4.19.31-stable review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 4.19.31-stable review
This is the start of the stable review cycle for the 4.19.31 release. There are 280 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 24 11:11:09 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.31-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.31-rc1
Martin Schwidefsky <[email protected]>
s390/setup: fix boot crash for machine without EDAT-1
Coly Li <[email protected]>
bcache: use (REQ_META|REQ_PRIO) to indicate bio for metadata
Sean Christopherson <[email protected]>
KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
Sean Christopherson <[email protected]>
KVM: nVMX: Apply addr size mask to effective address for VMX instructions
Sean Christopherson <[email protected]>
KVM: nVMX: Sign extend displacements of VMX instr's mem operands
Sean Christopherson <[email protected]>
KVM: x86/mmu: Do not cache MMIO accesses while memslots are in flux
Sean Christopherson <[email protected]>
KVM: x86/mmu: Detect MMIO generation wrap in any address space
Sean Christopherson <[email protected]>
KVM: Call kvm_arch_memslots_updated() before updating memslots
Harry Wentland <[email protected]>
drm/amd/display: don't call dm_pp_ function from an fpu block
Evan Quan <[email protected]>
drm/amd/powerplay: correct power reading on fiji
Gustavo A. R. Silva <[email protected]>
drm/radeon/evergreen_cs: fix missing break in switch statement
Noralf Trønnes <[email protected]>
drm/fb-helper: generic: Fix drm_fbdev_client_restore()
Steve Longerbeam <[email protected]>
media: imx: csi: Stop upstream before disabling IDMA channel
Steve Longerbeam <[email protected]>
media: imx: csi: Disable CSI immediately after last EOF
Lucas A. M. Magalhães <[email protected]>
media: vimc: Add vimc-streamer for stream control
Sakari Ailus <[email protected]>
media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
French, Nicholas A <[email protected]>
media: lgdt330x: fix lock status reporting
Steve Longerbeam <[email protected]>
media: imx: prpencvf: Stop upstream before disabling IDMA channel
Zhang, Jun <[email protected]>
rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Jarkko Sakkinen <[email protected]>
tpm: Unify the send callback behaviour
Jarkko Sakkinen <[email protected]>
tpm/tpm_crb: Avoid unaligned reads in crb_recv()
Aditya Pakki <[email protected]>
md: Fix failed allocation of md_register_thread
Adrian Hunter <[email protected]>
perf intel-pt: Fix divide by zero when TSC is not available
Kan Liang <[email protected]>
perf/x86/intel/uncore: Fix client IMC events return huge result
Adrian Hunter <[email protected]>
perf intel-pt: Fix overlap calculation for padding
Adrian Hunter <[email protected]>
perf auxtrace: Define auxtrace record alignment
Adrian Hunter <[email protected]>
perf tools: Fix split_kallsyms_for_kcore() for trampoline symbols
Adrian Hunter <[email protected]>
perf intel-pt: Fix CYC timestamp calculation after OVF
Josh Poimboeuf <[email protected]>
x86/unwind/orc: Fix ORC unwind table alignment
Nicolas Pitre <[email protected]>
vt: perform safe console erase in the right order
Greg Kroah-Hartman <[email protected]>
stable-kernel-rules.rst: add link to networking patch queue
Daniel Axtens <[email protected]>
bcache: never writeback a discard operation
Viresh Kumar <[email protected]>
PM / wakeup: Rework wakeup source timer cancellation
J. Bruce Fields <[email protected]>
svcrpc: fix UDP on servers with lots of threads
Trond Myklebust <[email protected]>
NFSv4.1: Reinitialise sequence results before retransmitting a request
Yihao Wu <[email protected]>
nfsd: fix wrong check in write_v4_end_grace()
NeilBrown <[email protected]>
nfsd: fix memory corruption caused by readdir
J. Bruce Fields <[email protected]>
nfsd: fix performance-limiting session calculation
Trond Myklebust <[email protected]>
NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
Trond Myklebust <[email protected]>
NFS: Fix an I/O request leakage in nfs_do_recoalesce
Trond Myklebust <[email protected]>
NFS: Fix I/O request leakages
Pavel Machek <[email protected]>
cpcap-charger: generate events for userspace
Gustavo A. R. Silva <[email protected]>
mfd: sm501: Fix potential NULL pointer dereference
Mikulas Patocka <[email protected]>
dm integrity: limit the rate of error messages
NeilBrown <[email protected]>
dm: fix to_sector() for 32bit
Yang Yingliang <[email protected]>
ipmi_si: fix use-after-free of resource->name
Dave Martin <[email protected]>
arm64: KVM: Fix architecturally invalid reset value for FPEXC32_EL2
Will Deacon <[email protected]>
arm64: debug: Ensure debug handlers check triggering exception level
Julien Thierry <[email protected]>
arm64: Fix HCR.TGE status for NMI contexts
Gustavo A. R. Silva <[email protected]>
ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
Christophe Leroy <[email protected]>
powerpc/traps: Fix the message printed when stack overflows
Christophe Leroy <[email protected]>
powerpc/traps: fix recoverability of machine check handling on book3s/32
Aneesh Kumar K.V <[email protected]>
powerpc/hugetlb: Don't do runtime allocation of 16G pages in LPAR configuration
Michael Ellerman <[email protected]>
powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
Mark Cave-Ayland <[email protected]>
powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
Paul Mackerras <[email protected]>
powerpc/powernv: Don't reprogram SLW image on every KVM guest entry/exit
Christophe Leroy <[email protected]>
powerpc/83xx: Also save/restore SPRG4-7 during suspend
Jordan Niethe <[email protected]>
powerpc/powernv: Make opal log only readable by root
Christophe Leroy <[email protected]>
powerpc/wii: properly disable use of BATs when requested.
Christophe Leroy <[email protected]>
powerpc/32: Clear on-stack exception marker upon exception return
J. Bruce Fields <[email protected]>
security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock
Xin Long <[email protected]>
selinux: add the missing walk_size + len check in selinux_sctp_bind_connect
zhangyi (F) <[email protected]>
jbd2: fix compile warning when using JBUFFER_TRACE
zhangyi (F) <[email protected]>
jbd2: clear dirty flag when revoking a buffer from an older transaction
Jay Dolan <[email protected]>
serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
Jay Dolan <[email protected]>
serial: 8250_pci: Fix number of ports for ACCES serial cards
Lubomir Rintel <[email protected]>
serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
Anssi Hannula <[email protected]>
serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
Willem de Bruijn <[email protected]>
bpf: only test gso type on gso packets
Tvrtko Ursulin <[email protected]>
drm/i915: Relax mmap VMA check
Marc Kleine-Budde <[email protected]>
can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument
Mark Walton <[email protected]>
gpio: pca953x: Fix dereference of irq data in shutdown
Loic Poulain <[email protected]>
media: i2c: ov5640: Fix post-reset delay
Sowjanya Komatineni <[email protected]>
i2c: tegra: fix maximum transfer size
QiaoChong <[email protected]>
parport_pc: fix find_superio io compare code, should use equal test.
Alexander Shishkin <[email protected]>
intel_th: Don't reference unassigned outputs
Heikki Krogerus <[email protected]>
device property: Fix the length used in PROPERTY_ENTRY_STRING()
Zev Weiss <[email protected]>
kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
Jan Stancek <[email protected]>
mm/memory.c: do_fault: avoid usage of stale vm_area_struct
Roman Penyaev <[email protected]>
mm/vmalloc: fix size check for remap_vmalloc_range_partial()
zhongjiang <[email protected]>
mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
Phuong Nguyen <[email protected]>
dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
Nikolaus Voss <[email protected]>
usb: typec: tps6598x: handle block writes separately with plain-I2C adapters
Dmitry Osipenko <[email protected]>
usb: chipidea: tegra: Fix missed ci_hdrc_remove_device()
Paul Cercueil <[email protected]>
clk: ingenic: Fix doc of ingenic_cgu_div_info
Paul Cercueil <[email protected]>
clk: ingenic: Fix round_rate misbehaving with non-integer dividers
Krzysztof Kozlowski <[email protected]>
clk: samsung: exynos5: Fix kfree() of const memory on setting driver_override
Krzysztof Kozlowski <[email protected]>
clk: samsung: exynos5: Fix possible NULL pointer exception on platform_device_alloc() failure
Tony Lindgren <[email protected]>
clk: clk-twl6040: Fix imprecise external abort for pdmclk
Kunihiko Hayashi <[email protected]>
clk: uniphier: Fix update register for CPU-gear
Jan Kara <[email protected]>
ext2: Fix underflow in ext2_max_size()
Vaibhav Jain <[email protected]>
cxl: Wrap iterations over afu slices inside 'afu_list_lock'
Michael J. Ruhl <[email protected]>
IB/hfi1: Close race condition on user context disable and close
Lucas Stach <[email protected]>
PCI: dwc: skip MSI init if MSIs have been explicitly disabled
Dongdong Liu <[email protected]>
PCI/DPC: Fix print AER status in DPC event handling
Bjorn Helgaas <[email protected]>
PCI/ASPM: Use LTR if already enabled by platform
Jan Kara <[email protected]>
ext4: fix crash during online resizing
yangerkun <[email protected]>
ext4: add mask of ext4 flags to swap
yangerkun <[email protected]>
ext4: update quota information while swapping boot loader inode
yangerkun <[email protected]>
ext4: cleanup pagecache before swap i_data
yangerkun <[email protected]>
ext4: fix check of inode in swap_inode_boot_loader
Arnd Bergmann <[email protected]>
cpufreq: pxa2xx: remove incorrect __init annotation
Yangtao Li <[email protected]>
cpufreq: tegra124: add missing of_node_put()
Viresh Kumar <[email protected]>
cpufreq: kryo: Release OPP tables on module removal
Masami Hiramatsu <[email protected]>
x86/kprobes: Prohibit probing on optprobe template code
Doug Berger <[email protected]>
irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code
Zenghui Yu <[email protected]>
irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table
Lubomir Rintel <[email protected]>
libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer
Stephen Boyd <[email protected]>
soc: qcom: rpmh: Avoid accessing freed memory from batch API
Filipe Manana <[email protected]>
Btrfs: fix corruption reading shared and compressed extents after hole punching
Johannes Thumshirn <[email protected]>
btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
Filipe Manana <[email protected]>
Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl
Filipe Manana <[email protected]>
Btrfs: setup a nofs context for memory allocation at btrfs_create_tree()
Finn Thain <[email protected]>
m68k: Add -ffreestanding to CFLAGS
Vivek Goyal <[email protected]>
ovl: Do not lose security.capability xattr over metadata file copy-up
Vivek Goyal <[email protected]>
ovl: During copy up, first copy up data and then xattrs
Jann Horn <[email protected]>
splice: don't merge into linked buffers
Varad Gautam <[email protected]>
fs/devpts: always delete dcache dentry-s in dput()
Himanshu Madhani <[email protected]>
scsi: qla2xxx: Fix LUN discovery if loop id is not assigned yet by firmware
Bart Van Assche <[email protected]>
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
Martin K. Petersen <[email protected]>
scsi: sd: Optimal I/O size should be a multiple of physical block size
Sagar Biradar <[email protected]>
scsi: aacraid: Fix performance issue on logical drives
Felipe Franciosi <[email protected]>
scsi: virtio_scsi: don't send sc payload with tmfs
Halil Pasic <[email protected]>
s390/virtio: handle find on invalid queue gracefully
Martin Schwidefsky <[email protected]>
s390/setup: fix early warning messages
Samuel Holland <[email protected]>
clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer instability
Stuart Menefy <[email protected]>
clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
Stuart Menefy <[email protected]>
clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
Stuart Menefy <[email protected]>
regulator: s2mpa01: Fix step values for some LDOs
Mark Zhang <[email protected]>
regulator: max77620: Initialize values for DT properties
Krzysztof Kozlowski <[email protected]>
regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
Andy Shevchenko <[email protected]>
spi: pxa2xx: Setup maximum supported DMA transfer length
Vignesh R <[email protected]>
spi: ti-qspi: Fix mmap read when more than one CS in use
Anders Roxell <[email protected]>
netfilter: ipt_CLUSTERIP: fix warning unused variable cn
Jiong Wu <[email protected]>
mmc:fix a bug when max_discard is 0
BOUGH CHEN <[email protected]>
mmc: sdhci-esdhc-imx: fix HS400 timing issue
Andy Shevchenko <[email protected]>
ACPI / device_sysfs: Avoid OF modalias creation for removed device
Juergen Gross <[email protected]>
xen: fix dom0 boot on huge systems
Jann Horn <[email protected]>
tracing/perf: Use strndup_user() instead of buggy open-coded version
zhangyi (F) <[email protected]>
tracing: Do not free iter->trace in fail path of tracing_open_pipe()
Tom Zanussi <[email protected]>
tracing: Use strncpy instead of memcpy for string keys in hist triggers
Pavel Shilovsky <[email protected]>
CIFS: Fix read after write for files with read caching
Pavel Shilovsky <[email protected]>
CIFS: Do not skip SMB2 message IDs on send failures
Pavel Shilovsky <[email protected]>
CIFS: Do not reset lease state to NONE on lease break
Ard Biesheuvel <[email protected]>
crypto: arm64/aes-ccm - fix bugs in non-NEON fallback routine
Ard Biesheuvel <[email protected]>
crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
Eric Biggers <[email protected]>
crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP
Eric Biggers <[email protected]>
crypto: x86/aesni-gcm - fix crash on empty plaintext
Eric Biggers <[email protected]>
crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP
Eric Biggers <[email protected]>
crypto: testmgr - skip crc32c context test for ahash algorithms
Eric Biggers <[email protected]>
crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
Eric Biggers <[email protected]>
crypto: pcbc - remove bogus memcpy()s with src == dest
Eric Biggers <[email protected]>
crypto: morus - fix handling chunked inputs
Eric Biggers <[email protected]>
crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
Ard Biesheuvel <[email protected]>
crypto: arm64/crct10dif - revert to C code for short inputs
Eric Biggers <[email protected]>
crypto: arm64/aes-neonbs - fix returning final keystream block
Ard Biesheuvel <[email protected]>
crypto: arm/crct10dif - revert to C code for short inputs
Eric Biggers <[email protected]>
crypto: aegis - fix handling chunked inputs
Eric Biggers <[email protected]>
crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
Al Viro <[email protected]>
fix cgroup_do_mount() handling of failure exits
Oliver O'Halloran <[email protected]>
libnvdimm: Fix altmap reservation size calculation
Dan Williams <[email protected]>
libnvdimm/pmem: Honor force_raw for legacy pmem regions
Wei Yang <[email protected]>
libnvdimm, pfn: Fix over-trim in trim_pfn_device()
Dan Williams <[email protected]>
libnvdimm/label: Clear 'updating' flag after label-set update
Dan Williams <[email protected]>
nfit/ars: Attempt short-ARS even in the no_init_ars case
Dan Williams <[email protected]>
nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot
Dan Williams <[email protected]>
acpi/nfit: Fix bus command validation
Dexuan Cui <[email protected]>
nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
Alexander Shishkin <[email protected]>
stm class: Prevent division by zero
Darrick J. Wong <[email protected]>
tmpfs: fix uninitialized return value in shmem_link
Thadeu Lima de Souza Cascardo <[email protected]>
selftests: fib_tests: sleep after changing carrier. again.
Mao Wenan <[email protected]>
net: set static variable an initial value in atl2_probe()
Michael Chan <[email protected]>
bnxt_en: Wait longer for the firmware message response to complete.
Michael Chan <[email protected]>
bnxt_en: Fix typo in firmware message timeout logic.
Jiong Wang <[email protected]>
nfp: bpf: fix ALU32 high bits clearance bug
Jiong Wang <[email protected]>
nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K
Vadim Lomovtsev <[email protected]>
net: thunderx: add nicvf_send_msg_to_pf result check for set_rx_mode_task
Vadim Lomovtsev <[email protected]>
net: thunderx: make CFG_DONE message to run through generic send-ack sequence
Alban Crequy <[email protected]>
bpf, lpm: fix lookup bug in map_delete_elem
Li RongQing <[email protected]>
mac80211_hwsim: propagate genlmsg_reply return code
Arnd Bergmann <[email protected]>
phonet: fix building with clang
Vineet Gupta <[email protected]>
ARCv2: don't assume core 0x54 has dual issue
Vineet Gupta <[email protected]>
ARCv2: support manual regfile save on interrupts
Vineet Gupta <[email protected]>
ARC: uacces: remove lp_start, lp_end from clobber list
Eugeniy Paltsev <[email protected]>
ARCv2: lib: memcpy: fix doing prefetchw outside of buffer
Jeff Kirsher <[email protected]>
ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN
Darrick J. Wong <[email protected]>
tmpfs: fix link accounting when a tmpfile is linked in
Michal Hocko <[email protected]>
mm: handle lru_add_drain_all for UP properly
Russell King <[email protected]>
net: marvell: mvneta: fix DMA debug warning
Thierry Reding <[email protected]>
ARM: tegra: Restore DT ABI on Tegra124 Chromebooks
Vladimir Murzin <[email protected]>
arm64: Relax GIC version check during early boot
Thomas Petazzoni <[email protected]>
ARM: dts: armada-xp: fix Armada XP boards NAND description
Michal Kalderon <[email protected]>
qed: Fix iWARP syn packet mac address validation.
Michal Kalderon <[email protected]>
qed: Fix iWARP buffer size provided for syn packet processing.
Bard liao <[email protected]>
ASoC: topology: free created components in tplg load error
Rayagonda Kokatanur <[email protected]>
mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue
Tobias Brunner <[email protected]>
xfrm: Fix inbound traffic via XFRM interfaces across network namespaces
Alexey Khoroshilov <[email protected]>
net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
Beniamino Galvani <[email protected]>
qmi_wwan: apply SET_DTR quirk to Sierra WP7607
Martin Blumenstingl <[email protected]>
pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Do not assume DSA master supports WoL
Florian Fainelli <[email protected]>
net: systemport: Fix reception of BPDUs
Anoob Soman <[email protected]>
scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
David Howells <[email protected]>
keys: Fix dependency loop between construction record and auth key
David Howells <[email protected]>
assoc_array: Fix shortcut creation
Robin Murphy <[email protected]>
ARM: 8835/1: dma-mapping: Clear DMA ops on teardown
Sean Tranchetti <[email protected]>
af_key: unconditionally clone on broadcast
Alexei Starovoitov <[email protected]>
bpf: fix lockdep false positive in stackmap
Willem de Bruijn <[email protected]>
bpf: only adjust gso_size on bytestream protocols
Dietmar Eggemann <[email protected]>
ARM: 8824/1: fix a migrating irq bug when hotplug cpu
Martin Willi <[email protected]>
esp: Skip TX bytes accounting when sending from a request socket
Andre Przywara <[email protected]>
clk: sunxi: A31: Fix wrong AHB gate number
Eugene Loh <[email protected]>
kallsyms: Handle too long symbols in kallsyms.c
Paul Kocialkowski <[email protected]>
clk: sunxi-ng: v3s: Fix TCON reset de-assert bit
Gabriel Fernandez <[email protected]>
Input: st-keyscan - fix potential zalloc NULL dereference
Miguel Ojeda <[email protected]>
auxdisplay: ht16k33: fix potential user-after-free on module unload
Paul Kocialkowski <[email protected]>
i2c: bcm2835: Clear current buffer pointers and counts after a transfer
Shubhrajyoti Datta <[email protected]>
i2c: cadence: Fix the hold bit setting
Huang Zijiang <[email protected]>
net: hns: Fix object reference leaks in hns_dsaf_roce_reset()
Jann Horn <[email protected]>
mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs
Rajneesh Bhardwaj <[email protected]>
x86/CPU: Add Icelake model number
Dan Carpenter <[email protected]>
net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend()
Bill Kuzeja <[email protected]>
scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd
Qian Cai <[email protected]>
Revert "mm: use early_pfn_to_nid in page_ext_init"
Yu Zhao <[email protected]>
mm/gup: fix gup_pmd_range() for dax
Benjamin Coddington <[email protected]>
NFS: Don't use page_file_mapping after removing the page
Nicolas Morey-Chaisemartin <[email protected]>
xprtrdma: Make sure Send CQ is allocated on an existing compvec
Yufen Yu <[email protected]>
floppy: check_events callback should not return a negative number
Andrea Claudi <[email protected]>
ipvs: fix dependency on nf_defrag_ipv6
Jianchao Wang <[email protected]>
blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue
Francesco Ruggeri <[email protected]>
netfilter: compat: initialize all fields in xt_init
Ilan Peer <[email protected]>
mac80211: Fix Tx aggregation session tear down with ITXQs
Johannes Berg <[email protected]>
mac80211: call drv_ibss_join() on restart
Dmitry Torokhov <[email protected]>
Input: matrix_keypad - use flush_delayed_work()
Dmitry Torokhov <[email protected]>
Input: ps2-gpio - flush TX work when closing port
Dmitry Torokhov <[email protected]>
Input: cap11xx - switch to using set_brightness_blocking()
Russell King <[email protected]>
ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug
Sylwester Nawrocki <[email protected]>
ASoC: samsung: Prevent clk_get_rate() calls in atomic context
James Morse <[email protected]>
KVM: arm64: Forbid kprobing of the VHE world-switch code
Christoffer Dall <[email protected]>
KVM: arm/arm64: vgic: Always initialize the group of private IRQs
Marc Zyngier <[email protected]>
arm/arm64: KVM: Don't panic on failure to properly reset system registers
Marc Zyngier <[email protected]>
arm/arm64: KVM: Allow a VCPU to fully reset itself
Christoffer Dall <[email protected]>
KVM: arm/arm64: Reset the VCPU without preemption and vcpu state loaded
Kuninori Morimoto <[email protected]>
ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check
Pierre-Louis Bossart <[email protected]>
ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables
Yizhuo <[email protected]>
ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
Tony Lindgren <[email protected]>
ARM: dts: Configure clock parent for pwm vibra
Paweł Chmiel <[email protected]>
Input: pwm-vibra - stop regulator after disabling pwm, not before
Jonathan Bakker <[email protected]>
Input: pwm-vibra - prevent unbalanced regulator
Stefan Haberland <[email protected]>
s390/dasd: fix using offset into zero size array error
Enric Balletbo i Serra <[email protected]>
arm64: dts: rockchip: fix graph_port warning on rk3399 bob kevin and excavator
Julien Thierry <[email protected]>
KVM: arm/arm64: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock
Tony Lindgren <[email protected]>
clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck reparenting
Shuming Fan <[email protected]>
ASoC: rt5682: Correct the setting while select ASRC clk for AD/DA filter
Steve Longerbeam <[email protected]>
gpu: ipu-v3: Fix CSI offsets for imx53
Julia Lawall <[email protected]>
drm/imx: imx-ldb: add missing of_node_puts
Alexander Shiyan <[email protected]>
gpu: ipu-v3: Fix i.MX51 CSI control registers offset
Philipp Zabel <[email protected]>
drm/imx: ignore plane updates on disabled crtcs
Zhang Zhijie <[email protected]>
crypto: rockchip - update new iv to device in multiple operations
Zhang Zhijie <[email protected]>
crypto: rockchip - fix scatterlist nents error
Eric Biggers <[email protected]>
crypto: ahash - fix another early termination in hash walk
Eric Biggers <[email protected]>
crypto: cfb - remove bogus memcpy() with src == dest
Eric Biggers <[email protected]>
crypto: cfb - add missing 'chunksize' property
Gilad Ben-Yossef <[email protected]>
crypto: ccree - don't copy zero size ciphertext
Gilad Ben-Yossef <[email protected]>
crypto: ccree - unmap buffer before copying IV
Hadar Gat <[email protected]>
crypto: ccree - fix free of unallocated mlli buffer
Horia Geantă <[email protected]>
crypto: caam - fix DMA mapping of stack memory
Pankaj Gupta <[email protected]>
crypto: caam - fixed handling of sg list
Gustavo A. R. Silva <[email protected]>
crypto: ccree - fix missing break in switch statement
Franck LENORMAND <[email protected]>
crypto: caam - fix hash context DMA unmap size
Zhi Jin <[email protected]>
stm class: Fix an endless loop in channel allocation
Alexander Usyskin <[email protected]>
mei: bus: move hw module get/put to probe/release
Alexander Usyskin <[email protected]>
mei: hbm: clean the feature flags on link reset
Krzysztof Kozlowski <[email protected]>
iio: adc: exynos-adc: Fix NULL pointer exception on unbind
Codrin Ciubotariu <[email protected]>
ASoC: codecs: pcm186x: Fix energysense SLEEP bit
Codrin Ciubotariu <[email protected]>
ASoC: codecs: pcm186x: fix wrong usage of DECLARE_TLV_DB_SCALE()
S.j. Wang <[email protected]>
ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
zhengbin <[email protected]>
9p/net: fix memory leak in p9_client_create
Hou Tao <[email protected]>
9p: use inode->i_lock to protect i_size_write() under 32-bit
Hans Verkuil <[email protected]>
media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
-------------
Diffstat:
Documentation/arm64/silicon-errata.txt | 2 + Documentation/process/stable-kernel-rules.rst | 3 + Makefile | 4 +- arch/arc/Kconfig | 8 + arch/arc/include/asm/arcregs.h | 8 + arch/arc/include/asm/entry-arcv2.h | 54 ++++++ arch/arc/include/asm/uaccess.h | 8 +- arch/arc/kernel/entry-arcv2.S | 4 +- arch/arc/kernel/intc-arcv2.c | 2 + arch/arc/kernel/setup.c | 26 ++- arch/arc/lib/memcpy-archs.S | 14 -- arch/arc/plat-hsdk/Kconfig | 1 + arch/arm/Kconfig | 1 + arch/arm/boot/dts/armada-xp-db.dts | 46 ++--- arch/arm/boot/dts/armada-xp-gp.dts | 13 +- arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts | 85 +++++----- arch/arm/boot/dts/omap4-droid4-xt894.dts | 11 ++ arch/arm/boot/dts/tegra124-nyan.dtsi | 17 +- arch/arm/crypto/crct10dif-ce-core.S | 14 +- arch/arm/crypto/crct10dif-ce-glue.c | 23 +-- arch/arm/include/asm/irq.h | 1 - arch/arm/include/asm/kvm_host.h | 10 ++ arch/arm/kernel/irq.c | 62 ------- arch/arm/kernel/smp.c | 2 +- arch/arm/kvm/coproc.c | 4 +- arch/arm/kvm/reset.c | 24 +++ arch/arm/mach-omap2/cpuidle44xx.c | 16 +- arch/arm/mach-omap2/display.c | 7 +- arch/arm/mach-s3c24xx/mach-osiris-dvs.c | 8 +- arch/arm/mm/dma-mapping.c | 2 + arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts | 2 +- .../dts/rockchip/rk3399-sapphire-excavator.dts | 2 +- arch/arm64/crypto/aes-ce-ccm-core.S | 5 +- arch/arm64/crypto/aes-ce-ccm-glue.c | 4 +- arch/arm64/crypto/aes-neonbs-core.S | 8 +- arch/arm64/crypto/crct10dif-ce-glue.c | 25 +-- arch/arm64/include/asm/hardirq.h | 31 ++++ arch/arm64/include/asm/kvm_host.h | 11 ++ arch/arm64/kernel/head.S | 3 +- arch/arm64/kernel/irq.c | 3 + arch/arm64/kernel/kgdb.c | 14 +- arch/arm64/kernel/probes/kprobes.c | 6 + arch/arm64/kvm/hyp/switch.c | 5 + arch/arm64/kvm/hyp/sysreg-sr.c | 5 + arch/arm64/kvm/reset.c | 50 +++++- arch/arm64/kvm/sys_regs.c | 10 +- arch/m68k/Makefile | 5 +- arch/mips/include/asm/kvm_host.h | 2 +- arch/powerpc/include/asm/book3s/64/hugetlb.h | 8 + arch/powerpc/include/asm/kvm_host.h | 2 +- arch/powerpc/include/asm/powernv.h | 2 + arch/powerpc/kernel/entry_32.S | 9 + arch/powerpc/kernel/process.c | 2 +- arch/powerpc/kernel/ptrace.c | 10 +- arch/powerpc/kernel/traps.c | 12 +- arch/powerpc/platforms/83xx/suspend-asm.S | 34 +++- arch/powerpc/platforms/embedded6xx/wii.c | 4 + arch/powerpc/platforms/powernv/idle.c | 27 +-- arch/powerpc/platforms/powernv/opal-msglog.c | 2 +- arch/powerpc/platforms/powernv/smp.c | 25 +++ arch/s390/include/asm/kvm_host.h | 2 +- arch/s390/kernel/setup.c | 31 +++- arch/x86/crypto/aegis128-aesni-glue.c | 38 ++--- arch/x86/crypto/aegis128l-aesni-glue.c | 38 ++--- arch/x86/crypto/aegis256-aesni-glue.c | 38 ++--- arch/x86/crypto/aesni-intel_glue.c | 13 +- arch/x86/crypto/morus1280_glue.c | 40 ++--- arch/x86/crypto/morus640_glue.c | 39 ++--- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore.h | 12 +- arch/x86/events/intel/uncore_snb.c | 4 +- arch/x86/include/asm/intel-family.h | 2 + arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kernel/kprobes/opt.c | 5 + arch/x86/kvm/mmu.c | 23 ++- arch/x86/kvm/vmx.c | 41 ++++- arch/x86/kvm/x86.c | 4 +- arch/x86/kvm/x86.h | 7 +- arch/x86/xen/mmu_pv.c | 13 +- block/blk-mq.c | 12 +- crypto/aead.c | 4 +- crypto/aegis128.c | 14 +- crypto/aegis128l.c | 14 +- crypto/aegis256.c | 14 +- crypto/ahash.c | 42 +++-- crypto/cfb.c | 14 +- crypto/morus1280.c | 13 +- crypto/morus640.c | 13 +- crypto/pcbc.c | 14 +- crypto/shash.c | 18 +- crypto/skcipher.c | 27 ++- crypto/testmgr.c | 14 +- crypto/testmgr.h | 25 +++ drivers/acpi/device_sysfs.c | 6 +- drivers/acpi/nfit/core.c | 43 ++--- drivers/auxdisplay/ht16k33.c | 2 +- drivers/base/power/wakeup.c | 8 +- drivers/block/floppy.c | 2 +- drivers/char/ipmi/ipmi_si_intf.c | 5 + drivers/char/ipmi/ipmi_si_mem_io.c | 5 +- drivers/char/ipmi/ipmi_si_port_io.c | 5 +- drivers/char/tpm/st33zp24/st33zp24.c | 2 +- drivers/char/tpm/tpm-interface.c | 11 +- drivers/char/tpm/tpm_atmel.c | 2 +- drivers/char/tpm/tpm_crb.c | 22 ++- drivers/char/tpm/tpm_i2c_atmel.c | 6 +- drivers/char/tpm/tpm_i2c_infineon.c | 2 +- drivers/char/tpm/tpm_i2c_nuvoton.c | 2 +- drivers/char/tpm/tpm_ibmvtpm.c | 8 +- drivers/char/tpm/tpm_infineon.c | 2 +- drivers/char/tpm/tpm_nsc.c | 2 +- drivers/char/tpm/tpm_tis_core.c | 2 +- drivers/char/tpm/tpm_vtpm_proxy.c | 3 +- drivers/char/tpm/xen-tpmfront.c | 2 +- drivers/clk/clk-twl6040.c | 53 +++++- drivers/clk/ingenic/cgu.c | 10 +- drivers/clk/ingenic/cgu.h | 2 +- drivers/clk/samsung/clk-exynos5-subcmu.c | 13 +- drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 4 +- drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 2 +- drivers/clk/uniphier/clk-uniphier-cpugear.c | 2 +- drivers/clocksource/Kconfig | 10 ++ drivers/clocksource/arm_arch_timer.c | 55 ++++++ drivers/clocksource/exynos_mct.c | 23 +-- drivers/clocksource/timer-ti-dm.c | 4 + drivers/cpufreq/pxa2xx-cpufreq.c | 4 +- drivers/cpufreq/qcom-cpufreq-kryo.c | 20 ++- drivers/cpufreq/tegra124-cpufreq.c | 2 + drivers/crypto/caam/caamalg.c | 1 + drivers/crypto/caam/caamhash.c | 93 +++------- drivers/crypto/ccree/cc_buffer_mgr.c | 8 +- drivers/crypto/ccree/cc_cipher.c | 7 +- drivers/crypto/rockchip/rk3288_crypto.c | 2 +- drivers/crypto/rockchip/rk3288_crypto.h | 4 +- drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c | 39 ++++- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 2 +- drivers/dma/sh/usb-dmac.c | 2 + drivers/gpio/gpio-pca953x.c | 3 +- drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c | 8 +- drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 6 +- drivers/gpu/drm/drm_fb_helper.c | 4 +- drivers/gpu/drm/i915/i915_gem.c | 3 +- drivers/gpu/drm/imx/imx-ldb.c | 25 ++- drivers/gpu/drm/imx/ipuv3-plane.c | 4 +- drivers/gpu/drm/radeon/evergreen_cs.c | 1 + drivers/gpu/ipu-v3/ipu-common.c | 8 +- drivers/hwtracing/intel_th/gth.c | 4 + drivers/hwtracing/stm/core.c | 11 +- drivers/i2c/busses/i2c-bcm2835.c | 12 ++ drivers/i2c/busses/i2c-cadence.c | 9 +- drivers/i2c/busses/i2c-tegra.c | 2 +- drivers/iio/adc/exynos_adc.c | 2 +- drivers/infiniband/hw/hfi1/hfi.h | 2 +- drivers/infiniband/hw/hfi1/init.c | 14 +- drivers/input/keyboard/cap11xx.c | 35 ++-- drivers/input/keyboard/matrix_keypad.c | 2 +- drivers/input/keyboard/st-keyscan.c | 4 +- drivers/input/misc/pwm-vibra.c | 19 ++- drivers/input/serio/ps2-gpio.c | 1 + drivers/irqchip/irq-brcmstb-l2.c | 10 +- drivers/irqchip/irq-gic-v3-its.c | 2 + drivers/mailbox/bcm-flexrm-mailbox.c | 4 +- drivers/md/bcache/request.c | 7 +- drivers/md/bcache/writeback.h | 3 + drivers/md/dm-integrity.c | 8 +- drivers/md/raid10.c | 2 + drivers/md/raid5.c | 2 + drivers/media/common/videobuf2/videobuf2-v4l2.c | 1 - drivers/media/dvb-frontends/lgdt330x.c | 2 +- drivers/media/i2c/ov5640.c | 2 +- drivers/media/platform/vimc/Makefile | 3 +- drivers/media/platform/vimc/vimc-capture.c | 18 +- drivers/media/platform/vimc/vimc-common.c | 35 ---- drivers/media/platform/vimc/vimc-common.h | 15 +- drivers/media/platform/vimc/vimc-debayer.c | 26 +-- drivers/media/platform/vimc/vimc-scaler.c | 28 +-- drivers/media/platform/vimc/vimc-sensor.c | 56 ++---- drivers/media/platform/vimc/vimc-streamer.c | 188 +++++++++++++++++++++ drivers/media/platform/vimc/vimc-streamer.h | 38 +++++ drivers/media/usb/uvc/uvc_video.c | 8 + drivers/mfd/sm501.c | 3 + drivers/misc/cxl/guest.c | 2 + drivers/misc/cxl/pci.c | 39 ++++- drivers/misc/mei/bus.c | 21 ++- drivers/misc/mei/hbm.c | 7 + drivers/mmc/core/core.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 1 + drivers/net/can/flexcan.c | 2 +- drivers/net/dsa/bcm_sf2.c | 12 +- drivers/net/ethernet/atheros/atlx/atl2.c | 4 +- drivers/net/ethernet/broadcom/bcmsysport.c | 4 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 27 ++- drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 7 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 7 +- drivers/net/ethernet/marvell/mvneta.c | 2 +- drivers/net/ethernet/netronome/nfp/bpf/jit.c | 17 +- drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 21 ++- drivers/net/ethernet/qlogic/qed/qed_iwarp.h | 1 - drivers/net/usb/qmi_wwan.c | 4 +- drivers/net/wireless/mac80211_hwsim.c | 2 +- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 - drivers/nvdimm/label.c | 23 ++- drivers/nvdimm/namespace_devs.c | 4 + drivers/nvdimm/pfn_devs.c | 4 +- drivers/parport/parport_pc.c | 2 +- drivers/pci/controller/dwc/pcie-designware-host.c | 2 +- drivers/pci/pcie/dpc.c | 27 ++- drivers/pci/probe.c | 36 ++-- drivers/pinctrl/meson/pinctrl-meson8b.c | 2 +- drivers/power/supply/cpcap-charger.c | 1 + drivers/regulator/max77620-regulator.c | 10 +- drivers/regulator/s2mpa01.c | 10 +- drivers/regulator/s2mps11.c | 6 +- drivers/s390/block/dasd_eckd.c | 8 + drivers/s390/virtio/virtio_ccw.c | 4 +- drivers/scsi/aacraid/linit.c | 13 +- drivers/scsi/libiscsi.c | 6 + drivers/scsi/qla2xxx/qla_init.c | 17 +- drivers/scsi/sd.c | 59 ++++++- drivers/scsi/virtio_scsi.c | 2 - drivers/soc/qcom/rpmh.c | 34 ++-- drivers/spi/spi-pxa2xx.c | 1 + drivers/spi/spi-ti-qspi.c | 6 +- drivers/staging/media/imx/imx-ic-prpencvf.c | 26 ++- drivers/staging/media/imx/imx-media-csi.c | 42 +++-- drivers/target/iscsi/iscsi_target.c | 4 +- drivers/tty/serial/8250/8250_of.c | 4 + drivers/tty/serial/8250/8250_pci.c | 141 ++++++++++++++-- drivers/tty/serial/xilinx_uartps.c | 8 +- drivers/tty/vt/vt.c | 15 +- drivers/usb/chipidea/ci_hdrc_tegra.c | 1 + drivers/usb/typec/tps6598x.c | 26 ++- fs/9p/v9fs_vfs.h | 23 ++- fs/9p/vfs_file.c | 6 +- fs/9p/vfs_inode.c | 23 ++- fs/9p/vfs_inode_dotl.c | 27 +-- fs/9p/vfs_super.c | 4 +- fs/btrfs/acl.c | 9 + fs/btrfs/disk-io.c | 8 + fs/btrfs/extent_io.c | 4 +- fs/btrfs/volumes.c | 4 +- fs/cifs/cifsglob.h | 19 +++ fs/cifs/file.c | 12 +- fs/cifs/smb2misc.c | 17 +- fs/cifs/smb2ops.c | 28 ++- fs/cifs/smb2transport.c | 14 +- fs/cifs/transport.c | 6 +- fs/devpts/inode.c | 1 + fs/ext2/super.c | 39 +++-- fs/ext4/ext4.h | 3 + fs/ext4/ioctl.c | 100 ++++++++--- fs/ext4/resize.c | 3 +- fs/jbd2/transaction.c | 33 ++-- fs/kernfs/mount.c | 8 +- fs/nfs/nfs4idmap.c | 31 ++-- fs/nfs/nfs4proc.c | 12 +- fs/nfs/pagelist.c | 29 +++- fs/nfs/write.c | 11 +- fs/nfsd/nfs3proc.c | 16 +- fs/nfsd/nfs3xdr.c | 1 + fs/nfsd/nfs4state.c | 8 +- fs/nfsd/nfsctl.c | 2 +- fs/overlayfs/copy_up.c | 59 +++++-- fs/overlayfs/overlayfs.h | 2 + fs/overlayfs/util.c | 55 +++--- fs/pipe.c | 14 ++ fs/splice.c | 4 + include/asm-generic/vmlinux.lds.h | 2 +- include/keys/request_key_auth-type.h | 36 ++++ include/kvm/arm_vgic.h | 2 +- include/linux/device-mapper.h | 2 +- include/linux/hardirq.h | 7 + include/linux/key-type.h | 22 +-- include/linux/kvm_host.h | 2 +- include/linux/pipe_fs_i.h | 1 + include/linux/property.h | 2 +- include/linux/skbuff.h | 6 + include/net/phonet/pep.h | 5 +- init/main.c | 3 +- kernel/bpf/lpm_trie.c | 1 + kernel/bpf/stackmap.c | 8 +- kernel/cgroup/cgroup.c | 9 +- kernel/rcu/tree.c | 20 ++- kernel/sysctl.c | 11 +- kernel/trace/trace.c | 1 - kernel/trace/trace_event_perf.c | 16 +- kernel/trace/trace_events_hist.c | 5 +- lib/assoc_array.c | 8 +- mm/gup.c | 3 +- mm/memory-failure.c | 14 +- mm/memory.c | 5 +- mm/page_alloc.c | 8 +- mm/page_ext.c | 4 +- mm/shmem.c | 12 +- mm/swap.c | 17 +- mm/vmalloc.c | 2 +- net/9p/client.c | 2 +- net/core/filter.c | 12 +- net/ipv4/esp4.c | 2 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv6/esp6.c | 2 +- net/key/af_key.c | 40 ++--- net/mac80211/agg-tx.c | 4 +- net/mac80211/util.c | 6 +- net/netfilter/ipvs/Kconfig | 1 + net/netfilter/ipvs/ip_vs_core.c | 10 +- net/netfilter/ipvs/ip_vs_ctl.c | 10 ++ net/netfilter/x_tables.c | 2 +- net/phonet/pep.c | 32 ++-- net/sunrpc/svcsock.c | 20 +-- net/sunrpc/xprtrdma/verbs.c | 3 +- net/xfrm/xfrm_interface.c | 4 +- net/xfrm/xfrm_policy.c | 4 +- scripts/kallsyms.c | 4 +- security/keys/internal.h | 13 +- security/keys/keyctl.c | 1 + security/keys/process_keys.c | 1 + security/keys/request_key.c | 72 ++++---- security/keys/request_key_auth.c | 16 +- security/selinux/hooks.c | 8 +- sound/soc/codecs/pcm186x.c | 8 +- sound/soc/codecs/rt5682.c | 2 + sound/soc/fsl/fsl_esai.c | 7 +- sound/soc/samsung/i2s.c | 10 +- sound/soc/sh/rcar/ssi.c | 2 +- sound/soc/soc-dapm.c | 24 +++ sound/soc/soc-topology.c | 8 +- tools/perf/util/auxtrace.c | 4 +- tools/perf/util/auxtrace.h | 3 + .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 37 +++- tools/perf/util/intel-pt.c | 2 + tools/perf/util/symbol.c | 2 + tools/testing/selftests/bpf/test_lpm_map.c | 10 ++ tools/testing/selftests/net/fib_tests.sh | 1 + virt/kvm/arm/arm.c | 10 ++ virt/kvm/arm/mmu.c | 2 +- virt/kvm/arm/psci.c | 36 ++-- virt/kvm/arm/vgic/vgic-init.c | 24 ++- virt/kvm/arm/vgic/vgic-its.c | 8 +- virt/kvm/arm/vgic/vgic.c | 10 +- virt/kvm/kvm_main.c | 7 +- 346 files changed, 3062 insertions(+), 1580 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/280 media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit 5e99456c20f712dcc13d9f6ca4278937d5367355 upstream.
Userspace shouldn't set bytesused to 0 for output buffers. vb2_warn_zero_bytesused() warns about this (only once!), but it also calls WARN_ON(1), which is confusing since it is not immediately clear that it warns about a 0 value for bytesused.
Just drop the WARN_ON as it serves no purpose.
--- drivers/media/common/videobuf2/videobuf2-v4l2.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/common/videobuf2/videobuf2-v4l2.c +0 -1
@@ -145,7 +145,6 @@ static void vb2_warn_zero_bytesused(strureturn ; check_once = true; -WARN_ON (1 );pr_warn ("use of bytesused == 0 is deprecated and will be removed in the future,\n" );if (vb->vb2_queue->allow_zero_bytesused)
Greg Kroah-Hartman
maintainerPATCH 2/280 9p: use inode->i_lock to protect i_size_write() under 32-bit
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
commit 5e3cc1ee1405a7eb3487ed24f786dec01b4cbe1f upstream.
