4.14.106-stable review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 4.14.106-stable review
This is the start of the stable review cycle for the 4.14.106 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 14 17:02:27 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.106-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.106-rc1
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Implement support for TSX Force Abort
Peter Zijlstra (Intel) <[email protected]>
x86: Add TSX Force Abort CPUID/MSR
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Generalize dynamic constraint creation
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Make cpuc allocations consistent
Geert Uytterhoeven <[email protected]>
driver core: Postpone DMA tear-down until after devres release
Daniel F. Dickinson <[email protected]>
ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom
Andreas Gruenbacher <[email protected]>
gfs2: Fix missed wakeups in find_insert_glock
Vincent Whitchurch <[email protected]>
ARM: 8781/1: Fix Thumb-2 syscall return for binutils 2.29+
Ard Biesheuvel <[email protected]>
drm: disable uncached DMA optimization for ARM and arm64
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3
Jan Kiszka <[email protected]>
arm64: dts: hikey: Give wifi some time after power-on
Gustavo A. R. Silva <[email protected]>
scsi: aacraid: Fix missing break in switch statement
Gustavo A. R. Silva <[email protected]>
iscsi_ibft: Fix missing break in switch statement
Vincent Batts <[email protected]>
Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
Jason Gerecke <[email protected]>
Input: wacom_serial4 - add support for Wacom ArtPad II tablet
Sudarsana Reddy Kalluru <[email protected]>
qed: Consider TX tcs while deriving the max num_queues for PF.
Manish Chopra <[email protected]>
qed: Fix EQ full firmware assert.
Tetsuo Handa <[email protected]>
fs: ratelimit __find_get_block_slow() failure message.
Tony Lindgren <[email protected]>
i2c: omap: Use noirq system sleep pm ops to idle device for suspend
Jun-Ru Chang <[email protected]>
MIPS: Remove function size check in get_frame_info()
Huacai Chen <[email protected]>
MIPS: Loongson: Introduce and use loongson_llsc_mb()
Arnaldo Carvalho de Melo <[email protected]>
perf trace: Support multiple "vfs_getname" probes
Jiri Olsa <[email protected]>
perf symbols: Filter out hidden symbols from labels
Julian Wiedmann <[email protected]>
s390/qeth: fix use-after-free in error path
Martynas Pumputis <[email protected]>
netfilter: nf_nat: skip nat clash resolution for same-origin entries
Florian Westphal <[email protected]>
selftests: netfilter: add simple masq/redirect test cases
Naresh Kamboju <[email protected]>
selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET
Andy Shevchenko <[email protected]>
dmaengine: dmatest: Abort test in case of mapping error
Stefano Garzarella <[email protected]>
vsock/virtio: reset connected sockets on device removal
Stefano Garzarella <[email protected]>
vsock/virtio: fix kernel panic after device hot-unplug
Codrin Ciubotariu <[email protected]>
dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
Paul Kocialkowski <[email protected]>
drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init
Alexei Starovoitov <[email protected]>
bpf: fix lockdep false positive in percpu_freelist
Martynas Pumputis <[email protected]>
bpf, selftests: fix handling of sparse CPU allocations
Greg Kroah-Hartman <[email protected]>
relay: check return of create_buf_file() properly
Zenghui Yu <[email protected]>
irqchip/gic-v3-its: Fix ITT_entry_size accessor
Jose Abreu <[email protected]>
net: stmmac: Disable EEE mode earlier in XMIT callback
Jose Abreu <[email protected]>
net: stmmac: Send TSO packets always from Queue 0
Jose Abreu <[email protected]>
net: stmmac: Fallback to Platform Data clock in Watchdog conversion
Lubomir Rintel <[email protected]>
irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
Anders Roxell <[email protected]>
usb: phy: fix link errors
Zhou Yanjie <[email protected]>
DTS: CI20: Fix bugs in ci20's device tree.
Srinivas Kandagatla <[email protected]>
arm64: dts: add msm8996 compatible to gicv3
Peng Hao <[email protected]>
ARM: pxa: ssp: unneeded to free devm_ allocated data
Yafang Shao <[email protected]>
bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt()
Madalin Bucur <[email protected]>
soc: fsl: qbman: avoid race in clearing QMan interrupt
Geert Uytterhoeven <[email protected]>
arm64: dts: renesas: r8a7796: Enable DMA for SCIF2
Tony Lindgren <[email protected]>
ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags
Ian Kent <[email protected]>
autofs: fix error return in autofs_fill_super()
Pan Bian <[email protected]>
autofs: drop dentry reference only when it is never used
Jan Kara <[email protected]>
fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
Dan Carpenter <[email protected]>
lib/test_kmod.c: potential double free in error handling
Mikhail Zaslonko <[email protected]>
mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
Michal Hocko <[email protected]>
mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
Qian Cai <[email protected]>
x86_64: increase stack size for KASAN_EXTRA
Kairui Song <[email protected]>
x86/kexec: Don't setup EFI info if EFI runtime is not enabled
John Johansen <[email protected]>
apparmor: Fix aa_label_build() error handling for failed merges
James Morse <[email protected]>
arm64: kprobe: Always blacklist the KVM world-switch code
Thomas Lendacky <[email protected]>
x86/microcode/amd: Don't falsely trick the late loading mechanism
Ronnie Sahlberg <[email protected]>
cifs: fix computation for MAX_SMB2_HDR_SIZE
Sinan Kaya <[email protected]>
platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
Dan Carpenter <[email protected]>
scsi: 53c700: pass correct "dev" to dma_alloc_attrs()
Ming Lu <[email protected]>
scsi: libfc: free skb when receiving invalid flogi resp
Manish Chopra <[email protected]>
qed: Fix stack out of bounds bug
Manish Chopra <[email protected]>
qed: Fix system crash in ll2 xmit
Manish Chopra <[email protected]>
qed: Fix VF probe failure while FLR
Manish Chopra <[email protected]>
qed: Fix LACP pdu drops for VFs
Manish Chopra <[email protected]>
qed: Fix bug in tx promiscuous mode settings
Yao Liu <[email protected]>
nfs: Fix NULL pointer dereference of dev_name
Fathi Boudra <[email protected]>
selftests: timers: use LDLIBS instead of LDFLAGS
Andrew Lunn <[email protected]>
gpio: vf610: Mask all GPIO interrupts
Florian Westphal <[email protected]>
netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present
Alexey Khoroshilov <[email protected]>
net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
Yonglong Liu <[email protected]>
net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
Yonglong Liu <[email protected]>
net: hns: Restart autoneg need return failed when autoneg off
Yonglong Liu <[email protected]>
net: hns: Fix for missing of_node_put() after of_parse_phandle()
Tomonori Sakita <[email protected]>
net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
Max Filippov <[email protected]>
xtensa: SMP: limit number of possible CPUs by NR_CPUS
Max Filippov <[email protected]>
xtensa: SMP: mark each possible CPU as present
Max Filippov <[email protected]>
xtensa: smp_lx200_defconfig: fix vectors clash
Max Filippov <[email protected]>
xtensa: SMP: fix secondary CPU initialization
Colin Ian King <[email protected]>
selftests: cpu-hotplug: fix case where CPUs offline > CPUs present
Max Filippov <[email protected]>
xtensa: SMP: fix ccount_timer_shutdown
Suravee Suthikulpanit <[email protected]>
iommu/amd: Fix IOMMU page flush when detach device from a domain
ZhangXiaoxu <[email protected]>
ipvs: Fix signed integer overflow when setsockopt timeout
Jerry Snitselaar <[email protected]>
iommu/amd: Unmap all mapped pages in error path of map_sg
Jerry Snitselaar <[email protected]>
iommu/amd: Call free_iova_fast with pfn in map_sg
Brian Welty <[email protected]>
IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
Stephane Eranian <[email protected]>
perf tools: Handle TOPOLOGY headers with no CPU
Stephane Eranian <[email protected]>
perf core: Fix perf_proc_update_handler() bug
Su Yanjun <[email protected]>
vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
Alistair Strachan <[email protected]>
media: uvcvideo: Fix 'type' check leading to overflow
Martin Wilck <[email protected]>
scsi: core: reset host byte in DID_NEXUS_FAILURE case
YueHaibing <[email protected]>
exec: Fix mem leak in kernel_read_file
Matthias Kaehlcke <[email protected]>
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
Max Filippov <[email protected]>
xtensa: fix get_wchan
Mike Kravetz <[email protected]>
hugetlbfs: fix races and page leaks during migration
Liu Xiang <[email protected]>
MIPS: irq: Allocate accurate order pages for irq stack
Gustavo A. R. Silva <[email protected]>
applicom: Fix potential Spectre v1 vulnerabilities
Jiaxun Yang <[email protected]>
x86/CPU/AMD: Set the CPB bit unconditionally on F17h
Andrew Lunn <[email protected]>
net: dsa: mv88e6xxx: Fix statistics on mv88e6161
Rajasingh Thavamani <[email protected]>
net: phy: Micrel KSZ8061: link failure after cable connect
Timur Celik <[email protected]>
tun: remove unnecessary memory barrier
Timur Celik <[email protected]>
tun: fix blocking read
David Ahern <[email protected]>
mpls: Return error for RTA_GATEWAY attribute
David Ahern <[email protected]>
ipv6: Return error for RTA_VIA attribute
David Ahern <[email protected]>
ipv4: Return error for RTA_VIA attribute
Nazarov Sergey <[email protected]>
net: avoid use IPCB in cipso_v4_error
Nazarov Sergey <[email protected]>
net: Add __icmp_send helper.
Igor Druzhinin <[email protected]>
xen-netback: fix occasional leak of grant ref mappings under memory pressure
Igor Druzhinin <[email protected]>
xen-netback: don't populate the hash cache on XenBus disconnect
Eric Biggers <[email protected]>
net: socket: set sock->sk to NULL after calling proto_ops::release()
Mao Wenan <[email protected]>
net: sit: fix memory leak in sit_init_net()
Heiner Kallweit <[email protected]>
net: phy: phylink: fix uninitialized variable in phylink_get_mac_state
YueHaibing <[email protected]>
net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
Sheng Lan <[email protected]>
net: netem: fix skb length BUG_ON in __skb_to_sgvec
Paul Moore <[email protected]>
netlabel: fix out-of-bounds memory accesses
Andrew Lunn <[email protected]>
net: dsa: mv88e6xxx: Fix u64 statistics
Haiyang Zhang <[email protected]>
hv_netvsc: Fix IP header checksum for coalesced packets
Jiri Benc <[email protected]>
geneve: correctly handle ipv6.disable module parameter
Michael Chan <[email protected]>
bnxt_en: Drop oversize TX packets to prevent errors.
Erik Hugne <[email protected]>
tipc: fix RDM/DGRAM connect() regression
Ido Schimmel <[email protected]>
team: Free BPF filter when unregistering netdev
Kai-Heng Feng <[email protected]>
sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
YueHaibing <[email protected]>
net-sysfs: Fix mem leak in netdev_register_kobject
Heiner Kallweit <[email protected]>
net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in mv88e6xxx_port_set_duplex
Ido Schimmel <[email protected]>
ip6mr: Do not call __IP6_INC_STATS() from preemptible context
Qing Xia <[email protected]>
staging: android: ion: fix sys heap pool's gfp_flags
Ajay Singh <[email protected]>
staging: wilc1000: fix to set correct value for 'vif_num'
Gustavo A. R. Silva <[email protected]>
staging: comedi: ni_660x: fix missing break in switch statement
Mans Rullgard <[email protected]>
USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
Ivan Mironov <[email protected]>
USB: serial: cp210x: add ID for Ingenico 3070
Daniele Palmas <[email protected]>
USB: serial: option: add Telit ME910 ECM composition
Viresh Kumar <[email protected]>
cpufreq: Use struct kobj_attribute instead of struct global_attr
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/exynos3250.dtsi | 3 + arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 13 +- arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 2 +- arch/arm/kernel/entry-common.S | 4 +- arch/arm/plat-pxa/ssp.c | 3 - arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 1 + arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- arch/arm64/boot/dts/renesas/r8a7796.dtsi | 3 + arch/arm64/kernel/probes/kprobes.c | 6 +- arch/mips/Kconfig | 15 + arch/mips/boot/dts/ingenic/ci20.dts | 8 +- arch/mips/include/asm/atomic.h | 6 + arch/mips/include/asm/barrier.h | 36 + arch/mips/include/asm/bitops.h | 5 + arch/mips/include/asm/futex.h | 3 + arch/mips/include/asm/pgtable.h | 2 + arch/mips/kernel/irq.c | 4 +- arch/mips/kernel/process.c | 7 +- arch/mips/loongson64/Platform | 23 + arch/mips/mm/tlbex.c | 10 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 154 ++++- arch/x86/events/perf_event.h | 17 +- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 6 + arch/x86/include/asm/page_64_types.h | 4 + arch/x86/kernel/cpu/amd.c | 8 +- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/kexec-bzimage64.c | 3 + arch/xtensa/configs/smp_lx200_defconfig | 1 + arch/xtensa/kernel/head.S | 5 +- arch/xtensa/kernel/process.c | 4 +- arch/xtensa/kernel/smp.c | 41 +- arch/xtensa/kernel/time.c | 2 +- drivers/base/dd.c | 2 +- drivers/char/applicom.c | 35 +- drivers/cpufreq/cpufreq.c | 6 +- drivers/cpufreq/intel_pstate.c | 18 +- drivers/dma/at_xdmac.c | 19 +- drivers/dma/dmatest.c | 28 +- drivers/firmware/iscsi_ibft.c | 1 + drivers/gpio/gpio-vf610.c | 5 + drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 + drivers/i2c/busses/i2c-omap.c | 13 +- drivers/infiniband/hw/hfi1/ud.c | 1 - drivers/infiniband/hw/qib/qib_ud.c | 1 - drivers/input/mouse/elan_i2c_core.c | 1 + drivers/input/tablet/wacom_serial4.c | 2 + drivers/iommu/amd_iommu.c | 19 +- drivers/irqchip/irq-mmp.c | 6 +- drivers/media/usb/uvc/uvc_driver.c | 14 +- drivers/net/dsa/mv88e6xxx/chip.c | 4 +- drivers/net/dsa/mv88e6xxx/port.c | 2 +- drivers/net/ethernet/altera/altera_msgdma.c | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 + drivers/net/ethernet/hisilicon/hns/hns_enet.c | 5 + drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 16 +- drivers/net/ethernet/hisilicon/hns_mdio.c | 2 +- drivers/net/ethernet/marvell/sky2.c | 24 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 8 +- drivers/net/ethernet/qlogic/qed/qed_l2.c | 17 +- drivers/net/ethernet/qlogic/qed/qed_l2.h | 3 + drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 +- drivers/net/ethernet/qlogic/qed/qed_sp.h | 1 + drivers/net/ethernet/qlogic/qed/qed_spq.c | 15 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 10 +- drivers/net/ethernet/qlogic/qed/qed_vf.c | 10 + drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 4 +- .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 17 +- drivers/net/geneve.c | 11 +- drivers/net/hyperv/netvsc_drv.c | 22 +- drivers/net/phy/micrel.c | 13 +- drivers/net/phy/phylink.c | 4 + drivers/net/team/team_mode_loadbalance.c | 15 + drivers/net/tun.c | 4 +- drivers/net/wireless/ath/ath9k/init.c | 6 +- drivers/net/xen-netback/hash.c | 2 + drivers/net/xen-netback/interface.c | 7 + drivers/net/xen-netback/netback.c | 10 +- drivers/platform/x86/Kconfig | 1 + drivers/s390/net/qeth_core_main.c | 15 +- drivers/scsi/53c700.c | 2 +- drivers/scsi/aacraid/commsup.c | 5 +- drivers/scsi/libfc/fc_lport.c | 6 +- drivers/scsi/scsi_lib.c | 1 + drivers/soc/fsl/qbman/qman.c | 9 +- drivers/staging/android/ion/ion_system_heap.c | 2 +- drivers/staging/comedi/drivers/ni_660x.c | 1 + drivers/staging/wilc1000/linux_wlan.c | 4 +- drivers/usb/phy/Kconfig | 2 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 6 + drivers/usb/serial/option.c | 2 + fs/autofs4/expire.c | 3 +- fs/autofs4/inode.c | 4 +- fs/buffer.c | 19 +- fs/cifs/smb2pdu.h | 4 +- fs/drop_caches.c | 8 +- fs/exec.c | 2 +- fs/gfs2/glock.c | 2 +- fs/hugetlbfs/inode.c | 12 + fs/nfs/super.c | 5 + include/drm/drm_cache.h | 18 + include/linux/cpufreq.h | 12 +- include/linux/irqchip/arm-gic-v3.h | 2 +- include/linux/stmmac.h | 1 + include/net/bluetooth/bluetooth.h | 2 +- include/net/icmp.h | 9 +- include/net/ip.h | 2 + kernel/bpf/hashtab.c | 4 +- kernel/bpf/percpu_freelist.c | 41 +- kernel/bpf/percpu_freelist.h | 4 + kernel/events/core.c | 14 +- kernel/relay.c | 4 +- lib/test_kmod.c | 2 +- mm/hugetlb.c | 16 +- mm/memory_hotplug.c | 6 +- mm/migrate.c | 11 + net/bluetooth/af_bluetooth.c | 16 +- net/bluetooth/l2cap_sock.c | 2 +- net/bluetooth/rfcomm/sock.c | 2 +- net/bluetooth/sco.c | 2 +- net/bridge/netfilter/ebtables.c | 9 +- net/core/filter.c | 2 + net/core/net-sysfs.c | 3 + net/ipv4/cipso_ipv4.c | 20 +- net/ipv4/fib_frontend.c | 4 + net/ipv4/icmp.c | 7 +- net/ipv4/ip_options.c | 22 +- net/ipv4/ip_vti.c | 50 ++ net/ipv6/ip6mr.c | 8 +- net/ipv6/route.c | 4 + net/ipv6/sit.c | 1 + net/mpls/af_mpls.c | 3 + net/netfilter/ipvs/ip_vs_ctl.c | 12 + net/netfilter/nf_conntrack_core.c | 16 + net/netlabel/netlabel_kapi.c | 3 +- net/nfc/llcp_commands.c | 20 + net/nfc/llcp_core.c | 24 +- net/sched/sch_netem.c | 10 +- net/socket.c | 1 + net/tipc/socket.c | 2 +- net/vmw_vsock/virtio_transport.c | 29 +- security/apparmor/domain.c | 5 +- tools/perf/builtin-trace.c | 25 +- tools/perf/util/cpumap.c | 11 +- tools/perf/util/symbol-elf.c | 9 +- tools/testing/selftests/bpf/bpf_util.h | 30 +- .../selftests/cpu-hotplug/cpu-on-off-test.sh | 13 +- tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/config | 2 +- tools/testing/selftests/netfilter/nft_nat.sh | 762 +++++++++++++++++++++ tools/testing/selftests/timers/Makefile | 2 +- 156 files changed, 1893 insertions(+), 375 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/135 cpufreq: Use struct kobj_attribute instead of struct global_attr
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit 625c85a62cb7d3c79f6e16de3cfa972033658250 upstream.
The cpufreq_global_kobject is created using kobject_create_and_add() helper, which assigns the kobj_type as dynamic_kobj_ktype and show/store routines are set to kobj_attr_show() and kobj_attr_store().
These routines pass struct kobj_attribute as an argument to the show/store callbacks. But all the cpufreq files created using the cpufreq_global_kobject expect the argument to be of type struct attribute. Things work fine currently as no one accesses the "attr" argument. We may not see issues even if the argument is used, as struct kobj_attribute has struct attribute as its first element and so they will both get same address.
But this is logically incorrect and we should rather use struct kobj_attribute instead of struct global_attr in the cpufreq core and drivers and the show/store callbacks should take struct kobj_attribute as argument instead.
This bug is caught using CFI CLANG builds in android kernel which catches mismatch in function prototypes for such callbacks.
--- drivers/cpufreq/cpufreq.c | 6 +++--- drivers/cpufreq/intel_pstate.c | 18 +++++++++--------- include/linux/cpufreq.h | 12 ++---------- 3 files changed, 14 insertions(+), 22 deletions(-)
drivers/cpufreq/cpufreq.c +3 -3
@@ -554,13 +554,13 @@ EXPORT_SYMBOL_GPL(cpufreq_policy_transit* SYSFS INTERFACE * *********************************************************************/ static ssize_t show_boost (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {return sprintf (buf,"%d\n" , cpufreq_driver->boost_enabled); } -static ssize_t store_boost (struct kobject *kobj,struct attribute *attr, -const char *buf,size_t count) +static ssize_t store_boost (struct kobject *kobj,struct kobj_attribute *attr, +const char *buf,size_t count) {int ret, enable;
drivers/cpufreq/intel_pstate.c +9 -9
@@ -811,7 +811,7 @@ static void intel_pstate_update_policies/************************** sysfs begin ************************/ #define show_one (file_name, object) \ static ssize_t show_##file_name \ - (struct kobject *kobj, struct attribute *attr, char *buf) \ + (struct kobject *kobj, struct kobj_attribute *attr, char *buf) \ { \ return sprintf(buf, "%u\n", global.object); \ }
@@ -820,7 +820,7 @@ static ssize_t intel_pstate_show_status(static int intel_pstate_update_status (const char *buf,size_t size);static ssize_t show_status (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {ssize_t ret;
@@ -831,7 +831,7 @@ static ssize_t show_status(struct kobjecreturn ret; } -static ssize_t store_status (struct kobject *a,struct attribute *b, +static ssize_t store_status (struct kobject *a,struct kobj_attribute *b,const char *buf,size_t count) {char *p =memchr (buf,'\n' , count);
@@ -845,7 +845,7 @@ static ssize_t store_status(struct kobje }static ssize_t show_turbo_pct (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {struct cpudata *cpu;int total, no_turbo, turbo_pct;
@@ -871,7 +871,7 @@ static ssize_t show_turbo_pct(struct kob }static ssize_t show_num_pstates (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {struct cpudata *cpu;int total;
@@ -892,7 +892,7 @@ static ssize_t show_num_pstates(struct k }static ssize_t show_no_turbo (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {ssize_t ret;
@@ -914,7 +914,7 @@ static ssize_t show_no_turbo(struct kobjreturn ret; } -static ssize_t store_no_turbo (struct kobject *a,struct attribute *b, +static ssize_t store_no_turbo (struct kobject *a,struct kobj_attribute *b,const char *buf,size_t count) {unsigned int input;
@@ -961,7 +961,7 @@ static ssize_t store_no_turbo(struct kobreturn count; } -static ssize_t store_max_perf_pct (struct kobject *a,struct attribute *b, +static ssize_t store_max_perf_pct (struct kobject *a,struct kobj_attribute *b,const char *buf,size_t count) {unsigned int input;
@@ -991,7 +991,7 @@ static ssize_t store_max_perf_pct(structreturn count; } -static ssize_t store_min_perf_pct (struct kobject *a,struct attribute *b, +static ssize_t store_min_perf_pct (struct kobject *a,struct kobj_attribute *b,const char *buf,size_t count) {unsigned int input;
include/linux/cpufreq.h +2 -10
@@ -254,20 +254,12 @@ __ATTR(_name, 0644, show_##_name, store_static struct freq_attr _name = \ __ATTR(_name, 0200, NULL, store_##_name) -struct global_attr { -struct attribute attr; -ssize_t (*show)(struct kobject *kobj, -struct attribute *attr,char *buf); -ssize_t (*store)(struct kobject *a,struct attribute *b, -const char *c,size_t count); -}; -#define define_one_global_ro (_name) \ -static struct global_attr _name = \ +static struct kobj_attribute _name = \ __ATTR(_name, 0444, show_##_name, NULL)#define define_one_global_rw (_name) \ -static struct global_attr _name = \ +static struct kobj_attribute _name = \ __ATTR(_name, 0644, show_##_name, store_##_name)
Greg Kroah-Hartman
maintainerPATCH 2/135 USB: serial: option: add Telit ME910 ECM composition
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 6431866b6707d27151be381252d6eef13025cfce upstream.
This patch adds Telit ME910 family ECM composition 0x1102.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1151,6 +1151,8 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */ + .driver_info = NCTRL(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
Greg Kroah-Hartman
maintainerPATCH 3/135 USB: serial: cp210x: add ID for Ingenico 3070
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Mironov <[email protected]>
commit dd9d3d86b08d6a106830364879c42c78db85389c upstream.
Here is how this device appears in kernel log:
usb 3-1: new full-speed USB device number 18 using xhci_hcd usb 3-1: New USB device found, idVendor=0b00, idProduct=3070 usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 3-1: Product: Ingenico 3070
usb 3-1: Manufacturer: Silicon Labs
usb 3-1: SerialNumber: 0001
Apparently this is a POS terminal with embedded USB-to-Serial converter.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -64,6 +64,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ + { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
Greg Kroah-Hartman
maintainerPATCH 4/135 USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mans Rullgard <[email protected]>
commit 8d7fa3d4ea3f0ca69554215e87411494e6346fdc upstream.
This adds the USB ID of the Hjelmslund Electronics USB485 Iso stick.
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 8 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -1020,6 +1020,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) }, +/* EZPrototypes devices */ + { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -1309,6 +1309,12 @@#define IONICS_PLUGCOMPUTER_PID 0x0102/* +* EZPrototypes (PID reseller) +*/ +#define EZPROTOTYPES_VID 0x1c40 +#define HJELMSLUND_USB485_ISO_PID 0x0477 + +/* * Dresden Elektronik Sensor Terminal Board */ #define DE_VID 0x1cf1/* Vendor ID */
Greg Kroah-Hartman
maintainerPATCH 5/135 staging: comedi: ni_660x: fix missing break in switch statement
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit 479826cc86118e0d87e5cefb3df5b748e0480924 upstream.
Add missing break statement in order to prevent the code from falling through to the default case and return -EINVAL every time.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/staging/comedi/drivers/ni_660x.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/comedi/drivers/ni_660x.c +1 -0
@@ -611,6 +611,7 @@ static int ni_660x_set_pfi_routing(struccase NI_660X_PFI_OUTPUT_DIO :if (chan >31 )return -EINVAL ; +break ;default :return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 6/135 staging: wilc1000: fix to set correct value for vif_num
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ajay Singh <[email protected]>
commit dda037057a572f5c82ac2499eb4e6fb17600ba3e upstream.
Set correct value in '->vif_num' for the total number of interfaces and set '->idx' value using 'i'.
--- drivers/staging/wilc1000/linux_wlan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/wilc1000/linux_wlan.c +2 -2
@@ -1238,8 +1238,8 @@ int wilc_netdev_init(struct wilc **wilc, vif->wilc = *wilc; vif->ndev = ndev; wl->vif[i] = vif; - wl->vif_num = i; - vif->idx = wl->vif_num; + wl->vif_num = i +1 ; + vif->idx = i; ndev->netdev_ops = &wilc_netdev_ops;
Greg Kroah-Hartman
maintainerPATCH 7/135 staging: android: ion: fix sys heap pools gfp_flags
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qing Xia <[email protected]>
commit 9bcf065e28122588a6cbee08cf847826dacbb438 upstream.
In the first loop, gfp_flags will be modified to high_order_gfp_flags, and there will be no chance to change back to low_order_gfp_flags.
--- drivers/staging/android/ion/ion_system_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/android/ion/ion_system_heap.c +1 -1
@@ -298,10 +298,10 @@ static int ion_system_heap_create_pools( bool cached) {int i; -gfp_t gfp_flags = low_order_gfp_flags;for (i =0 ; i <NUM_ORDERS ; i++) {struct ion_page_pool *pool; +gfp_t gfp_flags = low_order_gfp_flags;if (orders[i] >4 ) gfp_flags = high_order_gfp_flags;
Greg Kroah-Hartman
maintainerPATCH 8/135 ip6mr: Do not call __IP6_INC_STATS() from preemptible context
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 87c11f1ddbbad38ad8bad47af133a8208985fbdf ]
Similar to commit 44f49dd8b5a6 ("ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context."), we cannot assume preemption is disabled when incrementing the counter and accessing a per-CPU variable.
Preemption can be enabled when we add a route in process context that corresponds to packets stored in the unresolved queue, which are then forwarded using this route [1].
Fix this by using IP6_INC_STATS() which takes care of disabling preemption on architectures where it is needed.
[1]
[ 157.451447] BUG: using __this_cpu_add() in preemptible [00000000] code: smcrouted/2314 [ 157.460409] caller is ip6mr_forward2+0x73e/0x10e0 [ 157.460434] CPU: 3 PID: 2314 Comm: smcrouted Not tainted 5.0.0-rc7-custom-03635-g22f2712113f1 #1336 [ 157.460449] Hardware name: Mellanox Technologies Ltd. MSN2100-CB2FO/SA001017, BIOS 5.6.5 06/07/2016 [ 157.460461] Call Trace: [ 157.460486] dump_stack+0xf9/0x1be [ 157.460553] check_preemption_disabled+0x1d6/0x200 [ 157.460576] ip6mr_forward2+0x73e/0x10e0 [ 157.460705] ip6_mr_forward+0x9a0/0x1510 [ 157.460771] ip6mr_mfc_add+0x16b3/0x1e00 [ 157.461155] ip6_mroute_setsockopt+0x3cb/0x13c0 [ 157.461384] do_ipv6_setsockopt.isra.8+0x348/0x4060 [ 157.462013] ipv6_setsockopt+0x90/0x110 [ 157.462036] rawv6_setsockopt+0x4a/0x120 [ 157.462058] __sys_setsockopt+0x16b/0x340 [ 157.462198] __x64_sys_setsockopt+0xbf/0x160 [ 157.462220] do_syscall_64+0x14d/0x610 [ 157.462349] entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- net/ipv6/ip6mr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ipv6/ip6mr.c +4 -4
@@ -2002,10 +2002,10 @@ int ip6mr_compat_ioctl(struct sock *sk,static inline int ip6mr_forward2_finish (struct net *net,struct sock *sk,struct sk_buff *skb) { -__IP6_INC_STATS (net,ip6_dst_idev (skb_dst (skb)), -IPSTATS_MIB_OUTFORWDATAGRAMS ); -__IP6_ADD_STATS (net,ip6_dst_idev (skb_dst (skb)), -IPSTATS_MIB_OUTOCTETS , skb->len); +IP6_INC_STATS (net,ip6_dst_idev (skb_dst (skb)), +IPSTATS_MIB_OUTFORWDATAGRAMS ); +IP6_ADD_STATS (net,ip6_dst_idev (skb_dst (skb)), +IPSTATS_MIB_OUTOCTETS , skb->len);return dst_output (net, sk, skb); }
Greg Kroah-Hartman
maintainerPATCH 9/135 net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in mv88e6xxx_port_set_duplex
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit c6195a8bdfc62a7cecf7df685e64847a4b700275 ]
When testing another issue I faced the problem that mv88e6xxx_port_setup_mac() failed due to DUPLEX_UNKNOWN being passed as argument to mv88e6xxx_port_set_duplex(). We should handle this case gracefully and return -EOPNOTSUPP, like e.g. mv88e6xxx_port_set_speed() is doing it.
--- drivers/net/dsa/mv88e6xxx/port.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/port.c +1 -1
@@ -165,7 +165,7 @@ int mv88e6xxx_port_set_duplex(struct mv8/* normal duplex detection */ break ;default : -return -EINVAL ; +return -EOPNOTSUPP ; } err =mv88e6xxx_port_write (chip, port,MV88E6XXX_PORT_MAC_CTL , reg);
Greg Kroah-Hartman
maintainerPATCH 10/135 net-sysfs: Fix mem leak in netdev_register_kobject
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
[ Upstream commit 895a5e96dbd6386c8e78e5b78e067dcc67b7f0ab ]
syzkaller report this:
BUG: memory leak
unreferenced object 0xffff88837a71a500 (size 256):
comm "syz-executor.2", pid 9770, jiffies 4297825125 (age 17.843s)
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 20 c0 ef 86 ff ff ff ff ........ .......
backtrace:
[<00000000db12624b>] netdev_register_kobject+0x124/0x2e0 net/core/net-sysfs.c:1751
[<00000000dc49a994>] register_netdevice+0xcc1/0x1270 net/core/dev.c:8516
[<00000000e5f3fea0>] tun_set_iff drivers/net/tun.c:2649 [inline]
[<00000000e5f3fea0>] __tun_chr_ioctl+0x2218/0x3d20 drivers/net/tun.c:2883
[<000000001b8ac127>] vfs_ioctl fs/ioctl.c:46 [inline]
[<000000001b8ac127>] do_vfs_ioctl+0x1a5/0x10e0 fs/ioctl.c:690
[<0000000079b269f8>] ksys_ioctl+0x89/0xa0 fs/ioctl.c:705
[<00000000de649beb>] __do_sys_ioctl fs/ioctl.c:712 [inline]
[<00000000de649beb>] __se_sys_ioctl fs/ioctl.c:710 [inline]
[<00000000de649beb>] __x64_sys_ioctl+0x74/0xb0 fs/ioctl.c:710
[<000000007ebded1e>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
[<00000000db315d36>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000115be9bb>] 0xffffffffffffffffIt should call kset_unregister to free 'dev->queues_kset'
in error path of register_queue_kobjects, otherwise will cause a mem leak.
--- net/core/net-sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/net-sysfs.c +3 -0
@@ -1402,6 +1402,9 @@ static int register_queue_kobjects(struc error:netdev_queue_update_kobjects (dev, txq,0 );net_rx_queue_update_kobjects (dev, rxq,0 ); +#ifdef CONFIG_SYSFS +kset_unregister (dev->queues_kset); +#endif return error; }
Greg Kroah-Hartman
maintainerPATCH 11/135 sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit b33b7cd6fd86478dd2890a9abeb6f036aa01fdf7 ]
Some sky2 chips fire IRQ after S3, before the driver is fully resumed:
[ 686.804877] do_IRQ: 1.37 No irq handler for vector
This is likely a platform bug that device isn't fully quiesced during S3. Use MSI-X, maskable MSI or INTx can prevent this issue from happening.
Since MSI-X and maskable MSI are not supported by this device, fallback to use INTx on affected platforms.
