5.4.8-stable review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.4.8-stable review
This is the start of the stable review cycle for the 5.4.8 release. There are 191 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 04 Jan 2020 21:55:35 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.8-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.8-rc1
Yangbo Lu <[email protected]>
mmc: sdhci-of-esdhc: re-implement erratum A-009204 workaround
Yangbo Lu <[email protected]>
mmc: sdhci-of-esdhc: fix up erratum A-008171 workaround
Stefano Garzarella <[email protected]>
vhost/vsock: accept only packets with the right dst_cid
Netanel Belgazal <[email protected]>
net: ena: fix napi handler misbehavior when the napi budget is zero
Russell King <[email protected]>
net: phylink: fix interface passed to mac_link_up
Hangbin Liu <[email protected]>
ipv6/addrconf: only check invalid header values when NETLINK_F_STRICT_CHK is set
Jonathan Lemon <[email protected]>
bnxt: apply computed clamp value for coalece parameter
Taehee Yoo <[email protected]>
gtp: do not allow adding duplicate tid and ms_addr pdp context
Taehee Yoo <[email protected]>
gtp: fix an use-after-free in ipv4_pdp_find()
Haiyang Zhang <[email protected]>
hv_netvsc: Fix tx_table init in rndis_set_subchannel()
Eric Dumazet <[email protected]>
tcp/dccp: fix possible race __inet_lookup_established()
Eric Dumazet <[email protected]>
tcp: do not send empty skb from tcp_write_xmit()
Mahesh Bandewar <[email protected]>
bonding: fix active-backup transition after link failure
Taehee Yoo <[email protected]>
gtp: avoid zero size hashtable
Taehee Yoo <[email protected]>
gtp: fix wrong condition in gtp_genl_dump_pdp()
Russell King <[email protected]>
net: marvell: mvpp2: phylink requires the link interrupt
Vladimir Oltean <[email protected]>
net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S
Hangbin Liu <[email protected]>
net/dst: do not confirm neighbor for vxlan and geneve pmtu update
Hangbin Liu <[email protected]>
sit: do not confirm neighbor when do pmtu update
Hangbin Liu <[email protected]>
vti: do not confirm neighbor when do pmtu update
Hangbin Liu <[email protected]>
tunnel: do not confirm neighbor when do pmtu update
Hangbin Liu <[email protected]>
net/dst: add new function skb_dst_update_pmtu_no_confirm
Hangbin Liu <[email protected]>
gtp: do not confirm neighbor when do pmtu update
Hangbin Liu <[email protected]>
ip6_gre: do not confirm neighbor when do pmtu update
Hangbin Liu <[email protected]>
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
Ido Schimmel <[email protected]>
mlxsw: spectrum: Use dedicated policer for VRRP packets
Amit Cohen <[email protected]>
mlxsw: spectrum_router: Skip loopback RIFs during MAC validation
Vasundhara Volam <[email protected]>
bnxt_en: Add missing devlink health reporters for VFs.
Vasundhara Volam <[email protected]>
bnxt_en: Fix the logic that creates the health reporters.
Vasundhara Volam <[email protected]>
bnxt_en: Remove unnecessary NULL checks for fw_health
Vasundhara Volam <[email protected]>
bnxt_en: Fix bp->fw_health allocation and free logic.
Vasundhara Volam <[email protected]>
bnxt_en: Return error if FW returns more data than dump length
Michael Chan <[email protected]>
bnxt_en: Free context memory in the open path if firmware has been reset.
Michael Chan <[email protected]>
bnxt_en: Fix MSIX request logic for RDMA driver.
Antonio Messina <[email protected]>
udp: fix integer overflow while computing available space in sk_rcvbuf
Cambda Zhu <[email protected]>
tcp: Fix highest_sack and highest_sack_seq
Vladis Dronov <[email protected]>
ptp: fix the race between the release of ptp_clock and cdev
Martin Blumenstingl <[email protected]>
net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs
Eric Dumazet <[email protected]>
net_sched: sch_fq: properly set sk->sk_pacing_status
Davide Caratti <[email protected]>
net/sched: add delete_empty() to filters and use it in cls_flower
Shmulik Ladkani <[email protected]>
net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device
Madalin Bucur <[email protected]>
net: phy: aquantia: add suspend / resume ops for AQR105
Vladyslav Tarasiuk <[email protected]>
net/mlxfw: Fix out-of-memory error in mfa2 flash burning
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Fix IP fragment location and behavior
Rahul Lakkireddy <[email protected]>
cxgb4/cxgb4vf: fix flow control display for auto negotiation
Brian Foster <[email protected]>
xfs: fix mount failure crash on invalid iclog memory access
Daniel Vetter <[email protected]>
drm: limit to INT_MAX in create_blob ioctl
Kees Cook <[email protected]>
uaccess: disallow > INT_MAX copy sizes
Tetsuo Handa <[email protected]>
tomoyo: Don't use nifty names on sockets.
Eric Dumazet <[email protected]>
hrtimer: Annotate lockless access to timer->state
Eric Dumazet <[email protected]>
net: icmp: fix data-race in cmp_global_allow()
Eric Dumazet <[email protected]>
net: add a READ_ONCE() in skb_peek_tail()
Eric Dumazet <[email protected]>
inetpeer: fix data-race in inet_putpeer / inet_putpeer
Eric Dumazet <[email protected]>
netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
Ursula Braun <[email protected]>
net/smc: add fallback check to connect()
Andrew Donnellan <[email protected]>
powerpc: Fix __clear_user() with KUAP enabled
Eric Dumazet <[email protected]>
6pack,mkiss: fix possible deadlock
Florian Westphal <[email protected]>
netfilter: ebtables: compat: reject all padding in matches/watchers
Anders Kaseorg <[email protected]>
Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection"
Yufen Yu <[email protected]>
md: make sure desc_nr less than MD_SB_DISKS
Marcelo Ricardo Leitner <[email protected]>
sctp: fix err handling of stream initialization
Greg Kroah-Hartman <[email protected]>
Revert "powerpc/vcpu: Assume dedicated processors as non-preempt"
Mike Rapoport <[email protected]>
userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
Johannes Weiner <[email protected]>
kernel: sysctl: make drop_caches write-only
Mike Kravetz <[email protected]>
mm/hugetlbfs: fix error handling when setting up mounts
Anders Roxell <[email protected]>
selftests: vm: add fragment CONFIG_TEST_VMALLOC
Vasily Gorbik <[email protected]>
s390: disable preemption when switching to nodat stack with CALL_ON_STACK
Daniel Baluta <[email protected]>
mailbox: imx: Fix Tx doorbell shutdown path
Ding Xiang <[email protected]>
ocfs2: fix passing zero to 'PTR_ERR' warning
Thomas Richter <[email protected]>
s390/cpum_sf: Check for SDBT and SDB consistency
Vasily Gorbik <[email protected]>
s390/unwind: filter out unreliable bogus %r14
Masahiro Yamada <[email protected]>
libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
Daniel Baluta <[email protected]>
mailbox: imx: Clear the right interrupts at shutdown
Harald Freudenberger <[email protected]>
s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
Arnaldo Carvalho de Melo <[email protected]>
perf regs: Make perf_reg_name() return "unknown" instead of NULL
Adrian Hunter <[email protected]>
perf script: Fix brstackinsn for AUXTRACE
Arnaldo Carvalho de Melo <[email protected]>
perf diff: Use llabs() with 64-bit values
Ronnie Sahlberg <[email protected]>
cifs: move cifsFileInfo_put logic into a work-queue
Diego Elio Pettenò <[email protected]>
cdrom: respect device capabilities during opening action
Erhard Furtner <[email protected]>
of: unittest: fix memory leak in attach_node_and_children
Jens Axboe <[email protected]>
io_uring: io_allocate_scq_urings() should return a sane state
Johannes Berg <[email protected]>
um: virtio: Keep reading on -EAGAIN
Paulo Alcantara (SUSE) <[email protected]>
cifs: Fix use-after-free bug in cifs_reconnect()
Chengguang Xu <[email protected]>
f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project()
Nathan Chancellor <[email protected]>
powerpc: Don't add -mabi= flags when building with Clang
Masahiro Yamada <[email protected]>
scripts/kallsyms: fix definitely-lost memory leak
Jason Gunthorpe <[email protected]>
drm/amdgpu: Call find_vma under mmap_sem
Colin Ian King <[email protected]>
apparmor: fix unsigned len comparison with less than zero
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic
Srinivas Pandruvada <[email protected]>
tools/power/x86/intel-speed-select: Ignore missing config level
Andy Shevchenko <[email protected]>
gpio: lynxpoint: Setup correct IRQ handlers
Vladimir Oltean <[email protected]>
gpio: mpc8xxx: Don't overwrite default irq_set_type callback
Gayatri Kammela <[email protected]>
platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support to intel_pmc_core driver
Gayatri Kammela <[email protected]>
platform/x86: intel_pmc_core: Fix the SoC naming inconsistency
Russell King <[email protected]>
gpio/mpc8xxx: fix qoriq GPIO reading
Omer Shpigelman <[email protected]>
habanalabs: skip VA block list update in reset flow
Sahitya Tummala <[email protected]>
f2fs: Fix deadlock in f2fs_gc() context during atomic files handling
Bart Van Assche <[email protected]>
scsi: target: iscsi: Wait for all commands to finish before freeing a session
Anatol Pomazau <[email protected]>
scsi: iscsi: Don't send data to unbound connection
Can Guo <[email protected]>
scsi: ufs: Fix up auto hibern8 enablement
Bart Van Assche <[email protected]>
scsi: target: core: Release SPC-2 reservations when closing a session
Finn Thain <[email protected]>
scsi: NCR5380: Add disconnect_mask module parameter
Maurizio Lombardi <[email protected]>
scsi: scsi_debug: num_tgts must be >= 0
Subhash Jadavani <[email protected]>
scsi: ufs: Fix error handing during hibern8 enter
peter chang <[email protected]>
scsi: pm80xx: Fix for SATA device discovery
Christophe Leroy <[email protected]>
powerpc/fixmap: Use __fix_to_virt() instead of fix_to_virt()
Kevin Hao <[email protected]>
watchdog: Fix the race between the release of watchdog_core_data and cdev
Julia Cartwright <[email protected]>
watchdog: prevent deferral of watchdogd wakeup on RT
Fabio Estevam <[email protected]>
watchdog: imx7ulp: Fix reboot hang
Andrew Duggan <[email protected]>
HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device
Blaž Hrastnik <[email protected]>
HID: Improve Windows Precision Touchpad detection.
Qian Cai <[email protected]>
libnvdimm/btt: fix variable 'rc' set but not used
Doug Berger <[email protected]>
ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening
Aaron Ma <[email protected]>
HID: i2c-hid: fix no irq after reset on raydium 3118
Hans de Goede <[email protected]>
HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
Rob Herring <[email protected]>
dt-bindings: Improve validation build error handling
Jinke Fan <[email protected]>
HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse
Coly Li <[email protected]>
bcache: at least try to shrink 1 node in bch_mca_scan()
Robert Jarzmik <[email protected]>
clk: pxa: fix one of the pxa RTC clocks
Finn Thain <[email protected]>
scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
Aneesh Kumar K.V <[email protected]>
powerpc/book3s/mm: Update Oops message to print the correct translation in use
Sam Bobroff <[email protected]>
powerpc/eeh: differentiate duplicate detection message
Gustavo L. F. Walbon <[email protected]>
powerpc/security: Fix wrong message when RFI Flush is disable
Tyrel Datwyler <[email protected]>
PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name when using drc-info
Tyrel Datwyler <[email protected]>
PCI: rpaphp: Annotate and correctly byte swap DRC properties
Tyrel Datwyler <[email protected]>
PCI: rpaphp: Don't rely on firmware feature to imply drc-info support
David Hildenbrand <[email protected]>
powerpc/pseries/cmm: Implement release() function for sysfs device
Bean Huo <[email protected]>
scsi: ufs: fix potential bug which ends in system hang
Tyrel Datwyler <[email protected]>
PCI: rpaphp: Fix up pointer to first drc-info entry
Kars de Jong <[email protected]>
scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane)
James Smart <[email protected]>
scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
Dmitry Torokhov <[email protected]>
Input: ili210x - handle errors from input_mt_init_slots()
Jan Stancek <[email protected]>
iomap: fix return value of iomap_dio_bio_actor on 32bit systems
Alain Volmat <[email protected]>
i2c: stm32f7: fix & reorder remove & probe error handling
Jean-Philippe Brucker <[email protected]>
iommu/arm-smmu-v3: Don't display an error when IRQ lines are missing
Konstantin Khlebnikov <[email protected]>
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
Lee Jones <[email protected]>
mfd: mfd-core: Honour Device Tree's request to disable a child-device
Nicolas Saenz Julienne <[email protected]>
dma-direct: check for overflows on 32 bit DMA addresses
Paul Cercueil <[email protected]>
irqchip: ingenic: Error out if IRQ domain creation failed
Florian Fainelli <[email protected]>
irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
Michael Hennerich <[email protected]>
clk: clk-gpio: propagate rate change to parent
Jeffrey Hugo <[email protected]>
clk: qcom: Allow constant ratio freq tables for rcg
Jeffrey Hugo <[email protected]>
clk: qcom: smd: Add missing pnoc clock
Chao Yu <[email protected]>
f2fs: fix to update dir's i_pino during cross_rename
James Smart <[email protected]>
scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
James Smart <[email protected]>
scsi: lpfc: Fix unexpected error messages during RSCN handling
Bart Van Assche <[email protected]>
scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
Jan Kara <[email protected]>
jbd2: Fix statistics for the number of logged blocks
Matthew Bobrowski <[email protected]>
ext4: iomap that extends beyond EOF should be marked dirty
Matthew Bobrowski <[email protected]>
ext4: update direct I/O read lock pattern for IOCB_NOWAIT
Aneesh Kumar K.V <[email protected]>
powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
Anthony Steinhauser <[email protected]>
powerpc/security/book3s64: Report L1TF status in sysfs
Michael Ellerman <[email protected]>
selftests/powerpc: Skip tm-signal-sigreturn-nt if TM not available
Pavel Modilaynen <[email protected]>
dtc: Use pkg-config to locate libyaml
Geert Uytterhoeven <[email protected]>
clocksource/drivers/timer-of: Use unique device name instead of timer
Chuhong Yuan <[email protected]>
clocksource/drivers/asm9260: Add a check for of_clk_get
Martin Schiller <[email protected]>
leds: trigger: netdev: fix handling on interface rename
Chuhong Yuan <[email protected]>
leds: an30259a: add a check for devm_regmap_init_i2c
Guido Günther <[email protected]>
leds: lm3692x: Handle failure to probe the regulator
Krzysztof Kozlowski <[email protected]>
dmaengine: fsl-qdma: Handle invalid qdma-queue0 IRQ
Vladimir Murzin <[email protected]>
dma-mapping: fix handling of dma-ranges for reserved memory (again)
Kees Cook <[email protected]>
dma-mapping: Add vmap checks to dma_map_single()
Eric Dumazet <[email protected]>
dma-debug: add a schedule point in debug_dma_dump_mappings()
Michael Ellerman <[email protected]>
powerpc/tools: Don't quote $objdump in scripts
Michael Ellerman <[email protected]>
selftests/powerpc: Fixup clobbers for TM tests
Dmitry Torokhov <[email protected]>
Input: st1232 - do not reset the chip too early
Aneesh Kumar K.V <[email protected]>
powerpc/pseries: Don't fail hash page table insert for bolted mapping
Michael Ellerman <[email protected]>
powerpc/pseries: Mark accumulate_stolen_time() as notrace
Luo Jiaxing <[email protected]>
scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails
Xiang Chen <[email protected]>
scsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec()
Dan Carpenter <[email protected]>
scsi: csiostor: Don't enable IRQs too early
James Smart <[email protected]>
scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
James Smart <[email protected]>
scsi: lpfc: Fix hardlockup in lpfc_abort_handler
David Disseldorp <[email protected]>
scsi: target: compare full CHAP_A Algorithm strings
Nicholas Graumann <[email protected]>
dmaengine: xilinx_dma: Clear desc_pendingcount in xilinx_dma_reset
Thierry Reding <[email protected]>
iommu/tegra-smmu: Fix page tables in > 4 GiB memory
Ezequiel Garcia <[email protected]>
iommu: rockchip: Free domain on .domain_free
Dmitry Torokhov <[email protected]>
platform/x86: peaq-wmi: switch to using polled mode of input devices
Srinivas Pandruvada <[email protected]>
tools/power/x86/intel-speed-select: Remove warning for unused result
Vaibhav Jain <[email protected]>
powerpc/papr_scm: Fix an off-by-one check in papr_scm_meta_{get, set}Chao Yu <[email protected]>
f2fs: fix to update time in lazytime mode
Evan Green <[email protected]>
Input: atmel_mxt_ts - disable IRQ across suspend
James Smart <[email protected]>
scsi: lpfc: Fix list corruption in lpfc_sli_get_iocbq
Anson Huang <[email protected]>
gpio: mxc: Only get the second IRQ when there is more than one IRQ
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Reject NVMe Encap cmnds to unsupported HBA
James Smart <[email protected]>
scsi: lpfc: Fix locking on mailbox command completion
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Fix clear pending bit in ioctl status
James Smart <[email protected]>
scsi: lpfc: Fix discovery failures when target device connectivity bounces
James Smart <[email protected]>
scsi: lpfc: Fix spinlock_irq issues in lpfc_els_flush_cmd()
Greg Kroah-Hartman <[email protected]>
Revert "MIPS: futex: Emit Loongson3 sync workarounds within asm"
Greg Kroah-Hartman <[email protected]>
Revert "MIPS: futex: Restore \n after sync instructions"
-------------
Diffstat:
Documentation/devicetree/bindings/Makefile | 5 +- Documentation/devicetree/writing-schema.rst | 6 +- Makefile | 4 +- arch/arm/boot/compressed/libfdt_env.h | 4 +- arch/arm/mm/dma-mapping-nommu.c | 2 +- arch/arm/mm/proc-v7-bugs.c | 3 + arch/mips/include/asm/barrier.h | 13 +- arch/mips/include/asm/futex.h | 15 +- arch/powerpc/Makefile | 4 + arch/powerpc/boot/libfdt_env.h | 2 + arch/powerpc/include/asm/fixmap.h | 7 +- arch/powerpc/include/asm/spinlock.h | 4 +- arch/powerpc/include/asm/uaccess.h | 9 +- arch/powerpc/kernel/eeh_driver.c | 4 +- arch/powerpc/kernel/security.c | 21 +- arch/powerpc/kernel/time.c | 2 +- arch/powerpc/kernel/traps.c | 15 +- arch/powerpc/lib/string_32.S | 4 +- arch/powerpc/lib/string_64.S | 6 +- arch/powerpc/mm/book3s64/hash_utils.c | 10 +- arch/powerpc/platforms/pseries/cmm.c | 5 + arch/powerpc/platforms/pseries/papr_scm.c | 4 +- arch/powerpc/platforms/pseries/setup.c | 7 - arch/powerpc/tools/relocs_check.sh | 2 +- arch/powerpc/tools/unrel_branch_check.sh | 4 +- arch/s390/kernel/machine_kexec.c | 2 + arch/s390/kernel/perf_cpum_sf.c | 17 +- arch/s390/kernel/unwind_bc.c | 5 + arch/s390/mm/maccess.c | 12 +- arch/um/drivers/virtio_uml.c | 8 +- drivers/cdrom/cdrom.c | 12 +- drivers/clk/clk-gpio.c | 2 +- drivers/clk/pxa/clk-pxa27x.c | 1 + drivers/clk/qcom/clk-rcg2.c | 2 + drivers/clk/qcom/clk-smd-rpm.c | 3 + drivers/clk/qcom/common.c | 3 + drivers/clocksource/asm9260_timer.c | 4 + drivers/clocksource/timer-of.c | 2 +- drivers/dma/fsl-qdma.c | 3 + drivers/dma/xilinx/xilinx_dma.c | 1 + drivers/gpio/gpio-lynxpoint.c | 6 + drivers/gpio/gpio-mpc8xxx.c | 6 +- drivers/gpio/gpio-mxc.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 37 ++-- drivers/gpu/drm/drm_property.c | 2 +- drivers/hid/hid-core.c | 4 + drivers/hid/hid-ids.h | 2 + drivers/hid/hid-logitech-hidpp.c | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-rmi.c | 3 +- drivers/hid/i2c-hid/i2c-hid-core.c | 2 + drivers/hv/vmbus_drv.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 19 +- drivers/input/touchscreen/atmel_mxt_ts.c | 4 + drivers/input/touchscreen/ili210x.c | 7 +- drivers/input/touchscreen/st1232.c | 22 +- drivers/iommu/arm-smmu-v3.c | 8 +- drivers/iommu/rockchip-iommu.c | 7 +- drivers/iommu/tegra-smmu.c | 11 +- drivers/irqchip/irq-bcm7038-l1.c | 4 + drivers/irqchip/irq-ingenic.c | 15 +- drivers/leds/leds-an30259a.c | 7 + drivers/leds/leds-lm3692x.c | 13 +- drivers/leds/trigger/ledtrig-netdev.c | 5 +- drivers/mailbox/imx-mailbox.c | 19 +- drivers/md/bcache/btree.c | 2 + drivers/md/md.c | 1 + drivers/mfd/mfd-core.c | 5 + drivers/misc/habanalabs/memory.c | 30 ++- drivers/mmc/host/sdhci-esdhc.h | 14 ++ drivers/mmc/host/sdhci-of-esdhc.c | 232 ++++++++++++++++++--- drivers/net/bonding/bond_main.c | 3 - drivers/net/dsa/bcm_sf2_cfp.c | 6 +- drivers/net/dsa/sja1105/sja1105_main.c | 8 +- drivers/net/dsa/sja1105/sja1105_static_config.c | 7 +- drivers/net/ethernet/amazon/ena/ena_netdev.c | 10 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 63 ++++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 93 ++++++--- drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 38 +++- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h | 4 + drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 8 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 1 + drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 21 +- .../net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 4 +- drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h | 1 + drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c | 18 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | 7 +- drivers/net/ethernet/mellanox/mlxsw/reg.h | 1 + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 9 +- .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 + .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 14 +- drivers/net/gtp.c | 111 +++++----- drivers/net/hamradio/6pack.c | 4 +- drivers/net/hamradio/mkiss.c | 4 +- drivers/net/hyperv/rndis_filter.c | 6 +- drivers/net/phy/aquantia_main.c | 2 + drivers/net/phy/phylink.c | 3 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 24 +-- drivers/nvdimm/btt.c | 8 +- drivers/of/unittest.c | 4 +- drivers/pci/hotplug/rpaphp_core.c | 38 ++-- drivers/platform/x86/Kconfig | 1 - drivers/platform/x86/intel_pmc_core.c | 17 +- drivers/platform/x86/peaq-wmi.c | 66 +++--- drivers/ptp/ptp_clock.c | 31 ++- drivers/ptp/ptp_private.h | 2 +- drivers/s390/crypto/zcrypt_error.h | 2 + drivers/scsi/NCR5380.c | 6 +- drivers/scsi/atari_scsi.c | 6 +- drivers/scsi/csiostor/csio_lnode.c | 15 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 9 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + drivers/scsi/iscsi_tcp.c | 8 + drivers/scsi/lpfc/lpfc_ct.c | 6 + drivers/scsi/lpfc/lpfc_els.c | 42 +++- drivers/scsi/lpfc/lpfc_hbadisc.c | 12 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +- drivers/scsi/lpfc/lpfc_scsi.c | 5 +- drivers/scsi/lpfc/lpfc_sli.c | 18 +- drivers/scsi/mac_scsi.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 15 +- drivers/scsi/pm8001/pm80xx_hwi.c | 2 + drivers/scsi/scsi_debug.c | 5 + drivers/scsi/scsi_trace.c | 11 +- drivers/scsi/sun3_scsi.c | 4 +- drivers/scsi/ufs/ufs-sysfs.c | 15 +- drivers/scsi/ufs/ufshcd.c | 35 ++-- drivers/scsi/ufs/ufshcd.h | 2 + drivers/scsi/zorro_esp.c | 11 +- drivers/target/iscsi/iscsi_target.c | 10 +- drivers/target/iscsi/iscsi_target_auth.c | 2 +- drivers/target/target_core_transport.c | 15 ++ drivers/vhost/vsock.c | 4 +- drivers/watchdog/imx7ulp_wdt.c | 16 ++ drivers/watchdog/watchdog_dev.c | 80 ++++--- fs/cifs/cifsfs.c | 13 +- fs/cifs/cifsglob.h | 5 +- fs/cifs/connect.c | 46 +++- fs/cifs/file.c | 74 ++++--- fs/ext4/inode.c | 16 +- fs/f2fs/f2fs.h | 24 ++- fs/f2fs/file.c | 1 + fs/f2fs/inode.c | 6 +- fs/f2fs/namei.c | 15 +- fs/f2fs/segment.c | 21 +- fs/f2fs/super.c | 20 +- fs/hugetlbfs/inode.c | 31 ++- fs/io_uring.c | 10 +- fs/iomap/direct-io.c | 4 +- fs/jbd2/commit.c | 4 +- fs/ocfs2/acl.c | 4 +- fs/quota/dquot.c | 29 +-- fs/userfaultfd.c | 18 +- fs/xfs/xfs_log.c | 2 + include/linux/dma-direct.h | 12 +- include/linux/dma-mapping.h | 8 +- include/linux/hrtimer.h | 14 +- include/linux/libfdt_env.h | 3 + include/linux/posix-clock.h | 19 +- include/linux/quota.h | 2 +- include/linux/rculist_nulls.h | 37 ++++ include/linux/skbuff.h | 6 +- include/linux/thread_info.h | 2 + include/net/dst.h | 13 +- include/net/dst_ops.h | 3 +- include/net/inet_hashtables.h | 12 +- include/net/sch_generic.h | 5 + include/net/sock.h | 5 + include/scsi/iscsi_proto.h | 1 + kernel/dma/coherent.c | 16 +- kernel/dma/debug.c | 1 + kernel/sysctl.c | 2 +- kernel/time/hrtimer.c | 11 +- kernel/time/posix-clock.c | 31 ++- net/bridge/br_netfilter_hooks.c | 3 + net/bridge/br_nf_core.c | 3 +- net/bridge/netfilter/ebtables.c | 33 ++- net/decnet/dn_route.c | 6 +- net/ipv4/icmp.c | 11 +- net/ipv4/inet_connection_sock.c | 2 +- net/ipv4/inet_diag.c | 3 +- net/ipv4/inet_hashtables.c | 16 +- net/ipv4/inetpeer.c | 12 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ip_vti.c | 2 +- net/ipv4/route.c | 9 +- net/ipv4/tcp_ipv4.c | 7 +- net/ipv4/tcp_output.c | 11 + net/ipv4/udp.c | 2 +- net/ipv4/xfrm4_policy.c | 5 +- net/ipv6/addrconf.c | 8 +- net/ipv6/inet6_connection_sock.c | 2 +- net/ipv6/ip6_gre.c | 2 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 2 +- net/ipv6/route.c | 22 +- net/ipv6/sit.c | 2 +- net/ipv6/xfrm6_policy.c | 5 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/sched/act_mirred.c | 22 +- net/sched/cls_api.c | 31 +-- net/sched/cls_flower.c | 12 ++ net/sched/sch_fq.c | 17 +- net/sctp/stream.c | 30 +-- net/sctp/transport.c | 2 +- net/smc/af_smc.c | 14 +- scripts/dtc/Makefile | 4 +- scripts/kallsyms.c | 2 + security/apparmor/label.c | 12 +- security/tomoyo/realpath.c | 32 +-- tools/perf/builtin-diff.c | 4 +- tools/perf/builtin-script.c | 2 +- tools/perf/util/perf_regs.h | 2 +- tools/power/x86/intel-speed-select/isst-config.c | 9 +- tools/power/x86/intel-speed-select/isst-core.c | 8 +- tools/power/x86/intel-speed-select/isst-display.c | 3 +- .../selftests/powerpc/ptrace/ptrace-tm-spd-tar.c | 2 +- .../selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c | 4 +- .../selftests/powerpc/ptrace/ptrace-tm-tar.c | 2 +- .../selftests/powerpc/ptrace/ptrace-tm-vsx.c | 4 +- .../selftests/powerpc/tm/tm-signal-sigreturn-nt.c | 4 + tools/testing/selftests/vm/config | 1 + 226 files changed, 1829 insertions(+), 873 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/191 Revert "MIPS: futex: Restore \n after sync instructions"
From: Greg Kroah-Hartman <[email protected]>
This reverts commit dc9d0a75ce9af74612d6a4d052e4df2bddfe8ed4 which is commit fd7710cb491f900eb63d2ce5aac0e682003e84e9 upstream.
This, and the follow-on patch, breaks the mips build so it needs to be reverted.
--- arch/mips/include/asm/futex.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/mips/include/asm/futex.h +3 -3
@@ -33,7 +33,7 @@" .set arch=r4000 \n" \"2: sc $1, %2 \n" \" beqzl $1, 1b \n" \ - __stringify(__WEAK_LLSC_MB) " \n" \ + __stringify(__WEAK_LLSC_MB) \"3: \n" \" .insn \n" \" .set pop \n" \
@@ -63,7 +63,7 @@" .set " MIPS_ISA_ARCH_LEVEL " \n" \ "2: "user_sc("$1", "%2")" \n" \" beqz $1, 1b \n" \ - __stringify(__WEAK_LLSC_MB) " \n" \ + __stringify(__WEAK_LLSC_MB) \"3: \n" \" .insn \n" \" .set pop \n" \
@@ -148,7 +148,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval," .set arch=r4000 \n" "2: sc $1, %2 \n" " beqzl $1, 1b \n" - __stringify(__WEAK_LLSC_MB) " \n" + __stringify(__WEAK_LLSC_MB)"3: \n" " .insn \n" " .set pop \n"
Greg Kroah-Hartman
maintainerPATCH 2/191 Revert "MIPS: futex: Emit Loongson3 sync workarounds within asm"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
This reverts commit d754a529a8be55f009c6679d772c472c1632cd5b which was commit 3c1d3f0979721a39dd2980c97466127ce65aa130 upstream.
This breaks the build and should be reverted.
--- arch/mips/include/asm/barrier.h | 13 ++++++------- arch/mips/include/asm/futex.h | 15 ++++++++------- 2 files changed, 14 insertions(+), 14 deletions(-)
arch/mips/include/asm/barrier.h +6 -7
@@ -218,14 +218,13 @@* ordering will be done by smp_llsc_mb() and friends. */ #if defined(CONFIG_WEAK_REORDERING_BEYOND_LLSC ) && defined(CONFIG_SMP ) -# define __WEAK_LLSC_MB sync -# define smp_llsc_mb () \ - __asm__ __volatile__(__stringify(__WEAK_LLSC_MB) : : :"memory") -# define __LLSC_CLOBBER +#define __WEAK_LLSC_MB " sync \n" +#define smp_llsc_mb () __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory") +#define __LLSC_CLOBBER#else -# define __WEAK_LLSC_MB -# define smp_llsc_mb () do { } while (0) -# define __LLSC_CLOBBER "memory" +#define __WEAK_LLSC_MB " \n" +#define smp_llsc_mb () do { } while (0) +#define __LLSC_CLOBBER "memory"#endif #ifdef CONFIG_CPU_CAVIUM_OCTEON
arch/mips/include/asm/futex.h +8 -7
@@ -16,7 +16,6 @@#include <asm/barrier.h> #include <asm/compiler.h> #include <asm/errno.h> -#include <asm/sync.h> #include <asm/war.h> #define __futex_atomic_op (insn, ret, oldval, uaddr, oparg) \
@@ -33,7 +32,7 @@" .set arch=r4000 \n" \"2: sc $1, %2 \n" \" beqzl $1, 1b \n" \ - __stringify(__WEAK_LLSC_MB) \ + __WEAK_LLSC_MB \"3: \n" \" .insn \n" \" .set pop \n" \
@@ -51,19 +50,19 @@ "i" (-EFAULT) \ : "memory"); \ } else if (cpu_has_llsc) { \ + loongson_llsc_mb(); \ __asm__ __volatile__( \ " .set push \n" \ " .set noat \n" \ " .set push \n" \ " .set "MIPS_ISA_ARCH_LEVEL" \n" \ - " " __SYNC(full, loongson3_war) " \n" \ "1: "user_ll("%1", "%4")" # __futex_atomic_op\n" \ " .set pop \n" \ " " insn " \n" \ " .set "MIPS_ISA_ARCH_LEVEL" \n" \ "2: "user_sc("$1", "%2")" \n" \" beqz $1, 1b \n" \ - __stringify(__WEAK_LLSC_MB) \ + __WEAK_LLSC_MB \"3: \n" \" .insn \n" \" .set pop \n" \
@@ -148,7 +147,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval," .set arch=r4000 \n" "2: sc $1, %2 \n" " beqzl $1, 1b \n" - __stringify(__WEAK_LLSC_MB) + __WEAK_LLSC_MB"3: \n" " .insn \n" " .set pop \n"
@@ -165,13 +164,13 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, "i" (-EFAULT) : "memory"); }else if (cpu_has_llsc) { +loongson_llsc_mb (); __asm__ __volatile__("# futex_atomic_cmpxchg_inatomic \n" " .set push \n" " .set noat \n" " .set push \n" " .set " MIPS_ISA_ARCH_LEVEL " \n" - " " __SYNC(full, loongson3_war) " \n" "1: "user_ll("%1", "%3")" \n"" bne %1, %z4, 3f \n" " .set pop \n"
@@ -179,7 +178,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval," .set " MIPS_ISA_ARCH_LEVEL " \n" "2: "user_sc("$1", "%2")" \n"" beqz $1, 1b \n" - "3: " __SYNC_ELSE(full, loongson3_war, __WEAK_LLSC_MB) "\n" + __WEAK_LLSC_MB +"3: \n" " .insn \n" " .set pop \n" " .section .fixup,\"ax\" \n"
@@ -194,6 +194,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval), "i" (-EFAULT) : "memory"); +loongson_llsc_mb (); }else return -ENOSYS ;
Greg Kroah-Hartman
maintainerPATCH 3/191 scsi: lpfc: Fix spinlock_irq issues in lpfc_els_flush_cmd()
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit d38b4a527fe898f859f74a3a43d4308f48ac7855 ]
While reviewing the CT behavior, issues with spinlock_irq were seen. The driver should be using spinlock_irqsave/irqrestore in the els flush routine.
