4.14.111-stable review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 4.14.111-stable review
This is the start of the stable review cycle for the 4.14.111 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Apr 6 08:44:23 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.111-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.111-rc1
Hans de Goede <[email protected]>
ACPI / video: Extend chassis-type detection with a "Lunch Box" check
Ville Syrjälä <[email protected]>
drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
Ben Dooks <[email protected]>
dmaengine: tegra: avoid overflow of byte tracking
Katsuhiro Suzuki <[email protected]>
clk: rockchip: fix frac settings of GPLL clock for rk3328
Rafael Ávila de Espíndola <[email protected]>
x86/build: Mark per-CPU symbols as absolute explicitly for LLD
Zumeng Chen <[email protected]>
wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
Ondrej Mosnacek <[email protected]>
selinux: do not override context on context mounts
George Rimar <[email protected]>
x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
Daniel Vetter <[email protected]>
drm/nouveau: Stop using drm_crtc_force_disable
Paul Kocialkowski <[email protected]>
drm: Auto-set allow_fb_modifiers when given modifiers at plane init
Axel Lin <[email protected]>
regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
Pawe? Chmiel <[email protected]>
media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
Florian Westphal <[email protected]>
netfilter: physdev: relax br_netfilter dependency
Shunyong Yang <[email protected]>
dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_*
Shunyong Yang <[email protected]>
dmaengine: qcom_hidma: assign channel cookie correctly
Anders Roxell <[email protected]>
dmaengine: imx-dma: fix warning comparison of distinct pointer types
Valentin Schneider <[email protected]>
cpu/hotplug: Mute hotplug lockdep during init
Buland Singh <[email protected]>
hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
Song Hongyan <[email protected]>
HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit
Timo Alho <[email protected]>
soc/tegra: fuse: Fix illegal free of IO base address
David Tolnay <[email protected]>
hwrng: virtio - Avoid repeated init of completion
Akinobu Mita <[email protected]>
media: mt9m111: set initial frame size other than 0x0
Roger Quadros <[email protected]>
usb: dwc3: gadget: Fix OTG events when gadget driver isn't loaded
Nathan Fontenot <[email protected]>
powerpc/pseries: Perform full re-add of CPU for topology update post-migration
Manfred Schlaegl <[email protected]>
tty: increase the default flip buffer limit to 2*640K
Chen-Yu Tsai <[email protected]>
backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state
Oleg Nesterov <[email protected]>
cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix the accounting
Valdis Kletnieks <[email protected]>
bpf: fix missing prototype warnings
Russell King <[email protected]>
ARM: avoid Cortex-A9 livelock on tight dmb loops
Vladimir Murzin <[email protected]>
ARM: 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of
Stanislaw Gruszka <[email protected]>
mt7601u: bump supported EEPROM version
Alexey Khoroshilov <[email protected]>
soc: qcom: gsbi: Fix error handling in gsbi_probe()
Ard Biesheuvel <[email protected]>
efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted
Mathieu Malaterre <[email protected]>
ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation
Ard Biesheuvel <[email protected]>
efi/memattr: Don't bail on zero VA if it equals the region's PA
Hidetoshi Seto <[email protected]>
sched/debug: Initialize sd_sysctl_cpus if !CONFIG_CPUMASK_OFFSTACK
wen yang <[email protected]>
ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
Rajneesh Bhardwaj <[email protected]>
platform/x86: intel_pmc_core: Fix PCH IP sts reading
Konstantin Khlebnikov <[email protected]>
e1000e: fix cyclic resets at link up with active tx
Guenter Roeck <[email protected]>
cdrom: Fix race condition in cdrom_sysctl_register
Manfred Schlaegl <[email protected]>
fbdev: fbmem: fix memory access if logo is bigger than the screen
Raju Rangoju <[email protected]>
iw_cxgb4: fix srqidx leak during connection abort
Thomas Gleixner <[email protected]>
genirq: Avoid summation loops for /proc/stat
Coly Li <[email protected]>
bcache: improve sysfs_strtoul_clamp()
Coly Li <[email protected]>
bcache: fix input overflow to sequential_cutoff
Coly Li <[email protected]>
bcache: fix input overflow to cache set sysfs file io_error_halflife
Luc Van Oostenryck <[email protected]>
sched/topology: Fix percpu data types in struct sd_data & struct s_data
John Stultz <[email protected]>
usb: f_fs: Avoid crash due to out-of-scope stack ptr access
Ranjani Sridharan <[email protected]>
ALSA: PCM: check if ops are defined before suspending PCM
Nathan Chancellor <[email protected]>
ARM: 8833/1: Ensure that NEON code always compiles with Clang
Chieh-Min Wang <[email protected]>
netfilter: conntrack: fix cloned unconfirmed skb->_nfct race in __nf_conntrack_confirm
Andrea Righi <[email protected]>
kprobes: Prohibit probing on bsearch()
Hans de Goede <[email protected]>
ACPI / video: Refactor and fix dmi_is_desktop()
Sara Sharon <[email protected]>
iwlwifi: pcie: fix emergency path
Michal Kazior <[email protected]>
leds: lp55xx: fix null deref on firmware load failure
Theodore Ts'o <[email protected]>
jbd2: fix race when writing superblock
Hong Liu <[email protected]>
HID: intel-ish-hid: avoid binding wrong ishtp_cl_device
Aurelien Jarno <[email protected]>
vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1
Ezequiel Garcia <[email protected]>
media: mtk-jpeg: Correct return type for mem2mem buffer helpers
Ezequiel Garcia <[email protected]>
media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
Ezequiel Garcia <[email protected]>
media: s5p-g2d: Correct return type for mem2mem buffer helpers
Ezequiel Garcia <[email protected]>
media: s5p-jpeg: Correct return type for mem2mem buffer helpers
Ezequiel Garcia <[email protected]>
media: sh_veu: Correct return type for mem2mem buffer helpers
Wen Yang <[email protected]>
SoC: imx-sgtl5000: add missing put_device()
Thomas Richter <[email protected]>
perf test: Fix failure of 'evsel-tp-sched' test on s390
Sedat Dilek <[email protected]>
scsi: fcoe: make use of fip_mode enum complete
Jason Yan <[email protected]>
scsi: megaraid_sas: return error when create DMA pool failed
Ross Lagerwall <[email protected]>
efi: cper: Fix possible out-of-bounds access
Erwan Velu <[email protected]>
cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies
Katsuhiro Suzuki <[email protected]>
clk: fractional-divider: check parent rate only if flag is set
Håkon Bugge <[email protected]>
IB/mlx4: Increase the timeout for CM cache
Florian Fainelli <[email protected]>
mlxsw: spectrum: Avoid -Wformat-truncation warnings
Florian Fainelli <[email protected]>
e1000e: Fix -Wformat-truncation warnings
Aaro Koskinen <[email protected]>
mmc: omap: fix the maximum timeout setting
Aneesh Kumar K.V <[email protected]>
powerpc/hugetlb: Handle mmap_min_addr correctly in get_unmapped_area callback
Nicolas Boichat <[email protected]>
iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables
Sebastian Andrzej Siewior <[email protected]>
ARM: 8840/1: use a raw_spinlock_t in unwind
Lubomir Rintel <[email protected]>
serial: 8250_pxa: honor the port number from devicetree
Sai Prakash Ranjan <[email protected]>
coresight: etm4x: Add support to enable ETMv4.2
Nathan Chancellor <[email protected]>
powerpc/xmon: Fix opcode being uninitialized in print_insn_powerpc
Benjamin Block <[email protected]>
scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
Paul Kocialkowski <[email protected]>
usb: chipidea: Grab the (legacy) USB PHY by phandle first
Eric Biggers <[email protected]>
crypto: cavium/zip - fix collision with generic cra_driver_name
Julia Lawall <[email protected]>
crypto: crypto4xx - add missing of_node_put after of_device_is_available
Alexei Avshalom Lazar <[email protected]>
wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
Rafael J. Wysocki <[email protected]>
PCI/PME: Fix hotplug/sysfs remove deadlock in pcie_pme_remove()
Tony Jones <[email protected]>
tools lib traceevent: Fix buffer overflow in arg_eval
Carlos Maiolino <[email protected]>
fs: fix guard_bio_eod to check for real EOD errors
luojiajun <[email protected]>
jbd2: fix invalid descriptor block checksum
Slavomir Kaslev <[email protected]>
fs: Make splice() and tee() take into account O_NONBLOCK flag on pipes
Yao Liu <[email protected]>
cifs: Fix NULL pointer dereference of devname
Jason Cai (Xiang Feng) <[email protected]>
dm thin: add sanity checks to thin-pool and external snapshot creation
Louis Taylor <[email protected]>
cifs: use correct format characters
Qian Cai <[email protected]>
page_poison: play nicely with KASAN
Shuriyc Chu <[email protected]>
fs/file.c: initialize init_files.resize_wait
Sahitya Tummala <[email protected]>
f2fs: do not use mutex lock in atomic context
Jia Guo <[email protected]>
ocfs2: fix a panic problem caused by o2cb_ctl
Qian Cai <[email protected]>
mm/slab.c: kmemleak no scan alien caches
Uladzislau Rezki (Sony) <[email protected]>
mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
Vlastimil Babka <[email protected]>
mm, mempolicy: fix uninit memory access
Qian Cai <[email protected]>
mm/page_ext.c: fix an imbalance with kmemleak
Peng Fan <[email protected]>
mm/cma.c: cma_declare_contiguous: correct err handling
Jiri Olsa <[email protected]>
perf c2c: Fix c2c report for empty numa node
Linus Torvalds <[email protected]>
iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver
John Garry <[email protected]>
scsi: hisi_sas: Set PHY linkrate when disconnected
Arnd Bergmann <[email protected]>
enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
Christian Brauner <[email protected]>
sysctl: handle overflow for file-max
Luc Van Oostenryck <[email protected]>
include/linux/relay.h: fix percpu annotation in struct rchan
Russell King <[email protected]>
gpio: gpio-omap: fix level interrupt idling
Tonghao Zhang <[email protected]>
net/mlx5: Avoid panic when setting vport mac, getting vport config
Tonghao Zhang <[email protected]>
net/mlx5: Avoid panic when setting vport rate
Douglas Anderson <[email protected]>
tracing: kdb: Fix ftdump to not sleep
Chao Yu <[email protected]>
f2fs: fix to avoid deadlock in f2fs_read_inline_dir()
Masahiro Yamada <[email protected]>
h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
Aurelien Aptel <[email protected]>
CIFS: fix POSIX lock leak and invalid ptr deref
Yang Shi <[email protected]>
mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
Razvan Stefanescu <[email protected]>
tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
Razvan Stefanescu <[email protected]>
tty/serial: atmel: Add is_half_duplex helper
Peter Zijlstra <[email protected]>
lib/int_sqrt: optimize initial value compute
zhangyi (F) <[email protected]>
ext4: cleanup bh release code in ext4_ind_remove_space()
Will Deacon <[email protected]>
arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
-------------
Diffstat:
Documentation/arm/kernel_mode_neon.txt | 4 +- Makefile | 4 +- arch/arm/boot/dts/lpc32xx.dtsi | 18 +++---- arch/arm/include/asm/barrier.h | 2 + arch/arm/include/asm/processor.h | 6 ++- arch/arm/include/asm/v7m.h | 2 +- arch/arm/kernel/entry-header.S | 3 +- arch/arm/kernel/entry-v7m.S | 4 ++ arch/arm/kernel/machine_kexec.c | 5 +- arch/arm/kernel/smp.c | 4 +- arch/arm/kernel/unwind.c | 14 +++--- arch/arm/lib/Makefile | 2 +- arch/arm/lib/xor-neon.c | 2 +- arch/arm/mach-omap2/prm_common.c | 4 +- arch/arm/mm/proc-v7m.S | 3 ++ arch/arm64/mm/fault.c | 11 +++-- arch/h8300/Makefile | 2 +- arch/powerpc/include/asm/topology.h | 2 + arch/powerpc/mm/hugetlbpage-radix.c | 5 +- arch/powerpc/mm/numa.c | 9 +--- arch/powerpc/platforms/pseries/hotplug-cpu.c | 19 ++++++++ arch/powerpc/xmon/ppc-dis.c | 2 +- arch/x86/boot/Makefile | 2 +- arch/x86/kernel/vmlinux.lds.S | 2 +- arch/x86/realmode/rm/Makefile | 2 +- drivers/acpi/acpi_video.c | 20 +++++--- drivers/cdrom/cdrom.c | 7 ++- drivers/char/hpet.c | 2 +- drivers/char/hw_random/virtio-rng.c | 2 +- drivers/clk/clk-fractional-divider.c | 2 +- drivers/clk/rockchip/clk-rk3328.c | 12 ++--- drivers/cpufreq/acpi-cpufreq.c | 4 +- drivers/crypto/amcc/crypto4xx_trng.c | 4 +- drivers/crypto/cavium/zip/zip_main.c | 6 ++- drivers/dma/imx-dma.c | 2 +- drivers/dma/qcom/hidma.c | 19 ++++---- drivers/dma/tegra20-apb-dma.c | 5 +- drivers/firmware/efi/cper.c | 13 ++++-- drivers/firmware/efi/libstub/arm-stub.c | 5 ++ drivers/firmware/efi/libstub/efi-stub-helper.c | 10 ++++ drivers/firmware/efi/libstub/efistub.h | 1 + drivers/firmware/efi/libstub/fdt.c | 3 ++ drivers/firmware/efi/memattr.c | 2 +- drivers/gpio/gpio-omap.c | 14 +++--- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + drivers/gpu/drm/drm_plane.c | 3 ++ drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 4 +- drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++-- drivers/hid/intel-ish-hid/ishtp/bus.c | 4 +- drivers/hwtracing/coresight/coresight-etm4x.c | 3 +- drivers/iio/adc/qcom-pm8xxx-xoadc.c | 10 ++-- drivers/infiniband/hw/cxgb4/cm.c | 5 +- drivers/infiniband/hw/mlx4/cm.c | 2 +- drivers/iommu/io-pgtable-arm-v7s.c | 3 +- drivers/leds/leds-lp55xx-common.c | 4 +- drivers/md/bcache/sysfs.c | 17 +++++-- drivers/md/bcache/sysfs.h | 13 ++++-- drivers/md/dm-thin.c | 13 ++++++ drivers/media/i2c/mt9m111.c | 2 + drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 40 ++++++++-------- drivers/media/platform/mx2_emmaprp.c | 6 +-- drivers/media/platform/s5p-g2d/g2d.c | 6 +-- drivers/media/platform/s5p-jpeg/jpeg-core.c | 57 ++++++++++++----------- drivers/media/platform/sh_veu.c | 4 +- drivers/mmc/host/omap.c | 2 +- drivers/net/ethernet/cisco/enic/enic_main.c | 6 +-- drivers/net/ethernet/intel/e1000e/netdev.c | 19 ++++---- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 17 ++++--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 4 +- drivers/net/wireless/ath/wil6210/cfg80211.c | 14 ++++-- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 11 +++-- drivers/net/wireless/mediatek/mt7601u/eeprom.h | 2 +- drivers/net/wireless/ti/wlcore/main.c | 7 ++- drivers/pci/pcie/pme.c | 22 ++++++--- drivers/platform/x86/intel_pmc_core.c | 3 +- drivers/platform/x86/intel_pmc_core.h | 2 +- drivers/regulator/act8865-regulator.c | 5 +- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +- drivers/scsi/fcoe/fcoe.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 7 ++- drivers/scsi/fcoe/fcoe_transport.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 10 ++++ drivers/scsi/megaraid/megaraid_sas_base.c | 1 + drivers/scsi/qedf/qedf_main.c | 2 +- drivers/scsi/scsi_scan.c | 6 +-- drivers/soc/qcom/qcom_gsbi.c | 7 ++- drivers/soc/tegra/fuse/fuse-tegra.c | 12 +++-- drivers/tty/serial/8250/8250_pxa.c | 4 ++ drivers/tty/serial/atmel_serial.c | 43 ++++++++++++----- drivers/tty/tty_buffer.c | 2 +- drivers/usb/chipidea/core.c | 9 +++- drivers/usb/dwc3/gadget.c | 2 + drivers/usb/gadget/function/f_fs.c | 1 + drivers/video/backlight/pwm_bl.c | 2 +- drivers/video/fbdev/core/fbmem.c | 3 ++ fs/buffer.c | 7 +++ fs/cifs/cifs_dfs_ref.c | 4 +- fs/cifs/connect.c | 5 ++ fs/cifs/file.c | 14 +++++- fs/cifs/smb1ops.c | 2 +- fs/ext4/indirect.c | 47 +++++++++---------- fs/f2fs/inline.c | 8 +++- fs/f2fs/trace.c | 8 +++- fs/file.c | 1 + fs/jbd2/commit.c | 6 ++- fs/jbd2/journal.c | 52 +++++++++++---------- fs/ocfs2/cluster/nodemanager.c | 14 +++--- fs/read_write.c | 6 +++ fs/splice.c | 12 +++++ include/linux/cgroup-defs.h | 2 +- include/linux/cgroup.h | 2 + include/linux/clk-provider.h | 3 ++ include/linux/filter.h | 4 +- include/linux/irqdesc.h | 1 + include/linux/relay.h | 2 +- include/linux/ring_buffer.h | 2 +- include/linux/sched/topology.h | 8 ++-- include/net/netfilter/br_netfilter.h | 1 - include/scsi/libfcoe.h | 4 +- kernel/cgroup/cgroup.c | 15 +++--- kernel/cgroup/pids.c | 4 +- kernel/cpu.c | 9 ++++ kernel/exit.c | 1 + kernel/irq/chip.c | 12 ++++- kernel/irq/internals.h | 8 +++- kernel/irq/irqdesc.c | 7 ++- kernel/sched/debug.c | 4 ++ kernel/sched/topology.c | 2 +- kernel/sysctl.c | 3 ++ kernel/trace/ring_buffer.c | 5 +- kernel/trace/trace.c | 6 ++- kernel/trace/trace_kdb.c | 6 ++- lib/bsearch.c | 2 + lib/int_sqrt.c | 6 +-- lib/raid6/Makefile | 2 +- mm/cma.c | 4 +- mm/mempolicy.c | 42 +++++++++++++---- mm/page_alloc.c | 2 +- mm/page_ext.c | 1 + mm/page_poison.c | 4 ++ mm/slab.c | 17 +++---- mm/vmalloc.c | 6 ++- net/bridge/br_netfilter_hooks.c | 5 -- net/netfilter/nf_conntrack_core.c | 14 ++++-- net/netfilter/xt_physdev.c | 9 +++- security/selinux/hooks.c | 9 +++- sound/core/pcm_native.c | 8 ++++ sound/soc/fsl/fsl-asoc-card.c | 1 + sound/soc/fsl/imx-sgtl5000.c | 1 + tools/lib/traceevent/event-parse.c | 2 +- tools/perf/builtin-c2c.c | 8 +++- tools/perf/tests/evsel-tp-sched.c | 6 +-- 152 files changed, 771 insertions(+), 378 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/121 arm64: debug: Dont propagate UNKNOWN FAR into si_code for debug signals
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit b9a4b9d084d978f80eb9210727c81804588b42ff upstream.
FAR_EL1 is UNKNOWN for all debug exceptions other than those caused by taking a hardware watchpoint. Unfortunately, if a debug handler returns a non-zero value, then we will propagate the UNKNOWN FAR value to userspace via the si_addr field of the SIGTRAP siginfo_t.
Instead, let's set si_addr to take on the PC of the faulting instruction, which we have available in the current pt_regs.
--- arch/arm64/mm/fault.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/arm64/mm/fault.c +6 -5
@@ -834,11 +834,12 @@ void __init hook_debug_fault_code(int nr debug_fault_info[nr].name = name; } -asmlinkage int __exception do_debug_exception(unsigned long addr, +asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint,unsigned int esr,struct pt_regs *regs) {const struct fault_info *inf = debug_fault_info +DBG_ESR_EVT (esr); +unsigned long pc =instruction_pointer (regs);struct siginfo info;int rv;
@@ -849,19 +850,19 @@ asmlinkage int __exception do_debug_exceif (interrupts_enabled (regs))trace_hardirqs_off (); -if (user_mode (regs) &&instruction_pointer (regs) >TASK_SIZE ) +if (user_mode (regs) && pc >TASK_SIZE )arm64_apply_bp_hardening (); -if (!inf->fn (addr, esr, regs)) { +if (!inf->fn (addr_if_watchpoint, esr, regs)) { rv =1 ; }else {pr_alert ("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n" , - inf->name, esr, addr); + inf->name, esr, pc); info.si_signo = inf->sig; info.si_errno =0 ; info.si_code = inf->code; - info.si_addr = (void __user *)addr; + info.si_addr = (void __user *)pc;arm64_notify_die ("" , regs, &info,0 ); rv =0 ; }
Greg Kroah-Hartman
maintainerPATCH 2/121 ext4: cleanup bh release code in ext4_ind_remove_space()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhangyi (F) <[email protected]>
commit 5e86bdda41534e17621d5a071b294943cae4376e upstream.
Currently, we are releasing the indirect buffer where we are done with it in ext4_ind_remove_space(), so we can see the brelse() and BUFFER_TRACE() everywhere. It seems fragile and hard to read, and we may probably forget to release the buffer some day. This patch cleans up the code by putting of the code which releases the buffers to the end of the function.
--- fs/ext4/indirect.c | 47 ++++++++++++++++++++++------------------------- 1 file changed, 22 insertions(+), 25 deletions(-)
fs/ext4/indirect.c +22 -25
@@ -1219,6 +1219,7 @@ int ext4_ind_remove_space(handle_t *handext4_lblk_t offsets[4 ], offsets2[4 ];Indirect chain[4 ], chain2[4 ];Indirect *partial, *partial2; +Indirect *p =NULL , *p2 =NULL ;ext4_lblk_t max_block;__le32 nr =0 , nr2 =0 ;int n =0 , n2 =0 ;
@@ -1260,7 +1261,7 @@ int ext4_ind_remove_space(handle_t *hand } - partial =ext4_find_shared (inode, n, offsets, chain, &nr); + partial = p =ext4_find_shared (inode, n, offsets, chain, &nr);if (nr) {if (partial == chain) {/* Shared branch grows from the inode */
@@ -1285,13 +1286,11 @@ int ext4_ind_remove_space(handle_t *hand partial->p +1 , (__le32 *)partial->bh->b_data+addr_per_block, (chain+n-1) - partial); -BUFFER_TRACE (partial->bh,"call brelse" ); -brelse (partial->bh); partial--; } end_range: - partial2 =ext4_find_shared (inode, n2, offsets2, chain2, &nr2); + partial2 = p2 =ext4_find_shared (inode, n2, offsets2, chain2, &nr2);if (nr2) {if (partial2 == chain2) {/*
@@ -1321,16 +1320,14 @@ end_range: (__le32 *)partial2->bh->b_data, partial2->p, (chain2+n2-1) - partial2); -BUFFER_TRACE (partial2->bh,"call brelse" ); -brelse (partial2->bh); partial2--; } goto do_indirects; }/* Punch happened within the same level (n == n2) */ - partial =ext4_find_shared (inode, n, offsets, chain, &nr); - partial2 =ext4_find_shared (inode, n2, offsets2, chain2, &nr2); + partial = p =ext4_find_shared (inode, n, offsets, chain, &nr); + partial2 = p2 =ext4_find_shared (inode, n2, offsets2, chain2, &nr2);/* Free top, but only if partial2 isn't its subtree. */ if (nr) {
@@ -1387,15 +1384,7 @@ end_range: partial->p +1 , partial2->p, (chain+n-1) - partial); -while (partial > chain) { -BUFFER_TRACE (partial->bh,"call brelse" ); -brelse (partial->bh); - } -while (partial2 > chain2) { -BUFFER_TRACE (partial2->bh,"call brelse" ); -brelse (partial2->bh); - } -return 0 ; + goto cleanup; }/*
@@ -1410,8 +1399,6 @@ end_range: partial->p +1 , (__le32 *)partial->bh->b_data+addr_per_block, (chain+n-1) - partial); -BUFFER_TRACE (partial->bh,"call brelse" ); -brelse (partial->bh); partial--; }if (partial2 > chain2 && depth2 <= depth) {
@@ -1419,11 +1406,21 @@ end_range: (__le32 *)partial2->bh->b_data, partial2->p, (chain2+n2-1) - partial2); -BUFFER_TRACE (partial2->bh,"call brelse" ); -brelse (partial2->bh); partial2--; } } + +cleanup: +while (p && p > chain) { +BUFFER_TRACE (p->bh,"call brelse" ); +brelse (p->bh); + p--; + } +while (p2 && p2 > chain2) { +BUFFER_TRACE (p2->bh,"call brelse" ); +brelse (p2->bh); + p2--; + }return 0 ; do_indirects:
@@ -1431,7 +1428,7 @@ do_indirects:switch (offsets[0 ]) {default :if (++n >= n2) -return 0 ; +break ; nr = i_data[EXT4_IND_BLOCK ];if (nr) {ext4_free_branches (handle, inode,NULL , &nr, &nr+1 ,1 );
@@ -1439,7 +1436,7 @@ do_indirects: }case EXT4_IND_BLOCK :if (++n >= n2) -return 0 ; +break ; nr = i_data[EXT4_DIND_BLOCK ];if (nr) {ext4_free_branches (handle, inode,NULL , &nr, &nr+1 ,2 );
@@ -1447,7 +1444,7 @@ do_indirects: }case EXT4_DIND_BLOCK :if (++n >= n2) -return 0 ; +break ; nr = i_data[EXT4_TIND_BLOCK ];if (nr) {ext4_free_branches (handle, inode,NULL , &nr, &nr+1 ,3 );
@@ -1456,5 +1453,5 @@ do_indirects:case EXT4_TIND_BLOCK : ; } -return 0 ; + goto cleanup; }
Greg Kroah-Hartman
maintainerPATCH 3/121 lib/int_sqrt: optimize initial value compute
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit f8ae107eef209bff29a5816bc1aad40d5cd69a80 upstream.
The initial value (@m) compute is:
m = 1UL << (BITS_PER_LONG - 2); while (m > x) m >>= 2;
Which is a linear search for the highest even bit smaller or equal to @x We can implement this using a binary search using __fls() (or better when its hardware implemented).
m = 1UL << (__fls(x) & ~1UL);
Especially for small values of @x; which are the more common arguments when doing a CDF on idle times; the linear search is near to worst case, while the binary search of __fls() is a constant 6 (or 5 on 32bit) branches.
cycles: branches: branch-misses:
PRE:
hot: 43.633557 +- 0.034373 45.333132 +- 0.002277 0.023529 +- 0.000681
cold: 207.438411 +- 0.125840 45.333132 +- 0.002277 6.976486 +- 0.004219
SOFTWARE FLS:
hot: 29.576176 +- 0.028850 26.666730 +- 0.004511 0.019463 +- 0.000663
cold: 165.947136 +- 0.188406 26.666746 +- 0.004511 6.133897 +- 0.004386
HARDWARE FLS:
hot: 24.720922 +- 0.025161 20.666784 +- 0.004509 0.020836 +- 0.000677
cold: 132.777197 +- 0.127471 20.666776 +- 0.004509 5.080285 +- 0.003874
Averages computed over all values <128k using a LFSR to generate order. Cold numbers have a LFSR based branch trace buffer 'confuser' ran between each int_sqrt() invocation.
--- lib/int_sqrt.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
lib/int_sqrt.c +2 -4
@@ -8,6 +8,7 @@#include <linux/kernel.h> #include <linux/export.h> +#include <linux/bitops.h> /** * int_sqrt - rough approximation to sqrt
@@ -22,10 +23,7 @@ unsigned long int_sqrt(unsigned long x)if (x <=1 )return x; - m =1UL << (BITS_PER_LONG -2 ); -while (m > x) - m >>=2 ; - + m =1UL << (__fls (x) & ~1UL );while (m !=0 ) { b = y + m; y >>=1 ;
Greg Kroah-Hartman
maintainerPATCH 4/121 tty/serial: atmel: Add is_half_duplex helper
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Razvan Stefanescu <[email protected]>
commit f3040983132bf3477acd45d2452a906e67c2fec9 upstream.
Use a helper function to check that a port needs to use half duplex communication, replacing several occurrences of multi-line bit checking.
--- drivers/tty/serial/atmel_serial.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/tty/serial/atmel_serial.c +11 -8
@@ -238,6 +238,12 @@ static inline void atmel_uart_write_char__raw_writeb (value, port->membase +ATMEL_US_THR ); } +static inline int atmel_uart_is_half_duplex (struct uart_port *port) +{ +return (port->rs485.flags &SER_RS485_ENABLED ) && + !(port->rs485.flags &SER_RS485_RX_DURING_TX ); +} +#ifdef CONFIG_SERIAL_ATMEL_PDC static bool atmel_use_pdc_rx (struct uart_port *port) {
@@ -489,9 +495,9 @@ static void atmel_stop_tx(struct uart_po/* Disable interrupts */ atmel_uart_writel (port,ATMEL_US_IDR , atmel_port->tx_done_mask); -if ((port->rs485.flags &SER_RS485_ENABLED ) && - !(port->rs485.flags &SER_RS485_RX_DURING_TX )) +if (atmel_uart_is_half_duplex (port))atmel_start_rx (port); + }/*
@@ -508,8 +514,7 @@ static void atmel_start_tx(struct uart_preturn ;if (atmel_use_pdc_tx (port) ||atmel_use_dma_tx (port)) -if ((port->rs485.flags &SER_RS485_ENABLED ) && - !(port->rs485.flags &SER_RS485_RX_DURING_TX )) +if (atmel_uart_is_half_duplex (port))atmel_stop_rx (port);if (atmel_use_pdc_tx (port))
@@ -806,8 +811,7 @@ static void atmel_complete_tx_dma(void **/ if (!uart_circ_empty (xmit))atmel_tasklet_schedule (atmel_port, &atmel_port->tasklet_tx); -else if ((port->rs485.flags &SER_RS485_ENABLED ) && - !(port->rs485.flags &SER_RS485_RX_DURING_TX )) { +else if (atmel_uart_is_half_duplex (port)) {/* DMA done, stop TX, start RX for RS485 */ atmel_start_rx (port); }
@@ -1383,8 +1387,7 @@ static void atmel_tx_pdc(struct uart_poratmel_uart_writel (port,ATMEL_US_IER , atmel_port->tx_done_mask); }else { -if ((port->rs485.flags &SER_RS485_ENABLED ) && - !(port->rs485.flags &SER_RS485_RX_DURING_TX )) { +if (atmel_uart_is_half_duplex (port)) {/* DMA done, stop TX, start RX for RS485 */ atmel_start_rx (port); }
Greg Kroah-Hartman
maintainerPATCH 5/121 tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Razvan Stefanescu <[email protected]>
commit 69646d7a3689fbe1a65ae90397d22ac3f1b8d40f upstream.
In half-duplex operation, RX should be started after TX completes.
If DMA is used, there is a case when the DMA transfer completes but the TX FIFO is not emptied, so the RX cannot be restarted just yet.
Use a boolean variable to store this state and rearm TX interrupt mask to be signaled again that the transfer finished. In interrupt transmit handler this variable is used to start RX. A warning message is generated if RX is activated before TX fifo is cleared.
RX after TX is done")
--- drivers/tty/serial/atmel_serial.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
drivers/tty/serial/atmel_serial.c +21 -3
@@ -176,6 +176,8 @@ struct atmel_uart_port {unsigned int pending_status;spinlock_t lock_suspended; +bool hd_start_rx;/* can start RX during half-duplex operation */ + #ifdef CONFIG_PM struct { u32 cr;
@@ -812,8 +814,13 @@ static void atmel_complete_tx_dma(void *if (!uart_circ_empty (xmit))atmel_tasklet_schedule (atmel_port, &atmel_port->tasklet_tx);else if (atmel_uart_is_half_duplex (port)) { -/* DMA done, stop TX, start RX for RS485 */ -atmel_start_rx (port); +/* +* DMA done, re-enable TXEMPTY and signal that we can stop +* TX and start RX for RS485 +*/ + atmel_port->hd_start_rx = true; +atmel_uart_writel (port,ATMEL_US_IER , + atmel_port->tx_done_mask); }spin_unlock_irqrestore (&port->lock, flags);
@@ -1258,9 +1265,20 @@ atmel_handle_transmit(struct uart_port *struct atmel_uart_port *atmel_port =to_atmel_uart_port (port);if (pending & atmel_port->tx_done_mask) { -/* Either PDC or interrupt transmission */ atmel_uart_writel (port,ATMEL_US_IDR , atmel_port->tx_done_mask); + +/* Start RX if flag was set and FIFO is empty */ +if (atmel_port->hd_start_rx) { +if (!(atmel_uart_readl (port,ATMEL_US_CSR ) + &ATMEL_US_TXEMPTY )) +dev_warn (port->dev,"Should start RX, but TX fifo is not empty\n" ); + + atmel_port->hd_start_rx = false; +atmel_start_rx (port); +return ; + } +atmel_tasklet_schedule (atmel_port, &atmel_port->tasklet_tx); } }
Greg Kroah-Hartman
maintainerPATCH 6/121 mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
commit a7f40cfe3b7ada57af9b62fd28430eeb4a7cfcb7 upstream.
When MPOL_MF_STRICT was specified and an existing page was already on a node that does not follow the policy, mbind() should return -EIO. But commit 6f4576e3687b ("mempolicy: apply page table walker on queue_pages_range()") broke the rule.
And commit c8633798497c ("mm: mempolicy: mbind and migrate_pages support thp migration") didn't return the correct value for THP mbind() too.
If MPOL_MF_STRICT is set, ignore vma_migratable() to make sure it reaches queue_pages_to_pte_range() or queue_pages_pmd() to check if an existing page was already on a node that does not follow the policy. And, non-migratable vma may be used, return -EIO too if MPOL_MF_MOVE or MPOL_MF_MOVE_ALL was specified.
Tested with https://github.com/metan-ucw/ltp/blob/master/testcases/kernel/syscalls/mbind/mbind02.c
--- mm/mempolicy.c | 40 +++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-)
mm/mempolicy.c +33 -7
@@ -427,6 +427,13 @@ static inline bool queue_pages_required(return node_isset (nid, *qp->nmask) == !(flags &MPOL_MF_INVERT ); } +/* +* queue_pages_pmd() has three possible return values: +* 1 - pages are placed on the right node or queued successfully. +* 0 - THP was split. +* -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing +* page was already on a node that does not follow the policy. +*/ static int queue_pages_pmd (pmd_t *pmd,spinlock_t *ptl,unsigned long addr,unsigned long end,struct mm_walk *walk) {
@@ -436,7 +443,7 @@ static int queue_pages_pmd(pmd_t *pmd, sunsigned long flags;if (unlikely (is_pmd_migration_entry (*pmd))) { - ret =1 ; + ret = -EIO ; goto unlock; } page =pmd_page (*pmd);
@@ -462,8 +469,15 @@ static int queue_pages_pmd(pmd_t *pmd, s ret =1 ; flags = qp->flags;/* go to thp migration */ -if (flags & (MPOL_MF_MOVE |MPOL_MF_MOVE_ALL )) +if (flags & (MPOL_MF_MOVE |MPOL_MF_MOVE_ALL )) { +if (!vma_migratable (walk->vma)) { + ret = -EIO ; + goto unlock; + } +migrate_page_add (page, qp->pagelist, flags); + }else + ret = -EIO ; unlock:spin_unlock (ptl); out:
@@ -488,8 +502,10 @@ static int queue_pages_pte_range(pmd_t * ptl =pmd_trans_huge_lock (pmd, vma);if (ptl) { ret =queue_pages_pmd (pmd, ptl, addr, end, walk); -if (ret) +if (ret >0 )return 0 ; +else if (ret <0 ) +return ret; }if (pmd_trans_unstable (pmd))
@@ -526,11 +542,16 @@ retry: goto retry; } -migrate_page_add (page, qp->pagelist, flags); +if (flags & (MPOL_MF_MOVE |MPOL_MF_MOVE_ALL )) { +if (!vma_migratable (vma)) +break ; +migrate_page_add (page, qp->pagelist, flags); + }else +break ; }pte_unmap_unlock (pte -1 , ptl);cond_resched (); -return 0 ; +return addr != end ? -EIO :0 ; } static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask,
@@ -600,7 +621,12 @@ static int queue_pages_test_walk(unsigneunsigned long endvma = vma->vm_end;unsigned long flags = qp->flags; -if (!vma_migratable (vma)) +/* +* Need check MPOL_MF_STRICT to return -EIO if possible +* regardless of vma_migratable +*/ +if (!vma_migratable (vma) && + !(flags &MPOL_MF_STRICT ))return 1 ;if (endvma > end)
@@ -627,7 +653,7 @@ static int queue_pages_test_walk(unsigne }/* queue pages from current vma */ -if (flags & (MPOL_MF_MOVE |MPOL_MF_MOVE_ALL )) +if (flags &MPOL_MF_VALID )return 0 ;return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 7/121 CIFS: fix POSIX lock leak and invalid ptr deref
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit bc31d0cdcfbadb6258b45db97e93b1c83822ba33 ]
We have a customer reporting crashes in lock_get_status() with many "Leaked POSIX lock" messages preceeding the crash.
Leaked POSIX lock on dev=0x0:0x56 ...
Leaked POSIX lock on dev=0x0:0x56 ...
Leaked POSIX lock on dev=0x0:0x56 ...
Leaked POSIX lock on dev=0x0:0x53 ...
Leaked POSIX lock on dev=0x0:0x53 ...
Leaked POSIX lock on dev=0x0:0x53 ...
Leaked POSIX lock on dev=0x0:0x53 ...
POSIX: fl_owner=ffff8900e7b79380 fl_flags=0x1 fl_type=0x1 fl_pid=20709 Leaked POSIX lock on dev=0x0:0x4b ino...
Leaked locks on dev=0x0:0x4b ino=0xf911400000029:
POSIX: fl_owner=ffff89f41c870e00 fl_flags=0x1 fl_type=0x1 fl_pid=19592
stack segment: 0000 [#1] SMP Modules linked in: binfmt_misc msr tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag rpcsec_gss_krb5 arc4 ecb auth_rpcgss nfsv4 md4 nfs nls_utf8 lockd grace cifs sunrpc ccm dns_resolver fscache af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock xfs libcrc32c sb_edac edac_core crct10dif_pclmul crc32_pclmul ghash_clmulni_intel drbg ansi_cprng vmw_balloon aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd joydev pcspkr vmxnet3 i2c_piix4 vmw_vmci shpchp fjes processor button ac btrfs xor raid6_pq sr_mod cdrom ata_generic sd_mod ata_piix vmwgfx crc32c_intel drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm serio_raw ahci libahci drm libata vmw_pvscsi sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod autofs4
Supported: Yes
CPU: 6 PID: 28250 Comm: lsof Not tainted 4.4.156-94.64-default #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 task: ffff88a345f28740 ti: ffff88c74005c000 task.ti: ffff88c74005c000 RIP: 0010:[<ffffffff8125dcab>] [<ffffffff8125dcab>] lock_get_status+0x9b/0x3b0 RSP: 0018:ffff88c74005fd90 EFLAGS: 00010202 RAX: ffff89bde83e20ae RBX: ffff89e870003d18 RCX: 0000000049534f50 RDX: ffffffff81a3541f RSI: ffffffff81a3544e RDI: ffff89bde83e20ae RBP: 0026252423222120 R08: 0000000020584953 R09: 000000000000ffff R10: 0000000000000000 R11: ffff88c74005fc70 R12: ffff89e5ca7b1340 R13: 00000000000050e5 R14: ffff89e870003d30 R15: ffff89e5ca7b1340 FS: 00007fafd64be800(0000) GS:ffff89f41fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001c80018 CR3: 000000a522048000 CR4: 0000000000360670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 0000000000000208 ffffffff81a3d6b6 ffff89e870003d30 ffff89e870003d18 ffff89e5ca7b1340 ffff89f41738d7c0 ffff89e870003d30 ffff89e5ca7b1340 ffffffff8125e08f 0000000000000000 ffff89bc22b67d00 ffff88c74005ff28 Call Trace: [<ffffffff8125e08f>] locks_show+0x2f/0x70 [<ffffffff81230ad1>] seq_read+0x251/0x3a0 [<ffffffff81275bbc>] proc_reg_read+0x3c/0x70 [<ffffffff8120e456>] __vfs_read+0x26/0x140 [<ffffffff8120e9da>] vfs_read+0x7a/0x120 [<ffffffff8120faf2>] SyS_read+0x42/0xa0 [<ffffffff8161cbc3>] entry_SYSCALL_64_fastpath+0x1e/0xb7
When Linux closes a FD (close(), close-on-exec, dup2(), ...) it calls filp_close() which also removes all posix locks.
