14c/0x44c
[<afbdb405>] __get_user_pages+0x1c4/0x3dc
[<b8fd7cd9>] __mm_populate+0xac/0x140
[<3215421e>] vm_mmap_pgoff+0xb4/0xb8
[<c148db69>] ksys_mmap_pgoff+0xcc/0x1fc
[<4fcd760f>] ret_from_syscall+0x0/0x38See commit a984506c542e2 ("powerpc/mm: Don't report PUDs as memory leaks when using kmemleak") for detailed explanation.
To fix that, this patch tells kmemleak to ignore the allocated hugepage table.
--- arch/powerpc/mm/hugetlbpage.c | 3 +++ 1 file changed, 3 insertions(+)
arch/powerpc/mm/hugetlbpage.c +3 -0
@@ -19,6 +19,7 @@#include <linux/moduleparam.h> #include <linux/swap.h> #include <linux/swapops.h> +#include <linux/kmemleak.h> #include <asm/pgtable.h> #include <asm/pgalloc.h> #include <asm/tlb.h>
@@ -112,6 +113,8 @@ static int __hugepte_alloc(struct mm_strfor (i = i -1 ; i >=0 ; i--, hpdp--) *hpdp =__hugepd (0 );kmem_cache_free (cachep, new); + }else { +kmemleak_ignore (new); }spin_unlock (ptl);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 19/205 drm/omap: fix memory barrier bug in DMM driver
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 538f66ba204944470a653a4cccc5f8befdf97c22 ]
A DMM timeout "timed out waiting for done" has been observed on DRA7 devices. The timeout happens rarely, and only when the system is under heavy load.
Debugging showed that the timeout can be made to happen much more frequently by optimizing the DMM driver, so that there's almost no code between writing the last DMM descriptors to RAM, and writing to DMM register which starts the DMM transaction.
The current theory is that a wmb() does not properly ensure that the data written to RAM is observable by all the components in the system.
This DMM timeout has caused interesting (and rare) bugs as the error handling was not functioning properly (the error handling has been fixed in previous commits):
* If a DMM timeout happened when a GEM buffer was being pinned for display on the screen, a timeout error would be shown, but the driver would continue programming DSS HW with broken buffer, leading to SYNCLOST floods and possible crashes.
* If a DMM timeout happened when other user (say, video decoder) was pinning a GEM buffer, a timeout would be shown but if the user handled the error properly, no other issues followed.
* If a DMM timeout happened when a GEM buffer was being released, the driver does not even notice the error, leading to crashes or hang later.
This patch adds wmb() and readl() calls after the last bit is written to RAM, which should ensure that the execution proceeds only after the data is actually in RAM, and thus observable by DMM.
The read-back should not be needed. Further study is required to understand if DMM is somehow special case and read-back is ok, or if DRA7's memory barriers do not work correctly.
--- drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +11 -0
@@ -285,6 +285,17 @@ static int dmm_txn_commit(struct dmm_txn } txn->last_pat->next_pa =0 ; +/* ensure that the written descriptors are visible to DMM */ +wmb (); + +/* +* NOTE: the wmb() above should be enough, but there seems to be a bug +* in OMAP's memory barrier implementation, which in some rare cases may +* cause the writes not to be observable after wmb(). +*/ + +/* read back to ensure the data is in RAM */ +readl (&txn->last_pat->next_pa);/* write to PAT_DESCR to clear out any pending transaction */ dmm_write (dmm,0x0 , reg[PAT_DESCR ][engine->id]);
Greg Kroah-Hartman
maintainerPATCH 20/205 drm/amd/display: Raise dispclk value for dce120 by 15%
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Kazlauskas <[email protected]>
[ Upstream commit 481f576c6c21bf0446eaa23623ef0262e9a5387c ]
[Why]
The DISPCLK value was previously requested to be 15% higher for all ASICs that went through the dce110 bandwidth code path. As part of a refactoring of dce_clocks and the dce110 set bandwidth codepath this was removed for power saving considerations.
That change caused display corruption under certain hardware configurations with Vega10.
[How]
The 15% DISPCLK increase is brought back but only on dce110 for now. This is should be a temporary workaround until the root cause is sorted out for why this occurs on Vega (or other ASICs, if reported).
--- drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c +3 -0
@@ -466,6 +466,9 @@ static void dce12_update_clocks(struct d {struct dm_pp_clock_for_voltage_req clock_voltage_req = {0 }; +/* TODO: Investigate why this is needed to fix display corruption. */ + new_clocks->dispclk_khz = new_clocks->dispclk_khz *115 /100 ; +if (should_set_clock (safe_to_lower, new_clocks->dispclk_khz, dccg->clks.dispclk_khz)) { clock_voltage_req.clk_type =DM_PP_CLOCK_TYPE_DISPLAY_CLK ; clock_voltage_req.clocks_in_khz = new_clocks->dispclk_khz;
Greg Kroah-Hartman
maintainerPATCH 21/205 drm/amd/display: fix gamma not being applied
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: SivapiriyanKumarasamy <[email protected]>
[ Upstream commit 30049754ab7c4b6148dd3cd64af7d54850604582 ]
[WHY]
Previously night light forced a full update by
applying a transfer function update regardless of if it was changed. This logic was removed,
Now gamma surface updates are only applied when there is also a plane info update, this does not work in cases such as using the night light slider.
[HOW]
When moving the night light slider we will perform a full update if the gamma has changed and there is a surface, even when the surface has not changed. Also get stream updates in setgamma prior to update planes and stream.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +14 -5
@@ -1120,9 +1120,6 @@ static enum surface_update_type get_plan*/ update_flags->bits.bpp_change =1 ; -if (u->gamma &&dce_use_lut (u->plane_info->format)) - update_flags->bits.gamma_change =1 ; -if (memcmp (&u->plane_info->tiling_info, &u->surface->tiling_info,sizeof (union dc_tiling_info )) !=0 ) { update_flags->bits.swizzle_change =1 ;
@@ -1139,7 +1136,6 @@ static enum surface_update_type get_planif (update_flags->bits.rotation_change || update_flags->bits.stereo_format_change || update_flags->bits.pixel_format_change - || update_flags->bits.gamma_change || update_flags->bits.bpp_change || update_flags->bits.bandwidth_change || update_flags->bits.output_tf_change)
@@ -1229,13 +1225,26 @@ static enum surface_update_type det_surfif (u->coeff_reduction_factor) update_flags->bits.coeff_reduction_change =1 ; +if (u->gamma) { +enum surface_pixel_format format =SURFACE_PIXEL_FORMAT_GRPH_BEGIN ; + +if (u->plane_info) + format = u->plane_info->format; +else if (u->surface) + format = u->surface->format; + +if (dce_use_lut (format)) + update_flags->bits.gamma_change =1 ; + } +if (update_flags->bits.in_transfer_func_change) { type =UPDATE_TYPE_MED ;elevate_update_type (&overall_type, type); }if (update_flags->bits.input_csc_change - || update_flags->bits.coeff_reduction_change) { + || update_flags->bits.coeff_reduction_change + || update_flags->bits.gamma_change) { type =UPDATE_TYPE_FULL ;elevate_update_type (&overall_type, type); }
Greg Kroah-Hartman
maintainerPATCH 22/205 drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 331d880b35a76b5de0eec8cbcecbf615d758a5f9 ]
In hibmc_drm_fb_create(), when the call to hibmc_framebuffer_init() fails with error, do not store the error code in the HiBMC device frame-buffer pointer, as this will be later checked for non-zero value in hibmc_fbdev_destroy() when our intention is to check for a valid function pointer.
This fixes the following crash:
[ 9.699791] Unable to handle kernel NULL pointer dereference at virtual address 000000000000001a [ 9.708672] Mem abort info: [ 9.711489] ESR = 0x96000004 [ 9.714570] Exception class = DABT (current EL), IL = 32 bits [ 9.720551] SET = 0, FnV = 0 [ 9.723631] EA = 0, S1PTW = 0 [ 9.726799] Data abort info: [ 9.729702] ISV = 0, ISS = 0x00000004 [ 9.733573] CM = 0, WnR = 0 [ 9.736566] [000000000000001a] user address but active_mm is swapper [ 9.742987] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 9.748614] Modules linked in: [ 9.751694] CPU: 16 PID: 293 Comm: kworker/16:1 Tainted: G W 4.19.0-rc4-next-20180920-00001-g9b0012c #322 [ 9.762681] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018 [ 9.771915] Workqueue: events work_for_cpu_fn [ 9.776312] pstate: 60000005 (nZCv daif -PAN -UAO) [ 9.781150] pc : drm_mode_object_put+0x0/0x20 [ 9.785547] lr : hibmc_fbdev_fini+0x40/0x58 [ 9.789767] sp : ffff00000af1bcf0 [ 9.793108] x29: ffff00000af1bcf0 x28: 0000000000000000 [ 9.798473] x27: 0000000000000000 x26: ffff000008f66630 [ 9.803838] x25: 0000000000000000 x24: ffff0000095abb98 [ 9.809203] x23: ffff8017db92fe00 x22: ffff8017d2b13000 [ 9.814568] x21: ffffffffffffffea x20: ffff8017d2f80018 [ 9.819933] x19: ffff8017d28a0018 x18: ffffffffffffffff [ 9.825297] x17: 0000000000000000 x16: 0000000000000000 [ 9.830662] x15: ffff0000092296c8 x14: ffff00008939970f [ 9.836026] x13: ffff00000939971d x12: ffff000009229940 [ 9.841391] x11: ffff0000085f8fc0 x10: ffff00000af1b9a0 [ 9.846756] x9 : 000000000000000d x8 : 6620657a696c6169 [ 9.852121] x7 : ffff8017d3340580 x6 : ffff8017d4168000 [ 9.857486] x5 : 0000000000000000 x4 : ffff8017db92fb20 [ 9.862850] x3 : 0000000000002690 x2 : ffff8017d3340480 [ 9.868214] x1 : 0000000000000028 x0 : 0000000000000002 [ 9.873580] Process kworker/16:1 (pid: 293, stack limit = 0x(____ptrval____)) [ 9.880788] Call trace: [ 9.883252] drm_mode_object_put+0x0/0x20 [ 9.887297] hibmc_unload+0x1c/0x80 [ 9.890815] hibmc_pci_probe+0x170/0x3c8 [ 9.894773] local_pci_probe+0x3c/0xb0 [ 9.898555] work_for_cpu_fn+0x18/0x28 [ 9.902337] process_one_work+0x1e0/0x318 [ 9.906382] worker_thread+0x228/0x450 [ 9.910164] kthread+0x128/0x130 [ 9.913418] ret_from_fork+0x10/0x18 [ 9.917024] Code: a94153f3 a8c27bfd d65f03c0 d503201f (f9400c01) [ 9.923180] ---[ end trace 2695ffa0af5be375 ]---
--- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +1 -0
@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct dr hi_fbdev->fb =hibmc_framebuffer_init (priv->dev, &mode_cmd, gobj);if (IS_ERR (hi_fbdev->fb)) { ret =PTR_ERR (hi_fbdev->fb); + hi_fbdev->fb =NULL ;DRM_ERROR ("failed to initialize framebuffer: %d\n" , ret); goto out_release_fbi; }
Greg Kroah-Hartman
maintainerPATCH 23/205 media: pci: cx23885: handle adding to list failure
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <[email protected]>
[ Upstream commit c5d59528e24ad22500347b199d52b9368e686a42 ]
altera_hw_filt_init() which calls append_internal() assumes that the node was successfully linked in while in fact it can silently fail. So the call-site needs to set return to -ENOMEM on append_internal() returning NULL and exit through the err path.
--- drivers/media/pci/cx23885/altera-ci.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/media/pci/cx23885/altera-ci.c +10 -0
@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct al } temp_int =append_internal (inter); +if (!temp_int) { + ret = -ENOMEM ; + goto err; + } inter->filts_used =1 ; inter->dev = config->dev; inter->fpga_rw = config->fpga_rw;
@@ -699,6 +703,7 @@ err: __func__, ret);kfree (pid_filt); +kfree (inter);return ret; }
@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_conf } temp_int =append_internal (inter); +if (!temp_int) { + ret = -ENOMEM ; + goto err; + } inter->cis_used =1 ; inter->dev = config->dev; inter->fpga_rw = config->fpga_rw;
@@ -801,6 +810,7 @@ err:ci_dbg_print ("%s: Cannot initialize CI: Error %d.\n" , __func__, ret);kfree (state); +kfree (inter);return ret; }
Greg Kroah-Hartman
maintainerPATCH 24/205 media: coda: dont overwrite h.264 profile_idc on decoder instance
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
[ Upstream commit 1f32061e843205f6fe8404d5100d5adcec334e75 ]
On a decoder instance, after the profile has been parsed from the stream __v4l2_ctrl_s_ctrl() is called to notify userspace about changes in the read-only profile control. This ends up calling back into the CODA driver where a missing check on the s_ctrl caused the profile information that has just been parsed from the stream to be overwritten with the default baseline profile.
Later on the driver fails to enable frame reordering, based on the wrong profile information.
profile/level controls)
--- drivers/media/platform/coda/coda-common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/platform/coda/coda-common.c +2 -1
@@ -1804,7 +1804,8 @@ static int coda_s_ctrl(struct v4l2_ctrlbreak ;case V4L2_CID_MPEG_VIDEO_H264_PROFILE :/* TODO: switch between baseline and constrained baseline */ - ctx->params.h264_profile_idc =66 ; +if (ctx->inst_type ==CODA_INST_ENCODER ) + ctx->params.h264_profile_idc =66 ;break ;case V4L2_CID_MPEG_VIDEO_H264_LEVEL :/* nothing to do, this is set by the encoder */
Greg Kroah-Hartman
maintainerPATCH 25/205 MIPS: kexec: Mark CPU offline before disabling local IRQ
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dengcheng Zhu <[email protected]>
[ Upstream commit dc57aaf95a516f70e2d527d8287a0332c481a226 ]
After changing CPU online status, it will not be sent any IPIs such as in __flush_cache_all() on software coherency systems. Do this before disabling local IRQ.
Patchwork: https://patchwork.linux-mips.org/patch/20571/
--- arch/mips/kernel/crash.c | 3 +++ arch/mips/kernel/machine_kexec.c | 3 +++ 2 files changed, 6 insertions(+)
arch/mips/kernel/crash.c +3 -0
@@ -36,6 +36,9 @@ static void crash_shutdown_secondary(voiif (!cpu_online (cpu))return ; +/* We won't be sent IPIs any more. */ +set_cpu_online (cpu, false); +local_irq_disable ();if (!cpumask_test_cpu (cpu, &cpus_in_crash))crash_save_cpu (regs, cpu);
arch/mips/kernel/machine_kexec.c +3 -0
@@ -118,6 +118,9 @@ machine_kexec(struct kimage *image) *ptr = (unsigned long )phys_to_virt (*ptr); } +/* Mark offline BEFORE disabling local irq. */ +set_cpu_online (smp_processor_id (), false); +/* * we do not want to be bothered. */
Greg Kroah-Hartman
maintainerPATCH 26/205 powerpc/boot: Ensure _zimage_start is a weak symbol
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Stanley <[email protected]>
[ Upstream commit ee9d21b3b3583712029a0db65a4b7c081d08d3b3 ]
When building with clang crt0's _zimage_start is not marked weak, which breaks the build when linking the kernel image:
$ objdump -t arch/powerpc/boot/crt0.o |grep _zimage_start$ 0000000000000058 g .text 0000000000000000 _zimage_start
ld: arch/powerpc/boot/wrapper.a(crt0.o): in function '_zimage_start':
(.text+0x58): multiple definition of '_zimage_start'; arch/powerpc/boot/pseries-head.o:(.text+0x0): first defined here
Clang requires the .weak directive to appear after the symbol is declared. The binutils manual says:
This directive sets the weak attribute on the comma separated list of symbol names. If the symbols do not already exist, they will be created.
So it appears this is different with clang. The only reference I could see for this was an OpenBSD mailing list post[1].
Changing it to be after the declaration fixes building with Clang, and still works with GCC.
$ objdump -t arch/powerpc/boot/crt0.o |grep _zimage_start$ 0000000000000058 w .text 0000000000000000 _zimage_start
Reported to clang as https://bugs.llvm.org/show_bug.cgi?id=38921
[1] https://groups.google.com/forum/#!topic/fa.openbsd.tech/PAgKKen2YCY
--- arch/powerpc/boot/crt0.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/boot/crt0.S +3 -1
@@ -47,8 +47,10 @@ p_end: .long _end p_pstack: .long _platform_stack_top #endif - .weak _zimage_start .globl _zimage_start + /* Clang appears to require the .weak directive to be after the symbol + * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ + .weak _zimage_start _zimage_start: .globl _zimage_start_lib _zimage_start_lib:
Greg Kroah-Hartman
maintainerPATCH 27/205 powerpc/memtrace: Remove memory in chunks
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rashmica Gupta <[email protected]>
[ Upstream commit 3f7daf3d7582dc6628ac40a9045dd1bbd80c5f35 ]
When hot-removing memory release_mem_region_adjustable() splits iomem resources if they are not the exact size of the memory being hot-deleted. Adding this memory back to the kernel adds a new resource.
Eg a node has memory 0x0 - 0xfffffffff. Hot-removing 1GB from 0xf40000000 results in the single resource 0x0-0xfffffffff being split into two resources: 0x0-0xf3fffffff and 0xf80000000-0xfffffffff.
When we hot-add the memory back we now have three resources:
0x0-0xf3fffffff, 0xf40000000-0xf7fffffff, and 0xf80000000-0xfffffffff.
This is an issue if we try to remove some memory that overlaps resources. Eg when trying to remove 2GB at address 0xf40000000, release_mem_region_adjustable() fails as it expects the chunk of memory to be within the boundaries of a single resource. We then get the
warning: "Unable to release resource" and attempting to use memtrace again gives us this error: "bash: echo: write error: Resource temporarily unavailable"
This patch makes memtrace remove memory in chunks that are always the same size from an address that is always equal to end_of_memory - n*size, for some n. So hotremoving and hotadding memory of different sizes will now not attempt to remove memory that spans multiple resources.
--- arch/powerpc/platforms/powernv/memtrace.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
arch/powerpc/platforms/powernv/memtrace.c +16 -5
@@ -90,17 +90,15 @@ static bool memtrace_offline_pages(u32 nwalk_memory_range (start_pfn, end_pfn, (void *)MEM_OFFLINE , change_memblock_state); -lock_device_hotplug (); -remove_memory (nid, start_pfn <<PAGE_SHIFT , nr_pages <<PAGE_SHIFT ); -unlock_device_hotplug ();return true; }static u64 memtrace_alloc_node (u32 nid,u64 size) { -u64 start_pfn, end_pfn, nr_pages; +u64 start_pfn, end_pfn, nr_pages, pfn;u64 base_pfn; +u64 bytes =memory_block_size_bytes ();if (!node_spanned_pages (nid))return 0 ;
@@ -113,8 +111,21 @@ static u64 memtrace_alloc_node(u32 nid, end_pfn =round_down (end_pfn - nr_pages, nr_pages);for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) { -if (memtrace_offline_pages (nid, base_pfn, nr_pages) == true) +if (memtrace_offline_pages (nid, base_pfn, nr_pages) == true) { +/* +* Remove memory in memory block size chunks so that +* iomem resources are always split to the same size and +* we never try to remove memory that spans two iomem +* resources. +*/ +lock_device_hotplug (); + end_pfn = base_pfn + nr_pages; +for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>>PAGE_SHIFT ) { +remove_memory (nid, pfn <<PAGE_SHIFT , bytes); + } +unlock_device_hotplug ();return base_pfn <<PAGE_SHIFT ; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 28/205 MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 2794f688b2c336e0da85e9f91fed33febbd9f54a ]
Call pcie_bus_configure_settings() on MIPS, like for other platforms. The function pcie_bus_configure_settings() makes sure the MPS (Max Payload Size) across the bus is uniform and provides the ability to tune the MRSS (Max Read Request Size) and MPS (Max Payload Size) to higher performance values. Some devices will not operate properly if these aren't set correctly because the firmware doesn't always do it.
Patchwork: https://patchwork.linux-mips.org/patch/20649/
--- arch/mips/pci/pci-legacy.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/mips/pci/pci-legacy.c +4 -0
@@ -127,8 +127,12 @@ static void pcibios_scanbus(struct pci_cif (pci_has_flag (PCI_PROBE_ONLY )) {pci_bus_claim_resources (bus); }else { +struct pci_bus *child; +pci_bus_size_bridges (bus);pci_bus_assign_resources (bus); +list_for_each_entry (child, &bus->children, node) +pcie_bus_configure_settings (child); }pci_bus_add_devices (bus); }
Greg Kroah-Hartman
maintainerPATCH 29/205 staging: erofs: fix a missing endian conversion
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 37ec35a6cc2b99eb7fd6b85b7d7b75dff46bc353 ]
This patch fixes a missing endian conversion invle_get_logical_extent_head.
--- drivers/staging/erofs/unzip_vle.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/staging/erofs/unzip_vle.c +5 -3
@@ -1490,6 +1490,7 @@ static erofs_off_t vle_get_logical_extenunsigned long long ofs;const unsigned int clusterbits =EROFS_SB (inode->i_sb)->clusterbits;const unsigned int clustersize =1 << clusterbits; +unsigned int delta0;if (page->index != blkaddr) {kunmap_atomic (*kaddr_iter);
@@ -1504,12 +1505,13 @@ static erofs_off_t vle_get_logical_exten di = *kaddr_iter +vle_extent_blkoff (inode, lcn);switch (vle_cluster_type (di)) {case Z_EROFS_VLE_CLUSTER_TYPE_NONHEAD : -BUG_ON (!di->di_u.delta[0 ]); -BUG_ON (lcn < di->di_u.delta[0 ]); + delta0 =le16_to_cpu (di->di_u.delta[0 ]); +DBG_BUGON (!delta0); +DBG_BUGON (lcn < delta0); ofs =vle_get_logical_extent_head (inode, page_iter, kaddr_iter, - lcn - di->di_u.delta[0 ], pcn, flags); + lcn - delta0, pcn, flags);break ;case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN : *flags ^=EROFS_MAP_ZIPPED ;
Greg Kroah-Hartman
maintainerPATCH 30/205 serial: 8250_of: Fix for lack of interrupt support
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit a27d938251ef40c43db81af16fc26b2cec181d4d ]
In commit c58caaab3bf8 ("serial: 8250: of: Defer probe on missing IRQ"), a check was added for the UART driver being probed prior to the parent IRQ controller.
Unfortunately this breaks certain boards which have no interrupt support, like Huawei D03.
Indeed, the 8250 DT bindings state that interrupts should be supported - not must.
To fix, switch from irq_of_parse_and_map() to of_irq_get(), which does relay whether the IRQ host controller domain is not ready, i.e. defer probe, instead of assuming it.
--- drivers/tty/serial/8250/8250_of.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
drivers/tty/serial/8250/8250_of.c +13 -9
@@ -58,7 +58,7 @@ static int of_platform_serial_setup(strustruct resource resource;struct device_node *np = ofdev->dev.of_node;u32 clk, spd, prop; -int ret; +int ret, irq;memset (port,0 ,sizeof *port);
@@ -143,21 +143,27 @@ static int of_platform_serial_setup(struif (ret >=0 ) port->line = ret; - port->irq =irq_of_parse_and_map (np,0 ); -if (!port->irq) { - ret = -EPROBE_DEFER ; - goto err_unprepare; + irq =of_irq_get (np,0 ); +if (irq <0 ) { +if (irq == -EPROBE_DEFER ) { + ret = -EPROBE_DEFER ; + goto err_unprepare; + } +/* IRQ support not mandatory */ + irq =0 ; } + port->irq = irq; + info->rst =devm_reset_control_get_optional_shared (&ofdev->dev,NULL );if (IS_ERR (info->rst)) { ret =PTR_ERR (info->rst); - goto err_dispose; + goto err_unprepare; } ret =reset_control_deassert (info->rst);if (ret) - goto err_dispose; + goto err_unprepare; port->type = type; port->uartclk = clk;
@@ -184,8 +190,6 @@ static int of_platform_serial_setup(stru port->handle_irq = fsl8250_handle_irq;return 0 ; -err_dispose: -irq_dispose_mapping (port->irq); err_unprepare:clk_disable_unprepare (info->clk); err_pmruntime:
Greg Kroah-Hartman
maintainerPATCH 31/205 sc16is7xx: Fix for multi-channel stall
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit 8344498721059754e09d30fe255a12dab8fb03ef ]
The SC16IS752 is a dual-channel device. The two channels are largely independent, but the IRQ signals are wired together as an open-drain, active low signal which will be driven low while either of the channels requires attention, which can be for significant periods of time until operations complete and the interrupt can be acknowledged. In that respect it is should be treated as a true level-sensitive IRQ.
The kernel, however, needs to be able to exit interrupt context in order to use I2C or SPI to access the device registers (which may involve sleeping). Therefore the interrupt needs to be masked out or paused in some way.
The usual way to manage sleeping from within an interrupt handler is to use a threaded interrupt handler - a regular interrupt routine does the minimum amount of work needed to triage the interrupt before waking the interrupt service thread. If the threaded IRQ is marked as IRQF_ONESHOT the kernel will automatically mask out the interrupt until the thread runs to completion. The sc16is7xx driver used to use a threaded IRQ, but a patch switched to using a kthread_worker in order to set realtime priorities on the handler thread and for other optimisations. The end result is non-threaded IRQ that schedules some work then returns IRQ_HANDLED, making the kernel think that all IRQ processing has completed.
The work-around to prevent a constant stream of interrupts is to mark the interrupt as edge-sensitive rather than level-sensitive, but interpreting an active-low source as a falling-edge source requires care to prevent a total cessation of interrupts. Whereas an edge-triggering source will generate a new edge for every interrupt condition a level-triggering source will keep the signal at the interrupting level until it no longer requires attention; in other words, the host won't see another edge until all interrupt conditions are cleared. It is therefore vital that the interrupt handler does not exit with an outstanding interrupt condition, otherwise the kernel will not receive another interrupt unless some other operation causes the interrupt state on the device to be cleared.
The existing sc16is7xx driver has a very simple interrupt "thread" (kthread_work job) that processes interrupts on each channel in turn until there are no more. If both channels are active and the first channel starts interrupting while the handler for the second channel is running then it will not be detected and an IRQ stall ensues. This could be handled easily if there was a shared IRQ status register, or a convenient way to determine if the IRQ had been deasserted for any length of time, but both appear to be lacking.
Avoid this problem (or at least make it much less likely to happen) by reducing the granularity of per-channel interrupt processing to one condition per iteration, only exiting the overall loop when both channels are no longer interrupting.
--- drivers/tty/serial/sc16is7xx.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/tty/serial/sc16is7xx.c +13 -6
@@ -657,7 +657,7 @@ static void sc16is7xx_handle_tx(struct uuart_write_wakeup (port); } -static void sc16is7xx_port_irq (struct sc16is7xx_port *s,int portno) +static bool sc16is7xx_port_irq (struct sc16is7xx_port *s,int portno) {struct uart_port *port = &s->p[portno].port;
@@ -666,7 +666,7 @@ static void sc16is7xx_port_irq(struct sc iir =sc16is7xx_port_read (port,SC16IS7XX_IIR_REG );if (iir &SC16IS7XX_IIR_NO_INT_BIT ) -break ; +return false; iir &=SC16IS7XX_IIR_ID_MASK ;
@@ -688,16 +688,23 @@ static void sc16is7xx_port_irq(struct sc port->line, iir);break ; } - }while (1 ); + }while (0 ); +return true; }static void sc16is7xx_ist (struct kthread_work *ws) {struct sc16is7xx_port *s =to_sc16is7xx_port (ws, irq_work); -int i; -for (i =0 ; i < s->devtype->nr_uart; ++i) -sc16is7xx_port_irq (s, i); +while (1 ) { +bool keep_polling = false; +int i; + +for (i =0 ; i < s->devtype->nr_uart; ++i) + keep_polling |=sc16is7xx_port_irq (s, i); +if (!keep_polling) +break ; + } }static irqreturn_t sc16is7xx_irq (int irq,void *dev_id)
Greg Kroah-Hartman
maintainerPATCH 32/205 media: tvp5150: fix width alignment during set_selection()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <[email protected]>
[ Upstream commit bd24db04101f45a9c1d874fe21b0c7eab7bcadec ]
The driver ignored the width alignment which exists due to the UYVY colorspace format. Fix the width alignment and make use of the the provided v4l2 helper function to set the width, height and all alignments in one.
--- drivers/media/i2c/tvp5150.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/media/i2c/tvp5150.c +9 -5
@@ -901,9 +901,6 @@ static int tvp5150_set_selection(struct/* tvp5150 has some special limits */ rect.left =clamp (rect.left,0 ,TVP5150_MAX_CROP_LEFT ); - rect.width = clamp_t(unsigned int, rect.width, -TVP5150_H_MAX -TVP5150_MAX_CROP_LEFT - rect.left, -TVP5150_H_MAX - rect.left); rect.top =clamp (rect.top,0 ,TVP5150_MAX_CROP_TOP );/* Calculate height based on current standard */
@@ -917,9 +914,16 @@ static int tvp5150_set_selection(structelse hmax =TVP5150_V_MAX_OTHERS ; - rect.height = clamp_t(unsigned int, rect.height, +/* +* alignments: +* - width = 2 due to UYVY colorspace +* - height, image = no special alignment +*/ +v4l_bound_align_image (&rect.width, +TVP5150_H_MAX -TVP5150_MAX_CROP_LEFT - rect.left, +TVP5150_H_MAX - rect.left,1 , &rect.height, hmax -TVP5150_MAX_CROP_TOP - rect.top, - hmax - rect.top); + hmax - rect.top,0 ,0 );tvp5150_write (sd,TVP5150_VERT_BLANKING_START , rect.top); tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP,
Greg Kroah-Hartman
maintainerPATCH 33/205 powerpc/selftests: Wait all threads to join
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 693b31b2fc1636f0aa7af53136d3b49f6ad9ff39 ]
Test tm-tmspr might exit before all threads stop executing, because it just waits for the very last thread to join before proceeding/exiting.
This patch makes sure that all threads that were created will join before proceeding/exiting.
This patch also guarantees that the amount of threads being created is equal to thread_num.
--- tools/testing/selftests/powerpc/tm/tm-tmspr.c | 27 ++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
tools/testing/selftests/powerpc/tm/tm-tmspr.c +17 -10
@@ -98,7 +98,7 @@ void texasr(void *in)int test_tmspr () { -pthread_t thread; +pthread_t *thread;int thread_num;unsigned long i;
@@ -107,21 +107,28 @@ int test_tmspr()/* To cause some context switching */ thread_num =10 *sysconf (_SC_NPROCESSORS_ONLN); + thread =malloc (thread_num *sizeof (pthread_t)); +if (thread ==NULL ) +return EXIT_FAILURE ; +/* Test TFIAR and TFHAR */ -for (i =0 ; i < thread_num ; i +=2 ){ -if (pthread_create (&thread,NULL , (void *)tfiar_tfhar, (void *)i)) +for (i =0 ; i < thread_num; i +=2 ) { +if (pthread_create (&thread[i],NULL , (void *)tfiar_tfhar, + (void *)i))return EXIT_FAILURE ; } -if (pthread_join (thread,NULL ) !=0 ) -return EXIT_FAILURE ; -/* Test TEXASR */ -for (i =0 ; i < thread_num ; i++){ -if (pthread_create (&thread,NULL , (void *)texasr, (void *)i)) +for (i =1 ; i < thread_num; i +=2 ) { +if (pthread_create (&thread[i],NULL , (void *)texasr, (void *)i))return EXIT_FAILURE ; } -if (pthread_join (thread,NULL ) !=0 ) -return EXIT_FAILURE ; + +for (i =0 ; i < thread_num; i++) { +if (pthread_join (thread[i],NULL ) !=0 ) +return EXIT_FAILURE ; + } + +free (thread);if (passed)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 34/205 staging:iio:ad7606: fix voltage scales
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Ardelean <[email protected]>
[ Upstream commit 4ee033301c898dd0835d035d0e0eb768a3d35da1 ]
Fixes commit 17be2a2905a6ec9aa27cd59521495e2f490d2af0 ("staging: iio:
ad7606: replace range/range_available with corresponding scale").
The AD7606 devices don't have a 2.5V voltage range, they have 5V & 10V voltage range, which is selectable via the gpio_range descriptor.
The scales also seem to have been miscomputed, because when they were applied to the raw values, the results differ from the expected values. After checking the ADC transfer function in the datasheet, these were re-computed.
--- drivers/staging/iio/adc/ad7606.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/staging/iio/adc/ad7606.c +5 -2
@@ -26,9 +26,12 @@#include "ad7606.h" -/* Scales are computed as 2.5/2**16 and 5/2**16 respectively */ +/* +* Scales are computed as 5000/32768 and 10000/32768 respectively, +* so that when applied to the raw values they provide mV values +*/ static const unsigned int scale_avail[2 ][2 ] = { - {0 ,38147 }, {0 ,76294 } + {0 ,152588 }, {0 ,305176 } };static int ad7606_reset (struct ad7606_state *st)
Greg Kroah-Hartman
maintainerPATCH 35/205 drm: rcar-du: Update Gen3 output limitations
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kieran Bingham <[email protected]>
[ Upstream commit 2a3181d9cfd6d5aa48f8527708d0c32072072cef ]
The R-Car Gen3 DU utilises the VSP1 hardware for memory access. The limits on the RPF and WPF in this pipeline are 8190x8190.
Update the supported maximum sizes accordingly.
--- drivers/gpu/drm/rcar-du/rcar_du_kms.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpu/drm/rcar-du/rcar_du_kms.c +12 -2
@@ -516,12 +516,22 @@ int rcar_du_modeset_init(struct rcar_du_ dev->mode_config.min_width =0 ; dev->mode_config.min_height =0 ; - dev->mode_config.max_width =4095 ; - dev->mode_config.max_height =2047 ; dev->mode_config.normalize_zpos = true; dev->mode_config.funcs = &rcar_du_mode_config_funcs; dev->mode_config.helper_private = &rcar_du_mode_config_helper; +if (rcdu->info->gen <3 ) { + dev->mode_config.max_width =4095 ; + dev->mode_config.max_height =2047 ; + }else { +/* +* The Gen3 DU uses the VSP1 for memory access, and is limited +* to frame sizes of 8190x8190. +*/ + dev->mode_config.max_width =8190 ; + dev->mode_config.max_height =8190 ; + } + rcdu->num_crtcs =hweight8 (rcdu->info->channels_mask); ret =rcar_du_properties_init (rcdu);
Greg Kroah-Hartman
maintainerPATCH 36/205 drm/amdgpu: Fix SDMA TO after GPU reset v3
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Grodzovsky <[email protected]>
[ Upstream commit d8de8260a45aae8f74af77eae9a162bdc0ed48d2 ]
After GPU reset amdgpu_vm_clear_bo triggers VM flush but job->vm_pd_addr is not set causing SDMA TO.
v2:
Per advise by Christian König avoid flushing VM for jobs where job->vm_pd_addr wasn't explicitly set.
v3:
Shortcut vm_flush_needed early.
Fixes cbd5285 drm/amdgpu: move setting the GART addr into TTM.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +1 -0
@@ -66,6 +66,7 @@ int amdgpu_job_alloc(struct amdgpu_devicamdgpu_sync_create (&(*job)->sync);amdgpu_sync_create (&(*job)->sched_sync); (*job)->vram_lost_counter =atomic_read (&adev->vram_lost_counter); + (*job)->vm_pd_addr =AMDGPU_BO_INVALID_OFFSET ;return 0 ; }
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +2 -1
@@ -714,7 +714,8 @@ int amdgpu_vm_flush(struct amdgpu_ring * } gds_switch_needed &= !!ring->funcs->emit_gds_switch; - vm_flush_needed &= !!ring->funcs->emit_vm_flush; + vm_flush_needed &= !!ring->funcs->emit_vm_flush && + job->vm_pd_addr !=AMDGPU_BO_INVALID_OFFSET ; pasid_mapping_needed &= adev->gmc.gmc_funcs->emit_pasid_mapping && ring->funcs->emit_wreg;
Greg Kroah-Hartman
maintainerPATCH 37/205 staging: most: video: fix registration of an empty comp core_component
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 1f447e51c0b9e8beeec0917ea5f51930f55e17c9 ]
Currently we have structrues comp (which is empty) and comp_info being used to register and deregister the component. This mismatch in naming occurred from a previous commit that renamed aim_info to comp. Fix this to use consistent component naming in line with most/net, most/sound etc.