Changed to spinlock_irqsave/irqrestore.
--- drivers/scsi/lpfc/lpfc_els.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +9 -7
@@ -7986,20 +7986,22 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)struct lpfc_sli_ring *pring;struct lpfc_iocbq *tmp_iocb, *piocb;IOCB_t *cmd =NULL ; +unsigned long iflags =0 ;lpfc_fabric_abort_vport (vport); +/* * For SLI3, only the hbalock is required. But SLI4 needs to coordinate * with the ring insert operation. Because lpfc_sli_issue_abort_iotag * ultimately grabs the ring_lock, the driver must splice the list into * a working list and release the locks before calling the abort. */ -spin_lock_irq (&phba->hbalock); +spin_lock_irqsave (&phba->hbalock, iflags); pring =lpfc_phba_elsring (phba);/* Bail out if we've no ELS wq, like in PCI error recovery case. */ if (unlikely (!pring)) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irqrestore (&phba->hbalock, iflags);return ; }
@@ -8037,21 +8039,21 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)if (phba->sli_rev ==LPFC_SLI_REV4 )spin_unlock (&pring->ring_lock); -spin_unlock_irq (&phba->hbalock); +spin_unlock_irqrestore (&phba->hbalock, iflags);/* Abort each txcmpl iocb on aborted list and remove the dlist links. */ list_for_each_entry_safe (piocb, tmp_iocb, &abort_list, dlist) { -spin_lock_irq (&phba->hbalock); +spin_lock_irqsave (&phba->hbalock, iflags);list_del_init (&piocb->dlist);lpfc_sli_issue_abort_iotag (phba, pring, piocb); -spin_unlock_irq (&phba->hbalock); +spin_unlock_irqrestore (&phba->hbalock, iflags); }if (!list_empty (&abort_list))lpfc_printf_vlog (vport,KERN_ERR ,LOG_ELS ,"3387 abort list for txq not empty\n" );INIT_LIST_HEAD (&abort_list); -spin_lock_irq (&phba->hbalock); +spin_lock_irqsave (&phba->hbalock, iflags);if (phba->sli_rev ==LPFC_SLI_REV4 )spin_lock (&pring->ring_lock);
@@ -8091,7 +8093,7 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)if (phba->sli_rev ==LPFC_SLI_REV4 )spin_unlock (&pring->ring_lock); -spin_unlock_irq (&phba->hbalock); +spin_unlock_irqrestore (&phba->hbalock, iflags);/* Cancel all the IOCBs from the completions list */ lpfc_sli_cancel_iocbs(phba, &abort_list,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/191 scsi: lpfc: Fix discovery failures when target device connectivity bounces
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 3f97aed6117c7677eb16756c4ec8b86000fd5822 ]
An issue was seen discovering all SCSI Luns when a target device undergoes link bounce.
The driver currently does not qualify the FC4 support on the target. Therefore it will send a SCSI PRLI and an NVMe PRLI. The expectation is that the target will reject the PRLI if it is not supported. If a PRLI times out, the driver will retry. The driver will not proceed with the device until both SCSI and NVMe PRLIs are resolved. In the failure case, the device is FCP only and does not respond to the NVMe PRLI, thus initiating the wait/retry loop in the driver. During that time, a RSCN is received (device bounced) causing the driver to issue a GID_FT. The GID_FT response comes back before the PRLI mess is resolved and it prematurely cancels the PRLI retry logic and leaves the device in a STE_PRLI_ISSUE state. Discovery with the target never completes or resets.
Fix by resetting the node state back to STE_NPR_NODE when GID_FT completes, thereby restarting the discovery process for the node.
--- drivers/scsi/lpfc/lpfc_hbadisc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_hbadisc.c +6 -1
@@ -5405,9 +5405,14 @@ lpfc_setup_disc_node(struct lpfc_vport *vport, uint32_t did)/* If we've already received a PLOGI from this NPort * we don't need to try to discover it again. */ -if (ndlp->nlp_flag &NLP_RCV_PLOGI ) +if (ndlp->nlp_flag &NLP_RCV_PLOGI && + !(ndlp->nlp_type & + (NLP_FCP_TARGET |NLP_NVME_TARGET )))return NULL ; + ndlp->nlp_prev_state = ndlp->nlp_state; +lpfc_nlp_set_state (vport, ndlp,NLP_STE_NPR_NODE ); +spin_lock_irq (shost->host_lock); ndlp->nlp_flag |=NLP_NPR_2B_DISC ;spin_unlock_irq (shost->host_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/191 scsi: mpt3sas: Fix clear pending bit in ioctl status
In reply to Greg Kroah-HartmanFrom: Sreekanth Reddy <[email protected]>
[ Upstream commit 782b281883caf70289ba6a186af29441a117d23e ]
When user issues diag register command from application with required size, and if driver unable to allocate the memory, then it will fail the register command. While failing the register command, driver is not currently clearing MPT3_CMD_PENDING bit in ctl_cmds.status variable which was set before trying to allocate the memory. As this bit is set, subsequent register command will be failed with BUSY status even when user wants to register the trace buffer will less memory.
Clear MPT3_CMD_PENDING bit in ctl_cmds.status before returning the diag register command with no memory status.
--- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/mpt3sas/mpt3sas_ctl.c +2 -1
@@ -1584,7 +1584,8 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc,ioc_err (ioc,"%s: failed allocating memory for diag buffers, requested size(%d)\n" , __func__, request_data_sz);mpt3sas_base_free_smid (ioc, smid); -return -ENOMEM ; + rc = -ENOMEM ; + goto out; } ioc->diag_buffer[buffer_type] = request_data; ioc->diag_buffer_sz[buffer_type] = request_data_sz;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/191 scsi: lpfc: Fix locking on mailbox command completion
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 07b8582430370097238b589f4e24da7613ca6dd3 ]
Symptoms were seen of the driver not having valid data for mailbox commands. After debugging, the following sequence was found:
The driver maintains a port-wide pointer of the mailbox command that is currently in execution. Once finished, the port-wide pointer is cleared (done in lpfc_sli4_mq_release()). The next mailbox command issued will set the next pointer and so on.
The mailbox response data is only copied if there is a valid port-wide pointer.
In the failing case, it was seen that a new mailbox command was being attempted in parallel with the completion. The parallel path was seeing the mailbox no long in use (flag check under lock) and thus set the port pointer. The completion path had cleared the active flag under lock, but had not touched the port pointer. The port pointer is cleared after the lock is released. In this case, the completion path cleared the just-set value by the parallel path.
Fix by making the calls that clear mbox state/port pointer while under lock. Also slightly cleaned up the error path.
--- drivers/scsi/lpfc/lpfc_sli.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_sli.c +7 -1
@@ -13161,13 +13161,19 @@ send_current_mbox: phba->sli.sli_flag &= ~LPFC_SLI_MBOX_ACTIVE ;/* Setting active mailbox pointer need to be in sync to flag clear */ phba->sli.mbox_active =NULL ; +if (bf_get (lpfc_trailer_consumed, mcqe)) +lpfc_sli4_mq_release (phba->sli4_hba.mbx_wq);spin_unlock_irqrestore (&phba->hbalock, iflags);/* Wake up worker thread to post the next pending mailbox command */ lpfc_worker_wake_up (phba); +return workposted; + out_no_mqe_complete: +spin_lock_irqsave (&phba->hbalock, iflags);if (bf_get (lpfc_trailer_consumed, mcqe))lpfc_sli4_mq_release (phba->sli4_hba.mbx_wq); -return workposted; +spin_unlock_irqrestore (&phba->hbalock, iflags); +return false; }/**
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/191 scsi: mpt3sas: Reject NVMe Encap cmnds to unsupported HBA
In reply to Greg Kroah-HartmanFrom: Sreekanth Reddy <[email protected]>
[ Upstream commit 77fd4f2c88bf83205a21f9ca49fdcc0c7868dba9 ]
If any faulty application issues an NVMe Encapsulated commands to HBA which doesn't support NVMe protocol then driver should return the command as invalid with the following message.
"HBA doesn't support NVMe. Rejecting NVMe Encapsulated request."
Otherwise below page fault kernel panic will be observed while building the PRPs as there is no PRP pools allocated for the HBA which doesn't support NVMe drives.
RIP: 0010:_base_build_nvme_prp+0x3b/0xf0 [mpt3sas] Call Trace: _ctl_do_mpt_command+0x931/0x1120 [mpt3sas] _ctl_ioctl_main.isra.11+0xa28/0x11e0 [mpt3sas] ? prepare_to_wait+0xb0/0xb0 ? tty_ldisc_deref+0x16/0x20 _ctl_ioctl+0x1a/0x20 [mpt3sas] do_vfs_ioctl+0xaa/0x620 ? vfs_read+0x117/0x140 ksys_ioctl+0x67/0x90 __x64_sys_ioctl+0x1a/0x20 do_syscall_64+0x60/0x190 entry_SYSCALL_64_after_hwframe+0x44/0xa9
[mkp: tweaked error string]
--- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/scsi/mpt3sas/mpt3sas_ctl.c +12 -0
@@ -778,6 +778,18 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,case MPI2_FUNCTION_NVME_ENCAPSULATED : { nvme_encap_request = (Mpi26NVMeEncapsulatedRequest_t *)request; +if (!ioc->pcie_sg_lookup) { +dtmprintk (ioc,ioc_info (ioc, +"HBA doesn't support NVMe. Rejecting NVMe Encapsulated request.\n" + )); + +if (ioc->logging_level &MPT_DEBUG_TM ) +_debug_dump_mf (nvme_encap_request, + ioc->request_sz/4 ); +mpt3sas_base_free_smid (ioc, smid); + ret = -EINVAL ; + goto out; + }/* * Get the Physical Address of the sense buffer. * Use Error Response buffer address field to hold the sense
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/191 gpio: mxc: Only get the second IRQ when there is more than one IRQ
In reply to Greg Kroah-HartmanFrom: Anson Huang <[email protected]>
[ Upstream commit c8f3d144004dd3f471ffd414690d15a005e4acd6 ]
On some of i.MX SoCs like i.MX8QXP, there is ONLY one IRQ for each GPIO bank, so it is better to check the IRQ count before getting second IRQ to avoid below error message during probe:
[ 1.070908] gpio-mxc 5d080000.gpio: IRQ index 1 not found [ 1.077420] gpio-mxc 5d090000.gpio: IRQ index 1 not found [ 1.083766] gpio-mxc 5d0a0000.gpio: IRQ index 1 not found [ 1.090122] gpio-mxc 5d0b0000.gpio: IRQ index 1 not found [ 1.096470] gpio-mxc 5d0c0000.gpio: IRQ index 1 not found [ 1.102804] gpio-mxc 5d0d0000.gpio: IRQ index 1 not found [ 1.109144] gpio-mxc 5d0e0000.gpio: IRQ index 1 not found [ 1.115475] gpio-mxc 5d0f0000.gpio: IRQ index 1 not found
--- drivers/gpio/gpio-mxc.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/gpio/gpio-mxc.c +10 -3
@@ -411,6 +411,7 @@ static int mxc_gpio_probe(struct platform_device *pdev) {struct device_node *np = pdev->dev.of_node;struct mxc_gpio_port *port; +int irq_count;int irq_base;int err;
@@ -426,9 +427,15 @@ static int mxc_gpio_probe(struct platform_device *pdev)if (IS_ERR (port->base))return PTR_ERR (port->base); - port->irq_high =platform_get_irq (pdev,1 ); -if (port->irq_high <0 ) - port->irq_high =0 ; + irq_count =platform_irq_count (pdev); +if (irq_count <0 ) +return irq_count; + +if (irq_count >1 ) { + port->irq_high =platform_get_irq (pdev,1 ); +if (port->irq_high <0 ) + port->irq_high =0 ; + } port->irq =platform_get_irq (pdev,0 );if (port->irq <0 )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 9/191 scsi: lpfc: Fix list corruption in lpfc_sli_get_iocbq
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 15498dc1a55b7aaea4b51ff03e3ff0f662e73f44 ]
After study, it was determined there was a double free of a CT iocb during execution of lpfc_offline_prep and lpfc_offline. The prep routine issued an abort for some CT iocbs, but the aborts did not complete fast enough for a subsequent routine that waits for completion. Thus the driver proceeded to lpfc_offline, which releases any pending iocbs. Unfortunately, the completions for the aborts were then received which re-released the ct iocbs.
Turns out the issue for why the aborts didn't complete fast enough was not their time on the wire/in the adapter. It was the lpfc_work_done routine, which requires the adapter state to be UP before it calls lpfc_sli_handle_slow_ring_event() to process the completions. The issue is the prep routine takes the link down as part of it's processing.
To fix, the following was performed:
- Prevent the offline routine from releasing iocbs that have had aborts issued on them. Defer to the abort completions. Also means the driver fully waits for the completions. Given this change, the recognition of "driver-generated" status which then releases the iocb is no longer valid. As such, the change made in the commit 296012285c90 is reverted. As recognition of "driver-generated" status is no longer valid, this patch reverts the changes made in
commit 296012285c90 ("scsi: lpfc: Fix leak of ELS completions on adapter reset")
- Modify lpfc_work_done to allow slow path completions so that the abort completions aren't ignored.
- Updated the fdmi path to recognize a CT request that fails due to the port being unusable. This stops FDMI retries. FDMI will be restarted on next link up.
--- drivers/scsi/lpfc/lpfc_ct.c | 6 ++++++ drivers/scsi/lpfc/lpfc_els.c | 3 +++ drivers/scsi/lpfc/lpfc_hbadisc.c | 5 ++++- drivers/scsi/lpfc/lpfc_sli.c | 3 --- 4 files changed, 13 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_ct.c +6 -0
@@ -1868,6 +1868,12 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,if (irsp->ulpStatus ==IOSTAT_LOCAL_REJECT ) {switch ((irsp->un.ulpWord[4 ] &IOERR_PARAM_MASK )) {case IOERR_SLI_ABORTED : +case IOERR_SLI_DOWN : +/* Driver aborted this IO. No retry as error +* is likely Offline->Online or some adapter +* error. Recovery will try again. +*/ +break ;case IOERR_ABORT_IN_PROGRESS :case IOERR_SEQUENCE_TIMEOUT :case IOERR_ILLEGAL_FRAME :
drivers/scsi/lpfc/lpfc_els.c +3 -0
@@ -8016,6 +8016,9 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)if (piocb->vport != vport)continue ; +if (piocb->iocb_flag &LPFC_DRIVER_ABORTED ) +continue ; +/* On the ELS ring we can have ELS_REQUESTs or * GEN_REQUESTs waiting for a response. */
drivers/scsi/lpfc/lpfc_hbadisc.c +4 -1
@@ -700,7 +700,10 @@ lpfc_work_done(struct lpfc_hba *phba)if (!(phba->hba_flag &HBA_SP_QUEUE_EVT ))set_bit (LPFC_DATA_READY , &phba->data_flags); }else { -if (phba->link_state >=LPFC_LINK_UP || +/* Driver could have abort request completed in queue +* when link goes down. Allow for this transition. +*/ +if (phba->link_state >=LPFC_LINK_DOWN || phba->link_flag &LS_MDS_LOOPBACK ) { pring->flag &= ~LPFC_DEFERRED_RING_EVENT ; lpfc_sli_handle_slow_ring_event(phba, pring,
drivers/scsi/lpfc/lpfc_sli.c +0 -3
@@ -11050,9 +11050,6 @@ lpfc_sli_abort_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, irsp->ulpStatus, irsp->un.ulpWord[4]);spin_unlock_irq (&phba->hbalock); -if (irsp->ulpStatus ==IOSTAT_LOCAL_REJECT && - irsp->un.ulpWord[4 ] ==IOERR_SLI_ABORTED ) -lpfc_sli_release_iocbq (phba, abort_iocb); } release_iocb:lpfc_sli_release_iocbq (phba, cmdiocb);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 10/191 Input: atmel_mxt_ts - disable IRQ across suspend
In reply to Greg Kroah-HartmanFrom: Evan Green <[email protected]>
[ Upstream commit 463fa44eec2fef50d111ed0199cf593235065c04 ]
Across suspend and resume, we are seeing error messages like the following:
atmel_mxt_ts i2c-PRP0001:00: __mxt_read_reg: i2c transfer failed (-121) atmel_mxt_ts i2c-PRP0001:00: Failed to read T44 and T5 (-121)
This occurs because the driver leaves its IRQ enabled. Upon resume, there is an IRQ pending, but the interrupt is serviced before both the driver and the underlying I2C bus have been resumed. This causes EREMOTEIO errors.
Disable the IRQ in suspend, and re-enable it on resume. If there are cases where the driver enters suspend with interrupts disabled, that's a bug we should fix separately.
--- drivers/input/touchscreen/atmel_mxt_ts.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/input/touchscreen/atmel_mxt_ts.c +4 -0
@@ -3156,6 +3156,8 @@ static int __maybe_unused mxt_suspend(struct device *dev)mutex_unlock (&input_dev->mutex); +disable_irq (data->irq); +return 0 ; }
@@ -3168,6 +3170,8 @@ static int __maybe_unused mxt_resume(struct device *dev)if (!input_dev)return 0 ; +enable_irq (data->irq); +mutex_lock (&input_dev->mutex);if (input_dev->users)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 11/191 f2fs: fix to update time in lazytime mode
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit fe1897eaa6646f5a64a4cee0e6473ed9887d324b ]
generic/018 reports an inconsistent status of atime, the testcase is as below:
- open file with O_SYNC
- write file to construct fraged space
- calc md5 of file
- record {a,c,m}time
- defrag file --- do nothing
- umount & mount
- check {a,c,m}time
The root cause is, as f2fs enables lazytime by default, atime update will dirty vfs inode, rather than dirtying f2fs inode (by set with FI_DIRTY_INODE), so later f2fs_write_inode() called from VFS will fail to update inode page due to our skip:
f2fs_write_inode()
if (is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0;
So eventually, after evict(), we lose last atime for ever.
To fix this issue, we need to check whether {a,c,m,cr}time is consistent in between inode cache and inode page, and only skip f2fs_update_inode() if f2fs inode is not dirty and time is consistent as well.
--- fs/f2fs/f2fs.h | 23 +++++++++++++++-------- fs/f2fs/inode.c | 6 +++++- 2 files changed, 20 insertions(+), 9 deletions(-)
fs/f2fs/f2fs.h +15 -8
@@ -2704,6 +2704,20 @@ static inline void clear_file(struct inode *inode, int type)f2fs_mark_inode_dirty_sync (inode, true); } +static inline bool f2fs_is_time_consistent (struct inode *inode) +{ +if (!timespec64_equal (F2FS_I (inode)->i_disk_time, &inode->i_atime)) +return false; +if (!timespec64_equal (F2FS_I (inode)->i_disk_time +1 , &inode->i_ctime)) +return false; +if (!timespec64_equal (F2FS_I (inode)->i_disk_time +2 , &inode->i_mtime)) +return false; +if (!timespec64_equal (F2FS_I (inode)->i_disk_time +3 , + &F2FS_I (inode)->i_crtime)) +return false; +return true; +} +static inline bool f2fs_skip_inode_update (struct inode *inode,int dsync) {bool ret;
@@ -2721,14 +2735,7 @@ static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync) i_size_read(inode) & ~PAGE_MASK)return false; -if (!timespec64_equal (F2FS_I (inode)->i_disk_time, &inode->i_atime)) -return false; -if (!timespec64_equal (F2FS_I (inode)->i_disk_time +1 , &inode->i_ctime)) -return false; -if (!timespec64_equal (F2FS_I (inode)->i_disk_time +2 , &inode->i_mtime)) -return false; -if (!timespec64_equal (F2FS_I (inode)->i_disk_time +3 , - &F2FS_I (inode)->i_crtime)) +if (!f2fs_is_time_consistent (inode))return false;down_read (&F2FS_I (inode)->i_sem);
fs/f2fs/inode.c +5 -1
@@ -615,7 +615,11 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) inode->i_ino == F2FS_META_INO(sbi))return 0 ; -if (!is_inode_flag_set (inode,FI_DIRTY_INODE )) +/* +* atime could be updated without dirtying f2fs inode in lazytime mode +*/ +if (f2fs_is_time_consistent (inode) && + !is_inode_flag_set (inode,FI_DIRTY_INODE ))return 0 ;if (!f2fs_is_checkpoint_ready (sbi))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 12/191 powerpc/papr_scm: Fix an off-by-one check in papr_scm_meta_{get, set}
In reply to Greg Kroah-HartmanFrom: Vaibhav Jain <[email protected]>
[ Upstream commit 612ee81b9461475b5a5612c2e8d71559dd3c7920 ]
A validation check to prevent out of bounds read/write inside functions papr_scm_meta_{get,set}() is off-by-one that prevent reads and writes to the last byte of the label area.
This bug manifests as a failure to probe a dimm when libnvdimm is unable to read the entire config-area as advertised by ND_CMD_GET_CONFIG_SIZE. This usually happens when there are large number of namespaces created in the region backed by the dimm and the label-index spans max possible config-area. An error of the form below usually reported in the kernel logs:
[ 255.293912] nvdimm: probe of nmem0 failed with error -22
The patch fixes these validation checks there by letting libnvdimm access the entire config-area.
--- arch/powerpc/platforms/pseries/papr_scm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/platforms/pseries/papr_scm.c +2 -2
@@ -152,7 +152,7 @@ static int papr_scm_meta_get(struct papr_scm_priv *p,int len, read;int64_t ret; -if ((hdr->in_offset + hdr->in_length) >= p->metadata_size) +if ((hdr->in_offset + hdr->in_length) > p->metadata_size)return -EINVAL ;for (len = hdr->in_length; len; len -= read) {
@@ -206,7 +206,7 @@ static int papr_scm_meta_set(struct papr_scm_priv *p,__be64 data_be;int64_t ret; -if ((hdr->in_offset + hdr->in_length) >= p->metadata_size) +if ((hdr->in_offset + hdr->in_length) > p->metadata_size)return -EINVAL ;for (len = hdr->in_length; len; len -= wrote) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 13/191 tools/power/x86/intel-speed-select: Remove warning for unused result
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
[ Upstream commit abd120e3bdf3dd72ba1ed9ac077a861e0e3dc43a ]
Fix warning for:isst-config.c: In function ‘set_cpu_online_offline’:
isst-config.c:221:3: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Wunused-result]
write(fd, "1\n", 2);
--- tools/power/x86/intel-speed-select/isst-config.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
tools/power/x86/intel-speed-select/isst-config.c +6 -3
@@ -169,7 +169,7 @@ int get_topo_max_cpus(void)static void set_cpu_online_offline (int cpu,int state) {char buffer[128 ]; -int fd; +int fd, ret;snprintf (buffer,sizeof (buffer),"/sys/devices/system/cpu/cpu%d/online" , cpu);
@@ -179,9 +179,12 @@ static void set_cpu_online_offline(int cpu, int state)err (-1 ,"%s open failed" , buffer);if (state) -write (fd,"1\n" ,2 ); + ret =write (fd,"1\n" ,2 );else -write (fd,"0\n" ,2 ); + ret =write (fd,"0\n" ,2 ); + +if (ret ==-1 ) +perror ("Online/Offline: Operation failed\n" );close (fd); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 14/191 platform/x86: peaq-wmi: switch to using polled mode of input devices
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit 60d15095336cfb56dce5c7767ed3b8c6c1cf79a3 ]
We have added polled mode to the normal input devices with the intent of retiring input_polled_dev. This converts peaq-wmi driver to use the polling mode of standard input devices and removes dependency on INPUT_POLLDEV.
Because the new polling coded does not allow peeking inside the poller structure to get the poll interval, we change the "debounce" process to operate on the time basis, instead of counting events.
We also fix error handling during initialization, as previously we leaked input device structure when we failed to register it.
--- drivers/platform/x86/Kconfig | 1 - drivers/platform/x86/peaq-wmi.c | 66 +++++++++++++++++++++------------ 2 files changed, 42 insertions(+), 25 deletions(-)
drivers/platform/x86/Kconfig +0 -1
@@ -806,7 +806,6 @@ config PEAQ_WMI tristate "PEAQ 2-in-1 WMI hotkey driver" depends on ACPI_WMI depends on INPUT - select INPUT_POLLDEV help Say Y here if you want to support WMI-based hotkeys on PEAQ 2-in-1s.
drivers/platform/x86/peaq-wmi.c +42 -24
117 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 15/191 iommu: rockchip: Free domain on .domain_free
In reply to Greg Kroah-HartmanFrom: Ezequiel Garcia <[email protected]>
[ Upstream commit 42bb97b80f2e3bf592e3e99d109b67309aa1b30e ]
IOMMU domain resource life is well-defined, managed by .domain_alloc and .domain_free.
Therefore, domain-specific resources shouldn't be tied to the device life, but instead to its domain.
--- drivers/iommu/rockchip-iommu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/iommu/rockchip-iommu.c +5 -2
@@ -980,13 +980,13 @@ static struct iommu_domain *rk_iommu_domain_alloc(unsigned type)if (!dma_dev)return NULL ; - rk_domain =devm_kzalloc (dma_dev,sizeof (*rk_domain),GFP_KERNEL ); + rk_domain =kzalloc (sizeof (*rk_domain),GFP_KERNEL );if (!rk_domain)return NULL ;if (type ==IOMMU_DOMAIN_DMA &&iommu_get_dma_cookie (&rk_domain->domain)) -return NULL ; + goto err_free_domain;/* * rk32xx iommus use a 2 level pagetable.
@@ -1021,6 +1021,8 @@ err_free_dt: err_put_cookie:if (type ==IOMMU_DOMAIN_DMA )iommu_put_dma_cookie (&rk_domain->domain); +err_free_domain: +kfree (rk_domain);return NULL ; }
@@ -1049,6 +1051,7 @@ static void rk_iommu_domain_free(struct iommu_domain *domain)if (domain->type ==IOMMU_DOMAIN_DMA )iommu_put_dma_cookie (&rk_domain->domain); +kfree (rk_domain); }static int rk_iommu_add_device (struct device *dev)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 16/191 iommu/tegra-smmu: Fix page tables in > 4 GiB memory
In reply to Greg Kroah-HartmanFrom: Thierry Reding <[email protected]>
[ Upstream commit 96d3ab802e4930a29a33934373157d6dff1b2c7e ]
Page tables that reside in physical memory beyond the 4 GiB boundary are currently not working properly. The reason is that when the physical address for page directory entries is read, it gets truncated at 32 bits and can cause crashes when passing that address to the DMA API.
Fix this by first casting the PDE value to a dma_addr_t and then using the page frame number mask for the SMMU instance to mask out the invalid bits, which are typically used for mapping attributes, etc.
--- drivers/iommu/tegra-smmu.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/iommu/tegra-smmu.c +6 -5
@@ -159,9 +159,9 @@ static bool smmu_dma_addr_valid(struct tegra_smmu *smmu, dma_addr_t addr)return (addr & smmu->pfn_mask) == addr; } -static dma_addr_t smmu_pde_to_dma (u32 pde) +static dma_addr_t smmu_pde_to_dma (struct tegra_smmu *smmu,u32 pde) { -return pde <<12 ; +return (dma_addr_t)(pde & smmu->pfn_mask) <<12 ; }static void smmu_flush_ptc_all (struct tegra_smmu *smmu)
@@ -549,6 +549,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova, dma_addr_t *dmap) {unsigned int pd_index =iova_pd_index (iova); +struct tegra_smmu *smmu = as->smmu;struct page *pt_page;u32 *pd;
@@ -557,7 +558,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova,return NULL ; pd =page_address (as->pd); - *dmap =smmu_pde_to_dma (pd[pd_index]); + *dmap =smmu_pde_to_dma (smmu, pd[pd_index]);return tegra_smmu_pte_offset (pt_page, iova); }
@@ -599,7 +600,7 @@ static u32 *as_get_pte(struct tegra_smmu_as *as, dma_addr_t iova, }else {u32 *pd =page_address (as->pd); - *dmap =smmu_pde_to_dma (pd[pde]); + *dmap =smmu_pde_to_dma (smmu, pd[pde]); }return tegra_smmu_pte_offset (as->pts[pde], iova);
@@ -624,7 +625,7 @@ static void tegra_smmu_pte_put_use(struct tegra_smmu_as *as, unsigned long iova)if (--as->count[pde] ==0 ) {struct tegra_smmu *smmu = as->smmu;u32 *pd =page_address (as->pd); -dma_addr_t pte_dma =smmu_pde_to_dma (pd[pde]); +dma_addr_t pte_dma =smmu_pde_to_dma (smmu, pd[pde]);tegra_smmu_set_pde (as, iova,0 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 17/191 dmaengine: xilinx_dma: Clear desc_pendingcount in xilinx_dma_reset
In reply to Greg Kroah-HartmanFrom: Nicholas Graumann <[email protected]>
[ Upstream commit 8a631a5a0f7d4a4a24dba8587d5d9152be0871cc ]
Whenever we reset the channel, we need to clear desc_pendingcount along with desc_submitcount. Otherwise when a new transaction is submitted, the irq coalesce level could be programmed to an incorrect value in the axidma case.
This behavior can be observed when terminating pending transactions with xilinx_dma_terminate_all() and then submitting new transactions without releasing and requesting the channel.
--- drivers/dma/xilinx/xilinx_dma.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/xilinx/xilinx_dma.c +1 -0
@@ -1433,6 +1433,7 @@ static int xilinx_dma_reset(struct xilinx_dma_chan *chan) chan->err = false; chan->idle = true; + chan->desc_pendingcount =0 ; chan->desc_submitcount =0 ;return err;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 18/191 scsi: target: compare full CHAP_A Algorithm strings
In reply to Greg Kroah-HartmanFrom: David Disseldorp <[email protected]>
[ Upstream commit 9cef2a7955f2754257a7cddedec16edae7b587d0 ]
RFC 2307 states:
For CHAP [RFC1994], in the first step, the initiator MUST send:
CHAP_A=<A1,A2...>
Where A1,A2... are proposed algorithms, in order of preference.
...
For the Algorithm, as stated in [RFC1994], one value is required to be implemented:
5 (CHAP with MD5)
LIO currently checks for this value by only comparing a single byte in the tokenized Algorithm string, which means that any value starting with a '5' (e.g. "55") is interpreted as "CHAP with MD5". Fix this by comparing the entire tokenized string.
--- drivers/target/iscsi/iscsi_target_auth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target_auth.c +1 -1
@@ -70,7 +70,7 @@ static int chap_check_algorithm(const char *a_str)if (!token) goto out; -if (!strncmp (token,"5" ,1 )) { +if (!strcmp (token,"5" )) {pr_debug ("Selected MD5 Algorithm\n" );kfree (orig);return CHAP_DIGEST_MD5 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 19/191 scsi: lpfc: Fix hardlockup in lpfc_abort_handler
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 91a52b617cdb8bf6d298892101c061d438b84a19 ]
In lpfc_abort_handler, the lock acquire order is hbalock (irqsave), buf_lock (irq) and ring_lock (irq). The issue is that in two places the locks are released out of order - the buf_lock and the hbalock - resulting in the cpu preemption/lock flags getting restored out of order and deadlocking the cpu.
Fix the unlock order by fully releasing the hbalocks as well.
--- drivers/scsi/lpfc/lpfc_scsi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_scsi.c +3 -2
@@ -4846,20 +4846,21 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd) ret_val =__lpfc_sli_issue_iocb (phba,LPFC_FCP_RING , abtsiocb,0 ); } -/* no longer need the lock after this point */ -spin_unlock_irqrestore (&phba->hbalock, flags);if (ret_val ==IOCB_ERROR ) {/* Indicate the IO is not being aborted by the driver. */ iocb->iocb_flag &= ~LPFC_DRIVER_ABORTED ; lpfc_cmd->waitq =NULL ;spin_unlock (&lpfc_cmd->buf_lock); +spin_unlock_irqrestore (&phba->hbalock, flags);lpfc_sli_release_iocbq (phba, abtsiocb); ret =FAILED ; goto out; } +/* no longer need the lock after this point */ spin_unlock (&lpfc_cmd->buf_lock); +spin_unlock_irqrestore (&phba->hbalock, flags);if (phba->cfg_poll &DISABLE_FCP_RING_INT ) lpfc_sli_handle_fast_ring_event(phba,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 20/191 scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit feff8b3d84d3d9570f893b4d83e5eab6693d6a52 ]
When operating in private loop mode, PLOGI exchanges are racing and the driver tries to abort it's PLOGI. But the PLOGI abort ends up terminating the login with the other end causing the other end to abort its PLOGI as well. Discovery never fully completes.
Fix by disabling the PLOGI abort when private loop and letting the state machine play out.
--- drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_nportdisc.c +3 -1
@@ -484,8 +484,10 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,* single discovery thread, this will cause a huge delay in * discovery. Also this will cause multiple state machines * running in parallel for this node. +* This only applies to a fabric environment. */ -if (ndlp->nlp_state ==NLP_STE_PLOGI_ISSUE ) { +if ((ndlp->nlp_state ==NLP_STE_PLOGI_ISSUE ) && + (vport->fc_flag &FC_FABRIC )) {/* software abort outstanding PLOGI */ lpfc_els_abort (phba, ndlp); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 21/191 scsi: csiostor: Dont enable IRQs too early
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit d6c9b31ac3064fbedf8961f120a4c117daa59932 ]
These are called with IRQs disabled from csio_mgmt_tmo_handler() so we can't call spin_unlock_irq() or it will enable IRQs prematurely.
--- drivers/scsi/csiostor/csio_lnode.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/scsi/csiostor/csio_lnode.c +9 -6
@@ -301,6 +301,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)struct fc_fdmi_port_name *port_name;uint8_t buf[64 ];uint8_t *fc4_type; +unsigned long flags;if (fdmi_req->wr_status !=FW_SUCCESS ) { csio_ln_dbg(ln, "WR error:%x in processing fdmi rhba cmd\n",
@@ -385,13 +386,13 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) len = (uint32_t )(pld - (uint8_t *)cmd);/* Submit FDMI RPA request */ -spin_lock_irq (&hw->lock); +spin_lock_irqsave (&hw->lock, flags);if (csio_ln_mgmt_submit_req (fdmi_req, csio_ln_fdmi_done,FCOE_CT , &fdmi_req->dma_buf, len)) {CSIO_INC_STATS (ln, n_fdmi_err);csio_ln_dbg (ln,"Failed to issue fdmi rpa req\n" ); } -spin_unlock_irq (&hw->lock); +spin_unlock_irqrestore (&hw->lock, flags); }/*
@@ -412,6 +413,7 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)struct fc_fdmi_rpl *reg_pl;struct fs_fdmi_attrs *attrib_blk;uint8_t buf[64 ]; +unsigned long flags;if (fdmi_req->wr_status !=FW_SUCCESS ) { csio_ln_dbg(ln, "WR error:%x in processing fdmi dprt cmd\n",
@@ -491,13 +493,13 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) attrib_blk->numattrs =htonl (numattrs);/* Submit FDMI RHBA request */ -spin_lock_irq (&hw->lock); +spin_lock_irqsave (&hw->lock, flags);if (csio_ln_mgmt_submit_req (fdmi_req, csio_ln_fdmi_rhba_cbfn,FCOE_CT , &fdmi_req->dma_buf, len)) {CSIO_INC_STATS (ln, n_fdmi_err);csio_ln_dbg (ln,"Failed to issue fdmi rhba req\n" ); } -spin_unlock_irq (&hw->lock); +spin_unlock_irqrestore (&hw->lock, flags); }/*
@@ -512,6 +514,7 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)void *cmd;struct fc_fdmi_port_name *port_name;uint32_t len; +unsigned long flags;if (fdmi_req->wr_status !=FW_SUCCESS ) { csio_ln_dbg(ln, "WR error:%x in processing fdmi dhba cmd\n",
@@ -542,13 +545,13 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) len +=sizeof (*port_name);/* Submit FDMI request */ -spin_lock_irq (&hw->lock); +spin_lock_irqsave (&hw->lock, flags);if (csio_ln_mgmt_submit_req (fdmi_req, csio_ln_fdmi_dprt_cbfn,FCOE_CT , &fdmi_req->dma_buf, len)) {CSIO_INC_STATS (ln, n_fdmi_err);csio_ln_dbg (ln,"Failed to issue fdmi dprt req\n" ); } -spin_unlock_irq (&hw->lock); +spin_unlock_irqrestore (&hw->lock, flags); }/**
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 22/191 scsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec()
In reply to Greg Kroah-HartmanFrom: Xiang Chen <[email protected]>
[ Upstream commit 550c0d89d52d3bec5c299f69b4ed5d2ee6b8a9a6 ]
For IOs from upper layer, preemption may be disabled as it may be called by function __blk_mq_delay_run_hw_queue which will call get_cpu() (it disables preemption). So if flags HISI_SAS_REJECT_CMD_BIT is set in function hisi_sas_task_exec(), it may disable preempt twice after down() and up() which will cause following call trace:
BUG: scheduling while atomic: fio/60373/0x00000002 Call trace: dump_backtrace+0x0/0x150 show_stack+0x24/0x30 dump_stack+0xa0/0xc4 __schedule_bug+0x68/0x88 __schedule+0x4b8/0x548 schedule+0x40/0xd0 schedule_timeout+0x200/0x378 __down+0x78/0xc8 down+0x54/0x70 hisi_sas_task_exec.isra.10+0x598/0x8d8 [hisi_sas_main] hisi_sas_queue_command+0x28/0x38 [hisi_sas_main] sas_queuecommand+0x168/0x1b0 [libsas] scsi_queue_rq+0x2ac/0x980 blk_mq_dispatch_rq_list+0xb0/0x550 blk_mq_do_dispatch_sched+0x6c/0x110 blk_mq_sched_dispatch_requests+0x114/0x1d8 __blk_mq_run_hw_queue+0xb8/0x130 __blk_mq_delay_run_hw_queue+0x1c0/0x220 blk_mq_run_hw_queue+0xb0/0x128 blk_mq_sched_insert_requests+0xdc/0x208 blk_mq_flush_plug_list+0x1b4/0x3a0 blk_flush_plug_list+0xdc/0x110 blk_finish_plug+0x3c/0x50 blkdev_direct_IO+0x404/0x550 generic_file_read_iter+0x9c/0x848 blkdev_read_iter+0x50/0x78 aio_read+0xc8/0x170 io_submit_one+0x1fc/0x8d8 __arm64_sys_io_submit+0xdc/0x280 el0_svc_common.constprop.0+0xe0/0x1e0 el0_svc_handler+0x34/0x90 el0_svc+0x10/0x14
...
To solve the issue, check preemptible() to avoid disabling preempt multiple when flag HISI_SAS_REJECT_CMD_BIT is set.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +7 -1
@@ -587,7 +587,13 @@ static int hisi_sas_task_exec(struct sas_task *task, gfp_t gfp_flags, dev = hisi_hba->dev;if (unlikely (test_bit (HISI_SAS_REJECT_CMD_BIT , &hisi_hba->flags))) { -if (in_softirq ()) +/* +* For IOs from upper layer, it may already disable preempt +* in the IO path, if disable preempt again in down(), +* function schedule() will report schedule_bug(), so check +* preemptible() before goto down(). +*/ +if (!preemptible ())return -EINVAL ;down (&hisi_hba->sem);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 23/191 scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails
In reply to Greg Kroah-HartmanFrom: Luo Jiaxing <[email protected]>
[ Upstream commit cabe7c10c97a0857a9fb14b6c772ab784947995d ]
Although if the debugfs initialization fails, we will delete the debugfs folder of hisi_sas, but we did not consider the scenario where debugfs was successfully initialized, but the probe failed for other reasons. We found out that hisi_sas folder is still remain after the probe failed.
When probe fail, we should delete debugfs folder to avoid the above issue.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + 2 files changed, 2 insertions(+)
drivers/scsi/hisi_sas/hisi_sas_main.c +1 -0
@@ -2682,6 +2682,7 @@ int hisi_sas_probe(struct platform_device *pdev, err_out_register_ha:scsi_remove_host (shost); err_out_ha: +hisi_sas_debugfs_exit (hisi_hba);hisi_sas_free (hisi_hba);scsi_host_put (shost);return rc;
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -0
@@ -3259,6 +3259,7 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) err_out_register_ha:scsi_remove_host (shost); err_out_ha: +hisi_sas_debugfs_exit (hisi_hba);scsi_host_put (shost); err_out_regions:pci_release_regions (pdev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 24/191 powerpc/pseries: Mark accumulate_stolen_time() as notrace
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit eb8e20f89093b64f48975c74ccb114e6775cee22 ]
accumulate_stolen_time() is called prior to interrupt state being reconciled, which can trip the warning in arch_local_irq_restore():
WARNING: CPU: 5 PID: 1017 at arch/powerpc/kernel/irq.c:258 .arch_local_irq_restore+0x9c/0x130
...
NIP .arch_local_irq_restore+0x9c/0x130
LR .rb_start_commit+0x38/0x80
Call Trace:
.ring_buffer_lock_reserve+0xe4/0x620
.trace_function+0x44/0x210
.function_trace_call+0x148/0x170
.ftrace_ops_no_ops+0x180/0x1d0
ftrace_call+0x4/0x8
.accumulate_stolen_time+0x1c/0xb0
decrementer_common+0x124/0x160For now just mark it as notrace. We may change the ordering to call it after interrupt state has been reconciled, but that is a larger change.
--- arch/powerpc/kernel/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/time.c +1 -1
@@ -232,7 +232,7 @@ static u64 scan_dispatch_log(u64 stop_tb)* Accumulate stolen time by scanning the dispatch trace log. * Called on entry from user mode. */ -void accumulate_stolen_time (void ) +void notrace accumulate_stolen_time(void) {u64 sst, ust;unsigned long save_irq_soft_mask =irq_soft_mask_return ();
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 25/191 powerpc/pseries: Dont fail hash page table insert for bolted mapping
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
[ Upstream commit 75838a3290cd4ebbd1f567f310ba04b6ef017ce4 ]
If the hypervisor returned H_PTEG_FULL for H_ENTER hcall, retry a hash page table insert by removing a random entry from the group.
After some runtime, it is very well possible to find all the 8 hash page table entry slot in the hpte group used for mapping. Don't fail a bolted entry insert in that case. With Storage class memory a user can find this error easily since a namespace enable/disable is equivalent to memory add/remove.
This results in failures as reported below:
$ ndctl create-namespace -r region1 -t pmem -m devdax -a 65536 -s 100M libndctl: ndctl_dax_enable: dax1.3: failed to enable Error: namespace1.2: failed to enable
failed to create namespace: No such device or address
In kernel log we find the details as below:
Unable to create mapping for hot added memory 0xc000042006000000..0xc00004200d000000: -1dax_pmem: probe of dax1.3 failed with error -14
This indicates that we failed to create a bolted hash table entry for direct-map address backing the namespace.
We also observe failures such that not all namespaces will be enabled with ndctl enable-namespace all command.
--- arch/powerpc/mm/book3s64/hash_utils.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
arch/powerpc/mm/book3s64/hash_utils.c +8 -1
@@ -294,7 +294,14 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend, ret = mmu_hash_ops.hpte_insert (hpteg, vpn, paddr, tprot,HPTE_V_BOLTED , psize, psize, ssize); - +if (ret ==-1 ) { +/* Try to remove a non bolted entry */ + ret = mmu_hash_ops.hpte_remove (hpteg); +if (ret !=-1 ) + ret = mmu_hash_ops.hpte_insert (hpteg, vpn, paddr, tprot, +HPTE_V_BOLTED , psize, psize, + ssize); + }if (ret <0 )break ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 26/191 Input: st1232 - do not reset the chip too early
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit efd7bb08a762d4f6322054c6824bd942971ac563 ]
We should not be putting the chip into reset while interrupts are enabled and ISR may be running. Fix this by installing a custom devm action and powering off the device/resetting GPIO line from there. This ensures proper ordering.
--- drivers/input/touchscreen/st1232.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/input/touchscreen/st1232.c +12 -10
@@ -149,6 +149,11 @@ static void st1232_ts_power(struct st1232_ts_data *ts, bool poweron)gpiod_set_value_cansleep (ts->reset_gpio, !poweron); } +static void st1232_ts_power_off (void *data) +{ +st1232_ts_power (data, false); +} +static const struct st_chip_info st1232_chip_info = { .have_z = true, .max_x =0x31f ,/* 800 - 1 */
@@ -229,6 +234,13 @@ static int st1232_ts_probe(struct i2c_client *client,st1232_ts_power (ts, true); + error =devm_add_action_or_reset (&client->dev, st1232_ts_power_off, ts); +if (error) { +dev_err (&client->dev, +"Failed to install power off action: %d\n" , error); +return error; + } + input_dev->name ="st1232-touchscreen" ; input_dev->id.bustype =BUS_I2C ; input_dev->dev.parent = &client->dev;
@@ -271,15 +283,6 @@ static int st1232_ts_probe(struct i2c_client *client,return 0 ; } -static int st1232_ts_remove (struct i2c_client *client) -{ -struct st1232_ts_data *ts =i2c_get_clientdata (client); - -st1232_ts_power (ts, false); - -return 0 ; -} -static int __maybe_unused st1232_ts_suspend (struct device *dev) {struct i2c_client *client =to_i2c_client (dev);
@@ -329,7 +332,6 @@ MODULE_DEVICE_TABLE(of, st1232_ts_dt_ids);static struct i2c_driver st1232_ts_driver = { .probe = st1232_ts_probe, - .remove = st1232_ts_remove, .id_table = st1232_ts_id, .driver = { .name =ST1232_TS_NAME ,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 27/191 selftests/powerpc: Fixup clobbers for TM tests
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit a02cbc7ffe529ed58b6bbe54652104fc2c88bd77 ]
Some of our TM (Transactional Memory) tests, list "r1" (the stack pointer) as a clobbered register.
GCC >= 9 doesn't accept this, and the build breaks:
ptrace-tm-spd-tar.c: In function 'tm_spd_tar':
ptrace-tm-spd-tar.c:31:2: error: listing the stack pointer register 'r1' in a clobber list is deprecated [-Werror=deprecated]
31 | asm __volatile__(
| ^~~ptrace-tm-spd-tar.c:31:2: note: the value of the stack pointer after an 'asm' statement must be the same as it was before the statement
We do have some fairly large inline asm blocks in these tests, and some of them do change the value of r1. However they should all return to C with the value in r1 restored, so I think it's legitimate to say r1 is not clobbered.
As Segher points out, the r1 clobbers may have been added because of the use of or 1,1,1, however that doesn't actually clobber r1.
Segher also points out that some of these tests do clobber LR, because they call functions, and that is not listed in the clobbers, so add that where appropriate.
--- tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c | 2 +- tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c | 4 ++-- tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c | 2 +- tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-)
tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c +1 -1
@@ -73,7 +73,7 @@ trans: [sprn_texasr]"i"(SPRN_TEXASR), [tar_1]"i"(TAR_1), [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), [dscr_2]"i"(DSCR_2), [tar_3]"i"(TAR_3), [dscr_3]"i"(DSCR_3) - : "memory", "r0", "r1", "r3", "r4", "r5", "r6" + : "memory", "r0", "r3", "r4", "r5", "r6", "lr" );/* TM failed, analyse */
tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c +2 -2
@@ -74,8 +74,8 @@ trans: "3: ;" : [res] "=r" (result), [texasr] "=r" (texasr) : [sprn_texasr] "i" (SPRN_TEXASR) - : "memory", "r0", "r1", "r3", "r4", -"r7" ,"r8" ,"r9" ,"r10" ,"r11" + : "memory", "r0", "r3", "r4", +"r7" ,"r8" ,"r9" ,"r10" ,"r11" ,"lr" );if (result) {
tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c +1 -1
@@ -62,7 +62,7 @@ trans: [sprn_ppr]"i"(SPRN_PPR), [sprn_texasr]"i"(SPRN_TEXASR), [tar_1]"i"(TAR_1), [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), [dscr_2]"i"(DSCR_2), [cptr1] "b" (&cptr[1]) - : "memory", "r0", "r1", "r3", "r4", "r5", "r6" + : "memory", "r0", "r3", "r4", "r5", "r6" );/* TM failed, analyse */
tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c +2 -2
@@ -62,8 +62,8 @@ trans:"3: ;" : [res] "=r" (result), [texasr] "=r" (texasr) : [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "b" (&cptr[1]) - : "memory", "r0", "r1", "r3", "r4", - "r7", "r8", "r9", "r10", "r11" + : "memory", "r0", "r3", "r4", + "r7", "r8", "r9", "r10", "r11", "lr" );if (result) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 28/191 powerpc/tools: Dont quote $objdump in scripts
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit e44ff9ea8f4c8a90c82f7b85bd4f5e497c841960 ]
Some of our scripts are passed $objdump and then call it as "$objdump". This doesn't work if it contains spaces because we're using ccache, for example you get errors such as:
./arch/powerpc/tools/relocs_check.sh: line 48: ccache ppc64le-objdump: No such file or directory ./arch/powerpc/tools/unrel_branch_check.sh: line 26: ccache ppc64le-objdump: No such file or directory
Fix it by not quoting the string when we expand it, allowing the shell to do the right thing for us.
--- arch/powerpc/tools/relocs_check.sh | 2 +- arch/powerpc/tools/unrel_branch_check.sh | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/tools/relocs_check.sh +1 -1
@@ -20,7 +20,7 @@ objdump="$1" vmlinux="$2" bad_relocs=$( -"$objdump" -R "$vmlinux" | +$objdump -R "$vmlinux" | # Only look at relocation lines. grep -E '\<R_' | # These relocations are okay
arch/powerpc/tools/unrel_branch_check.sh +2 -2
@@ -18,14 +18,14 @@ vmlinux="$2" #__end_interrupts should be located within the first 64K end_intr=0x$( -"$objdump" -R "$vmlinux" -d --start-address=0xc000000000000000 \ +$objdump -R "$vmlinux" -d --start-address=0xc000000000000000 \ --stop-address=0xc000000000010000 | grep '\<__end_interrupts>:' | awk '{print $1}' ) BRANCHES=$( -"$objdump" -R "$vmlinux" -D --start-address=0xc000000000000000 \ +$objdump -R "$vmlinux" -D --start-address=0xc000000000000000 \ --stop-address=${end_intr} | grep -e "^c[0-9a-f]*:[[:space:]]*\([0-9a-f][0-9a-f][[:space:]]\)\{4\}[[:space:]]*b" | grep -v '\<__start_initialization_multiplatform>' |
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 29/191 dma-debug: add a schedule point in debug_dma_dump_mappings()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 9ff6aa027dbb98755f0265695354f2dd07c0d1ce ]
debug_dma_dump_mappings() can take a lot of cpu cycles :
lpk43:/# time wc -l /sys/kernel/debug/dma-api/dump 163435 /sys/kernel/debug/dma-api/dump
real 0m0.463s
user 0m0.003s
sys 0m0.459s
Let's add a cond_resched() to avoid holding cpu for too long.
--- kernel/dma/debug.c | 1 + 1 file changed, 1 insertion(+)
kernel/dma/debug.c +1 -0
@@ -420,6 +420,7 @@ void debug_dma_dump_mappings(struct device *dev) }spin_unlock_irqrestore (&bucket->lock, flags); +cond_resched (); } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 30/191 dma-mapping: Add vmap checks to dma_map_single()
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 4544b9f25e70eae9f70a243de0cc802aa5c8cb69 ]
As we've seen from USB and other areas[1], we need to always do runtime checks for DMA operating on memory regions that might be remapped. This adds vmap checks (similar to those already in USB but missing in other places) into dma_map_single() so all callers benefit from the checking.
[1] https://git.kernel.org/linus/3840c5b78803b2b6cc1ff820100a74a092c40cbb
--- include/linux/dma-mapping.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/dma-mapping.h +4 -0
@@ -583,6 +583,10 @@ static inline unsigned long dma_get_merge_boundary(struct device *dev)static inline dma_addr_t dma_map_single_attrs (struct device *dev,void *ptr,size_t size,enum dma_data_direction dir,unsigned long attrs) { +/* DMA must never operate on areas that might be remapped. */ +if (dev_WARN_ONCE (dev,is_vmalloc_addr (ptr), +"rejecting DMA map of vmalloc memory\n" )) +return DMA_MAPPING_ERROR ;debug_dma_map_single (dev, ptr, size);return dma_map_page_attrs (dev,virt_to_page (ptr),offset_in_page (ptr), size, dir, attrs);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 31/191 dma-mapping: fix handling of dma-ranges for reserved memory (again)
In reply to Greg Kroah-HartmanFrom: Vladimir Murzin <[email protected]>
[ Upstream commit a445e940ea686fc60475564009821010eb213be3 ]
Daniele reported that issue previously fixed in c41f9ea998f3 ("drivers: dma-coherent: Account dma_pfn_offset when used with device tree") reappear shortly after 43fc509c3efb ("dma-coherent: introduce interface for default DMA pool") where fix was accidentally dropped.
Lets put fix back in place and respect dma-ranges for reserved memory.
--- arch/arm/mm/dma-mapping-nommu.c | 2 +- include/linux/dma-mapping.h | 4 ++-- kernel/dma/coherent.c | 16 +++++++++------- 3 files changed, 12 insertions(+), 10 deletions(-)
arch/arm/mm/dma-mapping-nommu.c +1 -1
@@ -35,7 +35,7 @@ static void *arm_nommu_dma_alloc(struct device *dev, size_t size, unsigned long attrs) { -void *ret =dma_alloc_from_global_coherent (size, dma_handle); +void *ret =dma_alloc_from_global_coherent (dev, size, dma_handle);/* * dma_alloc_from_global_coherent() may fail because:
include/linux/dma-mapping.h +2 -2
@@ -162,7 +162,7 @@ int dma_release_from_dev_coherent(struct device *dev, int order, void *vaddr);int dma_mmap_from_dev_coherent (struct device *dev,struct vm_area_struct *vma,void *cpu_addr,size_t size,int *ret); -void *dma_alloc_from_global_coherent (ssize_t size,dma_addr_t *dma_handle); +void *dma_alloc_from_global_coherent (struct device *dev,ssize_t size,dma_addr_t *dma_handle);int dma_release_from_global_coherent (int order,void *vaddr);int dma_mmap_from_global_coherent (struct vm_area_struct *vma,void *cpu_addr,size_t size,int *ret);
@@ -172,7 +172,7 @@ int dma_mmap_from_global_coherent(struct vm_area_struct *vma, void *cpu_addr,#define dma_release_from_dev_coherent (dev, order, vaddr) (0)#define dma_mmap_from_dev_coherent (dev, vma, vaddr, order, ret) (0) -static inline void *dma_alloc_from_global_coherent (ssize_t size, +static inline void *dma_alloc_from_global_coherent (struct device *dev,ssize_t size,dma_addr_t *dma_handle) {return NULL ;
kernel/dma/coherent.c +9 -7
@@ -123,8 +123,9 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr,return ret; } -static void *__dma_alloc_from_coherent (struct dma_coherent_mem *mem, -ssize_t size,dma_addr_t *dma_handle) +static void *__dma_alloc_from_coherent (struct device *dev, +struct dma_coherent_mem *mem, +ssize_t size,dma_addr_t *dma_handle) {int order =get_order (size);unsigned long flags;
@@ -143,7 +144,7 @@ static void *__dma_alloc_from_coherent(struct dma_coherent_mem *mem,/* * Memory was found in the coherent area. */ - *dma_handle = mem->device_base + (pageno <<PAGE_SHIFT ); + *dma_handle =dma_get_device_base (dev, mem) + (pageno <<PAGE_SHIFT ); ret = mem->virt_base + (pageno <<PAGE_SHIFT );spin_unlock_irqrestore (&mem->spinlock, flags);memset (ret,0 , size);
@@ -175,17 +176,18 @@ int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size,if (!mem)return 0 ; - *ret =__dma_alloc_from_coherent (mem, size, dma_handle); + *ret =__dma_alloc_from_coherent (dev, mem, size, dma_handle);return 1 ; } -void *dma_alloc_from_global_coherent (ssize_t size,dma_addr_t *dma_handle) +void *dma_alloc_from_global_coherent (struct device *dev,ssize_t size, +dma_addr_t *dma_handle) {if (!dma_coherent_default_memory)return NULL ; -return __dma_alloc_from_coherent (dma_coherent_default_memory, size, - dma_handle); +return __dma_alloc_from_coherent (dev, dma_coherent_default_memory, size, + dma_handle); } static int __dma_release_from_coherent(struct dma_coherent_mem *mem,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 32/191 dmaengine: fsl-qdma: Handle invalid qdma-queue0 IRQ
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 41814c4eadf8a791b6d07114f96e7e120e59555c ]
platform_get_irq_byname() might return -errno which later would be cast to an unsigned int and used in IRQ handling code leading to usage of wrong ID and errors about wrong irq_base.
--- drivers/dma/fsl-qdma.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/dma/fsl-qdma.c +3 -0
@@ -1155,6 +1155,9 @@ static int fsl_qdma_probe(struct platform_device *pdev)return ret; fsl_qdma->irq_base =platform_get_irq_byname (pdev,"qdma-queue0" ); +if (fsl_qdma->irq_base <0 ) +return fsl_qdma->irq_base; + fsl_qdma->feature =of_property_read_bool (np,"big-endian" );INIT_LIST_HEAD (&fsl_qdma->dma_dev.channels);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 33/191 leds: lm3692x: Handle failure to probe the regulator
In reply to Greg Kroah-HartmanFrom: Guido Günther <[email protected]>
[ Upstream commit 396128d2ffcba6e1954cfdc9a89293ff79cbfd7c ]
Instead use devm_regulator_get_optional since the regulator is optional and check for errors.
--- drivers/leds/leds-lm3692x.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/leds/leds-lm3692x.c +11 -2
@@ -334,9 +334,18 @@ static int lm3692x_probe_dt(struct lm3692x_led *led)return ret; } - led->regulator =devm_regulator_get (&led->client->dev,"vled" ); -if (IS_ERR (led->regulator)) + led->regulator =devm_regulator_get_optional (&led->client->dev,"vled" ); +if (IS_ERR (led->regulator)) { + ret =PTR_ERR (led->regulator); +if (ret != -ENODEV ) { +if (ret != -EPROBE_DEFER ) +dev_err (&led->client->dev, +"Failed to get vled regulator: %d\n" , + ret); +return ret; + } led->regulator =NULL ; + } child =device_get_next_child_node (&led->client->dev, child);if (!child) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 34/191 leds: an30259a: add a check for devm_regmap_init_i2c
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit fc7b5028f2627133c7c18734715a08829eab4d1f ]
an30259a_probe misses a check for devm_regmap_init_i2c and may cause problems.
Add a check and print errors like other leds drivers.
--- drivers/leds/leds-an30259a.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/leds/leds-an30259a.c +7 -0
@@ -305,6 +305,13 @@ static int an30259a_probe(struct i2c_client *client) chip->regmap =devm_regmap_init_i2c (client, &an30259a_regmap_config); +if (IS_ERR (chip->regmap)) { + err =PTR_ERR (chip->regmap); +dev_err (&client->dev,"Failed to allocate register map: %d\n" , + err); + goto exit; + } +for (i =0 ; i < chip->num_leds; i++) {struct led_init_data init_data = {};
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 35/191 leds: trigger: netdev: fix handling on interface rename
In reply to Greg Kroah-HartmanFrom: Martin Schiller <[email protected]>
[ Upstream commit 5f820ed52371b4f5d8c43c93f03408d0dbc01e5b ]
The NETDEV_CHANGENAME code is not "unneeded" like it is stated in commit 4cb6560514fa ("leds: trigger: netdev: fix refcnt leak on interface rename").
The event was accidentally misinterpreted equivalent to NETDEV_UNREGISTER, but should be equivalent to NETDEV_REGISTER.
This was the case in the original code from the openwrt project.
Otherwise, you are unable to set netdev led triggers for (non-existent) netdevices, which has to be renamed. This is the case, for example, for ppp interfaces in openwrt.
--- drivers/leds/trigger/ledtrig-netdev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/leds/trigger/ledtrig-netdev.c +4 -1
@@ -302,10 +302,12 @@ static int netdev_trig_notify(struct notifier_block *nb, container_of(nb, struct led_netdev_data, notifier);if (evt !=NETDEV_UP && evt !=NETDEV_DOWN && evt !=NETDEV_CHANGE - && evt !=NETDEV_REGISTER && evt !=NETDEV_UNREGISTER ) + && evt !=NETDEV_REGISTER && evt !=NETDEV_UNREGISTER + && evt !=NETDEV_CHANGENAME )return NOTIFY_DONE ;if (!(dev == trigger_data->net_dev || + (evt ==NETDEV_CHANGENAME && !strcmp (dev->name, trigger_data->device_name)) || (evt ==NETDEV_REGISTER && !strcmp (dev->name, trigger_data->device_name))))return NOTIFY_DONE ;
@@ -315,6 +317,7 @@ static int netdev_trig_notify(struct notifier_block *nb,clear_bit (NETDEV_LED_MODE_LINKUP , &trigger_data->mode);switch (evt) { +case NETDEV_CHANGENAME :case NETDEV_REGISTER :if (trigger_data->net_dev)dev_put (trigger_data->net_dev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 36/191 clocksource/drivers/asm9260: Add a check for of_clk_get
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit 6e001f6a4cc73cd06fc7b8c633bc4906c33dd8ad ]
asm9260_timer_init misses a check for of_clk_get.
Add a check for it and print errors like other clocksource drivers.
--- drivers/clocksource/asm9260_timer.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/clocksource/asm9260_timer.c +4 -0
@@ -194,6 +194,10 @@ static int __init asm9260_timer_init(struct device_node *np) } clk =of_clk_get (np,0 ); +if (IS_ERR (clk)) { +pr_err ("Failed to get clk!\n" ); +return PTR_ERR (clk); + } ret =clk_prepare_enable (clk);if (ret) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 37/191 clocksource/drivers/timer-of: Use unique device name instead of timer
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 4411464d6f8b5e5759637235a6f2b2a85c2be0f1 ]
If a hardware-specific driver does not provide a name, the timer-of core falls back to device_node.name. Due to generic DT node naming policies, that name is almost always "timer", and thus doesn't identify the actual timer used.
Fix this by using device_node.full_name instead, which includes the unit addrees.
Example impact on /proc/timer_list:
-Clock Event Device: timer
+Clock Event Device: timer@fcfec400
--- drivers/clocksource/timer-of.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clocksource/timer-of.c +1 -1
@@ -192,7 +192,7 @@ int __init timer_of_init(struct device_node *np, struct timer_of *to) }if (!to->clkevt.name) - to->clkevt.name = np->name; + to->clkevt.name = np->full_name; to->np = np;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 38/191 dtc: Use pkg-config to locate libyaml
In reply to Greg Kroah-HartmanFrom: Pavel Modilaynen <[email protected]>
[ Upstream commit 067c650c456e758f933aaf87a202f841d34be269 ]
Using Makefile's wildcard with absolute path to detect the presence of libyaml results in false-positive detection when cross-compiling e.g. in yocto environment. The latter results in build error:
| scripts/dtc/yamltree.o: In function `yaml_propval_int': | yamltree.c: undefined reference to `yaml_sequence_start_event_initialize' | yamltree.c: undefined reference to `yaml_emitter_emit' | yamltree.c: undefined reference to `yaml_scalar_event_initialize'
...
Use pkg-config to locate libyaml to address this scenario.
--- scripts/dtc/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/dtc/Makefile +2 -2
@@ -11,7 +11,7 @@ dtc-objs += dtc-lexer.lex.o dtc-parser.tab.o # Source files need to get at the userspace version of libfdt_env.h to compile HOST_EXTRACFLAGS := -I $(srctree)/$(src)/libfdt -ifeq ($(wildcard /usr/include/yaml.h),) +ifeq ($(shell pkg-config --exists yaml-0.1 2>/dev/null && echo yes),) ifneq ($(CHECK_DTBS),) $(error dtc needs libyaml for DT schema validation support. \ Install the necessary libyaml development package.)
@@ -19,7 +19,7 @@ endif HOST_EXTRACFLAGS += -DNO_YAML else dtc-objs += yamltree.o -HOSTLDLIBS_dtc := -lyaml +HOSTLDLIBS_dtc := $(shell pkg-config yaml-0.1 --libs) endif # Generated files need one more search path to include headers in source tree
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 39/191 selftests/powerpc: Skip tm-signal-sigreturn-nt if TM not available
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit 505127068d9b705a6cf335143239db91bfe7bbe2 ]
On systems where TM (Transactional Memory) is disabled the tm-signal-sigreturn-nt test causes a SIGILL:
test: tm_signal_sigreturn_nt
tags: git_version:7c202575ef63
!! child died by signal 4
failure: tm_signal_sigreturn_nt
We should skip the test if TM is not available.
--- tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/powerpc/tm/tm-signal-sigreturn-nt.c +4 -0
@@ -10,10 +10,12 @@*/ #define _GNU_SOURCE +#include <stdio.h> #include <stdlib.h> #include <signal.h> #include "utils.h" +#include "tm.h" void trap_signal_handler (int signo,siginfo_t *si,void *uc) {
@@ -29,6 +31,8 @@ int tm_signal_sigreturn_nt(void) {struct sigaction trap_sa; +SKIP_IF (!have_htm ()); + trap_sa.sa_flags =SA_SIGINFO ; trap_sa.sa_sigaction = trap_signal_handler;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 40/191 powerpc/security/book3s64: Report L1TF status in sysfs
In reply to Greg Kroah-HartmanFrom: Anthony Steinhauser <[email protected]>
[ Upstream commit 8e6b6da91ac9b9ec5a925b6cb13f287a54bd547d ]
Some PowerPC CPUs are vulnerable to L1TF to the same extent as to Meltdown. It is also mitigated by flushing the L1D on privilege transition.
Currently the sysfs gives a false negative on L1TF on CPUs that I verified to be vulnerable, a Power9 Talos II Boston 004e 1202, PowerNV T2P9D01.