The lock struct is initialized like so in filp_close() and passed down to cifs
...
lock.fl_type = F_UNLCK;
lock.fl_flags = FL_POSIX | FL_CLOSE;
lock.fl_start = 0;
lock.fl_end = OFFSET_MAX;
...Note the FL_CLOSE flag, which hints the VFS code that this unlocking is done for closing the fd.
filp_close()
locks_remove_posix(filp, id);
vfs_lock_file(filp, F_SETLK, &lock, NULL);
return filp->f_op->lock(filp, cmd, fl) => cifs_lock()
rc = cifs_setlk(file, flock, type, wait_flag, posix_lck, lock, unlock, xid);
rc = server->ops->mand_unlock_range(cfile, flock, xid);
if (flock->fl_flags & FL_POSIX && !rc)
rc = locks_lock_file_wait(file, flock)Notice how we don't call locks_lock_file_wait() which does the generic VFS lock/unlock/wait work on the inode if rc != 0.
If we are closing the handle, the SMB server is supposed to remove any locks associated with it. Similarly, cifs.ko frees and wakes up any lock and lock waiter when closing the file:
cifs_close()
cifsFileInfo_put(file->private_data)
/*
* Delete any outstanding lock records. We'll lose them when the file
* is closed anyway.
*/
down_write(&cifsi->lock_sem);
list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) {
list_del(&li->llist);
cifs_del_lock_waiters(li);
kfree(li);
}
list_del(&cifs_file->llist->llist);
kfree(cifs_file->llist);
up_write(&cifsi->lock_sem);So we can safely ignore unlocking failures in cifs_lock() if they happen with the FL_CLOSE flag hint set as both the server and the client take care of it during the actual closing.
This is not a proper fix for the unlocking failure but it's safe and it seems to prevent the lock leakages and crashes the customer experiences.
--- fs/cifs/file.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
fs/cifs/file.c +13 -1
@@ -1631,8 +1631,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type, rc = server->ops->mand_unlock_range (cfile, flock, xid); out: -if (flock->fl_flags &FL_POSIX && !rc) +if (flock->fl_flags &FL_POSIX ) { +/* +* If this is a request to remove all locks because we +* are closing the file, it doesn't matter if the +* unlocking failed as both cifs.ko and the SMB server +* remove the lock on file close +*/ +if (rc) { +cifs_dbg (VFS ,"%s failed rc=%d\n" , __func__, rc); +if (!(flock->fl_flags &FL_CLOSE )) +return rc; + } rc =locks_lock_file_wait (file, flock); + }return rc; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 8/121 h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fc2b47b55f17fd996f7a01975ce1c33c2f2513f6 ]
It believe it is a bad idea to hardcode a specific compiler prefix that may or may not be installed on a user's system. It is annoying when testing features that should not require compilers at all.
For example, mrproper, headers_install, etc. should work without any compiler.
They look like follows on my machine.
$ make ARCH=h8300 mrproper ./scripts/gcc-version.sh: line 26: h8300-unknown-linux-gcc: command not found ./scripts/gcc-version.sh: line 27: h8300-unknown-linux-gcc: command not found make: h8300-unknown-linux-gcc: Command not found make: h8300-unknown-linux-gcc: Command not found [ a bunch of the same error messages continue ]
$ make ARCH=h8300 headers_install ./scripts/gcc-version.sh: line 26: h8300-unknown-linux-gcc: command not found ./scripts/gcc-version.sh: line 27: h8300-unknown-linux-gcc: command not found make: h8300-unknown-linux-gcc: Command not found HOSTCC scripts/basic/fixdep make: h8300-unknown-linux-gcc: Command not found WRAP arch/h8300/include/generated/uapi/asm/kvm_para.h [ snip ]
The solution is to delete this line, or to use cc-cross-prefix like some architectures do. I chose the latter as a moderate fixup.
I added an alternative 'h8300-linux-' because it is available at:
https://mirrors.edge.kernel.org/pub/tools/crosstool/files/bin/x86_64/8.1.0/
--- arch/h8300/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/h8300/Makefile +1 -1
@@ -23,7 +23,7 @@ KBUILD_AFLAGS += $(aflags-y) LDFLAGS += $(ldflags-y) ifeq ($(CROSS_COMPILE),) -CROSS_COMPILE := h8300-unknown-linux- +CROSS_COMPILE := $(call cc-cross-prefix, h8300-unknown-linux- h8300-linux-) endif core-y += arch/$(ARCH)/kernel/ arch/$(ARCH)/mm/
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 9/121 f2fs: fix to avoid deadlock in f2fs_read_inline_dir()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit aadcef64b22f668c1a107b86d3521d9cac915c24 ]
As Jiqun Li reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=202883
sometimes, dead lock when make system call SYS_getdents64 with fsync() is called by another process.
monkey running on android9.0
1. task 9785 held sbi->cp_rwsem and waiting lock_page()
2. task 10349 held mm_sem and waiting sbi->cp_rwsem
3. task 9709 held lock_page() and waiting mm_sem
so this is a dead lock scenario.
task stack is show by crash tools as following
crash_arm64> bt ffffffc03c354080
PID: 9785 TASK: ffffffc03c354080 CPU: 1 COMMAND: "RxIoScheduler-3"
Quoted 1 line
Quoted 1 line
#7 [
ffffffc01b50fac0]__lock_pageatffffff80081b11e8
crash-arm64> bt 10349
PID: 10349 TASK: ffffffc018b83080 CPU: 1 COMMAND: "BUGLY_ASYNC_UPL"
Quoted 1 line
Quoted 1 line
#3 [
ffffffc01f8cfa40]rwsem_down_read_failedatffffff8008a93afc
PC: 00000033 LR: 00000000 SP: 00000000 PSTATE: ffffffffffffffff
crash-arm64> bt 9709
PID: 9709 TASK: ffffffc03e7f3080 CPU: 1 COMMAND: "IntentService[A"
Quoted 2 lines
Quoted 2 lines
#3 [
ffffffc001e67850]rwsem_down_read_failedatffffff8008a93afc#8 [ffffffc001e67b80]el1_iaatffffff8008084fc4
PC: ffffff8008274114 [compat_filldir64+120]
LR: ffffff80083584d4 [f2fs_fill_dentries+448]
SP: ffffffc001e67b80 PSTATE: 80400145
X29: ffffffc001e67b80 X28: 0000000000000000 X27: 000000000000001a
X26: 00000000000093d7 X25: ffffffc070d52480 X24: 0000000000000008
X23: 0000000000000028 X22: 00000000d43dfd60 X21: ffffffc001e67e90
X20: 0000000000000011 X19: ffffff80093a4000 X18: 0000000000000000
X17: 0000000000000000 X16: 0000000000000000 X15: 0000000000000000
X14: ffffffffffffffff X13: 0000000000000008 X12: 0101010101010101
X11: 7f7f7f7f7f7f7f7f X10: 6a6a6a6a6a6a6a6a X9: 7f7f7f7f7f7f7f7f
X8: 0000000080808000 X7: ffffff800827409c X6: 0000000080808000
X5: 0000000000000008 X4: 00000000000093d7 X3: 000000000000001a
X2: 0000000000000011 X1: ffffffc070d52480 X0: 0000000000800238Quoted 1 line
Quoted 1 line
#9 [
ffffffc001e67be0]f2fs_fill_dentriesatffffff80083584d0
PC: 0000003c LR: 00000000 SP: 00000000 PSTATE: 000000d9
X12: f48a02ff X11: d4678960 X10: d43dfc00 X9: d4678ae4
X8: 00000058 X7: d4678994 X6: d43de800 X5: 000000d9
X4: d43dfc0c X3: d43dfc10 X2: d46799c8 X1: 00000000
X0: 00001068Below potential deadlock will happen between three threads:
Thread A Thread B Thread C
- f2fs_do_sync_file
- f2fs_write_checkpoint
- down_write(&sbi->node_change) -- 1)
- do_page_fault
- down_write(&mm->mmap_sem) -- 2)
- do_wp_page
- f2fs_vm_page_mkwrite
- getdents64
- f2fs_read_inline_dir
- lock_page -- 3)
- f2fs_sync_node_pages
- lock_page -- 3)
- __do_map_lock
- down_read(&sbi->node_change) -- 1)
- f2fs_fill_dentries
- dir_emit
- compat_filldir64
- do_page_fault
- down_read(&mm->mmap_sem) -- 2)
Since f2fs_readdir is protected by inode.i_rwsem, there should not be any updates in inode page, we're safe to lookup dents in inode page without its lock held, so taking off the lock to improve concurrency of readdir and avoid potential deadlock.
--- fs/f2fs/inline.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/f2fs/inline.c +7 -1
@@ -656,6 +656,12 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,if (IS_ERR (ipage))return PTR_ERR (ipage); +/* +* f2fs_readdir was protected by inode.i_rwsem, it is safe to access +* ipage without page's lock held. +*/ +unlock_page (ipage); + inline_dentry =inline_data_addr (inode, ipage);make_dentry_ptr_inline (inode, &d, inline_dentry);
@@ -664,7 +670,7 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,if (!err) ctx->pos = d.max; -f2fs_put_page (ipage,1 ); +f2fs_put_page (ipage,0 );return err <0 ? err :0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 10/121 tracing: kdb: Fix ftdump to not sleep
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 31b265b3baaf55f209229888b7ffea523ddab366 ]
As reported back in 2016-11 [1], the "ftdump" kdb command triggers a BUG for "sleeping function called from invalid context".
kdb's "ftdump" command wants to call ring_buffer_read_prepare() in atomic context. A very simple solution for this is to add allocation flags to ring_buffer_read_prepare() so kdb can call it without triggering the allocation error. This patch does that.
Note that in the original email thread about this, it was suggested that perhaps the solution for kdb was to either preallocate the buffer ahead of time or create our own iterator. I'm hoping that this alternative of adding allocation flags to ring_buffer_read_prepare() can be considered since it means I don't need to duplicate more of the core trace code into "trace_kdb.c" (for either creating my own iterator or re-preparing a ring allocator whose memory was already allocated).
NOTE: another option for kdb is to actually figure out how to make it reuse the existing ftrace_dump() function and totally eliminate the duplication. This sounds very appealing and actually works (the "sr z" command can be seen to properly dump the ftrace buffer). The downside here is that ftrace_dump() fully consumes the trace buffer. Unless that is changed I'd rather not use it because it means "ftdump | grep xyz" won't be very useful to search the ftrace buffer since it will throw away the whole trace on the first grep. A future patch to dump only the last few lines of the buffer will also be hard to implement.
[1] https://lkml.kernel.org/r/[email protected]
--- include/linux/ring_buffer.h | 2 +- kernel/trace/ring_buffer.c | 5 +++-- kernel/trace/trace.c | 6 ++++-- kernel/trace/trace_kdb.c | 6 ++++-- 4 files changed, 12 insertions(+), 7 deletions(-)
include/linux/ring_buffer.h +1 -1
@@ -123,7 +123,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts, unsigned long *lost_events);struct ring_buffer_iter * -ring_buffer_read_prepare (struct ring_buffer *buffer,int cpu); +ring_buffer_read_prepare (struct ring_buffer *buffer,int cpu,gfp_t flags);void ring_buffer_read_prepare_sync (void );void ring_buffer_read_start (struct ring_buffer_iter *iter);void ring_buffer_read_finish (struct ring_buffer_iter *iter);
kernel/trace/ring_buffer.c +3 -2
@@ -4010,6 +4010,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);* ring_buffer_read_prepare - Prepare for a non consuming read of the buffer * @buffer: The ring buffer to read from * @cpu: The cpu buffer to iterate over +* @flags: gfp flags to use for memory allocation * * This performs the initial preparations necessary to iterate * through the buffer. Memory is allocated, buffer recording
@@ -4027,7 +4028,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);* This overall must be paired with ring_buffer_read_finish. */ struct ring_buffer_iter * -ring_buffer_read_prepare (struct ring_buffer *buffer,int cpu) +ring_buffer_read_prepare (struct ring_buffer *buffer,int cpu,gfp_t flags) {struct ring_buffer_per_cpu *cpu_buffer;struct ring_buffer_iter *iter;
@@ -4035,7 +4036,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)if (!cpumask_test_cpu (cpu, buffer->cpumask))return NULL ; - iter =kmalloc (sizeof (*iter),GFP_KERNEL ); + iter =kmalloc (sizeof (*iter), flags);if (!iter)return NULL ;
kernel/trace/trace.c +4 -2
@@ -3901,7 +3901,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)if (iter->cpu_file ==RING_BUFFER_ALL_CPUS ) {for_each_tracing_cpu (cpu) { iter->buffer_iter[cpu] = -ring_buffer_read_prepare (iter->trace_buffer->buffer, cpu); +ring_buffer_read_prepare (iter->trace_buffer->buffer, + cpu,GFP_KERNEL ); }ring_buffer_read_prepare_sync ();for_each_tracing_cpu (cpu) {
@@ -3911,7 +3912,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) }else { cpu = iter->cpu_file; iter->buffer_iter[cpu] = -ring_buffer_read_prepare (iter->trace_buffer->buffer, cpu); +ring_buffer_read_prepare (iter->trace_buffer->buffer, + cpu,GFP_KERNEL );ring_buffer_read_prepare_sync ();ring_buffer_read_start (iter->buffer_iter[cpu]);tracing_iter_reset (iter, cpu);
kernel/trace/trace_kdb.c +4 -2
@@ -51,14 +51,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file)if (cpu_file ==RING_BUFFER_ALL_CPUS ) {for_each_tracing_cpu (cpu) { iter.buffer_iter[cpu] = -ring_buffer_read_prepare (iter.trace_buffer->buffer, cpu); +ring_buffer_read_prepare (iter.trace_buffer->buffer, + cpu,GFP_ATOMIC );ring_buffer_read_start (iter.buffer_iter[cpu]);tracing_iter_reset (&iter, cpu); } }else { iter.cpu_file = cpu_file; iter.buffer_iter[cpu_file] = -ring_buffer_read_prepare (iter.trace_buffer->buffer, cpu_file); +ring_buffer_read_prepare (iter.trace_buffer->buffer, + cpu_file,GFP_ATOMIC );ring_buffer_read_start (iter.buffer_iter[cpu_file]);tracing_iter_reset (&iter, cpu_file); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 11/121 net/mlx5: Avoid panic when setting vport rate
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 24319258660a84dd77f4be026a55b10a12524919 ]
If we try to set VFs rate on a VF (not PF) net device, the kernel will be crash. The commands are show as below:
$ echo 2 > /sys/class/net/$MLX_PF0/device/sriov_numvfs $ ip link set $MLX_VF0 vf 0 max_tx_rate 2 min_tx_rate 1
If not applied the first patch ("net/mlx5: Avoid panic when setting vport mac, getting vport config"), the command:
$ ip link set $MLX_VF0 vf 0 rate 100
can also crash the kernel.
[ 1650.006388] RIP: 0010:mlx5_eswitch_set_vport_rate+0x1f/0x260 [mlx5_core] [ 1650.007092] do_setlink+0x982/0xd20 [ 1650.007129] __rtnl_newlink+0x528/0x7d0 [ 1650.007374] rtnl_newlink+0x43/0x60 [ 1650.007407] rtnetlink_rcv_msg+0x2a2/0x320 [ 1650.007484] netlink_rcv_skb+0xcb/0x100 [ 1650.007519] netlink_unicast+0x17f/0x230 [ 1650.007554] netlink_sendmsg+0x2d2/0x3d0 [ 1650.007592] sock_sendmsg+0x36/0x50 [ 1650.007625] ___sys_sendmsg+0x280/0x2a0 [ 1650.007963] __sys_sendmsg+0x58/0xa0 [ 1650.007998] do_syscall_64+0x5b/0x180 [ 1650.009438] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +9 -4
@@ -1966,19 +1966,24 @@ static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider)int mlx5_eswitch_set_vport_rate (struct mlx5_eswitch *esw,int vport,u32 max_rate,u32 min_rate) { -u32 fw_max_bw_share =MLX5_CAP_QOS (esw->dev, max_tsar_bw_share); -bool min_rate_supported =MLX5_CAP_QOS (esw->dev, esw_bw_share) && - fw_max_bw_share >=MLX5_MIN_BW_SHARE ; -bool max_rate_supported =MLX5_CAP_QOS (esw->dev, esw_rate_limit);struct mlx5_vport *evport; +u32 fw_max_bw_share;u32 previous_min_rate;u32 divider; +bool min_rate_supported; +bool max_rate_supported;int err =0 ;if (!ESW_ALLOWED (esw))return -EPERM ;if (!LEGAL_VPORT (esw, vport))return -EINVAL ; + + fw_max_bw_share =MLX5_CAP_QOS (esw->dev, max_tsar_bw_share); + min_rate_supported =MLX5_CAP_QOS (esw->dev, esw_bw_share) && + fw_max_bw_share >=MLX5_MIN_BW_SHARE ; + max_rate_supported =MLX5_CAP_QOS (esw->dev, esw_rate_limit); +if ((min_rate && !min_rate_supported) || (max_rate && !max_rate_supported))return -EOPNOTSUPP ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 12/121 net/mlx5: Avoid panic when setting vport mac, getting vport config
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6e77c413e8e73d0f36b5358b601389d75ec4451c ]
If we try to set VFs mac address on a VF (not PF) net device, the kernel will be crash. The commands are show as below:
$ echo 2 > /sys/class/net/$MLX_PF0/device/sriov_numvfs $ ip link set $MLX_VF0 vf 0 mac 00:11:22:33:44:00
[exception RIP: mlx5_eswitch_set_vport_mac+41] [ffffb8b7079e3688] do_setlink at ffffffff8f67f85b [ffffb8b7079e37a8] __rtnl_newlink at ffffffff8f683778 [ffffb8b7079e3b68] rtnl_newlink at ffffffff8f683a63 [ffffb8b7079e3b90] rtnetlink_rcv_msg at ffffffff8f67d812 [ffffb8b7079e3c10] netlink_rcv_skb at ffffffff8f6b88ab [ffffb8b7079e3c60] netlink_unicast at ffffffff8f6b808f [ffffb8b7079e3ca0] netlink_sendmsg at ffffffff8f6b8412 [ffffb8b7079e3d18] sock_sendmsg at ffffffff8f6452f6 [ffffb8b7079e3d30] ___sys_sendmsg at ffffffff8f645860 [ffffb8b7079e3eb0] __sys_sendmsg at ffffffff8f647a38 [ffffb8b7079e3f38] do_syscall_64 at ffffffff8f00401b [ffffb8b7079e3f50] entry_SYSCALL_64_after_hwframe at ffffffff8f80008c
and
[exception RIP: mlx5_eswitch_get_vport_config+12] [ffffa70607e57678] mlx5e_get_vf_config at ffffffffc03c7f8f [mlx5_core] [ffffa70607e57688] do_setlink at ffffffffbc67fa59 [ffffa70607e577a8] __rtnl_newlink at ffffffffbc683778 [ffffa70607e57b68] rtnl_newlink at ffffffffbc683a63 [ffffa70607e57b90] rtnetlink_rcv_msg at ffffffffbc67d812 [ffffa70607e57c10] netlink_rcv_skb at ffffffffbc6b88ab [ffffa70607e57c60] netlink_unicast at ffffffffbc6b808f [ffffa70607e57ca0] netlink_sendmsg at ffffffffbc6b8412 [ffffa70607e57d18] sock_sendmsg at ffffffffbc6452f6 [ffffa70607e57d30] ___sys_sendmsg at ffffffffbc645860 [ffffa70607e57eb0] __sys_sendmsg at ffffffffbc647a38 [ffffa70607e57f38] do_syscall_64 at ffffffffbc00401b [ffffa70607e57f50] entry_SYSCALL_64_after_hwframe at ffffffffbc80008c
--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +2 -2
@@ -1719,7 +1719,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,u64 node_guid;int err =0 ; -if (!MLX5_CAP_GEN (esw->dev, vport_group_manager)) +if (!esw || !MLX5_CAP_GEN (esw->dev, vport_group_manager))return -EPERM ;if (!LEGAL_VPORT (esw, vport) ||is_multicast_ether_addr (mac))return -EINVAL ;
@@ -1793,7 +1793,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw, {struct mlx5_vport *evport; -if (!MLX5_CAP_GEN (esw->dev, vport_group_manager)) +if (!esw || !MLX5_CAP_GEN (esw->dev, vport_group_manager))return -EPERM ;if (!LEGAL_VPORT (esw, vport))return -EINVAL ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 13/121 gpio: gpio-omap: fix level interrupt idling
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d01849f7deba81f4959fd9e51bf20dbf46987d1c ]
Tony notes that the GPIO module does not idle when level interrupts are in use, as the wakeup appears to get stuck.
After extensive investigation, it appears that the wakeup will only be cleared if the interrupt status register is cleared while the interrupt is enabled. However, we are currently clearing it with the interrupt disabled for level-based interrupts.
It is acknowledged that this observed behaviour conflicts with a statement in the TRM:
CAUTION
After servicing the interrupt, the status bit in the interrupt status register (GPIOi.GPIO_IRQSTATUS_0 or GPIOi.GPIO_IRQSTATUS_1) must be reset and the interrupt line released (by setting the corresponding bit of the interrupt status register to 1) before enabling an interrupt for the GPIO channel in the interrupt-enable register (GPIOi.GPIO_IRQSTATUS_SET_0 or GPIOi.GPIO_IRQSTATUS_SET_1) to prevent the occurrence of unexpected interrupts when enabling an interrupt for the GPIO channel.
However, this does not appear to be a practical problem.
Further, as reported by Grygorii Strashko <[email protected]>, the TI Android kernel tree has an earlier similar patch as "GPIO: OMAP:
Fix the sequence to clear the IRQ status" saying:
if the status is cleared after disabling the IRQ then sWAKEUP will not be cleared and gates the module transition
When we unmask the level interrupt after the interrupt has been handled, enable the interrupt and only then clear the interrupt. If the interrupt is still pending, the hardware will re-assert the interrupt status.
Should the caution note in the TRM prove to be a problem, we could use a clear-enable-clear sequence instead.
--- drivers/gpio/gpio-omap.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/gpio/gpio-omap.c +8 -6
@@ -841,14 +841,16 @@ static void omap_gpio_unmask_irq(struct irq_data *d)if (trigger)omap_set_gpio_triggering (bank, offset, trigger); -/* For level-triggered GPIOs, the clearing must be done after -* the HW source is cleared, thus after the handler has run */ -if (bank->level_mask &BIT (offset)) { -omap_set_gpio_irqenable (bank, offset,0 ); +omap_set_gpio_irqenable (bank, offset,1 ); + +/* +* For level-triggered GPIOs, clearing must be done after the source +* is cleared, thus after the handler has run. OMAP4 needs this done +* after enabing the interrupt to clear the wakeup status. +*/ +if (bank->level_mask &BIT (offset))omap_clear_gpio_irqstatus (bank, offset); - } -omap_set_gpio_irqenable (bank, offset,1 );raw_spin_unlock_irqrestore (&bank->lock, flags); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 14/121 include/linux/relay.h: fix percpu annotation in struct rchan
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 62461ac2e5b6520b6d65fc6d7d7b4b8df4b848d8 ]
The percpu member of this structure is declared as:
struct ... ** __percpu member;
So its type is:
__percpu pointer to pointer to struct ...
But looking at how it's used, its type should be:
pointer to __percpu pointer to struct ...
and it should thus be declared as:
struct ... * __percpu *member;
So fix the placement of '__percpu' in the definition of this structures.
This silents a few Sparse's warnings like:
warning: incorrect type in initializer (different address spaces)
expected void const [noderef] <asn:3> *__vpp_verify got struct sched_domain **
--- include/linux/relay.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/relay.h +1 -1
@@ -66,7 +66,7 @@ struct rchanstruct kref kref;/* channel refcount */ void *private_data;/* for user-defined data */ size_t last_toobig;/* tried to log event > subbuf size */ -struct rchan_buf **__percpu buf;/* per-cpu channel buffers */ +struct rchan_buf *__percpu *buf;/* per-cpu channel buffers */ int is_global;/* One global buffer ? */ struct list_head list;/* for channel list */ struct dentry *parent;/* parent dentry passed to open */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 15/121 sysctl: handle overflow for file-max
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 32a5ad9c22852e6bd9e74bdec5934ef9d1480bc5 ]
Currently, when writing
echo 18446744073709551616 > /proc/sys/fs/file-max
/proc/sys/fs/file-max will overflow and be set to 0. That quickly crashes the system.
This commit sets the max and min value for file-max. The max value is set to long int. Any higher value cannot currently be used as the percpu counters are long ints and not unsigned integers.
Note that the file-max value is ultimately parsed via __do_proc_doulongvec_minmax(). This function does not report error when min or max are exceeded. Which means if a value largen that long int is written userspace will not receive an error instead the old value will be kept. There is an argument to be made that this should be changed and __do_proc_doulongvec_minmax() should return an error when a dedicated min or max value are exceeded. However this has the potential to break userspace so let's defer this to an RFC patch.
--- kernel/sysctl.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/sysctl.c +3 -0
@@ -125,6 +125,7 @@ static int __maybe_unused one = 1;static int __maybe_unused two =2 ;static int __maybe_unused four =4 ;static unsigned long one_ul =1 ; +static unsigned long long_max =LONG_MAX ;static int one_hundred =100 ;static int one_thousand =1000 ;#ifdef CONFIG_PRINTK
@@ -1681,6 +1682,8 @@ static struct ctl_table fs_table[] = { .maxlen = sizeof(files_stat.max_files), .mode = 0644, .proc_handler = proc_doulongvec_minmax, + .extra1 = &zero, + .extra2 = &long_max, }, { .procname = "nr_open",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 16/121 enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 43d281662fdb46750d49417559b71069f435298d ]
The enic driver relies on the CONFIG_CPUMASK_OFFSTACK feature to dynamically allocate a struct member, but this is normally intended for local variables.
Building with clang, I get a warning for a few locations that check the address of the cpumask_var_t:
drivers/net/ethernet/cisco/enic/enic_main.c:122:22: error: address of array 'enic->msix[i].affinity_mask' will always evaluate to 'true' [-Werror,-Wpointer-bool-conversion]
As far as I can tell, the code is still correct, as the truth value of the pointer is what we need in this configuration. To get rid of the warning, use cpumask_available() instead of checking the pointer directly.
--- drivers/net/ethernet/cisco/enic/enic_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/cisco/enic/enic_main.c +3 -3
@@ -119,7 +119,7 @@ static void enic_init_affinity_hint(struct enic *enic)for (i =0 ; i < enic->intr_count; i++) {if (enic_is_err_intr (enic, i) ||enic_is_notify_intr (enic, i) || - (enic->msix[i].affinity_mask && + (cpumask_available (enic->msix[i].affinity_mask) && !cpumask_empty (enic->msix[i].affinity_mask)))continue ; if (zalloc_cpumask_var(&enic->msix[i].affinity_mask,
@@ -148,7 +148,7 @@ static void enic_set_affinity_hint(struct enic *enic)for (i =0 ; i < enic->intr_count; i++) {if (enic_is_err_intr (enic, i) ||enic_is_notify_intr (enic, i) || - !enic->msix[i].affinity_mask || + !cpumask_available (enic->msix[i].affinity_mask) ||cpumask_empty (enic->msix[i].affinity_mask))continue ; err = irq_set_affinity_hint(enic->msix_entry[i].vector,
@@ -161,7 +161,7 @@ static void enic_set_affinity_hint(struct enic *enic)for (i =0 ; i < enic->wq_count; i++) {int wq_intr =enic_msix_wq_intr (enic, i); -if (enic->msix[wq_intr].affinity_mask && +if (cpumask_available (enic->msix[wq_intr].affinity_mask) && !cpumask_empty (enic->msix[wq_intr].affinity_mask)) netif_set_xps_queue(enic->netdev, enic->msix[wq_intr].affinity_mask,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 17/121 scsi: hisi_sas: Set PHY linkrate when disconnected
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit efdcad62e7b8a02fcccc5ccca57806dce1482ac8 ]
When the PHY comes down, we currently do not set the negotiated linkrate:
root@(none)$ pwd /sys/class/sas_phy/phy-0:0 root@(none)$ more enable 1 root@(none)$ more negotiated_linkrate 12.0 Gbit root@(none)$ echo 0 > enable root@(none)$ more negotiated_linkrate 12.0 Gbit root@(none)$
This patch fixes the driver code to set it properly when the PHY comes down.
If the PHY had been enabled, then set unknown; otherwise, flag as disabled.
The logical place to set the negotiated linkrate for this scenario is PHY down routine, which is called from the PHY down ISR.
However, it is not possible to know if the PHY comes down due to PHY disable or loss of link, as sas_phy.enabled member is not set until after the transport disable routine is complete, which races with the PHY down ISR.
As an imperfect solution, use sas_phy_data.enable as the flag to know if the PHY is down due to disable. It's imperfect, as sas_phy_data is internal to libsas.
I can't see another way without adding a new field to hisi_sas_phy and managing it, or changing SCSI SAS transport.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/scsi/hisi_sas/hisi_sas_main.c +10 -0
@@ -10,6 +10,7 @@*/ #include "hisi_sas.h" +#include "../libsas/sas_internal.h" #define DRV_NAME "hisi_sas"#define DEV_IS_GONE (dev) \
@@ -1508,9 +1509,18 @@ static void hisi_sas_port_formed(struct asd_sas_phy *sas_phy)static void hisi_sas_phy_disconnected (struct hisi_sas_phy *phy) { +struct asd_sas_phy *sas_phy = &phy->sas_phy; +struct sas_phy *sphy = sas_phy->phy; +struct sas_phy_data *d = sphy->hostdata; + phy->phy_attached =0 ; phy->phy_type =0 ; phy->port =NULL ; + +if (d->enable) + sphy->negotiated_linkrate =SAS_LINK_RATE_UNKNOWN ; +else + sphy->negotiated_linkrate =SAS_PHY_DISABLED ; }void hisi_sas_phy_down (struct hisi_hba *hisi_hba,int phy_no,int rdy)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 18/121 iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e0f0ae838a25464179d37f355d763f9ec139fc15 ]
The pm8xxx_get_channel() implementation is unclear, and causes gcc to suddenly generate odd warnings. The trigger for the warning (at least for me) was the entirely unrelated commit 79a4e91d1bb2 ("device.h: Add __cold to dev_<level> logging functions"), which apparently changes gcc code generation in the caller function enough to cause this:
drivers/iio/adc/qcom-pm8xxx-xoadc.c: In function ‘pm8xxx_xoadc_probe’:
drivers/iio/adc/qcom-pm8xxx-xoadc.c:633:8: warning: ‘ch’ may be used uninitialized in this function [-Wmaybe-uninitialized]
ret = pm8xxx_read_channel_rsv(adc, ch, AMUX_RSV4,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
&read_nomux_rsv4, true);
~~~~~~~~~~~~~~~~~~~~~~~
drivers/iio/adc/qcom-pm8xxx-xoadc.c:426:27: note: ‘ch’ was declared here
struct pm8xxx_chan_info *ch;
^~because gcc for some reason then isn't able to see that the termination condition for the "for( )" loop in that function is also the condition for returning NULL.
So it's not _actually_ uninitialized, but the function is admittedly just unnecessarily oddly written.
Simplify and clarify the function, making gcc also see that it always returns a valid initialized value.
--- drivers/iio/adc/qcom-pm8xxx-xoadc.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/iio/adc/qcom-pm8xxx-xoadc.c +3 -7
@@ -423,18 +423,14 @@ static irqreturn_t pm8xxx_eoc_irq(int irq, void *d)static struct pm8xxx_chan_info *pm8xxx_get_channel (struct pm8xxx_xoadc *adc,u8 chan) { -struct pm8xxx_chan_info *ch;int i;for (i =0 ; i < adc->nchans; i++) { - ch = &adc->chans[i]; +struct pm8xxx_chan_info *ch = &adc->chans[i];if (ch->hwchan->amux_channel == chan) -break ; +return ch; } -if (i == adc->nchans) -return NULL ; - -return ch; +return NULL ; } static int pm8xxx_read_channel_rsv(struct pm8xxx_xoadc *adc,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 19/121 perf c2c: Fix c2c report for empty numa node
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e34c940245437f36d2c492edd1f8237eff391064 ]
Ravi Bangoria reported that we fail with an empty NUMA node with the following message:
$ lscpu NUMA node0 CPU(s): NUMA node1 CPU(s): 0-4
$ sudo ./perf c2c report node/cpu topology bugFailed setup nodes
Fix this by detecting the empty node and keeping its CPU set empty.
--- tools/perf/builtin-c2c.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
tools/perf/builtin-c2c.c +6 -2
@@ -1935,6 +1935,12 @@ static int setup_nodes(struct perf_session *session)if (!set)return -ENOMEM ; + nodes[node] = set; + +/* empty node, skip */ +if (cpu_map__empty (map)) +continue ; +for (cpu =0 ; cpu < map->nr; cpu++) {set_bit (map->map[cpu], set);
@@ -1943,8 +1949,6 @@ static int setup_nodes(struct perf_session *session) cpu2node[map->map[cpu]] = node; } - - nodes[node] = set; }setup_nodes_header ();
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 20/121 mm/cma.c: cma_declare_contiguous: correct err handling
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0d3bd18a5efd66097ef58622b898d3139790aa9d ]
In case cma_init_reserved_mem failed, need to free the memblock allocated by memblock_reserve or memblock_alloc_range.
Quote Catalin's comments:
https://lkml.org/lkml/2019/2/26/482
Kmemleak is supposed to work with the memblock_{alloc,free} pair and it ignores the memblock_reserve() as a memblock_alloc() implementation detail. It is, however, tolerant to memblock_free() being called on a sub-range or just a different range from a previous memblock_alloc(). So the original patch looks fine to me. FWIW:
--- mm/cma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
mm/cma.c +3 -1
@@ -348,12 +348,14 @@ int __init cma_declare_contiguous(phys_addr_t base, ret =cma_init_reserved_mem (base, size, order_per_bit, name, res_cma);if (ret) - goto err; + goto free_mem;pr_info ("Reserved %ld MiB at %pa\n" , (unsigned long )size /SZ_1M , &base);return 0 ; +free_mem: +memblock_free (base, size); err:pr_err ("Failed to reserve %ld MiB\n" , (unsigned long )size /SZ_1M );return ret;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 21/121 mm/page_ext.c: fix an imbalance with kmemleak
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0c81585499601acd1d0e1cbf424cabfaee60628c ]
After offlining a memory block, kmemleak scan will trigger a crash, as it encounters a page ext address that has already been freed during memory offlining. At the beginning in alloc_page_ext(), it calls kmemleak_alloc(), but it does not call kmemleak_free() in free_page_ext().
BUG: unable to handle kernel paging request at ffff888453d00000
PGD 128a01067 P4D 128a01067 PUD 128a04067 PMD 47e09e067 PTE 800ffffbac2ff060
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
CPU: 1 PID: 1594 Comm: bash Not tainted 5.0.0-rc8+ #15
Hardware name: HP ProLiant DL180 Gen9/ProLiant DL180 Gen9, BIOS U20 10/25/2017
RIP: 0010:scan_block+0xb5/0x290
Code: 85 6e 01 00 00 48 b8 00 00 30 f5 81 88 ff ff 48 39 c3 0f 84 5b 01 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 0f 85 87 01 00 00 <4c> 8b 3b e8 f3 0c fa ff 4c 39 3d 0c 6b 4c 01 0f 87 08 01 00 00 4c
RSP: 0018:ffff8881ec57f8e0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff888453d00000 RCX: ffffffffa61e5a54
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888453d00000
RBP: ffff8881ec57f920 R08: fffffbfff4ed588d R09: fffffbfff4ed588c
R10: fffffbfff4ed588c R11: ffffffffa76ac463 R12: dffffc0000000000
R13: ffff888453d00ff9 R14: ffff8881f80cef48 R15: ffff8881f80cef48
FS: 00007f6c0e3f8740(0000) GS:ffff8881f7680000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888453d00000 CR3: 00000001c4244003 CR4: 00000000001606a0
Call Trace:
scan_gray_list+0x269/0x430
kmemleak_scan+0x5a8/0x10f0
kmemleak_write+0x541/0x6ca
full_proxy_write+0xf8/0x190
__vfs_write+0xeb/0x980
vfs_write+0x15a/0x4f0
ksys_write+0xd2/0x1b0
__x64_sys_write+0x73/0xb0
do_syscall_64+0xeb/0xaaa
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f6c0dad73b8
Code: 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 65 63 2d 00 8b 00 85 c0 75 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 49 89 d4 55
RSP: 002b:00007ffd5b863cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f6c0dad73b8
RDX: 0000000000000005 RSI: 000055a9216e1710 RDI: 0000000000000001
RBP: 000055a9216e1710 R08: 000000000000000a R09: 00007ffd5b863840
R10: 000000000000000a R11: 0000000000000246 R12: 00007f6c0dda9780
R13: 0000000000000005 R14: 00007f6c0dda4740 R15: 0000000000000005
Modules linked in: nls_iso8859_1 nls_cp437 vfat fat kvm_intel kvm irqbypass efivars ip_tables x_tables xfs sd_mod ahci libahci igb i2c_algo_bit libata i2c_core dm_mirror dm_region_hash dm_log dm_mod efivarfs
CR2: ffff888453d00000
---[ end trace ccf646c7456717c5 ]---
Kernel panic - not syncing: Fatal exception
Shutting down cpus with NMI
Kernel Offset: 0x24c00000 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffffbfffffff)
---[ end Kernel panic - not syncing: Fatal exception ]------ mm/page_ext.c | 1 + 1 file changed, 1 insertion(+)
mm/page_ext.c +1 -0
@@ -271,6 +271,7 @@ static void free_page_ext(void *addr) table_size =get_entry_size () *PAGES_PER_SECTION ;BUG_ON (PageReserved (page)); +kmemleak_free (addr);free_pages_exact (addr, table_size); } }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 22/121 mm, mempolicy: fix uninit memory access
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2e25644e8da4ed3a27e7b8315aaae74660be72dc ]
Syzbot with KMSAN reports (excerpt):
==================================================================
BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:353 [inline] BUG: KMSAN: uninit-value in mpol_rebind_mm+0x249/0x370 mm/mempolicy.c:384 CPU: 1 PID: 17420 Comm: syz-executor4 Not tainted 4.20.0-rc7+ #15 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:295 mpol_rebind_policy mm/mempolicy.c:353 [inline] mpol_rebind_mm+0x249/0x370 mm/mempolicy.c:384 update_tasks_nodemask+0x608/0xca0 kernel/cgroup/cpuset.c:1120 update_nodemasks_hier kernel/cgroup/cpuset.c:1185 [inline] update_nodemask kernel/cgroup/cpuset.c:1253 [inline] cpuset_write_resmask+0x2a98/0x34b0 kernel/cgroup/cpuset.c:1728
...
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmem_cache_alloc+0x572/0xb90 mm/slub.c:2777 mpol_new mm/mempolicy.c:276 [inline] do_mbind mm/mempolicy.c:1180 [inline] kernel_mbind+0x8a7/0x31a0 mm/mempolicy.c:1347 __do_sys_mbind mm/mempolicy.c:1354 [inline]
As it's difficult to report where exactly the uninit value resides in the mempolicy object, we have to guess a bit. mm/mempolicy.c:353 contains this part of mpol_rebind_policy():
if (!mpol_store_user_nodemask(pol) &&
nodes_equal(pol->w.cpuset_mems_allowed, *newmask))"mpol_store_user_nodemask(pol)" is testing pol->flags, which I couldn't ever see being uninitialized after leaving mpol_new(). So I'll guess it's actually about accessing pol->w.cpuset_mems_allowed on line 354, but still part of statement starting on line 353.