Use inode->i_lock to protect i_size_write(), else i_size_read() in generic_fillattr() may loop infinitely in read_seqcount_begin() when multiple processes invoke v9fs_vfs_getattr() or v9fs_vfs_getattr_dotl() simultaneously under 32-bit SMP environment, and a soft lockup will be triggered as show below:
watchdog: BUG: soft lockup - CPU#5 stuck for 22s! [stat:2217] Modules linked in: CPU: 5 PID: 2217 Comm: stat Not tainted 5.0.0-rc1-00005-g7f702faf5a9e #4 Hardware name: Generic DT based system PC is at generic_fillattr+0x104/0x108 LR is at 0xec497f00 pc : [<802b8898>] lr : [<ec497f00>] psr: 200c0013 sp : ec497e20 ip : ed608030 fp : ec497e3c r10: 00000000 r9 : ec497f00 r8 : ed608030 r7 : ec497ebc r6 : ec497f00 r5 : ee5c1550 r4 : ee005780 r3 : 0000052d r2 : 00000000 r1 : ec497f00 r0 : ed608030 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: ac48006a DAC: 00000051 CPU: 5 PID: 2217 Comm: stat Not tainted 5.0.0-rc1-00005-g7f702faf5a9e #4 Hardware name: Generic DT based system Backtrace: [<8010d974>] (dump_backtrace) from [<8010dc88>] (show_stack+0x20/0x24) [<8010dc68>] (show_stack) from [<80a1d194>] (dump_stack+0xb0/0xdc) [<80a1d0e4>] (dump_stack) from [<80109f34>] (show_regs+0x1c/0x20) [<80109f18>] (show_regs) from [<801d0a80>] (watchdog_timer_fn+0x280/0x2f8) [<801d0800>] (watchdog_timer_fn) from [<80198658>] (__hrtimer_run_queues+0x18c/0x380) [<801984cc>] (__hrtimer_run_queues) from [<80198e60>] (hrtimer_run_queues+0xb8/0xf0) [<80198da8>] (hrtimer_run_queues) from [<801973e8>] (run_local_timers+0x28/0x64) [<801973c0>] (run_local_timers) from [<80197460>] (update_process_times+0x3c/0x6c) [<80197424>] (update_process_times) from [<801ab2b8>] (tick_nohz_handler+0xe0/0x1bc) [<801ab1d8>] (tick_nohz_handler) from [<80843050>] (arch_timer_handler_virt+0x38/0x48) [<80843018>] (arch_timer_handler_virt) from [<80180a64>] (handle_percpu_devid_irq+0x8c/0x240) [<801809d8>] (handle_percpu_devid_irq) from [<8017ac20>] (generic_handle_irq+0x34/0x44) [<8017abec>] (generic_handle_irq) from [<8017b344>] (__handle_domain_irq+0x6c/0xc4) [<8017b2d8>] (__handle_domain_irq) from [<801022e0>] (gic_handle_irq+0x4c/0x88) [<80102294>] (gic_handle_irq) from [<80101a30>] (__irq_svc+0x70/0x98) [<802b8794>] (generic_fillattr) from [<8056b284>] (v9fs_vfs_getattr_dotl+0x74/0xa4) [<8056b210>] (v9fs_vfs_getattr_dotl) from [<802b8904>] (vfs_getattr_nosec+0x68/0x7c) [<802b889c>] (vfs_getattr_nosec) from [<802b895c>] (vfs_getattr+0x44/0x48) [<802b8918>] (vfs_getattr) from [<802b8a74>] (vfs_statx+0x9c/0xec) [<802b89d8>] (vfs_statx) from [<802b9428>] (sys_lstat64+0x48/0x78) [<802b93e0>] (sys_lstat64) from [<80101000>] (ret_fast_syscall+0x0/0x28)
[[email protected]: updated comment to not refer to a function in another subsystem]
--- fs/9p/v9fs_vfs.h | 23 +++++++++++++++++++++-- fs/9p/vfs_file.c | 6 +++++- fs/9p/vfs_inode.c | 23 +++++++++++------------ fs/9p/vfs_inode_dotl.c | 27 ++++++++++++++------------- fs/9p/vfs_super.c | 4 ++-- 5 files changed, 53 insertions(+), 30 deletions(-)
fs/9p/v9fs_vfs.h +21 -2
@@ -40,6 +40,9 @@*/ #define P9_LOCK_TIMEOUT (30*HZ) +/* flags for v9fs_stat2inode() & v9fs_stat2inode_dotl() */ +#define V9FS_STAT2INODE_KEEP_ISIZE 1 +extern struct file_system_type v9fs_fs_type;extern const struct address_space_operations v9fs_addr_operations;extern const struct file_operations v9fs_file_operations;
@@ -61,8 +64,10 @@ int v9fs_init_inode(struct v9fs_session_ struct inode *inode, umode_t mode, dev_t);void v9fs_evict_inode (struct inode *inode);ino_t v9fs_qid2ino (struct p9_qid *qid); -void v9fs_stat2inode (struct p9_wstat *,struct inode *,struct super_block *); -void v9fs_stat2inode_dotl (struct p9_stat_dotl *,struct inode *); +void v9fs_stat2inode (struct p9_wstat *stat,struct inode *inode, +struct super_block *sb,unsigned int flags); +void v9fs_stat2inode_dotl (struct p9_stat_dotl *stat,struct inode *inode, +unsigned int flags);int v9fs_dir_release (struct inode *inode,struct file *filp);int v9fs_file_open (struct inode *inode,struct file *file);void v9fs_inode2stat (struct inode *inode,struct p9_wstat *stat);
@@ -83,4 +88,18 @@ static inline void v9fs_invalidate_inode }int v9fs_open_to_dotl_flags (int flags); + +static inline void v9fs_i_size_write (struct inode *inode,loff_t i_size) +{ +/* +* 32-bit need the lock, concurrent updates could break the +* sequences and make i_size_read() loop forever. +* 64-bit updates are atomic and can skip the locking. +*/ +if (sizeof (i_size) >sizeof (long )) +spin_lock (&inode->i_lock); +i_size_write (inode, i_size); +if (sizeof (i_size) >sizeof (long )) +spin_unlock (&inode->i_lock); +}#endif
fs/9p/vfs_file.c +5 -1
@@ -442,7 +442,11 @@ v9fs_file_write_iter(struct kiocb *iocb, i_size =i_size_read (inode);if (iocb->ki_pos > i_size) {inode_add_bytes (inode, iocb->ki_pos - i_size); -i_size_write (inode, iocb->ki_pos); +/* +* Need to serialize against i_size_write() in +* v9fs_stat2inode() +*/ +v9fs_i_size_write (inode, iocb->ki_pos); }return retval; }
fs/9p/vfs_inode.c +11 -12
@@ -538,7 +538,7 @@ static struct inode *v9fs_qid_iget(strucif (retval) goto error; -v9fs_stat2inode (st, inode, sb); +v9fs_stat2inode (st, inode, sb,0 );v9fs_cache_inode_get_cookie (inode);unlock_new_inode (inode);return inode;
@@ -1092,7 +1092,7 @@ v9fs_vfs_getattr(const struct path *pathif (IS_ERR (st))return PTR_ERR (st); -v9fs_stat2inode (st,d_inode (dentry), dentry->d_sb); +v9fs_stat2inode (st,d_inode (dentry), dentry->d_sb,0 );generic_fillattr (d_inode (dentry), stat);p9stat_free (st);
@@ -1170,12 +1170,13 @@ static int v9fs_vfs_setattr(struct dentr* @stat: Plan 9 metadata (mistat) structure * @inode: inode to populate * @sb: superblock of filesystem +* @flags: control flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) * */ void v9fs_stat2inode (struct p9_wstat *stat,struct inode *inode, -struct super_block *sb) +struct super_block *sb,unsigned int flags) {umode_t mode;char ext[32 ];
@@ -1216,10 +1217,11 @@ v9fs_stat2inode(struct p9_wstat *stat, s mode =p9mode2perm (v9ses, stat); mode |= inode->i_mode & ~S_IALLUGO ; inode->i_mode = mode; -i_size_write (inode, stat->length); +if (!(flags &V9FS_STAT2INODE_KEEP_ISIZE )) +v9fs_i_size_write (inode, stat->length);/* not real number of blocks, but 512 byte ones ... */ - inode->i_blocks = (i_size_read (inode) +512 -1 ) >>9 ; + inode->i_blocks = (stat->length +512 -1 ) >>9 ; v9inode->cache_validity &= ~V9FS_INO_INVALID_ATTR ; }
@@ -1416,9 +1418,9 @@ int v9fs_refresh_inode(struct p9_fid *fi {int umode;dev_t rdev; -loff_t i_size;struct p9_wstat *st;struct v9fs_session_info *v9ses; +unsigned int flags; v9ses =v9fs_inode2v9ses (inode); st =p9_client_stat (fid);
@@ -1431,16 +1433,13 @@ int v9fs_refresh_inode(struct p9_fid *fiif ((inode->i_mode &S_IFMT ) != (umode &S_IFMT )) goto out; -spin_lock (&inode->i_lock);/* * We don't want to refresh inode->i_size, * because we may have cached data */ - i_size = inode->i_size; -v9fs_stat2inode (st, inode, inode->i_sb); -if (v9ses->cache ==CACHE_LOOSE || v9ses->cache ==CACHE_FSCACHE ) - inode->i_size = i_size; -spin_unlock (&inode->i_lock); + flags = (v9ses->cache ==CACHE_LOOSE || v9ses->cache ==CACHE_FSCACHE ) ? +V9FS_STAT2INODE_KEEP_ISIZE :0 ; +v9fs_stat2inode (st, inode, inode->i_sb, flags); out:p9stat_free (st);kfree (st);
fs/9p/vfs_inode_dotl.c +14 -13
@@ -143,7 +143,7 @@ static struct inode *v9fs_qid_iget_dotl(if (retval) goto error; -v9fs_stat2inode_dotl (st, inode); +v9fs_stat2inode_dotl (st, inode,0 );v9fs_cache_inode_get_cookie (inode); retval =v9fs_get_acl (inode, fid);if (retval)
@@ -496,7 +496,7 @@ v9fs_vfs_getattr_dotl(const struct pathif (IS_ERR (st))return PTR_ERR (st); -v9fs_stat2inode_dotl (st,d_inode (dentry)); +v9fs_stat2inode_dotl (st,d_inode (dentry),0 );generic_fillattr (d_inode (dentry), stat);/* Change block size to what the server returned */ stat->blksize = st->st_blksize;
@@ -607,11 +607,13 @@ int v9fs_vfs_setattr_dotl(struct dentry* v9fs_stat2inode_dotl - populate an inode structure with stat info * @stat: stat structure * @inode: inode to populate +* @flags: ctrl flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) * */ void -v9fs_stat2inode_dotl (struct p9_stat_dotl *stat,struct inode *inode) +v9fs_stat2inode_dotl (struct p9_stat_dotl *stat,struct inode *inode, +unsigned int flags) {umode_t mode;struct v9fs_inode *v9inode =V9FS_I (inode);
@@ -631,7 +633,8 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl mode |= inode->i_mode & ~S_IALLUGO ; inode->i_mode = mode; -i_size_write (inode, stat->st_size); +if (!(flags &V9FS_STAT2INODE_KEEP_ISIZE )) +v9fs_i_size_write (inode, stat->st_size); inode->i_blocks = stat->st_blocks; }else {if (stat->st_result_mask &P9_STATS_ATIME ) {
@@ -661,8 +664,9 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl }if (stat->st_result_mask &P9_STATS_RDEV ) inode->i_rdev =new_decode_dev (stat->st_rdev); -if (stat->st_result_mask &P9_STATS_SIZE ) -i_size_write (inode, stat->st_size); +if (!(flags &V9FS_STAT2INODE_KEEP_ISIZE ) && + stat->st_result_mask &P9_STATS_SIZE ) +v9fs_i_size_write (inode, stat->st_size);if (stat->st_result_mask &P9_STATS_BLOCKS ) inode->i_blocks = stat->st_blocks; }
@@ -928,9 +932,9 @@ v9fs_vfs_get_link_dotl(struct dentry *deint v9fs_refresh_inode_dotl (struct p9_fid *fid,struct inode *inode) { -loff_t i_size;struct p9_stat_dotl *st;struct v9fs_session_info *v9ses; +unsigned int flags; v9ses =v9fs_inode2v9ses (inode); st =p9_client_getattr_dotl (fid,P9_STATS_ALL );
@@ -942,16 +946,13 @@ int v9fs_refresh_inode_dotl(struct p9_fiif ((inode->i_mode &S_IFMT ) != (st->st_mode &S_IFMT )) goto out; -spin_lock (&inode->i_lock);/* * We don't want to refresh inode->i_size, * because we may have cached data */ - i_size = inode->i_size; -v9fs_stat2inode_dotl (st, inode); -if (v9ses->cache ==CACHE_LOOSE || v9ses->cache ==CACHE_FSCACHE ) - inode->i_size = i_size; -spin_unlock (&inode->i_lock); + flags = (v9ses->cache ==CACHE_LOOSE || v9ses->cache ==CACHE_FSCACHE ) ? +V9FS_STAT2INODE_KEEP_ISIZE :0 ; +v9fs_stat2inode_dotl (st, inode, flags); out:kfree (st);return 0 ;
fs/9p/vfs_super.c +2 -2
@@ -172,7 +172,7 @@ static struct dentry *v9fs_mount(struct goto release_sb; }d_inode (root)->i_ino =v9fs_qid2ino (&st->qid); -v9fs_stat2inode_dotl (st,d_inode (root)); +v9fs_stat2inode_dotl (st,d_inode (root),0 );kfree (st); }else {struct p9_wstat *st =NULL ;
@@ -183,7 +183,7 @@ static struct dentry *v9fs_mount(struct }d_inode (root)->i_ino =v9fs_qid2ino (&st->qid); -v9fs_stat2inode (st,d_inode (root), sb); +v9fs_stat2inode (st,d_inode (root), sb,0 );p9stat_free (st);kfree (st);
Greg Kroah-Hartman
maintainerPATCH 3/280 9p/net: fix memory leak in p9_client_create
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhengbin <[email protected]>
commit bb06c388fa20ae24cfe80c52488de718a7e3a53f upstream.
If msize is less than 4096, we should close and put trans, destroy tagpool, not just free client. This patch fixes that.
--- net/9p/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/9p/client.c +1 -1
@@ -1073,7 +1073,7 @@ struct p9_client *p9_client_create(constp9_debug (P9_DEBUG_ERROR ,"Please specify a msize of at least 4k\n" ); err = -EINVAL ; - goto free_client; + goto close_trans; } err =p9_client_version (clnt);
Greg Kroah-Hartman
maintainerPATCH 4/280 ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: S.j. Wang <[email protected]>
commit cc29ea007347f39f4c5a4d27b0b555955a0277f9 upstream.
The ESAI_xCR_xWA is xCR's bit, not the xCCR's bit, driver set it to wrong register, correct it.
Fixes 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver")
--- sound/soc/fsl/fsl_esai.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/soc/fsl/fsl_esai.c +4 -3
@@ -398,7 +398,8 @@ static int fsl_esai_set_dai_fmt(struct sbreak ;case SND_SOC_DAIFMT_RIGHT_J :/* Data on rising edge of bclk, frame high, right aligned */ - xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCR_xWA; + xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP; + xcr |= ESAI_xCR_xWA;break ;case SND_SOC_DAIFMT_DSP_A :/* Data on rising edge of bclk, frame high, 1clk before data */
@@ -455,12 +456,12 @@ static int fsl_esai_set_dai_fmt(struct sreturn -EINVAL ; } - mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR; + mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR | ESAI_xCR_xWA;regmap_update_bits (esai_priv->regmap,REG_ESAI_TCR , mask, xcr);regmap_update_bits (esai_priv->regmap,REG_ESAI_RCR , mask, xcr); mask = ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCCR_xFSP | - ESAI_xCCR_xFSD | ESAI_xCCR_xCKD | ESAI_xCR_xWA; + ESAI_xCCR_xFSD | ESAI_xCCR_xCKD;regmap_update_bits (esai_priv->regmap,REG_ESAI_TCCR , mask, xccr);regmap_update_bits (esai_priv->regmap,REG_ESAI_RCCR , mask, xccr);
Greg Kroah-Hartman
maintainerPATCH 5/280 ASoC: codecs: pcm186x: fix wrong usage of DECLARE_TLV_DB_SCALE()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Codrin Ciubotariu <[email protected]>
commit fcf4daabf08079e6d09958a2992e7446ef8d0438 upstream.
According to DS, the gain is between -12 dB and 40 dB, with a 0.5 dB step. Tested on pcm1863.
--- sound/soc/codecs/pcm186x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/pcm186x.c +1 -1
@@ -42,7 +42,7 @@ struct pcm186x_priv {bool is_master_mode; }; -static const DECLARE_TLV_DB_SCALE(pcm186x_pga_tlv, -1200, 4000, 50); +static const DECLARE_TLV_DB_SCALE(pcm186x_pga_tlv, -1200, 50, 0);static const struct snd_kcontrol_new pcm1863_snd_controls[] = { SOC_DOUBLE_R_S_TLV("ADC Capture Volume", PCM186X_PGA_VAL_CH1_L,
Greg Kroah-Hartman
maintainerPATCH 6/280 ASoC: codecs: pcm186x: Fix energysense SLEEP bit
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Codrin Ciubotariu <[email protected]>
commit 05bd7fcdd06b19a10f069af1bea3ad9abac038d7 upstream.
The ADCs are sleeping when the SLEEP bit is set and running when it's cleared, so the bit should be inverted.
Tested on pcm1863.
--- sound/soc/codecs/pcm186x.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/pcm186x.c +3 -3
@@ -158,7 +158,7 @@ static const struct snd_soc_dapm_widget* Put the codec into SLEEP mode when not in use, allowing the * Energysense mechanism to operate. */ - SND_SOC_DAPM_ADC("ADC", "HiFi Capture", PCM186X_POWER_CTRL, 1, 0), + SND_SOC_DAPM_ADC("ADC", "HiFi Capture", PCM186X_POWER_CTRL, 1, 1), };static const struct snd_soc_dapm_widget pcm1865_dapm_widgets[] = {
@@ -184,8 +184,8 @@ static const struct snd_soc_dapm_widget* Put the codec into SLEEP mode when not in use, allowing the * Energysense mechanism to operate. */ -SND_SOC_DAPM_ADC ("ADC1" ,"HiFi Capture 1" ,PCM186X_POWER_CTRL ,1 ,0 ), - SND_SOC_DAPM_ADC("ADC2", "HiFi Capture 2", PCM186X_POWER_CTRL, 1, 0), +SND_SOC_DAPM_ADC ("ADC1" ,"HiFi Capture 1" ,PCM186X_POWER_CTRL ,1 ,1 ), + SND_SOC_DAPM_ADC("ADC2", "HiFi Capture 2", PCM186X_POWER_CTRL, 1, 1), }; static const struct snd_soc_dapm_route pcm1863_dapm_routes[] = {
Greg Kroah-Hartman
maintainerPATCH 7/280 iio: adc: exynos-adc: Fix NULL pointer exception on unbind
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 2ea8bab4dd2a9014e723b28091831fa850b82d83 upstream.
Fix NULL pointer exception on device unbind when device tree does not contain "has-touchscreen" property. In such case the input device is not registered so it should not be unregistered.
$ echo "12d10000.adc" > /sys/bus/platform/drivers/exynos-adc/unbind
Unable to handle kernel NULL pointer dereference at virtual address 00000474
...
(input_unregister_device) from [<c0772060>] (exynos_adc_remove+0x20/0x80)
(exynos_adc_remove) from [<c0587d5c>] (platform_drv_remove+0x20/0x40)
(platform_drv_remove) from [<c05860f0>] (device_release_driver_internal+0xdc/0x1ac)
(device_release_driver_internal) from [<c0583ecc>] (unbind_store+0x60/0xd4)
(unbind_store) from [<c031b89c>] (kernfs_fop_write+0x100/0x1e0)
(kernfs_fop_write) from [<c029709c>] (__vfs_write+0x2c/0x17c)
(__vfs_write) from [<c0297374>] (vfs_write+0xa4/0x184)
(vfs_write) from [<c0297594>] (ksys_write+0x4c/0xac)
(ksys_write) from [<c0101000>] (ret_fast_syscall+0x0/0x28)--- drivers/iio/adc/exynos_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/exynos_adc.c +1 -1
@@ -915,7 +915,7 @@ static int exynos_adc_remove(struct platstruct iio_dev *indio_dev =platform_get_drvdata (pdev);struct exynos_adc *info =iio_priv (indio_dev); -if (IS_REACHABLE (CONFIG_INPUT )) { +if (IS_REACHABLE (CONFIG_INPUT ) && info->input) {free_irq (info->tsirq, info);input_unregister_device (info->input); }
Greg Kroah-Hartman
maintainerPATCH 8/280 mei: hbm: clean the feature flags on link reset
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 37fd0b623023484ef6df79ed46f21f06ecc611ff upstream.
The list of supported functions can be altered upon link reset, clean the flags to allow correct selections of supported features.
--- drivers/misc/mei/hbm.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/misc/mei/hbm.c +7 -0
@@ -986,29 +986,36 @@ static void mei_hbm_config_features(stru dev->version.minor_version >= HBM_MINOR_VERSION_PGI) dev->hbm_f_pg_supported = 1; + dev->hbm_f_dc_supported =0 ;if (dev->version.major_version >=HBM_MAJOR_VERSION_DC ) dev->hbm_f_dc_supported =1 ; + dev->hbm_f_ie_supported =0 ;if (dev->version.major_version >=HBM_MAJOR_VERSION_IE ) dev->hbm_f_ie_supported =1 ;/* disconnect on connect timeout instead of link reset */ + dev->hbm_f_dot_supported =0 ;if (dev->version.major_version >=HBM_MAJOR_VERSION_DOT ) dev->hbm_f_dot_supported =1 ;/* Notification Event Support */ + dev->hbm_f_ev_supported =0 ;if (dev->version.major_version >=HBM_MAJOR_VERSION_EV ) dev->hbm_f_ev_supported =1 ;/* Fixed Address Client Support */ + dev->hbm_f_fa_supported =0 ;if (dev->version.major_version >=HBM_MAJOR_VERSION_FA ) dev->hbm_f_fa_supported =1 ;/* OS ver message Support */ + dev->hbm_f_os_supported =0 ;if (dev->version.major_version >=HBM_MAJOR_VERSION_OS ) dev->hbm_f_os_supported =1 ;/* DMA Ring Support */ + dev->hbm_f_dr_supported =0 ;if (dev->version.major_version >HBM_MAJOR_VERSION_DR || (dev->version.major_version ==HBM_MAJOR_VERSION_DR && dev->version.minor_version >=HBM_MINOR_VERSION_DR ))
Greg Kroah-Hartman
maintainerPATCH 9/280 mei: bus: move hw module get/put to probe/release
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit b5958faa34e2f99f3475ad89c52d98dfea079d33 upstream.
Fix unbalanced module reference counting during internal reset, which prevents the drivers unloading.
Tracking mei_me/txe modules on mei client bus via mei_cldev_enable/disable is error prone due to possible internal reset flow, where clients are disconnected underneath. Moving reference counting to probe and release of mei bus client driver solves this issue in simplest way, as each client provides only a single connection to a client bus driver.
--- drivers/misc/mei/bus.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
drivers/misc/mei/bus.c +10 -11
@@ -541,17 +541,9 @@ int mei_cldev_enable(struct mei_cl_devic goto out; } -if (!mei_cl_bus_module_get (cldev)) { -dev_err (&cldev->dev,"get hw module failed" ); - ret = -ENODEV ; - goto out; - } - ret =mei_cl_connect (cl, cldev->me_cl,NULL ); -if (ret <0 ) { +if (ret <0 )dev_err (&cldev->dev,"cannot connect\n" ); -mei_cl_bus_module_put (cldev); - } out:mutex_unlock (&bus->device_lock);
@@ -614,7 +606,6 @@ int mei_cldev_disable(struct mei_cl_deviif (err <0 )dev_err (bus->dev,"Could not disconnect from the ME client\n" ); -mei_cl_bus_module_put (cldev); out:/* Flush queues and remove any pending read */ mei_cl_flush_queues (cl,NULL );
@@ -725,9 +716,16 @@ static int mei_cl_device_probe(struct deif (!id)return -ENODEV ; +if (!mei_cl_bus_module_get (cldev)) { +dev_err (&cldev->dev,"get hw module failed" ); +return -ENODEV ; + } + ret = cldrv->probe (cldev, id); -if (ret) +if (ret) { +mei_cl_bus_module_put (cldev);return ret; + }__module_get (THIS_MODULE );return 0 ;
@@ -755,6 +753,7 @@ static int mei_cl_device_remove(struct dmei_cldev_unregister_callbacks (cldev); +mei_cl_bus_module_put (cldev);module_put (THIS_MODULE ); dev->driver =NULL ;return ret;
Greg Kroah-Hartman
maintainerPATCH 10/280 stm class: Fix an endless loop in channel allocation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhi Jin <[email protected]>
commit a1d75dad3a2c689e70a1c4e0214cca9de741d0aa upstream.
There is a bug in the channel allocation logic that leads to an endless loop when looking for a contiguous range of channels in a range with a mixture of free and occupied channels. For example, opening three consequtive channels, closing the first two and requesting 4 channels in a row will trigger this soft lockup. The bug is that the search loop forgets to skip over the range once it detects that one channel in that range is occupied.
Restore the original intent to the logic by fixing the omission.
--- drivers/hwtracing/stm/core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hwtracing/stm/core.c +3 -0
@@ -244,6 +244,9 @@ static int find_free_channels(unsigned l ;if (i == width)return pos; + +/* step over [pos..pos+i) to continue search */ + pos += i; }return -1 ;
Greg Kroah-Hartman
maintainerPATCH 11/280 crypto: caam - fix hash context DMA unmap size
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Franck LENORMAND <[email protected]>
commit 65055e2108847af5e577cc7ce6bde45ea136d29a upstream.
When driver started using state->caam_ctxt for storing both running hash and final hash, it was not updated to handle different DMA unmap lengths.
--- drivers/crypto/caam/caamhash.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/crypto/caam/caamhash.c +5 -3
@@ -118,6 +118,7 @@ struct caam_hash_ctx {struct caam_hash_state {dma_addr_t buf_dma;dma_addr_t ctx_dma; +int ctx_dma_len;u8 buf_0[CAAM_MAX_HASH_BLOCK_SIZE ]____cacheline_aligned ;int buflen_0;u8 buf_1[CAAM_MAX_HASH_BLOCK_SIZE ]____cacheline_aligned ;
@@ -170,6 +171,7 @@ static inline int map_seq_out_ptr_ctx(u3 struct caam_hash_state *state, int ctx_len) { + state->ctx_dma_len = ctx_len; state->ctx_dma =dma_map_single (jrdev, state->caam_ctx, ctx_len,DMA_FROM_DEVICE );if (dma_mapping_error (jrdev, state->ctx_dma)) {
@@ -223,6 +225,7 @@ static inline int ctx_map_to_sec4_sg(str struct caam_hash_state *state, int ctx_len, struct sec4_sg_entry *sec4_sg, u32 flag) { + state->ctx_dma_len = ctx_len; state->ctx_dma =dma_map_single (jrdev, state->caam_ctx, ctx_len, flag);if (dma_mapping_error (jrdev, state->ctx_dma)) {dev_err (jrdev,"unable to map ctx\n" );
@@ -527,12 +530,10 @@ static inline void ahash_unmap_ctx(strucstruct ahash_edesc *edesc, struct ahash_request *req, int dst_len, u32 flag) { - struct crypto_ahash *ahash = crypto_ahash_reqtfm(req); -struct caam_hash_ctx *ctx =crypto_ahash_ctx (ahash); struct caam_hash_state *state = ahash_request_ctx(req);if (state->ctx_dma) { -dma_unmap_single (dev, state->ctx_dma, ctx->ctx_len, flag); +dma_unmap_single (dev, state->ctx_dma, state->ctx_dma_len, flag); state->ctx_dma =0 ; }ahash_unmap (dev, edesc, req, dst_len);
@@ -1505,6 +1506,7 @@ static int ahash_init(struct ahash_reque state->final = ahash_final_no_ctx; state->ctx_dma =0 ; + state->ctx_dma_len =0 ; state->current_buf =0 ; state->buf_dma =0 ; state->buflen_0 =0 ;
Greg Kroah-Hartman
maintainerPATCH 12/280 crypto: ccree - fix missing break in switch statement
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit b5be853181a8d4a6e20f2073ccd273d6280cad88 upstream.
Add missing break statement in order to prevent the code from falling through to case S_DIN_to_DES.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/crypto/ccree/cc_cipher.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/ccree/cc_cipher.c +1 -0
@@ -79,6 +79,7 @@ static int validate_keys_sizes(struct ccdefault :break ; } +break ;case S_DIN_to_DES:if (size ==DES3_EDE_KEY_SIZE || size ==DES_KEY_SIZE )return 0 ;
Greg Kroah-Hartman
maintainerPATCH 13/280 crypto: caam - fixed handling of sg list
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pankaj Gupta <[email protected]>
commit 42e95d1f10dcf8b18b1d7f52f7068985b3dc5b79 upstream.
when the source sg contains more than 1 fragment and destination sg contains 1 fragment, the caam driver mishandle the buffers to be sent to caam.
--- drivers/crypto/caam/caamalg.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/caam/caamalg.c +1 -0
@@ -1005,6 +1005,7 @@ static void init_aead_job(struct aead_reif (unlikely (req->src != req->dst)) {if (edesc->dst_nents ==1 ) { dst_dma =sg_dma_address (req->dst); + out_options =0 ; }else { dst_dma = edesc->sec4_sg_dma + sec4_sg_index *
Greg Kroah-Hartman
maintainerPATCH 14/280 crypto: caam - fix DMA mapping of stack memory
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geantă <[email protected]>
commit c19650d6ea99bcd903d3e55dd61860026c701339 upstream.
Roland reports the following issue and provides a root cause analysis:
"On a v4.19 i.MX6 system with IMA and CONFIG_DMA_API_DEBUG enabled, a warning is generated when accessing files on a filesystem for which IMA measurement is enabled:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at kernel/dma/debug.c:1181 check_for_stack.part.9+0xd0/0x120
caam_jr 2101000.jr0: DMA-API: device driver maps memory from stack [addr=b668049e]
Modules linked in:
CPU: 0 PID: 1 Comm: switch_root Not tainted 4.19.0-20181214-1 #2
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
Backtrace:
[<c010efb8>] (dump_backtrace) from [<c010f2d0>] (show_stack+0x20/0x24)
[<c010f2b0>] (show_stack) from [<c08b04f4>] (dump_stack+0xa0/0xcc)
[<c08b0454>] (dump_stack) from [<c012b610>] (__warn+0xf0/0x108)
[<c012b520>] (__warn) from [<c012b680>] (warn_slowpath_fmt+0x58/0x74)
[<c012b62c>] (warn_slowpath_fmt) from [<c0199acc>] (check_for_stack.part.9+0xd0/0x120)
[<c01999fc>] (check_for_stack.part.9) from [<c019a040>] (debug_dma_map_page+0x144/0x174)
[<c0199efc>] (debug_dma_map_page) from [<c065f7f4>] (ahash_final_ctx+0x5b4/0xcf0)
[<c065f240>] (ahash_final_ctx) from [<c065b3c4>] (ahash_final+0x1c/0x20)
[<c065b3a8>] (ahash_final) from [<c03fe278>] (crypto_ahash_op+0x38/0x80)
[<c03fe240>] (crypto_ahash_op) from [<c03fe2e0>] (crypto_ahash_final+0x20/0x24)
[<c03fe2c0>] (crypto_ahash_final) from [<c03f19a8>] (ima_calc_file_hash+0x29c/0xa40)
[<c03f170c>] (ima_calc_file_hash) from [<c03f2b24>] (ima_collect_measurement+0x1dc/0x240)
[<c03f2948>] (ima_collect_measurement) from [<c03f0a60>] (process_measurement+0x4c4/0x6b8)
[<c03f059c>] (process_measurement) from [<c03f0cdc>] (ima_file_check+0x88/0xa4)
[<c03f0c54>] (ima_file_check) from [<c02d8adc>] (path_openat+0x5d8/0x1364)
[<c02d8504>] (path_openat) from [<c02dad24>] (do_filp_open+0x84/0xf0)
[<c02daca0>] (do_filp_open) from [<c02cf50c>] (do_open_execat+0x84/0x1b0)
[<c02cf488>] (do_open_execat) from [<c02d1058>] (__do_execve_file+0x43c/0x890)
[<c02d0c1c>] (__do_execve_file) from [<c02d1770>] (sys_execve+0x44/0x4c)
[<c02d172c>] (sys_execve) from [<c0101000>] (ret_fast_syscall+0x0/0x28)
---[ end trace 3455789a10e3aefd ]---The cause is that the struct ahash_request *req is created as a stack-local variable up in the stack (presumably somewhere in the IMA implementation), then passed down into the CAAM driver, which tries to dma_single_map the req->result (indirectly via map_seq_out_ptr_result) in order to make that buffer available for the CAAM to store the result of the following hash operation.
The calling code doesn't know how req will be used by the CAAM driver, and there could be other such occurrences where stack memory is passed down to the CAAM driver. Therefore we should rather fix this issue in the CAAM driver where the requirements are known."
Fix this problem by:
-instructing the crypto engine to write the final hash in state->caam_ctx -subsequently memcpy-ing the final hash into req->result
--- drivers/crypto/caam/caamhash.c | 85 ++++++++++------------------------------- 1 file changed, 21 insertions(+), 64 deletions(-)
drivers/crypto/caam/caamhash.c +21 -64
@@ -185,18 +185,6 @@ static inline int map_seq_out_ptr_ctx(u3return 0 ; } -/* Map req->result, and append seq_out_ptr command that points to it */ -static inline dma_addr_t map_seq_out_ptr_result (u32 *desc,struct device *jrdev, -u8 *result,int digestsize) -{ -dma_addr_t dst_dma; - - dst_dma =dma_map_single (jrdev, result, digestsize,DMA_FROM_DEVICE ); -append_seq_out_ptr (desc, dst_dma, digestsize,0 ); - -return dst_dma; -} -/* Map current buffer in state (if length > 0) and put it in link table */ static inline int buf_map_to_sec4_sg(struct device *jrdev, struct sec4_sg_entry *sec4_sg,
@@ -488,7 +476,6 @@ static int ahash_setkey(struct crypto_ah/* * ahash_edesc - s/w-extended ahash descriptor -* @dst_dma: physical mapped address of req->result * @sec4_sg_dma: physical mapped address of h/w link table * @src_nents: number of segments in input scatterlist * @sec4_sg_bytes: length of dma mapped sec4_sg space
@@ -496,7 +483,6 @@ static int ahash_setkey(struct crypto_ah* @sec4_sg: h/w link table */ struct ahash_edesc { -dma_addr_t dst_dma;dma_addr_t sec4_sg_dma;int src_nents;int sec4_sg_bytes;
@@ -512,8 +498,6 @@ static inline void ahash_unmap(struct deif (edesc->src_nents)dma_unmap_sg (dev, req->src, edesc->src_nents,DMA_TO_DEVICE ); -if (edesc->dst_dma) -dma_unmap_single (dev, edesc->dst_dma, dst_len,DMA_FROM_DEVICE );if (edesc->sec4_sg_bytes) dma_unmap_single(dev, edesc->sec4_sg_dma,
@@ -546,9 +530,9 @@ static void ahash_done(struct device *jrstruct ahash_edesc *edesc;struct crypto_ahash *ahash =crypto_ahash_reqtfm (req);int digestsize =crypto_ahash_digestsize (ahash); +struct caam_hash_state *state =ahash_request_ctx (req);#ifdef DEBUG struct caam_hash_ctx *ctx =crypto_ahash_ctx (ahash); -struct caam_hash_state *state =ahash_request_ctx (req);dev_err (jrdev,"%s %d: err 0x%x\n" , __func__, __LINE__, err);#endif
@@ -557,17 +541,14 @@ static void ahash_done(struct device *jrif (err)caam_jr_strstatus (jrdev, err); -ahash_unmap (jrdev, edesc, req, digestsize); +ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_FROM_DEVICE ); +memcpy (req->result, state->caam_ctx, digestsize);kfree (edesc);#ifdef DEBUG print_hex_dump(KERN_ERR, "ctx@"__stringify(__LINE__)": ",DUMP_PREFIX_ADDRESS ,16 ,4 , state->caam_ctx, ctx->ctx_len,1 ); -if (req->result) - print_hex_dump(KERN_ERR, "result@"__stringify(__LINE__)": ", -DUMP_PREFIX_ADDRESS ,16 ,4 , req->result, - digestsize,1 );#endif req->base.complete (&req->base, err);
@@ -615,9 +596,9 @@ static void ahash_done_ctx_src(struct destruct ahash_edesc *edesc;struct crypto_ahash *ahash =crypto_ahash_reqtfm (req);int digestsize =crypto_ahash_digestsize (ahash); +struct caam_hash_state *state =ahash_request_ctx (req);#ifdef DEBUG struct caam_hash_ctx *ctx =crypto_ahash_ctx (ahash); -struct caam_hash_state *state =ahash_request_ctx (req);dev_err (jrdev,"%s %d: err 0x%x\n" , __func__, __LINE__, err);#endif
@@ -626,17 +607,14 @@ static void ahash_done_ctx_src(struct deif (err)caam_jr_strstatus (jrdev, err); -ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_TO_DEVICE ); +ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_BIDIRECTIONAL ); +memcpy (req->result, state->caam_ctx, digestsize);kfree (edesc);#ifdef DEBUG print_hex_dump(KERN_ERR, "ctx@"__stringify(__LINE__)": ",DUMP_PREFIX_ADDRESS ,16 ,4 , state->caam_ctx, ctx->ctx_len,1 ); -if (req->result) - print_hex_dump(KERN_ERR, "result@"__stringify(__LINE__)": ", -DUMP_PREFIX_ADDRESS ,16 ,4 , req->result, - digestsize,1 );#endif req->base.complete (&req->base, err);
@@ -897,7 +875,7 @@ static int ahash_final_ctx(struct ahash_ edesc->sec4_sg_bytes = sec4_sg_bytes; ret =ctx_map_to_sec4_sg (jrdev, state, ctx->ctx_len, - edesc->sec4_sg,DMA_TO_DEVICE ); + edesc->sec4_sg,DMA_BIDIRECTIONAL );if (ret) goto unmap_ctx;
@@ -917,14 +895,7 @@ static int ahash_final_ctx(struct ahash_append_seq_in_ptr (desc, edesc->sec4_sg_dma, ctx->ctx_len + buflen,LDST_SGF ); - - edesc->dst_dma =map_seq_out_ptr_result (desc, jrdev, req->result, - digestsize); -if (dma_mapping_error (jrdev, edesc->dst_dma)) { -dev_err (jrdev,"unable to map dst\n" ); - ret = -ENOMEM ; - goto unmap_ctx; - } +append_seq_out_ptr (desc, state->ctx_dma, digestsize,0 );#ifdef DEBUG print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
@@ -937,7 +908,7 @@ static int ahash_final_ctx(struct ahash_return -EINPROGRESS ; unmap_ctx: -ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_FROM_DEVICE ); +ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_BIDIRECTIONAL );kfree (edesc);return ret; }
@@ -991,7 +962,7 @@ static int ahash_finup_ctx(struct ahash_ edesc->src_nents = src_nents; ret =ctx_map_to_sec4_sg (jrdev, state, ctx->ctx_len, - edesc->sec4_sg,DMA_TO_DEVICE ); + edesc->sec4_sg,DMA_BIDIRECTIONAL );if (ret) goto unmap_ctx;
@@ -1005,13 +976,7 @@ static int ahash_finup_ctx(struct ahash_if (ret) goto unmap_ctx; - edesc->dst_dma =map_seq_out_ptr_result (desc, jrdev, req->result, - digestsize); -if (dma_mapping_error (jrdev, edesc->dst_dma)) { -dev_err (jrdev,"unable to map dst\n" ); - ret = -ENOMEM ; - goto unmap_ctx; - } +append_seq_out_ptr (desc, state->ctx_dma, digestsize,0 );#ifdef DEBUG print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
@@ -1024,7 +989,7 @@ static int ahash_finup_ctx(struct ahash_return -EINPROGRESS ; unmap_ctx: -ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_FROM_DEVICE ); +ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_BIDIRECTIONAL );kfree (edesc);return ret; }
@@ -1083,10 +1048,8 @@ static int ahash_digest(struct ahash_req desc = edesc->hw_desc; - edesc->dst_dma =map_seq_out_ptr_result (desc, jrdev, req->result, - digestsize); -if (dma_mapping_error (jrdev, edesc->dst_dma)) { -dev_err (jrdev,"unable to map dst\n" ); + ret =map_seq_out_ptr_ctx (desc, jrdev, state, digestsize); +if (ret) {ahash_unmap (jrdev, edesc, req, digestsize);kfree (edesc);return -ENOMEM ;
@@ -1101,7 +1064,7 @@ static int ahash_digest(struct ahash_reqif (!ret) { ret = -EINPROGRESS ; }else { -ahash_unmap (jrdev, edesc, req, digestsize); +ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_FROM_DEVICE );kfree (edesc); }
@@ -1143,12 +1106,9 @@ static int ahash_final_no_ctx(struct ahaappend_seq_in_ptr (desc, state->buf_dma, buflen,0 ); } - edesc->dst_dma =map_seq_out_ptr_result (desc, jrdev, req->result, - digestsize); -if (dma_mapping_error (jrdev, edesc->dst_dma)) { -dev_err (jrdev,"unable to map dst\n" ); + ret =map_seq_out_ptr_ctx (desc, jrdev, state, digestsize); +if (ret) goto unmap; - }#ifdef DEBUG print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
@@ -1159,7 +1119,7 @@ static int ahash_final_no_ctx(struct ahaif (!ret) { ret = -EINPROGRESS ; }else { -ahash_unmap (jrdev, edesc, req, digestsize); +ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_FROM_DEVICE );kfree (edesc); }
@@ -1358,12 +1318,9 @@ static int ahash_finup_no_ctx(struct aha goto unmap; } - edesc->dst_dma =map_seq_out_ptr_result (desc, jrdev, req->result, - digestsize); -if (dma_mapping_error (jrdev, edesc->dst_dma)) { -dev_err (jrdev,"unable to map dst\n" ); + ret =map_seq_out_ptr_ctx (desc, jrdev, state, digestsize); +if (ret) goto unmap; - }#ifdef DEBUG print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
@@ -1374,7 +1331,7 @@ static int ahash_finup_no_ctx(struct ahaif (!ret) { ret = -EINPROGRESS ; }else { -ahash_unmap (jrdev, edesc, req, digestsize); +ahash_unmap_ctx (jrdev, edesc, req, digestsize,DMA_FROM_DEVICE );kfree (edesc); }
Greg Kroah-Hartman
maintainerPATCH 15/280 crypto: ccree - fix free of unallocated mlli buffer
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hadar Gat <[email protected]>
commit a49411959ea6d4915a9fd2a7eb5ba220e6284e9a upstream.
In cc_unmap_aead_request(), call dma_pool_free() for mlli buffer only if an item is allocated from the pool and not always if there is a pool allocated.
This fixes a kernel panic when trying to free a non-allocated item.
--- drivers/crypto/ccree/cc_buffer_mgr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/crypto/ccree/cc_buffer_mgr.c +4 -4
@@ -614,10 +614,10 @@ void cc_unmap_aead_request(struct device hw_iv_size, DMA_BIDIRECTIONAL); } -/*In case a pool was set, a table was -*allocated and should be released -*/ -if (areq_ctx->mlli_params.curr_pool) { +/* Release pool */ +if ((areq_ctx->assoc_buff_type ==CC_DMA_BUF_MLLI || + areq_ctx->data_buff_type ==CC_DMA_BUF_MLLI ) && + (areq_ctx->mlli_params.mlli_virt_addr)) {dev_dbg (dev,"free MLLI buffer: dma=%pad virt=%pK\n" , &areq_ctx->mlli_params.mlli_dma_addr, areq_ctx->mlli_params.mlli_virt_addr);
Greg Kroah-Hartman
maintainerPATCH 16/280 crypto: ccree - unmap buffer before copying IV
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gilad Ben-Yossef <[email protected]>
commit c139c72e2beb3e3db5148910b3962b7322e24374 upstream.
We were copying the last ciphertext block into the IV field for CBC before removing the DMA mapping of the output buffer with the result of the buffer sometime being out-of-sync cache wise and were getting intermittent cases of bad output IV.
Fix it by moving the DMA buffer unmapping before the copy.
--- drivers/crypto/ccree/cc_cipher.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/ccree/cc_cipher.c +2 -1
@@ -635,6 +635,8 @@ static void cc_cipher_complete(struct deunsigned int ivsize =crypto_skcipher_ivsize (sk_tfm);unsigned int len; +cc_unmap_cipher_request (dev, req_ctx, ivsize, src, dst); +switch (ctx_p->cipher_mode) {case DRV_CIPHER_CBC :/*
@@ -664,7 +666,6 @@ static void cc_cipher_complete(struct debreak ; } -cc_unmap_cipher_request (dev, req_ctx, ivsize, src, dst);kzfree (req_ctx->iv);skcipher_request_complete (req, err);
Greg Kroah-Hartman
maintainerPATCH 17/280 crypto: ccree - dont copy zero size ciphertext
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gilad Ben-Yossef <[email protected]>
commit 2b5ac17463dcb2411fed506edcf259a89bb538ba upstream.
For decryption in CBC mode we need to save the last ciphertext block for use as the next IV. However, we were trying to do this also with zero sized ciphertext resulting in a panic.
Fix this by only doing the copy if the ciphertext length is at least of IV size.
--- drivers/crypto/ccree/cc_cipher.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/ccree/cc_cipher.c +2 -1
@@ -783,7 +783,8 @@ static int cc_cipher_decrypt(struct skcimemset (req_ctx,0 ,sizeof (*req_ctx)); -if (ctx_p->cipher_mode ==DRV_CIPHER_CBC ) { +if ((ctx_p->cipher_mode ==DRV_CIPHER_CBC ) && + (req->cryptlen >= ivsize)) {/* Allocate and save the last IV sized bytes of the source, * which will be lost in case of in-place decryption.
Greg Kroah-Hartman
maintainerPATCH 18/280 crypto: cfb - add missing chunksize property
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 394a9e044702e6a8958a5e89d2a291605a587a2a upstream.
Like some other block cipher mode implementations, the CFB implementation assumes that while walking through the scatterlist, a partial block does not occur until the end. But the walk is incorrectly being done with a blocksize of 1, as 'cra_blocksize' is set to 1 (since CFB is a stream cipher) but no 'chunksize' is set. This bug causes incorrect encryption/decryption for some scatterlist layouts.
Fix it by setting the 'chunksize'. Also extend the CFB test vectors to cover this bug as well as cases where the message length is not a multiple of the block size.
--- crypto/cfb.c | 6 ++++++ crypto/testmgr.h | 25 +++++++++++++++++++++++++ 2 files changed, 31 insertions(+)
crypto/cfb.c +6 -0
@@ -298,6 +298,12 @@ static int crypto_cfb_create(struct cryp inst->alg.base.cra_blocksize =1 ; inst->alg.base.cra_alignmask = alg->cra_alignmask; +/* +* To simplify the implementation, configure the skcipher walk to only +* give a partial block at the very end, never earlier. +*/ + inst->alg.chunksize = alg->cra_blocksize; + inst->alg.ivsize = alg->cra_blocksize; inst->alg.min_keysize = alg->cra_cipher.cia_min_keysize; inst->alg.max_keysize = alg->cra_cipher.cia_max_keysize;
crypto/testmgr.h +25 -0
@@ -11416,6 +11416,31 @@ static const struct cipher_testvec aes_c "\x75\xa3\x85\x74\x1a\xb9\xce\xf8" "\x20\x31\x62\x3d\x55\xb1\xe4\x71", .len = 64, + .also_non_np = 1, + .np = 2, + .tap = { 31, 33 }, + }, { /* > 16 bytes, not a multiple of 16 bytes */ + .key ="\x2b\x7e\x15\x16\x28\xae\xd2\xa6" +"\xab\xf7\x15\x88\x09\xcf\x4f\x3c" , + .klen = 16, + .iv = "\x00\x01\x02\x03\x04\x05\x06\x07" +"\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" , + .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96" +"\xe9\x3d\x7e\x11\x73\x93\x17\x2a" +"\xae" , + .ctext = "\x3b\x3f\xd9\x2e\xb7\x2d\xad\x20" +"\x33\x34\x49\xf8\xe8\x3c\xfb\x4a" +"\xc8" , + .len = 17, + }, { /* < 16 bytes */ + .key ="\x2b\x7e\x15\x16\x28\xae\xd2\xa6" +"\xab\xf7\x15\x88\x09\xcf\x4f\x3c" , + .klen = 16, + .iv = "\x00\x01\x02\x03\x04\x05\x06\x07" +"\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" , + .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f", + .ctext = "\x3b\x3f\xd9\x2e\xb7\x2d\xad", + .len = 7, }, };
Greg Kroah-Hartman
maintainerPATCH 19/280 crypto: cfb - remove bogus memcpy() with src == dest
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 6c2e322b3621dc8be72e5c86d4fdb587434ba625 upstream.
The memcpy() in crypto_cfb_decrypt_inplace() uses walk->iv as both the source and destination, which has undefined behavior. It is unneeded because walk->iv is already used to hold the previous ciphertext block; thus, walk->iv is already updated to its final value. So, remove it.
Also, note that in-place decryption is the only case where the previous ciphertext block is not directly available. Therefore, as a related cleanup I also updated crypto_cfb_encrypt_segment() to directly use the previous ciphertext block rather than save it into walk->iv. This makes it consistent with in-place encryption and out-of-place decryption; now only in-place decryption is different, because it has to be.