This fixes the message two issues, one with a null empty name when loading the module:
[ 1485.269515] most_core: registered new core component (null)
and an Oops when removing the module:
[ 1485.277971] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 [ 1485.278648] PGD 0 P4D 0 [ 1485.279253] Oops: 0002 [#2] SMP PTI [ 1485.279847] CPU: 1 PID: 32629 Comm: modprobe Tainted: P D WC OE 4.18.0-8-generic #9 [ 1485.280442] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 [ 1485.281040] RIP: 0010:most_deregister_component+0x3c/0x70 [most_core]
.. etc
--- drivers/staging/most/video/video.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/most/video/video.c +2 -2
@@ -530,7 +530,7 @@ static int comp_disconnect_channel(strucreturn 0 ; } -static struct core_component comp_info = { +static struct core_component comp = { .name ="video" , .probe_channel = comp_probe_channel, .disconnect_channel = comp_disconnect_channel,
@@ -565,7 +565,7 @@ static void __exit comp_exit(void) }spin_unlock_irq (&list_lock); -most_deregister_component (&comp_info); +most_deregister_component (&comp);BUG_ON (!list_empty (&video_devices)); }
Greg Kroah-Hartman
maintainerPATCH 38/205 9p locks: fix glock.client_id leak in do_lock
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
[ Upstream commit b4dc44b3cac9e8327e0655f530ed0c46f2e6214c ]
the 9p client code overwrites our glock.client_id pointing to a static buffer by an allocated string holding the network provided value which we do not care about; free and reset the value as appropriate.
This is almost identical to the leak in v9fs_file_getlock() fixed by Al Viro in commit ce85dd58ad5a6 ("9p: we are leaking glock.client_id in v9fs_file_getlock()"), which was returned as an error by a coverity false positive -- while we are here attempt to make the code slightly more robust to future change of the net/9p/client code and hopefully more clear to coverity that there is no problem.
--- fs/9p/vfs_file.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
fs/9p/vfs_file.c +14 -2
@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct filebreak ;if (schedule_timeout_interruptible (P9_LOCK_TIMEOUT ) !=0 )break ; +/* +* p9_client_lock_dotl overwrites flock.client_id with the +* server message, free and reuse the client name +*/ +if (flock.client_id != fid->clnt->name) { +kfree (flock.client_id); + flock.client_id = fid->clnt->name; + } }/* map 9p status to VFS status */
@@ -235,6 +243,8 @@ out_unlock:locks_lock_file_wait (filp, fl); fl->fl_type = fl_type; } +if (flock.client_id != fid->clnt->name) +kfree (flock.client_id); out:return res; }
@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file res =p9_client_getlock_dotl (fid, &glock);if (res <0 ) -return res; + goto out;/* map 9p lock type to os lock type */ switch (glock.type) {case P9_LOCK_TYPE_RDLCK :
@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file fl->fl_end = glock.start + glock.length -1 ; fl->fl_pid = -glock.proc_id; } -kfree (glock.client_id); +out: +if (glock.client_id != fid->clnt->name) +kfree (glock.client_id);return res; }
Greg Kroah-Hartman
maintainerPATCH 39/205 udf: Prevent write-unsupported filesystem to be remounted read-write
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit a9ad01bc759df79b0012f43ee52164391e31cd96 ]
There are certain filesystem features which we support for reading but not for writing. We properly refuse to mount such filesystems read-write however for some features (such as read-only partitions), we don't check for these features when remounting the filesystem from read-only to read-write. Thus such filesystems could be remounted read-write leading to strange behavior (most likely crashes).
Fix the problem by marking in superblock whether the filesystem has some features that are supported in read-only mode and check this flag during remount.
--- fs/udf/super.c | 30 ++++++++++++++++-------------- fs/udf/udf_sb.h | 2 ++ 2 files changed, 18 insertions(+), 14 deletions(-)
fs/udf/super.c +16 -14
@@ -613,14 +613,11 @@ static int udf_remount_fs(struct super_bstruct udf_options uopt;struct udf_sb_info *sbi =UDF_SB (sb);int error =0 ; -struct logicalVolIntegrityDescImpUse *lvidiu =udf_sb_lvidiu (sb); + +if (!(*flags &SB_RDONLY ) &&UDF_QUERY_FLAG (sb,UDF_FLAG_RW_INCOMPAT )) +return -EACCES ;sync_filesystem (sb); -if (lvidiu) { -int write_rev =le16_to_cpu (lvidiu->minUDFWriteRev); -if (write_rev >UDF_MAX_WRITE_VERSION && !(*flags &SB_RDONLY )) -return -EACCES ; - } uopt.flags = sbi->s_flags; uopt.uid = sbi->s_uid;
@@ -1257,6 +1254,7 @@ static int udf_load_partdesc(struct supe ret = -EACCES ; goto out_bh; } +UDF_SET_FLAG (sb,UDF_FLAG_RW_INCOMPAT ); ret =udf_load_vat (sb, i, type1_idx);if (ret <0 ) goto out_bh;
@@ -2155,10 +2153,12 @@ static int udf_fill_super(struct super_b UDF_MAX_READ_VERSION); ret = -EINVAL ; goto error_out; - }else if (minUDFWriteRev >UDF_MAX_WRITE_VERSION && - !sb_rdonly (sb)) { - ret = -EACCES ; - goto error_out; + }else if (minUDFWriteRev >UDF_MAX_WRITE_VERSION ) { +if (!sb_rdonly (sb)) { + ret = -EACCES ; + goto error_out; + } +UDF_SET_FLAG (sb,UDF_FLAG_RW_INCOMPAT ); } sbi->s_udfrev = minUDFWriteRev;
@@ -2176,10 +2176,12 @@ static int udf_fill_super(struct super_b }if (sbi->s_partmaps[sbi->s_partition].s_partition_flags & -UDF_PART_FLAG_READ_ONLY && - !sb_rdonly (sb)) { - ret = -EACCES ; - goto error_out; +UDF_PART_FLAG_READ_ONLY ) { +if (!sb_rdonly (sb)) { + ret = -EACCES ; + goto error_out; + } +UDF_SET_FLAG (sb,UDF_FLAG_RW_INCOMPAT ); }if (udf_find_fileset (sb, &fileset, &rootdir)) {
fs/udf/udf_sb.h +2 -0
@@ -30,6 +30,8 @@#define UDF_FLAG_LASTBLOCK_SET 16#define UDF_FLAG_BLOCKSIZE_SET 17#define UDF_FLAG_INCONSISTENT 18 +#define UDF_FLAG_RW_INCOMPAT 19/* Set when we find RW incompatible +* feature */ #define UDF_PART_FLAG_UNALLOC_BITMAP 0x0001#define UDF_PART_FLAG_UNALLOC_TABLE 0x0002
Greg Kroah-Hartman
maintainerPATCH 40/205 ARM: dts: imx6ull: keep IMX6UL_ prefix for signals on both i.MX6UL and i.MX6ULL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sébastien Szymanski <[email protected]>
[ Upstream commit 31edaa6e7fd8143085a6a60c564447c07e76ed9f ]
Signals available on both i.MX6UL and i.MX6ULL should have the same name because it is the case of all others common signals, it avoids to make mistakes (use the wrong ones) and it makes writing device tree files less complicated. For example:
imx6ul-imx6ull-board.dtsi:
...
pinctrl_uart5: uart5grp {
fsl,pins = <
MX6UL_PAD_UART5_TX_DATA__UART5_DCE_TX 0x1b0b1
MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x1b0b1 >;
};
imx6ul-board.dts:
#include <imx6ul.dtsi>
#include <imx6ul-imx6ull-board.dtsi>
...
imx6ull-board.dts:
#include <imx6ull.dtsi>
#include <imx6ul-imx6ull-board.dtsi>
...
Without this patch, the imx6ull-board.dtb will use MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX instead of MX6ULL_PAD_UART5_RX_DATA__UART5_DCE_RX and the uart5 will be misconfigured.
--- arch/arm/boot/dts/imx6ull-pinfunc.h | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
arch/arm/boot/dts/imx6ull-pinfunc.h +13 -5
@@ -14,14 +14,23 @@* The pin function ID is a tuple of * <mux_reg conf_reg input_reg mux_mode input_val> */ +/* signals common for i.MX6UL and i.MX6ULL */ +#undef MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX +#define MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6 +#undef MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX +#define MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7 +#undef MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS +#define MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5 +#undef MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS +#define MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6 +#undef MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS +#define MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7 + +/* signals for i.MX6ULL only */ #define MX6ULL_PAD_UART1_TX_DATA__UART5_DTE_RX 0x0084 0x0310 0x0644 0x9 0x4#define MX6ULL_PAD_UART1_RX_DATA__UART5_DCE_RX 0x0088 0x0314 0x0644 0x9 0x5#define MX6ULL_PAD_UART1_CTS_B__UART5_DCE_RTS 0x008C 0x0318 0x0640 0x9 0x3#define MX6ULL_PAD_UART1_RTS_B__UART5_DTE_RTS 0x0090 0x031C 0x0640 0x9 0x4 -#define MX6ULL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6 -#define MX6ULL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7 -#define MX6ULL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5 -#define MX6ULL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6#define MX6ULL_PAD_ENET2_RX_DATA0__EPDC_SDDO08 0x00E4 0x0370 0x0000 0x9 0x0#define MX6ULL_PAD_ENET2_RX_DATA1__EPDC_SDDO09 0x00E8 0x0374 0x0000 0x9 0x0#define MX6ULL_PAD_ENET2_RX_EN__EPDC_SDDO10 0x00EC 0x0378 0x0000 0x9 0x0
@@ -55,7 +64,6 @@#define MX6ULL_PAD_CSI_DATA00__ESAI_TX_HF_CLK 0x01E4 0x0470 0x0000 0x9 0x0#define MX6ULL_PAD_CSI_DATA01__ESAI_RX_HF_CLK 0x01E8 0x0474 0x0000 0x9 0x0#define MX6ULL_PAD_CSI_DATA02__ESAI_RX_FS 0x01EC 0x0478 0x0000 0x9 0x0 -#define MX6ULL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7#define MX6ULL_PAD_CSI_DATA03__ESAI_RX_CLK 0x01F0 0x047C 0x0000 0x9 0x0#define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0#define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0
Greg Kroah-Hartman
maintainerPATCH 41/205 media: ov5640: fix mode change regression
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugues Fruchet <[email protected]>
[ Upstream commit fb98e29ff1ea5a8118265d11f0e03bc8608a49cb ]
Symptom was fuzzy image because of JPEG default format not being changed according to new format selected, fix this. Init sequence initialises format to YUV422 UYVY but sensor->fmt initial value was set to JPEG, fix this.
--- drivers/media/i2c/ov5640.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/media/i2c/ov5640.c +16 -5
@@ -223,6 +223,7 @@ struct ov5640_dev {int power_count;struct v4l2_mbus_framefmt fmt; +bool pending_fmt_change;const struct ov5640_mode_info *current_mode;enum ov5640_frame_rate current_fr;
@@ -255,7 +256,7 @@ static inline struct v4l2_subdev *ctrl_t* should be identified and removed to speed register load time * over i2c. */ - +/* YUV422 UYVY VGA@30fps */ static const struct reg_value ov5640_init_setting_30fps_VGA[] = { {0x3103 ,0x11 ,0 ,0 }, {0x3008 ,0x82 ,0 ,5 }, {0x3008 ,0x42 ,0 ,0 }, {0x3103 ,0x03 ,0 ,0 }, {0x3017 ,0x00 ,0 ,0 }, {0x3018 ,0x00 ,0 ,0 },
@@ -1968,9 +1969,12 @@ static int ov5640_set_fmt(struct v4l2_suif (new_mode != sensor->current_mode) { sensor->current_mode = new_mode; - sensor->fmt = *mbus_fmt; sensor->pending_mode_change = true; } +if (mbus_fmt->code != sensor->fmt.code) { + sensor->fmt = *mbus_fmt; + sensor->pending_fmt_change = true; + } out:mutex_unlock (&sensor->lock);return ret;
@@ -2544,10 +2548,13 @@ static int ov5640_s_stream(struct v4l2_s ret =ov5640_set_mode (sensor, sensor->current_mode);if (ret) goto out; + } +if (enable && sensor->pending_fmt_change) { ret =ov5640_set_framefmt (sensor, &sensor->fmt);if (ret) goto out; + sensor->pending_fmt_change = false; }if (sensor->ep.bus_type ==V4L2_MBUS_CSI2 )
@@ -2642,9 +2649,14 @@ static int ov5640_probe(struct i2c_clienreturn -ENOMEM ; sensor->i2c_client = client; + +/* +* default init sequence initialize sensor to +* YUV422 UYVY VGA@30fps +*/ fmt = &sensor->fmt; - fmt->code = ov5640_formats[0 ].code; - fmt->colorspace = ov5640_formats[0 ].colorspace; + fmt->code =MEDIA_BUS_FMT_UYVY8_2X8 ; + fmt->colorspace =V4L2_COLORSPACE_SRGB ; fmt->ycbcr_enc =V4L2_MAP_YCBCR_ENC_DEFAULT (fmt->colorspace); fmt->quantization =V4L2_QUANTIZATION_FULL_RANGE ; fmt->xfer_func =V4L2_MAP_XFER_FUNC_DEFAULT (fmt->colorspace);
@@ -2656,7 +2668,6 @@ static int ov5640_probe(struct i2c_clien sensor->current_fr =OV5640_30_FPS ; sensor->current_mode = &ov5640_mode_data[OV5640_30_FPS ][OV5640_MODE_VGA_640_480 ]; - sensor->pending_mode_change = true; sensor->ae_target =52 ;
Greg Kroah-Hartman
maintainerPATCH 42/205 9p: clear dangling pointers in p9stat_free
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
[ Upstream commit 62e3941776fea8678bb8120607039410b1b61a65 ]
p9stat_free is more of a cleanup function than a 'free' function as it only frees the content of the struct; there are chances of use-after-free if it is improperly used (e.g. p9stat_free called twice as it used to be possible to)
Clearing dangling pointers makes the function idempotent and safer to use.
--- net/9p/protocol.c | 5 +++++ 1 file changed, 5 insertions(+)
net/9p/protocol.c +5 -0
@@ -46,10 +46,15 @@ p9pdu_writef(struct p9_fcall *pdu, int pvoid p9stat_free (struct p9_wstat *stbuf) {kfree (stbuf->name); + stbuf->name =NULL ;kfree (stbuf->uid); + stbuf->uid =NULL ;kfree (stbuf->gid); + stbuf->gid =NULL ;kfree (stbuf->muid); + stbuf->muid =NULL ;kfree (stbuf->extension); + stbuf->extension =NULL ; }EXPORT_SYMBOL (p9stat_free);
Greg Kroah-Hartman
maintainerPATCH 43/205 drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit ff30e9e8509cb877dc7cbc776b36c70f5bdd290f ]
We accidentally left out the size of the amdgpu_bo_list struct. It could lead to memory corruption on 32 bit systems. You'd have to pick the absolute maximum and set "num_entries == 59652323" then size would wrap to 16 bytes.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +2 -1
@@ -67,7 +67,8 @@ int amdgpu_bo_list_create(struct amdgpu_unsigned i;int r; -if (num_entries >SIZE_MAX /sizeof (struct amdgpu_bo_list_entry )) +if (num_entries > (SIZE_MAX -sizeof (struct amdgpu_bo_list )) + /sizeof (struct amdgpu_bo_list_entry ))return -EINVAL ; size =sizeof (struct amdgpu_bo_list );
Greg Kroah-Hartman
maintainerPATCH 44/205 media: ov5640: fix restore of last mode set
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugues Fruchet <[email protected]>
[ Upstream commit 985cdcb08a0488558d1005139596b64d73bee267 ]
Mode setting depends on last mode set, in particular because of exposure calculation when downscale mode change between subsampling and scaling.
At stream on the last mode was wrongly set to current mode, so no change was detected and exposure calculation was not made, fix this.
--- drivers/media/i2c/ov5640.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/media/i2c/ov5640.c +8 -4
@@ -226,6 +226,7 @@ struct ov5640_dev {bool pending_fmt_change;const struct ov5640_mode_info *current_mode; +const struct ov5640_mode_info *last_mode;enum ov5640_frame_rate current_fr;struct v4l2_fract frame_interval;
@@ -1614,10 +1615,10 @@ static int ov5640_set_mode_direct(structreturn __v4l2_ctrl_s_ctrl (sensor->ctrls.auto_exp, exposure); } -static int ov5640_set_mode (struct ov5640_dev *sensor, -const struct ov5640_mode_info *orig_mode) +static int ov5640_set_mode (struct ov5640_dev *sensor) {const struct ov5640_mode_info *mode = sensor->current_mode; +const struct ov5640_mode_info *orig_mode = sensor->last_mode;enum ov5640_downsize_mode dn_mode, orig_dn_mode;s32 exposure;int ret;
@@ -1674,6 +1675,7 @@ static int ov5640_set_mode(struct ov5640return ret; sensor->pending_mode_change = false; + sensor->last_mode = mode;return 0 ; }
@@ -1690,6 +1692,7 @@ static int ov5640_restore_mode(struct ov ret =ov5640_load_regs (sensor, &ov5640_mode_init_data);if (ret <0 )return ret; + sensor->last_mode = &ov5640_mode_init_data; ret = ov5640_mod_reg(sensor, OV5640_REG_SYS_ROOT_DIVIDER, 0x3f, (ilog2(OV5640_SCLK2X_ROOT_DIVIDER_DEFAULT) << 2) |
@@ -1698,7 +1701,7 @@ static int ov5640_restore_mode(struct ovreturn ret;/* now restore the last capture mode */ - ret =ov5640_set_mode (sensor, &ov5640_mode_init_data); + ret =ov5640_set_mode (sensor);if (ret <0 )return ret;
@@ -2545,7 +2548,7 @@ static int ov5640_s_stream(struct v4l2_sif (sensor->streaming == !enable) {if (enable && sensor->pending_mode_change) { - ret =ov5640_set_mode (sensor, sensor->current_mode); + ret =ov5640_set_mode (sensor);if (ret) goto out; }
@@ -2668,6 +2671,7 @@ static int ov5640_probe(struct i2c_clien sensor->current_fr =OV5640_30_FPS ; sensor->current_mode = &ov5640_mode_data[OV5640_30_FPS ][OV5640_MODE_VGA_640_480 ]; + sensor->last_mode = sensor->current_mode; sensor->ae_target =52 ;
Greg Kroah-Hartman
maintainerPATCH 45/205 cdrom: fix improper type cast, which can leat to information leak.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Young_X <[email protected]>
commit e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 upstream.
There is another cast from unsigned long to int which causes a bounds check to fail with specially crafted input. The value is then used as an index in the slot array in cdrom_slot_status().
This issue is similar to CVE-2018-16658 and CVE-2018-10940.
--- drivers/cdrom/cdrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cdrom/cdrom.c +1 -1
@@ -2445,7 +2445,7 @@ static int cdrom_ioctl_select_disc(strucreturn -ENOSYS ;if (arg !=CDSL_CURRENT && arg !=CDSL_NONE ) { -if ((int )arg >= cdi->capacity) +if (arg >= cdi->capacity)return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 46/205 ovl: fix error handling in ovl_verify_set_fh()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit babf4770be0adc69e6d2de150f4040f175e24beb upstream.
We hit a BUG on kfree of an ERR_PTR()...
--- fs/overlayfs/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/overlayfs/namei.c +3 -1
@@ -422,8 +422,10 @@ int ovl_verify_set_fh(struct dentry *den fh =ovl_encode_real_fh (real, is_upper); err =PTR_ERR (fh); -if (IS_ERR (fh)) +if (IS_ERR (fh)) { + fh =NULL ; goto fail; + } err =ovl_verify_fh (dentry, name, fh);if (set && err == -ENODATA )
Greg Kroah-Hartman
maintainerPATCH 47/205 ovl: fix recursive oi->lock in ovl_link()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 6cd078702f2f33cb6b19a682de3e9184112f1a46 upstream.
linking a non-copied-up file into a non-copied-up parent results in a nested call to mutex_lock_interruptible(&oi->lock). Fix this by copying up target parent before ovl_nlink_start(), same as done in ovl_rename().
~/unionmount-testsuite$ ./run --ov -s ~/unionmount-testsuite$ ln /mnt/a/foo100 /mnt/a/dir100/
WARNING: possible recursive locking detected
--------------------------------------------
ln/1545 is trying to acquire lock:
00000000bcce7c4c (&ovl_i_lock_key[depth]){+.+.}, at:
ovl_copy_up_start+0x28/0x7d
but task is already holding lock:
0000000026d73d5b (&ovl_i_lock_key[depth]){+.+.}, at:
ovl_nlink_start+0x3c/0xc1[SzM: this seems to be a false positive, but doing the copy-up first is harmless and removes the lockdep splat]
--- fs/overlayfs/dir.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/overlayfs/dir.c +4 -0
@@ -663,6 +663,10 @@ static int ovl_link(struct dentry *old,if (err) goto out_drop_write; + err =ovl_copy_up (new->d_parent); +if (err) + goto out_drop_write; +if (ovl_is_metacopy_dentry (old)) { err =ovl_set_redirect (old, false);if (err)
Greg Kroah-Hartman
maintainerPATCH 48/205 ovl: check whiteout in ovl_create_over_whiteout()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 5e1275808630ea3b2c97c776f40e475017535f72 upstream.
Kaixuxia repors that it's possible to crash overlayfs by removing the whiteout on the upper layer before creating a directory over it. This is a reproducer:
mkdir lower upper work merge
touch lower/file
mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge rm merge/file
ls -al merge/file
rm upper/file
ls -al merge/
mkdir merge/file
Before commencing with a vfs_rename(..., RENAME_EXCHANGE) verify that the lookup of "upper" is positive and is a whiteout, and return ESTALE otherwise.
Reported by: kaixuxia <[email protected]>
--- fs/overlayfs/dir.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/overlayfs/dir.c +4 -0
@@ -463,6 +463,10 @@ static int ovl_create_over_whiteout(struif (IS_ERR (upper)) goto out_unlock; + err = -ESTALE ; +if (d_is_negative (upper) || !IS_WHITEOUT (d_inode (upper))) + goto out_dput; + newdentry =ovl_create_temp (workdir, cattr); err =PTR_ERR (newdentry);if (IS_ERR (newdentry))
Greg Kroah-Hartman
maintainerPATCH 49/205 ovl: automatically enable redirect_dir on metacopy=on
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit d47748e5ae5af6572e520cc9767bbe70c22ea498 upstream.
Current behavior is to automatically disable metacopy if redirect_dir is not enabled and proceed with the mount.
If "metacopy=on" mount option was given, then this behavior can confuse the
user: no mount failure, yet metacopy is disabled.
This patch makes metacopy=on imply redirect_dir=on.
The converse is also true: turning off full redirect with redirect_dir= {off|follow|nofollow} will disable metacopy.
If both metacopy=on and redirect_dir={off|follow|nofollow} is specified, then mount will fail, since there's no way to correctly resolve the conflict.
--- Documentation/filesystems/overlayfs.txt | 6 +++++ fs/overlayfs/super.c | 36 +++++++++++++++++++++++++------- 2 files changed, 35 insertions(+), 7 deletions(-)
Documentation/filesystems/overlayfs.txt +6 -0
@@ -286,6 +286,12 @@ pointed by REDIRECT. This should not be "trusted." xattrs will require CAP_SYS_ADMIN. But it should be possible for untrusted layers like from a pen drive. +Note: redirect_dir={off|nofollow|follow(*)} conflicts with metacopy=on, and +results in an error. + +(*) redirect_dir=follow only conflicts with metacopy=on if upperdir=... is +given. + Sharing and copying layers --------------------------
fs/overlayfs/super.c +29 -7
@@ -472,6 +472,7 @@ static int ovl_parse_opt(char *opt, stru {char *p;int err; +bool metacopy_opt = false, redirect_opt = false; config->redirect_mode =kstrdup (ovl_redirect_mode_def (),GFP_KERNEL );if (!config->redirect_mode)
@@ -516,6 +517,7 @@ static int ovl_parse_opt(char *opt, stru config->redirect_mode =match_strdup (&args[0 ]);if (!config->redirect_mode)return -ENOMEM ; + redirect_opt = true;break ;case OPT_INDEX_ON :
@@ -548,6 +550,7 @@ static int ovl_parse_opt(char *opt, strucase OPT_METACOPY_ON : config->metacopy = true; + metacopy_opt = true;break ;case OPT_METACOPY_OFF :
@@ -572,13 +575,32 @@ static int ovl_parse_opt(char *opt, struif (err)return err; -/* metacopy feature with upper requires redirect_dir=on */ -if (config->upperdir && config->metacopy && !config->redirect_dir) { -pr_warn ("overlayfs: metadata only copy up requires \"redirect_dir=on\", falling back to metacopy=off.\n" ); - config->metacopy = false; - }else if (config->metacopy && !config->redirect_follow) { -pr_warn ("overlayfs: metadata only copy up requires \"redirect_dir=follow\" on non-upper mount, falling back to metacopy=off.\n" ); - config->metacopy = false; +/* +* This is to make the logic below simpler. It doesn't make any other +* difference, since config->redirect_dir is only used for upper. +*/ +if (!config->upperdir && config->redirect_follow) + config->redirect_dir = true; + +/* Resolve metacopy -> redirect_dir dependency */ +if (config->metacopy && !config->redirect_dir) { +if (metacopy_opt && redirect_opt) { +pr_err ("overlayfs: conflicting options: metacopy=on,redirect_dir=%s\n" , + config->redirect_mode); +return -EINVAL ; + } +if (redirect_opt) { +/* +* There was an explicit redirect_dir=... that resulted +* in this conflict. +*/ +pr_info ("overlayfs: disabling metacopy due to redirect_dir=%s\n" , + config->redirect_mode); + config->metacopy = false; + }else { +/* Automatically enable redirect otherwise. */ + config->redirect_follow = config->redirect_dir = true; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 50/205 serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 641a41dbba217ee5bd26abe6be77f8cead9cd00e upstream.
This patch fixes an issue that the sci_remove() could not remove dev_attr_rx_fifo_timeout because uart_remove_one_port() set the port->port.type to PORT_UNKNOWN.
--- drivers/tty/serial/sh-sci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/sh-sci.c +2 -2
@@ -3102,6 +3102,7 @@ static struct uart_driver sci_uart_drivestatic int sci_remove (struct platform_device *dev) {struct sci_port *port =platform_get_drvdata (dev); +unsigned int type = port->port.type;/* uart_remove_... clears it */ sci_ports_in_use &= ~BIT (port->port.line);uart_remove_one_port (&sci_uart_driver, &port->port);
@@ -3112,8 +3113,7 @@ static int sci_remove(struct platform_desysfs_remove_file (&dev->dev.kobj, &dev_attr_rx_fifo_trigger.attr); } -if (port->port.type ==PORT_SCIFA || port->port.type ==PORT_SCIFB || - port->port.type ==PORT_HSCIF ) { +if (type ==PORT_SCIFA || type ==PORT_SCIFB || type ==PORT_HSCIF ) {sysfs_remove_file (&dev->dev.kobj, &dev_attr_rx_fifo_timeout.attr); }
Greg Kroah-Hartman
maintainerPATCH 51/205 scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Himanshu Madhani <[email protected]>
commit 4c1458df9635c7e3ced155f594d2e7dfd7254e21 upstream.
--- drivers/scsi/qla2xxx/qla_mbx.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/scsi/qla2xxx/qla_mbx.c +1 -4
@@ -3762,10 +3762,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t * mcp->mb[0 ] =MBC_PORT_PARAMS ; mcp->mb[1 ] = loop_id; mcp->mb[2 ] =BIT_0 ; -if (IS_CNA_CAPABLE (vha->hw)) - mcp->mb[3 ] = port_speed & (BIT_5 |BIT_4 |BIT_3 |BIT_2 |BIT_1 |BIT_0 ); -else - mcp->mb[3 ] = port_speed & (BIT_2 |BIT_1 |BIT_0 ); + mcp->mb[3 ] = port_speed & (BIT_5 |BIT_4 |BIT_3 |BIT_2 |BIT_1 |BIT_0 ); mcp->mb[9 ] = vha->vp_idx; mcp->out_mb =MBX_9 |MBX_3 |MBX_2 |MBX_1 |MBX_0 ; mcp->in_mb =MBX_3 |MBX_1 |MBX_0 ;
Greg Kroah-Hartman
maintainerPATCH 52/205 scsi: qla2xxx: Fix process response queue for ISP26XX and above
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit b86ac8fd4b2f6ec2f9ca9194c56eac12d620096f upstream.
This patch improves performance for 16G and above adapter by removing additional call to process_response_queue().
[mkp: typo]
--- drivers/scsi/qla2xxx/qla_init.c | 2 -- drivers/scsi/qla2xxx/qla_iocb.c | 17 ----------------- 2 files changed, 19 deletions(-)
drivers/scsi/qla2xxx/qla_init.c +0 -2
@@ -7142,7 +7142,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vh } icb->firmware_options_2 &=cpu_to_le32 ( ~(BIT_3 |BIT_2 |BIT_1 |BIT_0 )); - vha->flags.process_response_queue =0 ;if (ha->zio_mode !=QLA_ZIO_DISABLED ) { ha->zio_mode =QLA_ZIO_MODE_6 ;
@@ -7153,7 +7152,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vh icb->firmware_options_2 |=cpu_to_le32 ( (uint32_t )ha->zio_mode); icb->interrupt_delay_timer =cpu_to_le16 (ha->zio_timer); - vha->flags.process_response_queue =1 ; }if (rval) {
drivers/scsi/qla2xxx/qla_iocb.c +0 -17
@@ -1526,12 +1526,6 @@ qla24xx_start_scsi(srb_t *sp)/* Set chip new ring index. */ WRT_REG_DWORD (req->req_q_in, req->ring_index); -RD_REG_DWORD_RELAXED (&ha->iobase->isp24.hccr); - -/* Manage unprocessed RIO/ZIO commands in response queue. */ -if (vha->flags.process_response_queue && - rsp->ring_ptr->signature !=RESPONSE_PROCESSED ) -qla24xx_process_response_queue (vha, rsp);spin_unlock_irqrestore (&ha->hardware_lock, flags);return QLA_SUCCESS ;
@@ -1725,12 +1719,6 @@ qla24xx_dif_start_scsi(srb_t *sp)/* Set chip new ring index. */ WRT_REG_DWORD (req->req_q_in, req->ring_index); -RD_REG_DWORD_RELAXED (&ha->iobase->isp24.hccr); - -/* Manage unprocessed RIO/ZIO commands in response queue. */ -if (vha->flags.process_response_queue && - rsp->ring_ptr->signature !=RESPONSE_PROCESSED ) -qla24xx_process_response_queue (vha, rsp);spin_unlock_irqrestore (&ha->hardware_lock, flags);
@@ -1880,11 +1868,6 @@ qla2xxx_start_scsi_mq(srb_t *sp)/* Set chip new ring index. */ WRT_REG_DWORD (req->req_q_in, req->ring_index); -/* Manage unprocessed RIO/ZIO commands in response queue. */ -if (vha->flags.process_response_queue && - rsp->ring_ptr->signature !=RESPONSE_PROCESSED ) -qla24xx_process_response_queue (vha, rsp); -spin_unlock_irqrestore (&qpair->qp_lock, flags);return QLA_SUCCESS ;
Greg Kroah-Hartman
maintainerPATCH 53/205 scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit 7c388f91ec1a59b0ed815b07b90536e2d57e1e1f upstream.
Remove stale debug trace.
--- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/scsi/qla2xxx/tcm_qla2xxx.c +0 -4
@@ -718,10 +718,6 @@ static int tcm_qla2xxx_queue_status(stru cmd->sg_cnt =0 ; cmd->offset =0 ; cmd->dma_data_direction =target_reverse_dma_direction (se_cmd); -if (cmd->trc_flags &TRC_XMIT_STATUS ) { -pr_crit ("Multiple calls for status = %p.\n" , cmd); -dump_stack (); - } cmd->trc_flags |=TRC_XMIT_STATUS ;if (se_cmd->data_direction ==DMA_FROM_DEVICE ) {
Greg Kroah-Hartman
maintainerPATCH 54/205 scsi: qla2xxx: Fix early srb free on abort
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit 8235f4b5aeba868739f6e12a51ad92689e3f78ef upstream.
Task abort can take 2 paths: 1) serial/synchronous abort where the calling thread will put to sleep, wait for completion and free cmd resource. 2) async abort where the cmd free will be free by the completion thread. For path 2, driver is freeing the SRB too early.
--- drivers/scsi/qla2xxx/qla_init.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/qla2xxx/qla_init.c +2 -0
@@ -1788,6 +1788,8 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp, bwait_for_completion (&abt_iocb->u.abt.comp); rval = abt_iocb->u.abt.comp_status ==CS_COMPLETE ?QLA_SUCCESS :QLA_FUNCTION_FAILED ; + }else { + goto done; } done_free_sp:
Greg Kroah-Hartman
maintainerPATCH 55/205 scsi: qla2xxx: shutdown chip if reset fail
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit 1e4ac5d6fe0a4af17e4b6251b884485832bf75a3 upstream.
If chip unable to fully initialize, use full shutdown sequence to clear out any stale FW state.
--- drivers/scsi/qla2xxx/qla_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_init.c +1 -1
@@ -6684,7 +6684,7 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)* The next call disables the board * completely. */ - ha->isp_ops->reset_adapter (vha); +qla2x00_abort_isp_cleanup (vha); vha->flags.online =0 ;clear_bit (ISP_ABORT_RETRY , &vha->dpc_flags);
Greg Kroah-Hartman
maintainerPATCH 56/205 scsi: qla2xxx: Reject bsg request if chip is down.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit 56d942de59ebfa2e970a6cd33299d1984710b6c0 upstream.
Reject bsg request if chip is down. This prevent erroneous timeout.
--- drivers/scsi/qla2xxx/qla_bsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_bsg.c +1 -1
@@ -2487,7 +2487,7 @@ qla24xx_bsg_request(struct bsg_job *bsg_ vha =shost_priv (host); } -if (qla2x00_reset_active (vha)) { +if (qla2x00_chip_is_down (vha)) {ql_dbg (ql_dbg_user, vha,0x709f ,"BSG: ISP abort active/needed -- cmd=%d.\n" , bsg_request->msgcode);
Greg Kroah-Hartman
maintainerPATCH 57/205 scsi: qla2xxx: Fix re-using LoopID when handle is in use
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit 5c6400536481d9ef44ef94e7bf2c7b8e81534db7 upstream.
This patch fixes issue where driver clears NPort ID map instead of marking handle in use. Once driver clears NPort ID from the database, it can reuse the same NPort ID resulting in a PLOGI failure.