--- drivers/net/ethernet/marvell/sky2.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/sky2.c +23 -1
@@ -46,6 +46,7 @@#include <linux/mii.h> #include <linux/of_device.h> #include <linux/of_net.h> +#include <linux/dmi.h> #include <asm/irq.h>
@@ -93,7 +94,7 @@ static int copybreak __read_mostly = 128module_param (copybreak, int,0 );MODULE_PARM_DESC (copybreak,"Receive copy threshold" ); -static int disable_msi =0 ; +static int disable_msi =-1 ;module_param (disable_msi, int,0 );MODULE_PARM_DESC (disable_msi,"Disable Message Signaled Interrupt (MSI)" );
@@ -4931,6 +4932,24 @@ static const char *sky2_name(u8 chipid,return buf; } +static const struct dmi_system_id msi_blacklist[] = { + { + .ident ="Dell Inspiron 1545" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Inspiron 1545" ), + }, + }, + { + .ident ="Gateway P-79" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Gateway" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"P-79" ), + }, + }, + {} +}; +static int sky2_probe (struct pci_dev *pdev,const struct pci_device_id *ent) {struct net_device *dev, *dev1;
@@ -5042,6 +5061,9 @@ static int sky2_probe(struct pci_dev *pd goto err_out_free_pci; } +if (disable_msi ==-1 ) + disable_msi = !!dmi_check_system (msi_blacklist); +if (!disable_msi &&pci_enable_msi (pdev) ==0 ) { err =sky2_test_msi (hw);if (err) {
Greg Kroah-Hartman
maintainerPATCH 12/135 team: Free BPF filter when unregistering netdev
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 692c31bd4054212312396b1d303bffab2c5b93a7 ]
When team is used in loadbalance mode a BPF filter can be used to provide a hash which will determine the Tx port.
When the netdev is later unregistered the filter is not freed which results in memory leaks [1].
Fix by freeing the program and the corresponding filter when unregistering the netdev.
[1]
unreferenced object 0xffff8881dbc47cc8 (size 16):
comm "teamd", pid 3068, jiffies 4294997779 (age 438.247s) hex dump (first 16 bytes):
a3 00 6b 6b 6b 6b 6b 6b 88 a5 82 e1 81 88 ff ff ..kkkkkk........
backtrace:
[<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
[<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
[<00000000610ef838>] genl_rcv_msg+0xca/0x170
[<00000000a281df93>] netlink_rcv_skb+0x132/0x380
[<000000004d9448a2>] genl_rcv+0x29/0x40
[<000000000321b2f4>] netlink_unicast+0x4c0/0x690
[<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
[<00000000068298c5>] sock_sendmsg+0xc8/0x110
[<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
[<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
[<0000000027c5f11a>] do_syscall_64+0x14d/0x610
[<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e23197e2>] 0xffffffffffffffff
unreferenced object 0xffff8881e182a588 (size 2048):
comm "teamd", pid 3068, jiffies 4294997780 (age 438.247s)
hex dump (first 32 bytes):
20 00 00 00 02 00 00 00 30 00 00 00 28 f0 ff ff .......0...(...
07 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 ........(.......
backtrace:
[<000000002daf01fb>] lb_bpf_func_set+0x45c/0x6d0
[<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
[<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
[<00000000610ef838>] genl_rcv_msg+0xca/0x170
[<00000000a281df93>] netlink_rcv_skb+0x132/0x380
[<000000004d9448a2>] genl_rcv+0x29/0x40
[<000000000321b2f4>] netlink_unicast+0x4c0/0x690
[<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
[<00000000068298c5>] sock_sendmsg+0xc8/0x110
[<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
[<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
[<0000000027c5f11a>] do_syscall_64+0x14d/0x610
[<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e23197e2>] 0xffffffffffffffff--- drivers/net/team/team_mode_loadbalance.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/net/team/team_mode_loadbalance.c +15 -0
@@ -319,6 +319,20 @@ static int lb_bpf_func_set(struct team *return 0 ; } +static void lb_bpf_func_free (struct team *team) +{ +struct lb_priv *lb_priv =get_lb_priv (team); +struct bpf_prog *fp; + +if (!lb_priv->ex->orig_fprog) +return ; + +__fprog_destroy (lb_priv->ex->orig_fprog); + fp =rcu_dereference_protected (lb_priv->fp, +lockdep_is_held (&team->lock)); +bpf_prog_destroy (fp); +} +static int lb_tx_method_get (struct team *team,struct team_gsetter_ctx *ctx) {struct lb_priv *lb_priv =get_lb_priv (team);
@@ -633,6 +647,7 @@ static void lb_exit(struct team *team)team_options_unregister (team, lb_options,ARRAY_SIZE (lb_options)); +lb_bpf_func_free (team);cancel_delayed_work_sync (&lb_priv->ex->stats.refresh_dw);free_percpu (lb_priv->pcpu_stats);kfree (lb_priv->ex);
Greg Kroah-Hartman
maintainerPATCH 13/135 tipc: fix RDM/DGRAM connect() regression
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Hugne <[email protected]>
[ Upstream commit 0e63208915a8d7590d0a6218dadb2a6a00ac705a ]
Fix regression bug introduced in
commit 365ad353c256 ("tipc: reduce risk of user starvation during link congestion")
Only signal -EDESTADDRREQ for RDM/DGRAM if we don't have a cached sockaddr.
--- net/tipc/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/socket.c +1 -1
@@ -943,7 +943,7 @@ static int __tipc_sendmsg(struct socketif (unlikely (!dest)) { dest = &tsk->peer; -if (!syn || dest->family !=AF_TIPC ) +if (!syn && dest->family !=AF_TIPC )return -EDESTADDRREQ ; }
Greg Kroah-Hartman
maintainerPATCH 14/135 bnxt_en: Drop oversize TX packets to prevent errors.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit 2b3c6885386020b1b9d92d45e8349637e27d1f66 ]
There have been reports of oversize UDP packets being sent to the driver to be transmitted, causing error conditions. The issue is likely caused by the dst of the SKB switching between 'lo' with 64K MTU and the hardware device with a smaller MTU. Patches are being proposed by Mahesh Bandewar <[email protected]> to fix the issue.
In the meantime, add a quick length check in the driver to prevent the error. The driver uses the TX packet size as index to look up an array to setup the TX BD. The array is large enough to support all MTU sizes supported by the driver. The oversize TX packet causes the driver to index beyond the array and put garbage values into the TX BD. Add a simple check to prevent this.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +6 -0
@@ -447,6 +447,12 @@ normal_tx: } length >>=9 ; +if (unlikely (length >=ARRAY_SIZE (bnxt_lhint_arr))) { +dev_warn_ratelimited (&pdev->dev,"Dropped oversize %d bytes TX packet.\n" , + skb->len); + i =0 ; + goto tx_dma_error; + } flags |= bnxt_lhint_arr[length]; txbd->tx_bd_len_flags_type =cpu_to_le32 (flags);
Greg Kroah-Hartman
maintainerPATCH 15/135 geneve: correctly handle ipv6.disable module parameter
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Benc <[email protected]>
[ Upstream commit cf1c9ccba7308e48a68fa77f476287d9d614e4c7 ]
When IPv6 is compiled but disabled at runtime, geneve_sock_add returns -EAFNOSUPPORT. For metadata based tunnels, this causes failure of the whole operation of bringing up the tunnel.
Ignore failure of IPv6 socket creation for metadata based tunnels caused by IPv6 not being available.
This is the same fix as what commit d074bf960044 ("vxlan: correctly handle ipv6.disable module parameter") is doing for vxlan.
Note there's also commit c0a47e44c098 ("geneve: should not call rt6_lookup() when ipv6 was disabled") which fixes a similar issue but for regular tunnels, while this patch is needed for metadata based tunnels.
--- drivers/net/geneve.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/geneve.c +8 -3
@@ -632,15 +632,20 @@ out:static int geneve_open (struct net_device *dev) {struct geneve_dev *geneve =netdev_priv (dev); -bool ipv6 = !!(geneve->info.mode &IP_TUNNEL_INFO_IPV6 );bool metadata = geneve->collect_md; +bool ipv4, ipv6;int ret =0 ; + ipv6 = geneve->info.mode &IP_TUNNEL_INFO_IPV6 || metadata; + ipv4 = !ipv6 || metadata;#if IS_ENABLED (CONFIG_IPV6 ) -if (ipv6 || metadata) +if (ipv6) { ret =geneve_sock_add (geneve, true); +if (ret <0 && ret != -EAFNOSUPPORT ) + ipv4 = false; + }#endif -if (!ret && (!ipv6 || metadata)) +if (ipv4) ret =geneve_sock_add (geneve, false);if (ret <0 )geneve_sock_release (geneve);
Greg Kroah-Hartman
maintainerPATCH 16/135 hv_netvsc: Fix IP header checksum for coalesced packets
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haiyang Zhang <[email protected]>
[ Upstream commit bf48648d650db1146b75b9bd358502431e86cf4f ]
Incoming packets may have IP header checksum verified by the host. They may not have IP header checksum computed after coalescing. This patch re-compute the checksum when necessary, otherwise the packets may be dropped, because Linux network stack always checks it.
--- drivers/net/hyperv/netvsc_drv.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-)
drivers/net/hyperv/netvsc_drv.c +19 -3
@@ -741,6 +741,14 @@ void netvsc_linkstatus_callback(struct hschedule_delayed_work (&ndev_ctx->dwork,0 ); } +static void netvsc_comp_ipcsum (struct sk_buff *skb) +{ +struct iphdr *iph = (struct iphdr *)skb->data; + + iph->check =0 ; + iph->check =ip_fast_csum (iph, iph->ihl); +} + static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net, struct napi_struct *napi, const struct ndis_tcp_ip_checksum_info *csum_info,
@@ -764,9 +772,17 @@ static struct sk_buff *netvsc_alloc_recv/* skb is already created with CHECKSUM_NONE */ skb_checksum_none_assert (skb); -/* -* In Linux, the IP checksum is always checked. -* Do L4 checksum offload if enabled and present. +/* Incoming packets may have IP header checksum verified by the host. +* They may not have IP header checksum computed after coalescing. +* We compute it here if the flags are set, because on Linux, the IP +* checksum is always checked. +*/ +if (csum_info && csum_info->receive.ip_checksum_value_invalid && + csum_info->receive.ip_checksum_succeeded && + skb->protocol ==htons (ETH_P_IP )) +netvsc_comp_ipcsum (skb); + +/* Do L4 checksum offload if enabled and present. */ if (csum_info && (net->features &NETIF_F_RXCSUM )) { if (csum_info->receive.tcp_checksum_succeeded ||
Greg Kroah-Hartman
maintainerPATCH 17/135 net: dsa: mv88e6xxx: Fix u64 statistics
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
[ Upstream commit 6e46e2d821bb22b285ae8187959096b65d063b0d ]
The switch maintains u64 counters for the number of octets sent and received. These are kept as two u32's which need to be combined. Fix the combing, which wrongly worked on u16's.
--- drivers/net/dsa/mv88e6xxx/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +1 -1
@@ -639,7 +639,7 @@ static uint64_t _mv88e6xxx_get_ethtool_sdefault :return UINT64_MAX ; } - value = (((u64 )high) <<16 ) | low; + value = (((u64 )high) <<32 ) | low;return value; }
Greg Kroah-Hartman
maintainerPATCH 18/135 netlabel: fix out-of-bounds memory accesses
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <[email protected]>
[ Upstream commit 5578de4834fe0f2a34fedc7374be691443396d1f ]
There are two array out-of-bounds memory accesses, one in cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both errors are embarassingly simple, and the fixes are straightforward.
As a FYI for anyone backporting this patch to kernels prior to v4.8, you'll want to apply the netlbl_bitmap_walk() patch to cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before Linux v4.8.
--- net/ipv4/cipso_ipv4.c | 3 ++- net/netlabel/netlabel_kapi.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/ipv4/cipso_ipv4.c +2 -1
@@ -667,7 +667,8 @@ static int cipso_v4_map_lvl_valid(constcase CIPSO_V4_MAP_PASS :return 0 ;case CIPSO_V4_MAP_TRANS : -if (doi_def->map.std->lvl.cipso[level] <CIPSO_V4_INV_LVL ) +if ((level < doi_def->map.std->lvl.cipso_size) && + (doi_def->map.std->lvl.cipso[level] <CIPSO_V4_INV_LVL ))return 0 ;break ; }
net/netlabel/netlabel_kapi.c +2 -1
@@ -903,7 +903,8 @@ int netlbl_bitmap_walk(const unsigned ch (state == 0 && (byte & bitmask) == 0))return bit_spot; - bit_spot++; +if (++bit_spot >= bitmap_len) +return -1 ; bitmask >>=1 ;if (bitmask ==0 ) { byte = bitmap[++byte_offset];
Greg Kroah-Hartman
maintainerPATCH 19/135 net: netem: fix skb length BUG_ON in __skb_to_sgvec
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheng Lan <[email protected]>
[ Upstream commit 5845f706388a4cde0f6b80f9e5d33527e942b7d9 ]
It can be reproduced by following steps:
1. virtio_net NIC is configured with gso/tso on
2. configure nginx as http server with an index file bigger than 1M bytes
3. use tc netem to produce duplicate packets and delay:
tc qdisc add dev eth0 root netem delay 100ms 10ms 30% duplicate 90%
4. continually curl the nginx http server to get index file on client
5. BUG_ON is seen quickly
[10258690.371129] kernel BUG at net/core/skbuff.c:4028! [10258690.371748] invalid opcode: 0000 [#1] SMP PTI [10258690.372094] CPU: 5 PID: 0 Comm: swapper/5 Tainted: G W 5.0.0-rc6 #2 [10258690.372094] RSP: 0018:ffffa05797b43da0 EFLAGS: 00010202 [10258690.372094] RBP: 00000000000005ea R08: 0000000000000000 R09: 00000000000005ea [10258690.372094] R10: ffffa0579334d800 R11: 00000000000002c0 R12: 0000000000000002 [10258690.372094] R13: 0000000000000000 R14: ffffa05793122900 R15: ffffa0578f7cb028 [10258690.372094] FS: 0000000000000000(0000) GS:ffffa05797b40000(0000) knlGS:0000000000000000 [10258690.372094] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [10258690.372094] CR2: 00007f1a6dc00868 CR3: 000000001000e000 CR4: 00000000000006e0 [10258690.372094] Call Trace: [10258690.372094] <IRQ> [10258690.372094] skb_to_sgvec+0x11/0x40 [10258690.372094] start_xmit+0x38c/0x520 [virtio_net] [10258690.372094] dev_hard_start_xmit+0x9b/0x200 [10258690.372094] sch_direct_xmit+0xff/0x260 [10258690.372094] __qdisc_run+0x15e/0x4e0 [10258690.372094] net_tx_action+0x137/0x210 [10258690.372094] __do_softirq+0xd6/0x2a9 [10258690.372094] irq_exit+0xde/0xf0 [10258690.372094] smp_apic_timer_interrupt+0x74/0x140 [10258690.372094] apic_timer_interrupt+0xf/0x20 [10258690.372094] </IRQ>
In __skb_to_sgvec(), the skb->len is not equal to the sum of the skb's linear data size and nonlinear data size, thus BUG_ON triggered. Because the skb is cloned and a part of nonlinear data is split off.
Duplicate packet is cloned in netem_enqueue() and may be delayed some time in qdisc. When qdisc len reached the limit and returns NET_XMIT_DROP, the skb will be retransmit later in write queue. the skb will be fragmented by tso_fragment(), the limit size that depends on cwnd and mss decrease, the skb's nonlinear data will be split off. The length of the skb cloned by netem will not be updated. When we use virtio_net NIC and invoke skb_to_sgvec(), the BUG_ON trigger.
To fix it, netem returns NET_XMIT_SUCCESS to upper stack when it clones a duplicate packet.
--- net/sched/sch_netem.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/sched/sch_netem.c +7 -3
@@ -435,6 +435,7 @@ static int netem_enqueue(struct sk_buffint nb =0 ;int count =1 ;int rc =NET_XMIT_SUCCESS ; +int rc_drop =NET_XMIT_DROP ;/* Do not fool qdisc_drop_all() */ skb->prev =NULL ;
@@ -474,6 +475,7 @@ static int netem_enqueue(struct sk_buff q->duplicate =0 ; rootq->enqueue (skb2, rootq, to_free); q->duplicate = dupsave; + rc_drop =NET_XMIT_SUCCESS ; }/*
@@ -486,7 +488,7 @@ static int netem_enqueue(struct sk_buffif (skb_is_gso (skb)) { segs =netem_segment (skb, sch, to_free);if (!segs) -return NET_XMIT_DROP ; +return rc_drop; }else { segs = skb; }
@@ -509,8 +511,10 @@ static int netem_enqueue(struct sk_buff1 <<(prandom_u32 () %8 ); } -if (unlikely (sch->q.qlen >= sch->limit)) -return qdisc_drop_all (skb, sch, to_free); +if (unlikely (sch->q.qlen >= sch->limit)) { +qdisc_drop_all (skb, sch, to_free); +return rc_drop; + }qdisc_qstats_backlog_inc (sch, skb);
Greg Kroah-Hartman
maintainerPATCH 20/135 net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
[ Upstream commit 58bdd544e2933a21a51eecf17c3f5f94038261b5 ]
KASAN report this:
BUG: KASAN: null-ptr-deref in nfc_llcp_build_gb+0x37f/0x540 [nfc] Read of size 3 at addr 0000000000000000 by task syz-executor.0/5401 CPU: 0 PID: 5401 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xfa/0x1ce lib/dump_stack.c:113 kasan_report+0x171/0x18d mm/kasan/report.c:321 memcpy+0x1f/0x50 mm/kasan/common.c:130 nfc_llcp_build_gb+0x37f/0x540 [nfc] nfc_llcp_register_device+0x6eb/0xb50 [nfc] nfc_register_device+0x50/0x1d0 [nfc] nfcsim_device_new+0x394/0x67d [nfcsim] ? 0xffffffffc1080000 nfcsim_init+0x6b/0x1000 [nfcsim] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9cb79dcc58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9cb79dcc70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9cb79dd6bc R13: 00000000004bcefb R14: 00000000006f7030 R15: 0000000000000004
nfc_llcp_build_tlv will return NULL on fails, caller should check it, otherwise will trigger a NULL dereference.
--- net/nfc/llcp_commands.c | 20 ++++++++++++++++++++ net/nfc/llcp_core.c | 24 ++++++++++++++++++++---- 2 files changed, 40 insertions(+), 4 deletions(-)
net/nfc/llcp_commands.c +20 -0
@@ -419,6 +419,10 @@ int nfc_llcp_send_connect(struct nfc_llc sock->service_name, sock->service_name_len, &service_name_tlv_length); +if (!service_name_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += service_name_tlv_length; }
@@ -429,9 +433,17 @@ int nfc_llcp_send_connect(struct nfc_llc miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&miux,0 , &miux_tlv_length); +if (!miux_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += miux_tlv_length; rw_tlv =nfc_llcp_build_tlv (LLCP_TLV_RW , &rw,0 , &rw_tlv_length); +if (!rw_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += rw_tlv_length;pr_debug ("SKB size %d SN length %zu\n" , size, sock->service_name_len);
@@ -484,9 +496,17 @@ int nfc_llcp_send_cc(struct nfc_llcp_soc miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&miux,0 , &miux_tlv_length); +if (!miux_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += miux_tlv_length; rw_tlv =nfc_llcp_build_tlv (LLCP_TLV_RW , &rw,0 , &rw_tlv_length); +if (!rw_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += rw_tlv_length; skb =llcp_allocate_pdu (sock,LLCP_PDU_CC , size);
net/nfc/llcp_core.c +20 -4
@@ -532,10 +532,10 @@ static u8 nfc_llcp_reserve_sdp_ssap(strustatic int nfc_llcp_build_gb (struct nfc_llcp_local *local) { -u8 *gb_cur, *version_tlv, version, version_length; -u8 *lto_tlv, lto_length; -u8 *wks_tlv, wks_length; -u8 *miux_tlv, miux_length; +u8 *gb_cur, version, version_length; +u8 lto_length, wks_length, miux_length; +u8 *version_tlv =NULL , *lto_tlv =NULL , + *wks_tlv =NULL , *miux_tlv =NULL ;__be16 wks =cpu_to_be16 (local->local_wks);u8 gb_len =0 ;int ret =0 ;
@@ -543,17 +543,33 @@ static int nfc_llcp_build_gb(struct nfc_ version =LLCP_VERSION_11 ; version_tlv =nfc_llcp_build_tlv (LLCP_TLV_VERSION , &version,1 , &version_length); +if (!version_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += version_length; lto_tlv =nfc_llcp_build_tlv (LLCP_TLV_LTO , &local->lto,1 , <o_length); +if (!lto_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += lto_length;pr_debug ("Local wks 0x%lx\n" , local->local_wks); wks_tlv =nfc_llcp_build_tlv (LLCP_TLV_WKS , (u8 *)&wks,2 , &wks_length); +if (!wks_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += wks_length; miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&local->miux,0 , &miux_length); +if (!miux_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += miux_length; gb_len +=ARRAY_SIZE (llcp_magic);
Greg Kroah-Hartman
maintainerPATCH 21/135 net: phy: phylink: fix uninitialized variable in phylink_get_mac_state
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit d25ed413d5e51644e18f66e34eec049f17a7abcb ]
When debugging an issue I found implausible values in state->pause. Reason in that state->pause isn't initialized and later only single bits are changed. Also the struct itself isn't initialized in phylink_resolve(). So better initialize state->pause and other not yet initialized fields.
v2:
- use right function name in subject
v3:
- initialize additional fields
--- drivers/net/phy/phylink.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/phy/phylink.c +4 -0
@@ -333,6 +333,10 @@ static int phylink_get_mac_state(structlinkmode_zero (state->lp_advertising); state->interface = pl->link_config.interface; state->an_enabled = pl->link_config.an_enabled; + state->speed =SPEED_UNKNOWN ; + state->duplex =DUPLEX_UNKNOWN ; + state->pause =MLO_PAUSE_NONE ; + state->an_complete =0 ; state->link =1 ;return pl->ops->mac_link_state (ndev, state);
Greg Kroah-Hartman
maintainerPATCH 22/135 net: sit: fix memory leak in sit_init_net()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mao Wenan <[email protected]>
[ Upstream commit 07f12b26e21ab359261bf75cfcb424fdc7daeb6d ]
If register_netdev() is failed to register sitn->fb_tunnel_dev, it will go to err_reg_dev and forget to free netdev(sitn->fb_tunnel_dev).
BUG: memory leak
unreferenced object 0xffff888378daad00 (size 512):
comm "syz-executor.1", pid 4006, jiffies 4295121142 (age 16.115s)
hex dump (first 32 bytes):
00 e6 ed c0 83 88 ff ff 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d6dcb63e>] kvmalloc include/linux/mm.h:577 [inline]
[<00000000d6dcb63e>] kvzalloc include/linux/mm.h:585 [inline]
[<00000000d6dcb63e>] netif_alloc_netdev_queues net/core/dev.c:8380 [inline]
[<00000000d6dcb63e>] alloc_netdev_mqs+0x600/0xcc0 net/core/dev.c:8970
[<00000000867e172f>] sit_init_net+0x295/0xa40 net/ipv6/sit.c:1848
[<00000000871019fa>] ops_init+0xad/0x3e0 net/core/net_namespace.c:129
[<00000000319507f6>] setup_net+0x2ba/0x690 net/core/net_namespace.c:314
[<0000000087db4f96>] copy_net_ns+0x1dc/0x330 net/core/net_namespace.c:437
[<0000000057efc651>] create_new_namespaces+0x382/0x730 kernel/nsproxy.c:107
[<00000000676f83de>] copy_namespaces+0x2ed/0x3d0 kernel/nsproxy.c:165
[<0000000030b74bac>] copy_process.part.27+0x231e/0x6db0 kernel/fork.c:1919
[<00000000fff78746>] copy_process kernel/fork.c:1713 [inline]
[<00000000fff78746>] _do_fork+0x1bc/0xe90 kernel/fork.c:2224
[<000000001c2e0d1c>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
[<00000000ec48bd44>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<0000000039acff8a>] 0xffffffffffffffff--- net/ipv6/sit.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/sit.c +1 -0
@@ -1856,6 +1856,7 @@ static int __net_init sit_init_net(struc err_reg_dev:ipip6_dev_free (sitn->fb_tunnel_dev); +free_netdev (sitn->fb_tunnel_dev); err_alloc_dev:return err; }
Greg Kroah-Hartman
maintainerPATCH 23/135 net: socket: set sock->sk to NULL after calling proto_ops::release()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit ff7b11aa481f682e0e9711abfeb7d03f5cd612bf ]
Commit 9060cb719e61 ("net: crypto set sk to NULL when af_alg_release.") fixed a use-after-free in sockfs_setattr() when an AF_ALG socket is closed concurrently with fchownat(). However, it ignored that many other proto_ops::release() methods don't set sock->sk to NULL and therefore allow the same use-after-free:
- base_sock_release
- bnep_sock_release
- cmtp_sock_release
- data_sock_release
- dn_release
- hci_sock_release
- hidp_sock_release
- iucv_sock_release
- l2cap_sock_release
- llcp_sock_release
- llc_ui_release
- rawsock_release
- rfcomm_sock_release
- sco_sock_release
- svc_release
- vcc_release
- x25_release
Rather than fixing all these and relying on every socket type to get this right forever, just make __sock_release() set sock->sk to NULL itself after calling proto_ops::release().
Reproducer that produces the KASAN splat when any of these socket types are configured into the kernel:
#include <pthread.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <unistd.h>
pthread_t t;
volatile int fd;
void *close_thread(void *arg)
{
for (;;) {
usleep(rand() % 100);
close(fd);
}
}
int main()
{
pthread_create(&t, NULL, close_thread, NULL);
for (;;) {
fd = socket(rand() % 50, rand() % 11, 0);
fchownat(fd, "", 1000, 1000, 0x1000);
close(fd);
}
}--- net/socket.c | 1 + 1 file changed, 1 insertion(+)
net/socket.c +1 -0
@@ -600,6 +600,7 @@ static void __sock_release(struct socketif (inode)inode_lock (inode); sock->ops->release (sock); + sock->sk =NULL ;if (inode)inode_unlock (inode); sock->ops =NULL ;
Greg Kroah-Hartman
maintainerPATCH 24/135 xen-netback: dont populate the hash cache on XenBus disconnect
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Druzhinin <[email protected]>
[ Upstream commit a2288d4e355992d369c50c45d017a85f6061ff71 ]
Occasionally, during the disconnection procedure on XenBus which includes hash cache deinitialization there might be some packets still in-flight on other processors. Handling of these packets includes hashing and hash cache population that finally results in hash cache data structure corruption.
In order to avoid this we prevent hashing of those packets if there are no queues initialized. In that case RCU protection of queues guards the hash cache as well.
--- drivers/net/xen-netback/hash.c | 2 ++ drivers/net/xen-netback/interface.c | 7 +++++++ 2 files changed, 9 insertions(+)
drivers/net/xen-netback/hash.c +2 -0
@@ -435,6 +435,8 @@ void xenvif_init_hash(struct xenvif *vifif (xenvif_hash_cache_size ==0 )return ; +BUG_ON (vif->hash.cache.count); +spin_lock_init (&vif->hash.cache.lock);INIT_LIST_HEAD (&vif->hash.cache.list); }
drivers/net/xen-netback/interface.c +7 -0
@@ -153,6 +153,13 @@ static u16 xenvif_select_queue(struct ne {struct xenvif *vif =netdev_priv (dev);unsigned int size = vif->hash.size; +unsigned int num_queues; + +/* If queues are not set up internally - always return 0 +* as the packet going to be dropped anyway */ + num_queues =READ_ONCE (vif->num_queues); +if (num_queues <1 ) +return 0 ;if (vif->hash.alg ==XEN_NETIF_CTRL_HASH_ALGORITHM_NONE )return fallback (dev, skb) % dev->real_num_tx_queues;
Greg Kroah-Hartman
maintainerPATCH 25/135 xen-netback: fix occasional leak of grant ref mappings under memory pressure
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Druzhinin <[email protected]>
[ Upstream commit 99e87f56b48f490fb16b6e0f74691c1e664dea95 ]
Zero-copy callback flag is not yet set on frag list skb at the moment xenvif_handle_frag_list() returns -ENOMEM. This eventually results in leaking grant ref mappings since xenvif_zerocopy_callback() is never called for these fragments. Those eventually build up and cause Xen to kill Dom0 as the slots get reused for new mappings:
"d0v0 Attempt to implicitly unmap a granted PTE c010000329fce005"
That behavior is observed under certain workloads where sudden spikes of page cache writes coexist with active atomic skb allocations from network traffic. Additionally, rework the logic to deal with frag_list deallocation in a single place.
--- drivers/net/xen-netback/netback.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/xen-netback/netback.c +5 -5
@@ -1074,11 +1074,6 @@ static int xenvif_handle_frag_list(strucskb_frag_size_set (&frags[i], len); } -/* Copied all the bits from the frag list -- free it. */ -skb_frag_list_init (skb); -xenvif_skb_zerocopy_prepare (queue, nskb); -kfree_skb (nskb); -/* Release all the original (foreign) frags. */ for (f =0 ; f <skb_shinfo (skb)->nr_frags; f++)skb_frag_unref (skb, f);
@@ -1147,6 +1142,8 @@ static int xenvif_tx_submit(struct xenvixenvif_fill_frags (queue, skb);if (unlikely (skb_has_frag_list (skb))) { +struct sk_buff *nskb =skb_shinfo (skb)->frag_list; +xenvif_skb_zerocopy_prepare (queue, nskb);if (xenvif_handle_frag_list (queue, skb)) {if (net_ratelimit ()) netdev_err(queue->vif->dev,
@@ -1155,6 +1152,9 @@ static int xenvif_tx_submit(struct xenvikfree_skb (skb);continue ; } +/* Copied all the bits from the frag list -- free it. */ +skb_frag_list_init (skb); +kfree_skb (nskb); } skb->dev = queue->vif->dev;
Greg Kroah-Hartman
maintainerPATCH 26/135 net: Add __icmp_send helper.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nazarov Sergey <[email protected]>
[ Upstream commit 9ef6b42ad6fd7929dd1b6092cb02014e382c6a91 ]
Add __icmp_send function having ip_options struct parameter
--- include/net/icmp.h | 9 ++++++++- net/ipv4/icmp.c | 7 ++++--- 2 files changed, 12 insertions(+), 4 deletions(-)
include/net/icmp.h +8 -1
@@ -22,6 +22,7 @@#include <net/inet_sock.h> #include <net/snmp.h> +#include <net/ip.h> struct icmp_err {int errno;
@@ -39,7 +40,13 @@ struct net_proto_family;struct sk_buff ;struct net ; -void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info); +void __icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info, +const struct ip_options *opt); +static inline void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info) +{ +__icmp_send (skb_in, type, code, info, &IPCB (skb_in)->opt); +} +int icmp_rcv (struct sk_buff *skb);void icmp_err (struct sk_buff *skb,u32 info);int icmp_init (void );
net/ipv4/icmp.c +4 -3
@@ -573,7 +573,8 @@ relookup_failed:* MUST reply to only the first fragment. */ -void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info) +void __icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info, +const struct ip_options *opt) {struct iphdr *iph;int room;
@@ -694,7 +695,7 @@ void icmp_send(struct sk_buff *skb_in, i iph->tos; mark =IP4_REPLY_MARK (net, skb_in->mark); -if (ip_options_echo (net, &icmp_param.replyopts.opt.opt, skb_in)) +if (__ip_options_echo (net, &icmp_param.replyopts.opt.opt, skb_in, opt)) goto out_unlock;
@@ -747,7 +748,7 @@ out_bh_enable:local_bh_enable (); out:; } -EXPORT_SYMBOL (icmp_send); +EXPORT_SYMBOL (__icmp_send);static void icmp_socket_deliver (struct sk_buff *skb,u32 info)
Greg Kroah-Hartman
maintainerPATCH 27/135 net: avoid use IPCB in cipso_v4_error
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nazarov Sergey <[email protected]>
[ Upstream commit 3da1ed7ac398f34fff1694017a07054d69c5f5c5 ]
Extract IP options in cipso_v4_error and use __icmp_send.
--- include/net/ip.h | 2 ++ net/ipv4/cipso_ipv4.c | 17 +++++++++++++++-- net/ipv4/ip_options.c | 22 +++++++++++++++++----- 3 files changed, 34 insertions(+), 7 deletions(-)
include/net/ip.h +2 -0
@@ -593,6 +593,8 @@ static inline int ip_options_echo(struct }void ip_options_fragment (struct sk_buff *skb); +int __ip_options_compile (struct net *net,struct ip_options *opt, +struct sk_buff *skb,__be32 *info);int ip_options_compile (struct net *net,struct ip_options *opt,struct sk_buff *skb); int ip_options_get(struct net *net, struct ip_options_rcu **optp,
net/ipv4/cipso_ipv4.c +15 -2
@@ -1736,13 +1736,26 @@ validate_return:*/ void cipso_v4_error (struct sk_buff *skb,int error,u32 gateway) { +unsigned char optbuf[sizeof (struct ip_options ) +40 ]; +struct ip_options *opt = (struct ip_options *)optbuf; +if (ip_hdr (skb)->protocol ==IPPROTO_ICMP || error != -EACCES )return ; +/* +* We might be called above the IP layer, +* so we can not use icmp_send and IPCB here. +*/ + +memset (opt,0 ,sizeof (struct ip_options )); + opt->optlen =ip_hdr (skb)->ihl*4 -sizeof (struct iphdr ); +if (__ip_options_compile (dev_net (skb->dev), opt, skb,NULL )) +return ; +if (gateway) -icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_NET_ANO ,0 ); +__icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_NET_ANO ,0 , opt);else -icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_HOST_ANO ,0 ); +__icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_HOST_ANO ,0 , opt); }/**
net/ipv4/ip_options.c +17 -5
@@ -251,8 +251,9 @@ static void spec_dst_fill(__be32 *spec_d* If opt == NULL, then skb->data should point to IP header. */ -int ip_options_compile (struct net *net, -struct ip_options *opt,struct sk_buff *skb) +int __ip_options_compile (struct net *net, +struct ip_options *opt,struct sk_buff *skb, +__be32 *info) {__be32 spec_dst =htonl (INADDR_ANY );unsigned char *pp_ptr =NULL ;
@@ -468,11 +469,22 @@ eol:return 0 ; error: -if (skb) { -icmp_send (skb,ICMP_PARAMETERPROB ,0 ,htonl ((pp_ptr-iph)<<24 )); - } +if (info) + *info =htonl ((pp_ptr-iph)<<24 );return -EINVAL ; } + +int ip_options_compile (struct net *net, +struct ip_options *opt,struct sk_buff *skb) +{ +int ret; +__be32 info; + + ret =__ip_options_compile (net, opt, skb, &info); +if (ret !=0 && skb) +icmp_send (skb,ICMP_PARAMETERPROB ,0 , info); +return ret; +}EXPORT_SYMBOL (ip_options_compile);/*
Greg Kroah-Hartman
maintainerPATCH 28/135 ipv4: Return error for RTA_VIA attribute
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit b6e9e5df4ecf100f6a10ab2ade8e46d47a4b9779 ]
IPv4 currently does not support nexthops outside of the AF_INET family. Specifically, it does not handle RTA_VIA attribute. If it is passed in a route add request, the actual route added only uses the device which is clearly not what the user intended:
$ ip ro add 172.16.1.0/24 via inet6 2001:db8:1::1 dev eth0 $ ip ro ls ... 172.16.1.0/24 dev eth0
Catch this and fail the route add:
$ ip ro add 172.16.1.0/24 via inet6 2001:db8:1::1 dev eth0 Error: IPv4 does not support RTA_VIA attribute.