--- crypto/cfb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
crypto/cfb.c +4 -4
@@ -77,12 +77,14 @@ static int crypto_cfb_encrypt_segment(stdo {crypto_cfb_encrypt_one (tfm, iv, dst);crypto_xor (dst, src, bsize); -memcpy (iv, dst, bsize); + iv = dst; src += bsize; dst += bsize; }while ((nbytes -= bsize) >= bsize); +memcpy (walk->iv, iv, bsize); +return nbytes; }
@@ -162,7 +164,7 @@ static int crypto_cfb_decrypt_inplace(stconst unsigned int bsize =crypto_cfb_bsize (tfm);unsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv;u8 tmp[MAX_CIPHER_BLOCKSIZE ]; do {
@@ -172,8 +174,6 @@ static int crypto_cfb_decrypt_inplace(st src += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
Greg Kroah-Hartman
maintainerPATCH 20/280 crypto: ahash - fix another early termination in hash walk
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 77568e535af7c4f97eaef1e555bf0af83772456c upstream.
Hash algorithms with an alignmask set, e.g. "xcbc(aes-aesni)" and "michael_mic", fail the improved hash tests because they sometimes produce the wrong digest. The bug is that in the case where a scatterlist element crosses pages, not all the data is actually hashed because the scatterlist walk terminates too early. This happens because the 'nbytes' variable in crypto_hash_walk_done() is assigned the number of bytes remaining in the page, then later interpreted as the number of bytes remaining in the scatterlist element. Fix it.
--- crypto/ahash.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
crypto/ahash.c +7 -7
@@ -86,17 +86,17 @@ static int hash_walk_new_entry(struct crint crypto_hash_walk_done (struct crypto_hash_walk *walk,int err) {unsigned int alignmask = walk->alignmask; -unsigned int nbytes = walk->entrylen; walk->data -= walk->offset; -if (nbytes && walk->offset & alignmask && !err) { - walk->offset =ALIGN (walk->offset, alignmask +1 ); - nbytes =min (nbytes, - ((unsigned int )(PAGE_SIZE )) - walk->offset); - walk->entrylen -= nbytes; +if (walk->entrylen && (walk->offset & alignmask) && !err) { +unsigned int nbytes; + walk->offset =ALIGN (walk->offset, alignmask +1 ); + nbytes =min (walk->entrylen, + (unsigned int )(PAGE_SIZE - walk->offset));if (nbytes) { + walk->entrylen -= nbytes; walk->data += walk->offset;return nbytes; }
@@ -116,7 +116,7 @@ int crypto_hash_walk_done(struct crypto_if (err)return err; -if (nbytes) { +if (walk->entrylen) { walk->offset =0 ; walk->pg++;return hash_walk_next (walk);
Greg Kroah-Hartman
maintainerPATCH 21/280 crypto: rockchip - fix scatterlist nents error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Zhijie <[email protected]>
commit 4359669a087633132203c52d67dd8c31e09e7b2e upstream.
In some cases, the nents of src scatterlist is different from dst scatterlist. So two variables are used to handle the nents of src&dst scatterlist.
--- drivers/crypto/rockchip/rk3288_crypto.c | 2 +- drivers/crypto/rockchip/rk3288_crypto.h | 3 ++- drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c | 5 +++-- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 2 +- 4 files changed, 7 insertions(+), 5 deletions(-)
drivers/crypto/rockchip/rk3288_crypto.c +1 -1
@@ -119,7 +119,7 @@ static int rk_load_data(struct rk_crypto count = (dev->left_bytes >PAGE_SIZE ) ?PAGE_SIZE : dev->left_bytes; -if (!sg_pcopy_to_buffer (dev->first, dev->nents, +if (!sg_pcopy_to_buffer (dev->first, dev->src_nents, dev->addr_vir, count, dev->total - dev->left_bytes)) { dev_err(dev->dev, "[%s:%d] pcopy err\n",
drivers/crypto/rockchip/rk3288_crypto.h +2 -1
@@ -207,7 +207,8 @@ struct rk_crypto_info {void *addr_vir;int aligned;int align_size; -size_t nents; +size_t src_nents; +size_t dst_nents;unsigned int total;unsigned int count;dma_addr_t addr_in;
drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c +3 -2
@@ -260,8 +260,9 @@ static int rk_ablk_start(struct rk_crypt dev->total = req->nbytes; dev->sg_src = req->src; dev->first = req->src; - dev->nents =sg_nents (req->src); + dev->src_nents =sg_nents (req->src); dev->sg_dst = req->dst; + dev->dst_nents =sg_nents (req->dst); dev->aligned =1 ;spin_lock_irqsave (&dev->lock, flags);
@@ -297,7 +298,7 @@ static int rk_ablk_rx(struct rk_crypto_i dev->unload_data (dev);if (!dev->aligned) { -if (!sg_pcopy_from_buffer (req->dst, dev->nents, +if (!sg_pcopy_from_buffer (req->dst, dev->dst_nents, dev->addr_vir, dev->count, dev->total - dev->left_bytes - dev->count)) {
drivers/crypto/rockchip/rk3288_crypto_ahash.c +1 -1
@@ -206,7 +206,7 @@ static int rk_ahash_start(struct rk_cryp dev->sg_dst =NULL ; dev->sg_src = req->src; dev->first = req->src; - dev->nents =sg_nents (req->src); + dev->src_nents =sg_nents (req->src); rctx =ahash_request_ctx (req); rctx->mode =0 ;
Greg Kroah-Hartman
maintainerPATCH 22/280 crypto: rockchip - update new iv to device in multiple operations
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Zhijie <[email protected]>
commit c1c214adcb56d36433480c8fedf772498e7e539c upstream.
For chain mode in cipher(eg. AES-CBC/DES-CBC), the iv is continuously updated in the operation. The new iv value should be written to device register by software.
--- drivers/crypto/rockchip/rk3288_crypto.h | 1 drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c | 34 +++++++++++++++++++++ 2 files changed, 35 insertions(+)
drivers/crypto/rockchip/rk3288_crypto.h +1 -0
@@ -245,6 +245,7 @@ struct rk_cipher_ctx {struct rk_crypto_info *dev;unsigned int keylen;u32 mode; +u8 iv[AES_BLOCK_SIZE ]; };enum alg_type {
drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c +34 -0
@@ -242,6 +242,17 @@ static void crypto_dma_start(struct rk_cstatic int rk_set_data_start (struct rk_crypto_info *dev) {int err; +struct ablkcipher_request *req = +ablkcipher_request_cast (dev->async_req); +struct crypto_ablkcipher *tfm =crypto_ablkcipher_reqtfm (req); +struct rk_cipher_ctx *ctx =crypto_ablkcipher_ctx (tfm); +u32 ivsize =crypto_ablkcipher_ivsize (tfm); +u8 *src_last_blk =page_address (sg_page (dev->sg_src)) + + dev->sg_src->offset + dev->sg_src->length - ivsize; + +/* store the iv that need to be updated in chain mode */ +if (ctx->mode &RK_CRYPTO_DEC ) +memcpy (ctx->iv, src_last_blk, ivsize); err = dev->load_data (dev, dev->sg_src, dev->sg_dst);if (!err)
@@ -286,6 +297,28 @@ static void rk_iv_copyback(struct rk_crymemcpy_fromio (req->info, dev->reg +RK_CRYPTO_AES_IV_0 , ivsize); } +static void rk_update_iv (struct rk_crypto_info *dev) +{ +struct ablkcipher_request *req = +ablkcipher_request_cast (dev->async_req); +struct crypto_ablkcipher *tfm =crypto_ablkcipher_reqtfm (req); +struct rk_cipher_ctx *ctx =crypto_ablkcipher_ctx (tfm); +u32 ivsize =crypto_ablkcipher_ivsize (tfm); +u8 *new_iv =NULL ; + +if (ctx->mode &RK_CRYPTO_DEC ) { + new_iv = ctx->iv; + }else { + new_iv =page_address (sg_page (dev->sg_dst)) + + dev->sg_dst->offset + dev->sg_dst->length - ivsize; + } + +if (ivsize ==DES_BLOCK_SIZE ) +memcpy_toio (dev->reg +RK_CRYPTO_TDES_IV_0 , new_iv, ivsize); +else if (ivsize ==AES_BLOCK_SIZE ) +memcpy_toio (dev->reg +RK_CRYPTO_AES_IV_0 , new_iv, ivsize); +} +/* return: * true some err was occurred * fault no err, continue
@@ -307,6 +340,7 @@ static int rk_ablk_rx(struct rk_crypto_i } }if (dev->left_bytes) { +rk_update_iv (dev);if (dev->aligned) {if (sg_is_last (dev->sg_src)) { dev_err(dev->dev, "[%s:%d] Lack of data\n",
Greg Kroah-Hartman
maintainerPATCH 23/280 drm/imx: ignore plane updates on disabled crtcs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4fb873c9648e383206e0a91cef9b03aa54066aca ]
This patch fixes backtraces like the following when sending SIGKILL to a process with a currently pending plane update:
[drm:ipu_plane_atomic_check] CRTC should be enabled
[drm:drm_framebuffer_remove] *ERROR* failed to commit
------------[ cut here ]------------
WARNING: CPU: 3 PID: 63 at drivers/gpu/drm/drm_framebuffer.c:926 drm_framebuffer_remove+0x47c/0x498 atomic remove_fb failed with -22
--- drivers/gpu/drm/imx/ipuv3-plane.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/imx/ipuv3-plane.c +2 -2
@@ -375,9 +375,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,if (ret)return ret; -/* CRTC should be enabled */ +/* nothing to check when disabling or disabled */ if (!crtc_state->enable) -return -EINVAL ; +return 0 ;switch (plane->type) {case DRM_PLANE_TYPE_PRIMARY :
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 24/280 gpu: ipu-v3: Fix i.MX51 CSI control registers offset
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2c0408dd0d8906b26fe8023889af7adf5e68b2c2 ]
The CSI0/CSI1 registers offset is at +0xe030000/+0xe038000 relative to the control module registers on IPUv3EX.
This patch fixes wrong values for i.MX51 CSI0/CSI1.
--- drivers/gpu/ipu-v3/ipu-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/ipu-v3/ipu-common.c +2 -2
@@ -898,8 +898,8 @@ static struct ipu_devtype ipu_type_imx51 = { .cpmem_ofs = 0x1f000000, .srm_ofs = 0x1f040000, .tpm_ofs = 0x1f060000, - .csi0_ofs = 0x1f030000, - .csi1_ofs = 0x1f038000, + .csi0_ofs = 0x1e030000, + .csi1_ofs = 0x1e038000, .ic_ofs = 0x1e020000, .disp0_ofs = 0x1e040000, .disp1_ofs = 0x1e048000,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 25/280 drm/imx: imx-ldb: add missing of_node_puts
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit aa3312012f103f91f123600bbf768b11c8f431bc ]
The device node iterators perform an of_node_get on each iteration, so a jump out of the loop requires an of_node_put.
Move the initialization channel->child = child; down to just before the call to imx_ldb_register so that intervening failures don't need to clear it. Add a label at the end of the function to do all the of_node_puts.
The semantic patch that finds part of this problem is as follows
(http://coccinelle.lip6.fr):
// <smpl>
@@
expression root,e;
local idexpression child;
iterator name for_each_child_of_node;
@@
for_each_child_of_node(root, child) {
... when != of_node_put(child)
when != e = child
(
return child;
|
* return ...;
)
...
}
// </smpl>
--- drivers/gpu/drm/imx/imx-ldb.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
drivers/gpu/drm/imx/imx-ldb.c +17 -8
@@ -651,8 +651,10 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)int bus_format; ret =of_property_read_u32 (child,"reg" , &i); -if (ret || i <0 || i >1 ) -return -EINVAL ; +if (ret || i <0 || i >1 ) { + ret = -EINVAL ; + goto free_child; + }if (!of_device_is_available (child))continue ;
@@ -665,7 +667,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) channel = &imx_ldb->channel[i]; channel->ldb = imx_ldb; channel->chno = i; - channel->child = child;/* * The output port is port@4 with an external 4-port mux or
@@ -675,13 +676,13 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) imx_ldb->lvds_mux ?4 :2 ,0 , &channel->panel, &channel->bridge);if (ret && ret != -ENODEV ) -return ret; + goto free_child;/* panel ddc only if there is no bridge */ if (!channel->bridge) { ret =imx_ldb_panel_ddc (dev, channel, child);if (ret) -return ret; + goto free_child; } bus_format =of_get_bus_format (dev, child);
@@ -697,18 +698,26 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)if (bus_format <0 ) {dev_err (dev,"could not determine data mapping: %d\n" , bus_format); -return bus_format; + ret = bus_format; + goto free_child; } channel->bus_format = bus_format; + channel->child = child; ret =imx_ldb_register (drm, channel); -if (ret) -return ret; +if (ret) { + channel->child =NULL ; + goto free_child; + } }dev_set_drvdata (dev, imx_ldb);return 0 ; + +free_child: +of_node_put (child); +return ret; } static void imx_ldb_unbind(struct device *dev, struct device *master,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 26/280 gpu: ipu-v3: Fix CSI offsets for imx53
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit bb867d219fda7fbaabea3314702474c4eac2b91d ]
The CSI offsets are wrong for both CSI0 and CSI1. They are at physical address 0x1e030000 and 0x1e038000 respectively.
--- drivers/gpu/ipu-v3/ipu-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/ipu-v3/ipu-common.c +2 -2
@@ -914,8 +914,8 @@ static struct ipu_devtype ipu_type_imx53 = { .cpmem_ofs = 0x07000000, .srm_ofs = 0x07040000, .tpm_ofs = 0x07060000, - .csi0_ofs = 0x07030000, - .csi1_ofs = 0x07038000, + .csi0_ofs = 0x06030000, + .csi1_ofs = 0x06038000, .ic_ofs = 0x06020000, .disp0_ofs = 0x06040000, .disp1_ofs = 0x06048000,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 27/280 ASoC: rt5682: Correct the setting while select ASRC clk for AD/DA filter
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8077ec011b1ea26abb7ca786f28ecccfb352717f ]
AD/DA ASRC function control two ASRC clock sources separately. Whether AD/DA filter select which clock source, we enable AD/DA ASRC function for all cases.
--- sound/soc/codecs/rt5682.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/rt5682.c +2 -0
@@ -1757,7 +1757,9 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = { {"ADC Stereo1 Filter", NULL, "ADC STO1 ASRC", is_using_asrc}, {"DAC Stereo1 Filter", NULL, "DAC STO1 ASRC", is_using_asrc}, {"ADC STO1 ASRC", NULL, "AD ASRC"}, + {"ADC STO1 ASRC", NULL, "DA ASRC"}, {"ADC STO1 ASRC", NULL, "CLKDET"}, + {"DAC STO1 ASRC", NULL, "AD ASRC"}, {"DAC STO1 ASRC", NULL, "DA ASRC"}, {"DAC STO1 ASRC", NULL, "CLKDET"},
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 28/280 clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck reparenting
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 983a5a43ec254cd5ddf3254db80ca96e8f8bb2a4 ]
Commit 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc") moved some omap4 timers to probe with ti-sysc interconnect target module. Turns out this broke pwm-omap-dmtimer where we now try to reparent the clock to itself with the following:
omap_dm_timer_of_set_source: failed to set parent
With ti-sysc, we can now configure the clock sources in the dts with assigned-clocks and assigned-clock-parents. So we should be able to remove omap_dm_timer_of_set_source with clean-up patches later on. But for now, let's just fix it first by checking if parent and fck are the same and bail out of so.
--- drivers/clocksource/timer-ti-dm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/clocksource/timer-ti-dm.c +4 -0
@@ -154,6 +154,10 @@ static int omap_dm_timer_of_set_source(struct omap_dm_timer *timer)if (IS_ERR (parent))return -ENODEV ; +/* Bail out if both clocks point to fck */ +if (clk_is_match (parent, timer->fclk)) +return 0 ; + ret =clk_set_parent (timer->fclk, parent);if (ret <0 )pr_err ("%s: failed to set parent\n" , __func__);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 29/280 KVM: arm/arm64: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fc3bc475231e12e9c0142f60100cf84d077c79e1 ]
vgic_dist->lpi_list_lock must always be taken with interrupts disabled as it is used in interrupt context.
For configurations such as PREEMPT_RT_FULL, this means that it should be a raw_spinlock since RT spinlocks are interruptible.
--- include/kvm/arm_vgic.h | 2 +- virt/kvm/arm/vgic/vgic-init.c | 2 +- virt/kvm/arm/vgic/vgic-its.c | 8 ++++---- virt/kvm/arm/vgic/vgic.c | 10 +++++----- 4 files changed, 11 insertions(+), 11 deletions(-)
include/kvm/arm_vgic.h +1 -1
@@ -256,7 +256,7 @@ struct vgic_dist {u64 propbaser;/* Protects the lpi_list and the count value below. */ -spinlock_t lpi_list_lock; +raw_spinlock_t lpi_list_lock;struct list_head lpi_list_head;int lpi_list_count;
virt/kvm/arm/vgic/vgic-init.c +1 -1
@@ -64,7 +64,7 @@ void kvm_vgic_early_init(struct kvm *kvm)struct vgic_dist *dist = &kvm->arch.vgic;INIT_LIST_HEAD (&dist->lpi_list_head); -spin_lock_init (&dist->lpi_list_lock); +raw_spin_lock_init (&dist->lpi_list_lock); }/* CREATION */
virt/kvm/arm/vgic/vgic-its.c +4 -4
@@ -73,7 +73,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid, irq->target_vcpu = vcpu; irq->group =1 ; -spin_lock_irqsave (&dist->lpi_list_lock, flags); +raw_spin_lock_irqsave (&dist->lpi_list_lock, flags);/* * There could be a race with another vgic_add_lpi(), so we need to
@@ -101,7 +101,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid, dist->lpi_list_count++; out_unlock: -spin_unlock_irqrestore (&dist->lpi_list_lock, flags); +raw_spin_unlock_irqrestore (&dist->lpi_list_lock, flags);/* * We "cache" the configuration table entries in our struct vgic_irq's.
@@ -339,7 +339,7 @@ int vgic_copy_lpi_list(struct kvm *kvm, struct kvm_vcpu *vcpu, u32 **intid_ptr)if (!intids)return -ENOMEM ; -spin_lock_irqsave (&dist->lpi_list_lock, flags); +raw_spin_lock_irqsave (&dist->lpi_list_lock, flags);list_for_each_entry (irq, &dist->lpi_list_head, lpi_list) {if (i == irq_count)break ;
@@ -348,7 +348,7 @@ int vgic_copy_lpi_list(struct kvm *kvm, struct kvm_vcpu *vcpu, u32 **intid_ptr)continue ; intids[i++] = irq->intid; } -spin_unlock_irqrestore (&dist->lpi_list_lock, flags); +raw_spin_unlock_irqrestore (&dist->lpi_list_lock, flags); *intid_ptr = intids;return i;
virt/kvm/arm/vgic/vgic.c +5 -5
@@ -72,7 +72,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid)struct vgic_irq *irq =NULL ;unsigned long flags; -spin_lock_irqsave (&dist->lpi_list_lock, flags); +raw_spin_lock_irqsave (&dist->lpi_list_lock, flags);list_for_each_entry (irq, &dist->lpi_list_head, lpi_list) {if (irq->intid != intid)
@@ -88,7 +88,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid) irq =NULL ; out_unlock: -spin_unlock_irqrestore (&dist->lpi_list_lock, flags); +raw_spin_unlock_irqrestore (&dist->lpi_list_lock, flags);return irq; }
@@ -138,15 +138,15 @@ void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)if (irq->intid <VGIC_MIN_LPI )return ; -spin_lock_irqsave (&dist->lpi_list_lock, flags); +raw_spin_lock_irqsave (&dist->lpi_list_lock, flags);if (!kref_put (&irq->refcount, vgic_irq_release)) { -spin_unlock_irqrestore (&dist->lpi_list_lock, flags); +raw_spin_unlock_irqrestore (&dist->lpi_list_lock, flags);return ; };list_del (&irq->lpi_list); dist->lpi_list_count--; -spin_unlock_irqrestore (&dist->lpi_list_lock, flags); +raw_spin_unlock_irqrestore (&dist->lpi_list_lock, flags);kfree (irq); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 30/280 arm64: dts: rockchip: fix graph_port warning on rk3399 bob kevin and excavator
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 26cd8657c7e745686a4c54a5cccf721ede208a25 ]
Ports are described by child 'port' nodes contained in the device node. 'ports' is optional and is used to group all 'port' nodes which is not the case here.
This patch fixes the following warnings:
arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts:25.9-29.5: Warning (graph_port): /edp-panel/ports: graph port node name should be 'port' arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts:46.9-50.5: Warningi (graph_port): /edp-panel/ports: graph port node name should be 'port' arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts:94.9-98.5: Warning (graph_port): /edp-panel/ports: graph port node name should be 'port'
--- arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts +1 -1
@@ -22,7 +22,7 @@ backlight = <&backlight>; power-supply = <&pp3300_disp>; - ports { + port { panel_in_edp: endpoint { remote-endpoint = <&edp_out_panel>; };
arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts +1 -1
@@ -43,7 +43,7 @@ backlight = <&backlight>; power-supply = <&pp3300_disp>; - ports { + port { panel_in_edp: endpoint { remote-endpoint = <&edp_out_panel>; };
arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +1 -1
@@ -50,7 +50,7 @@ pinctrl-0 = <&lcd_panel_reset>; power-supply = <&vcc3v3_s0>; - ports { + port { panel_in_edp: endpoint { remote-endpoint = <&edp_out_panel>; };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 31/280 s390/dasd: fix using offset into zero size array error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4a8ef6999bce998fa5813023a9a6b56eea329dba ]
Dan Carpenter reported the following:
The patch 52898025cf7d: "[S390] dasd: security and PSF update patch for EMC CKD ioctl" from Mar 8, 2010, leads to the following static checker warning:
drivers/s390/block/dasd_eckd.c:4486 dasd_symm_io() error: using offset into zero size array 'psf_data[]'
drivers/s390/block/dasd_eckd.c
4458 /* Copy parms from caller */
4459 rc = -EFAULT;
4460 if (copy_from_user(&usrparm, argp, sizeof(usrparm)))
^^^^^^^The user can specify any "usrparm.psf_data_len". They choose zero by mistake.
4461 goto out;
4462 if (is_compat_task()) {
4463 /* Make sure pointers are sane even on 31 bit. */ 4464 rc = -EINVAL; 4465 if ((usrparm.psf_data >> 32) != 0) 4466 goto out; 4467 if ((usrparm.rssd_result >> 32) != 0) 4468 goto out; 4469 usrparm.psf_data &= 0x7fffffffULL; 4470 usrparm.rssd_result &= 0x7fffffffULL; 4471 } 4472 /* alloc I/O data area */ 4473 psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA); 4474 rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
4475 if (!psf_data || !rssd_result) {
kzalloc() returns a ZERO_SIZE_PTR (0x16).
4476 rc = -ENOMEM; 4477 goto out_free; 4478 } 4479 4480 /* get syscall header from user space */ 4481 rc = -EFAULT; 4482 if (copy_from_user(psf_data, 4483 (void __user *)(unsigned long) usrparm.psf_data, 4484 usrparm.psf_data_len))
That all works great.
4485 goto out_free; 4486 psf0 = psf_data[0]; 4487 psf1 = psf_data[1];
But now we're assuming that "->psf_data_len" was at least 2 bytes.
Fix this by checking the user specified length psf_data_len.
--- drivers/s390/block/dasd_eckd.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/s390/block/dasd_eckd.c +8 -0
@@ -4469,6 +4469,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp) usrparm.psf_data &=0x7fffffffULL ; usrparm.rssd_result &=0x7fffffffULL ; } +/* at least 2 bytes are accessed and should be allocated */ +if (usrparm.psf_data_len <2 ) { +DBF_DEV_EVENT (DBF_WARNING , device, +"Symmetrix ioctl invalid data length %d" , + usrparm.psf_data_len); + rc = -EINVAL ; + goto out; + }/* alloc I/O data area */ psf_data =kzalloc (usrparm.psf_data_len,GFP_KERNEL |GFP_DMA ); rssd_result =kzalloc (usrparm.rssd_result_len,GFP_KERNEL |GFP_DMA );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 32/280 Input: pwm-vibra - prevent unbalanced regulator
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 3ca232df9921f083c3b37ba5fbc76f4d9046268b ]
pwm_vibrator_stop disables the regulator, but it can be called from multiple places, even when the regulator is already disabled. Fix this by using regulator_is_enabled check when starting and stopping device.
--- drivers/input/misc/pwm-vibra.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/input/misc/pwm-vibra.c +12 -5
@@ -34,6 +34,7 @@ struct pwm_vibrator {struct work_struct play_work;u16 level;u32 direction_duty_cycle; +bool vcc_on; };static int pwm_vibrator_start (struct pwm_vibrator *vibrator)
@@ -42,10 +43,13 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)struct pwm_state state;int err; - err =regulator_enable (vibrator->vcc); -if (err) { -dev_err (pdev,"failed to enable regulator: %d" , err); -return err; +if (!vibrator->vcc_on) { + err =regulator_enable (vibrator->vcc); +if (err) { +dev_err (pdev,"failed to enable regulator: %d" , err); +return err; + } + vibrator->vcc_on = true; }pwm_get_state (vibrator->pwm, &state);
@@ -76,7 +80,10 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)static void pwm_vibrator_stop (struct pwm_vibrator *vibrator) { -regulator_disable (vibrator->vcc); +if (vibrator->vcc_on) { +regulator_disable (vibrator->vcc); + vibrator->vcc_on = false; + }if (vibrator->pwm_dir)pwm_disable (vibrator->pwm_dir);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 33/280 Input: pwm-vibra - stop regulator after disabling pwm, not before
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 94803aef3533676194c772383472636c453e3147 ]
This patch fixes order of disable calls in pwm_vibrator_stop. Currently when starting device, we first enable vcc regulator and then setup and enable pwm. When stopping, we should do this in oposite order, so first disable pwm and then disable regulator.
Previously order was the same as in start.
--- drivers/input/misc/pwm-vibra.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/input/misc/pwm-vibra.c +4 -4
@@ -80,14 +80,14 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)static void pwm_vibrator_stop (struct pwm_vibrator *vibrator) { +if (vibrator->pwm_dir) +pwm_disable (vibrator->pwm_dir); +pwm_disable (vibrator->pwm); +if (vibrator->vcc_on) {regulator_disable (vibrator->vcc); vibrator->vcc_on = false; } - -if (vibrator->pwm_dir) -pwm_disable (vibrator->pwm_dir); -pwm_disable (vibrator->pwm); }static void pwm_vibrator_play_work (struct work_struct *work)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 34/280 ARM: dts: Configure clock parent for pwm vibra
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0840242e887586268f665bf58d5e1a7d6ebf35ed ]
Commit 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc") moved some omap4 timers to probe with ti-sysc interconnect target module. Turns out this broke pwm-omap-dmtimer for reparenting of the timer clock.
With ti-sysc, we can now configure the clock sources in the dts with assigned-clocks and assigned-clock-parents.
--- arch/arm/boot/dts/omap4-droid4-xt894.dts | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/arm/boot/dts/omap4-droid4-xt894.dts +11 -0
@@ -644,6 +644,17 @@ }; }; +/* Configure pwm clock source for timers 8 & 9 */ +&timer8 { + assigned-clocks = <&abe_clkctrl OMAP4_TIMER8_CLKCTRL 24>; + assigned-clock-parents = <&sys_clkin_ck>; +}; + +&timer9 { + assigned-clocks = <&l4_per_clkctrl OMAP4_TIMER9_CLKCTRL 24>; + assigned-clock-parents = <&sys_clkin_ck>; +}; + /* * As uart1 is wired to mdm6600 with rts and cts, we can use the cts pin for * uart1 wakeirq.
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 35/280 ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dc30e70391376ba3987aeb856ae6d9c0706534f1 ]
In function omap4_dsi_mux_pads(), local variable "reg" could be uninitialized if function regmap_read() returns -EINVAL. However, it will be used directly in the later context, which is potentially unsafe.
--- arch/arm/mach-omap2/display.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/display.c +6 -1
@@ -83,6 +83,7 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)u32 enable_mask, enable_shift;u32 pipd_mask, pipd_shift;u32 reg; +int ret;if (dsi_id ==0 ) { enable_mask =OMAP4_DSI1_LANEENABLE_MASK ;
@@ -98,7 +99,11 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)return -ENODEV ; } -regmap_read (omap4_dsi_mux_syscon,OMAP4_DSIPHY_SYSCON_OFFSET , ®); + ret =regmap_read (omap4_dsi_mux_syscon, +OMAP4_DSIPHY_SYSCON_OFFSET , + ®); +if (ret) +return ret; reg &= ~enable_mask; reg &= ~pipd_mask;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 36/280 ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c16e12010060c6c7a31f08b4a99513064cb53b7d ]
KASAN reports and additional traces point to out-of-bounds accesses to the dapm_up_seq and dapm_down_seq lookup tables. The indices used are larger than the array definition.
Fix by adding missing entries for the new widget types in these two lookup tables, and align them with PGA values.
Also the sequences for the following widgets were not defined. Since their values defaulted to zero, assign them explicitly
snd_soc_dapm_input
snd_soc_dapm_output
snd_soc_dapm_vmid
snd_soc_dapm_siggen
snd_soc_dapm_sink
--- sound/soc/soc-dapm.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
sound/soc/soc-dapm.c +24 -0
@@ -71,12 +71,16 @@ static int dapm_up_seq[] = { [snd_soc_dapm_clock_supply] = 1, [snd_soc_dapm_supply] = 2, [snd_soc_dapm_micbias] = 3, + [snd_soc_dapm_vmid] = 3, [snd_soc_dapm_dai_link] = 2, [snd_soc_dapm_dai_in] = 4, [snd_soc_dapm_dai_out] = 4, [snd_soc_dapm_aif_in] = 4, [snd_soc_dapm_aif_out] = 4, [snd_soc_dapm_mic] = 5, + [snd_soc_dapm_siggen] = 5, + [snd_soc_dapm_input] = 5, + [snd_soc_dapm_output] = 5, [snd_soc_dapm_mux] = 6, [snd_soc_dapm_demux] = 6, [snd_soc_dapm_dac] = 7,
@@ -84,11 +88,19 @@ static int dapm_up_seq[] = { [snd_soc_dapm_mixer] = 8, [snd_soc_dapm_mixer_named_ctl] = 8, [snd_soc_dapm_pga] = 9, + [snd_soc_dapm_buffer] = 9, + [snd_soc_dapm_scheduler] = 9, + [snd_soc_dapm_effect] = 9, + [snd_soc_dapm_src] = 9, + [snd_soc_dapm_asrc] = 9, + [snd_soc_dapm_encoder] = 9, + [snd_soc_dapm_decoder] = 9, [snd_soc_dapm_adc] = 10, [snd_soc_dapm_out_drv] = 11, [snd_soc_dapm_hp] = 11, [snd_soc_dapm_spk] = 11, [snd_soc_dapm_line] = 11, + [snd_soc_dapm_sink] = 11, [snd_soc_dapm_kcontrol] = 12, [snd_soc_dapm_post] = 13, };
@@ -101,13 +113,25 @@ static int dapm_down_seq[] = { [snd_soc_dapm_spk] = 3, [snd_soc_dapm_line] = 3, [snd_soc_dapm_out_drv] = 3, + [snd_soc_dapm_sink] = 3, [snd_soc_dapm_pga] = 4, + [snd_soc_dapm_buffer] = 4, + [snd_soc_dapm_scheduler] = 4, + [snd_soc_dapm_effect] = 4, + [snd_soc_dapm_src] = 4, + [snd_soc_dapm_asrc] = 4, + [snd_soc_dapm_encoder] = 4, + [snd_soc_dapm_decoder] = 4, [snd_soc_dapm_switch] = 5, [snd_soc_dapm_mixer_named_ctl] = 5, [snd_soc_dapm_mixer] = 5, [snd_soc_dapm_dac] = 6, [snd_soc_dapm_mic] = 7, + [snd_soc_dapm_siggen] = 7, + [snd_soc_dapm_input] = 7, + [snd_soc_dapm_output] = 7, [snd_soc_dapm_micbias] = 8, + [snd_soc_dapm_vmid] = 8, [snd_soc_dapm_mux] = 9, [snd_soc_dapm_demux] = 9, [snd_soc_dapm_aif_in] = 10,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 37/280 ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d9111d36024de07784f2e1ba2ccf70b16035f378 ]
commit 4d230d1271064 ("ASoC: rsnd: fixup not to call clk_get/set under non-atomic") added new rsnd_ssi_prepare() and moved rsnd_ssi_master_clk_start() to .prepare.
But, ssi user count (= ssi->usrcnt) is incremented at .init (= rsnd_ssi_init()).
Because of these timing exchange, ssi->usrcnt check at rsnd_ssi_master_clk_start() should be adjusted. Otherwise, 2nd master clock setup will be no check. This patch fixup this issue.
--- sound/soc/sh/rcar/ssi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sh/rcar/ssi.c +1 -1
@@ -283,7 +283,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,if (rsnd_ssi_is_multi_slave (mod, io))return 0 ; -if (ssi->usrcnt >1 ) { +if (ssi->usrcnt >0 ) {if (ssi->rate != rate) {dev_err (dev,"SSI parent/child should use same rate\n" );return -EINVAL ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 38/280 KVM: arm/arm64: Reset the VCPU without preemption and vcpu state loaded
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e761a927bc9a7ee6ceb7c4f63d5922dbced87f0d ]
We have two ways to reset a vcpu:
- either through VCPU_INIT
- or through a PSCI_ON call
The first one is easy to reason about. The second one is implemented in a more bizarre way, as it is the vcpu that handles PSCI_ON that resets the vcpu that is being powered-on. As we need to turn the logic around and have the target vcpu to reset itself, we must take some preliminary steps.
Resetting the VCPU state modifies the system register state in memory, but this may interact with vcpu_load/vcpu_put if running with preemption disabled, which in turn may lead to corrupted system register state.
Address this by disabling preemption and doing put/load if required around the reset logic.
--- arch/arm64/kvm/reset.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-)
arch/arm64/kvm/reset.c +24 -2
@@ -99,16 +99,33 @@ int kvm_arch_dev_ioctl_check_extension(struct kvm *kvm, long ext)* This function finds the right table above and sets the registers on * the virtual CPU struct to their architecturally defined reset * values. +* +* Note: This function can be called from two paths: The KVM_ARM_VCPU_INIT +* ioctl or as part of handling a request issued by another VCPU in the PSCI +* handling code. In the first case, the VCPU will not be loaded, and in the +* second case the VCPU will be loaded. Because this function operates purely +* on the memory-backed valus of system registers, we want to do a full put if +* we were loaded (handling a request) and load the values back at the end of +* the function. Otherwise we leave the state alone. In both cases, we +* disable preemption around the vcpu reset as we would otherwise race with +* preempt notifiers which also call put/load. */ int kvm_reset_vcpu (struct kvm_vcpu *vcpu) {const struct kvm_regs *cpu_reset; +int ret = -EINVAL ; +bool loaded; + +preempt_disable (); + loaded = (vcpu->cpu !=-1 ); +if (loaded) +kvm_arch_vcpu_put (vcpu);switch (vcpu->arch.target) {default :if (test_bit (KVM_ARM_VCPU_EL1_32BIT , vcpu->arch.features)) {if (!cpu_has_32bit_el1 ()) -return -EINVAL ; + goto out; cpu_reset = &default_regs_reset32; }else { cpu_reset = &default_regs_reset;
@@ -131,5 +148,10 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu) vcpu->arch.workaround_flags |=VCPU_WORKAROUND_2_FLAG ;/* Reset timer */ -return kvm_timer_vcpu_reset (vcpu); + ret =kvm_timer_vcpu_reset (vcpu); +out: +if (loaded) +kvm_arch_vcpu_load (vcpu,smp_processor_id ()); +preempt_enable (); +return ret; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 39/280 arm/arm64: KVM: Allow a VCPU to fully reset itself
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 358b28f09f0ab074d781df72b8a671edb1547789 ]
The current kvm_psci_vcpu_on implementation will directly try to manipulate the state of the VCPU to reset it. However, since this is not done on the thread that runs the VCPU, we can end up in a strangely corrupted state when the source and target VCPUs are running at the same time.
Fix this by factoring out all reset logic from the PSCI implementation and forwarding the required information along with a request to the target VCPU.
--- arch/arm/include/asm/kvm_host.h | 10 +++++++++ arch/arm/kvm/reset.c | 24 +++++++++++++++++++++ arch/arm64/include/asm/kvm_host.h | 11 ++++++++++ arch/arm64/kvm/reset.c | 24 +++++++++++++++++++++ virt/kvm/arm/arm.c | 10 +++++++++ virt/kvm/arm/psci.c | 36 ++++++++++++++----------------- 6 files changed, 95 insertions(+), 20 deletions(-)
arch/arm/include/asm/kvm_host.h +10 -0
@@ -48,6 +48,7 @@#define KVM_REQ_SLEEP \ KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)#define KVM_REQ_IRQ_PENDING KVM_ARCH_REQ(1) +#define KVM_REQ_VCPU_RESET KVM_ARCH_REQ(2)DECLARE_STATIC_KEY_FALSE (userspace_irqchip_in_use);
@@ -147,6 +148,13 @@ struct kvm_cpu_context {typedef struct kvm_cpu_context kvm_cpu_context_t ; +struct vcpu_reset_state { +unsigned long pc; +unsigned long r0; +bool be; +bool reset; +}; +struct kvm_vcpu_arch {struct kvm_cpu_context ctxt;
@@ -186,6 +194,8 @@ struct kvm_vcpu_arch {/* Cache some mmu pages needed inside spinlock regions */ struct kvm_mmu_memory_cache mmu_page_cache; +struct vcpu_reset_state reset_state; +/* Detect first run of a vcpu */ bool has_run_once; };
arch/arm/kvm/reset.c +24 -0
@@ -26,6 +26,7 @@#include <asm/cputype.h> #include <asm/kvm_arm.h> #include <asm/kvm_coproc.h> +#include <asm/kvm_emulate.h> #include <kvm/arm_arch_timer.h>
@@ -69,6 +70,29 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)/* Reset CP15 registers */ kvm_reset_coprocs (vcpu); +/* +* Additional reset state handling that PSCI may have imposed on us. +* Must be done after all the sys_reg reset. +*/ +if (READ_ONCE (vcpu->arch.reset_state.reset)) { +unsigned long target_pc = vcpu->arch.reset_state.pc; + +/* Gracefully handle Thumb2 entry point */ +if (target_pc &1 ) { + target_pc &= ~1UL ; +vcpu_set_thumb (vcpu); + } + +/* Propagate caller endianness */ +if (vcpu->arch.reset_state.be) +kvm_vcpu_set_be (vcpu); + + *vcpu_pc (vcpu) = target_pc; +vcpu_set_reg (vcpu,0 , vcpu->arch.reset_state.r0); + + vcpu->arch.reset_state.reset = false; + } +/* Reset arch_timer context */ return kvm_timer_vcpu_reset (vcpu); }
arch/arm64/include/asm/kvm_host.h +11 -0
@@ -48,6 +48,7 @@#define KVM_REQ_SLEEP \ KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)#define KVM_REQ_IRQ_PENDING KVM_ARCH_REQ(1) +#define KVM_REQ_VCPU_RESET KVM_ARCH_REQ(2)DECLARE_STATIC_KEY_FALSE (userspace_irqchip_in_use);
@@ -206,6 +207,13 @@ struct kvm_cpu_context {typedef struct kvm_cpu_context kvm_cpu_context_t ; +struct vcpu_reset_state { +unsigned long pc; +unsigned long r0; +bool be; +bool reset; +}; +struct kvm_vcpu_arch {struct kvm_cpu_context ctxt;
@@ -295,6 +303,9 @@ struct kvm_vcpu_arch {/* Virtual SError ESR to restore when HCR_EL2.VSE is set */ u64 vsesr_el2; +/* Additional reset state */ +struct vcpu_reset_state reset_state; +/* True when deferrable sysregs are loaded on the physical CPU, * see kvm_vcpu_load_sysregs and kvm_vcpu_put_sysregs. */ bool sysregs_loaded_on_cpu;
arch/arm64/kvm/reset.c +24 -0
@@ -31,6 +31,7 @@#include <asm/kvm_arm.h> #include <asm/kvm_asm.h> #include <asm/kvm_coproc.h> +#include <asm/kvm_emulate.h> #include <asm/kvm_mmu.h> /*
@@ -140,6 +141,29 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)/* Reset system registers */ kvm_reset_sys_regs (vcpu); +/* +* Additional reset state handling that PSCI may have imposed on us. +* Must be done after all the sys_reg reset. +*/ +if (vcpu->arch.reset_state.reset) { +unsigned long target_pc = vcpu->arch.reset_state.pc; + +/* Gracefully handle Thumb2 entry point */ +if (vcpu_mode_is_32bit (vcpu) && (target_pc &1 )) { + target_pc &= ~1UL ; +vcpu_set_thumb (vcpu); + } + +/* Propagate caller endianness */ +if (vcpu->arch.reset_state.be) +kvm_vcpu_set_be (vcpu); + + *vcpu_pc (vcpu) = target_pc; +vcpu_set_reg (vcpu,0 , vcpu->arch.reset_state.r0); + + vcpu->arch.reset_state.reset = false; + } +/* Reset PMU */ kvm_pmu_vcpu_reset (vcpu);
virt/kvm/arm/arm.c +10 -0
@@ -624,6 +624,13 @@ static void vcpu_req_sleep(struct kvm_vcpu *vcpu)/* Awaken to handle a signal, request we sleep again later. */ kvm_make_request (KVM_REQ_SLEEP , vcpu); } + +/* +* Make sure we will observe a potential reset request if we've +* observed a change to the power state. Pairs with the smp_wmb() in +* kvm_psci_vcpu_on(). +*/ +smp_rmb (); }static int kvm_vcpu_initialized (struct kvm_vcpu *vcpu)
@@ -637,6 +644,9 @@ static void check_vcpu_requests(struct kvm_vcpu *vcpu)if (kvm_check_request (KVM_REQ_SLEEP , vcpu))vcpu_req_sleep (vcpu); +if (kvm_check_request (KVM_REQ_VCPU_RESET , vcpu)) +kvm_reset_vcpu (vcpu); +/* * Clear IRQ_PENDING requests that were made to guarantee * that a VCPU sees new virtual interrupts.
virt/kvm/arm/psci.c +16 -20
@@ -104,12 +104,10 @@ static void kvm_psci_vcpu_off(struct kvm_vcpu *vcpu)static unsigned long kvm_psci_vcpu_on (struct kvm_vcpu *source_vcpu) { +struct vcpu_reset_state *reset_state;struct kvm *kvm = source_vcpu->kvm;struct kvm_vcpu *vcpu =NULL ; -struct swait_queue_head *wq;unsigned long cpu_id; -unsigned long context_id; -phys_addr_t target_pc; cpu_id =smccc_get_arg1 (source_vcpu) &MPIDR_HWID_BITMASK ;if (vcpu_mode_is_32bit (source_vcpu))
@@ -130,32 +128,30 @@ static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)return PSCI_RET_INVALID_PARAMS ; } - target_pc =smccc_get_arg2 (source_vcpu); - context_id =smccc_get_arg3 (source_vcpu); + reset_state = &vcpu->arch.reset_state; -kvm_reset_vcpu (vcpu); - -/* Gracefully handle Thumb2 entry point */ -if (vcpu_mode_is_32bit (vcpu) && (target_pc &1 )) { - target_pc &= ~((phys_addr_t )1 ); -vcpu_set_thumb (vcpu); - } + reset_state->pc =smccc_get_arg2 (source_vcpu);/* Propagate caller endianness */ -if (kvm_vcpu_is_be (source_vcpu)) -kvm_vcpu_set_be (vcpu); + reset_state->be =kvm_vcpu_is_be (source_vcpu); - *vcpu_pc (vcpu) = target_pc;/* * NOTE: We always update r0 (or x0) because for PSCI v0.1 * the general puspose registers are undefined upon CPU_ON. */ -smccc_set_retval (vcpu, context_id,0 ,0 ,0 ); - vcpu->arch.power_off = false; -smp_mb ();/* Make sure the above is visible */ + reset_state->r0 =smccc_get_arg3 (source_vcpu); + +WRITE_ONCE (reset_state->reset, true); +kvm_make_request (KVM_REQ_VCPU_RESET , vcpu); - wq =kvm_arch_vcpu_wq (vcpu); -swake_up_one (wq); +/* +* Make sure the reset request is observed if the change to +* power_state is observed. +*/ +smp_wmb (); + + vcpu->arch.power_off = false; +kvm_vcpu_wake_up (vcpu);return PSCI_RET_SUCCESS ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 40/280 arm/arm64: KVM: Dont panic on failure to properly reset system registers
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 20589c8cc47dce5854c8bf1b44a9fc63d798d26d ]
Failing to properly reset system registers is pretty bad. But not quite as bad as bringing the whole machine down... So warn loudly, but slightly more gracefully.
--- arch/arm/kvm/coproc.c | 4 ++-- arch/arm64/kvm/sys_regs.c | 8 +++++--- 2 files changed, 7 insertions(+), 5 deletions(-)
arch/arm/kvm/coproc.c +2 -2
@@ -1450,6 +1450,6 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu)reset_coproc_regs (vcpu, table, num);for (num =1 ; num <NR_CP15_REGS ; num++) -if (vcpu_cp15 (vcpu, num) ==0x42424242 ) -panic ("Didn't reset vcpu_cp15(vcpu, %zi)" , num); +WARN (vcpu_cp15 (vcpu, num) ==0x42424242 , +"Didn't reset vcpu_cp15(vcpu, %zi)" , num); }
arch/arm64/kvm/sys_regs.c +5 -3
@@ -2586,7 +2586,9 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu) table =get_target_table (vcpu->arch.target, true, &num);reset_sys_reg_descs (vcpu, table, num); -for (num =1 ; num <NR_SYS_REGS ; num++) -if (__vcpu_sys_reg (vcpu, num) ==0x4242424242424242 ) -panic ("Didn't reset __vcpu_sys_reg(%zi)" , num); +for (num =1 ; num <NR_SYS_REGS ; num++) { +if (WARN (__vcpu_sys_reg (vcpu, num) ==0x4242424242424242 , +"Didn't reset __vcpu_sys_reg(%zi)\n" , num)) +break ; + } }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 41/280 KVM: arm/arm64: vgic: Always initialize the group of private IRQs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ab2d5eb03dbb7b37a1c6356686fb48626ab0c93e ]
We currently initialize the group of private IRQs during kvm_vgic_vcpu_init, and the value of the group depends on the GIC model we are emulating. However, CPUs created before creating (and initializing) the VGIC might end up with the wrong group if the VGIC is created as GICv3 later.