[mkp: fixed Himanshu's SoB]
--- drivers/scsi/qla2xxx/qla_init.c | 18 ++++-------------- drivers/scsi/qla2xxx/qla_target.c | 3 ++- 2 files changed, 6 insertions(+), 15 deletions(-)
drivers/scsi/qla2xxx/qla_init.c +4 -14
@@ -1954,25 +1954,15 @@ qla24xx_handle_plogi_done_event(struct s cid.b.rsvd_1 =0 ;ql_dbg (ql_dbg_disc, vha,0x20ec , -"%s %d %8phC LoopID 0x%x in use post gnl\n" , +"%s %d %8phC lid %#x in use with pid %06x post gnl\n" , __func__, __LINE__, ea->fcport->port_name, - ea->fcport->loop_id); + ea->fcport->loop_id, cid.b24); -if (IS_SW_RESV_ADDR (cid)) { -set_bit (ea->fcport->loop_id, vha->hw->loop_id_map); - ea->fcport->loop_id =FC_NO_LOOP_ID ; - }else { -qla2x00_clear_loop_id (ea->fcport); - } +set_bit (ea->fcport->loop_id, vha->hw->loop_id_map); + ea->fcport->loop_id =FC_NO_LOOP_ID ;qla24xx_post_gnl_work (vha, ea->fcport);break ;case MBS_PORT_ID_USED : -ql_dbg (ql_dbg_disc, vha,0x20ed , -"%s %d %8phC NPortId %02x%02x%02x inuse post gidpn\n" , - __func__, __LINE__, ea->fcport->port_name, - ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area, - ea->fcport->d_id.b.al_pa); - lid = ea->iop[1 ] &0xffff ; qlt_find_sess_invalidate_other(vha, wwn_to_u64(ea->fcport->port_name),
drivers/scsi/qla2xxx/qla_target.c +2 -1
@@ -1261,7 +1261,8 @@ void qlt_schedule_sess_for_deletion(struqla24xx_chk_fcp_state (sess);ql_dbg (ql_dbg_tgt, sess->vha,0xe001 , -"Scheduling sess %p for deletion\n" , sess); +"Scheduling sess %p for deletion %8phC\n" , + sess, sess->port_name);INIT_WORK (&sess->del_work, qla24xx_delete_sess_fn);WARN_ON (!queue_work (sess->vha->hw->wq, &sess->del_work));
Greg Kroah-Hartman
maintainerPATCH 58/205 scsi: qla2xxx: Fix for double free of SRB structure
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giridhar Malavali <[email protected]>
commit bcc71cc3cde1468958a3ea859276d8d1a1a68265 upstream.
This patch fixes issue during switch command query where driver was freeing SRB resources multiple times
Following stack trace will be seen
[ 853.436234] BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 [ 853.436348] IP: [<ffffffff811df514>] kmem_cache_alloc+0x74/0x1e0 [ 853.436476] PGD 0 [ 853.436601] Oops: 0000 [#1] SMP
[ 853.454700] [<ffffffff81099f6a>] ? mod_timer+0x14a/0x220 [ 853.455543] [<ffffffff81185465>] mempool_alloc_slab+0x15/0x20 [ 853.456395] [<ffffffff811855a9>] mempool_alloc+0x69/0x170 [ 853.457257] [<ffffffff81098af2>] ? internal_add_timer+0x32/0x70 [ 853.458136] [<ffffffffc0092d2b>] qla2xxx_queuecommand+0x29b/0x3f0 [qla2xxx] [ 853.459024] [<ffffffff8146535a>] scsi_dispatch_cmd+0xaa/0x230 [ 853.459923] [<ffffffff8146e11f>] scsi_request_fn+0x4df/0x680 [ 853.460829] [<ffffffff81029557>] ? __switch_to+0xd7/0x510 [ 853.461747] [<ffffffff812f7113>] __blk_run_queue+0x33/0x40 [ 853.462670] [<ffffffff812f7735>] blk_delay_work+0x25/0x40 [ 853.463603] [<ffffffff810a882a>] process_one_work+0x17a/0x440 [ 853.464546] [<ffffffff810a94f6>] worker_thread+0x126/0x3c0 [ 853.465501] [<ffffffff810a93d0>] ? manage_workers.isra.24+0x2a0/0x2a0 [ 853.466447] [<ffffffff810b099f>] kthread+0xcf/0xe0 [ 853.467379] [<ffffffff810b08d0>] ? insert_kthread_work+0x40/0x40 [ 853.470172] Code: db e2 7e 49 8b 50 08 4d 8b 20 49 8b 40 10 4d 85 e4 0f 84 20 01 00 00 48 85 c0 0f 84 17 01 00 00 49 63 46 20 48 8d 4a 01 4d 8b 06 <49> 8b 1c 04 4c 89 e0 65 49 0f c7 08 0f 94 c0 84 c0 74 ba 49 63 [ 853.472072] RIP [<ffffffff811df514>] kmem_cache_alloc+0x74/0x1e0 [ 853.472971] RSP <ffff88103726fc50>
--- drivers/scsi/qla2xxx/qla_gs.c | 3 +++ drivers/scsi/qla2xxx/qla_init.c | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_gs.c +3 -0
@@ -3261,6 +3261,9 @@ static void qla24xx_async_gpsc_sp_done(v"Async done-%s res %x, WWPN %8phC \n" , sp->name, res, fcport->port_name); +if (res ==QLA_FUNCTION_TIMEOUT ) +return ; +if (res == (DID_ERROR <<16 )) {/* entry status error */ goto done;
drivers/scsi/qla2xxx/qla_init.c +13 -2
@@ -52,12 +52,14 @@ qla2x00_sp_timeout(struct timer_list *t)struct srb_iocb *iocb;struct req_que *req;unsigned long flags; +struct qla_hw_data *ha = sp->vha->hw; -spin_lock_irqsave (sp->qpair->qp_lock_ptr, flags); +WARN_ON (irqs_disabled ()); +spin_lock_irqsave (&ha->hardware_lock, flags); req = sp->qpair->req; req->outstanding_cmds[sp->handle] =NULL ; iocb = &sp->u.iocb_cmd; -spin_unlock_irqrestore (sp->qpair->qp_lock_ptr, flags); +spin_unlock_irqrestore (&ha->hardware_lock, flags); iocb->timeout (sp); }
@@ -972,6 +974,15 @@ void qla24xx_async_gpdb_sp_done(void *s, fcport->flags &= ~(FCF_ASYNC_SENT |FCF_ASYNC_ACTIVE ); +if (res ==QLA_FUNCTION_TIMEOUT ) +return ; + +if (res ==QLA_FUNCTION_TIMEOUT ) { +dma_pool_free (sp->vha->hw->s_dma_pool, sp->u.iocb_cmd.u.mbx.in, + sp->u.iocb_cmd.u.mbx.in_dma); +return ; + } +memset (&ea,0 ,sizeof (ea)); ea.event =FCME_GPDB_DONE ; ea.fcport = fcport;
Greg Kroah-Hartman
maintainerPATCH 59/205 scsi: qla2xxx: Fix NVMe session hang on unload
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit f7d61c995df74d6bb57bbff6a2b7b1874c4a2baa upstream.
Send aborts only when chip is active.
--- drivers/scsi/qla2xxx/qla_nvme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_nvme.c +1 -1
@@ -607,7 +607,7 @@ void qla_nvme_abort(struct qla_hw_data * {int rval; -if (!test_bit (ABORT_ISP_ACTIVE , &sp->vha->dpc_flags)) { +if (ha->flags.fw_started) { rval = ha->isp_ops->abort_command (sp);if (!rval && !qla_nvme_wait_on_command (sp)) ql_log(ql_log_warn, NULL, 0x2112,
Greg Kroah-Hartman
maintainerPATCH 60/205 scsi: qla2xxx: Fix NVMe Target discovery
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit db186382af21e926e90df19499475f2552192b77 upstream.
This patch fixes issue when remoteport registers itself as both FCP and FC-NVMe with the switch, driver will pick FC-NVMe personality as default when scanning for targets.
Driver was using comaprative operator instead of bitwise operator to check for fc4_type for both FCP and FC-NVME.
--- drivers/scsi/qla2xxx/qla_os.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_os.c +2 -2
@@ -4808,10 +4808,10 @@ void qla24xx_create_new_sess(struct scsi fcport->d_id = e->u.new_sess.id; fcport->flags |=FCF_FABRIC_DEVICE ; fcport->fw_login_state =DSC_LS_PLOGI_PEND ; -if (e->u.new_sess.fc4_type ==FS_FC4TYPE_FCP ) +if (e->u.new_sess.fc4_type &FS_FC4TYPE_FCP ) fcport->fc4_type =FC4_TYPE_FCP_SCSI ; -if (e->u.new_sess.fc4_type ==FS_FC4TYPE_NVME ) { +if (e->u.new_sess.fc4_type &FS_FC4TYPE_NVME ) { fcport->fc4_type =FC4_TYPE_OTHER ; fcport->fc4f_nvme =FC4_TYPE_NVME ; }
Greg Kroah-Hartman
maintainerPATCH 61/205 scsi: qla2xxx: Fix duplicate switch database entries
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit 732ee9a912cf2d9a50c5f9c4213cdc2f885d6aa6 upstream.
The response data buffer used in switch scan is reused 4 times. (For example, for commands GPN_FT, GNN_FT for FCP and FC-NVME) Before driver reuses this buffer, clear it to prevent duplicate entries in our database.
--- drivers/scsi/qla2xxx/qla_gs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/qla2xxx/qla_gs.c +3 -3
@@ -4447,9 +4447,9 @@ int qla24xx_async_gpnft(scsi_qla_host_t sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout;qla2x00_init_timer (sp,qla2x00_get_async_timeout (vha) +2 ); - rspsz =sizeof (struct ct_sns_gpnft_rsp ) + - ((vha->hw->max_fibre_devices -1 ) * -sizeof (struct ct_sns_gpn_ft_data )); + rspsz = sp->u.iocb_cmd.u.ctarg.rsp_size; +memset (sp->u.iocb_cmd.u.ctarg.rsp,0 , sp->u.iocb_cmd.u.ctarg.rsp_size); +memset (sp->u.iocb_cmd.u.ctarg.req,0 , sp->u.iocb_cmd.u.ctarg.req_size); ct_sns = (struct ct_sns_pkt *)sp->u.iocb_cmd.u.ctarg.req;/* CT_IU preamble */
Greg Kroah-Hartman
maintainerPATCH 62/205 scsi: qla2xxx: Fix driver hang when FC-NVMe LUNs are configured
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Himanshu Madhani <[email protected]>
commit 39553065f77c297239308470ee313841f4e07db4 upstream.
This patch fixes multiple call for qla_nvme_unregister_remote_port() as part of qlt_schedule_session_for_deletion(), Do not call it again during qla_nvme_delete()
--- drivers/scsi/qla2xxx/qla_nvme.c | 3 --- 1 file changed, 3 deletions(-)
drivers/scsi/qla2xxx/qla_nvme.c +0 -3
@@ -660,9 +660,6 @@ void qla_nvme_delete(struct scsi_qla_hos __func__, fcport);nvme_fc_set_remoteport_devloss (fcport->nvme_remote_port,0 ); -init_completion (&fcport->nvme_del_done); -nvme_fc_unregister_remoteport (fcport->nvme_remote_port); -wait_for_completion (&fcport->nvme_del_done); }if (vha->nvme_local_port) {
Greg Kroah-Hartman
maintainerPATCH 63/205 vfs: fix FIGETBSZ ioctl on an overlayfs file
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 8f97d1e99149a7f1aa19e47a51b09764382a482e upstream.
Some anon_bdev filesystems (e.g. overlayfs, ceph) don't have s_blocksize set. Returning zero from FIGETBSZ ioctl results in a Floating point exception from the e2fsprogs utility filefrag, which divides the size of the file with the value returned by FIGETBSZ.
Fix the interface by returning -EINVAL for these filesystems.
--- fs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ioctl.c +3 -0
@@ -669,6 +669,9 @@ int do_vfs_ioctl(struct file *filp, unsireturn ioctl_fiemap (filp, arg);case FIGETBSZ : +/* anon_bdev filesystems may not have a block size */ +if (!inode->i_sb->s_blocksize) +return -EINVAL ;return put_user (inode->i_sb->s_blocksize, argp);case FICLONE :
Greg Kroah-Hartman
maintainerPATCH 64/205 fuse: Fix use-after-free in fuse_dev_do_read()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill Tkhai <[email protected]>
commit bc78abbd55dd28e2287ec6d6502b842321a17c87 upstream.
We may pick freed req in this way:
[cpu0] [cpu1]
fuse_dev_do_read() fuse_dev_do_write()
list_move_tail(&req->list, ...); ...
spin_unlock(&fpq->lock); ...
... request_end(fc, req);
... fuse_put_request(fc, req);
if (test_bit(FR_INTERRUPTED, ...))
queue_interrupt(fiq, req);Fix that by keeping req alive until we finish all manipulations.
--- fs/fuse/dev.c | 2 ++ 1 file changed, 2 insertions(+)
fs/fuse/dev.c +2 -0
@@ -1311,12 +1311,14 @@ static ssize_t fuse_dev_do_read(struct f goto out_end; }list_move_tail (&req->list, &fpq->processing); +__fuse_get_request (req);spin_unlock (&fpq->lock);set_bit (FR_SENT , &req->flags);/* matches barrier in request_wait_answer() */ smp_mb__after_atomic ();if (test_bit (FR_INTERRUPTED , &req->flags))queue_interrupt (fiq, req); +fuse_put_request (fc, req);return reqsize;
Greg Kroah-Hartman
maintainerPATCH 65/205 fuse: Fix use-after-free in fuse_dev_do_write()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill Tkhai <[email protected]>
commit d2d2d4fb1f54eff0f3faa9762d84f6446a4bc5d0 upstream.
After we found req in request_find() and released the lock, everything may happen with the req in parallel:
cpu0 cpu1
fuse_dev_do_write() fuse_dev_do_write()
req = request_find(fpq, ...) ...
spin_unlock(&fpq->lock) ...
... req = request_find(fpq, oh.unique)
... spin_unlock(&fpq->lock)
queue_interrupt(&fc->iq, req); ...
... ...
... ...
request_end(fc, req);
fuse_put_request(fc, req); ... queue_interrupt(&fc->iq, req);
--- fs/fuse/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/fuse/dev.c +5 -1
@@ -1877,16 +1877,20 @@ static ssize_t fuse_dev_do_write(struct/* Is it an interrupt reply? */ if (req->intr_unique == oh.unique) { +__fuse_get_request (req);spin_unlock (&fpq->lock); err = -EINVAL ; -if (nbytes !=sizeof (struct fuse_out_header )) +if (nbytes !=sizeof (struct fuse_out_header )) { +fuse_put_request (fc, req); goto err_finish; + }if (oh.error == -ENOSYS ) fc->no_interrupt =1 ;else if (oh.error == -EAGAIN )queue_interrupt (&fc->iq, req); +fuse_put_request (fc, req);fuse_copy_finish (cs);return nbytes;
Greg Kroah-Hartman
maintainerPATCH 66/205 fuse: fix blocked_waitq wakeup
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 908a572b80f6e9577b45e81b3dfe2e22111286b8 upstream.
Using waitqueue_active() is racy. Make sure we issue a wake_up() unconditionally after storing into fc->blocked. After that it's okay to optimize with waitqueue_active() since the first wake up provides the necessary barrier for all waiters, not the just the woken one.
--- fs/fuse/dev.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
fs/fuse/dev.c +11 -4
@@ -391,12 +391,19 @@ static void request_end(struct fuse_connif (test_bit (FR_BACKGROUND , &req->flags)) {spin_lock (&fc->lock);clear_bit (FR_BACKGROUND , &req->flags); -if (fc->num_background == fc->max_background) +if (fc->num_background == fc->max_background) { fc->blocked =0 ; - -/* Wake up next waiter, if any */ -if (!fc->blocked &&waitqueue_active (&fc->blocked_waitq))wake_up (&fc->blocked_waitq); + }else if (!fc->blocked) { +/* +* Wake up next waiter, if any. It's okay to use +* waitqueue_active(), as we've already synced up +* fc->blocked with waiters with the wake_up() call +* above. +*/ +if (waitqueue_active (&fc->blocked_waitq)) +wake_up (&fc->blocked_waitq); + }if (fc->num_background == fc->congestion_threshold && fc->sb) {clear_bdi_congested (fc->sb->s_bdi,BLK_RW_SYNC );
Greg Kroah-Hartman
maintainerPATCH 67/205 fuse: set FR_SENT while locked
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 4c316f2f3ff315cb48efb7435621e5bfb81df96d upstream.
Otherwise fuse_dev_do_write() could come in and finish off the request, and the set_bit(FR_SENT, ...) could trigger the WARN_ON(test_bit(FR_SENT, ...)) in request_end().
--- fs/fuse/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/dev.c +1 -1
@@ -1319,8 +1319,8 @@ static ssize_t fuse_dev_do_read(struct f }list_move_tail (&req->list, &fpq->processing);__fuse_get_request (req); -spin_unlock (&fpq->lock);set_bit (FR_SENT , &req->flags); +spin_unlock (&fpq->lock);/* matches barrier in request_wait_answer() */ smp_mb__after_atomic ();if (test_bit (FR_INTERRUPTED , &req->flags))
Greg Kroah-Hartman
maintainerPATCH 68/205 drm/msm: fix OF child-node lookup
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit f9a7082327e26f54067a49cac2316d31e0cc8ba7 upstream.
Use the new of_get_compatible_child() helper to lookup the legacy pwrlevels child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the probed device's node).
While at it, also fix the related child-node reference leak.
drivers/gpu/drm/msm/adreno/adreno_gpu.c +3 -2
@@ -633,8 +633,7 @@ static int adreno_get_legacy_pwrlevels(struct device *dev)struct device_node *child, *node;int ret; - node =of_find_compatible_node (dev->of_node,NULL , -"qcom,gpu-pwrlevels" ); + node =of_get_compatible_child (dev->of_node,"qcom,gpu-pwrlevels" );if (!node) {dev_err (dev,"Could not find the GPU powerlevels\n" );return -ENXIO ;
@@ -655,6 +654,8 @@ static int adreno_get_legacy_pwrlevels(struct device *dev)dev_pm_opp_add (dev, val,0 ); } +of_node_put (node); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 69/205 arm64: dts: stratix10: Support Ethernet Jumbo frame
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
commit a27460c9768ee19949c5b91f3d959ccd88c2a64a upstream
Properly specify the RX and TX FIFO size which is important for Jumbo frames.
Update the max-frame-size to support Jumbo frames.
--- arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 6 ++++++ arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +6 -0
@@ -137,6 +137,8 @@ reset-names = "stmmaceth", "stmmaceth-ocp"; clocks = <&clkmgr STRATIX10_EMAC0_CLK>; clock-names = "stmmaceth"; + tx-fifo-depth = <16384>; + rx-fifo-depth = <16384>; status = "disabled"; };
@@ -150,6 +152,8 @@ reset-names = "stmmaceth", "stmmaceth-ocp"; clocks = <&clkmgr STRATIX10_EMAC1_CLK>; clock-names = "stmmaceth"; + tx-fifo-depth = <16384>; + rx-fifo-depth = <16384>; status = "disabled"; };
@@ -163,6 +167,8 @@ reset-names = "stmmaceth", "stmmaceth-ocp"; clocks = <&clkmgr STRATIX10_EMAC2_CLK>; clock-names = "stmmaceth"; + tx-fifo-depth = <16384>; + rx-fifo-depth = <16384>; status = "disabled"; };
arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts +1 -1
@@ -76,7 +76,7 @@ phy-mode = "rgmii"; phy-handle = <&phy0>; - max-frame-size = <3800>; + max-frame-size = <9000>; mdio0 { #address-cells = <1>;
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 70/205 arm64: dts: stratix10: fix multicast filtering
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
commit fd5ba6ee3187617287fb9cb187e3d6b3631210a3 upstream
On Stratix 10, the EMAC has 256 hash buckets for multicast filtering. This needs to be specified in DTS, otherwise the stmmac driver defaults to 64 buckets and initializes the filter incorrectly. As a result, e.g. valid IPv6 multicast traffic ends up being dropped.
--- arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +3 -0
@@ -139,6 +139,7 @@ clock-names = "stmmaceth"; tx-fifo-depth = <16384>; rx-fifo-depth = <16384>; + snps,multicast-filter-bins = <256>; status = "disabled"; };
@@ -154,6 +155,7 @@ clock-names = "stmmaceth"; tx-fifo-depth = <16384>; rx-fifo-depth = <16384>; + snps,multicast-filter-bins = <256>; status = "disabled"; };
@@ -169,6 +171,7 @@ clock-names = "stmmaceth"; tx-fifo-depth = <16384>; rx-fifo-depth = <16384>; + snps,multicast-filter-bins = <256>; status = "disabled"; };
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 71/205 clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e2576c8bdfd462c34b8a46c0084e7c30b0851bf4 ]
On the Khadas VIM2 (GXM) and LePotato (GXL) board there are problems with reboot; e.g. a ~60 second delay between issuing reboot and the board power cycling (and in some OS configurations reboot will fail and require manual power cycling).
Similar to 'commit c987ac6f1f088663b6dad39281071aeb31d450a8 ("clk:
meson-gxbb: set fclk_div2 as CLK_IS_CRITICAL")' the SCPI Cortex-M4 Co-Processor seems to depend on FCLK_DIV3 being operational.
Until commit 05f814402d6174369b3b29832cbb5eb5ed287059 ("clk:
meson: add fdiv clock gates"), this clock was modeled and left on by the bootloader.
We don't have precise documentation about the SCPI Co-Processor and its clock requirement so we are learning things the hard way.
Marking this clock as critical solves the problem but it should not be viewed as final solution. Ideally, the SCPI driver should claim these clocks. We also depends on some clock hand-off mechanism making its way to CCF, to make sure the clock stays on between its registration and the SCPI driver probe.
--- drivers/clk/meson/gxbb.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/clk/meson/gxbb.c +12 -0
@@ -522,6 +522,18 @@ static struct clk_regmap gxbb_fclk_div3 = { .ops = &clk_regmap_gate_ops, .parent_names = (const char *[]){ "fclk_div3_div" }, .num_parents = 1, +/* +* FIXME: +* This clock, as fdiv2, is used by the SCPI FW and is required +* by the platform to operate correctly. +* Until the following condition are met, we need this clock to +* be marked as critical: +* a) The SCPI generic driver claims and enable all the clocks +* it needs +* b) CCF has a clock hand-off mechanism to make the sure the +* clock stays on until the proper driver comes along +*/ + .flags = CLK_IS_CRITICAL, }, };
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 72/205 clk: meson: axg: mark fdiv2 and fdiv3 as critical
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d6ee1e7e9004d3d246cdfa14196989e0a9466c16 ]
Similar to gxbb and gxl platforms, axg SCPI Cortex-M co-processor uses the fdiv2 and fdiv3 to, among other things, provide the cpu clock.
Until clock hand-off mechanism makes its way to CCF and the generic SCPI claims platform specific clocks, these clocks must be marked as critical to make sure they are never disabled when needed by the co-processor.
--- drivers/clk/meson/axg.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/clk/meson/axg.c +13 -0
@@ -319,6 +319,7 @@ static struct clk_regmap axg_fclk_div2 = { .ops = &clk_regmap_gate_ops, .parent_names = (const char *[]){ "fclk_div2_div" }, .num_parents = 1, + .flags = CLK_IS_CRITICAL, }, };
@@ -343,6 +344,18 @@ static struct clk_regmap axg_fclk_div3 = { .ops = &clk_regmap_gate_ops, .parent_names = (const char *[]){ "fclk_div3_div" }, .num_parents = 1, +/* +* FIXME: +* This clock, as fdiv2, is used by the SCPI FW and is required +* by the platform to operate correctly. +* Until the following condition are met, we need this clock to +* be marked as critical: +* a) The SCPI generic driver claims and enable all the clocks +* it needs +* b) CCF has a clock hand-off mechanism to make the sure the +* clock stays on until the proper driver comes along +*/ + .flags = CLK_IS_CRITICAL, }, };
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 73/205 zram: close udev startup race condition as default groups
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
commit fef912bf860e upstream.
commit 98af4d4df889 upstream.
I got a report from Howard Chen that he saw zram and sysfs race(ie, zram block device file is created but sysfs for it isn't yet) when he tried to create new zram devices via hotadd knob.
v4.20 kernel fixes it by [1, 2] but it's too large size to merge into -stable so this patch fixes the problem by registering defualt group by Greg KH's approach[3].
This patch should be applied to every stable tree [3.16+] currently existing from kernel.org because the problem was introduced at 2.6.37 by [4].
[1] fef912bf860e, block: genhd: add 'groups' argument to device_add_disk
[2] 98af4d4df889, zram: register default groups with device_add_disk()
[3] http://kroah.com/log/blog/2013/06/26/how-to-create-a-sysfs-file-correctly/
[4] 33863c21e69e9, Staging: zram: Replace ioctls with sysfs interface
--- drivers/block/zram/zram_drv.c | 26 ++++++-------------------- 1 file changed, 6 insertions(+), 20 deletions(-)
drivers/block/zram/zram_drv.c +6 -20
@@ -1636,6 +1636,11 @@ static const struct attribute_group zram_disk_attr_group = { .attrs = zram_disk_attrs, }; +static const struct attribute_group *zram_disk_attr_groups[] = { + &zram_disk_attr_group, +NULL , +}; +/* * Allocate and initialize new zram device. the function returns * '>= 0' device_id upon success, and negative value otherwise.
@@ -1716,24 +1721,15 @@ static int zram_add(void) zram->disk->queue->backing_dev_info->capabilities |= (BDI_CAP_STABLE_WRITES |BDI_CAP_SYNCHRONOUS_IO ); +disk_to_dev (zram->disk)->groups = zram_disk_attr_groups;add_disk (zram->disk); - ret =sysfs_create_group (&disk_to_dev (zram->disk)->kobj, - &zram_disk_attr_group); -if (ret <0 ) { -pr_err ("Error creating sysfs group for device %d\n" , - device_id); - goto out_free_disk; - }strlcpy (zram->compressor, default_compressor,sizeof (zram->compressor));zram_debugfs_register (zram);pr_info ("Added device: %s\n" , zram->disk->disk_name);return device_id; -out_free_disk: -del_gendisk (zram->disk); -put_disk (zram->disk); out_free_queue:blk_cleanup_queue (queue); out_free_idr:
@@ -1762,16 +1758,6 @@ static int zram_remove(struct zram *zram)mutex_unlock (&bdev->bd_mutex);zram_debugfs_unregister (zram); -/* -* Remove sysfs first, so no one will perform a disksize -* store while we destroy the devices. This also helps during -* hot_remove -- zram_reset_device() is the last holder of -* ->init_lock, no later/concurrent disksize_store() or any -* other sysfs handlers are possible. -*/ -sysfs_remove_group (&disk_to_dev (zram->disk)->kobj, - &zram_disk_attr_group); -/* Make sure all the pending I/O are finished */ fsync_bdev (bdev);zram_reset_device (zram);
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 74/205 MIPS: Loongson-3: Fix CPU UART irq delivery problem
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d06f8a2f1befb5a3d0aa660ab1c05e9b744456ea ]
Masking/unmasking the CPU UART irq in CP0_Status (and redirecting it to other CPUs) may cause interrupts be lost, especially in multi-package machines (Package-0's UART irq cannot be delivered to others). So make mask_loongson_irq() and unmask_loongson_irq() be no-ops.
The original problem (UART IRQ may deliver to any core) is also because of masking/unmasking the CPU UART irq in CP0_Status. So it is safe to remove all of the stuff.
Patchwork: https://patchwork.linux-mips.org/patch/20433/
--- arch/mips/loongson64/loongson-3/irq.c | 43 ++------------------------- 1 file changed, 3 insertions(+), 40 deletions(-)
arch/mips/loongson64/loongson-3/irq.c +3 -40
@@ -102,45 +102,8 @@ static struct irqaction cascade_irqaction = { .name = "cascade", }; -static inline void mask_loongson_irq (struct irq_data *d) -{ -clear_c0_status (0x100 << (d->irq -MIPS_CPU_IRQ_BASE )); -irq_disable_hazard (); - -/* Workaround: UART IRQ may deliver to any core */ -if (d->irq ==LOONGSON_UART_IRQ ) { -int cpu =smp_processor_id (); -int node_id =cpu_logical_map (cpu) / loongson_sysconf.cores_per_node; -int core_id =cpu_logical_map (cpu) % loongson_sysconf.cores_per_node; -u64 intenclr_addr = smp_group[node_id] | - (u64)(&LOONGSON_INT_ROUTER_INTENCLR ); -u64 introuter_lpc_addr = smp_group[node_id] | - (u64)(&LOONGSON_INT_ROUTER_LPC ); - - *(volatile u32 *)intenclr_addr =1 <<10 ; - *(volatile u8 *)introuter_lpc_addr =0x10 + (1 <<core_id); - } -} - -static inline void unmask_loongson_irq (struct irq_data *d) -{ -/* Workaround: UART IRQ may deliver to any core */ -if (d->irq ==LOONGSON_UART_IRQ ) { -int cpu =smp_processor_id (); -int node_id =cpu_logical_map (cpu) / loongson_sysconf.cores_per_node; -int core_id =cpu_logical_map (cpu) % loongson_sysconf.cores_per_node; -u64 intenset_addr = smp_group[node_id] | - (u64)(&LOONGSON_INT_ROUTER_INTENSET ); -u64 introuter_lpc_addr = smp_group[node_id] | - (u64)(&LOONGSON_INT_ROUTER_LPC ); - - *(volatile u32 *)intenset_addr =1 <<10 ; - *(volatile u8 *)introuter_lpc_addr =0x10 + (1 <<core_id); - } - -set_c0_status (0x100 << (d->irq -MIPS_CPU_IRQ_BASE )); -irq_enable_hazard (); -} +static inline void mask_loongson_irq (struct irq_data *d) { } +static inline void unmask_loongson_irq (struct irq_data *d) { }/* For MIPS IRQs which shared by all cores */ static struct irq_chip loongson_irq_chip = {
@@ -183,7 +146,7 @@ void __init mach_init_irq(void) chip->irq_set_affinity = plat_set_irq_affinity;irq_set_chip_and_handler (LOONGSON_UART_IRQ , - &loongson_irq_chip, handle_level_irq); + &loongson_irq_chip, handle_percpu_irq);/* setup HT1 irq */ setup_irq (LOONGSON_HT1_IRQ , &cascade_irqaction);
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 75/205 MIPS: Loongson-3: Fix BRIDGE irq delivery problem
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 360fe725f8849aaddc53475fef5d4a0c439b05ae ]
After commit e509bd7da149dc349160 ("genirq: Allow migration of chained interrupts by installing default action") Loongson-3 fails at here:
setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction);
This is because both chained_action and cascade_irqaction don't have IRQF_SHARED flag. This will cause Loongson-3 resume fails because HPET timer interrupt can't be delivered during S3. So we set the irqchip of the chained irq to loongson_irq_chip which doesn't disable the chained irq in CP0.Status.
Patchwork: https://patchwork.linux-mips.org/patch/20434/
--- arch/mips/include/asm/mach-loongson64/irq.h | 2 +- arch/mips/loongson64/loongson-3/irq.c | 13 +++---------- 2 files changed, 4 insertions(+), 11 deletions(-)
arch/mips/include/asm/mach-loongson64/irq.h +1 -1
@@ -10,7 +10,7 @@#define MIPS_CPU_IRQ_BASE 56#define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2)/* UART */ -#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3)/* HT1 */ +#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3)/* CASCADE */ #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7)/* CPU Timer */ #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base
arch/mips/loongson64/loongson-3/irq.c +3 -10
@@ -96,12 +96,6 @@ void mach_irq_dispatch(unsigned int pending) } } -static struct irqaction cascade_irqaction = { - .handler = no_action, - .flags =IRQF_NO_SUSPEND , - .name ="cascade" , -}; -static inline void mask_loongson_irq (struct irq_data *d) { }static inline void unmask_loongson_irq (struct irq_data *d) { }
@@ -147,11 +141,10 @@ void __init mach_init_irq(void)irq_set_chip_and_handler (LOONGSON_UART_IRQ , &loongson_irq_chip, handle_percpu_irq); +irq_set_chip_and_handler (LOONGSON_BRIDGE_IRQ , + &loongson_irq_chip, handle_percpu_irq); -/* setup HT1 irq */ -setup_irq (LOONGSON_HT1_IRQ , &cascade_irqaction); - -set_c0_status (STATUSF_IP2 |STATUSF_IP6 ); +set_c0_status (STATUSF_IP2 |STATUSF_IP3 |STATUSF_IP6 ); }#ifdef CONFIG_HOTPLUG_CPU
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 76/205 xtensa: add NOTES section to the linker script
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 4119ba211bc4f1bf638f41e50b7a0f329f58aa16 upstream.
This section collects all source .note.* sections together in the vmlinux image. Without it .note.Linux section may be placed at address 0, while the rest of the kernel is at its normal address, resulting in a huge vmlinux.bin image that may not be linked into the xtensa Image.elf.
--- arch/xtensa/boot/Makefile | 2 +- arch/xtensa/kernel/vmlinux.lds.S | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
arch/xtensa/boot/Makefile +1 -1
@@ -33,7 +33,7 @@ uImage: $(obj)/uImage boot-elf boot-redboot: $(addprefix $(obj)/,$(subdir-y)) $(Q)$(MAKE) $(build)=$(obj)/$@ $(MAKECMDGOALS) -OBJCOPYFLAGS = --strip-all -R .comment -R .note.gnu.build-id -O binary +OBJCOPYFLAGS = --strip-all -R .comment -R .notes -O binary vmlinux.bin: vmlinux FORCE $(call if_changed,objcopy)
arch/xtensa/kernel/vmlinux.lds.S +1 -0
@@ -131,6 +131,7 @@ SECTIONS .fixup : { *(.fixup) } EXCEPTION_TABLE(16) + NOTES /* Data section */ _sdata = .;
Greg Kroah-Hartman
maintainerPATCH 77/205 xtensa: make sure bFLT stack is 16 byte aligned
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 0773495b1f5f1c5e23551843f87b5ff37e7af8f7 upstream.
Xtensa ABI requires stack alignment to be at least 16. In noMMU configuration ARCH_SLAB_MINALIGN is used to align stack. Make it at least 16.
This fixes the following runtime error in noMMU configuration, caused by interaction between insufficiently aligned stack and alloca function, that results in corruption of on-stack variable in the libc function glob:
Caught unhandled exception in 'sh' (pid = 47, pc = 0x02d05d65)
- should not happen
EXCCAUSE is 15
--- arch/xtensa/include/asm/processor.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/xtensa/include/asm/processor.h +5 -1
@@ -23,7 +23,11 @@# error Linux requires the Xtensa Windowed Registers Option.#endif -#define ARCH_SLAB_MINALIGN XCHAL_DATA_WIDTH +/* Xtensa ABI requires stack alignment to be at least 16 */ + +#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16) + +#define ARCH_SLAB_MINALIGN STACK_ALIGN/* * User space process size: 1 GB.
Greg Kroah-Hartman
maintainerPATCH 78/205 xtensa: fix boot parameters address translation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 40dc948f234b73497c3278875eb08a01d5854d3f upstream.
The bootloader may pass physical address of the boot parameters structure to the MMUv3 kernel in the register a2. Code in the _SetupMMU block in the arch/xtensa/kernel/head.S is supposed to map that physical address to the virtual address in the configured virtual memory layout.
This code haven't been updated when additional 256+256 and 512+512 memory layouts were introduced and it may produce wrong addresses when used with these layouts.
--- arch/xtensa/kernel/head.S | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/xtensa/kernel/head.S +5 -2
@@ -88,9 +88,12 @@ _SetupMMU: initialize_mmu #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY rsr a2, excsave1 - movi a3, 0x08000000 + movi a3, XCHAL_KSEG_PADDR + bltu a2, a3, 1f + sub a2, a2, a3 + movi a3, XCHAL_KSEG_SIZE bgeu a2, a3, 1f - movi a3, 0xd0000000 + movi a3, XCHAL_KSEG_CACHED_VADDR add a2, a2, a3 wsr a2, excsave1 1:
Greg Kroah-Hartman
maintainerPATCH 79/205 um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit 0676b957c24bfb6e495449ba7b7e72c5b5d79233 upstream.
32bit UML used to define PTRACE_SYSEMU and PTRACE_SYSEMU_SINGLESTEP own its own because many years ago not all libcs had these request codes in their UAPI.
These days PTRACE_SYSEMU/_SINGLESTEP is well known and part of glibc and our own define becomes problematic.
With change c48831d0eebf ("linux/x86: sync sys/ptrace.h with Linux 4.14 [BZ #22433]") glibc turned PTRACE_SYSEMU/_SINGLESTEP into a enum and UML failed to build.