--- arch/powerpc/kernel/security.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/kernel/security.c +5 -0
@@ -168,6 +168,11 @@ ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, cha return sprintf(buf, "Vulnerable\n"); } + +ssize_t cpu_show_l1tf (struct device *dev,struct device_attribute *attr,char *buf) +{ +return cpu_show_meltdown (dev, attr, buf); +}#endif ssize_t cpu_show_spectre_v1 (struct device *dev,struct device_attribute *attr,char *buf)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 41/191 powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
[ Upstream commit 16f6b67cf03cb43db7104acb2ca877bdc2606c92 ]
With large memory (8TB and more) hotplug, we can get soft lockup warnings as below. These were caused by a long loop without any explicit cond_resched which is a problem for !PREEMPT kernels.
Avoid this using cond_resched() while inserting hash page table entries. We already do similar cond_resched() in __add_pages(), see commit f64ac5e6e306 ("mm, memory_hotplug: add scheduling point to __add_pages").
rcu: 3-....: (24002 ticks this GP) idle=13e/1/0x4000000000000002 softirq=722/722 fqs=12001
(t=24003 jiffies g=4285 q=2002)
NMI backtrace for cpu 3
CPU: 3 PID: 3870 Comm: ndctl Not tainted 5.3.0-197.18-default+ #2
Call Trace:
dump_stack+0xb0/0xf4 (unreliable)
nmi_cpu_backtrace+0x124/0x130
nmi_trigger_cpumask_backtrace+0x1ac/0x1f0
arch_trigger_cpumask_backtrace+0x28/0x3c
rcu_dump_cpu_stacks+0xf8/0x154
rcu_sched_clock_irq+0x878/0xb40
update_process_times+0x48/0x90
tick_sched_handle.isra.16+0x4c/0x80
tick_sched_timer+0x68/0xe0
__hrtimer_run_queues+0x180/0x430
hrtimer_interrupt+0x110/0x300
timer_interrupt+0x108/0x2f0
decrementer_common+0x114/0x120
--- interrupt: 901 at arch_add_memory+0xc0/0x130
LR = arch_add_memory+0x74/0x130
memremap_pages+0x494/0x650
devm_memremap_pages+0x3c/0xa0
pmem_attach_disk+0x188/0x750
nvdimm_bus_probe+0xac/0x2c0
really_probe+0x148/0x570
driver_probe_device+0x19c/0x1d0
device_driver_attach+0xcc/0x100
bind_store+0x134/0x1c0
drv_attr_store+0x44/0x60
sysfs_kf_write+0x64/0x90
kernfs_fop_write+0x1a0/0x270
__vfs_write+0x3c/0x70
vfs_write+0xd0/0x260
ksys_write+0xdc/0x130
system_call+0x5c/0x68--- arch/powerpc/mm/book3s64/hash_utils.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/mm/book3s64/hash_utils.c +1 -0
@@ -305,6 +305,7 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend,if (ret <0 )break ; +cond_resched ();#ifdef CONFIG_DEBUG_PAGEALLOC if (debug_pagealloc_enabled () && (paddr >>PAGE_SHIFT ) < linear_map_hash_count)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 42/191 ext4: update direct I/O read lock pattern for IOCB_NOWAIT
In reply to Greg Kroah-HartmanFrom: Matthew Bobrowski <[email protected]>
[ Upstream commit 548feebec7e93e58b647dba70b3303dcb569c914 ]
This patch updates the lock pattern in ext4_direct_IO_read() to not block on inode lock in cases of IOCB_NOWAIT direct I/O reads. The locking condition implemented here is similar to that of 942491c9e6d6 ("xfs: fix AIM7 regression").
--- fs/ext4/inode.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/ext4/inode.c +7 -1
@@ -3836,7 +3836,13 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter)* writes & truncates and since we take care of writing back page cache, * we are protected against page writeback as well. */ -inode_lock_shared (inode); +if (iocb->ki_flags &IOCB_NOWAIT ) { +if (!inode_trylock_shared (inode)) +return -EAGAIN ; + }else { +inode_lock_shared (inode); + } + ret =filemap_write_and_wait_range (mapping, iocb->ki_pos, iocb->ki_pos + count -1 );if (ret)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 43/191 ext4: iomap that extends beyond EOF should be marked dirty
In reply to Greg Kroah-HartmanFrom: Matthew Bobrowski <[email protected]>
[ Upstream commit 2e9b51d78229d5145725a481bb5464ebc0a3f9b2 ]
This patch addresses what Dave Chinner had discovered and fixed within
commit: 7684e2c4384d. This changes does not have any user visible impact for ext4 as none of the current users of ext4_iomap_begin() that extend files depend on IOMAP_F_DIRTY.
When doing a direct IO that spans the current EOF, and there are written blocks beyond EOF that extend beyond the current write, the only metadata update that needs to be done is a file size extension.
However, we don't mark such iomaps as IOMAP_F_DIRTY to indicate that there is IO completion metadata updates required, and hence we may fail to correctly sync file size extensions made in IO completion when O_DSYNC writes are being used and the hardware supports FUA.
Hence when setting IOMAP_F_DIRTY, we need to also take into account whether the iomap spans the current EOF. If it does, then we need to mark it dirty so that IO completion will call generic_write_sync() to flush the inode size update to stable storage correctly.
--- fs/ext4/inode.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/ext4/inode.c +7 -1
@@ -3532,8 +3532,14 @@ retry:return ret; } +/* +* Writes that span EOF might trigger an I/O size update on completion, +* so consider them to be dirty for the purposes of O_DSYNC, even if +* there is no other metadata changes being made or are pending here. +*/ iomap->flags =0 ; -if (ext4_inode_datasync_dirty (inode)) +if (ext4_inode_datasync_dirty (inode) || + offset + length >i_size_read (inode)) iomap->flags |=IOMAP_F_DIRTY ; iomap->bdev = inode->i_sb->s_bdev; iomap->dax_dev = sbi->s_daxdev;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 44/191 jbd2: Fix statistics for the number of logged blocks
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 015c6033068208d6227612c878877919f3fcf6b6 ]
jbd2 statistics counting number of blocks logged in a transaction was wrong. It didn't count the commit block and more importantly it didn't count revoke descriptor blocks. Make sure these get properly counted.
--- fs/jbd2/commit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/jbd2/commit.c +3 -1
@@ -727,7 +727,6 @@ start_journal_io:submit_bh (REQ_OP_WRITE ,REQ_SYNC , bh); }cond_resched (); - stats.run.rs_blocks_logged += bufs;/* Force a new descriptor to be generated next time round the loop. */
@@ -814,6 +813,7 @@ start_journal_io:if (unlikely (!buffer_uptodate (bh))) err = -EIO ;jbd2_unfile_log_bh (bh); + stats.run.rs_blocks_logged++;/* * The list contains temporary buffer heads created by
@@ -859,6 +859,7 @@ start_journal_io:BUFFER_TRACE (bh,"ph5: control buffer writeout done: unfile" );clear_buffer_jwrite (bh);jbd2_unfile_log_bh (bh); + stats.run.rs_blocks_logged++;__brelse (bh);/* One for getblk */ /* AKPM: bforget here */ }
@@ -880,6 +881,7 @@ start_journal_io: }if (cbh) err =journal_wait_on_commit_record (journal, cbh); + stats.run.rs_blocks_logged++;if (jbd2_has_feature_async_commit (journal) && journal->j_flags &JBD2_BARRIER ) {blkdev_issue_flush (journal->j_dev,GFP_NOFS ,NULL );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 45/191 scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit f6b8540f40201bff91062dd64db8e29e4ddaaa9d ]
According to SBC-2 a TRANSFER LENGTH field of zero means that 256 logical blocks must be transferred. Make the SCSI tracing code follow SBC-2.
--- drivers/scsi/scsi_trace.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/scsi/scsi_trace.c +7 -4
@@ -18,15 +18,18 @@ static const char * scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len) { const char *ret = trace_seq_buffer_ptr(p); -sector_t lba =0 , txlen =0 ; +u32 lba =0 , txlen; lba |= ((cdb[1 ] &0x1F ) <<16 ); lba |= (cdb[2 ] <<8 ); lba |= cdb[3 ]; - txlen = cdb[4 ]; +/* +* From SBC-2: a TRANSFER LENGTH field set to zero specifies that 256 +* logical blocks shall be read (READ(6)) or written (WRITE(6)). +*/ + txlen = cdb[4 ] ? cdb[4 ] :256 ; -trace_seq_printf (p,"lba=%llu txlen=%llu" , - (unsigned long long )lba, (unsigned long long )txlen); +trace_seq_printf (p,"lba=%u txlen=%u" , lba, txlen);trace_seq_putc (p,0 );return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 46/191 scsi: lpfc: Fix unexpected error messages during RSCN handling
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 2332e6e475b016e2026763f51333f84e2e6c57a3 ]
During heavy RCN activity and log_verbose = 0 we see these messages:
2754 PRLI failure DID:521245 Status:x9/xb2c00, data: x0 0231 RSCN timeout Data: x0 x3
0230 Unexpected timeout, hba link state x5
This is due to delayed RSCN activity.
Correct by avoiding the timeout thus the messages by restarting the discovery timeout whenever an rscn is received.
Filter PRLI responses such that severity depends on whether expected for the configuration or not. For example, PRLI errors on a fabric will be informational (they are expected), but Point-to-Point errors are not necessarily expected so they are raised to an error level.
--- drivers/scsi/lpfc/lpfc_els.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +19 -2
@@ -2236,6 +2236,7 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,struct Scsi_Host *shost =lpfc_shost_from_vport (vport);IOCB_t *irsp;struct lpfc_nodelist *ndlp; +char *mode;/* we pass cmdiocb to state machine which needs rspiocb as well */ cmdiocb->context_un.rsp_iocb = rspiocb;
@@ -2273,8 +2274,17 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, goto out; } +/* If we don't send GFT_ID to Fabric, a PRLI error +* could be expected. +*/ +if ((vport->fc_flag &FC_FABRIC ) || + (vport->cfg_enable_fc4_type !=LPFC_ENABLE_BOTH )) + mode =KERN_ERR ; +else + mode =KERN_INFO ; +/* PRLI failed */ - lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS, + lpfc_printf_vlog(vport, mode, LOG_ELS, "2754 PRLI failure DID:%06X Status:x%x/x%x, " "data: x%x\n", ndlp->nlp_DID, irsp->ulpStatus,
@@ -6455,7 +6465,7 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,uint32_t payload_len, length, nportid, *cmd;int rscn_cnt;int rscn_id =0 , hba_id =0 ; -int i; +int i, tmo; pcmd = (struct lpfc_dmabuf *) cmdiocb->context2; lp = (uint32_t *) pcmd->virt;
@@ -6561,6 +6571,13 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,spin_lock_irq (shost->host_lock); vport->fc_flag |=FC_RSCN_DEFERRED ; + +/* Restart disctmo if its already running */ +if (vport->fc_flag &FC_DISC_TMO ) { + tmo = ((phba->fc_ratov *3 ) +3 ); +mod_timer (&vport->fc_disctmo, + jiffies +msecs_to_jiffies (1000 * tmo)); + }if ((rscn_cnt <FC_MAX_HOLD_RSCN ) && !(vport->fc_flag &FC_RSCN_DISCOVERY )) { vport->fc_flag |=FC_RSCN_MODE ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 47/191 scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 7cfd5639d99bec0d27af089d0c8c114330e43a72 ]
If the driver receives a login that is later then LOGO'd by the remote port (aka ndlp), the driver, upon the completion of the LOGO ACC transmission, will logout the node and unregister the rpi that is being used for the node. As part of the unreg, the node's rpi value is replaced by the LPFC_RPI_ALLOC_ERROR value. If the port is subsequently offlined, the offline walks the nodes and ensures they are logged out, which possibly entails unreg'ing their rpi values. This path does not validate the node's rpi value, thus doesn't detect that it has been unreg'd already. The replaced rpi value is then used when accessing the rpi bitmask array which tracks active rpi values. As the LPFC_RPI_ALLOC_ERROR value is not a valid index for the bitmask, it may fault the system.
Revise the rpi release code to detect when the rpi value is the replaced RPI_ALLOC_ERROR value and ignore further release steps.
--- drivers/scsi/lpfc/lpfc_sli.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/scsi/lpfc/lpfc_sli.c +7 -0
@@ -18187,6 +18187,13 @@ lpfc_sli4_alloc_rpi(struct lpfc_hba *phba)static void __lpfc_sli4_free_rpi (struct lpfc_hba *phba,int rpi) { +/* +* if the rpi value indicates a prior unreg has already +* been done, skip the unreg. +*/ +if (rpi ==LPFC_RPI_ALLOC_ERROR ) +return ; +if (test_and_clear_bit (rpi, phba->sli4_hba.rpi_bmask)) { phba->sli4_hba.rpi_count--; phba->sli4_hba.max_cfg_param.rpi_used--;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 48/191 f2fs: fix to update dirs i_pino during cross_rename
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 2a60637f06ac94869b2e630eaf837110d39bf291 ]
As Eric reported:
RENAME_EXCHANGE support was just added to fsstress in xfstests:
commit 65dfd40a97b6bbbd2a22538977bab355c5bc0f06 Author: kaixuxia <[email protected]> Date: Thu Oct 31 14:41:48 2019 +0800 fsstress: add EXCHANGE renameat2 support
This is causing xfstest generic/579 to fail due to fsck.f2fs reporting errors. I'm not sure what the problem is, but it still happens even with all the fs-verity stuff in the test commented out, so that the test just runs fsstress.
generic/579 23s ... [10:02:25]
[ 7.745370] run fstests generic/579 at 2019-11-04 10:02:25
_check_generic_filesystem: filesystem on /dev/vdc is inconsistent (see /results/f2fs/results-default/generic/579.full for details)
[10:02:47]
Ran: generic/579
Failures: generic/579
Failed 1 of 1 tests
Xunit report: /results/f2fs/results-default/result.xml
Here's the contents of 579.full:
_check_generic_filesystem: filesystem on /dev/vdc is inconsistent
*** fsck.f2fs output ***
[ASSERT] (__chk_dots_dentries:1378) --> Bad inode number[0x24] for '..', parent parent ino is [0xd10]
The root cause is that we forgot to update directory's i_pino during cross_rename, fix it.
--- fs/f2fs/namei.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/f2fs/namei.c +12 -3
@@ -981,7 +981,8 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,if (!old_dir_entry || whiteout)file_lost_pino (old_inode);else -F2FS_I (old_inode)->i_pino = new_dir->i_ino; +/* adjust dir's i_pino to pass fsck check */ +f2fs_i_pino_write (old_inode, new_dir->i_ino);up_write (&F2FS_I (old_inode)->i_sem); old_inode->i_ctime =current_time (old_inode);
@@ -1141,7 +1142,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,f2fs_set_link (old_dir, old_entry, old_page, new_inode);down_write (&F2FS_I (old_inode)->i_sem); -file_lost_pino (old_inode); +if (!old_dir_entry) +file_lost_pino (old_inode); +else +/* adjust dir's i_pino to pass fsck check */ +f2fs_i_pino_write (old_inode, new_dir->i_ino);up_write (&F2FS_I (old_inode)->i_sem); old_dir->i_ctime =current_time (old_dir);
@@ -1156,7 +1161,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,f2fs_set_link (new_dir, new_entry, new_page, old_inode);down_write (&F2FS_I (new_inode)->i_sem); -file_lost_pino (new_inode); +if (!new_dir_entry) +file_lost_pino (new_inode); +else +/* adjust dir's i_pino to pass fsck check */ +f2fs_i_pino_write (new_inode, old_dir->i_ino);up_write (&F2FS_I (new_inode)->i_sem); new_dir->i_ctime =current_time (new_dir);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 49/191 clk: qcom: smd: Add missing pnoc clock
In reply to Greg Kroah-HartmanFrom: Jeffrey Hugo <[email protected]>
[ Upstream commit ba1d366de261981c0dd04fac44d2ce3a5eba2eaa ]
When MSM8998 support was added, and analysis was done to determine what clocks would be consumed. That analysis had a flaw, which caused the pnoc to be skipped. The pnoc clock needs to be on to access the uart for the console. The clock is on from boot, but has no consumer votes in the RPM. When we attempt to boot the modem, it causes the RPM to turn off pnoc, which kills our access to the console and causes CPU hangs.
We need pnoc to be defined, so that clk_smd_rpm_handoff() will put in an implicit vote for linux and prevent issues when booting modem. Hopefully pnoc can be consumed by the interconnect framework in future so that Linux can rely on explicit votes.
--- drivers/clk/qcom/clk-smd-rpm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/qcom/clk-smd-rpm.c +3 -0
@@ -648,6 +648,7 @@ static const struct rpm_smd_clk_desc rpm_clk_qcs404 = { };/* msm8998 */ +DEFINE_CLK_SMD_RPM (msm8998, pcnoc_clk, pcnoc_a_clk,QCOM_SMD_RPM_BUS_CLK ,0 );DEFINE_CLK_SMD_RPM (msm8998, snoc_clk, snoc_a_clk,QCOM_SMD_RPM_BUS_CLK ,1 );DEFINE_CLK_SMD_RPM (msm8998, cnoc_clk, cnoc_a_clk,QCOM_SMD_RPM_BUS_CLK ,2 );DEFINE_CLK_SMD_RPM (msm8998, ce1_clk, ce1_a_clk,QCOM_SMD_RPM_CE_CLK ,0 );
@@ -670,6 +671,8 @@ DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk2_pin, rf_clk2_a_pin, 5);DEFINE_CLK_SMD_RPM_XO_BUFFER (msm8998, rf_clk3, rf_clk3_a,6 );DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL (msm8998, rf_clk3_pin, rf_clk3_a_pin,6 );static struct clk_smd_rpm *msm8998_clks[] = { + [RPM_SMD_PCNOC_CLK ] = &msm8998_pcnoc_clk, + [RPM_SMD_PCNOC_A_CLK ] = &msm8998_pcnoc_a_clk, [RPM_SMD_SNOC_CLK ] = &msm8998_snoc_clk, [RPM_SMD_SNOC_A_CLK ] = &msm8998_snoc_a_clk, [RPM_SMD_CNOC_CLK ] = &msm8998_cnoc_clk,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 50/191 clk: qcom: Allow constant ratio freq tables for rcg
In reply to Greg Kroah-HartmanFrom: Jeffrey Hugo <[email protected]>
[ Upstream commit efd164b5520afd6fb2883b68e0d408a7de29c491 ]
Some RCGs (the gfx_3d_src_clk in msm8998 for example) are basically just some constant ratio from the input across the entire frequency range. It would be great if we could specify the frequency table as a single entry constant ratio instead of a long list, ie:
{ .src = P_GPUPLL0_OUT_EVEN, .pre_div = 3 },
{ }So, lets support that.
We need to fix a corner case in qcom_find_freq() where if the freq table is non-null, but has no frequencies, we end up returning an "entry" before the table array, which is bad. Then, we need ignore the freq from the table, and instead base everything on the requested freq.
--- drivers/clk/qcom/clk-rcg2.c | 2 ++ drivers/clk/qcom/common.c | 3 +++ 2 files changed, 5 insertions(+)
drivers/clk/qcom/clk-rcg2.c +2 -0
@@ -220,6 +220,8 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f,if (clk_flags &CLK_SET_RATE_PARENT ) { rate = f->freq;if (f->pre_div) { +if (!rate) + rate = req->rate; rate /=2 ; rate *= f->pre_div +1 ; }
drivers/clk/qcom/common.c +3 -0
@@ -29,6 +29,9 @@ struct freq_tbl *qcom_find_freq(const struct freq_tbl *f, unsigned long rate)if (!f)return NULL ; +if (!f->freq) +return f; +for (; f->freq; f++)if (rate <= f->freq)return f;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 51/191 clk: clk-gpio: propagate rate change to parent
In reply to Greg Kroah-HartmanFrom: Michael Hennerich <[email protected]>
[ Upstream commit fc59462c5ce60da119568fac325c92fc6b7c6175 ]
For an external clock source, which is gated via a GPIO, the rate change should typically be propagated to the parent clock.
The situation where we are requiring this propagation, is when an external clock is connected to override an internal clock (which typically has a fixed rate). The external clock can have a different rate than the internal one, and may also be variable, thus requiring the rate propagation.
This rate change wasn't propagated until now, and it's unclear about cases where this shouldn't be propagated. Thus, it's unclear whether this is fixing a bug, or extending the current driver behavior. Also, it's unsure about whether this may break any existing setups; in the case that it does, a device-tree property may be added to disable this flag.
--- drivers/clk/clk-gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/clk-gpio.c +1 -1
@@ -280,7 +280,7 @@ static int gpio_clk_driver_probe(struct platform_device *pdev)else clk =clk_register_gpio_gate (&pdev->dev, node->name, parent_names ? parent_names[0 ] :NULL , gpiod, -0 ); +CLK_SET_RATE_PARENT );if (IS_ERR (clk))return PTR_ERR (clk);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 52/191 irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 27eebb60357ed5aa6659442f92907c0f7368d6ae ]
If the 'brcm,irq-can-wake' property is specified, make sure we also enable the corresponding parent interrupt we are attached to.
--- drivers/irqchip/irq-bcm7038-l1.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/irqchip/irq-bcm7038-l1.c +4 -0
@@ -281,6 +281,10 @@ static int __init bcm7038_l1_init_one(struct device_node *dn,pr_err ("failed to map parent interrupt %d\n" , parent_irq);return -EINVAL ; } + +if (of_property_read_bool (dn,"brcm,irq-can-wake" )) +enable_irq_wake (parent_irq); +irq_set_chained_handler_and_data (parent_irq, bcm7038_l1_irq_handle, intc);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 53/191 irqchip: ingenic: Error out if IRQ domain creation failed
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
[ Upstream commit 52ecc87642f273a599c9913b29fd179c13de457b ]
If we cannot create the IRQ domain, the driver should fail to probe instead of succeeding with just a warning message.
--- drivers/irqchip/irq-ingenic.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/irqchip/irq-ingenic.c +10 -5
@@ -108,6 +108,14 @@ static int __init ingenic_intc_of_init(struct device_node *node, goto out_unmap_irq; } + domain =irq_domain_add_legacy (node, num_chips *32 , +JZ4740_IRQ_BASE ,0 , + &irq_domain_simple_ops,NULL ); +if (!domain) { + err = -ENOMEM ; + goto out_unmap_base; + } +for (i =0 ; i < num_chips; i++) {/* Mask all irqs */ writel(0xffffffff, intc->base + (i * CHIP_SIZE) +
@@ -134,14 +142,11 @@ static int __init ingenic_intc_of_init(struct device_node *node, IRQ_NOPROBE | IRQ_LEVEL); } - domain =irq_domain_add_legacy (node, num_chips *32 ,JZ4740_IRQ_BASE ,0 , - &irq_domain_simple_ops,NULL ); -if (!domain) -pr_warn ("unable to register IRQ domain\n" ); -setup_irq (parent_irq, &intc_cascade_action);return 0 ; +out_unmap_base: +iounmap (intc->base); out_unmap_irq:irq_dispose_mapping (parent_irq); out_free:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 54/191 dma-direct: check for overflows on 32 bit DMA addresses
In reply to Greg Kroah-HartmanFrom: Nicolas Saenz Julienne <[email protected]>
[ Upstream commit b12d66278dd627cbe1ea7c000aa4715aaf8830c8 ]
As seen on the new Raspberry Pi 4 and sta2x11's DMA implementation it is possible for a device configured with 32 bit DMA addresses and a partial DMA mapping located at the end of the address space to overflow. It happens when a higher physical address, not DMAable, is translated to it's DMA counterpart.
For example the Raspberry Pi 4, configurable up to 4 GB of memory, has an interconnect capable of addressing the lower 1 GB of physical memory with a DMA offset of 0xc0000000. It transpires that, any attempt to translate physical addresses higher than the first GB will result in an overflow which dma_capable() can't detect as it only checks for addresses bigger then the maximum allowed DMA address.
Fix this by verifying in dma_capable() if the DMA address range provided is at any point lower than the minimum possible DMA address on the bus.
--- include/linux/dma-direct.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
include/linux/dma-direct.h +10 -2
@@ -3,8 +3,11 @@#define _LINUX_DMA_DIRECT_H 1#include <linux/dma-mapping.h> +#include <linux/memblock.h> /* for min_low_pfn */ #include <linux/mem_encrypt.h> +static inline dma_addr_t phys_to_dma (struct device *dev,phys_addr_t paddr); +#ifdef CONFIG_ARCH_HAS_PHYS_TO_DMA #include <asm/dma-direct.h> #else
@@ -24,11 +27,16 @@ static inline phys_addr_t __dma_to_phys(struct device *dev, dma_addr_t dev_addr)static inline bool dma_capable (struct device *dev,dma_addr_t addr,size_t size) { +dma_addr_t end = addr + size -1 ; +if (!dev->dma_mask)return false; -return addr + size -1 <= -min_not_zero (*dev->dma_mask, dev->bus_dma_mask); +if (!IS_ENABLED (CONFIG_ARCH_DMA_ADDR_T_64BIT ) && +min (addr, end) <phys_to_dma (dev,PFN_PHYS (min_low_pfn))) +return false; + +return end <=min_not_zero (*dev->dma_mask, dev->bus_dma_mask); }#endif /* !CONFIG_ARCH_HAS_PHYS_TO_DMA */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 55/191 mfd: mfd-core: Honour Device Trees request to disable a child-device
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
[ Upstream commit 6b5c350648b857047b47acf74a57087ad27d6183 ]
Until now, MFD has assumed all child devices passed to it (via mfd_cells) are to be registered. It does not take into account requests from Device Tree and the like to disable child devices on a per-platform basis.
Well now it does.
--- drivers/mfd/mfd-core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/mfd/mfd-core.c +5 -0
@@ -174,6 +174,11 @@ static int mfd_add_device(struct device *parent, int id,if (parent->of_node && cell->of_compatible) {for_each_child_of_node (parent->of_node, np) {if (of_device_is_compatible (np, cell->of_compatible)) { +if (!of_device_is_available (np)) { +/* Ignore disabled devices error free */ + ret =0 ; + goto fail_alias; + } pdev->dev.of_node = np; pdev->dev.fwnode = &np->fwnode;break ;
Signature · 1 line
2.20.1
Re: [PATCH 5.4 055/191] mfd: mfd-core: Honour Device Trees request to disable a child-device
Quoted 9 lines · Greg Kroah-Hartman
From: Lee Jones <[email protected]>
[ Upstream commit
6b5c350648b857047b47acf74a57087ad27d6183]Until now, MFD has assumed all child devices passed to it (via
mfd_cells) are to be registered. It does not take into account requests from Device Tree and the like to disable child devices on a per-platform basis.
Quoted 4 lines
Well now it does.
As far as I understand it, this commit is not suitable for backporting. The link above explains the problem for a similar patch:
But I believe this would introduce a rather ugly bug in mfd_remove_devices() if the first sub-device is set to disabled:
It iterates over the children devices to find the base address of the allocated "usage count" array, which is then used to free it. If the first sub-device is missing, it would free the wrong address.
This problem does not exist in mainline because the MFD usage counting was removed entirely as part of the larger "Simplify MFD Core" series [1].
None of the device trees in the stable kernels should depend on disabling MFD devices from the device tree. (They were written at a time when the MFD core ignored that request entirely...) Therefore, I would suggest to drop this patch entirely.
[1]: https://lore.kernel.org/lkml/[email protected]/
Quoted 33 lines
Reported-by Barry Song <[email protected]>Reported-by Stephan Gerhold <[email protected]>Reviewed-by Daniel Thompson <[email protected]>Reviewed-by Mark Brown <[email protected]>Tested-by Stephan Gerhold <[email protected]>Signed-off-by Lee Jones <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/mfd/mfd-core.c | 5 +++++ 1 file changed, 5 insertions(+)drivers/mfd/mfd-core.c +5
-0@@ -174,6 +174,11 @@ static int mfd_add_device(struct device *parent, int id,if (parent->of_node && cell->of_compatible) {for_each_child_of_node (parent->of_node, np) {if (of_device_is_compatible (np, cell->of_compatible)) { +if (!of_device_is_available (np)) { +/* Ignore disabled devices error free */ + ret =0 ; + goto fail_alias; + } pdev->dev.of_node = np; pdev->dev.fwnode = &np->fwnode;break ;Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerRe: [PATCH 5.4 055/191] mfd: mfd-core: Honour Device Trees request to disable a child-device
Quoted 24 lines · Stephan Gerhold
Quoted 9 lines · Greg Kroah-Hartman
From: Lee Jones <[email protected]>
[ Upstream commit
6b5c350648b857047b47acf74a57087ad27d6183]Until now, MFD has assumed all child devices passed to it (via
mfd_cells) are to be registered. It does not take into account requests from Device Tree and the like to disable child devices on a per-platform basis.Quoted 4 lines
Well now it does.
As far as I understand it, this commit is not suitable for backporting. The link above explains the problem for a similar patch:
But I believe this would introduce a rather ugly bug in
mfd_remove_devices()if the first sub-device is set to disabled:
It iterates over the children devices to find the base address of the allocated "usage count" array, which is then used to free it. If the first sub-device is missing, it would free the wrong address.
Quoted 7 lines
This problem does not exist in mainline because the MFD usage counting was removed entirely as part of the larger "Simplify MFD Core" series [1].
None of the device trees in the stable kernels should depend on disabling MFD devices from the device tree. (They were written at a time when the MFD core ignored that request entirely...) Therefore, I would suggest to drop this patch entirely.
Thanks for catching this, now dropped from all stable queues.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 56/191 fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
In reply to Greg Kroah-HartmanFrom: Konstantin Khlebnikov <[email protected]>
[ Upstream commit 6fcbcec9cfc7b3c6a2c1f1a23ebacedff7073e0a ]
Quota statistics counted as 64-bit per-cpu counter. Reading sums per-cpu fractions as signed 64-bit int, filters negative values and then reports lower half as signed 32-bit int.
Result may looks like:
fs.quota.allocated_dquots = 22327
fs.quota.cache_hits = -489852115
fs.quota.drops = -487288718
fs.quota.free_dquots = 22083
fs.quota.lookups = -486883485
fs.quota.reads = 22327
fs.quota.syncs = 335064
fs.quota.writes = 3088689
Values bigger than 2^31-1 reported as negative.
All counters except "allocated_dquots" and "free_dquots" are monotonic, thus they should be reported as is without filtering negative values.
Kernel doesn't have generic helper for 64-bit sysctl yet, let's use at least unsigned long.
--- fs/quota/dquot.c | 29 +++++++++++++++++------------ include/linux/quota.h | 2 +- 2 files changed, 18 insertions(+), 13 deletions(-)
fs/quota/dquot.c +17 -12
@@ -2861,68 +2861,73 @@ EXPORT_SYMBOL(dquot_quotactl_sysfile_ops);static int do_proc_dqstats (struct ctl_table *table,int write,void __user *buffer,size_t *lenp,loff_t *ppos) { -unsigned int type = (int *)table->data - dqstats.stat; +unsigned int type = (unsigned long *)table->data - dqstats.stat; +s64 value =percpu_counter_sum (&dqstats.counter[type]); + +/* Filter negative values for non-monotonic counters */ +if (value <0 && (type ==DQST_ALLOC_DQUOTS || + type ==DQST_FREE_DQUOTS )) + value =0 ;/* Update global table */ - dqstats.stat[type] = -percpu_counter_sum_positive (&dqstats.counter[type]); -return proc_dointvec (table, write, buffer, lenp, ppos); + dqstats.stat[type] = value; +return proc_doulongvec_minmax (table, write, buffer, lenp, ppos); }static struct ctl_table fs_dqstats_table[] = { { .procname ="lookups" , .data = &dqstats.stat[DQST_LOOKUPS ], - .maxlen =sizeof (int ), + .maxlen =sizeof (unsigned long ), .mode =0444 , .proc_handler = do_proc_dqstats, }, { .procname ="drops" , .data = &dqstats.stat[DQST_DROPS ], - .maxlen =sizeof (int ), + .maxlen =sizeof (unsigned long ), .mode =0444 , .proc_handler = do_proc_dqstats, }, { .procname ="reads" , .data = &dqstats.stat[DQST_READS ], - .maxlen =sizeof (int ), + .maxlen =sizeof (unsigned long ), .mode =0444 , .proc_handler = do_proc_dqstats, }, { .procname ="writes" , .data = &dqstats.stat[DQST_WRITES ], - .maxlen =sizeof (int ), + .maxlen =sizeof (unsigned long ), .mode =0444 , .proc_handler = do_proc_dqstats, }, { .procname ="cache_hits" , .data = &dqstats.stat[DQST_CACHE_HITS ], - .maxlen =sizeof (int ), + .maxlen =sizeof (unsigned long ), .mode =0444 , .proc_handler = do_proc_dqstats, }, { .procname ="allocated_dquots" , .data = &dqstats.stat[DQST_ALLOC_DQUOTS ], - .maxlen =sizeof (int ), + .maxlen =sizeof (unsigned long ), .mode =0444 , .proc_handler = do_proc_dqstats, }, { .procname ="free_dquots" , .data = &dqstats.stat[DQST_FREE_DQUOTS ], - .maxlen =sizeof (int ), + .maxlen =sizeof (unsigned long ), .mode =0444 , .proc_handler = do_proc_dqstats, }, { .procname ="syncs" , .data = &dqstats.stat[DQST_SYNCS ], - .maxlen =sizeof (int ), + .maxlen =sizeof (unsigned long ), .mode =0444 , .proc_handler = do_proc_dqstats, },
include/linux/quota.h +1 -1
@@ -263,7 +263,7 @@ enum { };struct dqstats { -int stat[_DQST_DQSTAT_LAST]; +unsigned long stat[_DQST_DQSTAT_LAST];struct percpu_counter counter[_DQST_DQSTAT_LAST]; };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 57/191 iommu/arm-smmu-v3: Dont display an error when IRQ lines are missing
In reply to Greg Kroah-HartmanFrom: Jean-Philippe Brucker <[email protected]>
[ Upstream commit f7aff1a93f52047739af31072de0ad8d149641f3 ]
Since commit 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()"), platform_get_irq_byname() displays an error when the IRQ isn't found. Since the SMMUv3 driver uses that function to query which interrupt method is available, the message is now displayed during boot for any SMMUv3 that doesn't implement the combined interrupt, or that implements MSIs.