Since we have no enforced ordering of creating the VGIC and creating VCPUs, we can end up with part the VCPUs being properly intialized and the remaining incorrectly initialized. That also means that we have no single place to do the per-cpu data structure initialization which depends on knowing the emulated GIC model (which is only the group field).
This patch removes the incorrect comment from kvm_vgic_vcpu_init and initializes the group of all previously created VCPUs's private interrupts in vgic_init in addition to the existing initialization in kvm_vgic_vcpu_init.
--- virt/kvm/arm/vgic/vgic-init.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
virt/kvm/arm/vgic/vgic-init.c +14 -8
@@ -231,13 +231,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu) irq->config =VGIC_CONFIG_LEVEL ; } -/* -* GICv3 can only be created via the KVM_DEVICE_CREATE API and -* so we always know the emulation type at this point as it's -* either explicitly configured as GICv3, or explicitly -* configured as GICv2, or not configured yet which also -* implies GICv2. -*/ if (dist->vgic_model ==KVM_DEV_TYPE_ARM_VGIC_V3 ) irq->group =1 ;else
@@ -281,7 +274,7 @@ int vgic_init(struct kvm *kvm) {struct vgic_dist *dist = &kvm->arch.vgic;struct kvm_vcpu *vcpu; -int ret =0 , i; +int ret =0 , i, idx;if (vgic_initialized (kvm))return 0 ;
@@ -298,6 +291,19 @@ int vgic_init(struct kvm *kvm)if (ret) goto out; +/* Initialize groups on CPUs created before the VGIC type was known */ +kvm_for_each_vcpu (idx, vcpu, kvm) { +struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu; + +for (i =0 ; i <VGIC_NR_PRIVATE_IRQS ; i++) { +struct vgic_irq *irq = &vgic_cpu->private_irqs[i]; +if (dist->vgic_model ==KVM_DEV_TYPE_ARM_VGIC_V3 ) + irq->group =1 ; +else + irq->group =0 ; + } + } +if (vgic_has_its (kvm)) { ret =vgic_v4_init (kvm);if (ret)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 42/280 KVM: arm64: Forbid kprobing of the VHE world-switch code
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7d82602909ed9c73b34ad26f05d10db4850a4f8c ]
On systems with VHE the kernel and KVM's world-switch code run at the same exception level. Code that is only used on a VHE system does not need to be annotated as __hyp_text as it can reside anywhere in the kernel text.
__hyp_text was also used to prevent kprobes from patching breakpoint instructions into this region, as this code runs at a different exception level. While this is no longer true with VHE, KVM still switches VBAR_EL1, meaning a kprobe's breakpoint executed in the world-switch code will cause a hyp-panic.
echo "p:weasel sysreg_save_guest_state_vhe" > /sys/kernel/debug/tracing/kprobe_events echo 1 > /sys/kernel/debug/tracing/events/kprobes/weasel/enable
lkvm run -k /boot/Image --console serial -p "console=ttyS0 earlycon=uart,mmio,0x3f8"
# lkvm run -k /boot/Image -m 384 -c 3 --name guest-1474 Info: Placing fdt at 0x8fe00000 - 0x8fffffff Info: virtio-mmio.devices=0x200@0x10000:36
Info: virtio-mmio.devices=0x200@0x10200:37
Info: virtio-mmio.devices=0x200@0x10400:38
[ 614.178186] Kernel panic - not syncing: HYP panic: [ 614.178186] PS:404003c9 PC:ffff0000100d70e0 ESR:f2000004 [ 614.178186] FAR:0000000080080000 HPFAR:0000000000800800 PAR:1d00007edbadc0de [ 614.178186] VCPU:00000000f8de32f1 [ 614.178383] CPU: 2 PID: 1482 Comm: kvm-vcpu-0 Not tainted 5.0.0-rc2 #10799 [ 614.178446] Call trace: [ 614.178480] dump_backtrace+0x0/0x148 [ 614.178567] show_stack+0x24/0x30 [ 614.178658] dump_stack+0x90/0xb4 [ 614.178710] panic+0x13c/0x2d8 [ 614.178793] hyp_panic+0xac/0xd8 [ 614.178880] kvm_vcpu_run_vhe+0x9c/0xe0 [ 614.178958] kvm_arch_vcpu_ioctl_run+0x454/0x798 [ 614.179038] kvm_vcpu_ioctl+0x360/0x898 [ 614.179087] do_vfs_ioctl+0xc4/0x858 [ 614.179174] ksys_ioctl+0x84/0xb8 [ 614.179261] __arm64_sys_ioctl+0x28/0x38 [ 614.179348] el0_svc_common+0x94/0x108 [ 614.179401] el0_svc_handler+0x38/0x78 [ 614.179487] el0_svc+0x8/0xc [ 614.179558] SMP: stopping secondary CPUs [ 614.179661] Kernel Offset: disabled [ 614.179695] CPU features: 0x003,2a80aa38 [ 614.179758] Memory Limit: none [ 614.179858] ---[ end Kernel panic - not syncing: HYP panic: [ 614.179858] PS:404003c9 PC:ffff0000100d70e0 ESR:f2000004 [ 614.179858] FAR:0000000080080000 HPFAR:0000000000800800 PAR:1d00007edbadc0de [ 614.179858] VCPU:00000000f8de32f1 ]---
Annotate the VHE world-switch functions that aren't marked __hyp_text using NOKPROBE_SYMBOL().
--- arch/arm64/kvm/hyp/switch.c | 5 +++++ arch/arm64/kvm/hyp/sysreg-sr.c | 5 +++++ 2 files changed, 10 insertions(+)
arch/arm64/kvm/hyp/switch.c +5 -0
@@ -23,6 +23,7 @@#include <kvm/arm_psci.h> #include <asm/cpufeature.h> +#include <asm/kprobes.h> #include <asm/kvm_asm.h> #include <asm/kvm_emulate.h> #include <asm/kvm_host.h>
@@ -107,6 +108,7 @@ static void activate_traps_vhe(struct kvm_vcpu *vcpu)write_sysreg (kvm_get_hyp_vector (), vbar_el1); } +NOKPROBE_SYMBOL (activate_traps_vhe); static void __hyp_text __activate_traps_nvhe(struct kvm_vcpu *vcpu) {
@@ -146,6 +148,7 @@ static void deactivate_traps_vhe(void)write_sysreg (CPACR_EL1_DEFAULT , cpacr_el1);write_sysreg (vectors, vbar_el1); } +NOKPROBE_SYMBOL (deactivate_traps_vhe); static void __hyp_text __deactivate_traps_nvhe(void) {
@@ -529,6 +532,7 @@ int kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu)return exit_code; } +NOKPROBE_SYMBOL (kvm_vcpu_run_vhe);/* Switch to the guest for legacy non-VHE systems */ int __hyp_text __kvm_vcpu_run_nvhe(struct kvm_vcpu *vcpu)
@@ -636,6 +640,7 @@ static void __hyp_call_panic_vhe(u64 spsr, u64 elr, u64 par,read_sysreg_el2 (esr),read_sysreg_el2 (far), read_sysreg(hpfar_el2), par, vcpu); } +NOKPROBE_SYMBOL (__hyp_call_panic_vhe); void __hyp_text __noreturn hyp_panic(struct kvm_cpu_context *host_ctxt) {
arch/arm64/kvm/hyp/sysreg-sr.c +5 -0
@@ -18,6 +18,7 @@#include <linux/compiler.h> #include <linux/kvm_host.h> +#include <asm/kprobes.h> #include <asm/kvm_asm.h> #include <asm/kvm_emulate.h> #include <asm/kvm_hyp.h>
@@ -98,12 +99,14 @@ void sysreg_save_host_state_vhe(struct kvm_cpu_context *ctxt) {__sysreg_save_common_state (ctxt); } +NOKPROBE_SYMBOL (sysreg_save_host_state_vhe);void sysreg_save_guest_state_vhe (struct kvm_cpu_context *ctxt) {__sysreg_save_common_state (ctxt);__sysreg_save_el2_return_state (ctxt); } +NOKPROBE_SYMBOL (sysreg_save_guest_state_vhe); static void __hyp_text __sysreg_restore_common_state(struct kvm_cpu_context *ctxt) {
@@ -171,12 +174,14 @@ void sysreg_restore_host_state_vhe(struct kvm_cpu_context *ctxt) {__sysreg_restore_common_state (ctxt); } +NOKPROBE_SYMBOL (sysreg_restore_host_state_vhe);void sysreg_restore_guest_state_vhe (struct kvm_cpu_context *ctxt) {__sysreg_restore_common_state (ctxt);__sysreg_restore_el2_return_state (ctxt); } +NOKPROBE_SYMBOL (sysreg_restore_guest_state_vhe); void __hyp_text __sysreg32_save_state(struct kvm_vcpu *vcpu) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 43/280 ASoC: samsung: Prevent clk_get_rate() calls in atomic context
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 860b454c2c0cbda6892954f5cdbbb48931b3c8db ]
This patch moves clk_get_rate() call from trigger() to hw_params() callback to avoid calling sleeping clk API from atomic context and prevent deadlock as indicated below.
Before this change clk_get_rate() was being called with same spinlock held as the one passed to the clk API when registering clocks exposed by the I2S driver.
[ 82.109780] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908
[ 82.117009] in_atomic(): 1, irqs_disabled(): 128, pid: 1554, name: speaker-test
[ 82.124235] 3 locks held by speaker-test/1554:
[ 82.128653] #0: cc8c5328 (snd_pcm_link_rwlock){...-}, at: snd_pcm_stream_lock_irq+0x20/0x38
[ 82.137058] #1: ec9eda17 (&(&substream->self_group.lock)->rlock){..-.}, at: snd_pcm_ioctl+0x900/0x1268
[ 82.146417] #2: 6ac279bf (&(&pri_dai->spinlock)->rlock){..-.}, at: i2s_trigger+0x64/0x6d4
[ 82.154650] irq event stamp: 8144
[ 82.157949] hardirqs last enabled at (8143): [<c0a0f574>] _raw_read_unlock_irq+0x24/0x5c
[ 82.166089] hardirqs last disabled at (8144): [<c0a0f6a8>] _raw_read_lock_irq+0x18/0x58
[ 82.174063] softirqs last enabled at (8004): [<c01024e4>] __do_softirq+0x3a4/0x66c
[ 82.181688] softirqs last disabled at (7997): [<c012d730>] irq_exit+0x140/0x168
[ 82.188964] Preemption disabled at:
[ 82.188967] [<00000000>] (null)
[ 82.195728] CPU: 6 PID: 1554 Comm: speaker-test Not tainted 5.0.0-rc5-00192-ga6e6caca8f03 #191
[ 82.204302] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 82.210376] [<c0111a54>] (unwind_backtrace) from [<c010d8f4>] (show_stack+0x10/0x14)
[ 82.218084] [<c010d8f4>] (show_stack) from [<c09ef004>] (dump_stack+0x90/0xc8)
[ 82.225278] [<c09ef004>] (dump_stack) from [<c0152980>] (___might_sleep+0x22c/0x2c8)
[ 82.232990] [<c0152980>] (___might_sleep) from [<c0a0a2e4>] (__mutex_lock+0x28/0xa3c)
[ 82.240788] [<c0a0a2e4>] (__mutex_lock) from [<c0a0ad80>] (mutex_lock_nested+0x1c/0x24)
[ 82.248763] [<c0a0ad80>] (mutex_lock_nested) from [<c04923dc>] (clk_prepare_lock+0x78/0xec)
[ 82.257079] [<c04923dc>] (clk_prepare_lock) from [<c049538c>] (clk_core_get_rate+0xc/0x5c)
[ 82.265309] [<c049538c>] (clk_core_get_rate) from [<c0766b18>] (i2s_trigger+0x490/0x6d4)
[ 82.273369] [<c0766b18>] (i2s_trigger) from [<c074fec4>] (soc_pcm_trigger+0x100/0x140)
[ 82.281254] [<c074fec4>] (soc_pcm_trigger) from [<c07378a0>] (snd_pcm_do_start+0x2c/0x30)
[ 82.289400] [<c07378a0>] (snd_pcm_do_start) from [<c07376cc>] (snd_pcm_action_single+0x38/0x78)
[ 82.298065] [<c07376cc>] (snd_pcm_action_single) from [<c073a450>] (snd_pcm_ioctl+0x910/0x1268)
[ 82.306734] [<c073a450>] (snd_pcm_ioctl) from [<c0292344>] (do_vfs_ioctl+0x90/0x9ec)
[ 82.314443] [<c0292344>] (do_vfs_ioctl) from [<c0292cd4>] (ksys_ioctl+0x34/0x60)
[ 82.321808] [<c0292cd4>] (ksys_ioctl) from [<c0101000>] (ret_fast_syscall+0x0/0x28)
[ 82.329431] Exception stack(0xeb875fa8 to 0xeb875ff0)
[ 82.334459] 5fa0: 00033c18 b6e31000 00000004 00004142 00033d80 00033d80
[ 82.342605] 5fc0: 00033c18 b6e31000 00008000 00000036 00008000 00000000 beea38a8 00008000
[ 82.350748] 5fe0: b6e3142c beea384c b6da9a30 b6c9212c
[ 82.355789]
[ 82.357245] ======================================================
[ 82.363397] WARNING: possible circular locking dependency detected
[ 82.369551] 5.0.0-rc5-00192-ga6e6caca8f03 #191 Tainted: G W
[ 82.376395] ------------------------------------------------------
[ 82.382548] speaker-test/1554 is trying to acquire lock:
[ 82.387834] 6d2007f4 (prepare_lock){+.+.}, at: clk_prepare_lock+0x78/0xec
[ 82.394593]
[ 82.394593] but task is already holding lock:
[ 82.400398] 6ac279bf (&(&pri_dai->spinlock)->rlock){..-.}, at: i2s_trigger+0x64/0x6d4
[ 82.408197]
[ 82.408197] which lock already depends on the new lock.
[ 82.416343]
[ 82.416343] the existing dependency chain (in reverse order) is:
[ 82.423795]
[ 82.423795] -> #1 (&(&pri_dai->spinlock)->rlock){..-.}:
[ 82.430472] clk_mux_set_parent+0x34/0xb8
[ 82.434975] clk_core_set_parent_nolock+0x1c4/0x52c
[ 82.440347] clk_set_parent+0x38/0x6c
[ 82.444509] of_clk_set_defaults+0xc8/0x308
[ 82.449186] of_clk_add_provider+0x84/0xd0
[ 82.453779] samsung_i2s_probe+0x408/0x5f8
[ 82.458376] platform_drv_probe+0x48/0x98
[ 82.462879] really_probe+0x224/0x3f4
[ 82.467037] driver_probe_device+0x70/0x1c4
[ 82.471716] bus_for_each_drv+0x44/0x8c
[ 82.476049] __device_attach+0xa0/0x138
[ 82.480382] bus_probe_device+0x88/0x90
[ 82.484715] deferred_probe_work_func+0x6c/0xbc
[ 82.489741] process_one_work+0x200/0x740
[ 82.494246] worker_thread+0x2c/0x4c8
[ 82.498408] kthread+0x128/0x164
[ 82.502131] ret_from_fork+0x14/0x20
[ 82.506204] (null)
[ 82.508976]
[ 82.508976] -> #0 (prepare_lock){+.+.}:
[ 82.514264] __mutex_lock+0x60/0xa3c
[ 82.518336] mutex_lock_nested+0x1c/0x24
[ 82.522756] clk_prepare_lock+0x78/0xec
[ 82.527088] clk_core_get_rate+0xc/0x5c
[ 82.531421] i2s_trigger+0x490/0x6d4
[ 82.535494] soc_pcm_trigger+0x100/0x140
[ 82.539913] snd_pcm_do_start+0x2c/0x30
[ 82.544246] snd_pcm_action_single+0x38/0x78
[ 82.549012] snd_pcm_ioctl+0x910/0x1268
[ 82.553345] do_vfs_ioctl+0x90/0x9ec
[ 82.557417] ksys_ioctl+0x34/0x60
[ 82.561229] ret_fast_syscall+0x0/0x28
[ 82.565477] 0xbeea384c
[ 82.568421]
[ 82.568421] other info that might help us debug this:
[ 82.568421]
[ 82.576394] Possible unsafe locking scenario:
[ 82.576394]
[ 82.582285] CPU0 CPU1
[ 82.586792] ---- ----
[ 82.591297] lock(&(&pri_dai->spinlock)->rlock);
[ 82.595977] lock(prepare_lock);
[ 82.601782] lock(&(&pri_dai->spinlock)->rlock);
[ 82.608975] lock(prepare_lock);
[ 82.612268]
[ 82.612268] *** DEADLOCK ***--- sound/soc/samsung/i2s.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/soc/samsung/i2s.c +5 -5
@@ -700,6 +700,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream, {struct i2s_dai *i2s =to_info (dai);u32 mod, mask =0 , val =0 ; +struct clk *rclksrc;unsigned long flags;WARN_ON (!pm_runtime_active (dai->dev));
@@ -782,6 +783,10 @@ static int i2s_hw_params(struct snd_pcm_substream *substream, i2s->frmclk =params_rate (params); + rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC ]; +if (rclksrc && !IS_ERR (rclksrc)) + i2s->rclk_srcrate =clk_get_rate (rclksrc); +return 0 ; }
@@ -886,11 +891,6 @@ static int config_setup(struct i2s_dai *i2s)return 0 ;if (!(i2s->quirks &QUIRK_NO_MUXPSR )) { -struct clk *rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC ]; - -if (rclksrc && !IS_ERR (rclksrc)) - i2s->rclk_srcrate =clk_get_rate (rclksrc); - psr = i2s->rclk_srcrate / i2s->frmclk / rfs;writel (((psr -1 ) <<8 ) |PSR_PSREN , i2s->addr +I2SPSR ); dev_dbg(&i2s->pdev->dev,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 44/280 ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 50d6b3cf9403879911e06d69c7ef41e43f8f7b4b ]
If we have a kernel configured for periodic timer interrupts, and we have cpuidle enabled, then we end up with CPU1 losing timer interupts after a hotplug.
This can manifest itself in RCU stall warnings, or userspace becoming unresponsive.
The problem is that the kernel initially wants to use the TWD timer for interrupts, but the TWD loses context when we enter the C3 cpuidle state. Nothing reprograms the TWD after idle.
We have solved this in the past by switching to broadcast timer ticks, and cpuidle44xx switches to that mode at boot time. However, there is nothing to switch from periodic mode local timers after a hotplug operation.
We call tick_broadcast_enter() in omap_enter_idle_coupled(), which one would expect would take care of the issue, but internally this only deals with one-shot local timers - tick_broadcast_enable() on the other hand only deals with periodic local timers. So, we need to call both.
--- arch/arm/mach-omap2/cpuidle44xx.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
arch/arm/mach-omap2/cpuidle44xx.c +4 -12
@@ -152,6 +152,10 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, mpuss_can_lose_context = (cx->mpu_state ==PWRDM_POWER_RET ) && (cx->mpu_logic_state ==PWRDM_POWER_OFF ); +/* Enter broadcast mode for periodic timers */ +tick_broadcast_enable (); + +/* Enter broadcast mode for one-shot timers */ tick_broadcast_enter ();/*
@@ -218,15 +222,6 @@ fail:return index; } -/* -* For each cpu, setup the broadcast timer because local timers -* stops for the states above C1. -*/ -static void omap_setup_broadcast_timer (void *arg) -{ -tick_broadcast_enable (); -} -static struct cpuidle_driver omap4_idle_driver = { .name ="omap4_idle" , .owner =THIS_MODULE ,
@@ -319,8 +314,5 @@ int __init omap4_idle_init(void)if (!cpu_clkdm[0 ] || !cpu_clkdm[1 ])return -ENODEV ; -/* Configure the broadcast timer on each cpu */ -on_each_cpu (omap_setup_broadcast_timer,NULL ,1 ); -return cpuidle_register (idle_driver, cpu_online_mask); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 45/280 Input: cap11xx - switch to using set_brightness_blocking()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 628442880af8c201d307a45f3862a7a17df8a189 ]
Updating LED state requires access to regmap and therefore we may sleep, so we could not do that directly form set_brightness() method. Historically we used private work to adjust the brightness, but with the introduction of set_brightness_blocking() we no longer need it.
As a bonus, not having our own work item means we do not have use-after-free issue as we neglected to cancel outstanding work on driver unbind.
--- drivers/input/keyboard/cap11xx.c | 35 ++++++++++---------------------- 1 file changed, 11 insertions(+), 24 deletions(-)
drivers/input/keyboard/cap11xx.c +11 -24
@@ -75,9 +75,7 @@struct cap11xx_led {struct cap11xx_priv *priv;struct led_classdev cdev; -struct work_struct work;u32 reg; -enum led_brightness new_brightness; };#endif
@@ -233,30 +231,21 @@ static void cap11xx_input_close(struct input_dev *idev) }#ifdef CONFIG_LEDS_CLASS -static void cap11xx_led_work (struct work_struct *work) +static int cap11xx_led_set (struct led_classdev *cdev, +enum led_brightness value) { - struct cap11xx_led *led = container_of(work, struct cap11xx_led, work); + struct cap11xx_led *led = container_of(cdev, struct cap11xx_led, cdev);struct cap11xx_priv *priv = led->priv; -int value = led->new_brightness;/* -* All LEDs share the same duty cycle as this is a HW limitation. -* Brightness levels per LED are either 0 (OFF) and 1 (ON). +* All LEDs share the same duty cycle as this is a HW +* limitation. Brightness levels per LED are either +* 0 (OFF) and 1 (ON). */ -regmap_update_bits (priv->regmap,CAP11XX_REG_LED_OUTPUT_CONTROL , -BIT (led->reg), value ?BIT (led->reg) :0 ); -} - -static void cap11xx_led_set (struct led_classdev *cdev, -enum led_brightness value) -{ - struct cap11xx_led *led = container_of(cdev, struct cap11xx_led, cdev); - -if (led->new_brightness == value) -return ; - - led->new_brightness = value; -schedule_work (&led->work); +return regmap_update_bits (priv->regmap, +CAP11XX_REG_LED_OUTPUT_CONTROL , +BIT (led->reg), + value ?BIT (led->reg) :0 ); } static int cap11xx_init_leds(struct device *dev,
@@ -299,7 +288,7 @@ static int cap11xx_init_leds(struct device *dev, led->cdev.default_trigger =of_get_property (child,"linux,default-trigger" ,NULL ); led->cdev.flags =0 ; - led->cdev.brightness_set = cap11xx_led_set; + led->cdev.brightness_set_blocking = cap11xx_led_set; led->cdev.max_brightness =1 ; led->cdev.brightness =LED_OFF ;
@@ -312,8 +301,6 @@ static int cap11xx_init_leds(struct device *dev, led->reg = reg; led->priv = priv; -INIT_WORK (&led->work, cap11xx_led_work); - error =devm_led_classdev_register (dev, &led->cdev);if (error) {of_node_put (child);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 46/280 Input: ps2-gpio - flush TX work when closing port
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 33a841ce5cef4ca6c18ad333248b6d273f54c839 ]
To ensure that TX work is not running after serio port has been torn down, let's flush it when closing the port.
--- drivers/input/serio/ps2-gpio.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/serio/ps2-gpio.c +1 -0
@@ -76,6 +76,7 @@ static void ps2_gpio_close(struct serio *serio) {struct ps2_gpio_data *drvdata = serio->port_data; +flush_delayed_work (&drvdata->tx_work);disable_irq (drvdata->irq); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 47/280 Input: matrix_keypad - use flush_delayed_work()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a342083abe576db43594a32d458a61fa81f7cb32 ]
We should be using flush_delayed_work() instead of flush_work() in matrix_keypad_stop() to ensure that we are not missing work that is scheduled but not yet put in the workqueue (i.e. its delay timer has not expired yet).
--- drivers/input/keyboard/matrix_keypad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/keyboard/matrix_keypad.c +1 -1
@@ -222,7 +222,7 @@ static void matrix_keypad_stop(struct input_dev *dev) keypad->stopped = true;spin_unlock_irq (&keypad->lock); -flush_work (&keypad->work.work); +flush_delayed_work (&keypad->work);/* * matrix_keypad_scan() will leave IRQs enabled; * we should disable them now.
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 48/280 mac80211: call drv_ibss_join() on restart
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4926b51bfaa6d36bd6f398fb7698679d3962e19d ]
If a driver does any significant activity in its ibss_join method, then it will very well expect that to be called during restart, before any stations are added. Do that.
--- net/mac80211/util.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/mac80211/util.c +5 -1
@@ -5,7 +5,7 @@* Copyright 2007 Johannes Berg <[email protected]> * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015-2017 Intel Deutschland GmbH -* Copyright (C) 2018 Intel Corporation +* Copyright (C) 2018-2019 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as
@@ -2020,6 +2020,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)case NL80211_IFTYPE_AP_VLAN :case NL80211_IFTYPE_MONITOR :break ; +case NL80211_IFTYPE_ADHOC : +if (sdata->vif.bss_conf.ibss_joined) +WARN_ON (drv_join_ibss (local, sdata)); +/* fall through */ default :ieee80211_reconfig_stations (sdata);/* fall through */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 49/280 mac80211: Fix Tx aggregation session tear down with ITXQs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6157ca0d6bfe437691b1e98a62e2efe12b6714da ]
When mac80211 requests the low level driver to stop an ongoing Tx aggregation, the low level driver is expected to call ieee80211_stop_tx_ba_cb_irqsafe() to indicate that it is ready to stop the session. The callback in turn schedules a worker to complete the session tear down, which in turn also handles the relevant state for the intermediate Tx queue.
However, as this flow in asynchronous, the intermediate queue should be stopped and not continue servicing frames, as in such a case frames that are dequeued would be marked as part of an aggregation, although the aggregation is already been stopped.
Fix this by stopping the intermediate Tx queue, before calling the low level driver to stop the Tx aggregation.
--- net/mac80211/agg-tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/agg-tx.c +3 -1
@@ -8,7 +8,7 @@* Copyright 2007, Michael Wu <[email protected]> * Copyright 2007-2010, Intel Corporation * Copyright(c) 2015-2017 Intel Deutschland GmbH -* Copyright (C) 2018 Intel Corporation +* Copyright (C) 2018 - 2019 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as
@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,set_bit (HT_AGG_STATE_STOPPING , &tid_tx->state); +ieee80211_agg_stop_txq (sta, tid); +spin_unlock_bh (&sta->lock); ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 50/280 netfilter: compat: initialize all fields in xt_init
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8d29d16d21342a0c86405d46de0c4ac5daf1760f ]
If a non zero value happens to be in xt[NFPROTO_BRIDGE].cur at init time, the following panic can be caused by running
% ebtables -t broute -F BROUTING
from a 32-bit user level on a 64-bit kernel. This patch replaces kmalloc_array with kcalloc when allocating xt.
[ 474.680846] BUG: unable to handle kernel paging request at 0000000009600920 [ 474.687869] PGD 2037006067 P4D 2037006067 PUD 2038938067 PMD 0 [ 474.693838] Oops: 0000 [#1] SMP [ 474.697055] CPU: 9 PID: 4662 Comm: ebtables Kdump: loaded Not tainted 4.19.17-11302235.AroraKernelnext.fc18.x86_64 #1 [ 474.707721] Hardware name: Supermicro X9DRT/X9DRT, BIOS 3.0 06/28/2013 [ 474.714313] RIP: 0010:xt_compat_calc_jump+0x2f/0x63 [x_tables] [ 474.720201] Code: 40 0f b6 ff 55 31 c0 48 6b ff 70 48 03 3d dc 45 00 00 48 89 e5 8b 4f 6c 4c 8b 47 60 ff c9 39 c8 7f 2f 8d 14 08 d1 fa 48 63 fa <41> 39 34 f8 4c 8d 0c fd 00 00 00 00 73 05 8d 42 01 eb e1 76 05 8d [ 474.739023] RSP: 0018:ffffc9000943fc58 EFLAGS: 00010207 [ 474.744296] RAX: 0000000000000000 RBX: ffffc90006465000 RCX: 0000000002580249 [ 474.751485] RDX: 00000000012c0124 RSI: fffffffff7be17e9 RDI: 00000000012c0124 [ 474.758670] RBP: ffffc9000943fc58 R08: 0000000000000000 R09: ffffffff8117cf8f [ 474.765855] R10: ffffc90006477000 R11: 0000000000000000 R12: 0000000000000001 [ 474.773048] R13: 0000000000000000 R14: ffffc9000943fcb8 R15: ffffc9000943fcb8 [ 474.780234] FS: 0000000000000000(0000) GS:ffff88a03f840000(0063) knlGS:00000000f7ac7700 [ 474.788612] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 474.794632] CR2: 0000000009600920 CR3: 0000002037422006 CR4: 00000000000606e0 [ 474.802052] Call Trace: [ 474.804789] compat_do_replace+0x1fb/0x2a3 [ebtables] [ 474.810105] compat_do_ebt_set_ctl+0x69/0xe6 [ebtables] [ 474.815605] ? try_module_get+0x37/0x42 [ 474.819716] compat_nf_setsockopt+0x4f/0x6d [ 474.824172] compat_ip_setsockopt+0x7e/0x8c [ 474.828641] compat_raw_setsockopt+0x16/0x3a [ 474.833220] compat_sock_common_setsockopt+0x1d/0x24 [ 474.838458] __compat_sys_setsockopt+0x17e/0x1b1 [ 474.843343] ? __check_object_size+0x76/0x19a [ 474.847960] __ia32_compat_sys_socketcall+0x1cb/0x25b [ 474.853276] do_fast_syscall_32+0xaf/0xf6 [ 474.857548] entry_SYSENTER_compat+0x6b/0x7a
--- net/netfilter/x_tables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/x_tables.c +1 -1
@@ -1899,7 +1899,7 @@ static int __init xt_init(void)seqcount_init (&per_cpu (xt_recseq, i)); } - xt =kmalloc_array (NFPROTO_NUMPROTO ,sizeof (struct xt_af ),GFP_KERNEL ); + xt =kcalloc (NFPROTO_NUMPROTO ,sizeof (struct xt_af ),GFP_KERNEL );if (!xt)return -ENOMEM ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 51/280 blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit aef1897cd36dcf5e296f1d2bae7e0d268561b685 ]
When requeue, if RQF_DONTPREP, rq has contained some driver specific data, so insert it to hctx dispatch list to avoid any merge. Take scsi as example, here is the trace event log (no io scheduler, because RQF_STARTED would prevent merging),
kworker/0:1H-339 [000] ...1 2037.209289: block_rq_insert: 8,0 R 4096 () 32768 + 8 [kworker/0:1H] scsi_inert_test-1987 [000] .... 2037.220465: block_bio_queue: 8,0 R 32776 + 8 [scsi_inert_test] scsi_inert_test-1987 [000] ...2 2037.220466: block_bio_backmerge: 8,0 R 32776 + 8 [scsi_inert_test] kworker/0:1H-339 [000] .... 2047.220913: block_rq_issue: 8,0 R 8192 () 32768 + 16 [kworker/0:1H] scsi_inert_test-1996 [000] ..s1 2047.221007: block_rq_complete: 8,0 R () 32768 + 8 [0] scsi_inert_test-1996 [000] .Ns1 2047.221045: block_rq_requeue: 8,0 R () 32776 + 8 [0] kworker/0:1H-339 [000] ...1 2047.221054: block_rq_insert: 8,0 R 4096 () 32776 + 8 [kworker/0:1H] kworker/0:1H-339 [000] ...1 2047.221056: block_rq_issue: 8,0 R 4096 () 32776 + 8 [kworker/0:1H] scsi_inert_test-1986 [000] ..s1 2047.221119: block_rq_complete: 8,0 R () 32776 + 8 [0]
(32768 + 8) was requeued by scsi_queue_insert and had RQF_DONTPREP. Then it was merged with (32776 + 8) and issued. Due to RQF_DONTPREP, the sdb only contained the part of (32768 + 8), then only that part was completed. The lucky thing was that scsi_io_completion detected it and requeued the remaining part. So we didn't get corrupted data. However, the requeue of (32776 + 8) is not expected.
--- block/blk-mq.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
block/blk-mq.c +10 -2
@@ -701,12 +701,20 @@ static void blk_mq_requeue_work(struct work_struct *work)spin_unlock_irq (&q->requeue_lock);list_for_each_entry_safe (rq, next, &rq_list, queuelist) { -if (!(rq->rq_flags &RQF_SOFTBARRIER )) +if (!(rq->rq_flags & (RQF_SOFTBARRIER |RQF_DONTPREP )))continue ; rq->rq_flags &= ~RQF_SOFTBARRIER ;list_del_init (&rq->queuelist); -blk_mq_sched_insert_request (rq, true, false, false); +/* +* If RQF_DONTPREP, rq has contained some driver specific +* data, so insert it to hctx dispatch list to avoid any +* merge. +*/ +if (rq->rq_flags &RQF_DONTPREP ) +blk_mq_request_bypass_insert (rq, false); +else +blk_mq_sched_insert_request (rq, true, false, false); }while (!list_empty (&rq_list)) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 52/280 ipvs: fix dependency on nf_defrag_ipv6
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 098e13f5b21d3398065fce8780f07a3ef62f4812 ]
ipvs relies on nf_defrag_ipv6 module to manage IPv6 fragmentation, but lacks proper Kconfig dependencies and does not explicitly request defrag features.
As a result, if netfilter hooks are not loaded, when IPv6 fragmented packet are handled by ipvs only the first fragment makes through.
Fix it properly declaring the dependency on Kconfig and registering netfilter hooks on ip_vs_add_service() and ip_vs_new_dest().
--- net/netfilter/ipvs/Kconfig | 1 + net/netfilter/ipvs/ip_vs_core.c | 10 ++++------ net/netfilter/ipvs/ip_vs_ctl.c | 10 ++++++++++ 3 files changed, 15 insertions(+), 6 deletions(-)
net/netfilter/ipvs/Kconfig +1 -0
@@ -29,6 +29,7 @@ config IP_VS_IPV6 bool "IPv6 support for IPVS" depends on IPV6 = y || IP_VS = IPV6 select IP6_NF_IPTABLES + select NF_DEFRAG_IPV6 ---help--- Add IPv6 support to IPVS.
net/netfilter/ipvs/ip_vs_core.c +4 -6
@@ -1536,14 +1536,12 @@ ip_vs_try_to_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,/* sorry, all this trouble for a no-hit :) */ IP_VS_DBG_PKT (12 , af, pp, skb, iph->off,"ip_vs_in: packet continues traversal as normal" ); -if (iph->fragoffs) { -/* Fragment that couldn't be mapped to a conn entry -* is missing module nf_defrag_ipv6 -*/ -IP_VS_DBG_RL ("Unhandled frag, load nf_defrag_ipv6\n" ); + +/* Fragment couldn't be mapped to a conn entry */ +if (iph->fragoffs)IP_VS_DBG_PKT (7 , af, pp, skb, iph->off,"unhandled fragment" ); - } + *verdict =NF_ACCEPT ;return 0 ; }
net/netfilter/ipvs/ip_vs_ctl.c +10 -0
@@ -43,6 +43,7 @@#ifdef CONFIG_IP_VS_IPV6 #include <net/ipv6.h> #include <net/ip6_route.h> +#include <net/netfilter/ipv6/nf_defrag_ipv6.h> #endif #include <net/route.h> #include <net/sock.h>
@@ -895,6 +896,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest, {struct ip_vs_dest *dest;unsigned int atype, i; +int ret =0 ;EnterFunction (2 );
@@ -905,6 +907,10 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest, atype & IPV6_ADDR_LINKLOCAL) && !__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6)) return -EINVAL; + + ret =nf_defrag_ipv6_enable (svc->ipvs->net); +if (ret) +return ret; } else#endif {
@@ -1228,6 +1234,10 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, ret = -EINVAL ; goto out_err; } + + ret =nf_defrag_ipv6_enable (ipvs->net); +if (ret) + goto out_err; }#endif
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 53/280 floppy: check_events callback should not return a negative number
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 96d7cb932e826219ec41ac02e5af037ffae6098c ]
floppy_check_events() is supposed to return bit flags to say which events occured. We should return zero to say that no event flags are set. Only BIT(0) and BIT(1) are used in the caller. And .check_events interface also expect to return an unsigned int value.
However, after commit a0c80efe5956, it may return -EINTR (-4u). Here, both BIT(0) and BIT(1) are cleared. So this patch shouldn't affect runtime, but it obviously is still worth fixing.
--- drivers/block/floppy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/floppy.c +1 -1
@@ -4084,7 +4084,7 @@ static unsigned int floppy_check_events(struct gendisk *disk,if (time_after (jiffies,UDRS ->last_checked +UDP ->checkfreq)) {if (lock_fdc (drive)) -return -EINTR ; +return 0 ;poll_drive (false,0 );process_fd_request (); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 54/280 xprtrdma: Make sure Send CQ is allocated on an existing compvec
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a4cb5bdb754afe21f3e9e7164213e8600cf69427 ]
Make sure the device has at least 2 completion vectors before allocating to compvec#1
--- net/sunrpc/xprtrdma/verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sunrpc/xprtrdma/verbs.c +2 -1
@@ -546,7 +546,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia, sendcq =ib_alloc_cq (ia->ri_device,NULL , ep->rep_attr.cap.max_send_wr +1 , -1 ,IB_POLL_WORKQUEUE ); + ia->ri_device->num_comp_vectors >1 ?1 :0 , +IB_POLL_WORKQUEUE );if (IS_ERR (sendcq)) { rc =PTR_ERR (sendcq); dprintk("RPC: %s: failed to create send CQ: %i\n",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 55/280 NFS: Dont use page_file_mapping after removing the page
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d2ceb7e57086750ea6198a31fd942d98099a0786 ]
If nfs_page_async_flush() removes the page from the mapping, then we can't use page_file_mapping() on it as nfs_updatepate() is wont to do when receiving an error. Instead, push the mapping to the stack before the page is possibly truncated.
--- fs/nfs/write.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/nfs/write.c +6 -5
@@ -238,9 +238,9 @@ out: }/* A writeback failed: mark the page as bad, and invalidate the page cache */ -static void nfs_set_pageerror (struct page *page) +static void nfs_set_pageerror (struct address_space *mapping) { -nfs_zap_mapping (page_file_mapping (page)->host,page_file_mapping (page)); +nfs_zap_mapping (mapping->host, mapping); }/*
@@ -994,7 +994,7 @@ static void nfs_write_completion(struct nfs_pgio_header *hdr)nfs_list_remove_request (req);if (test_bit (NFS_IOHDR_ERROR , &hdr->flags) && (hdr->good_bytes < bytes)) { -nfs_set_pageerror (req->wb_page); +nfs_set_pageerror (page_file_mapping (req->wb_page));nfs_context_set_write_error (req->wb_context, hdr->error); goto remove_req; }
@@ -1330,7 +1330,8 @@ int nfs_updatepage(struct file *file, struct page *page, unsigned int offset, unsigned int count) {struct nfs_open_context *ctx =nfs_file_open_context (file); -struct inode *inode =page_file_mapping (page)->host; +struct address_space *mapping =page_file_mapping (page); +struct inode *inode = mapping->host;int status =0 ;nfs_inc_stats (inode,NFSIOS_VFSUPDATEPAGE );
@@ -1348,7 +1349,7 @@ int nfs_updatepage(struct file *file, struct page *page, status =nfs_writepage_setup (ctx, page, offset, count);if (status <0 ) -nfs_set_pageerror (page); +nfs_set_pageerror (mapping);else __set_page_dirty_nobuffers (page); out:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 56/280 mm/gup: fix gup_pmd_range() for dax
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 414fd080d125408cb15d04ff4907e1dd8145c8c7 ]
For dax pmd, pmd_trans_huge() returns false but pmd_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb.
--- mm/gup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/gup.c +2 -1
@@ -1649,7 +1649,8 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,if (!pmd_present (pmd))return 0 ; -if (unlikely (pmd_trans_huge (pmd) ||pmd_huge (pmd))) { +if (unlikely (pmd_trans_huge (pmd) ||pmd_huge (pmd) || +pmd_devmap (pmd))) {/* * NUMA hinting faults need to be handled in the GUP * slowpath for accounting purposes and so that they
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 57/280 Revert "mm: use early_pfn_to_nid in page_ext_init"
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2f1ee0913ce58efe7f18fbd518bd54c598559b89 ]
This reverts commit fe53ca54270a ("mm: use early_pfn_to_nid in page_ext_init").
When booting a system with "page_owner=on",
start_kernel
page_ext_init
invoke_init_callbacks
init_section_page_ext
init_page_owner
init_early_allocated_pages
init_zones_in_node
init_pages_in_zone
lookup_page_ext
page_to_nid
The issue here is that page_to_nid() will not work since some page flags have no node information until later in page_alloc_init_late() due to DEFERRED_STRUCT_PAGE_INIT. Hence, it could trigger an out-of-bounds access with an invalid nid.
UBSAN: Undefined behaviour in ./include/linux/mm.h:1104:50 index 7 is out of range for type 'zone [5]'
Also, kernel will panic since flags were poisoned earlier with,
CONFIG_DEBUG_VM_PGFLAGS=yCONFIG_NODE_NOT_IN_PAGE_FLAGS=n
start_kernel
setup_arch
pagetable_init
paging_init
sparse_init
sparse_init_nid
memblock_alloc_try_nid_raw
It did not handle it well in init_pages_in_zone() which ends up calling page_to_nid().
page:ffffea0004200000 is uninitialized and poisoned
raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) page_owner info is not active (free page?) kernel BUG at include/linux/mm.h:990! RIP: 0010:init_page_owner+0x486/0x520
This means that assumptions behind commit fe53ca54270a ("mm: use early_pfn_to_nid in page_ext_init") are incomplete. Therefore, revert the commit for now. A proper way to move the page_owner initialization to sooner is to hook into memmap initialization.
--- init/main.c | 3 ++- mm/page_ext.c | 4 +--- 2 files changed, 3 insertions(+), 4 deletions(-)
init/main.c +2 -1
@@ -689,7 +689,6 @@ asmlinkage __visible void __init start_kernel(void) initrd_start = 0; }#endif -page_ext_init ();kmemleak_init ();debug_objects_mem_init ();setup_per_cpu_pageset ();
@@ -1140,6 +1139,8 @@ static noinline void __init kernel_init_freeable(void)sched_init_smp ();page_alloc_init_late (); +/* Initialize page ext after all struct pages are initialized. */ +page_ext_init ();do_basic_setup ();
mm/page_ext.c +1 -3
@@ -398,10 +398,8 @@ void __init page_ext_init(void)* We know some arch can have a nodes layout such as * -------------pfn--------------> * N0 | N1 | N2 | N0 | N1 | N2|.... -* -* Take into account DEFERRED_STRUCT_PAGE_INIT. */ -if (early_pfn_to_nid (pfn) != nid) +if (pfn_to_nid (pfn) != nid)continue ;if (init_section_page_ext (pfn, nid)) goto oom;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 58/280 scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 388a49959ee4e4e99f160241d9599efa62cd4299 ]
In qla2x00_async_tm_cmd, we reference off sp after it has been freed. This caused a panic on a system running a slub debug kernel. Since fcport is passed in anyways, just use that instead.
--- drivers/scsi/qla2xxx/qla_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_init.c +2 -2
@@ -1719,13 +1719,13 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,/* Issue Marker IOCB */ qla2x00_marker (vha, vha->hw->req_q_map[0 ], - vha->hw->rsp_q_map[0 ], sp->fcport->loop_id, lun, + vha->hw->rsp_q_map[0 ], fcport->loop_id, lun, flags ==TCF_LUN_RESET ?MK_SYNC_ID_LUN :MK_SYNC_ID ); } done_free_sp: sp->free (sp); - sp->fcport->flags &= ~FCF_ASYNC_SENT ; + fcport->flags &= ~FCF_ASYNC_SENT ; done:return rval; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 59/280 net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8d6ea932856c7087ce8c3d0e79494b7d5386f962 ]
The value of ->num_ports comes from bcm_sf2_sw_probe() and it is less than or equal to DSA_MAX_PORTS. The ds->ports[] array is used inside the dsa_is_user_port() and dsa_is_cpu_port() functions. The ds->ports[] array is allocated in dsa_switch_alloc() and it has ds->num_ports elements so this leads to a static checker warning about a potential out of bounds read.
--- drivers/net/dsa/bcm_sf2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/bcm_sf2.c +1 -1
@@ -692,7 +692,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)* port, the other ones have already been disabled during * bcm_sf2_sw_setup */ -for (port =0 ; port <DSA_MAX_PORTS ; port++) { +for (port =0 ; port < ds->num_ports; port++) {if (dsa_is_user_port (ds, port) ||dsa_is_cpu_port (ds, port))bcm_sf2_port_disable (ds, port,NULL ); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 60/280 x86/CPU: Add Icelake model number
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8cd8f0ce0d6aafe661cb3d6781c8b82bc696c04d ]
Add the CPUID model number of Icelake (ICL) mobile processors to the Intel family list. Icelake U/Y series uses model number 0x7E.
--- arch/x86/include/asm/intel-family.h | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/include/asm/intel-family.h +2 -0
@@ -55,6 +55,8 @@#define INTEL_FAM6_CANNONLAKE_MOBILE 0x66 +#define INTEL_FAM6_ICELAKE_MOBILE 0x7E +/* "Small Core" Processors (Atom) */ #define INTEL_FAM6_ATOM_PINEVIEW 0x1C
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 61/280 mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2c2ade81741c66082f8211f0b96cf509cc4c0218 ]
The basic idea behind ->pagecnt_bias is: If we pre-allocate the maximum number of references that we might need to create in the fastpath later, the bump-allocation fastpath only has to modify the non-atomic bias value that tracks the number of extra references we hold instead of the atomic refcount. The maximum number of allocations we can serve (under the assumption that no allocation is made with size 0) is nc->size, so that's the bias used.
However, even when all memory in the allocation has been given away, a reference to the page is still held; and in the offset < 0 slowpath, the page may be reused if everyone else has dropped their references. This means that the necessary number of references is actually nc->size+1.
Luckily, from a quick grep, it looks like the only path that can call page_frag_alloc(fragsz=1) is TAP with the IFF_NAPI_FRAGS flag, which requires CAP_NET_ADMIN in the init namespace and is only intended to be used for kernel testing and fuzzing.
To test for this issue, put a WARN_ON(page_ref_count(page) == 0) in the offset < 0 path, below the virt_to_page() call, and then repeatedly call writev() on a TAP device with IFF_TAP|IFF_NO_PI|IFF_NAPI_FRAGS|IFF_NAPI, with a vector consisting of 15 elements containing 1 byte each.