Let's drop our define and rely on the fact that every libc has PTRACE_SYSEMU/_SINGLESTEP.
--- arch/x86/um/shared/sysdep/ptrace_32.h | 10 ---------- 1 file changed, 10 deletions(-)
arch/x86/um/shared/sysdep/ptrace_32.h +0 -10
@@ -10,20 +10,10 @@static inline void update_debugregs (int seq) {} -/* syscall emulation path in ptrace */ - -#ifndef PTRACE_SYSEMU -#define PTRACE_SYSEMU 31 -#endif -void set_using_sysemu (int value);int get_using_sysemu (void );extern int sysemu_supported; -#ifndef PTRACE_SYSEMU_SINGLESTEP -#define PTRACE_SYSEMU_SINGLESTEP 32 -#endif -#define UPT_SYSCALL_ARG1 (r) UPT_BX(r)#define UPT_SYSCALL_ARG2 (r) UPT_CX(r)#define UPT_SYSCALL_ARG3 (r) UPT_DX(r)
Greg Kroah-Hartman
maintainerPATCH 80/205 clk: s2mps11: Fix matching when built as module and DT node contains compatible
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 8985167ecf57f97061599a155bb9652c84ea4913 upstream.
When driver is built as module and DT node contains clocks compatible (e.g. "samsung,s2mps11-clk"), the module will not be autoloaded because module aliases won't match.
The modalias from uevent: of:NclocksT<NULL>Csamsung,s2mps11-clk The modalias from driver: platform:s2mps11-clk
The devices are instantiated by parent's MFD. However both Device Tree bindings and parent define the compatible for clocks devices. In case of module matching this DT compatible will be used.
The issue will not happen if this is a built-in (no need for module matching) or when clocks DT node does not contain compatible (not correct from bindings perspective but working for driver).
Note when backporting to stable kernels: adjust the list of device ID entries.
--- drivers/clk/clk-s2mps11.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/clk/clk-s2mps11.c +30 -0
@@ -245,6 +245,36 @@ static const struct platform_device_id s };MODULE_DEVICE_TABLE (platform, s2mps11_clk_id); +#ifdef CONFIG_OF +/* +* Device is instantiated through parent MFD device and device matching is done +* through platform_device_id. +* +* However if device's DT node contains proper clock compatible and driver is +* built as a module, then the *module* matching will be done trough DT aliases. +* This requires of_device_id table. In the same time this will not change the +* actual *device* matching so do not add .of_match_table. +*/ +static const struct of_device_id s2mps11_dt_match[] = { + { + .compatible ="samsung,s2mps11-clk" , + .data = (void *)S2MPS11X , + }, { + .compatible ="samsung,s2mps13-clk" , + .data = (void *)S2MPS13X , + }, { + .compatible ="samsung,s2mps14-clk" , + .data = (void *)S2MPS14X , + }, { + .compatible ="samsung,s5m8767-clk" , + .data = (void *)S5M8767X , + }, { +/* Sentinel */ + }, +}; +MODULE_DEVICE_TABLE (of, s2mps11_dt_match); +#endif +static struct platform_driver s2mps11_clk_driver = { .driver = { .name ="s2mps11-clk" ,
Greg Kroah-Hartman
maintainerPATCH 81/205 clk: at91: Fix division by zero in PLL recalc_rate()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Wahl <[email protected]>
commit 0f5cb0e6225cae2f029944cb8c74617aab6ddd49 upstream.
Commit a982e45dc150 ("clk: at91: PLL recalc_rate() now using cached MUL and DIV values") removed a check that prevents a division by zero. This now causes a stacktrace when booting the kernel on a at91 platform if the PLL DIV register contains zero. This commit reintroduces this check.
--- drivers/clk/at91/clk-pll.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/at91/clk-pll.c +3 -0
@@ -133,6 +133,9 @@ static unsigned long clk_pll_recalc_rate {struct clk_pll *pll =to_clk_pll (hw); +if (!pll->div || !pll->mul) +return 0 ; +return (parent_rate / pll->div) * (pll->mul +1 ); }
Greg Kroah-Hartman
maintainerPATCH 82/205 clk: sunxi-ng: h6: fix bus clocks divider position
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <[email protected]>
commit 2852bfbf4f168fec27049ad9ed20941fc9e84b95 upstream.
The bus clocks (AHB/APB) on Allwinner H6 have their second divider start at bit 8, according to the user manual and the BSP code. However, currently the divider offset is incorrectly set to 16, thus the divider is not correctly read and the clock frequency is not correctly calculated.
Fix this bit offset on all affected bus clocks in ccu-sun50i-h6.
--- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/clk/sunxi-ng/ccu-sun50i-h6.c +4 -4
@@ -224,7 +224,7 @@ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ah psi_ahb1_ahb2_parents,0x510 ,0 ,5 ,/* M */ -16 ,2 ,/* P */ +8 ,2 ,/* P */ 24 ,2 ,/* mux */ 0);
@@ -233,19 +233,19 @@ static const char * const ahb3_apb1_apb2 "pll-periph0" }; static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c,0 ,5 ,/* M */ -16 ,2 ,/* P */ +8 ,2 ,/* P */ 24 ,2 ,/* mux */ 0); static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520,0 ,5 ,/* M */ -16 ,2 ,/* P */ +8 ,2 ,/* P */ 24 ,2 ,/* mux */ 0); static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524,0 ,5 ,/* M */ -16 ,2 ,/* P */ +8 ,2 ,/* P */ 24 ,2 ,/* mux */ 0);
Greg Kroah-Hartman
maintainerPATCH 83/205 clk: rockchip: fix wrong mmc sample phase shift for rk3328
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyuan Xu <[email protected]>
commit 82f4b67f018c88a7cc9337f0067ed3d6ec352648 upstream.
mmc sample shift is 0 for RK3328 referring to the TRM. So fix them.
--- drivers/clk/rockchip/clk-rk3328.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/clk/rockchip/clk-rk3328.c +4 -4
@@ -813,22 +813,22 @@ static struct rockchip_clk_branch rk3328MMC (SCLK_SDMMC_DRV ,"sdmmc_drv" ,"clk_sdmmc" ,RK3328_SDMMC_CON0 ,1 ),MMC (SCLK_SDMMC_SAMPLE ,"sdmmc_sample" ,"clk_sdmmc" , -RK3328_SDMMC_CON1 ,1 ), +RK3328_SDMMC_CON1 ,0 ),MMC (SCLK_SDIO_DRV ,"sdio_drv" ,"clk_sdio" ,RK3328_SDIO_CON0 ,1 ),MMC (SCLK_SDIO_SAMPLE ,"sdio_sample" ,"clk_sdio" , -RK3328_SDIO_CON1 ,1 ), +RK3328_SDIO_CON1 ,0 ),MMC (SCLK_EMMC_DRV ,"emmc_drv" ,"clk_emmc" ,RK3328_EMMC_CON0 ,1 ),MMC (SCLK_EMMC_SAMPLE ,"emmc_sample" ,"clk_emmc" , -RK3328_EMMC_CON1 ,1 ), +RK3328_EMMC_CON1 ,0 ),MMC (SCLK_SDMMC_EXT_DRV ,"sdmmc_ext_drv" ,"clk_sdmmc_ext" ,RK3328_SDMMC_EXT_CON0 ,1 ),MMC (SCLK_SDMMC_EXT_SAMPLE ,"sdmmc_ext_sample" ,"clk_sdmmc_ext" , - RK3328_SDMMC_EXT_CON1, 1), + RK3328_SDMMC_EXT_CON1, 0), }; static const char *const rk3328_critical_clocks[] __initconst = {
Greg Kroah-Hartman
maintainerPATCH 84/205 clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enric Balletbo i Serra <[email protected]>
commit 665636b2940d0897c4130253467f5e8c42eea392 upstream.
Fixes the signedness bug returning '(-22)' on the return type by removing the sanity checker in rockchip_ddrclk_get_parent(). The function should return and unsigned value only and it's safe to remove the sanity checker as the core functions that call get_parent like clk_core_get_parent_by_index already ensures the validity of the clk index returned (index >= core->num_parents).
--- drivers/clk/rockchip/clk-ddr.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/clk/rockchip/clk-ddr.c +0 -4
@@ -80,16 +80,12 @@ static long rockchip_ddrclk_sip_round_rastatic u8 rockchip_ddrclk_get_parent (struct clk_hw *hw) {struct rockchip_ddrclk *ddrclk =to_rockchip_ddrclk_hw (hw); -int num_parents =clk_hw_get_num_parents (hw);u32 val; val =clk_readl (ddrclk->reg_base + ddrclk->mux_offset) >> ddrclk->mux_shift; val &=GENMASK (ddrclk->mux_width -1 ,0 ); -if (val >= num_parents) -return -EINVAL ; -return val; }
Greg Kroah-Hartman
maintainerPATCH 85/205 libceph: bump CEPH_MSG_MAX_DATA_LEN
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 94e6992bb560be8bffb47f287194adf070b57695 upstream.
If the read is large enough, we end up spinning in the messenger:
libceph: osd0 192.168.122.1:6801 io error
libceph: osd0 192.168.122.1:6801 io error
libceph: osd0 192.168.122.1:6801 io error
This is a receive side limit, so only reads were affected.
--- include/linux/ceph/libceph.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
include/linux/ceph/libceph.h +7 -1
@@ -81,7 +81,13 @@ struct ceph_options {#define CEPH_MSG_MAX_FRONT_LEN (16*1024*1024)#define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024) -#define CEPH_MSG_MAX_DATA_LEN (16*1024*1024) + +/* +* Handle the largest possible rbd object in one message. +* There is no limit on the size of cephfs objects, but it has to obey +* rsize and wsize mount options anyway. +*/ +#define CEPH_MSG_MAX_DATA_LEN (32*1024*1024)#define CEPH_AUTH_NAME_DEFAULT "guest"
Greg Kroah-Hartman
maintainerPATCH 86/205 Revert "ceph: fix dentry leak in splice_dentry()"
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan, Zheng <[email protected]>
commit efe328230dc01aa0b1269aad0b5fae73eea4677a upstream.
This reverts commit 8b8f53af1ed9df88a4c0fbfdf3db58f62060edf3.
splice_dentry() is used by three places. For two places, req->r_dentry is passed to splice_dentry(). In the case of error, req->r_dentry does not get updated. So splice_dentry() should not drop reference.
--- fs/ceph/inode.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ceph/inode.c +6 -2
@@ -1132,8 +1132,12 @@ static struct dentry *splice_dentry(struif (IS_ERR (realdn)) {pr_err ("splice_dentry error %ld %p inode %p ino %llx.%llx\n" ,PTR_ERR (realdn), dn, in,ceph_vinop (in)); -dput (dn); - dn = realdn;/* note realdn contains the error */ + dn = realdn; +/* +* Caller should release 'dn' in the case of error. +* If 'req->r_dentry' is passed to this function, +* caller should leave 'req->r_dentry' untouched. +*/ goto out; }else if (realdn) { dout("dn %p (%d) spliced with %p (%d) "
Greg Kroah-Hartman
maintainerPATCH 87/205 thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Osipenko <[email protected]>
commit 3c587768271e9c20276522025729e4ebca51583b upstream.
This patch fixes use-after-free that was detected by KASAN. The bug is triggered on a CPUFreq driver module unload by freeing 'cdev' on device unregister and then using the freed structure during of the cdev's sysfs data destruction. The solution is to unregister the sysfs at first, then destroy sysfs data and finally release the cooling device.
--- drivers/thermal/thermal_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/thermal/thermal_core.c +2 -1
@@ -1102,8 +1102,9 @@ void thermal_cooling_device_unregister(smutex_unlock (&thermal_list_lock);ida_simple_remove (&thermal_cdev_ida, cdev->id); -device_unregister (&cdev->device); +device_del (&cdev->device);thermal_cooling_device_destroy_sysfs (cdev); +put_device (&cdev->device); }EXPORT_SYMBOL_GPL (thermal_cooling_device_unregister);
Greg Kroah-Hartman
maintainerPATCH 88/205 mach64: fix display corruption on big endian machines
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 3c6c6a7878d00a3ac997a779c5b9861ff25dfcc8 upstream.
The code for manual bit triple is not endian-clean. It builds the variable "hostdword" using byte accesses, therefore we must read the variable with "le32_to_cpu".
The patch also enables (hardware or software) bit triple only if the image is monochrome (image->depth). If we want to blit full-color image, we shouldn't use the triple code.
--- drivers/video/fbdev/aty/mach64_accel.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/video/fbdev/aty/mach64_accel.c +3 -3
@@ -345,7 +345,7 @@ void atyfb_imageblit(struct fb_info *inf* since Rage 3D IIc we have DP_HOST_TRIPLE_EN bit * this hwaccelerated triple has an issue with not aligned data */ -if (M64_HAS (HW_TRIPLE ) && image->width %8 ==0 ) +if (image->depth ==1 &&M64_HAS (HW_TRIPLE ) && image->width %8 ==0 ) pix_width |=DP_HOST_TRIPLE_EN ; }
@@ -382,7 +382,7 @@ void atyfb_imageblit(struct fb_info *inf src_bytes = (((image->width * image->depth) +7 ) /8 ) * image->height;/* manual triple each pixel */ -if (info->var.bits_per_pixel ==24 && !(pix_width &DP_HOST_TRIPLE_EN )) { +if (image->depth ==1 && info->var.bits_per_pixel ==24 && !(pix_width &DP_HOST_TRIPLE_EN )) {int inbit, outbit, mult24, byte_id_in_dword, width;u8 *pbitmapin = (u8 *)image->data, *pbitmapout;u32 hostdword;
@@ -415,7 +415,7 @@ void atyfb_imageblit(struct fb_info *inf } }wait_for_fifo (1 , par); -aty_st_le32 (HOST_DATA0 , hostdword, par); +aty_st_le32 (HOST_DATA0 ,le32_to_cpu (hostdword), par); } }else {u32 *pbitmap, dwords = (src_bytes +3 ) /4 ;
Greg Kroah-Hartman
maintainerPATCH 89/205 mach64: fix image corruption due to reading accelerator registers
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit c09bcc91bb94ed91f1391bffcbe294963d605732 upstream.
Reading the registers without waiting for engine idle returns unpredictable values. These unpredictable values result in display corruption - if atyfb_imageblit reads the content of DP_PIX_WIDTH with the bit DP_HOST_TRIPLE_EN set (from previous invocation), the driver would never ever clear the bit, resulting in display corruption.
We don't want to wait for idle because it would degrade performance, so this patch modifies the driver so that it never reads accelerator registers.
HOST_CNTL doesn't have to be read, we can just write it with HOST_BYTE_ALIGN because no other part of the driver cares if HOST_BYTE_ALIGN is set.
DP_PIX_WIDTH is written in the functions atyfb_copyarea and atyfb_fillrect with the default value and in atyfb_imageblit with the value set according to the source image data.
--- drivers/video/fbdev/aty/mach64_accel.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
drivers/video/fbdev/aty/mach64_accel.c +9 -13
@@ -127,7 +127,7 @@ void aty_init_engine(struct atyfb_par *p/* set host attributes */ wait_for_fifo (13 , par); -aty_st_le32 (HOST_CNTL ,0 , par); +aty_st_le32 (HOST_CNTL ,HOST_BYTE_ALIGN , par);/* set pattern attributes */ aty_st_le32 (PAT_REG0 ,0 , par);
@@ -233,7 +233,8 @@ void atyfb_copyarea(struct fb_info *info rotation =rotation24bpp (dx, direction); } -wait_for_fifo (4 , par); +wait_for_fifo (5 , par); +aty_st_le32 (DP_PIX_WIDTH , par->crtc.dp_pix_width, par);aty_st_le32 (DP_SRC ,FRGD_SRC_BLIT , par);aty_st_le32 (SRC_Y_X , (sx <<16 ) | sy, par);aty_st_le32 (SRC_HEIGHT1_WIDTH1 , (width <<16 ) | area->height, par);
@@ -269,7 +270,8 @@ void atyfb_fillrect(struct fb_info *info rotation =rotation24bpp (dx,DST_X_LEFT_TO_RIGHT ); } -wait_for_fifo (3 , par); +wait_for_fifo (4 , par); +aty_st_le32 (DP_PIX_WIDTH , par->crtc.dp_pix_width, par);aty_st_le32 (DP_FRGD_CLR , color, par); aty_st_le32(DP_SRC, BKGD_SRC_BKGD_CLR | FRGD_SRC_FRGD_CLR | MONO_SRC_ONE,
@@ -284,7 +286,7 @@ void atyfb_imageblit(struct fb_info *inf {struct atyfb_par *par = (struct atyfb_par *) info->par;u32 src_bytes, dx = image->dx, dy = image->dy, width = image->width; -u32 pix_width_save, pix_width, host_cntl, rotation =0 , src, mix; +u32 pix_width, rotation =0 , src, mix;if (par->asleep)return ;
@@ -296,8 +298,7 @@ void atyfb_imageblit(struct fb_info *infreturn ; } - pix_width = pix_width_save =aty_ld_le32 (DP_PIX_WIDTH , par); - host_cntl =aty_ld_le32 (HOST_CNTL , par) |HOST_BYTE_ALIGN ; + pix_width = par->crtc.dp_pix_width;switch (image->depth) {case 1 :
@@ -370,12 +371,11 @@ void atyfb_imageblit(struct fb_info *inf mix =FRGD_MIX_D_XOR_S |BKGD_MIX_D ; } -wait_for_fifo (6 , par); -aty_st_le32 (DP_WRITE_MASK ,0xFFFFFFFF , par); +wait_for_fifo (5 , par);aty_st_le32 (DP_PIX_WIDTH , pix_width, par);aty_st_le32 (DP_MIX , mix, par);aty_st_le32 (DP_SRC , src, par); -aty_st_le32 (HOST_CNTL , host_cntl, par); +aty_st_le32 (HOST_CNTL ,HOST_BYTE_ALIGN , par);aty_st_le32 (DST_CNTL ,DST_Y_TOP_TO_BOTTOM |DST_X_LEFT_TO_RIGHT | rotation, par);draw_rect (dx, dy, width, image->height, par);
@@ -424,8 +424,4 @@ void atyfb_imageblit(struct fb_info *infaty_st_le32 (HOST_DATA0 ,get_unaligned_le32 (pbitmap), par); } } - -/* restore pix_width */ -wait_for_fifo (1 , par); -aty_st_le32 (DP_PIX_WIDTH , pix_width_save, par); }
Greg Kroah-Hartman
maintainerPATCH 90/205 acpi/nfit, x86/mce: Handle only uncorrectable machine checks
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Verma <[email protected]>
commit 5d96c9342c23ee1d084802dcf064caa67ecaa45b upstream.
The MCE handler for nfit devices is called for memory errors on a Non-Volatile DIMM and adds the error location to a 'badblocks' list. This list is used by the various NVDIMM drivers to avoid consuming known poison locations during IO.
The MCE handler gets called for both corrected and uncorrectable errors. Until now, both kinds of errors have been added to the badblocks list. However, corrected memory errors indicate that the problem has already been fixed by hardware, and the resulting interrupt is merely a notification to Linux.
As far as future accesses to that location are concerned, it is perfectly fine to use, and thus doesn't need to be included in the above badblocks list.
Add a check in the nfit MCE handler to filter out corrected mce events, and only process uncorrectable errors.
--- arch/x86/include/asm/mce.h | 1 + arch/x86/kernel/cpu/mcheck/mce.c | 3 ++- drivers/acpi/nfit/mce.c | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-)
arch/x86/include/asm/mce.h +1 -0
@@ -216,6 +216,7 @@ static inline int umc_normaddr_to_sysaddint mce_available (struct cpuinfo_x86 *c);bool mce_is_memory_error (struct mce *m); +bool mce_is_correctable (struct mce *m);DECLARE_PER_CPU (unsigned, mce_exception_count);DECLARE_PER_CPU (unsigned, mce_poll_count);
arch/x86/kernel/cpu/mcheck/mce.c +2 -1
@@ -534,7 +534,7 @@ bool mce_is_memory_error(struct mce *m) }EXPORT_SYMBOL_GPL (mce_is_memory_error); -static bool mce_is_correctable (struct mce *m) +bool mce_is_correctable (struct mce *m) {if (m->cpuvendor ==X86_VENDOR_AMD && m->status &MCI_STATUS_DEFERRED )return false;
@@ -544,6 +544,7 @@ static bool mce_is_correctable(struct mcreturn true; } +EXPORT_SYMBOL_GPL (mce_is_correctable);static bool cec_add_mce (struct mce *m) {
drivers/acpi/nfit/mce.c +2 -2
@@ -25,8 +25,8 @@ static int nfit_handle_mce(struct notifistruct acpi_nfit_desc *acpi_desc;struct nfit_spa *nfit_spa; -/* We only care about memory errors */ -if (!mce_is_memory_error (mce)) +/* We only care about uncorrectable memory errors */ +if (!mce_is_memory_error (mce) ||mce_is_correctable (mce))return NOTIFY_DONE ;/*
Greg Kroah-Hartman
maintainerPATCH 91/205 acpi/nfit, x86/mce: Validate a MCEs address before using it
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Verma <[email protected]>
commit e8a308e5f47e545e0d41d0686c00f5f5217c5f61 upstream.
The NFIT machine check handler uses the physical address from the mce structure, and compares it against information in the ACPI NFIT table to determine whether that location lies on an NVDIMM. The mce->addr field however may not always be valid, and this is indicated by the MCI_STATUS_ADDRV bit in the status field.
Export mce_usable_address() which already performs validation for the address, and use it in the NFIT handler.
--- arch/x86/include/asm/mce.h | 1 + arch/x86/kernel/cpu/mcheck/mce.c | 3 ++- drivers/acpi/nfit/mce.c | 4 ++++ 3 files changed, 7 insertions(+), 1 deletion(-)
arch/x86/include/asm/mce.h +1 -0
@@ -217,6 +217,7 @@ static inline int umc_normaddr_to_sysaddint mce_available (struct cpuinfo_x86 *c);bool mce_is_memory_error (struct mce *m);bool mce_is_correctable (struct mce *m); +int mce_usable_address (struct mce *m);DECLARE_PER_CPU (unsigned, mce_exception_count);DECLARE_PER_CPU (unsigned, mce_poll_count);
arch/x86/kernel/cpu/mcheck/mce.c +2 -1
@@ -485,7 +485,7 @@ static void mce_report_event(struct pt_r* be somewhat complicated (e.g. segment offset would require an instruction * parser). So only support physical addresses up to page granuality for now. */ -static int mce_usable_address (struct mce *m) +int mce_usable_address (struct mce *m) {if (!(m->status &MCI_STATUS_ADDRV ))return 0 ;
@@ -505,6 +505,7 @@ static int mce_usable_address(struct mcereturn 1 ; } +EXPORT_SYMBOL_GPL (mce_usable_address);bool mce_is_memory_error (struct mce *m) {
drivers/acpi/nfit/mce.c +4 -0
@@ -29,6 +29,10 @@ static int nfit_handle_mce(struct notifiif (!mce_is_memory_error (mce) ||mce_is_correctable (mce))return NOTIFY_DONE ; +/* Verify the address reported in the MCE is valid. */ +if (!mce_usable_address (mce)) +return NOTIFY_DONE ; +/* * mce->addr contains the physical addr accessed that caused the * machine check. We need to walk through the list of NFITs, and see
Greg Kroah-Hartman
maintainerPATCH 92/205 acpi, nfit: Fix ARS overflow continuation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 3fa58dcab50a0aa16817f16a8d38aee869eb3fb9 upstream.
When the platform BIOS is unable to report all the media error records it requires the OS to restart the scrub at a prescribed location. The driver detects the overflow condition, but then fails to report it to the ARS state machine after reaping the records. Propagate -ENOSPC correctly to continue the ARS operation.
--- drivers/acpi/nfit/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/acpi/nfit/core.c +2 -2
@@ -2845,9 +2845,9 @@ static int acpi_nfit_query_poison(structreturn rc;if (ars_status_process_records (acpi_desc)) -return -ENOMEM ; +dev_err (acpi_desc->dev,"Failed to process ARS records\n" ); -return 0 ; +return rc; } static int ars_register(struct acpi_nfit_desc *acpi_desc,
Greg Kroah-Hartman
maintainerPATCH 93/205 reset: hisilicon: fix potential NULL pointer dereference
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit e9a2310fb689151166df7fd9971093362d34bd79 upstream.
There is a potential execution path in which function platform_get_resource() returns NULL. If this happens, we will end up having a NULL pointer dereference.
Fix this by replacing devm_ioremap with devm_ioremap_resource, which has the NULL check and the memory region request.
This code was detected with the help of Coccinelle.
--- drivers/clk/hisilicon/reset.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/clk/hisilicon/reset.c +2 -3
@@ -109,9 +109,8 @@ struct hisi_reset_controller *hisi_resetreturn NULL ; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - rstc->membase =devm_ioremap (&pdev->dev, - res->start,resource_size (res)); -if (!rstc->membase) + rstc->membase =devm_ioremap_resource (&pdev->dev, res); +if (IS_ERR (rstc->membase))return NULL ;spin_lock_init (&rstc->lock);
Greg Kroah-Hartman
maintainerPATCH 94/205 crypto: hisilicon - Fix NULL dereference for same dst and src
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
commit 68a031d22c57b94870ba13513c9d93b8a8119ab2 upstream.
When the source and destination addresses for the cipher are the same, we will get a NULL dereference from accessing the split destination scatterlist memories, as shown:
[ 56.565719] tcrypt: [ 56.565719] testing speed of async ecb(aes) (hisi_sec_aes_ecb) encryption [ 56.574683] tcrypt: test 0 (128 bit key, 16 byte blocks): [ 56.587585] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 56.596361] Mem abort info: [ 56.599151] ESR = 0x96000006 [ 56.602196] Exception class = DABT (current EL), IL = 32 bits [ 56.608105] SET = 0, FnV = 0 [ 56.611149] EA = 0, S1PTW = 0 [ 56.614280] Data abort info: [ 56.617151] ISV = 0, ISS = 0x00000006 [ 56.620976] CM = 0, WnR = 0 [ 56.623930] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____) [ 56.630533] [0000000000000000] pgd=0000041fc7e4d003, pud=0000041fcd9bf003, pmd=0000000000000000 [ 56.639224] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 56.644782] Modules linked in: tcrypt(+) [ 56.648695] CPU: 21 PID: 2326 Comm: insmod Tainted: G W 4.19.0-rc6-00001-g3fabfb8-dirty #716 [ 56.658420] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT17 Nemo 2.0 RC0 10/05/2018 [ 56.667537] pstate: 20000005 (nzCv daif -PAN -UAO) [ 56.672322] pc : sec_alg_skcipher_crypto+0x318/0x748 [ 56.677274] lr : sec_alg_skcipher_crypto+0x178/0x748 [ 56.682224] sp : ffff0000118e3840 [ 56.685525] x29: ffff0000118e3840 x28: ffff841fbb3f8118 [ 56.690825] x27: 0000000000000000 x26: 0000000000000000 [ 56.696125] x25: ffff841fbb3f8080 x24: ffff841fbadc0018 [ 56.701425] x23: ffff000009119000 x22: ffff841fbb24e280 [ 56.706724] x21: ffff841ff212e780 x20: ffff841ff212e700 [ 56.712023] x19: 0000000000000001 x18: ffffffffffffffff [ 56.717322] x17: 0000000000000000 x16: 0000000000000000 [ 56.722621] x15: ffff0000091196c8 x14: 72635f7265687069 [ 56.727920] x13: 636b735f676c615f x12: ffff000009119940 [ 56.733219] x11: 0000000000000000 x10: 00000000006080c0 [ 56.738519] x9 : 0000000000000000 x8 : ffff841fbb24e480 [ 56.743818] x7 : ffff841fbb24e500 x6 : ffff841ff00cdcc0 [ 56.749117] x5 : 0000000000000010 x4 : 0000000000000000 [ 56.754416] x3 : ffff841fbb24e380 x2 : ffff841fbb24e480 [ 56.759715] x1 : 0000000000000000 x0 : ffff000008f682c8 [ 56.765016] Process insmod (pid: 2326, stack limit = 0x(____ptrval____)) [ 56.771702] Call trace: [ 56.774136] sec_alg_skcipher_crypto+0x318/0x748 [ 56.778740] sec_alg_skcipher_encrypt+0x10/0x18 [ 56.783259] test_skcipher_speed+0x2a0/0x700 [tcrypt] [ 56.788298] do_test+0x18f8/0x48c8 [tcrypt] [ 56.792469] tcrypt_mod_init+0x60/0x1000 [tcrypt] [ 56.797161] do_one_initcall+0x5c/0x178 [ 56.800985] do_init_module+0x58/0x1b4 [ 56.804721] load_module+0x1da4/0x2150 [ 56.808456] __se_sys_init_module+0x14c/0x1e8 [ 56.812799] __arm64_sys_init_module+0x18/0x20 [ 56.817231] el0_svc_common+0x60/0xe8 [ 56.820880] el0_svc_handler+0x2c/0x80 [ 56.824615] el0_svc+0x8/0xc [ 56.827483] Code: a94c87a3 910b2000 f87b7842 f9004ba2 (b87b7821) [ 56.833564] ---[ end trace 0f63290590e93d94 ]---
Segmentation fault
Fix this by only accessing these memories when we have different src and dst.
--- drivers/crypto/hisilicon/sec/sec_algs.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/crypto/hisilicon/sec/sec_algs.c +6 -4
@@ -732,6 +732,7 @@ static int sec_alg_skcipher_crypto(strucint *splits_in_nents;int *splits_out_nents =NULL ;struct sec_request_el *el, *temp; +bool split = skreq->src != skreq->dst;mutex_init (&sec_req->lock); sec_req->req_base = &skreq->base;
@@ -750,7 +751,7 @@ static int sec_alg_skcipher_crypto(strucif (ret) goto err_free_split_sizes; -if (skreq->src != skreq->dst) { +if (split) { sec_req->len_out =sg_nents (skreq->dst); ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps, &splits_out, &splits_out_nents,
@@ -785,8 +786,9 @@ static int sec_alg_skcipher_crypto(struc split_sizes[i], skreq->src != skreq->dst, splits_in[i], splits_in_nents[i], - splits_out[i], - splits_out_nents[i], info); + split ? splits_out[i] :NULL , + split ? splits_out_nents[i] :0 , + info);if (IS_ERR (el)) { ret =PTR_ERR (el); goto err_free_elements;
@@ -854,7 +856,7 @@ err_free_elements:crypto_skcipher_ivsize (atfm), DMA_BIDIRECTIONAL); err_unmap_out_sg: -if (skreq->src != skreq->dst) +if (split)sec_unmap_sg_on_err (skreq->dst, steps, splits_out, splits_out_nents, sec_req->len_out, info->dev);
Greg Kroah-Hartman
maintainerPATCH 95/205 crypto: hisilicon - Fix reference after free of memories on error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
commit 0b0cf6af3f3151c26c27e8e51def5527091c3e69 upstream.
coccicheck currently warns of the following issues in the driver:
drivers/crypto/hisilicon/sec/sec_algs.c:864:51-66: ERROR: reference preceded by free on line 812 drivers/crypto/hisilicon/sec/sec_algs.c:864:40-49: ERROR: reference preceded by free on line 813 drivers/crypto/hisilicon/sec/sec_algs.c:861:8-24: ERROR: reference preceded by free on line 814 drivers/crypto/hisilicon/sec/sec_algs.c:860:41-51: ERROR: reference preceded by free on line 815 drivers/crypto/hisilicon/sec/sec_algs.c:867:7-18: ERROR: reference preceded by free on line 816
It would appear than on certain error paths that we may attempt reference- after-free some memories.
This patch fixes those issues. The solution doesn't look perfect, but having same memories free'd possibly from separate functions makes it tricky.
--- drivers/crypto/hisilicon/sec/sec_algs.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/crypto/hisilicon/sec/sec_algs.c +11 -10
@@ -808,13 +808,6 @@ static int sec_alg_skcipher_crypto(struc* more refined but this is unlikely to happen so no need. */ -/* Cleanup - all elements in pointer arrays have been coppied */ -kfree (splits_in_nents); -kfree (splits_in); -kfree (splits_out_nents); -kfree (splits_out); -kfree (split_sizes); -/* Grab a big lock for a long time to avoid concurrency issues */ mutex_lock (&queue->queuelock);
@@ -829,13 +822,13 @@ static int sec_alg_skcipher_crypto(struc (!queue->havesoftqueue || kfifo_avail(&queue->softqueue) > steps)) || !list_empty(&ctx->backlog)) { + ret = -EBUSY ;if ((skreq->base.flags &CRYPTO_TFM_REQ_MAY_BACKLOG )) {list_add_tail (&sec_req->backlog_head, &ctx->backlog);mutex_unlock (&queue->queuelock); -return -EBUSY ; + goto out; } - ret = -EBUSY ;mutex_unlock (&queue->queuelock); goto err_free_elements; }
@@ -844,7 +837,15 @@ static int sec_alg_skcipher_crypto(strucif (ret) goto err_free_elements; -return -EINPROGRESS ; + ret = -EINPROGRESS ; +out: +/* Cleanup - all elements in pointer arrays have been copied */ +kfree (splits_in_nents); +kfree (splits_in); +kfree (splits_out_nents); +kfree (splits_out); +kfree (split_sizes); +return ret; err_free_elements:list_for_each_entry_safe (el, temp, &sec_req->elements, head) {
Greg Kroah-Hartman
maintainerPATCH 96/205 vhost/scsi: truncate T10 PI iov_iter to prot_bytes
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Edwards <[email protected]>
commit 4542d623c7134bc1738f8a68ccb6dd546f1c264f upstream.
Commands with protection information included were not truncating the protection iov_iter to the number of protection bytes in the command. This resulted in vhost_scsi mis-calculating the size of the protection SGL in vhost_scsi_calc_sgls(), and including both the protection and data SG entries in the protection SGL.
--- drivers/vhost/scsi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/vhost/scsi.c +3 -1
@@ -964,7 +964,8 @@ vhost_scsi_handle_vq(struct vhost_scsi * prot_bytes =vhost32_to_cpu (vq, v_req_pi.pi_bytesin); }/* -* Set prot_iter to data_iter, and advance past any +* Set prot_iter to data_iter and truncate it to +* prot_bytes, and advance data_iter past any * preceeding prot_bytes that may be present. * * Also fix up the exp_data_len to reflect only the
@@ -973,6 +974,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *if (prot_bytes) { exp_data_len -= prot_bytes; prot_iter = data_iter; +iov_iter_truncate (&prot_iter, prot_bytes);iov_iter_advance (&data_iter, prot_bytes); } tag =vhost64_to_cpu (vq, v_req_pi.tag);
Greg Kroah-Hartman
maintainerPATCH 97/205 scsi: qla2xxx: Initialize port speed to avoid setting lower speed
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <[email protected]>
commit f635e48e866ee1a47d2d42ce012fdcc07bf55853 upstream.
This patch initializes port speed so that firmware does not set lower operating speed. Setting lower speed in firmware impacts WRITE perfomance.
--- drivers/scsi/qla2xxx/qla_init.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/qla2xxx/qla_init.c +1 -0
@@ -4714,6 +4714,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vh fcport->loop_id =FC_NO_LOOP_ID ;qla2x00_set_fcport_state (fcport,FCS_UNCONFIGURED ); fcport->supported_classes =FC_COS_UNSPECIFIED ; + fcport->fp_speed =PORT_SPEED_UNKNOWN ; fcport->ct_desc.ct_sns = dma_alloc_coherent(&vha->hw->pdev->dev, sizeof(struct ct_sns_pkt), &fcport->ct_desc.ct_sns_dma,
Greg Kroah-Hartman
maintainerPATCH 98/205 SCSI: fix queue cleanup race before queue initialization is done
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit 8dc765d438f1e42b3e8227b3b09fad7d73f4ec9a upstream.
c2856ae2f315d ("blk-mq: quiesce queue before freeing queue") has already fixed this race, however the implied synchronize_rcu() in blk_mq_quiesce_queue() can slow down LUN probe a lot, so caused performance regression.