--- net/ipv4/fib_frontend.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv4/fib_frontend.c +4 -0
@@ -675,6 +675,10 @@ static int rtm_to_fib_config(struct netcase RTA_GATEWAY : cfg->fc_gw =nla_get_be32 (attr);break ; +case RTA_VIA : +NL_SET_ERR_MSG (extack,"IPv4 does not support RTA_VIA attribute" ); + err = -EINVAL ; + goto errout;case RTA_PRIORITY : cfg->fc_priority =nla_get_u32 (attr);break ;
Greg Kroah-Hartman
maintainerPATCH 29/135 ipv6: Return error for RTA_VIA attribute
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit e3818541b49fb88650ba339d33cc53e4095da5b3 ]
IPv6 currently does not support nexthops outside of the AF_INET6 family. Specifically, it does not handle RTA_VIA attribute. If it is passed in a route add request, the actual route added only uses the device which is clearly not what the user intended:
$ ip -6 ro add 2001:db8:2::/64 via inet 172.16.1.1 dev eth0 $ ip ro ls ... 2001:db8:2::/64 dev eth0 metric 1024 pref medium
Catch this and fail the route add:
$ ip -6 ro add 2001:db8:2::/64 via inet 172.16.1.1 dev eth0 Error: IPv6 does not support RTA_VIA attribute.
--- net/ipv6/route.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/route.c +4 -0
@@ -3024,6 +3024,10 @@ static int rtm_to_fib6_config(struct sk_ cfg->fc_gateway =nla_get_in6_addr (tb[RTA_GATEWAY ]); cfg->fc_flags |=RTF_GATEWAY ; } +if (tb[RTA_VIA ]) { +NL_SET_ERR_MSG (extack,"IPv6 does not support RTA_VIA attribute" ); + goto errout; + }if (tb[RTA_DST ]) {int plen = (rtm->rtm_dst_len +7 ) >>3 ;
Greg Kroah-Hartman
maintainerPATCH 30/135 mpls: Return error for RTA_GATEWAY attribute
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit be48220edd48ca0d569782992840488a52373a24 ]
MPLS does not support nexthops with an MPLS address family. Specifically, it does not handle RTA_GATEWAY attribute. Make it clear by returning an error.
--- net/mpls/af_mpls.c | 3 +++ 1 file changed, 3 insertions(+)
net/mpls/af_mpls.c +3 -0
@@ -1787,6 +1787,9 @@ static int rtm_to_route_config(struct sk goto errout;break ; } +case RTA_GATEWAY : +NL_SET_ERR_MSG (extack,"MPLS does not support RTA_GATEWAY attribute" ); + goto errout;case RTA_VIA : { if (nla_get_via(nla, &cfg->rc_via_alen,
Greg Kroah-Hartman
maintainerPATCH 31/135 tun: fix blocking read
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Celik <[email protected]>
[ Upstream commit 71828b2240692cec0e68b8d867bc00e1745e7fae ]
This patch moves setting of the current state into the loop. Otherwise the task may end up in a busy wait loop if none of the break conditions are met.
--- drivers/net/tun.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/tun.c +2 -2
@@ -1714,9 +1714,9 @@ static struct sk_buff *tun_ring_recv(str }add_wait_queue (&tfile->wq.wait, &wait); - current->state =TASK_INTERRUPTIBLE ;while (1 ) { +set_current_state (TASK_INTERRUPTIBLE ); skb =skb_array_consume (&tfile->tx_array);if (skb)break ;
@@ -1732,7 +1732,7 @@ static struct sk_buff *tun_ring_recv(strschedule (); } - current->state =TASK_RUNNING ; +set_current_state (TASK_RUNNING );remove_wait_queue (&tfile->wq.wait, &wait); out:
Greg Kroah-Hartman
maintainerPATCH 32/135 tun: remove unnecessary memory barrier
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Celik <[email protected]>
[ Upstream commit ecef67cb10db7b83b3b71c61dbb29aa070ab0112 ]
Replace set_current_state with __set_current_state since no memory barrier is needed at this point.
--- drivers/net/tun.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/tun.c +1 -1
@@ -1732,7 +1732,7 @@ static struct sk_buff *tun_ring_recv(strschedule (); } -set_current_state (TASK_RUNNING ); +__set_current_state (TASK_RUNNING );remove_wait_queue (&tfile->wq.wait, &wait); out:
Greg Kroah-Hartman
maintainerPATCH 33/135 net: phy: Micrel KSZ8061: link failure after cable connect
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajasingh Thavamani <[email protected]>
[ Upstream commit 232ba3a51cc224b339c7114888ed7f0d4d95695e ]
With Micrel KSZ8061 PHY, the link may occasionally not come up after Ethernet cable connect. The vendor's (Microchip, former Micrel) errata sheet 80000688A.pdf descripes the problem and possible workarounds in detail, see below.
The batch implements workaround 1, which permanently fixes the issue.
DESCRIPTION
Link-up may not occur properly when the Ethernet cable is initially connected. This issue occurs more commonly when the cable is connected slowly, but it may occur any time a cable is connected. This issue occurs in the auto-negotiation circuit, and will not occur if auto-negotiation is disabled (which requires that the two link partners be set to the same speed and duplex).
END USER IMPLICATIONS
When this issue occurs, link is not established. Subsequent cable plug/unplaug cycle will not correct the issue.
WORk AROUND
There are four approaches to work around this issue:
1. This issue can be prevented by setting bit 15 in MMD device address 1, register 2, prior to connecting the cable or prior to setting the Restart Auto-negotiation bit in register 0h. The MMD registers are accessed via the indirect access registers Dh and Eh, or via the Micrel EthUtil utility as shown here:
. if using the EthUtil utility (usually with a Micrel KSZ8061
Evaluation Board), type the following commands:
> address 1
> mmd 1
> iw 2 b61a
. Alternatively, write the following registers to write to the
indirect MMD register:
Write register Dh, data 0001h
Write register Eh, data 0002h
Write register Dh, data 4001h
Write register Eh, data B61Ah
2. The issue can be avoided by disabling auto-negotiation in the KSZ8061, either by the strapping option, or by clearing bit 12 in register 0h. Care must be taken to ensure that the KSZ8061 and the link partner will link with the same speed and duplex. Note that the KSZ8061 defaults to full-duplex when auto-negotiation is off, but other devices may default to half-duplex in the event of failed auto-negotiation.
3. The issue can be avoided by connecting the cable prior to powering-up or resetting the KSZ8061, and leaving it plugged in thereafter.
4. If the above measures are not taken and the problem occurs, link can be recovered by setting the Restart Auto-Negotiation bit in register 0h, or by resetting or power cycling the device. Reset may be either hardware reset or software reset (register 0h, bit 15).
PLAN
This errata will not be corrected in the future revision.
--- drivers/net/phy/micrel.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/net/phy/micrel.c +12 -1
@@ -339,6 +339,17 @@ static int ksz8041_config_aneg(struct phreturn genphy_config_aneg (phydev); } +static int ksz8061_config_init (struct phy_device *phydev) +{ +int ret; + + ret =phy_write_mmd (phydev,MDIO_MMD_PMAPMD ,MDIO_DEVID1 ,0xB61A ); +if (ret) +return ret; + +return kszphy_config_init (phydev); +} + static int ksz9021_load_values_from_of(struct phy_device *phydev, const struct device_node *of_node, u16 reg,
@@ -938,7 +949,7 @@ static struct phy_driver ksphy_driver[] .phy_id_mask = MICREL_PHY_ID_MASK, .features = PHY_BASIC_FEATURES, .flags = PHY_HAS_INTERRUPT, - .config_init = kszphy_config_init, + .config_init = ksz8061_config_init, .config_aneg = genphy_config_aneg, .read_status = genphy_read_status, .ack_interrupt = kszphy_ack_interrupt,
Greg Kroah-Hartman
maintainerPATCH 34/135 net: dsa: mv88e6xxx: Fix statistics on mv88e6161
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
[ Upstream commit a6da21bb0eae459a375d5bd48baed821d14301d0 ]
Despite what the datesheet says, the silicon implements the older way of snapshoting the statistics. Change the op.
--- drivers/net/dsa/mv88e6xxx/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +1 -1
@@ -2569,7 +2569,7 @@ static const struct mv88e6xxx_ops mv88e6 .port_pause_limit = mv88e6097_port_pause_limit, .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit, .port_disable_pri_override = mv88e6xxx_port_disable_pri_override, - .stats_snapshot = mv88e6320_g1_stats_snapshot, + .stats_snapshot = mv88e6xxx_g1_stats_snapshot, .stats_get_sset_count = mv88e6095_stats_get_sset_count, .stats_get_strings = mv88e6095_stats_get_strings, .stats_get_stats = mv88e6095_stats_get_stats,
Greg Kroah-Hartman
maintainerPATCH 35/135 x86/CPU/AMD: Set the CPB bit unconditionally on F17h
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
commit 0237199186e7a4aa5310741f0a6498a20c820fd7 upstream.
Some F17h models do not have CPB set in CPUID even though the CPU supports it. Set the feature bit unconditionally on all F17h.
[ bp: Rewrite commit message and patch. ]
--- arch/x86/kernel/cpu/amd.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
arch/x86/kernel/cpu/amd.c +3 -5
@@ -791,11 +791,9 @@ static void init_amd_bd(struct cpuinfo_xstatic void init_amd_zn (struct cpuinfo_x86 *c) {set_cpu_cap (c,X86_FEATURE_ZEN ); -/* -* Fix erratum 1076: CPB feature bit not being set in CPUID. It affects -* all up to and including B1. -*/ -if (c->x86_model <=1 && c->x86_stepping <=1 ) + +/* Fix erratum 1076: CPB feature bit not being set in CPUID. */ +if (!cpu_has (c,X86_FEATURE_CPB ))set_cpu_cap (c,X86_FEATURE_CPB ); }
Greg Kroah-Hartman
maintainerPATCH 36/135 applicom: Fix potential Spectre v1 vulnerabilities
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit d7ac3c6ef5d8ce14b6381d52eb7adafdd6c8bb3c upstream.
IndexCard is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
drivers/char/applicom.c:418 ac_write() warn: potential spectre issue 'apbs' [r] drivers/char/applicom.c:728 ac_ioctl() warn: potential spectre issue 'apbs' [r] (local cap)
Fix this by sanitizing IndexCard before using it to index apbs.
Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1].
[1] https://lore.kernel.org/lkml/[email protected]/
--- drivers/char/applicom.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-)
drivers/char/applicom.c +24 -11
@@ -32,6 +32,7 @@#include <linux/wait.h> #include <linux/init.h> #include <linux/fs.h> +#include <linux/nospec.h> #include <asm/io.h> #include <linux/uaccess.h>
@@ -386,7 +387,11 @@ static ssize_t ac_write(struct file *fil TicCard = st_loc.tic_des_from_pc;/* tic number to send */ IndexCard = NumCard -1 ; -if ((NumCard <1 ) || (NumCard >MAX_BOARD ) || !apbs[IndexCard].RamIO) +if (IndexCard >=MAX_BOARD ) +return -EINVAL ; + IndexCard =array_index_nospec (IndexCard,MAX_BOARD ); + +if (!apbs[IndexCard].RamIO)return -EINVAL ;#ifdef DEBUG
@@ -697,6 +702,7 @@ static long ac_ioctl(struct file *file,unsigned char IndexCard;void __iomem *pmem;int ret =0 ; +static int warncount =10 ;volatile unsigned char byte_reset_it;struct st_ram_io *adgl;void __user *argp = (void __user *)arg;
@@ -711,16 +717,12 @@ static long ac_ioctl(struct file *file,mutex_lock (&ac_mutex); IndexCard = adgl->num_card-1 ; -if (cmd !=6 && ((IndexCard >=MAX_BOARD ) || !apbs[IndexCard].RamIO)) { -static int warncount =10 ; -if (warncount) { -printk (KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n" ,(int )IndexCard+1 ); - warncount--; - } -kfree (adgl); -mutex_unlock (&ac_mutex); -return -EINVAL ; - } +if (cmd !=6 && IndexCard >=MAX_BOARD ) + goto err; + IndexCard =array_index_nospec (IndexCard,MAX_BOARD ); + +if (cmd !=6 && !apbs[IndexCard].RamIO) + goto err;switch (cmd) {
@@ -838,5 +840,16 @@ static long ac_ioctl(struct file *file,kfree (adgl);mutex_unlock (&ac_mutex);return 0 ; + +err: +if (warncount) { +pr_warn ("APPLICOM driver IOCTL, bad board number %d\n" , + (int )IndexCard +1 ); + warncount--; + } +kfree (adgl); +mutex_unlock (&ac_mutex); +return -EINVAL ; + }
Greg Kroah-Hartman
maintainerPATCH 37/135 MIPS: irq: Allocate accurate order pages for irq stack
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Xiang <[email protected]>
commit 72faa7a773ca59336f3c889e878de81445c5a85c upstream.
The irq_pages is the number of pages for irq stack, but not the order which is needed by __get_free_pages().
We can use get_order() to calculate the accurate order.
--- arch/mips/kernel/irq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/kernel/irq.c +2 -2
@@ -52,6 +52,7 @@ asmlinkage void spurious_interrupt(void)void __init init_IRQ (void ) {int i; +unsigned int order =get_order (IRQ_STACK_SIZE );for (i =0 ; i <NR_IRQS ; i++)irq_set_noprobe (i);
@@ -62,8 +63,7 @@ void __init init_IRQ(void)arch_init_irq ();for_each_possible_cpu (i) { -int irq_pages =IRQ_STACK_SIZE /PAGE_SIZE ; -void *s = (void *)__get_free_pages (GFP_KERNEL , irq_pages); +void *s = (void *)__get_free_pages (GFP_KERNEL , order); irq_stack[i] = s; pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
Greg Kroah-Hartman
maintainerPATCH 38/135 hugetlbfs: fix races and page leaks during migration
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Kravetz <[email protected]>
commit cb6acd01e2e43fd8bad11155752b7699c3d0fb76 upstream.
hugetlb pages should only be migrated if they are 'active'. The routines set/clear_page_huge_active() modify the active state of hugetlb pages.
When a new hugetlb page is allocated at fault time, set_page_huge_active is called before the page is locked. Therefore, another thread could race and migrate the page while it is being added to page table by the fault code. This race is somewhat hard to trigger, but can be seen by strategically adding udelay to simulate worst case scheduling behavior. Depending on 'how' the code races, various BUG()s could be triggered.
To address this issue, simply delay the set_page_huge_active call until after the page is successfully added to the page table.
Hugetlb pages can also be leaked at migration time if the pages are associated with a file in an explicitly mounted hugetlbfs filesystem. For example, consider a two node system with 4GB worth of huge pages available. A program mmaps a 2G file in a hugetlbfs filesystem. It then migrates the pages associated with the file from one node to another. When the program exits, huge page counts are as follows:
node0
1024 free_hugepages
1024 nr_hugepages
node1
0 free_hugepages
1024 nr_hugepages
Filesystem Size Used Avail Use% Mounted on nodev 4.0G 2.0G 2.0G 50% /var/opt/hugepool
That is as expected. 2G of huge pages are taken from the free_hugepages counts, and 2G is the size of the file in the explicitly mounted filesystem. If the file is then removed, the counts become:
node0
1024 free_hugepages
1024 nr_hugepages
node1
1024 free_hugepages
1024 nr_hugepages
Filesystem Size Used Avail Use% Mounted on nodev 4.0G 2.0G 2.0G 50% /var/opt/hugepool
Note that the filesystem still shows 2G of pages used, while there actually are no huge pages in use. The only way to 'fix' the filesystem accounting is to unmount the filesystem
If a hugetlb page is associated with an explicitly mounted filesystem, this information in contained in the page_private field. At migration time, this information is not preserved. To fix, simply transfer page_private from old to new page at migration time if necessary.
There is a related race with removing a huge page from a file and migration. When a huge page is removed from the pagecache, the page_mapping() field is cleared, yet page_private remains set until the page is actually freed by free_huge_page(). A page could be migrated while in this state. However, since page_mapping() is not set the hugetlbfs specific routine to transfer page_private is not called and we leak the page count in the filesystem.
To fix that, check for this condition before migrating a huge page. If the condition is detected, return EBUSY for the page.
--- fs/hugetlbfs/inode.c | 12 ++++++++++++ mm/hugetlb.c | 16 +++++++++++++--- mm/migrate.c | 11 +++++++++++ 3 files changed, 36 insertions(+), 3 deletions(-)
fs/hugetlbfs/inode.c +12 -0
@@ -845,6 +845,18 @@ static int hugetlbfs_migrate_page(struct rc =migrate_huge_page_move_mapping (mapping, newpage, page);if (rc !=MIGRATEPAGE_SUCCESS )return rc; + +/* +* page_private is subpool pointer in hugetlb pages. Transfer to +* new page. PagePrivate is not associated with page_private for +* hugetlb pages and can not be set here as only page_huge_active +* pages can be migrated. +*/ +if (page_private (page)) { +set_page_private (newpage,page_private (page)); +set_page_private (page,0 ); + } +if (mode !=MIGRATE_SYNC_NO_COPY )migrate_page_copy (newpage, page);else
mm/hugetlb.c +13 -3
@@ -3577,7 +3577,6 @@ retry_avoidcopy:copy_user_huge_page (new_page, old_page, address, vma,pages_per_huge_page (h));__SetPageUptodate (new_page); -set_page_huge_active (new_page); mmun_start = address &huge_page_mask (h); mmun_end = mmun_start +huge_page_size (h);
@@ -3600,6 +3599,7 @@ retry_avoidcopy: make_huge_pte(vma, new_page, 1));page_remove_rmap (old_page, true);hugepage_add_new_anon_rmap (new_page, vma, address); +set_page_huge_active (new_page);/* Make the old page be freed below */ new_page = old_page; }
@@ -3682,6 +3682,7 @@ static int hugetlb_no_page(struct mm_strstruct page *page;pte_t new_pte;spinlock_t *ptl; +bool new_page = false;/* * Currently, we are forced to kill the process in the event the
@@ -3747,7 +3748,7 @@ retry: }clear_huge_page (page, address,pages_per_huge_page (h));__SetPageUptodate (page); -set_page_huge_active (page); + new_page = true;if (vma->vm_flags &VM_MAYSHARE ) {int err =huge_add_to_page_cache (page, mapping, idx);
@@ -3818,6 +3819,15 @@ retry: }spin_unlock (ptl); + +/* +* Only make newly allocated pages active. Existing pages found +* in the pagecache could be !page_huge_active() if they have been +* isolated for migration. +*/ +if (new_page) +set_page_huge_active (page); +unlock_page (page); out:return ret;
@@ -4053,7 +4063,6 @@ int hugetlb_mcopy_atomic_pte(struct mm_s* the set_pte_at() write. */ __SetPageUptodate (page); -set_page_huge_active (page); mapping = dst_vma->vm_file->f_mapping; idx =vma_hugecache_offset (h, dst_vma, dst_addr);
@@ -4121,6 +4130,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_supdate_mmu_cache (dst_vma, dst_addr, dst_pte);spin_unlock (ptl); +set_page_huge_active (page);if (vm_shared)unlock_page (page); ret =0 ;
mm/migrate.c +11 -0
@@ -1303,6 +1303,16 @@ static int unmap_and_move_huge_page(new_lock_page (hpage); } +/* +* Check for pages which are in the process of being freed. Without +* page_mapping() set, hugetlbfs specific move page routine will not +* be called and we could leak usage counts for subpools. +*/ +if (page_private (hpage) && !page_mapping (hpage)) { + rc = -EBUSY ; + goto out_unlock; + } +if (PageAnon (hpage)) anon_vma =page_get_anon_vma (hpage);
@@ -1334,6 +1344,7 @@ put_anon:set_page_owner_migrate_reason (new_hpage, reason); } +out_unlock:unlock_page (hpage); out:if (rc != -EAGAIN )
Greg Kroah-Hartman
maintainerPATCH 39/135 xtensa: fix get_wchan
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit d90b88fd3653f1fb66ecc6571b860d5a5749fa56 upstream.
Stack unwinding is implemented incorrectly in xtensa get_wchan: instead of extracting a0 and a1 registers from the spill location under the stack pointer it extracts a word pointed to by the stack pointer and subtracts 4 or 3 from it.
--- arch/xtensa/kernel/process.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/xtensa/kernel/process.c +2 -2
@@ -314,8 +314,8 @@ unsigned long get_wchan(struct task_stru/* Stack layout: sp-4: ra, sp-3: sp' */ - pc =MAKE_PC_FROM_RA (*(unsigned long *)sp -4 , sp); - sp = *(unsigned long *)sp -3 ; + pc =MAKE_PC_FROM_RA (SPILL_SLOT (sp,0 ), sp); + sp =SPILL_SLOT (sp,1 ); }while (count++ <16 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 40/135 Bluetooth: Fix locking in bt_accept_enqueue() for BH context
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Kaehlcke <[email protected]>
commit c4f5627f7eeecde1bb6b646d8c0907b96dc2b2a6 upstream.
With commit e16337622016 ("Bluetooth: Handle bt_accept_enqueue() socket atomically") lock_sock[_nested]() is used to acquire the socket lock before manipulating the socket. lock_sock[_nested]() may block, which is problematic since bt_accept_enqueue() can be called in bottom half context (e.g. from rfcomm_connect_ind()):
[<ffffff80080d81ec>] __might_sleep+0x4c/0x80 [<ffffff800876c7b0>] lock_sock_nested+0x24/0x58 [<ffffff8000d7c27c>] bt_accept_enqueue+0x48/0xd4 [bluetooth] [<ffffff8000e67d8c>] rfcomm_connect_ind+0x190/0x218 [rfcomm]
Add a parameter to bt_accept_enqueue() to indicate whether the function is called from BH context, and acquire the socket lock with bh_lock_sock_nested() if that's the case.
Also adapt all callers of bt_accept_enqueue() to pass the new parameter:
- l2cap_sock_new_connection_cb()
- uses lock_sock() to lock the parent socket => process context
- rfcomm_connect_ind()
- acquires the parent socket lock with bh_lock_sock() => BH context
- __sco_chan_add()
- called from sco_chan_add(), which is called from sco_connect(). parent is NULL, hence bt_accept_enqueue() isn't called in this code path and we can ignore it
- also called from sco_conn_ready(). uses bh_lock_sock() to acquire the parent lock => BH context
--- include/net/bluetooth/bluetooth.h | 2 +- net/bluetooth/af_bluetooth.c | 16 +++++++++++++--- net/bluetooth/l2cap_sock.c | 2 +- net/bluetooth/rfcomm/sock.c | 2 +- net/bluetooth/sco.c | 2 +- 5 files changed, 17 insertions(+), 7 deletions(-)
include/net/bluetooth/bluetooth.h +1 -1
@@ -273,7 +273,7 @@ int bt_sock_ioctl(struct socket *sock,int bt_sock_wait_state (struct sock *sk,int state,unsigned long timeo);int bt_sock_wait_ready (struct sock *sk,unsigned long flags); -void bt_accept_enqueue (struct sock *parent,struct sock *sk); +void bt_accept_enqueue (struct sock *parent,struct sock *sk,bool bh);void bt_accept_unlink (struct sock *sk);struct sock *bt_accept_dequeue (struct sock *parent,struct socket *newsock);
net/bluetooth/af_bluetooth.c +13 -3
@@ -154,15 +154,25 @@ void bt_sock_unlink(struct bt_sock_list }EXPORT_SYMBOL (bt_sock_unlink); -void bt_accept_enqueue (struct sock *parent,struct sock *sk) +void bt_accept_enqueue (struct sock *parent,struct sock *sk,bool bh) {BT_DBG ("parent %p, sk %p" , parent, sk);sock_hold (sk); -lock_sock_nested (sk,SINGLE_DEPTH_NESTING ); + +if (bh) +bh_lock_sock_nested (sk); +else +lock_sock_nested (sk,SINGLE_DEPTH_NESTING ); +list_add_tail (&bt_sk (sk)->accept_q, &bt_sk (parent)->accept_q);bt_sk (sk)->parent = parent; -release_sock (sk); + +if (bh) +bh_unlock_sock (sk); +else +release_sock (sk); + parent->sk_ack_backlog++; }EXPORT_SYMBOL (bt_accept_enqueue);
net/bluetooth/l2cap_sock.c +1 -1
@@ -1253,7 +1253,7 @@ static struct l2cap_chan *l2cap_sock_newl2cap_sock_init (sk, parent); -bt_accept_enqueue (parent, sk); +bt_accept_enqueue (parent, sk, false);release_sock (parent);
net/bluetooth/rfcomm/sock.c +1 -1
@@ -988,7 +988,7 @@ int rfcomm_connect_ind(struct rfcomm_sesrfcomm_pi (sk)->channel = channel; sk->sk_state =BT_CONFIG ; -bt_accept_enqueue (parent, sk); +bt_accept_enqueue (parent, sk, true);/* Accept connection and return socket DLC */ *d =rfcomm_pi (sk)->dlc;
net/bluetooth/sco.c +1 -1
@@ -193,7 +193,7 @@ static void __sco_chan_add(struct sco_co conn->sk = sk;if (parent) -bt_accept_enqueue (parent, sk); +bt_accept_enqueue (parent, sk, true); } static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
Greg Kroah-Hartman
maintainerPATCH 41/135 exec: Fix mem leak in kernel_read_file
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
commit f612acfae86af7ecad754ae6a46019be9da05b8e upstream.
syzkaller report this:
BUG: memory leak
unreferenced object 0xffffc9000488d000 (size 9195520):
comm "syz-executor.0", pid 2752, jiffies 4294787496 (age 18.757s)
hex dump (first 32 bytes):
ff ff ff ff ff ff ff ff a8 00 00 00 01 00 00 00 ................
02 00 00 00 00 00 00 00 80 a1 7a c1 ff ff ff ff ..........z.....
backtrace:
[<000000000863775c>] __vmalloc_node mm/vmalloc.c:1795 [inline]
[<000000000863775c>] __vmalloc_node_flags mm/vmalloc.c:1809 [inline]
[<000000000863775c>] vmalloc+0x8c/0xb0 mm/vmalloc.c:1831
[<000000003f668111>] kernel_read_file+0x58f/0x7d0 fs/exec.c:924
[<000000002385813f>] kernel_read_file_from_fd+0x49/0x80 fs/exec.c:993
[<0000000011953ff1>] __do_sys_finit_module+0x13b/0x2a0 kernel/module.c:3895
[<000000006f58491f>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
[<00000000ee78baf4>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000241f889b>] 0xffffffffffffffffIt should goto 'out_free' lable to free allocated buf while kernel_read fails.
--- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/exec.c +1 -1
@@ -925,7 +925,7 @@ int kernel_read_file(struct file *file, bytes =kernel_read (file, *buf + pos, i_size - pos, &pos);if (bytes <0 ) { ret = bytes; - goto out; + goto out_free; }if (bytes ==0 )
Greg Kroah-Hartman
maintainerPATCH 42/135 scsi: core: reset host byte in DID_NEXUS_FAILURE case
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <[email protected]>
commit 4a067cf823d9d8e50d41cfb618011c0d4a969c72 upstream.
Up to 4.12, __scsi_error_from_host_byte() would reset the host byte to DID_OK for various cases including DID_NEXUS_FAILURE. Commit 2a842acab109 ("block: introduce new block status code type") replaced this function with scsi_result_to_blk_status() and removed the host-byte resetting code for the DID_NEXUS_FAILURE case. As the line set_host_byte(cmd, DID_OK) was preserved for the other cases, I suppose this was an editing mistake.
The fact that the host byte remains set after 4.13 is causing problems with the sg_persist tool, which now returns success rather then exit status 24 when a RESERVATION CONFLICT error is encountered.
--- drivers/scsi/scsi_lib.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/scsi_lib.c +1 -0
@@ -734,6 +734,7 @@ static blk_status_t __scsi_error_from_hoset_host_byte (cmd,DID_OK );return BLK_STS_TARGET ;case DID_NEXUS_FAILURE : +set_host_byte (cmd,DID_OK );return BLK_STS_NEXUS ;case DID_ALLOC_FAILURE :set_host_byte (cmd,DID_OK );
Greg Kroah-Hartman
maintainerPATCH 43/135 media: uvcvideo: Fix type check leading to overflow
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Strachan <[email protected]>
commit 47bb117911b051bbc90764a8bff96543cbd2005f upstream.
When initially testing the Camera Terminal Descriptor wTerminalType field (buffer[4]), no mask is used. Later in the function, the MSB is overloaded to store the descriptor subtype, and so a mask of 0x7fff is used to check the type.
If a descriptor is specially crafted to set this overloaded bit in the original wTerminalType field, the initial type check will fail (falling through, without adjusting the buffer size), but the later type checks will pass, assuming the buffer has been made suitably large, causing an overflow.
Avoid this problem by checking for the MSB in the wTerminalType field. If the bit is set, assume the descriptor is bad, and abort parsing it.
Originally reported here:
https://groups.google.com/forum/#!topic/syzkaller/Ot1fOE6v1d8
A similar (non-compiling) patch was provided at that time.
--- drivers/media/usb/uvc/uvc_driver.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +11 -3
@@ -1054,11 +1054,19 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } -/* Make sure the terminal type MSB is not null, otherwise it -* could be confused with a unit. +/* +* Reject invalid terminal types that would cause issues: +* +* - The high byte must be non-zero, otherwise it would be +* confused with a unit. +* +* - Bit 15 must be 0, as we use it internally as a terminal +* direction flag. +* +* Other unknown types are accepted. */ type =get_unaligned_le16 (&buffer[4 ]); -if ((type &0xff00 ) ==0 ) { +if ((type &0x7f00 ) ==0 || (type &0x8000 ) !=0 ) { uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " "interface %d INPUT_TERMINAL %d has invalid " "type 0x%04x, skipping\n", udev->devnum,
Greg Kroah-Hartman
maintainerPATCH 44/135 vti4: Fix a ipip packet processing bug in IPCOMP virtual tunnel
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dd9ee3444014e8f28c0eefc9fffc9ac9c5248c12 ]
Recently we run a network test over ipcomp virtual tunnel.We find that if a ipv4 packet needs fragment, then the peer can't receive it.
We deep into the code and find that when packet need fragment the smaller fragment will be encapsulated by ipip not ipcomp. So when the ipip packet goes into xfrm, it's skb->dev is not properly set. The ipv4 reassembly code always set skb'dev to the last fragment's dev. After ipv4 defrag processing, when the kernel rp_filter parameter is set, the skb will be drop by -EXDEV error.
This patch adds compatible support for the ipip process in ipcomp virtual tunnel.
--- net/ipv4/ip_vti.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+)
net/ipv4/ip_vti.c +50 -0
@@ -74,6 +74,33 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,return 0 ; } +static int vti_input_ipip (struct sk_buff *skb,int nexthdr,__be32 spi, +int encap_type) +{ +struct ip_tunnel *tunnel; +const struct iphdr *iph =ip_hdr (skb); +struct net *net =dev_net (skb->dev); +struct ip_tunnel_net *itn =net_generic (net, vti_net_id); + + tunnel =ip_tunnel_lookup (itn, skb->dev->ifindex,TUNNEL_NO_KEY , + iph->saddr, iph->daddr,0 ); +if (tunnel) { +if (!xfrm4_policy_check (NULL ,XFRM_POLICY_IN , skb)) + goto drop; + +XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip4 = tunnel; + + skb->dev = tunnel->dev; + +return xfrm_input (skb, nexthdr, spi, encap_type); + } + +return -EINVAL ; +drop: +kfree_skb (skb); +return 0 ; +} +static int vti_rcv (struct sk_buff *skb) {XFRM_SPI_SKB_CB (skb)->family =AF_INET ;
@@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb)return vti_input (skb,ip_hdr (skb)->protocol,0 ,0 ); } +static int vti_rcv_ipip (struct sk_buff *skb) +{ +XFRM_SPI_SKB_CB (skb)->family =AF_INET ; +XFRM_SPI_SKB_CB (skb)->daddroff = offsetof(struct iphdr , daddr); + +return vti_input_ipip (skb,ip_hdr (skb)->protocol,ip_hdr (skb)->saddr,0 ); +} +static int vti_rcv_cb (struct sk_buff *skb,int err) {unsigned short family;
@@ -439,6 +474,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = { .priority = 100, }; +static struct xfrm_tunnel ipip_handler__read_mostly = { + .handler = vti_rcv_ipip, + .err_handler = vti4_err, + .priority =0 , +}; +static int __net_init vti_init_net (struct net *net) {int err;
@@ -607,6 +648,13 @@ static int __init vti_init(void)if (err <0 ) goto xfrm_proto_comp_failed; + msg ="ipip tunnel" ; + err =xfrm4_tunnel_register (&ipip_handler,AF_INET ); +if (err <0 ) { +pr_info ("%s: cant't register tunnel\n" ,__func__); + goto xfrm_tunnel_failed; + } + msg ="netlink interface" ; err =rtnl_link_register (&vti_link_ops);if (err <0 )
@@ -616,6 +664,8 @@ static int __init vti_init(void) rtnl_link_failed:xfrm4_protocol_deregister (&vti_ipcomp4_protocol,IPPROTO_COMP ); +xfrm_tunnel_failed: +xfrm4_tunnel_deregister (&ipip_handler,AF_INET ); xfrm_proto_comp_failed:xfrm4_protocol_deregister (&vti_ah4_protocol,IPPROTO_AH ); xfrm_proto_ah_failed:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 45/135 perf core: Fix perf_proc_update_handler() bug
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1a51c5da5acc6c188c917ba572eebac5f8793432 ]
The perf_proc_update_handler() handles /proc/sys/kernel/perf_event_max_sample_rate syctl variable. When the PMU IRQ handler timing monitoring is disabled, i.e, when /proc/sys/kernel/perf_cpu_time_max_percent is equal to 0 or 100, then no modification to sysctl_perf_event_sample_rate is allowed to prevent possible hang from wrong values.