[ 20.700337] arm-smmu-v3 arm-smmu-v3.7.auto: IRQ combined not found [ 20.706508] arm-smmu-v3 arm-smmu-v3.7.auto: IRQ eventq not found [ 20.712503] arm-smmu-v3 arm-smmu-v3.7.auto: IRQ priq not found [ 20.718325] arm-smmu-v3 arm-smmu-v3.7.auto: IRQ gerror not found
Use platform_get_irq_byname_optional() to avoid displaying a spurious error.
--- drivers/iommu/arm-smmu-v3.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/iommu/arm-smmu-v3.c +4 -4
@@ -3611,19 +3611,19 @@ static int arm_smmu_device_probe(struct platform_device *pdev)/* Interrupt lines */ - irq =platform_get_irq_byname (pdev,"combined" ); + irq =platform_get_irq_byname_optional (pdev,"combined" );if (irq >0 ) smmu->combined_irq = irq;else { - irq =platform_get_irq_byname (pdev,"eventq" ); + irq =platform_get_irq_byname_optional (pdev,"eventq" );if (irq >0 ) smmu->evtq.q.irq = irq; - irq =platform_get_irq_byname (pdev,"priq" ); + irq =platform_get_irq_byname_optional (pdev,"priq" );if (irq >0 ) smmu->priq.q.irq = irq; - irq =platform_get_irq_byname (pdev,"gerror" ); + irq =platform_get_irq_byname_optional (pdev,"gerror" );if (irq >0 ) smmu->gerr_irq = irq; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/191 i2c: stm32f7: fix & reorder remove & probe error handling
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
[ Upstream commit 53aaaa5d9b1e95eb40e877fbffa6f964a8394bb7 ]
Add missing dma channels free calls in case of error during probe and reorder the remove function so that dma channels are freed after the i2c adapter is deleted.
Overall, reorder the remove function so that probe error handling order and remove function order are same.
--- drivers/i2c/busses/i2c-stm32f7.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/i2c/busses/i2c-stm32f7.c +12 -7
@@ -1985,6 +1985,11 @@ pm_disable:pm_runtime_set_suspended (i2c_dev->dev);pm_runtime_dont_use_autosuspend (i2c_dev->dev); +if (i2c_dev->dma) { +stm32_i2c_dma_free (i2c_dev->dma); + i2c_dev->dma =NULL ; + } + clk_free:clk_disable_unprepare (i2c_dev->clk);
@@ -1995,21 +2000,21 @@ static int stm32f7_i2c_remove(struct platform_device *pdev) {struct stm32f7_i2c_dev *i2c_dev =platform_get_drvdata (pdev); -if (i2c_dev->dma) { -stm32_i2c_dma_free (i2c_dev->dma); - i2c_dev->dma =NULL ; - } -i2c_del_adapter (&i2c_dev->adap);pm_runtime_get_sync (i2c_dev->dev); -clk_disable_unprepare (i2c_dev->clk); -pm_runtime_put_noidle (i2c_dev->dev);pm_runtime_disable (i2c_dev->dev);pm_runtime_set_suspended (i2c_dev->dev);pm_runtime_dont_use_autosuspend (i2c_dev->dev); +if (i2c_dev->dma) { +stm32_i2c_dma_free (i2c_dev->dma); + i2c_dev->dma =NULL ; + } + +clk_disable_unprepare (i2c_dev->clk); +return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 59/191 iomap: fix return value of iomap_dio_bio_actor on 32bit systems
In reply to Greg Kroah-HartmanFrom: Jan Stancek <[email protected]>
[ Upstream commit e9f930ac88a8936ccc2d021110c98810cf5aa810 ]
Naresh reported LTP diotest4 failing for 32bit x86 and arm -next kernels on ext4. Same problem exists in 5.4-rc7 on xfs.
The failure comes down to:
openat(AT_FDCWD, "testdata-4.5918", O_RDWR|O_DIRECT) = 4 mmap2(NULL, 4096, PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7b000
read(4, 0xb7f7b000, 4096) = 0 // expects -EFAULT
Problem is conversion at iomap_dio_bio_actor() return. Ternary operator has a return type and an attempt is made to convert each of operands to the type of the other. In this case "ret" (int) is converted to type of "copied" (unsigned long). Both have size of 4 bytes:
size_t copied = 0;
int ret = -14;
long long actor_ret = copied ? copied : ret;
On x86_64: actor_ret == -14;
On x86 : actor_ret == 4294967282Replace ternary operator with 2 return statements to avoid this unwanted conversion.
--- fs/iomap/direct-io.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/iomap/direct-io.c +3 -1
@@ -318,7 +318,9 @@ zero_tail:if (pad)iomap_dio_zero (dio, iomap, pos, fs_block_size - pad); } -return copied ? copied : ret; +if (copied) +return copied; +return ret; } static loff_t
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/191 Input: ili210x - handle errors from input_mt_init_slots()
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit 43f06a4c639de8ee89fc348a9a3ecd70320a04dd ]
input_mt_init_slots() may fail and we need to handle such failures.
--- drivers/input/touchscreen/ili210x.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/input/touchscreen/ili210x.c +6 -1
@@ -334,7 +334,12 @@ static int ili210x_i2c_probe(struct i2c_client *client,input_set_abs_params (input,ABS_MT_POSITION_X ,0 ,0xffff ,0 ,0 );input_set_abs_params (input,ABS_MT_POSITION_Y ,0 ,0xffff ,0 ,0 );touchscreen_parse_properties (input, true, &priv->prop); -input_mt_init_slots (input, priv->max_touches,INPUT_MT_DIRECT ); + + error =input_mt_init_slots (input, priv->max_touches,INPUT_MT_DIRECT ); +if (error) { +dev_err (dev,"Unable to set up slots, err: %d\n" , error); +return error; + } error =devm_add_action (dev, ili210x_cancel_work, priv);if (error)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/191 scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 6c6d59e0fe5b86cf273d6d744a6a9768c4ecc756 ]
Coverity reported the following:
*** CID 101747: Null pointer dereferences (FORWARD_NULL) /drivers/scsi/lpfc/lpfc_els.c: 4439 in lpfc_cmpl_els_rsp()
4433 kfree(mp);
4434 }
4435 mempool_free(mbox, phba->mbox_mem_pool);
4436 }
4437 out:
4438 if (ndlp && NLP_CHK_NODE_ACT(ndlp)) {
vvv CID 101747: Null pointer dereferences (FORWARD_NULL)
vvv Dereferencing null pointer "shost".
4439 spin_lock_irq(shost->host_lock);
4440 ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI);
4441 spin_unlock_irq(shost->host_lock);4442
4443 /* If the node is not being used by another discovery thread,
4444 * and we are sending a reject, we are done with it.
Fix by adding a check for non-null shost in line 4438. The scenario when shost is set to null is when ndlp is null. As such, the ndlp check present was sufficient. But better safe than sorry so add the shost check.
Addresses-Coverity-ID: 101747 ("Null pointer dereferences")
--- drivers/scsi/lpfc/lpfc_els.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_els.c +1 -1
@@ -4440,7 +4440,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,mempool_free (mbox, phba->mbox_mem_pool); } out: -if (ndlp &&NLP_CHK_NODE_ACT (ndlp)) { +if (ndlp &&NLP_CHK_NODE_ACT (ndlp) && shost) {spin_lock_irq (shost->host_lock); ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN |NLP_RM_DFLT_RPI );spin_unlock_irq (shost->host_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/191 scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane)
In reply to Greg Kroah-HartmanFrom: Kars de Jong <[email protected]>
[ Upstream commit 02f7e9f351a9de95577eafdc3bd413ed1c3b589f ]
When using this driver on a Blizzard 1260, there were failures whenever DMA transfers from the SCSI bus to memory of 65535 bytes were followed by a DMA transfer of 1 byte. This caused the byte at offset 65535 to be overwritten with 0xff. The Blizzard hardware can't handle single byte DMA transfers.
Besides this issue, limiting the DMA length to something that is not a multiple of the page size is very inefficient on most file systems.
It seems this limit was chosen because the DMA transfer counter of the ESP by default is 16 bits wide, thus limiting the length to 65535 bytes. However, the value 0 means 65536 bytes, which is handled by the ESP and the Blizzard just fine. It is also the default maximum used by esp_scsi when drivers don't provide their own dma_length_limit() function.
The limit of 65536 bytes can be used by all boards except the Fastlane. The old driver used a limit of 65532 bytes (0xfffc), which is reintroduced in this patch.
--- drivers/scsi/zorro_esp.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/scsi/zorro_esp.c +9 -2
@@ -218,7 +218,14 @@ static int fastlane_esp_irq_pending(struct esp *esp)static u32 zorro_esp_dma_length_limit (struct esp *esp,u32 dma_addr,u32 dma_len) { -return dma_len >0xFFFF ?0xFFFF : dma_len; +return dma_len > (1U <<16 ) ? (1U <<16 ) : dma_len; +} + +static u32 fastlane_esp_dma_length_limit (struct esp *esp,u32 dma_addr, +u32 dma_len) +{ +/* The old driver used 0xfffc as limit, so do that here too */ +return dma_len >0xfffc ?0xfffc : dma_len; }static void zorro_esp_reset_dma (struct esp *esp)
@@ -604,7 +611,7 @@ static const struct esp_driver_ops fastlane_esp_ops = { .esp_write8 = zorro_esp_write8, .esp_read8 = zorro_esp_read8, .irq_pending = fastlane_esp_irq_pending, - .dma_length_limit = zorro_esp_dma_length_limit, + .dma_length_limit = fastlane_esp_dma_length_limit, .reset_dma = zorro_esp_reset_dma, .dma_drain = zorro_esp_dma_drain, .dma_invalidate = fastlane_esp_dma_invalidate,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/191 PCI: rpaphp: Fix up pointer to first drc-info entry
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
[ Upstream commit 9723c25f99aff0451cfe6392e1b9fdd99d0bf9f0 ]
The first entry of the ibm,drc-info property is an int encoded count of the number of drc-info entries that follow. The "value" pointer returned by of_prop_next_u32() is still pointing at the this value when we call of_read_drc_info_cell(), but the helper function expects that value to be pointing at the first element of an entry.
Fix up by incrementing the "value" pointer to point at the first element of the first drc-info entry prior.
--- drivers/pci/hotplug/rpaphp_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/hotplug/rpaphp_core.c +2 -0
@@ -239,6 +239,8 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name, value =of_prop_next_u32 (info,NULL , &entries);if (!value)return -EINVAL ; +else + value++;for (j =0 ; j < entries; j++) {of_read_drc_info_cell (&info, &value, &drc);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/191 scsi: ufs: fix potential bug which ends in system hang
In reply to Greg Kroah-HartmanFrom: Bean Huo <[email protected]>
[ Upstream commit cfcbae3895b86c390ede57b2a8f601dd5972b47b ]
In function __ufshcd_query_descriptor(), in the event of an error happening, we directly goto out_unlock and forget to invaliate hba->dev_cmd.query.descriptor pointer. This results in this pointer still valid in ufshcd_copy_query_response() for other query requests which go through ufshcd_exec_raw_upiu_cmd(). This will cause __memcpy() crash and system hangs. Log as shown below:
Unable to handle kernel paging request at virtual address
ffff000012233c40
Mem abort info:
ESR = 0x96000047
Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000047
CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000028cc735c [ffff000012233c40] pgd=00000000bffff003, pud=00000000bfffe003, pmd=00000000ba8b8003, pte=0000000000000000
Internal error: Oops: 96000047 [#2] PREEMPT SMP ... Call trace: __memcpy+0x74/0x180 ufshcd_issue_devman_upiu_cmd+0x250/0x3c0 ufshcd_exec_raw_upiu_cmd+0xfc/0x1a8 ufs_bsg_request+0x178/0x3b0 bsg_queue_rq+0xc0/0x118 blk_mq_dispatch_rq_list+0xb0/0x538 blk_mq_sched_dispatch_requests+0x18c/0x1d8 __blk_mq_run_hw_queue+0xb4/0x118 blk_mq_run_work_fn+0x28/0x38 process_one_work+0x1ec/0x470 worker_thread+0x48/0x458 kthread+0x130/0x138 ret_from_fork+0x10/0x1c Code: 540000ab a8c12027 a88120c7 a8c12027 (a88120c7) ---[ end trace 793e1eb5dff69f2d ]--- note: kworker/0:2H[2054] exited with preempt_count 1
This patch is to move "descriptor = NULL" down to below the label "out_unlock".
--- drivers/scsi/ufs/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +1 -1
@@ -2986,10 +2986,10 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba, goto out_unlock; } - hba->dev_cmd.query.descriptor =NULL ; *buf_len =be16_to_cpu (response->upiu_res.length); out_unlock: + hba->dev_cmd.query.descriptor =NULL ;mutex_unlock (&hba->dev_cmd.lock); out:ufshcd_release (hba);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/191 powerpc/pseries/cmm: Implement release() function for sysfs device
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
[ Upstream commit 7d8212747435c534c8d564fbef4541a463c976ff ]
When unloading the module, one gets
------------[ cut here ]------------ Device 'cmm0' does not have a release() function, it is broken and must be fixed. See Documentation/kobject.txt. WARNING: CPU: 0 PID: 19308 at drivers/base/core.c:1244 .device_release+0xcc/0xf0 ...
We only have one static fake device. There is nothing to do when releasing the device (via cmm_exit()).
--- arch/powerpc/platforms/pseries/cmm.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/platforms/pseries/cmm.c +5 -0
@@ -411,6 +411,10 @@ static struct bus_type cmm_subsys = { .dev_name = "cmm", }; +static void cmm_release_device (struct device *dev) +{ +} +/** * cmm_sysfs_register - Register with sysfs *
@@ -426,6 +430,7 @@ static int cmm_sysfs_register(struct device *dev) dev->id =0 ; dev->bus = &cmm_subsys; + dev->release = cmm_release_device;if ((rc =device_register (dev))) goto subsys_unregister;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/191 PCI: rpaphp: Dont rely on firmware feature to imply drc-info support
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
[ Upstream commit 52e2b0f16574afd082cff0f0e8567b2d9f68c033 ]
In the event that the partition is migrated to a platform with older firmware that doesn't support the ibm,drc-info property the device tree is modified to remove the ibm,drc-info property and replace it with the older style ibm,drc-* properties for types, names, indexes, and power-domains. One of the requirements of the drc-info firmware feature is that the client is able to handle both the new property, and old style properties at runtime. Therefore we can't rely on the firmware feature alone to dictate which property is currently present in the device tree.
Fix this short coming by checking explicitly for the ibm,drc-info property, and falling back to the older ibm,drc-* properties if it doesn't exist.
--- drivers/pci/hotplug/rpaphp_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/hotplug/rpaphp_core.c +1 -1
@@ -275,7 +275,7 @@ int rpaphp_check_drc_props(struct device_node *dn, char *drc_name,return -EINVAL ; } -if (firmware_has_feature (FW_FEATURE_DRC_INFO )) +if (of_find_property (dn->parent,"ibm,drc-info" ,NULL ))return rpaphp_check_drc_props_v2 (dn, drc_name, drc_type, *my_index);else
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/191 PCI: rpaphp: Annotate and correctly byte swap DRC properties
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
[ Upstream commit 0737686778c6dbe0908d684dd5b9c05b127526ba ]
The device tree is in big endian format and any properties directly retrieved using OF helpers that don't explicitly byte swap should be annotated. In particular there are several places where we grab the opaque property value for the old ibm,drc-* properties and the ibm,my-drc-index property.
Fix this for better static checking by annotating values we know to explicitly big endian, and byte swap where appropriate.
--- drivers/pci/hotplug/rpaphp_core.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-)
drivers/pci/hotplug/rpaphp_core.c +15 -14
@@ -154,11 +154,11 @@ static enum pci_bus_speed get_max_bus_speed(struct slot *slot)return speed; } -static int get_children_props (struct device_node *dn,const int **drc_indexes, -const int **drc_names,const int **drc_types, -const int **drc_power_domains) +static int get_children_props (struct device_node *dn,const __be32 **drc_indexes, +const __be32 **drc_names,const __be32 **drc_types, +const __be32 **drc_power_domains) { -const int *indexes, *names, *types, *domains; +const __be32 *indexes, *names, *types, *domains; indexes =of_get_property (dn,"ibm,drc-indexes" ,NULL ); names =of_get_property (dn,"ibm,drc-names" ,NULL );
@@ -194,8 +194,8 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name, char *drc_type, unsigned int my_index) { char *name_tmp, *type_tmp; -const int *indexes, *names; -const int *types, *domains; +const __be32 *indexes, *names; +const __be32 *types, *domains;int i, rc; rc =get_children_props (dn->parent, &indexes, &names, &types, &domains);
@@ -208,7 +208,7 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name,/* Iterate through parent properties, looking for my-drc-index */ for (i =0 ; i <be32_to_cpu (indexes[0 ]); i++) { -if ((unsigned int ) indexes[i +1 ] == my_index) +if (be32_to_cpu (indexes[i +1 ]) == my_index)break ; name_tmp += (strlen (name_tmp) +1 );
@@ -267,7 +267,7 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,int rpaphp_check_drc_props (struct device_node *dn,char *drc_name,char *drc_type) { -const unsigned int *my_index; +const __be32 *my_index; my_index =of_get_property (dn,"ibm,my-drc-index" ,NULL );if (!my_index) {
@@ -277,10 +277,10 @@ int rpaphp_check_drc_props(struct device_node *dn, char *drc_name,if (of_find_property (dn->parent,"ibm,drc-info" ,NULL ))return rpaphp_check_drc_props_v2 (dn, drc_name, drc_type, - *my_index); +be32_to_cpu (*my_index));else return rpaphp_check_drc_props_v1 (dn, drc_name, drc_type, - *my_index); +be32_to_cpu (*my_index)); }EXPORT_SYMBOL_GPL (rpaphp_check_drc_props);
@@ -311,10 +311,11 @@ static int is_php_type(char *drc_type)* for built-in pci slots (even when the built-in slots are * dlparable.) */ -static int is_php_dn (struct device_node *dn,const int **indexes, -const int **names,const int **types,const int **power_domains) +static int is_php_dn (struct device_node *dn,const __be32 **indexes, +const __be32 **names,const __be32 **types, +const __be32 **power_domains) { -const int *drc_types; +const __be32 *drc_types;int rc; rc =get_children_props (dn, indexes, names, &drc_types, power_domains);
@@ -349,7 +350,7 @@ int rpaphp_add_slot(struct device_node *dn)struct slot *slot;int retval =0 ;int i; -const int *indexes, *names, *types, *power_domains; +const __be32 *indexes, *names, *types, *power_domains;char *name, *type;if (!dn->name ||strcmp (dn->name,"pci" ))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/191 PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name when using drc-info
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
[ Upstream commit 4f9f2d3d7a434b7f882b72550194c9278f4a3925 ]
The newer ibm,drc-info property is a condensed description of the old ibm,drc-* properties (ie. names, types, indexes, and power-domains). When matching a drc-index to a drc-name we need to verify that the index is within the start and last drc-index range and map it to a drc-name using the drc-name-prefix and logical index.
Fix the mapping by checking that the index is within the range of the current drc-info entry, and build the name from the drc-name-prefix concatenated with the starting drc-name-suffix value and the sequential index obtained by subtracting ibm,my-drc-index from this entries drc-start-index.
--- drivers/pci/hotplug/rpaphp_core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pci/hotplug/rpaphp_core.c +3 -2
@@ -248,9 +248,10 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,/* Should now know end of current entry */ /* Found it */ -if (my_index <= drc.last_drc_index) { +if (my_index >= drc.drc_index_start && my_index <= drc.last_drc_index) { +int index = my_index - drc.drc_index_start;sprintf (cell_drc_name,"%s%d" , drc.drc_name_prefix, - my_index); + drc.drc_name_suffix_start + index);break ; } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/191 powerpc/security: Fix wrong message when RFI Flush is disable
In reply to Greg Kroah-HartmanFrom: Gustavo L. F. Walbon <[email protected]>
[ Upstream commit 4e706af3cd8e1d0503c25332b30cad33c97ed442 ]
The issue was showing "Mitigation" message via sysfs whatever the state of "RFI Flush", but it should show "Vulnerable" when it is disabled.
If you have "L1D private" feature enabled and not "RFI Flush" you are vulnerable to meltdown attacks.
"RFI Flush" is the key feature to mitigate the meltdown whatever the "L1D private" state.
SEC_FTR_L1D_THREAD_PRIV is a feature for Power9 only.
So the message should be as the truth table shows:
CPU | L1D private | RFI Flush | sysfs ----|-------------|-----------|------------------------------------- P9 | False | False | Vulnerable P9 | False | True | Mitigation: RFI Flush P9 | True | False | Vulnerable: L1D private per thread P9 | True | True | Mitigation: RFI Flush, L1D private per thread P8 | False | False | Vulnerable P8 | False | True | Mitigation: RFI Flush
Output before this fix:
# cat /sys/devices/system/cpu/vulnerabilities/meltdown Mitigation: RFI Flush, L1D private per thread # echo 0 > /sys/kernel/debug/powerpc/rfi_flush # cat /sys/devices/system/cpu/vulnerabilities/meltdown Mitigation: L1D private per thread
Output after fix:
# cat /sys/devices/system/cpu/vulnerabilities/meltdown Mitigation: RFI Flush, L1D private per thread # echo 0 > /sys/kernel/debug/powerpc/rfi_flush # cat /sys/devices/system/cpu/vulnerabilities/meltdown Vulnerable: L1D private per thread
--- arch/powerpc/kernel/security.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
arch/powerpc/kernel/security.c +6 -10
@@ -142,26 +142,22 @@ ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, cha thread_priv =security_ftr_enabled (SEC_FTR_L1D_THREAD_PRIV ); -if (rfi_flush || thread_priv) { +if (rfi_flush) {struct seq_buf s;seq_buf_init (&s, buf,PAGE_SIZE -1 ); -seq_buf_printf (&s,"Mitigation: " ); - -if (rfi_flush) -seq_buf_printf (&s,"RFI Flush" ); - -if (rfi_flush && thread_priv) -seq_buf_printf (&s,", " ); - +seq_buf_printf (&s,"Mitigation: RFI Flush" );if (thread_priv) -seq_buf_printf (&s,"L1D private per thread" ); +seq_buf_printf (&s,", L1D private per thread" );seq_buf_printf (&s,"\n" );return s.len; } +if (thread_priv) +return sprintf (buf,"Vulnerable: L1D private per thread\n" ); +if (!security_ftr_enabled (SEC_FTR_L1D_FLUSH_HV ) && !security_ftr_enabled (SEC_FTR_L1D_FLUSH_PR ))return sprintf (buf,"Not affected\n" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/191 powerpc/eeh: differentiate duplicate detection message
In reply to Greg Kroah-HartmanFrom: Sam Bobroff <[email protected]>
[ Upstream commit de84ffc3ccbeec3678f95a3d898fc188efa0d9c5 ]
Currently when an EEH error is detected, the system log receives the same (or almost the same) message twice:
EEH: PHB#0 failure detected, location: N/A
EEH: PHB#0 failure detected, location: N/A
or
EEH: eeh_dev_check_failure: Frozen PHB#0-PE#0 detected
EEH: Frozen PHB#0-PE#0 detected
This looks like a bug, but in fact the messages are from different functions and mean slightly different things. So keep both but change one of the messages slightly, so that it's clear they are different:
EEH: PHB#0 failure detected, location: N/A
EEH: Recovering PHB#0, location: N/A
or
EEH: eeh_dev_check_failure: Frozen PHB#0-PE#0 detected
EEH: Recovering PHB#0-PE#0
--- arch/powerpc/kernel/eeh_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kernel/eeh_driver.c +2 -2
@@ -897,12 +897,12 @@ void eeh_handle_normal_event(struct eeh_pe *pe)/* Log the event */ if (pe->type &EEH_PE_PHB ) { -pr_err ("EEH: PHB#%x failure detected, location: %s\n" , +pr_err ("EEH: Recovering PHB#%x, location: %s\n" , pe->phb->global_number,eeh_pe_loc_get (pe)); }else {struct eeh_pe *phb_pe =eeh_phb_pe_get (pe->phb); -pr_err ("EEH: Frozen PHB#%x-PE#%x detected\n" , +pr_err ("EEH: Recovering PHB#%x-PE#%x\n" , pe->phb->global_number, pe->addr);pr_err ("EEH: PE location: %s, PHB location: %s\n" ,eeh_pe_loc_get (pe),eeh_pe_loc_get (phb_pe));
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 71/191 powerpc/book3s/mm: Update Oops message to print the correct translation in use
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
[ Upstream commit d7e02f7b7991dbe14a2acfb0e53d675cd149001c ]
Avoids confusion when printing Oops message like below
Faulting instruction address: 0xc00000000008bdb4
Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix MMU=Hash SMP NR_CPUS=2048 NUMA PowerNV
This was because we never clear the MMU_FTR_HPTE_TABLE feature flag even if we run with radix translation. It was discussed that we should look at this feature flag as an indication of the capability to run hash translation and we should not clear the flag even if we run in radix translation. All the code paths check for radix_enabled() check and if found true consider we are running with radix translation. Follow the same sequence for finding the MMU translation string to be used in Oops message.
--- arch/powerpc/kernel/traps.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
arch/powerpc/kernel/traps.c +11 -4
@@ -250,15 +250,22 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, }NOKPROBE_SYMBOL (oops_end); +static char *get_mmu_str (void ) +{ +if (early_radix_enabled ()) +return " MMU=Radix" ; +if (early_mmu_has_feature (MMU_FTR_HPTE_TABLE )) +return " MMU=Hash" ; +return "" ; +} +static int __die (const char *str,struct pt_regs *regs,long err) {printk ("Oops: %s, sig: %ld [#%d]\n" , str, err, ++die_counter); - printk("%s PAGE_SIZE=%luK%s%s%s%s%s%s%s %s\n", + printk("%s PAGE_SIZE=%luK%s%s%s%s%s%s %s\n", IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN) ? "LE" : "BE", - PAGE_SIZE / 1024, - early_radix_enabled() ? " MMU=Radix" : "", - early_mmu_has_feature(MMU_FTR_HPTE_TABLE) ? " MMU=Hash" : "", + PAGE_SIZE / 1024, get_mmu_str(), IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT" : "", IS_ENABLED(CONFIG_SMP) ? " SMP" : "", IS_ENABLED(CONFIG_SMP) ? (" NR_CPUS=" __stringify(NR_CPUS)) : "",
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 72/191 scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
In reply to Greg Kroah-HartmanFrom: Finn Thain <[email protected]>
[ Upstream commit 79172ab20bfd8437b277254028efdb68484e2c21 ]
Since the scsi subsystem adopted the blk-mq API, a host with zero sg_tablesize crashes with a NULL pointer dereference.
blk_queue_max_segments: set to minimum 1
scsi 0:0:0:0: Direct-Access QEMU QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5
scsi target0:0:0: Beginning Domain Validation
scsi target0:0:0: Domain Validation skipping write tests
scsi target0:0:0: Ending Domain Validationblk_queue_max_segments: set to minimum 1
scsi 0:0:1:0: Direct-Access QEMU QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5
scsi target0:0:1: Beginning Domain Validation
scsi target0:0:1: Domain Validation skipping write tests
scsi target0:0:1: Ending Domain Validationblk_queue_max_segments: set to minimum 1
scsi 0:0:2:0: CD-ROM QEMU QEMU CD-ROM 2.5+ PQ: 0 ANSI: 5
scsi target0:0:2: Beginning Domain Validation
scsi target0:0:2: Domain Validation skipping write tests
scsi target0:0:2: Ending Domain Validationblk_queue_max_segments: set to minimum 1blk_queue_max_segments: set to minimum 1blk_queue_max_segments: set to minimum 1blk_queue_max_segments: set to minimum 1
sr 0:0:2:0: Power-on or device reset occurred
sd 0:0:0:0: Power-on or device reset occurred
sd 0:0:1:0: Power-on or device reset occurred
sd 0:0:0:0: [sda] 10485762 512-byte logical blocks: (5.37 GB/5.00 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
Unable to handle kernel NULL pointer dereference at virtual address (ptrval) Oops: 00000000 Modules linked in: PC: [<001cd874>] blk_mq_free_request+0x66/0xe2 SR: 2004 SP: (ptrval) a2: 00874520 d0: 00000000 d1: 00000000 d2: 009ba800 d3: 00000000 d4: 00000000 d5: 08000002 a0: 0087be68 a1: 009a81e0
Process kworker/u2:2 (pid: 15, task=(ptrval)) Frame format=7 eff addr=0000007a ssw=0505 faddr=0000007a wb 1 stat/addr/data: 0000 00000000 00000000
wb 2 stat/addr/data: 0000 00000000 00000000
wb 3 stat/addr/data: 0000 0000007a 00000000 push data: 00000000 00000000 00000000 00000000 Stack from 0087bd98:
00000002 00000000 0087be72 009a7820 0087bdb4 001c4f6c 009a7820 0087bdd4
0024d200 009a7820 0024d0dc 0087be72 009baa00 0087be68 009a5000 0087be7c
00265d10 009a5000 0087be72 00000003 00000000 00000000 00000000 0087be68
00000bb8 00000005 00000000 00000000 00000000 00000000 00265c56 00000000
009ba60c 0036ddf4 00000002 ffffffff 009baa00 009ba600 009a50d6 0087be74
00227ba0 009baa08 00000001 009baa08 009ba60c 0036ddf4 00000000 00000000
Call Trace: [<001c4f6c>] blk_put_request+0xe/0x14
[<0024d200>] __scsi_execute+0x124/0x174
[<0024d0dc>] __scsi_execute+0x0/0x174
[<00265d10>] sd_revalidate_disk+0xba/0x1f02
[<00265c56>] sd_revalidate_disk+0x0/0x1f02
[<0036ddf4>] strlen+0x0/0x22
[<00227ba0>] device_add+0x3da/0x604
[<0036ddf4>] strlen+0x0/0x22
[<00267e64>] sd_probe+0x30c/0x4b4
[<0002da44>] process_one_work+0x0/0x402
[<0022b978>] really_probe+0x226/0x354
[<0022bc34>] driver_probe_device+0xa4/0xf0
[<0002da44>] process_one_work+0x0/0x402
[<0022bcd0>] __driver_attach_async_helper+0x50/0x70
[<00035dae>] async_run_entry_fn+0x36/0x130
[<0002db88>] process_one_work+0x144/0x402
[<0002e1aa>] worker_thread+0x0/0x570
[<0002e29a>] worker_thread+0xf0/0x570
[<0002e1aa>] worker_thread+0x0/0x570
[<003768d8>] schedule+0x0/0xb8
[<0003f58c>] __init_waitqueue_head+0x0/0x12
[<00033e92>] kthread+0xc2/0xf6
[<000331e8>] kthread_parkme+0x0/0x4e
[<003768d8>] schedule+0x0/0xb8
[<00033dd0>] kthread+0x0/0xf6
[<00002c10>] ret_from_kernel_thread+0xc/0x14
Code: 0280 0006 0800 56c0 4400 0280 0000 00ff <52b4> 0c3a 082b 0006 0013 6706 2042 53a8 00c4 4ab9 0047 3374 6640 202d 000c 670cDisabling lock debugging due to kernel taint
Avoid this by setting sg_tablesize = 1.