Then 1311326cf4755c7 ("blk-mq: avoid to synchronize rcu inside blk_cleanup_queue()") tried to quiesce queue for avoiding unnecessary synchronize_rcu()
only when queue initialization is done, because it is usual to see lots of inexistent LUNs which need to be probed.
However, turns out it isn't safe to quiesce queue only when queue initialization is done. Because when one SCSI command is completed, the user of sending command can be waken up immediately, then the scsi device may be removed, meantime the run queue in scsi_end_request() is still in-progress, so kernel panic can be caused.
In Red Hat QE lab, there are several reports about this kind of kernel panic triggered during kernel booting.
This patch tries to address the issue by grabing one queue usage counter during freeing one request and the following run queue.
--- block/blk-core.c | 5 ++--- drivers/scsi/scsi_lib.c | 8 ++++++++ 2 files changed, 10 insertions(+), 3 deletions(-)
block/blk-core.c +2 -3
@@ -793,9 +793,8 @@ void blk_cleanup_queue(struct request_qu* dispatch may still be in-progress since we dispatch requests * from more than one contexts. * -* No need to quiesce queue if it isn't initialized yet since -* blk_freeze_queue() should be enough for cases of passthrough -* request. +* We rely on driver to deal with the race in case that queue +* initialization isn't done. */ if (q->mq_ops &&blk_queue_init_done (q))blk_mq_quiesce_queue (q);
drivers/scsi/scsi_lib.c +8 -0
@@ -697,6 +697,12 @@ static bool scsi_end_request(struct requ*/ scsi_mq_uninit_cmd (cmd); +/* +* queue is still alive, so grab the ref for preventing it +* from being cleaned up during running queue. +*/ +percpu_ref_get (&q->q_usage_counter); +__blk_mq_end_request (req, error); if (scsi_target(sdev)->single_lun ||
@@ -704,6 +710,8 @@ static bool scsi_end_request(struct requkblockd_schedule_work (&sdev->requeue_work); elseblk_mq_run_hw_queues (q ,true ); + +percpu_ref_put (&q->q_usage_counter); }else {unsigned long flags;
Greg Kroah-Hartman
maintainerPATCH 99/205 Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for CONFIG_SWAP"
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit cc4ebf5c0a3440ed0a32d25c55ebdb6ce5f3c0bc upstream.
This reverts commit 4f94b2c7462d9720b2afa7e8e8d4c19446bb31ce.
That commit was buggy, as it used rlwinm instead of rlwimi. Instead of fixing that bug, we revert the previous commit in order to reduce the dependency between L1 entries and L2 entries
--- arch/powerpc/include/asm/mmu-8xx.h | 34 ++++----------------------- arch/powerpc/kernel/head_8xx.S | 45 ++++++++++++++++++++++--------------- arch/powerpc/mm/8xx_mmu.c | 2 - 3 files changed, 34 insertions(+), 47 deletions(-)
arch/powerpc/include/asm/mmu-8xx.h +6 -28
@@ -34,20 +34,12 @@* respectively NA for All or X for Supervisor and no access for User. * Then we use the APG to say whether accesses are according to Page rules or * "all Supervisor" rules (Access to all) -* We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP: -* When that bit is not set access is done iaw "all user" -* which means no access iaw page rules. -* Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED -* 0x => No access => 11 (all accesses performed as user iaw page definition) -* 10 => No user => 01 (all accesses performed according to page definition) -* 11 => User => 00 (all accesses performed as supervisor iaw page definition) +* Therefore, we define 2 APG groups. lsb is _PMD_USER +* 0 => No user => 01 (all accesses performed according to page definition) +* 1 => User => 00 (all accesses performed as supervisor iaw page definition) * We define all 16 groups so that all other bits of APG can take any value */ -#ifdef CONFIG_SWAP -#define MI_APG_INIT 0xf4f4f4f4 -#else #define MI_APG_INIT 0x44444444 -#endif /* The effective page number register. When read, contains the information * about the last instruction TLB miss. When MI_RPN is written, bits in
@@ -115,20 +107,12 @@* Supervisor and no access for user and NA for ALL. * Then we use the APG to say whether accesses are according to Page rules or * "all Supervisor" rules (Access to all) -* We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP: -* When that bit is not set access is done iaw "all user" -* which means no access iaw page rules. -* Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED -* 0x => No access => 11 (all accesses performed as user iaw page definition) -* 10 => No user => 01 (all accesses performed according to page definition) -* 11 => User => 00 (all accesses performed as supervisor iaw page definition) +* Therefore, we define 2 APG groups. lsb is _PMD_USER +* 0 => No user => 01 (all accesses performed according to page definition) +* 1 => User => 00 (all accesses performed as supervisor iaw page definition) * We define all 16 groups so that all other bits of APG can take any value */ -#ifdef CONFIG_SWAP -#define MD_APG_INIT 0xf4f4f4f4 -#else #define MD_APG_INIT 0x44444444 -#endif /* The effective page number register. When read, contains the information * about the last instruction TLB miss. When MD_RPN is written, bits in
@@ -180,12 +164,6 @@*/ #define SPRN_M_TW 799 -/* APGs */ -#define M_APG0 0x00000000 -#define M_APG1 0x00000020 -#define M_APG2 0x00000040 -#define M_APG3 0x00000060 -#ifdef CONFIG_PPC_MM_SLICES #include <asm/nohash/32/slice.h> #define SLICE_ARRAY_SIZE (1 << (32 - SLICE_LOW_SHIFT - 1))
arch/powerpc/kernel/head_8xx.S +27 -18
92 lines not on this page · raw message
arch/powerpc/mm/8xx_mmu.c +1 -1
@@ -79,7 +79,7 @@ void __init MMU_init_hw(void)for (; i <32 && mem >=LARGE_PAGE_SIZE_8M ; i++) {mtspr (SPRN_MD_CTR , ctr | (i <<8 ));mtspr (SPRN_MD_EPN , (unsigned long )__va (addr) |MD_EVALID ); -mtspr (SPRN_MD_TWC ,MD_PS8MEG |MD_SVALID |M_APG2 ); +mtspr (SPRN_MD_TWC ,MD_PS8MEG |MD_SVALID );mtspr (SPRN_MD_RPN , addr | flags | _PAGE_PRESENT); addr +=LARGE_PAGE_SIZE_8M ; mem -=LARGE_PAGE_SIZE_8M ;
Greg Kroah-Hartman
maintainerPATCH 100/205 soc: ti: QMSS: Fix usage of irq_set_affinity_hint
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 832ad0e3da4510fd17f98804abe512ea9a747035 upstream.
The Keystone QMSS driver is pretty damaged, in the sense that it does things like this:
irq_set_affinity_hint(irq, to_cpumask(&cpu_map));
where cpu_map is a local variable. As we leave the function, this will point to nowhere-land, and things will end-up badly.
Instead, let's use a proper cpumask that gets allocated, giving the driver a chance to actually work with things like irqbalance as well as have a hypothetical 64bit future.
--- drivers/soc/ti/knav_qmss.h | 4 ++-- drivers/soc/ti/knav_qmss_acc.c | 10 +++++----- drivers/soc/ti/knav_qmss_queue.c | 22 +++++++++++++++------- 3 files changed, 22 insertions(+), 14 deletions(-)
drivers/soc/ti/knav_qmss.h +2 -2
@@ -329,8 +329,8 @@ struct knav_range_ops { };struct knav_irq_info { -int irq; -u32 cpu_map; +int irq; +struct cpumask *cpu_mask; };struct knav_range_info {
drivers/soc/ti/knav_qmss_acc.c +5 -5
@@ -205,18 +205,18 @@ static int knav_range_setup_acc_irq(stru {struct knav_device *kdev = range->kdev;struct knav_acc_channel *acc; -unsigned long cpu_map; +struct cpumask *cpu_mask;int ret =0 , irq;u32 old, new;if (range->flags &RANGE_MULTI_QUEUE ) { acc = range->acc; irq = range->irqs[0 ].irq; - cpu_map = range->irqs[0 ].cpu_map; + cpu_mask = range->irqs[0 ].cpu_mask; }else { acc = range->acc + queue; irq = range->irqs[queue].irq; - cpu_map = range->irqs[queue].cpu_map; + cpu_mask = range->irqs[queue].cpu_mask; } old = acc->open_mask;
@@ -239,8 +239,8 @@ static int knav_range_setup_acc_irq(stru acc->name, acc->name); ret =request_irq (irq, knav_acc_int_handler,0 , acc->name, range); -if (!ret && cpu_map) { - ret =irq_set_affinity_hint (irq,to_cpumask (&cpu_map)); +if (!ret && cpu_mask) { + ret =irq_set_affinity_hint (irq, cpu_mask);if (ret) {dev_warn (range->kdev->dev,"Failed to set IRQ affinity\n" );
drivers/soc/ti/knav_qmss_queue.c +15 -7
@@ -118,19 +118,17 @@ static int knav_queue_setup_irq(struct k struct knav_queue_inst *inst) {unsigned queue = inst->id - range->queue_base; -unsigned long cpu_map;int ret =0 , irq;if (range->flags &RANGE_HAS_IRQ ) { irq = range->irqs[queue].irq; - cpu_map = range->irqs[queue].cpu_map; ret =request_irq (irq, knav_queue_int_handler,0 , inst->irq_name, inst);if (ret)return ret;disable_irq (irq); -if (cpu_map) { - ret =irq_set_affinity_hint (irq,to_cpumask (&cpu_map)); +if (range->irqs[queue].cpu_mask) { + ret =irq_set_affinity_hint (irq, range->irqs[queue].cpu_mask);if (ret) {dev_warn (range->kdev->dev,"Failed to set IRQ affinity\n" );
@@ -1262,9 +1260,19 @@ static int knav_setup_queue_range(struct range->num_irqs++; -if (IS_ENABLED (CONFIG_SMP ) && oirq.args_count ==3 ) - range->irqs[i].cpu_map = - (oirq.args[2 ] &0x0000ff00 ) >>8 ; +if (IS_ENABLED (CONFIG_SMP ) && oirq.args_count ==3 ) { +unsigned long mask; +int bit; + + range->irqs[i].cpu_mask =devm_kzalloc (dev, +cpumask_size (),GFP_KERNEL ); +if (!range->irqs[i].cpu_mask) +return -ENOMEM ; + + mask = (oirq.args[2 ] &0x0000ff00 ) >>8 ; +for_each_set_bit (bit, &mask,BITS_PER_LONG ) +cpumask_set_cpu (bit, range->irqs[i].cpu_mask); + } } range->num_irqs =min (range->num_irqs, range->num_queues);
Greg Kroah-Hartman
maintainerPATCH 101/205 ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Changwei Ge <[email protected]>
commit 29aa30167a0a2e6045a0d6d2e89d8168132333d5 upstream.
Somehow, file system metadata was corrupted, which causes ocfs2_check_dir_entry() to fail in function ocfs2_dir_foreach_blk_el().
According to the original design intention, if above happens we should skip the problematic block and continue to retrieve dir entry. But there is obviouse misuse of brelse around related code.
After failure of ocfs2_check_dir_entry(), current code just moves to next position and uses the problematic buffer head again and again during which the problematic buffer head is released for multiple times. I suppose, this a serious issue which is long-lived in ocfs2. This may cause other file systems which is also used in a the same host insane.
So we should also consider about bakcporting this patch into linux -stable.
--- fs/ocfs2/dir.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/ocfs2/dir.c +1 -2
@@ -1897,8 +1897,7 @@ static int ocfs2_dir_foreach_blk_el(stru/* On error, skip the f_pos to the next block. */ ctx->pos = (ctx->pos | (sb->s_blocksize -1 )) +1 ; -brelse (bh); -continue ; +break ; }if (le64_to_cpu (de->inode)) {unsigned char d_type =DT_UNKNOWN ;
Greg Kroah-Hartman
maintainerPATCH 102/205 ocfs2: free up write context when direct IO failed
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wengang Wang <[email protected]>
commit 5040f8df56fb90c7919f1c9b0b6e54c843437456 upstream.
The write context should also be freed even when direct IO failed. Otherwise a memory leak is introduced and entries remain in oi->ip_unwritten_list causing the following BUG later in unlink path:
ERROR: bug expression: !list_empty(&oi->ip_unwritten_list)
ERROR: Clear inode of 215043, inode has unwritten extents
...
Call Trace: ? __set_current_blocked+0x42/0x68 ocfs2_evict_inode+0x91/0x6a0 [ocfs2] ? bit_waitqueue+0x40/0x33 evict+0xdb/0x1af iput+0x1a2/0x1f7 do_unlinkat+0x194/0x28f SyS_unlinkat+0x1b/0x2f do_syscall_64+0x79/0x1ae entry_SYSCALL_64_after_hwframe+0x151/0x0
This patch also logs, with frequency limit, direct IO failures.
--- fs/ocfs2/aops.c | 12 ++++++++++-- fs/ocfs2/cluster/masklog.h | 9 +++++++++ 2 files changed, 19 insertions(+), 2 deletions(-)
fs/ocfs2/aops.c +10 -2
@@ -2412,8 +2412,16 @@ static int ocfs2_dio_end_io(struct kiocb/* this io's submitter should not have unlocked this before we could */ BUG_ON (!ocfs2_iocb_is_rw_locked (iocb)); -if (bytes >0 && private) - ret =ocfs2_dio_end_io_write (inode, private, offset, bytes); +if (bytes <=0 ) +mlog_ratelimited (ML_ERROR ,"Direct IO failed, bytes = %lld" , + (long long )bytes); +if (private) { +if (bytes >0 ) + ret =ocfs2_dio_end_io_write (inode, private, offset, + bytes); +else +ocfs2_dio_free_write_ctx (inode, private); + }ocfs2_iocb_clear_rw_locked (iocb);
fs/ocfs2/cluster/masklog.h +9 -0
@@ -178,6 +178,15 @@ do { \ ##__VA_ARGS__); \ } while (0) +#define mlog_ratelimited (mask, fmt, ...) \ +do { \ + static DEFINE_RATELIMIT_STATE(_rs, \ + DEFAULT_RATELIMIT_INTERVAL, \ + DEFAULT_RATELIMIT_BURST); \ + if (__ratelimit(&_rs)) \ + mlog(mask, fmt, ##__VA_ARGS__); \ +} while (0) +#define mlog_errno (st) ({ \ int _st = (st); \ if (_st != -ERESTARTSYS && _st != -EINTR && \
Greg Kroah-Hartman
maintainerPATCH 103/205 mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Arcangeli <[email protected]>
commit ac5b2c18911ffe95c08d69273917f90212cf5659 upstream.
THP allocation might be really disruptive when allocated on NUMA system with the local node full or hard to reclaim. Stefan has posted an allocation stall report on 4.12 based SLES kernel which suggests the same issue:
kvm: page allocation stalls for 194572ms, order:9, mode:0x4740ca(__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_THISNODE|__GFP_MOVABLE|__GFP_DIRECT_RECLAIM), nodemask=(null) kvm cpuset=/ mems_allowed=0-1
CPU: 10 PID: 84752 Comm: kvm Tainted: G W 4.12.0+98-ph <a href="/view.php?id=1" title="[geschlossen] Integration Ramdisk" class="resolved">0000001</a> SLE15 (unreleased) Hardware name: Supermicro SYS-1029P-WTRT/X11DDW-NT, BIOS 2.0 12/05/2017 Call Trace: dump_stack+0x5c/0x84 warn_alloc+0xe0/0x180 __alloc_pages_slowpath+0x820/0xc90 __alloc_pages_nodemask+0x1cc/0x210 alloc_pages_vma+0x1e5/0x280 do_huge_pmd_wp_page+0x83f/0xf00 __handle_mm_fault+0x93d/0x1060 handle_mm_fault+0xc6/0x1b0 __do_page_fault+0x230/0x430 do_page_fault+0x2a/0x70 page_fault+0x7b/0x80 [...] Mem-Info: active_anon:126315487 inactive_anon:1612476 isolated_anon:5 active_file:60183 inactive_file:245285 isolated_file:0 unevictable:15657 dirty:286 writeback:1 unstable:0 slab_reclaimable:75543 slab_unreclaimable:2509111 mapped:81814 shmem:31764 pagetables:370616 bounce:0 free:32294031 free_pcp:6233 free_cma:0 Node 0 active_anon:254680388kB inactive_anon:1112760kB active_file:240648kB inactive_file:981168kB unevictable:13368kB isolated(anon):0kB isolated(file):0kB mapped:280240kB dirty:1144kB writeback:0kB shmem:95832kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 81225728kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 1 active_anon:250583072kB inactive_anon:5337144kB active_file:84kB inactive_file:0kB unevictable:49260kB isolated(anon):20kB isolated(file):0kB mapped:47016kB dirty:0kB writeback:4kB shmem:31224kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 31897600kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
The defrag mode is "madvise" and from the above report it is clear that the THP has been allocated for MADV_HUGEPAGA vma.
Andrea has identified that the main source of the problem is __GFP_THISNODE usage:
: The problem is that direct compaction combined with the NUMA : __GFP_THISNODE logic in mempolicy.c is telling reclaim to swap very : hard the local node, instead of failing the allocation if there's no : THP available in the local node.
:
: Such logic was ok until __GFP_THISNODE was added to the THP allocation : path even with MPOL_DEFAULT.
:
: The idea behind the __GFP_THISNODE addition, is that it is better to : provide local memory in PAGE_SIZE units than to use remote NUMA THP : backed memory. That largely depends on the remote latency though, on : threadrippers for example the overhead is relatively low in my : experience.
:
: The combination of __GFP_THISNODE and __GFP_DIRECT_RECLAIM results in : extremely slow qemu startup with vfio, if the VM is larger than the : size of one host NUMA node. This is because it will try very hard to : unsuccessfully swapout get_user_pages pinned pages as result of the : __GFP_THISNODE being set, instead of falling back to PAGE_SIZE : allocations and instead of trying to allocate THP on other nodes (it : would be even worse without vfio type1 GUP pins of course, except it'd : be swapping heavily instead).
Fix this by removing __GFP_THISNODE for THP requests which are requesting the direct reclaim. This effectivelly reverts 5265047ac301 on the grounds that the zone/node reclaim was known to be disruptive due to premature reclaim when there was memory free. While it made sense at the time for HPC workloads without NUMA awareness on rare machines, it was ultimately harmful in the majority of cases. The existing behaviour is similar, if not as widespare as it applies to a corner case but crucially, it cannot be tuned around like zone_reclaim_mode can. The default behaviour should always be to cause the least harm for the common case.
If there are specialised use cases out there that want zone_reclaim_mode in specific cases, then it can be built on top. Longterm we should consider a memory policy which allows for the node reclaim like behavior for the specific memory ranges which would allow a
[1] http://lkml.kernel.org/r/[email protected]
Mel said:
: Both patches look correct to me but I'm responding to this one because : it's the fix. The change makes sense and moves further away from the : severe stalling behaviour we used to see with both THP and zone reclaim : mode.
:
: I put together a basic experiment with usemem configured to reference a : buffer multiple times that is 80% the size of main memory on a 2-socket : box with symmetric node sizes and defrag set to "always". The defrag : setting is not the default but it would be functionally similar to : accessing a buffer with madvise(MADV_HUGEPAGE). Usemem is configured to : reference the buffer multiple times and while it's not an interesting : workload, it would be expected to complete reasonably quickly as it fits : within memory. The results were;
:
: usemem
: vanilla noreclaim-v1
: Amean Elapsd-1 42.78 ( 0.00%) 26.87 ( 37.18%) : Amean Elapsd-3 27.55 ( 0.00%) 7.44 ( 73.00%) : Amean Elapsd-4 5.72 ( 0.00%) 5.69 ( 0.45%)
:
: This shows the elapsed time in seconds for 1 thread, 3 threads and 4 : threads referencing buffers 80% the size of memory. With the patches : applied, it's 37.18% faster for the single thread and 73% faster with two : threads. Note that 4 threads showing little difference does not indicate : the problem is related to thread counts. It's simply the case that 4 : threads gets spread so their workload mostly fits in one node. :
: The overall view from /proc/vmstats is more startling
:
: 4.19.0-rc1 4.19.0-rc1
: vanillanoreclaim-v1r1
: Minor Faults 35593425 708164
: Major Faults 484088 36
: Swap Ins 3772837 0 : Swap Outs 3932295 0 : : Massive amounts of swap in/out without the patch : : Direct pages scanned 6013214 0 : Kswapd pages scanned 0 0 : Kswapd pages reclaimed 0 0 : Direct pages reclaimed 4033009 0
:
: Lots of reclaim activity without the patch
:
: Kswapd efficiency 100% 100%
: Kswapd velocity 0.000 0.000
: Direct efficiency 67% 100%
: Direct velocity 11191.956 0.000
:
: Mostly from direct reclaim context as you'd expect without the patch. :
: Page writes by reclaim 3932314.000 0.000
: Page writes file 19 0 : Page writes anon 3932295 0 : Page reclaim immediate 42336 0
:
: Writes from reclaim context is never good but the patch eliminates it. :
: We should never have default behaviour to thrash the system for such a : basic workload. If zone reclaim mode behaviour is ever desired but on a : single task instead of a global basis then the sensible option is to build : a mempolicy that enforces that behaviour.
This was a severe regression compared to previous kernels that made important workloads unusable and it starts when __GFP_THISNODE was added to THP allocations under MADV_HUGEPAGE. It is not a significant risk to go to the previous behavior before __GFP_THISNODE was added, it worked like that for years.
This was simply an optimization to some lucky workloads that can fit in a single node, but it ended up breaking the VM for others that can't possibly fit in a single node, so going back is safe.
--- mm/mempolicy.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
mm/mempolicy.c +30 -2
@@ -2046,8 +2046,36 @@ alloc_pages_vma(gfp_t gfp, int order, st nmask =policy_nodemask (gfp, pol);if (!nmask ||node_isset (hpage_node, *nmask)) {mpol_cond_put (pol); - page =__alloc_pages_node (hpage_node, - gfp | __GFP_THISNODE, order); +/* +* We cannot invoke reclaim if __GFP_THISNODE +* is set. Invoking reclaim with +* __GFP_THISNODE set, would cause THP +* allocations to trigger heavy swapping +* despite there may be tons of free memory +* (including potentially plenty of THP +* already available in the buddy) on all the +* other NUMA nodes. +* +* At most we could invoke compaction when +* __GFP_THISNODE is set (but we would need to +* refrain from invoking reclaim even if +* compaction returned COMPACT_SKIPPED because +* there wasn't not enough memory to succeed +* compaction). For now just avoid +* __GFP_THISNODE instead of limiting the +* allocation path to a strict and single +* compaction invocation. +* +* Supposedly if direct reclaim was enabled by +* the caller, the app prefers THP regardless +* of the node it comes from so this would be +* more desiderable behavior than only +* providing THP originated from the local +* node in such case. +*/ +if (!(gfp & __GFP_DIRECT_RECLAIM)) + gfp |= __GFP_THISNODE; + page =__alloc_pages_node (hpage_node, gfp, order); goto out; } }
Greg Kroah-Hartman
maintainerPATCH 104/205 memory_hotplug: cond_resched in __remove_pages
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit dd33ad7b251f900481701b2a82d25de583867708 upstream.
We have received a bug report that unbinding a large pmem (>1TB) can result in a soft lockup:
NMI watchdog: BUG: soft lockup - CPU#9 stuck for 23s! [ndctl:4365] [...]
Supported: Yes
CPU: 9 PID: 4365 Comm: ndctl Not tainted 4.12.14-94.40-default #1 SLE12-SP4 Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5C620.86B.01.00.0833.051120182255 05/11/2018 task: ffff9cce7d4410c0 task.stack: ffffbe9eb1bc4000 RIP: 0010:__put_page+0x62/0x80 Call Trace: devm_memremap_pages_release+0x152/0x260 release_nodes+0x18d/0x1d0 device_release_driver_internal+0x160/0x210 unbind_store+0xb3/0xe0 kernfs_fop_write+0x102/0x180 __vfs_write+0x26/0x150 vfs_write+0xad/0x1a0 SyS_write+0x42/0x90 do_syscall_64+0x74/0x150 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x7fd13166b3d0
It has been reported on an older (4.12) kernel but the current upstream code doesn't cond_resched in the hot remove code at all and the given range to remove might be really large. Fix the issue by calling cond_resched once per memory section.
--- mm/memory_hotplug.c | 1 + 1 file changed, 1 insertion(+)
mm/memory_hotplug.c +1 -0
@@ -587,6 +587,7 @@ int __remove_pages(struct zone *zone, unfor (i =0 ; i < sections_to_remove; i++) {unsigned long pfn = phys_start_pfn + i*PAGES_PER_SECTION ; +cond_resched (); ret =__remove_section (zone,__pfn_to_section (pfn), map_offset, altmap); map_offset =0 ;
Greg Kroah-Hartman
maintainerPATCH 105/205 netfilter: conntrack: fix calculation of next bucket number in early_drop
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Khoruzhick <[email protected]>
commit f393808dc64149ccd0e5a8427505ba2974a59854 upstream.
If there's no entry to drop in bucket that corresponds to the hash, early_drop() should look for it in other buckets. But since it increments hash instead of bucket number, it actually looks in the same bucket 8
times: hsize is 16k by default (14 bits) and hash is 32-bit value, so reciprocal_scale(hash, hsize) returns the same value for hash..hash+7 in most cases.
Fix it by increasing bucket number instead of hash and rename _hash to bucket to avoid future confusion.
--- net/netfilter/nf_conntrack_core.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/netfilter/nf_conntrack_core.c +8 -5
@@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(strureturn drops; } -static noinline int early_drop(struct net *net, unsigned int _hash) +static noinline int early_drop(struct net *net, unsigned int hash) { -unsigned int i; +unsigned int i, bucket;for (i =0 ; i <NF_CT_EVICTION_RANGE ; i++) {struct hlist_nulls_head *ct_hash; -unsigned int hash, hsize, drops; +unsigned int hsize, drops;rcu_read_lock ();nf_conntrack_get_ht (&ct_hash, &hsize); - hash =reciprocal_scale (_hash++, hsize); +if (!i) + bucket =reciprocal_scale (hash, hsize); +else + bucket = (bucket +1 ) % hsize; - drops =early_drop_list (net, &ct_hash[hash]); + drops =early_drop_list (net, &ct_hash[bucket]);rcu_read_unlock ();if (drops) {
Greg Kroah-Hartman
maintainerPATCH 106/205 ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 6282e916f774e37845c65d1eae9f8c649004f033 upstream.
Due to what appears to be a copy/paste error, the opening ENTRY() of cpu_v7_hvc_switch_mm() lacks a matching ENDPROC(), and instead, the one for cpu_v7_smc_switch_mm() is duplicated.
Given that it is ENDPROC() that emits the Thumb annotation, the cpu_v7_hvc_switch_mm() routine will be called in ARM mode on a Thumb2 kernel, resulting in the following splat:
Internal error: Oops - undefined instruction: 0 [#1] SMP THUMB2 Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.18.0-rc1-00030-g4d28ad89189d-dirty #488 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 PC is at cpu_v7_hvc_switch_mm+0x12/0x18 LR is at flush_old_exec+0x31b/0x570 pc : [<c0316efe>] lr : [<c04117c7>] psr: 00000013 sp : ee899e50 ip : 00000000 fp : 00000001 r10: eda28f34 r9 : eda31800 r8 : c12470e0 r7 : eda1fc00 r6 : eda53000 r5 : 00000000 r4 : ee88c000 r3 : c0316eec r2 : 00000001 r1 : eda53000 r0 : 6da6c000 Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Note the 'ISA ARM' in the last line.
Fix this by using the correct name in ENDPROC().
--- arch/arm/mm/proc-v7.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mm/proc-v7.S +1 -1
@@ -112,7 +112,7 @@ ENTRY(cpu_v7_hvc_switch_mm) hvc #0 ldmfd sp!, {r0 - r3} b cpu_v7_switch_mm -ENDPROC(cpu_v7_smc_switch_mm) +ENDPROC(cpu_v7_hvc_switch_mm) #endif ENTRY(cpu_v7_iciallu_switch_mm) mov r3, #0
Greg Kroah-Hartman
maintainerPATCH 107/205 bonding/802.3ad: fix link_failure_count tracking
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarod Wilson <[email protected]>
commit ea53abfab960909d622ca37bcfb8e1c5378d21cc upstream.
Commit 4d2c0cda07448ea6980f00102dc3964eb25e241c set slave->link to BOND_LINK_DOWN for 802.3ad bonds whenever invalid speed/duplex values were read, to fix a problem with slaves getting into weird states, but in the process, broke tracking of link failures, as going straight to BOND_LINK_DOWN when a link is indeed down (cable pulled, switch rebooted) means we broke out of bond_miimon_inspect()'s BOND_LINK_DOWN case because !link_state was already true, we never incremented commit, and never got a chance to call bond_miimon_commit(), where slave->link_failure_count would be incremented. I believe the simple fix here is to mark the slave as BOND_LINK_FAIL, and let bond_miimon_inspect() transition the link from _FAIL to either _UP or _DOWN, and in the latter case, we now get proper incrementing of link_failure_count again.
--- drivers/net/bonding/bond_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/bonding/bond_main.c +2 -2
@@ -3111,13 +3111,13 @@ static int bond_slave_netdev_event(unsigcase NETDEV_CHANGE :/* For 802.3ad mode only: * Getting invalid Speed/Duplex values here will put slave -* in weird state. So mark it as link-down for the time +* in weird state. So mark it as link-fail for the time * being and let link-monitoring (miimon) set it right when * correct speeds/duplex are available. */ if (bond_update_speed_duplex (slave) &&BOND_MODE (bond) ==BOND_MODE_8023AD ) - slave->link =BOND_LINK_DOWN ; + slave->link =BOND_LINK_FAIL ;if (BOND_MODE (bond) ==BOND_MODE_8023AD )bond_3ad_adapter_speed_duplex_changed (slave);
Greg Kroah-Hartman
maintainerPATCH 108/205 mtd: spi-nor: cadence-quadspi: Return error code in cqspi_direct_read_execute()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit 91d7b67000c6e9bd605624079fee5a084238ad92 upstream.
We return 0 unconditionally in 'cqspi_direct_read_execute()'. However, 'ret' is set to some error codes in several error handling paths.
Return 'ret' instead to propagate the error code.
--- drivers/mtd/spi-nor/cadence-quadspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/spi-nor/cadence-quadspi.c +1 -1
@@ -996,7 +996,7 @@ static int cqspi_direct_read_execute(str err_unmap:dma_unmap_single (nor->dev, dma_dst, len,DMA_DEV_TO_MEM ); -return 0 ; +return ret; } static ssize_t cqspi_read(struct spi_nor *nor, loff_t from,
Greg Kroah-Hartman
maintainerPATCH 109/205 mtd: nand: Fix nanddev_neraseblocks()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
commit d098093ba06eb032057d1aca1c2e45889e099d00 upstream.
nanddev_neraseblocks() currently returns the number pages per LUN instead of the total number of eraseblocks.
--- include/linux/mtd/nand.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/linux/mtd/nand.h +2 -3
@@ -324,9 +324,8 @@ static inline unsigned int nanddev_ntarg*/ static inline unsigned int nanddev_neraseblocks (const struct nand_device *nand) { -return (u64 )nand->memorg.luns_per_target * - nand->memorg.eraseblocks_per_lun * - nand->memorg.pages_per_eraseblock; +return nand->memorg.ntargets * nand->memorg.luns_per_target * + nand->memorg.eraseblocks_per_lun; }/**
Greg Kroah-Hartman
maintainerPATCH 110/205 mtd: docg3: dont set conflicting BCH_CONST_PARAMS option
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit be2e1c9dcf76886a83fb1c433a316e26d4ca2550 upstream.
I noticed during the creation of another bugfix that the BCH_CONST_PARAMS option that is set by DOCG3 breaks setting variable parameters for any other users of the BCH library code.
The only other user we have today is the MTD_NAND software BCH implementation (most flash controllers use hardware BCH these days and are not affected). I considered removing BCH_CONST_PARAMS entirely because of the inherent conflict, but according to the description in lib/bch.c there is a significant performance benefit in keeping it.
To avoid the immediate problem of the conflict between MTD_NAND_BCH and DOCG3, this only sets the constant parameters if MTD_NAND_BCH is disabled, which should fix the problem for all cases that are affected. This should also work for all stable kernels.
Note that there is only one machine that actually seems to use the DOCG3 driver (arch/arm/mach-pxa/mioa701.c), so most users should have the driver disabled, but it almost certainly shows up if we wanted to test random kernels on machines that use software BCH in MTD.
--- drivers/mtd/devices/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/devices/Kconfig +1 -1
@@ -207,7 +207,7 @@ comment "Disk-On-Chip Device Drivers" config MTD_DOCG3 tristate "M-Systems Disk-On-Chip G3" select BCH - select BCH_CONST_PARAMS + select BCH_CONST_PARAMS if !MTD_NAND_BCH select BITREVERSE help This provides an MTD device driver for the M-Systems DiskOnChip
Greg Kroah-Hartman
maintainerPATCH 111/205 hwmon: (core) Fix double-free in __hwmon_device_register()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Osipenko <[email protected]>
commit 74e3512731bd5c9673176425a76a7cc5efa8ddb6 upstream.
Fix double-free that happens when thermal zone setup fails, see KASAN log below.