For w.cpuset_mems_allowed to be not initialized, and the nodes_equal() reachable for a mempolicy where mpol_set_nodemask() is called in do_mbind(), it seems the only possibility is a MPOL_PREFERRED policy with empty set of nodes, i.e. MPOL_LOCAL equivalent, with MPOL_F_LOCAL flag. Let's exclude such policies from the nodes_equal() check. Note the uninit access should be benign anyway, as rebinding this kind of policy is always a no-op. Therefore no actual need for stable inclusion.
--- mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/mempolicy.c +1 -1
@@ -349,7 +349,7 @@ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask) {if (!pol)return ; -if (!mpol_store_user_nodemask (pol) && +if (!mpol_store_user_nodemask (pol) && !(pol->flags &MPOL_F_LOCAL ) &&nodes_equal (pol->w.cpuset_mems_allowed, *newmask))return ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 23/121 mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit afd07389d3f4933c7f7817a92fb5e053d59a3182 ]
One of the vmalloc stress test case triggers the kernel BUG():
<snip>
[60.562151] ------------[ cut here ]------------ [60.562154] kernel BUG at mm/vmalloc.c:512! [60.562206] invalid opcode: 0000 [#1] PREEMPT SMP PTI [60.562247] CPU: 0 PID: 430 Comm: vmalloc_test/0 Not tainted 4.20.0+ #161 [60.562293] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 [60.562351] RIP: 0010:alloc_vmap_area+0x36f/0x390 <snip>
it can happen due to big align request resulting in overflowing of calculated address, i.e. it becomes 0 after ALIGN()'s fixup.
Fix it by checking if calculated address is within vstart/vend range.
--- mm/vmalloc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
mm/vmalloc.c +5 -1
@@ -498,7 +498,11 @@ nocache: } found: -if (addr + size > vend) +/* +* Check also calculated address against the vstart, +* because it can be 0 because of big align request. +*/ +if (addr + size > vend || addr < vstart) goto overflow; va->va_start = addr;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 24/121 mm/slab.c: kmemleak no scan alien caches
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 92d1d07daad65c300c7d0b68bbef8867e9895d54 ]
Kmemleak throws endless warnings during boot due to in __alloc_alien_cache(),
alc = kmalloc_node(memsize, gfp, node);
init_arraycache(&alc->ac, entries, batch);
kmemleak_no_scan(ac);Kmemleak does not track the array cache (alc->ac) but the alien cache (alc) instead, so let it track the latter by lifting kmemleak_no_scan() out of init_arraycache().
There is another place that calls init_arraycache(), but alloc_kmem_cache_cpus() uses the percpu allocation where will never be considered as a leak.
kmemleak: Found object by alias at 0xffff8007b9aa7e38
CPU: 190 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc2+ #2
Call trace:
dump_backtrace+0x0/0x168
show_stack+0x24/0x30
dump_stack+0x88/0xb0
lookup_object+0x84/0xac
find_and_get_object+0x84/0xe4
kmemleak_no_scan+0x74/0xf4
setup_kmem_cache_node+0x2b4/0x35c
__do_tune_cpucache+0x250/0x2d4
do_tune_cpucache+0x4c/0xe4
enable_cpucache+0xc8/0x110
setup_cpu_cache+0x40/0x1b8
__kmem_cache_create+0x240/0x358
create_cache+0xc0/0x198
kmem_cache_create_usercopy+0x158/0x20c
kmem_cache_create+0x50/0x64
fsnotify_init+0x58/0x6c
do_one_initcall+0x194/0x388
kernel_init_freeable+0x668/0x688
kernel_init+0x18/0x124
ret_from_fork+0x10/0x18
kmemleak: Object 0xffff8007b9aa7e00 (size 256):
kmemleak: comm "swapper/0", pid 1, jiffies 4294697137
kmemleak: min_count = 1
kmemleak: count = 0
kmemleak: flags = 0x1
kmemleak: checksum = 0
kmemleak: backtrace:
kmemleak_alloc+0x84/0xb8
kmem_cache_alloc_node_trace+0x31c/0x3a0
__kmalloc_node+0x58/0x78
setup_kmem_cache_node+0x26c/0x35c
__do_tune_cpucache+0x250/0x2d4
do_tune_cpucache+0x4c/0xe4
enable_cpucache+0xc8/0x110
setup_cpu_cache+0x40/0x1b8
__kmem_cache_create+0x240/0x358
create_cache+0xc0/0x198
kmem_cache_create_usercopy+0x158/0x20c
kmem_cache_create+0x50/0x64
fsnotify_init+0x58/0x6c
do_one_initcall+0x194/0x388
kernel_init_freeable+0x668/0x688
kernel_init+0x18/0x124
kmemleak: Not scanning unknown object at 0xffff8007b9aa7e38
CPU: 190 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc2+ #2
Call trace:
dump_backtrace+0x0/0x168
show_stack+0x24/0x30
dump_stack+0x88/0xb0
kmemleak_no_scan+0x90/0xf4
setup_kmem_cache_node+0x2b4/0x35c
__do_tune_cpucache+0x250/0x2d4
do_tune_cpucache+0x4c/0xe4
enable_cpucache+0xc8/0x110
setup_cpu_cache+0x40/0x1b8
__kmem_cache_create+0x240/0x358
create_cache+0xc0/0x198
kmem_cache_create_usercopy+0x158/0x20c
kmem_cache_create+0x50/0x64
fsnotify_init+0x58/0x6c
do_one_initcall+0x194/0x388
kernel_init_freeable+0x668/0x688
kernel_init+0x18/0x124
ret_from_fork+0x10/0x18--- mm/slab.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
mm/slab.c +9 -8
@@ -563,14 +563,6 @@ static void start_cpu_timer(int cpu)static void init_arraycache (struct array_cache *ac,int limit,int batch) { -/* -* The array_cache structures contain pointers to free object. -* However, when such objects are allocated or transferred to another -* cache the pointers are not cleared and they could be counted as -* valid references during a kmemleak scan. Therefore, kmemleak must -* not scan such objects. -*/ -kmemleak_no_scan (ac);if (ac) { ac->avail =0 ; ac->limit = limit;
@@ -586,6 +578,14 @@ static struct array_cache *alloc_arraycache(int node, int entries,struct array_cache *ac =NULL ; ac =kmalloc_node (memsize, gfp, node); +/* +* The array_cache structures contain pointers to free object. +* However, when such objects are allocated or transferred to another +* cache the pointers are not cleared and they could be counted as +* valid references during a kmemleak scan. Therefore, kmemleak must +* not scan such objects. +*/ +kmemleak_no_scan (ac);init_arraycache (ac, entries, batchcount);return ac; }
@@ -680,6 +680,7 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries, alc =kmalloc_node (memsize, gfp, node);if (alc) { +kmemleak_no_scan (alc);init_arraycache (&alc->ac, entries, batch);spin_lock_init (&alc->lock); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 25/121 ocfs2: fix a panic problem caused by o2cb_ctl
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cc725ef3cb202ef2019a3c67c8913efa05c3cce6 ]
In the process of creating a node, it will cause NULL pointer dereference in kernel if o2cb_ctl failed in the interval (mkdir, o2cb_set_node_attribute(node_num)] in function o2cb_add_node.
The node num is initialized to 0 in function o2nm_node_group_make_item, o2nm_node_group_drop_item will mistake the node number 0 for a valid node number when we delete the node before the node number is set correctly. If the local node number of the current host happens to be 0, cluster->cl_local_node will be set to O2NM_INVALID_NODE_NUM while o2hb_thread still running. The panic stack is generated as follows:
o2hb_thread
\-o2hb_do_disk_heartbeat
\-o2hb_check_own_slot
|-slot = ®->hr_slots[o2nm_this_node()];
//o2nm_this_node() return O2NM_INVALID_NODE_NUMWe need to check whether the node number is set when we delete the node.
--- fs/ocfs2/cluster/nodemanager.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
fs/ocfs2/cluster/nodemanager.c +8 -6
@@ -621,13 +621,15 @@ static void o2nm_node_group_drop_item(struct config_group *group,struct o2nm_node *node =to_o2nm_node (item);struct o2nm_cluster *cluster =to_o2nm_cluster (group->cg_item.ci_parent); -o2net_disconnect_node (node); +if (cluster->cl_nodes[node->nd_num] == node) { +o2net_disconnect_node (node); -if (cluster->cl_has_local && - (cluster->cl_local_node == node->nd_num)) { - cluster->cl_has_local =0 ; - cluster->cl_local_node =O2NM_INVALID_NODE_NUM ; -o2net_stop_listening (node); +if (cluster->cl_has_local && + (cluster->cl_local_node == node->nd_num)) { + cluster->cl_has_local =0 ; + cluster->cl_local_node =O2NM_INVALID_NODE_NUM ; +o2net_stop_listening (node); + } }/* XXX call into net to stop this node from trading messages */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 26/121 f2fs: do not use mutex lock in atomic context
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9083977dabf3833298ddcd40dee28687f1e6b483 ]
Fix below warning coming because of using mutex lock in atomic context.
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:98 in_atomic(): 1, irqs_disabled(): 0, pid: 585, name: sh Preemption disabled at: __radix_tree_preload+0x28/0x130 Call trace: dump_backtrace+0x0/0x2b4 show_stack+0x20/0x28 dump_stack+0xa8/0xe0 ___might_sleep+0x144/0x194 __might_sleep+0x58/0x8c mutex_lock+0x2c/0x48 f2fs_trace_pid+0x88/0x14c f2fs_set_node_page_dirty+0xd0/0x184
Do not use f2fs_radix_tree_insert() to avoid doing cond_resched() with spin_lock() acquired.
--- fs/f2fs/trace.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/f2fs/trace.c +7 -1
@@ -61,6 +61,7 @@ void f2fs_trace_pid(struct page *page)set_page_private (page, (unsigned long )pid); +retry:if (radix_tree_preload (GFP_NOFS ))return ;
@@ -71,7 +72,12 @@ void f2fs_trace_pid(struct page *page)if (p)radix_tree_delete (&pids, pid); -f2fs_radix_tree_insert (&pids, pid, current); +if (radix_tree_insert (&pids, pid, current)) { +spin_unlock (&pids_lock); +radix_tree_preload_end (); +cond_resched (); + goto retry; + } trace_printk("%3x:%3x %4x %-16s\n", MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 27/121 fs/file.c: initialize init_files.resize_wait
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5704a06810682683355624923547b41540e2801a ]
(Taken from https://bugzilla.kernel.org/show_bug.cgi?id=200647)
'get_unused_fd_flags' in kthread cause kernel crash. It works fine on 4.1, but causes crash after get 64 fds. It also cause crash on ubuntu1404/1604/1804, centos7.5, and the crash messages are almost the same.
The crash message on centos7.5 shows below:
start fd 61
start fd 62
start fd 63
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: __wake_up_common+0x2e/0x90
PGD 0
Oops: 0000 [#1] SMP
Modules linked in: test(OE) xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter devlink sunrpc kvm_intel kvm irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd sg ppdev pcspkr virtio_balloon parport_pc parport i2c_piix4 joydev ip_tables xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_generic ata_generic pata_acpi virtio_scsi virtio_console virtio_net cirrus drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm crct10dif_pclmul crct10dif_common crc32c_intel drm ata_piix serio_raw libata virtio_pci virtio_ring i2c_core
virtio floppy dm_mirror dm_region_hash dm_log dm_mod
CPU: 2 PID: 1820 Comm: test_fd Kdump: loaded Tainted: G OE ------------ 3.10.0-862.3.3.el7.x86_64 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
task: ffff8e92b9431fa0 ti: ffff8e94247a0000 task.ti: ffff8e94247a0000
RIP: 0010:__wake_up_common+0x2e/0x90
RSP: 0018:ffff8e94247a2d18 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffffffff9d09daa0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffff9d09daa0
RBP: ffff8e94247a2d50 R08: 0000000000000000 R09: ffff8e92b95dfda8
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff9d09daa8
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff8e9434e80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000017c686000 CR4: 00000000000207e0
Call Trace:
__wake_up+0x39/0x50
expand_files+0x131/0x250
__alloc_fd+0x47/0x170
get_unused_fd_flags+0x30/0x40
test_fd+0x12a/0x1c0 [test]
kthread+0xd1/0xe0
ret_from_fork_nospec_begin+0x21/0x21
Code: 66 90 55 48 89 e5 41 57 41 89 f7 41 56 41 89 ce 41 55 41 54 49 89 fc 49 83 c4 08 53 48 83 ec 10 48 8b 47 08 89 55 cc 4c 89 45 d0 <48> 8b 08 49 39 c4 48 8d 78 e8 4c 8d 69 e8 75 08 eb 3b 4c 89 ef
RIP __wake_up_common+0x2e/0x90
RSP <ffff8e94247a2d18>
CR2: 0000000000000000This issue exists since CentOS 7.5 3.10.0-862 and CentOS 7.4 (3.10.0-693.21.1 ) is ok. Root cause: the item 'resize_wait' is not initialized before being used.
--- fs/file.c | 1 + 1 file changed, 1 insertion(+)
fs/file.c +1 -0
@@ -462,6 +462,7 @@ struct files_struct init_files = { .full_fds_bits = init_files.full_fds_bits_init, }, .file_lock = __SPIN_LOCK_UNLOCKED(init_files.file_lock), + .resize_wait = __WAIT_QUEUE_HEAD_INITIALIZER(init_files.resize_wait), };static unsigned int find_next_fd (struct fdtable *fdt,unsigned int start)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 28/121 page_poison: play nicely with KASAN
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4117992df66a26fa33908b4969e04801534baab1 ]
KASAN does not play well with the page poisoning (CONFIG_PAGE_POISONING). It triggers false positives in the allocation path:
BUG: KASAN: use-after-free in memchr_inv+0x2ea/0x330 Read of size 8 at addr ffff88881f800000 by task swapper/0 CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.0-rc1+ #54 Call Trace: dump_stack+0xe0/0x19a print_address_description.cold.2+0x9/0x28b kasan_report.cold.3+0x7a/0xb5 __asan_report_load8_noabort+0x19/0x20 memchr_inv+0x2ea/0x330 kernel_poison_pages+0x103/0x3d5 get_page_from_freelist+0x15e7/0x4d90
because KASAN has not yet unpoisoned the shadow page for allocation before it checks memchr_inv() but only found a stale poison pattern.
Also, false positives in free path,
BUG: KASAN: slab-out-of-bounds in kernel_poison_pages+0x29e/0x3d5 Write of size 4096 at addr ffff8888112cc000 by task swapper/0/1 CPU: 5 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc1+ #55 Call Trace: dump_stack+0xe0/0x19a print_address_description.cold.2+0x9/0x28b kasan_report.cold.3+0x7a/0xb5 check_memory_region+0x22d/0x250 memset+0x28/0x40 kernel_poison_pages+0x29e/0x3d5 __free_pages_ok+0x75f/0x13e0
due to KASAN adds poisoned redzones around slab objects, but the page poisoning needs to poison the whole page.
--- mm/page_alloc.c | 2 +- mm/page_poison.c | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-)
mm/page_alloc.c +1 -1
@@ -1764,8 +1764,8 @@ inline void post_alloc_hook(struct page *page, unsigned int order,arch_alloc_page (page, order);kernel_map_pages (page,1 << order,1 ); -kernel_poison_pages (page,1 << order,1 );kasan_alloc_pages (page, order); +kernel_poison_pages (page,1 << order,1 );set_page_owner (page, order, gfp_flags); }
mm/page_poison.c +4 -0
@@ -6,6 +6,7 @@#include <linux/page_ext.h> #include <linux/poison.h> #include <linux/ratelimit.h> +#include <linux/kasan.h> static bool want_page_poisoning__read_mostly ;
@@ -34,7 +35,10 @@ static void poison_page(struct page *page) {void *addr =kmap_atomic (page); +/* KASAN still think the page is in-use, so skip it. */ +kasan_disable_current ();memset (addr,PAGE_POISON ,PAGE_SIZE ); +kasan_enable_current ();kunmap_atomic (addr); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 29/121 cifs: use correct format characters
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 259594bea574e515a148171b5cd84ce5cbdc028a ]
When compiling with -Wformat, clang emits the following warnings:
fs/cifs/smb1ops.c:312:20: warning: format specifies type 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
tgt_total_cnt, total_in_tgt);
^~~~~~~~~~~~fs/cifs/cifs_dfs_ref.c:289:4: warning: format specifies type 'short' but the argument has type 'int' [-Wformat]
ref->flags, ref->server_type);
^~~~~~~~~~fs/cifs/cifs_dfs_ref.c:289:16: warning: format specifies type 'short' but the argument has type 'int' [-Wformat]
ref->flags, ref->server_type);
^~~~~~~~~~~~~~~~fs/cifs/cifs_dfs_ref.c:291:4: warning: format specifies type 'short' but the argument has type 'int' [-Wformat]
ref->ref_flag, ref->path_consumed);
^~~~~~~~~~~~~fs/cifs/cifs_dfs_ref.c:291:19: warning: format specifies type 'short' but the argument has type 'int' [-Wformat]
ref->ref_flag, ref->path_consumed);
^~~~~~~~~~~~~~~~~~The types of these arguments are unconditionally defined, so this patch updates the format character to the correct ones for ints and unsigned ints.
--- fs/cifs/cifs_dfs_ref.c | 4 ++-- fs/cifs/smb1ops.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
fs/cifs/cifs_dfs_ref.c +2 -2
@@ -271,9 +271,9 @@ static void dump_referral(const struct dfs_info3_param *ref) {cifs_dbg (FYI ,"DFS: ref path: %s\n" , ref->path_name);cifs_dbg (FYI ,"DFS: node path: %s\n" , ref->node_name); -cifs_dbg (FYI ,"DFS: fl: %hd, srv_type: %hd\n" , +cifs_dbg (FYI ,"DFS: fl: %d, srv_type: %d\n" , ref->flags, ref->server_type); -cifs_dbg (FYI ,"DFS: ref_flags: %hd, path_consumed: %hd\n" , +cifs_dbg (FYI ,"DFS: ref_flags: %d, path_consumed: %d\n" , ref->ref_flag, ref->path_consumed); }
fs/cifs/smb1ops.c +1 -1
@@ -306,7 +306,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) remaining = tgt_total_cnt - total_in_tgt;if (remaining <0 ) { -cifs_dbg (FYI ,"Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%hu\n" , +cifs_dbg (FYI ,"Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%u\n" , tgt_total_cnt, total_in_tgt);return -EPROTO ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 30/121 dm thin: add sanity checks to thin-pool and external snapshot creation
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 70de2cbda8a5d788284469e755f8b097d339c240 ]
Invoking dm_get_device() twice on the same device path with different modes is dangerous. Because in that case, upgrade_mode() will alloc a new 'dm_dev' and free the old one, which may be referenced by a previous caller. Dereferencing the dangling pointer will trigger kernel NULL pointer dereference.
The following two cases can reproduce this issue. Actually, they are invalid setups that must be disallowed, e.g.:
1. Creating a thin-pool with read_only mode, and the same device as both metadata and data.
dmsetup create thinp --table \
"0 41943040 thin-pool /dev/vdb /dev/vdb 128 0 1 read_only"BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 ... Call Trace: new_read+0xfb/0x110 [dm_bufio] dm_bm_read_lock+0x43/0x190 [dm_persistent_data] ? kmem_cache_alloc_trace+0x15c/0x1e0 __create_persistent_data_objects+0x65/0x3e0 [dm_thin_pool] dm_pool_metadata_open+0x8c/0xf0 [dm_thin_pool] pool_ctr.cold.79+0x213/0x913 [dm_thin_pool] ? realloc_argv+0x50/0x70 [dm_mod] dm_table_add_target+0x14e/0x330 [dm_mod] table_load+0x122/0x2e0 [dm_mod] ? dev_status+0x40/0x40 [dm_mod] ctl_ioctl+0x1aa/0x3e0 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] do_vfs_ioctl+0xa2/0x600 ? handle_mm_fault+0xda/0x200 ? __do_page_fault+0x26c/0x4f0 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x55/0x150 entry_SYSCALL_64_after_hwframe+0x44/0xa9
2. Creating a external snapshot using the same thin-pool device.
dmsetup create thinp --table \
"0 41943040 thin-pool /dev/vdc /dev/vdb 128 0 2 ignore_discard"
dmsetup message /dev/mapper/thinp 0 "create_thin 0"
dmsetup create snap --table \
"0 204800 thin /dev/mapper/thinp 0 /dev/mapper/thinp"BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... Call Trace: ? __alloc_pages_nodemask+0x13c/0x2e0 retrieve_status+0xa5/0x1f0 [dm_mod] ? dm_get_live_or_inactive_table.isra.7+0x20/0x20 [dm_mod] table_status+0x61/0xa0 [dm_mod] ctl_ioctl+0x1aa/0x3e0 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] do_vfs_ioctl+0xa2/0x600 ksys_ioctl+0x60/0x90 ? ksys_write+0x4f/0xb0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x55/0x150 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/md/dm-thin.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/md/dm-thin.c +13 -0
@@ -3292,6 +3292,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) as.argc = argc; as.argv = argv; +/* make sure metadata and data are different devices */ +if (!strcmp (argv[0 ], argv[1 ])) { + ti->error ="Error setting metadata or data device" ; + r = -EINVAL ; + goto out_unlock; + } +/* * Set default pool features. */
@@ -4173,6 +4180,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) tc->sort_bio_list =RB_ROOT ;if (argc ==3 ) { +if (!strcmp (argv[0 ], argv[2 ])) { + ti->error ="Error setting origin device" ; + r = -EINVAL ; + goto bad_origin_dev; + } + r =dm_get_device (ti, argv[2 ],FMODE_READ , &origin_dev);if (r) { ti->error ="Error opening origin device" ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 31/121 cifs: Fix NULL pointer dereference of devname
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 68e2672f8fbd1e04982b8d2798dd318bf2515dd2 ]
There is a NULL pointer dereference of devname in strspn()
The oops looks something like:
CIFS: Attempting to mount (null)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... RIP: 0010:strspn+0x0/0x50 ... Call Trace: ? cifs_parse_mount_options+0x222/0x1710 [cifs] ? cifs_get_volume_info+0x2f/0x80 [cifs] cifs_setup_volume_info+0x20/0x190 [cifs] cifs_get_volume_info+0x50/0x80 [cifs] cifs_smb3_do_mount+0x59/0x630 [cifs] ? ida_alloc_range+0x34b/0x3d0 cifs_do_mount+0x11/0x20 [cifs] mount_fs+0x52/0x170 vfs_kern_mount+0x6b/0x170 do_mount+0x216/0xdc0 ksys_mount+0x83/0xd0 __x64_sys_mount+0x25/0x30 do_syscall_64+0x65/0x220 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix this by adding a NULL check on devname in cifs_parse_devname()
--- fs/cifs/connect.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/cifs/connect.c +5 -0
@@ -1265,6 +1265,11 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol)const char *delims ="/\\" ;size_t len; +if (unlikely (!devname || !*devname)) { +cifs_dbg (VFS ,"Device name not specified.\n" ); +return -EINVAL ; + } +/* make sure we have a valid UNC double delimiter prefix */ len =strspn (devname, delims);if (len !=2 )
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 32/121 fs: Make splice() and tee() take into account O_NONBLOCK flag on pipes
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ee5e001196d1345b8fee25925ff5f1d67936081e ]
The current implementation of splice() and tee() ignores O_NONBLOCK set on pipe file descriptors and checks only the SPLICE_F_NONBLOCK flag for blocking on pipe arguments. This is inconsistent since splice()-ing from/to non-pipe file descriptors does take O_NONBLOCK into consideration.
Fix this by promoting O_NONBLOCK, when set on a pipe, to SPLICE_F_NONBLOCK.
Some context for how the current implementation of splice() leads to inconsistent behavior. In the ongoing work[1] to add VM tracing capability to trace-cmd we stream tracing data over named FIFOs or vsockets from guests back to the host.
When we receive SIGINT from user to stop tracing, we set O_NONBLOCK on the input file descriptor and set SPLICE_F_NONBLOCK for the next call to splice(). If splice() was blocked waiting on data from the input FIFO, after SIGINT splice() restarts with the same arguments (no SPLICE_F_NONBLOCK) and blocks again instead of returning -EAGAIN when no data is available.
This differs from the splice() behavior when reading from a vsocket or when we're doing a traditional read()/write() loop (trace-cmd's --nosplice argument).
With this patch applied we get the same behavior in all situations after setting O_NONBLOCK which also matches the behavior of doing a read()/write() loop instead of splice().
This change does have potential of breaking users who don't expect EAGAIN from splice() when SPLICE_F_NONBLOCK is not set. OTOH programs that set O_NONBLOCK and don't anticipate EAGAIN are arguably buggy[2].
[1] https://github.com/skaslev/trace-cmd/tree/vsock
[2] https://github.com/torvalds/linux/blob/d47e3da1759230e394096fd742aad423c291ba48/fs/read_write.c#L1425
--- fs/splice.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/splice.c +12 -0
@@ -1118,6 +1118,9 @@ static long do_splice(struct file *in, loff_t __user *off_in,if (ipipe == opipe)return -EINVAL ; +if ((in->f_flags | out->f_flags) &O_NONBLOCK ) + flags |=SPLICE_F_NONBLOCK ; +return splice_pipe_to_pipe (ipipe, opipe, len, flags); }
@@ -1143,6 +1146,9 @@ static long do_splice(struct file *in, loff_t __user *off_in,if (unlikely (ret <0 ))return ret; +if (in->f_flags &O_NONBLOCK ) + flags |=SPLICE_F_NONBLOCK ; +file_start_write (out); ret =do_splice_from (ipipe, out, &offset, len, flags);file_end_write (out);
@@ -1167,6 +1173,9 @@ static long do_splice(struct file *in, loff_t __user *off_in, offset = in->f_pos; } +if (out->f_flags &O_NONBLOCK ) + flags |=SPLICE_F_NONBLOCK ; +pipe_lock (opipe); ret =wait_for_space (opipe, flags);if (!ret)
@@ -1704,6 +1713,9 @@ static long do_tee(struct file *in, struct file *out, size_t len,* copying the data. */ if (ipipe && opipe && ipipe != opipe) { +if ((in->f_flags | out->f_flags) &O_NONBLOCK ) + flags |=SPLICE_F_NONBLOCK ; +/* * Keep going, unless we encounter an error. The ipipe/opipe * ordering doesn't really matter.
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 33/121 jbd2: fix invalid descriptor block checksum
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6e876c3dd205d30b0db6850e97a03d75457df007 ]
In jbd2_journal_commit_transaction(), if we are in abort mode, we may flush the buffer without setting descriptor block checksum by goto start_journal_io. Then fs is mounted, jbd2_descriptor_block_csum_verify() failed.
[ 271.379811] EXT4-fs (vdd): shut down requested (2) [ 271.381827] Aborting journal on device vdd-8. [ 271.597136] JBD2: Invalid checksum recovering block 22199 in log [ 271.598023] JBD2: recovery failed [ 271.598484] EXT4-fs (vdd): error loading journal
Fix this problem by keep setting descriptor block checksum if the descriptor buffer is not NULL.
This checksum problem can be reproduced by xfstests generic/388.
--- fs/jbd2/commit.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/jbd2/commit.c +4 -2
@@ -693,9 +693,11 @@ void jbd2_journal_commit_transaction(journal_t *journal)the last tag we set up. */ tag->t_flags |=cpu_to_be16 (JBD2_FLAG_LAST_TAG ); - -jbd2_descriptor_block_csum_set (journal, descriptor); start_journal_io: +if (descriptor) +jbd2_descriptor_block_csum_set (journal, + descriptor); +for (i =0 ; i < bufs; i++) {struct buffer_head *bh = wbuf[i];/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 34/121 fs: fix guard_bio_eod to check for real EOD errors
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dce30ca9e3b676fb288c33c1f4725a0621361185 ]
guard_bio_eod() can truncate a segment in bio to allow it to do IO on odd last sectors of a device.
It already checks if the IO starts past EOD, but it does not consider the possibility of an IO request starting within device boundaries can contain more than one segment past EOD.
In such cases, truncated_bytes can be bigger than PAGE_SIZE, and will underflow bvec->bv_len.
Fix this by checking if truncated_bytes is lower than PAGE_SIZE.
This situation has been found on filesystems such as isofs and vfat, which doesn't check the device size before mount, if the device is smaller than the filesystem itself, a readahead on such filesystem, which spans EOD, can trigger this situation, leading a call to zero_user() with a wrong size possibly corrupting memory.
I didn't see any crash, or didn't let the system run long enough to check if memory corruption will be hit somewhere, but adding instrumentation to guard_bio_end() to check truncated_bytes size, was enough to see the error.
The following script can trigger the error.
MNT=/mnt
IMG=./DISK.img
DEV=/dev/loop0
mkfs.vfat $IMG
mount $IMG $MNT
cp -R /etc $MNT &> /dev/null
umount $MNT
losetup -D
losetup --find --show --sizelimit 16247280 $IMG
mount $DEV $MNT
find $MNT -type f -exec cat {} + >/dev/null
Kudos to Eric Sandeen for coming up with the reproducer above
--- fs/buffer.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/buffer.c +7 -0
@@ -3084,6 +3084,13 @@ void guard_bio_eod(int op, struct bio *bio)/* Uhhuh. We've got a bio that straddles the device size! */ truncated_bytes = bio->bi_iter.bi_size - (maxsector <<9 ); +/* +* The bio contains more than one segment which spans EOD, just return +* and let IO layer turn it into an EIO +*/ +if (truncated_bytes > bvec->bv_len) +return ; +/* Truncate the bio.. */ bio->bi_iter.bi_size -= truncated_bytes; bvec->bv_len -= truncated_bytes;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 35/121 tools lib traceevent: Fix buffer overflow in arg_eval
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7c5b019e3a638a5a290b0ec020f6ca83d2ec2aaa ]
Fix buffer overflow observed when running perf test.
The overflow is when trying to evaluate "1ULL << (64 - 1)" which is resulting in -9223372036854775808 which overflows the 20 character buffer.
If is possible this bug has been reported before but I still don't see any fix checked in:
See: https://www.spinics.net/lists/linux-perf-users/msg07714.html
--- tools/lib/traceevent/event-parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/traceevent/event-parse.c +1 -1
@@ -2430,7 +2430,7 @@ static int arg_num_eval(struct print_arg *arg, long long *val)static char *arg_eval (struct print_arg *arg) {long long val; -static char buf[20 ]; +static char buf[24 ];switch (arg->type) {case PRINT_ATOM :
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 36/121 PCI/PME: Fix hotplug/sysfs remove deadlock in pcie_pme_remove()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 95c80bc6952b6a5badc7b702d23e5bf14d251e7c ]
Dongdong reported a deadlock triggered by a hotplug event during a sysfs "remove" operation:
pciehp 0000:00:0c.0:pcie004: Slot(0-1): Link Up
# echo 1 > 0000:00:0c.0/remove
PME and hotplug share an MSI/MSI-X vector. The sysfs "remove" side is:
remove_store
pci_stop_and_remove_bus_device_locked
pci_lock_rescan_remove
pci_stop_and_remove_bus_device
...
pcie_pme_remove
pcie_pme_suspend
synchronize_irq # wait for hotplug IRQ handler
pci_unlock_rescan_remove
The hotplug side is:
pciehp_ist
pciehp_handle_presence_or_link_change
pciehp_configure_device
pci_lock_rescan_remove # wait for pci_unlock_rescan_remove()
INFO: task bash:10913 blocked for more than 120 seconds.
# ps -ax |grep D PID TTY STAT TIME COMMAND 10913 ttyAMA0 Ds+ 0:00 -bash 14022 ? D 0:00 [irq/745-pciehp]
# cat /proc/14022/stack __switch_to+0x94/0xd8 pci_lock_rescan_remove+0x20/0x28 pciehp_configure_device+0x30/0x140 pciehp_handle_presence_or_link_change+0x324/0x458 pciehp_ist+0x1dc/0x1e0
# cat /proc/10913/stack __switch_to+0x94/0xd8 synchronize_irq+0x8c/0xc0 pcie_pme_suspend+0xa4/0x118 pcie_pme_remove+0x20/0x40 pcie_port_remove_service+0x3c/0x58 ... pcie_port_device_remove+0x2c/0x48 pcie_portdrv_remove+0x68/0x78 pci_device_remove+0x48/0x120 ... pci_stop_bus_device+0x84/0xc0 pci_stop_and_remove_bus_device_locked+0x24/0x40 remove_store+0xa4/0xb8 dev_attr_store+0x44/0x60 sysfs_kf_write+0x58/0x80
It is incorrect to call pcie_pme_suspend() from pcie_pme_remove() for two reasons.
First, pcie_pme_suspend() calls synchronize_irq(), which will wait for the native hotplug interrupt handler as well as for the PME one, because they share one IRQ (as per the spec). That may deadlock if hotplug is signaled while pcie_pme_remove() is running and the latter calls pci_lock_rescan_remove() before the former.
Second, if pcie_pme_suspend() figures out that wakeup needs to be enabled for the port, it will return without disabling the interrupt as expected by pcie_pme_remove() which was overlooked by commit c7b5a4e6e8fb ("PCI / PM:
Fix native PME handling during system suspend/resume").
To fix that, rework pcie_pme_remove() to disable the PME interrupt, clear its status and prevent the PME worker function from re-enabling it before calling free_irq() on it, which should be sufficient.
--- drivers/pci/pcie/pme.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/pci/pcie/pme.c +15 -7
@@ -367,6 +367,16 @@ static bool pcie_pme_check_wakeup(struct pci_bus *bus)return false; } +static void pcie_pme_disable_interrupt (struct pci_dev *port, +struct pcie_pme_service_data *data) +{ +spin_lock_irq (&data->lock); +pcie_pme_interrupt_enable (port, false); +pcie_clear_root_pme_status (port); + data->noirq = true; +spin_unlock_irq (&data->lock); +} +/** * pcie_pme_suspend - Suspend PCIe PME service device. * @srv: PCIe service device to suspend.
@@ -391,11 +401,7 @@ static int pcie_pme_suspend(struct pcie_device *srv)return 0 ; } -spin_lock_irq (&data->lock); -pcie_pme_interrupt_enable (port, false); -pcie_clear_root_pme_status (port); - data->noirq = true; -spin_unlock_irq (&data->lock); +pcie_pme_disable_interrupt (port, data);synchronize_irq (srv->irq);
@@ -431,9 +437,11 @@ static int pcie_pme_resume(struct pcie_device *srv)*/ static void pcie_pme_remove (struct pcie_device *srv) { -pcie_pme_suspend (srv); +struct pcie_pme_service_data *data =get_service_data (srv); + +pcie_pme_disable_interrupt (srv->port, data);free_irq (srv->irq, srv); -kfree (get_service_data (srv)); +kfree (data); }static struct pcie_port_service_driver pcie_pme_driver = {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 37/121 wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit de77a53c2d1e8fb3621e63e8e1f0f0c9a1a99ff7 ]
ies1 or ies2 might be null when code inside _wil_cfg80211_merge_extra_ies access them.
Add explicit check for null and make sure ies1/ies2 are not accessed in such a case.
spos might be null and be accessed inside _wil_cfg80211_merge_extra_ies.
Add explicit check for null in the while condition statement and make sure spos is not accessed in such a case.
--- drivers/net/wireless/ath/wil6210/cfg80211.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/wil6210/cfg80211.c +11 -3
@@ -1224,6 +1224,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,u8 *buf, *dpos;const u8 *spos; +if (!ies1) + ies1_len =0 ; + +if (!ies2) + ies2_len =0 ; +if (ies1_len ==0 && ies2_len ==0 ) { *merged_ies =NULL ; *merged_len =0 ;
@@ -1233,17 +1239,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, buf =kmalloc (ies1_len + ies2_len,GFP_KERNEL );if (!buf)return -ENOMEM ; -memcpy (buf, ies1, ies1_len); +if (ies1) +memcpy (buf, ies1, ies1_len); dpos = buf + ies1_len; spos = ies2; -while (spos +1 < ies2 + ies2_len) { +while (spos && (spos +1 < ies2 + ies2_len)) {/* IE tag at offset 0, length at offset 1 */ u16 ielen =2 + spos[1 ];if (spos + ielen > ies2 + ies2_len)break ;if (spos[0 ] ==WLAN_EID_VENDOR_SPECIFIC && - !_wil_cfg80211_find_ie (ies1, ies1_len, spos, ielen)) { + (!ies1 || !_wil_cfg80211_find_ie (ies1, ies1_len, + spos, ielen))) {memcpy (dpos, spos, ielen); dpos += ielen; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 38/121 crypto: crypto4xx - add missing of_node_put after of_device_is_available
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8c2b43d2d85b48a97d2f8279278a4aac5b45f925 ]
Add an of_node_put when a tested device node is not available.
The semantic patch that fixes this problem is as follows
(http://coccinelle.lip6.fr):
// <smpl>
@@
identifier f;
local idexpression e;
expression x;
@@
e = f(...);
... when != of_node_put(e)
when != x = e
when != e = x
when anyif (<+...of_device_is_available(e)...+>) {
... when != of_node_put(e)
(
return e;
|
+ of_node_put(e);
return ...;
)
}
// </smpl>
--- drivers/crypto/amcc/crypto4xx_trng.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/crypto/amcc/crypto4xx_trng.c +3 -1
@@ -80,8 +80,10 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev)/* Find the TRNG device node and map it */ trng =of_find_matching_node (NULL , ppc4xx_trng_match); -if (!trng || !of_device_is_available (trng)) +if (!trng || !of_device_is_available (trng)) { +of_node_put (trng);return ; + } dev->trng_base =of_iomap (trng,0 );of_node_put (trng);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 39/121 crypto: cavium/zip - fix collision with generic cra_driver_name
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 41798036430015ad45137db2d4c213cd77fd0251 ]
The cavium/zip implementation of the deflate compression algorithm is incorrectly being registered under the generic driver name, which prevents the generic implementation from being registered with the crypto API when CONFIG_CRYPTO_DEV_CAVIUM_ZIP=y. Similarly the lzs algorithm (which does not currently have a generic implementation...) is incorrectly being registered as lzs-generic.
Fix the naming collision by adding a suffix "-cavium" to the cra_driver_name of the cavium/zip algorithms.
--- drivers/crypto/cavium/zip/zip_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/crypto/cavium/zip/zip_main.c +4 -2
@@ -351,6 +351,7 @@ static struct pci_driver zip_driver = {static struct crypto_alg zip_comp_deflate = { .cra_name ="deflate" , + .cra_driver_name ="deflate-cavium" , .cra_flags =CRYPTO_ALG_TYPE_COMPRESS , .cra_ctxsize =sizeof (struct zip_kernel_ctx ), .cra_priority =300 ,
@@ -365,6 +366,7 @@ static struct crypto_alg zip_comp_deflate = {static struct crypto_alg zip_comp_lzs = { .cra_name ="lzs" , + .cra_driver_name ="lzs-cavium" , .cra_flags =CRYPTO_ALG_TYPE_COMPRESS , .cra_ctxsize =sizeof (struct zip_kernel_ctx ), .cra_priority =300 ,
@@ -384,7 +386,7 @@ static struct scomp_alg zip_scomp_deflate = { .decompress = zip_scomp_decompress, .base = { .cra_name = "deflate", - .cra_driver_name = "deflate-scomp", + .cra_driver_name = "deflate-scomp-cavium", .cra_module = THIS_MODULE, .cra_priority = 300, }
@@ -397,7 +399,7 @@ static struct scomp_alg zip_scomp_lzs = { .decompress = zip_scomp_decompress, .base = { .cra_name = "lzs", - .cra_driver_name = "lzs-scomp", + .cra_driver_name = "lzs-scomp-cavium", .cra_module = THIS_MODULE, .cra_priority = 300, }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 40/121 usb: chipidea: Grab the (legacy) USB PHY by phandle first
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 68ef236274793066b9ba3154b16c0acc1c891e5c ]
According to the chipidea driver bindings, the USB PHY is specified via the "phys" phandle node. However, this only takes effect for USB PHYs that use the common PHY framework. For legacy USB PHYs, a simple lookup based on the USB PHY type is done instead.
This does not play out well when more than one USB PHY is registered, since the first registered PHY matching the type will always be returned regardless of what the driver was bound to.