The problem is that the test to prevent modification is made after the sysctl variable is modified in perf_proc_update_handler().
You get an error:
$ echo 10001 >/proc/sys/kernel/perf_event_max_sample_rate echo: write error: invalid argument
But the value is still modified causing all sorts of inconsistencies:
$ cat /proc/sys/kernel/perf_event_max_sample_rate 10001
This patch fixes the problem by moving the parsing of the value after the test.
Committer testing:
# echo 100 > /proc/sys/kernel/perf_cpu_time_max_percent # echo 10001 > /proc/sys/kernel/perf_event_max_sample_rate -bash: echo: write error: Invalid argument # cat /proc/sys/kernel/perf_event_max_sample_rate 10001 #
--- kernel/events/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
kernel/events/core.c +7 -7
@@ -436,18 +436,18 @@ int perf_proc_update_handler(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos) { - int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); - -if (ret || !write) -return ret; - + int ret; +int perf_cpu = sysctl_perf_cpu_time_max_percent;/* * If throttling is disabled don't allow the write: */ -if (sysctl_perf_cpu_time_max_percent ==100 || - sysctl_perf_cpu_time_max_percent ==0 ) +if (write && (perf_cpu ==100 || perf_cpu ==0 ))return -EINVAL ; + ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos); +if (ret || !write) +return ret; + max_samples_per_tick =DIV_ROUND_UP (sysctl_perf_event_sample_rate,HZ ); perf_sample_period_ns =NSEC_PER_SEC / sysctl_perf_event_sample_rate;update_perf_cpu_limits ();
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 46/135 perf tools: Handle TOPOLOGY headers with no CPU
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1497e804d1a6e2bd9107ddf64b0310449f4673eb ]
This patch fixes an issue in cpumap.c when used with the TOPOLOGY header. In some configurations, some NUMA nodes may have no CPU (empty cpulist). Yet a cpumap map must be created otherwise perf abort with an error. This patch handles this case by creating a dummy map.
Before:
$ perf record -o - -e cycles noploop 2 | perf script -i - 0x6e8 [0x6c]: failed to process type: 80
After:
$ perf record -o - -e cycles noploop 2 | perf script -i - noploop for 2 seconds
--- tools/perf/util/cpumap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
tools/perf/util/cpumap.c +9 -2
@@ -134,7 +134,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list)if (!cpu_list)return cpu_map__read_all_cpu_map (); -if (!isdigit (*cpu_list)) +/* +* must handle the case of empty cpumap to cover +* TOPOLOGY header for NUMA nodes with no CPU +* ( e.g., because of CPU hotplug) +*/ +if (!isdigit (*cpu_list) && *cpu_list !='\0' ) goto out;while (isdigit (*cpu_list)) {
@@ -181,8 +186,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list)if (nr_cpus >0 ) cpus =cpu_map__trim_new (nr_cpus, tmp_cpus); -else +else if (*cpu_list !='\0' ) cpus =cpu_map__default_new (); +else + cpus =cpu_map__dummy_new (); invalid:free (tmp_cpus); out:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 47/135 IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 904bba211acc2112fdf866e5a2bc6cd9ecd0de1b ]
The work completion length for a receiving a UD send with immediate is short by 4 bytes causing application using this opcode to fail.
The UD receive logic incorrectly subtracts 4 bytes for immediate value. These bytes are already included in header length and are used to calculate header/payload split, so the result is these 4 bytes are subtracted twice, once when the header length subtracted from the overall length and once again in the UD opcode specific path.
Remove the extra subtraction when handling the opcode.
--- drivers/infiniband/hw/hfi1/ud.c | 1 - drivers/infiniband/hw/qib/qib_ud.c | 1 - 2 files changed, 2 deletions(-)
drivers/infiniband/hw/hfi1/ud.c +0 -1
@@ -954,7 +954,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet) opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { wc.ex.imm_data = ohdr->u.ud.imm_data; wc.wc_flags =IB_WC_WITH_IMM ; - tlen -=sizeof (u32); } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { wc.ex.imm_data =0 ; wc.wc_flags =0 ;
drivers/infiniband/hw/qib/qib_ud.c +0 -1
@@ -515,7 +515,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr, opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { wc.ex.imm_data = ohdr->u.ud.imm_data; wc.wc_flags =IB_WC_WITH_IMM ; - tlen -=sizeof (u32); } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { wc.ex.imm_data =0 ; wc.wc_flags =0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 48/135 iommu/amd: Call free_iova_fast with pfn in map_sg
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 51d8838d66d3249508940d8f59b07701f2129723 ]
In the error path of map_sg, free_iova_fast is being called with address instead of the pfn. This results in a bad value getting into the rcache, and can result in hitting a BUG_ON when iova_magazine_free_pfns is called.
--- drivers/iommu/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd_iommu.c +1 -1
@@ -2566,7 +2566,7 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, } out_free_iova: -free_iova_fast (&dma_dom->iovad, address, npages); +free_iova_fast (&dma_dom->iovad, address >>PAGE_SHIFT , npages); out_err:return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 49/135 iommu/amd: Unmap all mapped pages in error path of map_sg
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f1724c0883bb0ce93b8dcb94b53dcca3b75ac9a7 ]
In the error path of map_sg there is an incorrect if condition for breaking out of the loop that searches the scatterlist for mapped pages to unmap. Instead of breaking out of the loop once all the pages that were mapped have been unmapped, it will break out of the loop after it has unmapped 1 page. Fix the condition, so it breaks out of the loop only after all the mapped pages have been unmapped.
--- drivers/iommu/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd_iommu.c +1 -1
@@ -2560,7 +2560,7 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, bus_addr = address + s->dma_address + (j <<PAGE_SHIFT );iommu_unmap_page (domain, bus_addr,PAGE_SIZE ); -if (--mapped_pages) +if (--mapped_pages ==0 ) goto out_free_iova; } }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 50/135 ipvs: Fix signed integer overflow when setsockopt timeout
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 53ab60baa1ac4f20b080a22c13b77b6373922fd7 ]
There is a UBSAN bug report as below:
UBSAN: Undefined behaviour in net/netfilter/ipvs/ip_vs_ctl.c:2227:21
signed integer overflow:
-2147483647 * 1000 cannot be represented in type 'int'
Reproduce program:
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#define IPPROTO_IP 0
#define IPPROTO_RAW 255
#define IP_VS_BASE_CTL (64+1024+64)
#define IP_VS_SO_SET_TIMEOUT (IP_VS_BASE_CTL+10)
/* The argument to IP_VS_SO_GET_TIMEOUT */
struct ipvs_timeout_t {
int tcp_timeout;
int tcp_fin_timeout;
int udp_timeout;
};
int main() {
int ret = -1;
int sockfd = -1;
struct ipvs_timeout_t to;
sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (sockfd == -1) {
printf("socket init error\n");
return -1;
}
to.tcp_timeout = -2147483647;
to.tcp_fin_timeout = -2147483647;
to.udp_timeout = -2147483647;
ret = setsockopt(sockfd,
IPPROTO_IP,
IP_VS_SO_SET_TIMEOUT,
(char *)(&to),
sizeof(to));
printf("setsockopt return %d\n", ret);
return ret;
}Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
--- net/netfilter/ipvs/ip_vs_ctl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/netfilter/ipvs/ip_vs_ctl.c +12 -0
@@ -2252,6 +2252,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user u->tcp_fin_timeout, u->udp_timeout); +#ifdef CONFIG_IP_VS_PROTO_TCP +if (u->tcp_timeout <0 || u->tcp_timeout > (INT_MAX /HZ ) || + u->tcp_fin_timeout <0 || u->tcp_fin_timeout > (INT_MAX /HZ )) { +return -EINVAL ; + } +#endif + +#ifdef CONFIG_IP_VS_PROTO_UDP +if (u->udp_timeout <0 || u->udp_timeout > (INT_MAX /HZ )) +return -EINVAL ; +#endif +#ifdef CONFIG_IP_VS_PROTO_TCP if (u->tcp_timeout) { pd =ip_vs_proto_data_get (ipvs,IPPROTO_TCP );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 51/135 iommu/amd: Fix IOMMU page flush when detach device from a domain
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9825bd94e3a2baae1f4874767ae3a7d4c049720e ]
When a VM is terminated, the VFIO driver detaches all pass-through devices from VFIO domain by clearing domain id and page table root pointer from each device table entry (DTE), and then invalidates the DTE. Then, the VFIO driver unmap pages and invalidate IOMMU pages.
Currently, the IOMMU driver keeps track of which IOMMU and how many devices are attached to the domain. When invalidate IOMMU pages, the driver checks if the IOMMU is still attached to the domain before issuing the invalidate page command.
However, since VFIO has already detached all devices from the domain, the subsequent INVALIDATE_IOMMU_PAGES commands are being skipped as there is no IOMMU attached to the domain. This results in data corruption and could cause the PCI device to end up in indeterministic state.
Fix this by invalidate IOMMU pages when detach a device, and before decrementing the per-domain device reference counts.
--- drivers/iommu/amd_iommu.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/iommu/amd_iommu.c +11 -4
@@ -1919,6 +1919,7 @@ static void do_attach(struct iommu_dev_data *dev_data,static void do_detach (struct iommu_dev_data *dev_data) { +struct protection_domain *domain = dev_data->domain;struct amd_iommu *iommu;u16 alias;
@@ -1934,10 +1935,6 @@ static void do_detach(struct iommu_dev_data *dev_data) iommu = amd_iommu_rlookup_table[dev_data->devid]; alias = dev_data->alias; -/* decrease reference counters */ - dev_data->domain->dev_iommu[iommu->index] -=1 ; - dev_data->domain->dev_cnt -=1 ; -/* Update data structures */ dev_data->domain =NULL ;list_del (&dev_data->list);
@@ -1947,6 +1944,16 @@ static void do_detach(struct iommu_dev_data *dev_data)/* Flush the DTE entry */ device_flush_dte (dev_data); + +/* Flush IOTLB */ +domain_flush_tlb_pde (domain); + +/* Wait for the flushes to finish */ +domain_flush_complete (domain); + +/* decrease reference counters - needs to happen after the flushes */ + domain->dev_iommu[iommu->index] -=1 ; + domain->dev_cnt -=1 ; }/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 52/135 xtensa: SMP: fix ccount_timer_shutdown
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4fe8713b873fc881284722ce4ac47995de7cf62c ]
ccount_timer_shutdown is called from the atomic context in the secondary_start_kernel, resulting in the following BUG:
BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 1, pid: 0, name: swapper/1 Preemption disabled at: secondary_start_kernel+0xa1/0x130 Call Trace: ___might_sleep+0xe7/0xfc __might_sleep+0x41/0x44 synchronize_irq+0x24/0x64 disable_irq+0x11/0x14 ccount_timer_shutdown+0x12/0x20 clockevents_switch_state+0x82/0xb4 clockevents_exchange_device+0x54/0x60 tick_check_new_device+0x46/0x70 clockevents_register_device+0x8c/0xc8 clockevents_config_and_register+0x1d/0x2c local_timer_setup+0x75/0x7c secondary_start_kernel+0xb4/0x130 should_never_return+0x32/0x35
Use disable_irq_nosync instead of disable_irq to avoid it. This is safe because the ccount timer IRQ is per-CPU, and once IRQ is masked the ISR will not be called.
--- arch/xtensa/kernel/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/time.c +1 -1
@@ -89,7 +89,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt) container_of(evt, struct ccount_timer, evt);if (timer->irq_enabled) { -disable_irq (evt->irq); +disable_irq_nosync (evt->irq); timer->irq_enabled =0 ; }return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 53/135 selftests: cpu-hotplug: fix case where CPUs offline > CPUs present
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2b531b6137834a55857a337ac17510d6436b6fbb ]
The cpu-hotplug test assumes that we can offline the maximum CPU as described by /sys/devices/system/cpu/offline. However, in the case where the number of CPUs exceeds like kernel configuration then the offline count can be greater than the present count and we end up trying to test the offlining of a CPU that is not available to offline. Fix this by testing the maximum present CPU instead.
Also, the test currently offlines the CPU and does not online it, so fix this by onlining the CPU after the test.
--- .../selftests/cpu-hotplug/cpu-on-off-test.sh | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh +10 -3
@@ -35,6 +35,10 @@ prerequisite() exit 0 fi + present_cpus=`cat $SYSFS/devices/system/cpu/present` + present_max=${present_cpus##*-} + echo "present_cpus = $present_cpus present_max = $present_max" + echo -e "\t Cpus in online state: $online_cpus" offline_cpus=`cat $SYSFS/devices/system/cpu/offline`
@@ -149,6 +153,8 @@ online_cpus=0 online_max=0 offline_cpus=0 offline_max=0 +present_cpus=0 +present_max=0 while getopts e:ahp: opt; do case $opt in
@@ -188,9 +194,10 @@ if [ $allcpus -eq 0 ]; then online_cpu_expect_success $online_max if [[ $offline_cpus -gt 0 ]]; then - echo -e "\t offline to online to offline: cpu $offline_max" - online_cpu_expect_success $offline_max - offline_cpu_expect_success $offline_max + echo -e "\t offline to online to offline: cpu $present_max" + online_cpu_expect_success $present_max + offline_cpu_expect_success $present_max + online_cpu $present_max fi exit 0 else
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 54/135 xtensa: SMP: fix secondary CPU initialization
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 32a7726c4f4aadfabdb82440d84f88a5a2c8fe13 ]
- add missing memory barriers to the secondary CPU synchronization spin loops; add comment to the matching memory barrier in the boot_secondary and __cpu_die functions;
- use READ_ONCE/WRITE_ONCE to access cpu_start_id/cpu_start_ccount instead of reading/writing them directly;
- re-initialize cpu_running every time before starting secondary CPU to flush possible previous CPU startup results.
--- arch/xtensa/kernel/head.S | 5 ++++- arch/xtensa/kernel/smp.c | 34 +++++++++++++++++++++------------- 2 files changed, 25 insertions(+), 14 deletions(-)
arch/xtensa/kernel/head.S +4 -1
@@ -281,12 +281,13 @@ should_never_return: movi a2, cpu_start_ccount 1: + memw l32i a3, a2, 0 beqi a3, 0, 1b movi a3, 0 s32i a3, a2, 0 - memw 1: + memw l32i a3, a2, 0 beqi a3, 0, 1b wsr a3, ccount
@@ -323,11 +324,13 @@ ENTRY(cpu_restart) rsr a0, prid neg a2, a0 movi a3, cpu_start_id + memw s32i a2, a3, 0 #if XCHAL_DCACHE_IS_WRITEBACK dhwbi a3, 0 #endif 1: + memw l32i a2, a3, 0 dhi a3, 0 bne a2, a0, 1b
arch/xtensa/kernel/smp.c +21 -13
@@ -195,9 +195,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)int i;#ifdef CONFIG_HOTPLUG_CPU - cpu_start_id = cpu; -system_flush_invalidate_dcache_range ( - (unsigned long )&cpu_start_id,sizeof (cpu_start_id)); +WRITE_ONCE (cpu_start_id, cpu); +/* Pairs with the third memw in the cpu_restart */ +mb (); +system_flush_invalidate_dcache_range ((unsigned long )&cpu_start_id, +sizeof (cpu_start_id));#endif smp_call_function_single (0 , mx_cpu_start, (void *)cpu,1 );
@@ -206,18 +208,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts) ccount =get_ccount ();while (!ccount); - cpu_start_ccount = ccount; +WRITE_ONCE (cpu_start_ccount, ccount); -while (time_before (jiffies, timeout)) { +do { +/* +* Pairs with the first two memws in the +* .Lboot_secondary. +*/ mb (); -if (!cpu_start_ccount) -break ; - } + ccount =READ_ONCE (cpu_start_ccount); + }while (ccount &&time_before (jiffies, timeout)); -if (cpu_start_ccount) { +if (ccount) {smp_call_function_single (0 , mx_cpu_stop, - (void *)cpu,1 ); - cpu_start_ccount =0 ; + (void *)cpu,1 ); +WRITE_ONCE (cpu_start_ccount,0 );return -EIO ; } }
@@ -237,6 +242,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)pr_debug ("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n" , __func__, cpu, idle, start_info.stack); +init_completion (&cpu_running); ret =boot_secondary (cpu, idle);if (ret ==0 ) { wait_for_completion_timeout(&cpu_running,
@@ -298,8 +304,10 @@ void __cpu_die(unsigned int cpu)unsigned long timeout = jiffies +msecs_to_jiffies (1000 );while (time_before (jiffies, timeout)) {system_invalidate_dcache_range ((unsigned long )&cpu_start_id, -sizeof (cpu_start_id)); -if (cpu_start_id == -cpu) { +sizeof (cpu_start_id)); +/* Pairs with the second memw in the cpu_restart */ +mb (); +if (READ_ONCE (cpu_start_id) == -cpu) {platform_cpu_kill (cpu);return ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 55/135 xtensa: smp_lx200_defconfig: fix vectors clash
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 306b38305c0f86de7f17c5b091a95451dcc93d7d ]
Secondary CPU reset vector overlaps part of the double exception handler code, resulting in weird crashes and hangups when running user code. Move exception vectors one page up so that they don't clash with the secondary CPU reset vector.
--- arch/xtensa/configs/smp_lx200_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/xtensa/configs/smp_lx200_defconfig +1 -0
@@ -34,6 +34,7 @@ CONFIG_SMP=y CONFIG_HOTPLUG_CPU=y # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set # CONFIG_PCI is not set +CONFIG_VECTORS_OFFSET=0x00002000 CONFIG_XTENSA_PLATFORM_XTFPGA=y CONFIG_CMDLINE_BOOL=y CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=96M@0"
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 56/135 xtensa: SMP: mark each possible CPU as present
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8b1c42cdd7181200dc1fff39dcb6ac1a3fac2c25 ]
Otherwise it is impossible to enable CPUs after booting with 'maxcpus' parameter.
--- arch/xtensa/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/smp.c +1 -1
@@ -83,7 +83,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus) {unsigned i; -for (i =0 ; i < max_cpus; ++i) +for_each_possible_cpu (i)set_cpu_present (i, true); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 57/135 xtensa: SMP: limit number of possible CPUs by NR_CPUS
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 25384ce5f9530def39421597b1457d9462df6455 ]
This fixes the following warning at boot when the kernel is booted on a board with more CPU cores than was configured in NR_CPUS:
smp_init_cpus: Core Count = 8
smp_init_cpus: Core Id = 0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at include/linux/cpumask.h:121 smp_init_cpus+0x54/0x74
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.0-rc3-00015-g1459333f88a0 #124
Call Trace:
__warn$part$3+0x6a/0x7c
warn_slowpath_null+0x35/0x3c
smp_init_cpus+0x54/0x74
setup_arch+0x1c0/0x1d0
start_kernel+0x44/0x310
_startup+0x107/0x107--- arch/xtensa/kernel/smp.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/xtensa/kernel/smp.c +5 -0
@@ -96,6 +96,11 @@ void __init smp_init_cpus(void)pr_info ("%s: Core Count = %d\n" , __func__, ncpus);pr_info ("%s: Core Id = %d\n" , __func__, core_id); +if (ncpus >NR_CPUS ) { + ncpus =NR_CPUS ; +pr_info ("%s: limiting core count by %d\n" , __func__, ncpus); + } +for (i =0 ; i < ncpus; ++i)set_cpu_possible (i, true); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 58/135 net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6571ebce112a21ec9be68ef2f53b96fcd41fd81b ]
If fill_level was not zero and status was not BUSY, result of "tx_prod - tx_cons - inuse" might be zero. Subtracting 1 unconditionally results invalid negative return value on this case.
Make sure not to return an negative value.
--- drivers/net/ethernet/altera/altera_msgdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/altera/altera_msgdma.c +2 -1
@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv) &0xffff ;if (inuse) {/* Tx FIFO is not empty */ - ready = priv->tx_prod - priv->tx_cons - inuse -1 ; + ready =max_t (int, + priv->tx_prod - priv->tx_cons - inuse -1 ,0 ); }else {/* Check for buffered last packet */ status =csrrd32 (priv->tx_dma_csr,msgdma_csroffs (status));
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 59/135 net: hns: Fix for missing of_node_put() after of_parse_phandle()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 263c6d75f9a544a3c2f8f6a26de4f4808d8f59cf ]
In hns enet driver, we use of_parse_handle() to get hold of the device node related to "ae-handle" but we have missed to put the node reference using of_node_put() after we are done using the node. This patch fixes it.
Note:
This problem is stated in Link: https://lkml.org/lkml/2018/12/22/217
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +5 -0
@@ -2532,6 +2532,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev) out_notify_fail: (void )cancel_work_sync (&priv->service_task); out_read_prop_fail: +/* safe for ACPI FW */ +of_node_put (to_of_node (priv->fwnode));free_netdev (ndev);return ret; }
@@ -2561,6 +2563,9 @@ static int hns_nic_dev_remove(struct platform_device *pdev)set_bit (NIC_STATE_REMOVING , &priv->state); (void )cancel_work_sync (&priv->service_task); +/* safe for ACPI FW */ +of_node_put (to_of_node (priv->fwnode)); +free_netdev (ndev);return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 60/135 net: hns: Restart autoneg need return failed when autoneg off
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ed29ca8b9592562559c64d027fb5eb126e463e2c ]
The hns driver of earlier devices, when autoneg off, restart autoneg will return -EINVAL, so make the hns driver for the latest devices do the same.
--- drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +9 -7
@@ -1154,16 +1154,18 @@ static int hns_get_regs_len(struct net_device *net_dev)*/ static int hns_nic_nway_reset (struct net_device *netdev) { -int ret =0 ;struct phy_device *phy = netdev->phydev; -if (netif_running (netdev)) { -/* if autoneg is disabled, don't restart auto-negotiation */ -if (phy && phy->autoneg ==AUTONEG_ENABLE ) - ret =genphy_restart_aneg (phy); - } +if (!netif_running (netdev)) +return 0 ; -return ret; +if (!phy) +return -EOPNOTSUPP ; + +if (phy->autoneg !=AUTONEG_ENABLE ) +return -EINVAL ; + +return genphy_restart_aneg (phy); } static u32
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 61/135 net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cec8abba13e6a26729dfed41019720068eeeff2b ]
When reading phy registers via Clause 45 MDIO protocol, after write address operation, the driver use another write address operation, so can not read the right value of any phy registers. This patch fixes it.
--- drivers/net/ethernet/hisilicon/hns_mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns_mdio.c +1 -1
@@ -321,7 +321,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum) }hns_mdio_cmd_write (mdio_dev, is_c45, -MDIO_C45_WRITE_ADDR , phy_id, devad); +MDIO_C45_READ , phy_id, devad); }/* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 62/135 net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c69c29a1a0a8f68cd87e98ba4a5a79fb8ef2a58c ]
If phy_power_on() fails in rk_gmac_powerup(), clocks are left enabled.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +3 -1
@@ -1284,8 +1284,10 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv) } ret =phy_power_on (bsp_priv, true); -if (ret) +if (ret) { +gmac_clk_enable (bsp_priv, false);return ret; + }pm_runtime_enable (dev);pm_runtime_get_sync (dev);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 63/135 netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2035f3ff8eaa29cfb5c8e2160b0f6e85eeb21a95 ]
Unlike ip(6)tables ebtables only counts user-defined chains.
The effect is that a 32bit ebtables binary on a 64bit kernel can do 'ebtables -N FOO' only after adding at least one rule, else the request fails with -EINVAL.
This is a similar fix as done in3f1e53abff84 ("netfilter: ebtables: don't attempt to allocate 0-sized compat array").
--- net/bridge/netfilter/ebtables.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/bridge/netfilter/ebtables.c +6 -3
@@ -2292,9 +2292,12 @@ static int compat_do_replace(struct net *net, void __user *user,xt_compat_lock (NFPROTO_BRIDGE ); - ret =xt_compat_init_offsets (NFPROTO_BRIDGE , tmp.nentries); -if (ret <0 ) - goto out_unlock; +if (tmp.nentries) { + ret =xt_compat_init_offsets (NFPROTO_BRIDGE , tmp.nentries); +if (ret <0 ) + goto out_unlock; + } + ret =compat_copy_entries (entries_tmp, tmp.entries_size, &state);if (ret <0 ) goto out_unlock;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 64/135 gpio: vf610: Mask all GPIO interrupts
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7ae710f9f8b2cf95297e7bbfe1c09789a7dc43d4 ]
On SoC reset all GPIO interrupts are disable. However, if kexec is used to boot into a new kernel, the SoC does not experience a reset. Hence GPIO interrupts can be left enabled from the previous kernel. It is then possible for the interrupt to fire before an interrupt handler is registered, resulting in the kernel complaining of an "unexpected IRQ trap", the interrupt is never cleared, and so fires again, resulting in an interrupt storm.
Disable all GPIO interrupts before registering the GPIO IRQ chip.
--- drivers/gpio/gpio-vf610.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpio/gpio-vf610.c +5 -0
@@ -261,6 +261,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)struct vf610_gpio_port *port;struct resource *iores;struct gpio_chip *gc; +int i;int ret; port =devm_kzalloc (&pdev->dev,sizeof (*port),GFP_KERNEL );
@@ -300,6 +301,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)if (ret <0 )return ret; +/* Mask all GPIO interrupts */ +for (i =0 ; i < gc->ngpio; i++) +vf610_gpio_writel (0 , port->base +PORT_PCR (i)); +/* Clear the interrupt status register for all GPIO's */ vf610_gpio_writel (~0 , port->base +PORT_ISFR );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 65/135 selftests: timers: use LDLIBS instead of LDFLAGS
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7d4e591bc051d3382c45caaa2530969fb42ed23d ]
posix_timers fails to build due to undefined reference errors:
aarch64-linaro-linux-gcc --sysroot=/build/tmp-rpb-glibc/sysroots/hikey
-O2 -pipe -g -feliminate-unused-debug-types -O3 -Wl,-no-as-needed -Wall
-DKTEST -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -lrt -lpthread
posix_timers.c
-o /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers /tmp/cc1FTZzT.o: In function `check_timer_create':
/usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers.c:157:
undefined reference to `timer_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers.c:170:
undefined reference to `timer_settime'
collect2: error: ld returned 1 exit status
It's GNU Make and linker specific.
The default Makefile rule looks like:
$(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS)
When linking is done by gcc itself, no issue, but when it needs to be passed to proper ld, only LDLIBS follows and then ld cannot know what libs to link with.
More detail:
https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html
LDFLAGS
Extra flags to give to compilers when they are supposed to invoke the linker, ‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable instead.
LDLIBS
Library flags or names given to compilers when they are supposed to invoke the linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS variable.
https://lkml.org/lkml/2010/2/10/362
tools/perf: libraries must come after objects
Link order matters, use LDLIBS instead of LDFLAGS to properly link against libpthread.
--- tools/testing/selftests/timers/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/timers/Makefile +1 -1
@@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 CFLAGS += -O3 -Wl,-no-as-needed -Wall -LDFLAGS += -lrt -lpthread -lm +LDLIBS += -lrt -lpthread -lm # these are all "safe" tests that don't modify # system time or require escalated privileges
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 66/135 nfs: Fix NULL pointer dereference of dev_name
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 80ff00172407e0aad4b10b94ef0816fc3e7813cb ]
There is a NULL pointer dereference of dev_name in nfs_parse_devname()
The oops looks something like:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... RIP: 0010:nfs_fs_mount+0x3b6/0xc20 [nfs] ... Call Trace: ? ida_alloc_range+0x34b/0x3d0 ? nfs_clone_super+0x80/0x80 [nfs] ? nfs_free_parsed_mount_data+0x60/0x60 [nfs] mount_fs+0x52/0x170 ? __init_waitqueue_head+0x3b/0x50 vfs_kern_mount+0x6b/0x170 do_mount+0x216/0xdc0 ksys_mount+0x83/0xd0 __x64_sys_mount+0x25/0x30 do_syscall_64+0x65/0x220 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix this by adding a NULL check on dev_name
--- fs/nfs/super.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfs/super.c +5 -0
@@ -1901,6 +1901,11 @@ static int nfs_parse_devname(const char *dev_name,size_t len;char *end; +if (unlikely (!dev_name || !*dev_name)) { +dfprintk (MOUNT ,"NFS: device name not specified\n" ); +return -EINVAL ; + } +/* Is the host name protected with square brakcets? */ if (*dev_name =='[' ) { end =strchr (++dev_name,']' );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 67/135 qed: Fix bug in tx promiscuous mode settings
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9e71a15d8b5bbce25c637f7f8833cd3f45b65646 ]
When running tx switched traffic between VNICs created via a bridge(to which VFs are added), adapter drops the unicast packets in tx flow due to VNIC's ucast mac being unknown to it. But VF interfaces being in promiscuous mode should have caused adapter to accept all the unknown ucast packets. Later, it was found that driver doesn't really configure tx promiscuous mode settings to accept all unknown unicast macs.
This patch fixes tx promiscuous mode settings to accept all unknown/unmatched unicast macs and works out the scenario.
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +6 -1
@@ -607,6 +607,10 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn, (!!(accept_filter &QED_ACCEPT_MCAST_MATCHED ) && !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED))); +SET_FIELD (state,ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL , + (!!(accept_filter &QED_ACCEPT_UCAST_MATCHED ) && + !!(accept_filter &QED_ACCEPT_UCAST_UNMATCHED ))); +SET_FIELD (state,ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL , !!(accept_filter &QED_ACCEPT_BCAST ));
@@ -2640,7 +2644,8 @@ static int qed_configure_filter_rx_mode(struct qed_dev *cdev,if (type ==QED_FILTER_RX_MODE_TYPE_PROMISC ) { accept_flags.rx_accept_filter |=QED_ACCEPT_UCAST_UNMATCHED |QED_ACCEPT_MCAST_UNMATCHED ; - accept_flags.tx_accept_filter |=QED_ACCEPT_MCAST_UNMATCHED ; + accept_flags.tx_accept_filter |=QED_ACCEPT_UCAST_UNMATCHED | +QED_ACCEPT_MCAST_UNMATCHED ; }else if (type ==QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC ) { accept_flags.rx_accept_filter |=QED_ACCEPT_MCAST_UNMATCHED ; accept_flags.tx_accept_filter |=QED_ACCEPT_MCAST_UNMATCHED ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 68/135 qed: Fix LACP pdu drops for VFs
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ff9296966e5e00b0d0d00477b2365a178f0f06a3 ]
VF is always configured to drop control frames (with reserved mac addresses) but to work LACP on the VFs, it would require LACP control frames to be forwarded or transmitted successfully.
This patch fixes this in such a way that trusted VFs (marked through ndo_set_vf_trust) would be allowed to pass the control frames such as LACP pdus.
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 5 +++++ drivers/net/ethernet/qlogic/qed/qed_l2.h | 3 +++ drivers/net/ethernet/qlogic/qed/qed_sriov.c | 10 ++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +5 -0
@@ -747,6 +747,11 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,return rc; } +if (p_params->update_ctl_frame_check) { + p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en; + p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en; + } +/* Update mcast bins for VFs, PF doesn't use this functionality */ qed_sp_update_mcast_bin (p_hwfn, p_ramrod, p_params);
drivers/net/ethernet/qlogic/qed/qed_l2.h +3 -0
@@ -218,6 +218,9 @@ struct qed_sp_vport_update_params {struct qed_rss_params *rss_params;struct qed_filter_accept_flags accept_flags;struct qed_sge_tpa_params *sge_tpa_params; +u8 update_ctl_frame_check; +u8 mac_chk_en; +u8 ethtype_chk_en; }; int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
drivers/net/ethernet/qlogic/qed/qed_sriov.c +8 -2
@@ -1963,7 +1963,9 @@ static void qed_iov_vf_mbx_start_vport(struct qed_hwfn *p_hwfn, params.vport_id = vf->vport_id; params.max_buffers_per_cqe = start->max_buffers_per_cqe; params.mtu = vf->mtu; - params.check_mac = true; + +/* Non trusted VFs should enable control frame filtering */ + params.check_mac = !vf->p_vf_info.is_trusted_configured; rc =qed_sp_eth_vport_start (p_hwfn, ¶ms);if (rc) {
@@ -4910,6 +4912,9 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) params.opaque_fid = vf->opaque_fid; params.vport_id = vf->vport_id; + params.update_ctl_frame_check =1 ; + params.mac_chk_en = !vf_info->is_trusted_configured; +if (vf_info->rx_accept_mode & mask) { flags->update_rx_mode_config =1 ; flags->rx_accept_filter = vf_info->rx_accept_mode;
@@ -4927,7 +4932,8 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) }if (flags->update_rx_mode_config || - flags->update_tx_mode_config) + flags->update_tx_mode_config || + params.update_ctl_frame_check)qed_sp_vport_update (hwfn, ¶ms,QED_SPQ_MODE_EBLOCK ,NULL ); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 69/135 qed: Fix VF probe failure while FLR
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 327852ec64205bb651be391a069784872098a3b2 ]
VFs may hit VF-PF channel timeout while probing, as in some cases it was observed that VF FLR and VF "acquire" message transaction (i.e first message from VF to PF in VF's probe flow) could occur simultaneously which could lead VF to fail sending "acquire" message to PF as VF is marked disabled from HW perspective due to FLR, which will result into channel timeout and VF probe failure.