--- drivers/scsi/atari_scsi.c | 6 +++--- drivers/scsi/mac_scsi.c | 2 +- drivers/scsi/sun3_scsi.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/scsi/atari_scsi.c +3 -3
@@ -742,7 +742,7 @@ static int __init atari_scsi_probe(struct platform_device *pdev) atari_scsi_template.sg_tablesize =SG_ALL ; }else { atari_scsi_template.can_queue =1 ; - atari_scsi_template.sg_tablesize =SG_NONE ; + atari_scsi_template.sg_tablesize =1 ; }if (setup_can_queue >0 )
@@ -751,8 +751,8 @@ static int __init atari_scsi_probe(struct platform_device *pdev)if (setup_cmd_per_lun >0 ) atari_scsi_template.cmd_per_lun = setup_cmd_per_lun; -/* Leave sg_tablesize at 0 on a Falcon! */ -if (ATARIHW_PRESENT (TT_SCSI ) && setup_sg_tablesize >=0 ) +/* Don't increase sg_tablesize on Falcon! */ +if (ATARIHW_PRESENT (TT_SCSI ) && setup_sg_tablesize >0 ) atari_scsi_template.sg_tablesize = setup_sg_tablesize;if (setup_hostid >=0 ) {
drivers/scsi/mac_scsi.c +1 -1
@@ -464,7 +464,7 @@ static int __init mac_scsi_probe(struct platform_device *pdev) mac_scsi_template.can_queue = setup_can_queue;if (setup_cmd_per_lun >0 ) mac_scsi_template.cmd_per_lun = setup_cmd_per_lun; -if (setup_sg_tablesize >=0 ) +if (setup_sg_tablesize >0 ) mac_scsi_template.sg_tablesize = setup_sg_tablesize;if (setup_hostid >=0 ) mac_scsi_template.this_id = setup_hostid &7 ;
drivers/scsi/sun3_scsi.c +2 -2
@@ -501,7 +501,7 @@ static struct scsi_host_template sun3_scsi_template = { .eh_host_reset_handler = sun3scsi_host_reset, .can_queue = 16, .this_id = 7, - .sg_tablesize = SG_NONE, + .sg_tablesize = 1, .cmd_per_lun = 2, .dma_boundary = PAGE_SIZE - 1, .cmd_size = NCR5380_CMD_SIZE,
@@ -523,7 +523,7 @@ static int __init sun3_scsi_probe(struct platform_device *pdev) sun3_scsi_template.can_queue = setup_can_queue;if (setup_cmd_per_lun >0 ) sun3_scsi_template.cmd_per_lun = setup_cmd_per_lun; -if (setup_sg_tablesize >=0 ) +if (setup_sg_tablesize >0 ) sun3_scsi_template.sg_tablesize = setup_sg_tablesize;if (setup_hostid >=0 ) sun3_scsi_template.this_id = setup_hostid &7 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 73/191 clk: pxa: fix one of the pxa RTC clocks
In reply to Greg Kroah-HartmanFrom: Robert Jarzmik <[email protected]>
[ Upstream commit 46acbcb4849b2ca2e6e975e7c8130c1d61c8fd0c ]
The pxa27x platforms have a single IP with 2 drivers, sa1100-rtc and rtc-pxa drivers.
A previous patch fixed the sa1100-rtc case, but the pxa-rtc wasn't fixed. This patch completes the previous one.
--- drivers/clk/pxa/clk-pxa27x.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/pxa/clk-pxa27x.c +1 -0
@@ -459,6 +459,7 @@ struct dummy_clk { };static struct dummy_clk dummy_clks[]__initdata = {DUMMY_CLK (NULL ,"pxa27x-gpio" ,"osc_32_768khz" ), +DUMMY_CLK (NULL ,"pxa-rtc" ,"osc_32_768khz" ),DUMMY_CLK (NULL ,"sa1100-rtc" ,"osc_32_768khz" ),DUMMY_CLK ("UARTCLK" ,"pxa2xx-ir" ,"STUART" ), };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 74/191 bcache: at least try to shrink 1 node in bch_mca_scan()
In reply to Greg Kroah-HartmanFrom: Coly Li <[email protected]>
[ Upstream commit 9fcc34b1a6dd4b8e5337e2b6ef45e428897eca6b ]
In bch_mca_scan(), the number of shrinking btree node is calculated by code like this,
unsigned long nr = sc->nr_to_scan;
nr /= c->btree_pages;
nr = min_t(unsigned long, nr, mca_can_free(c));variable sc->nr_to_scan is number of objects (here is bcache B+tree nodes' number) to shrink, and pointer variable sc is sent from memory management code as parametr of a callback.
If sc->nr_to_scan is smaller than c->btree_pages, after the above calculation, variable 'nr' will be 0 and nothing will be shrunk. It is frequeently observed that only 1 or 2 is set to sc->nr_to_scan and make nr to be zero. Then bch_mca_scan() will do nothing more then acquiring and releasing mutex c->bucket_lock.
This patch checkes whether nr is 0 after the above calculation, if 0 is the result then set 1 to variable 'n'. Then at least bch_mca_scan() will try to shrink a single B+tree node.
--- drivers/md/bcache/btree.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/bcache/btree.c +2 -0
@@ -723,6 +723,8 @@ static unsigned long bch_mca_scan(struct shrinker *shrink,* IO can always make forward progress: */ nr /= c->btree_pages; +if (nr ==0 ) + nr =1 ; nr = min_t(unsigned long, nr, mca_can_free(c)); i =0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 75/191 HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse
In reply to Greg Kroah-HartmanFrom: Jinke Fan <[email protected]>
[ Upstream commit f1a0094cbbe97a5f8aca7bdc64bfe43ac9dc6879 ]
The PixArt OEM mouse disconnets/reconnects every minute on Linux. All contents of dmesg are repetitive:
[ 1465.810014] usb 1-2.2: USB disconnect, device number 20 [ 1467.431509] usb 1-2.2: new low-speed USB device number 21 using xhci_hcd [ 1467.654982] usb 1-2.2: New USB device found, idVendor=03f0,idProduct=1f4a, bcdDevice= 1.00 [ 1467.654985] usb 1-2.2: New USB device strings: Mfr=1, Product=2,SerialNumber=0 [ 1467.654987] usb 1-2.2: Product: HP USB Optical Mouse [ 1467.654988] usb 1-2.2: Manufacturer: PixArt [ 1467.699722] input: PixArt HP USB Optical Mouse as /devices/pci0000:00/0000:00:07.1/0000:05:00.3/usb1/1-2/1-2.2/1-2.2:1.0/0003:03F0:1F4A.0012/input/input19 [ 1467.700124] hid-generic 0003:03F0:1F4A.0012: input,hidraw0: USB HID v1.11 Mouse [PixArt HP USB Optical Mouse] on usb-0000:05:00.3-2.2/input0
So add HID_QUIRK_ALWAYS_POLL for this one as well.
Test the patch, the mouse is no longer disconnected and there are no duplicate logs in dmesg.
Reference:
https://github.com/sriemer/fix-linux-mouse
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -573,6 +573,7 @@#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941 0x0941#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641 +#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a 0x1f4a#define USB_VENDOR_ID_HUION 0x256c#define USB_DEVICE_ID_HUION_TABLET 0x006e
drivers/hid/hid-quirks.c +1 -0
@@ -94,6 +94,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X), HID_QUIRK_MULTI_INPUT },
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 76/191 dt-bindings: Improve validation build error handling
In reply to Greg Kroah-HartmanFrom: Rob Herring <[email protected]>
[ Upstream commit 93512dad334deb444619505f1fbb761156f7471b ]
Schema errors can cause make to exit before useful information is printed. This leaves developers wondering what's wrong. It can be overcome passing '-k' to make, but that's not an obvious solution. There's 2 scenarios where this happens.
When using DT_SCHEMA_FILES to validate with a single schema, any error in the schema results in processed-schema.yaml being empty causing a make error. The result is the specific errors in the schema are never shown because processed-schema.yaml is the first target built. Simply making processed-schema.yaml last in extra-y ensures the full schema validation with detailed error messages happen first.
The 2nd problem is while schema errors are ignored for processed-schema.yaml, full validation of the schema still runs in parallel and any schema validation errors will still stop the build when running validation of dts files. The fix is to not add the schema examples to extra-y in this case. This means 'dtbs_check' is no longer a superset of 'dt_binding_check'. Update the documentation to make this clear.
--- Documentation/devicetree/bindings/Makefile | 5 ++++- Documentation/devicetree/writing-schema.rst | 6 ++++-- 2 files changed, 8 insertions(+), 3 deletions(-)
Documentation/devicetree/bindings/Makefile +4 -1
@@ -12,7 +12,6 @@ $(obj)/%.example.dts: $(src)/%.yaml FORCE $(call if_changed,chk_binding) DT_TMP_SCHEMA := processed-schema.yaml -extra-y += $(DT_TMP_SCHEMA) quiet_cmd_mk_schema = SCHEMA $@ cmd_mk_schema = $(DT_MK_SCHEMA) $(DT_MK_SCHEMA_FLAGS) -o $@ $(real-prereqs)
@@ -26,8 +25,12 @@ DT_DOCS = $(shell \ DT_SCHEMA_FILES ?= $(addprefix $(src)/,$(DT_DOCS)) +ifeq ($(CHECK_DTBS),) extra-y += $(patsubst $(src)/%.yaml,%.example.dts, $(DT_SCHEMA_FILES)) extra-y += $(patsubst $(src)/%.yaml,%.example.dt.yaml, $(DT_SCHEMA_FILES)) +endif $(obj)/$(DT_TMP_SCHEMA): $(DT_SCHEMA_FILES) FORCE $(call if_changed,mk_schema) + +extra-y += $(DT_TMP_SCHEMA)
Documentation/devicetree/writing-schema.rst +4 -2
@@ -130,11 +130,13 @@ binding schema. All of the DT binding documents can be validated using the make dt_binding_check -In order to perform validation of DT source files, use the `dtbs_check` target:: +In order to perform validation of DT source files, use the ``dtbs_check`` target:: make dtbs_check -This will first run the `dt_binding_check` which generates the processed schema. +Note that ``dtbs_check`` will skip any binding schema files with errors. It is +necessary to use ``dt_binding_check`` to get all the validation errors in the +binding schema files. It is also possible to run checks with a single schema file by setting the ``DT_SCHEMA_FILES`` variable to a specific schema file.
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 77/191 HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 61005d65b6c7dcf61c19516e6ebe5acc02d2cdda ]
My Logitech M185 (PID:4038) 2.4 GHz wireless HID++ mouse is causing intermittent errors like these in the log:
[11091.034857] logitech-hidpp-device 0003:046D:4038.0006: hidpp20_batterylevel_get_battery_capacity: received protocol error 0x09 [12388.031260] logitech-hidpp-device 0003:046D:4038.0006: hidpp20_batterylevel_get_battery_capacity: received protocol error 0x09 [16613.718543] logitech-hidpp-device 0003:046D:4038.0006: hidpp20_batterylevel_get_battery_capacity: received protocol error 0x09 [23529.938728] logitech-hidpp-device 0003:046D:4038.0006: hidpp20_batterylevel_get_battery_capacity: received protocol error 0x09
We are already silencing error-code 0x09 (HIDPP_ERROR_RESOURCE_ERROR) errors in other places, lets do the same in hidpp20_batterylevel_get_battery_capacity to remove these harmless, but scary looking errors from the dmesg output.
--- drivers/hid/hid-logitech-hidpp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-logitech-hidpp.c +3 -0
@@ -1102,6 +1102,9 @@ static int hidpp20_batterylevel_get_battery_capacity(struct hidpp_device *hidpp, ret =hidpp_send_fap_command_sync (hidpp, feature_index,CMD_BATTERY_LEVEL_STATUS_GET_BATTERY_LEVEL_STATUS ,NULL ,0 , &response); +/* Ignore these intermittent errors */ +if (ret ==HIDPP_ERROR_RESOURCE_ERROR ) +return -EIO ;if (ret >0 ) {hid_err (hidpp->hid_dev,"%s: received protocol error 0x%02x\n" , __func__, ret);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 78/191 HID: i2c-hid: fix no irq after reset on raydium 3118
In reply to Greg Kroah-HartmanFrom: Aaron Ma <[email protected]>
[ Upstream commit 0c8432236dea20a95f68fa17989ea3f8af0186a5 ]
On some ThinkPad L390 some raydium 3118 touchscreen devices doesn't response any data after reset, but some does.
Add this ID to no irq quirk,
then don't wait for any response alike on these touchscreens. All kinds of raydium 3118 devices work fine.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -960,6 +960,7 @@#define I2C_VENDOR_ID_RAYDIUM 0x2386#define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33 +#define I2C_PRODUCT_ID_RAYDIUM_3118 0x3118#define USB_VENDOR_ID_RAZER 0x1532#define USB_DEVICE_ID_RAZER_BLADE_14 0x011D
drivers/hid/i2c-hid/i2c-hid-core.c +2 -0
@@ -170,6 +170,8 @@ static const struct i2c_hid_quirks { I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV }, {I2C_VENDOR_ID_HANTICK ,I2C_PRODUCT_ID_HANTICK_5288 , I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, { USB_VENDOR_ID_ELAN, HID_ANY_ID, I2C_HID_QUIRK_BOGUS_IRQ }, { 0, 0 }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 79/191 ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening
In reply to Greg Kroah-HartmanFrom: Doug Berger <[email protected]>
[ Upstream commit 4ae5061a19b550dfe25397843427ed2ebab16b16 ]
When the default processor handling was added to the function cpu_v7_spectre_init() it only excluded other ARM implemented processor cores. The Broadcom Brahma B53 core is not implemented by ARM so it ended up falling through into the set of processors that attempt to use the ARM_SMCCC_ARCH_WORKAROUND_1 service to harden the branch predictor.
Since this workaround is not necessary for the Brahma-B53 this commit explicitly checks for it and prevents it from applying a branch predictor hardening workaround.
--- arch/arm/mm/proc-v7-bugs.c | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/mm/proc-v7-bugs.c +3 -0
@@ -65,6 +65,9 @@ static void cpu_v7_spectre_init(void)break ;#ifdef CONFIG_ARM_PSCI +case ARM_CPU_PART_BRAHMA_B53 : +/* Requires no workaround */ +break ;default :/* Other ARM CPUs require no workaround */ if (read_cpuid_implementor () ==ARM_CPU_IMP_ARM )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 80/191 libnvdimm/btt: fix variable rc set but not used
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit 4e24e37d5313edca8b4ab86f240c046c731e28d6 ]
drivers/nvdimm/btt.c: In function 'btt_read_pg':drivers/nvdimm/btt.c:1264:8: warning: variable 'rc' set but not used [-Wunused-but-set-variable]
int rc;
^~Add a ratelimited message in case a storm of errors is encountered.
--- drivers/nvdimm/btt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/nvdimm/btt.c +4 -4
@@ -1261,11 +1261,11 @@ static int btt_read_pg(struct btt *btt, struct bio_integrity_payload *bip, ret =btt_data_read (arena, page, off, postmap, cur_len);if (ret) { -int rc; -/* Media error - set the e_flag */ - rc =btt_map_write (arena, premap, postmap,0 ,1 , -NVDIMM_IO_ATOMIC ); +if (btt_map_write (arena, premap, postmap,0 ,1 ,NVDIMM_IO_ATOMIC )) +dev_warn_ratelimited (to_dev (arena), +"Error persistently tracking bad blocks at %#x\n" , + premap); goto out_rtt; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 81/191 HID: Improve Windows Precision Touchpad detection.
In reply to Greg Kroah-HartmanFrom: Blaž Hrastnik <[email protected]>
[ Upstream commit 2dbc6f113acd74c66b04bf49fb027efd830b1c5a ]
Per Microsoft spec, usage 0xC5 (page 0xFF) returns a blob containing data used to verify the touchpad as a Windows Precision Touchpad.
0x85, REPORTID_PTPHQA, // REPORT_ID (PTPHQA)
0x09, 0xC5, // USAGE (Vendor Usage 0xC5)
0x15, 0x00, // LOGICAL_MINIMUM (0)
0x26, 0xff, 0x00, // LOGICAL_MAXIMUM (0xff)
0x75, 0x08, // REPORT_SIZE (8)
0x96, 0x00, 0x01, // REPORT_COUNT (0x100 (256))
0xb1, 0x02, // FEATURE (Data,Var,Abs)However, some devices, namely Microsoft's Surface line of products instead implement a "segmented device certification report" (usage 0xC6) which returns the same report, but in smaller chunks.
0x06, 0x00, 0xff, // USAGE_PAGE (Vendor Defined)
0x85, REPORTID_PTPHQA, // REPORT_ID (PTPHQA)
0x09, 0xC6, // USAGE (Vendor usage for segment #)
0x25, 0x08, // LOGICAL_MAXIMUM (8)
0x75, 0x08, // REPORT_SIZE (8)
0x95, 0x01, // REPORT_COUNT (1)
0xb1, 0x02, // FEATURE (Data,Var,Abs)
0x09, 0xC7, // USAGE (Vendor Usage)
0x26, 0xff, 0x00, // LOGICAL_MAXIMUM (0xff)
0x95, 0x20, // REPORT_COUNT (32)
0xb1, 0x02, // FEATURE (Data,Var,Abs)By expanding Win8 touchpad detection to also look for the segmented report, all Surface touchpads are now properly recognized by hid-multitouch.
--- drivers/hid/hid-core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hid/hid-core.c +4 -0
@@ -781,6 +781,10 @@ static void hid_scan_feature_usage(struct hid_parser *parser, u32 usage)if (usage ==0xff0000c5 && parser->global.report_count ==256 && parser->global.report_size ==8 ) parser->scan_flags |=HID_SCAN_FLAG_MT_WIN_8 ; + +if (usage ==0xff0000c6 && parser->global.report_count ==1 && + parser->global.report_size ==8 ) + parser->scan_flags |=HID_SCAN_FLAG_MT_WIN_8 ; }static void hid_scan_collection (struct hid_parser *parser,unsigned type)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 82/191 HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device
In reply to Greg Kroah-HartmanFrom: Andrew Duggan <[email protected]>
[ Upstream commit 8725aa4fa7ded30211ebd28bb1c9bae806eb3841 ]
In the event that the RMI device is unreachable, the calls to rmi_set_mode() or rmi_set_page() will fail before registering the RMI transport device. When the device is removed, rmi_remove() will call rmi_unregister_transport_device() which will attempt to access the rmi_dev pointer which was not set. This patch adds a check of the RMI_STARTED bit before calling rmi_unregister_transport_device(). The RMI_STARTED bit is only set after rmi_register_transport_device() completes successfully.
The kernel oops was reported in this message:
https://www.spinics.net/lists/linux-input/msg58433.html
--- drivers/hid/hid-rmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hid/hid-rmi.c +2 -1
@@ -744,7 +744,8 @@ static void rmi_remove(struct hid_device *hdev) {struct rmi_data *hdata =hid_get_drvdata (hdev); -if (hdata->device_flags &RMI_DEVICE ) { +if ((hdata->device_flags &RMI_DEVICE ) + &&test_bit (RMI_STARTED , &hdata->flags)) {clear_bit (RMI_STARTED , &hdata->flags);cancel_work_sync (&hdata->reset_work);rmi_unregister_transport_device (&hdata->xport);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 83/191 watchdog: imx7ulp: Fix reboot hang
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit 6083ab7b2f3f25022e2e8f4c42f14a8521f47873 ]
The following hang is observed when a 'reboot' command is issued:
# reboot # Stopping network: OK Stopping klogd: OK Stopping syslogd: OK umount: devtmpfs busy - remounted read-only [ 8.612079] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null) The system is going down NOW! Sent SIGTERM to all processes Sent SIGKILL to all processes Requesting system reboot [ 10.694753] reboot: Restarting system [ 11.699008] Reboot failed -- System halted
Fix this problem by adding a .restart ops member.
--- drivers/watchdog/imx7ulp_wdt.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/watchdog/imx7ulp_wdt.c +16 -0
@@ -106,12 +106,28 @@ static int imx7ulp_wdt_set_timeout(struct watchdog_device *wdog,return 0 ; } +static int imx7ulp_wdt_restart (struct watchdog_device *wdog, +unsigned long action,void *data) +{ +struct imx7ulp_wdt_device *wdt =watchdog_get_drvdata (wdog); + +imx7ulp_wdt_enable (wdt->base, true); +imx7ulp_wdt_set_timeout (&wdt->wdd,1 ); + +/* wait for wdog to fire */ +while (true) + ; + +return NOTIFY_DONE ; +} +static const struct watchdog_ops imx7ulp_wdt_ops = { .owner =THIS_MODULE , .start = imx7ulp_wdt_start, .stop = imx7ulp_wdt_stop, .ping = imx7ulp_wdt_ping, .set_timeout = imx7ulp_wdt_set_timeout, + .restart = imx7ulp_wdt_restart, };static const struct watchdog_info imx7ulp_wdt_info = {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 84/191 watchdog: prevent deferral of watchdogd wakeup on RT
In reply to Greg Kroah-HartmanFrom: Julia Cartwright <[email protected]>
[ Upstream commit a19f89335f4bda3d77d991c96583e3e51856acbb ]
When PREEMPT_RT is enabled, all hrtimer expiry functions are deferred for execution into the context of ksoftirqd unless otherwise annotated.
Deferring the expiry of the hrtimer used by the watchdog core, however, is a waste, as the callback does nothing but queue a kthread work item and wakeup watchdogd.
It's worst then that, too: the deferral through ksoftirqd also means that for correct behavior a user must adjust the scheduling parameters of both watchdogd _and_ ksoftirqd, which is unnecessary and has other side effects (like causing unrelated expiry functions to execute at potentially elevated priority).
Instead, mark the hrtimer used by the watchdog core as being _HARD to allow it's execution directly from hardirq context. The work done in this expiry function is well-bounded and minimal.
A user still must adjust the scheduling parameters of the watchdogd to be correct w.r.t. their application needs.
--- drivers/watchdog/watchdog_dev.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/watchdog/watchdog_dev.c +6 -4
@@ -158,7 +158,8 @@ static inline void watchdog_update_worker(struct watchdog_device *wdd)ktime_t t =watchdog_next_keepalive (wdd);if (t >0 ) -hrtimer_start (&wd_data->timer, t,HRTIMER_MODE_REL ); +hrtimer_start (&wd_data->timer, t, +HRTIMER_MODE_REL_HARD ); }else {hrtimer_cancel (&wd_data->timer); }
@@ -177,7 +178,7 @@ static int __watchdog_ping(struct watchdog_device *wdd)if (ktime_after (earliest_keepalive, now)) {hrtimer_start (&wd_data->timer,ktime_sub (earliest_keepalive, now), -HRTIMER_MODE_REL ); +HRTIMER_MODE_REL_HARD );return 0 ; }
@@ -971,7 +972,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)return -ENODEV ;kthread_init_work (&wd_data->work, watchdog_ping_work); -hrtimer_init (&wd_data->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); +hrtimer_init (&wd_data->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_HARD ); wd_data->timer.function = watchdog_timer_expired;if (wdd->id ==0 ) {
@@ -1019,7 +1020,8 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)__module_get (wdd->ops->owner);kref_get (&wd_data->kref);if (handle_boot_enabled) -hrtimer_start (&wd_data->timer,0 ,HRTIMER_MODE_REL ); +hrtimer_start (&wd_data->timer,0 , +HRTIMER_MODE_REL_HARD );else pr_info ("watchdog%d running and kernel based pre-userspace handler disabled\n" , wdd->id);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 85/191 watchdog: Fix the race between the release of watchdog_core_data and cdev
In reply to Greg Kroah-HartmanFrom: Kevin Hao <[email protected]>
[ Upstream commit 72139dfa2464e43957d330266994740bb7be2535 ]
The struct cdev is embedded in the struct watchdog_core_data. In the
current code, we manage the watchdog_core_data with a kref, but the
cdev is manged by a kobject. There is no any relationship between
this kref and kobject. So it is possible that the watchdog_core_data is
freed before the cdev is entirely released. We can easily get the
following call trace with CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_DEBUG_OBJECTS_TIMERS enabled.
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x38
WARNING: CPU: 23 PID: 1028 at lib/debugobjects.c:481 debug_print_object+0xb0/0xf0 Modules linked in: softdog(-) deflate ctr twofish_generic twofish_common camellia_generic serpent_generic blowfish_generic blowfish_common cast5_generic cast_common cmac xcbc af_key sch_fq_codel openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 CPU: 23 PID: 1028 Comm: modprobe Not tainted 5.3.0-next-20190924-yoctodev-standard+ #180 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 00400009 (nzcv daif +PAN -UAO) pc : debug_print_object+0xb0/0xf0 lr : debug_print_object+0xb0/0xf0 sp : ffff80001cbcfc70 x29: ffff80001cbcfc70 x28: ffff800010ea2128 x27: ffff800010bad000 x26: 0000000000000000 x25: ffff80001103c640 x24: ffff80001107b268 x23: ffff800010bad9e8 x22: ffff800010ea2128 x21: ffff000bc2c62af8 x20: ffff80001103c600 x19: ffff800010e867d8 x18: 0000000000000060 x17: 0000000000000000 x16: 0000000000000000 x15: ffff000bd7240470 x14: 6e6968207473696c x13: 5f72656d6974203a x12: 6570797420746365 x11: 6a626f2029302065 x10: 7461747320657669 x9 : 7463612820657669 x8 : 3378302f3078302b x7 : 0000000000001d7a x6 : ffff800010fd5889 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff000bff948548 x1 : 276a1c9e1edc2300 x0 : 0000000000000000 Call trace: debug_print_object+0xb0/0xf0 debug_check_no_obj_freed+0x1e8/0x210 kfree+0x1b8/0x368 watchdog_cdev_unregister+0x88/0xc8 watchdog_dev_unregister+0x38/0x48 watchdog_unregister_device+0xa8/0x100 softdog_exit+0x18/0xfec4 [softdog] __arm64_sys_delete_module+0x174/0x200 el0_svc_handler+0xd0/0x1c8 el0_svc+0x8/0xc
This is a common issue when using cdev embedded in a struct. Fortunately, we already have a mechanism to solve this kind of issue. Please see commit 233ed09d7fda ("chardev: add helper function to register char devs with a struct device") for more detail.
In this patch, we choose to embed the struct device into the watchdog_core_data, and use the API provided by the commit 233ed09d7fda to make sure that the release of watchdog_core_data and cdev are in sequence.
--- drivers/watchdog/watchdog_dev.c | 70 +++++++++++++++------------------ 1 file changed, 32 insertions(+), 38 deletions(-)
drivers/watchdog/watchdog_dev.c +32 -38
@@ -34,7 +34,6 @@#include <linux/init.h> /* For __init/__exit/... */ #include <linux/hrtimer.h> /* For hrtimers */ #include <linux/kernel.h> /* For printk/panic/... */ -#include <linux/kref.h> /* For data references */ #include <linux/kthread.h> /* For kthread_work */ #include <linux/miscdevice.h> /* For handling misc devices */ #include <linux/module.h> /* For module stuff/... */
@@ -52,14 +51,14 @@/* * struct watchdog_core_data - watchdog core internal data -* @kref: Reference count. +* @dev: The watchdog's internal device * @cdev: The watchdog's Character device. * @wdd: Pointer to watchdog device. * @lock: Lock for watchdog core. * @status: Watchdog core internal status bits. */ struct watchdog_core_data { -struct kref kref; +struct device dev;struct cdev cdev;struct watchdog_device *wdd;struct mutex lock;
@@ -840,7 +839,7 @@ static int watchdog_open(struct inode *inode, struct file *file) file->private_data = wd_data;if (!hw_running) -kref_get (&wd_data->kref); +get_device (&wd_data->dev);/* * open_timeout only applies for the first open from
@@ -861,11 +860,11 @@ out_clear:return err; } -static void watchdog_core_data_release (struct kref *kref) +static void watchdog_core_data_release (struct device *dev) {struct watchdog_core_data *wd_data; - wd_data = container_of(kref, struct watchdog_core_data, kref); + wd_data = container_of(dev, struct watchdog_core_data, dev);kfree (wd_data); }
@@ -925,7 +924,7 @@ done:*/ if (!running) {module_put (wd_data->cdev.owner); -kref_put (&wd_data->kref, watchdog_core_data_release); +put_device (&wd_data->dev); }return 0 ; }
@@ -944,17 +943,22 @@ static struct miscdevice watchdog_miscdev = { .fops = &watchdog_fops, }; +static struct class watchdog_class = { + .name ="watchdog" , + .owner =THIS_MODULE , + .dev_groups = wdt_groups, +}; +/* * watchdog_cdev_register: register watchdog character device * @wdd: watchdog device -* @devno: character device number * * Register a watchdog character device including handling the legacy * /dev/watchdog node. /dev/watchdog is actually a miscdevice and * thus we set it up like that. */ -static int watchdog_cdev_register (struct watchdog_device *wdd,dev_t devno) +static int watchdog_cdev_register (struct watchdog_device *wdd) {struct watchdog_core_data *wd_data;int err;
@@ -962,7 +966,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) wd_data =kzalloc (sizeof (struct watchdog_core_data ),GFP_KERNEL );if (!wd_data)return -ENOMEM ; -kref_init (&wd_data->kref);mutex_init (&wd_data->lock); wd_data->wdd = wdd;
@@ -991,23 +994,33 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) } } +device_initialize (&wd_data->dev); + wd_data->dev.devt =MKDEV (MAJOR (watchdog_devt), wdd->id); + wd_data->dev.class = &watchdog_class; + wd_data->dev.parent = wdd->parent; + wd_data->dev.groups = wdd->groups; + wd_data->dev.release = watchdog_core_data_release; +dev_set_drvdata (&wd_data->dev, wdd); +dev_set_name (&wd_data->dev,"watchdog%d" , wdd->id); +/* Fill in the data structures */ cdev_init (&wd_data->cdev, &watchdog_fops); - wd_data->cdev.owner = wdd->ops->owner;/* Add the device */ - err =cdev_add (&wd_data->cdev, devno,1 ); + err =cdev_device_add (&wd_data->cdev, &wd_data->dev);if (err) {pr_err ("watchdog%d unable to add device %d:%d\n" , wdd->id,MAJOR (watchdog_devt), wdd->id);if (wdd->id ==0 ) {misc_deregister (&watchdog_miscdev); old_wd_data =NULL ; -kref_put (&wd_data->kref, watchdog_core_data_release); +put_device (&wd_data->dev); }return err; } + wd_data->cdev.owner = wdd->ops->owner; +/* Record time of most recent heartbeat as 'just before now'. */ wd_data->last_hw_keepalive =ktime_sub (ktime_get (),1 );watchdog_set_open_deadline (wd_data);
@@ -1018,7 +1031,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)*/ if (watchdog_hw_running (wdd)) {__module_get (wdd->ops->owner); -kref_get (&wd_data->kref); +get_device (&wd_data->dev);if (handle_boot_enabled)hrtimer_start (&wd_data->timer,0 ,HRTIMER_MODE_REL_HARD );
@@ -1042,7 +1055,7 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) {struct watchdog_core_data *wd_data = wdd->wd_data; -cdev_del (&wd_data->cdev); +cdev_device_del (&wd_data->cdev, &wd_data->dev);if (wdd->id ==0 ) {misc_deregister (&watchdog_miscdev); old_wd_data =NULL ;
@@ -1061,15 +1074,9 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd)hrtimer_cancel (&wd_data->timer);kthread_cancel_work_sync (&wd_data->work); -kref_put (&wd_data->kref, watchdog_core_data_release); +put_device (&wd_data->dev); } -static struct class watchdog_class = { - .name ="watchdog" , - .owner =THIS_MODULE , - .dev_groups = wdt_groups, -}; -static int watchdog_reboot_notifier (struct notifier_block *nb,unsigned long code,void *data) {
@@ -1100,27 +1107,14 @@ static int watchdog_reboot_notifier(struct notifier_block *nb,int watchdog_dev_register (struct watchdog_device *wdd) { -struct device *dev; -dev_t devno;int ret; - devno =MKDEV (MAJOR (watchdog_devt), wdd->id); - - ret =watchdog_cdev_register (wdd, devno); + ret =watchdog_cdev_register (wdd);if (ret)return ret; - dev =device_create_with_groups (&watchdog_class, wdd->parent, - devno, wdd, wdd->groups, -"watchdog%d" , wdd->id); -if (IS_ERR (dev)) { -watchdog_cdev_unregister (wdd); -return PTR_ERR (dev); - } - ret =watchdog_register_pretimeout (wdd);if (ret) { -device_destroy (&watchdog_class, devno);watchdog_cdev_unregister (wdd);return ret; }
@@ -1128,7 +1122,8 @@ int watchdog_dev_register(struct watchdog_device *wdd)if (test_bit (WDOG_STOP_ON_REBOOT , &wdd->status)) { wdd->reboot_nb.notifier_call = watchdog_reboot_notifier; - ret =devm_register_reboot_notifier (dev, &wdd->reboot_nb); + ret =devm_register_reboot_notifier (&wdd->wd_data->dev, + &wdd->reboot_nb);if (ret) {pr_err ("watchdog%d: Cannot register reboot notifier (%d)\n" , wdd->id, ret);
@@ -1150,7 +1145,6 @@ int watchdog_dev_register(struct watchdog_device *wdd)void watchdog_dev_unregister (struct watchdog_device *wdd) {watchdog_unregister_pretimeout (wdd); -device_destroy (&watchdog_class, wdd->wd_data->cdev.dev);watchdog_cdev_unregister (wdd); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 86/191 powerpc/fixmap: Use __fix_to_virt() instead of fix_to_virt()
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 77693a5fb57be4606a6024ec8e3076f9499b906b ]
Modify back __set_fixmap() to using __fix_to_virt() instead of fix_to_virt() otherwise the following happens because it seems GCC doesn't see idx as a builtin const.
CC mm/early_ioremap.o
In file included from ./include/linux/kernel.h:11:0,
from mm/early_ioremap.c:11:
In function ‘fix_to_virt’,
inlined from ‘__set_fixmap’ at ./arch/powerpc/include/asm/fixmap.h:87:2,
inlined from ‘__early_ioremap’ at mm/early_ioremap.c:156:4:./include/linux/compiler.h:350:38: error: call to ‘__compiletime_assert_32’ declared with attribute error: BUILD_BUG_ON failed: idx >= __end_of_fixed_addresses
_compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
^
./include/linux/compiler.h:331:4: note: in definition of macro ‘__compiletime_assert’
prefix ## suffix(); \
^./include/linux/compiler.h:350:2: note: in expansion of macro ‘_compiletime_assert’
_compiletime_assert(condition, msg, __compiletime_assert_, __LINE__) ^./include/linux/build_bug.h:39:37: note: in expansion of macro ‘compiletime_assert’
#define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
^./include/linux/build_bug.h:50:2: note: in expansion of macro ‘BUILD_BUG_ON_MSG’
BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
^./include/asm-generic/fixmap.h:32:2: note: in expansion of macro ‘BUILD_BUG_ON’
BUILD_BUG_ON(idx >= __end_of_fixed_addresses);
^
--- arch/powerpc/include/asm/fixmap.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/fixmap.h +6 -1
@@ -77,7 +77,12 @@ enum fixed_addresses {static inline void __set_fixmap (enum fixed_addresses idx,phys_addr_t phys,pgprot_t flags) { -map_kernel_page (fix_to_virt (idx), phys, flags); +if (__builtin_constant_p (idx)) +BUILD_BUG_ON (idx >= __end_of_fixed_addresses); +else if (WARN_ON (idx >= __end_of_fixed_addresses)) +return ; + +map_kernel_page (__fix_to_virt (idx), phys, flags); }#endif /* !__ASSEMBLY__ */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 87/191 scsi: pm80xx: Fix for SATA device discovery
In reply to Greg Kroah-HartmanFrom: peter chang <[email protected]>
[ Upstream commit ce21c63ee995b7a8b7b81245f2cee521f8c3c220 ]
Driver was missing complete() call in mpi_sata_completion which result in SATA abort error handling timing out. That causes the device to be left in the in_recovery state so subsequent commands sent to the device fail and the OS removes access to it.