==================================================================
BUG: KASAN: double-free or invalid-free in __hwmon_device_register+0x5dc/0xa7c CPU: 0 PID: 132 Comm: kworker/0:2 Tainted: G B 4.19.0-rc8-next-20181016-00042-gb52cd80401e9-dirty #41 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) Workqueue: events deferred_probe_work_func Backtrace: [<c0110540>] (dump_backtrace) from [<c0110944>] (show_stack+0x20/0x24) [<c0110924>] (show_stack) from [<c105cb08>] (dump_stack+0x9c/0xb0) [<c105ca6c>] (dump_stack) from [<c02fdaec>] (print_address_description+0x68/0x250) [<c02fda84>] (print_address_description) from [<c02fd4ac>] (kasan_report_invalid_free+0x68/0x88) [<c02fd444>] (kasan_report_invalid_free) from [<c02fc85c>] (__kasan_slab_free+0x1f4/0x200) [<c02fc668>] (__kasan_slab_free) from [<c02fd0c0>] (kasan_slab_free+0x14/0x18) [<c02fd0ac>] (kasan_slab_free) from [<c02f9c6c>] (kfree+0x90/0x294) [<c02f9bdc>] (kfree) from [<c0b41bbc>] (__hwmon_device_register+0x5dc/0xa7c) [<c0b415e0>] (__hwmon_device_register) from [<c0b421e8>] (hwmon_device_register_with_info+0xa0/0xa8) [<c0b42148>] (hwmon_device_register_with_info) from [<c0b42324>] (devm_hwmon_device_register_with_info+0x74/0xb4) [<c0b422b0>] (devm_hwmon_device_register_with_info) from [<c0b4481c>] (lm90_probe+0x414/0x578) [<c0b44408>] (lm90_probe) from [<c0aeeff4>] (i2c_device_probe+0x35c/0x384) [<c0aeec98>] (i2c_device_probe) from [<c08776cc>] (really_probe+0x290/0x3e4) [<c087743c>] (really_probe) from [<c0877a2c>] (driver_probe_device+0x80/0x1c4) [<c08779ac>] (driver_probe_device) from [<c0877da8>] (__device_attach_driver+0x104/0x11c) [<c0877ca4>] (__device_attach_driver) from [<c0874dd8>] (bus_for_each_drv+0xa4/0xc8) [<c0874d34>] (bus_for_each_drv) from [<c08773b0>] (__device_attach+0xf0/0x15c) [<c08772c0>] (__device_attach) from [<c0877e24>] (device_initial_probe+0x1c/0x20) [<c0877e08>] (device_initial_probe) from [<c08762f4>] (bus_probe_device+0xdc/0xec) [<c0876218>] (bus_probe_device) from [<c0876a08>] (deferred_probe_work_func+0xa8/0xd4) [<c0876960>] (deferred_probe_work_func) from [<c01527c4>] (process_one_work+0x3dc/0x96c) [<c01523e8>] (process_one_work) from [<c01541e0>] (worker_thread+0x4ec/0x8bc) [<c0153cf4>] (worker_thread) from [<c015b238>] (kthread+0x230/0x240) [<c015b008>] (kthread) from [<c01010bc>] (ret_from_fork+0x14/0x38) Exception stack(0xcf743fb0 to 0xcf743ff8)
3fa0: 00000000 00000000 00000000 00000000
3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000
Allocated by task 132: kasan_kmalloc.part.1+0x58/0xf4 kasan_kmalloc+0x90/0xa4 kmem_cache_alloc_trace+0x90/0x2a0 __hwmon_device_register+0xbc/0xa7c hwmon_device_register_with_info+0xa0/0xa8 devm_hwmon_device_register_with_info+0x74/0xb4 lm90_probe+0x414/0x578 i2c_device_probe+0x35c/0x384 really_probe+0x290/0x3e4 driver_probe_device+0x80/0x1c4 __device_attach_driver+0x104/0x11c bus_for_each_drv+0xa4/0xc8 __device_attach+0xf0/0x15c device_initial_probe+0x1c/0x20 bus_probe_device+0xdc/0xec deferred_probe_work_func+0xa8/0xd4 process_one_work+0x3dc/0x96c worker_thread+0x4ec/0x8bc kthread+0x230/0x240 ret_from_fork+0x14/0x38 (null) Freed by task 132: __kasan_slab_free+0x12c/0x200 kasan_slab_free+0x14/0x18 kfree+0x90/0x294 hwmon_dev_release+0x1c/0x20 device_release+0x4c/0xe8 kobject_put+0xac/0x11c device_unregister+0x2c/0x30 __hwmon_device_register+0xa58/0xa7c hwmon_device_register_with_info+0xa0/0xa8 devm_hwmon_device_register_with_info+0x74/0xb4 lm90_probe+0x414/0x578 i2c_device_probe+0x35c/0x384 really_probe+0x290/0x3e4 driver_probe_device+0x80/0x1c4 __device_attach_driver+0x104/0x11c bus_for_each_drv+0xa4/0xc8 __device_attach+0xf0/0x15c device_initial_probe+0x1c/0x20 bus_probe_device+0xdc/0xec deferred_probe_work_func+0xa8/0xd4 process_one_work+0x3dc/0x96c worker_thread+0x4ec/0x8bc kthread+0x230/0x240 ret_from_fork+0x14/0x38 (null)
--- drivers/hwmon/hwmon.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/hwmon/hwmon.c +4 -4
@@ -635,8 +635,10 @@ __hwmon_device_register(struct device *dif (info[i]->config[j] &HWMON_T_INPUT ) { err =hwmon_thermal_add_sensor (dev, hwdev, j); -if (err) - goto free_device; +if (err) { +device_unregister (hdev); + goto ida_remove; + } } } }
@@ -644,8 +646,6 @@ __hwmon_device_register(struct device *dreturn hdev; -free_device: -device_unregister (hdev); free_hwmon:kfree (hwdev); ida_remove:
Greg Kroah-Hartman
maintainerPATCH 112/205 perf cs-etm: Correct CPU mode for samples
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
commit d6c9c05fe1eb4b213b183d8a1e79416256dc833a upstream.
Since commit edeb0c90df35 ("perf tools: Stop fallbacking to kallsyms for vdso symbols lookup"), the kernel address cannot be properly parsed to kernel symbol with command 'perf script -k vmlinux'. The reason is CoreSight samples is always to set CPU mode as PERF_RECORD_MISC_USER, thus it fails to find corresponding map/dso in below flows:
process_sample_event()
`-> machine__resolve() `-> thread__find_map(thread, sample->cpumode, sample->ip, al);
In this flow it needs to pass argument 'sample->cpumode' to tell what's the CPU mode, before it always passed PERF_RECORD_MISC_USER but without any failure until the commit edeb0c90df35 ("perf tools: Stop fallbacking to kallsyms for vdso symbols lookup") has been merged. The reason is even with the wrong CPU mode the function thread__find_map() firstly fails to find map but it will rollback to find kernel map for vdso symbols lookup. In the latest code it has removed the fallback code, thus if CPU mode is PERF_RECORD_MISC_USER then it cannot find map anymore with kernel address.
This patch is to correct samples CPU mode setting, it creates a new helper function cs_etm__cpu_mode() to tell what's the CPU mode based on the address with the info from machine structure; this patch has a bit extension to check not only kernel and user mode, but also check for host/guest and hypervisor mode. Finally this patch uses the function in instruction and branch samples and also apply in cs_etm__mem_access() for a minor polishing.
--- tools/perf/util/cs-etm.c | 39 ++++++++++++++++++++++++++++++--------- 1 file changed, 30 insertions(+), 9 deletions(-)
tools/perf/util/cs-etm.c +30 -9
@@ -244,6 +244,27 @@ static void cs_etm__free(struct perf_seszfree (&aux); } +static u8 cs_etm__cpu_mode (struct cs_etm_queue *etmq,u64 address) +{ +struct machine *machine; + + machine = etmq->etm->machine; + +if (address >= etmq->etm->kernel_start) { +if (machine__is_host (machine)) +return PERF_RECORD_MISC_KERNEL ; +else +return PERF_RECORD_MISC_GUEST_KERNEL ; + }else { +if (machine__is_host (machine)) +return PERF_RECORD_MISC_USER ; +else if (perf_guest) +return PERF_RECORD_MISC_GUEST_USER ; +else +return PERF_RECORD_MISC_HYPERVISOR ; + } +} +static u32 cs_etm__mem_access (struct cs_etm_queue *etmq,u64 address,size_t size,u8 *buffer) {
@@ -258,10 +279,7 @@ static u32 cs_etm__mem_access(struct cs_return -1 ; machine = etmq->etm->machine; -if (address >= etmq->etm->kernel_start) - cpumode =PERF_RECORD_MISC_KERNEL ; -else - cpumode =PERF_RECORD_MISC_USER ; + cpumode =cs_etm__cpu_mode (etmq, address); thread = etmq->thread;if (!thread) {
@@ -653,7 +671,7 @@ static int cs_etm__synth_instruction_samstruct perf_sample sample = {.ip =0 ,}; event->sample.header.type =PERF_RECORD_SAMPLE ; - event->sample.header.misc =PERF_RECORD_MISC_USER ; + event->sample.header.misc =cs_etm__cpu_mode (etmq, addr); event->sample.header.size =sizeof (struct perf_event_header ); sample.ip = addr;
@@ -665,7 +683,7 @@ static int cs_etm__synth_instruction_sam sample.cpu = etmq->packet->cpu; sample.flags =0 ; sample.insn_len =1 ; - sample.cpumode = event->header.misc; + sample.cpumode = event->sample.header.misc;if (etm->synth_opts.last_branch) {cs_etm__copy_last_branch_rb (etmq);
@@ -706,12 +724,15 @@ static int cs_etm__synth_branch_sample(su64 nr;struct branch_entry entries; } dummy_bs; +u64 ip; + + ip =cs_etm__last_executed_instr (etmq->prev_packet); event->sample.header.type =PERF_RECORD_SAMPLE ; - event->sample.header.misc =PERF_RECORD_MISC_USER ; + event->sample.header.misc =cs_etm__cpu_mode (etmq, ip); event->sample.header.size =sizeof (struct perf_event_header ); - sample.ip =cs_etm__last_executed_instr (etmq->prev_packet); + sample.ip = ip; sample.pid = etmq->pid; sample.tid = etmq->tid; sample.addr =cs_etm__first_executed_instr (etmq->packet);
@@ -720,7 +741,7 @@ static int cs_etm__synth_branch_sample(s sample.period =1 ; sample.cpu = etmq->packet->cpu; sample.flags =0 ; - sample.cpumode =PERF_RECORD_MISC_USER ; + sample.cpumode = event->sample.header.misc;/* * perf report cannot handle events without a branch stack
Greg Kroah-Hartman
maintainerPATCH 113/205 perf stat: Handle different PMU names with common prefix
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
commit ea1fa48c055f833eb25f0c33188feecb7002ada5 upstream.
On s390 the CPU Measurement Facility for counters now supports 2 PMUs named cpum_cf (CPU Measurement Facility for counters) and cpum_cf_diag (CPU Measurement Facility for diagnostic counters) for one and the same CPU.
Running command
[root@s35lp76 perf]# ./perf stat -e tx_c_tend \ -- ~/mytests/cf-tx-events 1
Measuring transactions
TX_C_TABORT_NO_SPECIAL: 0 expected:0
TX_C_TABORT_SPECIAL: 0 expected:0
TX_C_TEND: 1 expected:1
TX_NC_TABORT: 11 expected:11
TX_NC_TEND: 1 expected:1
Performance counter stats for '/root/mytests/cf-tx-events 1':
2 tx_c_tend
0.002120091 seconds time elapsed
0.000121000 seconds user
0.002127000 seconds sys[root@s35lp76 perf]#
displays output which is unexpected (and wrong):
2 tx_c_tend
The test program definitely triggers only one transaction, as shown in line 'TX_C_TEND: 1 expected:1'.
This is caused by the following call sequence:
pmu_lookup() scans and installs a PMU. +--> pmu_aliases() parses all aliases in directory
.../<pmu-name>/events/* which are file names.
+--> pmu_aliases_parse() Read each file in directory and create
an new alias entry. This is done with
+--> perf_pmu__new_alias() and
+--> __perf_pmu__new_alias() which also check for
identical alias names.After pmu_aliases() returns, a complete list of event names for this pmu has been created. Now function
pmu_add_cpu_aliases() is called to add the events listed in the json
| files to the alias list of the cpu.
+--> perf_pmu__find_map() Returns a pointer to the json events.
Now function pmu_add_cpu_aliases() scans through all events listed in the JSON files for this CPU.
Each json event pmu name is compared with the current PMU being built up and if they mismatch, the json event is added to the current PMUs alias list.
To avoid duplicate entries the following comparison is done:
if (!is_arm_pmu_core(name)) {
pname = pe->pmu ? pe->pmu : "cpu";
if (strncmp(pname, name, strlen(pname)))
continue;
}The culprit is the strncmp() function.
Using current s390 PMU naming, the first PMU is 'cpum_cf' and a long list of events is added, among them 'tx_c_tend'
When the second PMU named 'cpum_cf_diag' is added, only one event named 'CF_DIAG' is added by the pmu_aliases() function.
Now function pmu_add_cpu_aliases() is invoked for PMU 'cpum_cf_diag'. Since the CPUID string is the same for both PMUs, json file events for PMU named 'cpum_cf' are added to the PMU 'cpm_cf_diag'
This happens because the strncmp() actually compares:
strncmp("cpum_cf", "cpum_cf_diag", 6);The first parameter is the pmu name taken from the event in the json file. The second parameter is the pmu name of the PMU currently being built.
They are different, but the length of the compare only tests the common prefix and this returns 0(true) when it should return false.
Now all events for PMU cpum_cf are added to the alias list for pmu cpum_cf_diag.
Later on in function parse_events_add_pmu() the event 'tx_c_end' is searched in all available PMUs and found twice, adding it two times to the evsel_list global variable which is the root of all events. This results in a counter value of 2 instead of 1.
Output with this patch:
[root@s35lp76 perf]# ./perf stat -e tx_c_tend \ -- ~/mytests/cf-tx-events 1
Measuring transactions
TX_C_TABORT_NO_SPECIAL: 0 expected:0
TX_C_TABORT_SPECIAL: 0 expected:0
TX_C_TEND: 1 expected:1
TX_NC_TABORT: 11 expected:11
TX_NC_TEND: 1 expected:1
Performance counter stats for '/root/mytests/cf-tx-events 1':
1 tx_c_tend
0.001815365 seconds time elapsed
0.000123000 seconds user
0.001756000 seconds sys[root@s35lp76 perf]#
--- tools/perf/util/pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/pmu.c +1 -1
@@ -773,7 +773,7 @@ static void pmu_add_cpu_aliases(struct lif (!is_arm_pmu_core (name)) { pname = pe->pmu ? pe->pmu :"cpu" ; -if (strncmp (pname, name,strlen (pname))) +if (strcmp (pname, name))continue ; }
Greg Kroah-Hartman
maintainerPATCH 114/205 perf callchain: Honour the ordering of PERF_CONTEXT_{USER,KERNEL,etc}
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: David S. Miller <[email protected]>
commit e9024d519d892b38176cafd46f68a7cdddd77412 upstream.
When processing using 'perf report -g caller', which is the default, we ended up reverting the callchain entries received from the kernel, but simply reverting throws away the information that tells that from a point onwards the addresses are for userspace, kernel, guest kernel, guest user, hypervisor.
The idea is that if we are walking backwards, for each cluster of non-cpumode entries we have to first scan backwards for the next one and use that for the cluster.
This seems silly and more expensive than it needs to be but it is enough for a initial fix.
The code here is really complicated because it is intimately intertwined with the lbr and branch handling, as well as this callchain order, further fixes will be needed to properly take into account the cpumode in those cases.
Another problem with ORDER_CALLER is that the NULL "0" IP that is at the end of most callchains shows up at the top of the histogram because every callchain contains it and with ORDER_CALLER it is the first entry.
--- tools/perf/util/machine.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-)
tools/perf/util/machine.c +34 -1
@@ -2140,6 +2140,27 @@ static int resolve_lbr_callchain_sample(return 0 ; } +static int find_prev_cpumode (struct ip_callchain *chain,struct thread *thread, +struct callchain_cursor *cursor, +struct symbol **parent, +struct addr_location *root_al, +u8 *cpumode,int ent) +{ +int err =0 ; + +while (--ent >=0 ) { +u64 ip = chain->ips[ent]; + +if (ip >=PERF_CONTEXT_MAX ) { + err =add_callchain_ip (thread, cursor, parent, + root_al, cpumode, ip, + false,NULL ,NULL ,0 ); +break ; + } + } +return err; +} + static int thread__resolve_callchain_sample(struct thread *thread, struct callchain_cursor *cursor, struct perf_evsel *evsel,
@@ -2246,6 +2267,12 @@ static int thread__resolve_callchain_sam } check_calls: +if (callchain_param.order !=ORDER_CALLEE ) { + err =find_prev_cpumode (chain, thread, cursor, parent, root_al, + &cpumode, chain->nr - first_call); +if (err) +return (err <0 ) ? err :0 ; + }for (i = first_call, nr_entries =0 ; i < chain_nr && nr_entries < max_stack; i++) {u64 ip;
@@ -2260,9 +2287,15 @@ check_calls:continue ;#endif ip = chain->ips[j]; -if (ip <PERF_CONTEXT_MAX ) ++nr_entries; +else if (callchain_param.order !=ORDER_CALLEE ) { + err =find_prev_cpumode (chain, thread, cursor, parent, + root_al, &cpumode, j); +if (err) +return (err <0 ) ? err :0 ; +continue ; + } err = add_callchain_ip(thread, cursor, parent, root_al, &cpumode, ip,
Greg Kroah-Hartman
maintainerPATCH 115/205 perf intel-pt/bts: Calculate cpumode for synthesized samples
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 5d4f0edaa3ac4f1844ed7c64cd2bae6f1912bac5 upstream.
In the absence of a fallback, samples must provide a correct cpumode for the 'ip'. Do that now there is no fallback.
--- tools/perf/util/intel-bts.c | 17 ++++++++++++----- tools/perf/util/intel-pt.c | 22 +++++++++++++--------- 2 files changed, 25 insertions(+), 14 deletions(-)
tools/perf/util/intel-bts.c +12 -5
@@ -269,6 +269,13 @@ static int intel_bts_do_fix_overlap(strureturn 0 ; } +static inline u8 intel_bts_cpumode (struct intel_bts *bts,uint64_t ip) +{ +return machine__kernel_ip (bts->machine, ip) ? +PERF_RECORD_MISC_KERNEL : +PERF_RECORD_MISC_USER ; +} +static int intel_bts_synth_branch_sample (struct intel_bts_queue *btsq,struct branch *branch) {
@@ -281,12 +288,8 @@ static int intel_bts_synth_branch_sample bts->num_events++ <= bts->synth_opts.initial_skip)return 0 ; - event.sample.header.type =PERF_RECORD_SAMPLE ; - event.sample.header.misc =PERF_RECORD_MISC_USER ; - event.sample.header.size =sizeof (struct perf_event_header ); - - sample.cpumode =PERF_RECORD_MISC_USER ; sample.ip =le64_to_cpu (branch->from); + sample.cpumode =intel_bts_cpumode (bts, sample.ip); sample.pid = btsq->pid; sample.tid = btsq->tid; sample.addr =le64_to_cpu (branch->to);
@@ -298,6 +301,10 @@ static int intel_bts_synth_branch_sample sample.insn_len = btsq->intel_pt_insn.length;memcpy (sample.insn, btsq->intel_pt_insn.buf,INTEL_PT_INSN_BUF_SZ ); + event.sample.header.type =PERF_RECORD_SAMPLE ; + event.sample.header.misc = sample.cpumode; + event.sample.header.size =sizeof (struct perf_event_header ); +if (bts->synth_opts.inject) { event.sample.header.size = bts->branches_event_size; ret = perf_event__synthesize_sample(&event,
tools/perf/util/intel-pt.c +13 -9
@@ -407,6 +407,13 @@ intel_pt_cache_lookup(struct dso *dso, sreturn auxtrace_cache__lookup (dso->auxtrace_cache, offset); } +static inline u8 intel_pt_cpumode (struct intel_pt *pt,uint64_t ip) +{ +return ip >= pt->kernel_start ? +PERF_RECORD_MISC_KERNEL : +PERF_RECORD_MISC_USER ; +} + static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn, uint64_t *insn_cnt_ptr, uint64_t *ip, uint64_t to_ip, uint64_t max_insn_cnt,
@@ -429,10 +436,7 @@ static int intel_pt_walk_next_insn(strucif (to_ip && *ip == to_ip) goto out_no_cache; -if (*ip >= ptq->pt->kernel_start) - cpumode =PERF_RECORD_MISC_KERNEL ; -else - cpumode =PERF_RECORD_MISC_USER ; + cpumode =intel_pt_cpumode (ptq->pt, *ip); thread = ptq->thread;if (!thread) {
@@ -1053,15 +1057,11 @@ static void intel_pt_prep_b_sample(struc union perf_event *event, struct perf_sample *sample) { - event->sample.header.type = PERF_RECORD_SAMPLE; - event->sample.header.misc =PERF_RECORD_MISC_USER ; - event->sample.header.size =sizeof (struct perf_event_header ); -if (!pt->timeless_decoding) sample->time =tsc_to_perf_time (ptq->timestamp, &pt->tc); - sample->cpumode =PERF_RECORD_MISC_USER ; sample->ip = ptq->state->from_ip; + sample->cpumode =intel_pt_cpumode (pt, sample->ip); sample->pid = ptq->pid; sample->tid = ptq->tid; sample->addr = ptq->state->to_ip;
@@ -1070,6 +1070,10 @@ static void intel_pt_prep_b_sample(struc sample->flags = ptq->flags; sample->insn_len = ptq->insn_len;memcpy (sample->insn, ptq->insn,INTEL_PT_INSN_BUF_SZ ); + + event->sample.header.type =PERF_RECORD_SAMPLE ; + event->sample.header.misc = sample->cpumode; + event->sample.header.size =sizeof (struct perf_event_header ); } static int intel_pt_inject_event(union perf_event *event,
Greg Kroah-Hartman
maintainerPATCH 116/205 perf intel-pt: Insert callchain context into synthesized callchains
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 242483068b4b9ad02f1653819b6e683577681e0e upstream.
In the absence of a fallback, callchains must encode also the callchain context. Do that now there is no fallback.
--- tools/perf/util/intel-pt.c | 6 +++-- tools/perf/util/thread-stack.c | 44 ++++++++++++++++++++++++++++++++--------- tools/perf/util/thread-stack.h | 2 - 3 files changed, 40 insertions(+), 12 deletions(-)
tools/perf/util/intel-pt.c +4 -2
@@ -763,7 +763,8 @@ static struct intel_pt_queue *intel_pt_aif (pt->synth_opts.callchain) {size_t sz =sizeof (struct ip_callchain ); - sz += pt->synth_opts.callchain_sz *sizeof (u64); +/* Add 1 to callchain_sz for callchain context */ + sz += (pt->synth_opts.callchain_sz +1 ) *sizeof (u64); ptq->chain =zalloc (sz);if (!ptq->chain) goto out_free;
@@ -1159,7 +1160,8 @@ static void intel_pt_prep_sample(structif (pt->synth_opts.callchain) {thread_stack__sample (ptq->thread, ptq->chain, - pt->synth_opts.callchain_sz, sample->ip); + pt->synth_opts.callchain_sz +1 , + sample->ip, pt->kernel_start); sample->callchain = ptq->chain; }
tools/perf/util/thread-stack.c +35 -9
55 lines not on this page · raw message
tools/perf/util/thread-stack.h +1 -1
@@ -84,7 +84,7 @@ int thread_stack__event(struct thread *t u64 to_ip, u16 insn_len, u64 trace_nr);void thread_stack__set_trace_nr (struct thread *thread,u64 trace_nr);void thread_stack__sample (struct thread *thread,struct ip_callchain *chain, -size_t sz,u64 ip); +size_t sz,u64 ip,u64 kernel_start);int thread_stack__flush (struct thread *thread);void thread_stack__free (struct thread *thread);size_t thread_stack__depth (struct thread *thread);
Greg Kroah-Hartman
maintainerPATCH 117/205 of, numa: Validate some distance map rules
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
commit 89c38422e072bb453e3045b8f1b962a344c3edea upstream.
Currently the NUMA distance map parsing does not validate the distance table for the distance-matrix rules 1-2 in [1].
However the arch NUMA code may enforce some of these rules, but not all. Such is the case for the arm64 port, which does not enforce the rule that the distance between separates nodes cannot equal LOCAL_DISTANCE.
The patch adds the following rules validation:
- distance of node to self equals LOCAL_DISTANCE
- distance of separate nodes > LOCAL_DISTANCE
This change avoids a yet-unresolved crash reported in [2].
A note on dealing with symmetrical distances between nodes:
Validating symmetrical distances between nodes is difficult. If it were mandated in the bindings that every distance must be recorded in the table, then it would be easy. However, it isn't.
In addition to this, it is also possible to record [b, a] distance only (and not [a, b]). So, when processing the table for [b, a], we cannot assert that current distance of [a, b] != [b, a] as invalid, as [a, b] distance may not be present in the table and current distance would be default at REMOTE_DISTANCE.
As such, we maintain the policy that we overwrite distance [a, b] = [b, a] for b > a. This policy is different to kernel ACPI SLIT validation, which allows non-symmetrical distances (ACPI spec SLIT rules allow it). However, the distance debug message is dropped as it may be misleading (for a distance which is later overwritten).
Some final notes on semantics:
- It is implied that it is the responsibility of the arch NUMA code to reset the NUMA distance map for an error in distance map parsing.
- It is the responsibility of the FW NUMA topology parsing (whether OF or ACPI) to enforce NUMA distance rules, and not arch NUMA code.
[1] Documents/devicetree/bindings/numa.txt
[2] https://www.spinics.net/lists/arm-kernel/msg683304.html
--- drivers/of/of_numa.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/of/of_numa.c +7 -2
@@ -115,9 +115,14 @@ static int __init of_numa_parse_distance distance =of_read_number (matrix,1 ); matrix++; +if ((nodea == nodeb && distance !=LOCAL_DISTANCE ) || + (nodea != nodeb && distance <=LOCAL_DISTANCE )) { +pr_err ("Invalid distance[node%d -> node%d] = %d\n" , + nodea, nodeb, distance); +return -EINVAL ; + } +numa_set_distance (nodea, nodeb, distance); -pr_debug ("distance[node%d -> node%d] = %d\n" , - nodea, nodeb, distance);/* Set default distance of node B->A same as A->B */ if (nodeb > nodea)
Greg Kroah-Hartman
maintainerPATCH 118/205 x86/cpu/vmware: Do not trace vmware_sched_clock()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (VMware) <[email protected]>
commit 15035388439f892017d38b05214d3cda6578af64 upstream.
When running function tracing on a Linux guest running on VMware Workstation, the guest would crash. This is due to tracing of the sched_clock internal call of the VMware vmware_sched_clock(), which causes an infinite recursion within the tracing code (clock calls must not be traced).
Make vmware_sched_clock() not traced by ftrace.
--- arch/x86/kernel/cpu/vmware.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/vmware.c +1 -1
@@ -77,7 +77,7 @@ static __init int setup_vmw_sched_clock( }early_param ("no-vmw-sched-clock" , setup_vmw_sched_clock); -static unsigned long long vmware_sched_clock (void ) +static unsigned long long notrace vmware_sched_clock (void ) {unsigned long long ns;
Greg Kroah-Hartman
maintainerPATCH 118/205 x86/cpu/vmware: Do not trace vmware_sched_clock()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (VMware) <[email protected]>
commit 15035388439f892017d38b05214d3cda6578af64 upstream.
When running function tracing on a Linux guest running on VMware Workstation, the guest would crash. This is due to tracing of the sched_clock internal call of the VMware vmware_sched_clock(), which causes an infinite recursion within the tracing code (clock calls must not be traced).
Make vmware_sched_clock() not traced by ftrace.
--- arch/x86/kernel/cpu/vmware.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/vmware.c +1 -1
@@ -77,7 +77,7 @@ static __init int setup_vmw_sched_clock( }early_param ("no-vmw-sched-clock" , setup_vmw_sched_clock); -static unsigned long long vmware_sched_clock (void ) +static unsigned long long notrace vmware_sched_clock (void ) {unsigned long long ns;
Greg Kroah-Hartman
maintainerPATCH 119/205 x86/hyper-v: Enable PIT shutdown quirk
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 1de72c706488b7be664a601cf3843bd01e327e58 upstream.
Hyper-V emulation of the PIT has a quirk such that the normal PIT shutdown path doesn't work, because clearing the counter register restarts the timer.
Disable the counter clearing on PIT shutdown.
--- arch/x86/kernel/cpu/mshyperv.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kernel/cpu/mshyperv.c +11 -0
@@ -20,6 +20,7 @@#include <linux/interrupt.h> #include <linux/irq.h> #include <linux/kexec.h> +#include <linux/i8253.h> #include <asm/processor.h> #include <asm/hypervisor.h> #include <asm/hyperv-tlfs.h>
@@ -285,6 +286,16 @@ static void __init ms_hyperv_init_platfoif (efi_enabled (EFI_BOOT )) x86_platform.get_nmi_reason = hv_get_nmi_reason; +/* +* Hyper-V VMs have a PIT emulation quirk such that zeroing the +* counter register during PIT shutdown restarts the PIT. So it +* continues to interrupt @18.2 HZ. Setting i8253_clear_counter +* to false tells pit_shutdown() not to zero the counter so that +* the PIT really is shutdown. Generation 2 VMs don't have a PIT, +* and setting this value has no effect. +*/ + i8253_clear_counter_on_shutdown = false; +#if IS_ENABLED (CONFIG_HYPERV )/* * Setup the hook to get control post apic initialization.
Greg Kroah-Hartman
maintainerPATCH 119/205 x86/hyper-v: Enable PIT shutdown quirk
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 1de72c706488b7be664a601cf3843bd01e327e58 upstream.
Hyper-V emulation of the PIT has a quirk such that the normal PIT shutdown path doesn't work, because clearing the counter register restarts the timer.
Disable the counter clearing on PIT shutdown.
--- arch/x86/kernel/cpu/mshyperv.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kernel/cpu/mshyperv.c +11 -0
@@ -20,6 +20,7 @@#include <linux/interrupt.h> #include <linux/irq.h> #include <linux/kexec.h> +#include <linux/i8253.h> #include <asm/processor.h> #include <asm/hypervisor.h> #include <asm/hyperv-tlfs.h>
@@ -285,6 +286,16 @@ static void __init ms_hyperv_init_platfoif (efi_enabled (EFI_BOOT )) x86_platform.get_nmi_reason = hv_get_nmi_reason; +/* +* Hyper-V VMs have a PIT emulation quirk such that zeroing the +* counter register during PIT shutdown restarts the PIT. So it +* continues to interrupt @18.2 HZ. Setting i8253_clear_counter +* to false tells pit_shutdown() not to zero the counter so that +* the PIT really is shutdown. Generation 2 VMs don't have a PIT, +* and setting this value has no effect. +*/ + i8253_clear_counter_on_shutdown = false; +#if IS_ENABLED (CONFIG_HYPERV )/* * Setup the hook to get control post apic initialization.
Greg Kroah-Hartman
maintainerPATCH 120/205 termios, tty/tty_baudrate.c: fix buffer overrun
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: H. Peter Anvin <[email protected]>
commit 991a25194097006ec1e0d2e0814ff920e59e3465 upstream.
On architectures with CBAUDEX == 0 (Alpha and PowerPC), the code in tty_baudrate.c does not do any limit checking on the tty_baudrate[] array, and in fact a buffer overrun is possible on both architectures. Add a limit check to prevent that situation.
This will be followed by a much bigger cleanup/simplification patch.
--- drivers/tty/tty_baudrate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/tty_baudrate.c +2 -2
@@ -77,7 +77,7 @@ speed_t tty_termios_baud_rate(struct kteelse cbaud +=15 ; } -return baud_table[cbaud]; +return cbaud >= n_baud_table ?0 : baud_table[cbaud]; }EXPORT_SYMBOL (tty_termios_baud_rate);
@@ -113,7 +113,7 @@ speed_t tty_termios_input_baud_rate(stru else cbaud += 15; } -return baud_table[cbaud]; +return cbaud >= n_baud_table ?0 : baud_table[cbaud];#else /* IBSHIFT */ return tty_termios_baud_rate (termios);#endif /* IBSHIFT */
Greg Kroah-Hartman
maintainerPATCH 121/205 arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: H. Peter Anvin (Intel) <[email protected]>
commit d0ffb805b729322626639336986bc83fc2e60871 upstream.
Alpha has had c_ispeed and c_ospeed, but still set speeds in c_cflags using arbitrary flags. Because BOTHER is not defined, the general Linux code doesn't allow setting arbitrary baud rates, and because CBAUDEX == 0, we can have an array overrun of the baud_rate[] table in drivers/tty/tty_baudrate.c if (c_cflags & CBAUD) == 037.
Resolve both problems by #defining BOTHER to 037 on Alpha.
However, userspace still needs to know if setting BOTHER is actually safe given legacy kernels (does anyone actually care about that on Alpha anymore?), so enable the TCGETS2/TCSETS*2 ioctls on Alpha, even though they use the same structure. Define struct termios2 just for compatibility; it is the exact same structure as struct termios. In a future patchset, this will be cleaned up so the uapi headers are usable from libc.
--- arch/alpha/include/asm/termios.h | 8 +++++++- arch/alpha/include/uapi/asm/ioctls.h | 5 +++++ arch/alpha/include/uapi/asm/termbits.h | 17 +++++++++++++++++ 3 files changed, 29 insertions(+), 1 deletion(-)
arch/alpha/include/asm/termios.h +7 -1
@@ -73,9 +73,15 @@ })#define user_termios_to_kernel_termios (k, u) \ - copy_from_user(k, u, sizeof(struct termios)) + copy_from_user(k, u, sizeof(struct termios2))#define kernel_termios_to_user_termios (u, k) \ + copy_to_user(u, k, sizeof(struct termios2)) + +#define user_termios_to_kernel_termios_1 (k, u) \ + copy_from_user(k, u, sizeof(struct termios)) + +#define kernel_termios_to_user_termios_1 (u, k) \ copy_to_user(u, k, sizeof(struct termios))#endif /* _ALPHA_TERMIOS_H */
arch/alpha/include/uapi/asm/ioctls.h +5 -0
@@ -32,6 +32,11 @@#define TCXONC _IO('t', 30)#define TCFLSH _IO('t', 31) +#define TCGETS2 _IOR('T', 42, struct termios2) +#define TCSETS2 _IOW('T', 43, struct termios2) +#define TCSETSW2 _IOW('T', 44, struct termios2) +#define TCSETSF2 _IOW('T', 45, struct termios2) +#define TIOCSWINSZ _IOW('t', 103, struct winsize)#define TIOCGWINSZ _IOR('t', 104, struct winsize)#define TIOCSTART _IO('t', 110)/* start output, like ^Q */
arch/alpha/include/uapi/asm/termbits.h +17 -0
@@ -26,6 +26,19 @@ struct termios {speed_t c_ospeed;/* output speed */ }; +/* Alpha has identical termios and termios2 */ + +struct termios2 { +tcflag_t c_iflag;/* input mode flags */ +tcflag_t c_oflag;/* output mode flags */ +tcflag_t c_cflag;/* control mode flags */ +tcflag_t c_lflag;/* local mode flags */ +cc_t c_cc[NCCS ];/* control characters */ +cc_t c_line;/* line discipline (== c_cc[19]) */ +speed_t c_ispeed;/* input speed */ +speed_t c_ospeed;/* output speed */ +}; +/* Alpha has matching termios and ktermios */ struct ktermios {
@@ -152,6 +165,7 @@ struct ktermios {#define B3000000 00034#define B3500000 00035#define B4000000 00036 +#define BOTHER 00037#define CSIZE 00001400#define CS5 00000000
@@ -169,6 +183,9 @@ struct ktermios {#define CMSPAR 010000000000/* mark or space (stick) parity */ #define CRTSCTS 020000000000/* flow control */ +#define CIBAUD 07600000 +#define IBSHIFT 16 +/* c_lflag bits */ #define ISIG 0x00000080#define ICANON 0x00000100
Greg Kroah-Hartman
maintainerPATCH 122/205 watchdog/core: Add missing prototypes for weak functions
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Malaterre <[email protected]>
commit 81bd415c91eb966118d773dddf254aebf3022411 upstream.
The split out of the hard lockup detector exposed two new weak functions, but no prototypes for them, which triggers the build warning:
kernel/watchdog.c:109:12: warning: no previous prototype for ‘watchdog_nmi_enable’ [-Wmissing-prototypes] kernel/watchdog.c:115:13: warning: no previous prototype for ‘watchdog_nmi_disable’ [-Wmissing-prototypes]
Add the prototypes.
--- include/linux/nmi.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/nmi.h +2 -0
@@ -119,6 +119,8 @@ static inline int hardlockup_detector_pevoid watchdog_nmi_stop (void );void watchdog_nmi_start (void );int watchdog_nmi_probe (void ); +int watchdog_nmi_enable (unsigned int cpu); +void watchdog_nmi_disable (unsigned int cpu);/** * touch_nmi_watchdog - restart NMI watchdog timeout.
Greg Kroah-Hartman
maintainerPATCH 123/205 btrfs: fix pinned underflow after transaction aborted
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Fengqi <[email protected]>
commit fcd5e74288f7d36991b1f0fb96b8c57079645e38 upstream.