In such cases, try retrying VF "acquire" message so that in later attempts it could be successful to pass message to PF after the VF FLR is completed and can be probed successfully.
--- drivers/net/ethernet/qlogic/qed/qed_vf.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/qlogic/qed/qed_vf.c +10 -0
@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp;struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info;struct vf_pf_resc_request *p_resc; +u8 retry_cnt =VF_ACQUIRE_THRESH ;bool resources_acquired = false;struct vfpf_acquire_tlv *req;int rc =0 , attempts =0 ;
@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)/* send acquire request */ rc =qed_send_msg2pf (p_hwfn, &resp->hdr.status,sizeof (*resp)); + +/* Re-try acquire in case of vf-pf hw channel timeout */ +if (retry_cnt && rc == -EBUSY ) { +DP_VERBOSE (p_hwfn,QED_MSG_IOV , +"VF retrying to acquire due to VPC timeout\n" ); + retry_cnt--; +continue ; + } +if (rc) goto exit;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 70/135 qed: Fix system crash in ll2 xmit
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7c81626a3c37e4ac320b8ad785694ba498f24794 ]
Cache number of fragments in the skb locally as in case of linear skb (with zero fragments), tx completion (or freeing of skb) may happen before driver tries to get number of frgaments from the skb which could lead to stale access to an already freed skb.
--- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_ll2.c +15 -5
@@ -2299,19 +2299,24 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb) {struct qed_ll2_tx_pkt_info pkt;const skb_frag_t *frag; +u8 flags =0 , nr_frags;int rc = -EINVAL , i;dma_addr_t mapping;u16 vlan =0 ; -u8 flags =0 ;if (unlikely (skb->ip_summed !=CHECKSUM_NONE )) {DP_INFO (cdev,"Cannot transmit a checksumed packet\n" );return -EINVAL ; } -if (1 +skb_shinfo (skb)->nr_frags >CORE_LL2_TX_MAX_BDS_PER_PACKET ) { +/* Cache number of fragments from SKB since SKB may be freed by +* the completion routine after calling qed_ll2_prepare_tx_packet() +*/ + nr_frags =skb_shinfo (skb)->nr_frags; + +if (1 + nr_frags >CORE_LL2_TX_MAX_BDS_PER_PACKET ) {DP_ERR (cdev,"Cannot transmit a packet with %d fragments\n" , -1 +skb_shinfo (skb)->nr_frags); +1 + nr_frags);return -EINVAL ; }
@@ -2333,7 +2338,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb) }memset (&pkt,0 ,sizeof (pkt)); - pkt.num_of_bds =1 +skb_shinfo (skb)->nr_frags; + pkt.num_of_bds =1 + nr_frags; pkt.vlan = vlan; pkt.bd_flags = flags; pkt.tx_dest =QED_LL2_TX_DEST_NW ;
@@ -2341,12 +2346,17 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb) pkt.first_frag_len = skb->len; pkt.cookie = skb; +/* qed_ll2_prepare_tx_packet() may actually send the packet if +* there are no fragments in the skb and subsequently the completion +* routine may run and free the SKB, so no dereferencing the SKB +* beyond this point unless skb has any fragments. +*/ rc =qed_ll2_prepare_tx_packet (&cdev->hwfns[0 ], cdev->ll2->handle, &pkt,1 );if (rc) goto err; -for (i =0 ; i <skb_shinfo (skb)->nr_frags; i++) { +for (i =0 ; i < nr_frags; i++) { frag = &skb_shinfo (skb)->frags[i]; mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 71/135 qed: Fix stack out of bounds bug
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ffb057f98928aa099b08e419bbe5afc26ec9f448 ]
KASAN reported following bug in qed_init_qm_get_idx_from_flags due to inappropriate casting of "pq_flags". Fix the type of "pq_flags".
[ 196.624707] BUG: KASAN: stack-out-of-bounds in qed_init_qm_get_idx_from_flags+0x1a4/0x1b8 [qed] [ 196.624712] Read of size 8 at addr ffff809b00bc7360 by task kworker/0:9/1712 [ 196.624714] [ 196.624720] CPU: 0 PID: 1712 Comm: kworker/0:9 Not tainted 4.18.0-60.el8.aarch64+debug #1 [ 196.624723] Hardware name: To be filled by O.E.M. Saber/Saber, BIOS 0ACKL024 09/26/2018 [ 196.624733] Workqueue: events work_for_cpu_fn [ 196.624738] Call trace: [ 196.624742] dump_backtrace+0x0/0x2f8 [ 196.624745] show_stack+0x24/0x30 [ 196.624749] dump_stack+0xe0/0x11c [ 196.624755] print_address_description+0x68/0x260 [ 196.624759] kasan_report+0x178/0x340 [ 196.624762] __asan_report_load_n_noabort+0x38/0x48 [ 196.624786] qed_init_qm_get_idx_from_flags+0x1a4/0x1b8 [qed] [ 196.624808] qed_init_qm_info+0xec0/0x2200 [qed] [ 196.624830] qed_resc_alloc+0x284/0x7e8 [qed] [ 196.624853] qed_slowpath_start+0x6cc/0x1ae8 [qed] [ 196.624864] __qede_probe.isra.10+0x1cc/0x12c0 [qede] [ 196.624874] qede_probe+0x78/0xf0 [qede] [ 196.624879] local_pci_probe+0xc4/0x180 [ 196.624882] work_for_cpu_fn+0x54/0x98 [ 196.624885] process_one_work+0x758/0x1900 [ 196.624888] worker_thread+0x4e0/0xd18 [ 196.624892] kthread+0x2c8/0x350 [ 196.624897] ret_from_fork+0x10/0x18 [ 196.624899] [ 196.624902] Allocated by task 2: [ 196.624906] kasan_kmalloc.part.1+0x40/0x108 [ 196.624909] kasan_kmalloc+0xb4/0xc8 [ 196.624913] kasan_slab_alloc+0x14/0x20 [ 196.624916] kmem_cache_alloc_node+0x1dc/0x480 [ 196.624921] copy_process.isra.1.part.2+0x1d8/0x4a98 [ 196.624924] _do_fork+0x150/0xfa0 [ 196.624926] kernel_thread+0x48/0x58 [ 196.624930] kthreadd+0x3a4/0x5a0 [ 196.624932] ret_from_fork+0x10/0x18 [ 196.624934] [ 196.624937] Freed by task 0: [ 196.624938] (stack is not available) [ 196.624940] [ 196.624943] The buggy address belongs to the object at ffff809b00bc0000 [ 196.624943] which belongs to the cache thread_stack of size 32768 [ 196.624946] The buggy address is located 29536 bytes inside of [ 196.624946] 32768-byte region [ffff809b00bc0000, ffff809b00bc8000) [ 196.624948] The buggy address belongs to the page: [ 196.624952] page:ffff7fe026c02e00 count:1 mapcount:0 mapping:ffff809b4001c000 index:0x0 compound_mapcount: 0 [ 196.624960] flags: 0xfffff8000008100(slab|head) [ 196.624967] raw: 0fffff8000008100 dead000000000100 dead000000000200 ffff809b4001c000 [ 196.624970] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 196.624973] page dumped because: kasan: bad access detected [ 196.624974] [ 196.624976] Memory state around the buggy address: [ 196.624980] ffff809b00bc7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624983] ffff809b00bc7280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624985] >ffff809b00bc7300: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 [ 196.624988] ^ [ 196.624990] ffff809b00bc7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624993] ffff809b00bc7400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624995] ==================================================================
--- drivers/net/ethernet/qlogic/qed/qed_dev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_dev.c +4 -4
@@ -435,19 +435,19 @@ static void qed_init_qm_pq(struct qed_hwfn *p_hwfn,/* get pq index according to PQ_FLAGS */ static u16 *qed_init_qm_get_idx_from_flags (struct qed_hwfn *p_hwfn, -u32 pq_flags) +unsigned long pq_flags) {struct qed_qm_info *qm_info = &p_hwfn->qm_info;/* Can't have multiple flags set here */ -if (bitmap_weight ((unsigned long *)&pq_flags, +if (bitmap_weight (&pq_flags,sizeof (pq_flags) *BITS_PER_BYTE ) >1 ) { -DP_ERR (p_hwfn,"requested multiple pq flags 0x%x\n" , pq_flags); +DP_ERR (p_hwfn,"requested multiple pq flags 0x%lx\n" , pq_flags); goto err; }if (!(qed_get_pq_flags (p_hwfn) & pq_flags)) { -DP_ERR (p_hwfn,"pq flag 0x%x is not set\n" , pq_flags); +DP_ERR (p_hwfn,"pq flag 0x%lx is not set\n" , pq_flags); goto err; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 72/135 scsi: libfc: free skb when receiving invalid flogi resp
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5d8fc4a9f0eec20b6c07895022a6bea3fb6dfb38 ]
The issue to be fixed in this commit is when libfc found it received a invalid FLOGI response from FC switch, it would return without freeing the fc frame, which is just the skb data. This would cause memory leak if FC switch keeps sending invalid FLOGI responses.
This fix is just to make it execute fc_frame_free(fp) before returning from function fc_lport_flogi_resp.
--- drivers/scsi/libfc/fc_lport.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/libfc/fc_lport.c +3 -3
@@ -1739,14 +1739,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, fc_frame_payload_op(fp) != ELS_LS_ACC) {FC_LPORT_DBG (lport,"FLOGI not accepted or bad response\n" );fc_lport_error (lport, fp); - goto err; + goto out; } flp =fc_frame_payload_get (fp,sizeof (*flp));if (!flp) {FC_LPORT_DBG (lport,"FLOGI bad response\n" );fc_lport_error (lport, fp); - goto err; + goto out; } mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1756,7 +1756,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,FC_LPORT_DBG (lport,"FLOGI bad mfs:%hu response, " "lport->mfs:%hu\n" , mfs, lport->mfs);fc_lport_error (lport, fp); - goto err; + goto out; }if (mfs <= lport->mfs) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 73/135 scsi: 53c700: pass correct "dev" to dma_alloc_attrs()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8437fcf14deed67e5ad90b5e8abf62fb20f30881 ]
The "hostdata->dev" pointer is NULL here. We set "hostdata->dev = dev;" later in the function and we also use "hostdata->dev" when we call dma_free_attrs() in NCR_700_release().
This bug predates git version control.
--- drivers/scsi/53c700.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/53c700.c +1 -1
@@ -295,7 +295,7 @@ NCR_700_detect(struct scsi_host_template *tpnt,if (tpnt->sdev_attrs ==NULL ) tpnt->sdev_attrs = NCR_700_dev_attrs; - memory =dma_alloc_attrs (hostdata->dev,TOTAL_MEM_SIZE , &pScript, + memory =dma_alloc_attrs (dev,TOTAL_MEM_SIZE , &pScript,GFP_KERNEL ,DMA_ATTR_NON_CONSISTENT );if (memory ==NULL ) {printk (KERN_ERR "53c700: Failed to allocate memory for driver, detaching\n" );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 74/135 platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0ee4b5f801b73b83a9fb3921d725f2162fd4a2e5 ]
Add BACKLIGHT_LCD_SUPPORT for SAMSUNG_Q10 to fix the
warning: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE.
SAMSUNG_Q10 selects BACKLIGHT_CLASS_DEVICE but BACKLIGHT_CLASS_DEVICE depends on BACKLIGHT_LCD_SUPPORT.
Copy BACKLIGHT_LCD_SUPPORT dependency into SAMSUNG_Q10 to fix:
WARNING: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE
Depends on [n]: HAS_IOMEM [=y] && BACKLIGHT_LCD_SUPPORT [=n] Selected by [y]:
- SAMSUNG_Q10 [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y]
--- drivers/platform/x86/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/Kconfig +1 -0
@@ -999,6 +999,7 @@ config INTEL_OAKTRAIL config SAMSUNG_Q10 tristate "Samsung Q10 Extras" depends on ACPI + depends on BACKLIGHT_LCD_SUPPORT select BACKLIGHT_CLASS_DEVICE ---help--- This driver provides support for backlight control on Samsung Q10
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 75/135 cifs: fix computation for MAX_SMB2_HDR_SIZE
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 58d15ed1203f4d858c339ea4d7dafa94bd2a56d3 ]
The size of the fixed part of the create response is 88 bytes not 56.
--- fs/cifs/smb2pdu.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/smb2pdu.h +2 -2
@@ -84,8 +84,8 @@#define NUMBER_OF_SMB2_COMMANDS 0x0013 -/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */ -#define MAX_SMB2_HDR_SIZE 0x00b0 +/* 52 transform hdr + 64 hdr + 88 create rsp */ +#define MAX_SMB2_HDR_SIZE 204#define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)#define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 76/135 x86/microcode/amd: Dont falsely trick the late loading mechanism
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 912139cfbfa6a2bc1da052314d2c29338dae1f6a ]
The load_microcode_amd() function searches for microcode patches and attempts to apply a microcode patch if it is of different level than the currently installed level.
While the processor won't actually load a level that is less than what is already installed, the logic wrongly returns UCODE_NEW thus signaling to its caller reload_store() that a late loading should be attempted.
If the file-system contains an older microcode revision than what is currently running, such a late microcode reload can result in these misleading messages:
x86/CPU: CPU features have changed after loading microcode, but might not take effect. x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.
These messages were issued on a system where SME/SEV are not enabled by the BIOS (MSR C001_0010[23] = 0b) because during boot, early_detect_mem_encrypt() is called and cleared the SME and SEV features in this case.
However, after the wrong late load attempt, get_cpu_cap() is called and reloads the SME and SEV feature bits, resulting in the messages.
Update the microcode level check to not attempt microcode loading if the current level is greater than(!) and not only equal to the current patch level.
[ bp: massage commit message. ]
--- arch/x86/kernel/cpu/microcode/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/microcode/amd.c +1 -1
@@ -707,7 +707,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)if (!p) {return ret; }else { -if (boot_cpu_data.microcode == p->patch_id) +if (boot_cpu_data.microcode >= p->patch_id)return ret; ret =UCODE_NEW ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 77/135 arm64: kprobe: Always blacklist the KVM world-switch code
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f2b3d8566d81deaca31f4e3163def0bea7746e11 ]
On systems with VHE the kernel and KVM's world-switch code run at the same exception level. Code that is only used on a VHE system does not need to be annotated as __hyp_text as it can reside anywhere in the
kernel text.
__hyp_text was also used to prevent kprobes from patching breakpoint instructions into this region, as this code runs at a different exception level. While this is no longer true with VHE, KVM still switches VBAR_EL1, meaning a kprobe's breakpoint executed in the world-switch code will cause a hyp-panic.
Move the __hyp_text check in the kprobes blacklist so it applies on VHE systems too, to cover the common code and guest enter/exit assembly.
--- arch/arm64/kernel/probes/kprobes.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/kernel/probes/kprobes.c +3 -3
@@ -554,13 +554,13 @@ bool arch_within_kprobe_blacklist(unsigned long addr) addr < (unsigned long)__entry_text_end) || (addr >= (unsigned long )__idmap_text_start && addr < (unsigned long )__idmap_text_end) || + (addr >= (unsigned long )__hyp_text_start && + addr < (unsigned long )__hyp_text_end) || !!search_exception_tables(addr)) return true;if (!is_kernel_in_hyp_mode ()) { -if ((addr >= (unsigned long )__hyp_text_start && - addr < (unsigned long )__hyp_text_end) || - (addr >= (unsigned long )__hyp_idmap_text_start && +if ((addr >= (unsigned long )__hyp_idmap_text_start && addr < (unsigned long )__hyp_idmap_text_end))return true; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 78/135 apparmor: Fix aa_label_build() error handling for failed merges
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d6d478aee003e19ef90321176552a8ad2929a47f ]
aa_label_merge() can return NULL for memory allocations failures make sure to handle and set the correct error in this case.
--- security/apparmor/domain.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
security/apparmor/domain.c +4 -1
@@ -1260,7 +1260,10 @@ int aa_change_profile(const char *fqname, int flags) aa_get_label(&profile->label));if (IS_ERR_OR_NULL (new)) { info ="failed to build target label" ; - error =PTR_ERR (new); +if (!new) + error = -ENOMEM ; +else + error =PTR_ERR (new); new =NULL ; perms.allow =0 ; goto audit;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 79/135 x86/kexec: Dont setup EFI info if EFI runtime is not enabled
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2aa958c99c7fd3162b089a1a56a34a0cdb778de1 ]
Kexec-ing a kernel with "efi=noruntime" on the first kernel's command line causes the following null pointer dereference:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 #PF error: [normal kernel read fault] Call Trace: efi_runtime_map_copy+0x28/0x30 bzImage64_load+0x688/0x872 arch_kexec_kernel_image_load+0x6d/0x70 kimage_file_alloc_init+0x13e/0x220 __x64_sys_kexec_file_load+0x144/0x290 do_syscall_64+0x55/0x1a0 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Just skip the EFI info setup if EFI runtime services are not enabled.
[ bp: Massage commit message. ]
--- arch/x86/kernel/kexec-bzimage64.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/kexec-bzimage64.c +3 -0
@@ -167,6 +167,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,struct efi_info *current_ei = &boot_params.efi_info;struct efi_info *ei = ¶ms->efi_info; +if (!efi_enabled (EFI_RUNTIME_SERVICES )) +return 0 ; +if (!current_ei->efi_memmap_size)return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 80/135 x86_64: increase stack size for KASAN_EXTRA
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a8e911d13540487942d53137c156bd7707f66e5d ]
If the kernel is configured with KASAN_EXTRA, the stack size is increasted significantly because this option sets "-fstack-reuse" to "none" in GCC [1]. As a result, it triggers stack overrun quite often with 32k stack size compiled using GCC 8. For example, this reproducer
https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/madvise/madvise06.c
triggers a "corrupted stack end detected inside scheduler" very reliably with CONFIG_SCHED_STACK_END_CHECK enabled.
There are just too many functions that could have a large stack with KASAN_EXTRA due to large local variables that have been called over and over again without being able to reuse the stacks. Some noticiable ones are
size
7648 shrink_page_list
3584 xfs_rmap_convert
3312 migrate_page_move_mapping
3312 dev_ethtool
3200 migrate_misplaced_transhuge_page
3168 copy_process
There are other 49 functions are over 2k in size while compiling kernel with "-Wframe-larger-than=" even with a related minimal config on this machine. Hence, it is too much work to change Makefiles for each object to compile without "-fsanitize-address-use-after-scope" individually.
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715#c23
Although there is a patch in GCC 9 to help the situation, GCC 9 probably won't be released in a few months and then it probably take another 6-month to 1-year for all major distros to include it as a default. Hence, the stack usage with KASAN_EXTRA can be revisited again in 2020 when GCC 9 is everywhere. Until then, this patch will help users avoid stack overrun.
This has already been fixed for arm64 for the same reason via 6e8830674ea ("arm64: kasan: Increase stack size for KASAN_EXTRA").
--- arch/x86/include/asm/page_64_types.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/include/asm/page_64_types.h +4 -0
@@ -7,7 +7,11 @@#endif #ifdef CONFIG_KASAN +#ifdef CONFIG_KASAN_EXTRA +#define KASAN_STACK_ORDER 2 +#else #define KASAN_STACK_ORDER 1 +#endif #else #define KASAN_STACK_ORDER 0#endif
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 81/135 mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit efad4e475c312456edb3c789d0996d12ed744c13 ]
Patch series "mm, memory_hotplug: fix uninitialized pages fallouts", v2.
Mikhail Zaslonko has posted fixes for the two bugs quite some time ago [1]. I have pushed back on those fixes because I believed that it is much better to plug the problem at the initialization time rather than play whack-a-mole all over the hotplug code and find all the places which expect the full memory section to be initialized.
We have ended up with commit 2830bf6f05fb ("mm, memory_hotplug:
initialize struct pages for the full memory section") merged and cause a regression [2][3]. The reason is that there might be memory layouts when two NUMA nodes share the same memory section so the merged fix is simply incorrect.
In order to plug this hole we really have to be zone range aware in those handlers. I have split up the original patch into two. One is unchanged (patch 2) and I took a different approach for `removable' crash.
[1] http://lkml.kernel.org/r/[email protected]
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1666948
[3] http://lkml.kernel.org/r/[email protected]
This patch (of 2):
Mikhail has reported the following VM_BUG_ON triggered when reading sysfs removable state of a memory block:
page:000003d08300c000 is uninitialized and poisoned
page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: is_mem_section_removable+0xb4/0x190 show_mem_removable+0x9a/0xd8 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: is_mem_section_removable+0xb4/0x190 Kernel panic - not syncing: Fatal exception: panic_on_oops
The reason is that the memory block spans the zone boundary and we are stumbling over an unitialized struct page. Fix this by enforcing zone range in is_mem_section_removable so that we never run away from a zone.
--- mm/memory_hotplug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/memory_hotplug.c +2 -1
@@ -1256,7 +1256,8 @@ static struct page *next_active_pageblock(struct page *page)bool is_mem_section_removable (unsigned long start_pfn,unsigned long nr_pages) {struct page *page =pfn_to_page (start_pfn); -struct page *end_page = page + nr_pages; +unsigned long end_pfn =min (start_pfn + nr_pages,zone_end_pfn (page_zone (page))); +struct page *end_page =pfn_to_page (end_pfn);/* Check the starting page of each pageblock within the range */ for (; page < end_page; page =next_active_pageblock (page)) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 82/135 mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 24feb47c5fa5b825efb0151f28906dfdad027e61 ]
If memory end is not aligned with the sparse memory section boundary, the mapping of such a section is only partly initialized. This may lead to VM_BUG_ON due to uninitialized struct pages access from test_pages_in_a_zone() function triggered by memory_hotplug sysfs handlers.
Here are the the panic examples:
CONFIG_DEBUG_VM_PGFLAGS=y
kernel parameter mem=2050M
--------------------------
page:000003d082008000 is uninitialized and poisoned
page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: test_pages_in_a_zone+0xde/0x160 show_valid_zones+0x5c/0x190 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: test_pages_in_a_zone+0xde/0x160 Kernel panic - not syncing: Fatal exception: panic_on_oops
Fix this by checking whether the pfn to check is within the zone.
[[email protected]: separated this change from
http://lkml.kernel.org/r/[email protected]]
--- mm/memory_hotplug.c | 3 +++ 1 file changed, 3 insertions(+)
mm/memory_hotplug.c +3 -0
@@ -1297,6 +1297,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, i++;if (i ==MAX_ORDER_NR_PAGES || pfn + i >= end_pfn)continue ; +/* Check if we got outside of the zone */ +if (zone && !zone_spans_pfn (zone, pfn + i)) +return 0 ; page =pfn_to_page (pfn + i);if (zone &&page_zone (page) != zone)return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 83/135 lib/test_kmod.c: potential double free in error handling
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit db7ddeab3ce5d64c9696e70d61f45ea9909cd196 ]
There is a copy and paste bug so we set "config->test_driver" to NULL twice instead of setting "config->test_fs". Smatch complains that it leads to a double free:
lib/test_kmod.c:840 __kmod_config_init() warn: 'config->test_fs' double freed
--- lib/test_kmod.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/test_kmod.c +1 -1
@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config) config->test_driver =NULL ;kfree_const (config->test_fs); - config->test_driver =NULL ; + config->test_fs =NULL ; }static void kmod_config_free (struct kmod_test_device *test_dev)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 84/135 fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c27d82f52f75fc9d8d9d40d120d2a96fdeeada5e ]
When superblock has lots of inodes without any pagecache (like is the case for /proc), drop_pagecache_sb() will iterate through all of them without dropping sb->s_inode_list_lock which can lead to softlockups (one of our customers hit this).
Fix the problem by going to the slow path and doing cond_resched() in case the process needs rescheduling.
--- fs/drop_caches.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/drop_caches.c +7 -1
@@ -21,8 +21,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)spin_lock (&sb->s_inode_list_lock);list_for_each_entry (inode, &sb->s_inodes, i_sb_list) {spin_lock (&inode->i_lock); +/* +* We must skip inodes in unusual state. We may also skip +* inodes without pages but we deliberately won't in case +* we need to reschedule to avoid softlockups. +*/ if ((inode->i_state & (I_FREEING |I_WILL_FREE |I_NEW )) || - (inode->i_mapping->nrpages ==0 )) { + (inode->i_mapping->nrpages ==0 && !need_resched ())) {spin_unlock (&inode->i_lock);continue ; }
@@ -30,6 +35,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)spin_unlock (&inode->i_lock);spin_unlock (&sb->s_inode_list_lock); +cond_resched ();invalidate_mapping_pages (inode->i_mapping,0 ,-1 );iput (toput_inode); toput_inode = inode;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 85/135 autofs: drop dentry reference only when it is never used
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 63ce5f552beb9bdb41546b3a26c4374758b21815 ]
autofs_expire_run() calls dput(dentry) to drop the reference count of dentry. However, dentry is read via autofs_dentry_ino(dentry) after that. This may result in a use-free-bug. The patch drops the reference count of dentry only when it is never used.
--- fs/autofs4/expire.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/autofs4/expire.c +2 -1
@@ -567,7 +567,6 @@ int autofs4_expire_run(struct super_block *sb, pkt.len = dentry->d_name.len;memcpy (pkt.name, dentry->d_name.name, pkt.len); pkt.name[pkt.len] ='\0' ; -dput (dentry);if (copy_to_user (pkt_p, &pkt,sizeof (struct autofs_packet_expire ))) ret = -EFAULT ;
@@ -580,6 +579,8 @@ int autofs4_expire_run(struct super_block *sb,complete_all (&ino->expire_complete);spin_unlock (&sbi->fs_lock); +dput (dentry); +return ret; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 86/135 autofs: fix error return in autofs_fill_super()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f585b283e3f025754c45bbe7533fc6e5c4643700 ]
In autofs_fill_super() on error of get inode/make root dentry the return should be ENOMEM as this is the only failure case of the called functions.
--- fs/autofs4/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/autofs4/inode.c +3 -1
@@ -259,8 +259,10 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent) } root_inode =autofs4_get_inode (s,S_IFDIR |0755 ); root =d_make_root (root_inode); -if (!root) +if (!root) { + ret = -ENOMEM ; goto fail_ino; + } pipe =NULL ; root->d_fsdata = ino;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 87/135 ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ef4a55b9197a8f844ea0663138e902dcce3e2f36 ]
We're now getting the following error:
genirq: Setting trigger mode 1 for irq 230 failed (regmap_irq_set_type+0x0/0x15c)
cpcap-usb-phy cpcap-usb-phy.0: could not get irq dp: -524
--- arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +1 -1
@@ -92,7 +92,7 @@ interrupts-extended = < &cpcap 15 0 &cpcap 14 0 &cpcap 28 0 &cpcap 19 0 &cpcap 18 0 &cpcap 17 0 &cpcap 16 0 &cpcap 49 0 - &cpcap 48 1 + &cpcap 48 0 >; interrupt-names = "id_ground", "id_float", "se0conn", "vbusvld",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 88/135 arm64: dts: renesas: r8a7796: Enable DMA for SCIF2
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 97f26702bc95b5c3a72671d5c6675e4d6ee0a2f4 ]
SCIF2 on R-Car M3-W can be used with both DMAC1 and DMAC2.
--- arch/arm64/boot/dts/renesas/r8a7796.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/renesas/r8a7796.dtsi +3 -0
@@ -937,6 +937,9 @@ <&cpg CPG_CORE R8A7796_CLK_S3D1>, <&scif_clk>; clock-names = "fck", "brg_int", "scif_clk"; + dmas = <&dmac1 0x13>, <&dmac1 0x12>, + <&dmac2 0x13>, <&dmac2 0x12>; + dma-names = "tx", "rx", "tx", "rx"; power-domains = <&sysc R8A7796_PD_ALWAYS_ON>; resets = <&cpg 310>; status = "disabled";
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 89/135 soc: fsl: qbman: avoid race in clearing QMan interrupt
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 89857a8a5c89a406b967ab2be7bd2ccdbe75e73d ]
By clearing all interrupt sources, not only those that already occurred, the existing code may acknowledge by mistake interrupts that occurred after the code checks for them.
--- drivers/soc/fsl/qbman/qman.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/soc/fsl/qbman/qman.c +5 -4
@@ -1048,18 +1048,19 @@ static void qm_mr_process_task(struct work_struct *work);static irqreturn_t portal_isr (int irq,void *ptr) {struct qman_portal *p = ptr; - -u32 clear =QM_DQAVAIL_MASK | p->irq_sources;u32 is =qm_in (&p->p,QM_REG_ISR ) & p->irq_sources; +u32 clear =0 ;if (unlikely (!is))return IRQ_NONE ;/* DQRR-handling if it's interrupt-driven */ -if (is &QM_PIRQ_DQRI ) +if (is &QM_PIRQ_DQRI ) {__poll_portal_fast (p,QMAN_POLL_LIMIT ); + clear =QM_DQAVAIL_MASK |QM_PIRQ_DQRI ; + }/* Handling of anything else that's interrupt-driven */ - clear |=__poll_portal_slow (p, is); + clear |=__poll_portal_slow (p, is) &QM_PIRQ_SLOW ;qm_out (&p->p,QM_REG_ISR , clear);return IRQ_HANDLED ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 90/135 bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c9e4576743eeda8d24dedc164d65b78877f9a98c ]
When sock recvbuff is set by bpf_setsockopt(), the value must by limited by rmem_max. It is the same with sendbuff.
--- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/filter.c +2 -0
@@ -3081,10 +3081,12 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,/* Only some socketops are supported */ switch (optname) {case SO_RCVBUF : + val =min_t (u32, val, sysctl_rmem_max); sk->sk_userlocks |=SOCK_RCVBUF_LOCK ; sk->sk_rcvbuf =max_t (int, val *2 ,SOCK_MIN_RCVBUF );break ;case SO_SNDBUF : + val =min_t (u32, val, sysctl_wmem_max); sk->sk_userlocks |=SOCK_SNDBUF_LOCK ; sk->sk_sndbuf =max_t (int, val *2 ,SOCK_MIN_SNDBUF );break ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 91/135 ARM: pxa: ssp: unneeded to free devm_ allocated data
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ba16adeb346387eb2d1ada69003588be96f098fa ]
devm_ allocated data will be automatically freed. The free of devm_ allocated data is invalid.
--- arch/arm/plat-pxa/ssp.c | 3 --- 1 file changed, 3 deletions(-)
arch/arm/plat-pxa/ssp.c +0 -3
@@ -237,8 +237,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)if (ssp ==NULL )return -ENODEV ; -iounmap (ssp->mmio_base); - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );release_mem_region (res->start,resource_size (res));
@@ -248,7 +246,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)list_del (&ssp->node);mutex_unlock (&ssp_lock); -kfree (ssp);return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 92/135 arm64: dts: add msm8996 compatible to gicv3
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2a81efb0de0e33f2d2c83154af0bd3ce389b3269 ]
Add compatible to gicv3 node to enable quirk required to restrict writing to GICR_WAKER register which is restricted on msm8996 SoC in Hypervisor.
With this quirk MSM8996 can at least boot out of mainline, which can help community to work with boards based on MSM8996.
Without this patch Qualcomm DB820c board reboots on mainline.
--- arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8996.dtsi +1 -1
@@ -359,7 +359,7 @@ }; intc: interrupt-controller@9bc0000 { - compatible = "arm,gic-v3"; + compatible = "qcom,msm8996-gic-v3", "arm,gic-v3"; #interrupt-cells = <3>; interrupt-controller; #redistributor-regions = <1>;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 93/135 DTS: CI20: Fix bugs in ci20s device tree.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1ca1c87f91d9dc50d6a38e2177b2032996e7901c ]
According to the Schematic, the hardware of ci20 leads to uart3, but not to uart2. Uart2 is miswritten in the original code.
--- arch/mips/boot/dts/ingenic/ci20.dts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/mips/boot/dts/ingenic/ci20.dts +4 -4
@@ -54,7 +54,7 @@ status = "okay"; pinctrl-names = "default"; - pinctrl-0 = <&pins_uart2>; + pinctrl-0 = <&pins_uart3>; }; &uart4 {
@@ -174,9 +174,9 @@ bias-disable; }; - pins_uart2: uart2 { - function = "uart2"; - groups = "uart2-data", "uart2-hwflow"; + pins_uart3: uart3 { + function = "uart3"; + groups = "uart3-data", "uart3-hwflow"; bias-disable; };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 94/135 usb: phy: fix link errors
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f2105d42597f4d10e431b195d69e96dccaf9b012 ]
Fix link errors when CONFIG_FSL_USB2_OTG is enabled and USB_OTG_FSM is set to module then the following link error occurs.
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_ioctl':drivers/usb/phy/phy-fsl-usb.c:1083: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:1083:(.text+0x574): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_start_srp':drivers/usb/phy/phy-fsl-usb.c:674: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:674:(.text+0x61c): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_set_host':drivers/usb/phy/phy-fsl-usb.c:593: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:593:(.text+0x7a4): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_start_hnp':drivers/usb/phy/phy-fsl-usb.c:695: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:695:(.text+0x858): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `a_wait_enum':drivers/usb/phy/phy-fsl-usb.c:274: undefined reference to `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:274:(.text+0x16f0): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o:drivers/usb/phy/phy-fsl-usb.c:619: more undefined references to `otg_statemachine' follow
aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_set_peripheral':
drivers/usb/phy/phy-fsl-usb.c:619:(.text+0x1fa0): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine' make[1]: *** [Makefile:1020: vmlinux] Error 1
make[1]: Target 'Image' not remade because of errors.
make: *** [Makefile:152: sub-make] Error 2
make: Target 'Image' not remade because of errors.
Rework so that FSL_USB2_OTG depends on that the USB_OTG_FSM is builtin.