--- drivers/scsi/pm8001/pm80xx_hwi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/pm8001/pm80xx_hwi.c +2 -0
@@ -2382,6 +2382,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)pm8001_printk ("task 0x%p done with io_status 0x%x" " resp 0x%x stat 0x%x but aborted by upper layer!\n" , t, status, ts->resp, ts->stat)); +if (t->slow_task) +complete (&t->slow_task->completion);pm8001_ccb_task_free (pm8001_ha, t, ccb, tag); }else {spin_unlock_irqrestore (&t->task_state_lock, flags);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 88/191 scsi: ufs: Fix error handing during hibern8 enter
In reply to Greg Kroah-HartmanFrom: Subhash Jadavani <[email protected]>
[ Upstream commit 6d303e4b19d694cdbebf76bcdb51ada664ee953d ]
During clock gating (ufshcd_gate_work()), we first put the link hibern8 by calling ufshcd_uic_hibern8_enter() and if ufshcd_uic_hibern8_enter() returns success (0) then we gate all the clocks. Now let’s zoom in to what ufshcd_uic_hibern8_enter() does internally: It calls __ufshcd_uic_hibern8_enter() and if failure is encountered, link recovery shall put the link back to the highest HS gear and returns success (0) to ufshcd_uic_hibern8_enter() which is the issue as link is still in active state due to recovery! Now ufshcd_uic_hibern8_enter() returns success to ufshcd_gate_work() and hence it goes ahead with gating the UFS clock while link is still in active state hence I believe controller would raise UIC error interrupts. But when we service the interrupt, clocks might have already been disabled!
This change fixes for this by returning failure from __ufshcd_uic_hibern8_enter() if recovery succeeds as link is still not in hibern8, upon receiving the error ufshcd_hibern8_enter() would initiate retry to put the link state back into hibern8.
--- drivers/scsi/ufs/ufshcd.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/scsi/ufs/ufshcd.c +14 -5
@@ -3885,15 +3885,24 @@ static int __ufshcd_uic_hibern8_enter(struct ufs_hba *hba) ktime_to_us(ktime_sub(ktime_get(), start)), ret);if (ret) { +int err; +dev_err (hba->dev,"%s: hibern8 enter failed. ret = %d\n" , __func__, ret);/* -* If link recovery fails then return error so that caller -* don't retry the hibern8 enter again. +* If link recovery fails then return error code returned from +* ufshcd_link_recovery(). +* If link recovery succeeds then return -EAGAIN to attempt +* hibern8 enter retry again. */ -if (ufshcd_link_recovery (hba)) - ret = -ENOLINK ; + err =ufshcd_link_recovery (hba); +if (err) { +dev_err (hba->dev,"%s: link recovery failed" , __func__); + ret = err; + }else { + ret = -EAGAIN ; + } }else ufshcd_vops_hibern8_notify (hba,UIC_CMD_DME_HIBER_ENTER ,POST_CHANGE );
@@ -3907,7 +3916,7 @@ static int ufshcd_uic_hibern8_enter(struct ufs_hba *hba)for (retries =UIC_HIBERN8_ENTER_RETRIES ; retries >0 ; retries--) { ret =__ufshcd_uic_hibern8_enter (hba); -if (!ret || ret == -ENOLINK ) +if (!ret) goto out; } out:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 89/191 scsi: scsi_debug: num_tgts must be >= 0
In reply to Greg Kroah-HartmanFrom: Maurizio Lombardi <[email protected]>
[ Upstream commit aa5334c4f3014940f11bf876e919c956abef4089 ]
Passing the parameter "num_tgts=-1" will start an infinite loop that exhausts the system memory
--- drivers/scsi/scsi_debug.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/scsi/scsi_debug.c +5 -0
@@ -5263,6 +5263,11 @@ static int __init scsi_debug_init(void)return -EINVAL ; } +if (sdebug_num_tgts <0 ) { +pr_err ("num_tgts must be >= 0\n" ); +return -EINVAL ; + } +if (sdebug_guard >1 ) {pr_err ("guard must be 0 or 1\n" );return -EINVAL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 90/191 scsi: NCR5380: Add disconnect_mask module parameter
In reply to Greg Kroah-HartmanFrom: Finn Thain <[email protected]>
[ Upstream commit 0b7a223552d455bcfba6fb9cfc5eef2b5fce1491 ]
Add a module parameter to inhibit disconnect/reselect for individual targets. This gains compatibility with Aztec PowerMonster SCSI/SATA adapters with buggy firmware. (No fix is available from the vendor.)
Apparently these adapters pass-through the product/vendor of the attached SATA device. Since they can't be identified from the response to an INQUIRY command, a device blacklist flag won't work.
--- drivers/scsi/NCR5380.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/scsi/NCR5380.c +5 -1
@@ -129,6 +129,9 @@#define NCR5380_release_dma_irq (x)#endif +static unsigned int disconnect_mask = ~0 ; +module_param (disconnect_mask, int,0444 ); +static int do_abort (struct Scsi_Host *);static void do_reset (struct Scsi_Host *);static void bus_reset_cleanup (struct Scsi_Host *);
@@ -954,7 +957,8 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)int err;bool ret = true;bool can_disconnect = instance->irq !=NO_IRQ && - cmd->cmnd[0 ] !=REQUEST_SENSE ; + cmd->cmnd[0 ] !=REQUEST_SENSE && + (disconnect_mask &BIT (scmd_id (cmd)));NCR5380_dprint (NDEBUG_ARBITRATION , instance); dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n",
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 91/191 scsi: target: core: Release SPC-2 reservations when closing a session
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 80647a89eaf3f2549741648f3230cd6ff68c23b4 ]
The SCSI specs require releasing SPC-2 reservations when a session is closed. Make sure that the target core does this.
Running the libiscsi tests triggers the KASAN complaint shown below. This patch fixes that use-after-free.
BUG: KASAN: use-after-free in target_check_reservation+0x171/0x980 [target_core_mod]
Read of size 8 at addr ffff88802ecd1878 by task iscsi_trx/17200
CPU: 0 PID: 17200 Comm: iscsi_trx Not tainted 5.4.0-rc1-dbg+ #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
dump_stack+0x8a/0xd6
print_address_description.constprop.0+0x40/0x60
__kasan_report.cold+0x1b/0x34
kasan_report+0x16/0x20
__asan_load8+0x58/0x90
target_check_reservation+0x171/0x980 [target_core_mod]
__target_execute_cmd+0xb1/0xf0 [target_core_mod]
target_execute_cmd+0x22d/0x4d0 [target_core_mod]
transport_generic_new_cmd+0x31f/0x5b0 [target_core_mod]
transport_handle_cdb_direct+0x6f/0x90 [target_core_mod]
iscsit_execute_cmd+0x381/0x3f0 [iscsi_target_mod]
iscsit_sequence_cmd+0x13b/0x1f0 [iscsi_target_mod]
iscsit_process_scsi_cmd+0x4c/0x130 [iscsi_target_mod]
iscsit_get_rx_pdu+0x8e8/0x15f0 [iscsi_target_mod]
iscsi_target_rx_thread+0x105/0x1b0 [iscsi_target_mod]
kthread+0x1bc/0x210
ret_from_fork+0x24/0x30
Allocated by task 1079:
save_stack+0x23/0x90
__kasan_kmalloc.constprop.0+0xcf/0xe0
kasan_slab_alloc+0x12/0x20
kmem_cache_alloc+0xfe/0x3a0
transport_alloc_session+0x29/0x80 [target_core_mod]
iscsi_target_login_thread+0xceb/0x1920 [iscsi_target_mod]
kthread+0x1bc/0x210
ret_from_fork+0x24/0x30
Freed by task 17193:
save_stack+0x23/0x90
__kasan_slab_free+0x13a/0x190
kasan_slab_free+0x12/0x20
kmem_cache_free+0xc8/0x3e0
transport_free_session+0x179/0x2f0 [target_core_mod]
transport_deregister_session+0x121/0x170 [target_core_mod]
iscsit_close_session+0x12c/0x350 [iscsi_target_mod]
iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod]
iscsit_response_queue+0x8fa/0xc00 [iscsi_target_mod]
iscsi_target_tx_thread+0x28e/0x390 [iscsi_target_mod]
kthread+0x1bc/0x210
ret_from_fork+0x24/0x30
The buggy address belongs to the object at ffff88802ecd1860
which belongs to the cache se_sess_cache of size 352
The buggy address is located 24 bytes inside of
352-byte region [ffff88802ecd1860, ffff88802ecd19c0)
The buggy address belongs to the page:
page:ffffea0000bb3400 refcount:1 mapcount:0 mapping:ffff8880bef2ed00 index:0x0 compound_mapcount: 0
flags: 0x1000000000010200(slab|head)
raw: 1000000000010200 dead000000000100 dead000000000122 ffff8880bef2ed00
raw: 0000000000000000 0000000080270027 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88802ecd1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88802ecd1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802ecd1800: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
^
ffff88802ecd1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88802ecd1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- drivers/target/target_core_transport.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/target/target_core_transport.c +15 -0
@@ -584,6 +584,15 @@ void transport_free_session(struct se_session *se_sess) }EXPORT_SYMBOL (transport_free_session); +static int target_release_res (struct se_device *dev,void *data) +{ +struct se_session *sess = data; + +if (dev->reservation_holder == sess) +target_release_reservation (dev); +return 0 ; +} +void transport_deregister_session (struct se_session *se_sess) {struct se_portal_group *se_tpg = se_sess->se_tpg;
@@ -600,6 +609,12 @@ void transport_deregister_session(struct se_session *se_sess) se_sess->fabric_sess_ptr =NULL ;spin_unlock_irqrestore (&se_tpg->session_lock, flags); +/* +* Since the session is being removed, release SPC-2 +* reservations held by the session that is disappearing. +*/ +target_for_each_device (target_release_res, se_sess); +pr_debug ("TARGET_CORE[%s]: Deregistered fabric_sess\n" , se_tpg->se_tpg_tfo->fabric_name);/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 92/191 scsi: ufs: Fix up auto hibern8 enablement
In reply to Greg Kroah-HartmanFrom: Can Guo <[email protected]>
[ Upstream commit 71d848b8d97ec0f8e993d63cf9de6ac8b3f7c43d ]
Fix up possible unclocked register access to auto hibern8 register in resume path and through sysfs entry. Meanwhile, enable auto hibern8 only after device is fully initialized in probe path.
--- drivers/scsi/ufs/ufs-sysfs.c | 15 +++++++++------ drivers/scsi/ufs/ufshcd.c | 14 +++++++------- drivers/scsi/ufs/ufshcd.h | 2 ++ 3 files changed, 18 insertions(+), 13 deletions(-)
drivers/scsi/ufs/ufs-sysfs.c +9 -6
@@ -126,13 +126,16 @@ static void ufshcd_auto_hibern8_update(struct ufs_hba *hba, u32 ahit)return ;spin_lock_irqsave (hba->host->host_lock, flags); -if (hba->ahit == ahit) - goto out_unlock; - hba->ahit = ahit; -if (!pm_runtime_suspended (hba->dev)) -ufshcd_writel (hba, hba->ahit,REG_AUTO_HIBERNATE_IDLE_TIMER ); -out_unlock: +if (hba->ahit != ahit) + hba->ahit = ahit;spin_unlock_irqrestore (hba->host->host_lock, flags); +if (!pm_runtime_suspended (hba->dev)) { +pm_runtime_get_sync (hba->dev); +ufshcd_hold (hba, false); +ufshcd_auto_hibern8_enable (hba); +ufshcd_release (hba); +pm_runtime_put (hba->dev); + } }/* Convert Auto-Hibernate Idle Timer register value to microseconds */
drivers/scsi/ufs/ufshcd.c +7 -7
@@ -3950,7 +3950,7 @@ static int ufshcd_uic_hibern8_exit(struct ufs_hba *hba)return ret; } -static void ufshcd_auto_hibern8_enable (struct ufs_hba *hba) +void ufshcd_auto_hibern8_enable (struct ufs_hba *hba) {unsigned long flags;
@@ -6890,9 +6890,6 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)/* UniPro link is active now */ ufshcd_set_link_active (hba); -/* Enable Auto-Hibernate if configured */ -ufshcd_auto_hibern8_enable (hba); - ret =ufshcd_verify_dev_init (hba);if (ret) goto out;
@@ -6943,6 +6940,9 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)/* set the state as operational after switching to desired gear */ hba->ufshcd_state =UFSHCD_STATE_OPERATIONAL ; +/* Enable Auto-Hibernate if configured */ +ufshcd_auto_hibern8_enable (hba); +/* * If we are in error handling context or in power management callbacks * context, no need to scan the host
@@ -7959,12 +7959,12 @@ static int ufshcd_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)if (hba->clk_scaling.is_allowed)ufshcd_resume_clkscaling (hba); -/* Schedule clock gating in case of no access to UFS device yet */ -ufshcd_release (hba); -/* Enable Auto-Hibernate if configured */ ufshcd_auto_hibern8_enable (hba); +/* Schedule clock gating in case of no access to UFS device yet */ +ufshcd_release (hba); + goto out; set_old_link_state:
drivers/scsi/ufs/ufshcd.h +2 -0
@@ -916,6 +916,8 @@ int ufshcd_query_attr(struct ufs_hba *hba, enum query_opcode opcode,int ufshcd_query_flag (struct ufs_hba *hba,enum query_opcode opcode,enum flag_idn idn,bool *flag_res); +void ufshcd_auto_hibern8_enable (struct ufs_hba *hba); +#define SD_ASCII_STD true#define SD_RAW false int ufshcd_read_string_desc(struct ufs_hba *hba, u8 desc_index,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 93/191 scsi: iscsi: Dont send data to unbound connection
In reply to Greg Kroah-HartmanFrom: Anatol Pomazau <[email protected]>
[ Upstream commit 238191d65d7217982d69e21c1d623616da34b281 ]
If a faulty initiator fails to bind the socket to the iSCSI connection before emitting a command, for instance, a subsequent send_pdu, it will crash the kernel due to a null pointer dereference in sock_sendmsg(), as shown in the log below. This patch makes sure the bind succeeded before trying to use the socket.
BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.4.0-rc2.iscsi+ #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 24.158246] Workqueue: iscsi_q_0 iscsi_xmitworker [ 24.158883] RIP: 0010:apparmor_socket_sendmsg+0x5/0x20 [...] [ 24.161739] RSP: 0018:ffffab6440043ca0 EFLAGS: 00010282 [ 24.162400] RAX: ffffffff891c1c00 RBX: ffffffff89d53968 RCX: 0000000000000001 [ 24.163253] RDX: 0000000000000030 RSI: ffffab6440043d00 RDI: 0000000000000000 [ 24.164104] RBP: 0000000000000030 R08: 0000000000000030 R09: 0000000000000030 [ 24.165166] R10: ffffffff893e66a0 R11: 0000000000000018 R12: ffffab6440043d00 [ 24.166038] R13: 0000000000000000 R14: 0000000000000000 R15: ffff9d5575a62e90 [ 24.166919] FS: 0000000000000000(0000) GS:ffff9d557db80000(0000) knlGS:0000000000000000 [ 24.167890] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.168587] CR2: 0000000000000018 CR3: 000000007a838000 CR4: 00000000000006e0 [ 24.169451] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.170320] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.171214] Call Trace: [ 24.171537] security_socket_sendmsg+0x3a/0x50 [ 24.172079] sock_sendmsg+0x16/0x60 [ 24.172506] iscsi_sw_tcp_xmit_segment+0x77/0x120 [ 24.173076] iscsi_sw_tcp_pdu_xmit+0x58/0x170 [ 24.173604] ? iscsi_dbg_trace+0x63/0x80 [ 24.174087] iscsi_tcp_task_xmit+0x101/0x280 [ 24.174666] iscsi_xmit_task+0x83/0x110 [ 24.175206] iscsi_xmitworker+0x57/0x380 [ 24.175757] ? __schedule+0x2a2/0x700 [ 24.176273] process_one_work+0x1b5/0x360 [ 24.176837] worker_thread+0x50/0x3c0 [ 24.177353] kthread+0xf9/0x130 [ 24.177799] ? process_one_work+0x360/0x360 [ 24.178401] ? kthread_park+0x90/0x90 [ 24.178915] ret_from_fork+0x35/0x40 [ 24.179421] Modules linked in: [ 24.179856] CR2: 0000000000000018 [ 24.180327] ---[ end trace b4b7674b6df5f480 ]---
--- drivers/scsi/iscsi_tcp.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/scsi/iscsi_tcp.c +8 -0
@@ -369,8 +369,16 @@ static int iscsi_sw_tcp_pdu_xmit(struct iscsi_task *task) {struct iscsi_conn *conn = task->conn;unsigned int noreclaim_flag; +struct iscsi_tcp_conn *tcp_conn = conn->dd_data; +struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data;int rc =0 ; +if (!tcp_sw_conn->sock) { +iscsi_conn_printk (KERN_ERR , conn, +"Transport not bound to socket!\n" ); +return -EINVAL ; + } + noreclaim_flag =memalloc_noreclaim_save ();while (iscsi_sw_tcp_xmit_qlen (conn)) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 94/191 scsi: target: iscsi: Wait for all commands to finish before freeing a session
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit e9d3009cb936bd0faf0719f68d98ad8afb1e613b ]
The iSCSI target driver is the only target driver that does not wait for ongoing commands to finish before freeing a session. Make the iSCSI target driver wait for ongoing commands to finish before freeing a session. This patch fixes the following KASAN complaint:
BUG: KASAN: use-after-free in __lock_acquire+0xb1a/0x2710
Read of size 8 at addr ffff8881154eca70 by task kworker/0:2/247
CPU: 0 PID: 247 Comm: kworker/0:2 Not tainted 5.4.0-rc1-dbg+ #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: target_completion target_complete_ok_work [target_core_mod]
Call Trace:
dump_stack+0x8a/0xd6
print_address_description.constprop.0+0x40/0x60
__kasan_report.cold+0x1b/0x33
kasan_report+0x16/0x20
__asan_load8+0x58/0x90
__lock_acquire+0xb1a/0x2710
lock_acquire+0xd3/0x200
_raw_spin_lock_irqsave+0x43/0x60
target_release_cmd_kref+0x162/0x7f0 [target_core_mod]
target_put_sess_cmd+0x2e/0x40 [target_core_mod]
lio_check_stop_free+0x12/0x20 [iscsi_target_mod]
transport_cmd_check_stop_to_fabric+0xd8/0xe0 [target_core_mod]
target_complete_ok_work+0x1b0/0x790 [target_core_mod]
process_one_work+0x549/0xa40
worker_thread+0x7a/0x5d0
kthread+0x1bc/0x210
ret_from_fork+0x24/0x30
Allocated by task 889:
save_stack+0x23/0x90
__kasan_kmalloc.constprop.0+0xcf/0xe0
kasan_slab_alloc+0x12/0x20
kmem_cache_alloc+0xf6/0x360
transport_alloc_session+0x29/0x80 [target_core_mod]
iscsi_target_login_thread+0xcd6/0x18f0 [iscsi_target_mod]
kthread+0x1bc/0x210
ret_from_fork+0x24/0x30
Freed by task 1025:
save_stack+0x23/0x90
__kasan_slab_free+0x13a/0x190
kasan_slab_free+0x12/0x20
kmem_cache_free+0x146/0x400
transport_free_session+0x179/0x2f0 [target_core_mod]
transport_deregister_session+0x130/0x180 [target_core_mod]
iscsit_close_session+0x12c/0x350 [iscsi_target_mod]
iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod]
iscsit_response_queue+0x8de/0xbe0 [iscsi_target_mod]
iscsi_target_tx_thread+0x27f/0x370 [iscsi_target_mod]
kthread+0x1bc/0x210
ret_from_fork+0x24/0x30
The buggy address belongs to the object at ffff8881154ec9c0
which belongs to the cache se_sess_cache of size 352
The buggy address is located 176 bytes inside of
352-byte region [ffff8881154ec9c0, ffff8881154ecb20)
The buggy address belongs to the page:
page:ffffea0004553b00 refcount:1 mapcount:0 mapping:ffff888101755400 index:0x0 compound_mapcount: 0
flags: 0x2fff000000010200(slab|head)
raw: 2fff000000010200 dead000000000100 dead000000000122 ffff888101755400
raw: 0000000000000000 0000000080130013 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881154ec900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881154ec980: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
>ffff8881154eca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881154eca80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881154ecb00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc--- drivers/target/iscsi/iscsi_target.c | 10 ++++++++-- include/scsi/iscsi_proto.h | 1 + 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/target/iscsi/iscsi_target.c +8 -2
@@ -1165,7 +1165,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, hdr->cmdsn,be32_to_cpu (hdr->data_length), payload_length, conn->cid); -target_get_sess_cmd (&cmd->se_cmd, true); +if (target_get_sess_cmd (&cmd->se_cmd, true) <0 ) +return iscsit_add_reject_cmd (cmd, +ISCSI_REASON_WAITING_FOR_LOGOUT , buf); cmd->sense_reason =transport_lookup_cmd_lun (&cmd->se_cmd,scsilun_to_int (&hdr->lun));
@@ -2002,7 +2004,9 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, conn->sess->se_sess,0 ,DMA_NONE , TCM_SIMPLE_TAG, cmd->sense_buffer + 2); -target_get_sess_cmd (&cmd->se_cmd, true); +if (target_get_sess_cmd (&cmd->se_cmd, true) <0 ) +return iscsit_add_reject_cmd (cmd, +ISCSI_REASON_WAITING_FOR_LOGOUT , buf);/* * TASK_REASSIGN for ERL=2 / connection stays inside of
@@ -4232,6 +4236,8 @@ int iscsit_close_connection(* must wait until they have completed. */ iscsit_check_conn_usage_count (conn); +target_sess_cmd_list_set_waiting (sess->se_sess); +target_wait_for_sess_cmds (sess->se_sess);ahash_request_free (conn->conn_tx_hash);if (conn->conn_rx_hash) {
include/scsi/iscsi_proto.h +1 -0
@@ -627,6 +627,7 @@ struct iscsi_reject {#define ISCSI_REASON_BOOKMARK_INVALID 9#define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10#define ISCSI_REASON_NEGOTIATION_RESET 11 +#define ISCSI_REASON_WAITING_FOR_LOGOUT 12/* Max. number of Key=Value pairs in a text message */ #define MAX_KEY_VALUE_PAIRS 8192
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 95/191 f2fs: Fix deadlock in f2fs_gc() context during atomic files handling
In reply to Greg Kroah-HartmanFrom: Sahitya Tummala <[email protected]>
[ Upstream commit 677017d196ba2a4cfff13626b951cc9a206b8c7c ]
The FS got stuck in the below stack when the storage is almost full/dirty condition (when FG_GC is being done).
schedule_timeoutio_schedule_timeoutcongestion_waitf2fs_drop_inmem_pages_allf2fs_gcf2fs_balance_fs__write_node_pagef2fs_fsync_node_pagesf2fs_do_sync_filef2fs_ioctl
The root cause for this issue is there is a potential infinite loop in f2fs_drop_inmem_pages_all() for the case where gc_failure is true and when there an inode whose i_gc_failures[GC_FAILURE_ATOMIC] is not set. Fix this by keeping track of the total atomic files currently opened and using that to exit from this condition.
--- fs/f2fs/f2fs.h | 1 + fs/f2fs/file.c | 1 + fs/f2fs/segment.c | 21 +++++++++++++++------ 3 files changed, 17 insertions(+), 6 deletions(-)
fs/f2fs/f2fs.h +1 -0
@@ -1289,6 +1289,7 @@ struct f2fs_sb_info {unsigned int gc_mode;/* current GC state */ unsigned int next_victim_seg[2 ];/* next segment in victim section */ /* for skip statistic */ +unsigned int atomic_files;/* # of opened atomic file */ unsigned long long skipped_atomic_files[2 ];/* FG_GC and BG_GC */ unsigned long long skipped_gc_rwsem;/* FG_GC only */
fs/f2fs/file.c +1 -0
@@ -1890,6 +1890,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)spin_lock (&sbi->inode_lock[ATOMIC_FILE ]);if (list_empty (&fi->inmem_ilist))list_add_tail (&fi->inmem_ilist, &sbi->inode_list[ATOMIC_FILE ]); + sbi->atomic_files++;spin_unlock (&sbi->inode_lock[ATOMIC_FILE ]);/* add inode in inmem_list first and set atomic_file */
fs/f2fs/segment.c +15 -6
@@ -288,6 +288,8 @@ void f2fs_drop_inmem_pages_all(struct f2fs_sb_info *sbi, bool gc_failure)struct list_head *head = &sbi->inode_list[ATOMIC_FILE ];struct inode *inode;struct f2fs_inode_info *fi; +unsigned int count = sbi->atomic_files; +unsigned int looped =0 ; next:spin_lock (&sbi->inode_lock[ATOMIC_FILE ]);if (list_empty (head)) {
@@ -296,22 +298,26 @@ next: } fi = list_first_entry(head, struct f2fs_inode_info, inmem_ilist); inode =igrab (&fi->vfs_inode); +if (inode) +list_move_tail (&fi->inmem_ilist, head);spin_unlock (&sbi->inode_lock[ATOMIC_FILE ]);if (inode) {if (gc_failure) { -if (fi->i_gc_failures[GC_FAILURE_ATOMIC ]) - goto drop; - goto skip; +if (!fi->i_gc_failures[GC_FAILURE_ATOMIC ]) + goto skip; } -drop:set_inode_flag (inode,FI_ATOMIC_REVOKE_REQUEST );f2fs_drop_inmem_pages (inode); +skip:iput (inode); } -skip:congestion_wait (BLK_RW_ASYNC ,HZ /50 );cond_resched (); +if (gc_failure) { +if (++looped >= count) +return ; + } goto next; }
@@ -327,13 +333,16 @@ void f2fs_drop_inmem_pages(struct inode *inode)mutex_unlock (&fi->inmem_lock); } -clear_inode_flag (inode,FI_ATOMIC_FILE ); fi->i_gc_failures[GC_FAILURE_ATOMIC ] =0 ;stat_dec_atomic_write (inode);spin_lock (&sbi->inode_lock[ATOMIC_FILE ]);if (!list_empty (&fi->inmem_ilist))list_del_init (&fi->inmem_ilist); +if (f2fs_is_atomic_file (inode)) { +clear_inode_flag (inode,FI_ATOMIC_FILE ); + sbi->atomic_files--; + }spin_unlock (&sbi->inode_lock[ATOMIC_FILE ]); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 96/191 habanalabs: skip VA block list update in reset flow
In reply to Greg Kroah-HartmanFrom: Omer Shpigelman <[email protected]>
[ Upstream commit 71c5e55e7c077fa17c42fbda91a8d14322825c44 ]
Reduce context close time by skipping the VA block free list update in order to avoid hard reset with open contexts.
Reset with open contexts can potentially lead to a kernel crash as the generic pool of the MMU hops is destroyed while it is not empty because some unmap operations are not done.
The commit affect mainly when running on simulator.
--- drivers/misc/habanalabs/memory.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-)
drivers/misc/habanalabs/memory.c +20 -10
@@ -965,17 +965,19 @@ init_page_pack_err:* * @ctx : current context * @vaddr : device virtual address to unmap +* @ctx_free : true if in context free flow, false otherwise. * * This function does the following: * - Unmap the physical pages related to the given virtual address * - return the device virtual block to the virtual block list */ -static int unmap_device_va (struct hl_ctx *ctx,u64 vaddr) +static int unmap_device_va (struct hl_ctx *ctx,u64 vaddr,bool ctx_free) {struct hl_device *hdev = ctx->hdev;struct hl_vm_phys_pg_pack *phys_pg_pack =NULL ;struct hl_vm_hash_node *hnode =NULL ;struct hl_userptr *userptr =NULL ; +struct hl_va_range *va_range;enum vm_type_t *vm_type;u64 next_vaddr, i;u32 page_size;
@@ -1003,6 +1005,7 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr)if (*vm_type ==VM_TYPE_USERPTR ) { is_userptr = true; + va_range = &ctx->host_va_range; userptr = hnode->ptr; rc =init_phys_pg_pack_from_userptr (ctx, userptr, &phys_pg_pack);
@@ -1014,6 +1017,7 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr) } }else if (*vm_type ==VM_TYPE_PHYS_PACK ) { is_userptr = false; + va_range = &ctx->dram_va_range; phys_pg_pack = hnode->ptr; }else { dev_warn(hdev->dev,
@@ -1052,12 +1056,18 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr)mutex_unlock (&ctx->mmu_lock); -if (add_va_block (hdev, - is_userptr ? &ctx->host_va_range : &ctx->dram_va_range, - vaddr, - vaddr + phys_pg_pack->total_size -1 )) -dev_warn (hdev->dev,"add va block failed for vaddr: 0x%llx\n" , - vaddr); +/* +* No point in maintaining the free VA block list if the context is +* closing as the list will be freed anyway +*/ +if (!ctx_free) { + rc =add_va_block (hdev, va_range, vaddr, + vaddr + phys_pg_pack->total_size -1 ); +if (rc) +dev_warn (hdev->dev, +"add va block failed for vaddr: 0x%llx\n" , + vaddr); + }atomic_dec (&phys_pg_pack->mapping_cnt);kfree (hnode);
@@ -1189,8 +1199,8 @@ int hl_mem_ioctl(struct hl_fpriv *hpriv, void *data)break ;case HL_MEM_OP_UNMAP : - rc =unmap_device_va (ctx, - args->in.unmap.device_virt_addr); + rc =unmap_device_va (ctx, args->in.unmap.device_virt_addr, + false);break ;default :
@@ -1620,7 +1630,7 @@ void hl_vm_ctx_fini(struct hl_ctx *ctx)dev_dbg (hdev->dev,"hl_mem_hash_node of vaddr 0x%llx of asid %d is still alive\n" , hnode->vaddr, ctx->asid); -unmap_device_va (ctx, hnode->vaddr); +unmap_device_va (ctx, hnode->vaddr, true); }spin_lock (&vm->idr_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 97/191 gpio/mpc8xxx: fix qoriq GPIO reading
In reply to Greg Kroah-HartmanFrom: Russell King <[email protected]>
[ Upstream commit 787b64a43f7acacf8099329ea08872e663f1e74f ]
Qoriq requires the IBE register to be set to enable GPIO inputs to be read. Set it.
--- drivers/gpio/gpio-mpc8xxx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpio/gpio-mpc8xxx.c +3 -0
@@ -386,6 +386,9 @@ static int mpc8xxx_probe(struct platform_device *pdev) gc->to_irq = mpc8xxx_gpio_to_irq; +if (of_device_is_compatible (np,"fsl,qoriq-gpio" )) + gc->write_reg (mpc8xxx_gc->regs +GPIO_IBE ,0xffffffff ); + ret =gpiochip_add_data (gc, mpc8xxx_gc);if (ret) { pr_err("%pOF: GPIO chip registration failed with status %d\n",
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 98/191 platform/x86: intel_pmc_core: Fix the SoC naming inconsistency
In reply to Greg Kroah-HartmanFrom: Gayatri Kammela <[email protected]>
[ Upstream commit 43e82d8aa92503d264309fb648b251b2d85caf1a ]
Intel's SoCs follow a naming convention which spells out the SoC name as two words instead of one word (E.g: Cannon Lake vs Cannonlake). Thus fix the naming inconsistency across the intel_pmc_core driver, so future SoCs can follow the naming consistency as below.