When running generic/475, we may get the following warning in dmesg:
[ 6902.102154] WARNING: CPU: 3 PID: 18013 at fs/btrfs/extent-tree.c:9776 btrfs_free_block_groups+0x2af/0x3b0 [btrfs] [ 6902.109160] CPU: 3 PID: 18013 Comm: umount Tainted: G W O 4.19.0-rc8+ #8 [ 6902.110971] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 [ 6902.112857] RIP: 0010:btrfs_free_block_groups+0x2af/0x3b0 [btrfs] [ 6902.118921] RSP: 0018:ffffc9000459bdb0 EFLAGS: 00010286 [ 6902.120315] RAX: ffff880175050bb0 RBX: ffff8801124a8000 RCX: 0000000000170007 [ 6902.121969] RDX: 0000000000000002 RSI: 0000000000170007 RDI: ffffffff8125fb74 [ 6902.123716] RBP: ffff880175055d10 R08: 0000000000000000 R09: 0000000000000000 [ 6902.125417] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880175055d88 [ 6902.127129] R13: ffff880175050bb0 R14: 0000000000000000 R15: dead000000000100 [ 6902.129060] FS: 00007f4507223780(0000) GS:ffff88017ba00000(0000) knlGS:0000000000000000 [ 6902.130996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6902.132558] CR2: 00005623599cac78 CR3: 000000014b700001 CR4: 00000000003606e0 [ 6902.134270] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 6902.135981] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 6902.137836] Call Trace: [ 6902.138939] close_ctree+0x171/0x330 [btrfs] [ 6902.140181] ? kthread_stop+0x146/0x1f0 [ 6902.141277] generic_shutdown_super+0x6c/0x100 [ 6902.142517] kill_anon_super+0x14/0x30 [ 6902.143554] btrfs_kill_super+0x13/0x100 [btrfs] [ 6902.144790] deactivate_locked_super+0x2f/0x70 [ 6902.146014] cleanup_mnt+0x3b/0x70 [ 6902.147020] task_work_run+0x9e/0xd0 [ 6902.148036] do_syscall_64+0x470/0x600 [ 6902.149142] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 6902.150375] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 6902.151640] RIP: 0033:0x7f45077a6a7b [ 6902.157324] RSP: 002b:00007ffd589f3e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 6902.159187] RAX: 0000000000000000 RBX: 000055e8eec732b0 RCX: 00007f45077a6a7b [ 6902.160834] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055e8eec73490 [ 6902.162526] RBP: 0000000000000000 R08: 000055e8eec734b0 R09: 00007ffd589f26c0 [ 6902.164141] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e8eec73490 [ 6902.165815] R13: 00007f4507ac61a4 R14: 0000000000000000 R15: 00007ffd589f40d8 [ 6902.167553] irq event stamp: 0 [ 6902.168998] hardirqs last enabled at (0): [<0000000000000000>] (null) [ 6902.170731] hardirqs last disabled at (0): [<ffffffff810cd810>] copy_process.part.55+0x3b0/0x1f00 [ 6902.172773] softirqs last enabled at (0): [<ffffffff810cd810>] copy_process.part.55+0x3b0/0x1f00 [ 6902.174671] softirqs last disabled at (0): [<0000000000000000>] (null) [ 6902.176407] ---[ end trace 463138c2986b275c ]--- [ 6902.177636] BTRFS info (device dm-3): space_info 4 has 273465344 free, is not full [ 6902.179453] BTRFS info (device dm-3): space_info total=276824064, used=4685824, pinned=18446744073708158976, reserved=0, may_use=0, readonly=65536
In the above line there's "pinned=18446744073708158976" which is an unsigned u64 value of -1392640, an obvious underflow.
When transaction_kthread is running cleanup_transaction(), another fsstress is running btrfs_commit_transaction(). The btrfs_finish_extent_commit() may get the same range as btrfs_destroy_pinned_extent() got, which causes the pinned underflow.
--- fs/btrfs/disk-io.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/btrfs/disk-io.c +11 -1
@@ -4359,13 +4359,23 @@ static int btrfs_destroy_pinned_extent(s unpin = pinned_extents; again:while (1 ) { +/* +* The btrfs_finish_extent_commit() may get the same range as +* ours between find_first_extent_bit and clear_extent_dirty. +* Hence, hold the unused_bg_unpin_mutex to avoid double unpin +* the same extent range. +*/ +mutex_lock (&fs_info->unused_bg_unpin_mutex); ret =find_first_extent_bit (unpin,0 , &start, &end,EXTENT_DIRTY ,NULL ); -if (ret) +if (ret) { +mutex_unlock (&fs_info->unused_bg_unpin_mutex);break ; + }clear_extent_dirty (unpin, start, end);btrfs_error_unpin_extent_range (fs_info, start, end); +mutex_unlock (&fs_info->unused_bg_unpin_mutex);cond_resched (); }
Greg Kroah-Hartman
maintainerPATCH 124/205 Btrfs: fix missing data checksums after a ranged fsync (msync)
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 008c6753f7e070c77c70d708a6bf0255b4381763 upstream.
Recently we got a massive simplification for fsync, where for the fast path we no longer log new extents while their respective ordered extents are still running.
However that simplification introduced a subtle regression for the case where we use a ranged fsync (msync). Consider the following example:
CPU 0 CPU 1
mmap write to range [2Mb, 4Mb[
mmap write to range [512Kb, 1Mb[
msync range [512K, 1Mb[
--> triggers fast fsync
(BTRFS_INODE_NEEDS_FULL_SYNC
not set)
--> creates extent map A for this
range and adds it to list of
modified extents
--> starts ordered extent A for
this range
--> waits for it to complete
writeback triggered for range
[2Mb, 4Mb[
--> create extent map B and
adds it to the list of
modified extents
--> creates ordered extent B
--> start looking for and logging
modified extents
--> logs extent maps A and B
--> finds checksums for extent A
in the csum tree, but not for
extent Bfsync (msync) finishes
--> ordered extent B
finishes and its checksums are added to the csum tree
<power cut>
After replaying the log, we have the extent covering the range [2Mb, 4Mb[ but do not have the data checksum items covering that file range.
This happens because at the very beginning of an fsync (btrfs_sync_file()) we start and wait for IO in the given range [512Kb, 1Mb[ and therefore wait for any ordered extents in that range to complete before we start logging the extents. However if right before we start logging the extent in our range [512Kb, 1Mb[, writeback is started for any other dirty range, such as the range [2Mb, 4Mb[ due to memory pressure or a concurrent fsync or msync (btrfs_sync_file() starts writeback before acquiring the inode's lock), an ordered extent is created for that other range and a new extent map is created to represent that range and added to the inode's list of modified extents.
That means that we will see that other extent in that list when collecting extents for logging (done at btrfs_log_changed_extents()) and log the extent before the respective ordered extent finishes - namely before the checksum items are added to the checksums tree, which is where log_extent_csums() looks for the checksums, therefore making us log an extent without logging its checksums. Before that massive simplification of fsync, this wasn't a problem because besides looking for checkums in the checksums tree, we also looked for them in any ordered extent still running.
The consequence of data checksums missing for a file range is that users attempting to read the affected file range will get -EIO errors and dmesg reports the following:
[10188.358136] BTRFS info (device sdc): no csum found for inode 297 start 57344 [10188.359278] BTRFS warning (device sdc): csum failed root 5 ino 297 off 57344 csum 0x98f94189 expected csum 0x00000000 mirror 1
So fix this by skipping extents outside of our logging range at btrfs_log_changed_extents() and leaving them on the list of modified extents so that any subsequent ranged fsync may collect them if needed. Also, if we find a hole extent outside of the range still log it, just to prevent having gaps between extent items after replaying the log, otherwise fsck will complain when we are not using the NO_HOLES feature (fstest btrfs/056 triggers such case).
--- fs/btrfs/tree-log.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
fs/btrfs/tree-log.c +17 -0
@@ -4399,6 +4399,23 @@ static int btrfs_log_changed_extents(str logged_end = end;list_for_each_entry_safe (em, n, &tree->modified_extents, list) { +/* +* Skip extents outside our logging range. It's important to do +* it for correctness because if we don't ignore them, we may +* log them before their ordered extent completes, and therefore +* we could log them without logging their respective checksums +* (the checksum items are added to the csum tree at the very +* end of btrfs_finish_ordered_io()). Also leave such extents +* outside of our range in the list, since we may have another +* ranged fsync in the near future that needs them. If an extent +* outside our range corresponds to a hole, log it to avoid +* leaving gaps between extents (fsck will complain when we are +* not using the NO_HOLES feature). +*/ +if ((em->start > end || em->start + em->len <= start) && + em->block_start !=EXTENT_MAP_HOLE ) +continue ; +list_del_init (&em->list);/* * Just an arbitrary number, this can be really CPU intensive
Greg Kroah-Hartman
maintainerPATCH 125/205 Btrfs: fix cur_offset in the error case for nocow
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <[email protected]>
commit 506481b20e818db40b6198815904ecd2d6daee64 upstream.
When the cow_file_range fails, the related resources are unlocked according to the range [start..end), so the unlock cannot be repeated in run_delalloc_nocow.
In some cases (e.g. cur_offset <= end && cow_start != -1), cur_offset is not updated correctly, so move the cur_offset update before cow_file_range.
kernel BUG at mm/page-writeback.c:2663!
Internal error: Oops - BUG: 0 [#1] SMP CPU: 3 PID: 31525 Comm: kworker/u8:7 Tainted: P O Hardware name: Realtek_RTD1296 (DT) Workqueue: writeback wb_workfn (flush-btrfs-1) task: ffffffc076db3380 ti: ffffffc02e9ac000 task.ti: ffffffc02e9ac000 PC is at clear_page_dirty_for_io+0x1bc/0x1e8 LR is at clear_page_dirty_for_io+0x14/0x1e8 pc : [<ffffffc00033c91c>] lr : [<ffffffc00033c774>] pstate: 40000145 sp : ffffffc02e9af4f0 Process kworker/u8:7 (pid: 31525, stack limit = 0xffffffc02e9ac020) Call trace: [<ffffffc00033c91c>] clear_page_dirty_for_io+0x1bc/0x1e8 [<ffffffbffc514674>] extent_clear_unlock_delalloc+0x1e4/0x210 [btrfs] [<ffffffbffc4fb168>] run_delalloc_nocow+0x3b8/0x948 [btrfs] [<ffffffbffc4fb948>] run_delalloc_range+0x250/0x3a8 [btrfs] [<ffffffbffc514c0c>] writepage_delalloc.isra.21+0xbc/0x1d8 [btrfs] [<ffffffbffc516048>] __extent_writepage+0xe8/0x248 [btrfs] [<ffffffbffc51630c>] extent_write_cache_pages.isra.17+0x164/0x378 [btrfs] [<ffffffbffc5185a8>] extent_writepages+0x48/0x68 [btrfs] [<ffffffbffc4f5828>] btrfs_writepages+0x20/0x30 [btrfs] [<ffffffc00033d758>] do_writepages+0x30/0x88 [<ffffffc0003ba0f4>] __writeback_single_inode+0x34/0x198 [<ffffffc0003ba6c4>] writeback_sb_inodes+0x184/0x3c0 [<ffffffc0003ba96c>] __writeback_inodes_wb+0x6c/0xc0 [<ffffffc0003bac20>] wb_writeback+0x1b8/0x1c0 [<ffffffc0003bb0f0>] wb_workfn+0x150/0x250 [<ffffffc0002b0014>] process_one_work+0x1dc/0x388 [<ffffffc0002b02f0>] worker_thread+0x130/0x500 [<ffffffc0002b6344>] kthread+0x10c/0x110 [<ffffffc000284590>] ret_from_fork+0x10/0x40 Code: d503201f a9025bb5 a90363b7 f90023b9 (d4210000)
--- fs/btrfs/inode.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/btrfs/inode.c +2 -3
@@ -1532,12 +1532,11 @@ out_check: }btrfs_release_path (path); -if (cur_offset <= end && cow_start == (u64)-1 ) { +if (cur_offset <= end && cow_start == (u64)-1 ) cow_start = cur_offset; - cur_offset = end; - }if (cow_start != (u64)-1 ) { + cur_offset = end; ret =cow_file_range (inode, locked_page, cow_start, end, end, page_started, nr_written,1 ,NULL );if (ret)
Greg Kroah-Hartman
maintainerPATCH 126/205 Btrfs: fix infinite loop on inode eviction after deduplication of eof block
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 11023d3f5fdf89bba5e1142127701ca6e6014587 upstream.
If we attempt to deduplicate the last block of a file A into the middle of a file B, and file A's size is not a multiple of the block size, we end rounding the deduplication length to 0 bytes, to avoid the data corruption issue fixed by commit de02b9f6bb65 ("Btrfs: fix data corruption when deduplicating between different files"). However a length of zero will cause the insertion of an extent state with a start value greater (by 1) then the end value, leading to a corrupt extent state that will trigger a warning and cause chaos such as an infinite loop during inode eviction. Example trace:
[96049.833585] ------------[ cut here ]------------ [96049.833714] WARNING: CPU: 0 PID: 24448 at fs/btrfs/extent_io.c:436 insert_state+0x101/0x120 [btrfs] [96049.833767] CPU: 0 PID: 24448 Comm: xfs_io Not tainted 4.19.0-rc7-btrfs-next-39 #1 [96049.833768] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [96049.833780] RIP: 0010:insert_state+0x101/0x120 [btrfs] [96049.833783] RSP: 0018:ffffafd2c3707af0 EFLAGS: 00010282 [96049.833785] RAX: 0000000000000000 RBX: 000000000004dfff RCX: 0000000000000006 [96049.833786] RDX: 0000000000000007 RSI: ffff99045c143230 RDI: ffff99047b2168a0 [96049.833787] RBP: ffff990457851cd0 R08: 0000000000000001 R09: 0000000000000000 [96049.833787] R10: ffffafd2c3707ab8 R11: 0000000000000000 R12: ffff9903b93b12c8 [96049.833788] R13: 000000000004e000 R14: ffffafd2c3707b80 R15: ffffafd2c3707b78 [96049.833790] FS: 00007f5c14e7d700(0000) GS:ffff99047b200000(0000) knlGS:0000000000000000 [96049.833791] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [96049.833792] CR2: 00007f5c146abff8 CR3: 0000000115f4c004 CR4: 00000000003606f0 [96049.833795] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [96049.833796] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [96049.833796] Call Trace: [96049.833809] __set_extent_bit+0x46c/0x6a0 [btrfs] [96049.833823] lock_extent_bits+0x6b/0x210 [btrfs] [96049.833831] ? _raw_spin_unlock+0x24/0x30 [96049.833841] ? test_range_bit+0xdf/0x130 [btrfs] [96049.833853] lock_extent_range+0x8e/0x150 [btrfs] [96049.833864] btrfs_double_extent_lock+0x78/0xb0 [btrfs] [96049.833875] btrfs_extent_same_range+0x14e/0x550 [btrfs] [96049.833885] ? rcu_read_lock_sched_held+0x3f/0x70 [96049.833890] ? __kmalloc_node+0x2b0/0x2f0 [96049.833899] ? btrfs_dedupe_file_range+0x19a/0x280 [btrfs] [96049.833909] btrfs_dedupe_file_range+0x270/0x280 [btrfs] [96049.833916] vfs_dedupe_file_range_one+0xd9/0xe0 [96049.833919] vfs_dedupe_file_range+0x131/0x1b0 [96049.833924] do_vfs_ioctl+0x272/0x6e0 [96049.833927] ? __fget+0x113/0x200 [96049.833931] ksys_ioctl+0x70/0x80 [96049.833933] __x64_sys_ioctl+0x16/0x20 [96049.833937] do_syscall_64+0x60/0x1b0 [96049.833939] entry_SYSCALL_64_after_hwframe+0x49/0xbe [96049.833941] RIP: 0033:0x7f5c1478ddd7 [96049.833943] RSP: 002b:00007ffe15b196a8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [96049.833945] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5c1478ddd7 [96049.833946] RDX: 00005625ece322d0 RSI: 00000000c0189436 RDI: 0000000000000004 [96049.833947] RBP: 0000000000000000 R08: 00007f5c14a46f48 R09: 0000000000000040 [96049.833948] R10: 0000000000000541 R11: 0000000000000202 R12: 0000000000000000 [96049.833949] R13: 0000000000000000 R14: 0000000000000004 R15: 00005625ece322d0 [96049.833954] irq event stamp: 6196 [96049.833956] hardirqs last enabled at (6195): [<ffffffff91b00663>] console_unlock+0x503/0x640 [96049.833958] hardirqs last disabled at (6196): [<ffffffff91a037dd>] trace_hardirqs_off_thunk+0x1a/0x1c [96049.833959] softirqs last enabled at (6114): [<ffffffff92600370>] __do_softirq+0x370/0x421 [96049.833964] softirqs last disabled at (6095): [<ffffffff91a8dd4d>] irq_exit+0xcd/0xe0 [96049.833965] ---[ end trace db7b05f01b7fa10c ]--- [96049.935816] R13: 0000000000000000 R14: 00005562e5259240 R15: 00007ffff092b910 [96049.935822] irq event stamp: 6584 [96049.935823] hardirqs last enabled at (6583): [<ffffffff91b00663>] console_unlock+0x503/0x640 [96049.935825] hardirqs last disabled at (6584): [<ffffffff91a037dd>] trace_hardirqs_off_thunk+0x1a/0x1c [96049.935827] softirqs last enabled at (6328): [<ffffffff92600370>] __do_softirq+0x370/0x421 [96049.935828] softirqs last disabled at (6313): [<ffffffff91a8dd4d>] irq_exit+0xcd/0xe0 [96049.935829] ---[ end trace db7b05f01b7fa123 ]--- [96049.935840] ------------[ cut here ]------------ [96049.936065] WARNING: CPU: 1 PID: 24463 at fs/btrfs/extent_io.c:436 insert_state+0x101/0x120 [btrfs] [96049.936107] CPU: 1 PID: 24463 Comm: umount Tainted: G W 4.19.0-rc7-btrfs-next-39 #1 [96049.936108] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [96049.936117] RIP: 0010:insert_state+0x101/0x120 [btrfs] [96049.936119] RSP: 0018:ffffafd2c3637bc0 EFLAGS: 00010282 [96049.936120] RAX: 0000000000000000 RBX: 000000000004dfff RCX: 0000000000000006 [96049.936121] RDX: 0000000000000007 RSI: ffff990445cf88e0 RDI: ffff99047b2968a0 [96049.936122] RBP: ffff990457851cd0 R08: 0000000000000001 R09: 0000000000000000 [96049.936123] R10: ffffafd2c3637b88 R11: 0000000000000000 R12: ffff9904574301e8 [96049.936124] R13: 000000000004e000 R14: ffffafd2c3637c50 R15: ffffafd2c3637c48 [96049.936125] FS: 00007fe4b87e72c0(0000) GS:ffff99047b280000(0000) knlGS:0000000000000000 [96049.936126] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [96049.936128] CR2: 00005562e52618d8 CR3: 00000001151c8005 CR4: 00000000003606e0 [96049.936129] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [96049.936131] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [96049.936131] Call Trace: [96049.936141] __set_extent_bit+0x46c/0x6a0 [btrfs] [96049.936154] lock_extent_bits+0x6b/0x210 [btrfs] [96049.936167] btrfs_evict_inode+0x1e1/0x5a0 [btrfs] [96049.936172] evict+0xbf/0x1c0 [96049.936174] dispose_list+0x51/0x80 [96049.936176] evict_inodes+0x193/0x1c0 [96049.936180] generic_shutdown_super+0x3f/0x110 [96049.936182] kill_anon_super+0xe/0x30 [96049.936189] btrfs_kill_super+0x13/0x100 [btrfs] [96049.936191] deactivate_locked_super+0x3a/0x70 [96049.936193] cleanup_mnt+0x3b/0x80 [96049.936195] task_work_run+0x93/0xc0 [96049.936198] exit_to_usermode_loop+0xfa/0x100 [96049.936201] do_syscall_64+0x17f/0x1b0 [96049.936202] entry_SYSCALL_64_after_hwframe+0x49/0xbe [96049.936204] RIP: 0033:0x7fe4b80cfb37 [96049.936206] RSP: 002b:00007ffff092b688 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [96049.936207] RAX: 0000000000000000 RBX: 00005562e5259060 RCX: 00007fe4b80cfb37 [96049.936208] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 00005562e525faa0 [96049.936209] RBP: 00005562e525faa0 R08: 00005562e525f770 R09: 0000000000000015 [96049.936210] R10: 00000000000006b4 R11: 0000000000000246 R12: 00007fe4b85d1e64 [96049.936211] R13: 0000000000000000 R14: 00005562e5259240 R15: 00007ffff092b910 [96049.936211] R13: 0000000000000000 R14: 00005562e5259240 R15: 00007ffff092b910 [96049.936216] irq event stamp: 6616 [96049.936219] hardirqs last enabled at (6615): [<ffffffff91b00663>] console_unlock+0x503/0x640 [96049.936219] hardirqs last disabled at (6616): [<ffffffff91a037dd>] trace_hardirqs_off_thunk+0x1a/0x1c [96049.936222] softirqs last enabled at (6328): [<ffffffff92600370>] __do_softirq+0x370/0x421 [96049.936222] softirqs last disabled at (6313): [<ffffffff91a8dd4d>] irq_exit+0xcd/0xe0 [96049.936223] ---[ end trace db7b05f01b7fa124 ]---
The second stack trace, from inode eviction, is repeated forever due to the infinite loop during eviction.
This is the same type of problem fixed way back in 2015 by commit 113e8283869b ("Btrfs: fix inode eviction infinite loop after extent_same ioctl") and commit ccccf3d67294 ("Btrfs: fix inode eviction infinite loop after cloning into it").
So fix this by returning immediately if the deduplication range length gets rounded down to 0 bytes, as there is nothing that needs to be done in such case.
Example reproducer:
$ mkfs.btrfs -f /dev/sdb $ mount /dev/sdb /mnt
$ xfs_io -f -c "pwrite -S 0xe6 0 100" /mnt/foo $ xfs_io -f -c "pwrite -S 0xe6 0 1M" /mnt/bar
# Unmount the filesystem and mount it again so that we start without any
# extent state records when we ask for the deduplication. $ umount /mnt $ mount /dev/sdb /mnt
$ xfs_io -c "dedupe /mnt/foo 0 500K 100" /mnt/bar
# This unmount triggers the infinite loop.
$ umount /mnt
A test case for fstests will follow soon.
--- fs/btrfs/ioctl.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/ioctl.c +2 -0
@@ -3489,6 +3489,8 @@ static int btrfs_extent_same_range(strucconst u64 sz =BTRFS_I (src)->root->fs_info->sectorsize; len =round_down (i_size_read (src), sz) - loff; +if (len ==0 ) +return 0 ; olen = len; } }
Greg Kroah-Hartman
maintainerPATCH 127/205 Btrfs: fix data corruption due to cloning of eof block
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit ac765f83f1397646c11092a032d4f62c3d478b81 upstream.
We currently allow cloning a range from a file which includes the last block of the file even if the file's size is not aligned to the block size. This is fine and useful when the destination file has the same size, but when it does not and the range ends somewhere in the middle of the destination file, it leads to corruption because the bytes between the EOF and the end of the block have undefined data (when there is support for discard/trimming they have a value of 0x00).
Example:
$ mkfs.btrfs -f /dev/sdb $ mount /dev/sdb /mnt
$ export foo_size=$((256 * 1024 + 100)) $ xfs_io -f -c "pwrite -S 0x3c 0 $foo_size" /mnt/foo $ xfs_io -f -c "pwrite -S 0xb5 0 1M" /mnt/bar
$ xfs_io -c "reflink /mnt/foo 0 512K $foo_size" /mnt/bar
$ od -A d -t x1 /mnt/bar 0000000 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 * 0524288 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c * 0786528 3c 3c 3c 3c 00 00 00 00 00 00 00 00 00 00 00 00 0786544 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 0790528 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 * 1048576
The bytes in the range from 786532 (512Kb + 256Kb + 100 bytes) to 790527 (512Kb + 256Kb + 4Kb - 1) got corrupted, having now a value of 0x00 instead of 0xb5.
This is similar to the problem we had for deduplication that got recently fixed by commit de02b9f6bb65 ("Btrfs: fix data corruption when deduplicating between different files").
Fix this by not allowing such operations to be performed and return the errno -EINVAL to user space. This is what XFS is doing as well at the VFS level. This change however now makes us return -EINVAL instead of -EOPNOTSUPP for cases where the source range maps to an inline extent and the destination range's end is smaller then the destination file's size, since the detection of inline extents is done during the actual process of dropping file extent items (at __btrfs_drop_extents()). Returning the -EINVAL error is done early on and solely based on the input parameters (offsets and length) and destination file's size. This makes us consistent with XFS and anyone else supporting cloning since this case is now checked at a higher level in the VFS and is where the -EINVAL will be returned from starting with kernel 4.20 (the VFS changed was introduced in 4.20-rc1 by commit 07d19dc9fbe9 ("vfs: avoid problematic remapping requests into partial EOF block"). So this change is more geared towards stable kernels, as it's unlikely the new VFS checks get removed intentionally.
A test case for fstests follows soon, as well as an update to filter existing tests that expect -EOPNOTSUPP to accept -EINVAL as well.
--- fs/btrfs/ioctl.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/btrfs/ioctl.c +10 -2
@@ -4280,9 +4280,17 @@ static noinline int btrfs_clone_files(st goto out_unlock;if (len ==0 ) olen = len = src->i_size - off; -/* if we extend to eof, continue to block boundary */ -if (off + len == src->i_size) +/* +* If we extend to eof, continue to block boundary if and only if the +* destination end offset matches the destination file's size, otherwise +* we would be corrupting data by placing the eof block into the middle +* of a file. +*/ +if (off + len == src->i_size) { +if (!IS_ALIGNED (len, bs) && destoff + len < inode->i_size) + goto out_unlock; len =ALIGN (src->i_size, bs) - off; + }if (len ==0 ) { ret =0 ;
Greg Kroah-Hartman
maintainerPATCH 128/205 btrfs: tree-checker: Fix misleading group system information
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaokun Zhang <[email protected]>
commit 761333f2f50ccc887aa9957ae829300262c0d15b upstream.
block_group_err shows the group system as a decimal value with a '0x' prefix, which is somewhat misleading.
Fix it to print hexadecimal, as was intended.
--- fs/btrfs/tree-checker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/tree-checker.c +1 -1
@@ -440,7 +440,7 @@ static int check_block_group_item(struct type != (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA)) { block_group_err(fs_info, leaf, slot, -"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llu or 0x%llx", +"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx", type, hweight64(type), BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA, BTRFS_BLOCK_GROUP_SYSTEM,
Greg Kroah-Hartman
maintainerPATCH 129/205 clockevents/drivers/i8253: Add support for PIT shutdown quirk
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 35b69a420bfb56b7b74cb635ea903db05e357bec upstream.
Add support for platforms where pit_shutdown() doesn't work because of a quirk in the PIT emulation. On these platforms setting the counter register to zero causes the PIT to start running again, negating the shutdown.
Provide a global variable that controls whether the counter register is zero'ed, which platform specific code can override.
--- drivers/clocksource/i8253.c | 14 ++++++++++++-- include/linux/i8253.h | 1 + 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/clocksource/i8253.c +12 -2
@@ -20,6 +20,13 @@DEFINE_RAW_SPINLOCK (i8253_lock);EXPORT_SYMBOL (i8253_lock); +/* +* Handle PIT quirk in pit_shutdown() where zeroing the counter register +* restarts the PIT, negating the shutdown. On platforms with the quirk, +* platform specific code can set this to false. +*/ +bool i8253_clear_counter_on_shutdown__ro_after_init = true; +#ifdef CONFIG_CLKSRC_I8253 /* * Since the PIT overflows every tick, its not very useful
@@ -109,8 +116,11 @@ static int pit_shutdown(struct clock_everaw_spin_lock (&i8253_lock);outb_p (0x30 ,PIT_MODE ); -outb_p (0 ,PIT_CH0 ); -outb_p (0 ,PIT_CH0 ); + +if (i8253_clear_counter_on_shutdown) { +outb_p (0 ,PIT_CH0 ); +outb_p (0 ,PIT_CH0 ); + }raw_spin_unlock (&i8253_lock);return 0 ;
include/linux/i8253.h +1 -0
@@ -21,6 +21,7 @@#define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ)extern raw_spinlock_t i8253_lock; +extern bool i8253_clear_counter_on_shutdown;extern struct clock_event_device i8253_clockevent;extern void clockevent_i8253_init (bool oneshot);
Greg Kroah-Hartman
maintainerPATCH 129/205 clockevents/drivers/i8253: Add support for PIT shutdown quirk
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 35b69a420bfb56b7b74cb635ea903db05e357bec upstream.
Add support for platforms where pit_shutdown() doesn't work because of a quirk in the PIT emulation. On these platforms setting the counter register to zero causes the PIT to start running again, negating the shutdown.
Provide a global variable that controls whether the counter register is zero'ed, which platform specific code can override.
--- drivers/clocksource/i8253.c | 14 ++++++++++++-- include/linux/i8253.h | 1 + 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/clocksource/i8253.c +12 -2
@@ -20,6 +20,13 @@DEFINE_RAW_SPINLOCK (i8253_lock);EXPORT_SYMBOL (i8253_lock); +/* +* Handle PIT quirk in pit_shutdown() where zeroing the counter register +* restarts the PIT, negating the shutdown. On platforms with the quirk, +* platform specific code can set this to false. +*/ +bool i8253_clear_counter_on_shutdown__ro_after_init = true; +#ifdef CONFIG_CLKSRC_I8253 /* * Since the PIT overflows every tick, its not very useful
@@ -109,8 +116,11 @@ static int pit_shutdown(struct clock_everaw_spin_lock (&i8253_lock);outb_p (0x30 ,PIT_MODE ); -outb_p (0 ,PIT_CH0 ); -outb_p (0 ,PIT_CH0 ); + +if (i8253_clear_counter_on_shutdown) { +outb_p (0 ,PIT_CH0 ); +outb_p (0 ,PIT_CH0 ); + }raw_spin_unlock (&i8253_lock);return 0 ;
include/linux/i8253.h +1 -0
@@ -21,6 +21,7 @@#define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ)extern raw_spinlock_t i8253_lock; +extern bool i8253_clear_counter_on_shutdown;extern struct clock_event_device i8253_clockevent;extern void clockevent_i8253_init (bool oneshot);
Greg Kroah-Hartman
maintainerPATCH 130/205 ext4: add missing brelse() update_backups()s error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit ea0abbb648452cdb6e1734b702b6330a7448fcf8 upstream.
--- fs/ext4/resize.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ext4/resize.c +3 -1
@@ -1124,8 +1124,10 @@ static void update_backups(struct super_ backup_block, backup_block - ext4_group_first_block_no(sb, group));BUFFER_TRACE (bh,"get_write_access" ); -if ((err =ext4_journal_get_write_access (handle, bh))) +if ((err =ext4_journal_get_write_access (handle, bh))) { +brelse (bh);break ; + }lock_buffer (bh);memcpy (bh->b_data, data, size);if (rest)
Greg Kroah-Hartman
maintainerPATCH 131/205 ext4: add missing brelse() in set_flexbg_block_bitmap()s error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit cea5794122125bf67559906a0762186cf417099c upstream.
--- fs/ext4/resize.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ext4/resize.c +4 -2
@@ -459,16 +459,18 @@ static int set_flexbg_block_bitmap(strucBUFFER_TRACE (bh,"get_write_access" ); err =ext4_journal_get_write_access (handle, bh); -if (err) +if (err) { +brelse (bh);return err; + }ext4_debug ("mark block bitmap %#04llx (+%llu/%u)\n" , first_cluster, first_cluster - start, count2);ext4_set_bits (bh->b_data, first_cluster - start, count2); err =ext4_handle_dirty_metadata (handle,NULL , bh); +brelse (bh);if (unlikely (err))return err; -brelse (bh); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 132/205 ext4: add missing brelse() add_new_gdb_meta_bg()s error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit 61a9c11e5e7a0dab5381afa5d9d4dd5ebf18f7a0 upstream.
--- fs/ext4/resize.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/ext4/resize.c +1 -2
@@ -926,6 +926,7 @@ static int add_new_gdb_meta_bg(struct susizeof (struct buffer_head *), GFP_NOFS);if (!n_group_desc) { +brelse (gdb_bh); err = -ENOMEM ;ext4_warning (sb,"not enough memory for %lu groups" , gdb_num +1 );
@@ -941,8 +942,6 @@ static int add_new_gdb_meta_bg(struct sukvfree (o_group_desc);BUFFER_TRACE (gdb_bh,"get_write_access" ); err =ext4_journal_get_write_access (handle, gdb_bh); -if (unlikely (err)) -brelse (gdb_bh);return err; }
Greg Kroah-Hartman
maintainerPATCH 133/205 ext4: avoid potential extra brelse in setup_new_flex_group_blocks()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit 9e4028935cca3f9ef9b6a90df9da6f1f94853536 upstream.
Currently bh is set to NULL only during first iteration of for cycle, then this pointer is not cleared after end of using.
Therefore rollback after errors can lead to extra brelse(bh) call, decrements bh counter and later trigger an unexpected warning in __brelse()
Patch moves brelse() calls in body of cycle to exclude requirement of brelse() call in rollback.
--- fs/ext4/resize.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
fs/ext4/resize.c +2 -6
@@ -607,7 +607,6 @@ handle_bb: bh =bclean (handle, sb, block);if (IS_ERR (bh)) { err =PTR_ERR (bh); - bh =NULL ; goto out; } overhead =ext4_group_overhead_blocks (sb, group);
@@ -620,9 +619,9 @@ handle_bb:ext4_mark_bitmap_end (EXT4_B2C (sbi, group_data[i].blocks_count), sb->s_blocksize *8 , bh->b_data); err =ext4_handle_dirty_metadata (handle,NULL , bh); +brelse (bh);if (err) goto out; -brelse (bh); handle_ib:if (bg_flags[i] &EXT4_BG_INODE_UNINIT )
@@ -637,18 +636,16 @@ handle_ib: bh =bclean (handle, sb, block);if (IS_ERR (bh)) { err =PTR_ERR (bh); - bh =NULL ; goto out; }ext4_mark_bitmap_end (EXT4_INODES_PER_GROUP (sb), sb->s_blocksize *8 , bh->b_data); err =ext4_handle_dirty_metadata (handle,NULL , bh); +brelse (bh);if (err) goto out; -brelse (bh); } - bh =NULL ;/* Mark group tables in block bitmap */ for (j =0 ; j <GROUP_TABLE_COUNT ; j++) {
@@ -687,7 +684,6 @@ handle_ib: } out: -brelse (bh); err2 =ext4_journal_stop (handle);if (err2 && !err) err = err2;
Greg Kroah-Hartman
maintainerPATCH 134/205 ext4: missing !bh check in ext4_xattr_inode_write()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit eb6984fa4ce2837dcb1f66720a600f31b0bb3739 upstream.
According to Ted Ts'o ext4_getblk() called in ext4_xattr_inode_write() should not return bh = NULL
The only time that bh could be NULL, then, would be in the case of something really going wrong; a programming error elsewhere (perhaps a wild pointer dereference) or I/O error causing on-disk file system corruption (although that would be highly unlikely given that we had *just* allocated the blocks and so the metadata blocks in question probably would still be in the cache).
--- fs/ext4/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/xattr.c +6 -0
@@ -1388,6 +1388,12 @@ retry: bh =ext4_getblk (handle, ea_inode, block,0 );if (IS_ERR (bh))return PTR_ERR (bh); +if (!bh) { +WARN_ON_ONCE (1 ); +EXT4_ERROR_INODE (ea_inode, +"ext4_getblk() return bh = NULL" ); +return -EFSCORRUPTED ; + } ret =ext4_journal_get_write_access (handle, bh);if (ret) goto out;
Greg Kroah-Hartman
maintainerPATCH 135/205 ext4: fix possible inode leak in the retry loop of ext4_resize_fs()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit db6aee62406d9fbb53315fcddd81f1dc271d49fa upstream.
--- fs/ext4/resize.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ext4/resize.c +4 -0
@@ -2058,6 +2058,10 @@ retry: n_blocks_count_retry =0 ;free_flex_gd (flex_gd); flex_gd =NULL ; +if (resize_inode) { +iput (resize_inode); + resize_inode =NULL ; + } goto retry; }
Greg Kroah-Hartman
maintainerPATCH 136/205 ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit a6758309a005060b8297a538a457c88699cb2520 upstream.
ext4_mark_iloc_dirty() callers expect that it releases iloc->bh even if it returns an error.
--- fs/ext4/inode.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/ext4/inode.c +3 -2
@@ -5804,9 +5804,10 @@ int ext4_mark_iloc_dirty(handle_t *handl {int err =0 ; -if (unlikely (ext4_forced_shutdown (EXT4_SB (inode->i_sb)))) +if (unlikely (ext4_forced_shutdown (EXT4_SB (inode->i_sb)))) { +put_bh (iloc->bh);return -EIO ; - + }if (IS_I_VERSION (inode))inode_inc_iversion (inode);
Greg Kroah-Hartman
maintainerPATCH 137/205 ext4: avoid buffer leak in ext4_orphan_add() after prior errors
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit feaf264ce7f8d54582e2f66eb82dd9dd124c94f3 upstream.