--- mm/page_alloc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
mm/page_alloc.c +4 -4
@@ -4532,11 +4532,11 @@ refill:/* Even if we own the page, we do not use atomic_set(). * This would break get_page_unless_zero() users. */ -page_ref_add (page, size -1 ); +page_ref_add (page, size);/* reset page count bias and offset to start of new frag */ nc->pfmemalloc =page_is_pfmemalloc (page); - nc->pagecnt_bias = size; + nc->pagecnt_bias = size +1 ; nc->offset = size; }
@@ -4552,10 +4552,10 @@ refill: size = nc->size;#endif /* OK, page count is 0, we can safely set it */ -set_page_count (page, size); +set_page_count (page, size +1 );/* reset page count bias and offset to start of new frag */ - nc->pagecnt_bias = size; + nc->pagecnt_bias = size +1 ; offset = size - fragsz; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 62/280 net: hns: Fix object reference leaks in hns_dsaf_roce_reset()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c969c6e7ab8cb42b5c787c567615474fdbad9d6a ]
The of_find_device_by_node() takes a reference to the underlying device structure, we should release that reference.
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +2 -0
@@ -3081,6 +3081,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset) dsaf_dev =dev_get_drvdata (&pdev->dev);if (!dsaf_dev) {dev_err (&pdev->dev,"dsaf_dev is NULL\n" ); +put_device (&pdev->dev);return -ENODEV ; }
@@ -3088,6 +3089,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)if (AE_IS_VER1 (dsaf_dev->dsaf_ver)) {dev_err (dsaf_dev->dev,"%s v1 chip doesn't support RoCE!\n" , dsaf_dev->ae_dev.name); +put_device (&pdev->dev);return -ENODEV ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 63/280 i2c: cadence: Fix the hold bit setting
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d358def706880defa4c9e87381c5bf086a97d5f9 ]
In case the hold bit is not needed we are carrying the old values. Fix the same by resetting the bit when not needed.
Fixes the sporadic i2c bus lockups on National Instruments Zynq-based devices.
--- drivers/i2c/busses/i2c-cadence.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-cadence.c +7 -2
@@ -382,8 +382,10 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)* Check for the message size against FIFO depth and set the * 'hold bus' bit if it is greater than FIFO depth. */ -if (id->recv_count >CDNS_I2C_FIFO_DEPTH ) +if ((id->recv_count >CDNS_I2C_FIFO_DEPTH ) || id->bus_hold_flag) ctrl_reg |=CDNS_I2C_CR_HOLD ; +else + ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD ;cdns_i2c_writereg (ctrl_reg,CDNS_I2C_CR_OFFSET );
@@ -440,8 +442,11 @@ static void cdns_i2c_msend(struct cdns_i2c *id)* Check for the message size against FIFO depth and set the * 'hold bus' bit if it is greater than FIFO depth. */ -if (id->send_count >CDNS_I2C_FIFO_DEPTH ) +if ((id->send_count >CDNS_I2C_FIFO_DEPTH ) || id->bus_hold_flag) ctrl_reg |=CDNS_I2C_CR_HOLD ; +else + ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD ; +cdns_i2c_writereg (ctrl_reg,CDNS_I2C_CR_OFFSET );/* Clear the interrupts in interrupt status register. */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 64/280 i2c: bcm2835: Clear current buffer pointers and counts after a transfer
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f275a4659484716259cc46268d9043424e51cf0f ]
The driver's interrupt handler checks whether a message is currently being handled with the curr_msg pointer. When it is NULL, the interrupt is considered to be unexpected. Similarly, the i2c_start_transfer routine checks for the remaining number of messages to handle in num_msgs.
However, these values are never cleared and always keep the message and number relevant to the latest transfer (which might be done already and the underlying message memory might have been freed).
When an unexpected interrupt hits with the DONE bit set, the isr will then try to access the flags field of the curr_msg structure, leading to a fatal page fault.
The msg_buf and msg_buf_remaining fields are also never cleared at the end of the transfer, which can lead to similar pitfalls.
Fix these issues by introducing a cleanup function and always calling it after a transfer is finished.
--- drivers/i2c/busses/i2c-bcm2835.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/i2c/busses/i2c-bcm2835.c +12 -0
@@ -191,6 +191,15 @@ static void bcm2835_i2c_start_transfer(struct bcm2835_i2c_dev *i2c_dev)bcm2835_i2c_writel (i2c_dev,BCM2835_I2C_C , c); } +static void bcm2835_i2c_finish_transfer (struct bcm2835_i2c_dev *i2c_dev) +{ + i2c_dev->curr_msg =NULL ; + i2c_dev->num_msgs =0 ; + + i2c_dev->msg_buf =NULL ; + i2c_dev->msg_buf_remaining =0 ; +} +/* * Note about I2C_C_CLEAR on error: * The I2C_C_CLEAR on errors will take some time to resolve -- if you were in
@@ -291,6 +300,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], time_left =wait_for_completion_timeout (&i2c_dev->completion, adap->timeout); + +bcm2835_i2c_finish_transfer (i2c_dev); +if (!time_left) {bcm2835_i2c_writel (i2c_dev,BCM2835_I2C_C ,BCM2835_I2C_C_CLEAR );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 65/280 auxdisplay: ht16k33: fix potential user-after-free on module unload
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 69ef9bc54715fb1cb7786ada15774e469e822209 ]
On module unload/remove, we need to ensure that work does not run after we have freed resources. Concretely, cancel_delayed_work() may return while the callback function is still running.
Quoted 1 line
From
kernel/workqueue.c:
The work callback function may still be running on return, unless it returns true and the work doesn't re-arm itself. Explicitly flush or use cancel_delayed_work_sync() to wait on it.
--- drivers/auxdisplay/ht16k33.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/auxdisplay/ht16k33.c +1 -1
@@ -509,7 +509,7 @@ static int ht16k33_remove(struct i2c_client *client)struct ht16k33_priv *priv =i2c_get_clientdata (client);struct ht16k33_fbdev *fbdev = &priv->fbdev; -cancel_delayed_work (&fbdev->work); +cancel_delayed_work_sync (&fbdev->work);unregister_framebuffer (fbdev->info);framebuffer_release (fbdev->info);free_page ((unsigned long ) fbdev->buffer);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 66/280 Input: st-keyscan - fix potential zalloc NULL dereference
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2439d37e1bf8a34d437573c086572abe0f3f1b15 ]
This patch fixes the following static checker warning:
drivers/input/keyboard/st-keyscan.c:156 keyscan_probe()
error: potential zalloc NULL dereference: 'keypad_data->input_dev'
--- drivers/input/keyboard/st-keyscan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/keyboard/st-keyscan.c +2 -2
@@ -153,6 +153,8 @@ static int keyscan_probe(struct platform_device *pdev) input_dev->id.bustype =BUS_HOST ; + keypad_data->input_dev = input_dev; + error =keypad_matrix_key_parse_dt (keypad_data);if (error)return error;
@@ -168,8 +170,6 @@ static int keyscan_probe(struct platform_device *pdev)input_set_drvdata (input_dev, keypad_data); - keypad_data->input_dev = input_dev; - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); keypad_data->base =devm_ioremap_resource (&pdev->dev, res);if (IS_ERR (keypad_data->base))
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 67/280 clk: sunxi-ng: v3s: Fix TCON reset de-assert bit
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5c59801f7018acba11b12de59017a3fcdcf7421d ]
According to the datasheet and the reference code from Allwinner, the bit used to de-assert the TCON reset is bit 4, not bit 3.
Fix it in the V3s CCU driver.
--- drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/sunxi-ng/ccu-sun8i-v3s.c +1 -1
@@ -542,7 +542,7 @@ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = { [RST_BUS_OHCI0] = { 0x2c0, BIT(29) }, [RST_BUS_VE] = { 0x2c4, BIT(0) }, - [RST_BUS_TCON0] = { 0x2c4, BIT(3) }, + [RST_BUS_TCON0] = { 0x2c4, BIT(4) }, [RST_BUS_CSI] = { 0x2c4, BIT(8) }, [RST_BUS_DE] = { 0x2c4, BIT(12) }, [RST_BUS_DBG] = { 0x2c4, BIT(31) },
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 68/280 kallsyms: Handle too long symbols in kallsyms.c
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6db2983cd8064808141ccefd75218f5b4345ffae ]
When checking for symbols with excessively long names, account for null terminating character.
--- scripts/kallsyms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/kallsyms.c +2 -2
@@ -120,8 +120,8 @@ static int read_symbol(FILE *in, struct sym_entry *s)fprintf (stderr,"Read error or end of file.\n" );return -1 ; } -if (strlen (sym) >KSYM_NAME_LEN ) { -fprintf (stderr,"Symbol %s too long for kallsyms (%zu vs %d).\n" +if (strlen (sym) >=KSYM_NAME_LEN ) { +fprintf (stderr,"Symbol %s too long for kallsyms (%zu >= %d).\n" "Please increase KSYM_NAME_LEN both in kernel and kallsyms.c\n" , sym,strlen (sym),KSYM_NAME_LEN );return -1 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 69/280 clk: sunxi: A31: Fix wrong AHB gate number
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ee0b27a3a4da0b0ed2318aa092f8856896e9450b ]
According to the manual the gate clock for MMC3 is at bit 11, and NAND1 is controlled by bit 12.
Fix the gate bit definitions in the clock driver.
--- drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/sunxi-ng/ccu-sun6i-a31.c +2 -2
@@ -264,9 +264,9 @@ static SUNXI_CCU_GATE(ahb1_mmc1_clk, "ahb1-mmc1", "ahb1", static SUNXI_CCU_GATE(ahb1_mmc2_clk, "ahb1-mmc2", "ahb1", 0x060, BIT(10), 0); static SUNXI_CCU_GATE(ahb1_mmc3_clk, "ahb1-mmc3", "ahb1", - 0x060, BIT(12), 0); + 0x060, BIT(11), 0); static SUNXI_CCU_GATE(ahb1_nand1_clk, "ahb1-nand1", "ahb1", - 0x060, BIT(13), 0); + 0x060, BIT(12), 0); static SUNXI_CCU_GATE(ahb1_nand0_clk, "ahb1-nand0", "ahb1", 0x060, BIT(13), 0); static SUNXI_CCU_GATE(ahb1_sdram_clk, "ahb1-sdram", "ahb1",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 70/280 esp: Skip TX bytes accounting when sending from a request socket
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 09db51241118aeb06e1c8cd393b45879ce099b36 ]
On ESP output, sk_wmem_alloc is incremented for the added padding if a socket is associated to the skb. When replying with TCP SYNACKs over IPsec, the associated sk is a casted request socket, only. Increasing sk_wmem_alloc on a request socket results in a write at an arbitrary struct offset. In the best case, this produces the following WARNING:
WARNING: CPU: 1 PID: 0 at lib/refcount.c:102 esp_output_head+0x2e4/0x308 [esp4] refcount_t: addition on 0; use-after-free. CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc3 #2 Hardware name: Marvell Armada 380/385 (Device Tree)
[...]
[<bf0ff354>] (esp_output_head [esp4]) from [<bf1006a4>] (esp_output+0xb8/0x180 [esp4]) [<bf1006a4>] (esp_output [esp4]) from [<c05dee64>] (xfrm_output_resume+0x558/0x664) [<c05dee64>] (xfrm_output_resume) from [<c05d07b0>] (xfrm4_output+0x44/0xc4) [<c05d07b0>] (xfrm4_output) from [<c05956bc>] (tcp_v4_send_synack+0xa8/0xe8) [<c05956bc>] (tcp_v4_send_synack) from [<c0586ad8>] (tcp_conn_request+0x7f4/0x948) [<c0586ad8>] (tcp_conn_request) from [<c058c404>] (tcp_rcv_state_process+0x2a0/0xe64) [<c058c404>] (tcp_rcv_state_process) from [<c05958ac>] (tcp_v4_do_rcv+0xf0/0x1f4) [<c05958ac>] (tcp_v4_do_rcv) from [<c0598a4c>] (tcp_v4_rcv+0xdb8/0xe20) [<c0598a4c>] (tcp_v4_rcv) from [<c056eb74>] (ip_protocol_deliver_rcu+0x2c/0x2dc) [<c056eb74>] (ip_protocol_deliver_rcu) from [<c056ee6c>] (ip_local_deliver_finish+0x48/0x54) [<c056ee6c>] (ip_local_deliver_finish) from [<c056eecc>] (ip_local_deliver+0x54/0xec) [<c056eecc>] (ip_local_deliver) from [<c056efac>] (ip_rcv+0x48/0xb8) [<c056efac>] (ip_rcv) from [<c0519c2c>] (__netif_receive_skb_one_core+0x50/0x6c) [...]
The issue triggers only when not using TCP syncookies, as for syncookies no socket is associated.
--- net/ipv4/esp4.c | 2 +- net/ipv6/esp6.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/ipv4/esp4.c +1 -1
@@ -325,7 +325,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * skb->len += tailen; skb->data_len += tailen; skb->truesize += tailen; -if (sk) +if (sk &&sk_fullsock (sk))refcount_add (tailen, &sk->sk_wmem_alloc); goto out;
net/ipv6/esp6.c +1 -1
@@ -293,7 +293,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info skb->len += tailen; skb->data_len += tailen; skb->truesize += tailen; -if (sk) +if (sk &&sk_fullsock (sk))refcount_add (tailen, &sk->sk_wmem_alloc); goto out;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 71/280 ARM: 8824/1: fix a migrating irq bug when hotplug cpu
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1b5ba350784242eb1f899bcffd95d2c7cff61e84 ]
Arm TC2 fails cpu hotplug stress test.
This issue was tracked down to a missing copy of the new affinity cpumask for the vexpress-spc interrupt into struct irq_common_data.affinity when the interrupt is migrated in migrate_one_irq().
Fix it by replacing the arm specific hotplug cpu migration with the generic irq code.
This is the counterpart implementation to commit 217d453d473c ("arm64:
fix a migrating irq bug when hotplug cpu").
Tested with cpu hotplug stress test on Arm TC2 (multi_v7_defconfig plus CONFIG_ARM_BIG_LITTLE_CPUFREQ=y and CONFIG_ARM_VEXPRESS_SPC_CPUFREQ=y). The vexpress-spc interrupt (irq=22) on this board is affine to CPU0. Its affinity cpumask now changes correctly e.g. from 0 to 1-4 when CPU0 is hotplugged out.
--- arch/arm/Kconfig | 1 + arch/arm/include/asm/irq.h | 1 - arch/arm/kernel/irq.c | 62 -------------------------------------- arch/arm/kernel/smp.c | 2 +- 4 files changed, 2 insertions(+), 64 deletions(-)
arch/arm/Kconfig +1 -0
@@ -1444,6 +1444,7 @@ config NR_CPUS config HOTPLUG_CPU bool "Support for hot-pluggable CPUs" depends on SMP + select GENERIC_IRQ_MIGRATION help Say Y here to experiment with turning CPUs off and on. CPUs can be controlled through /sys/devices/system/cpu.
arch/arm/include/asm/irq.h +0 -1
@@ -25,7 +25,6 @@#ifndef __ASSEMBLY__struct irqaction ;struct pt_regs ; -extern void migrate_irqs (void );extern void asm_do_IRQ (unsigned int ,struct pt_regs *);void handle_IRQ (unsigned int ,struct pt_regs *);
arch/arm/kernel/irq.c +0 -62
71 lines not on this page · raw message
arch/arm/kernel/smp.c +1 -1
@@ -254,7 +254,7 @@ int __cpu_disable(void)/* * OK - migrate IRQs away from this CPU */ -migrate_irqs (); +irq_migrate_all_off_this_cpu ();/* * Flush user cache and TLB mappings, and then remove this CPU
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 72/280 bpf: only adjust gso_size on bytestream protocols
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b90efd2258749e04e1b3f71ef0d716f2ac2337e0 ]
bpf_skb_change_proto and bpf_skb_adjust_room change skb header length. For GSO packets they adjust gso_size to maintain the same MTU.
The gso size can only be safely adjusted on bytestream protocols. Commit d02f51cbcf12 ("bpf: fix bpf_skb_adjust_net/bpf_skb_proto_xlat to deal with gso sctp skbs") excluded SKB_GSO_SCTP.
Since then type SKB_GSO_UDP_L4 has been added, whose contents are one gso_size unit per datagram. Also exclude these.
Move from a blacklist to a whitelist check to future proof against additional such new GSO types, e.g., for fraglist based GRO.
--- include/linux/skbuff.h | 6 ++++++ net/core/filter.c | 12 ++++-------- 2 files changed, 10 insertions(+), 8 deletions(-)
include/linux/skbuff.h +6 -0
@@ -4086,6 +4086,12 @@ static inline bool skb_is_gso_sctp(const struct sk_buff *skb)return skb_shinfo (skb)->gso_type &SKB_GSO_SCTP ; } +static inline bool skb_is_gso_tcp (const struct sk_buff *skb) +{ +return skb_is_gso (skb) && +skb_shinfo (skb)->gso_type & (SKB_GSO_TCPV4 |SKB_GSO_TCPV6 ); +} +static inline void skb_gso_reset (struct sk_buff *skb) {skb_shinfo (skb)->gso_size =0 ;
net/core/filter.c +4 -8
@@ -2614,8 +2614,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)u32 off =skb_mac_header_len (skb);int ret; -/* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */ -if (skb_is_gso (skb) &&unlikely (skb_is_gso_sctp (skb))) +if (!skb_is_gso_tcp (skb))return -ENOTSUPP ; ret =skb_cow (skb, len_diff);
@@ -2656,8 +2655,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)u32 off =skb_mac_header_len (skb);int ret; -/* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */ -if (skb_is_gso (skb) &&unlikely (skb_is_gso_sctp (skb))) +if (!skb_is_gso_tcp (skb))return -ENOTSUPP ; ret =skb_unclone (skb,GFP_ATOMIC );
@@ -2782,8 +2780,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)u32 off =skb_mac_header_len (skb) +bpf_skb_net_base_len (skb);int ret; -/* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */ -if (skb_is_gso (skb) &&unlikely (skb_is_gso_sctp (skb))) +if (!skb_is_gso_tcp (skb))return -ENOTSUPP ; ret =skb_cow (skb, len_diff);
@@ -2812,8 +2809,7 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)u32 off =skb_mac_header_len (skb) +bpf_skb_net_base_len (skb);int ret; -/* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */ -if (skb_is_gso (skb) &&unlikely (skb_is_gso_sctp (skb))) +if (!skb_is_gso_tcp (skb))return -ENOTSUPP ; ret =skb_unclone (skb,GFP_ATOMIC );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 73/280 bpf: fix lockdep false positive in stackmap
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 3defaf2f15b2bfd86c6664181ac009e91985f8ac ]
Lockdep warns about false positive:
[ 11.211460] ------------[ cut here ]------------ [ 11.211936] DEBUG_LOCKS_WARN_ON(depth <= 0) [ 11.211985] WARNING: CPU: 0 PID: 141 at ../kernel/locking/lockdep.c:3592 lock_release+0x1ad/0x280 [ 11.213134] Modules linked in: [ 11.214954] RIP: 0010:lock_release+0x1ad/0x280 [ 11.223508] Call Trace: [ 11.223705] <IRQ> [ 11.223874] ? __local_bh_enable+0x7a/0x80 [ 11.224199] up_read+0x1c/0xa0 [ 11.224446] do_up_read+0x12/0x20 [ 11.224713] irq_work_run_list+0x43/0x70 [ 11.225030] irq_work_run+0x26/0x50 [ 11.225310] smp_irq_work_interrupt+0x57/0x1f0 [ 11.225662] irq_work_interrupt+0xf/0x20
since rw_semaphore is released in a different task vs task that locked the sema. It is expected behavior.
Fix the warning with up_read_non_owner() and rwsem_release() annotation.
--- kernel/bpf/stackmap.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/bpf/stackmap.c +7 -1
@@ -44,7 +44,7 @@ static void do_up_read(struct irq_work *entry)struct stack_map_irq_work *work; work = container_of(entry, struct stack_map_irq_work, irq_work); -up_read (work->sem); +up_read_non_owner (work->sem); work->sem =NULL ; }
@@ -338,6 +338,12 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, }else { work->sem = ¤t->mm->mmap_sem;irq_work_queue (&work->irq_work); +/* +* The irq_work will release the mmap_sem with +* up_read_non_owner(). The rwsem_release() is called +* here to release the lock from lockdep's perspective. +*/ +rwsem_release (¤t->mm->mmap_sem.dep_map,1 , _RET_IP_); } }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 74/280 af_key: unconditionally clone on broadcast
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fc2d5cfdcfe2ab76b263d91429caa22451123085 ]
Attempting to avoid cloning the skb when broadcasting by inflating the refcount with sock_hold/sock_put while under RCU lock is dangerous and violates RCU principles. It leads to subtle race conditions when attempting to free the SKB, as we may reference sockets that have already been freed by the stack.
Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c4b [006b6b6b6b6b6c4b] address between user and kernel address ranges Internal error: Oops: 96000004 [#1] PREEMPT SMP task: fffffff78f65b380 task.stack: ffffff8049a88000 pc : sock_rfree+0x38/0x6c lr : skb_release_head_state+0x6c/0xcc Process repro (pid: 7117, stack limit = 0xffffff8049a88000) Call trace: sock_rfree+0x38/0x6c skb_release_head_state+0x6c/0xcc skb_release_all+0x1c/0x38 __kfree_skb+0x1c/0x30 kfree_skb+0xd0/0xf4 pfkey_broadcast+0x14c/0x18c pfkey_sendmsg+0x1d8/0x408 sock_sendmsg+0x44/0x60 ___sys_sendmsg+0x1d0/0x2a8 __sys_sendmsg+0x64/0xb4 SyS_sendmsg+0x34/0x4c el0_svc_naked+0x34/0x38 Kernel panic - not syncing: Fatal exception
--- net/key/af_key.c | 40 +++++++++++++++------------------------- 1 file changed, 15 insertions(+), 25 deletions(-)
net/key/af_key.c +15 -25
@@ -196,30 +196,22 @@ static int pfkey_release(struct socket *sock)return 0 ; } -static int pfkey_broadcast_one (struct sk_buff *skb,struct sk_buff **skb2, -gfp_t allocation,struct sock *sk) +static int pfkey_broadcast_one (struct sk_buff *skb,gfp_t allocation, +struct sock *sk) {int err = -ENOBUFS ; -sock_hold (sk); -if (*skb2 ==NULL ) { -if (refcount_read (&skb->users) !=1 ) { - *skb2 =skb_clone (skb, allocation); - }else { - *skb2 = skb; -refcount_inc (&skb->users); - } - } -if (*skb2 !=NULL ) { -if (atomic_read (&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) { -skb_set_owner_r (*skb2, sk); -skb_queue_tail (&sk->sk_receive_queue, *skb2); - sk->sk_data_ready (sk); - *skb2 =NULL ; - err =0 ; - } +if (atomic_read (&sk->sk_rmem_alloc) > sk->sk_rcvbuf) +return err; + + skb =skb_clone (skb, allocation); + +if (skb) { +skb_set_owner_r (skb, sk); +skb_queue_tail (&sk->sk_receive_queue, skb); + sk->sk_data_ready (sk); + err =0 ; } -sock_put (sk);return err; }
@@ -234,7 +226,6 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, {struct netns_pfkey *net_pfkey =net_generic (net, pfkey_net_id);struct sock *sk; -struct sk_buff *skb2 =NULL ;int err = -ESRCH ;/* XXX Do we need something like netlink_overrun? I think
@@ -253,7 +244,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,* socket. */ if (pfk->promisc) -pfkey_broadcast_one (skb, &skb2,GFP_ATOMIC , sk); +pfkey_broadcast_one (skb,GFP_ATOMIC , sk);/* the exact target will be processed later */ if (sk == one_sk)
@@ -268,7 +259,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,continue ; } - err2 =pfkey_broadcast_one (skb, &skb2,GFP_ATOMIC , sk); + err2 =pfkey_broadcast_one (skb,GFP_ATOMIC , sk);/* Error is cleared after successful sending to at least one * registered KM */
@@ -278,9 +269,8 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,rcu_read_unlock ();if (one_sk !=NULL ) - err =pfkey_broadcast_one (skb, &skb2, allocation, one_sk); + err =pfkey_broadcast_one (skb, allocation, one_sk); -kfree_skb (skb2);kfree_skb (skb);return err; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 75/280 ARM: 8835/1: dma-mapping: Clear DMA ops on teardown
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fc67e6f120a388b611d94cc40baf99a5cc56b283 ]
Installing the appropriate non-IOMMU DMA ops in arm_iommu_detch_device() serves the case where IOMMU-aware drivers choose to control their own mapping but still make DMA API calls, however it also affects the case when the arch code itself tears down the mapping upon driver unbinding, where the ops now get left in place and can inhibit arch_setup_dma_ops() on subsequent re-probe attempts.
Fix the latter case by making sure that arch_teardown_dma_ops() cleans up whenever the ops were automatically installed by its counterpart.
--- arch/arm/mm/dma-mapping.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/mm/dma-mapping.c +2 -0
@@ -2400,4 +2400,6 @@ void arch_teardown_dma_ops(struct device *dev)return ;arm_teardown_iommu_dma_ops (dev); +/* Let arch_setup_dma_ops() start again from scratch upon re-probe */ +set_dma_ops (dev,NULL ); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 76/280 assoc_array: Fix shortcut creation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit bb2ba2d75a2d673e76ddaf13a9bd30d6a8b1bb08 ]
Fix the creation of shortcuts for which the length of the index key value is an exact multiple of the machine word size. The problem is that the code that blanks off the unused bits of the shortcut value malfunctions if the number of bits in the last word equals machine word size. This is due to the "<<" operator being given a shift of zero in this case, and so the mask that should be all zeros is all ones instead. This causes the subsequent masking operation to clear everything rather than clearing nothing.
Ordinarily, the presence of the hash at the beginning of the tree index key makes the issue very hard to test for, but in this case, it was encountered due to a development mistake that caused the hash output to be either 0 (keyring) or 1 (non-keyring) only. This made it susceptible to the keyctl/unlink/valid test in the keyutils package.
The fix is simply to skip the blanking if the shift would be 0. For example, an index key that is 64 bits long would produce a 0 shift and thus a 'blank' of all 1s. This would then be inverted and AND'd onto the index_key, incorrectly clearing the entire last word.
--- lib/assoc_array.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
lib/assoc_array.c +5 -3
@@ -768,9 +768,11 @@ all_leaves_cluster_together: new_s0->index_key[i] = ops->get_key_chunk (index_key, i *ASSOC_ARRAY_KEY_CHUNK_SIZE ); - blank =ULONG_MAX << (level &ASSOC_ARRAY_KEY_CHUNK_MASK ); -pr_devel ("blank off [%zu] %d: %lx\n" , keylen -1 , level, blank); - new_s0->index_key[keylen -1 ] &= ~blank; +if (level &ASSOC_ARRAY_KEY_CHUNK_MASK ) { + blank =ULONG_MAX << (level &ASSOC_ARRAY_KEY_CHUNK_MASK ); +pr_devel ("blank off [%zu] %d: %lx\n" , keylen -1 , level, blank); + new_s0->index_key[keylen -1 ] &= ~blank; + }/* This now reduces to a node splitting exercise for which we'll need * to regenerate the disparity table.
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 77/280 keys: Fix dependency loop between construction record and auth key
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 822ad64d7e46a8e2c8b8a796738d7b657cbb146d ]
In the request_key() upcall mechanism there's a dependency loop by which if a key type driver overrides the ->request_key hook and the userspace side manages to lose the authorisation key, the auth key and the internal construction record (struct key_construction) can keep each other pinned.
Fix this by the following changes:
(1) Killing off the construction record and using the auth key instead.
(2) Including the operation name in the auth key payload and making the payload available outside of security/keys/.
(3) The ->request_key hook is given the authkey instead of the cons record and operation name.
Changes (2) and (3) allow the auth key to naturally be cleaned up if the keyring it is in is destroyed or cleared or the auth key is unlinked.
--- fs/nfs/nfs4idmap.c | 31 ++++++------ include/keys/request_key_auth-type.h | 36 ++++++++++++++ include/linux/key-type.h | 22 +++------ security/keys/internal.h | 13 +---- security/keys/keyctl.c | 1 + security/keys/process_keys.c | 1 + security/keys/request_key.c | 72 +++++++++++----------------- security/keys/request_key_auth.c | 16 ++++--- 8 files changed, 100 insertions(+), 92 deletions(-) create mode 100644 include/keys/request_key_auth-type.h
fs/nfs/nfs4idmap.c +17 -14
@@ -44,6 +44,7 @@#include <linux/keyctl.h> #include <linux/key-type.h> #include <keys/user-type.h> +#include <keys/request_key_auth-type.h> #include <linux/module.h> #include "internal.h"
@@ -59,7 +60,7 @@ static struct key_type key_type_id_resolver_legacy;struct idmap_legacy_upcalldata {struct rpc_pipe_msg pipe_msg;struct idmap_msg idmap_msg; -struct key_construction *key_cons; +struct key *authkey;struct idmap *idmap; };
@@ -384,7 +385,7 @@ static const match_table_t nfs_idmap_tokens = { { Opt_find_err, NULL } }; -static int nfs_idmap_legacy_upcall (struct key_construction *,const char *,void *); +static int nfs_idmap_legacy_upcall (struct key *,void *);static ssize_t idmap_pipe_downcall (struct file *,const char __user *,size_t );static void idmap_release_pipe (struct inode *);
@@ -549,11 +550,12 @@ nfs_idmap_prepare_pipe_upcall(struct idmap *idmap,static void nfs_idmap_complete_pipe_upcall_locked (struct idmap *idmap,int ret) { -struct key_construction *cons = idmap->idmap_upcall_data->key_cons; +struct key *authkey = idmap->idmap_upcall_data->authkey;kfree (idmap->idmap_upcall_data); idmap->idmap_upcall_data =NULL ; -complete_request_key (cons, ret); +complete_request_key (authkey, ret); +key_put (authkey); } static void
@@ -563,15 +565,14 @@ nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret)nfs_idmap_complete_pipe_upcall_locked (idmap, ret); } -static int nfs_idmap_legacy_upcall (struct key_construction *cons, -const char *op, -void *aux) +static int nfs_idmap_legacy_upcall (struct key *authkey,void *aux) {struct idmap_legacy_upcalldata *data; +struct request_key_auth *rka =get_request_key_auth (authkey);struct rpc_pipe_msg *msg;struct idmap_msg *im;struct idmap *idmap = (struct idmap *)aux; -struct key *key = cons->key; +struct key *key = rka->target_key;int ret = -ENOKEY ;if (!aux)
@@ -586,7 +587,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons, msg = &data->pipe_msg; im = &data->idmap_msg; data->idmap = idmap; - data->key_cons = cons; + data->authkey =key_get (authkey); ret =nfs_idmap_prepare_message (key->description, idmap, im, msg);if (ret <0 )
@@ -604,7 +605,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons, out2:kfree (data); out1: -complete_request_key (cons, ret); +complete_request_key (authkey, ret);return ret; }
@@ -651,9 +652,10 @@ out:static ssize_t idmap_pipe_downcall (struct file *filp,const char __user *src,size_t mlen) { +struct request_key_auth *rka;struct rpc_inode *rpci =RPC_I (file_inode (filp));struct idmap *idmap = (struct idmap *)rpci->private; -struct key_construction *cons; +struct key *authkey;struct idmap_msg im;size_t namelen_in;int ret = -ENOKEY ;
@@ -665,7 +667,8 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)if (idmap->idmap_upcall_data ==NULL ) goto out_noupcall; - cons = idmap->idmap_upcall_data->key_cons; + authkey = idmap->idmap_upcall_data->authkey; + rka =get_request_key_auth (authkey);if (mlen !=sizeof (im)) { ret = -ENOSPC ;
@@ -690,9 +693,9 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) ret =nfs_idmap_read_and_verify_message (&im, &idmap->idmap_upcall_data->idmap_msg, - cons->key, cons->authkey); + rka->target_key, authkey);if (ret >=0 ) { -key_set_timeout (cons->key, nfs_idmap_cache_timeout); +key_set_timeout (rka->target_key, nfs_idmap_cache_timeout); ret = mlen; }
include/keys/request_key_auth-type.h new file +36 -0
@@ -0,0 +1,36 @@ +/* request_key authorisation token key type +* +* Copyright (C) 2005 Red Hat, Inc. All Rights Reserved. +* Written by David Howells ([email protected]) +* +* This program is free software; you can redistribute it and/or +* modify it under the terms of the GNU General Public Licence +* as published by the Free Software Foundation; either version +* 2 of the Licence, or (at your option) any later version. +*/ + +#ifndef _KEYS_REQUEST_KEY_AUTH_TYPE_H +#define _KEYS_REQUEST_KEY_AUTH_TYPE_H + +#include <linux/key.h> + +/* +* Authorisation record for request_key(). +*/ +struct request_key_auth { +struct key *target_key; +struct key *dest_keyring; +const struct cred *cred; +void *callout_info; +size_t callout_len; +pid_t pid; +char op[8 ]; +} __randomize_layout; + +static inline struct request_key_auth *get_request_key_auth (const struct key *key) +{ +return key->payload.data[0 ]; +} + + +#endif /* _KEYS_REQUEST_KEY_AUTH_TYPE_H */
include/linux/key-type.h +6 -16
@@ -17,15 +17,6 @@#ifdef CONFIG_KEYS -/* -* key under-construction record -* - passed to the request_key actor if supplied -*/ -struct key_construction { -struct key *key;/* key being constructed */ -struct key *authkey;/* authorisation for key being constructed */ -}; -/* * Pre-parsed payload, used by key add, update and instantiate. *
@@ -47,8 +38,7 @@ struct key_preparsed_payload {time64_t expiry;/* Expiry time of key */ } __randomize_layout; -typedef int (*request_key_actor_t )(struct key_construction *key, -const char *op,void *aux); +typedef int (*request_key_actor_t )(struct key *auth_key,void *aux);/* * Preparsed matching criterion.
@@ -170,20 +160,20 @@ extern int key_instantiate_and_link(struct key *key,const void *data, size_t datalen, struct key *keyring, - struct key *instkey); + struct key *authkey);extern int key_reject_and_link (struct key *key,unsigned timeout,unsigned error,struct key *keyring, -struct key *instkey); -extern void complete_request_key (struct key_construction *cons,int error); +struct key *authkey); +extern void complete_request_key (struct key *authkey,int error);static inline int key_negate_and_link (struct key *key,unsigned timeout,struct key *keyring, -struct key *instkey) +struct key *authkey) { -return key_reject_and_link (key, timeout,ENOKEY , keyring, instkey); +return key_reject_and_link (key, timeout,ENOKEY , keyring, authkey); }extern int generic_key_instantiate (struct key *key,struct key_preparsed_payload *prep);
security/keys/internal.h +1 -12
@@ -188,20 +188,9 @@ static inline int key_permission(const key_ref_t key_ref, unsigned perm)return key_task_permission (key_ref,current_cred (), perm); } -/* -* Authorisation record for request_key(). -*/ -struct request_key_auth { -struct key *target_key; -struct key *dest_keyring; -const struct cred *cred; -void *callout_info; -size_t callout_len; -pid_t pid; -} __randomize_layout; -extern struct key_type key_type_request_key_auth;extern struct key *request_key_auth_new (struct key *target, +const char *op,const void *callout_info,size_t callout_len,struct key *dest_keyring);
security/keys/keyctl.c +1 -0
@@ -26,6 +26,7 @@#include <linux/security.h> #include <linux/uio.h> #include <linux/uaccess.h> +#include <keys/request_key_auth-type.h> #include "internal.h" #define KEY_MAX_DESC_SIZE 4096
security/keys/process_keys.c +1 -0
@@ -20,6 +20,7 @@#include <linux/security.h> #include <linux/user_namespace.h> #include <linux/uaccess.h> +#include <keys/request_key_auth-type.h> #include "internal.h" /* Session keyring create vs join semaphore */
security/keys/request_key.c +29 -43
144 lines not on this page · raw message
security/keys/request_key_auth.c +9 -7
@@ -18,7 +18,7 @@#include <linux/slab.h> #include <linux/uaccess.h> #include "internal.h" -#include <keys/user-type.h> +#include <keys/request_key_auth-type.h> static int request_key_auth_preparse (struct key_preparsed_payload *);static void request_key_auth_free_preparse (struct key_preparsed_payload *);
@@ -69,7 +69,7 @@ static int request_key_auth_instantiate(struct key *key,static void request_key_auth_describe (const struct key *key,struct seq_file *m) { -struct request_key_auth *rka = key->payload.data[0 ]; +struct request_key_auth *rka =get_request_key_auth (key);seq_puts (m,"key:" );seq_puts (m, key->description);
@@ -84,7 +84,7 @@ static void request_key_auth_describe(const struct key *key,static long request_key_auth_read (const struct key *key,char __user *buffer,size_t buflen) { -struct request_key_auth *rka = key->payload.data[0 ]; +struct request_key_auth *rka =get_request_key_auth (key);size_t datalen;long ret;
@@ -110,7 +110,7 @@ static long request_key_auth_read(const struct key *key,*/ static void request_key_auth_revoke (struct key *key) { -struct request_key_auth *rka = key->payload.data[0 ]; +struct request_key_auth *rka =get_request_key_auth (key);kenter ("{%d}" , key->serial);
@@ -137,7 +137,7 @@ static void free_request_key_auth(struct request_key_auth *rka)*/ static void request_key_auth_destroy (struct key *key) { -struct request_key_auth *rka = key->payload.data[0 ]; +struct request_key_auth *rka =get_request_key_auth (key);kenter ("{%d}" , key->serial);
@@ -148,8 +148,9 @@ static void request_key_auth_destroy(struct key *key)* Create an authorisation token for /sbin/request-key or whoever to gain * access to the caller's security data. */ -struct key *request_key_auth_new (struct key *target,const void *callout_info, -size_t callout_len,struct key *dest_keyring) +struct key *request_key_auth_new (struct key *target,const char *op, +const void *callout_info,size_t callout_len, +struct key *dest_keyring) {struct request_key_auth *rka, *irka;const struct cred *cred = current->cred;
@@ -167,6 +168,7 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,if (!rka->callout_info) goto error_free_rka; rka->callout_len = callout_len; +strlcpy (rka->op, op,sizeof (rka->op));/* see if the calling process is already servicing the key request of * another process */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 78/280 scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 79edd00dc6a96644d76b4a1cb97d94d49e026768 ]
When a target sends Check Condition, whilst initiator is busy xmiting re-queued data, could lead to race between iscsi_complete_task() and iscsi_xmit_task() and eventually crashing with the following kernel backtrace.
[3326150.987523] ALERT: BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 [3326150.987549] ALERT: IP: [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.987571] WARN: PGD 569c8067 PUD 569c9067 PMD 0 [3326150.987582] WARN: Oops: 0002 [#1] SMP [3326150.987593] WARN: Modules linked in: tun nfsv3 nfs fscache dm_round_robin [3326150.987762] WARN: CPU: 2 PID: 8399 Comm: kworker/u32:1 Tainted: G O 4.4.0+2 #1 [3326150.987774] WARN: Hardware name: Dell Inc. PowerEdge R720/0W7JN5, BIOS 2.5.4 01/22/2016 [3326150.987790] WARN: Workqueue: iscsi_q_13 iscsi_xmitworker [libiscsi] [3326150.987799] WARN: task: ffff8801d50f3800 ti: ffff8801f5458000 task.ti: ffff8801f5458000 [3326150.987810] WARN: RIP: e030:[<ffffffffa05ce70d>] [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.987825] WARN: RSP: e02b:ffff8801f545bdb0 EFLAGS: 00010246 [3326150.987831] WARN: RAX: 00000000ffffffc3 RBX: ffff880282d2ab20 RCX: ffff88026b6ac480 [3326150.987842] WARN: RDX: 0000000000000000 RSI: 00000000fffffe01 RDI: ffff880282d2ab20 [3326150.987852] WARN: RBP: ffff8801f545bdc8 R08: 0000000000000000 R09: 0000000000000008 [3326150.987862] WARN: R10: 0000000000000000 R11: 000000000000fe88 R12: 0000000000000000 [3326150.987872] WARN: R13: ffff880282d2abe8 R14: ffff880282d2abd8 R15: ffff880282d2ac08 [3326150.987890] WARN: FS: 00007f5a866b4840(0000) GS:ffff88028a640000(0000) knlGS:0000000000000000 [3326150.987900] WARN: CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [3326150.987907] WARN: CR2: 0000000000000078 CR3: 0000000070244000 CR4: 0000000000042660 [3326150.987918] WARN: Stack: [3326150.987924] WARN: ffff880282d2ad58 ffff880282d2ab20 ffff880282d2abe8 ffff8801f545be18 [3326150.987938] WARN: ffffffffa05cea90 ffff880282d2abf8 ffff88026b59cc80 ffff88026b59cc00 [3326150.987951] WARN: ffff88022acf32c0 ffff880289491800 ffff880255a80800 0000000000000400 [3326150.987964] WARN: Call Trace: [3326150.987975] WARN: [<ffffffffa05cea90>] iscsi_xmitworker+0x2f0/0x360 [libiscsi] [3326150.987988] WARN: [<ffffffff8108862c>] process_one_work+0x1fc/0x3b0 [3326150.987997] WARN: [<ffffffff81088f95>] worker_thread+0x2a5/0x470 [3326150.988006] WARN: [<ffffffff8159cad8>] ? __schedule+0x648/0x870 [3326150.988015] WARN: [<ffffffff81088cf0>] ? rescuer_thread+0x300/0x300 [3326150.988023] WARN: [<ffffffff8108ddf5>] kthread+0xd5/0xe0 [3326150.988031] WARN: [<ffffffff8108dd20>] ? kthread_stop+0x110/0x110 [3326150.988040] WARN: [<ffffffff815a0bcf>] ret_from_fork+0x3f/0x70 [3326150.988048] WARN: [<ffffffff8108dd20>] ? kthread_stop+0x110/0x110 [3326150.988127] ALERT: RIP [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.988138] WARN: RSP <ffff8801f545bdb0> [3326150.988144] WARN: CR2: 0000000000000078 [3326151.020366] WARN: ---[ end trace 1c60974d4678d81b ]---
Commit 6f8830f5bbab ("scsi: libiscsi: add lock around task lists to fix list corruption regression") introduced "taskqueuelock" to fix list corruption during the race, but this wasn't enough.
Re-setting of conn->task to NULL, could race with iscsi_xmit_task(). iscsi_complete_task()
{
....
if (conn->task == task)
conn->task = NULL;
}conn->task in iscsi_xmit_task() could be NULL and so will be task. __iscsi_get_task(task) will crash (NullPtr de-ref), trying to access refcount.
iscsi_xmit_task()
{
struct iscsi_task *task = conn->task;
__iscsi_get_task(task);
}This commit will take extra conn->session->back_lock in iscsi_xmit_task() to ensure iscsi_xmit_task() waits for iscsi_complete_task(), if iscsi_complete_task() wins the race. If iscsi_xmit_task() wins the race, iscsi_xmit_task() increments task->refcount
(__iscsi_get_task) ensuring iscsi_complete_task() will not iscsi_free_task().
--- drivers/scsi/libiscsi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/scsi/libiscsi.c +6 -0
@@ -1449,7 +1449,13 @@ static int iscsi_xmit_task(struct iscsi_conn *conn)if (test_bit (ISCSI_SUSPEND_BIT , &conn->suspend_tx))return -ENODATA ; +spin_lock_bh (&conn->session->back_lock); +if (conn->task ==NULL ) { +spin_unlock_bh (&conn->session->back_lock); +return -ENODATA ; + }__iscsi_get_task (task); +spin_unlock_bh (&conn->session->back_lock);spin_unlock_bh (&conn->session->frwd_lock); rc = conn->session->tt->xmit_task (task);spin_lock_bh (&conn->session->frwd_lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 79/280 net: systemport: Fix reception of BPDUs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a40061ea2e39494104602b3048751341bda374a1 ]
SYSTEMPORT has its RXCHK parser block that attempts to validate the packet structures, unfortunately setting the L2 header check bit will cause Bridge PDUs (BPDUs) to be incorrectly rejected because they look like LLC/SNAP packets with a non-IPv4 or non-IPv6 Ethernet Type.
--- drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/broadcom/bcmsysport.c +4 -0
@@ -134,6 +134,10 @@ static int bcm_sysport_set_rx_csum(struct net_device *dev, priv->rx_chk_en = !!(wanted &NETIF_F_RXCSUM ); reg =rxchk_readl (priv,RXCHK_CONTROL ); +/* Clear L2 header checks, which would prevent BPDUs +* from being received. +*/ + reg &= ~RXCHK_L2_HDR_DIS ;if (priv->rx_chk_en) reg |=RXCHK_EN ;else
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 80/280 net: dsa: bcm_sf2: Do not assume DSA master supports WoL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c3152ec4c0691e351f35a2f63347a464b5f35151 ]
We assume in the bcm_sf2 driver that the DSA master network device supports ethtool_ops::{get,set}_wol operations, which is not a given. Avoid de-referencing potentially non-existent function pointers and check them as we should.
--- drivers/net/dsa/bcm_sf2.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/dsa/bcm_sf2.c +6 -4
@@ -724,10 +724,11 @@ static void bcm_sf2_sw_get_wol(struct dsa_switch *ds, int port, {struct net_device *p = ds->ports[port].cpu_dp->master;struct bcm_sf2_priv *priv =bcm_sf2_to_priv (ds); -struct ethtool_wolinfo pwol; +struct ethtool_wolinfo pwol = { };/* Get the parent device WoL settings */ - p->ethtool_ops->get_wol (p, &pwol); +if (p->ethtool_ops->get_wol) + p->ethtool_ops->get_wol (p, &pwol);/* Advertise the parent device supported settings */ wol->supported = pwol.supported;
@@ -748,9 +749,10 @@ static int bcm_sf2_sw_set_wol(struct dsa_switch *ds, int port,struct net_device *p = ds->ports[port].cpu_dp->master;struct bcm_sf2_priv *priv =bcm_sf2_to_priv (ds);s8 cpu_port = ds->ports[port].cpu_dp->index; -struct ethtool_wolinfo pwol; +struct ethtool_wolinfo pwol = { }; - p->ethtool_ops->get_wol (p, &pwol); +if (p->ethtool_ops->get_wol) + p->ethtool_ops->get_wol (p, &pwol);if (wol->wolopts & ~pwol.supported)return -EINVAL ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 81/280 pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c17abcfa93bf0be5e48bb011607d237ac2bfc839 ]
Fix the mismatch between the "sdxc_d13_1_a" pin group definition from meson8b_cbus_groups and the entry in sdxc_a_groups ("sdxc_d0_13_1_a"). This makes it possible to use "sdxc_d13_1_a" in device-tree files to route the MMC data 1..3 pins to GPIOX_1..3.
--- drivers/pinctrl/meson/pinctrl-meson8b.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/meson/pinctrl-meson8b.c +1 -1
@@ -665,7 +665,7 @@ static const char * const sd_a_groups[] = {static const char *const sdxc_a_groups[] = {"sdxc_d0_0_a" ,"sdxc_d13_0_a" ,"sdxc_d47_a" ,"sdxc_clk_a" , -"sdxc_cmd_a" ,"sdxc_d0_1_a" ,"sdxc_d0_13_1_a" +"sdxc_cmd_a" ,"sdxc_d0_1_a" ,"sdxc_d13_1_a" };static const char *const pcm_a_groups[] = {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 82/280 qmi_wwan: apply SET_DTR quirk to Sierra WP7607
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 97dc47a1308a3af46a09b1546cfb869f2e382a81 ]
The 1199:68C0 USB ID is reused by Sierra WP7607 which requires the DTR quirk to be detected. Apply QMI_QUIRK_SET_DTR unconditionally as already done for other IDs shared between different devices.