--- drivers/usb/phy/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/phy/Kconfig +1 -1
@@ -21,7 +21,7 @@ config AB8500_USB config FSL_USB2_OTG bool "Freescale USB OTG Transceiver Driver" - depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM + depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y' select USB_PHY help
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 95/135 irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2380a22b60ce6f995eac806e69c66e397b59d045 ]
Resetting bit 4 disables the interrupt delivery to the "secure processor" core. This breaks the keyboard on a OLPC XO 1.75 laptop, where the firmware running on the "secure processor" bit-bangs the PS/2 protocol over the GPIO lines.
It is not clear what the rest of the bits are and Marvell was unhelpful when asked for documentation. Aside from the SP bit, there are probably priority bits.
Leaving the unknown bits as the firmware set them up seems to be a wiser course of action compared to just turning them off.
--- drivers/irqchip/irq-mmp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/irqchip/irq-mmp.c +5 -1
@@ -34,6 +34,9 @@#define SEL_INT_PENDING (1 << 6)#define SEL_INT_NUM_MASK 0x3f +#define MMP2_ICU_INT_ROUTE_PJ4_IRQ (1 << 5) +#define MMP2_ICU_INT_ROUTE_PJ4_FIQ (1 << 6) +struct icu_chip_data {int nr_irqs;unsigned int virq_base;
@@ -190,7 +193,8 @@ static const struct mmp_intc_conf mmp_conf = {static const struct mmp_intc_conf mmp2_conf = { .conf_enable =0x20 , .conf_disable =0x0 , - .conf_mask =0x7f , + .conf_mask =MMP2_ICU_INT_ROUTE_PJ4_IRQ | +MMP2_ICU_INT_ROUTE_PJ4_FIQ , }; static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 96/135 net: stmmac: Fallback to Platform Data clock in Watchdog conversion
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4ec5302fa906ec9d86597b236f62315bacdb9622 ]
If we don't have DT then stmmac_clk will not be available. Let's add a new Platform Data field so that we can specify the refclk by this mean.
This way we can still use the coalesce command in PCI based setups.
--- .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 14 ++++++++++---- include/linux/stmmac.h | 1 + 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +10 -4
@@ -702,8 +702,11 @@ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv) {unsigned long clk =clk_get_rate (priv->plat->stmmac_clk); -if (!clk) -return 0 ; +if (!clk) { + clk = priv->plat->clk_ref_rate; +if (!clk) +return 0 ; + }return (usec * (clk /1000000 )) /256 ; }
@@ -712,8 +715,11 @@ static u32 stmmac_riwt2usec(u32 riwt, struct stmmac_priv *priv) {unsigned long clk =clk_get_rate (priv->plat->stmmac_clk); -if (!clk) -return 0 ; +if (!clk) { + clk = priv->plat->clk_ref_rate; +if (!clk) +return 0 ; + }return (riwt *256 ) / (clk /1000000 ); }
include/linux/stmmac.h +1 -0
@@ -183,6 +183,7 @@ struct plat_stmmacenet_data {struct clk *pclk;struct clk *clk_ptp_ref;unsigned int clk_ptp_rate; +unsigned int clk_ref_rate;struct reset_control *stmmac_rst;struct stmmac_axi *axi;int has_gmac4;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 97/135 net: stmmac: Send TSO packets always from Queue 0
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c5acdbee22a1b200dde07effd26fd1f649e9ab8a ]
The number of TSO enabled channels in HW can be different than the number of total channels. There is no way to determined, at runtime, the number of TSO capable channels and its safe to assume that if TSO is enabled then at least channel 0 will be TSO capable.
Lets always send TSO packets from Queue 0.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +10 -1
@@ -3019,8 +3019,17 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)/* Manage oversized TCP frames for GMAC4 device */ if (skb_is_gso (skb) && priv->tso) { -if (skb_shinfo (skb)->gso_type & (SKB_GSO_TCPV4 |SKB_GSO_TCPV6 )) +if (skb_shinfo (skb)->gso_type & (SKB_GSO_TCPV4 |SKB_GSO_TCPV6 )) { +/* +* There is no way to determine the number of TSO +* capable Queues. Let's use always the Queue 0 +* because if TSO is supported then at least this +* one will be capable. +*/ +skb_set_queue_mapping (skb,0 ); +return stmmac_tso_xmit (skb, dev); + } }if (unlikely (stmmac_tx_avail (priv, queue) < nfrags +1 )) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 98/135 net: stmmac: Disable EEE mode earlier in XMIT callback
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e2cd682deb231ba6f80524bb84e57e7138261149 ]
In stmmac xmit callback we use a different flow for TSO packets but TSO xmit callback is not disabling the EEE mode.
Fix this by disabling earlier the EEE mode, i.e. before calling the TSO xmit callback.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +3 -3
@@ -3017,6 +3017,9 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) tx_q = &priv->tx_queue[queue]; +if (priv->tx_path_in_lpi_mode) +stmmac_disable_eee_mode (priv); +/* Manage oversized TCP frames for GMAC4 device */ if (skb_is_gso (skb) && priv->tso) {if (skb_shinfo (skb)->gso_type & (SKB_GSO_TCPV4 |SKB_GSO_TCPV6 )) {
@@ -3044,9 +3047,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)return NETDEV_TX_BUSY ; } -if (priv->tx_path_in_lpi_mode) -stmmac_disable_eee_mode (priv); - entry = tx_q->cur_tx; first_entry = entry;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 99/135 irqchip/gic-v3-its: Fix ITT_entry_size accessor
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 56841070ccc87b463ac037d2d1f2beb8e5e35f0c ]
According to ARM IHI 0069C (ID070116), we should use GITS_TYPER's bits [7:4] as ITT_entry_size instead of [8:4]. Although this is pretty annoying, it only results in a potential over-allocation of memory, and nothing bad happens.
--- include/linux/irqchip/arm-gic-v3.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/irqchip/arm-gic-v3.h +1 -1
@@ -306,7 +306,7 @@#define GITS_TYPER_PLPIS (1UL << 0)#define GITS_TYPER_VLPIS (1UL << 1)#define GITS_TYPER_ITT_ENTRY_SIZE_SHIFT 4 -#define GITS_TYPER_ITT_ENTRY_SIZE (r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0x1f) + 1) +#define GITS_TYPER_ITT_ENTRY_SIZE (r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0xf) + 1)#define GITS_TYPER_IDBITS_SHIFT 8#define GITS_TYPER_DEVBITS_SHIFT 13#define GITS_TYPER_DEVBITS (r) ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 100/135 relay: check return of create_buf_file() properly
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2c1cf00eeacb784781cf1c9896b8af001246d339 ]
If create_buf_file() returns an error, don't try to reference it later as a valid dentry pointer.
This problem was exposed when debugfs started to return errors instead of just NULL for some calls when they do not succeed properly.
Also, the check for WARN_ON(dentry) was just wrong :)
--- kernel/relay.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/relay.c +3 -1
@@ -427,6 +427,8 @@ static struct dentry *relay_create_buf_file(struct rchan *chan, dentry = chan->cb->create_buf_file (tmpname, chan->parent,S_IRUSR , buf, &chan->is_global); +if (IS_ERR (dentry)) + dentry =NULL ;kfree (tmpname);
@@ -460,7 +462,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu) dentry = chan->cb->create_buf_file (NULL ,NULL ,S_IRUSR , buf, &chan->is_global); -if (WARN_ON (dentry)) +if (IS_ERR_OR_NULL (dentry)) goto free_buf; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 101/135 bpf, selftests: fix handling of sparse CPU allocations
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1bb54c4071f585ebef56ce8fdfe6026fa2cbcddd ]
Previously, bpf_num_possible_cpus() had a bug when calculating a number of possible CPUs in the case of sparse CPU allocations, as it was considering only the first range or element of /sys/devices/system/cpu/possible.
E.g. in the case of "0,2-3" (CPU 1 is not available), the function returned 1 instead of 3.
This patch fixes the function by making it parse all CPU ranges and elements.
--- tools/testing/selftests/bpf/bpf_util.h | 30 +++++++++++++++++--------- 1 file changed, 20 insertions(+), 10 deletions(-)
tools/testing/selftests/bpf/bpf_util.h +20 -10
@@ -13,7 +13,7 @@ static inline unsigned int bpf_num_possible_cpus(void)unsigned int start, end, possible_cpus =0 ;char buff[128 ];FILE *fp; -int n; +int len, n, i, j =0 ; fp =fopen (fcpu,"r" );if (!fp) {
@@ -21,17 +21,27 @@ static inline unsigned int bpf_num_possible_cpus(void)exit (1 ); } -while (fgets (buff,sizeof (buff), fp)) { - n =sscanf (buff,"%u-%u" , &start, &end); -if (n ==0 ) { -printf ("Failed to retrieve # possible CPUs!\n" ); -exit (1 ); - }else if (n ==1 ) { - end = start; +if (!fgets (buff,sizeof (buff), fp)) { +printf ("Failed to read %s!\n" , fcpu); +exit (1 ); + } + + len =strlen (buff); +for (i =0 ; i <= len; i++) { +if (buff[i] ==',' || buff[i] =='\0' ) { + buff[i] ='\0' ; + n =sscanf (&buff[j],"%u-%u" , &start, &end); +if (n <=0 ) { +printf ("Failed to retrieve # possible CPUs!\n" ); +exit (1 ); + }else if (n ==1 ) { + end = start; + } + possible_cpus += end - start +1 ; + j = i +1 ; } - possible_cpus = start ==0 ? end +1 :0 ; -break ; } +fclose (fp);return possible_cpus;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 102/135 bpf: fix lockdep false positive in percpu_freelist
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a89fac57b5d080771efd4d71feaae19877cf68f0 ]
Lockdep warns about false positive:
[ 12.492084] 00000000e6b28347 (&head->lock){+...}, at: pcpu_freelist_push+0x2a/0x40
[ 12.492696] but this lock was taken by another, HARDIRQ-safe lock in the past:
[ 12.493275] (&rq->lock){-.-.}
[ 12.493276]
[ 12.493276]
[ 12.493276] and interrupts could create inverse lock ordering between them.
[ 12.493276]
[ 12.494435]
[ 12.494435] other info that might help us debug this:
[ 12.494979] Possible interrupt unsafe locking scenario:
[ 12.494979]
[ 12.495518] CPU0 CPU1
[ 12.495879] ---- ----
[ 12.496243] lock(&head->lock);
[ 12.496502] local_irq_disable();
[ 12.496969] lock(&rq->lock);
[ 12.497431] lock(&head->lock);
[ 12.497890] <Interrupt>
[ 12.498104] lock(&rq->lock);
[ 12.498368]
[ 12.498368] *** DEADLOCK ***
[ 12.498368]
[ 12.498837] 1 lock held by dd/276:
[ 12.499110] #0: 00000000c58cb2ee (rcu_read_lock){....}, at: trace_call_bpf+0x5e/0x240
[ 12.499747]
[ 12.499747] the shortest dependencies between 2nd lock and 1st lock:
[ 12.500389] -> (&rq->lock){-.-.} {
[ 12.500669] IN-HARDIRQ-W at:
[ 12.500934] _raw_spin_lock+0x2f/0x40
[ 12.501373] scheduler_tick+0x4c/0xf0
[ 12.501812] update_process_times+0x40/0x50
[ 12.502294] tick_periodic+0x27/0xb0
[ 12.502723] tick_handle_periodic+0x1f/0x60
[ 12.503203] timer_interrupt+0x11/0x20
[ 12.503651] __handle_irq_event_percpu+0x43/0x2c0
[ 12.504167] handle_irq_event_percpu+0x20/0x50
[ 12.504674] handle_irq_event+0x37/0x60
[ 12.505139] handle_level_irq+0xa7/0x120
[ 12.505601] handle_irq+0xa1/0x150
[ 12.506018] do_IRQ+0x77/0x140
[ 12.506411] ret_from_intr+0x0/0x1d
[ 12.506834] _raw_spin_unlock_irqrestore+0x53/0x60
[ 12.507362] __setup_irq+0x481/0x730
[ 12.507789] setup_irq+0x49/0x80
[ 12.508195] hpet_time_init+0x21/0x32
[ 12.508644] x86_late_time_init+0xb/0x16
[ 12.509106] start_kernel+0x390/0x42a
[ 12.509554] secondary_startup_64+0xa4/0xb0
[ 12.510034] IN-SOFTIRQ-W at:
[ 12.510305] _raw_spin_lock+0x2f/0x40
[ 12.510772] try_to_wake_up+0x1c7/0x4e0
[ 12.511220] swake_up_locked+0x20/0x40
[ 12.511657] swake_up_one+0x1a/0x30
[ 12.512070] rcu_process_callbacks+0xc5/0x650
[ 12.512553] __do_softirq+0xe6/0x47b
[ 12.512978] irq_exit+0xc3/0xd0
[ 12.513372] smp_apic_timer_interrupt+0xa9/0x250
[ 12.513876] apic_timer_interrupt+0xf/0x20
[ 12.514343] default_idle+0x1c/0x170
[ 12.514765] do_idle+0x199/0x240
[ 12.515159] cpu_startup_entry+0x19/0x20
[ 12.515614] start_kernel+0x422/0x42a
[ 12.516045] secondary_startup_64+0xa4/0xb0
[ 12.516521] INITIAL USE at:
[ 12.516774] _raw_spin_lock_irqsave+0x38/0x50
[ 12.517258] rq_attach_root+0x16/0xd0
[ 12.517685] sched_init+0x2f2/0x3eb
[ 12.518096] start_kernel+0x1fb/0x42a
[ 12.518525] secondary_startup_64+0xa4/0xb0
[ 12.518986] }
[ 12.519132] ... key at: [<ffffffff82b7bc28>] __key.71384+0x0/0x8
[ 12.519649] ... acquired at:
[ 12.519892] pcpu_freelist_pop+0x7b/0xd0
[ 12.520221] bpf_get_stackid+0x1d2/0x4d0
[ 12.520563] ___bpf_prog_run+0x8b4/0x11a0
[ 12.520887]
[ 12.521008] -> (&head->lock){+...} {
[ 12.521292] HARDIRQ-ON-W at:
[ 12.521539] _raw_spin_lock+0x2f/0x40
[ 12.521950] pcpu_freelist_push+0x2a/0x40
[ 12.522396] bpf_get_stackid+0x494/0x4d0
[ 12.522828] ___bpf_prog_run+0x8b4/0x11a0
[ 12.523296] INITIAL USE at:
[ 12.523537] _raw_spin_lock+0x2f/0x40
[ 12.523944] pcpu_freelist_populate+0xc0/0x120
[ 12.524417] htab_map_alloc+0x405/0x500
[ 12.524835] __do_sys_bpf+0x1a3/0x1a90
[ 12.525253] do_syscall_64+0x4a/0x180
[ 12.525659] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 12.526167] }
[ 12.526311] ... key at: [<ffffffff838f7668>] __key.13130+0x0/0x8
[ 12.526812] ... acquired at:
[ 12.527047] __lock_acquire+0x521/0x1350
[ 12.527371] lock_acquire+0x98/0x190
[ 12.527680] _raw_spin_lock+0x2f/0x40
[ 12.527994] pcpu_freelist_push+0x2a/0x40
[ 12.528325] bpf_get_stackid+0x494/0x4d0
[ 12.528645] ___bpf_prog_run+0x8b4/0x11a0
[ 12.528970]
[ 12.529092]
[ 12.529092] stack backtrace:
[ 12.529444] CPU: 0 PID: 276 Comm: dd Not tainted 5.0.0-rc3-00018-g2fa53f892422 #475
[ 12.530043] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[ 12.530750] Call Trace:
[ 12.530948] dump_stack+0x5f/0x8b
[ 12.531248] check_usage_backwards+0x10c/0x120
[ 12.531598] ? ___bpf_prog_run+0x8b4/0x11a0
[ 12.531935] ? mark_lock+0x382/0x560
[ 12.532229] mark_lock+0x382/0x560
[ 12.532496] ? print_shortest_lock_dependencies+0x180/0x180
[ 12.532928] __lock_acquire+0x521/0x1350
[ 12.533271] ? find_get_entry+0x17f/0x2e0
[ 12.533586] ? find_get_entry+0x19c/0x2e0
[ 12.533902] ? lock_acquire+0x98/0x190
[ 12.534196] lock_acquire+0x98/0x190
[ 12.534482] ? pcpu_freelist_push+0x2a/0x40
[ 12.534810] _raw_spin_lock+0x2f/0x40
[ 12.535099] ? pcpu_freelist_push+0x2a/0x40
[ 12.535432] pcpu_freelist_push+0x2a/0x40
[ 12.535750] bpf_get_stackid+0x494/0x4d0
[ 12.536062] ___bpf_prog_run+0x8b4/0x11a0It has been explained that is a false positive here:
https://lkml.org/lkml/2018/7/25/756
Recap:
- stackmap uses pcpu_freelist
- The lock in pcpu_freelist is a percpu lock
- stackmap is only used by tracing bpf_prog
- A tracing bpf_prog cannot be run if another bpf_prog
has already been running (ensured by the percpu bpf_prog_active counter).
Eric pointed out that this lockdep splats stops other legit lockdep splats in selftests/bpf/test_progs.c.
Fix this by calling local_irq_save/restore for stackmap.
Another false positive had also been worked around by calling local_irq_save in commit 89ad2fa3f043 ("bpf: fix lockdep splat"). That commit added unnecessary irq_save/restore to fast path of bpf hash map. irqs are already disabled at that point, since htab is holding per bucket spin_lock with irqsave.
Let's reduce overhead for htab by introducing __pcpu_freelist_push/pop function w/o irqsave and convert pcpu_freelist_push/pop to irqsave to be used elsewhere (right now only in stackmap).
It stops lockdep false positive in stackmap with a bit of acceptable overhead.
--- kernel/bpf/hashtab.c | 4 ++-- kernel/bpf/percpu_freelist.c | 41 +++++++++++++++++++++++++----------- kernel/bpf/percpu_freelist.h | 4 ++++ 3 files changed, 35 insertions(+), 14 deletions(-)
kernel/bpf/hashtab.c +2 -2
@@ -655,7 +655,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) }if (htab_is_prealloc (htab)) { -pcpu_freelist_push (&htab->freelist, &l->fnode); +__pcpu_freelist_push (&htab->freelist, &l->fnode); }else {atomic_dec (&htab->count); l->htab = htab;
@@ -717,7 +717,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, }else {struct pcpu_freelist_node *l; - l =pcpu_freelist_pop (&htab->freelist); + l =__pcpu_freelist_pop (&htab->freelist);if (!l)return ERR_PTR (-E2BIG ); l_new = container_of(l, struct htab_elem, fnode);
kernel/bpf/percpu_freelist.c +29 -12
86 lines not on this page · raw message
kernel/bpf/percpu_freelist.h +4 -0
@@ -22,8 +22,12 @@ struct pcpu_freelist_node {struct pcpu_freelist_node *next; }; +/* pcpu_freelist_* do spin_lock_irqsave. */ void pcpu_freelist_push (struct pcpu_freelist *,struct pcpu_freelist_node *);struct pcpu_freelist_node *pcpu_freelist_pop (struct pcpu_freelist *); +/* __pcpu_freelist_* do spin_lock only. caller must disable irqs. */ +void __pcpu_freelist_push (struct pcpu_freelist *,struct pcpu_freelist_node *); +struct pcpu_freelist_node *__pcpu_freelist_pop (struct pcpu_freelist *);void pcpu_freelist_populate (struct pcpu_freelist *s,void *buf,u32 elem_size,u32 nr_elems);int pcpu_freelist_init (struct pcpu_freelist *);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 103/135 drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b14e945bda8ae227d1bf2b1837c0c4a61721cd1a ]
When initializing clocks, a reference to the TCON channel 0 clock is obtained. However, the clock is never prepared and enabled later. Switching from simplefb to DRM actually disables the clock (that was usually configured by U-Boot) because of that.
On the V3s, this results in a hang when writing to some mixer registers when switching over to DRM from simplefb.
Fix this by preparing and enabling the clock when initializing other clocks. Waiting for sun4i_tcon_channel_enable to enable the clock is apparently too late and results in the same mixer register access hang.
--- drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/sun4i/sun4i_tcon.c +2 -0
@@ -371,6 +371,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,dev_err (dev,"Couldn't get the TCON channel 0 clock\n" );return PTR_ERR (tcon->sclk0); } +clk_prepare_enable (tcon->sclk0);if (tcon->quirks->has_channel_1) { tcon->sclk1 =devm_clk_get (dev,"tcon-ch1" );
@@ -385,6 +386,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,static void sun4i_tcon_free_clocks (struct sun4i_tcon *tcon) { +clk_disable_unprepare (tcon->sclk0);clk_disable_unprepare (tcon->clk); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 104/135 dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dc3f595b6617ebc0307e0ce151e8f2f2b2489b95 ]
atchan->status variable is used to store two different information:
- pass channel interrupts status from interrupt handler to tasklet;
- channel information like whether it is cyclic or paused;
This causes a bug when device_terminate_all() is called, (AT_XDMAC_CHAN_IS_CYCLIC cleared on atchan->status) and then a late End of Block interrupt arrives (AT_XDMAC_CIS_BIS), which sets bit 0 of atchan->status. Bit 0 is also used for AT_XDMAC_CHAN_IS_CYCLIC, so when a new descriptor for a cyclic transfer is created, the driver reports the channel as in use:
if (test_and_set_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status)) {
dev_err(chan2dev(chan), "channel currently used\n");
return NULL;
}This patch fixes the bug by adding a different struct member to keep the interrupts status separated from the channel status bits.
--- drivers/dma/at_xdmac.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/dma/at_xdmac.c +10 -9
@@ -203,6 +203,7 @@ struct at_xdmac_chan {u32 save_cim;u32 save_cnda;u32 save_cndc; +u32 irq_status;unsigned long status;struct tasklet_struct tasklet;struct dma_slave_config sconfig;
@@ -1580,8 +1581,8 @@ static void at_xdmac_tasklet(unsigned long data)struct at_xdmac_desc *desc;u32 error_mask; -dev_dbg (chan2dev (&atchan->chan),"%s: status=0x%08lx\n" , - __func__, atchan->status); +dev_dbg (chan2dev (&atchan->chan),"%s: status=0x%08x\n" , + __func__, atchan->irq_status); error_mask =AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS
@@ -1589,15 +1590,15 @@ static void at_xdmac_tasklet(unsigned long data)if (at_xdmac_chan_is_cyclic (atchan)) {at_xdmac_handle_cyclic (atchan); - }else if ((atchan->status &AT_XDMAC_CIS_LIS ) - || (atchan->status & error_mask)) { + }else if ((atchan->irq_status &AT_XDMAC_CIS_LIS ) + || (atchan->irq_status & error_mask)) {struct dma_async_tx_descriptor *txd; -if (atchan->status &AT_XDMAC_CIS_RBEIS ) +if (atchan->irq_status &AT_XDMAC_CIS_RBEIS )dev_err (chan2dev (&atchan->chan),"read bus error!!!" ); -if (atchan->status &AT_XDMAC_CIS_WBEIS ) +if (atchan->irq_status &AT_XDMAC_CIS_WBEIS )dev_err (chan2dev (&atchan->chan),"write bus error!!!" ); -if (atchan->status &AT_XDMAC_CIS_ROIS ) +if (atchan->irq_status &AT_XDMAC_CIS_ROIS )dev_err (chan2dev (&atchan->chan),"request overflow error!!!" );spin_lock_bh (&atchan->lock);
@@ -1652,7 +1653,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id) atchan = &atxdmac->chan[i]; chan_imr =at_xdmac_chan_read (atchan,AT_XDMAC_CIM ); chan_status =at_xdmac_chan_read (atchan,AT_XDMAC_CIS ); - atchan->status = chan_status & chan_imr; + atchan->irq_status = chan_status & chan_imr;dev_vdbg (atxdmac->dma.dev,"%s: chan%d: imr=0x%x, status=0x%x\n" , __func__, i, chan_imr, chan_status);
@@ -1666,7 +1667,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)at_xdmac_chan_read (atchan,AT_XDMAC_CDA ), at_xdmac_chan_read(atchan, AT_XDMAC_CUBC)); -if (atchan->status & (AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS )) +if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS ))at_xdmac_write (atxdmac,AT_XDMAC_GD , atchan->mask);tasklet_schedule (&atchan->tasklet);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 105/135 vsock/virtio: fix kernel panic after device hot-unplug
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 22b5c0b63f32568e130fa2df4ba23efce3eb495b ]
virtio_vsock_remove() invokes the vsock_core_exit() also if there are opened sockets for the AF_VSOCK protocol family. In this way the vsock "transport" pointer is set to NULL, triggering the kernel panic at the first socket activity.
This patch move the vsock_core_init()/vsock_core_exit() in the virtio_vsock respectively in module_init and module_exit functions, that cannot be invoked until there are open sockets.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1609699
--- net/vmw_vsock/virtio_transport.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
net/vmw_vsock/virtio_transport.c +18 -8
@@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void) {struct virtio_vsock *vsock =virtio_vsock_get (); +if (!vsock) +return VMADDR_CID_ANY ; +return vsock->guest_cid; }
@@ -584,10 +587,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)virtio_vsock_update_guest_cid (vsock); - ret =vsock_core_init (&virtio_transport.transport); -if (ret <0 ) - goto out_vqs; - vsock->rx_buf_nr =0 ; vsock->rx_buf_max_nr =0 ;atomic_set (&vsock->queued_replies,0 );
@@ -618,8 +617,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)mutex_unlock (&the_virtio_vsock_mutex);return 0 ; -out_vqs: - vsock->vdev->config->del_vqs (vsock->vdev); out:kfree (vsock);mutex_unlock (&the_virtio_vsock_mutex);
@@ -669,7 +666,6 @@ static void virtio_vsock_remove(struct virtio_device *vdev)mutex_lock (&the_virtio_vsock_mutex); the_virtio_vsock =NULL ; -vsock_core_exit ();mutex_unlock (&the_virtio_vsock_mutex); vdev->config->del_vqs (vdev);
@@ -702,14 +698,28 @@ static int __init virtio_vsock_init(void) virtio_vsock_workqueue =alloc_workqueue ("virtio_vsock" ,0 ,0 );if (!virtio_vsock_workqueue)return -ENOMEM ; + ret =register_virtio_driver (&virtio_vsock_driver);if (ret) -destroy_workqueue (virtio_vsock_workqueue); + goto out_wq; + + ret =vsock_core_init (&virtio_transport.transport); +if (ret) + goto out_vdr; + +return 0 ; + +out_vdr: +unregister_virtio_driver (&virtio_vsock_driver); +out_wq: +destroy_workqueue (virtio_vsock_workqueue);return ret; + } static void __exit virtio_vsock_exit(void) { +vsock_core_exit ();unregister_virtio_driver (&virtio_vsock_driver);destroy_workqueue (virtio_vsock_workqueue); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 106/135 vsock/virtio: reset connected sockets on device removal
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 85965487abc540368393a15491e6e7fcd230039d ]
When the virtio transport device disappear, we should reset all connected sockets in order to inform the users.
--- net/vmw_vsock/virtio_transport.c | 3 +++ 1 file changed, 3 insertions(+)
net/vmw_vsock/virtio_transport.c +3 -0
@@ -634,6 +634,9 @@ static void virtio_vsock_remove(struct virtio_device *vdev)flush_work (&vsock->event_work);flush_work (&vsock->send_pkt_work); +/* Reset all connected sockets when the device disappear */ +vsock_for_each_connected_socket (virtio_vsock_reset_sock); + vdev->config->reset (vdev);mutex_lock (&vsock->rx_lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 107/135 dmaengine: dmatest: Abort test in case of mapping error
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6454368a804c4955ccd116236037536f81e5b1f1 ]
In case of mapping error the DMA addresses are invalid and continuing will screw system memory or potentially something else.
[ 222.480310] dmatest: dma0chan7-copy0: summary 1 tests, 3 failures 6 iops 349 KB/s (0) ... [ 240.912725] check: Corrupted low memory at 00000000c7c75ac9 (2940 phys) = 5656000000000000 [ 240.921998] check: Corrupted low memory at 000000005715a1cd (2948 phys) = 279f2aca5595ab2b [ 240.931280] check: Corrupted low memory at 000000002f4024c0 (2950 phys) = 5e5624f349e793cf
...
Abort any test if mapping failed.
--- drivers/dma/dmatest.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-)
drivers/dma/dmatest.c +12 -16
@@ -626,11 +626,9 @@ static int dmatest_func(void *data) srcs[i] = um->addr[i] + src_off; ret =dma_mapping_error (dev->dev, um->addr[i]);if (ret) { -dmaengine_unmap_put (um);result ("src mapping error" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; } um->to_cnt++; }
@@ -645,11 +643,9 @@ static int dmatest_func(void *data) DMA_BIDIRECTIONAL); ret =dma_mapping_error (dev->dev, dsts[i]);if (ret) { -dmaengine_unmap_put (um);result ("dst mapping error" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; } um->bidi_cnt++; }
@@ -679,12 +675,10 @@ static int dmatest_func(void *data) }if (!tx) { -dmaengine_unmap_put (um);result ("prep error" , total_tests, src_off, dst_off, len, ret);msleep (100 ); - failed_tests++; -continue ; + goto error_unmap_continue; } done->done = false;
@@ -693,12 +687,10 @@ static int dmatest_func(void *data) cookie = tx->tx_submit (tx);if (dma_submit_error (cookie)) { -dmaengine_unmap_put (um);result ("submit error" , total_tests, src_off, dst_off, len, ret);msleep (100 ); - failed_tests++; -continue ; + goto error_unmap_continue; }dma_async_issue_pending (chan);
@@ -711,16 +703,14 @@ static int dmatest_func(void *data)dmaengine_unmap_put (um);result ("test timed out" , total_tests, src_off, dst_off, len,0 ); - failed_tests++; -continue ; + goto error_unmap_continue; }else if (status !=DMA_COMPLETE ) {dmaengine_unmap_put (um);result (status ==DMA_ERROR ?"completion error status" :"completion busy status" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; }dmaengine_unmap_put (um);
@@ -765,6 +755,12 @@ static int dmatest_func(void *data)verbose_result ("test passed" , total_tests, src_off, dst_off, len,0 ); } + +continue ; + +error_unmap_continue: +dmaengine_unmap_put (um); + failed_tests++; } ktime =ktime_sub (ktime_get (), ktime); ktime =ktime_sub (ktime, comparetime);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 108/135 selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 952b72f89ae23b316da8c1021b18d0c388ad6cc4 ]
In selftests the config fragment for netfilter was added as NF_TABLES_INET=y and this patch correct it as CONFIG_NF_TABLES_INET=y
--- tools/testing/selftests/netfilter/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/netfilter/config +1 -1
@@ -1,2 +1,2 @@ CONFIG_NET_NS=y -NF_TABLES_INET=y +CONFIG_NF_TABLES_INET=y
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 109/135 selftests: netfilter: add simple masq/redirect test cases
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 98bfc3414bda335dbd7fec58bde6266f991801d7 ]
Check basic nat/redirect/masquerade for ipv4 and ipv6.
--- tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/nft_nat.sh | 762 +++++++++++++++++++ 2 files changed, 763 insertions(+), 1 deletion(-) create mode 100755 tools/testing/selftests/netfilter/nft_nat.sh
tools/testing/selftests/netfilter/Makefile +1 -1
@@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 # Makefile for netfilter selftests -TEST_PROGS := nft_trans_stress.sh +TEST_PROGS := nft_trans_stress.sh nft_nat.sh include ../lib.mk
tools/testing/selftests/netfilter/nft_nat.sh new file +762 -0
762 lines not on this page · raw message
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 110/135 netfilter: nf_nat: skip nat clash resolution for same-origin entries
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4e35c1cb9460240e983a01745b5f29fe3a4d8e39 ]
It is possible that two concurrent packets originating from the same socket of a connection-less protocol (e.g. UDP) can end up having different IP_CT_DIR_REPLY tuples which results in one of the packets being dropped.
To illustrate this, consider the following simplified scenario:
1. Packet A and B are sent at the same time from two different threads by same UDP socket. No matching conntrack entry exists yet. Both packets cause allocation of a new conntrack entry.
2. get_unique_tuple gets called for A. No clashing entry found. conntrack entry for A is added to main conntrack table.
3. get_unique_tuple is called for B and will find that the reply tuple of B is already taken by A.
It will allocate a new UDP source port for B to resolve the clash.
4. conntrack entry for B cannot be added to main conntrack table because its ORIGINAL direction is clashing with A and the REPLY directions of A and B are not the same anymore due to UDP source port reallocation done in step 3.
This patch modifies nf_conntrack_tuple_taken so it doesn't consider colliding reply tuples if the IP_CT_DIR_ORIGINAL tuples are equal.
[ Florian: simplify patch to not use .allow_clash setting
and always ignore identical flows ]
--- net/netfilter/nf_conntrack_core.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
net/netfilter/nf_conntrack_core.c +16 -0
@@ -869,6 +869,22 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, }if (nf_ct_key_equal (h, tuple, zone, net)) { +/* Tuple is taken already, so caller will need to find +* a new source port to use. +* +* Only exception: +* If the *original tuples* are identical, then both +* conntracks refer to the same flow. +* This is a rare situation, it can occur e.g. when +* more than one UDP packet is sent from same socket +* in different threads. +* +* Let nf_ct_resolve_clash() deal with this later. +*/ +if (nf_ct_tuple_equal (&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL ].tuple, + &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple)) +continue ; +NF_CT_STAT_INC_ATOMIC (net, found);rcu_read_unlock ();return 1 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 111/135 s390/qeth: fix use-after-free in error path
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit afa0c5904ba16d59b0454f7ee4c807dae350f432 ]
The error path in qeth_alloc_qdio_buffers() that takes care of cleaning up the Output Queues is buggy. It first frees the queue, but then calls qeth_clear_outq_buffers() with that very queue struct.
Make the call to qeth_clear_outq_buffers() part of the free action (in the correct order), and while at it fix the naming of the helper.