Fix this by looking up the PHY based on the "phys" phandle node. Although generic PHYs are rather matched by their "phys-name" and not the "phys" phandle directly, there is no helper for similar lookup on legacy PHYs and it's probably not worth the effort to add it.
When no legacy USB PHY is found by phandle, fallback to grabbing any registered USB2 PHY. This ensures backward compatibility if some users were actually relying on this mechanism.
--- drivers/usb/chipidea/core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/chipidea/core.c +8 -1
@@ -938,8 +938,15 @@ static int ci_hdrc_probe(struct platform_device *pdev) }else if (ci->platdata->usb_phy) { ci->usb_phy = ci->platdata->usb_phy; }else { + ci->usb_phy =devm_usb_get_phy_by_phandle (dev->parent,"phys" , +0 ); ci->phy =devm_phy_get (dev->parent,"usb-phy" ); - ci->usb_phy =devm_usb_get_phy (dev->parent,USB_PHY_TYPE_USB2 ); + +/* Fallback to grabbing any registered USB2 PHY */ +if (IS_ERR (ci->usb_phy) && +PTR_ERR (ci->usb_phy) != -EPROBE_DEFER ) + ci->usb_phy =devm_usb_get_phy (dev->parent, +USB_PHY_TYPE_USB2 );/* if both generic PHY and USB PHY layers aren't enabled */ if (PTR_ERR(ci->phy) == -ENOSYS &&
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 41/121 scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1749ef00f7312679f76d5e9104c5d1e22a829038 ]
We had a test-report where, under memory pressure, adding LUNs to the systems would fail (the tests add LUNs strictly in sequence):
[ 5525.853432] scsi 0:0:1:1088045124: Direct-Access IBM 2107900 .148 PQ: 0 ANSI: 5 [ 5525.853826] scsi 0:0:1:1088045124: alua: supports implicit TPGS [ 5525.853830] scsi 0:0:1:1088045124: alua: device naa.6005076303ffd32700000000000044da port group 0 rel port 43 [ 5525.853931] sd 0:0:1:1088045124: Attached scsi generic sg10 type 0 [ 5525.854075] sd 0:0:1:1088045124: [sdk] Disabling DIF Type 1 protection [ 5525.855495] sd 0:0:1:1088045124: [sdk] 2097152 512-byte logical blocks: (1.07 GB/1.00 GiB) [ 5525.855606] sd 0:0:1:1088045124: [sdk] Write Protect is off [ 5525.855609] sd 0:0:1:1088045124: [sdk] Mode Sense: ed 00 00 08 [ 5525.855795] sd 0:0:1:1088045124: [sdk] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 5525.857838] sdk: sdk1 [ 5525.859468] sd 0:0:1:1088045124: [sdk] Attached SCSI disk [ 5525.865073] sd 0:0:1:1088045124: alua: transition timeout set to 60 seconds [ 5525.865078] sd 0:0:1:1088045124: alua: port group 00 state A preferred supports tolusnA [ 5526.015070] sd 0:0:1:1088045124: alua: port group 00 state A preferred supports tolusnA [ 5526.015213] sd 0:0:1:1088045124: alua: port group 00 state A preferred supports tolusnA [ 5526.587439] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured [ 5526.588562] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured
Looking at the code of scsi_alloc_sdev(), and all the calling contexts, there seems to be no reason to use GFP_ATMOIC here. All the different call-contexts use a mutex at some point, and nothing in between that requires no sleeping, as far as I could see. Additionally, the code that later allocates the block queue for the device (scsi_mq_alloc_queue()) already uses GFP_KERNEL.
There are similar allocations in two other functions:scsi_probe_and_add_lun(), and scsi_add_lun(),; that can also be done with GFP_KERNEL.
Here is the contexts for the three functions so far:
scsi_alloc_sdev()
scsi_probe_and_add_lun()
scsi_sequential_lun_scan()
__scsi_scan_target()
scsi_scan_target()
mutex_lock()
scsi_scan_channel()
scsi_scan_host_selected()
mutex_lock()
scsi_report_lun_scan()
__scsi_scan_target()
...
__scsi_add_device()
mutex_lock()
__scsi_scan_target()
...
scsi_report_lun_scan()
...
scsi_get_host_dev()
mutex_lock()
scsi_probe_and_add_lun()
...
scsi_add_lun()
scsi_probe_and_add_lun()
...So replace all these, and give them a bit of a better chance to succeed, with more chances of reclaim.
--- drivers/scsi/scsi_scan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/scsi_scan.c +3 -3
@@ -220,7 +220,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,struct Scsi_Host *shost =dev_to_shost (starget->dev.parent); sdev =kzalloc (sizeof (*sdev) + shost->transportt->device_size, -GFP_ATOMIC ); +GFP_KERNEL );if (!sdev) goto out;
@@ -796,7 +796,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,*/ sdev->inquiry =kmemdup (inq_result,max_t (size_t, sdev->inquiry_len,36 ), -GFP_ATOMIC ); +GFP_KERNEL );if (sdev->inquiry ==NULL )return SCSI_SCAN_NO_RESPONSE ;
@@ -1085,7 +1085,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,if (!sdev) goto out; - result =kmalloc (result_len,GFP_ATOMIC | + result =kmalloc (result_len,GFP_KERNEL | ((shost->unchecked_isa_dma) ? __GFP_DMA :0 ));if (!result) goto out_free_sdev;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 42/121 powerpc/xmon: Fix opcode being uninitialized in print_insn_powerpc
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e7140639b1de65bba435a6bd772d134901141f86 ]
When building with -Wsometimes-uninitialized, Clang warns:
arch/powerpc/xmon/ppc-dis.c:157:7: warning: variable 'opcode' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]
if (cpu_has_feature(CPU_FTRS_POWER9))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/powerpc/xmon/ppc-dis.c:167:7: note: uninitialized use occurs here
if (opcode == NULL)
^~~~~~
arch/powerpc/xmon/ppc-dis.c:157:3: note: remove the 'if' if its
condition is always true
if (cpu_has_feature(CPU_FTRS_POWER9))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/powerpc/xmon/ppc-dis.c:132:38: note: initialize the variable
'opcode' to silence this warning
const struct powerpc_opcode *opcode;
^
= NULL1 warning generated.
This warning seems to make no sense on the surface because opcode is set to NULL right below this statement. However, there is a comma instead of semicolon to end the dialect assignment, meaning that the opcode assignment only happens in the if statement. Properly terminate that line so that Clang no longer warns.
--- arch/powerpc/xmon/ppc-dis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/xmon/ppc-dis.c +1 -1
@@ -162,7 +162,7 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr) dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 |PPC_OPCODE_POWER8 |PPC_OPCODE_POWER9 |PPC_OPCODE_HTM |PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 - |PPC_OPCODE_VSX |PPC_OPCODE_VSX3 ), + |PPC_OPCODE_VSX |PPC_OPCODE_VSX3 );/* Get the major opcode of the insn. */ opcode =NULL ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 43/121 coresight: etm4x: Add support to enable ETMv4.2
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5666dfd1d8a45a167f0d8b4ef47ea7f780b1f24a ]
SDM845 has ETMv4.2 and can use the existing etm4x driver. But the current etm driver checks only for ETMv4.0 and errors out for other etm4x versions. This patch adds this missing support to enable SoC's with ETMv4x to use same driver by checking only the ETM architecture major version number.
Without this change, we get below error during etm probe:
/ # dmesg | grep etm
[ 6.660093] coresight-etm4x: probe of 7040000.etm failed with error -22 [ 6.666902] coresight-etm4x: probe of 7140000.etm failed with error -22 [ 6.673708] coresight-etm4x: probe of 7240000.etm failed with error -22 [ 6.680511] coresight-etm4x: probe of 7340000.etm failed with error -22 [ 6.687313] coresight-etm4x: probe of 7440000.etm failed with error -22 [ 6.694113] coresight-etm4x: probe of 7540000.etm failed with error -22 [ 6.700914] coresight-etm4x: probe of 7640000.etm failed with error -22 [ 6.707717] coresight-etm4x: probe of 7740000.etm failed with error -22
With this change, etm probe is successful:
/ # dmesg | grep etm
[ 6.659198] coresight-etm4x 7040000.etm: CPU0: ETM v4.2 initialized [ 6.665848] coresight-etm4x 7140000.etm: CPU1: ETM v4.2 initialized [ 6.672493] coresight-etm4x 7240000.etm: CPU2: ETM v4.2 initialized [ 6.679129] coresight-etm4x 7340000.etm: CPU3: ETM v4.2 initialized [ 6.685770] coresight-etm4x 7440000.etm: CPU4: ETM v4.2 initialized [ 6.692403] coresight-etm4x 7540000.etm: CPU5: ETM v4.2 initialized [ 6.699024] coresight-etm4x 7640000.etm: CPU6: ETM v4.2 initialized [ 6.705646] coresight-etm4x 7740000.etm: CPU7: ETM v4.2 initialized
--- drivers/hwtracing/coresight/coresight-etm4x.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-etm4x.c +2 -1
@@ -61,7 +61,8 @@ static void etm4_os_unlock(struct etmv4_drvdata *drvdata)static bool etm4_arch_supported (u8 arch) { -switch (arch) { +/* Mask out the minor version number */ +switch (arch &0xf0 ) {case ETM_ARCH_V4 :break ;default :
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 44/121 serial: 8250_pxa: honor the port number from devicetree
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fe9ed6d2483fda55465f32924fb15bce0fac3fac ]
Like the other OF-enabled drivers, use the port number from the firmware if the devicetree specifies an alias:
aliases {
...
serial2 = &uart2; /* Should be ttyS2 */
}This is how the deprecated pxa.c driver behaved, switching to 8250_pxa messes up the numbering.
--- drivers/tty/serial/8250/8250_pxa.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/tty/serial/8250/8250_pxa.c +4 -0
@@ -118,6 +118,10 @@ static int serial_pxa_probe(struct platform_device *pdev)if (ret)return ret; + ret =of_alias_get_id (pdev->dev.of_node,"serial" ); +if (ret >=0 ) + uart.port.line = ret; + uart.port.type =PORT_XSCALE ; uart.port.iotype =UPIO_MEM32 ; uart.port.mapbase = mmres->start;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 45/121 ARM: 8840/1: use a raw_spinlock_t in unwind
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 74ffe79ae538283bbf7c155e62339f1e5c87b55a ]
Mostly unwind is done with irqs enabled however SLUB may call it with irqs disabled while creating a new SLUB cache.
I had system freeze while loading a module which called kmem_cache_create() on init. That means SLUB's __slab_alloc() disabled interrupts and then
->new_slab_objects()
->new_slab()
->setup_object()
->setup_object_debug()
->init_tracking()
->set_track()
->save_stack_trace()
->save_stack_trace_tsk()
->walk_stackframe()
->unwind_frame()
->unwind_find_idx()
=>spin_lock_irqsave(&unwind_lock);--- arch/arm/kernel/unwind.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
arch/arm/kernel/unwind.c +7 -7
@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[];static const struct unwind_idx *__origin_unwind_idx;extern const struct unwind_idx __stop_unwind_idx[]; -static DEFINE_SPINLOCK (unwind_lock); +static DEFINE_RAW_SPINLOCK (unwind_lock);static LIST_HEAD (unwind_tables);/* Convert a prel31 symbol to an absolute address */
@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr)/* module unwind tables */ struct unwind_table *table; -spin_lock_irqsave (&unwind_lock, flags); +raw_spin_lock_irqsave (&unwind_lock, flags);list_for_each_entry (table, &unwind_tables, list) {if (addr >= table->begin_addr && addr < table->end_addr) {
@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr)break ; } } -spin_unlock_irqrestore (&unwind_lock, flags); +raw_spin_unlock_irqrestore (&unwind_lock, flags); }pr_debug ("%s: idx = %p\n" , __func__, idx);
@@ -529,9 +529,9 @@ struct unwind_table *unwind_table_add(unsigned long start, unsigned long size, tab->begin_addr = text_addr; tab->end_addr = text_addr + text_size; -spin_lock_irqsave (&unwind_lock, flags); +raw_spin_lock_irqsave (&unwind_lock, flags);list_add_tail (&tab->list, &unwind_tables); -spin_unlock_irqrestore (&unwind_lock, flags); +raw_spin_unlock_irqrestore (&unwind_lock, flags);return tab; }
@@ -543,9 +543,9 @@ void unwind_table_del(struct unwind_table *tab)if (!tab)return ; -spin_lock_irqsave (&unwind_lock, flags); +raw_spin_lock_irqsave (&unwind_lock, flags);list_del (&tab->list); -spin_unlock_irqrestore (&unwind_lock, flags); +raw_spin_unlock_irqrestore (&unwind_lock, flags);kfree (tab); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 46/121 iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 032ebd8548c9d05e8d2bdc7a7ec2fe29454b0ad0 ]
L1 tables are allocated with __get_dma_pages, and therefore already ignored by kmemleak.
Without this, the kernel would print this error message on boot, when the first L1 table is allocated:
[ 2.810533] kmemleak: Trying to color unknown object at 0xffffffd652388000 as Black [ 2.818190] CPU: 5 PID: 39 Comm: kworker/5:0 Tainted: G S 4.19.16 #8 [ 2.831227] Workqueue: events deferred_probe_work_func [ 2.836353] Call trace: ... [ 2.852532] paint_ptr+0xa0/0xa8 [ 2.855750] kmemleak_ignore+0x38/0x6c [ 2.859490] __arm_v7s_alloc_table+0x168/0x1f4 [ 2.863922] arm_v7s_alloc_pgtable+0x114/0x17c [ 2.868354] alloc_io_pgtable_ops+0x3c/0x78
...
--- drivers/iommu/io-pgtable-arm-v7s.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iommu/io-pgtable-arm-v7s.c +2 -1
@@ -217,7 +217,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,if (dma != phys) goto out_unmap; } -kmemleak_ignore (table); +if (lvl ==2 ) +kmemleak_ignore (table);return table; out_unmap:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 47/121 powerpc/hugetlb: Handle mmap_min_addr correctly in get_unmapped_area callback
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5330367fa300742a97e20e953b1f77f48392faae ]
After we ALIGN up the address we need to make sure we didn't overflow and resulted in zero address. In that case, we need to make sure that the returned address is greater than mmap_min_addr.
This fixes selftest va_128TBswitch --run-hugetlb reporting failures when run as non root user for
mmap(-1, MAP_HUGETLB)
The bug is that a non-root user requesting address -1 will be given address 0 which will then fail, whereas they should have been given something else that would have succeeded.
We also avoid the first mmap(-1, MAP_HUGETLB) returning NULL address as mmap address with this change. So we think this is not a security issue, because it only affects whether we choose an address below mmap_min_addr, not whether we actually allow that address to be mapped. ie. there are existing capability checks to prevent a user mapping below mmap_min_addr and those will still be honoured even without this fix.
--- arch/powerpc/mm/hugetlbpage-radix.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/powerpc/mm/hugetlbpage-radix.c +3 -2
@@ -1,6 +1,7 @@// SPDX-License-Identifier: GPL-2.0 #include <linux/mm.h> #include <linux/hugetlb.h> +#include <linux/security.h> #include <asm/pgtable.h> #include <asm/pgalloc.h> #include <asm/cacheflush.h>
@@ -79,7 +80,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,if (addr) { addr =ALIGN (addr,huge_page_size (h)); vma =find_vma (mm, addr); -if (high_limit - len >= addr && +if (high_limit - len >= addr && addr >= mmap_min_addr && (!vma || addr + len <=vm_start_gap (vma)))return addr; }
@@ -89,7 +90,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,*/ info.flags =VM_UNMAPPED_AREA_TOPDOWN ; info.length = len; - info.low_limit =PAGE_SIZE ; + info.low_limit =max (PAGE_SIZE , mmap_min_addr); info.high_limit = mm->mmap_base + (high_limit -DEFAULT_MAP_WINDOW ); info.align_mask =PAGE_MASK & ~huge_page_mask (h); info.align_offset =0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 48/121 mmc: omap: fix the maximum timeout setting
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a6327b5e57fdc679c842588c3be046c0b39cc127 ]
When running OMAP1 kernel on QEMU, MMC access is annoyingly noisy:
MMC: CTO of 0xff and 0xfe cannot be used! MMC: CTO of 0xff and 0xfe cannot be used! MMC: CTO of 0xff and 0xfe cannot be used! [ad inf.]
Emulator warnings appear to be valid. The TI document SPRU680 [1] ("OMAP5910 Dual-Core Processor MultiMedia Card/Secure Data Memory Card (MMC/SD) Reference Guide") page 36 states that the maximum timeout is 253 cycles and "0xff and 0xfe cannot be used".
Fix by using 0xfd as the maximum timeout.
Tested using QEMU 2.5 (Siemens SX1 machine, OMAP310), and also checked on real hardware using Palm TE (OMAP310), Nokia 770 (OMAP1710) and Nokia N810 (OMAP2420) that MMC works as before.
[1] http://www.ti.com/lit/ug/spru680/spru680.pdf
--- drivers/mmc/host/omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/omap.c +1 -1
@@ -920,7 +920,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host *host, struct mmc_reques reg &= ~(1 <<5 );OMAP_MMC_WRITE (host,SDIO , reg);/* Set maximum timeout */ -OMAP_MMC_WRITE (host,CTO ,0xff ); +OMAP_MMC_WRITE (host,CTO ,0xfd ); }static inline void set_data_timeout (struct mmc_omap_host *host,struct mmc_request *req)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 49/121 e1000e: Fix -Wformat-truncation warnings
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 135e7245479addc6b1f5d031e3d7e2ddb3d2b109 ]
Provide precision hints to snprintf() since we know the destination buffer size of the RX/TX ring names are IFNAMSIZ + 5 - 1. This fixes the following warnings:
drivers/net/ethernet/intel/e1000e/netdev.c: In function 'e1000_request_msix':drivers/net/ethernet/intel/e1000e/netdev.c:2109:13: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
"%s-rx-0", netdev->name);
^drivers/net/ethernet/intel/e1000e/netdev.c:2107:3: note: 'snprintf' output between 6 and 21 bytes into a destination of size 20
snprintf(adapter->rx_ring->name, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sizeof(adapter->rx_ring->name) - 1,
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"%s-rx-0", netdev->name);
~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/intel/e1000e/netdev.c:2125:13: warning: 'snprintf'
output may be truncated before the last format character
[-Wformat-truncation=]
"%s-tx-0", netdev->name);
^drivers/net/ethernet/intel/e1000e/netdev.c:2123:3: note: 'snprintf' output between 6 and 21 bytes into a destination of size 20
snprintf(adapter->tx_ring->name, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sizeof(adapter->tx_ring->name) - 1,
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"%s-tx-0", netdev->name);
~~~~~~~~~~~~~~~~~~~~~~~~--- drivers/net/ethernet/intel/e1000e/netdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +2 -2
@@ -2120,7 +2120,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter)if (strlen (netdev->name) < (IFNAMSIZ -5 ))snprintf (adapter->rx_ring->name,sizeof (adapter->rx_ring->name) -1 , -"%s-rx-0" , netdev->name); +"%.14s-rx-0" , netdev->name);else memcpy (adapter->rx_ring->name, netdev->name,IFNAMSIZ ); err = request_irq(adapter->msix_entries[vector].vector,
@@ -2136,7 +2136,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter)if (strlen (netdev->name) < (IFNAMSIZ -5 ))snprintf (adapter->tx_ring->name,sizeof (adapter->tx_ring->name) -1 , -"%s-tx-0" , netdev->name); +"%.14s-tx-0" , netdev->name);else memcpy (adapter->tx_ring->name, netdev->name,IFNAMSIZ ); err = request_irq(adapter->msix_entries[vector].vector,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 50/121 mlxsw: spectrum: Avoid -Wformat-truncation warnings
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ab2c4e2581ad32c28627235ff0ae8c5a5ea6899f ]
Give precision identifiers to the two snprintf() formatting the priority and TC strings to avoid producing these two warnings:
drivers/net/ethernet/mellanox/mlxsw/spectrum.c: In function 'mlxsw_sp_port_get_prio_strings':drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2132:37: warning: '%d' directive output may be truncated writing between 1 and 3 bytes into a region of size between 0 and 31 [-Wformat-truncation=]
snprintf(*p, ETH_GSTRING_LEN, "%s_%d",
^~
drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2132:3: note: 'snprintf' output between 3 and 36 bytes into a destination of size 32
snprintf(*p, ETH_GSTRING_LEN, "%s_%d", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mlxsw_sp_port_hw_prio_stats[i].str, prio);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/net/ethernet/mellanox/mlxsw/spectrum.c: In function 'mlxsw_sp_port_get_tc_strings':drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2143:37: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 31 [-Wformat-truncation=]
snprintf(*p, ETH_GSTRING_LEN, "%s_%d",
^~
drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2143:3: note: 'snprintf' output between 3 and 44 bytes into a destination of size 32
snprintf(*p, ETH_GSTRING_LEN, "%s_%d", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mlxsw_sp_port_hw_tc_stats[i].str, tc);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +2 -2
@@ -2019,7 +2019,7 @@ static void mlxsw_sp_port_get_prio_strings(u8 **p, int prio)int i;for (i =0 ; i <MLXSW_SP_PORT_HW_PRIO_STATS_LEN ; i++) { -snprintf (*p,ETH_GSTRING_LEN ,"%s_%d" , +snprintf (*p,ETH_GSTRING_LEN ,"%.29s_%.1d" , mlxsw_sp_port_hw_prio_stats[i].str, prio); *p +=ETH_GSTRING_LEN ; }
@@ -2030,7 +2030,7 @@ static void mlxsw_sp_port_get_tc_strings(u8 **p, int tc)int i;for (i =0 ; i <MLXSW_SP_PORT_HW_TC_STATS_LEN ; i++) { -snprintf (*p,ETH_GSTRING_LEN ,"%s_%d" , +snprintf (*p,ETH_GSTRING_LEN ,"%.29s_%.1d" , mlxsw_sp_port_hw_tc_stats[i].str, tc); *p +=ETH_GSTRING_LEN ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 51/121 IB/mlx4: Increase the timeout for CM cache
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2612d723aadcf8281f9bf8305657129bd9f3cd57 ]
Using CX-3 virtual functions, either from a bare-metal machine or pass-through from a VM, MAD packets are proxied through the PF driver.
Since the VF drivers have separate name spaces for MAD Transaction Ids (TIDs), the PF driver has to re-map the TIDs and keep the book keeping in a cache.
Following the RDMA Connection Manager (CM) protocol, it is clear when an entry has to evicted form the cache. But life is not perfect, remote peers may die or be rebooted. Hence, it's a timeout to wipe out a cache entry, when the PF driver assumes the remote peer has gone.
During workloads where a high number of QPs are destroyed concurrently, excessive amount of CM DREQ retries has been observed
The problem can be demonstrated in a bare-metal environment, where two nodes have instantiated 8 VFs each. This using dual ported HCAs, so we have 16 vPorts per physical server.
64 processes are associated with each vPort and creates and destroys one QP for each of the remote 64 processes. That is, 1024 QPs per vPort, all in all 16K QPs. The QPs are created/destroyed using the CM.
When tearing down these 16K QPs, excessive CM DREQ retries (and duplicates) are observed. With some cat/paste/awk wizardry on the infiniband_cm sysfs, we observe as sum of the 16 vPorts on one of the nodes:
cm_rx_duplicates:
dreq 2102
cm_rx_msgs:
drep 1989
dreq 6195
rep 3968
req 4224
rtu 4224
cm_tx_msgs:
drep 4093
dreq 27568
rep 4224
req 3968
rtu 3968
cm_tx_retries:
dreq 23469Note that the active/passive side is equally distributed between the two nodes.
Enabling pr_debug in cm.c gives tons of:
[171778.814239] <mlx4_ib> mlx4_ib_multiplex_cm_handler: id{slave:1,sl_cm_id: 0xd393089f} is NULL!
By increasing the CM_CLEANUP_CACHE_TIMEOUT from 5 to 30 seconds, the tear-down phase of the application is reduced from approximately 90 to 50 seconds. Retries/duplicates are also significantly reduced:
cm_rx_duplicates:
dreq 2460
[]
cm_tx_retries:
dreq 3010
req 47Increasing the timeout further didn't help, as these duplicates and retries stems from a too short CMA timeout, which was 20 (~4 seconds) on the systems. By increasing the CMA timeout to 22 (~17 seconds), the numbers fell down to about 10 for both of them.
Adjustment of the CMA timeout is not part of this commit.
--- drivers/infiniband/hw/mlx4/cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/cm.c +1 -1
@@ -39,7 +39,7 @@#include "mlx4_ib.h" -#define CM_CLEANUP_CACHE_TIMEOUT (5 * HZ) +#define CM_CLEANUP_CACHE_TIMEOUT (30 * HZ)struct id_map_entry {struct rb_node node;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 52/121 clk: fractional-divider: check parent rate only if flag is set
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d13501a2bedfbea0983cc868d3f1dc692627f60d ]
Custom approximation of fractional-divider may not need parent clock rate checking. For example Rockchip SoCs work fine using grand parent clock rate even if target rate is greater than parent.
This patch checks parent clock rate only if CLK_SET_RATE_PARENT flag is set.
For detailed example, clock tree of Rockchip I2S audio hardware.
- Clock rate of CPLL is 1.2GHz, GPLL is 491.52MHz.
- i2s1_div is integer divider can divide N (N is 1~128). Input clock is CPLL or GPLL. Initial divider value is N = 1. Ex) PLL = CPLL, N = 10, i2s1_div output rate is CPLL / 10 = 1.2GHz / 10 = 120MHz
- i2s1_frac is fractional divider can divide input to x/y, x and y are 16bit integer.
CPLL --> | selector | ---> i2s1_div -+--> | selector | --> I2S1 MCLK
GPLL --> | | ,--------------' | |
`--> i2s1_frac ---> | |Clock mux system try to choose suitable one from i2s1_div and i2s1_frac for master clock (MCLK) of I2S1.
Bad scenario as follows:
- Try to set MCLK to 8.192MHz (32kHz audio replay) Candidate setting is
- i2s1_div: GPLL / 60 = 8.192MHz
i2s1_div candidate is exactly same as target clock rate, so mux choose this clock source. i2s1_div output rate is changed 491.52MHz -> 8.192MHz
- After that try to set to 11.2896MHz (44.1kHz audio replay) Candidate settings are
- i2s1_div : CPLL / 107 = 11.214945MHz
- i2s1_frac: i2s1_div = 8.192MHz
This is because clk_fd_round_rate() thinks target rate (11.2896MHz) is higher than parent rate (i2s1_div = 8.192MHz) and returns parent clock rate.
Above is current upstreamed behavior. Clock mux system choose i2s1_div, but this clock rate is not acceptable for I2S driver, so users cannot replay audio.
Expected behavior is:
- Try to set master clock to 11.2896MHz (44.1kHz audio replay) Candidate settings are
- i2s1_div : CPLL / 107 = 11.214945MHz
- i2s1_frac: i2s1_div * 147/6400 = 11.2896MHz Change i2s1_div to GPLL / 1 = 491.52MHz at same time.
If apply this commit, clk_fd_round_rate() calls custom approximate function of Rockchip even if target rate is higher than parent. Custom function changes both grand parent (i2s1_div) and parent (i2s_frac) settings at same time. Clock mux system can choose i2s1_frac and audio works fine.
--- drivers/clk/clk-fractional-divider.c | 2 +- include/linux/clk-provider.h | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/clk/clk-fractional-divider.c +1 -1
@@ -77,7 +77,7 @@ static long clk_fd_round_rate(struct clk_hw *hw, unsigned long rate,unsigned long m, n;u64 ret; -if (!rate || rate >= *parent_rate) +if (!rate || (!clk_hw_can_set_rate_parent (hw) && rate >= *parent_rate))return *parent_rate;if (fd->approximation)
include/linux/clk-provider.h +3 -0
@@ -743,6 +743,9 @@ unsigned int __clk_get_enable_count(struct clk *clk);unsigned long clk_hw_get_rate (const struct clk_hw *hw);unsigned long __clk_get_flags (struct clk *clk);unsigned long clk_hw_get_flags (const struct clk_hw *hw); +#define clk_hw_can_set_rate_parent (hw) \ + (clk_hw_get_flags((hw)) & CLK_SET_RATE_PARENT) +bool clk_hw_is_prepared (const struct clk_hw *hw);bool clk_hw_is_enabled (const struct clk_hw *hw);bool __clk_is_enabled (struct clk *clk);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 53/121 cpufreq: acpi-cpufreq: Report if CPU doesnt support boost technologies
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1222d527f314c86a3b59a522115d62facc5a7965 ]
There is some rare cases where CPB (and possibly IDA) are missing on processors.
This is the case fixed by commit f7f3dc00f612 ("x86/cpu/AMD: Fix erratum 1076 (CPB bit)") and following.
In such context, the boost status isn't reported by /sys/devices/system/cpu/cpufreq/boost.
This commit is about printing a message to report that the CPU doesn't expose the boost capabilities.
This message could help debugging platforms hit by this phenomena.
--- drivers/cpufreq/acpi-cpufreq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/cpufreq/acpi-cpufreq.c +3 -1
@@ -909,8 +909,10 @@ static void __init acpi_cpufreq_boost_init(void) {int ret; -if (!(boot_cpu_has (X86_FEATURE_CPB ) ||boot_cpu_has (X86_FEATURE_IDA ))) +if (!(boot_cpu_has (X86_FEATURE_CPB ) ||boot_cpu_has (X86_FEATURE_IDA ))) { +pr_debug ("Boost capabilities not present in the processor\n" );return ; + } acpi_cpufreq_driver.set_boost = set_boost; acpi_cpufreq_driver.boost_enabled =boost_state (0 );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 54/121 efi: cper: Fix possible out-of-bounds access
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 45b14a4ffcc1e0b5caa246638f942cbe7eaea7ad ]
When checking a generic status block, we iterate over all the generic data blocks. The loop condition only checks that the start of the generic data block is valid (within estatus->data_length) but not the whole block. Because the size of data blocks (excluding error data) may vary depending on the revision and the revision is contained within the data block, ensure that enough of the current data block is valid before dereferencing any members otherwise an out-of-bounds access may occur if estatus->data_length is invalid.
This relies on the fact that struct acpi_hest_generic_data_v300 is a superset of the earlier version. Also rework the other checks to avoid potential underflow.
--- drivers/firmware/efi/cper.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/firmware/efi/cper.c +9 -4
@@ -641,19 +641,24 @@ EXPORT_SYMBOL_GPL(cper_estatus_check_header);int cper_estatus_check (const struct acpi_hest_generic_status *estatus) {struct acpi_hest_generic_data *gdata; -unsigned int data_len, gedata_len; +unsigned int data_len, record_size;int rc; rc =cper_estatus_check_header (estatus);if (rc)return rc; + data_len = estatus->data_length;apei_estatus_for_each_section (estatus, gdata) { - gedata_len =acpi_hest_get_error_length (gdata); -if (gedata_len > data_len -acpi_hest_get_size (gdata)) +if (sizeof (struct acpi_hest_generic_data ) > data_len) +return -EINVAL ; + + record_size =acpi_hest_get_record_size (gdata); +if (record_size > data_len)return -EINVAL ; - data_len -=acpi_hest_get_record_size (gdata); + + data_len -= record_size; }if (data_len)return -EINVAL ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 55/121 scsi: megaraid_sas: return error when create DMA pool failed
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit bcf3b67d16a4c8ffae0aa79de5853435e683945c ]
when create DMA pool for cmd frames failed, we should return -ENOMEM, instead of 0.
In some case in:
megasas_init_adapter_fusion()
-->megasas_alloc_cmds()
-->megasas_create_frame_pool
create DMA pool failed,
--> megasas_free_cmds() [1]
-->megasas_alloc_cmds_fusion()
failed, then goto fail_alloc_cmds.
-->megasas_free_cmds() [2]we will call megasas_free_cmds twice, [1] will kfree cmd_list,
[2] will use cmd_list.it will cause a problem:
Unable to handle kernel NULL pointer dereference at virtual address
00000000
pgd = ffffffc000f70000
[00000000] *pgd=0000001fbf893003, *pud=0000001fbf893003, *pmd=0000001fbf894003, *pte=006000006d000707
Internal error: Oops: 96000005 [#1] SMP Modules linked in: CPU: 18 PID: 1 Comm: swapper/0 Not tainted task: ffffffdfb9290000 ti: ffffffdfb923c000 task.ti: ffffffdfb923c000 PC is at megasas_free_cmds+0x30/0x70 LR is at megasas_free_cmds+0x24/0x70 ... Call trace: [<ffffffc0005b779c>] megasas_free_cmds+0x30/0x70 [<ffffffc0005bca74>] megasas_init_adapter_fusion+0x2f4/0x4d8 [<ffffffc0005b926c>] megasas_init_fw+0x2dc/0x760 [<ffffffc0005b9ab0>] megasas_probe_one+0x3c0/0xcd8 [<ffffffc0004a5abc>] local_pci_probe+0x4c/0xb4 [<ffffffc0004a5c40>] pci_device_probe+0x11c/0x14c [<ffffffc00053a5e4>] driver_probe_device+0x1ec/0x430 [<ffffffc00053a92c>] __driver_attach+0xa8/0xb0 [<ffffffc000538178>] bus_for_each_dev+0x74/0xc8 [<ffffffc000539e88>] driver_attach+0x28/0x34 [<ffffffc000539a18>] bus_add_driver+0x16c/0x248 [<ffffffc00053b234>] driver_register+0x6c/0x138 [<ffffffc0004a5350>] __pci_register_driver+0x5c/0x6c [<ffffffc000ce3868>] megasas_init+0xc0/0x1a8 [<ffffffc000082a58>] do_one_initcall+0xe8/0x1ec [<ffffffc000ca7be8>] kernel_init_freeable+0x1c8/0x284 [<ffffffc0008d90b8>] kernel_init+0x1c/0xe4
--- drivers/scsi/megaraid/megaraid_sas_base.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/megaraid/megaraid_sas_base.c +1 -0
@@ -4087,6 +4087,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance)if (megasas_create_frame_pool (instance)) {dev_printk (KERN_DEBUG , &instance->pdev->dev,"Error creating frame DMA pool\n" );megasas_free_cmds (instance); +return -ENOMEM ; }return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 56/121 scsi: fcoe: make use of fip_mode enum complete
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8beb90aaf334a6efa3e924339926b5f93a234dbb ]
commit 1917d42d14b7 ("fcoe: use enum for fip_mode") introduces a separate enum for the fip_mode that shall be used during initialisation handling until it is passed to fcoe_ctrl_link_up to set the initial fip_state. That change was incomplete and gcc quietly converted in various places between the fip_mode and the fip_state enum values with implicit enum conversions, which fortunately cannot cause any issues in the actual code's execution.
clang however warns about these implicit enum conversions in the scsi drivers. This commit consolidates the use of the two enums, guided by clang's enum-conversion warnings.
This commit now completes the use of the fip_mode: It expects and uses fip_mode in {bnx2fc,fcoe}_interface_create and fcoe_ctlr_init, and it calls fcoe_ctrl_set_set() with the correct values in fcoe_ctlr_link_up(). It also breaks the association between FIP_MODE_AUTO and FIP_ST_AUTO to indicate these two enums are distinct.
--- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +- drivers/scsi/fcoe/fcoe.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 7 +++++-- drivers/scsi/fcoe/fcoe_transport.c | 2 +- drivers/scsi/qedf/qedf_main.c | 2 +- include/scsi/libfcoe.h | 4 ++-- 6 files changed, 11 insertions(+), 8 deletions(-)
drivers/scsi/bnx2fc/bnx2fc_fcoe.c +1 -1
@@ -1445,7 +1445,7 @@ bind_err:static struct bnx2fc_interface *bnx2fc_interface_create (struct bnx2fc_hba *hba,struct net_device *netdev, -enum fip_state fip_mode) +enum fip_mode fip_mode) {struct fcoe_ctlr_device *ctlr_dev;struct bnx2fc_interface *interface;
drivers/scsi/fcoe/fcoe.c +1 -1
@@ -390,7 +390,7 @@ static int fcoe_interface_setup(struct fcoe_interface *fcoe,* Returns: pointer to a struct fcoe_interface or NULL on error */ static struct fcoe_interface *fcoe_interface_create (struct net_device *netdev, -enum fip_state fip_mode) +enum fip_mode fip_mode) {struct fcoe_ctlr_device *ctlr_dev;struct fcoe_ctlr *ctlr;
drivers/scsi/fcoe/fcoe_ctlr.c +5 -2
@@ -147,7 +147,7 @@ static void fcoe_ctlr_map_dest(struct fcoe_ctlr *fip)* fcoe_ctlr_init() - Initialize the FCoE Controller instance * @fip: The FCoE controller to initialize */ -void fcoe_ctlr_init (struct fcoe_ctlr *fip,enum fip_state mode) +void fcoe_ctlr_init (struct fcoe_ctlr *fip,enum fip_mode mode) {fcoe_ctlr_set_state (fip,FIP_ST_LINK_WAIT ); fip->mode = mode;
@@ -454,7 +454,10 @@ void fcoe_ctlr_link_up(struct fcoe_ctlr *fip)mutex_unlock (&fip->ctlr_mutex);fc_linkup (fip->lp); }else if (fip->state ==FIP_ST_LINK_WAIT ) { -fcoe_ctlr_set_state (fip, fip->mode); +if (fip->mode ==FIP_MODE_NON_FIP ) +fcoe_ctlr_set_state (fip,FIP_ST_NON_FIP ); +else +fcoe_ctlr_set_state (fip,FIP_ST_AUTO );switch (fip->mode) {default :LIBFCOE_FIP_DBG (fip,"invalid mode %d\n" , fip->mode);
drivers/scsi/fcoe/fcoe_transport.c +1 -1
@@ -870,7 +870,7 @@ static int fcoe_transport_create(const char *buffer, struct kernel_param *kp)int rc = -ENODEV ;struct net_device *netdev =NULL ;struct fcoe_transport *ft =NULL ; -enum fip_state fip_mode = (enum fip_state )(long )kp->arg; +enum fip_mode fip_mode = (enum fip_mode )kp->arg;mutex_lock (&ft_mutex);
drivers/scsi/qedf/qedf_main.c +1 -1
@@ -1382,7 +1382,7 @@ static struct libfc_function_template qedf_lport_template = {static void qedf_fcoe_ctlr_setup (struct qedf_ctx *qedf) { -fcoe_ctlr_init (&qedf->ctlr,FIP_ST_AUTO ); +fcoe_ctlr_init (&qedf->ctlr,FIP_MODE_AUTO ); qedf->ctlr.send = qedf_fip_send; qedf->ctlr.get_src_addr = qedf_get_src_mac;
include/scsi/libfcoe.h +2 -2
@@ -79,7 +79,7 @@ enum fip_state {* It must not change after fcoe_ctlr_init() sets it. */ enum fip_mode { -FIP_MODE_AUTO =FIP_ST_AUTO , +FIP_MODE_AUTO ,FIP_MODE_NON_FIP ,FIP_MODE_FABRIC ,FIP_MODE_VN2VN ,
@@ -250,7 +250,7 @@ struct fcoe_rport { };/* FIP API functions */ -void fcoe_ctlr_init (struct fcoe_ctlr *,enum fip_state ); +void fcoe_ctlr_init (struct fcoe_ctlr *,enum fip_mode );void fcoe_ctlr_destroy (struct fcoe_ctlr *);void fcoe_ctlr_link_up (struct fcoe_ctlr *);int fcoe_ctlr_link_down (struct fcoe_ctlr *);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 57/121 perf test: Fix failure of evsel-tp-sched test on s390
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 03d309711d687460d1345de8a0363f45b1c8cd11 ]
Commit 489338a717a0 ("perf tests evsel-tp-sched: Fix bitwise operator") causes test case 14 "Parse sched tracepoints fields" to fail on s390.
This test succeeds on x86.
In fact this test now fails on all architectures with type char treated as type unsigned char.
The root cause is the signed-ness of character arrays in the tracepoints sched_switch for structure members prev_comm and next_comm.