--- drivers/net/usb/qmi_wwan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/usb/qmi_wwan.c +2 -2
@@ -1208,8 +1208,8 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ {QMI_FIXED_INTF(0x1199, 0x68a2, 19)}, /* Sierra Wireless MC7710 in QMI mode */ - {QMI_FIXED_INTF(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC7304/MC7354 */ - {QMI_FIXED_INTF(0x1199, 0x68c0, 10)}, /* Sierra Wireless MC7304/MC7354 */ + {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC7304/MC7354, WP76xx */ + {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 10)},/* Sierra Wireless MC7304/MC7354 */ {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */ {QMI_FIXED_INTF(0x1199, 0x901f, 8)}, /* Sierra Wireless EM7355 */ {QMI_FIXED_INTF(0x1199, 0x9041, 8)}, /* Sierra Wireless MC7305/MC7355 */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 83/280 net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e928b5d6b75e239feb9c6d5488974b6646a0ebc8 ]
If mv643xx_eth_shared_of_probe() fails, mv643xx_eth_shared_probe() leaves clk enabled.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/ethernet/marvell/mv643xx_eth.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/mv643xx_eth.c +6 -1
@@ -2886,7 +2886,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev) ret =mv643xx_eth_shared_of_probe (pdev);if (ret) -return ret; + goto err_put_clk; pd =dev_get_platdata (&pdev->dev); msp->tx_csum_limit = (pd != NULL && pd->tx_csum_limit) ?
@@ -2894,6 +2894,11 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)infer_hw_params (msp);return 0 ; + +err_put_clk: +if (!IS_ERR (msp->clk)) +clk_disable_unprepare (msp->clk); +return ret; }static int mv643xx_eth_shared_remove (struct platform_device *pdev)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 84/280 xfrm: Fix inbound traffic via XFRM interfaces across network namespaces
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 660899ddf06ae8bb5bbbd0a19418b739375430c5 ]
After moving an XFRM interface to another namespace it stays associated with the original namespace (net in struct xfrm_if and the list keyed with xfrmi_net_id), allowing processes in the new namespace to use SAs/policies that were created in the original namespace. For instance, this allows a keying daemon in one namespace to establish IPsec SAs for other namespaces without processes there having access to the keys or IKE credentials.
This worked fine for outbound traffic, however, for inbound traffic the lookup for the interfaces and the policies used the incorrect namespace (the one the XFRM interface was moved to).
--- net/xfrm/xfrm_interface.c | 4 ++-- net/xfrm/xfrm_policy.c | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-)
net/xfrm/xfrm_interface.c +2 -2
@@ -76,10 +76,10 @@ static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb)int ifindex;struct xfrm_if *xi; -if (!skb->dev) +if (!secpath_exists (skb) || !skb->dev)return NULL ; - xfrmn =net_generic (dev_net (skb->dev), xfrmi_net_id); + xfrmn =net_generic (xs_net (xfrm_input_state (skb)), xfrmi_net_id); ifindex = skb->dev->ifindex;for_each_xfrmi_rcu (xfrmn->xfrmi[0 ], xi) {
net/xfrm/xfrm_policy.c +3 -1
@@ -2340,8 +2340,10 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,if (ifcb) { xi = ifcb->decode_session (skb); -if (xi) +if (xi) { if_id = xi->p.if_id; + net = xi->net; + } }rcu_read_unlock ();
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 85/280 mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d7bf31a0f85faaf63c63c39d55154825a1eaaea9 ]
RING_CONTROL reg was not written due to wrong address, hence all the subsequent ring flush was timing out.
--- drivers/mailbox/bcm-flexrm-mailbox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mailbox/bcm-flexrm-mailbox.c +2 -2
@@ -1396,9 +1396,9 @@ static void flexrm_shutdown(struct mbox_chan *chan)/* Clear ring flush state */ timeout =1000 ;/* timeout of 1s */ -writel_relaxed (0x0 , ring +RING_CONTROL ); +writel_relaxed (0x0 , ring->regs +RING_CONTROL ); do { - if (!(readl_relaxed(ring + RING_FLUSH_DONE) & + if (!(readl_relaxed(ring->regs + RING_FLUSH_DONE) & FLUSH_DONE_MASK)) break; mdelay(1);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 86/280 ASoC: topology: free created components in tplg load error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 304017d31df36fb61eb2ed3ebf65fb6870b3c731 ]
Topology resources are no longer needed if any element failed to load.
--- sound/soc/soc-topology.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/soc-topology.c +7 -1
@@ -2493,6 +2493,7 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp, struct snd_soc_tplg_ops *ops, const struct firmware *fw, u32 id) { struct soc_tplg tplg; +int ret;/* setup parsing context */ memset (&tplg,0 ,sizeof (tplg));
@@ -2506,7 +2507,12 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp, tplg.bytes_ext_ops = ops->bytes_ext_ops; tplg.bytes_ext_ops_count = ops->bytes_ext_ops_count; -return soc_tplg_load (&tplg); + ret =soc_tplg_load (&tplg); +/* free the created components if fail to load topology */ +if (ret) +snd_soc_tplg_component_remove (comp,SND_SOC_TPLG_INDEX_ALL ); + +return ret; }EXPORT_SYMBOL_GPL (snd_soc_tplg_component_load);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 87/280 qed: Fix iWARP buffer size provided for syn packet processing.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9addc92730df55e2c05e8d3f69267a89d65bcba8 ]
The assumption that the maximum size of a syn packet is 128 bytes is wrong. Tunneling headers were not accounted for. Allocate buffers large enough for mtu.
--- drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 12 ++++++------ drivers/net/ethernet/qlogic/qed/qed_iwarp.h | 1 - 2 files changed, 6 insertions(+), 7 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_iwarp.c +6 -6
@@ -2606,7 +2606,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,struct qed_iwarp_info *iwarp_info;struct qed_ll2_acquire_data data;struct qed_ll2_cbs cbs; -u32 mpa_buff_size; +u32 buff_size;u16 n_ooo_bufs;int rc =0 ;int i;
@@ -2633,7 +2633,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,memset (&data,0 ,sizeof (data)); data.input.conn_type =QED_LL2_TYPE_IWARP ; - data.input.mtu =QED_IWARP_MAX_SYN_PKT_SIZE ; + data.input.mtu = params->max_mtu; data.input.rx_num_desc =QED_IWARP_LL2_SYN_RX_SIZE ; data.input.tx_num_desc =QED_IWARP_LL2_SYN_TX_SIZE ; data.input.tx_max_bds_per_packet =1 ;/* will never be fragmented */
@@ -2655,9 +2655,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn, goto err; } + buff_size =QED_IWARP_MAX_BUF_SIZE (params->max_mtu); rc =qed_iwarp_ll2_alloc_buffers (p_hwfn,QED_IWARP_LL2_SYN_RX_SIZE , -QED_IWARP_MAX_SYN_PKT_SIZE , + buff_size, iwarp_info->ll2_syn_handle);if (rc) goto err;
@@ -2711,10 +2712,9 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,if (rc) goto err; - mpa_buff_size =QED_IWARP_MAX_BUF_SIZE (params->max_mtu); rc =qed_iwarp_ll2_alloc_buffers (p_hwfn, data.input.rx_num_desc, - mpa_buff_size, + buff_size, iwarp_info->ll2_mpa_handle);if (rc) goto err;
@@ -2727,7 +2727,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn, iwarp_info->max_num_partial_fpdus = (u16 )p_hwfn->p_rdma_info->num_qps; - iwarp_info->mpa_intermediate_buf =kzalloc (mpa_buff_size,GFP_KERNEL ); + iwarp_info->mpa_intermediate_buf =kzalloc (buff_size,GFP_KERNEL );if (!iwarp_info->mpa_intermediate_buf) goto err;
drivers/net/ethernet/qlogic/qed/qed_iwarp.h +0 -1
@@ -46,7 +46,6 @@ enum qed_iwarp_qp_state qed_roce2iwarp_state(enum qed_roce_qp_state state);#define QED_IWARP_LL2_SYN_TX_SIZE (128)#define QED_IWARP_LL2_SYN_RX_SIZE (256) -#define QED_IWARP_MAX_SYN_PKT_SIZE (128)#define QED_IWARP_LL2_OOO_DEF_TX_SIZE (256)#define QED_IWARP_MAX_OOO (16)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 88/280 qed: Fix iWARP syn packet mac address validation.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8be3dadf04050c2907760ec1955ca1c8fbc25585 ]
The ll2 forwards all syn packets to the driver without validating the mac address. Add validation check in the driver's iWARP listener flow and drop the packet if it isn't intended for the device.
--- drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/qlogic/qed/qed_iwarp.c +9 -0
@@ -1689,6 +1689,15 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn, eth_hlen =ETH_HLEN + (vlan_valid ?sizeof (u32) :0 ); +if (!ether_addr_equal (ethh->h_dest, + p_hwfn->p_rdma_info->iwarp.mac_addr)) { +DP_VERBOSE (p_hwfn, +QED_MSG_RDMA , +"Got unexpected mac %pM instead of %pM\n" , + ethh->h_dest, p_hwfn->p_rdma_info->iwarp.mac_addr); +return -EINVAL ; + } +ether_addr_copy (remote_mac_addr, ethh->h_source);ether_addr_copy (local_mac_addr, ethh->h_dest);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 89/280 ARM: dts: armada-xp: fix Armada XP boards NAND description
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6fc979179c98d2591784937d5618edc3e5cd31c1 ]
Commit 3b79919946cd2cf4dac47842afc9a893acec4ed7 ("ARM: dts:
armada-370-xp: update NAND node with new bindings") updated some Marvell Armada DT description to use the new NAND controller bindings, but did it incorrectly for a number of boards: armada-xp-gp, armada-xp-db and armada-xp-lenovo-ix4-300d. Due to this, the NAND is no longer detected on those platforms.
This commit fixes that by properly using the new NAND DT binding. This commit was runtime-tested on Armada XP GP, the two other platforms are only compile-tested.
--- arch/arm/boot/dts/armada-xp-db.dts | 46 +++++----- arch/arm/boot/dts/armada-xp-gp.dts | 13 +-- .../boot/dts/armada-xp-lenovo-ix4-300d.dts | 85 ++++++++++--------- 3 files changed, 76 insertions(+), 68 deletions(-)
arch/arm/boot/dts/armada-xp-db.dts +24 -22
@@ -144,30 +144,32 @@ status = "okay"; }; - nand@d0000 { + nand-controller@d0000 { status = "okay"; - label = "pxa3xx_nand-0"; - num-cs = <1>; - marvell,nand-keep-config; - nand-on-flash-bbt; - - partitions { - compatible = "fixed-partitions"; - #address-cells = <1>; - #size-cells = <1>; - - partition@0 { - label = "U-Boot"; - reg = <0 0x800000>; - }; - partition@800000 { - label = "Linux"; - reg = <0x800000 0x800000>; - }; - partition@1000000 { - label = "Filesystem"; - reg = <0x1000000 0x3f000000>; + nand@0 { + reg = <0>; + label = "pxa3xx_nand-0"; + nand-rb = <0>; + nand-on-flash-bbt; + + partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; + #size-cells = <1>; + + partition@0 { + label = "U-Boot"; + reg = <0 0x800000>; + }; + partition@800000 { + label = "Linux"; + reg = <0x800000 0x800000>; + }; + partition@1000000 { + label = "Filesystem"; + reg = <0x1000000 0x3f000000>; + }; }; }; };
arch/arm/boot/dts/armada-xp-gp.dts +8 -5
@@ -160,12 +160,15 @@ status = "okay"; }; - nand@d0000 { + nand-controller@d0000 { status = "okay"; - label = "pxa3xx_nand-0"; - num-cs = <1>; - marvell,nand-keep-config; - nand-on-flash-bbt; + + nand@0 { + reg = <0>; + label = "pxa3xx_nand-0"; + nand-rb = <0>; + nand-on-flash-bbt; + }; }; };
arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts +44 -41
93 lines not on this page · raw message
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 90/280 arm64: Relax GIC version check during early boot
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 74698f6971f25d045301139413578865fc2bd8f9 ]
Updates to the GIC architecture allow ID_AA64PFR0_EL1.GIC to have values other than 0 or 1. At the moment, Linux is quite strict in the way it handles this field at early boot stage (cpufeature is fine) and will refuse to use the system register CPU interface if it doesn't find the value 1.
--- arch/arm64/kernel/head.S | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm64/kernel/head.S +1 -2
@@ -522,8 +522,7 @@ set_hcr: /* GICv3 system register access */ mrs x0, id_aa64pfr0_el1 ubfx x0, x0, #24, #4 - cmp x0, #1 - b.ne 3f + cbz x0, 3f mrs_s x0, SYS_ICC_SRE_EL2 orr x0, x0, #ICC_SRE_EL2_SRE // Set ICC_SRE_EL2.SRE==1
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 91/280 ARM: tegra: Restore DT ABI on Tegra124 Chromebooks
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 94d9b9337d09bdd27735005b3251d97ab29f7273 ]
Commit 482997699ef0 ("ARM: tegra: Fix unit_address_vs_reg DTC warnings for /memory") inadventently broke device tree ABI by adding a unit- address to the "/memory" node because the device tree compiler flagged the missing unit-address as a warning.
Tegra124 Chromebooks (a.k.a. Nyan) use a bootloader that relies on the full name of the memory node in device tree being exactly "/memory". It can be argued whether this was a good decision or not, and some other bootloaders (such as U-Boot) do accept a unit-address in the name of the node, but the device tree is an ABI and we can't break existing setups just because the device tree compiler considers it bad practice to omit the unit-address nowadays.
This partially reverts the offending commit and restores device tree ABI compatibility.
--- arch/arm/boot/dts/tegra124-nyan.dtsi | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
arch/arm/boot/dts/tegra124-nyan.dtsi +16 -1
@@ -13,10 +13,25 @@ stdout-path = "serial0:115200n8"; }; - memory@80000000 { + /* + * Note that recent version of the device tree compiler (starting with + * version 1.4.2) warn about this node containing a reg property, but + * missing a unit-address. However, the bootloader on these Chromebook + * devices relies on the full name of this node to be exactly /memory. + * Adding the unit-address causes the bootloader to create a /memory + * node and write the memory bank configuration to that node, which in + * turn leads the kernel to believe that the device has 2 GiB of + * memory instead of the amount detected by the bootloader. + * + * The name of this node is effectively ABI and must not be changed. + */ + memory { + device_type = "memory"; reg = <0x0 0x80000000 0x0 0x80000000>; }; + /delete-node/ memory@80000000; + host1x@50000000 { hdmi@54280000 { status = "okay";
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 92/280 net: marvell: mvneta: fix DMA debug warning
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a8fef9ba58c9966ddb1fec916d8d8137c9d8bc89 ]
Booting 4.20 on SolidRun Clearfog issues this warning with DMA API debug enabled:
WARNING: CPU: 0 PID: 555 at kernel/dma/debug.c:1230 check_sync+0x514/0x5bc mvneta f1070000.ethernet: DMA-API: device driver tries to sync DMA memory it has not allocated [device address=0x000000002dd7dc00] [size=240 bytes] Modules linked in: ahci mv88e6xxx dsa_core xhci_plat_hcd xhci_hcd devlink armada_thermal marvell_cesa des_generic ehci_orion phy_armada38x_comphy mcp3021 spi_orion evbug sfp mdio_i2c ip_tables x_tables CPU: 0 PID: 555 Comm: bridge-network- Not tainted 4.20.0+ #291 Hardware name: Marvell Armada 380/385 (Device Tree) [<c0019638>] (unwind_backtrace) from [<c0014888>] (show_stack+0x10/0x14) [<c0014888>] (show_stack) from [<c07f54e0>] (dump_stack+0x9c/0xd4) [<c07f54e0>] (dump_stack) from [<c00312bc>] (__warn+0xf8/0x124) [<c00312bc>] (__warn) from [<c00313b0>] (warn_slowpath_fmt+0x38/0x48) [<c00313b0>] (warn_slowpath_fmt) from [<c00b0370>] (check_sync+0x514/0x5bc) [<c00b0370>] (check_sync) from [<c00b04f8>] (debug_dma_sync_single_range_for_cpu+0x6c/0x74) [<c00b04f8>] (debug_dma_sync_single_range_for_cpu) from [<c051bd14>] (mvneta_poll+0x298/0xf58) [<c051bd14>] (mvneta_poll) from [<c0656194>] (net_rx_action+0x128/0x424) [<c0656194>] (net_rx_action) from [<c000a230>] (__do_softirq+0xf0/0x540) [<c000a230>] (__do_softirq) from [<c00386e0>] (irq_exit+0x124/0x144) [<c00386e0>] (irq_exit) from [<c009b5e0>] (__handle_domain_irq+0x58/0xb0) [<c009b5e0>] (__handle_domain_irq) from [<c03a63c4>] (gic_handle_irq+0x48/0x98) [<c03a63c4>] (gic_handle_irq) from [<c0009a10>] (__irq_svc+0x70/0x98)
...
This appears to be caused by mvneta_rx_hwbm() calling dma_sync_single_range_for_cpu() with the wrong struct device pointer, as the buffer manager device pointer is used to map and unmap the buffer. Fix this.
--- drivers/net/ethernet/marvell/mvneta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvneta.c +1 -1
@@ -2147,7 +2147,7 @@ err_drop_frame:if (unlikely (!skb)) goto err_drop_frame_ret_pool; - dma_sync_single_range_for_cpu(dev->dev.parent, + dma_sync_single_range_for_cpu(&pp->bm_priv->pdev->dev, rx_desc->buf_phys_addr, MVNETA_MH_SIZE + NET_SKB_PAD, rx_bytes,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 93/280 mm: handle lru_add_drain_all for UP properly
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6ea183d60c469560e7b08a83c9804299e84ec9eb ]
Since for_each_cpu(cpu, mask) added by commit 2d3854a37e8b767a ("cpumask: introduce new API, without changing anything") did not evaluate the mask argument if NR_CPUS == 1 due to CONFIG_SMP=n, lru_add_drain_all() is hitting WARN_ON() at __flush_work() added by commit 4d43d395fed12463 ("workqueue: Try to catch flush_work() without INIT_WORK().") by unconditionally calling flush_work() [1].
Workaround this issue by using CONFIG_SMP=n specific lru_add_drain_all implementation. There is no real need to defer the implementation to the workqueue as the draining is going to happen on the local cpu. So alias lru_add_drain_all to lru_add_drain which does all the necessary work.
[[email protected]: fix various build warnings]
[1] https://lkml.kernel.org/r/[email protected]
--- mm/swap.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
mm/swap.c +10 -7
@@ -321,11 +321,6 @@ static inline void activate_page_drain(int cpu) { } -static bool need_activate_page_drain (int cpu) -{ -return false; -} -void activate_page (struct page *page) {struct zone *zone =page_zone (page);
@@ -654,13 +649,15 @@ void lru_add_drain(void)put_cpu (); } +#ifdef CONFIG_SMP + +static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work); +static void lru_add_drain_per_cpu (struct work_struct *dummy) {lru_add_drain (); } -static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work); -/* * Doesn't need any cpu hotplug locking because we do rely on per-cpu * kworkers being shut down before our page_alloc_cpu_dead callback is
@@ -703,6 +700,12 @@ void lru_add_drain_all(void) mutex_unlock(&lock); } +#else +void lru_add_drain_all (void ) +{ +lru_add_drain (); +} +#endif /** * release_pages - batched put_page()
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 94/280 tmpfs: fix link accounting when a tmpfile is linked in
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1062af920c07f5b54cf5060fde3339da6df0cf6b ]
tmpfs has a peculiarity of accounting hard links as if they were separate inodes: so that when the number of inodes is limited, as it is by default, a user cannot soak up an unlimited amount of unreclaimable dcache memory just by repeatedly linking a file.
But when v3.11 added O_TMPFILE, and the ability to use linkat() on the fd, we missed accommodating this new case in tmpfs: "df -i" shows that an extra "inode" remains accounted after the file is unlinked and the fd closed and the actual inode evicted. If a user repeatedly links tmpfiles into a tmpfs, the limit will be hit (ENOSPC) even after they are deleted.
Just skip the extra reservation from shmem_link() in this case: there's a sense in which this first link of a tmpfile is then cheaper than a hard link of another file, but the accounting works out, and there's still good limiting, so no need to do anything more complicated.
--- mm/shmem.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
mm/shmem.c +7 -3
@@ -2901,10 +2901,14 @@ static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentr* No ordinary (disk based) filesystem counts links as inodes; * but each new link needs a new dentry, pinning lowmem, and * tmpfs dentries cannot be pruned until they are unlinked. +* But if an O_TMPFILE file is linked into the tmpfs, the +* first link must skip that, to get the accounting right. */ - ret =shmem_reserve_inode (inode->i_sb); -if (ret) - goto out; +if (inode->i_nlink) { + ret =shmem_reserve_inode (inode->i_sb); +if (ret) + goto out; + } dir->i_size +=BOGO_DIRENT_SIZE ; inode->i_ctime = dir->i_ctime = dir->i_mtime =current_time (inode);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 95/280 ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 156a67a9065e3339be85f811d1b13b920e50d73b ]
The enabling L3/L4 filtering for transmit switched packets for all devices caused unforeseen issue on older devices when trying to send UDP traffic in an ordered sequence. This bit was originally intended for X550 devices, which supported this feature, so limit the scope of this bit to only X550 devices.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +5 -2
@@ -3924,8 +3924,11 @@ static void ixgbe_setup_mrqc(struct ixgbe_adapter *adapter)else mrqc =IXGBE_MRQC_VMDQRSS64EN ; -/* Enable L3/L4 for Tx Switched packets */ - mrqc |=IXGBE_MRQC_L3L4TXSWEN ; +/* Enable L3/L4 for Tx Switched packets only for X550, +* older devices do not support this feature +*/ +if (hw->mac.type >= ixgbe_mac_X550) + mrqc |=IXGBE_MRQC_L3L4TXSWEN ; }else {if (tcs >4 ) mrqc =IXGBE_MRQC_RTRSS8TCEN ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 96/280 ARCv2: lib: memcpy: fix doing prefetchw outside of buffer
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f8a15f97664178f27dfbf86a38f780a532cb6df0 ]
ARCv2 optimized memcpy uses PREFETCHW instruction for prefetching the next cache line but doesn't ensure that the line is not past the end of the buffer. PRETECHW changes the line ownership and marks it dirty, which can cause data corruption if this area is used for DMA IO.
Fix the issue by avoiding the PREFETCHW. This leads to performance degradation but it is OK as we'll introduce new memcpy implementation optimized for unaligned memory access using.
We also cut off all PREFETCH instructions at they are quite useless here:
* we call PREFETCH right before LOAD instruction call.
* we copy 16 or 32 bytes of data (depending on CONFIG_ARC_HAS_LL64) in a main logical loop. so we call PREFETCH 4 times (or 2 times) for each L1 cache line (in case of 64B L1 cache Line which is default case). Obviously this is not optimal.
--- arch/arc/lib/memcpy-archs.S | 14 -------------- 1 file changed, 14 deletions(-)
arch/arc/lib/memcpy-archs.S +0 -14
@@ -25,15 +25,11 @@ #endif #ifdef CONFIG_ARC_HAS_LL64 -# define PREFETCH_READ(RX) prefetch [RX, 56] -# define PREFETCH_WRITE(RX) prefetchw [RX, 64] # define LOADX(DST,RX) ldd.ab DST, [RX, 8] # define STOREX(SRC,RX) std.ab SRC, [RX, 8] # define ZOLSHFT 5 # define ZOLAND 0x1F #else -# define PREFETCH_READ(RX) prefetch [RX, 28] -# define PREFETCH_WRITE(RX) prefetchw [RX, 32] # define LOADX(DST,RX) ld.ab DST, [RX, 4] # define STOREX(SRC,RX) st.ab SRC, [RX, 4] # define ZOLSHFT 4
@@ -41,8 +37,6 @@ #endif ENTRY_CFI(memcpy) - prefetch [r1] ; Prefetch the read location - prefetchw [r0] ; Prefetch the write location mov.f 0, r2 ;;; if size is zero jz.d [blink]
@@ -72,8 +66,6 @@ ENTRY_CFI(memcpy) lpnz @.Lcopy32_64bytes ;; LOOP START LOADX (r6, r1) - PREFETCH_READ (r1) - PREFETCH_WRITE (r3) LOADX (r8, r1) LOADX (r10, r1) LOADX (r4, r1)
@@ -117,9 +109,7 @@ ENTRY_CFI(memcpy) lpnz @.Lcopy8bytes_1 ;; LOOP START ld.ab r6, [r1, 4] - prefetch [r1, 28] ;Prefetch the next read location ld.ab r8, [r1,4] - prefetchw [r3, 32] ;Prefetch the next write location SHIFT_1 (r7, r6, 24) or r7, r7, r5
@@ -162,9 +152,7 @@ ENTRY_CFI(memcpy) lpnz @.Lcopy8bytes_2 ;; LOOP START ld.ab r6, [r1, 4] - prefetch [r1, 28] ;Prefetch the next read location ld.ab r8, [r1,4] - prefetchw [r3, 32] ;Prefetch the next write location SHIFT_1 (r7, r6, 16) or r7, r7, r5
@@ -204,9 +192,7 @@ ENTRY_CFI(memcpy) lpnz @.Lcopy8bytes_3 ;; LOOP START ld.ab r6, [r1, 4] - prefetch [r1, 28] ;Prefetch the next read location ld.ab r8, [r1,4] - prefetchw [r3, 32] ;Prefetch the next write location SHIFT_1 (r7, r6, 8) or r7, r7, r5
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 97/280 ARC: uacces: remove lp_start, lp_end from clobber list
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d5e3c55e01d8b1774b37b4647c30fb22f1d39077 ]
Newer ARC gcc handles lp_start, lp_end in a different way and doesn't like them in the clobber list.
--- arch/arc/include/asm/uaccess.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arc/include/asm/uaccess.h +4 -4
@@ -207,7 +207,7 @@ raw_copy_from_user(void *to, const void __user *from, unsigned long n)*/ "=&r" (tmp), "+r" (to), "+r" (from) : - : "lp_count", "lp_start", "lp_end", "memory"); + : "lp_count", "memory"); return n; }
@@ -433,7 +433,7 @@ raw_copy_to_user(void __user *to, const void *from, unsigned long n)*/ "=&r" (tmp), "+r" (to), "+r" (from) : - : "lp_count", "lp_start", "lp_end", "memory"); + : "lp_count", "memory"); return n; }
@@ -653,7 +653,7 @@ static inline unsigned long __arc_clear_user(void __user *to, unsigned long n)" .previous \n" : "+r"(d_char), "+r"(res) : "i"(0) - : "lp_count", "lp_start", "lp_end", "memory"); + : "lp_count", "memory"); return res; }
@@ -686,7 +686,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count) " .previous \n" : "+r"(res), "+r"(dst), "+r"(src), "=r"(val) : "g"(-EFAULT), "r"(count) - : "lp_count", "lp_start", "lp_end", "memory"); + : "lp_count", "memory");return res; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 98/280 ARCv2: support manual regfile save on interrupts
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e494239a007e601448110ac304fe055951f9de3b ]
There's a hardware bug which affects the HSDK platform, triggered by micro-ops for auto-saving regfile on taken interrupt. The workaround is to inhibit autosave.
--- arch/arc/Kconfig | 8 +++++ arch/arc/include/asm/entry-arcv2.h | 54 ++++++++++++++++++++++++++++++ arch/arc/kernel/entry-arcv2.S | 4 ++- arch/arc/kernel/intc-arcv2.c | 2 ++ arch/arc/plat-hsdk/Kconfig | 1 + 5 files changed, 68 insertions(+), 1 deletion(-)
arch/arc/Kconfig +8 -0
@@ -420,6 +420,14 @@ config ARC_HAS_ACCL_REGS (also referred to as r58:r59). These can also be used by gcc as GPR so kernel needs to save/restore per process +config ARC_IRQ_NO_AUTOSAVE + bool "Disable hardware autosave regfile on interrupts" + default n + help + On HS cores, taken interrupt auto saves the regfile on stack. + This is programmable and can be optionally disabled in which case + software INTERRUPT_PROLOGUE/EPILGUE do the needed work + endif # ISA_ARCV2 endmenu # "ARC CPU Configuration"
arch/arc/include/asm/entry-arcv2.h +54 -0
66 lines not on this page · raw message
arch/arc/kernel/entry-arcv2.S +3 -1
@@ -209,7 +209,9 @@ restore_regs: ;####### Return from Intr ####### debug_marker_l1: - bbit1.nt r0, STATUS_DE_BIT, .Lintr_ret_to_delay_slot + ; bbit1.nt r0, STATUS_DE_BIT, .Lintr_ret_to_delay_slot + btst r0, STATUS_DE_BIT ; Z flag set if bit clear + bnz .Lintr_ret_to_delay_slot ; branch if STATUS_DE_BIT set .Lisr_ret_fast_path: ; Handle special case #1: (Entry via Exception, Return via IRQ)
arch/arc/kernel/intc-arcv2.c +2 -0
@@ -49,11 +49,13 @@ void arc_init_IRQ(void) *(unsigned int *)&ictrl =0 ; +#ifndef CONFIG_ARC_IRQ_NO_AUTOSAVE ictrl.save_nr_gpr_pairs =6 ;/* r0 to r11 (r12 saved manually) */ ictrl.save_blink =1 ; ictrl.save_lp_regs =1 ;/* LP_COUNT, LP_START, LP_END */ ictrl.save_u_to_u =0 ;/* user ctxt saved on kernel stack */ ictrl.save_idx_regs =1 ;/* JLI, LDI, EI */ +#endif WRITE_AUX (AUX_IRQ_CTRL , ictrl);
arch/arc/plat-hsdk/Kconfig +1 -0
@@ -9,6 +9,7 @@ menuconfig ARC_SOC_HSDK bool "ARC HS Development Kit SOC" depends on ISA_ARCV2 select ARC_HAS_ACCL_REGS + select ARC_IRQ_NO_AUTOSAVE select CLK_HSDK select RESET_HSDK select MIGHT_HAVE_PCI
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 99/280 ARCv2: dont assume core 0x54 has dual issue
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7b2e932f633bcb7b190fc7031ce6dac75f8c3472 ]
The first release of core4 (0x54) was dual issue only (HS4x). Newer releases allow hardware to be configured as single issue (HS3x) or dual issue.
Prevent accessing a HS4x only aux register in HS3x, which otherwise leads to illegal instruction exceptions
--- arch/arc/include/asm/arcregs.h | 8 ++++++++ arch/arc/kernel/setup.c | 26 +++++++++++++++++++++----- 2 files changed, 29 insertions(+), 5 deletions(-)
arch/arc/include/asm/arcregs.h +8 -0
@@ -151,6 +151,14 @@ struct bcr_isa_arcv2 {#endif }; +struct bcr_uarch_build_arcv2 { +#ifdef CONFIG_CPU_BIG_ENDIAN +unsigned int pad:8 , prod:8 , maj:8 , min:8 ; +#else +unsigned int min:8 , maj:8 , prod:8 , pad:8 ; +#endif +}; +struct bcr_mpy {#ifdef CONFIG_CPU_BIG_ENDIAN unsigned int pad:8 , x1616:8 , dsp:4 , cycles:2 , type:2 , ver:8 ;
arch/arc/kernel/setup.c +21 -5
@@ -196,13 +196,29 @@ static void read_arc_build_cfg_regs(void) cpu->bpu.num_pred =2048 << bpu.pte;if (cpu->core.family >=0x54 ) { -unsigned int exec_ctrl; -READ_BCR (AUX_EXEC_CTRL , exec_ctrl); - cpu->extn.dual_enb = !(exec_ctrl &1 ); +struct bcr_uarch_build_arcv2 uarch; -/* dual issue always present for this core */ - cpu->extn.dual =1 ; +/* +* The first 0x54 core (uarch maj:min 0:1 or 0:2) was +* dual issue only (HS4x). But next uarch rev (1:0) +* allows it be configured for single issue (HS3x) +* Ensure we fiddle with dual issue only on HS4x +*/ +READ_BCR (ARC_REG_MICRO_ARCH_BCR , uarch); + +if (uarch.prod ==4 ) { +unsigned int exec_ctrl; + +/* dual issue hardware always present */ + cpu->extn.dual =1 ; + +READ_BCR (AUX_EXEC_CTRL , exec_ctrl); + +/* dual issue hardware enabled ? */ + cpu->extn.dual_enb = !(exec_ctrl &1 ); + + } } }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 100/280 phonet: fix building with clang
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6321aa197547da397753757bd84c6ce64b3e3d89 ]
clang warns about overflowing the data[] member in the struct pnpipehdr:
net/phonet/pep.c:295:8: warning: array index 4 is past the end of the array (which contains 1 element) [-Warray-bounds]
if (hdr->data[4] == PEP_IND_READY)
^ ~
include/net/phonet/pep.h:66:3: note: array 'data' declared here
u8 data[1];Using a flexible array member at the end of the struct avoids the warning, but since we cannot have a flexible array member inside of the union, each index now has to be moved back by one, which makes it a little uglier.
--- include/net/phonet/pep.h | 5 +++-- net/phonet/pep.c | 32 ++++++++++++++++---------------- 2 files changed, 19 insertions(+), 18 deletions(-)
include/net/phonet/pep.h +3 -2
@@ -63,10 +63,11 @@ struct pnpipehdr {u8 state_after_reset;/* reset request */ u8 error_code;/* any response */ u8 pep_type;/* status indication */ -u8 data[1 ]; +u8 data0;/* anything else */ }; +u8 data[]; }; -#define other_pep_type data[1] +#define other_pep_type data[0]static inline struct pnpipehdr *pnp_hdr (struct sk_buff *skb) {
net/phonet/pep.c +16 -16
@@ -132,7 +132,7 @@ static int pep_indicate(struct sock *sk, u8 id, u8 code, ph->utid =0 ; ph->message_id = id; ph->pipe_handle = pn->pipe_handle; - ph->data[0 ] = code; + ph->error_code = code;return pn_skb_send (sk, skb,NULL ); }
@@ -153,7 +153,7 @@ static int pipe_handler_request(struct sock *sk, u8 id, u8 code, ph->utid = id;/* whatever */ ph->message_id = id; ph->pipe_handle = pn->pipe_handle; - ph->data[0 ] = code; + ph->error_code = code;return pn_skb_send (sk, skb,NULL ); }
@@ -208,7 +208,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,struct pnpipehdr *ph;struct sockaddr_pn dst;u8 data[4 ] = { - oph->data[0 ],/* PEP type */ + oph->pep_type,/* PEP type */ code,/* error code, at an unusual offset */ PAD ,PAD , };
@@ -221,7 +221,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code, ph->utid = oph->utid; ph->message_id =PNS_PEP_CTRL_RESP ; ph->pipe_handle = oph->pipe_handle; - ph->data[0 ] = oph->data[1 ];/* CTRL id */ + ph->data0 = oph->data[0 ];/* CTRL id */ pn_skb_get_src_sockaddr (oskb, &dst);return pn_skb_send (sk, skb, &dst);
@@ -272,17 +272,17 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)return -EINVAL ; hdr =pnp_hdr (skb); -if (hdr->data[0 ] !=PN_PEP_TYPE_COMMON ) { +if (hdr->pep_type !=PN_PEP_TYPE_COMMON ) {net_dbg_ratelimited ("Phonet unknown PEP type: %u\n" , - (unsigned int )hdr->data[0 ]); + (unsigned int )hdr->pep_type);return -EOPNOTSUPP ; } -switch (hdr->data[1 ]) { +switch (hdr->data[0 ]) {case PN_PEP_IND_FLOW_CONTROL :switch (pn->tx_fc) {case PN_LEGACY_FLOW_CONTROL : -switch (hdr->data[4 ]) { +switch (hdr->data[3 ]) {case PEP_IND_BUSY :atomic_set (&pn->tx_credits,0 );break ;
@@ -292,7 +292,7 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) }break ;case PN_ONE_CREDIT_FLOW_CONTROL : -if (hdr->data[4 ] ==PEP_IND_READY ) +if (hdr->data[3 ] ==PEP_IND_READY )atomic_set (&pn->tx_credits, wake =1 );break ; }
@@ -301,12 +301,12 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)case PN_PEP_IND_ID_MCFC_GRANT_CREDITS :if (pn->tx_fc !=PN_MULTI_CREDIT_FLOW_CONTROL )break ; -atomic_add (wake = hdr->data[4 ], &pn->tx_credits); +atomic_add (wake = hdr->data[3 ], &pn->tx_credits);break ;default :net_dbg_ratelimited ("Phonet unknown PEP indication: %u\n" , - (unsigned int )hdr->data[1 ]); + (unsigned int )hdr->data[0 ]);return -EOPNOTSUPP ; }if (wake)
@@ -318,7 +318,7 @@ static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb) {struct pep_sock *pn =pep_sk (sk);struct pnpipehdr *hdr =pnp_hdr (skb); -u8 n_sb = hdr->data[0 ]; +u8 n_sb = hdr->data0; pn->rx_fc = pn->tx_fc =PN_LEGACY_FLOW_CONTROL ;__skb_pull (skb,sizeof (*hdr));
@@ -506,7 +506,7 @@ static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb)return -ECONNREFUSED ;/* Parse sub-blocks */ - n_sb = hdr->data[4 ]; + n_sb = hdr->data[3 ];while (n_sb >0 ) {u8 type, buf[6 ], len =sizeof (buf);const u8 *data =pep_get_sb (skb, &type, &len, buf);
@@ -739,7 +739,7 @@ static int pipe_do_remove(struct sock *sk) ph->utid =0 ; ph->message_id =PNS_PIPE_REMOVE_REQ ; ph->pipe_handle = pn->pipe_handle; - ph->data[0 ] =PAD ; + ph->data0 =PAD ;return pn_skb_send (sk, skb,NULL ); }
@@ -817,7 +817,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp, peer_type = hdr->other_pep_type <<8 ;/* Parse sub-blocks (options) */ - n_sb = hdr->data[4 ]; + n_sb = hdr->data[3 ];while (n_sb >0 ) {u8 type, buf[1 ], len =sizeof (buf);const u8 *data =pep_get_sb (skb, &type, &len, buf);
@@ -1109,7 +1109,7 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb) ph->utid =0 ;if (pn->aligned) { ph->message_id =PNS_PIPE_ALIGNED_DATA ; - ph->data[0 ] =0 ;/* padding */ + ph->data0 =0 ;/* padding */ }else ph->message_id =PNS_PIPE_DATA ; ph->pipe_handle = pn->pipe_handle;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 101/280 mac80211_hwsim: propagate genlmsg_reply return code
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 17407715240456448e4989bee46ffc93991add83 ]
genlmsg_reply can fail, so propagate its return code
--- drivers/net/wireless/mac80211_hwsim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mac80211_hwsim.c +1 -1
@@ -3454,7 +3454,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info) goto out_err; } -genlmsg_reply (skb, info); + res =genlmsg_reply (skb, info);break ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 102/280 bpf, lpm: fix lookup bug in map_delete_elem
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7c0cdf0b3940f63d9777c3fcf250a2f83859ca54 ]
trie_delete_elem() was deleting an entry even though it was not matching if the prefixlen was correct. This patch adds a check on matchlen.
Reproducer:
$ sudo bpftool map create /sys/fs/bpf/mylpm type lpm_trie key 8 value 1 entries 128 name mylpm flags 1 $ sudo bpftool map update pinned /sys/fs/bpf/mylpm key hex 10 00 00 00 aa bb cc dd value hex 01 $ sudo bpftool map dump pinned /sys/fs/bpf/mylpm key: 10 00 00 00 aa bb cc dd value: 01 Found 1 element $ sudo bpftool map delete pinned /sys/fs/bpf/mylpm key hex 10 00 00 00 ff ff ff ff $ echo $? 0 $ sudo bpftool map dump pinned /sys/fs/bpf/mylpm Found 0 elements
A similar reproducer is added in the selftests.
Without the patch:
$ sudo ./tools/testing/selftests/bpf/test_lpm_map test_lpm_map: test_lpm_map.c:485: test_lpm_delete: Assertion `bpf_map_delete_elem(map_fd, key) == -1 && errno == ENOENT' failed. Aborted
With the patch: test_lpm_map runs without errors.
--- kernel/bpf/lpm_trie.c | 1 + tools/testing/selftests/bpf/test_lpm_map.c | 10 ++++++++++ 2 files changed, 11 insertions(+)
kernel/bpf/lpm_trie.c +1 -0
@@ -432,6 +432,7 @@ static int trie_delete_elem(struct bpf_map *map, void *_key) }if (!node || node->prefixlen != key->prefixlen || + node->prefixlen != matchlen || (node->flags &LPM_TREE_NODE_FLAG_IM )) { ret = -ENOENT ; goto out;
tools/testing/selftests/bpf/test_lpm_map.c +10 -0
@@ -474,6 +474,16 @@ static void test_lpm_delete(void)assert (bpf_map_lookup_elem (map_fd, key, &value) ==-1 && errno ==ENOENT ); + key->prefixlen =30 ;// unused prefix so far +inet_pton (AF_INET ,"192.255.0.0" , key->data); +assert (bpf_map_delete_elem (map_fd, key) ==-1 && + errno ==ENOENT ); + + key->prefixlen =16 ;// same prefix as the root node +inet_pton (AF_INET ,"192.255.0.0" , key->data); +assert (bpf_map_delete_elem (map_fd, key) ==-1 && + errno ==ENOENT ); +/* assert initial lookup */ key->prefixlen =32 ;inet_pton (AF_INET ,"192.168.0.1" , key->data);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 103/280 net: thunderx: make CFG_DONE message to run through generic send-ack sequence
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0dd563b9a62c4cbabf5d4fd6596440c2491e72b1 ]
At the end of NIC VF initialization VF sends CFG_DONE message to PF without using nicvf_msg_send_to_pf routine. This potentially could re-write data in mailbox. This commit is to implement common way of sending CFG_DONE message by the same way with other configuration messages by using nicvf_send_msg_to_pf() routine.
--- drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 15 ++++++++++++--- 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/net/ethernet/cavium/thunder/nic_main.c +1 -1
@@ -1039,7 +1039,7 @@ static void nic_handle_mbx_intr(struct nicpf *nic, int vf)case NIC_MBOX_MSG_CFG_DONE :/* Last message of VF config msg sequence */ nic_enable_vf (nic, vf, true); - goto unlock; +break ;case NIC_MBOX_MSG_SHUTDOWN :/* First msg in VF teardown sequence */ if (vf >= nic->num_vf_en)
drivers/net/ethernet/cavium/thunder/nicvf_main.c +12 -3
@@ -172,6 +172,17 @@ static int nicvf_check_pf_ready(struct nicvf *nic)return 1 ; } +static void nicvf_send_cfg_done (struct nicvf *nic) +{ +union nic_mbx mbx = {}; + + mbx.msg.msg =NIC_MBOX_MSG_CFG_DONE ; +if (nicvf_send_msg_to_pf (nic, &mbx)) { +netdev_err (nic->netdev, +"PF didn't respond to CFG DONE msg\n" ); + } +} +static void nicvf_read_bgx_stats (struct nicvf *nic,struct bgx_stats_msg *bgx) {if (bgx->rx)
@@ -1416,7 +1427,6 @@ int nicvf_open(struct net_device *netdev)struct nicvf *nic =netdev_priv (netdev);struct queue_set *qs = nic->qs;struct nicvf_cq_poll *cq_poll =NULL ; -union nic_mbx mbx = {};netif_carrier_off (netdev);
@@ -1512,8 +1522,7 @@ int nicvf_open(struct net_device *netdev)nicvf_enable_intr (nic,NICVF_INTR_RBDR , qidx);/* Send VF config done msg to PF */ - mbx.msg.msg =NIC_MBOX_MSG_CFG_DONE ; -nicvf_write_to_mbx (nic, &mbx); +nicvf_send_cfg_done (nic);return 0 ; cleanup:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 104/280 net: thunderx: add nicvf_send_msg_to_pf result check for set_rx_mode_task
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7db730d9d2f7b6af6aeac621b1890ea477a0cb8d ]
The rx_set_mode invokes number of messages to be send to PF for receive mode configuration. In case if there any issues we need to stop sending messages and release allocated memory.
This commit is to implement check of nicvf_msg_send_to_pf() result.
--- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/net/ethernet/cavium/thunder/nicvf_main.c +8 -4
@@ -1950,7 +1950,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs,/* flush DMAC filters and reset RX mode */ mbx.xcast.msg =NIC_MBOX_MSG_RESET_XCAST ; -nicvf_send_msg_to_pf (nic, &mbx); +if (nicvf_send_msg_to_pf (nic, &mbx) <0 ) + goto free_mc;if (mode &BGX_XCAST_MCAST_FILTER ) {/* once enabling filtering, we need to signal to PF to add
@@ -1958,7 +1959,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs,*/ mbx.xcast.msg =NIC_MBOX_MSG_ADD_MCAST ; mbx.xcast.data.mac =0 ; -nicvf_send_msg_to_pf (nic, &mbx); +if (nicvf_send_msg_to_pf (nic, &mbx) <0 ) + goto free_mc; }/* check if we have any specific MACs to be added to PF DMAC filter */
@@ -1967,9 +1969,9 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs,for (idx =0 ; idx < mc_addrs->count; idx++) { mbx.xcast.msg =NIC_MBOX_MSG_ADD_MCAST ; mbx.xcast.data.mac = mc_addrs->mc[idx]; -nicvf_send_msg_to_pf (nic, &mbx); +if (nicvf_send_msg_to_pf (nic, &mbx) <0 ) + goto free_mc; } -kfree (mc_addrs); }/* and finally set rx mode for PF accordingly */
@@ -1977,6 +1979,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs, mbx.xcast.data.mode = mode;nicvf_send_msg_to_pf (nic, &mbx); +free_mc: +kfree (mc_addrs); }static void nicvf_set_rx_mode_task (struct work_struct *work_arg)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 105/280 nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 71c190249f0ced5b26377ea6bf829ab3af77a40c ]
The intended optimization should be A ^ 0 = A, not A ^ -1 = A.
--- drivers/net/ethernet/netronome/nfp/bpf/jit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/netronome/nfp/bpf/jit.c +1 -1
@@ -2306,7 +2306,7 @@ static int xor_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)static int xor_imm (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta) { -return wrp_alu32_imm (nfp_prog, meta,ALU_OP_XOR , !~meta->insn.imm); +return wrp_alu32_imm (nfp_prog, meta,ALU_OP_XOR , !meta->insn.imm); }static int and_reg (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 106/280 nfp: bpf: fix ALU32 high bits clearance bug
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f036ebd9bfbe1e91a3d855e85e05fc5ff156b641 ]
NFP BPF JIT compiler is doing a couple of small optimizations when jitting ALU imm instructions, some of these optimizations could save code-gen, for example:
A & -1 = A A | 0 = A A ^ 0 = A
However, for ALU32, high 32-bit of the 64-bit register should still be cleared according to ISA semantics.