--- fs/ext4/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ext4/namei.c +3 -1
@@ -2811,7 +2811,9 @@ int ext4_orphan_add(handle_t *handle, stlist_del_init (&EXT4_I (inode)->i_orphan);mutex_unlock (&sbi->s_orphan_lock); } - } + }else +brelse (iloc.bh); +jbd_debug (4 ,"superblock will point to %lu\n" , inode->i_ino);jbd_debug (4 ,"orphan inode %lu will point to %d\n" , inode->i_ino,NEXT_ORPHAN (inode));
Greg Kroah-Hartman
maintainerPATCH 138/205 ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit f348e2241fb73515d65b5d77dd9c174128a7fbf2 upstream.
--- fs/ext4/resize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/resize.c +1 -1
@@ -2022,7 +2022,7 @@ retry: err =ext4_alloc_flex_bg_array (sb, n_group +1 );if (err) -return err; + goto out; err =ext4_mb_alloc_groupinfo (sb, n_group +1 );if (err)
Greg Kroah-Hartman
maintainerPATCH 139/205 ext4: avoid possible double brelse() in add_new_gdb() on error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 4f32c38b4662312dd3c5f113d8bdd459887fb773 upstream.
--- fs/ext4/resize.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/resize.c +1 -0
@@ -871,6 +871,7 @@ static int add_new_gdb(handle_t *handle, err =ext4_handle_dirty_metadata (handle,NULL , gdb_bh);if (unlikely (err)) {ext4_std_error (sb, err); + iloc.bh =NULL ; goto exit_inode; }brelse (dind);
Greg Kroah-Hartman
maintainerPATCH 140/205 ext4: fix possible leak of sbi->s_group_desc_leak in error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 9e463084cdb22e0b56b2dfbc50461020409a5fd3 upstream.
--- fs/ext4/super.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
fs/ext4/super.c +8 -8
@@ -4074,6 +4074,14 @@ static int ext4_fill_super(struct super_ sbi->s_groups_count = blocks_count; sbi->s_blockfile_groups =min_t (ext4_group_t, sbi->s_groups_count, (EXT4_MAX_BLOCK_FILE_PHYS /EXT4_BLOCKS_PER_GROUP (sb))); +if (((u64 )sbi->s_groups_count * sbi->s_inodes_per_group) != +le32_to_cpu (es->s_inodes_count)) { +ext4_msg (sb,KERN_ERR ,"inodes count not valid: %u vs %llu" , +le32_to_cpu (es->s_inodes_count), + ((u64 )sbi->s_groups_count * sbi->s_inodes_per_group)); + ret = -EINVAL ; + goto failed_mount; + } db_count = (sbi->s_groups_count +EXT4_DESC_PER_BLOCK (sb) -1 ) /EXT4_DESC_PER_BLOCK (sb);if (ext4_has_feature_meta_bg (sb)) {
@@ -4093,14 +4101,6 @@ static int ext4_fill_super(struct super_ ret = -ENOMEM ; goto failed_mount; } -if (((u64 )sbi->s_groups_count * sbi->s_inodes_per_group) != -le32_to_cpu (es->s_inodes_count)) { -ext4_msg (sb,KERN_ERR ,"inodes count not valid: %u vs %llu" , -le32_to_cpu (es->s_inodes_count), - ((u64 )sbi->s_groups_count * sbi->s_inodes_per_group)); - ret = -EINVAL ; - goto failed_mount; - }bgl_lock_init (sbi->s_blockgroup_lock);
Greg Kroah-Hartman
maintainerPATCH 141/205 ext4: fix possible leak of s_journal_flag_rwsem in error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit af18e35bfd01e6d65a5e3ef84ffe8b252d1628c5 upstream.
--- fs/ext4/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/super.c +1 -0
@@ -4509,6 +4509,7 @@ failed_mount6:percpu_counter_destroy (&sbi->s_freeinodes_counter);percpu_counter_destroy (&sbi->s_dirs_counter);percpu_counter_destroy (&sbi->s_dirtyclusters_counter); +percpu_free_rwsem (&sbi->s_journal_flag_rwsem); failed_mount5:ext4_ext_release (sb);ext4_release_system_zone (sb);
Greg Kroah-Hartman
maintainerPATCH 142/205 ext4: fix buffer leak in ext4_xattr_get_block() on error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit ecaaf408478b6fb4d9986f9b6652f3824e374f4c upstream.
--- fs/ext4/xattr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ext4/xattr.c +3 -1
@@ -2282,8 +2282,10 @@ static struct buffer_head *ext4_xattr_geif (!bh)return ERR_PTR (-EIO ); error =ext4_xattr_check_block (inode, bh); -if (error) +if (error) { +brelse (bh);return ERR_PTR (error); + }return bh; }
Greg Kroah-Hartman
maintainerPATCH 143/205 ext4: release bs.bh before re-using in ext4_xattr_block_find()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit 45ae932d246f721e6584430017176cbcadfde610 upstream.
bs.bh was taken in previous ext4_xattr_block_find() call, it should be released before re-using
--- fs/ext4/xattr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/xattr.c +2 -0
@@ -2405,6 +2405,8 @@ retry_inode: error =ext4_xattr_block_set (handle, inode, &i, &bs); }else if (error == -ENOSPC ) {if (EXT4_I (inode)->i_file_acl && !bs.s.base) { +brelse (bs.bh); + bs.bh =NULL ; error =ext4_xattr_block_find (inode, &i, &bs);if (error) goto cleanup;
Greg Kroah-Hartman
maintainerPATCH 144/205 ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit 6bdc9977fcdedf47118d2caf7270a19f4b6d8a8f upstream.
--- fs/ext4/xattr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/xattr.c +2 -0
@@ -2627,6 +2627,8 @@ out:kfree (buffer);if (is)brelse (is->iloc.bh); +if (bs) +brelse (bs->bh);kfree (is);kfree (bs);
Greg Kroah-Hartman
maintainerPATCH 145/205 ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit 53692ec074d00589c2cf1d6d17ca76ad0adce6ec upstream.
--- fs/ext4/xattr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/ext4/xattr.c +5 -2
@@ -2708,7 +2708,6 @@ int ext4_expand_extra_isize_ea(struct in struct ext4_inode *raw_inode, handle_t *handle) { struct ext4_xattr_ibody_header *header; -struct buffer_head *bh;struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);static unsigned int mnt_count;size_t min_offs;
@@ -2749,13 +2748,17 @@ retry:* EA block can hold new_extra_isize bytes. */ if (EXT4_I (inode)->i_file_acl) { +struct buffer_head *bh; + bh =sb_bread (inode->i_sb,EXT4_I (inode)->i_file_acl); error = -EIO ;if (!bh) goto cleanup; error =ext4_xattr_check_block (inode, bh); -if (error) +if (error) { +brelse (bh); goto cleanup; + } base =BHDR (bh); end = bh->b_data + bh->b_size; min_offs = end - base;
Greg Kroah-Hartman
maintainerPATCH 146/205 ext4: fix buffer leak in __ext4_read_dirblock() on error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit de59fae0043f07de5d25e02ca360f7d57bfa5866 upstream.
--- fs/ext4/namei.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/namei.c +1 -0
@@ -126,6 +126,7 @@ static struct buffer_head *__ext4_read_dif (!is_dx_block && type ==INDEX ) {ext4_error_inode (inode, func, line, block,"directory leaf block found instead of index block" ); +brelse (bh);return ERR_PTR (-EFSCORRUPTED ); } if (!ext4_has_metadata_csum(inode->i_sb) ||
Greg Kroah-Hartman
maintainerPATCH 147/205 mount: Retest MNT_LOCKED in do_umount
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit 25d202ed820ee347edec0bf3bf553544556bf64b upstream.
It was recently pointed out that the one instance of testing MNT_LOCKED outside of the namespace_sem is in ksys_umount.
Fix that by adding a test inside of do_umount with namespace_sem and the mount_lock held. As it helps to fail fails the existing test is maintained with an additional comment pointing out that it may be racy because the locks are not held.
--- fs/namespace.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/namespace.c +8 -2
@@ -1540,8 +1540,13 @@ static int do_umount(struct mount *mnt,namespace_lock ();lock_mount_hash (); - event++; +/* Recheck MNT_LOCKED with the locks held */ + retval = -EINVAL ; +if (mnt->mnt.mnt_flags &MNT_LOCKED ) + goto out; + + event++;if (flags &MNT_DETACH ) {if (!list_empty (&mnt->mnt_list))umount_tree (mnt,UMOUNT_PROPAGATE );
@@ -1555,6 +1560,7 @@ static int do_umount(struct mount *mnt, retval =0 ; } } +out:unlock_mount_hash ();namespace_unlock ();return retval;
@@ -1645,7 +1651,7 @@ int ksys_umount(char __user *name, int f goto dput_and_out;if (!check_mnt (mnt)) goto dput_and_out; -if (mnt->mnt.mnt_flags &MNT_LOCKED ) +if (mnt->mnt.mnt_flags &MNT_LOCKED )/* Check optimistically */ goto dput_and_out; retval = -EPERM ;if (flags &MNT_FORCE && !capable (CAP_SYS_ADMIN ))
Greg Kroah-Hartman
maintainerPATCH 148/205 mount: Dont allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit df7342b240185d58d3d9665c0bbf0a0f5570ec29 upstream.
Jonathan Calmels from NVIDIA reported that he's able to bypass the mount visibility security check in place in the Linux kernel by using a combination of the unbindable property along with the private mount propagation option to allow a unprivileged user to see a path which was purposefully hidden by the root user.
Reproducer:
# Hide a path to all users using a tmpfs
root@castiana:~# mount -t tmpfs tmpfs /sys/devices/ root@castiana:~#
# As an unprivileged user, unshare user namespace and mount namespace
stgraber@castiana:~$ unshare -U -m -r
# Confirm the path is still not accessible
root@castiana:~# ls /sys/devices/
# Make /sys recursively unbindable and private root@castiana:~# mount --make-runbindable /sys root@castiana:~# mount --make-private /sys # Recursively bind-mount the rest of /sys over to /mnnt root@castiana:~# mount --rbind /sys/ /mnt
# Access our hidden /sys/device as an unprivileged user
root@castiana:~# ls /mnt/devices/ breakpoint cpu cstate_core cstate_pkg i915 intel_pt isa kprobe LNXSYSTM:00 msr pci0000:00 platform pnp0 power software system tracepoint uncore_arb uncore_cbox_0 uncore_cbox_1 uprobe virtual
Solve this by teaching copy_tree to fail if a mount turns out to be both unbindable and locked.
--- fs/namespace.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/namespace.c +8 -2
@@ -1734,8 +1734,14 @@ struct mount *copy_tree(struct mount *mnfor (s = r; s; s =next_mnt (s, r)) {if (!(flag &CL_COPY_UNBINDABLE ) &&IS_MNT_UNBINDABLE (s)) { - s =skip_mnt_tree (s); -continue ; +if (s->mnt.mnt_flags &MNT_LOCKED ) { +/* Both unbindable and locked. */ + q =ERR_PTR (-EPERM ); + goto out; + }else { + s =skip_mnt_tree (s); +continue ; + } }if (!(flag &CL_COPY_MNT_NS_FILE ) &&is_mnt_ns_file (s->mnt.mnt_root)) {
Greg Kroah-Hartman
maintainerPATCH 149/205 mount: Prevent MNT_DETACH from disconnecting locked mounts
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit 9c8e0a1b683525464a2abe9fb4b54404a50ed2b4 upstream.
Quoted 40 lines · Timothy Baldwin
As per
mount_namespaces(7)unprivileged users should not be able to look under mount points:Mounts that come as a single unit from more privileged mount are locked together and may not be separated in a less privileged mount namespace.
However they can:
1. Create a mount namespace.
2. In the mount namespace open a file descriptor to the parent of a mount point.
3. Destroy the mount namespace.
4. Use the file descriptor to look under the mount point.I have reproduced this with Linux 4.16.18 and Linux 4.18-rc8.
The setup:
$ sudo sysctl kernel.unprivileged_userns_clone=1 kernel.unprivileged_userns_clone = 1 $ mkdir -p A/B/Secret $ sudo mount -t tmpfs hide A/B"Secret" is indeed hidden as expected:
$ ls -lR A A: total 0 drwxrwxrwt 2 root root 40 Feb 12 21:08 BA/B:
total 0The attack revealing "Secret":
$ unshare -Umr sh -c "exec unshare -m ls -lR /proc/self/fd/4/ 4<A" /proc/self/fd/4/: total 0 drwxr-xr-x 3 root root 60 Feb 12 21:08 B
Quoted 6 lines
/proc/self/fd/4/B:
total 0
drwxr-xr-x 2 root root 40 Feb 12 21:08 Secret
/proc/self/fd/4/B/Secret:
total 0
I tracked this down to put_mnt_ns running passing UMOUNT_SYNC and disconnecting all of the mounts in a mount namespace. Fix this by factoring drop_mounts out of drop_collected_mounts and passing 0 instead of UMOUNT_SYNC.
There are two possible behavior differences that result from this.
- No longer setting UMOUNT_SYNC will no longer set MNT_SYNC_UMOUNT on the vfsmounts being unmounted. This effects the lazy rcu walk by kicking the walk out of rcu mode and forcing it to be a non-lazy walk.
- No longer disconnecting locked mounts will keep some mounts around longer as they stay because the are locked to other mounts.
There are only two users of drop_collected mounts: audit_tree.c and put_mnt_ns.
In audit_tree.c the mounts are private and there are no rcu lazy walks only calls to iterate_mounts. So the changes should have no effect except for a small timing effect as the connected mounts are disconnected.
In put_mnt_ns there may be references from process outside the mount namespace to the mounts. So the mounts remaining connected will be the bug fix that is needed. That rcu walks are allowed to continue appears not to be a problem especially as the rcu walk change was about an implementation detail not about semantics.
--- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/namespace.c +1 -1
@@ -1794,7 +1794,7 @@ void drop_collected_mounts(struct vfsmou {namespace_lock ();lock_mount_hash (); -umount_tree (real_mount (mnt),UMOUNT_SYNC ); +umount_tree (real_mount (mnt),0 );unlock_mount_hash ();namespace_unlock (); }
Greg Kroah-Hartman
maintainerPATCH 150/205 mnt: fix __detach_mounts infinite loop
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
commit 1e9c75fb9c47a75a9aec0cd17db5f6dc36b58e00 upstream.
Since commit ff17fa561a04 ("d_invalidate(): unhash immediately") immediately unhashes the dentry, we'll never return the mountpoint in lookup_mountpoint(), which can lead to an unbreakable loop in d_invalidate().
I have reports of NFS clients getting into this condition after the server removes an export of an existing mount created through follow_automount(), but I suspect there are various other ways to produce this problem if we hunt down users of d_invalidate(). For example, it is possible to get into this state by using XFS' d_invalidate() call in xfs_vn_unlink():
truncate -s 100m img{1,2}
mkfs.xfs -q -n version=ci img1
mkfs.xfs -q -n version=ci img2
mkdir -p /mnt/xfs
mount img1 /mnt/xfs
mkdir /mnt/xfs/sub1
mount img2 /mnt/xfs/sub1
cat > /mnt/xfs/sub1/foo &
umount -l /mnt/xfs/sub1
mount img2 /mnt/xfs/sub1
mount --make-private /mnt/xfs
mkdir /mnt/xfs/sub2
mount --move /mnt/xfs/sub1 /mnt/xfs/sub2
rmdir /mnt/xfs/sub1
Fix this by moving the check for an unlinked dentry out of the detach_mounts() path.
--- fs/namespace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/namespace.c +3 -3
@@ -695,9 +695,6 @@ static struct mountpoint *lookup_mountpohlist_for_each_entry (mp, chain, m_hash) {if (mp->m_dentry == dentry) { -/* might be worth a WARN_ON() */ -if (d_unlinked (dentry)) -return ERR_PTR (-ENOENT ); mp->m_count++;return mp; }
@@ -711,6 +708,9 @@ static struct mountpoint *get_mountpointint ret;if (d_mountpoint (dentry)) { +/* might be worth a WARN_ON() */ +if (d_unlinked (dentry)) +return ERR_PTR (-ENOENT ); mountpoint:read_seqlock_excl (&mount_lock); mp =lookup_mountpoint (dentry);
Greg Kroah-Hartman
maintainerPATCH 151/205 uapi: fix linux/kfd_ioctl.h userspace compilation errors
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry V. Levin <[email protected]>
commit aba118389a6fb2ad7958de0f37b5869852bd38cf upstream.
Consistently use types provided by <linux/types.h> via <drm/drm.h> to fix the following linux/kfd_ioctl.h userspace compilation errors:
/usr/include/linux/kfd_ioctl.h:250:2: error: unknown type name 'uint32_t'
uint32_t reset_type;/usr/include/linux/kfd_ioctl.h:251:2: error: unknown type name 'uint32_t'
uint32_t reset_cause;/usr/include/linux/kfd_ioctl.h:252:2: error: unknown type name 'uint32_t'
uint32_t memory_lost;/usr/include/linux/kfd_ioctl.h:253:2: error: unknown type name 'uint32_t'
uint32_t gpu_id;
--- include/uapi/linux/kfd_ioctl.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/uapi/linux/kfd_ioctl.h +4 -4
@@ -247,10 +247,10 @@ struct kfd_hsa_memory_exception_data {/* hw exception data */ struct kfd_hsa_hw_exception_data { -uint32_t reset_type; -uint32_t reset_cause; -uint32_t memory_lost; -uint32_t gpu_id; +__u32 reset_type; +__u32 reset_cause; +__u32 memory_lost; +__u32 gpu_id; };/* Event data */
Greg Kroah-Hartman
maintainerPATCH 152/205 ARM: cpuidle: Dont register the driver when back-end init returns -ENXIO
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
commit 763f191af51f127cf8e69cd361f50bf6180768a5 upstream.
There's no point to register the cpuidle driver for the current CPU, when the initialization of the arch specific back-end data fails by returning -ENXIO.
Instead, let's re-order the sequence to its original flow, by first trying to initialize the back-end part and then act accordingly on the returned error code. Additionally, let's print the error message, no matter of what error code that was returned.
--- drivers/cpuidle/cpuidle-arm.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)
drivers/cpuidle/cpuidle-arm.c +10 -12
@@ -103,13 +103,6 @@ static int __init arm_idle_init_cpu(int goto out_kfree_drv; } - ret =cpuidle_register_driver (drv); -if (ret) { -if (ret != -EBUSY ) -pr_err ("Failed to register cpuidle driver\n" ); - goto out_kfree_drv; - } -/* * Call arch CPU operations in order to initialize * idle states suspend back-end specific data
@@ -117,15 +110,20 @@ static int __init arm_idle_init_cpu(int ret =arm_cpuidle_init (cpu);/* -* Skip the cpuidle device initialization if the reported +* Allow the initialization to continue for other CPUs, if the reported * failure is a HW misconfiguration/breakage (-ENXIO). */ -if (ret == -ENXIO ) -return 0 ; -if (ret) {pr_err ("CPU %d failed to init idle CPU ops\n" , cpu); - goto out_unregister_drv; + ret = ret == -ENXIO ?0 : ret; + goto out_kfree_drv; + } + + ret =cpuidle_register_driver (drv); +if (ret) { +if (ret != -EBUSY ) +pr_err ("Failed to register cpuidle driver\n" ); + goto out_kfree_drv; } dev =kzalloc (sizeof (*dev),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 153/205 kdb: use correct pointer when btc calls btt
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit dded2e159208a9edc21dd5c5f583afa28d378d39 upstream.
On a powerpc 8xx, 'btc' fails as follows:
Entering kdb (current=0x(ptrval), pid 282) due to Keyboard Entry kdb> btc
btc: cpu status: Currently on cpu 0
Available cpus: 0kdb_getarea: Bad address 0x0
when booting the kernel with 'debug_boot_weak_hash', it fails as well
Entering kdb (current=0xba99ad80, pid 284) due to Keyboard Entry kdb> btc
btc: cpu status: Currently on cpu 0
Available cpus: 0kdb_getarea: Bad address 0xba99ad80
On other platforms, Oopses have been observed too, see
https://github.com/linuxppc/linux/issues/139
This is due to btc calling 'btt' with %p pointer as an argument.
This patch replaces %p by %px to get the real pointer value as expected by 'btt'
--- kernel/debug/kdb/kdb_bt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/debug/kdb/kdb_bt.c +2 -2
@@ -179,14 +179,14 @@ kdb_bt(int argc, const char **argv)kdb_printf ("no process for cpu %ld\n" , cpu);return 0 ; } -sprintf (buf,"btt 0x%p\n" ,KDB_TSK (cpu)); +sprintf (buf,"btt 0x%px\n" ,KDB_TSK (cpu));kdb_parse (buf);return 0 ; }kdb_printf ("btc: cpu status: " );kdb_parse ("cpu\n" );for_each_online_cpu (cpu) { -sprintf (buf,"btt 0x%p\n" ,KDB_TSK (cpu)); +sprintf (buf,"btt 0x%px\n" ,KDB_TSK (cpu));kdb_parse (buf);touch_nmi_watchdog (); }
Greg Kroah-Hartman
maintainerPATCH 154/205 kdb: print real address of pointers instead of hashed addresses
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit 568fb6f42ac6851320adaea25f8f1b94de14e40a upstream.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p"), all pointers printed with %p are printed with hashed addresses instead of real addresses in order to avoid leaking addresses in dmesg and syslog. But this applies to kdb too, with is unfortunate:
Entering kdb (current=0x(ptrval), pid 329) due to Keyboard Entry
kdb> ps
15 sleeping system daemon (state M) processes suppressed,
use 'ps A' to see all.
Task Addr Pid Parent [*] cpu State Thread Command
0x(ptrval) 329 328 1 0 R 0x(ptrval) *sh
0x(ptrval) 1 0 0 0 S 0x(ptrval) init
0x(ptrval) 3 2 0 0 D 0x(ptrval) rcu_gp
0x(ptrval) 4 2 0 0 D 0x(ptrval) rcu_par_gp
0x(ptrval) 5 2 0 0 D 0x(ptrval) kworker/0:0
0x(ptrval) 6 2 0 0 D 0x(ptrval) kworker/0:0H
0x(ptrval) 7 2 0 0 D 0x(ptrval) kworker/u2:0
0x(ptrval) 8 2 0 0 D 0x(ptrval) mm_percpu_wq
0x(ptrval) 10 2 0 0 D 0x(ptrval) rcu_preemptThe whole purpose of kdb is to debug, and for debugging real addresses need to be known. In addition, data displayed by kdb doesn't go into dmesg.
This patch replaces all %p by %px in kdb in order to display real addresses.
--- kernel/debug/kdb/kdb_main.c | 14 +++++++------- kernel/debug/kdb/kdb_support.c | 12 ++++++------ 2 files changed, 13 insertions(+), 13 deletions(-)
kernel/debug/kdb/kdb_main.c +7 -7
@@ -1192,7 +1192,7 @@ static int kdb_local(kdb_reason_t reasonif (reason ==KDB_REASON_DEBUG ) {/* special case below */ }else { -kdb_printf ("\nEntering kdb (current=0x%p, pid %d) " , +kdb_printf ("\nEntering kdb (current=0x%px, pid %d) " , kdb_current, kdb_current ? kdb_current->pid :0 );#if defined(CONFIG_SMP )kdb_printf ("on processor %d " ,raw_smp_processor_id ());
@@ -1208,7 +1208,7 @@ static int kdb_local(kdb_reason_t reason*/ switch (db_result) {case KDB_DB_BPT : -kdb_printf ("\nEntering kdb (0x%p, pid %d) " , +kdb_printf ("\nEntering kdb (0x%px, pid %d) " , kdb_current, kdb_current->pid);#if defined(CONFIG_SMP )kdb_printf ("on processor %d " ,raw_smp_processor_id ());
@@ -2048,7 +2048,7 @@ static int kdb_lsmod(int argc, const chaif (mod->state ==MODULE_STATE_UNFORMED )continue ; -kdb_printf ("%-20s%8u 0x%p " , mod->name, +kdb_printf ("%-20s%8u 0x%px " , mod->name, mod->core_layout.size, (void *)mod);#ifdef CONFIG_MODULE_UNLOAD kdb_printf ("%4d " ,module_refcount (mod));
@@ -2059,7 +2059,7 @@ static int kdb_lsmod(int argc, const chakdb_printf (" (Loading)" ); else kdb_printf(" (Live)"); -kdb_printf (" 0x%p" , mod->core_layout.base); +kdb_printf (" 0x%px" , mod->core_layout.base);#ifdef CONFIG_MODULE_UNLOAD {
@@ -2341,7 +2341,7 @@ void kdb_ps1(const struct task_struct *preturn ; cpu =kdb_process_cpu (p); - kdb_printf("0x%p %8d %8d %d %4d %c 0x%p %c%s\n", + kdb_printf("0x%px %8d %8d %d %4d %c 0x%px %c%s\n", (void *)p, p->pid, p->parent->pid, kdb_task_has_cpu(p), kdb_process_cpu(p), kdb_task_state_char(p),
@@ -2354,7 +2354,7 @@ void kdb_ps1(const struct task_struct *p }else {if (KDB_TSK (cpu) != p)kdb_printf (" Error: does not match running " -"process table (0x%p)\n" ,KDB_TSK (cpu)); +"process table (0x%px)\n" ,KDB_TSK (cpu)); } } }
@@ -2692,7 +2692,7 @@ int kdb_register_flags(char *cmd,for_each_kdbcmd (kp, i) {if (kp->cmd_name && (strcmp (kp->cmd_name, cmd) ==0 )) {kdb_printf ("Duplicate kdb command registered: " -"%s, func %p help %s\n" , cmd, func, help); +"%s, func %px help %s\n" , cmd, func, help);return 1 ; } }
kernel/debug/kdb/kdb_support.c +6 -6
@@ -40,7 +40,7 @@int kdbgetsymval (const char *symname,kdb_symtab_t *symtab) {if (KDB_DEBUG (AR )) -kdb_printf ("kdbgetsymval: symname=%s, symtab=%p\n" , symname, +kdb_printf ("kdbgetsymval: symname=%s, symtab=%px\n" , symname, symtab);memset (symtab,0 ,sizeof (*symtab)); symtab->sym_start =kallsyms_lookup_name (symname);
@@ -88,7 +88,7 @@ int kdbnearsym(unsigned long addr, kdb_schar *knt1 =NULL ;if (KDB_DEBUG (AR )) -kdb_printf ("kdbnearsym: addr=0x%lx, symtab=%p\n" , addr, symtab); +kdb_printf ("kdbnearsym: addr=0x%lx, symtab=%px\n" , addr, symtab);memset (symtab,0 ,sizeof (*symtab));if (addr <4096 )
@@ -149,7 +149,7 @@ int kdbnearsym(unsigned long addr, kdb_s symtab->mod_name ="kernel" ;if (KDB_DEBUG (AR ))kdb_printf ("kdbnearsym: returns %d symtab->sym_start=0x%lx, " -"symtab->mod_name=%p, symtab->sym_name=%p (%s)\n" , ret, +"symtab->mod_name=%px, symtab->sym_name=%px (%s)\n" , ret, symtab->sym_start, symtab->mod_name, symtab->sym_name, symtab->sym_name);
@@ -887,13 +887,13 @@ void debug_kusage(void) __func__, dah_first);if (dah_first) { h_used = (struct debug_alloc_header *)debug_alloc_pool; -kdb_printf ("%s: h_used %p size %d\n" , __func__, h_used, +kdb_printf ("%s: h_used %px size %d\n" , __func__, h_used, h_used->size); } do { h_used = (struct debug_alloc_header *) ((char *)h_free + dah_overhead + h_free->size); - kdb_printf("%s: h_used %p size %d caller %p\n", + kdb_printf("%s: h_used %px size %d caller %px\n", __func__, h_used, h_used->size, h_used->caller); h_free = (struct debug_alloc_header *) (debug_alloc_pool + h_free->next);
@@ -902,7 +902,7 @@ void debug_kusage(void) ((char *)h_free + dah_overhead + h_free->size);if ((char *)h_used - debug_alloc_pool !=sizeof (debug_alloc_pool_aligned)) -kdb_printf ("%s: h_used %p size %d caller %p\n" , +kdb_printf ("%s: h_used %px size %d caller %px\n" , __func__, h_used, h_used->size, h_used->caller); out:spin_unlock (&dap_lock);
Greg Kroah-Hartman
maintainerPATCH 155/205 sunrpc: correct the computation for page_ptr when truncating
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <[email protected]>
commit 5d7a5bcb67c70cbc904057ef52d3fcfeb24420bb upstream.
When truncating the encode buffer, the page_ptr is getting advanced, causing the next page to be skipped while encoding. The page is still included in the response, so the response contains a page of bogus data.
We need to adjust the page_ptr backwards to ensure we encode the next page into the correct place.
We saw this triggered when concurrent directory modifications caused nfsd4_encode_direct_fattr() to return nfserr_noent, and the resulting call to xdr_truncate_encode() corrupted the READDIR reply.
--- net/sunrpc/xdr.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/sunrpc/xdr.c +2 -3
@@ -639,11 +639,10 @@ void xdr_truncate_encode(struct xdr_streWARN_ON_ONCE (xdr->iov);return ; } -if (fraglen) { +if (fraglen) xdr->end = head->iov_base + head->iov_len; - xdr->page_ptr--; - }/* (otherwise assume xdr->end is already set) */ + xdr->page_ptr--; head->iov_len = len; buf->len = len; xdr->p = head->iov_base + head->iov_len;
Greg Kroah-Hartman
maintainerPATCH 156/205 NFSv4: Dont exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 21a446cf186570168b7281b154b1993968598aca upstream.
If we exit the NFSv4 state manager due to a umount, then we can end up leaving the NFS4CLNT_MANAGER_RUNNING flag set. If another mount causes the nfs4_client to be rereferenced before it is destroyed, then we end up never being able to recover state.
--- fs/nfs/nfs4state.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
fs/nfs/nfs4state.c +5 -3
@@ -2583,11 +2583,12 @@ static void nfs4_state_manager(struct nfnfs4_clear_state_manager_bit (clp);/* Did we race with an attempt to give us more work? */ if (clp->cl_state ==0 ) -break ; +return ;if (test_and_set_bit (NFS4CLNT_MANAGER_RUNNING , &clp->cl_state) !=0 ) -break ; +return ; }while (refcount_read (&clp->cl_count) >1 ); -return ; + goto out_drain; + out_error:if (strlen (section)) section_sep =": " ;
@@ -2595,6 +2596,7 @@ out_error:" with error %d\n" , section_sep, section, clp->cl_hostname, -status);ssleep (1 ); +out_drain:nfs4_end_drain_session (clp);nfs4_clear_state_manager_bit (clp); }
Greg Kroah-Hartman
maintainerPATCH 157/205 nfsd: COPY and CLONE operations require the saved filehandle to be set
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <[email protected]>
commit 01310bb7c9c98752cc763b36532fab028e0f8f81 upstream.
Make sure we have a saved filehandle, otherwise we'll oops with a null pointer dereference in nfs4_preprocess_stateid_op().
--- fs/nfsd/nfs4proc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfsd/nfs4proc.c +3 -0
@@ -1037,6 +1037,9 @@ nfsd4_verify_copy(struct svc_rqst *rqstp {__be32 status; +if (!cstate->save_fh.fh_dentry) +return nfserr_nofilehandle; + status =nfs4_preprocess_stateid_op (rqstp, cstate, &cstate->save_fh, src_stateid,RD_STATE , src,NULL );if (status) {
Greg Kroah-Hartman
maintainerPATCH 158/205 rtc: hctosys: Add missing range error reporting
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 7ce9a992ffde8ce93d5ae5767362a5c7389ae895 upstream.
Fix an issue with the 32-bit range error path in rtc_hctosys' where no error code is set and consequently the successful preceding call result from rtc_read_time' is propagated to rtc_hctosys_ret'. This in turn makes any subsequent call to hctosys_show' incorrectly report in sysfs that the system time has been set from this RTC while it has not.
Set the error to ERANGE then if we can't express the result due to an overflow.
--- drivers/rtc/hctosys.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/rtc/hctosys.c +3 -1
@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void) tv64.tv_sec =rtc_tm_to_time64 (&tm);#if BITS_PER_LONG ==32 -if (tv64.tv_sec >INT_MAX ) +if (tv64.tv_sec >INT_MAX ) { + err = -ERANGE ; goto err_read; + }#endif err =do_settimeofday64 (&tv64);
Greg Kroah-Hartman
maintainerPATCH 159/205 fuse: fix use-after-free in fuse_direct_IO()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Czerner <[email protected]>
commit ebacb81273599555a7a19f7754a1451206a5fc4f upstream.
In async IO blocking case the additional reference to the io is taken for it to survive fuse_aio_complete(). In non blocking case this additional reference is not needed, however we still reference io to figure out whether to wait for completion or not. This is wrong and will lead to use-after-free. Fix it by storing blocking information in separate variable.
This was spotted by KASAN when running generic/208 fstest.
--- fs/fuse/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/fuse/file.c +3 -1
@@ -2913,10 +2913,12 @@ fuse_direct_IO(struct kiocb *iocb, struc }if (io->async) { +bool blocking = io->blocking; +fuse_aio_complete (io, ret <0 ? ret :0 ,-1 );/* we have a non-extending, async request, so return */ -if (!io->blocking) +if (!blocking)return -EIOCBQUEUED ;wait_for_completion (&wait);
Greg Kroah-Hartman
maintainerPATCH 160/205 fuse: fix leaked notify reply
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 7fabaf303458fcabb694999d6fa772cc13d4e217 upstream.
fuse_request_send_notify_reply() may fail if the connection was reset for some reason (e.g. fs was unmounted). Don't leak request reference in this case. Besides leaking memory, this resulted in fc->num_waiting not being decremented and hence fuse_wait_aborted() left in a hanging and unkillable state.
--- fs/fuse/dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/fuse/dev.c +3 -1
@@ -1724,8 +1724,10 @@ static int fuse_retrieve(struct fuse_con req->in.args[1 ].size = total_len; err =fuse_request_send_notify_reply (fc, req, outarg->notify_unique); -if (err) +if (err) {fuse_retrieve_end (fc, req); +fuse_put_request (fc, req); + }return err; }
Greg Kroah-Hartman
maintainerPATCH 161/205 fuse: fix possibly missed wake-up after abort
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 2d84a2d19b6150c6dbac1e6ebad9c82e4c123772 upstream.
In current fuse_drop_waiting() implementation it's possible that fuse_wait_aborted() will not be woken up in the unlikely case that fuse_abort_conn() + fuse_wait_aborted() runs in between checking fc->connected and calling atomic_dec(&fc->num_waiting).
Do the atomic_dec_and_test() unconditionally, which also provides the necessary barrier against reordering with the fc->connected check.
The explicit smp_mb() in fuse_wait_aborted() is not actually needed, since the spin_unlock() in fuse_abort_conn() provides the necessary RELEASE barrier after resetting fc->connected. However, this is not a performance sensitive path, and adding the explicit barrier makes it easier to document.
--- fs/fuse/dev.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/fuse/dev.c +9 -3
@@ -129,9 +129,13 @@ static bool fuse_block_alloc(struct fusestatic void fuse_drop_waiting (struct fuse_conn *fc) { -if (fc->connected) { -atomic_dec (&fc->num_waiting); - }else if (atomic_dec_and_test (&fc->num_waiting)) { +/* +* lockess check of fc->connected is okay, because atomic_dec_and_test() +* provides a memory barrier mached with the one in fuse_wait_aborted() +* to ensure no wake-up is missed. +*/ +if (atomic_dec_and_test (&fc->num_waiting) && + !READ_ONCE (fc->connected)) {/* wake up aborters */ wake_up_all (&fc->blocked_waitq); }
@@ -2167,6 +2171,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);void fuse_wait_aborted (struct fuse_conn *fc) { +/* matches implicit memory barrier in fuse_drop_waiting() */ +smp_mb ();wait_event (fc->blocked_waitq,atomic_read (&fc->num_waiting) ==0 ); }