On s390 the output of:
[root@m35lp76 perf]# cat /sys/kernel/debug/tracing/events/sched/sched_switch/format
name: sched_switch
ID: 287
format:
field:unsigned short common_type; offset:0; size:2; signed:0;
...
field:char prev_comm[16]; offset:8; size:16; signed:0;
...
field:char next_comm[16]; offset:40; size:16; signed:0;
reveals the character arrays prev_comm and next_comm are per default unsigned char and have values in the range of 0..255.
On x86 both fields are signed as this output shows:
[root@f29]# cat /sys/kernel/debug/tracing/events/sched/sched_switch/format name: sched_switch ID: 287 format: field:unsigned short common_type; offset:0; size:2; signed:0; ... field:char prev_comm[16]; offset:8; size:16; signed:1; ... field:char next_comm[16]; offset:40; size:16; signed:1;
and the character arrays prev_comm and next_comm are per default signed char and have values in the range of -1..127. The implementation of type char is architecture specific.
Since the character arrays in both tracepoints sched_switch and sched_wakeup should contain ascii characters, simply omit the check for signedness in the test case.
Output before:
[root@m35lp76 perf]# ./perf test -F 14
14: Parse sched tracepoints fields :
--- start ---
sched:sched_switch: "prev_comm" signedness(0) is wrong, should be 1 sched:sched_switch: "next_comm" signedness(0) is wrong, should be 1 sched:sched_wakeup: "comm" signedness(0) is wrong, should be 1 ---- end ----
14: Parse sched tracepoints fields : FAILED!
[root@m35lp76 perf]#
Output after:
[root@m35lp76 perf]# ./perf test -Fv 14
14: Parse sched tracepoints fields :
--- start ---
---- end ----
Parse sched tracepoints fields: Ok
[root@m35lp76 perf]#
--- tools/perf/tests/evsel-tp-sched.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/perf/tests/evsel-tp-sched.c +3 -3
@@ -43,7 +43,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtesreturn -1 ; } -if (perf_evsel__test_field (evsel,"prev_comm" ,16 , true)) +if (perf_evsel__test_field (evsel,"prev_comm" ,16 , false)) ret =-1 ;if (perf_evsel__test_field (evsel,"prev_pid" ,4 , true))
@@ -55,7 +55,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtesif (perf_evsel__test_field (evsel,"prev_state" ,sizeof (long ), true)) ret =-1 ; -if (perf_evsel__test_field (evsel,"next_comm" ,16 , true)) +if (perf_evsel__test_field (evsel,"next_comm" ,16 , false)) ret =-1 ;if (perf_evsel__test_field (evsel,"next_pid" ,4 , true))
@@ -73,7 +73,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtesreturn -1 ; } -if (perf_evsel__test_field (evsel,"comm" ,16 , true)) +if (perf_evsel__test_field (evsel,"comm" ,16 , false)) ret =-1 ;if (perf_evsel__test_field (evsel,"pid" ,4 , true))
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 58/121 SoC: imx-sgtl5000: add missing put_device()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8fa857da9744f513036df1c43ab57f338941ae7d ]
The of_find_device_by_node() takes a reference to the underlying device structure, we should release that reference.
Detected by coccinelle with the following warnings:
./sound/soc/fsl/imx-sgtl5000.c:169:1-7: ERROR: missing put_device; call of_find_device_by_node on line 105, but without a corresponding object release within this function. ./sound/soc/fsl/imx-sgtl5000.c:177:1-7: ERROR: missing put_device; call of_find_device_by_node on line 105, but without a corresponding object release within this function.
--- sound/soc/fsl/imx-sgtl5000.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/imx-sgtl5000.c +1 -0
@@ -115,6 +115,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) ret = -EPROBE_DEFER ; goto fail; } +put_device (&ssi_pdev->dev); codec_dev =of_find_i2c_device_by_node (codec_np);if (!codec_dev) {dev_err (&pdev->dev,"failed to find codec platform device\n" );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 59/121 media: sh_veu: Correct return type for mem2mem buffer helpers
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 43c145195c7fc3025ee7ecfc67112ac1c82af7c2 ]
Fix the assigned type of mem2mem buffer handling API. Namely, these functions:
v4l2_m2m_next_buf
v4l2_m2m_last_buf
v4l2_m2m_buf_remove
v4l2_m2m_next_src_buf
v4l2_m2m_next_dst_buf
v4l2_m2m_last_src_buf
v4l2_m2m_last_dst_buf
v4l2_m2m_src_buf_remove
v4l2_m2m_dst_buf_remove
return a struct vb2_v4l2_buffer, and not a struct vb2_buffer.
Fixing this is necessary to fix the mem2mem buffer handling API, changing the return to the correct struct vb2_v4l2_buffer instead of a void pointer.
--- drivers/media/platform/sh_veu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/platform/sh_veu.c +2 -2
@@ -276,13 +276,13 @@ static void sh_veu_process(struct sh_veu_dev *veu,static void sh_veu_device_run (void *priv) {struct sh_veu_dev *veu = priv; -struct vb2_buffer *src_buf, *dst_buf; +struct vb2_v4l2_buffer *src_buf, *dst_buf; src_buf =v4l2_m2m_next_src_buf (veu->m2m_ctx); dst_buf =v4l2_m2m_next_dst_buf (veu->m2m_ctx);if (src_buf && dst_buf) -sh_veu_process (veu, src_buf, dst_buf); +sh_veu_process (veu, &src_buf->vb2_buf, &dst_buf->vb2_buf); }/* ========== video ioctls ========== */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 60/121 media: s5p-jpeg: Correct return type for mem2mem buffer helpers
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4a88f89885c7cf65c62793f385261a6e3315178a ]
Fix the assigned type of mem2mem buffer handling API. Namely, these functions:
v4l2_m2m_next_buf
v4l2_m2m_last_buf
v4l2_m2m_buf_remove
v4l2_m2m_next_src_buf
v4l2_m2m_next_dst_buf
v4l2_m2m_last_src_buf
v4l2_m2m_last_dst_buf
v4l2_m2m_src_buf_remove
v4l2_m2m_dst_buf_remove
return a struct vb2_v4l2_buffer, and not a struct vb2_buffer.
Fixing this is necessary to fix the mem2mem buffer handling API, changing the return to the correct struct vb2_v4l2_buffer instead of a void pointer.
--- drivers/media/platform/s5p-jpeg/jpeg-core.c | 38 ++++++++++----------- 1 file changed, 19 insertions(+), 19 deletions(-)
drivers/media/platform/s5p-jpeg/jpeg-core.c +19 -19
@@ -793,14 +793,14 @@ static void skip(struct s5p_jpeg_buffer *buf, long len);static void exynos4_jpeg_parse_decode_h_tbl (struct s5p_jpeg_ctx *ctx) {struct s5p_jpeg *jpeg = ctx->jpeg; -struct vb2_buffer *vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); +struct vb2_v4l2_buffer *vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx);struct s5p_jpeg_buffer jpeg_buffer;unsigned int word;int c, x, components; jpeg_buffer.size =2 ;/* Ls */ jpeg_buffer.data = - (unsigned long )vb2_plane_vaddr (vb,0 ) + ctx->out_q.sos +2 ; + (unsigned long )vb2_plane_vaddr (&vb->vb2_buf,0 ) + ctx->out_q.sos +2 ; jpeg_buffer.curr =0 ; word =0 ;
@@ -830,14 +830,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx)static void exynos4_jpeg_parse_huff_tbl (struct s5p_jpeg_ctx *ctx) {struct s5p_jpeg *jpeg = ctx->jpeg; -struct vb2_buffer *vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); +struct vb2_v4l2_buffer *vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx);struct s5p_jpeg_buffer jpeg_buffer;unsigned int word;int c, i, n, j;for (j =0 ; j < ctx->out_q.dht.n; ++j) { jpeg_buffer.size = ctx->out_q.dht.len[j]; - jpeg_buffer.data = (unsigned long )vb2_plane_vaddr (vb,0 ) + + jpeg_buffer.data = (unsigned long )vb2_plane_vaddr (&vb->vb2_buf,0 ) + ctx->out_q.dht.marker[j]; jpeg_buffer.curr =0 ;
@@ -889,13 +889,13 @@ static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx)static void exynos4_jpeg_parse_decode_q_tbl (struct s5p_jpeg_ctx *ctx) {struct s5p_jpeg *jpeg = ctx->jpeg; -struct vb2_buffer *vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); +struct vb2_v4l2_buffer *vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx);struct s5p_jpeg_buffer jpeg_buffer;int c, x, components; jpeg_buffer.size = ctx->out_q.sof_len; jpeg_buffer.data = - (unsigned long )vb2_plane_vaddr (vb,0 ) + ctx->out_q.sof; + (unsigned long )vb2_plane_vaddr (&vb->vb2_buf,0 ) + ctx->out_q.sof; jpeg_buffer.curr =0 ;skip (&jpeg_buffer,5 );/* P, Y, X */
@@ -920,14 +920,14 @@ static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx)static void exynos4_jpeg_parse_q_tbl (struct s5p_jpeg_ctx *ctx) {struct s5p_jpeg *jpeg = ctx->jpeg; -struct vb2_buffer *vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); +struct vb2_v4l2_buffer *vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx);struct s5p_jpeg_buffer jpeg_buffer;unsigned int word;int c, i, j;for (j =0 ; j < ctx->out_q.dqt.n; ++j) { jpeg_buffer.size = ctx->out_q.dqt.len[j]; - jpeg_buffer.data = (unsigned long )vb2_plane_vaddr (vb,0 ) + + jpeg_buffer.data = (unsigned long )vb2_plane_vaddr (&vb->vb2_buf,0 ) + ctx->out_q.dqt.marker[j]; jpeg_buffer.curr =0 ;
@@ -2072,15 +2072,15 @@ static void s5p_jpeg_device_run(void *priv) {struct s5p_jpeg_ctx *ctx = priv;struct s5p_jpeg *jpeg = ctx->jpeg; -struct vb2_buffer *src_buf, *dst_buf; +struct vb2_v4l2_buffer *src_buf, *dst_buf;unsigned long src_addr, dst_addr, flags;spin_lock_irqsave (&ctx->jpeg->slock, flags); src_buf =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); dst_buf =v4l2_m2m_next_dst_buf (ctx->fh.m2m_ctx); - src_addr =vb2_dma_contig_plane_dma_addr (src_buf,0 ); - dst_addr =vb2_dma_contig_plane_dma_addr (dst_buf,0 ); + src_addr =vb2_dma_contig_plane_dma_addr (&src_buf->vb2_buf,0 ); + dst_addr =vb2_dma_contig_plane_dma_addr (&dst_buf->vb2_buf,0 );s5p_jpeg_reset (jpeg->regs);s5p_jpeg_poweron (jpeg->regs);
@@ -2153,7 +2153,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) {struct s5p_jpeg *jpeg = ctx->jpeg;struct s5p_jpeg_fmt *fmt; -struct vb2_buffer *vb; +struct vb2_v4l2_buffer *vb;struct s5p_jpeg_addr jpeg_addr = {};u32 pix_size, padding_bytes =0 ;
@@ -2172,7 +2172,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) vb =v4l2_m2m_next_dst_buf (ctx->fh.m2m_ctx); } - jpeg_addr.y =vb2_dma_contig_plane_dma_addr (vb,0 ); + jpeg_addr.y =vb2_dma_contig_plane_dma_addr (&vb->vb2_buf,0 );if (fmt->colplanes ==2 ) { jpeg_addr.cb = jpeg_addr.y + pix_size - padding_bytes;
@@ -2190,7 +2190,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)static void exynos4_jpeg_set_jpeg_addr (struct s5p_jpeg_ctx *ctx) {struct s5p_jpeg *jpeg = ctx->jpeg; -struct vb2_buffer *vb; +struct vb2_v4l2_buffer *vb;unsigned int jpeg_addr =0 ;if (ctx->mode ==S5P_JPEG_ENCODE )
@@ -2198,7 +2198,7 @@ static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)else vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); - jpeg_addr =vb2_dma_contig_plane_dma_addr (vb,0 ); + jpeg_addr =vb2_dma_contig_plane_dma_addr (&vb->vb2_buf,0 );if (jpeg->variant->version ==SJPEG_EXYNOS5433 && ctx->mode ==S5P_JPEG_DECODE ) jpeg_addr += ctx->out_q.sos;
@@ -2314,7 +2314,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) {struct s5p_jpeg *jpeg = ctx->jpeg;struct s5p_jpeg_fmt *fmt; -struct vb2_buffer *vb; +struct vb2_v4l2_buffer *vb;struct s5p_jpeg_addr jpeg_addr = {};u32 pix_size;
@@ -2328,7 +2328,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) fmt = ctx->cap_q.fmt; } - jpeg_addr.y =vb2_dma_contig_plane_dma_addr (vb,0 ); + jpeg_addr.y =vb2_dma_contig_plane_dma_addr (&vb->vb2_buf,0 );if (fmt->colplanes ==2 ) { jpeg_addr.cb = jpeg_addr.y + pix_size;
@@ -2346,7 +2346,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)static void exynos3250_jpeg_set_jpeg_addr (struct s5p_jpeg_ctx *ctx) {struct s5p_jpeg *jpeg = ctx->jpeg; -struct vb2_buffer *vb; +struct vb2_v4l2_buffer *vb;unsigned int jpeg_addr =0 ;if (ctx->mode ==S5P_JPEG_ENCODE )
@@ -2354,7 +2354,7 @@ static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)else vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); - jpeg_addr =vb2_dma_contig_plane_dma_addr (vb,0 ); + jpeg_addr =vb2_dma_contig_plane_dma_addr (&vb->vb2_buf,0 );exynos3250_jpeg_jpgadr (jpeg->regs, jpeg_addr); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 61/121 media: s5p-g2d: Correct return type for mem2mem buffer helpers
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 30fa627b32230737bc3f678067e2adfecf956987 ]
Fix the assigned type of mem2mem buffer handling API. Namely, these functions:
v4l2_m2m_next_buf
v4l2_m2m_last_buf
v4l2_m2m_buf_remove
v4l2_m2m_next_src_buf
v4l2_m2m_next_dst_buf
v4l2_m2m_last_src_buf
v4l2_m2m_last_dst_buf
v4l2_m2m_src_buf_remove
v4l2_m2m_dst_buf_remove
return a struct vb2_v4l2_buffer, and not a struct vb2_buffer.
Fixing this is necessary to fix the mem2mem buffer handling API, changing the return to the correct struct vb2_v4l2_buffer instead of a void pointer.
--- drivers/media/platform/s5p-g2d/g2d.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/s5p-g2d/g2d.c +3 -3
@@ -498,7 +498,7 @@ static void device_run(void *prv) {struct g2d_ctx *ctx = prv;struct g2d_dev *dev = ctx->dev; -struct vb2_buffer *src, *dst; +struct vb2_v4l2_buffer *src, *dst;unsigned long flags;u32 cmd =0 ;
@@ -513,10 +513,10 @@ static void device_run(void *prv)spin_lock_irqsave (&dev->ctrl_lock, flags);g2d_set_src_size (dev, &ctx->in); -g2d_set_src_addr (dev,vb2_dma_contig_plane_dma_addr (src,0 )); +g2d_set_src_addr (dev,vb2_dma_contig_plane_dma_addr (&src->vb2_buf,0 ));g2d_set_dst_size (dev, &ctx->out); -g2d_set_dst_addr (dev,vb2_dma_contig_plane_dma_addr (dst,0 )); +g2d_set_dst_addr (dev,vb2_dma_contig_plane_dma_addr (&dst->vb2_buf,0 ));g2d_set_rop4 (dev, ctx->rop);g2d_set_flip (dev, ctx->flip);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 62/121 media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8d20dcefe471763f23ad538369ec65b51993ffff ]
Fix the assigned type of mem2mem buffer handling API. Namely, these functions:
v4l2_m2m_next_buf
v4l2_m2m_last_buf
v4l2_m2m_buf_remove
v4l2_m2m_next_src_buf
v4l2_m2m_next_dst_buf
v4l2_m2m_last_src_buf
v4l2_m2m_last_dst_buf
v4l2_m2m_src_buf_remove
v4l2_m2m_dst_buf_remove
return a struct vb2_v4l2_buffer, and not a struct vb2_buffer.
Fixing this is necessary to fix the mem2mem buffer handling API, changing the return to the correct struct vb2_v4l2_buffer instead of a void pointer.
--- drivers/media/platform/mx2_emmaprp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/mx2_emmaprp.c +3 -3
@@ -288,7 +288,7 @@ static void emmaprp_device_run(void *priv) {struct emmaprp_ctx *ctx = priv;struct emmaprp_q_data *s_q_data, *d_q_data; -struct vb2_buffer *src_buf, *dst_buf; +struct vb2_v4l2_buffer *src_buf, *dst_buf;struct emmaprp_dev *pcdev = ctx->dev;unsigned int s_width, s_height;unsigned int d_width, d_height;
@@ -308,8 +308,8 @@ static void emmaprp_device_run(void *priv) d_height = d_q_data->height; d_size = d_width * d_height; - p_in =vb2_dma_contig_plane_dma_addr (src_buf,0 ); - p_out =vb2_dma_contig_plane_dma_addr (dst_buf,0 ); + p_in =vb2_dma_contig_plane_dma_addr (&src_buf->vb2_buf,0 ); + p_out =vb2_dma_contig_plane_dma_addr (&dst_buf->vb2_buf,0 );if (!p_in || !p_out) {v4l2_err (&pcdev->v4l2_dev,"Acquiring kernel pointers to buffers failed\n" );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 63/121 media: mtk-jpeg: Correct return type for mem2mem buffer helpers
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1b275e4e8b70dbff9850874b30831c1bd8d3c504 ]
Fix the assigned type of mem2mem buffer handling API. Namely, these functions:
v4l2_m2m_next_buf
v4l2_m2m_last_buf
v4l2_m2m_buf_remove
v4l2_m2m_next_src_buf
v4l2_m2m_next_dst_buf
v4l2_m2m_last_src_buf
v4l2_m2m_last_dst_buf
v4l2_m2m_src_buf_remove
v4l2_m2m_dst_buf_remove
return a struct vb2_v4l2_buffer, and not a struct vb2_buffer.
Fixing this is necessary to fix the mem2mem buffer handling API, changing the return to the correct struct vb2_v4l2_buffer instead of a void pointer.
--- .../media/platform/mtk-jpeg/mtk_jpeg_core.c | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-)
drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c +20 -20
@@ -702,7 +702,7 @@ end:v4l2_m2m_buf_queue (ctx->fh.m2m_ctx,to_vb2_v4l2_buffer (vb)); } -static void *mtk_jpeg_buf_remove (struct mtk_jpeg_ctx *ctx, +static struct vb2_v4l2_buffer *mtk_jpeg_buf_remove (struct mtk_jpeg_ctx *ctx,enum v4l2_buf_type type) {if (V4L2_TYPE_IS_OUTPUT (type))
@@ -714,7 +714,7 @@ static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx,static int mtk_jpeg_start_streaming (struct vb2_queue *q,unsigned int count) {struct mtk_jpeg_ctx *ctx =vb2_get_drv_priv (q); -struct vb2_buffer *vb; +struct vb2_v4l2_buffer *vb;int ret =0 ; ret =pm_runtime_get_sync (ctx->jpeg->dev);
@@ -724,14 +724,14 @@ static int mtk_jpeg_start_streaming(struct vb2_queue *q, unsigned int count)return 0 ; err:while ((vb =mtk_jpeg_buf_remove (ctx, q->type))) -v4l2_m2m_buf_done (to_vb2_v4l2_buffer (vb),VB2_BUF_STATE_QUEUED ); +v4l2_m2m_buf_done (vb,VB2_BUF_STATE_QUEUED );return ret; }static void mtk_jpeg_stop_streaming (struct vb2_queue *q) {struct mtk_jpeg_ctx *ctx =vb2_get_drv_priv (q); -struct vb2_buffer *vb; +struct vb2_v4l2_buffer *vb;/* * STREAMOFF is an acknowledgment for source change event.
@@ -743,7 +743,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q)struct mtk_jpeg_src_buf *src_buf; vb =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); - src_buf =mtk_jpeg_vb2_to_srcbuf (vb); + src_buf =mtk_jpeg_vb2_to_srcbuf (&vb->vb2_buf);mtk_jpeg_set_queue_data (ctx, &src_buf->dec_param); ctx->state =MTK_JPEG_RUNNING ; }else if (V4L2_TYPE_IS_OUTPUT (q->type)) {
@@ -751,7 +751,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q) }while ((vb =mtk_jpeg_buf_remove (ctx, q->type))) -v4l2_m2m_buf_done (to_vb2_v4l2_buffer (vb),VB2_BUF_STATE_ERROR ); +v4l2_m2m_buf_done (vb,VB2_BUF_STATE_ERROR );pm_runtime_put_sync (ctx->jpeg->dev); }
@@ -807,7 +807,7 @@ static void mtk_jpeg_device_run(void *priv) {struct mtk_jpeg_ctx *ctx = priv;struct mtk_jpeg_dev *jpeg = ctx->jpeg; -struct vb2_buffer *src_buf, *dst_buf; +struct vb2_v4l2_buffer *src_buf, *dst_buf;enum vb2_buffer_state buf_state =VB2_BUF_STATE_ERROR ;unsigned long flags;struct mtk_jpeg_src_buf *jpeg_src_buf;
@@ -817,11 +817,11 @@ static void mtk_jpeg_device_run(void *priv) src_buf =v4l2_m2m_next_src_buf (ctx->fh.m2m_ctx); dst_buf =v4l2_m2m_next_dst_buf (ctx->fh.m2m_ctx); - jpeg_src_buf =mtk_jpeg_vb2_to_srcbuf (src_buf); + jpeg_src_buf =mtk_jpeg_vb2_to_srcbuf (&src_buf->vb2_buf);if (jpeg_src_buf->flags &MTK_JPEG_BUF_FLAGS_LAST_FRAME ) { -for (i =0 ; i < dst_buf->num_planes; i++) -vb2_set_plane_payload (dst_buf, i,0 ); +for (i =0 ; i < dst_buf->vb2_buf.num_planes; i++) +vb2_set_plane_payload (&dst_buf->vb2_buf, i,0 ); buf_state =VB2_BUF_STATE_DONE ; goto dec_end; }
@@ -833,8 +833,8 @@ static void mtk_jpeg_device_run(void *priv)return ; } -mtk_jpeg_set_dec_src (ctx, src_buf, &bs); -if (mtk_jpeg_set_dec_dst (ctx, &jpeg_src_buf->dec_param, dst_buf, &fb)) +mtk_jpeg_set_dec_src (ctx, &src_buf->vb2_buf, &bs); +if (mtk_jpeg_set_dec_dst (ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb)) goto dec_end;spin_lock_irqsave (&jpeg->hw_lock, flags);
@@ -849,8 +849,8 @@ static void mtk_jpeg_device_run(void *priv) dec_end:v4l2_m2m_src_buf_remove (ctx->fh.m2m_ctx);v4l2_m2m_dst_buf_remove (ctx->fh.m2m_ctx); -v4l2_m2m_buf_done (to_vb2_v4l2_buffer (src_buf), buf_state); -v4l2_m2m_buf_done (to_vb2_v4l2_buffer (dst_buf), buf_state); +v4l2_m2m_buf_done (src_buf, buf_state); +v4l2_m2m_buf_done (dst_buf, buf_state);v4l2_m2m_job_finish (jpeg->m2m_dev, ctx->fh.m2m_ctx); }
@@ -926,7 +926,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) {struct mtk_jpeg_dev *jpeg = priv;struct mtk_jpeg_ctx *ctx; -struct vb2_buffer *src_buf, *dst_buf; +struct vb2_v4l2_buffer *src_buf, *dst_buf;struct mtk_jpeg_src_buf *jpeg_src_buf;enum vb2_buffer_state buf_state =VB2_BUF_STATE_ERROR ;u32 dec_irq_ret;
@@ -943,7 +943,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) src_buf =v4l2_m2m_src_buf_remove (ctx->fh.m2m_ctx); dst_buf =v4l2_m2m_dst_buf_remove (ctx->fh.m2m_ctx); - jpeg_src_buf =mtk_jpeg_vb2_to_srcbuf (src_buf); + jpeg_src_buf =mtk_jpeg_vb2_to_srcbuf (&src_buf->vb2_buf);if (dec_irq_ret >=MTK_JPEG_DEC_RESULT_UNDERFLOW )mtk_jpeg_dec_reset (jpeg->dec_reg_base);
@@ -953,15 +953,15 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) goto dec_end; } -for (i =0 ; i < dst_buf->num_planes; i++) -vb2_set_plane_payload (dst_buf, i, +for (i =0 ; i < dst_buf->vb2_buf.num_planes; i++) +vb2_set_plane_payload (&dst_buf->vb2_buf, i, jpeg_src_buf->dec_param.comp_size[i]); buf_state =VB2_BUF_STATE_DONE ; dec_end: -v4l2_m2m_buf_done (to_vb2_v4l2_buffer (src_buf), buf_state); -v4l2_m2m_buf_done (to_vb2_v4l2_buffer (dst_buf), buf_state); +v4l2_m2m_buf_done (src_buf, buf_state); +v4l2_m2m_buf_done (dst_buf, buf_state);v4l2_m2m_job_finish (jpeg->m2m_dev, ctx->fh.m2m_ctx);return IRQ_HANDLED ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 64/121 vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cc4b1242d7e3b42eed73881fc749944146493e4f ]
The preadv2 and pwritev2 syscalls are supposed to emulate the readv and writev syscalls when offset == -1. Therefore the compat code should check for offset before calling do_compat_preadv64 and do_compat_pwritev64. This is the case for the preadv2 and pwritev2 syscalls, but handling of offset == -1 is missing in their 64-bit equivalent.
This patch fixes that, calling do_compat_readv and do_compat_writev when offset == -1. This fixes the following glibc tests on x32:
- misc/tst-preadvwritev2
- misc/tst-preadvwritev64v2
--- fs/read_write.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/read_write.c +6 -0
@@ -1235,6 +1235,9 @@ COMPAT_SYSCALL_DEFINE5(preadv64v2, unsigned long, fd, const struct compat_iovec __user *,vec, unsigned long, vlen, loff_t, pos, rwf_t, flags) { + if (pos == -1) + return do_compat_readv(fd, vec, vlen, flags); +return do_compat_preadv64 (fd, vec, vlen, pos, flags); }#endif
@@ -1341,6 +1344,9 @@ COMPAT_SYSCALL_DEFINE5(pwritev64v2, unsigned long, fd, const struct compat_iovec __user *,vec, unsigned long, vlen, loff_t, pos, rwf_t, flags) { + if (pos == -1) + return do_compat_writev(fd, vec, vlen, flags); +return do_compat_pwritev64 (fd, vec, vlen, pos, flags); }#endif
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 65/121 HID: intel-ish-hid: avoid binding wrong ishtp_cl_device
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0d28f49412405d87d3aae83da255070a46e67627 ]
When performing a warm reset in ishtp bus driver, the ishtp_cl_device will not be removed, its fw_client still points to the already freed ishtp_device.fw_clients array.
Later after driver finishing ishtp client enumeration, this dangling pointer may cause driver to bind the wrong ishtp_cl_device to the new client, causing wrong callback to be called for messages intended for the new client.
This helps in development of firmware where frequent switching of firmwares is required without Linux reboot.
--- drivers/hid/intel-ish-hid/ishtp/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/intel-ish-hid/ishtp/bus.c +3 -1
@@ -623,7 +623,8 @@ int ishtp_cl_device_bind(struct ishtp_cl *cl)spin_lock_irqsave (&cl->dev->device_list_lock, flags);list_for_each_entry (cl_device, &cl->dev->device_list, device_link) { -if (cl_device->fw_client->client_id == cl->fw_client_id) { +if (cl_device->fw_client && + cl_device->fw_client->client_id == cl->fw_client_id) { cl->device = cl_device; rv =0 ;break ;
@@ -683,6 +684,7 @@ void ishtp_bus_remove_all_clients(struct ishtp_device *ishtp_dev,spin_lock_irqsave (&ishtp_dev->device_list_lock, flags);list_for_each_entry_safe (cl_device, n, &ishtp_dev->device_list, device_link) { + cl_device->fw_client =NULL ;if (warm_reset && cl_device->reference_count)continue ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 66/121 jbd2: fix race when writing superblock
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 538bcaa6261b77e71d37f5596c33127c1a3ec3f7 ]
The jbd2 superblock is lockless now, so there is probably a race condition between writing it so disk and modifing contents of it, which may lead to checksum error. The following race is the one case that we have captured.
jbd2 fsstressjbd2_journal_commit_transaction
jbd2_journal_update_sb_log_tail
jbd2_write_superblock
jbd2_superblock_csum_set jbd2_journal_revoke
jbd2_journal_set_features(revork) modify superblock
submit_bh(checksum incorrect)
Fix this by locking the buffer head before modifing it. We always write the jbd2 superblock after we modify it, so this just means calling the lock_buffer() a little earlier.
This checksum corruption problem can be reproduced by xfstests generic/475.
--- fs/jbd2/journal.c | 52 ++++++++++++++++++++++++----------------------- 1 file changed, 27 insertions(+), 25 deletions(-)
fs/jbd2/journal.c +27 -25
@@ -1343,6 +1343,10 @@ static int journal_reset(journal_t *journal)return jbd2_journal_start_thread (journal); } +/* +* This function expects that the caller will have locked the journal +* buffer head, and will return with it unlocked +*/ static int jbd2_write_superblock (journal_t *journal,int write_flags) {struct buffer_head *bh = journal->j_sb_buffer;
@@ -1352,7 +1356,6 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)trace_jbd2_write_superblock (journal, write_flags);if (!(journal->j_flags &JBD2_BARRIER )) write_flags &= ~(REQ_FUA |REQ_PREFLUSH ); -lock_buffer (bh);if (buffer_write_io_error (bh)) {/* * Oh, dear. A previous attempt to write the journal
@@ -1411,6 +1414,7 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,jbd_debug (1 ,"JBD2: updating superblock (start %lu, seq %u)\n" , tail_block, tail_tid); +lock_buffer (journal->j_sb_buffer); sb->s_sequence =cpu_to_be32 (tail_tid); sb->s_start =cpu_to_be32 (tail_block);
@@ -1441,18 +1445,17 @@ static void jbd2_mark_journal_empty(journal_t *journal, int write_op)journal_superblock_t *sb = journal->j_superblock;BUG_ON (!mutex_is_locked (&journal->j_checkpoint_mutex)); -read_lock (&journal->j_state_lock); -/* Is it already empty? */ -if (sb->s_start ==0 ) { -read_unlock (&journal->j_state_lock); +lock_buffer (journal->j_sb_buffer); +if (sb->s_start ==0 ) {/* Is it already empty? */ +unlock_buffer (journal->j_sb_buffer);return ; } +jbd_debug (1 ,"JBD2: Marking journal as empty (seq %d)\n" , journal->j_tail_sequence); sb->s_sequence =cpu_to_be32 (journal->j_tail_sequence); sb->s_start =cpu_to_be32 (0 ); -read_unlock (&journal->j_state_lock);jbd2_write_superblock (journal, write_op);
@@ -1475,9 +1478,8 @@ void jbd2_journal_update_sb_errno(journal_t *journal)journal_superblock_t *sb = journal->j_superblock;int errcode; -read_lock (&journal->j_state_lock); +lock_buffer (journal->j_sb_buffer); errcode = journal->j_errno; -read_unlock (&journal->j_state_lock);if (errcode == -ESHUTDOWN ) errcode =0 ;jbd_debug (1 ,"JBD2: updating superblock error (errno %d)\n" , errcode);
@@ -1881,28 +1883,27 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat, sb = journal->j_superblock; +/* Load the checksum driver if necessary */ +if ((journal->j_chksum_driver ==NULL ) && +INCOMPAT_FEATURE_ON (JBD2_FEATURE_INCOMPAT_CSUM_V3 )) { + journal->j_chksum_driver =crypto_alloc_shash ("crc32c" ,0 ,0 ); +if (IS_ERR (journal->j_chksum_driver)) { +printk (KERN_ERR "JBD2: Cannot load crc32c driver.\n" ); + journal->j_chksum_driver =NULL ; +return 0 ; + } +/* Precompute checksum seed for all metadata */ + journal->j_csum_seed =jbd2_chksum (journal, ~0 , sb->s_uuid, +sizeof (sb->s_uuid)); + } + +lock_buffer (journal->j_sb_buffer); +/* If enabling v3 checksums, update superblock */ if (INCOMPAT_FEATURE_ON (JBD2_FEATURE_INCOMPAT_CSUM_V3 )) { sb->s_checksum_type =JBD2_CRC32C_CHKSUM ; sb->s_feature_compat &= ~cpu_to_be32 (JBD2_FEATURE_COMPAT_CHECKSUM ); - -/* Load the checksum driver */ -if (journal->j_chksum_driver ==NULL ) { - journal->j_chksum_driver =crypto_alloc_shash ("crc32c" , -0 ,0 ); -if (IS_ERR (journal->j_chksum_driver)) { -printk (KERN_ERR "JBD2: Cannot load crc32c " -"driver.\n" ); - journal->j_chksum_driver =NULL ; -return 0 ; - } - -/* Precompute checksum seed for all metadata */ - journal->j_csum_seed =jbd2_chksum (journal, ~0 , - sb->s_uuid, -sizeof (sb->s_uuid)); - } }/* If enabling v1 checksums, downgrade superblock */
@@ -1914,6 +1915,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat, sb->s_feature_compat |=cpu_to_be32 (compat); sb->s_feature_ro_compat |=cpu_to_be32 (ro); sb->s_feature_incompat |=cpu_to_be32 (incompat); +unlock_buffer (journal->j_sb_buffer);return 1 ;#undef COMPAT_FEATURE_ON
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 67/121 leds: lp55xx: fix null deref on firmware load failure
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5ddb0869bfc1bca6cfc592c74c64a026f936638c ]
I've stumbled upon a kernel crash and the logs
pointed me towards the lp5562 driver:
Quoted 8 lines
<4>[306013.841294] lp5562 0-0030: Direct firmware load for lp5562 failed with error -2 <4>[306013.894990] lp5562 0-0030: Falling back to user helper ... <3>[306073.924886] lp5562 0-0030: firmware request failed <1>[306073.939456] Unable to handle kernel NULL pointer dereference at virtual address 00000000 <4>[306074.251011] PC is at _raw_spin_lock+0x1c/0x58 <4>[306074.255539] LR is at release_firmware+0x6c/0x138...
After taking a look I noticed firmware_release()
could be called with either NULL or a dangling
pointer.
--- drivers/leds/leds-lp55xx-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/leds/leds-lp55xx-common.c +2 -2
@@ -201,7 +201,7 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context)if (!fw) {dev_err (dev,"firmware request failed\n" ); - goto out; +return ; }/* handling firmware data is chip dependent */
@@ -214,9 +214,9 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context)mutex_unlock (&chip->lock); -out:/* firmware should be released for other channel use */ release_firmware (chip->fw); + chip->fw =NULL ; }static int lp55xx_request_firmware (struct lp55xx_chip *chip)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 68/121 iwlwifi: pcie: fix emergency path
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c6ac9f9fb98851f47b978a9476594fc3c477a34d ]
Allocator swaps the pending requests with 0 when it starts working. This means that relying on it n RX path to decide if to move to emergency is not always a good idea, since it may be zero, but there are still a lot of unallocated RBs in the system. Change allocator to decrement the pending requests on real time. It is more expensive since it accesses the atomic variable more times, but it gives the RX path a better idea of the system's status.
--- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/rx.c +8 -3
@@ -475,7 +475,7 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)struct iwl_trans_pcie *trans_pcie =IWL_TRANS_GET_PCIE_TRANS (trans);struct iwl_rb_allocator *rba = &trans_pcie->rba;struct list_head local_empty; -int pending =atomic_xchg (&rba->req_pending,0 ); +int pending =atomic_read (&rba->req_pending);IWL_DEBUG_RX (trans,"Pending allocation requests = %d\n" , pending);
@@ -530,11 +530,13 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans) i++; } +atomic_dec (&rba->req_pending); pending--; +if (!pending) { - pending =atomic_xchg (&rba->req_pending,0 ); + pending =atomic_read (&rba->req_pending);IWL_DEBUG_RX (trans, -"Pending allocation requests = %d\n" , +"Got more pending allocation requests = %d\n" , pending); }
@@ -546,12 +548,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)spin_unlock (&rba->lock);atomic_inc (&rba->req_ready); + }spin_lock (&rba->lock);/* return unused rbds to the allocator empty list */ list_splice_tail (&local_empty, &rba->rbd_empty);spin_unlock (&rba->lock); + +IWL_DEBUG_RX (trans,"%s, exit.\n" , __func__); }/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 69/121 ACPI / video: Refactor and fix dmi_is_desktop()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cecf3e3e0803462335e25d083345682518097334 ]
This commit refactors the chassis-type detection introduced by commit 53fa1f6e8a59 ("ACPI / video: Only default only_lcd to true on Win8-ready _desktops_") (where desktop means anything without a builtin screen).
The DMI chassis_type is an unsigned integer, so rather then doing a whole bunch of string-compares on it, convert it to an int and feed the result to a switch case.
Note the switch case uses hex values, this is done because the spec uses hex values too. This changes the check for "Main Server Chassis" from checking for 11 decimal to 11 hexadecimal, this is a bug fix, the original check for 11 decimal was wrong.
--- drivers/acpi/acpi_video.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/acpi/acpi_video.c +13 -6
@@ -2123,21 +2123,28 @@ static int __init intel_opregion_present(void)return opregion; } +/* Check if the chassis-type indicates there is no builtin LCD panel */ static bool dmi_is_desktop (void ) {const char *chassis_type; +unsigned long type; chassis_type =dmi_get_system_info (DMI_CHASSIS_TYPE );if (!chassis_type)return false; -if (!strcmp (chassis_type,"3" ) ||/* 3: Desktop */ - !strcmp (chassis_type,"4" ) ||/* 4: Low Profile Desktop */ - !strcmp (chassis_type,"5" ) ||/* 5: Pizza Box */ - !strcmp (chassis_type,"6" ) ||/* 6: Mini Tower */ - !strcmp (chassis_type,"7" ) ||/* 7: Tower */ - !strcmp (chassis_type,"11" ))/* 11: Main Server Chassis */ +if (kstrtoul (chassis_type,10 , &type) !=0 ) +return false; + +switch (type) { +case 0x03 :/* Desktop */ +case 0x04 :/* Low Profile Desktop */ +case 0x05 :/* Pizza Box */ +case 0x06 :/* Mini Tower */ +case 0x07 :/* Tower */ +case 0x11 :/* Main Server Chassis */ return true; + }return false; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 70/121 kprobes: Prohibit probing on bsearch()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 02106f883cd745523f7766d90a739f983f19e650 ]
Since kprobe breakpoing handler is using bsearch(), probing on this routine can cause recursive breakpoint problem.
int3
->do_int3()
->ftrace_int3_handler()
->ftrace_location()
->ftrace_location_range()
->bsearch() -> int3Prohibit probing on bsearch().