--- drivers/s390/net/qeth_core_main.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/s390/net/qeth_core_main.c +6 -9
@@ -2472,11 +2472,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx)return rc; } -static void qeth_free_qdio_out_buf (struct qeth_qdio_out_q *q) +static void qeth_free_output_queue (struct qeth_qdio_out_q *q) {if (!q)return ; +qeth_clear_outq_buffers (q,1 );qdio_free_buffers (q->qdio_bufs,QDIO_MAX_BUFFERS_PER_Q );kfree (q); }
@@ -2549,10 +2550,8 @@ static int qeth_alloc_qdio_buffers(struct qeth_card *card) card->qdio.out_qs[i]->bufs[j] =NULL ; } out_freeoutq: -while (i >0 ) { -qeth_free_qdio_out_buf (card->qdio.out_qs[--i]); -qeth_clear_outq_buffers (card->qdio.out_qs[i],1 ); - } +while (i >0 ) +qeth_free_output_queue (card->qdio.out_qs[--i]);kfree (card->qdio.out_qs); card->qdio.out_qs =NULL ; out_freepool:
@@ -2585,10 +2584,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card)qeth_free_buffer_pool (card);/* free outbound qdio_qs */ if (card->qdio.out_qs) { -for (i =0 ; i < card->qdio.no_out_queues; ++i) { -qeth_clear_outq_buffers (card->qdio.out_qs[i],1 ); -qeth_free_qdio_out_buf (card->qdio.out_qs[i]); - } +for (i =0 ; i < card->qdio.no_out_queues; i++) +qeth_free_output_queue (card->qdio.out_qs[i]);kfree (card->qdio.out_qs); card->qdio.out_qs =NULL ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 112/135 perf symbols: Filter out hidden symbols from labels
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 59a17706915fe5ea6f711e1f92d4fb706bce07fe ]
When perf is built with the annobin plugin (RHEL8 build) extra symbols are added to its binary:
# nm perf | grep annobin | head -10 0000000000241100 t .annobin_annotate.c 0000000000326490 t .annobin_annotate.c 0000000000249255 t .annobin_annotate.c_end 00000000003283a8 t .annobin_annotate.c_end 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bc3e2 t .annobin_annotate.c_end.unlikely 00000000001bc400 t .annobin_annotate.c_end.unlikely 00000000001bce18 t .annobin_annotate.c.hot 00000000001bce18 t .annobin_annotate.c.hot ...
Those symbols have no use for report or annotation and should be skipped. Moreover they interfere with the DWARF unwind test on the PPC arch, where they are mixed with checked symbols and then the test fails:
# perf test dwarf -v 59: Test dwarf unwind : --- start --- test child forked, pid 8515 unwind: .annobin_dwarf_unwind.c:ip = 0x10dba40dc (0x2740dc) ... got: .annobin_dwarf_unwind.c 0x10dba40dc, expecting test__arch_unwind_sample unwind: failed with 'no error'
The annobin symbols are defined as NOTYPE/LOCAL/HIDDEN:
# readelf -s ./perf | grep annobin | head -1
40: 00000000001bce4f 0 NOTYPE LOCAL HIDDEN 13 .annobin_init.cThey can still pass the check for the label symbol. Adding check for HIDDEN and INTERNAL (as suggested by Nick below) visibility and filter out such symbols.
Quoted 4 lines
Just to be awkward, if you are going to ignore
STV_HIDDENsymbols then you should probably also ignoreSTV_INTERNALones as well... Annobin does not generate them, but you never know, one day some other tool might create some.
--- tools/perf/util/symbol-elf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
tools/perf/util/symbol-elf.c +8 -1
@@ -87,6 +87,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym)return GELF_ST_TYPE (sym->st_info); } +static inline uint8_t elf_sym__visibility (const GElf_Sym *sym) +{ +return GELF_ST_VISIBILITY (sym->st_other); +} +#ifndef STT_GNU_IFUNC #define STT_GNU_IFUNC 10#endif
@@ -111,7 +116,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym)return elf_sym__type (sym) ==STT_NOTYPE && sym->st_name !=0 && sym->st_shndx !=SHN_UNDEF && - sym->st_shndx !=SHN_ABS ; + sym->st_shndx !=SHN_ABS && +elf_sym__visibility (sym) !=STV_HIDDEN && +elf_sym__visibility (sym) !=STV_INTERNAL ; }static bool elf_sym__is_a (GElf_Sym *sym,enum map_type type)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 113/135 perf trace: Support multiple "vfs_getname" probes
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6ab3bc240ade47a0f52bc16d97edd9accbe0024e ]
With a suitably defined "probe:vfs_getname" probe, 'perf trace' can "beautify" its output, so syscalls like open() or openat() can print the "filename" argument instead of just its hex address, like:
$ perf trace -e open -- touch /dev/null
[...]
0.590 ( 0.014 ms): touch/18063 open(filename: /dev/null, flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3
[...]The output without such beautifier looks like:
0.529 ( 0.011 ms): touch/18075 open(filename: 0xc78cf288, flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3
However, when the vfs_getname probe expands to multiple probes and it is not the first one that is hit, the beautifier fails, as following:
0.326 ( 0.010 ms): touch/18072 open(filename: , flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3
Fix it by hooking into all the expanded probes (inlines), now, for instance:
[root@quaco ~]# perf probe -l
probe:vfs_getname (on getname_flags:73@fs/namei.c with pathname)
probe:vfs_getname_1 (on getname_flags:73@fs/namei.c with pathname)
[root@quaco ~]# perf trace -e open* sleep 1
0.010 ( 0.005 ms): sleep/5588 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: RDONLY|CLOEXEC) = 3
0.029 ( 0.006 ms): sleep/5588 openat(dfd: CWD, filename: /lib64/libc.so.6, flags: RDONLY|CLOEXEC) = 3
0.194 ( 0.008 ms): sleep/5588 openat(dfd: CWD, filename: /usr/lib/locale/locale-archive, flags: RDONLY|CLOEXEC) = 3[root@quaco ~]#
Works, further verified with:
[root@quaco ~]# perf test vfs
65: Use vfs_getname probe to get syscall args filenames : Ok
66: Add vfs_getname probe to get syscall args filenames : Ok
67: Check open filename arg using perf trace + vfs_getname: Ok [root@quaco ~]#
--- tools/perf/builtin-trace.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
tools/perf/builtin-trace.c +18 -7
@@ -2109,19 +2109,30 @@ static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);static bool perf_evlist__add_vfs_getname (struct perf_evlist *evlist) { -struct perf_evsel *evsel =perf_evsel__newtp ("probe" ,"vfs_getname" ); +bool found = false; +struct perf_evsel *evsel, *tmp; +struct parse_events_error err = { .idx =0 , }; +int ret =parse_events (evlist,"probe:vfs_getname*" , &err); -if (IS_ERR (evsel)) +if (ret)return false; -if (perf_evsel__field (evsel,"pathname" ) ==NULL ) { +evlist__for_each_entry_safe (evlist, evsel, tmp) { +if (!strstarts (perf_evsel__name (evsel),"probe:vfs_getname" )) +continue ; + +if (perf_evsel__field (evsel,"pathname" )) { + evsel->handler = trace__vfs_getname; + found = true; +continue ; + } + +list_del_init (&evsel->node); + evsel->evlist =NULL ;perf_evsel__delete (evsel); -return false; } - evsel->handler = trace__vfs_getname; -perf_evlist__add (evlist, evsel); -return true; +return found; }static struct perf_evsel *perf_evsel__new_pgfault (u64 config)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 114/135 MIPS: Loongson: Introduce and use loongson_llsc_mb()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e02e07e3127d8aec1f4bcdfb2fc52a2d99b4859e ]
On the Loongson-2G/2H/3A/3B there is a hardware flaw that ll/sc and lld/scd is very weak ordering. We should add sync instructions "before each ll/lld" and "at the branch-target between ll/sc" to workaround. Otherwise, this flaw will cause deadlock occasionally (e.g. when doing heavy load test with LTP).
Below is the explaination of CPU designer:
"For Loongson 3 family, when a memory access instruction (load, store, or prefetch)'s executing occurs between the execution of LL and SC, the success or failure of SC is not predictable. Although programmer would not insert memory access instructions between LL and SC, the memory instructions before LL in program-order, may dynamically executed between the execution of LL/SC, so a memory fence (SYNC) is needed before LL/LLD to avoid this situation.
Since Loongson-3A R2 (3A2000), we have improved our hardware design to handle this case. But we later deduce a rarely circumstance that some speculatively executed memory instructions due to branch misprediction between LL/SC still fall into the above case, so a memory fence (SYNC) at branch-target (if its target is not between LL/SC) is needed for Loongson 3A1000, 3B1500, 3A2000 and 3A3000.
Our processor is continually evolving and we aim to to remove all these workaround-SYNCs around LL/SC for new-come processor."
Here is an example:
Both cpu1 and cpu2 simutaneously run atomic_add by 1 on same atomic var, this bug cause both 'sc' run by two cpus (in atomic_add) succeed at same time('sc' return 1), and the variable is only *added by 1*, sometimes, which is wrong and unacceptable(it should be added by 2).
Why disable fix-loongson3-llsc in compiler?
Because compiler fix will cause problems in kernel's __ex_table section.
This patch fix all the cases in kernel, but:
+. the fix at the end of futex_atomic_cmpxchg_inatomic is for branch-target of 'bne', there other cases which smp_mb__before_llsc() and smp_llsc_mb() fix the ll and branch-target coincidently such as atomic_sub_if_positive/ cmpxchg/xchg, just like this one.
+. Loongson 3 does support CONFIG_EDAC_ATOMIC_SCRUB, so no need to touch edac.h
+. local_ops and cmpxchg_local should not be affected by this bug since only the owner can write.
+. mips_atomic_set for syscall.c is deprecated and rarely used, just let it go
[[email protected]:
- Simplify the addition of -mno-fix-loongson3-llsc to cflags, and add a comment describing why it's there.
- Make loongson_llsc_mb() a no-op when CONFIG_CPU_LOONGSON3_WORKAROUNDS=n, rather than a compiler memory barrier.
- Add a comment describing the bug & how loongson_llsc_mb() helps in asm/barrier.h.]
--- arch/mips/Kconfig | 15 ++++++++++++++ arch/mips/include/asm/atomic.h | 6 ++++++ arch/mips/include/asm/barrier.h | 36 +++++++++++++++++++++++++++++++++ arch/mips/include/asm/bitops.h | 5 +++++ arch/mips/include/asm/futex.h | 3 +++ arch/mips/include/asm/pgtable.h | 2 ++ arch/mips/loongson64/Platform | 23 +++++++++++++++++++++ arch/mips/mm/tlbex.c | 10 +++++++++ 8 files changed, 100 insertions(+)
arch/mips/Kconfig +15 -0
@@ -1407,6 +1407,21 @@ config LOONGSON3_ENHANCEMENT please say 'N' here. If you want a high-performance kernel to run on new Loongson 3 machines only, please say 'Y' here. +config CPU_LOONGSON3_WORKAROUNDS + bool "Old Loongson 3 LLSC Workarounds" + default y if SMP + depends on CPU_LOONGSON3 + help + Loongson 3 processors have the llsc issues which require workarounds. + Without workarounds the system may hang unexpectedly. + + Newer Loongson 3 will fix these issues and no workarounds are needed. + The workarounds have no significant side effect on them but may + decrease the performance of the system so this option should be + disabled unless the kernel is intended to be run on old systems. + + If unsure, please say Y. + config CPU_LOONGSON2E bool "Loongson 2E" depends on SYS_HAS_CPU_LOONGSON2E
arch/mips/include/asm/atomic.h +6 -0
@@ -47,6 +47,7 @@ static __inline__ void atomic_##op(int i, atomic_t * v) \if (kernel_uses_llsc &&R10000_LLSC_WAR ) { \int temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set arch=r4000 \n" \ "1: ll %0, %1 # atomic_" #op " \n" \
@@ -86,6 +87,7 @@ static __inline__ int atomic_##op##_return_relaxed(int i, atomic_t * v) \if (kernel_uses_llsc &&R10000_LLSC_WAR ) { \int temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set arch=r4000 \n" \ "1: ll %1, %2 # atomic_" #op "_return \n" \
@@ -134,6 +136,7 @@ static __inline__ int atomic_fetch_##op##_relaxed(int i, atomic_t * v) \if (kernel_uses_llsc &&R10000_LLSC_WAR ) { \int temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set arch=r4000 \n" \ "1: ll %1, %2 # atomic_fetch_" #op " \n" \
@@ -389,6 +392,7 @@ static __inline__ void atomic64_##op(long i, atomic64_t * v) \if (kernel_uses_llsc &&R10000_LLSC_WAR ) { \long temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set arch=r4000 \n" \ "1: lld %0, %1 # atomic64_" #op " \n" \
@@ -428,6 +432,7 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \if (kernel_uses_llsc &&R10000_LLSC_WAR ) { \long temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set arch=r4000 \n" \ "1: lld %1, %2 # atomic64_" #op "_return\n" \
@@ -477,6 +482,7 @@ static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v) \if (kernel_uses_llsc &&R10000_LLSC_WAR ) { \long temp; \ \ +loongson_llsc_mb (); \ __asm__ __volatile__( \ " .set arch=r4000 \n" \ "1: lld %1, %2 # atomic64_fetch_" #op "\n" \
arch/mips/include/asm/barrier.h +36 -0
@@ -222,6 +222,42 @@#define __smp_mb__before_atomic () __smp_mb__before_llsc()#define __smp_mb__after_atomic () smp_llsc_mb() +/* +* Some Loongson 3 CPUs have a bug wherein execution of a memory access (load, +* store or pref) in between an ll & sc can cause the sc instruction to +* erroneously succeed, breaking atomicity. Whilst it's unusual to write code +* containing such sequences, this bug bites harder than we might otherwise +* expect due to reordering & speculation: +* +* 1) A memory access appearing prior to the ll in program order may actually +* be executed after the ll - this is the reordering case. +* +* In order to avoid this we need to place a memory barrier (ie. a sync +* instruction) prior to every ll instruction, in between it & any earlier +* memory access instructions. Many of these cases are already covered by +* smp_mb__before_llsc() but for the remaining cases, typically ones in +* which multiple CPUs may operate on a memory location but ordering is not +* usually guaranteed, we use loongson_llsc_mb() below. +* +* This reordering case is fixed by 3A R2 CPUs, ie. 3A2000 models and later. +* +* 2) If a conditional branch exists between an ll & sc with a target outside +* of the ll-sc loop, for example an exit upon value mismatch in cmpxchg() +* or similar, then misprediction of the branch may allow speculative +* execution of memory accesses from outside of the ll-sc loop. +* +* In order to avoid this we need a memory barrier (ie. a sync instruction) +* at each affected branch target, for which we also use loongson_llsc_mb() +* defined below. +* +* This case affects all current Loongson 3 CPUs. +*/ +#ifdef CONFIG_CPU_LOONGSON3_WORKAROUNDS /* Loongson-3's LLSC workaround */ +#define loongson_llsc_mb () __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory") +#else +#define loongson_llsc_mb () do { } while (0) +#endif +#include <asm-generic/barrier.h> #endif /* __ASM_BARRIER_H */
arch/mips/include/asm/bitops.h +5 -0
@@ -68,6 +68,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr) : "ir" (1UL << bit), GCC_OFF_SMALL_ASM() (*m)); #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) }else if (kernel_uses_llsc &&__builtin_constant_p (bit)) { +loongson_llsc_mb (); do { __asm__ __volatile__( " " __LL "%0, %1 # set_bit \n"
@@ -78,6 +79,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr) } while (unlikely(!temp));#endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */ }else if (kernel_uses_llsc) { +loongson_llsc_mb (); do { __asm__ __volatile__( " .set "MIPS_ISA_ARCH_LEVEL" \n"
@@ -120,6 +122,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr) : "ir" (~(1UL << bit))); #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) }else if (kernel_uses_llsc &&__builtin_constant_p (bit)) { +loongson_llsc_mb (); do { __asm__ __volatile__( " " __LL "%0, %1 # clear_bit \n"
@@ -130,6 +133,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr) } while (unlikely(!temp));#endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */ }else if (kernel_uses_llsc) { +loongson_llsc_mb (); do { __asm__ __volatile__( " .set "MIPS_ISA_ARCH_LEVEL" \n"
@@ -188,6 +192,7 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)unsigned long *m = ((unsigned long *) addr) + (nr >>SZLONG_LOG );unsigned long temp; +loongson_llsc_mb (); do { __asm__ __volatile__( " .set "MIPS_ISA_ARCH_LEVEL" \n"
arch/mips/include/asm/futex.h +3 -0
@@ -50,6 +50,7 @@ "i" (-EFAULT) \ : "memory"); \ } else if (cpu_has_llsc) { \ + loongson_llsc_mb(); \ __asm__ __volatile__( \ " .set push \n" \ " .set noat \n" \
@@ -162,6 +163,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, "i" (-EFAULT) : "memory"); }else if (cpu_has_llsc) { +loongson_llsc_mb (); __asm__ __volatile__("# futex_atomic_cmpxchg_inatomic \n" " .set push \n"
@@ -190,6 +192,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval), "i" (-EFAULT) : "memory"); +loongson_llsc_mb (); }else return -ENOSYS ;
arch/mips/include/asm/pgtable.h +2 -0
@@ -229,6 +229,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval) : [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp) : [global] "r" (page_global)); } else if (kernel_uses_llsc) { +loongson_llsc_mb (); __asm__ __volatile__ (" .set " MIPS_ISA_ARCH_LEVEL " \n" " .set push \n"
@@ -244,6 +245,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)" .set mips0 \n" : [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp) : [global] "r" (page_global)); + loongson_llsc_mb(); }#else /* !CONFIG_SMP */ if (pte_none (*buddy))
arch/mips/loongson64/Platform +23 -0
@@ -23,6 +23,29 @@ ifdef CONFIG_CPU_LOONGSON2F_WORKAROUNDS endif cflags-$(CONFIG_CPU_LOONGSON3) += -Wa,--trap + +# +# Some versions of binutils, not currently mainline as of 2019/02/04, support +# an -mfix-loongson3-llsc flag which emits a sync prior to each ll instruction +# to work around a CPU bug (see loongson_llsc_mb() in asm/barrier.h for a +# description). +# +# We disable this in order to prevent the assembler meddling with the +# instruction that labels refer to, ie. if we label an ll instruction: +# +# 1: ll v0, 0(a0) +# +# ...then with the assembler fix applied the label may actually point at a sync +# instruction inserted by the assembler, and if we were using the label in an +# exception table the table would no longer contain the address of the ll +# instruction. +# +# Avoid this by explicitly disabling that assembler behaviour. If upstream +# binutils does not merge support for the flag then we can revisit & remove +# this later - for now it ensures vendor toolchains don't cause problems. +# +cflags-$(CONFIG_CPU_LOONGSON3) += $(call as-option,-Wa$(comma)-mno-fix-loongson3-llsc,) + # # binutils from v2.25 on and gcc starting from v4.9.0 treat -march=loongson3a # as MIPS64 R2; older versions as just R1. This leaves the possibility open
arch/mips/mm/tlbex.c +10 -0
@@ -935,6 +935,8 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,* to mimic that here by taking a load/istream page * fault. */ +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (p,0 );UASM_i_LA (p, ptr, (unsigned long )tlb_do_page_fault_0);uasm_i_jr (p, ptr);
@@ -1660,6 +1662,8 @@ static void iPTE_LW(u32 **p, unsigned int pte, unsigned int ptr) {#ifdef CONFIG_SMP +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (p,0 );# ifdef CONFIG_PHYS_ADDR_T_64BIT if (cpu_has_64bits)uasm_i_lld (p, pte,0 , ptr);
@@ -2277,6 +2281,8 @@ static void build_r4000_tlb_load_handler(void)#endif uasm_l_nopage_tlbl (&l, p); +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (&p,0 );build_restore_work_registers (&p);#ifdef CONFIG_CPU_MICROMIPS if ((unsigned long )tlb_do_page_fault_0 &1 ) {
@@ -2332,6 +2338,8 @@ static void build_r4000_tlb_store_handler(void)#endif uasm_l_nopage_tlbs (&l, p); +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (&p,0 );build_restore_work_registers (&p);#ifdef CONFIG_CPU_MICROMIPS if ((unsigned long )tlb_do_page_fault_1 &1 ) {
@@ -2388,6 +2396,8 @@ static void build_r4000_tlb_modify_handler(void)#endif uasm_l_nopage_tlbm (&l, p); +if (IS_ENABLED (CONFIG_CPU_LOONGSON3_WORKAROUNDS )) +uasm_i_sync (&p,0 );build_restore_work_registers (&p);#ifdef CONFIG_CPU_MICROMIPS if ((unsigned long )tlb_do_page_fault_1 &1 ) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 115/135 MIPS: Remove function size check in get_frame_info()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2b424cfc69728224fcb5fad138ea7260728e0901 ]
Patch (b6c7a324df37b "MIPS: Fix get_frame_info() handling of microMIPS function size.") introduces additional function size check for microMIPS by only checking insn between ip and ip + func_size. However, func_size in get_frame_info() is always 0 if KALLSYMS is not enabled. This causes get_frame_info() to return immediately without calculating correct frame_size, which in turn causes "Can't analyze schedule() prologue" warning messages at boot time.
This patch removes func_size check, and let the frame_size check run up to 128 insns for both MIPS and microMIPS.
--- arch/mips/kernel/process.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/mips/kernel/process.c +3 -4
@@ -370,7 +370,7 @@ static inline int is_sp_move_ins(union mips_instruction *ip, int *frame_size)static int get_frame_info (struct mips_frame_info *info) {bool is_mmips =IS_ENABLED (CONFIG_CPU_MICROMIPS ); -union mips_instruction insn, *ip, *ip_end; +union mips_instruction insn, *ip;const unsigned int max_insns =128 ;unsigned int last_insn_size =0 ;unsigned int i;
@@ -383,10 +383,9 @@ static int get_frame_info(struct mips_frame_info *info)if (!ip) goto err; - ip_end = (void *)ip + info->func_size; - -for (i =0 ; i < max_insns && ip < ip_end; i++) { +for (i =0 ; i < max_insns; i++) { ip = (void *)ip + last_insn_size; +if (is_mmips &&mm_insn_16bit (ip->halfword[0 ])) { insn.word = ip->halfword[0 ] <<16 ; last_insn_size =2 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 116/135 i2c: omap: Use noirq system sleep pm ops to idle device for suspend
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c6e2bd956936d925748581e4d0294f10f1d92f2c ]
We currently get the following error with pixcir_ts driver during a suspend resume cycle:
omap_i2c 4802a000.i2c: controller timed outpixcir_ts 1-005c: pixcir_int_enable: can't read reg 0x34 : -110 pixcir_ts 1-005c: Failed to disable interrupt generation: -110 pixcir_ts 1-005c: Failed to stopdpm_run_callback(): pixcir_i2c_ts_resume+0x0/0x98 [pixcir_i2c_ts] returns -110
PM: Device 1-005c failed to resume: error -110
And at least am437x based devices with pixcir_ts will fail to resume to a touchscreen that is configured as the wakeup-source in device tree for these devices.
This is because pixcir_ts tries to reconfigure it's registers for noirq suspend which fails. This also leaves i2c-omap in enabled state for suspend.
Let's fix the pixcir_ts issue and make sure i2c-omap is suspended by adding SET_NOIRQ_SYSTEM_SLEEP_PM_OPS.
Let's also get rid of some ifdefs while at it and replace them with __maybe_unused as SET_RUNTIME_PM_OPS and SET_NOIRQ_SYSTEM_SLEEP_PM_OPS already deal with the various PM Kconfig options.
--- drivers/i2c/busses/i2c-omap.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
drivers/i2c/busses/i2c-omap.c +5 -8
@@ -1477,8 +1477,7 @@ static int omap_i2c_remove(struct platform_device *pdev)return 0 ; } -#ifdef CONFIG_PM -static int omap_i2c_runtime_suspend (struct device *dev) +static int __maybe_unused omap_i2c_runtime_suspend (struct device *dev) {struct omap_i2c_dev *omap =dev_get_drvdata (dev);
@@ -1504,7 +1503,7 @@ static int omap_i2c_runtime_suspend(struct device *dev)return 0 ; } -static int omap_i2c_runtime_resume (struct device *dev) +static int __maybe_unused omap_i2c_runtime_resume (struct device *dev) {struct omap_i2c_dev *omap =dev_get_drvdata (dev);
@@ -1519,20 +1518,18 @@ static int omap_i2c_runtime_resume(struct device *dev) }static const struct dev_pm_ops omap_i2c_pm_ops = { + SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, + pm_runtime_force_resume)SET_RUNTIME_PM_OPS (omap_i2c_runtime_suspend, omap_i2c_runtime_resume,NULL ) }; -#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops) -#else -#define OMAP_I2C_PM_OPS NULL -#endif /* CONFIG_PM */ static struct platform_driver omap_i2c_driver = { .probe = omap_i2c_probe, .remove = omap_i2c_remove, .driver = { .name ="omap_i2c" , - .pm =OMAP_I2C_PM_OPS , + .pm = &omap_i2c_pm_ops, .of_match_table =of_match_ptr (omap_i2c_of_match), }, };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 117/135 fs: ratelimit __find_get_block_slow() failure message.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 43636c804df0126da669c261fc820fb22f62bfc2 ]
When something let __find_get_block_slow() hit all_mapped path, it calls printk() for 100+ times per a second. But there is no need to print same message with such high frequency; it is just asking for stall warning, or at least bloating log files.
[ 399.866302][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.873324][T15342] b_state=0x00000029, b_size=512 [ 399.878403][T15342] device loop0 blocksize: 4096 [ 399.883296][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.890400][T15342] b_state=0x00000029, b_size=512 [ 399.895595][T15342] device loop0 blocksize: 4096 [ 399.900556][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.907471][T15342] b_state=0x00000029, b_size=512 [ 399.912506][T15342] device loop0 blocksize: 4096
This patch reduces frequency to up to once per a second, in addition to concatenating three lines into one.
[ 399.866302][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8, b_state=0x00000029, b_size=512, device loop0 blocksize: 4096
--- fs/buffer.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
fs/buffer.c +10 -9
@@ -208,6 +208,7 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)struct buffer_head *head;struct page *page;int all_mapped =1 ; + static DEFINE_RATELIMIT_STATE(last_warned, HZ, 1); index = block >> (PAGE_SHIFT - bd_inode->i_blkbits); page =find_get_page_flags (bd_mapping, index,FGP_ACCESSED );
@@ -235,15 +236,15 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)* file io on the block device and getblk. It gets dealt with * elsewhere, don't buffer_error if we had some unmapped buffers */ -if (all_mapped) { -printk ("__find_get_block_slow() failed. " -"block=%llu, b_blocknr=%llu\n" , - (unsigned long long )block, - (unsigned long long )bh->b_blocknr); -printk ("b_state=0x%08lx, b_size=%zu\n" , - bh->b_state, bh->b_size); -printk ("device %pg blocksize: %d\n" , bdev, -1 << bd_inode->i_blkbits); +ratelimit_set_flags (&last_warned,RATELIMIT_MSG_ON_RELEASE ); +if (all_mapped &&__ratelimit (&last_warned)) { +printk ("__find_get_block_slow() failed. block=%llu, " +"b_blocknr=%llu, b_state=0x%08lx, b_size=%zu, " +"device %pg blocksize: %d\n" , + (unsigned long long )block, + (unsigned long long )bh->b_blocknr, + bh->b_state, bh->b_size, bdev, +1 << bd_inode->i_blkbits); } out_unlock:spin_unlock (&bd_mapping->private_lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 118/135 qed: Fix EQ full firmware assert.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 660492bcf4a7561b5fdc13be0ae0b0c0a8c120be ]
When slowpath messages are sent with high rate, the resulting events can lead to a FW assert in case they are not handled fast enough (Event Queue Full assert). Attempt to send queued slowpath messages only after the newly evacuated entries in the EQ ring are indicated to FW.
--- drivers/net/ethernet/qlogic/qed/qed_sp.h | 1 + drivers/net/ethernet/qlogic/qed/qed_spq.c | 15 +++++++-------- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_sp.h +1 -0
@@ -380,6 +380,7 @@ void qed_consq_setup(struct qed_hwfn *p_hwfn);* @param p_hwfn */ void qed_consq_free (struct qed_hwfn *p_hwfn); +int qed_spq_pend_post (struct qed_hwfn *p_hwfn);/** * @file
drivers/net/ethernet/qlogic/qed/qed_spq.c +7 -8
@@ -404,6 +404,11 @@ int qed_eq_completion(struct qed_hwfn *p_hwfn, void *cookie)qed_eq_prod_update (p_hwfn,qed_chain_get_prod_idx (p_chain)); +/* Attempt to post pending requests */ +spin_lock_bh (&p_hwfn->p_spq->lock); + rc =qed_spq_pend_post (p_hwfn); +spin_unlock_bh (&p_hwfn->p_spq->lock); +return rc; }
@@ -747,7 +752,7 @@ static int qed_spq_post_list(struct qed_hwfn *p_hwfn,return 0 ; } -static int qed_spq_pend_post (struct qed_hwfn *p_hwfn) +int qed_spq_pend_post (struct qed_hwfn *p_hwfn) {struct qed_spq *p_spq = p_hwfn->p_spq;struct qed_spq_entry *p_ent =NULL ;
@@ -879,7 +884,6 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,struct qed_spq_entry *p_ent =NULL ;struct qed_spq_entry *tmp;struct qed_spq_entry *found =NULL ; -int rc;if (!p_hwfn)return -EINVAL ;
@@ -937,12 +941,7 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,*/ qed_spq_return_entry (p_hwfn, found); -/* Attempt to post pending requests */ -spin_lock_bh (&p_spq->lock); - rc =qed_spq_pend_post (p_hwfn); -spin_unlock_bh (&p_spq->lock); - -return rc; +return 0 ; }int qed_consq_alloc (struct qed_hwfn *p_hwfn)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 119/135 qed: Consider TX tcs while deriving the max num_queues for PF.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fb1faab74ddef9ec2d841d54e5d0912a097b3abe ]
Max supported queues is derived incorrectly in the case of multi-CoS. Need to consider TCs while calculating num_queues for PF.
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +3 -2
@@ -2170,7 +2170,7 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,u16 num_queues =0 ;/* Since the feature controls only queue-zones, -* make sure we have the contexts [rx, tx, xdp] to +* make sure we have the contexts [rx, xdp, tcs] to * match. */ for_each_hwfn (cdev, i) {
@@ -2180,7 +2180,8 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,u16 cids; cids = hwfn->pf_params.eth_pf_params.num_cons; - num_queues +=min_t (u16, l2_queues, cids /3 ); + cids /= (2 + info->num_tc); + num_queues +=min_t (u16, l2_queues, cids); }/* queues might theoretically be >256, but interrupts'
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 120/135 Input: wacom_serial4 - add support for Wacom ArtPad II tablet
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit 44fc95e218a09d7966a9d448941fdb003f6bb69f upstream.
Tablet initially begins communicating at 9600 baud, so this command should be used to connect to the device:
$ inputattach --daemon --baud 9600 --wacom_iv /dev/ttyS0
https://github.com/linuxwacom/xf86-input-wacom/issues/40
--- drivers/input/tablet/wacom_serial4.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/tablet/wacom_serial4.c +2 -0
@@ -187,6 +187,7 @@ enum {MODEL_DIGITIZER_II =0x5544 ,/* UD */ MODEL_GRAPHIRE =0x4554 ,/* ET */ MODEL_PENPARTNER =0x4354 ,/* CT */ + MODEL_ARTPAD_II = 0x4B54, /* KT */ };static void wacom_handle_model_response (struct wacom *wacom)
@@ -245,6 +246,7 @@ static void wacom_handle_model_response( wacom->flags =F_HAS_STYLUS2 |F_HAS_SCROLLWHEEL ;break ; +case MODEL_ARTPAD_II :case MODEL_DIGITIZER_II : wacom->dev->name ="Wacom Digitizer II" ; wacom->dev->id.version =MODEL_DIGITIZER_II ;
Greg Kroah-Hartman
maintainerPATCH 121/135 Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Batts <[email protected]>
commit e154ab69321ce2c54f19863d75c77b4e2dc9d365 upstream.
Lenovo s21e-20 uses ELAN0601 in its ACPI tables for the Elan touchpad.
--- drivers/input/mouse/elan_i2c_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/elan_i2c_core.c +1 -0
@@ -1252,6 +1252,7 @@ static const struct acpi_device_id elan_ { "ELAN0000", 0 }, { "ELAN0100", 0 }, { "ELAN0600", 0 }, + { "ELAN0601", 0 }, { "ELAN0602", 0 }, { "ELAN0605", 0 }, { "ELAN0608", 0 },
Greg Kroah-Hartman
maintainerPATCH 122/135 iscsi_ibft: Fix missing break in switch statement
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit df997abeebadaa4824271009e2d2b526a70a11cb upstream.
Add missing break statement in order to prevent the code from falling through to case ISCSI_BOOT_TGT_NAME, which is unnecessary.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/firmware/iscsi_ibft.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/iscsi_ibft.c +1 -0
@@ -542,6 +542,7 @@ static umode_t __init ibft_check_tgt_forcase ISCSI_BOOT_TGT_NIC_ASSOC :case ISCSI_BOOT_TGT_CHAP_TYPE : rc =S_IRUGO ; +break ;case ISCSI_BOOT_TGT_NAME :if (tgt->tgt_name_len) rc =S_IRUGO ;
Greg Kroah-Hartman
maintainerPATCH 123/135 scsi: aacraid: Fix missing break in switch statement
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit 5e420fe635813e5746b296cfc8fff4853ae205a2 upstream.
Add missing break statement and fix identation issue.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/scsi/aacraid/commsup.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/aacraid/commsup.c +3 -2
@@ -1332,8 +1332,9 @@ static void aac_handle_aif(struct aac_de ADD :DELETE ;break ; } -case AifBuManagerEvent: -aac_handle_aif_bu (dev, aifcmd); +break ; +case AifBuManagerEvent: +aac_handle_aif_bu (dev, aifcmd);break ; }
Greg Kroah-Hartman
maintainerPATCH 124/135 arm64: dts: hikey: Give wifi some time after power-on
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
commit 83b944174ad79825ae84a47af1a0354485b24602 upstream.