--- drivers/net/ethernet/netronome/nfp/bpf/jit.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
drivers/net/ethernet/netronome/nfp/bpf/jit.c +6 -11
@@ -1288,15 +1288,10 @@ wrp_alu64_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta,static int wrp_alu32_imm (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta, -enum alu_op alu_op,bool skip) +enum alu_op alu_op) {const struct bpf_insn *insn = &meta->insn; -if (skip) { - meta->skip = true; -return 0 ; - } -wrp_alu_imm (nfp_prog, insn->dst_reg *2 , alu_op, insn->imm);wrp_immed (nfp_prog,reg_both (insn->dst_reg *2 +1 ),0 );
@@ -2306,7 +2301,7 @@ static int xor_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)static int xor_imm (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta) { -return wrp_alu32_imm (nfp_prog, meta,ALU_OP_XOR , !meta->insn.imm); +return wrp_alu32_imm (nfp_prog, meta,ALU_OP_XOR ); }static int and_reg (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta)
@@ -2316,7 +2311,7 @@ static int and_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)static int and_imm (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta) { -return wrp_alu32_imm (nfp_prog, meta,ALU_OP_AND , !~meta->insn.imm); +return wrp_alu32_imm (nfp_prog, meta,ALU_OP_AND ); }static int or_reg (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta)
@@ -2326,7 +2321,7 @@ static int or_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)static int or_imm (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta) { -return wrp_alu32_imm (nfp_prog, meta,ALU_OP_OR , !meta->insn.imm); +return wrp_alu32_imm (nfp_prog, meta,ALU_OP_OR ); }static int add_reg (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta)
@@ -2336,7 +2331,7 @@ static int add_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)static int add_imm (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta) { -return wrp_alu32_imm (nfp_prog, meta,ALU_OP_ADD , !meta->insn.imm); +return wrp_alu32_imm (nfp_prog, meta,ALU_OP_ADD ); }static int sub_reg (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta)
@@ -2346,7 +2341,7 @@ static int sub_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)static int sub_imm (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta) { -return wrp_alu32_imm (nfp_prog, meta,ALU_OP_SUB , !meta->insn.imm); +return wrp_alu32_imm (nfp_prog, meta,ALU_OP_SUB ); }static int mul_reg (struct nfp_prog *nfp_prog,struct nfp_insn_meta *meta)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 107/280 bnxt_en: Fix typo in firmware message timeout logic.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 67681d02aaa1db9044a16df4ca9c77cde1221a3e ]
The logic that polls for the firmware message response uses a shorter sleep interval for the first few passes. But there was a typo so it was using the wrong counter (larger counter) for these short sleep passes. The result is a slightly shorter timeout period for these firmware messages than intended. Fix it by using the proper counter.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -1
@@ -3542,7 +3542,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len,if (len)break ;/* on first few passes, just barely sleep */ -if (i <DFLT_HWRM_CMD_TIMEOUT ) +if (i <HWRM_SHORT_TIMEOUT_COUNTER )usleep_range (HWRM_SHORT_MIN_TIMEOUT ,HWRM_SHORT_MAX_TIMEOUT );else
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 108/280 bnxt_en: Wait longer for the firmware message response to complete.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0000b81a063b5f3ab82fa18041c28327ce72c312 ]
The code waits up to 20 usec for the firmware response to complete once we've seen the valid response header in the buffer. It turns out that in some scenarios, this wait time is not long enough. Extend it to 150 usec and use usleep_range() instead of udelay().
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -1
@@ -3565,7 +3565,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len,dma_rmb ();if (*valid)break ; -udelay (1 ); +usleep_range (1 ,5 ); }if (j >=HWRM_VALID_BIT_DELAY_USEC ) {
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -1
@@ -548,7 +548,7 @@ struct rx_tpa_end_cmp_ext { (HWRM_SHORT_TIMEOUT_COUNTER * HWRM_SHORT_MIN_TIMEOUT + \ ((n) - HWRM_SHORT_TIMEOUT_COUNTER) * HWRM_MIN_TIMEOUT)) -#define HWRM_VALID_BIT_DELAY_USEC 20 +#define HWRM_VALID_BIT_DELAY_USEC 150#define BNXT_RX_EVENT 1#define BNXT_AGG_EVENT 2
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 109/280 net: set static variable an initial value in atl2_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4593403fa516a5a4cffe6883c5062d60932cbfbe ]
cards_found is a static variable, but when it enters atl2_probe(), cards_found is set to zero, the value is not consistent with last probe, so next behavior is not our expect.
--- drivers/net/ethernet/atheros/atlx/atl2.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/atheros/atlx/atl2.c +1 -3
@@ -1335,13 +1335,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) {struct net_device *netdev;struct atl2_adapter *adapter; -static int cards_found; +static int cards_found =0 ;unsigned long mmio_start;int mmio_len;int err; - cards_found =0 ; - err =pci_enable_device (pdev);if (err)return err;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 110/280 selftests: fib_tests: sleep after changing carrier. again.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit af548a27b158d548d41e56255e6eaca1658cc3be ]
Just like commit e2ba732a1681 ("selftests: fib_tests: sleep after changing carrier"), wait one second to allow linkwatch to propagate the carrier change to the stack.
There are two sets of carrier tests. The first slept after the carrier was set to off, and when the second set ran, it was likely that the linkwatch would be able to run again without much delay, reducing the likelihood of a race. However, if you run 'fib_tests.sh -t carrier' on a loop, you will quickly notice the failures.
Sleeping on the second set of tests make the failures go away.
--- tools/testing/selftests/net/fib_tests.sh | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/fib_tests.sh +1 -0
@@ -385,6 +385,7 @@ fib_carrier_unicast_test() set -e $IP link set dev dummy0 carrier off + sleep 1 set +e echo " Carrier down"
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 111/280 tmpfs: fix uninitialized return value in shmem_link
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 29b00e609960ae0fcff382f4c7079dd0874a5311 ]
When we made the shmem_reserve_inode call in shmem_link conditional, we forgot to update the declaration for ret so that it always has a known value. Dan Carpenter pointed out this deficiency in the original patch.
--- mm/shmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/shmem.c +1 -1
@@ -2895,7 +2895,7 @@ static int shmem_create(struct inode *dir, struct dentry *dentry, umode_t mode,static int shmem_link (struct dentry *old_dentry,struct inode *dir,struct dentry *dentry) {struct inode *inode =d_inode (old_dentry); -int ret; +int ret =0 ;/* * No ordinary (disk based) filesystem counts links as inodes;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 112/280 stm class: Prevent division by zero
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit bf7cbaae0831252b416f375ca9b1027ecd4642dd upstream.
Using STP_POLICY_ID_SET ioctl command with dummy_stm device, or any STM device that supplies zero mmio channel size, will trigger a division by zero bug in the kernel.
Prevent this by disallowing channel widths other than 1 for such devices.
--- drivers/hwtracing/stm/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/hwtracing/stm/core.c +5 -3
@@ -553,7 +553,7 @@ static int stm_char_policy_set_ioctl(str {struct stm_device *stm = stmf->stm;struct stp_policy_id *id; -int ret = -EINVAL ; +int ret = -EINVAL , wlimit =1 ;u32 size;if (stmf->output.nr_chans)
@@ -581,8 +581,10 @@ static int stm_char_policy_set_ioctl(strif (id->__reserved_0 || id->__reserved_1) goto err_free; -if (id->width <1 || - id->width >PAGE_SIZE / stm->data->sw_mmiosz) +if (stm->data->sw_mmiosz) + wlimit =PAGE_SIZE / stm->data->sw_mmiosz; + +if (id->width <1 || id->width > wlimit) goto err_free; ret =stm_file_assign (stmf, id->id, id->width);
Greg Kroah-Hartman
maintainerPATCH 113/280 nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dexuan Cui <[email protected]>
commit 43f89877f26671c6309cd87d7364b1a3e66e71cf upstream.
In the case of ND_CMD_CALL, we should also check out_obj->type.
The patch uses out_obj->type, which is a short alias to out_obj->package.type.
--- drivers/acpi/nfit/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/acpi/nfit/core.c +7 -7
@@ -533,6 +533,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descreturn -EINVAL ; } +if (out_obj->type !=ACPI_TYPE_BUFFER ) { +dev_dbg (dev,"%s unexpected output object type cmd: %s type: %d\n" , + dimm_name, cmd_name, out_obj->type); + rc = -EINVAL ; + goto out; + } +if (call_pkg) { call_pkg->nd_fw_size = out_obj->buffer.length; memcpy(call_pkg->nd_payload + call_pkg->nd_size_in,
@@ -551,13 +558,6 @@ int acpi_nfit_ctl(struct nvdimm_bus_descreturn 0 ; } -if (out_obj->package.type !=ACPI_TYPE_BUFFER ) { -dev_dbg (dev,"%s unexpected output object type cmd: %s type: %d\n" , - dimm_name, cmd_name, out_obj->type); - rc = -EINVAL ; - goto out; - } -dev_dbg (dev,"%s cmd: %s output length: %d\n" , dimm_name, cmd_name, out_obj->buffer.length); print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
Greg Kroah-Hartman
maintainerPATCH 114/280 acpi/nfit: Fix bus command validation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit ebe9f6f19d80d8978d16078dff3d5bd93ad8d102 upstream.
Commit 11189c1089da "acpi/nfit: Fix command-supported detection" broke ND_CMD_CALL for bus-level commands. The "func = cmd" assumption is only valid for:
ND_CMD_ARS_CAP
ND_CMD_ARS_START
ND_CMD_ARS_STATUS
ND_CMD_CLEAR_ERROR
The function number otherwise needs to be pulled from the command payload for:
NFIT_CMD_TRANSLATE_SPA
NFIT_CMD_ARS_INJECT_SET
NFIT_CMD_ARS_INJECT_CLEAR
NFIT_CMD_ARS_INJECT_GET
Update cmd_to_func() for the bus case and call it in the common path.
--- drivers/acpi/nfit/core.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/acpi/nfit/core.c +12 -10
@@ -397,7 +397,7 @@ static int cmd_to_func(struct nfit_mem *if (call_pkg) {int i; -if (nfit_mem->family != call_pkg->nd_family) +if (nfit_mem && nfit_mem->family != call_pkg->nd_family)return -ENOTTY ;for (i =0 ; i <ARRAY_SIZE (call_pkg->nd_reserved2); i++)
@@ -406,6 +406,10 @@ static int cmd_to_func(struct nfit_mem *return call_pkg->nd_command; } +/* In the !call_pkg case, bus commands == bus functions */ +if (!nfit_mem) +return cmd; +/* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */ if (nfit_mem->family ==NVDIMM_FAMILY_INTEL )return cmd;
@@ -436,17 +440,18 @@ int acpi_nfit_ctl(struct nvdimm_bus_descif (cmd_rc) *cmd_rc = -EINVAL ; +if (cmd ==ND_CMD_CALL ) + call_pkg = buf; + func =cmd_to_func (nfit_mem, cmd, call_pkg); +if (func <0 ) +return func; +if (nvdimm) {struct acpi_device *adev = nfit_mem->adev;if (!adev)return -ENOTTY ; -if (cmd ==ND_CMD_CALL ) - call_pkg = buf; - func =cmd_to_func (nfit_mem, cmd, call_pkg); -if (func <0 ) -return func; dimm_name =nvdimm_name (nvdimm); cmd_name =nvdimm_cmd_name (cmd); cmd_mask =nvdimm_cmd_mask (nvdimm);
@@ -457,12 +462,9 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc }else {struct acpi_device *adev =to_acpi_dev (acpi_desc); - func = cmd; cmd_name =nvdimm_bus_cmd_name (cmd); cmd_mask = nd_desc->cmd_mask; - dsm_mask = cmd_mask; -if (cmd ==ND_CMD_CALL ) - dsm_mask = nd_desc->bus_dsm_mask; + dsm_mask = nd_desc->bus_dsm_mask; desc =nd_cmd_bus_desc (cmd); guid =to_nfit_uuid (NFIT_DEV_BUS ); handle = adev->handle;
Greg Kroah-Hartman
maintainerPATCH 115/280 nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit c6c5df293bf1b488cf8459aac658aecfdccb13a9 upstream.
If query-ARS reports that ARS has stopped and requires continuation attempt to retrieve short-ARS results before continuing the long operation.
--- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/nfit/core.c +1 -1
@@ -2900,6 +2900,7 @@ static int ars_register(struct acpi_nfitswitch (acpi_nfit_query_poison (acpi_desc)) {case 0 : +case -ENOSPC :case -EAGAIN : rc =ars_start (acpi_desc, nfit_spa,ARS_REQ_SHORT );/* shouldn't happen, try again later */
@@ -2924,7 +2925,6 @@ static int ars_register(struct acpi_nfitbreak ;case -EBUSY :case -ENOMEM : -case -ENOSPC :/* * BIOS was using ARS, wait for it to complete (or * resources to become available) and then perform our
Greg Kroah-Hartman
maintainerPATCH 116/280 nfit/ars: Attempt short-ARS even in the no_init_ars case
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit fa3ed4d981b1fc19acdd07fcb152a4bd3706892b upstream.
The no_init_ars option is meant to prevent long-ARS, but short-ARS should be allowed to grab any immediate results.
--- drivers/acpi/nfit/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/acpi/nfit/core.c +3 -2
@@ -2892,11 +2892,12 @@ static int ars_register(struct acpi_nfit {int rc; -if (no_init_ars ||test_bit (ARS_FAILED , &nfit_spa->ars_state)) +if (test_bit (ARS_FAILED , &nfit_spa->ars_state))return acpi_nfit_register_region (acpi_desc, nfit_spa);set_bit (ARS_REQ_SHORT , &nfit_spa->ars_state); -set_bit (ARS_REQ_LONG , &nfit_spa->ars_state); +if (!no_init_ars) +set_bit (ARS_REQ_LONG , &nfit_spa->ars_state);switch (acpi_nfit_query_poison (acpi_desc)) {case 0 :
Greg Kroah-Hartman
maintainerPATCH 117/280 libnvdimm/label: Clear updating flag after label-set update
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 966d23a006ca7b44ac8cf4d0c96b19785e0c3da0 upstream.
The UEFI 2.7 specification sets expectations that the 'updating' flag is eventually cleared. To date, the libnvdimm core has never adhered to that protocol. The policy of the core matches the policy of other multi-device info-block formats like MD-Software-RAID that expect administrator intervention on inconsistent info-blocks, not automatic invalidation.
However, some pre-boot environments may unfortunately attempt to "clean up" the labels and invalidate a set when it fails to find at least one "non-updating" label in the set. Clear the updating flag after set updates to minimize the window of vulnerability to aggressive pre-boot environments.
Ideally implementations would not write to the label area outside of creating namespaces.
Note that this only minimizes the window, it does not close it as the system can still crash while clearing the flag and the set can be subsequently deleted / invalidated by the pre-boot environment.
--- drivers/nvdimm/label.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/nvdimm/label.c +18 -5
@@ -625,7 +625,7 @@ static const guid_t *to_abstraction_guidstatic int __pmem_label_update (struct nd_region *nd_region,struct nd_mapping *nd_mapping,struct nd_namespace_pmem *nspm, -int pos) +int pos,unsigned long flags) {struct nd_namespace_common *ndns = &nspm->nsio.common;struct nd_interleave_set *nd_set = nd_region->nd_set;
@@ -666,7 +666,7 @@ static int __pmem_label_update(struct ndmemcpy (nd_label->uuid, nspm->uuid,NSLABEL_UUID_LEN );if (nspm->alt_name)memcpy (nd_label->name, nspm->alt_name,NSLABEL_NAME_LEN ); - nd_label->flags =__cpu_to_le32 (NSLABEL_FLAG_UPDATING ); + nd_label->flags =__cpu_to_le32 (flags); nd_label->nlabel =__cpu_to_le16 (nd_region->ndr_mappings); nd_label->position =__cpu_to_le16 (pos); nd_label->isetcookie =__cpu_to_le64 (cookie);
@@ -1120,13 +1120,13 @@ static int del_labels(struct nd_mappingint nd_pmem_namespace_label_update (struct nd_region *nd_region,struct nd_namespace_pmem *nspm,resource_size_t size) { -int i; +int i, rc;for (i =0 ; i < nd_region->ndr_mappings; i++) {struct nd_mapping *nd_mapping = &nd_region->mapping[i];struct nvdimm_drvdata *ndd =to_ndd (nd_mapping);struct resource *res; -int rc, count =0 ; +int count =0 ;if (size ==0 ) { rc =del_labels (nd_mapping, nspm->uuid);
@@ -1144,7 +1144,20 @@ int nd_pmem_namespace_label_update(strucif (rc <0 )return rc; - rc =__pmem_label_update (nd_region, nd_mapping, nspm, i); + rc =__pmem_label_update (nd_region, nd_mapping, nspm, i, +NSLABEL_FLAG_UPDATING ); +if (rc) +return rc; + } + +if (size ==0 ) +return 0 ; + +/* Clear the UPDATING flag per UEFI 2.7 expectations */ +for (i =0 ; i < nd_region->ndr_mappings; i++) { +struct nd_mapping *nd_mapping = &nd_region->mapping[i]; + + rc =__pmem_label_update (nd_region, nd_mapping, nspm, i,0 );if (rc)return rc; }
Greg Kroah-Hartman
maintainerPATCH 118/280 libnvdimm, pfn: Fix over-trim in trim_pfn_device()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
commit f101ada7da6551127d192c2f1742c1e9e0f62799 upstream.
When trying to see whether current nd_region intersects with others, trim_pfn_device() has already calculated the *size* to be expanded to SECTION size.
Do not double append 'adjust' to 'size' when calculating whether the end of a region collides with the next pmem region.
--- drivers/nvdimm/pfn_devs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvdimm/pfn_devs.c +1 -1
@@ -619,7 +619,7 @@ static void trim_pfn_device(struct nd_pfif (region_intersects (start, size,IORESOURCE_SYSTEM_RAM ,IORES_DESC_NONE ) ==REGION_MIXED || !IS_ALIGNED (end, nd_pfn->align) - ||nd_region_conflict (nd_region, start, size + adjust)) + ||nd_region_conflict (nd_region, start, size)) *end_trunc = end -phys_pmem_align_down (nd_pfn, end); }
Greg Kroah-Hartman
maintainerPATCH 119/280 libnvdimm/pmem: Honor force_raw for legacy pmem regions
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit fa7d2e639cd90442d868dfc6ca1d4cc9d8bf206e upstream.
For recovery, where non-dax access is needed to a given physical address range, and testing, allow the 'force_raw' attribute to override the default establishment of a dev_pagemap.
Otherwise without this capability it is possible to end up with a namespace that can not be activated due to corrupted info-block, and one that can not be repaired due to a section collision.
--- drivers/nvdimm/namespace_devs.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/nvdimm/namespace_devs.c +4 -0
@@ -138,6 +138,7 @@ bool nd_is_uuid_unique(struct device *debool pmem_should_map_pages (struct device *dev) {struct nd_region *nd_region =to_nd_region (dev->parent); +struct nd_namespace_common *ndns =to_ndns (dev);struct nd_namespace_io *nsio;if (!IS_ENABLED (CONFIG_ZONE_DEVICE ))
@@ -149,6 +150,9 @@ bool pmem_should_map_pages(struct deviceif (is_nd_pfn (dev) ||is_nd_btt (dev))return false; +if (ndns->force_raw) +return false; + nsio =to_nd_namespace_io (dev); if (region_intersects(nsio->res.start, resource_size(&nsio->res), IORESOURCE_SYSTEM_RAM,
Greg Kroah-Hartman
maintainerPATCH 120/280 libnvdimm: Fix altmap reservation size calculation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver O'Halloran <[email protected]>
commit 07464e88365e9236febaca9ed1a2e2006d8bc952 upstream.
Libnvdimm reserves the first 8K of pfn and devicedax namespaces to store a superblock describing the namespace. This 8K reservation is contained within the altmap area which the kernel uses for the vmemmap backing for the pages within the namespace. The altmap allows for some pages at the start of the altmap area to be reserved and that mechanism is used to protect the superblock from being re-used as vmemmap backing.
The number of PFNs to reserve is calculated using:
PHYS_PFN(SZ_8K)
Which is implemented as:
#define PHYS_PFN(x) ((unsigned long)((x) >> PAGE_SHIFT))
So on systems where PAGE_SIZE is greater than 8K the reservation size is truncated to zero and the superblock area is re-used as vmemmap backing. As a result all the namespace information stored in the superblock (i.e. if it's a PFN or DAX namespace) is lost and the namespace needs to be re-created to get access to the contents.
This patch fixes this by using PFN_UP() rather than PHYS_PFN() to ensure that at least one page is reserved. On systems with a 4K pages size this patch should have no effect.
--- drivers/nvdimm/pfn_devs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvdimm/pfn_devs.c +1 -1
@@ -534,7 +534,7 @@ static unsigned long init_altmap_base(restatic unsigned long init_altmap_reserve (resource_size_t base) { -unsigned long reserve =PHYS_PFN (SZ_8K ); +unsigned long reserve =PFN_UP (SZ_8K );unsigned long base_pfn =PHYS_PFN (base); reserve += base_pfn -PFN_SECTION_ALIGN_DOWN (base_pfn);
Greg Kroah-Hartman
maintainerPATCH 121/280 fix cgroup_do_mount() handling of failure exits
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 399504e21a10be16dd1408ba0147367d9d82a10c upstream.
same story as with last May fixes in sysfs (7b745a4e4051 "unfuck sysfs_mount()"); new_sb is left uninitialized in case of early errors in kernfs_mount_ns() and papering over it by treating any error from kernfs_mount_ns() as equivalent to !new_ns ends up conflating the cases when objects had never been transferred to a superblock with ones when that has happened and resulting new superblock had been dropped. Easily fixed (same way as in sysfs case). Additionally, there's a superblock leak on kernfs_node_dentry() failure *and* a dentry leak inside kernfs_node_dentry() itself - the latter on probably impossible errors, but the former not impossible to trigger (as the matter of fact, injecting allocation failures at that point *does* trigger it).
--- fs/kernfs/mount.c | 8 ++++++-- kernel/cgroup/cgroup.c | 9 ++++++--- 2 files changed, 12 insertions(+), 5 deletions(-)
fs/kernfs/mount.c +6 -2
@@ -196,8 +196,10 @@ struct dentry *kernfs_node_dentry(structreturn dentry; knparent =find_next_ancestor (kn,NULL ); -if (WARN_ON (!knparent)) +if (WARN_ON (!knparent)) { +dput (dentry);return ERR_PTR (-EINVAL ); + } do { struct dentry *dtmp;
@@ -206,8 +208,10 @@ struct dentry *kernfs_node_dentry(structif (kn == knparent)return dentry; kntmp =find_next_ancestor (kn, knparent); -if (WARN_ON (!kntmp)) +if (WARN_ON (!kntmp)) { +dput (dentry);return ERR_PTR (-EINVAL ); + } dtmp =lookup_one_len_unlocked (kntmp->name, dentry,strlen (kntmp->name));dput (dentry);
kernel/cgroup/cgroup.c +6 -3
@@ -1998,7 +1998,7 @@ struct dentry *cgroup_do_mount(struct fi struct cgroup_namespace *ns) {struct dentry *dentry; -bool new_sb; +bool new_sb = false; dentry =kernfs_mount (fs_type, flags, root->kf_root, magic, &new_sb);
@@ -2008,6 +2008,7 @@ struct dentry *cgroup_do_mount(struct fi*/ if (!IS_ERR (dentry) && ns != &init_cgroup_ns) {struct dentry *nsdentry; +struct super_block *sb = dentry->d_sb;struct cgroup *cgrp;mutex_lock (&cgroup_mutex);
@@ -2018,12 +2019,14 @@ struct dentry *cgroup_do_mount(struct fispin_unlock_irq (&css_set_lock);mutex_unlock (&cgroup_mutex); - nsdentry =kernfs_node_dentry (cgrp->kn, dentry->d_sb); + nsdentry =kernfs_node_dentry (cgrp->kn, sb);dput (dentry); +if (IS_ERR (nsdentry)) +deactivate_locked_super (sb); dentry = nsdentry; } -if (IS_ERR (dentry) || !new_sb) +if (!new_sb)cgroup_put (&root->cgrp);return dentry;
Greg Kroah-Hartman
maintainerPATCH 122/280 crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 6ebc97006b196aafa9df0497fdfa866cf26f259b upstream.
Some algorithms have a ->setkey() method that is not atomic, in the sense that setting a key can fail after changes were already made to the tfm context. In this case, if a key was already set the tfm can end up in a state that corresponds to neither the old key nor the new key.
For example, in gcm.c, if the kzalloc() fails due to lack of memory, then the CTR part of GCM will have the new key but GHASH will not.
It's not feasible to make all ->setkey() methods atomic, especially ones that have to key multiple sub-tfms. Therefore, make the crypto API set CRYPTO_TFM_NEED_KEY if ->setkey() fails, to prevent the tfm from being used until a new key is set.
[Cc stable mainly because when introducing the NEED_KEY flag I changed
AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG previously didn't have this problem. So these "incompletely keyed" states became theoretically accessible via AF_ALG -- though, the opportunities for causing real mischief seem pretty limited.]
--- crypto/aead.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
crypto/aead.c +3 -1
@@ -61,8 +61,10 @@ int crypto_aead_setkey(struct crypto_aeaelse err =crypto_aead_alg (tfm)->setkey (tfm, key, keylen); -if (err) +if (unlikely (err)) { +crypto_aead_set_flags (tfm,CRYPTO_TFM_NEED_KEY );return err; + }crypto_aead_clear_flags (tfm,CRYPTO_TFM_NEED_KEY );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 123/280 crypto: aegis - fix handling chunked inputs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 0f533e67d26f228ea5dfdacc8a4bdeb487af5208 upstream.
The generic AEGIS implementations all fail the improved AEAD tests because they produce the wrong result with some data layouts. The issue is that they assume that if the skcipher_walk API gives 'nbytes' not aligned to the walksize (a.k.a. walk.stride), then it is the end of the data. In fact, this can happen before the end. Fix them.
--- crypto/aegis128.c | 14 +++++++------- crypto/aegis128l.c | 14 +++++++------- crypto/aegis256.c | 14 +++++++------- 3 files changed, 21 insertions(+), 21 deletions(-)
crypto/aegis128.c +7 -7
@@ -290,19 +290,19 @@ static void crypto_aegis128_process_cryp const struct aegis128_ops *ops) {struct skcipher_walk walk; -u8 *src, *dst; -unsigned int chunksize; ops->skcipher_walk_init (&walk, req, false);while (walk.nbytes) { - src = walk.src.virt.addr; - dst = walk.dst.virt.addr; - chunksize = walk.nbytes; +unsigned int nbytes = walk.nbytes; - ops->crypt_chunk (state, dst, src, chunksize); +if (nbytes < walk.total) + nbytes =round_down (nbytes, walk.stride); -skcipher_walk_done (&walk,0 ); + ops->crypt_chunk (state, walk.dst.virt.addr, walk.src.virt.addr, + nbytes); + +skcipher_walk_done (&walk, walk.nbytes - nbytes); } }
crypto/aegis128l.c +7 -7
@@ -353,19 +353,19 @@ static void crypto_aegis128l_process_cry const struct aegis128l_ops *ops) {struct skcipher_walk walk; -u8 *src, *dst; -unsigned int chunksize; ops->skcipher_walk_init (&walk, req, false);while (walk.nbytes) { - src = walk.src.virt.addr; - dst = walk.dst.virt.addr; - chunksize = walk.nbytes; +unsigned int nbytes = walk.nbytes; - ops->crypt_chunk (state, dst, src, chunksize); +if (nbytes < walk.total) + nbytes =round_down (nbytes, walk.stride); -skcipher_walk_done (&walk,0 ); + ops->crypt_chunk (state, walk.dst.virt.addr, walk.src.virt.addr, + nbytes); + +skcipher_walk_done (&walk, walk.nbytes - nbytes); } }
crypto/aegis256.c +7 -7
@@ -303,19 +303,19 @@ static void crypto_aegis256_process_cryp const struct aegis256_ops *ops) {struct skcipher_walk walk; -u8 *src, *dst; -unsigned int chunksize; ops->skcipher_walk_init (&walk, req, false);while (walk.nbytes) { - src = walk.src.virt.addr; - dst = walk.dst.virt.addr; - chunksize = walk.nbytes; +unsigned int nbytes = walk.nbytes; - ops->crypt_chunk (state, dst, src, chunksize); +if (nbytes < walk.total) + nbytes =round_down (nbytes, walk.stride); -skcipher_walk_done (&walk,0 ); + ops->crypt_chunk (state, walk.dst.virt.addr, walk.src.virt.addr, + nbytes); + +skcipher_walk_done (&walk, walk.nbytes - nbytes); } }
Greg Kroah-Hartman
maintainerPATCH 124/280 crypto: arm/crct10dif - revert to C code for short inputs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 62fecf295e3c48be1b5f17c440b93875b9adb4d6 upstream.
The SIMD routine ported from x86 used to have a special code path for inputs < 16 bytes, which got lost somewhere along the way. Instead, the current glue code aligns the input pointer to permit the NEON routine to use special versions of the vld1 instructions that assume 16 byte alignment, but this could result in inputs of less than 16 bytes to be passed in. This not only fails the new extended tests that Eric has implemented, it also results in the code reading past the end of the input, which could potentially result in crashes when dealing with less than 16 bytes of input at the end of a page which is followed by an unmapped page.
So update the glue code to only invoke the NEON routine if the input is at least 16 bytes.
--- arch/arm/crypto/crct10dif-ce-core.S | 14 +++++++------- arch/arm/crypto/crct10dif-ce-glue.c | 23 ++++++----------------- 2 files changed, 13 insertions(+), 24 deletions(-)
arch/arm/crypto/crct10dif-ce-core.S +7 -7
@@ -124,10 +124,10 @@ ENTRY(crc_t10dif_pmull) vext.8 q10, qzr, q0, #4 // receive the initial 64B data, xor the initial crc value - vld1.64 {q0-q1}, [arg2, :128]! - vld1.64 {q2-q3}, [arg2, :128]! - vld1.64 {q4-q5}, [arg2, :128]! - vld1.64 {q6-q7}, [arg2, :128]! + vld1.64 {q0-q1}, [arg2]! + vld1.64 {q2-q3}, [arg2]! + vld1.64 {q4-q5}, [arg2]! + vld1.64 {q6-q7}, [arg2]! CPU_LE( vrev64.8 q0, q0 ) CPU_LE( vrev64.8 q1, q1 ) CPU_LE( vrev64.8 q2, q2 )
@@ -167,7 +167,7 @@ CPU_LE( vrev64.8 q7, q7 ) _fold_64_B_loop: .macro fold64, reg1, reg2 - vld1.64 {q11-q12}, [arg2, :128]! + vld1.64 {q11-q12}, [arg2]! vmull.p64 q8, \reg1\()h, d21 vmull.p64 \reg1, \reg1\()l, d20
@@ -238,7 +238,7 @@ _16B_reduction_loop: vmull.p64 q7, d15, d21 veor.8 q7, q7, q8 - vld1.64 {q0}, [arg2, :128]! + vld1.64 {q0}, [arg2]! CPU_LE( vrev64.8 q0, q0 ) vswp d0, d1 veor.8 q7, q7, q0
@@ -335,7 +335,7 @@ _less_than_128: vmov.i8 q0, #0 vmov s3, arg1_low32 // get the initial crc value - vld1.64 {q7}, [arg2, :128]! + vld1.64 {q7}, [arg2]! CPU_LE( vrev64.8 q7, q7 ) vswp d14, d15 veor.8 q7, q7, q0
arch/arm/crypto/crct10dif-ce-glue.c +6 -17
@@ -35,26 +35,15 @@ static int crct10dif_update(struct shash unsigned int length) {u16 *crc =shash_desc_ctx (desc); -unsigned int l; -if (!may_use_simd ()) { - *crc =crc_t10dif_generic (*crc, data, length); +if (length >=CRC_T10DIF_PMULL_CHUNK_SIZE &&may_use_simd ()) { +kernel_neon_begin (); + *crc =crc_t10dif_pmull (*crc, data, length); +kernel_neon_end (); }else { -if (unlikely ((u32 )data %CRC_T10DIF_PMULL_CHUNK_SIZE )) { - l =min_t (u32, length,CRC_T10DIF_PMULL_CHUNK_SIZE - - ((u32 )data %CRC_T10DIF_PMULL_CHUNK_SIZE )); - - *crc =crc_t10dif_generic (*crc, data, l); - - length -= l; - data += l; - } -if (length >0 ) { -kernel_neon_begin (); - *crc =crc_t10dif_pmull (*crc, data, length); -kernel_neon_end (); - } + *crc =crc_t10dif_generic (*crc, data, length); } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 125/280 crypto: arm64/aes-neonbs - fix returning final keystream block
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 12455e320e19e9cc7ad97f4ab89c280fe297387c upstream.
The arm64 NEON bit-sliced implementation of AES-CTR fails the improved skcipher tests because it sometimes produces the wrong ciphertext. The bug is that the final keystream block isn't returned from the assembly code when the number of non-final blocks is zero. This can happen if the input data ends a few bytes after a page boundary. In this case the last bytes get "encrypted" by XOR'ing them with uninitialized memory.
Fix the assembly code to return the final keystream block when needed.
--- arch/arm64/crypto/aes-neonbs-core.S | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/arm64/crypto/aes-neonbs-core.S +6 -2
@@ -971,18 +971,22 @@ CPU_LE( rev x8, x8 ) 8: next_ctr v0 st1 {v0.16b}, [x24] - cbz x23, 0f + cbz x23, .Lctr_done cond_yield_neon 98b b 99b -0: frame_pop +.Lctr_done: + frame_pop ret /* * If we are handling the tail of the input (x6 != NULL), return the * final keystream block back to the caller. */ +0: cbz x25, 8b + st1 {v0.16b}, [x25] + b 8b 1: cbz x25, 8b st1 {v1.16b}, [x25] b 8b
Greg Kroah-Hartman
maintainerPATCH 126/280 crypto: arm64/crct10dif - revert to C code for short inputs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit d72b9d4acd548251f55b16843fc7a05dc5c80de8 upstream.
The SIMD routine ported from x86 used to have a special code path for inputs < 16 bytes, which got lost somewhere along the way. Instead, the current glue code aligns the input pointer to 16 bytes, which is not really necessary on this architecture (although it could be beneficial to performance to expose aligned data to the the NEON routine), but this could result in inputs of less than 16 bytes to be passed in. This not only fails the new extended tests that Eric has implemented, it also results in the code reading past the end of the input, which could potentially result in crashes when dealing with less than 16 bytes of input at the end of a page which is followed by an unmapped page.
So update the glue code to only invoke the NEON routine if the input is at least 16 bytes.
--- arch/arm64/crypto/crct10dif-ce-glue.c | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-)
arch/arm64/crypto/crct10dif-ce-glue.c +6 -19
@@ -36,26 +36,13 @@ static int crct10dif_update(struct shash unsigned int length) {u16 *crc =shash_desc_ctx (desc); -unsigned int l; -if (unlikely ((u64 )data %CRC_T10DIF_PMULL_CHUNK_SIZE )) { - l =min_t (u32, length,CRC_T10DIF_PMULL_CHUNK_SIZE - - ((u64 )data %CRC_T10DIF_PMULL_CHUNK_SIZE )); - - *crc =crc_t10dif_generic (*crc, data, l); - - length -= l; - data += l; - } - -if (length >0 ) { -if (may_use_simd ()) { -kernel_neon_begin (); - *crc =crc_t10dif_pmull (*crc, data, length); -kernel_neon_end (); - }else { - *crc =crc_t10dif_generic (*crc, data, length); - } +if (length >=CRC_T10DIF_PMULL_CHUNK_SIZE &&may_use_simd ()) { +kernel_neon_begin (); + *crc =crc_t10dif_pmull (*crc, data, length); +kernel_neon_end (); + }else { + *crc =crc_t10dif_generic (*crc, data, length); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 127/280 crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit ba7d7433a0e998c902132bd47330e355a1eaa894 upstream.
Some algorithms have a ->setkey() method that is not atomic, in the sense that setting a key can fail after changes were already made to the tfm context. In this case, if a key was already set the tfm can end up in a state that corresponds to neither the old key nor the new key.
It's not feasible to make all ->setkey() methods atomic, especially ones that have to key multiple sub-tfms. Therefore, make the crypto API set CRYPTO_TFM_NEED_KEY if ->setkey() fails and the algorithm requires a key, to prevent the tfm from being used until a new key is set.
Note: we can't set CRYPTO_TFM_NEED_KEY for OPTIONAL_KEY algorithms, so ->setkey() for those must nevertheless be atomic. That's fine for now since only the crc32 and crc32c algorithms set OPTIONAL_KEY, and it's not intended that OPTIONAL_KEY be used much.
[Cc stable mainly because when introducing the NEED_KEY flag I changed
AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG previously didn't have this problem. So these "incompletely keyed" states became theoretically accessible via AF_ALG -- though, the opportunities for causing real mischief seem pretty limited.]
--- crypto/ahash.c | 28 +++++++++++++++++++--------- crypto/shash.c | 18 +++++++++++++----- 2 files changed, 32 insertions(+), 14 deletions(-)
crypto/ahash.c +19 -9
@@ -190,6 +190,21 @@ static int ahash_setkey_unaligned(structreturn ret; } +static int ahash_nosetkey (struct crypto_ahash *tfm,const u8 *key, +unsigned int keylen) +{ +return -ENOSYS ; +} + +static void ahash_set_needkey (struct crypto_ahash *tfm) +{ +const struct hash_alg_common *alg =crypto_hash_alg_common (tfm); + +if (tfm->setkey != ahash_nosetkey && + !(alg->base.cra_flags &CRYPTO_ALG_OPTIONAL_KEY )) +crypto_ahash_set_flags (tfm,CRYPTO_TFM_NEED_KEY ); +} +int crypto_ahash_setkey (struct crypto_ahash *tfm,const u8 *key,unsigned int keylen) {
@@ -201,20 +216,16 @@ int crypto_ahash_setkey(struct crypto_ahelse err = tfm->setkey (tfm, key, keylen); -if (err) +if (unlikely (err)) { +ahash_set_needkey (tfm);return err; + }crypto_ahash_clear_flags (tfm,CRYPTO_TFM_NEED_KEY );return 0 ; }EXPORT_SYMBOL_GPL (crypto_ahash_setkey); -static int ahash_nosetkey (struct crypto_ahash *tfm,const u8 *key, -unsigned int keylen) -{ -return -ENOSYS ; -} -static inline unsigned int ahash_align_buffer_size (unsigned len,unsigned long mask) {
@@ -467,8 +478,7 @@ static int crypto_ahash_init_tfm(structif (alg->setkey) { hash->setkey = alg->setkey; -if (!(alg->halg.base.cra_flags &CRYPTO_ALG_OPTIONAL_KEY )) -crypto_ahash_set_flags (hash,CRYPTO_TFM_NEED_KEY ); +ahash_set_needkey (hash); }return 0 ;
crypto/shash.c +13 -5
@@ -53,6 +53,13 @@ static int shash_setkey_unaligned(structreturn err; } +static void shash_set_needkey (struct crypto_shash *tfm,struct shash_alg *alg) +{ +if (crypto_shash_alg_has_setkey (alg) && + !(alg->base.cra_flags &CRYPTO_ALG_OPTIONAL_KEY )) +crypto_shash_set_flags (tfm,CRYPTO_TFM_NEED_KEY ); +} +int crypto_shash_setkey (struct crypto_shash *tfm,const u8 *key,unsigned int keylen) {
@@ -65,8 +72,10 @@ int crypto_shash_setkey(struct crypto_shelse err = shash->setkey (tfm, key, keylen); -if (err) +if (unlikely (err)) { +shash_set_needkey (tfm, shash);return err; + }crypto_shash_clear_flags (tfm,CRYPTO_TFM_NEED_KEY );return 0 ;
@@ -368,7 +377,8 @@ int crypto_init_shash_ops_async(struct c crt->final = shash_async_final; crt->finup = shash_async_finup; crt->digest = shash_async_digest; - crt->setkey = shash_async_setkey; +if (crypto_shash_alg_has_setkey (alg)) + crt->setkey = shash_async_setkey;crypto_ahash_set_flags (crt,crypto_shash_get_flags (shash) &CRYPTO_TFM_NEED_KEY );
@@ -390,9 +400,7 @@ static int crypto_shash_init_tfm(struct hash->descsize = alg->descsize; -if (crypto_shash_alg_has_setkey (alg) && - !(alg->base.cra_flags &CRYPTO_ALG_OPTIONAL_KEY )) -crypto_shash_set_flags (hash,CRYPTO_TFM_NEED_KEY ); +shash_set_needkey (hash, alg);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 128/280 crypto: morus - fix handling chunked inputs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit d644f1c8746ed24f81075480f9e9cb3777ae8d65 upstream.
The generic MORUS implementations all fail the improved AEAD tests because they produce the wrong result with some data layouts. The issue is that they assume that if the skcipher_walk API gives 'nbytes' not aligned to the walksize (a.k.a. walk.stride), then it is the end of the data. In fact, this can happen before the end. Fix them.
--- crypto/morus1280.c | 13 +++++++------ crypto/morus640.c | 13 +++++++------ 2 files changed, 14 insertions(+), 12 deletions(-)
crypto/morus1280.c +7 -6
@@ -366,18 +366,19 @@ static void crypto_morus1280_process_cry const struct morus1280_ops *ops) {struct skcipher_walk walk; -u8 *dst; -const u8 *src; ops->skcipher_walk_init (&walk, req, false);while (walk.nbytes) { - src = walk.src.virt.addr; - dst = walk.dst.virt.addr; +unsigned int nbytes = walk.nbytes; - ops->crypt_chunk (state, dst, src, walk.nbytes); +if (nbytes < walk.total) + nbytes =round_down (nbytes, walk.stride); -skcipher_walk_done (&walk,0 ); + ops->crypt_chunk (state, walk.dst.virt.addr, walk.src.virt.addr, + nbytes); + +skcipher_walk_done (&walk, walk.nbytes - nbytes); } }
crypto/morus640.c +7 -6
@@ -365,18 +365,19 @@ static void crypto_morus640_process_cryp const struct morus640_ops *ops) {struct skcipher_walk walk; -u8 *dst; -const u8 *src; ops->skcipher_walk_init (&walk, req, false);while (walk.nbytes) { - src = walk.src.virt.addr; - dst = walk.dst.virt.addr; +unsigned int nbytes = walk.nbytes; - ops->crypt_chunk (state, dst, src, walk.nbytes); +if (nbytes < walk.total) + nbytes =round_down (nbytes, walk.stride); -skcipher_walk_done (&walk,0 ); + ops->crypt_chunk (state, walk.dst.virt.addr, walk.src.virt.addr, + nbytes); + +skcipher_walk_done (&walk, walk.nbytes - nbytes); } }
Greg Kroah-Hartman
maintainerPATCH 129/280 crypto: pcbc - remove bogus memcpy()s with src == dest
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 251b7aea34ba3c4d4fdfa9447695642eb8b8b098 upstream.
The memcpy()s in the PCBC implementation use walk->iv as both the source and destination, which has undefined behavior. These memcpy()'s are actually unneeded, because walk->iv is already used to hold the previous plaintext block XOR'd with the previous ciphertext block. Thus, walk->iv is already updated to its final value.
So remove the broken and unnecessary memcpy()s.
--- crypto/pcbc.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
crypto/pcbc.c +4 -10
@@ -51,7 +51,7 @@ static int crypto_pcbc_encrypt_segment(sunsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr;u8 *dst = walk->dst.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv; do { crypto_xor(iv, src, bsize);
@@ -72,7 +72,7 @@ static int crypto_pcbc_encrypt_inplace(sint bsize =crypto_cipher_blocksize (tfm);unsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv;u8 tmpbuf[MAX_CIPHER_BLOCKSIZE ]; do {
@@ -84,8 +84,6 @@ static int crypto_pcbc_encrypt_inplace(s src += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
@@ -121,7 +119,7 @@ static int crypto_pcbc_decrypt_segment(sunsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr;u8 *dst = walk->dst.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv; do { crypto_cipher_decrypt_one(tfm, dst, src);
@@ -132,8 +130,6 @@ static int crypto_pcbc_decrypt_segment(s dst += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
@@ -144,7 +140,7 @@ static int crypto_pcbc_decrypt_inplace(sint bsize =crypto_cipher_blocksize (tfm);unsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv;u8 tmpbuf[MAX_CIPHER_BLOCKSIZE ]__aligned(__alignof__(u32)) ; do {
@@ -156,8 +152,6 @@ static int crypto_pcbc_decrypt_inplace(s src += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
Greg Kroah-Hartman
maintainerPATCH 130/280 crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit b1f6b4bf416b49f00f3abc49c639371cdecaaad1 upstream.
Some algorithms have a ->setkey() method that is not atomic, in the sense that setting a key can fail after changes were already made to the tfm context. In this case, if a key was already set the tfm can end up in a state that corresponds to neither the old key nor the new key.
For example, in lrw.c, if gf128mul_init_64k_bbe() fails due to lack of memory, then priv::table will be left NULL. After that, encryption with that tfm will cause a NULL pointer dereference.
It's not feasible to make all ->setkey() methods atomic, especially ones that have to key multiple sub-tfms. Therefore, make the crypto API set CRYPTO_TFM_NEED_KEY if ->setkey() fails and the algorithm requires a key, to prevent the tfm from being used until a new key is set.
[Cc stable mainly because when introducing the NEED_KEY flag I changed
AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG previously didn't have this problem. So these "incompletely keyed" states became theoretically accessible via AF_ALG -- though, the opportunities for causing real mischief seem pretty limited.]