--- lib/bsearch.c | 2 ++ 1 file changed, 2 insertions(+)
lib/bsearch.c +2 -0
@@ -11,6 +11,7 @@#include <linux/export.h> #include <linux/bsearch.h> +#include <linux/kprobes.h> /* * bsearch - binary search an array of elements
@@ -53,3 +54,4 @@ void *bsearch(const void *key, const void *base, size_t num, size_t size,return NULL ; }EXPORT_SYMBOL (bsearch); +NOKPROBE_SYMBOL (bsearch);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 71/121 netfilter: conntrack: fix cloned unconfirmed skb->_nfct race in __nf_conntrack_confirm
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 13f5251fd17088170c18844534682d9cab5ff5aa ]
For bridge(br_flood) or broadcast/multicast packets, they could clone skb with unconfirmed conntrack which break the rule that unconfirmed skb->_nfct is never shared. With nfqueue running on my system, the race can be easily reproduced with following warning calltrace:
[13257.707525] CPU: 0 PID: 12132 Comm: main Tainted: P W 4.4.60 #7744 [13257.707568] Hardware name: Qualcomm (Flattened Device Tree) [13257.714700] [<c021f6dc>] (unwind_backtrace) from [<c021bce8>] (show_stack+0x10/0x14) [13257.720253] [<c021bce8>] (show_stack) from [<c0449e10>] (dump_stack+0x94/0xa8) [13257.728240] [<c0449e10>] (dump_stack) from [<c022a7e0>] (warn_slowpath_common+0x94/0xb0) [13257.735268] [<c022a7e0>] (warn_slowpath_common) from [<c022a898>] (warn_slowpath_null+0x1c/0x24) [13257.743519] [<c022a898>] (warn_slowpath_null) from [<c06ee450>] (__nf_conntrack_confirm+0xa8/0x618) [13257.752284] [<c06ee450>] (__nf_conntrack_confirm) from [<c0772670>] (ipv4_confirm+0xb8/0xfc) [13257.761049] [<c0772670>] (ipv4_confirm) from [<c06e7a60>] (nf_iterate+0x48/0xa8) [13257.769725] [<c06e7a60>] (nf_iterate) from [<c06e7af0>] (nf_hook_slow+0x30/0xb0) [13257.777108] [<c06e7af0>] (nf_hook_slow) from [<c07f20b4>] (br_nf_post_routing+0x274/0x31c) [13257.784486] [<c07f20b4>] (br_nf_post_routing) from [<c06e7a60>] (nf_iterate+0x48/0xa8) [13257.792556] [<c06e7a60>] (nf_iterate) from [<c06e7af0>] (nf_hook_slow+0x30/0xb0) [13257.800458] [<c06e7af0>] (nf_hook_slow) from [<c07e5580>] (br_forward_finish+0x94/0xa4) [13257.808010] [<c07e5580>] (br_forward_finish) from [<c07f22ac>] (br_nf_forward_finish+0x150/0x1ac) [13257.815736] [<c07f22ac>] (br_nf_forward_finish) from [<c06e8df0>] (nf_reinject+0x108/0x170) [13257.824762] [<c06e8df0>] (nf_reinject) from [<c06ea854>] (nfqnl_recv_verdict+0x3d8/0x420) [13257.832924] [<c06ea854>] (nfqnl_recv_verdict) from [<c06e940c>] (nfnetlink_rcv_msg+0x158/0x248) [13257.841256] [<c06e940c>] (nfnetlink_rcv_msg) from [<c06e5564>] (netlink_rcv_skb+0x54/0xb0) [13257.849762] [<c06e5564>] (netlink_rcv_skb) from [<c06e4ec8>] (netlink_unicast+0x148/0x23c) [13257.858093] [<c06e4ec8>] (netlink_unicast) from [<c06e5364>] (netlink_sendmsg+0x2ec/0x368) [13257.866348] [<c06e5364>] (netlink_sendmsg) from [<c069fb8c>] (sock_sendmsg+0x34/0x44) [13257.874590] [<c069fb8c>] (sock_sendmsg) from [<c06a03dc>] (___sys_sendmsg+0x1ec/0x200) [13257.882489] [<c06a03dc>] (___sys_sendmsg) from [<c06a11c8>] (__sys_sendmsg+0x3c/0x64) [13257.890300] [<c06a11c8>] (__sys_sendmsg) from [<c0209b40>] (ret_fast_syscall+0x0/0x34)
The original code just triggered the warning but do nothing. It will caused the shared conntrack moves to the dying list and the packet be droppped (nf_ct_resolve_clash returns NF_DROP for dying conntrack).
- Reproduce steps:
+----------------------------+
| br0(bridge) |
| |
+-+---------+---------+------+
| eth0| | eth1| | eth2|
| | | | | |
+--+--+ +--+--+ +---+-+
| | |
| | |
+--+-+ +-+--+ +--+-+
| PC1| | PC2| | PC3|
+----+ +----+ +----+iptables -A FORWARD -m mark --mark 0x1000000/0x1000000 -j NFQUEUE --queue-num 100 --queue-bypass
ps: Our nfq userspace program will set mark on packets whose connection has already been processed.
PC1 sends broadcast packets simulated by hping3:
hping3 --rand-source --udp 192.168.1.255 -i u100
- Broadcast racing flow chart is as follow:
br_handle_frame
BR_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, br_handle_frame_finish) // skb->_nfct (unconfirmed conntrack) is constructed at PRE_ROUTING stage br_handle_frame_finish
// check if this packet is broadcast
br_flood_forward
br_flood
list_for_each_entry_rcu(p, &br->port_list, list) // iterate through each port
maybe_deliver
deliver_clone
skb = skb_clone(skb)
__br_forward
BR_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD,...)
// queue in our nfq and received by our userspace program
// goto __nf_conntrack_confirm with process context on CPU 1
br_pass_frame_up
BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,...)
// goto __nf_conntrack_confirm with softirq context on CPU 0Because conntrack confirm can happen at both INPUT and POSTROUTING stage. So with NFQUEUE running, skb->_nfct with the same unconfirmed conntrack could race on different core.
This patch fixes a repeating kernel splat, now it is only displayed once.
--- net/netfilter/nf_conntrack_core.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
net/netfilter/nf_conntrack_core.c +11 -3
@@ -763,10 +763,18 @@ __nf_conntrack_confirm(struct sk_buff *skb)* REJECT will give spurious warnings here. */ -/* No external references means no one else could have -* confirmed us. +/* Another skb with the same unconfirmed conntrack may +* win the race. This may happen for bridge(br_flood) +* or broadcast/multicast packets do skb_clone with +* unconfirmed conntrack. */ -WARN_ON (nf_ct_is_confirmed (ct)); +if (unlikely (nf_ct_is_confirmed (ct))) { +WARN_ON_ONCE (1 ); +nf_conntrack_double_unlock (hash, reply_hash); +local_bh_enable (); +return NF_DROP ; + } +pr_debug ("Confirming conntrack %p\n" , ct);/* We have to check the DYING flag after unlink to prevent * a race against nf_ct_get_next_corpse() possibly called from
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 72/121 ARM: 8833/1: Ensure that NEON code always compiles with Clang
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit de9c0d49d85dc563549972edc5589d195cd5e859 ]
While building arm32 allyesconfig, I ran into the following errors:
arch/arm/lib/xor-neon.c:17:2: error: You should compile this file with '-mfloat-abi=softfp -mfpu=neon'
In file included from lib/raid6/neon1.c:27:
/home/nathan/cbl/prebuilt/lib/clang/8.0.0/include/arm_neon.h:28:2:
error: "NEON support not enabled"
Building V=1 showed NEON_FLAGS getting passed along to Clang but __ARM_NEON__ was not getting defined. Ultimately, it boils down to Clang only defining __ARM_NEON__ when targeting armv7, rather than armv6k, which is the '-march' value for allyesconfig.
Quoted 1 line
From
lib/Basic/Targets/ARM.cppin the Clang source:
// This only gets set when Neon instructions are actually available, unlike // the VFP define, hence the soft float and arch check. This is subtly // different from gcc, we follow the intent which was that it should be set // when Neon instructions are actually available.
if ((FPU & NeonFPU) && !SoftFloat && ArchVersion >= 7) {
Builder.defineMacro("__ARM_NEON", "1");
Builder.defineMacro("__ARM_NEON__");
// current AArch32 NEON implementations do not support double-precision
// floating-point even when it is present in VFP.
Builder.defineMacro("__ARM_NEON_FP",
"0x" + Twine::utohexstr(HW_FP & ~HW_FP_DP));}
Ard Biesheuvel recommended explicitly adding '-march=armv7-a' at the beginning of the NEON_FLAGS definitions so that __ARM_NEON__ always gets definined by Clang. This doesn't functionally change anything because that code will only run where NEON is supported, which is implicitly armv7.
--- Documentation/arm/kernel_mode_neon.txt | 4 ++-- arch/arm/lib/Makefile | 2 +- arch/arm/lib/xor-neon.c | 2 +- lib/raid6/Makefile | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-)
Documentation/arm/kernel_mode_neon.txt +2 -2
@@ -6,7 +6,7 @@ TL;DR summary * Use only NEON instructions, or VFP instructions that don't rely on support code * Isolate your NEON code in a separate compilation unit, and compile it with - '-mfpu=neon -mfloat-abi=softfp' + '-march=armv7-a -mfpu=neon -mfloat-abi=softfp' * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into your NEON code * Don't sleep in your NEON code, and be aware that it will be executed with
@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special care is taken. Therefore, the recommended and only supported way of using NEON/VFP in the kernel is by adhering to the following rules: * isolate the NEON code in a separate compilation unit and compile it with - '-mfpu=neon -mfloat-abi=softfp'; + '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'; * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the calls into the unit containing the NEON code from a compilation unit which is *not* built with the GCC flag '-mfpu=neon' set.
arch/arm/lib/Makefile +1 -1
@@ -39,7 +39,7 @@ $(obj)/csumpartialcopy.o: $(obj)/csumpartialcopygeneric.S $(obj)/csumpartialcopyuser.o: $(obj)/csumpartialcopygeneric.S ifeq ($(CONFIG_KERNEL_MODE_NEON),y) - NEON_FLAGS := -mfloat-abi=softfp -mfpu=neon + NEON_FLAGS := -march=armv7-a -mfloat-abi=softfp -mfpu=neon CFLAGS_xor-neon.o += $(NEON_FLAGS) obj-$(CONFIG_XOR_BLOCKS) += xor-neon.o endif
arch/arm/lib/xor-neon.c +1 -1
@@ -14,7 +14,7 @@MODULE_LICENSE ("GPL" );#ifndef __ARM_NEON__ -#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon' +#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp -mfpu=neon'#endif /*
lib/raid6/Makefile +1 -1
@@ -40,7 +40,7 @@ endif ifeq ($(CONFIG_KERNEL_MODE_NEON),y) NEON_FLAGS := -ffreestanding ifeq ($(ARCH),arm) -NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon +NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon endif CFLAGS_recov_neon_inner.o += $(NEON_FLAGS) ifeq ($(ARCH),arm64)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 73/121 ALSA: PCM: check if ops are defined before suspending PCM
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d9c0b2afe820fa3b3f8258a659daee2cc71ca3ef ]
BE dai links only have internal PCM's and their substream ops may not be set. Suspending these PCM's will result in their
ops->trigger() being invoked and cause a kernel oops.
So skip suspending PCM's if their ops are NULL.
[ NOTE: this change is required now for following the recent PCM core
change to get rid of snd_pcm_suspend() call. Since DPCM BE takes the runtime carried from FE while keeping NULL ops, it can hit this bug. See details at:
https://github.com/thesofproject/linux/pull/582
-- tiwai ]
--- sound/core/pcm_native.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/core/pcm_native.c +8 -0
@@ -1482,6 +1482,14 @@ int snd_pcm_suspend_all(struct snd_pcm *pcm)/* FIXME: the open/close code should lock this as well */ if (substream->runtime ==NULL )continue ; + +/* +* Skip BE dai link PCM's that are internal and may +* not have their substream ops set. +*/ +if (!substream->ops) +continue ; + err =snd_pcm_suspend (substream);if (err <0 && err != -EBUSY )return err;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 74/121 usb: f_fs: Avoid crash due to out-of-scope stack ptr access
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 54f64d5c983f939901dacc8cfc0983727c5c742e ]
Since the 5.0 merge window opened, I've been seeing frequent crashes on suspend and reboot with the trace:
[ 36.911170] Unable to handle kernel paging request at virtual address ffffff801153d660 [ 36.912769] Unable to handle kernel paging request at virtual address ffffff800004b564 ... [ 36.950666] Call trace: [ 36.950670] queued_spin_lock_slowpath+0x1cc/0x2c8 [ 36.950681] _raw_spin_lock_irqsave+0x64/0x78 [ 36.950692] complete+0x28/0x70 [ 36.950703] ffs_epfile_io_complete+0x3c/0x50 [ 36.950713] usb_gadget_giveback_request+0x34/0x108 [ 36.950721] dwc3_gadget_giveback+0x50/0x68 [ 36.950723] dwc3_thread_interrupt+0x358/0x1488 [ 36.950731] irq_thread_fn+0x30/0x88 [ 36.950734] irq_thread+0x114/0x1b0 [ 36.950739] kthread+0x104/0x130 [ 36.950747] ret_from_fork+0x10/0x1c
I isolated this down to in ffs_epfile_io():
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/usb/gadget/function/f_fs.c#n1065
Where the completion done is setup on the stack:
DECLARE_COMPLETION_ONSTACK(done);
Then later we setup a request and queue it, and wait for it:
if (unlikely(wait_for_completion_interruptible(&done))) {
/*
* To avoid race condition with ffs_epfile_io_complete,
* dequeue the request first then check
* status. usb_ep_dequeue API should guarantee no race
* condition with req->complete callback.
*/
usb_ep_dequeue(ep->ep, req);
interrupted = ep->status < 0;
}
The problem is, that we end up being interrupted, dequeue the request, and exit.
But then the irq triggers and we try calling complete() on the context pointer which points to now random stack space, which results in the panic.
Alan Stern pointed out there is a bug here, in that the snippet above "assumes that usb_ep_dequeue() waits until the request has been completed." And that:
wait_for_completion(&done);
Is needed right after the usb_ep_dequeue().
Thus this patch implements that change. With it I no longer see the crashes on suspend or reboot.
This issue seems to have been uncovered by behavioral changes in the dwc3 driver in commit fec9095bdef4e ("usb: dwc3: gadget:
remove wait_end_transfer").
--- drivers/usb/gadget/function/f_fs.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/function/f_fs.c +1 -0
@@ -1009,6 +1009,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)* condition with req->complete callback. */ usb_ep_dequeue (ep->ep, req); +wait_for_completion (&done); interrupted = ep->status <0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 75/121 sched/topology: Fix percpu data types in struct sd_data & struct s_data
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 99687cdbb3f6c8e32bcc7f37496e811f30460e48 ]
The percpu members of struct sd_data and s_data are declared as:
struct ... ** __percpu member;
So their type is:
__percpu pointer to pointer to struct ...
But looking at how they're used, their type should be:
pointer to __percpu pointer to struct ...
and they should thus be declared as:
struct ... * __percpu *member;
So fix the placement of '__percpu' in the definition of these structures.
This addresses a bunch of Sparse's warnings like:
warning: incorrect type in initializer (different address spaces)
expected void const [noderef] <asn:3> *__vpp_verify got struct sched_domain **
--- include/linux/sched/topology.h | 8 ++++---- kernel/sched/topology.c | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-)
include/linux/sched/topology.h +4 -4
@@ -177,10 +177,10 @@ typedef int (*sched_domain_flags_f)(void);#define SDTL_OVERLAP 0x01struct sd_data { -struct sched_domain **__percpu sd; -struct sched_domain_shared **__percpu sds; -struct sched_group **__percpu sg; -struct sched_group_capacity **__percpu sgc; +struct sched_domain *__percpu *sd; +struct sched_domain_shared *__percpu *sds; +struct sched_group *__percpu *sg; +struct sched_group_capacity *__percpu *sgc; };struct sched_domain_topology_level {
kernel/sched/topology.c +1 -1
@@ -499,7 +499,7 @@ static int __init isolated_cpu_setup(char *str)__setup ("isolcpus=" , isolated_cpu_setup);struct s_data { -struct sched_domain **__percpu sd; +struct sched_domain *__percpu *sd;struct root_domain *rd; };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 76/121 bcache: fix input overflow to cache set sysfs file io_error_halflife
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a91fbda49f746119828f7e8ad0f0aa2ab0578f65 ]
Cache set sysfs entry io_error_halflife is used to set c->error_decay. c->error_decay is in type unsigned int, and it is converted by strtoul_or_return(), therefore overflow to c->error_decay is possible for a large input value.
This patch fixes the overflow by using strtoul_safe_clamp() to convert input string to an unsigned long value in range [0, UINT_MAX], then divides by 88 and set it to c->error_decay.
--- drivers/md/bcache/sysfs.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/md/bcache/sysfs.c +11 -2
@@ -660,8 +660,17 @@ STORE(__bch_cache_set) c->error_limit =strtoul_or_return (buf) <<IO_ERROR_SHIFT ;/* See count_io_errors() for why 88 */ -if (attr == &sysfs_io_error_halflife) - c->error_decay =strtoul_or_return (buf) /88 ; +if (attr == &sysfs_io_error_halflife) { +unsigned long v =0 ; +ssize_t ret; + + ret =strtoul_safe_clamp (buf, v,0 ,UINT_MAX ); +if (!ret) { + c->error_decay = v /88 ; +return size; + } +return ret; + }sysfs_strtoul (journal_delay_ms, c->journal_delay_ms);sysfs_strtoul (verify, c->verify);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 77/121 bcache: fix input overflow to sequential_cutoff
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8c27a3953e92eb0b22dbb03d599f543a05f9574e ]
People may set sequential_cutoff of a cached device via sysfs file, but current code does not check input value overflow. E.g. if value 4294967295 (UINT_MAX) is written to file sequential_cutoff, its value is 4GB, but if 4294967296 (UINT_MAX + 1) is written into, its value will be 0. This is an unexpected behavior.
This patch replaces d_strtoi_h() by sysfs_strtoul_clamp() to convert input string to unsigned integer value, and limit its range in [0, UINT_MAX]. Then the input overflow can be fixed.
--- drivers/md/bcache/sysfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/bcache/sysfs.c +3 -1
@@ -217,7 +217,9 @@ STORE(__cached_dev)d_strtoul (writeback_rate_d_term);d_strtoul_nonzero (writeback_rate_p_term_inverse); -d_strtoi_h (sequential_cutoff); +sysfs_strtoul_clamp (sequential_cutoff, + dc->sequential_cutoff, +0 ,UINT_MAX );d_strtoi_h (readahead);if (attr == &sysfs_clear_stats)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 78/121 bcache: improve sysfs_strtoul_clamp()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 596b5a5dd1bc2fa019fdaaae522ef331deef927f ]
Currently sysfs_strtoul_clamp() is defined as,
82 #define sysfs_strtoul_clamp(file, var, min, max) \
83 do { \
84 if (attr == &sysfs_ ## file) \
85 return strtoul_safe_clamp(buf, var, min, max) \
86 ?: (ssize_t) size; \87 } while (0)
The problem is, if bit width of var is less then unsigned long, min and max may not protect var from integer overflow, because overflow happens in strtoul_safe_clamp() before checking min and max.
To fix such overflow in sysfs_strtoul_clamp(), to make min and max take effect, this patch adds an unsigned long variable, and uses it to macro strtoul_safe_clamp() to convert an unsigned long value in range defined by [min, max]. Then assign this value to var. By this method, if bit width of var is less than unsigned long, integer overflow won't happen before min and max are checking.
Now sysfs_strtoul_clamp() can properly handle smaller data type like unsigned int, of cause min and max should be defined in range of unsigned int too.
--- drivers/md/bcache/sysfs.h | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/md/bcache/sysfs.h +10 -3
@@ -81,9 +81,16 @@ do { \#define sysfs_strtoul_clamp (file, var, min, max) \ do { \ - if (attr == &sysfs_ ## file) \ - return strtoul_safe_clamp(buf, var, min, max) \ - ?: (ssize_t) size; \ + if (attr == &sysfs_ ## file) { \ + unsigned long v = 0; \ + ssize_t ret; \ + ret = strtoul_safe_clamp(buf, v, min, max); \ + if (!ret) { \ + var = v; \ + return size; \ + } \ + return ret; \ + } \ } while (0)#define strtoul_or_return (cp) \
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 79/121 genirq: Avoid summation loops for /proc/stat
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1136b0728969901a091f0471968b2b76ed14d9ad ]
Waiman reported that on large systems with a large amount of interrupts the readout of /proc/stat takes a long time to sum up the interrupt statistics. In principle this is not a problem. but for unknown reasons some enterprise quality software reads /proc/stat with a high frequency.
The reason for this is that interrupt statistics are accounted per cpu. So the /proc/stat logic has to sum up the interrupt stats for each interrupt.
This can be largely avoided for interrupts which are not marked as 'PER_CPU' interrupts by simply adding a per interrupt summation counter which is incremented along with the per interrupt per cpu counter.
The PER_CPU interrupts need to avoid that and use only per cpu accounting because they share the interrupt number and the interrupt descriptor and concurrent updates would conflict or require unwanted synchronization.
8<-------------
v2: Undo the unintentional layout change of struct irq_desc.
include/linux/irqdesc.h | 1 + kernel/irq/chip.c | 12 ++++++++++-- kernel/irq/internals.h | 8 +++++++- kernel/irq/irqdesc.c | 7 ++++++- 4 files changed, 24 insertions(+), 4 deletions(-)
--- include/linux/irqdesc.h | 1 + kernel/irq/chip.c | 12 ++++++++++-- kernel/irq/internals.h | 8 +++++++- kernel/irq/irqdesc.c | 7 ++++++- 4 files changed, 24 insertions(+), 4 deletions(-)
include/linux/irqdesc.h +1 -0
@@ -65,6 +65,7 @@ struct irq_desc {unsigned int core_internal_state__do_not_mess_with_it;unsigned int depth;/* nested irq disables */ unsigned int wake_depth;/* nested wake enables */ +unsigned int tot_count;unsigned int irq_count;/* For detecting broken IRQs */ unsigned long last_unhandled;/* Aging timer for unhandled count */ unsigned int irqs_unhandled;
kernel/irq/chip.c +10 -2
@@ -834,7 +834,11 @@ void handle_percpu_irq(struct irq_desc *desc) {struct irq_chip *chip =irq_desc_get_chip (desc); -kstat_incr_irqs_this_cpu (desc); +/* +* PER CPU interrupts are not serialized. Do not touch +* desc->tot_count. +*/ +__kstat_incr_irqs_this_cpu (desc);if (chip->irq_ack) chip->irq_ack (&desc->irq_data);
@@ -863,7 +867,11 @@ void handle_percpu_devid_irq(struct irq_desc *desc)unsigned int irq =irq_desc_get_irq (desc);irqreturn_t res; -kstat_incr_irqs_this_cpu (desc); +/* +* PER CPU interrupts are not serialized. Do not touch +* desc->tot_count. +*/ +__kstat_incr_irqs_this_cpu (desc);if (chip->irq_ack) chip->irq_ack (&desc->irq_data);
kernel/irq/internals.h +7 -1
@@ -240,12 +240,18 @@ static inline void irq_state_set_masked(struct irq_desc *desc)#undef __irqd_to_state -static inline void kstat_incr_irqs_this_cpu (struct irq_desc *desc) +static inline void __kstat_incr_irqs_this_cpu (struct irq_desc *desc) {__this_cpu_inc (*desc->kstat_irqs);__this_cpu_inc (kstat.irqs_sum); } +static inline void kstat_incr_irqs_this_cpu (struct irq_desc *desc) +{ +__kstat_incr_irqs_this_cpu (desc); + desc->tot_count++; +} +static inline int irq_desc_get_node (struct irq_desc *desc) {return irq_common_data_get_node (&desc->irq_common_data);
kernel/irq/irqdesc.c +6 -1
@@ -119,6 +119,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node, desc->depth =1 ; desc->irq_count =0 ; desc->irqs_unhandled =0 ; + desc->tot_count =0 ; desc->name =NULL ; desc->owner = owner;for_each_possible_cpu (cpu)
@@ -895,11 +896,15 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)unsigned int kstat_irqs (unsigned int irq) {struct irq_desc *desc =irq_to_desc (irq); -int cpu;unsigned int sum =0 ; +int cpu;if (!desc || !desc->kstat_irqs)return 0 ; +if (!irq_settings_is_per_cpu_devid (desc) && + !irq_settings_is_per_cpu (desc)) +return desc->tot_count; +for_each_possible_cpu (cpu) sum += *per_cpu_ptr (desc->kstat_irqs, cpu);return sum;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 80/121 iw_cxgb4: fix srqidx leak during connection abort
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f368ff188ae4b3ef6f740a15999ea0373261b619 ]
When an application aborts the connection by moving QP from RTS to ERROR, then iw_cxgb4's modify_rc_qp() RTS->ERROR logic sets the *srqidxp to 0 via t4_set_wq_in_error(&qhp->wq, 0), and aborts the connection by calling c4iw_ep_disconnect().
c4iw_ep_disconnect() does the following:
1. sends up a close_complete_upcall(ep, -ECONNRESET) to libcxgb4.
2. sends abort request CPL to hw.
But, since the close_complete_upcall() is sent before sending the ABORT_REQ to hw, libcxgb4 would fail to release the srqidx if the connection holds one. Because, the srqidx is passed up to libcxgb4 only after corresponding ABORT_RPL is processed by kernel in abort_rpl().
This patch handle the corner-case by moving the call to close_complete_upcall() from c4iw_ep_disconnect() to abort_rpl(). So that libcxgb4 is notified about the -ECONNRESET only after abort_rpl(), and libcxgb4 can relinquish the srqidx properly.
--- drivers/infiniband/hw/cxgb4/cm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/hw/cxgb4/cm.c +3 -2
@@ -1884,8 +1884,10 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb) }mutex_unlock (&ep->com.mutex); -if (release) +if (release) { +close_complete_upcall (ep, -ECONNRESET );release_ep_resources (ep); + }c4iw_put_ep (&ep->com);return 0 ; }
@@ -3584,7 +3586,6 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)if (close) {if (abrupt) {set_bit (EP_DISC_ABORT , &ep->com.history); -close_complete_upcall (ep, -ECONNRESET ); ret =send_abort (ep); }else {set_bit (EP_DISC_CLOSE , &ep->com.history);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 81/121 fbdev: fbmem: fix memory access if logo is bigger than the screen
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a5399db139cb3ad9b8502d8b1bd02da9ce0b9df0 ]
There is no clipping on the x or y axis for logos larger that the framebuffer size. Therefore: a logo bigger than screen size leads to invalid memory access:
[ 1.254664] Backtrace: [ 1.254728] [<c02714e0>] (cfb_imageblit) from [<c026184c>] (fb_show_logo+0x620/0x684) [ 1.254763] r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4 [ 1.254774] r4:c6a3e800 [ 1.254810] [<c026122c>] (fb_show_logo) from [<c026c1e4>] (fbcon_switch+0x3fc/0x46c) [ 1.254842] r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800 [ 1.254852] r4:c6808c00 [ 1.254889] [<c026bde8>] (fbcon_switch) from [<c029c8f8>] (redraw_screen+0xf0/0x1e8) [ 1.254918] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080 [ 1.254928] r4:c6808c00 [ 1.254961] [<c029c808>] (redraw_screen) from [<c029d264>] (do_bind_con_driver+0x194/0x2e4) [ 1.254991] r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0
So prevent displaying a logo bigger than screen size and avoid invalid memory access.
--- drivers/video/fbdev/core/fbmem.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/core/fbmem.c +3 -0
@@ -427,6 +427,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, {unsigned int x; +if (image->width > info->var.xres || image->height > info->var.yres) +return ; +if (rotate ==FB_ROTATE_UR ) { for (x = 0; x < num && image->dx + image->width <= info->var.xres;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 82/121 cdrom: Fix race condition in cdrom_sysctl_register
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f25191bb322dec8fa2979ecb8235643aa42470e1 ]
The following traceback is sometimes seen when booting an image in qemu:
[ 54.608293] cdrom: Uniform CD-ROM driver Revision: 3.20 [ 54.611085] Fusion MPT base driver 3.04.20 [ 54.611877] Copyright (c) 1999-2008 LSI Corporation [ 54.616234] Fusion MPT SAS Host driver 3.04.20 [ 54.635139] sysctl duplicate entry: /dev/cdrom//info [ 54.639578] CPU: 0 PID: 266 Comm: kworker/u4:5 Not tainted 5.0.0-rc5 #1 [ 54.639578] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 [ 54.641273] Workqueue: events_unbound async_run_entry_fn [ 54.641273] Call Trace: [ 54.641273] dump_stack+0x67/0x90 [ 54.641273] __register_sysctl_table+0x50b/0x570 [ 54.641273] ? rcu_read_lock_sched_held+0x6f/0x80 [ 54.641273] ? kmem_cache_alloc_trace+0x1c7/0x1f0 [ 54.646814] __register_sysctl_paths+0x1c8/0x1f0 [ 54.646814] cdrom_sysctl_register.part.7+0xc/0x5f [ 54.646814] register_cdrom.cold.24+0x2a/0x33 [ 54.646814] sr_probe+0x4bd/0x580 [ 54.646814] ? __driver_attach+0xd0/0xd0 [ 54.646814] really_probe+0xd6/0x260 [ 54.646814] ? __driver_attach+0xd0/0xd0 [ 54.646814] driver_probe_device+0x4a/0xb0 [ 54.646814] ? __driver_attach+0xd0/0xd0 [ 54.646814] bus_for_each_drv+0x73/0xc0 [ 54.646814] __device_attach+0xd6/0x130 [ 54.646814] bus_probe_device+0x9a/0xb0 [ 54.646814] device_add+0x40c/0x670 [ 54.646814] ? __pm_runtime_resume+0x4f/0x80 [ 54.646814] scsi_sysfs_add_sdev+0x81/0x290 [ 54.646814] scsi_probe_and_add_lun+0x888/0xc00 [ 54.646814] ? scsi_autopm_get_host+0x21/0x40 [ 54.646814] __scsi_add_device+0x116/0x130 [ 54.646814] ata_scsi_scan_host+0x93/0x1c0 [ 54.646814] async_run_entry_fn+0x34/0x100 [ 54.646814] process_one_work+0x237/0x5e0 [ 54.646814] worker_thread+0x37/0x380 [ 54.646814] ? rescuer_thread+0x360/0x360 [ 54.646814] kthread+0x118/0x130 [ 54.646814] ? kthread_create_on_node+0x60/0x60 [ 54.646814] ret_from_fork+0x3a/0x50
The only sensible explanation is that cdrom_sysctl_register() is called twice, once from the module init function and once from register_cdrom(). cdrom_sysctl_register() is not mutex protected and may happily execute twice if the second call is made before the first call is complete.
Use a static atomic to ensure that the function is executed exactly once.
--- drivers/cdrom/cdrom.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/cdrom/cdrom.c +3 -4
@@ -265,6 +265,7 @@/* #define ERRLOGMASK (CD_WARNING|CD_OPEN|CD_COUNT_TRACKS|CD_CLOSE) */ /* #define ERRLOGMASK (CD_WARNING|CD_REG_UNREG|CD_DO_IOCTL|CD_OPEN|CD_CLOSE|CD_COUNT_TRACKS) */ +#include <linux/atomic.h> #include <linux/module.h> #include <linux/fs.h> #include <linux/major.h>
@@ -3689,9 +3690,9 @@ static struct ctl_table_header *cdrom_sysctl_header;static void cdrom_sysctl_register (void ) { -static int initialized; +static atomic_t initialized =ATOMIC_INIT (0 ); -if (initialized ==1 ) +if (!atomic_add_unless (&initialized,1 ,1 ))return ; cdrom_sysctl_header =register_sysctl_table (cdrom_root_table);
@@ -3702,8 +3703,6 @@ static void cdrom_sysctl_register(void) cdrom_sysctl_settings.debug = debug; cdrom_sysctl_settings.lock = lockdoor; cdrom_sysctl_settings.check = check_media_type; - - initialized =1 ; }static void cdrom_sysctl_unregister (void )
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 83/121 e1000e: fix cyclic resets at link up with active tx
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0f9e980bf5ee1a97e2e401c846b2af989eb21c61 ]
I'm seeing series of e1000e resets (sometimes endless) at system boot if something generates tx traffic at this time. In my case this is netconsole who sends message "e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames" from e1000e itself. As result e1000_watchdog_task sees used tx buffer while carrier is off and start this reset cycle again.
[ 17.794359] e1000e: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 17.794714] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready [ 22.936455] e1000e 0000:02:00.0 eth1: changing MTU from 1500 to 9000 [ 23.033336] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 26.102364] e1000e: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 27.174495] 8021q: 802.1Q VLAN Support v1.8 [ 27.174513] 8021q: adding VLAN 0 to HW filter on device eth1 [ 30.671724] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 30.898564] netpoll: netconsole: local port 6666 [ 30.898566] netpoll: netconsole: local IPv6 address 2a02:6b8:0:80b:beae:c5ff:fe28:23f8 [ 30.898567] netpoll: netconsole: interface 'eth1' [ 30.898568] netpoll: netconsole: remote port 6666 [ 30.898568] netpoll: netconsole: remote IPv6 address 2a02:6b8:b000:605c:e61d:2dff:fe03:3790 [ 30.898569] netpoll: netconsole: remote ethernet address b0:a8:6e:f4:ff:c0 [ 30.917747] console [netcon0] enabled [ 30.917749] netconsole: network logging started [ 31.453353] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 34.185730] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 34.321840] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 34.465822] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 34.597423] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 34.745417] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 34.877356] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 35.005441] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 35.157376] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 35.289362] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 35.417441] e1000e 0000:02:00.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 37.790342] e1000e: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None
This patch flushes tx buffers only once when carrier is off rather than at each watchdog iteration.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +6 -9
@@ -5306,8 +5306,13 @@ static void e1000_watchdog_task(struct work_struct *work)/* 8000ES2LAN requires a Rx packet buffer work-around * on link down event; reset the controller to flush * the Rx packet buffer. +* +* If the link is lost the controller stops DMA, but +* if there is queued Tx work it cannot be done. So +* reset the controller to flush the Tx packet buffers. */ -if (adapter->flags &FLAG_RX_NEEDS_RESTART ) +if ((adapter->flags &FLAG_RX_NEEDS_RESTART ) || +e1000_desc_unused (tx_ring) +1 < tx_ring->count) adapter->flags |=FLAG_RESTART_NOW ;else pm_schedule_suspend(netdev->dev.parent,
@@ -5330,14 +5335,6 @@ link_up: adapter->gotc_old = adapter->stats.gotc;spin_unlock (&adapter->stats64_lock); -/* If the link is lost the controller stops DMA, but -* if there is queued Tx work it cannot be done. So -* reset the controller to flush the Tx packet buffers. -*/ -if (!netif_carrier_ok (netdev) && - (e1000_desc_unused (tx_ring) +1 < tx_ring->count)) - adapter->flags |=FLAG_RESTART_NOW ; -/* If reset is necessary, do it outside of interrupt context. */ if (adapter->flags &FLAG_RESTART_NOW ) {schedule_work (&adapter->reset_task);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 84/121 platform/x86: intel_pmc_core: Fix PCH IP sts reading
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0e68eeea9894feeba2edf7ec63e4551b87f39621 ]
A previous commit "platform/x86: intel_pmc_core: Make the driver PCH family agnostic <c977b98bbef5898ed3d30b08ea67622e9e82082a>" provided better abstraction to this driver but has some fundamental issues.
e.g. the following condition
for (index = 0; index < pmcdev->map->ppfear_buckets &&
index < PPFEAR_MAX_NUM_ENTRIES; index++, iter++)
is wrong because for CNL, PPFEAR_MAX_NUM_ENTRIES is hardcoded as 5 which is _wrong_ and even though ppfear_buckets is 8, the loop fails to read all eight registers needed for CNL PCH i.e. PPFEAR0 and PPFEAR1. This patch refactors the pfear show logic to correctly read PCH IP power gating status for Cannonlake and beyond.
--- drivers/platform/x86/intel_pmc_core.c | 3 ++- drivers/platform/x86/intel_pmc_core.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/platform/x86/intel_pmc_core.c +2 -1
@@ -222,7 +222,8 @@ static int pmc_core_ppfear_sts_show(struct seq_file *s, void *unused) index < PPFEAR_MAX_NUM_ENTRIES; index++, iter++) pf_regs[index] =pmc_core_reg_read_byte (pmcdev, iter); -for (index =0 ; map[index].name; index++) +for (index =0 ; map[index].name && + index < pmcdev->map->ppfear_buckets *8 ; index++)pmc_core_display_map (s, index, pf_regs[index /8 ], map);return 0 ;
drivers/platform/x86/intel_pmc_core.h +1 -1
@@ -38,7 +38,7 @@#define SPT_PMC_SLP_S0_RES_COUNTER_STEP 0x64#define PMC_BASE_ADDR_MASK ~(SPT_PMC_MMIO_REG_LEN - 1)#define MTPMC_MASK 0xffff0000 -#define PPFEAR_MAX_NUM_ENTRIES 5 +#define PPFEAR_MAX_NUM_ENTRIES 12#define SPT_PPFEAR_NUM_ENTRIES 5#define SPT_PMC_READ_DISABLE_BIT 0x16#define SPT_PMC_MSG_FULL_STS_BIT 0x18
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 85/121 ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 11907e9d3533648615db08140e3045b829d2c141 ]
The of_find_device_by_node() takes a reference to the underlying device structure, we should release that reference.
--- sound/soc/fsl/fsl-asoc-card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/fsl-asoc-card.c +1 -0
@@ -689,6 +689,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) asrc_fail:of_node_put (asrc_np);of_node_put (codec_np); +put_device (&cpu_pdev->dev); fail:of_node_put (cpu_np);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 86/121 sched/debug: Initialize sd_sysctl_cpus if !CONFIG_CPUMASK_OFFSTACK
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1ca4fa3ab604734e38e2a3000c9abf788512ffa7 ]
register_sched_domain_sysctl() copies the cpu_possible_mask into sd_sysctl_cpus, but only if sd_sysctl_cpus hasn't already been allocated (ie, CONFIG_CPUMASK_OFFSTACK is set). However, when CONFIG_CPUMASK_OFFSTACK is not set, sd_sysctl_cpus is left uninitialized (all zeroes) and the kernel may fail to initialize sched_domain sysctl entries for all possible CPUs.
This is visible to the user if the kernel is booted with maxcpus=n, or if ACPI tables have been modified to leave CPUs offline, and then checking for missing /proc/sys/kernel/sched_domain/cpu* entries.
Fix this by separating the allocation and initialization, and adding a flag to initialize the possible CPU entries while system booting only.
--- kernel/sched/debug.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/sched/debug.c +4 -0
@@ -339,6 +339,7 @@ void register_sched_domain_sysctl(void) {static struct ctl_table *cpu_entries;static struct ctl_table **cpu_idx; +static bool init_done = false;char buf[32 ];int i;
@@ -368,7 +369,10 @@ void register_sched_domain_sysctl(void)if (!cpumask_available (sd_sysctl_cpus)) {if (!alloc_cpumask_var (&sd_sysctl_cpus,GFP_KERNEL ))return ; + } +if (!init_done) { + init_done = true;/* init to possible to not have holes in @cpu_entries */ cpumask_copy (sd_sysctl_cpus, cpu_possible_mask); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 87/121 efi/memattr: Dont bail on zero VA if it equals the regions PA
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5de0fef0230f3c8d75cff450a71740a7bf2db866 ]
The EFI memory attributes code cross-references the EFI memory map with the more granular EFI memory attributes table to ensure that they are in sync before applying the strict permissions to the regions it describes.
Since we always install virtual mappings for the EFI runtime regions to which these strict permissions apply, we currently perform a sanity check on the EFI memory descriptor, and ensure that the EFI_MEMORY_RUNTIME bit is set, and that the virtual address has been assigned.
However, in cases where a runtime region exists at physical address 0x0, and the virtual mapping equals the physical mapping, e.g., when running in mixed mode on x86, we encounter a memory descriptor with the runtime attribute and virtual address 0x0, and incorrectly draw the conclusion that a runtime region exists for which no virtual mapping was installed, and give up altogether. The consequence of this is that firmware mappings retain their read-write-execute permissions, making the system more vulnerable to attacks.
So let's only bail if the virtual address of 0x0 has been assigned to a physical region that does not reside at address 0x0.
--- drivers/firmware/efi/memattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/memattr.c +1 -1
@@ -94,7 +94,7 @@ static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out)if (!(md->attribute &EFI_MEMORY_RUNTIME ))continue ; -if (md->virt_addr ==0 ) { +if (md->virt_addr ==0 && md->phys_addr !=0 ) {/* no virtual mapping has been installed by the stub */ break ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 88/121 ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 3e3380d0675d5e20b0af067d60cb947a4348bf9b ]
Improve the DTS files by removing all the leading "0x" and zeros to fix the following dtc warnings:
Warning (unit_address_format): Node /XXX unit name should not have leading "0x"
and
Warning (unit_address_format): Node /XXX unit name should not have leading 0s
Converted using the following command:
find . -type f \( -iname *.dts -o -iname *.dtsi \) -exec sed -i -e "s/@\([0-9a-fA-FxX\.;:#]+\)\s*{/@\L\1 {/g" -e "s/@0x\(.*\) {/@\1 {/g" -e "s/@0+\(.*\) {/@\1 {/g" {} +
For simplicity, two sed expressions were used to solve each warnings separately.