Somewhere along recent changes to power control of the wl1835, power-on became very unreliable on the hikey, failing like this:
wl1271_sdio: probe of mmc2:0001:1 failed with error -16wl1271_sdio: probe of mmc2:0001:2 failed with error -16
After playing with some dt parameters and comparing to other users of this chip, it turned out we need some power-on delay to make things stable again. In contrast to those other users which define 200 ms, the hikey would already be happy with 1 ms. Still, we use the safer 10 ms, like on the Ultra96.
--- arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +1 -0
@@ -118,6 +118,7 @@ reset-gpios = <&gpio0 5 GPIO_ACTIVE_LOW>; clocks = <&pmic>; clock-names = "ext_clock"; + post-power-on-delay-ms = <10>; power-off-delay-us = <10>; };
Greg Kroah-Hartman
maintainerPATCH 125/135 ARM: dts: exynos: Fix pinctrl definition for eMMC RTSN line on Odroid X2/U3
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit ec33745bccc8f336957c751f4153421cc9ef5a54 upstream.
Commit 225da7e65a03 ("ARM: dts: add eMMC reset line for exynos4412-odroid-common") added MMC power sequence for eMMC card of Odroid X2/U3. It reused generic sd1_cd pin control configuration node and only disabled pull-up. However that time the pinctrl configuration was not applied during MMC power sequence driver initialization. This has been changed later by commit d97a1e5d7cd2 ("mmc: pwrseq: convert to proper platform device").
It turned out then, that the provided pinctrl configuration is not correct, because the eMMC_RTSN line is being re-configured as 'special function/card detect function for mmc1 controller' not the simple 'output', thus the power sequence driver doesn't really set the pin value. This in effect broke the reboot of Odroid X2/U3 boards. Fix this by providing separate node with eMMC_RTSN pin configuration.
--- arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/arm/boot/dts/exynos4412-odroid-common.dtsi +6 -7
@@ -60,7 +60,7 @@ }; emmc_pwrseq: pwrseq { - pinctrl-0 = <&sd1_cd>; + pinctrl-0 = <&emmc_rstn>; pinctrl-names = "default"; compatible = "mmc-pwrseq-emmc"; reset-gpios = <&gpk1 2 GPIO_ACTIVE_LOW>;
@@ -161,12 +161,6 @@ cpu0-supply = <&buck2_reg>; }; -/* RSTN signal for eMMC */ -&sd1_cd { - samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>; - samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>; -}; - &pinctrl_1 { gpio_power_key: power_key { samsung,pins = "gpx1-3";
@@ -184,6 +178,11 @@ samsung,pins = "gpx3-7"; samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>; }; + + emmc_rstn: emmc-rstn { + samsung,pins = "gpk1-2"; + samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>; + }; }; &ehci {
Greg Kroah-Hartman
maintainerPATCH 126/135 ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit a66352e005488ecb4b534ba1af58a9f671eba9b8 upstream.
Add minimal parameters needed by the Exynos CLKOUT driver to Exynos3250 PMU node. This fixes the following warning on boot:
exynos_clkout_init: failed to register clkout clock
--- arch/arm/boot/dts/exynos3250.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/exynos3250.dtsi +3 -0
@@ -172,6 +172,9 @@ interrupt-controller; #interrupt-cells = <3>; interrupt-parent = <&gic>; + clock-names = "clkout8"; + clocks = <&cmu CLK_FIN_PLL>; + #clock-cells = <1>; }; mipi_phy: video-phy {
Greg Kroah-Hartman
maintainerPATCH 127/135 drm: disable uncached DMA optimization for ARM and arm64
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e02f5c1bb2283cfcee68f2f0feddcc06150f13aa ]
The DRM driver stack is designed to work with cache coherent devices only, but permits an optimization to be enabled in some cases, where for some buffers, both the CPU and the GPU use uncached mappings, removing the need for DMA snooping and allocation in the CPU caches.
The use of uncached GPU mappings relies on the correct implementation of the PCIe NoSnoop TLP attribute by the platform, otherwise the GPU will use cached mappings nonetheless. On x86 platforms, this does not seem to matter, as uncached CPU mappings will snoop the caches in any case. However, on ARM and arm64, enabling this optimization on a platform where NoSnoop is ignored results in loss of coherency, which breaks correct operation of the device. Since we have no way of detecting whether NoSnoop works or not, just disable this optimization entirely for ARM and arm64.
--- include/drm/drm_cache.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
include/drm/drm_cache.h +18 -0
@@ -45,6 +45,24 @@ static inline bool drm_arch_can_wc_memory(void)return false;#elif defined(CONFIG_MIPS ) && defined(CONFIG_CPU_LOONGSON3 )return false; +#elif defined(CONFIG_ARM ) || defined(CONFIG_ARM64 ) +/* +* The DRM driver stack is designed to work with cache coherent devices +* only, but permits an optimization to be enabled in some cases, where +* for some buffers, both the CPU and the GPU use uncached mappings, +* removing the need for DMA snooping and allocation in the CPU caches. +* +* The use of uncached GPU mappings relies on the correct implementation +* of the PCIe NoSnoop TLP attribute by the platform, otherwise the GPU +* will use cached mappings nonetheless. On x86 platforms, this does not +* seem to matter, as uncached CPU mappings will snoop the caches in any +* case. However, on ARM and arm64, enabling this optimization on a +* platform where NoSnoop is ignored results in loss of coherency, which +* breaks correct operation of the device. Since we have no way of +* detecting whether NoSnoop works or not, just disable this +* optimization entirely for ARM and arm64. +*/ +return false;#else return true;#endif
Signature · 8 lines
2.19.1 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Greg Kroah-Hartman
maintainerPATCH 128/135 ARM: 8781/1: Fix Thumb-2 syscall return for binutils 2.29+
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit afc9f65e01cd114cb2cedf544d22239116ce0cc6 ]
When building the kernel as Thumb-2 with binutils 2.29 or newer, if the assembler has seen the .type directive (via ENDPROC()) for a symbol, it automatically handles the setting of the lowest bit when the symbol is used with ADR. The badr macro on the other hand handles this lowest bit manually. This leads to a jump to a wrong address in the wrong state in the syscall return path:
Internal error: Oops - undefined instruction: 0 [#2] SMP THUMB2 Modules linked in: CPU: 0 PID: 652 Comm: modprobe Tainted: G D 4.18.0-rc3+ #8 PC is at ret_fast_syscall+0x4/0x62 LR is at sys_brk+0x109/0x128 pc : [<80101004>] lr : [<801c8a35>] psr: 60000013 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 50c5387d Table: 9e82006a DAC: 00000051 Process modprobe (pid: 652, stack limit = 0x(ptrval))
80101000 <ret_fast_syscall>:
80101000: b672 cpsid i 80101002: f8d9 2008 ldr.w r2, [r9, #8] 80101006: f1b2 4ffe cmp.w r2, #2130706432 ; 0x7f000000
80101184 <local_restart>:
80101184: f8d9 a000 ldr.w sl, [r9]
80101188: e92d 0030 stmdb sp!, {r4, r5}
8010118c: f01a 0ff0 tst.w sl, #240 ; 0xf0
80101190: d117 bne.n 801011c2 <__sys_trace>
80101192: 46ba mov sl, r7
80101194: f5ba 7fc8 cmp.w sl, #400 ; 0x190
80101198: bf28 it cs
8010119a: f04f 0a00 movcs.w sl, #0
8010119e: f3af 8014 nop.w {20}
801011a2: f2af 1ea2 subw lr, pc, #418 ; 0x1a2To fix this, add a new symbol name which doesn't have ENDPROC used on it and use that with badr. We can't remove the badr usage since that would would cause breakage with older binutils.
--- arch/arm/kernel/entry-common.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/arm/kernel/entry-common.S +3 -1
@@ -46,6 +46,7 @@ saved_pc .req lr * features make this path too inefficient. */ ret_fast_syscall: +__ret_fast_syscall: UNWIND(.fnstart ) UNWIND(.cantunwind ) disable_irq_notrace @ disable interrupts
@@ -75,6 +76,7 @@ fast_work_pending: * r0 first to avoid needing to save registers around each C function call. */ ret_fast_syscall: +__ret_fast_syscall: UNWIND(.fnstart ) UNWIND(.cantunwind ) str r0, [sp, #S_R0 + S_OFF]! @ save returned r0
@@ -241,7 +243,7 @@ local_restart: tst r10, #_TIF_SYSCALL_WORK @ are we tracing syscalls? bne __sys_trace - invoke_syscall tbl, scno, r10, ret_fast_syscall + invoke_syscall tbl, scno, r10, __ret_fast_syscall add r1, sp, #S_OFF 2: cmp scno, #(__ARM_NR_BASE - __NR_SYSCALL_BASE)
Greg Kroah-Hartman
maintainerPATCH 129/135 gfs2: Fix missed wakeups in find_insert_glock
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 605b0487f0bc1ae9963bf52ece0f5c8055186f81 upstream.
Mark Syms has reported seeing tasks that are stuck waiting in find_insert_glock. It turns out that struct lm_lockname contains four padding bytes on 64-bit architectures that function glock_waitqueue doesn't skip when hashing the glock name. As a result, we can end up waking up the wrong waitqueue, and the waiting tasks may be stuck forever.
Fix that by using ht_parms.key_len instead of sizeof(struct lm_lockname) for the key length.
--- fs/gfs2/glock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/glock.c +1 -1
@@ -107,7 +107,7 @@ static int glock_wake_function(wait_queustatic wait_queue_head_t *glock_waitqueue (struct lm_lockname *name) { -u32 hash =jhash2 ((u32 *)name,sizeof (*name) /4 ,0 ); +u32 hash =jhash2 ((u32 *)name, ht_parms.key_len /4 ,0 );return glock_wait_table +hash_32 (hash,GLOCK_WAIT_TABLE_BITS ); }
Greg Kroah-Hartman
maintainerPATCH 130/135 ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel F. Dickinson <[email protected]>
commit ce938231bd3b1d7af3cbd8836f084801090470e1 upstream.
ath9k_of_init() function[0] was initially written on the assumption that if someone had an explicit ath9k OF node that "there must be something wrong, why would someone add an OF node if everything is fine"[1] (Quoting Martin Blumenstingl <[email protected]>)
"it turns out it's not that simple. with your requirements I'm now aware of two use-cases where the current code in ath9k_of_init() doesn't work without modifications"[1]
The "your requirements" Martin speaks of is the result of the fact that I have a device (PowerCloud Systems CR5000) has some kind of default - not unique mac address - set and requires to set the correct MAC address via mac-address devicetree property, however:
"some cards come with a physical EEPROM chip [or OTP] so "qca,no-eeprom" should not be set (your use-case). in this case AH_USE_EEPROM should be set (which is the default when there is no OF node)"[1]
The other use case is:
the firmware on some PowerMac G5 seems to add a OF node for the ath9k card automatically. depending on the EEPROM on the card AH_NO_EEP_SWAP should be unset (which is the default when there is no OF node). see [3]
After this patch to ath9k_of_init() the new behavior will be:
if there's no OF node then everything is the same as before if there's an empty OF node then ath9k will use the hardware EEPROM
(before ath9k would fail to initialize because no EEPROM data was provided by userspace)
if there's an OF node with only a MAC address then ath9k will use
the MAC address and the hardware EEPROM (see the case above)
with "qca,no-eeprom" EEPROM data from userspace will be requested.
the behavior here will not change
[1]
Martin provides additional background on EEPROM swapping[1].
Thanks to Christian Lamparter <[email protected]> for all his help on troubleshooting this issue and the basis for this patch.
[0]https://elixir.bootlin.com/linux/v4.20-rc7/source/drivers/net/wireless/ath/ath9k/init.c#L615 [1]https://github.com/openwrt/openwrt/pull/1645#issuecomment-448027058 [2]https://github.com/openwrt/openwrt/pull/1613 [3]https://patchwork.kernel.org/patch/10241731/
--- drivers/net/wireless/ath/ath9k/init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath9k/init.c +3 -3
@@ -580,15 +580,15 @@ static int ath9k_of_init(struct ath_soft ret =ath9k_eeprom_request (sc, eeprom_name);if (ret)return ret; + + ah->ah_flags &= ~AH_USE_EEPROM ; + ah->ah_flags |=AH_NO_EEP_SWAP ; } mac =of_get_mac_address (np);if (mac)ether_addr_copy (common->macaddr, mac); - ah->ah_flags &= ~AH_USE_EEPROM ; - ah->ah_flags |=AH_NO_EEP_SWAP ; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 131/135 driver core: Postpone DMA tear-down until after devres release
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit 376991db4b6464e906d699ef07681e2ffa8ab08c upstream.
When unbinding the (IOMMU-enabled) R-Car SATA device on Salvator-XS (R-Car H3 ES2.0), in preparation of rebinding against vfio-platform for device pass-through for virtualization:
echo ee300000.sata > /sys/bus/platform/drivers/sata_rcar/unbind
the kernel crashes with:
Unable to handle kernel paging request at virtual address ffffffbf029ffffc
Mem abort info:
ESR = 0x96000006
Exception class = DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
swapper pgtable: 4k pages, 39-bit VAs, pgdp = 000000007e8c586c [ffffffbf029ffffc] pgd=000000073bfc6003, pud=000000073bfc6003, pmd=0000000000000000
Internal error: Oops: 96000006 [#1] SMP Modules linked in: CPU: 0 PID: 1098 Comm: bash Not tainted 5.0.0-rc5-salvator-x-00452-g37596f884f4318ef #287 Hardware name: Renesas Salvator-X 2nd version board based on r8a7795 ES2.0+ (DT) pstate: 60400005 (nZCv daif +PAN -UAO) pc : __free_pages+0x8/0x58 lr : __dma_direct_free_pages+0x50/0x5c
sp : ffffff801268baa0
x29: ffffff801268baa0 x28: 0000000000000000
x27: ffffffc6f9c60bf0 x26: ffffffc6f9c60bf0
x25: ffffffc6f9c60810 x24: 0000000000000000
x23: 00000000fffff000 x22: ffffff8012145000
x21: 0000000000000800 x20: ffffffbf029fffc8
x19: 0000000000000000 x18: ffffffc6f86c42c8
x17: 0000000000000000 x16: 0000000000000070
x15: 0000000000000003 x14: 0000000000000000
x13: ffffff801103d7f8 x12: 0000000000000028
x11: ffffff8011117604 x10: 0000000000009ad8
x9 : ffffff80110126d0 x8 : ffffffc6f7563000
x7 : 6b6b6b6b6b6b6b6b x6 : 0000000000000018
x5 : ffffff8011cf3cc8 x4 : 0000000000004000
x3 : 0000000000080000 x2 : 0000000000000001
x1 : 0000000000000000 x0 : ffffffbf029fffc8 Process bash (pid: 1098, stack limit = 0x00000000c38e3e32)
Call trace: __free_pages+0x8/0x58 __dma_direct_free_pages+0x50/0x5c arch_dma_free+0x1c/0x98 dma_direct_free+0x14/0x24 dma_free_attrs+0x9c/0xdc dmam_release+0x18/0x20 release_nodes+0x25c/0x28c devres_release_all+0x48/0x4c device_release_driver_internal+0x184/0x1f0 device_release_driver+0x14/0x1c unbind_store+0x70/0xb8 drv_attr_store+0x24/0x34 sysfs_kf_write+0x4c/0x64 kernfs_fop_write+0x154/0x1c4 __vfs_write+0x34/0x164 vfs_write+0xb4/0x16c ksys_write+0x5c/0xbc __arm64_sys_write+0x14/0x1c el0_svc_common+0x98/0x114 el0_svc_handler+0x1c/0x24 el0_svc+0x8/0xc Code: d51b4234 17fffffa a9bf7bfd 910003fd (b9403404) ---[ end trace 8c564cdd3a1a840f ]---
While I've bisected this to commit e8e683ae9a736407 ("iommu/of: Fix probe-deferral"), and reverting that commit on post-v5.0-rc4 kernels does fix the problem, this turned out to be a red herring.
On arm64, arch_teardown_dma_ops() resets dev->dma_ops to NULL. Hence if a driver has used a managed DMA allocation API, the allocated DMA memory will be freed using the direct DMA ops, while it may have been allocated using a custom DMA ops (iommu_dma_ops in this case).
Fix this by reversing the order of the calls to devres_release_all() and arch_teardown_dma_ops().
[rm: backport for 4.12-4.19 - kernels before 5.0 will not see
the crash above, but may get silent memory corruption instead]
--- drivers/base/dd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/dd.c +1 -1
@@ -850,9 +850,9 @@ static void __device_release_driver(stru drv->remove (dev);device_links_driver_cleanup (dev); -dma_deconfigure (dev);devres_release_all (dev); +dma_deconfigure (dev); dev->driver =NULL ;dev_set_drvdata (dev,NULL );if (dev->pm_domain && dev->pm_domain->dismiss)
Greg Kroah-Hartman
maintainerPATCH 132/135 perf/x86/intel: Make cpuc allocations consistent
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Peter Zijlstra (Intel)" <[email protected]>
commit d01b1f96a82e5dd7841a1d39db3abfdaf95f70ab upstream
The cpuc data structure allocation is different between fake and real cpuc's; use the same code to init/free both.
--- arch/x86/events/core.c | 13 +++++-------- arch/x86/events/intel/core.c | 29 ++++++++++++++++++----------- arch/x86/events/perf_event.h | 11 ++++++++--- 3 files changed, 31 insertions(+), 22 deletions(-)
arch/x86/events/core.c +5 -8
@@ -1968,7 +1968,7 @@ static int x86_pmu_commit_txn(struct pmu*/ static void free_fake_cpuc (struct cpu_hw_events *cpuc) { -kfree (cpuc->shared_regs); +intel_cpuc_finish (cpuc);kfree (cpuc); }
@@ -1980,14 +1980,11 @@ static struct cpu_hw_events *allocate_fa cpuc =kzalloc (sizeof (*cpuc),GFP_KERNEL );if (!cpuc)return ERR_PTR (-ENOMEM ); - -/* only needed, if we have extra_regs */ -if (x86_pmu.extra_regs) { - cpuc->shared_regs =allocate_shared_regs (cpu); -if (!cpuc->shared_regs) - goto error; - } cpuc->is_fake =1 ; + +if (intel_cpuc_prepare (cpuc, cpu)) + goto error; +return cpuc; error:free_fake_cpuc (cpuc);
arch/x86/events/intel/core.c +18 -11
@@ -3262,7 +3262,7 @@ ssize_t intel_event_sysfs_show(char *pagreturn x86_event_sysfs_show (page, config, event); } -struct intel_shared_regs *allocate_shared_regs (int cpu) +static struct intel_shared_regs *allocate_shared_regs (int cpu) {struct intel_shared_regs *regs;int i;
@@ -3294,10 +3294,9 @@ static struct intel_excl_cntrs *allocatereturn c; } -static int intel_pmu_cpu_prepare (int cpu) -{ -struct cpu_hw_events *cpuc = &per_cpu (cpu_hw_events, cpu); +int intel_cpuc_prepare (struct cpu_hw_events *cpuc,int cpu) +{if (x86_pmu.extra_regs || x86_pmu.lbr_sel_map) { cpuc->shared_regs =allocate_shared_regs (cpu);if (!cpuc->shared_regs)
@@ -3307,7 +3306,7 @@ static int intel_pmu_cpu_prepare(int cpuif (x86_pmu.flags &PMU_FL_EXCL_CNTRS ) {size_t sz =X86_PMC_IDX_MAX *sizeof (struct event_constraint ); - cpuc->constraint_list =kzalloc (sz,GFP_KERNEL ); + cpuc->constraint_list =kzalloc_node (sz,GFP_KERNEL ,cpu_to_node (cpu));if (!cpuc->constraint_list) goto err_shared_regs;
@@ -3332,6 +3331,11 @@ err:return -ENOMEM ; } +static int intel_pmu_cpu_prepare (int cpu) +{ +return intel_cpuc_prepare (&per_cpu (cpu_hw_events, cpu), cpu); +} +static void flip_smm_bit (void *data) {unsigned long set = *(unsigned long *)data;
@@ -3403,9 +3407,8 @@ static void intel_pmu_cpu_starting(int c } } -static void free_excl_cntrs (int cpu) +static void free_excl_cntrs (struct cpu_hw_events *cpuc) { -struct cpu_hw_events *cpuc = &per_cpu (cpu_hw_events, cpu);struct intel_excl_cntrs *c; c = cpuc->excl_cntrs;
@@ -3423,9 +3426,8 @@ static void intel_pmu_cpu_dying(int cpu)fini_debug_store_on_cpu (cpu); } -static void intel_pmu_cpu_dead (int cpu) +void intel_cpuc_finish (struct cpu_hw_events *cpuc) { -struct cpu_hw_events *cpuc = &per_cpu (cpu_hw_events, cpu);struct intel_shared_regs *pc; pc = cpuc->shared_regs;
@@ -3435,7 +3437,12 @@ static void intel_pmu_cpu_dead(int cpu) cpuc->shared_regs =NULL ; } -free_excl_cntrs (cpu); +free_excl_cntrs (cpuc); +} + +static void intel_pmu_cpu_dead (int cpu) +{ +intel_cpuc_finish (&per_cpu (cpu_hw_events, cpu)); } static void intel_pmu_sched_task(struct perf_event_context *ctx,
@@ -4494,7 +4501,7 @@ static __init int fixup_ht_bug(void)hardlockup_detector_perf_restart ();for_each_online_cpu (c) -free_excl_cntrs (c); +free_excl_cntrs (&per_cpu (cpu_hw_events, c));cpus_read_unlock ();pr_info ("PMU erratum BJ122, BV98, HSD29 workaround disabled, HT off\n" );
arch/x86/events/perf_event.h +8 -3
@@ -880,7 +880,8 @@ struct event_constraint * x86_get_event_constraints(struct cpu_hw_events *cpuc, int idx, struct perf_event *event); -struct intel_shared_regs *allocate_shared_regs (int cpu); +extern int intel_cpuc_prepare (struct cpu_hw_events *cpuc,int cpu); +extern void intel_cpuc_finish (struct cpu_hw_events *cpuc);int intel_pmu_init (void );
@@ -1014,9 +1015,13 @@ static inline int intel_pmu_init(void)return 0 ; } -static inline struct intel_shared_regs *allocate_shared_regs (int cpu) +static inline int intel_cpuc_prepare (struct cpu_hw_event *cpuc,int cpu) +{ +return 0 ; +} + +static inline void intel_cpuc_finish (struct cpu_hw_event *cpuc) { -return NULL ; }static inline int is_ht_workaround_enabled (void )
Greg Kroah-Hartman
maintainerPATCH 133/135 perf/x86/intel: Generalize dynamic constraint creation
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Peter Zijlstra (Intel)" <[email protected]>
commit 11f8b2d65ca9029591c8df26bb6bd063c312b7fe upstream
Such that we can re-use it.
--- arch/x86/events/intel/core.c | 51 +++++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 21 deletions(-)
arch/x86/events/intel/core.c +30 -21
@@ -2640,6 +2640,35 @@ intel_stop_scheduling(struct cpu_hw_even }static struct event_constraint * +dyn_constraint (struct cpu_hw_events *cpuc,struct event_constraint *c,int idx) +{ +WARN_ON_ONCE (!cpuc->constraint_list); + +if (!(c->flags &PERF_X86_EVENT_DYNAMIC )) { +struct event_constraint *cx; + +/* +* grab pre-allocated constraint entry +*/ + cx = &cpuc->constraint_list[idx]; + +/* +* initialize dynamic constraint +* with static constraint +*/ + *cx = *c; + +/* +* mark constraint as dynamic +*/ + cx->flags |=PERF_X86_EVENT_DYNAMIC ; + c = cx; + } + +return c; +} + +static struct event_constraint *intel_get_excl_constraints (struct cpu_hw_events *cpuc,struct perf_event *event,int idx,struct event_constraint *c) {
@@ -2669,27 +2698,7 @@ intel_get_excl_constraints(struct cpu_hw* only needed when constraint has not yet * been cloned (marked dynamic) */ -if (!(c->flags &PERF_X86_EVENT_DYNAMIC )) { -struct event_constraint *cx; - -/* -* grab pre-allocated constraint entry -*/ - cx = &cpuc->constraint_list[idx]; - -/* -* initialize dynamic constraint -* with static constraint -*/ - *cx = *c; - -/* -* mark constraint as dynamic, so we -* can free it later on -*/ - cx->flags |=PERF_X86_EVENT_DYNAMIC ; - c = cx; - } + c =dyn_constraint (cpuc, c, idx);/* * From here on, the constraint is dynamic.
Greg Kroah-Hartman
maintainerPATCH 134/135 x86: Add TSX Force Abort CPUID/MSR
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Peter Zijlstra (Intel)" <[email protected]>
commit 52f64909409c17adf54fcf5f9751e0544ca3a6b4 upstream
Skylake systems will receive a microcode update to address a TSX errata. This microcode will (by default) clobber PMC3 when TSX instructions are (speculatively or not) executed.
It also provides an MSR to cause all TSX transaction to abort and preserve PMC3.
Add the CPUID enumeration and MSR definition.
--- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 6 ++++++ 2 files changed, 7 insertions(+)
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -339,6 +339,7 @@/* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2)/* AVX-512 Neural Network Instructions */ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3)/* AVX-512 Multiply Accumulation Single precision */ +#define X86_FEATURE_TSX_FORCE_ABORT (18*32+13)/* "" TSX_FORCE_ABORT */ #define X86_FEATURE_PCONFIG (18*32+18)/* Intel PCONFIG */ #define X86_FEATURE_SPEC_CTRL (18*32+26)/* "" Speculation Control (IBRS + IBPB) */ #define X86_FEATURE_INTEL_STIBP (18*32+27)/* "" Single Thread Indirect Branch Predictors */
arch/x86/include/asm/msr-index.h +6 -0
@@ -610,6 +610,12 @@#define MSR_IA32_TSC_DEADLINE 0x000006E0 + +#define MSR_TSX_FORCE_ABORT 0x0000010F + +#define MSR_TFA_RTM_FORCE_ABORT_BIT 0 +#define MSR_TFA_RTM_FORCE_ABORT BIT_ULL(MSR_TFA_RTM_FORCE_ABORT_BIT) +/* P4/Xeon+ specific */ #define MSR_IA32_MCG_EAX 0x00000180#define MSR_IA32_MCG_EBX 0x00000181
Greg Kroah-Hartman
maintainerPATCH 135/135 perf/x86/intel: Implement support for TSX Force Abort
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Peter Zijlstra (Intel)" <[email protected]>
commit 400816f60c543153656ac74eaf7f36f6b7202378 upstream
Skylake (and later) will receive a microcode update to address a TSX errata. This microcode will, on execution of a TSX instruction (speculative or not) use (clobber) PMC3. This update will also provide a new MSR to change this behaviour along with a CPUID bit to enumerate the presence of this new MSR.
When the MSR gets set; the microcode will no longer use PMC3 but will Force Abort every TSX transaction (upon executing COMMIT).
When TSX Force Abort (TFA) is allowed (default); the MSR gets set when PMC3 gets scheduled and cleared when, after scheduling, PMC3 is unused.
When TFA is not allowed; clear PMC3 from all constraints such that it will not get used.
--- arch/x86/events/intel/core.c | 74 +++++++++++++++++++++++++++++++++++++++++-- arch/x86/events/perf_event.h | 6 +++ 2 files changed, 77 insertions(+), 3 deletions(-)
arch/x86/events/intel/core.c +71 -3
@@ -1995,6 +1995,39 @@ static void intel_pmu_nhm_enable_all(intintel_pmu_enable_all (added); } +static void intel_set_tfa (struct cpu_hw_events *cpuc,bool on) +{ +u64 val = on ?MSR_TFA_RTM_FORCE_ABORT :0 ; + +if (cpuc->tfa_shadow != val) { + cpuc->tfa_shadow = val; +wrmsrl (MSR_TSX_FORCE_ABORT , val); + } +} + +static void intel_tfa_commit_scheduling (struct cpu_hw_events *cpuc,int idx,int cntr) +{ +/* +* We're going to use PMC3, make sure TFA is set before we touch it. +*/ +if (cntr ==3 && !cpuc->is_fake) +intel_set_tfa (cpuc, true); +} + +static void intel_tfa_pmu_enable_all (int added) +{ +struct cpu_hw_events *cpuc =this_cpu_ptr (&cpu_hw_events); + +/* +* If we find PMC3 is no longer used when we enable the PMU, we can +* clear TFA. +*/ +if (!test_bit (3 , cpuc->active_mask)) +intel_set_tfa (cpuc, false); + +intel_pmu_enable_all (added); +} +static inline u64 intel_pmu_get_status (void ) {u64 status;
@@ -3218,6 +3251,26 @@ glp_get_event_constraints(struct cpu_hw_return c; } +static bool allow_tsx_force_abort = true; + +static struct event_constraint * +tfa_get_event_constraints (struct cpu_hw_events *cpuc,int idx, +struct perf_event *event) +{ +struct event_constraint *c =hsw_get_event_constraints (cpuc, idx, event); + +/* +* Without TFA we must not use PMC3. +*/ +if (!allow_tsx_force_abort &&test_bit (3 , c->idxmsk)) { + c =dyn_constraint (cpuc, c, idx); + c->idxmsk64 &= ~(1ULL <<3 ); + c->weight--; + } + +return c; +} +/* * Broadwell: *
@@ -3312,13 +3365,15 @@ int intel_cpuc_prepare(struct cpu_hw_eve goto err; } -if (x86_pmu.flags &PMU_FL_EXCL_CNTRS ) { +if (x86_pmu.flags & (PMU_FL_EXCL_CNTRS |PMU_FL_TFA )) {size_t sz =X86_PMC_IDX_MAX *sizeof (struct event_constraint ); cpuc->constraint_list =kzalloc_node (sz,GFP_KERNEL ,cpu_to_node (cpu));if (!cpuc->constraint_list) goto err_shared_regs; + } +if (x86_pmu.flags &PMU_FL_EXCL_CNTRS ) { cpuc->excl_cntrs =allocate_excl_cntrs (cpu);if (!cpuc->excl_cntrs) goto err_constraint_list;
@@ -3425,9 +3480,10 @@ static void free_excl_cntrs(struct cpu_hif (c->core_id ==-1 || --c->refcnt ==0 )kfree (c); cpuc->excl_cntrs =NULL ; -kfree (cpuc->constraint_list); - cpuc->constraint_list =NULL ; } + +kfree (cpuc->constraint_list); + cpuc->constraint_list =NULL ; }static void intel_pmu_cpu_dying (int cpu)
@@ -3912,8 +3968,11 @@ static struct attribute *intel_pmu_caps_ NULL }; +DEVICE_BOOL_ATTR (allow_tsx_force_abort,0644 , allow_tsx_force_abort); +static struct attribute *intel_pmu_attrs[] = { &dev_attr_freeze_on_smi.attr, +NULL ,/* &dev_attr_allow_tsx_force_abort.attr.attr */ NULL , };
@@ -4369,6 +4428,15 @@ __init int intel_pmu_init(void) x86_pmu.cpu_events =get_hsw_events_attrs ();intel_pmu_pebs_data_source_skl ( boot_cpu_data.x86_model ==INTEL_FAM6_SKYLAKE_X ); + +if (boot_cpu_has (X86_FEATURE_TSX_FORCE_ABORT )) { + x86_pmu.flags |=PMU_FL_TFA ; + x86_pmu.get_event_constraints = tfa_get_event_constraints; + x86_pmu.enable_all = intel_tfa_pmu_enable_all; + x86_pmu.commit_scheduling = intel_tfa_commit_scheduling; + intel_pmu_attrs[1 ] = &dev_attr_allow_tsx_force_abort.attr.attr; + } +pr_cont ("Skylake events, " ); name ="skylake" ;break ;
arch/x86/events/perf_event.h +6 -0
@@ -239,6 +239,11 @@ struct cpu_hw_events {int excl_thread_id;/* 0 or 1 */ /* +* SKL TSX_FORCE_ABORT shadow +*/ +u64 tfa_shadow; + +/* * AMD specific bits */ struct amd_nb *amd_nb;
@@ -672,6 +677,7 @@ do { \#define PMU_FL_HAS_RSP_1 0x2/* has 2 equivalent offcore_rsp regs */ #define PMU_FL_EXCL_CNTRS 0x4/* has exclusive counter requirements */ #define PMU_FL_EXCL_ENABLED 0x8/* exclusive counter active */ +#define PMU_FL_TFA 0x20/* deal with TSX force abort */ #define EVENT_VAR (_id) event_attr_##_id#define EVENT_PTR (_id) &event_attr_##_id.attr.attr
stable-rc/linux-4.14.y boot: 105 boots: 1 failed, 103 passed with 1 untried/unknown (v4.14.105-136-gf881675936ef)
stable-rc/linux-4.14.y boot: 105 boots: 1 failed, 103 passed with 1 untried/unknown (v4.14.105-136-gf881675936ef)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.14.105-136-gf881675936ef/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.105-136-gf881675936ef/
Tree: stable-rc
Branch: linux-4.14.y
Git Describe: v4.14.105-136-gf881675936ef
Git Commit: f881675936ef263f178eab5a5cf95bc86089cf20
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 58 unique boards, 23 SoC families, 12 builds out of 197
Boot Failure Detected:
arm64:
defconfig:
gcc-7:
rk3399-firefly: 1 failed lab
---
For more info write to <[email protected]>
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.106 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 14 17:02:27 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.106-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.14.106-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: f881675936ef263f178eab5a5cf95bc86089cf20
git describe: v4.14.105-136-gf881675936ef
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.105-136-gf881675936ef
No regressions (compared to build v4.14.105)
No fixes (compared to build v4.14.105)
Ran 22869 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* spectre-meltdown-checker-test
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.106 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 14 17:02:27 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.106-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
20 tests: 20 pass, 0 failLinux version: 4.14.106-rc1-g4dc8caa
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Cheers
Jon
Signature · 1 line
nvpublic
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.106 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 14 17:02:27 UTC 2019. Anything received after that time might be too late.
Build results:
total: 172 pass: 172 fail: 0 Qemu test results: total: 329 pass: 329 fail: 0
Guenter