--- crypto/skcipher.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-)
crypto/skcipher.c +18 -9
@@ -584,6 +584,12 @@ static unsigned int crypto_skcipher_extsreturn crypto_alg_extsize (alg); } +static void skcipher_set_needkey (struct crypto_skcipher *tfm) +{ +if (tfm->keysize) +crypto_skcipher_set_flags (tfm,CRYPTO_TFM_NEED_KEY ); +} +static int skcipher_setkey_blkcipher (struct crypto_skcipher *tfm,const u8 *key,unsigned int keylen) {
@@ -597,8 +603,10 @@ static int skcipher_setkey_blkcipher(str err =crypto_blkcipher_setkey (blkcipher, key, keylen);crypto_skcipher_set_flags (tfm,crypto_blkcipher_get_flags (blkcipher) &CRYPTO_TFM_RES_MASK ); -if (err) +if (unlikely (err)) { +skcipher_set_needkey (tfm);return err; + }crypto_skcipher_clear_flags (tfm,CRYPTO_TFM_NEED_KEY );return 0 ;
@@ -676,8 +684,7 @@ static int crypto_init_skcipher_ops_blkc skcipher->ivsize =crypto_blkcipher_ivsize (blkcipher); skcipher->keysize = calg->cra_blkcipher.max_keysize; -if (skcipher->keysize) -crypto_skcipher_set_flags (skcipher,CRYPTO_TFM_NEED_KEY ); +skcipher_set_needkey (skcipher);return 0 ; }
@@ -697,8 +704,10 @@ static int skcipher_setkey_ablkcipher(stcrypto_skcipher_set_flags (tfm,crypto_ablkcipher_get_flags (ablkcipher) &CRYPTO_TFM_RES_MASK ); -if (err) +if (unlikely (err)) { +skcipher_set_needkey (tfm);return err; + }crypto_skcipher_clear_flags (tfm,CRYPTO_TFM_NEED_KEY );return 0 ;
@@ -775,8 +784,7 @@ static int crypto_init_skcipher_ops_ablksizeof (struct ablkcipher_request ); skcipher->keysize = calg->cra_ablkcipher.max_keysize; -if (skcipher->keysize) -crypto_skcipher_set_flags (skcipher,CRYPTO_TFM_NEED_KEY ); +skcipher_set_needkey (skcipher);return 0 ; }
@@ -819,8 +827,10 @@ static int skcipher_setkey(struct cryptoelse err = cipher->setkey (tfm, key, keylen); -if (err) +if (unlikely (err)) { +skcipher_set_needkey (tfm);return err; + }crypto_skcipher_clear_flags (tfm,CRYPTO_TFM_NEED_KEY );return 0 ;
@@ -852,8 +862,7 @@ static int crypto_skcipher_init_tfm(stru skcipher->ivsize = alg->ivsize; skcipher->keysize = alg->max_keysize; -if (skcipher->keysize) -crypto_skcipher_set_flags (skcipher,CRYPTO_TFM_NEED_KEY ); +skcipher_set_needkey (skcipher);if (alg->exit) skcipher->base.exit = crypto_skcipher_exit_tfm;
Greg Kroah-Hartman
maintainerPATCH 131/280 crypto: testmgr - skip crc32c context test for ahash algorithms
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit eb5e6730db98fcc4b51148b4a819fa4bf864ae54 upstream.
Instantiating "cryptd(crc32c)" causes a crypto self-test failure because the crypto_alloc_shash() in alg_test_crc32c() fails. This is because cryptd(crc32c) is an ahash algorithm, not a shash algorithm; so it can only be accessed through the ahash API, unlike shash algorithms which can be accessed through both the ahash and shash APIs.
As the test is testing the shash descriptor format which is only applicable to shash algorithms, skip it for ahash algorithms.
(Note that it's still important to fix crypto self-test failures even
for weird algorithm instantiations like cryptd(crc32c) that no one would really use; in fips_enabled mode unprivileged users can use them to panic the kernel, and also they prevent treating a crypto self-test failure as a bug when fuzzing the kernel.)
--- crypto/testmgr.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
crypto/testmgr.c +10 -4
@@ -1894,14 +1894,21 @@ static int alg_test_crc32c(const struct err =alg_test_hash (desc, driver, type, mask);if (err) - goto out; +return err; tfm =crypto_alloc_shash (driver, type, mask);if (IS_ERR (tfm)) { +if (PTR_ERR (tfm) == -ENOENT ) { +/* +* This crc32c implementation is only available through +* ahash API, not the shash API, so the remaining part +* of the test is not applicable to it. +*/ +return 0 ; + }printk (KERN_ERR "alg: crc32c: Failed to load transform for %s: " "%ld\n" , driver,PTR_ERR (tfm)); - err =PTR_ERR (tfm); - goto out; +return PTR_ERR (tfm); } do {
@@ -1928,7 +1935,6 @@ static int alg_test_crc32c(const structcrypto_free_shash (tfm); -out:return err; }
Greg Kroah-Hartman
maintainerPATCH 132/280 crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit ba6771c0a0bc2fac9d6a8759bab8493bd1cffe3b upstream.
The x86 AEGIS implementations all fail the improved AEAD tests because they produce the wrong result with some data layouts. The issue is that they assume that if the skcipher_walk API gives 'nbytes' not aligned to the walksize (a.k.a. walk.stride), then it is the end of the data. In fact, this can happen before the end.
Also, when the CRYPTO_TFM_REQ_MAY_SLEEP flag is given, they can incorrectly sleep in the skcipher_walk_*() functions while preemption has been disabled by kernel_fpu_begin().
Fix these bugs.
--- arch/x86/crypto/aegis128-aesni-glue.c | 38 +++++++++++++-------------------- arch/x86/crypto/aegis128l-aesni-glue.c | 38 +++++++++++++-------------------- arch/x86/crypto/aegis256-aesni-glue.c | 38 +++++++++++++-------------------- 3 files changed, 45 insertions(+), 69 deletions(-)
arch/x86/crypto/aegis128-aesni-glue.c +15 -23
@@ -119,31 +119,20 @@ static void crypto_aegis128_aesni_proces }static void crypto_aegis128_aesni_process_crypt ( -struct aegis_state *state,struct aead_request *req, +struct aegis_state *state,struct skcipher_walk *walk,const struct aegis_crypt_ops *ops) { -struct skcipher_walk walk; -u8 *src, *dst; -unsigned int chunksize, base; - - ops->skcipher_walk_init (&walk, req, false); - -while (walk.nbytes) { - src = walk.src.virt.addr; - dst = walk.dst.virt.addr; - chunksize = walk.nbytes; - - ops->crypt_blocks (state, chunksize, src, dst); - - base = chunksize & ~(AEGIS128_BLOCK_SIZE -1 ); - src += base; - dst += base; - chunksize &=AEGIS128_BLOCK_SIZE -1 ; - -if (chunksize >0 ) - ops->crypt_tail (state, chunksize, src, dst); +while (walk->nbytes >=AEGIS128_BLOCK_SIZE ) { + ops->crypt_blocks (state, +round_down (walk->nbytes,AEGIS128_BLOCK_SIZE ), + walk->src.virt.addr, walk->dst.virt.addr); +skcipher_walk_done (walk, walk->nbytes %AEGIS128_BLOCK_SIZE ); + } -skcipher_walk_done (&walk,0 ); +if (walk->nbytes) { + ops->crypt_tail (state, walk->nbytes, walk->src.virt.addr, + walk->dst.virt.addr); +skcipher_walk_done (walk,0 ); } }
@@ -186,13 +175,16 @@ static void crypto_aegis128_aesni_crypt( {struct crypto_aead *tfm =crypto_aead_reqtfm (req);struct aegis_ctx *ctx =crypto_aegis128_aesni_ctx (tfm); +struct skcipher_walk walk;struct aegis_state state; + ops->skcipher_walk_init (&walk, req, true); +kernel_fpu_begin ();crypto_aegis128_aesni_init (&state, ctx->key.bytes, req->iv);crypto_aegis128_aesni_process_ad (&state, req->src, req->assoclen); -crypto_aegis128_aesni_process_crypt (&state, req, ops); +crypto_aegis128_aesni_process_crypt (&state, &walk, ops);crypto_aegis128_aesni_final (&state, tag_xor, req->assoclen, cryptlen);kernel_fpu_end ();
arch/x86/crypto/aegis128l-aesni-glue.c +15 -23
@@ -119,31 +119,20 @@ static void crypto_aegis128l_aesni_proce }static void crypto_aegis128l_aesni_process_crypt ( -struct aegis_state *state,struct aead_request *req, +struct aegis_state *state,struct skcipher_walk *walk,const struct aegis_crypt_ops *ops) { -struct skcipher_walk walk; -u8 *src, *dst; -unsigned int chunksize, base; - - ops->skcipher_walk_init (&walk, req, false); - -while (walk.nbytes) { - src = walk.src.virt.addr; - dst = walk.dst.virt.addr; - chunksize = walk.nbytes; - - ops->crypt_blocks (state, chunksize, src, dst); - - base = chunksize & ~(AEGIS128L_BLOCK_SIZE -1 ); - src += base; - dst += base; - chunksize &=AEGIS128L_BLOCK_SIZE -1 ; - -if (chunksize >0 ) - ops->crypt_tail (state, chunksize, src, dst); +while (walk->nbytes >=AEGIS128L_BLOCK_SIZE ) { + ops->crypt_blocks (state,round_down (walk->nbytes, +AEGIS128L_BLOCK_SIZE ), + walk->src.virt.addr, walk->dst.virt.addr); +skcipher_walk_done (walk, walk->nbytes %AEGIS128L_BLOCK_SIZE ); + } -skcipher_walk_done (&walk,0 ); +if (walk->nbytes) { + ops->crypt_tail (state, walk->nbytes, walk->src.virt.addr, + walk->dst.virt.addr); +skcipher_walk_done (walk,0 ); } }
@@ -186,13 +175,16 @@ static void crypto_aegis128l_aesni_crypt {struct crypto_aead *tfm =crypto_aead_reqtfm (req);struct aegis_ctx *ctx =crypto_aegis128l_aesni_ctx (tfm); +struct skcipher_walk walk;struct aegis_state state; + ops->skcipher_walk_init (&walk, req, true); +kernel_fpu_begin ();crypto_aegis128l_aesni_init (&state, ctx->key.bytes, req->iv);crypto_aegis128l_aesni_process_ad (&state, req->src, req->assoclen); -crypto_aegis128l_aesni_process_crypt (&state, req, ops); +crypto_aegis128l_aesni_process_crypt (&state, &walk, ops);crypto_aegis128l_aesni_final (&state, tag_xor, req->assoclen, cryptlen);kernel_fpu_end ();
arch/x86/crypto/aegis256-aesni-glue.c +15 -23
@@ -119,31 +119,20 @@ static void crypto_aegis256_aesni_proces }static void crypto_aegis256_aesni_process_crypt ( -struct aegis_state *state,struct aead_request *req, +struct aegis_state *state,struct skcipher_walk *walk,const struct aegis_crypt_ops *ops) { -struct skcipher_walk walk; -u8 *src, *dst; -unsigned int chunksize, base; - - ops->skcipher_walk_init (&walk, req, false); - -while (walk.nbytes) { - src = walk.src.virt.addr; - dst = walk.dst.virt.addr; - chunksize = walk.nbytes; - - ops->crypt_blocks (state, chunksize, src, dst); - - base = chunksize & ~(AEGIS256_BLOCK_SIZE -1 ); - src += base; - dst += base; - chunksize &=AEGIS256_BLOCK_SIZE -1 ; - -if (chunksize >0 ) - ops->crypt_tail (state, chunksize, src, dst); +while (walk->nbytes >=AEGIS256_BLOCK_SIZE ) { + ops->crypt_blocks (state, +round_down (walk->nbytes,AEGIS256_BLOCK_SIZE ), + walk->src.virt.addr, walk->dst.virt.addr); +skcipher_walk_done (walk, walk->nbytes %AEGIS256_BLOCK_SIZE ); + } -skcipher_walk_done (&walk,0 ); +if (walk->nbytes) { + ops->crypt_tail (state, walk->nbytes, walk->src.virt.addr, + walk->dst.virt.addr); +skcipher_walk_done (walk,0 ); } }
@@ -186,13 +175,16 @@ static void crypto_aegis256_aesni_crypt( {struct crypto_aead *tfm =crypto_aead_reqtfm (req);struct aegis_ctx *ctx =crypto_aegis256_aesni_ctx (tfm); +struct skcipher_walk walk;struct aegis_state state; + ops->skcipher_walk_init (&walk, req, true); +kernel_fpu_begin ();crypto_aegis256_aesni_init (&state, ctx->key, req->iv);crypto_aegis256_aesni_process_ad (&state, req->src, req->assoclen); -crypto_aegis256_aesni_process_crypt (&state, req, ops); +crypto_aegis256_aesni_process_crypt (&state, &walk, ops);crypto_aegis256_aesni_final (&state, tag_xor, req->assoclen, cryptlen);kernel_fpu_end ();
Greg Kroah-Hartman
maintainerPATCH 133/280 crypto: x86/aesni-gcm - fix crash on empty plaintext
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 3af349639597fea582a93604734d717e59a0e223 upstream.
gcmaes_crypt_by_sg() dereferences the NULL pointer returned by scatterwalk_ffwd() when encrypting an empty plaintext and the source scatterlist ends immediately after the associated data.
Fix it by only fast-forwarding to the src/dst data scatterlists if the data length is nonzero.
This bug is reproduced by the "rfc4543(gcm(aes))" test vectors when run with the new AEAD test manager.
--- arch/x86/crypto/aesni-intel_glue.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
arch/x86/crypto/aesni-intel_glue.c +8 -5
@@ -830,11 +830,14 @@ static int gcmaes_crypt_by_sg(bool enc,scatterwalk_map_and_copy (assoc, req->src,0 , assoclen,0 ); } - src_sg =scatterwalk_ffwd (src_start, req->src, req->assoclen); -scatterwalk_start (&src_sg_walk, src_sg); -if (req->src != req->dst) { - dst_sg =scatterwalk_ffwd (dst_start, req->dst, req->assoclen); -scatterwalk_start (&dst_sg_walk, dst_sg); +if (left) { + src_sg =scatterwalk_ffwd (src_start, req->src, req->assoclen); +scatterwalk_start (&src_sg_walk, src_sg); +if (req->src != req->dst) { + dst_sg =scatterwalk_ffwd (dst_start, req->dst, + req->assoclen); +scatterwalk_start (&dst_sg_walk, dst_sg); + } }kernel_fpu_begin ();
Greg Kroah-Hartman
maintainerPATCH 134/280 crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 2060e284e9595fc3baed6e035903c05b93266555 upstream.
The x86 MORUS implementations all fail the improved AEAD tests because they produce the wrong result with some data layouts. The issue is that they assume that if the skcipher_walk API gives 'nbytes' not aligned to the walksize (a.k.a. walk.stride), then it is the end of the data. In fact, this can happen before the end.
Also, when the CRYPTO_TFM_REQ_MAY_SLEEP flag is given, they can incorrectly sleep in the skcipher_walk_*() functions while preemption has been disabled by kernel_fpu_begin().
Fix these bugs.
--- arch/x86/crypto/morus1280_glue.c | 40 +++++++++++++++------------------------ arch/x86/crypto/morus640_glue.c | 39 ++++++++++++++------------------------ 2 files changed, 31 insertions(+), 48 deletions(-)
arch/x86/crypto/morus1280_glue.c +16 -24
@@ -85,31 +85,20 @@ static void crypto_morus1280_glue_processtatic void crypto_morus1280_glue_process_crypt (struct morus1280_state *state,struct morus1280_ops ops, -struct aead_request *req) +struct skcipher_walk *walk) { -struct skcipher_walk walk; -u8 *cursor_src, *cursor_dst; -unsigned int chunksize, base; - - ops.skcipher_walk_init (&walk, req, false); - -while (walk.nbytes) { - cursor_src = walk.src.virt.addr; - cursor_dst = walk.dst.virt.addr; - chunksize = walk.nbytes; - - ops.crypt_blocks (state, cursor_src, cursor_dst, chunksize); - - base = chunksize & ~(MORUS1280_BLOCK_SIZE -1 ); - cursor_src += base; - cursor_dst += base; - chunksize &=MORUS1280_BLOCK_SIZE -1 ; - -if (chunksize >0 ) - ops.crypt_tail (state, cursor_src, cursor_dst, - chunksize); +while (walk->nbytes >=MORUS1280_BLOCK_SIZE ) { + ops.crypt_blocks (state, walk->src.virt.addr, + walk->dst.virt.addr, +round_down (walk->nbytes, +MORUS1280_BLOCK_SIZE )); +skcipher_walk_done (walk, walk->nbytes %MORUS1280_BLOCK_SIZE ); + } -skcipher_walk_done (&walk,0 ); +if (walk->nbytes) { + ops.crypt_tail (state, walk->src.virt.addr, walk->dst.virt.addr, + walk->nbytes); +skcipher_walk_done (walk,0 ); } }
@@ -147,12 +136,15 @@ static void crypto_morus1280_glue_crypt(struct crypto_aead *tfm =crypto_aead_reqtfm (req);struct morus1280_ctx *ctx =crypto_aead_ctx (tfm);struct morus1280_state state; +struct skcipher_walk walk; + + ops.skcipher_walk_init (&walk, req, true);kernel_fpu_begin (); ctx->ops->init (&state, &ctx->key, req->iv);crypto_morus1280_glue_process_ad (&state, ctx->ops, req->src, req->assoclen); -crypto_morus1280_glue_process_crypt (&state, ops, req); +crypto_morus1280_glue_process_crypt (&state, ops, &walk); ctx->ops->final (&state, tag_xor, req->assoclen, cryptlen);kernel_fpu_end ();
arch/x86/crypto/morus640_glue.c +15 -24
@@ -85,31 +85,19 @@ static void crypto_morus640_glue_processstatic void crypto_morus640_glue_process_crypt (struct morus640_state *state,struct morus640_ops ops, -struct aead_request *req) +struct skcipher_walk *walk) { -struct skcipher_walk walk; -u8 *cursor_src, *cursor_dst; -unsigned int chunksize, base; - - ops.skcipher_walk_init (&walk, req, false); - -while (walk.nbytes) { - cursor_src = walk.src.virt.addr; - cursor_dst = walk.dst.virt.addr; - chunksize = walk.nbytes; - - ops.crypt_blocks (state, cursor_src, cursor_dst, chunksize); - - base = chunksize & ~(MORUS640_BLOCK_SIZE -1 ); - cursor_src += base; - cursor_dst += base; - chunksize &=MORUS640_BLOCK_SIZE -1 ; - -if (chunksize >0 ) - ops.crypt_tail (state, cursor_src, cursor_dst, - chunksize); +while (walk->nbytes >=MORUS640_BLOCK_SIZE ) { + ops.crypt_blocks (state, walk->src.virt.addr, + walk->dst.virt.addr, +round_down (walk->nbytes,MORUS640_BLOCK_SIZE )); +skcipher_walk_done (walk, walk->nbytes %MORUS640_BLOCK_SIZE ); + } -skcipher_walk_done (&walk,0 ); +if (walk->nbytes) { + ops.crypt_tail (state, walk->src.virt.addr, walk->dst.virt.addr, + walk->nbytes); +skcipher_walk_done (walk,0 ); } }
@@ -143,12 +131,15 @@ static void crypto_morus640_glue_crypt(sstruct crypto_aead *tfm =crypto_aead_reqtfm (req);struct morus640_ctx *ctx =crypto_aead_ctx (tfm);struct morus640_state state; +struct skcipher_walk walk; + + ops.skcipher_walk_init (&walk, req, true);kernel_fpu_begin (); ctx->ops->init (&state, &ctx->key, req->iv);crypto_morus640_glue_process_ad (&state, ctx->ops, req->src, req->assoclen); -crypto_morus640_glue_process_crypt (&state, ops, req); +crypto_morus640_glue_process_crypt (&state, ops, &walk); ctx->ops->final (&state, tag_xor, req->assoclen, cryptlen);kernel_fpu_end ();
Greg Kroah-Hartman
maintainerPATCH 135/280 crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit eaf46edf6ea89675bd36245369c8de5063a0272c upstream.
The NEON MAC calculation routine fails to handle the case correctly where there is some data in the buffer, and the input fills it up exactly. In this case, we enter the loop at the end with w8 == 0, while a negative value is assumed, and so the loop carries on until the increment of the 32-bit counter wraps around, which is quite obviously wrong.
So omit the loop altogether in this case, and exit right away.
--- arch/arm64/crypto/aes-ce-ccm-core.S | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/arm64/crypto/aes-ce-ccm-core.S +3 -2
@@ -74,12 +74,13 @@ ENTRY(ce_aes_ccm_auth_data) beq 10f ext v0.16b, v0.16b, v0.16b, #1 /* rotate out the mac bytes */ b 7b -8: mov w7, w8 +8: cbz w8, 91f + mov w7, w8 add w8, w8, #16 9: ext v1.16b, v1.16b, v1.16b, #1 adds w7, w7, #1 bne 9b - eor v0.16b, v0.16b, v1.16b +91: eor v0.16b, v0.16b, v1.16b st1 {v0.16b}, [x0] 10: str w8, [x3] ret
Greg Kroah-Hartman
maintainerPATCH 136/280 crypto: arm64/aes-ccm - fix bugs in non-NEON fallback routine
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 969e2f59d589c15f6aaf306e590dde16f12ea4b3 upstream.
Commit 5092fcf34908 ("crypto: arm64/aes-ce-ccm: add non-SIMD generic fallback") introduced C fallback code to replace the NEON routines when invoked from a context where the NEON is not available (i.e., from the context of a softirq taken while the NEON is already being used in kernel process context)
Fix two logical flaws in the MAC calculation of the associated data.
--- arch/arm64/crypto/aes-ce-ccm-glue.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm64/crypto/aes-ce-ccm-glue.c +1 -3
@@ -125,7 +125,7 @@ static void ccm_update_mac(struct crypto abytes -= added; } -while (abytes >AES_BLOCK_SIZE ) { +while (abytes >=AES_BLOCK_SIZE ) {__aes_arm64_encrypt (key->key_enc, mac, mac,num_rounds (key));crypto_xor (mac, in,AES_BLOCK_SIZE );
@@ -139,8 +139,6 @@ static void ccm_update_mac(struct crypto num_rounds(key));crypto_xor (mac, in, abytes); *macp = abytes; - }else { - *macp =0 ; } } }
Greg Kroah-Hartman
maintainerPATCH 137/280 CIFS: Do not reset lease state to NONE on lease break
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 7b9b9edb49ad377b1e06abf14354c227e9ac4b06 upstream.
Currently on lease break the client sets a caching level twice:
when oplock is detected and when oplock is processed. While the 1st attempt sets the level to the value provided by the server, the 2nd one resets the level to None unconditionally. This happens because the oplock/lease processing code was changed to avoid races between page cache flushes and oplock breaks. The commit c11f1df5003d534 ("cifs: Wait for writebacks to complete before attempting write.") fixed the races for oplocks but didn't apply the same changes for leases resulting in overwriting the server granted value to None. Fix this by properly processing lease breaks.
--- fs/cifs/smb2misc.c | 17 ++++++++++++++--- fs/cifs/smb2ops.c | 15 ++++++++++++--- 2 files changed, 26 insertions(+), 6 deletions(-)
fs/cifs/smb2misc.c +14 -3
@@ -517,7 +517,6 @@ smb2_tcon_has_lease(struct cifs_tcon *tc__u8 lease_state;struct list_head *tmp;struct cifsFileInfo *cfile; -struct TCP_Server_Info *server = tcon->ses->server;struct cifs_pending_open *open;struct cifsInodeInfo *cinode; int ack_req = le32_to_cpu(rsp->Flags &
@@ -537,13 +536,25 @@ smb2_tcon_has_lease(struct cifs_tcon *tccifs_dbg (FYI ,"lease key match, lease break 0x%x\n" ,le32_to_cpu (rsp->NewLeaseState)); - server->ops->set_oplock_level (cinode, lease_state,0 ,NULL ); -if (ack_req) cfile->oplock_break_cancelled = false;else cfile->oplock_break_cancelled = true; +set_bit (CIFS_INODE_PENDING_OPLOCK_BREAK , &cinode->flags); + +/* +* Set or clear flags depending on the lease state being READ. +* HANDLE caching flag should be added when the client starts +* to defer closing remote file handles with HANDLE leases. +*/ +if (lease_state &SMB2_LEASE_READ_CACHING_HE ) +set_bit (CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , + &cinode->flags); +else +clear_bit (CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , + &cinode->flags); +queue_work (cifsoplockd_wq, &cfile->oplock_break);kfree (lw);return true;
fs/cifs/smb2ops.c +12 -3
@@ -2301,6 +2301,15 @@ smb2_downgrade_oplock(struct TCP_Server_ }static void +smb21_downgrade_oplock (struct TCP_Server_Info *server, +struct cifsInodeInfo *cinode,bool set_level2) +{ + server->ops->set_oplock_level (cinode, + set_level2 ?SMB2_LEASE_READ_CACHING_HE : +0 ,0 ,NULL ); +} + +static void smb2_set_oplock_level (struct cifsInodeInfo *cinode,__u32 oplock,unsigned int epoch,bool *purge_cache) {
@@ -3351,7 +3360,7 @@ struct smb_version_operations smb21_oper .print_stats = smb2_print_stats, .is_oplock_break = smb2_is_valid_oplock_break, .handle_cancelled_mid = smb2_handle_cancelled_mid, - .downgrade_oplock = smb2_downgrade_oplock, + .downgrade_oplock = smb21_downgrade_oplock, .need_neg = smb2_need_neg, .negotiate = smb2_negotiate, .negotiate_wsize = smb2_negotiate_wsize,
@@ -3447,7 +3456,7 @@ struct smb_version_operations smb30_oper .dump_share_caps = smb2_dump_share_caps, .is_oplock_break = smb2_is_valid_oplock_break, .handle_cancelled_mid = smb2_handle_cancelled_mid, - .downgrade_oplock = smb2_downgrade_oplock, + .downgrade_oplock = smb21_downgrade_oplock, .need_neg = smb2_need_neg, .negotiate = smb2_negotiate, .negotiate_wsize = smb2_negotiate_wsize,
@@ -3551,7 +3560,7 @@ struct smb_version_operations smb311_ope .dump_share_caps = smb2_dump_share_caps, .is_oplock_break = smb2_is_valid_oplock_break, .handle_cancelled_mid = smb2_handle_cancelled_mid, - .downgrade_oplock = smb2_downgrade_oplock, + .downgrade_oplock = smb21_downgrade_oplock, .need_neg = smb2_need_neg, .negotiate = smb2_negotiate, .negotiate_wsize = smb2_negotiate_wsize,
Greg Kroah-Hartman
maintainerPATCH 138/280 CIFS: Do not skip SMB2 message IDs on send failures
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit c781af7e0c1fed9f1d0e0ec31b86f5b21a8dca17 upstream.
When we hit failures during constructing MIDs or sending PDUs through the network, we end up not using message IDs assigned to the packet. The next SMB packet will skip those message IDs and continue with the next one. This behavior may lead to a server not granting us credits until we use the skipped IDs. Fix this by reverting the current ID to the original value if any errors occur before we push the packet through the network stack.
This patch fixes the generic/310 test from the xfs-tests.
--- fs/cifs/cifsglob.h | 19 +++++++++++++++++++ fs/cifs/smb2ops.c | 13 +++++++++++++ fs/cifs/smb2transport.c | 14 ++++++++++++-- fs/cifs/transport.c | 6 +++++- 4 files changed, 49 insertions(+), 3 deletions(-)
fs/cifs/cifsglob.h +19 -0
@@ -235,6 +235,8 @@ struct smb_version_operations {int * (*get_credits_field)(struct TCP_Server_Info *,const int );unsigned int (*get_credits)(struct mid_q_entry *);__u64 (*get_next_mid)(struct TCP_Server_Info *); +void (*revert_current_mid)(struct TCP_Server_Info *server, +const unsigned int val);/* data offset from read response message */ unsigned int (*read_data_offset)(char *);/*
@@ -756,6 +758,22 @@ get_next_mid(struct TCP_Server_Info *serreturn cpu_to_le16 (mid); } +static inline void +revert_current_mid (struct TCP_Server_Info *server,const unsigned int val) +{ +if (server->ops->revert_current_mid) + server->ops->revert_current_mid (server, val); +} + +static inline void +revert_current_mid_from_hdr (struct TCP_Server_Info *server, +const struct smb2_sync_hdr *shdr) +{ +unsigned int num =le16_to_cpu (shdr->CreditCharge); + +return revert_current_mid (server, num >0 ? num :1 ); +} +static inline __u16 get_mid (const struct smb_hdr *smb) {
@@ -1391,6 +1409,7 @@ struct mid_q_entry {struct kref refcount;struct TCP_Server_Info *server;/* server corresponding to this mid */ __u64 mid;/* multiplex id */ +__u16 credits;/* number of credits consumed by this mid */ __u32 pid;/* process id */ __u32 sequence_number;/* for CIFS signing */ unsigned long when_alloc;/* when mid was created */
fs/cifs/smb2ops.c +13 -0
@@ -204,6 +204,15 @@ smb2_get_next_mid(struct TCP_Server_Inforeturn mid; } +static void +smb2_revert_current_mid (struct TCP_Server_Info *server,const unsigned int val) +{ +spin_lock (&GlobalMid_Lock); +if (server->CurrentMid >= val) + server->CurrentMid -= val; +spin_unlock (&GlobalMid_Lock); +} +static struct mid_q_entry *smb2_find_mid (struct TCP_Server_Info *server,char *buf) {
@@ -3256,6 +3265,7 @@ struct smb_version_operations smb20_oper .get_credits = smb2_get_credits, .wait_mtu_credits = cifs_wait_mtu_credits, .get_next_mid = smb2_get_next_mid, + .revert_current_mid = smb2_revert_current_mid, .read_data_offset = smb2_read_data_offset, .read_data_length = smb2_read_data_length, .map_error = map_smb2_to_linux_error,
@@ -3350,6 +3360,7 @@ struct smb_version_operations smb21_oper .get_credits = smb2_get_credits, .wait_mtu_credits = smb2_wait_mtu_credits, .get_next_mid = smb2_get_next_mid, + .revert_current_mid = smb2_revert_current_mid, .read_data_offset = smb2_read_data_offset, .read_data_length = smb2_read_data_length, .map_error = map_smb2_to_linux_error,
@@ -3445,6 +3456,7 @@ struct smb_version_operations smb30_oper .get_credits = smb2_get_credits, .wait_mtu_credits = smb2_wait_mtu_credits, .get_next_mid = smb2_get_next_mid, + .revert_current_mid = smb2_revert_current_mid, .read_data_offset = smb2_read_data_offset, .read_data_length = smb2_read_data_length, .map_error = map_smb2_to_linux_error,
@@ -3549,6 +3561,7 @@ struct smb_version_operations smb311_ope .get_credits = smb2_get_credits, .wait_mtu_credits = smb2_wait_mtu_credits, .get_next_mid = smb2_get_next_mid, + .revert_current_mid = smb2_revert_current_mid, .read_data_offset = smb2_read_data_offset, .read_data_length = smb2_read_data_length, .map_error = map_smb2_to_linux_error,
fs/cifs/smb2transport.c +12 -2
@@ -576,6 +576,7 @@ smb2_mid_entry_alloc(const struct smb2_s struct TCP_Server_Info *server) {struct mid_q_entry *temp; +unsigned int credits =le16_to_cpu (shdr->CreditCharge);if (server ==NULL ) {cifs_dbg (VFS ,"Null TCP session in smb2_mid_entry_alloc\n" );
@@ -586,6 +587,7 @@ smb2_mid_entry_alloc(const struct smb2_smemset (temp,0 ,sizeof (struct mid_q_entry ));kref_init (&temp->refcount); temp->mid =le64_to_cpu (shdr->MessageId); + temp->credits = credits >0 ? credits :1 ; temp->pid = current->pid; temp->command = shdr->Command;/* Always LE */ temp->when_alloc = jiffies;
@@ -674,13 +676,18 @@ smb2_setup_request(struct cifs_ses *ses,smb2_seq_num_into_buf (ses->server, shdr); rc =smb2_get_mid_entry (ses, shdr, &mid); -if (rc) +if (rc) { +revert_current_mid_from_hdr (ses->server, shdr);return ERR_PTR (rc); + } + rc =smb2_sign_rqst (rqst, ses->server);if (rc) { +revert_current_mid_from_hdr (ses->server, shdr);cifs_delete_mid (mid);return ERR_PTR (rc); } +return mid; }
@@ -695,11 +702,14 @@ smb2_setup_async_request(struct TCP_Servsmb2_seq_num_into_buf (server, shdr); mid =smb2_mid_entry_alloc (shdr, server); -if (mid ==NULL ) +if (mid ==NULL ) { +revert_current_mid_from_hdr (server, shdr);return ERR_PTR (-ENOMEM ); + } rc =smb2_sign_rqst (rqst, server);if (rc) { +revert_current_mid_from_hdr (server, shdr);DeleteMidQEntry (mid);return ERR_PTR (rc); }
fs/cifs/transport.c +5 -1
@@ -638,6 +638,7 @@ cifs_call_async(struct TCP_Server_Info *cifs_in_send_dec (server);if (rc <0 ) { +revert_current_mid (server, mid->credits); server->sequence_number -=2 ;cifs_delete_mid (mid); }
@@ -842,6 +843,7 @@ compound_send_recv(const unsigned int xifor (i =0 ; i < num_rqst; i++) { midQ[i] = ses->server->ops->setup_request (ses, &rqst[i]);if (IS_ERR (midQ[i])) { +revert_current_mid (ses->server, i);for (j =0 ; j < i; j++)cifs_delete_mid (midQ[j]);mutex_unlock (&ses->server->srv_mutex);
@@ -867,8 +869,10 @@ compound_send_recv(const unsigned int xifor (i =0 ; i < num_rqst; i++)cifs_save_when_sent (midQ[i]); -if (rc <0 ) +if (rc <0 ) { +revert_current_mid (ses->server, num_rqst); ses->server->sequence_number -=2 ; + }mutex_unlock (&ses->server->srv_mutex);
Greg Kroah-Hartman
maintainerPATCH 139/280 CIFS: Fix read after write for files with read caching
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 6dfbd84684700cb58b34e8602c01c12f3d2595c8 upstream.
When we have a READ lease for a file and have just issued a write operation to the server we need to purge the cache and set oplock/lease level to NONE to avoid reading stale data. Currently we do that only if a write operation succedeed thus not covering cases when a request was sent to the server but a negative error code was returned later for some other reasons (e.g. -EIOCBQUEUED or -EINTR). Fix this by turning off caching regardless of the error code being returned.
The patches fixes generic tests 075 and 112 from the xfs-tests.
--- fs/cifs/file.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/cifs/file.c +7 -5
@@ -2871,14 +2871,16 @@ cifs_strict_writev(struct kiocb *iocb, s* these pages but not on the region from pos to ppos+len-1. */ written =cifs_user_writev (iocb, from); -if (written >0 &&CIFS_CACHE_READ (cinode)) { +if (CIFS_CACHE_READ (cinode)) {/* -* Windows 7 server can delay breaking level2 oplock if a write -* request comes - break it on the client to prevent reading -* an old data. +* We have read level caching and we have just sent a write +* request to the server thus making data in the cache stale. +* Zap the cache and set oplock/lease level to NONE to avoid +* reading stale data from the cache. All subsequent read +* operations will read new data from the server. */ cifs_zap_mapping (inode); -cifs_dbg (FYI ,"Set no oplock for inode=%p after a write operation\n" , +cifs_dbg (FYI ,"Set Oplock/Lease to NONE for inode=%p after write\n" , inode); cinode->oplock =0 ; }
Greg Kroah-Hartman
maintainerPATCH 140/280 tracing: Use strncpy instead of memcpy for string keys in hist triggers
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Zanussi <[email protected]>
commit 9f0bbf3115ca9f91f43b7c74e9ac7d79f47fc6c2 upstream.
Because there may be random garbage beyond a string's null terminator, it's not correct to copy the the complete character array for use as a hist trigger key. This results in multiple histogram entries for the 'same' string key.
So, in the case of a string key, use strncpy instead of memcpy to avoid copying in the extra bytes.
Before, using the gdbus entries in the following hist trigger as an example:
# echo 'hist:key=comm' > /sys/kernel/debug/tracing/events/sched/sched_waking/trigger # cat /sys/kernel/debug/tracing/events/sched/sched_waking/hist
...
{ comm: ImgDecoder #4 } hitcount: 203
{ comm: gmain } hitcount: 213
{ comm: gmain } hitcount: 216
{ comm: StreamTrans #73 } hitcount: 221
{ comm: mozStorage #3 } hitcount: 230
{ comm: gdbus } hitcount: 233
{ comm: StyleThread#5 } hitcount: 253
{ comm: gdbus } hitcount: 256
{ comm: gdbus } hitcount: 260
{ comm: StyleThread#4 } hitcount: 271...
# cat /sys/kernel/debug/tracing/events/sched/sched_waking/hist | egrep gdbus | wc -l 51
After:
# cat /sys/kernel/debug/tracing/events/sched/sched_waking/hist | egrep gdbus | wc -l 1
--- kernel/trace/trace_events_hist.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/trace/trace_events_hist.c +3 -2
@@ -4621,9 +4621,10 @@ static inline void add_to_key(char *comp/* ensure NULL-termination */ if (size > key_field->size -1 ) size = key_field->size -1 ; - } -memcpy (compound_key + key_field->offset, key, size); +strncpy (compound_key + key_field->offset, (char *)key, size); + }else +memcpy (compound_key + key_field->offset, key, size); } static void
Greg Kroah-Hartman
maintainerPATCH 141/280 tracing: Do not free iter->trace in fail path of tracing_open_pipe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhangyi (F) <[email protected]>
commit e7f0c424d0806b05d6f47be9f202b037eb701707 upstream.
Commit d716ff71dd12 ("tracing: Remove taking of trace_types_lock in pipe files") use the current tracer instead of the copy in tracing_open_pipe(), but it forget to remove the freeing sentence in the error path.
There's an error path that can call kfree(iter->trace) after the iter->trace was assigned to tr->current_trace, which would be bad to free.
--- kernel/trace/trace.c | 1 - 1 file changed, 1 deletion(-)
kernel/trace/trace.c +0 -1
@@ -5606,7 +5606,6 @@ out:return ret; fail: -kfree (iter->trace);kfree (iter);__trace_array_put (tr);mutex_unlock (&trace_types_lock);
Greg Kroah-Hartman
maintainerPATCH 142/280 tracing/perf: Use strndup_user() instead of buggy open-coded version
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 83540fbc8812a580b6ad8f93f4c29e62e417687e upstream.
The first version of this method was missing the check for ret == PATH_MAX; then such a check was added, but it didn't call kfree() on error, so there was still a small memory leak in the error case. Fix it by using strndup_user() instead of open-coding it.
--- kernel/trace/trace_event_perf.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
kernel/trace/trace_event_perf.c +7 -9
@@ -298,15 +298,13 @@ int perf_uprobe_init(struct perf_event *if (!p_event->attr.uprobe_path)return -EINVAL ; - path =kzalloc (PATH_MAX ,GFP_KERNEL ); -if (!path) -return -ENOMEM ; - ret =strncpy_from_user ( - path,u64_to_user_ptr (p_event->attr.uprobe_path),PATH_MAX ); -if (ret ==PATH_MAX ) -return -E2BIG ; -if (ret <0 ) - goto out; + + path =strndup_user (u64_to_user_ptr (p_event->attr.uprobe_path), +PATH_MAX ); +if (IS_ERR (path)) { + ret =PTR_ERR (path); +return (ret == -EINVAL ) ? -E2BIG : ret; + }if (path[0 ] =='\0' ) { ret = -EINVAL ; goto out;
Greg Kroah-Hartman
maintainerPATCH 143/280 xen: fix dom0 boot on huge systems
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
commit 01bd2ac2f55a1916d81dace12fa8d7ae1c79b5ea upstream.
Commit f7c90c2aa40048 ("x86/xen: don't write ptes directly in 32-bit PV guests") introduced a regression for booting dom0 on huge systems with lots of RAM (in the TB range).
Reason is that on those hosts the p2m list needs to be moved early in the boot process and this requires temporary page tables to be created. Said commit modified xen_set_pte_init() to use a hypercall for writing a PTE, but this requires the page table being in the direct mapped area, which is not the case for the temporary page tables used in xen_relocate_p2m().
As the page tables are completely written before being linked to the actual address space instead of set_pte() a plain write to memory can be used in xen_relocate_p2m().
--- arch/x86/xen/mmu_pv.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/x86/xen/mmu_pv.c +6 -7
@@ -2106,10 +2106,10 @@ void __init xen_relocate_p2m(void) pt =early_memremap (pt_phys,PAGE_SIZE );clear_page (pt);for (idx_pte =0 ; - idx_pte <min (n_pte,PTRS_PER_PTE ); - idx_pte++) { -set_pte (pt + idx_pte, -pfn_pte (p2m_pfn,PAGE_KERNEL )); + idx_pte <min (n_pte,PTRS_PER_PTE ); + idx_pte++) { + pt[idx_pte] =pfn_pte (p2m_pfn, +PAGE_KERNEL ); p2m_pfn++; } n_pte -=PTRS_PER_PTE ;
@@ -2117,8 +2117,7 @@ void __init xen_relocate_p2m(void)make_lowmem_page_readonly (__va (pt_phys));pin_pagetable_pfn (MMUEXT_PIN_L1_TABLE ,PFN_DOWN (pt_phys)); -set_pmd (pmd + idx_pt, -__pmd (_PAGE_TABLE | pt_phys)); + pmd[idx_pt] =__pmd (_PAGE_TABLE | pt_phys); pt_phys +=PAGE_SIZE ; } n_pt -=PTRS_PER_PMD ;
@@ -2126,7 +2125,7 @@ void __init xen_relocate_p2m(void)make_lowmem_page_readonly (__va (pmd_phys));pin_pagetable_pfn (MMUEXT_PIN_L2_TABLE ,PFN_DOWN (pmd_phys)); -set_pud (pud + idx_pmd,__pud (_PAGE_TABLE | pmd_phys)); + pud[idx_pmd] =__pud (_PAGE_TABLE | pmd_phys); pmd_phys +=PAGE_SIZE ; } n_pmd -=PTRS_PER_PUD ;
Greg Kroah-Hartman
maintainerPATCH 144/280 ACPI / device_sysfs: Avoid OF modalias creation for removed device
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit f16eb8a4b096514ac06fb25bf599dcc792899b3d upstream.
If SSDT overlay is loaded via ConfigFS and then unloaded the device, we would like to have OF modalias for, already gone. Thus, acpi_get_name() returns no allocated buffer for such case and kernel crashes afterwards:
ACPI: Host-directed Dynamic ACPI Table Unload ads7950 spi-PRP0001:00: Dropping the link to regulator.0
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 #PF error: [normal kernel read fault] PGD 80000000070d6067 P4D 80000000070d6067 PUD 70d0067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 40 Comm: kworker/u4:2 Not tainted 5.0.0+ #96 Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48 Workqueue: kacpi_hotplug acpi_device_del_work_fn RIP: 0010:create_of_modalias.isra.1+0x4c/0x150 Code: 00 00 48 89 44 24 18 31 c0 48 8d 54 24 08 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 ff ff ff ff e8 7a b0 03 00 48 8b 4c 24 10 <0f> b6 01 84 c0 74 27 48 c7 c7 00 09 f4 a5 0f b6 f0 8d 50 20 f6 04 RSP: 0000:ffffa51040297c10 EFLAGS: 00010246 RAX: 0000000000001001 RBX: 0000000000000785 RCX: 0000000000000000 RDX: 0000000000001001 RSI: 0000000000000286 RDI: ffffa2163dc042e0 RBP: ffffa216062b1196 R08: 0000000000001001 R09: ffffa21639873000 R10: ffffffffa606761d R11: 0000000000000001 R12: ffffa21639873218 R13: ffffa2163deb5060 R14: ffffa216063d1010 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa2163e000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000007114000 CR4: 00000000001006f0 Call Trace: __acpi_device_uevent_modalias+0xb0/0x100 spi_uevent+0xd/0x40
...
In order to fix above let create_of_modalias() check the status returned by acpi_get_name() and bail out in case of failure.
--- drivers/acpi/device_sysfs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/acpi/device_sysfs.c +5 -1
@@ -202,11 +202,15 @@ static int create_of_modalias(struct acp {struct acpi_buffer buf = {ACPI_ALLOCATE_BUFFER };const union acpi_object *of_compatible, *obj; +acpi_status status;int len, count;int i, nval;char *c; -acpi_get_name (acpi_dev->handle,ACPI_SINGLE_NAME , &buf); + status =acpi_get_name (acpi_dev->handle,ACPI_SINGLE_NAME , &buf); +if (ACPI_FAILURE (status)) +return -ENODEV ; +/* DT strings are all in lower case */ for (c = buf.pointer; *c !='\0' ; c++) *c =tolower (*c);
Greg Kroah-Hartman
maintainerPATCH 145/280 mmc: sdhci-esdhc-imx: fix HS400 timing issue
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: BOUGH CHEN <[email protected]>
commit de0a0decf2edfc5b0c782915f4120cf990a9bd13 upstream.
Now tuning reset will be done when the timing is MMC_TIMING_LEGACY/ MMC_TIMING_MMC_HS/MMC_TIMING_SD_HS. But for timing MMC_TIMING_MMC_HS, we can not do tuning reset, otherwise HS400 timing is not right.
Here is the process of init HS400, first finish tuning in HS200 mode, then switch to HS mode and 8 bit DDR mode, finally switch to HS400 mode. If we do tuning reset in HS mode, this will cause HS400 mode lost the tuning setting, which will cause CRC error.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/sdhci-esdhc-imx.c +1 -0
@@ -981,6 +981,7 @@ static void esdhc_set_uhs_signaling(strucase MMC_TIMING_UHS_SDR25 :case MMC_TIMING_UHS_SDR50 :case MMC_TIMING_UHS_SDR104 : +case MMC_TIMING_MMC_HS :case MMC_TIMING_MMC_HS200 :writel (m, host->ioaddr +ESDHC_MIX_CTRL );break ;
Greg Kroah-Hartman
maintainerPATCH 146/280 mmc:fix a bug when max_discard is 0
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiong Wu <[email protected]>
commit d4721339dcca7def04909a8e60da43c19a24d8bf upstream.
The original purpose of the code I fix is to replace max_discard with max_trim if max_trim is less than max_discard. When max_discard is 0 we should replace max_discard with max_trim as well, because max_discard equals 0 happens only when the max_do_calc_max_discard process is overflowed, so if mmc_can_trim(card) is true, max_discard should be replaced by an available max_trim.
However, in the original code, there are two lines of code interfere the right process.
1) if (max_discard && mmc_can_trim(card))
when max_discard is 0, it skips the process checking if max_discard needs to be replaced with max_trim.
2) if (max_trim < max_discard)
the condition is false when max_discard is 0. it also skips the process that replaces max_discard with max_trim, in fact, we should replace the 0-valued max_discard with max_trim.
--- drivers/mmc/core/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/core/core.c +2 -2
@@ -2378,9 +2378,9 @@ unsigned int mmc_calc_max_discard(structreturn card->pref_erase; max_discard =mmc_do_calc_max_discard (card,MMC_ERASE_ARG ); -if (max_discard &&mmc_can_trim (card)) { +if (mmc_can_trim (card)) { max_trim =mmc_do_calc_max_discard (card,MMC_TRIM_ARG ); -if (max_trim < max_discard) +if (max_trim < max_discard || max_discard ==0 ) max_discard = max_trim; }else if (max_discard < card->erase_size) { max_discard =0 ;