To make the regex expression more robust a few other issues were resolved, namely setting unit-address to lower case, and adding a whitespace before the opening curly brace:
https://elinux.org/Device_Tree_Linux#Linux_conventions
This will solve as a side effect warning:
Warning (simple_bus_reg): Node /XXX@<UPPER> simple-bus unit address format error, expected "<lower>"
This is a follow up to commit 4c9847b7375a ("dt-bindings: Remove leading 0x from bindings notation")
--- arch/arm/boot/dts/lpc32xx.dtsi | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
arch/arm/boot/dts/lpc32xx.dtsi +9 -9
@@ -230,7 +230,7 @@ status = "disabled"; }; - i2s1: i2s@2009C000 { + i2s1: i2s@2009c000 { compatible = "nxp,lpc3220-i2s"; reg = <0x2009C000 0x1000>; };
@@ -273,7 +273,7 @@ status = "disabled"; }; - i2c1: i2c@400A0000 { + i2c1: i2c@400a0000 { compatible = "nxp,pnx-i2c"; reg = <0x400A0000 0x100>; interrupt-parent = <&sic1>;
@@ -284,7 +284,7 @@ clocks = <&clk LPC32XX_CLK_I2C1>; }; - i2c2: i2c@400A8000 { + i2c2: i2c@400a8000 { compatible = "nxp,pnx-i2c"; reg = <0x400A8000 0x100>; interrupt-parent = <&sic1>;
@@ -295,7 +295,7 @@ clocks = <&clk LPC32XX_CLK_I2C2>; }; - mpwm: mpwm@400E8000 { + mpwm: mpwm@400e8000 { compatible = "nxp,lpc3220-motor-pwm"; reg = <0x400E8000 0x78>; status = "disabled";
@@ -394,7 +394,7 @@ #gpio-cells = <3>; /* bank, pin, flags */ }; - timer4: timer@4002C000 { + timer4: timer@4002c000 { compatible = "nxp,lpc3220-timer"; reg = <0x4002C000 0x1000>; interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
@@ -412,7 +412,7 @@ status = "disabled"; }; - watchdog: watchdog@4003C000 { + watchdog: watchdog@4003c000 { compatible = "nxp,pnx4008-wdt"; reg = <0x4003C000 0x1000>; clocks = <&clk LPC32XX_CLK_WDOG>;
@@ -451,7 +451,7 @@ status = "disabled"; }; - timer1: timer@4004C000 { + timer1: timer@4004c000 { compatible = "nxp,lpc3220-timer"; reg = <0x4004C000 0x1000>; interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
@@ -475,7 +475,7 @@ status = "disabled"; }; - pwm1: pwm@4005C000 { + pwm1: pwm@4005c000 { compatible = "nxp,lpc3220-pwm"; reg = <0x4005C000 0x4>; clocks = <&clk LPC32XX_CLK_PWM1>;
@@ -484,7 +484,7 @@ status = "disabled"; }; - pwm2: pwm@4005C004 { + pwm2: pwm@4005c004 { compatible = "nxp,lpc3220-pwm"; reg = <0x4005C004 0x4>; clocks = <&clk LPC32XX_CLK_PWM2>;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 89/121 efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4e46c2a956215482418d7b315749fb1b6c6bc224 ]
The UEFI spec revision 2.7 errata A section 8.4 has the following to say about the virtual memory runtime services:
"This section contains function definitions for the virtual memory support that may be optionally used by an operating system at runtime. If an operating system chooses to make EFI runtime service calls in a virtual addressing mode instead of the flat physical mode, then the operating system must use the services in this section to switch the EFI runtime services from flat physical addressing to virtual addressing."
So it is pretty clear that calling SetVirtualAddressMap() is entirely optional, and so there is no point in doing so unless it achieves anything useful for us.
This is not the case for 64-bit ARM. The identity mapping used by the firmware is arbitrarily converted into another permutation of userland addresses (i.e., bits [63:48] cleared), and the runtime code could easily deal with the original layout in exactly the same way as it deals with the converted layout. However, due to constraints related to page size differences if the OS is not running with 4k pages, and related to systems that may expose the individual sections of PE/COFF runtime modules as different memory regions, creating the virtual layout is a bit fiddly, and requires us to sort the memory map and reason about adjacent regions with identical memory types etc etc.
So the obvious fix is to stop calling SetVirtualAddressMap() altogether on arm64 systems. However, to avoid surprises, which are notoriously hard to diagnose when it comes to OS<->firmware interactions, let's start by making it an opt-out feature, and implement support for the 'efi=novamap' kernel command line parameter on ARM and arm64 systems.
( Note that 32-bit ARM generally does require SetVirtualAddressMap() to be
used, given that the physical memory map and the kernel virtual address map are not guaranteed to be non-overlapping like on arm64. However, having support for efi=novamap,noruntime on 32-bit ARM, combined with the recently proposed support for earlycon=efifb, is likely to be useful to diagnose boot issues on such systems if they have no accessible serial port. )
--- drivers/firmware/efi/libstub/arm-stub.c | 5 +++++ drivers/firmware/efi/libstub/efi-stub-helper.c | 10 ++++++++++ drivers/firmware/efi/libstub/efistub.h | 1 + drivers/firmware/efi/libstub/fdt.c | 3 +++ 4 files changed, 19 insertions(+)
drivers/firmware/efi/libstub/arm-stub.c +5 -0
@@ -364,6 +364,11 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size, paddr = in->phys_addr; size = in->num_pages *EFI_PAGE_SIZE ; +if (novamap ()) { + in->virt_addr = in->phys_addr; +continue ; + } +/* * Make the mapping compatible with 64k pages: this allows * a 4k page size kernel to kexec a 64k page size kernel and
drivers/firmware/efi/libstub/efi-stub-helper.c +10 -0
@@ -34,6 +34,7 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE; static int __section(.data) __nokaslr; static int __section(.data) __quiet; +static int __section(.data) __novamap; int __pure nokaslr(void) {
@@ -43,6 +44,10 @@ int __pure is_quiet(void) {return __quiet; } +int __pure novamap (void ) +{ +return __novamap; +}#define EFI_MMAP_NR_SLACK_SLOTS 8
@@ -454,6 +459,11 @@ efi_status_t efi_parse_options(char const *cmdline) __chunk_size =-1UL ; } +if (!strncmp (str,"novamap" ,7 )) { + str +=strlen ("novamap" ); + __novamap =1 ; + } +/* Group words together, delimited by "," */ while (*str && *str !=' ' && *str !=',' ) str++;
drivers/firmware/efi/libstub/efistub.h +1 -0
@@ -27,6 +27,7 @@extern int __pure nokaslr (void );extern int __pure is_quiet (void ); +extern int __pure novamap (void );#define pr_efi (sys_table, msg) do { \ if (!is_quiet()) efi_printk(sys_table, "EFI stub: "msg); \
drivers/firmware/efi/libstub/fdt.c +3 -0
@@ -327,6 +327,9 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,if (status ==EFI_SUCCESS ) {efi_set_virtual_address_map_t *svam; +if (novamap ()) +return EFI_SUCCESS ; +/* Install the new virtual address map */ svam = sys_table->runtime->set_virtual_address_map; status = svam(runtime_entry_count * desc_size, desc_size,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 90/121 soc: qcom: gsbi: Fix error handling in gsbi_probe()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8cd09a3dd3e176c62da67efcd477a44a8d87185e ]
If of_platform_populate() fails in gsbi_probe(), gsbi->hclk is left undisabled.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/soc/qcom/qcom_gsbi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/soc/qcom/qcom_gsbi.c +5 -2
@@ -138,7 +138,7 @@ static int gsbi_probe(struct platform_device *pdev)struct resource *res;void __iomem *base;struct gsbi_info *gsbi; -int i; +int i, ret;u32 mask, gsbi_num;const struct crci_config *config =NULL ;
@@ -221,7 +221,10 @@ static int gsbi_probe(struct platform_device *pdev)platform_set_drvdata (pdev, gsbi); -return of_platform_populate (node,NULL ,NULL , &pdev->dev); + ret =of_platform_populate (node,NULL ,NULL , &pdev->dev); +if (ret) +clk_disable_unprepare (gsbi->hclk); +return ret; }static int gsbi_remove (struct platform_device *pdev)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 91/121 mt7601u: bump supported EEPROM version
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 3bd1505fed71d834f45e87b32ff07157fdda47e0 ]
As reported by Michael eeprom 0d is supported and work with the driver.
Dump of /sys/kernel/debug/ieee80211/phy1/mt7601u/eeprom_param with 0d EEPORM looks like this:
RSSI offset: 0 0
Reference temp: f9
LNA gain: 8
Reg channels: 1-14
Per rate power:
raw:05 bw20:05 bw40:05 raw:05 bw20:05 bw40:05 raw:03 bw20:03 bw40:03 raw:03 bw20:03 bw40:03 raw:04 bw20:04 bw40:04 raw:00 bw20:00 bw40:00 raw:00 bw20:00 bw40:00 raw:00 bw20:00 bw40:00 raw:02 bw20:02 bw40:02 raw:00 bw20:00 bw40:00 Per channel power: tx_power ch1:09 ch2:09 tx_power ch3:0a ch4:0a tx_power ch5:0a ch6:0a tx_power ch7:0b ch8:0b tx_power ch9:0b ch10:0b tx_power ch11:0b ch12:0b tx_power ch13:0b ch14:0b
--- drivers/net/wireless/mediatek/mt7601u/eeprom.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt7601u/eeprom.h +1 -1
@@ -17,7 +17,7 @@struct mt7601u_dev ; -#define MT7601U_EE_MAX_VER 0x0c +#define MT7601U_EE_MAX_VER 0x0d#define MT7601U_EEPROM_SIZE 256#define MT7601U_DEFAULT_TX_POWER 6
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 92/121 ARM: 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 72cd4064fccaae15ab84d40d4be23667402df4ed ]
ARMv8M introduces support for Security extension to M class, among other things it affects exception handling, especially, encoding of EXC_RETURN.
The new bits have been added:
Bit [6] Secure or Non-secure stack
Bit [5] Default callee register stacking
Bit [0] Exception Secure
which conflicts with hard-coded value of EXC_RETURN:
In fact, we only care of few bits:
Bit [3] Mode (0 - Handler, 1 - Thread)
Bit [2] Stack pointer selection (0 - Main, 1 - Process)
We can toggle only those bits and left other bits as they were on exception entry.
It is basically, what patch does - saves EXC_RETURN when we do transition form Thread to Handler mode (it is first svc), so later saved value is used instead of EXC_RET_THREADMODE_PROCESSSTACK.
--- arch/arm/include/asm/v7m.h | 2 +- arch/arm/kernel/entry-header.S | 3 ++- arch/arm/kernel/entry-v7m.S | 4 ++++ arch/arm/mm/proc-v7m.S | 3 +++ 4 files changed, 10 insertions(+), 2 deletions(-)
arch/arm/include/asm/v7m.h +1 -1
@@ -49,7 +49,7 @@* (0 -> msp; 1 -> psp). Bits [1:0] are fixed to 0b01. */ #define EXC_RET_STACK_MASK 0x00000004 -#define EXC_RET_THREADMODE_PROCESSSTACK 0xfffffffd +#define EXC_RET_THREADMODE_PROCESSSTACK (3 << 2)/* Cache related definitions */
arch/arm/kernel/entry-header.S +2 -1
@@ -127,7 +127,8 @@ */ .macro v7m_exception_slow_exit ret_r0 cpsid i - ldr lr, =EXC_RET_THREADMODE_PROCESSSTACK + ldr lr, =exc_ret + ldr lr, [lr] @ read original r12, sp, lr, pc and xPSR add r12, sp, #S_IP
arch/arm/kernel/entry-v7m.S +4 -0
@@ -146,3 +146,7 @@ ENTRY(vector_table) .rept CONFIG_CPU_V7M_NUM_IRQ .long __irq_entry @ External Interrupts .endr + .align 2 + .globl exc_ret +exc_ret: + .space 4
arch/arm/mm/proc-v7m.S +3 -0
@@ -139,6 +139,9 @@ __v7m_setup_cont: cpsie i svc #0 1: cpsid i + ldr r0, =exc_ret + orr lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK + str lr, [r0] ldmia sp, {r0-r3, r12} str r5, [r12, #11 * 4] @ restore the original SVC vector entry mov lr, r6 @ restore LR
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 93/121 ARM: avoid Cortex-A9 livelock on tight dmb loops
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5388a5b82199facacd3d7ac0d05aca6e8f902fed ]
machine_crash_nonpanic_core() does this:
while (1) cpu_relax();
because the kernel has crashed, and we have no known safe way to deal with the CPU. So, we place the CPU into an infinite loop which we expect it to never exit - at least not until the system as a whole is reset by some method.
In the absence of erratum 754327, this code assembles to:
b .
In other words, an infinite loop. When erratum 754327 is enabled, this becomes:
1: dmb
b 1b
It has been observed that on some systems (eg, OMAP4) where, if a crash is triggered, the system tries to kexec into the panic kernel, but fails after taking the secondary CPU down - placing it into one of these loops. This causes the system to livelock, and the most noticable effect is the system stops after issuing:
Loading crashdump kernel...
to the system console.
The tested as working solution I came up with was to add wfe() to these infinite loops thusly:
while (1) {
cpu_relax();
wfe();
}which, without 754327 builds to:
1: wfe
b 1b
or with 754327 is enabled:
1: dmb
wfe b 1b
Adding "wfe" does two things depending on the environment we're running under:
- where we're running on bare metal, and the processor implements "wfe", it stops us spinning endlessly in a loop where we're never going to do any useful work.
- if we're running in a VM, it allows the CPU to be given back to the hypervisor and rescheduled for other purposes (maybe a different VM) rather than wasting CPU cycles inside a crashed VM.
However, in light of erratum 794072, Will Deacon wanted to see 10 nops as well - which is reasonable to cover the case where we have erratum 754327 enabled _and_ we have a processor that doesn't implement the wfe hint.
So, we now end up with:
1: wfe
b 1b
when erratum 754327 is disabled, or:
1: dmb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
wfe
b 1b
when erratum 754327 is enabled. We also get the dmb + 10 nop sequence elsewhere in the kernel, in terminating loops.
This is reasonable - it means we get the workaround for erratum 794072 when erratum 754327 is enabled, but still relinquish the dead processor - either by placing it in a lower power mode when wfe is implemented as such or by returning it to the hypervisior, or in the case where wfe is a no-op, we use the workaround specified in erratum 794072 to avoid the problem.
These as two entirely orthogonal problems - the 10 nops addresses erratum 794072, and the wfe is an optimisation that makes the system more efficient when crashed either in terms of power consumption or by allowing the host/other VMs to make use of the CPU.
I don't see any reason not to use kexec() inside a VM - it has the potential to provide automated recovery from a failure of the VMs kernel with the opportunity for saving a crashdump of the failure. A panic() with a reboot timeout won't do that, and reading the libvirt documentation, setting on_reboot to "preserve" won't either (the documentation states "The preserve action for an on_reboot event is treated as a destroy".) Surely it has to be a good thing to avoiding having CPUs spinning inside a VM that is doing no useful work.
--- arch/arm/include/asm/barrier.h | 2 ++ arch/arm/include/asm/processor.h | 6 +++++- arch/arm/kernel/machine_kexec.c | 5 ++++- arch/arm/kernel/smp.c | 4 +++- arch/arm/mach-omap2/prm_common.c | 4 +++- 5 files changed, 17 insertions(+), 4 deletions(-)
arch/arm/include/asm/barrier.h +2 -0
@@ -11,6 +11,8 @@#define sev () __asm__ __volatile__ ("sev" : : : "memory")#define wfe () __asm__ __volatile__ ("wfe" : : : "memory")#define wfi () __asm__ __volatile__ ("wfi" : : : "memory") +#else +#define wfe () do { } while (0)#endif #if __LINUX_ARM_ARCH__ >=7
arch/arm/include/asm/processor.h +5 -1
@@ -77,7 +77,11 @@ extern void release_thread(struct task_struct *);unsigned long get_wchan (struct task_struct *p);#if __LINUX_ARM_ARCH__ ==6 || defined(CONFIG_ARM_ERRATA_754327 ) -#define cpu_relax () smp_mb() +#define cpu_relax () \ + do { \ + smp_mb(); \ + __asm__ __volatile__("nop; nop; nop; nop; nop; nop; nop; nop; nop; nop;"); \ + } while (0)#else #define cpu_relax () barrier()#endif
arch/arm/kernel/machine_kexec.c +4 -1
@@ -91,8 +91,11 @@ void machine_crash_nonpanic_core(void *unused)set_cpu_online (smp_processor_id (), false);atomic_dec (&waiting_for_crash_ipi); -while (1 ) + +while (1 ) {cpu_relax (); +wfe (); + } }void crash_smp_send_stop (void )
arch/arm/kernel/smp.c +3 -1
@@ -602,8 +602,10 @@ static void ipi_cpu_stop(unsigned int cpu)local_fiq_disable ();local_irq_disable (); -while (1 ) +while (1 ) {cpu_relax (); +wfe (); + } } static DEFINE_PER_CPU(struct completion *, cpu_completion);
arch/arm/mach-omap2/prm_common.c +3 -1
@@ -528,8 +528,10 @@ void omap_prm_reset_system(void) prm_ll_data->reset_system (); -while (1 ) +while (1 ) {cpu_relax (); +wfe (); + } }/**
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 94/121 bpf: fix missing prototype warnings
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 116bfa96a255123ed209da6544f74a4f2eaca5da ]
Compiling with W=1 generates warnings:
CC kernel/bpf/core.okernel/bpf/core.c:721:12: warning: no previous prototype for ?bpf_jit_alloc_exec_limit? [-Wmissing-prototypes]
721 | u64 __weak bpf_jit_alloc_exec_limit(void)
| ^~~~~~~~~~~~~~~~~~~~~~~~
kernel/bpf/core.c:757:14: warning: no previous prototype for ?bpf_jit_alloc_exec? [-Wmissing-prototypes]
757 | void *__weak bpf_jit_alloc_exec(unsigned long size)
| ^~~~~~~~~~~~~~~~~~
kernel/bpf/core.c:762:13: warning: no previous prototype for ?bpf_jit_free_exec? [-Wmissing-prototypes]
762 | void __weak bpf_jit_free_exec(void *addr)
| ^~~~~~~~~~~~~~~~~All three are weak functions that archs can override, provide proper prototypes for when a new arch provides their own.
--- include/linux/filter.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/linux/filter.h +3 -1
@@ -741,7 +741,9 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,unsigned int alignment, bpf_jit_fill_hole_t bpf_fill_ill_insns);void bpf_jit_binary_free (struct bpf_binary_header *hdr); - +u64 bpf_jit_alloc_exec_limit (void ); +void *bpf_jit_alloc_exec (unsigned long size); +void bpf_jit_free_exec (void *addr);void bpf_jit_free (struct bpf_prog *fp);struct bpf_prog *bpf_jit_blind_constants (struct bpf_prog *fp);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 95/121 cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix the accounting
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 51bee5abeab2058ea5813c5615d6197a23dbf041 ]
The only user of cgroup_subsys->free() callback is pids_cgrp_subsys which needs pids_free() to uncharge the pid.
However, ->free() is called from __put_task_struct()->cgroup_free() and this is too late. Even the trivial program which does
for (;;) {
int pid = fork();
assert(pid >= 0);
if (pid)
wait(NULL);
else
exit(0);
}can run out of limits because release_task()->call_rcu(delayed_put_task_struct) implies an RCU gp after the task/pid goes away and before the final put().
Test-case:
mkdir -p /tmp/CG
mount -t cgroup2 none /tmp/CG
echo '+pids' > /tmp/CG/cgroup.subtree_control
mkdir /tmp/CG/PID
echo 2 > /tmp/CG/PID/pids.max
perl -e 'while ($p = fork) { wait; } $p // die "fork failed: $!\n"' & echo $! > /tmp/CG/PID/cgroup.procs
Without this patch the forking process fails soon after migration.
Rename cgroup_subsys->free() to cgroup_subsys->release() and move the callsite into the new helper, cgroup_release(), called by release_task() which actually frees the pid(s).
--- include/linux/cgroup-defs.h | 2 +- include/linux/cgroup.h | 2 ++ kernel/cgroup/cgroup.c | 15 +++++++++------ kernel/cgroup/pids.c | 4 ++-- kernel/exit.c | 1 + 5 files changed, 15 insertions(+), 9 deletions(-)
include/linux/cgroup-defs.h +1 -1
@@ -523,7 +523,7 @@ struct cgroup_subsys {void (*cancel_fork)(struct task_struct *task);void (*fork)(struct task_struct *task);void (*exit)(struct task_struct *task); -void (*free)(struct task_struct *task); +void (*release)(struct task_struct *task);void (*bind)(struct cgroup_subsys_state *root_css); bool early_init:1;
include/linux/cgroup.h +2 -0
@@ -118,6 +118,7 @@ extern int cgroup_can_fork(struct task_struct *p);extern void cgroup_cancel_fork (struct task_struct *p);extern void cgroup_post_fork (struct task_struct *p);void cgroup_exit (struct task_struct *p); +void cgroup_release (struct task_struct *p);void cgroup_free (struct task_struct *p);int cgroup_init_early (void );
@@ -668,6 +669,7 @@ static inline int cgroup_can_fork(struct task_struct *p) { return 0; }static inline void cgroup_cancel_fork (struct task_struct *p) {}static inline void cgroup_post_fork (struct task_struct *p) {}static inline void cgroup_exit (struct task_struct *p) {} +static inline void cgroup_release (struct task_struct *p) {}static inline void cgroup_free (struct task_struct *p) {}static inline int cgroup_init_early (void ) {return 0 ; }
kernel/cgroup/cgroup.c +9 -6
@@ -187,7 +187,7 @@ static u64 css_serial_nr_next = 1;*/ static u16 have_fork_callback__read_mostly ;static u16 have_exit_callback__read_mostly ; -static u16 have_free_callback__read_mostly ; +static u16 have_release_callback__read_mostly ;static u16 have_canfork_callback__read_mostly ;/* cgroup namespace for init task */
@@ -5112,7 +5112,7 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss, bool early) have_fork_callback |= (bool )ss->fork << ss->id; have_exit_callback |= (bool )ss->exit << ss->id; - have_free_callback |= (bool )ss->free << ss->id; + have_release_callback |= (bool )ss->release << ss->id; have_canfork_callback |= (bool )ss->can_fork << ss->id;/* At system boot, before all subsystems have been
@@ -5546,16 +5546,19 @@ void cgroup_exit(struct task_struct *tsk) }while_each_subsys_mask (); } -void cgroup_free (struct task_struct *task) +void cgroup_release (struct task_struct *task) { -struct css_set *cset =task_css_set (task);struct cgroup_subsys *ss;int ssid; - do_each_subsys_mask(ss, ssid, have_free_callback) { - ss->free (task); + do_each_subsys_mask(ss, ssid, have_release_callback) { + ss->release (task); }while_each_subsys_mask (); +} +void cgroup_free (struct task_struct *task) +{ +struct css_set *cset =task_css_set (task);put_css_set (cset); }
kernel/cgroup/pids.c +2 -2
@@ -247,7 +247,7 @@ static void pids_cancel_fork(struct task_struct *task)pids_uncharge (pids,1 ); } -static void pids_free (struct task_struct *task) +static void pids_release (struct task_struct *task) {struct pids_cgroup *pids =css_pids (task_css (task, pids_cgrp_id));
@@ -342,7 +342,7 @@ struct cgroup_subsys pids_cgrp_subsys = { .cancel_attach = pids_cancel_attach, .can_fork = pids_can_fork, .cancel_fork = pids_cancel_fork, - .free = pids_free, + .release = pids_release, .legacy_cftypes = pids_files, .dfl_cftypes = pids_files, .threaded = true,
kernel/exit.c +1 -0
@@ -218,6 +218,7 @@ repeat: }write_unlock_irq (&tasklist_lock); +cgroup_release (p);release_thread (p);call_rcu (&p->rcu, delayed_put_task_struct);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 96/121 backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cec2b18832e26bc866bef2be22eff4e25bbc4034 ]
gpiod_get_value() gives out a warning if access to the underlying gpiochip requires sleeping, which is common for I2C based chips:
WARNING: CPU: 0 PID: 77 at drivers/gpio/gpiolib.c:2500 gpiod_get_value+0xd0/0x100
Modules linked in:
CPU: 0 PID: 77 Comm: kworker/0:2 Not tainted 4.14.0-rc3-00589-gf32897915d48-dirty #90
Hardware name: Allwinner sun4i/sun5i Families
Workqueue: events deferred_probe_work_func
[<c010ec50>] (unwind_backtrace) from [<c010b784>] (show_stack+0x10/0x14)
[<c010b784>] (show_stack) from [<c0797224>] (dump_stack+0x88/0x9c)
[<c0797224>] (dump_stack) from [<c0125b08>] (__warn+0xe8/0x100)
[<c0125b08>] (__warn) from [<c0125bd0>] (warn_slowpath_null+0x20/0x28)
[<c0125bd0>] (warn_slowpath_null) from [<c037069c>] (gpiod_get_value+0xd0/0x100)
[<c037069c>] (gpiod_get_value) from [<c03778d0>] (pwm_backlight_probe+0x238/0x508)
[<c03778d0>] (pwm_backlight_probe) from [<c0411a2c>] (platform_drv_probe+0x50/0xac)
[<c0411a2c>] (platform_drv_probe) from [<c0410224>] (driver_probe_device+0x238/0x2e8)
[<c0410224>] (driver_probe_device) from [<c040e820>] (bus_for_each_drv+0x44/0x94)
[<c040e820>] (bus_for_each_drv) from [<c040ff0c>] (__device_attach+0xb0/0x114)
[<c040ff0c>] (__device_attach) from [<c040f4f8>] (bus_probe_device+0x84/0x8c)
[<c040f4f8>] (bus_probe_device) from [<c040f944>] (deferred_probe_work_func+0x50/0x14c)
[<c040f944>] (deferred_probe_work_func) from [<c013be84>] (process_one_work+0x1ec/0x414)
[<c013be84>] (process_one_work) from [<c013ce5c>] (worker_thread+0x2b0/0x5a0)
[<c013ce5c>] (worker_thread) from [<c0141908>] (kthread+0x14c/0x154)
[<c0141908>] (kthread) from [<c0107ab0>] (ret_from_fork+0x14/0x24)This was missed in commit 0c9501f823a4 ("backlight: pwm_bl: Handle gpio that can sleep"). The code was then moved to a separate function in commit 7613c922315e ("backlight: pwm_bl: Move the checks for initial power state to a separate function").
The only usage of gpiod_get_value() is during the probe stage, which is safe to sleep in. Switch to gpiod_get_value_cansleep().
--- drivers/video/backlight/pwm_bl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/backlight/pwm_bl.c +1 -1
@@ -212,7 +212,7 @@ static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb)*/ /* if the enable GPIO is disabled, do not enable the backlight */ -if (pb->enable_gpio &&gpiod_get_value (pb->enable_gpio) ==0 ) +if (pb->enable_gpio &&gpiod_get_value_cansleep (pb->enable_gpio) ==0 )return FB_BLANK_POWERDOWN ;/* The regulator is disabled, do not enable the backlight */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 97/121 tty: increase the default flip buffer limit to 2*640K
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7ab57b76ebf632bf2231ccabe26bea33868118c6 ]
We increase the default limit for buffer memory allocation by a factor of 10 to 640K to prevent data loss when using fast serial interfaces.
For example when using RS485 without flow-control at speeds of 1Mbit/s an upwards we've run into problems such as applications being too slow to read out this buffer (on embedded devices based on imx53 or imx6).
If you want to write transmitted data to a slow SD card and thus have realtime requirements, this limit can become a problem.
That shouldn't be the case and 640K buffers fix such problems for us.
This value is a maximum limit for allocation only. It has no effect on systems that currently run fine. When transmission is slow enough applications and hardware can keep up and increasing this limit doesn't change anything.
It only _allows_ to allocate more than 2*64K in cases we currently fail to allocate memory despite having some.
--- drivers/tty/tty_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/tty_buffer.c +1 -1
@@ -25,7 +25,7 @@* Byte threshold to limit memory consumption for flip buffers. * The actual memory limit is > 2x this amount. */ -#define TTYB_DEFAULT_MEM_LIMIT 65536 +#define TTYB_DEFAULT_MEM_LIMIT (640 * 1024UL)/* * We default to dicing tty buffer allocations to this many characters
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 98/121 powerpc/pseries: Perform full re-add of CPU for topology update post-migration
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 81b61324922c67f73813d8a9c175f3c153f6a1c6 ]
On pseries systems, performing a partition migration can result in altering the nodes a CPU is assigned to on the destination system. For exampl, pre-migration on the source system CPUs are in node 1 and 3, post-migration on the destination system CPUs are in nodes 2 and 3.
Handling the node change for a CPU can cause corruption in the slab cache if we hit a timing where a CPUs node is changed while cache_reap() is invoked. The corruption occurs because the slab cache code appears to rely on the CPU and slab cache pages being on the same node.
The current dynamic updating of a CPUs node done in arch/powerpc/mm/numa.c does not prevent us from hitting this scenario.
Changing the device tree property update notification handler that recognizes an affinity change for a CPU to do a full DLPAR remove and add of the CPU instead of dynamically changing its node resolves this issue.
--- arch/powerpc/include/asm/topology.h | 2 ++ arch/powerpc/mm/numa.c | 9 +-------- arch/powerpc/platforms/pseries/hotplug-cpu.c | 19 +++++++++++++++++++ 3 files changed, 22 insertions(+), 8 deletions(-)
arch/powerpc/include/asm/topology.h +2 -0
@@ -117,6 +117,8 @@ static inline int prrn_is_enabled(void)#define topology_sibling_cpumask (cpu) (per_cpu(cpu_sibling_map, cpu))#define topology_core_cpumask (cpu) (per_cpu(cpu_core_map, cpu))#define topology_core_id (cpu) (cpu_to_core_id(cpu)) + +int dlpar_cpu_readd (int cpu);#endif #endif
arch/powerpc/mm/numa.c +1 -8
@@ -1527,13 +1527,6 @@ static void reset_topology_timer(void)#ifdef CONFIG_SMP -static void stage_topology_update (int core_id) -{ -cpumask_or (&cpu_associativity_changes_mask, - &cpu_associativity_changes_mask,cpu_sibling_mask (core_id)); -reset_topology_timer (); -} -static int dt_update_callback (struct notifier_block *nb,unsigned long action,void *data) {
@@ -1546,7 +1539,7 @@ static int dt_update_callback(struct notifier_block *nb, !of_prop_cmp(update->prop->name, "ibm,associativity")) {u32 core_id;of_property_read_u32 (update->dn,"reg" , &core_id); -stage_topology_update (core_id); + rc =dlpar_cpu_readd (core_id); rc =NOTIFY_OK ; }break ;
arch/powerpc/platforms/pseries/hotplug-cpu.c +19 -0
@@ -799,6 +799,25 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)return rc; } +int dlpar_cpu_readd (int cpu) +{ +struct device_node *dn; +struct device *dev; +u32 drc_index; +int rc; + + dev =get_cpu_device (cpu); + dn = dev->of_node; + + rc =of_property_read_u32 (dn,"ibm,my-drc-index" , &drc_index); + + rc =dlpar_cpu_remove_by_index (drc_index); +if (!rc) + rc =dlpar_cpu_add (drc_index); + +return rc; +} +int dlpar_cpu (struct pseries_hp_errorlog *hp_elog) {u32 count, drc_index;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 99/121 usb: dwc3: gadget: Fix OTG events when gadget driver isnt loaded
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 169e3b68cadb5775daca009ced4faf01ffd97dcf ]
On v3.10a in dual-role mode, if port is in device mode and gadget driver isn't loaded, the OTG event interrupts don't come through.
It seems that if the core is configured to be OTG2.0 only, then we can't leave the DCFG.DEVSPD at Super-speed (default) if we expect OTG to work properly. It must be set to High-speed.
Fix this issue by configuring DCFG.DEVSPD to the supported maximum speed at gadget init. Device tree still needs to provide correct supported maximum speed for this to work.
This issue wasn't present on v2.40a but is seen on v3.10a. It doesn't cause any side effects on v2.40a.
--- drivers/usb/dwc3/gadget.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/dwc3/gadget.c +2 -0
@@ -3286,6 +3286,8 @@ int dwc3_gadget_init(struct dwc3 *dwc) goto err4; } +dwc3_gadget_set_speed (&dwc->gadget, dwc->maximum_speed); +return 0 ; err4:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 100/121 media: mt9m111: set initial frame size other than 0x0
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 29856308137de1c21eda89411695f4fc6e9780ff ]
This driver sets initial frame width and height to 0x0, which is invalid. So set it to selection rectangle bounds instead.
This is detected by v4l2-compliance detected.
--- drivers/media/i2c/mt9m111.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/i2c/mt9m111.c +2 -0
@@ -974,6 +974,8 @@ static int mt9m111_probe(struct i2c_client *client, mt9m111->rect.top =MT9M111_MIN_DARK_ROWS ; mt9m111->rect.width =MT9M111_MAX_WIDTH ; mt9m111->rect.height =MT9M111_MAX_HEIGHT ; + mt9m111->width = mt9m111->rect.width; + mt9m111->height = mt9m111->rect.height; mt9m111->fmt = &mt9m111_colour_fmts[0 ]; mt9m111->lastpage =-1 ;mutex_init (&mt9m111->power_lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 101/121 hwrng: virtio - Avoid repeated init of completion
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit aef027db48da56b6f25d0e54c07c8401ada6ce21 ]
The virtio-rng driver uses a completion called have_data to wait for a virtio read to be fulfilled by the hypervisor. The completion is reset before placing a buffer on the virtio queue and completed by the virtio callback once data has been written into the buffer.
Prior to this commit, the driver called init_completion on this completion both during probe as well as when registering virtio buffers as part of a hwrng read operation. The second of these init_completion calls should instead be reinit_completion because the have_data completion has already been inited by probe. As described in Documentation/scheduler/completion.txt, "Calling init_completion() twice on the same completion object is most likely a bug".
This bug was present in the initial implementation of virtio-rng in f7f510ec1957 ("virtio: An entropy device, as suggested by hpa"). Back then the have_data completion was a single static completion rather than a member of one of potentially multiple virtrng_info structs as implemented later by 08e53fbdb85c ("virtio-rng: support multiple virtio-rng devices"). The original driver incorrectly used init_completion rather than INIT_COMPLETION to reset have_data during read.
Tested by running head -c48 /dev/random | hexdump within crosvm, the Chrome OS virtual machine monitor, and confirming that the virtio-rng driver successfully produces random bytes from the host.
--- drivers/char/hw_random/virtio-rng.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/hw_random/virtio-rng.c +1 -1
@@ -73,7 +73,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)if (!vi->busy) { vi->busy = true; -init_completion (&vi->have_data); +reinit_completion (&vi->have_data);register_buffer (vi, buf, size); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 102/121 soc/tegra: fuse: Fix illegal free of IO base address
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 51294bf6b9e897d595466dcda5a3f2751906a200 ]
On cases where device tree entries for fuse and clock provider are in different order, fuse driver needs to defer probing. This leads to freeing incorrect IO base address as the fuse->base variable gets overwritten once during first probe invocation. This leads to the following spew during boot:
[ 3.082285] Trying to vfree() nonexistent vm area (00000000cfe8fd94) [ 3.082308] WARNING: CPU: 5 PID: 126 at /hdd/l4t/kernel/stable/mm/vmalloc.c:1511 __vunmap+0xcc/0xd8 [ 3.082318] Modules linked in: [ 3.082330] CPU: 5 PID: 126 Comm: kworker/5:1 Tainted: G S 4.19.7-tegra-gce119d3 #1 [ 3.082340] Hardware name: quill (DT) [ 3.082353] Workqueue: events deferred_probe_work_func [ 3.082364] pstate: 40000005 (nZcv daif -PAN -UAO) [ 3.082372] pc : __vunmap+0xcc/0xd8 [ 3.082379] lr : __vunmap+0xcc/0xd8 [ 3.082385] sp : ffff00000a1d3b60 [ 3.082391] x29: ffff00000a1d3b60 x28: 0000000000000000 [ 3.082402] x27: 0000000000000000 x26: ffff000008e8b610 [ 3.082413] x25: 0000000000000000 x24: 0000000000000009 [ 3.082423] x23: ffff000009221a90 x22: ffff000009f6d000 [ 3.082432] x21: 0000000000000000 x20: 0000000000000000 [ 3.082442] x19: ffff000009f6d000 x18: ffffffffffffffff [ 3.082452] x17: 0000000000000000 x16: 0000000000000000 [ 3.082462] x15: ffff0000091396c8 x14: 0720072007200720 [ 3.082471] x13: 0720072007200720 x12: 0720072907340739 [ 3.082481] x11: 0764076607380765 x10: 0766076307300730 [ 3.082491] x9 : 0730073007300730 x8 : 0730073007280720 [ 3.082501] x7 : 0761076507720761 x6 : 0000000000000102 [ 3.082510] x5 : 0000000000000000 x4 : 0000000000000000 [ 3.082519] x3 : ffffffffffffffff x2 : ffff000009150ff8 [ 3.082528] x1 : 3d95b1429fff5200 x0 : 0000000000000000 [ 3.082538] Call trace: [ 3.082545] __vunmap+0xcc/0xd8 [ 3.082552] vunmap+0x24/0x30 [ 3.082561] __iounmap+0x2c/0x38 [ 3.082569] tegra_fuse_probe+0xc8/0x118 [ 3.082577] platform_drv_probe+0x50/0xa0 [ 3.082585] really_probe+0x1b0/0x288 [ 3.082593] driver_probe_device+0x58/0x100 [ 3.082601] __device_attach_driver+0x98/0xf0 [ 3.082609] bus_for_each_drv+0x64/0xc8 [ 3.082616] __device_attach+0xd8/0x130 [ 3.082624] device_initial_probe+0x10/0x18 [ 3.082631] bus_probe_device+0x90/0x98 [ 3.082638] deferred_probe_work_func+0x74/0xb0 [ 3.082649] process_one_work+0x1e0/0x318 [ 3.082656] worker_thread+0x228/0x450 [ 3.082664] kthread+0x128/0x130 [ 3.082672] ret_from_fork+0x10/0x18 [ 3.082678] ---[ end trace 0810fe6ba772c1c7 ]---
Fix this by retaining the value of fuse->base until driver has successfully probed.
--- drivers/soc/tegra/fuse/fuse-tegra.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/soc/tegra/fuse/fuse-tegra.c +9 -3
@@ -133,13 +133,17 @@ static int tegra_fuse_probe(struct platform_device *pdev)/* take over the memory region from the early initialization */ res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); fuse->base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (fuse->base)) -return PTR_ERR (fuse->base); +if (IS_ERR (fuse->base)) { + err =PTR_ERR (fuse->base); + fuse->base = base; +return err; + } fuse->clk =devm_clk_get (&pdev->dev,"fuse" );if (IS_ERR (fuse->clk)) {dev_err (&pdev->dev,"failed to get FUSE clock: %ld" ,PTR_ERR (fuse->clk)); + fuse->base = base;return PTR_ERR (fuse->clk); }
@@ -148,8 +152,10 @@ static int tegra_fuse_probe(struct platform_device *pdev)if (fuse->soc->probe) { err = fuse->soc->probe (fuse); -if (err <0 ) +if (err <0 ) { + fuse->base = base;return err; + } } if (tegra_fuse_create_sysfs(&pdev->dev, fuse->soc->info->size,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 103/121 HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2edefc056e4f0e6ec9508dd1aca2c18fa320efef ]
Host driver should handle interrupt mask register earlier than wake up ish FW else there will be conditions when FW interrupt comes, host PIMR register still not set ready, so move the interrupt mask setting before ish_wakeup.
Clear PISR busy_clear bit in ish_irq_handler. If not clear, there will be conditions host driver received a busy_clear interrupt (before the busy_clear mask bit is ready), it will return IRQ_NONE after check_generated_interrupt, the interrupt will never be cleared, causing the DEVICE not sending following IRQ.
Since PISR clear should not be called for the CHV device we do this change. After the change, both ISH2HOST interrupt and busy_clear interrupt will be considered as interrupt from ISH, busy_clear interrupt will return IRQ_HANDLED from IPC_IS_BUSY check.
--- drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/hid/intel-ish-hid/ipc/ipc.c +6 -3
@@ -91,7 +91,10 @@ static bool check_generated_interrupt(struct ishtp_device *dev)IPC_INT_FROM_ISH_TO_HOST_CHV_AB (pisr_val); }else { pisr_val =ish_reg_read (dev,IPC_REG_PISR_BXT ); - interrupt_generated =IPC_INT_FROM_ISH_TO_HOST_BXT (pisr_val); + interrupt_generated = !!pisr_val; +/* only busy-clear bit is RW, others are RO */ +if (pisr_val) +ish_reg_write (dev,IPC_REG_PISR_BXT , pisr_val); }return interrupt_generated;
@@ -843,11 +846,11 @@ int ish_hw_start(struct ishtp_device *dev) {ish_set_host_rdy (dev); +set_host_ready (dev); +/* After that we can enable ISH DMA operation and wakeup ISHFW */ ish_wakeup (dev); -set_host_ready (dev); -/* wait for FW-initiated reset flow */ if (!dev->recvd_hw_ready) wait_event_interruptible_timeout(dev->wait_hw_ready,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 104/121 hpet: Fix missing = character in the __setup() code of hpet_mmap_enable
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 24d48a61f2666630da130cc2ec2e526eacf229e3 ]
Commit '3d035f580699 ("drivers/char/hpet.c: allow user controlled mmap for user processes")' introduced a new kernel command line parameter hpet_mmap, that is required to expose the memory map of the HPET registers to user-space. Unfortunately the kernel command line parameter 'hpet_mmap' is broken and never takes effect due to missing '=' character in the __setup() code of hpet_mmap_enable.
Before this patch:
dmesg output with the kernel command line parameter hpet_mmap=1
[ 0.204152] HPET mmap disabled
dmesg output with the kernel command line parameter hpet_mmap=0
[ 0.204192] HPET mmap disabled
After this patch:
dmesg output with the kernel command line parameter hpet_mmap=1
[ 0.203945] HPET mmap enabled
dmesg output with the kernel command line parameter hpet_mmap=0
[ 0.204652] HPET mmap disabled
--- drivers/char/hpet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/hpet.c +1 -1
@@ -377,7 +377,7 @@ static __init int hpet_mmap_enable(char *str)pr_info ("HPET mmap %s\n" , hpet_mmap_enabled ?"enabled" :"disabled" );return 1 ; } -__setup ("hpet_mmap" , hpet_mmap_enable); +__setup ("hpet_mmap=" , hpet_mmap_enable);static int hpet_mmap (struct file *file,struct vm_area_struct *vma) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 105/121 cpu/hotplug: Mute hotplug lockdep during init
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ce48c457b95316b9a01b5aa9d4456ce820df94b4 ]
Since we've had:
commit cb538267ea1e ("jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked() operations")
we've been getting some lockdep warnings during init, such as on HiKey960:
[ 0.820495] WARNING: CPU: 4 PID: 0 at kernel/cpu.c:316 lockdep_assert_cpus_held+0x3c/0x48 [ 0.820498] Modules linked in: [ 0.820509] CPU: 4 PID: 0 Comm: swapper/4 Tainted: G S 4.20.0-rc5-00051-g4cae42a #34 [ 0.820511] Hardware name: HiKey960 (DT) [ 0.820516] pstate: 600001c5 (nZCv dAIF -PAN -UAO) [ 0.820520] pc : lockdep_assert_cpus_held+0x3c/0x48 [ 0.820523] lr : lockdep_assert_cpus_held+0x38/0x48 [ 0.820526] sp : ffff00000a9cbe50 [ 0.820528] x29: ffff00000a9cbe50 x28: 0000000000000000 [ 0.820533] x27: 00008000b69e5000 x26: ffff8000bff4cfe0 [ 0.820537] x25: ffff000008ba69e0 x24: 0000000000000001 [ 0.820541] x23: ffff000008fce000 x22: ffff000008ba70c8 [ 0.820545] x21: 0000000000000001 x20: 0000000000000003 [ 0.820548] x19: ffff00000a35d628 x18: ffffffffffffffff [ 0.820552] x17: 0000000000000000 x16: 0000000000000000 [ 0.820556] x15: ffff00000958f848 x14: 455f3052464d4d34 [ 0.820559] x13: 00000000769dde98 x12: ffff8000bf3f65a8 [ 0.820564] x11: 0000000000000000 x10: ffff00000958f848 [ 0.820567] x9 : ffff000009592000 x8 : ffff00000958f848 [ 0.820571] x7 : ffff00000818ffa0 x6 : 0000000000000000 [ 0.820574] x5 : 0000000000000000 x4 : 0000000000000001 [ 0.820578] x3 : 0000000000000000 x2 : 0000000000000001 [ 0.820582] x1 : 00000000ffffffff x0 : 0000000000000000 [ 0.820587] Call trace: [ 0.820591] lockdep_assert_cpus_held+0x3c/0x48 [ 0.820598] static_key_enable_cpuslocked+0x28/0xd0 [ 0.820606] arch_timer_check_ool_workaround+0xe8/0x228 [ 0.820610] arch_timer_starting_cpu+0xe4/0x2d8 [ 0.820615] cpuhp_invoke_callback+0xe8/0xd08 [ 0.820619] notify_cpu_starting+0x80/0xb8 [ 0.820625] secondary_start_kernel+0x118/0x1d0
We've also had a similar warning in sched_init_smp() for every asymmetric system that would enable the sched_asym_cpucapacity static key, although that was singled out in:
commit 40fa3780bac2 ("sched/core: Take the hotplug lock in sched_init_smp()")
Those warnings are actually harmless, since we cannot have hotplug operations at the time they appear. Instead of starting to sprinkle useless hotplug lock operations in the init codepaths, mute the warnings until they start warning about real problems.
--- kernel/cpu.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/cpu.c +9 -0
@@ -314,6 +314,15 @@ void cpus_write_unlock(void)void lockdep_assert_cpus_held (void ) { +/* +* We can't have hotplug operations before userspace starts running, +* and some init codepaths will knowingly not take the hotplug lock. +* This is all valid, so mute lockdep until it makes sense to report +* unheld locks. +*/ +if (system_state <SYSTEM_RUNNING ) +return ; +percpu_rwsem_assert_held (&cpu_hotplug_lock); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 106/121 dmaengine: imx-dma: fix warning comparison of distinct pointer types
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9227ab5643cb8350449502dd9e3168a873ab0e3b ]
The warning got introduced by commit 930507c18304 ("arm64: add basic Kconfig symbols for i.MX8"). Since it got enabled for arm64. The warning haven't been seen before since size_t was 'unsigned int' when built on arm32.
../drivers/dma/imx-dma.c: In function ‘imxdma_sg_next’:../include/linux/kernel.h:846:29: warning: comparison of distinct pointer types lacks a cast
(!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
^~
../include/linux/kernel.h:860:4: note: in expansion of macro ‘__typecheck’
(__typecheck(x, y) && __no_side_effects(x, y))
^~~~~~~~~~~
../include/linux/kernel.h:870:24: note: in expansion of macro ‘__safe_cmp’
__builtin_choose_expr(__safe_cmp(x, y), \
^~~~~~~~~~
../include/linux/kernel.h:879:19: note: in expansion of macro ‘__careful_cmp’
#define min(x, y) __careful_cmp(x, y, <)
^~~~~~~~~~~~~
../drivers/dma/imx-dma.c:288:8: note: in expansion of macro ‘min’
now = min(d->len, sg_dma_len(sg));
^~~Rework so that we use min_t and pass in the size_t that returns the minimum of two values, using the specified type.
--- drivers/dma/imx-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/imx-dma.c +1 -1
@@ -290,7 +290,7 @@ static inline int imxdma_sg_next(struct imxdma_desc *d)struct scatterlist *sg = d->sg;unsigned long now; - now =min (d->len,sg_dma_len (sg)); + now =min_t (size_t, d->len,sg_dma_len (sg));if (d->len !=IMX_DMA_LENGTH_LOOP ) d->len -= now;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 107/121 dmaengine: qcom_hidma: assign channel cookie correctly
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 546c0547555efca8ba8c120716c325435e29df1b ]
When dma_cookie_complete() is called in hidma_process_completed(), dma_cookie_status() will return DMA_COMPLETE in hidma_tx_status(). Then, hidma_txn_is_success() will be called to use channel cookie mchan->last_success to do additional DMA status check. Current code assigns mchan->last_success after dma_cookie_complete(). This causes a race condition of dma_cookie_status() returns DMA_COMPLETE before mchan->last_success is assigned correctly. The race will cause hidma_tx_status() return DMA_ERROR but the transaction is actually a success. Moreover, in async_tx case, it will cause a timeout panic in async_tx_quiesce().
Kernel panic - not syncing: async_tx_quiesce: DMA error waiting for transaction ... Call trace: [<ffff000008089994>] dump_backtrace+0x0/0x1f4 [<ffff000008089bac>] show_stack+0x24/0x2c [<ffff00000891e198>] dump_stack+0x84/0xa8 [<ffff0000080da544>] panic+0x12c/0x29c [<ffff0000045d0334>] async_tx_quiesce+0xa4/0xc8 [async_tx] [<ffff0000045d03c8>] async_trigger_callback+0x70/0x1c0 [async_tx] [<ffff0000048b7d74>] raid_run_ops+0x86c/0x1540 [raid456] [<ffff0000048bd084>] handle_stripe+0x5e8/0x1c7c [raid456] [<ffff0000048be9ec>] handle_active_stripes.isra.45+0x2d4/0x550 [raid456] [<ffff0000048beff4>] raid5d+0x38c/0x5d0 [raid456] [<ffff000008736538>] md_thread+0x108/0x168 [<ffff0000080fb1cc>] kthread+0x10c/0x138 [<ffff000008084d34>] ret_from_fork+0x10/0x18
--- drivers/dma/qcom/hidma.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/dma/qcom/hidma.c +9 -8
@@ -133,24 +133,25 @@ static void hidma_process_completed(struct hidma_chan *mchan) desc = &mdesc->desc; last_cookie = desc->cookie; + llstat =hidma_ll_status (mdma->lldev, mdesc->tre_ch); +spin_lock_irqsave (&mchan->lock, irqflags); +if (llstat ==DMA_COMPLETE ) { + mchan->last_success = last_cookie; + result.result =DMA_TRANS_NOERROR ; + }else { + result.result =DMA_TRANS_ABORTED ; + } +dma_cookie_complete (desc);spin_unlock_irqrestore (&mchan->lock, irqflags); - llstat =hidma_ll_status (mdma->lldev, mdesc->tre_ch);dmaengine_desc_get_callback (desc, &cb);dma_run_dependencies (desc);spin_lock_irqsave (&mchan->lock, irqflags);list_move (&mdesc->node, &mchan->free); - -if (llstat ==DMA_COMPLETE ) { - mchan->last_success = last_cookie; - result.result =DMA_TRANS_NOERROR ; - }else - result.result =DMA_TRANS_ABORTED ; -spin_unlock_irqrestore (&mchan->lock, irqflags);dmaengine_desc_callback_invoke (&cb, &result);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 108/121 dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_*
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 875aac8a46424e5b73a9ff7f40b83311b609e407 ]
In async_tx_test_ack(), it uses flags in struct dma_async_tx_descriptor to check the ACK status. As hidma reuses the descriptor in a free list when hidma_prep_dma_*(memcpy/memset) is called, the flag will keep ACKed if the descriptor has been used before. This will cause a BUG_ON in async_tx_quiesce().
kernel BUG at crypto/async_tx/async_tx.c:282!
Internal error: Oops - BUG: 0 1 SMP ... task: ffff8017dd3ec000 task.stack: ffff8017dd3e8000 PC is at async_tx_quiesce+0x54/0x78 [async_tx] LR is at async_trigger_callback+0x98/0x110 [async_tx]
This patch initializes flags in dma_async_tx_descriptor by the flags passed from the caller when hidma_prep_dma_*(memcpy/memset) is called.
--- drivers/dma/qcom/hidma.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/qcom/hidma.c +2 -0
@@ -411,6 +411,7 @@ hidma_prep_dma_memcpy(struct dma_chan *dmach, dma_addr_t dest, dma_addr_t src,if (!mdesc)return NULL ; + mdesc->desc.flags = flags;hidma_ll_set_transfer_params (mdma->lldev, mdesc->tre_ch, src, dest, len, flags,HIDMA_TRE_MEMCPY );
@@ -443,6 +444,7 @@ hidma_prep_dma_memset(struct dma_chan *dmach, dma_addr_t dest, int value,if (!mdesc)return NULL ; + mdesc->desc.flags = flags;hidma_ll_set_transfer_params (mdma->lldev, mdesc->tre_ch, value, dest, len, flags,HIDMA_TRE_MEMSET );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 109/121 netfilter: physdev: relax br_netfilter dependency
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8e2f311a68494a6677c1724bdcb10bada21af37c ]
Following command:
iptables -D FORWARD -m physdev ...
causes connectivity loss in some setups.
Reason is that iptables userspace will probe kernel for the module revision of the physdev patch, and physdev has an artificial dependency on br_netfilter (xt_physdev use makes no sense unless a br_netfilter module is loaded).
This causes the "phydev" module to be loaded, which in turn enables the "call-iptables" infrastructure.
bridged packets might then get dropped by the iptables ruleset.
The better fix would be to change the "call-iptables" defaults to 0 and enforce explicit setting to 1, but that breaks backwards compatibility.
This does the next best thing: add a request_module call to checkentry. This was a stray '-D ... -m physdev' won't activate br_netfilter anymore.
--- include/net/netfilter/br_netfilter.h | 1 - net/bridge/br_netfilter_hooks.c | 5 ----- net/netfilter/xt_physdev.c | 9 +++++++-- 3 files changed, 7 insertions(+), 8 deletions(-)
include/net/netfilter/br_netfilter.h +0 -1
@@ -49,7 +49,6 @@ static inline struct rtable *bridge_parent_rtable(const struct net_device *dev) }struct net_device *setup_pre_routing (struct sk_buff *skb); -void br_netfilter_enable (void );#if IS_ENABLED (CONFIG_IPV6 )int br_validate_ipv6 (struct net *net,struct sk_buff *skb);
net/bridge/br_netfilter_hooks.c +0 -5
@@ -881,11 +881,6 @@ static const struct nf_br_ops br_ops = { .br_dev_xmit_hook = br_nf_dev_xmit, }; -void br_netfilter_enable (void ) -{ -} -EXPORT_SYMBOL_GPL (br_netfilter_enable); -/* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because * br_dev_queue_push_xmit is called afterwards */ static const struct nf_hook_ops br_nf_ops[] = {
net/netfilter/xt_physdev.c +7 -2
@@ -96,8 +96,7 @@ match_outdev:static int physdev_mt_check (const struct xt_mtchk_param *par) {const struct xt_physdev_info *info = par->matchinfo; - -br_netfilter_enable (); +static bool brnf_probed__read_mostly ;if (!(info->bitmask &XT_PHYSDEV_OP_MASK ) || info->bitmask & ~XT_PHYSDEV_OP_MASK )
@@ -113,6 +112,12 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)if (par->hook_mask & (1 <<NF_INET_LOCAL_OUT ))return -EINVAL ; } + +if (!brnf_probed) { + brnf_probed = true; +request_module ("br_netfilter" ); + } +return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 110/121 media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 49710c32cd9d6626a77c9f5f978a5f58cb536b35 ]
Previously when doing format enumeration, it was returning all
formats supported by driver, even if they're not supported by hw.
Add missing check for fmt_ver_flag, so it'll be fixed and only those
supported by hw will be returned. Similar thing is already done in s5p_jpeg_find_format.
It was found by using v4l2-compliance tool and checking result
of VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS test
and using v4l2-ctl to get list of all supported formats.
Tested on s5pv210-galaxys (Samsung i9000 phone).
--- drivers/media/platform/s5p-jpeg/jpeg-core.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/media/platform/s5p-jpeg/jpeg-core.c +11 -8
@@ -1293,13 +1293,16 @@ static int s5p_jpeg_querycap(struct file *file, void *priv,return 0 ; } -static int enum_fmt (struct s5p_jpeg_fmt *sjpeg_formats,int n, +static int enum_fmt (struct s5p_jpeg_ctx *ctx, +struct s5p_jpeg_fmt *sjpeg_formats,int n,struct v4l2_fmtdesc *f,u32 type) {int i, num =0 ; +unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag;for (i =0 ; i < n; ++i) { -if (sjpeg_formats[i].flags & type) { +if (sjpeg_formats[i].flags & type && + sjpeg_formats[i].flags & fmt_ver_flag) {/* index-th format of type type found ? */ if (num == f->index)break ;
@@ -1326,11 +1329,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, void *priv,struct s5p_jpeg_ctx *ctx =fh_to_ctx (priv);if (ctx->mode ==S5P_JPEG_ENCODE ) -return enum_fmt (sjpeg_formats,SJPEG_NUM_FORMATS , f, +return enum_fmt (ctx, sjpeg_formats,SJPEG_NUM_FORMATS , f,SJPEG_FMT_FLAG_ENC_CAPTURE ); -return enum_fmt (sjpeg_formats,SJPEG_NUM_FORMATS , f, -SJPEG_FMT_FLAG_DEC_CAPTURE ); +return enum_fmt (ctx, sjpeg_formats,SJPEG_NUM_FORMATS , f, +SJPEG_FMT_FLAG_DEC_CAPTURE ); } static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv,
@@ -1339,11 +1342,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv,struct s5p_jpeg_ctx *ctx =fh_to_ctx (priv);if (ctx->mode ==S5P_JPEG_ENCODE ) -return enum_fmt (sjpeg_formats,SJPEG_NUM_FORMATS , f, +return enum_fmt (ctx, sjpeg_formats,SJPEG_NUM_FORMATS , f,SJPEG_FMT_FLAG_ENC_OUTPUT ); -return enum_fmt (sjpeg_formats,SJPEG_NUM_FORMATS , f, -SJPEG_FMT_FLAG_DEC_OUTPUT ); +return enum_fmt (ctx, sjpeg_formats,SJPEG_NUM_FORMATS , f, +SJPEG_FMT_FLAG_DEC_OUTPUT ); } static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 111/121 regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f01a7beb6791f1c419424c1a6958b7d0a289c974 ]
The act8600_sudcdc_voltage_ranges setting does not match the datasheet.
The problems in below entry:
REGULATOR_LINEAR_RANGE(19000000, 191, 255, 400000),
1. The off-by-one min_sel causes wrong volatage calculation. The min_sel should be 192.
2. According to the datasheet[1] Table 7. (on page 43):
The selector 248 (0b11111000) ~ 255 (0b11111111) are 41.400V.
Also fix off-by-one for ACT8600_SUDCDC_VOLTAGE_NUM.
[1] https://active-semi.com/wp-content/uploads/ACT8600_Datasheet.pdf
--- drivers/regulator/act8865-regulator.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/regulator/act8865-regulator.c +3 -2
@@ -131,7 +131,7 @@* ACT8865 voltage number */ #define ACT8865_VOLTAGE_NUM 64 -#define ACT8600_SUDCDC_VOLTAGE_NUM 255 +#define ACT8600_SUDCDC_VOLTAGE_NUM 256struct act8865 {struct regmap *regmap;
@@ -222,7 +222,8 @@ static const struct regulator_linear_range act8600_sudcdc_voltage_ranges[] = {REGULATOR_LINEAR_RANGE (3000000 ,0 ,63 ,0 ),REGULATOR_LINEAR_RANGE (3000000 ,64 ,159 ,100000 ),REGULATOR_LINEAR_RANGE (12600000 ,160 ,191 ,200000 ), - REGULATOR_LINEAR_RANGE(19000000, 191, 255, 400000), +REGULATOR_LINEAR_RANGE (19000000 ,192 ,247 ,400000 ), + REGULATOR_LINEAR_RANGE(41400000, 248, 255, 0), }; static struct regulator_ops act8865_ops = {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 112/121 drm: Auto-set allow_fb_modifiers when given modifiers at plane init
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 890880ddfdbe256083170866e49c87618b706ac7 ]
When drivers pass non-empty lists of modifiers for initializing their planes, we can infer that they allow framebuffer modifiers and set the driver's allow_fb_modifiers mode config element.
In case the allow_fb_modifiers element was not set (some drivers tend to set them after registering planes), the modifiers will still be registered but won't be available to userspace unless the flag is set later. However in that case, the IN_FORMATS blob won't be created.
In order to avoid this case and generally reduce the trouble associated with the flag, always set allow_fb_modifiers when a non-empty list of format modifiers is passed at plane init.
--- drivers/gpu/drm/drm_plane.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/drm_plane.c +3 -0
@@ -203,6 +203,9 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, format_modifier_count++; } +if (format_modifier_count) + config->allow_fb_modifiers = true; + plane->modifier_count = format_modifier_count; plane->modifiers = kmalloc_array(format_modifier_count, sizeof(format_modifiers[0]),
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 113/121 drm/nouveau: Stop using drm_crtc_force_disable
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 934c5b32a5e43d8de2ab4f1566f91d7c3bf8cb64 ]
The correct way for legacy drivers to update properties that need to do a full modeset, is to do a full modeset.
Note that we don't need to call the drm_mode_config_internal helper because we're not changing any of the refcounted paramters.
v2: Fixup error handling (Ville). Since the old code didn't bother I decided to just delete it instead of adding even more code for just error handling.
--- drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +3 -1
@@ -750,7 +750,9 @@ static int nv17_tv_set_property(struct drm_encoder *encoder,/* Disable the crtc to ensure a full modeset is * performed whenever it's turned on again. */ if (crtc) -drm_crtc_force_disable (crtc); +drm_crtc_helper_set_mode (crtc, &crtc->mode, + crtc->x, crtc->y, + crtc->primary->fb); }return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 114/121 x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 927185c124d62a9a4d35878d7f6d432a166b74e3 ]
The kernel uses the OUTPUT_FORMAT linker script command in it's linker scripts. Most of the time, the -m option is passed to the linker with correct architecture, but sometimes (at least for x86_64) the -m option contradicts the OUTPUT_FORMAT directive.
Specifically, arch/x86/boot and arch/x86/realmode/rm produce i386 object files, but are linked with the -m elf_x86_64 linker flag when building for x86_64.
The GNU linker manpage doesn't explicitly state any tie-breakers between -m and OUTPUT_FORMAT. But with BFD and Gold linkers, OUTPUT_FORMAT overrides the emulation value specified with the -m option.
LLVM lld has a different behavior, however. When supplied with contradicting -m and OUTPUT_FORMAT values it fails with the following error message:
ld.lld: error: arch/x86/realmode/rm/header.o is incompatible with elf_x86_64
Therefore, just add the correct -m after the incorrect one (it overrides it), so the linker invocation looks like this:
ld -m elf_x86_64 -z max-page-size=0x200000 -m elf_i386 --emit-relocs -T \
realmode.lds header.o trampoline_64.o stack.o reboot.o -o realmode.elfThis is not a functional change for GNU ld, because (although not explicitly documented) OUTPUT_FORMAT overrides -m EMULATION.
Tested by building x86_64 kernel with GNU gcc/ld toolchain and booting it in QEMU.
[ bp: massage and clarify text. ]
--- arch/x86/boot/Makefile | 2 +- arch/x86/realmode/rm/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/x86/boot/Makefile +1 -1
@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE AFLAGS_header.o += -I$(objtree)/$(obj) $(obj)/header.o: $(obj)/zoffset.h -LDFLAGS_setup.elf := -T +LDFLAGS_setup.elf := -m elf_i386 -T $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE $(call if_changed,ld)
arch/x86/realmode/rm/Makefile +1 -1
@@ -47,7 +47,7 @@ $(obj)/pasyms.h: $(REALMODE_OBJS) FORCE targets += realmode.lds $(obj)/realmode.lds: $(obj)/pasyms.h -LDFLAGS_realmode.elf := --emit-relocs -T +LDFLAGS_realmode.elf := -m elf_i386 --emit-relocs -T CPPFLAGS_realmode.lds += -P -C -I$(objtree)/$(obj) targets += realmode.elf
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 115/121 selinux: do not override context on context mounts
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 53e0c2aa9a59a48e3798ef193d573ade85aa80f5 ]
Ignore all selinux_inode_notifysecctx() calls on mounts with SBLABEL_MNT flag unset. This is achived by returning -EOPNOTSUPP for this case in selinux_inode_setsecurtity() (because that function should not be called in such case anyway) and translating this error to 0 in selinux_inode_notifysecctx().
This fixes behavior of kernfs-based filesystems when mounted with the 'context=' option. Before this patch, if a node's context had been explicitly set to a non-default value and later the filesystem has been remounted with the 'context=' option, then this node would show up as having the manually-set context and not the mount-specified one.
Steps to reproduce:
# mount -t cgroup2 cgroup2 /sys/fs/cgroup/unified
# chcon unconfined_u:object_r:user_home_t:s0 /sys/fs/cgroup/unified/cgroup.stat
# ls -lZ /sys/fs/cgroup/unified
total 0
-r--r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.controllers
-rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.max.depth
-rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.max.descendants
-rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.procs
-r--r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 0 Dec 13 10:41 cgroup.stat
-rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.subtree_control
-rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.threads
# umount /sys/fs/cgroup/unified
# mount -o context=system_u:object_r:tmpfs_t:s0 -t cgroup2 cgroup2 /sys/fs/cgroup/unifiedResult before:
# ls -lZ /sys/fs/cgroup/unified
total 0
-r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.controllers
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.depth
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.descendants
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.procs
-r--r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 0 Dec 13 10:41 cgroup.stat
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.subtree_control
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.threadsResult after:
# ls -lZ /sys/fs/cgroup/unified
total 0
-r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.controllers
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.depth
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.descendants
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.procs
-r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.stat
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.subtree_control
-rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.threads--- security/selinux/hooks.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
security/selinux/hooks.c +8 -1
@@ -3339,12 +3339,16 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags) { struct inode_security_struct *isec = inode_security_novalidate(inode); +struct superblock_security_struct *sbsec = inode->i_sb->s_security;u32 newsid;int rc;if (strcmp (name,XATTR_SELINUX_SUFFIX ))return -EOPNOTSUPP ; +if (!(sbsec->flags &SBLABEL_MNT )) +return -EOPNOTSUPP ; +if (!value || !size)return -EACCES ;
@@ -6103,7 +6107,10 @@ static void selinux_inode_invalidate_secctx(struct inode *inode)*/ static int selinux_inode_notifysecctx (struct inode *inode,void *ctx,u32 ctxlen) { -return selinux_inode_setsecurity (inode,XATTR_SELINUX_SUFFIX , ctx, ctxlen,0 ); +int rc =selinux_inode_setsecurity (inode,XATTR_SELINUX_SUFFIX , + ctx, ctxlen,0 ); +/* Do not return error when suppressing label (SBLABEL_MNT not set). */ +return rc == -EOPNOTSUPP ?0 : rc; }/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 116/121 wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ba2ffc96321c8433606ceeb85c9e722b8113e5a7 ]
Release fw_status, raw_fw_status, and tx_res_if when wl12xx_fetch_firmware failed instead of meaningless goto out to avoid the following memory leak reports(Only the last one listed):
unreferenced object 0xc28a9a00 (size 512):
comm "kworker/0:4", pid 31298, jiffies 2783204 (age 203.290s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<6624adab>] kmemleak_alloc+0x40/0x74
[<500ddb31>] kmem_cache_alloc_trace+0x1ac/0x270
[<db4d731d>] wl12xx_chip_wakeup+0xc4/0x1fc [wlcore]
[<76c5db53>] wl1271_op_add_interface+0x4a4/0x8f4 [wlcore]
[<cbf30777>] drv_add_interface+0xa4/0x1a0 [mac80211]
[<65bac325>] ieee80211_reconfig+0x9c0/0x1644 [mac80211]
[<2817c80e>] ieee80211_restart_work+0x90/0xc8 [mac80211]
[<7e1d425a>] process_one_work+0x284/0x42c
[<55f9432e>] worker_thread+0x2fc/0x48c
[<abb582c6>] kthread+0x148/0x160
[<63144b13>] ret_from_fork+0x14/0x2c
[< (null)>] (null)
[<1f6e7715>] 0xffffffff--- drivers/net/wireless/ti/wlcore/main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/ti/wlcore/main.c +5 -2
@@ -1058,8 +1058,11 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool plt) goto out; ret =wl12xx_fetch_firmware (wl, plt); -if (ret <0 ) - goto out; +if (ret <0 ) { +kfree (wl->fw_status); +kfree (wl->raw_fw_status); +kfree (wl->tx_res_if); + } out:return ret;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 117/121 x86/build: Mark per-CPU symbols as absolute explicitly for LLD
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d071ae09a4a1414c1433d5ae9908959a7325b0ad ]
Accessing per-CPU variables is done by finding the offset of the variable in the per-CPU block and adding it to the address of the respective CPU's block.
Section 3.10.8 of ld.bfd's documentation states:
For expressions involving numbers, relative addresses and absolute addresses, ld follows these rules to evaluate terms:
Other binary operations, that is, between two relative addresses not in the same section, or between a relative address and an absolute address, first convert any non-absolute term to an absolute address before applying the operator."
Note that LLVM's linker does not adhere to the GNU ld's implementation and as such requires implicitly-absolute terms to be explicitly marked as absolute in the linker script. If not, it fails currently with:
ld.lld: error: ./arch/x86/kernel/vmlinux.lds:153: at least one side of the expression must be absolute ld.lld: error: ./arch/x86/kernel/vmlinux.lds:154: at least one side of the expression must be absolute Makefile:1040: recipe for target 'vmlinux' failed
This is not a functional change for ld.bfd which converts the term to an absolute symbol anyways as specified above.
Based on a previous submission by Tri Vo <[email protected]>.
--- arch/x86/kernel/vmlinux.lds.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/vmlinux.lds.S +1 -1
@@ -390,7 +390,7 @@ SECTIONS * Per-cpu symbols which need to be offset from __per_cpu_load * for the boot processor. */ -#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load +#define INIT_PER_CPU(x) init_per_cpu__##x = ABSOLUTE(x) + __per_cpu_load INIT_PER_CPU(gdt_page); INIT_PER_CPU(irq_stack_union);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 118/121 clk: rockchip: fix frac settings of GPLL clock for rk3328
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a0e447b0c50240a90ab84b7126b3c06b0bab4adc ]
This patch fixes settings of GPLL frequency in fractional mode for rk3328. In this mode, FOUTVCO is calcurated by following formula:
FOUTVCO = FREF * FBDIV / REFDIV + ((FREF * FRAC / REFDIV) >> 24)
The problem is in FREF * FRAC >> 24 term. This result always lacks one from target value is specified by rate member. For example first itme of rk3328_pll_frac_rate originally has
- rate : 1016064000
- refdiv: 3
- fbdiv : 127
- frac : 134217
- FREF * FBDIV / REFDIV = 1016000000
- (FREF * FRAC / REFDIV) >> 24 = 63999
Thus calculated rate is 1016063999. It seems wrong.
If frac has 134218 (it is increased 1 from original value), second term is 64000. All other items have same situation. So this patch adds 1 to frac member in all items of rk3328_pll_frac_rate.
--- drivers/clk/rockchip/clk-rk3328.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/clk/rockchip/clk-rk3328.c +6 -6
@@ -78,17 +78,17 @@ static struct rockchip_pll_rate_table rk3328_pll_rates[] = {static struct rockchip_pll_rate_table rk3328_pll_frac_rates[] = {/* _mhz, _refdiv, _fbdiv, _postdiv1, _postdiv2, _dsmpd, _frac */ -RK3036_PLL_RATE (1016064000 ,3 ,127 ,1 ,1 ,0 ,134217 ), +RK3036_PLL_RATE (1016064000 ,3 ,127 ,1 ,1 ,0 ,134218 ),/* vco = 1016064000 */ -RK3036_PLL_RATE (983040000 ,24 ,983 ,1 ,1 ,0 ,671088 ), +RK3036_PLL_RATE (983040000 ,24 ,983 ,1 ,1 ,0 ,671089 ),/* vco = 983040000 */ -RK3036_PLL_RATE (491520000 ,24 ,983 ,2 ,1 ,0 ,671088 ), +RK3036_PLL_RATE (491520000 ,24 ,983 ,2 ,1 ,0 ,671089 ),/* vco = 983040000 */ -RK3036_PLL_RATE (61440000 ,6 ,215 ,7 ,2 ,0 ,671088 ), +RK3036_PLL_RATE (61440000 ,6 ,215 ,7 ,2 ,0 ,671089 ),/* vco = 860156000 */ -RK3036_PLL_RATE (56448000 ,12 ,451 ,4 ,4 ,0 ,9797894 ), +RK3036_PLL_RATE (56448000 ,12 ,451 ,4 ,4 ,0 ,9797895 ),/* vco = 903168000 */ -RK3036_PLL_RATE (40960000 ,12 ,409 ,4 ,5 ,0 ,10066329 ), +RK3036_PLL_RATE (40960000 ,12 ,409 ,4 ,5 ,0 ,10066330 ),/* vco = 819200000 */ {/* sentinel */ }, };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 119/121 dmaengine: tegra: avoid overflow of byte tracking
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e486df39305864604b7e25f2a95d51039517ac57 ]
The dma_desc->bytes_transferred counter tracks the number of bytes moved by the DMA channel. This is then used to calculate the information passed back in the in the tegra_dma_tx_status callback, which is usually fine.
When the DMA channel is configured as continous, then the bytes_transferred counter will increase over time and eventually overflow to become negative so the residue count will become invalid and the ALSA sound-dma code will report invalid hardware pointer values to the application. This results in some users becoming confused about the playout position and putting audio data in the wrong place.
To fix this issue, always ensure the bytes_transferred field is modulo the size of the request. We only do this for the case of the cyclic transfer done ISR as anyone attempting to move 2GiB of DMA data in one transfer is unlikely.
Note, we don't fix the issue that we should /never/ transfer a negative number of bytes so we could make those fields unsigned.
--- drivers/dma/tegra20-apb-dma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/dma/tegra20-apb-dma.c +4 -1
@@ -635,7 +635,10 @@ static void handle_cont_sngl_cycle_dma_done(struct tegra_dma_channel *tdc, sgreq =list_first_entry (&tdc->pending_sg_req,typeof (*sgreq), node); dma_desc = sgreq->dma_desc; - dma_desc->bytes_transferred += sgreq->req_len; +/* if we dma for long enough the transfer count will wrap */ + dma_desc->bytes_transferred = + (dma_desc->bytes_transferred + sgreq->req_len) % + dma_desc->bytes_requested;/* Callback need to be call */ if (!dma_desc->cb_count)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 120/121 drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c978ae9bde582e82a04c63a4071701691dd8b35c ]
We aren't supposed to force a stop+start between every i2c msg when performing multi message transfers. This should eg. cause the DDC segment address to be reset back to 0 between writing the segment address and reading the actual EDID extension block.
To quote the E-DDC spec:
"... this standard requires that the segment pointer be
reset to 00h when a NO ACK or a STOP condition is received."
Since we're going to touch this might as well consult the I2C_M_STOP flag to determine whether we want to force the stop or not.
Cc: Brian Vincent <[email protected]>
References: https://bugs.freedesktop.org/show_bug.cgi?id=108081
--- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_dp_mst_topology.c +1 -0
@@ -3199,6 +3199,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs msg.u.i2c_read.transactions[i].i2c_dev_id = msgs[i].addr; msg.u.i2c_read.transactions[i].num_bytes = msgs[i].len; msg.u.i2c_read.transactions[i].bytes = msgs[i].buf; + msg.u.i2c_read.transactions[i].no_stop_bit = !(msgs[i].flags &I2C_M_STOP ); } msg.u.i2c_read.read_i2c_device_id = msgs[num -1 ].addr; msg.u.i2c_read.num_bytes_read = msgs[num -1 ].len;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 121/121 ACPI / video: Extend chassis-type detection with a "Lunch Box" check
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d693c008e3ca04db5916ff72e68ce661888a913b ]
Commit 53fa1f6e8a59 ("ACPI / video: Only default only_lcd to true on Win8-ready _desktops_") introduced chassis type detection, limiting the lcd_only check for the backlight to devices where the chassis-type indicates their is no builtin LCD panel.
The purpose of the lcd_only check is to avoid advertising a backlight interface on desktops, since skylake and newer machines seem to always have a backlight interface even if there is no LCD panel. The limiting of this check to desktops only was done to avoid breaking backlight support on some laptops which do not have the lcd flag set.
The Fujitsu ESPRIMO Q910 which is a compact (NUC like) desktop machine has a chassis type of 0x10 aka "Lunch Box". Without the lcd_only check we end up falsely advertising backlight/brightness control on this device. This commit extend the dmi_is_desktop check to return true for type 0x10 to fix this.
--- drivers/acpi/acpi_video.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/acpi_video.c +1 -0
@@ -2142,6 +2142,7 @@ static bool dmi_is_desktop(void)case 0x05 :/* Pizza Box */ case 0x06 :/* Mini Tower */ case 0x07 :/* Tower */ +case 0x10 :/* Lunch Box */ case 0x11 :/* Main Server Chassis */ return true; }
Signature · 1 line
2.19.1
stable-rc/linux-4.14.y boot: 115 boots: 1 failed, 96 passed with 18 offline (v4.14.110-122-g662f0922cca4)
stable-rc/linux-4.14.y boot: 115 boots: 1 failed, 96 passed with 18 offline (v4.14.110-122-g662f0922cca4)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.14.110-122-g662f0922cca4/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.110-122-g662f0922cca4/
Tree: stable-rc
Branch: linux-4.14.y
Git Describe: v4.14.110-122-g662f0922cca4
Git Commit: 662f0922cca4c200ee0fc72591d6684e59fa2861
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 62 unique boards, 23 SoC families, 14 builds out of 201
Boot Failure Detected:
arm64:
defconfig:
gcc-7:
rk3399-firefly: 1 failed lab
Offline Platforms:
arm:
bcm2835_defconfig:
gcc-7
bcm2835-rpi-b: 1 offline lab
multi_v7_defconfig:
gcc-7
alpine-db: 1 offline lab
at91-sama5d4_xplained: 1 offline lab
qcom-apq8064-cm-qs600: 1 offline lab
qcom-apq8064-ifc6410: 1 offline lab
socfpga_cyclone5_de0_sockit: 1 offline lab
sun5i-r8-chip: 1 offline lab
tegra124-jetson-tk1: 1 offline lab
tegra20-iris-512: 1 offline lab
tegra_defconfig:
gcc-7
tegra124-jetson-tk1: 1 offline lab
tegra20-iris-512: 1 offline lab
sunxi_defconfig:
gcc-7
sun5i-r8-chip: 1 offline lab
sama5_defconfig:
gcc-7
at91-sama5d4_xplained: 1 offline lab
qcom_defconfig:
gcc-7
qcom-apq8064-cm-qs600: 1 offline lab
qcom-apq8064-ifc6410: 1 offline labarm64:
defconfig:
gcc-7
apq8016-sbc: 1 offline lab
juno-r2: 1 offline lab
mt7622-rfb1: 1 offline lab---
For more info write to <[email protected]>
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.111 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Apr 6 08:44:23 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.111-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.14.111-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: 4c8aee9c89b14fe8bba63a014b2ec11588683406
git describe: v4.14.110-121-g4c8aee9c89b1
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.110-121-g4c8aee9c89b1
No regressions (compared to build v4.14.109-230-g662f0922cca4)
No fixes (compared to build v4.14.109-230-g662f0922cca4)
Ran 23331 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.111 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Apr 6 08:44:23 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.111-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.111 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Apr 6 08:44:23 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.111-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
22 tests: 22 pass, 0 failLinux version: 4.14.111-rc1-g662f092
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Cheers
Jon
Signature · 1 line
nvpublic
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.111 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Apr 6 08:44:23 UTC 2019. Anything received after that time might be too late.
For v4.14.110-121-g4c8aee9:
Build results:
total: 172 pass: 172 fail: 0 Qemu test results: total: 329 pass: 329 fail: 0
Guenter