Cometlake -> Comet Lake
Tigerlake -> Tiger Lake
Elkhartlake -> Elkhart Lake
--- drivers/platform/x86/intel_pmc_core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/platform/x86/intel_pmc_core.c +7 -7
@@ -158,7 +158,7 @@ static const struct pmc_reg_map spt_reg_map = { .pm_vric1_offset = SPT_PMC_VRIC1_OFFSET, }; -/* Cannonlake: PGD PFET Enable Ack Status Register(s) bitmap */ +/* Cannon Lake: PGD PFET Enable Ack Status Register(s) bitmap */ static const struct pmc_bit_map cnp_pfear_map[] = { {"PMC" ,BIT (0 )}, {"OPI-DMI" ,BIT (1 )},
@@ -185,7 +185,7 @@ static const struct pmc_bit_map cnp_pfear_map[] = { {"SDX", BIT(4)}, {"SPE", BIT(5)}, {"Fuse", BIT(6)}, -/* Reserved for Cannonlake but valid for Icelake */ +/* Reserved for Cannon Lake but valid for Ice Lake */ {"SBR8", BIT(7)}, {"CSME_FSC", BIT(0)},
@@ -229,12 +229,12 @@ static const struct pmc_bit_map cnp_pfear_map[] = { {"HDA_PGD4", BIT(2)}, {"HDA_PGD5", BIT(3)}, {"HDA_PGD6", BIT(4)}, -/* Reserved for Cannonlake but valid for Icelake */ +/* Reserved for Cannon Lake but valid for Ice Lake */ {"PSF6", BIT(5)}, {"PSF7", BIT(6)}, {"PSF8", BIT(7)}, -/* Icelake generation onwards only */ +/* Ice Lake generation onwards only */ {"RES_65", BIT(0)}, {"RES_66", BIT(1)}, {"RES_67", BIT(2)},
@@ -324,7 +324,7 @@ static const struct pmc_bit_map cnp_ltr_show_map[] = { {"ISH", CNP_PMC_LTR_ISH}, {"UFSX2", CNP_PMC_LTR_UFSX2}, {"EMMC", CNP_PMC_LTR_EMMC}, -/* Reserved for Cannonlake but valid for Icelake */ +/* Reserved for Cannon Lake but valid for Ice Lake */ {"WIGIG", ICL_PMC_LTR_WIGIG},/* Below two cannot be used for LTR_IGNORE */ {"CURRENT_PLATFORM", CNP_PMC_LTR_CUR_PLT},
@@ -871,8 +871,8 @@ static int pmc_core_probe(struct platform_device *pdev) pmcdev->map = (struct pmc_reg_map *)cpu_id->driver_data;/* -* Coffeelake has CPU ID of Kabylake and Cannonlake PCH. So here -* Sunrisepoint PCH regmap can't be used. Use Cannonlake PCH regmap +* Coffee Lake has CPU ID of Kaby Lake and Cannon Lake PCH. So here +* Sunrisepoint PCH regmap can't be used. Use Cannon Lake PCH regmap * in this case. */ if (pmcdev->map == &spt_reg_map && !pci_dev_present (pmc_pci_ids))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 99/191 platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support to intel_pmc_core driver
In reply to Greg Kroah-HartmanFrom: Gayatri Kammela <[email protected]>
[ Upstream commit 5406327d43edd9a171bd260f49c752d148727eaf ]
Add Comet Lake to the list of the platforms that intel_pmc_core driver supports for pmc_core device.
Just like Ice Lake, Comet Lake can also reuse all the Cannon Lake PCH IPs. No additional effort is needed to enable but to simply reuse them.
--- drivers/platform/x86/intel_pmc_core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/platform/x86/intel_pmc_core.c +5 -2
@@ -160,6 +160,7 @@ static const struct pmc_reg_map spt_reg_map = {/* Cannon Lake: PGD PFET Enable Ack Status Register(s) bitmap */ static const struct pmc_bit_map cnp_pfear_map[] = { +/* Reserved for Cannon Lake but valid for Comet Lake */ {"PMC" ,BIT (0 )}, {"OPI-DMI" ,BIT (1 )}, {"SPI/eSPI" ,BIT (2 )},
@@ -185,7 +186,7 @@ static const struct pmc_bit_map cnp_pfear_map[] = { {"SDX", BIT(4)}, {"SPE", BIT(5)}, {"Fuse", BIT(6)}, -/* Reserved for Cannon Lake but valid for Ice Lake */ +/* Reserved for Cannon Lake but valid for Ice Lake and Comet Lake */ {"SBR8", BIT(7)}, {"CSME_FSC", BIT(0)},
@@ -229,7 +230,7 @@ static const struct pmc_bit_map cnp_pfear_map[] = { {"HDA_PGD4", BIT(2)}, {"HDA_PGD5", BIT(3)}, {"HDA_PGD6", BIT(4)}, -/* Reserved for Cannon Lake but valid for Ice Lake */ +/* Reserved for Cannon Lake but valid for Ice Lake and Comet Lake */ {"PSF6", BIT(5)}, {"PSF7", BIT(6)}, {"PSF8", BIT(7)},
@@ -813,6 +814,8 @@ static const struct x86_cpu_id intel_pmc_core_ids[] = {INTEL_CPU_FAM6 (CANNONLAKE_L , cnp_reg_map),INTEL_CPU_FAM6 (ICELAKE_L , icl_reg_map),INTEL_CPU_FAM6 (ICELAKE_NNPI , icl_reg_map), +INTEL_CPU_FAM6 (COMETLAKE , cnp_reg_map), + INTEL_CPU_FAM6(COMETLAKE_L, cnp_reg_map), {} };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 100/191 gpio: mpc8xxx: Dont overwrite default irq_set_type callback
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 4e50573f39229d5e9c985fa3b4923a8b29619ade ]
The per-SoC devtype structures can contain their own callbacks that overwrite mpc8xxx_gpio_devtype_default.
The clear intention is that mpc8xxx_irq_set_type is used in case the SoC does not specify a more specific callback. But what happens is that if the SoC doesn't specify one, its .irq_set_type is de-facto NULL, and this overwrites mpc8xxx_irq_set_type to a no-op. This means that the following SoCs are affected:
- fsl,mpc8572-gpio
- fsl,ls1028a-gpio
- fsl,ls1088a-gpio
On these boards, the irq_set_type does exactly nothing, and the GPIO controller keeps its GPICR register in the hardware-default state. On the LS1028A, that is ACTIVE_BOTH, which means 2 interrupts are raised even if the IRQ client requests LEVEL_HIGH. Another implication is that the IRQs are not checked (e.g. level-triggered interrupts are not rejected, although they are not supported).
--- drivers/gpio/gpio-mpc8xxx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpio/gpio-mpc8xxx.c +2 -1
@@ -377,7 +377,8 @@ static int mpc8xxx_probe(struct platform_device *pdev)* It's assumed that only a single type of gpio controller is available * on the current machine, so overwriting global data is fine. */ - mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type; +if (devtype->irq_set_type) + mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type;if (devtype->gpio_dir_out) gc->direction_output = devtype->gpio_dir_out;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 101/191 gpio: lynxpoint: Setup correct IRQ handlers
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit e272f7ec070d212b9301d5a465bc8952f8dcf908 ]
When commit 75e99bf5ed8f ("gpio: lynxpoint: set default handler to be handle_bad_irq()") switched default handler to be handle_bad_irq() the lp_irq_type() function remained untouched. It means that even request_irq() can't change the handler and we are not able to handle IRQs properly anymore. Fix it by setting correct handlers in the lp_irq_type() callback.
--- drivers/gpio/gpio-lynxpoint.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpio/gpio-lynxpoint.c +6 -0
@@ -164,6 +164,12 @@ static int lp_irq_type(struct irq_data *d, unsigned type) value |=TRIG_SEL_BIT |INT_INV_BIT ;outl (value, reg); + +if (type &IRQ_TYPE_EDGE_BOTH ) +irq_set_handler_locked (d, handle_edge_irq); +else if (type &IRQ_TYPE_LEVEL_MASK ) +irq_set_handler_locked (d, handle_level_irq); +spin_unlock_irqrestore (&lg->lock, flags);return 0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 102/191 tools/power/x86/intel-speed-select: Ignore missing config level
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
[ Upstream commit 20183ccd3e4d01d23b0a01fe9f3ee73fbae312fa ]
It is possible that certain config levels are not available, even if the max level includes the level. There can be missing levels in some platforms. So ignore the level when called for information dump for all levels and fail if specifically ask for the missing level.
Here the changes is to continue reading information about other levels even if we fail to get information for the current level. But use the "processed" flag to indicate the failure. When the "processed" flag is not set, don't dump information about that level.
--- tools/power/x86/intel-speed-select/isst-core.c | 8 ++++---- tools/power/x86/intel-speed-select/isst-display.c | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-)
tools/power/x86/intel-speed-select/isst-core.c +4 -4
@@ -553,7 +553,6 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) i); ctdp_level = &pkg_dev->ctdp_level[i]; - ctdp_level->processed =1 ; ctdp_level->level = i; ctdp_level->control_cpu = cpu; ctdp_level->pkg_id =get_physical_package_id (cpu);
@@ -561,7 +560,10 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) ret =isst_get_ctdp_control (cpu, i, ctdp_level);if (ret) -return ret; +continue ; + + pkg_dev->processed =1 ; + ctdp_level->processed =1 ; ret =isst_get_tdp_info (cpu, i, ctdp_level);if (ret)
@@ -614,8 +616,6 @@ int isst_get_process_ctdp(int cpu, int tdp_level, struct isst_pkg_ctdp *pkg_dev) } } - pkg_dev->processed =1 ; -return 0 ; }
tools/power/x86/intel-speed-select/isst-display.c +2 -1
@@ -314,7 +314,8 @@ void isst_ctdp_display_information(int cpu, FILE *outf, int tdp_level,char value[256 ];int i, base_level =1 ; -print_package_info (cpu, outf); +if (pkg_dev->processed) +print_package_info (cpu, outf);for (i =0 ; i <= pkg_dev->levels; ++i) {struct isst_pkg_ctdp_level_info *ctdp_level;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 103/191 Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
[ Upstream commit 7a1323b5dfe44a9013a2cc56ef2973034a00bf88 ]
The crash handler calls hv_synic_cleanup() to shutdown the Hyper-V synthetic interrupt controller. But if the CPU that calls hv_synic_cleanup() has a VMbus channel interrupt assigned to it (which is likely the case in smaller VM sizes), hv_synic_cleanup() returns an error and the synthetic interrupt controller isn't shutdown. While the lack of being shutdown hasn't caused a known problem, it still should be fixed for highest reliability.
So directly call hv_synic_disable_regs() instead of hv_synic_cleanup(), which ensures that the synic is always shutdown.
--- drivers/hv/vmbus_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hv/vmbus_drv.c +1 -1
@@ -2308,7 +2308,7 @@ static void hv_crash_handler(struct pt_regs *regs) vmbus_connection.conn_state =DISCONNECTED ; cpu =smp_processor_id ();hv_stimer_cleanup (cpu); -hv_synic_cleanup (cpu); +hv_synic_disable_regs (cpu);hyperv_cleanup (); };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 104/191 apparmor: fix unsigned len comparison with less than zero
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 00e0590dbaec6f1bcaa36a85467d7e3497ced522 ]
The sanity check in macro update_for_len checks to see if len is less than zero, however, len is a size_t so it can never be less than zero, so this sanity check is a no-op. Fix this by making len a ssize_t so the comparison will work and add ulen that is a size_t copy of len so that the min() macro won't throw warnings about comparing different types.
Addresses-Coverity: ("Macro compares unsigned to 0")
--- security/apparmor/label.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
security/apparmor/label.c +7 -5
@@ -1458,11 +1458,13 @@ static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,/* helper macro for snprint routines */ #define update_for_len (total, len, size, str) \ do { \ + size_t ulen = len; \ + \ AA_BUG(len < 0); \ - total += len; \ - len = min(len, size); \ - size -= len; \ - str += len; \ + total += ulen; \ + ulen = min(ulen, size); \ + size -= ulen; \ + str += ulen; \ } while (0)/**
@@ -1597,7 +1599,7 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,struct aa_ns *prev_ns =NULL ;struct label_it i;int count =0 , total =0 ; -size_t len; +ssize_t len;AA_BUG (!str && size !=0 );AA_BUG (!label);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 105/191 drm/amdgpu: Call find_vma under mmap_sem
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit a9ae8731e6e52829a935d81a65d7f925cb95dbac ]
find_vma() must be called under the mmap_sem, reorganize this code to do the vma check after entering the lock.
Further, fix the unlocked use of struct task_struct's mm, instead use the mm from hmm_mirror which has an active mm_grab. Also the mm_grab must be converted to a mm_get before acquiring mmap_sem or calling find_vma().
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 37 ++++++++++++++----------- 1 file changed, 21 insertions(+), 16 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +21 -16
@@ -35,6 +35,7 @@#include <linux/hmm.h> #include <linux/pagemap.h> #include <linux/sched/task.h> +#include <linux/sched/mm.h> #include <linux/seq_file.h> #include <linux/slab.h> #include <linux/swap.h>
@@ -788,7 +789,7 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages)struct hmm_mirror *mirror = bo->mn ? &bo->mn->mirror :NULL ;struct ttm_tt *ttm = bo->tbo.ttm;struct amdgpu_ttm_tt *gtt = (void *)ttm; -struct mm_struct *mm = gtt->usertask->mm; +struct mm_struct *mm;unsigned long start = gtt->userptr;struct vm_area_struct *vma;struct hmm_range *range;
@@ -796,25 +797,14 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages)uint64_t *pfns;int r =0 ; -if (!mm)/* Happens during process shutdown */ -return -ESRCH ; -if (unlikely (!mirror)) {DRM_DEBUG_DRIVER ("Failed to get hmm_mirror\n" ); - r = -EFAULT ; - goto out; +return -EFAULT ; } - vma =find_vma (mm, start); -if (unlikely (!vma || start < vma->vm_start)) { - r = -EFAULT ; - goto out; - } -if (unlikely ((gtt->userflags &AMDGPU_GEM_USERPTR_ANONONLY ) && - vma->vm_file)) { - r = -EPERM ; - goto out; - } + mm = mirror->hmm->mmu_notifier.mm; +if (!mmget_not_zero (mm))/* Happens during process shutdown */ +return -ESRCH ; range =kzalloc (sizeof (*range),GFP_KERNEL );if (unlikely (!range)) {
@@ -847,6 +837,17 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages)hmm_range_wait_until_valid (range,HMM_RANGE_DEFAULT_TIMEOUT );down_read (&mm->mmap_sem); + vma =find_vma (mm, start); +if (unlikely (!vma || start < vma->vm_start)) { + r = -EFAULT ; + goto out_unlock; + } +if (unlikely ((gtt->userflags &AMDGPU_GEM_USERPTR_ANONONLY ) && + vma->vm_file)) { + r = -EPERM ; + goto out_unlock; + } + r =hmm_range_fault (range,0 );up_read (&mm->mmap_sem);
@@ -865,15 +866,19 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo, struct page **pages) } gtt->range = range; +mmput (mm);return 0 ; +out_unlock: +up_read (&mm->mmap_sem); out_free_pfns:hmm_range_unregister (range);kvfree (pfns); out_free_ranges:kfree (range); out: +mmput (mm);return r; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 106/191 scripts/kallsyms: fix definitely-lost memory leak
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 21915eca088dc271c970e8351290e83d938114ac ]
build_initial_tok_table() overwrites unused sym_entry to shrink the table size. Before the entry is overwritten, table[i].sym must be freed since it is malloc'ed data.
This fixes the 'definitely lost' report from valgrind. I ran valgrind against x86_64_defconfig of v5.4-rc8 kernel, and here is the summary:
[Before the fix]
LEAK SUMMARY:
definitely lost: 53,184 bytes in 2,874 blocks
[After the fix]
LEAK SUMMARY:
definitely lost: 0 bytes in 0 blocks
--- scripts/kallsyms.c | 2 ++ 1 file changed, 2 insertions(+)
scripts/kallsyms.c +2 -0
@@ -489,6 +489,8 @@ static void build_initial_tok_table(void) table[pos] = table[i];learn_symbol (table[pos].sym, table[pos].len); pos++; + }else { +free (table[i].sym); } } table_cnt = pos;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 107/191 powerpc: Dont add -mabi= flags when building with Clang
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 465bfd9c44dea6b55962b5788a23ac87a467c923 ]
When building pseries_defconfig, building vdso32 errors out:
error: unknown target ABI 'elfv1'
This happens because -m32 in clang changes the target to 32-bit, which does not allow the ABI to be changed.
Commit 4dc831aa8813 ("powerpc: Fix compiling a BE kernel with a powerpc64le toolchain") added these flags to fix building big endian kernels with a little endian GCC.
Clang doesn't need -mabi because the target triple controls the default value. -mlittle-endian and -mbig-endian manipulate the triple into either powerpc64-* or powerpc64le-*, which properly sets the default ABI.
Adding a debug print out in the PPC64TargetInfo constructor after line 383 above shows this:
$ echo | ./clang -E --target=powerpc64-linux -mbig-endian -o /dev/null - Default ABI: elfv1
$ echo | ./clang -E --target=powerpc64-linux -mlittle-endian -o /dev/null - Default ABI: elfv2
$ echo | ./clang -E --target=powerpc64le-linux -mbig-endian -o /dev/null - Default ABI: elfv1
$ echo | ./clang -E --target=powerpc64le-linux -mlittle-endian -o /dev/null - Default ABI: elfv2
Don't specify -mabi when building with clang to avoid the build error with -m32 and not change any code generation.
-mcall-aixdesc is not an implemented flag in clang so it can be safely excluded as well, see commit 238abecde8ad ("powerpc: Don't use gcc specific options on clang").
pseries_defconfig successfully builds after this patch and powernv_defconfig and ppc44x_defconfig don't regress.
--- arch/powerpc/Makefile | 4 ++++ 1 file changed, 4 insertions(+)
arch/powerpc/Makefile +4 -0
@@ -91,11 +91,13 @@ MULTIPLEWORD := -mmultiple endif ifdef CONFIG_PPC64 +ifndef CONFIG_CC_IS_CLANG cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mcall-aixdesc) aflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mabi=elfv2 endif +endif ifndef CONFIG_CC_IS_CLANG cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mno-strict-align
@@ -141,6 +143,7 @@ endif endif CFLAGS-$(CONFIG_PPC64) := $(call cc-option,-mtraceback=no) +ifndef CONFIG_CC_IS_CLANG ifdef CONFIG_CPU_LITTLE_ENDIAN CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc)) AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2)
@@ -149,6 +152,7 @@ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcall-aixdesc) AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) endif +endif CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc)) CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 108/191 f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project()
In reply to Greg Kroah-HartmanFrom: Chengguang Xu <[email protected]>
[ Upstream commit 909110c060f22e65756659ec6fa957ae75777e00 ]
Setting softlimit larger than hardlimit seems meaningless for disk quota but currently it is allowed. In this case, there may be a bit of comfusion for users when they run df comamnd to directory which has project quota.
For example, we set 20M softlimit and 10M hardlimit of block usage limit for project quota of test_dir(project id 123).
[root@hades f2fs]# repquota -P -a
*** Report for project quotas on device /dev/nvme0n1p8 Block grace time: 7days; Inode grace time: 7days Block limits File limits
Project used soft hard grace used soft hard grace
----------------------------------------------------------------------
0 -- 4 0 0 1 0 0
123 +- 10248 20480 10240 2 0 0
The result of df command as below:
[root@hades f2fs]# df -h /mnt/f2fs/test
Filesystem Size Used Avail Use% Mounted on/dev/nvme0n1p8 20M 11M 10M 51% /mnt/f2fs
Even though it looks like there is another 10M free space to use, if we write new data to diretory test(inherit project id), the write will fail with errno(-EDQUOT).
After this patch, the df result looks like below.
[root@hades f2fs]# df -h /mnt/f2fs/test
Filesystem Size Used Avail Use% Mounted on/dev/nvme0n1p8 10M 10M 0 100% /mnt/f2fs
--- fs/f2fs/super.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
fs/f2fs/super.c +14 -6
@@ -1213,9 +1213,13 @@ static int f2fs_statfs_project(struct super_block *sb,return PTR_ERR (dquot);spin_lock (&dquot->dq_dqb_lock); - limit = (dquot->dq_dqb.dqb_bsoftlimit ? - dquot->dq_dqb.dqb_bsoftlimit : - dquot->dq_dqb.dqb_bhardlimit) >> sb->s_blocksize_bits; + limit =0 ; +if (dquot->dq_dqb.dqb_bsoftlimit) + limit = dquot->dq_dqb.dqb_bsoftlimit; +if (dquot->dq_dqb.dqb_bhardlimit && + (!limit || dquot->dq_dqb.dqb_bhardlimit < limit)) + limit = dquot->dq_dqb.dqb_bhardlimit; +if (limit && buf->f_blocks > limit) { curblock = dquot->dq_dqb.dqb_curspace >> sb->s_blocksize_bits; buf->f_blocks = limit;
@@ -1224,9 +1228,13 @@ static int f2fs_statfs_project(struct super_block *sb, (buf->f_blocks - curblock) : 0; } - limit = dquot->dq_dqb.dqb_isoftlimit ? - dquot->dq_dqb.dqb_isoftlimit : - dquot->dq_dqb.dqb_ihardlimit; + limit =0 ; +if (dquot->dq_dqb.dqb_isoftlimit) + limit = dquot->dq_dqb.dqb_isoftlimit; +if (dquot->dq_dqb.dqb_ihardlimit && + (!limit || dquot->dq_dqb.dqb_ihardlimit < limit)) + limit = dquot->dq_dqb.dqb_ihardlimit; +if (limit && buf->f_files > limit) { buf->f_files = limit; buf->f_ffree =
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 109/191 cifs: Fix use-after-free bug in cifs_reconnect()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara (SUSE) <[email protected]>
[ Upstream commit 8354d88efdab72b4da32fc4f032448fcef22dab4 ]
Ensure we grab an active reference in cifs superblock while doing failover to prevent automounts (DFS links) of expiring and then destroying the superblock pointer.
This patch fixes the following KASAN report:
[ 464.301462] BUG: KASAN: use-after-free in cifs_reconnect+0x6ab/0x1350 [ 464.303052] Read of size 8 at addr ffff888155e580d0 by task
cifsd/1107
[ 464.304682] CPU: 3 PID: 1107 Comm: cifsd Not tainted 5.4.0-rc4+ #13 [ 464.305552] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58-rebuilt.opensuse.org 04/01/2014 [ 464.307146] Call Trace: [ 464.307875] dump_stack+0x5b/0x90 [ 464.308631] print_address_description.constprop.0+0x16/0x200 [ 464.309478] ? cifs_reconnect+0x6ab/0x1350 [ 464.310253] ? cifs_reconnect+0x6ab/0x1350 [ 464.311040] __kasan_report.cold+0x1a/0x41 [ 464.311811] ? cifs_reconnect+0x6ab/0x1350 [ 464.312563] kasan_report+0xe/0x20 [ 464.313300] cifs_reconnect+0x6ab/0x1350 [ 464.314062] ? extract_hostname.part.0+0x90/0x90 [ 464.314829] ? printk+0xad/0xde [ 464.315525] ? _raw_spin_lock+0x7c/0xd0 [ 464.316252] ? _raw_read_lock_irq+0x40/0x40 [ 464.316961] ? ___ratelimit+0xed/0x182 [ 464.317655] cifs_readv_from_socket+0x289/0x3b0 [ 464.318386] cifs_read_from_socket+0x98/0xd0 [ 464.319078] ? cifs_readv_from_socket+0x3b0/0x3b0 [ 464.319782] ? try_to_wake_up+0x43c/0xa90 [ 464.320463] ? cifs_small_buf_get+0x4b/0x60 [ 464.321173] ? allocate_buffers+0x98/0x1a0 [ 464.321856] cifs_demultiplex_thread+0x218/0x14a0 [ 464.322558] ? cifs_handle_standard+0x270/0x270 [ 464.323237] ? __switch_to_asm+0x40/0x70 [ 464.323893] ? __switch_to_asm+0x34/0x70 [ 464.324554] ? __switch_to_asm+0x40/0x70 [ 464.325226] ? __switch_to_asm+0x40/0x70 [ 464.325863] ? __switch_to_asm+0x34/0x70 [ 464.326505] ? __switch_to_asm+0x40/0x70 [ 464.327161] ? __switch_to_asm+0x34/0x70 [ 464.327784] ? finish_task_switch+0xa1/0x330 [ 464.328414] ? __switch_to+0x363/0x640 [ 464.329044] ? __schedule+0x575/0xaf0 [ 464.329655] ? _raw_spin_lock_irqsave+0x82/0xe0 [ 464.330301] kthread+0x1a3/0x1f0 [ 464.330884] ? cifs_handle_standard+0x270/0x270 [ 464.331624] ? kthread_create_on_node+0xd0/0xd0 [ 464.332347] ret_from_fork+0x35/0x40
[ 464.333577] Allocated by task 1110: [ 464.334381] save_stack+0x1b/0x80 [ 464.335123] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 464.335848] cifs_smb3_do_mount+0xd4/0xb00 [ 464.336619] legacy_get_tree+0x6b/0xa0 [ 464.337235] vfs_get_tree+0x41/0x110 [ 464.337975] fc_mount+0xa/0x40 [ 464.338557] vfs_kern_mount.part.0+0x6c/0x80 [ 464.339227] cifs_dfs_d_automount+0x336/0xd29 [ 464.339846] follow_managed+0x1b1/0x450 [ 464.340449] lookup_fast+0x231/0x4a0 [ 464.341039] path_openat+0x240/0x1fd0 [ 464.341634] do_filp_open+0x126/0x1c0 [ 464.342277] do_sys_open+0x1eb/0x2c0 [ 464.342957] do_syscall_64+0x5e/0x190 [ 464.343555] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 464.344772] Freed by task 0: [ 464.345347] save_stack+0x1b/0x80 [ 464.345966] __kasan_slab_free+0x12c/0x170 [ 464.346576] kfree+0xa6/0x270 [ 464.347211] rcu_core+0x39c/0xc80 [ 464.347800] __do_softirq+0x10d/0x3da
[ 464.348919] The buggy address belongs to the object at
ffff888155e58000
which belongs to the cache kmalloc-256 of size 256
[ 464.350222] The buggy address is located 208 bytes inside of
256-byte region [ffff888155e58000, ffff888155e58100)
[ 464.351575] The buggy address belongs to the page:
[ 464.352333] page:ffffea0005579600 refcount:1 mapcount:0
mapping:ffff88815a803400 index:0x0 compound_mapcount: 0
[ 464.353583] flags: 0x200000000010200(slab|head)
[ 464.354209] raw: 0200000000010200 ffffea0005576200 0000000400000004
ffff88815a803400
[ 464.355353] raw: 0000000000000000 0000000080100010 00000001ffffffff
0000000000000000
[ 464.356458] page dumped because: kasan: bad access detected[ 464.367005] Memory state around the buggy address: [ 464.367787] ffff888155e57f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.368877] ffff888155e58000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 464.369967] >ffff888155e58080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 464.371111] ^ [ 464.371775] ffff888155e58100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.372893] ffff888155e58180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.373983] ==================================================================
--- fs/cifs/connect.c | 46 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 11 deletions(-)
fs/cifs/connect.c +35 -11
@@ -387,7 +387,7 @@ static inline int reconn_set_ipaddr(struct TCP_Server_Info *server)#ifdef CONFIG_CIFS_DFS_UPCALL struct super_cb_data {struct TCP_Server_Info *server; -struct cifs_sb_info *cifs_sb; +struct super_block *sb; };/* These functions must be called with server->srv_mutex held */
@@ -398,25 +398,39 @@ static void super_cb(struct super_block *sb, void *arg)struct cifs_sb_info *cifs_sb;struct cifs_tcon *tcon; -if (d->cifs_sb) +if (d->sb)return ; cifs_sb =CIFS_SB (sb); tcon =cifs_sb_master_tcon (cifs_sb);if (tcon->ses->server == d->server) - d->cifs_sb = cifs_sb; + d->sb = sb; } -static inline struct cifs_sb_info * -find_super_by_tcp (struct TCP_Server_Info *server) +static struct super_block *get_tcp_super (struct TCP_Server_Info *server) {struct super_cb_data d = { .server = server, - .cifs_sb =NULL , + .sb =NULL , };iterate_supers_type (&cifs_fs_type, super_cb, &d); -return d.cifs_sb ? d.cifs_sb :ERR_PTR (-ENOENT ); + +if (unlikely (!d.sb)) +return ERR_PTR (-ENOENT ); +/* +* Grab an active reference in order to prevent automounts (DFS links) +* of expiring and then freeing up our cifs superblock pointer while +* we're doing failover. +*/ +cifs_sb_active (d.sb); +return d.sb; +} + +static inline void put_tcp_super (struct super_block *sb) +{ +if (!IS_ERR_OR_NULL (sb)) +cifs_sb_deactive (sb); } static void reconn_inval_dfs_target(struct TCP_Server_Info *server,
@@ -480,6 +494,7 @@ cifs_reconnect(struct TCP_Server_Info *server)struct mid_q_entry *mid_entry;struct list_head retry_list;#ifdef CONFIG_CIFS_DFS_UPCALL +struct super_block *sb =NULL ;struct cifs_sb_info *cifs_sb =NULL ;struct dfs_cache_tgt_list tgt_list = {0 };struct dfs_cache_tgt_iterator *tgt_it =NULL ;
@@ -489,13 +504,15 @@ cifs_reconnect(struct TCP_Server_Info *server) server->nr_targets =1 ;#ifdef CONFIG_CIFS_DFS_UPCALL spin_unlock (&GlobalMid_Lock); - cifs_sb =find_super_by_tcp (server); -if (IS_ERR (cifs_sb)) { - rc =PTR_ERR (cifs_sb); + sb =get_tcp_super (server); +if (IS_ERR (sb)) { + rc =PTR_ERR (sb);cifs_dbg (FYI ,"%s: will not do DFS failover: rc = %d\n" , __func__, rc); - cifs_sb =NULL ; + sb =NULL ; }else { + cifs_sb =CIFS_SB (sb); + rc =reconn_setup_dfs_targets (cifs_sb, &tgt_list, &tgt_it);if (rc && (rc != -EOPNOTSUPP )) { cifs_server_dbg(VFS, "%s: no target servers for DFS failover\n",
@@ -512,6 +529,10 @@ cifs_reconnect(struct TCP_Server_Info *server)/* the demux thread will exit normally next time through the loop */ spin_unlock (&GlobalMid_Lock); +#ifdef CONFIG_CIFS_DFS_UPCALL +dfs_cache_free_tgts (&tgt_list); +put_tcp_super (sb); +#endif return rc; }else server->tcpStatus = CifsNeedReconnect;
@@ -638,7 +659,10 @@ cifs_reconnect(struct TCP_Server_Info *server) __func__, rc); }dfs_cache_free_tgts (&tgt_list); + } + +put_tcp_super (sb);#endif if (server->tcpStatus == CifsNeedNegotiate)mod_delayed_work (cifsiod_wq, &server->echo,0 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 110/191 um: virtio: Keep reading on -EAGAIN
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 7e60746005573a06149cdee7acedf428906f3a59 ]
When we get an interrupt from the socket getting readable, and start reading, there's a possibility for a race. This depends on the implementation of the device, but e.g. with qemu's libvhost-user, we can see:
device virtio_uml
---------------------------------------
write header
get interrupt
read header
read body -> returns -EAGAINwrite body
The -EAGAIN return is because the socket is non-blocking, and then this leads us to abandon this message.
In fact, we've already read the header, so when the get another signal/interrupt for the body, we again read it as though it's a new message header, and also abandon it for the same reason (wrong size etc.)
This essentially breaks things, and if that message was one that required a response, it leads to a deadlock as the device is waiting for the response but we'll never reply.
Fix this by spinning on -EAGAIN as well when we read the message body. We need to handle -EAGAIN as "no message" while reading the header, since we share an interrupt.
Note that this situation is highly unlikely to occur in normal usage, since there will be very few messages and only in the startup phase. With the inband call feature this does tend to happen (eventually) though.
--- arch/um/drivers/virtio_uml.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/um/drivers/virtio_uml.c +4 -4
@@ -83,7 +83,7 @@ static int full_sendmsg_fds(int fd, const void *buf, unsigned int len,return 0 ; } -static int full_read (int fd,void *buf,int len) +static int full_read (int fd,void *buf,int len,bool abortable) {int rc;
@@ -93,7 +93,7 @@ static int full_read(int fd, void *buf, int len) buf += rc; len -= rc; } - }while (len && (rc >0 || rc == -EINTR )); + }while (len && (rc >0 || rc == -EINTR || (!abortable && rc == -EAGAIN )));if (rc <0 )return rc;
@@ -104,7 +104,7 @@ static int full_read(int fd, void *buf, int len)static int vhost_user_recv_header (int fd,struct vhost_user_msg *msg) { -return full_read (fd, msg,sizeof (msg->header)); +return full_read (fd, msg,sizeof (msg->header), true); } static int vhost_user_recv(int fd, struct vhost_user_msg *msg,
@@ -118,7 +118,7 @@ static int vhost_user_recv(int fd, struct vhost_user_msg *msg, size = msg->header.size;if (size > max_payload_size)return -EPROTO ; -return full_read (fd, &msg->payload, size); +return full_read (fd, &msg->payload, size, false); } static int vhost_user_recv_resp(struct virtio_uml_device *vu_dev,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 111/191 io_uring: io_allocate_scq_urings() should return a sane state
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit eb065d301e8c83643367bdb0898becc364046bda ]
We currently rely on the ring destroy on cleaning things up in case of failure, but io_allocate_scq_urings() can leave things half initialized if only parts of it fails.
Be nice and return with either everything setup in success, or return an error with things nicely cleaned up.
--- fs/io_uring.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/io_uring.c +8 -2
@@ -3773,12 +3773,18 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx, ctx->cq_entries = rings->cq_ring_entries; size =array_size (sizeof (struct io_uring_sqe ), p->sq_entries); -if (size ==SIZE_MAX ) +if (size ==SIZE_MAX ) { +io_mem_free (ctx->rings); + ctx->rings =NULL ;return -EOVERFLOW ; + } ctx->sq_sqes =io_mem_alloc (size); -if (!ctx->sq_sqes) +if (!ctx->sq_sqes) { +io_mem_free (ctx->rings); + ctx->rings =NULL ;return -ENOMEM ; + }return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 112/191 of: unittest: fix memory leak in attach_node_and_children
In reply to Greg Kroah-HartmanFrom: Erhard Furtner <[email protected]>
[ Upstream commit 2aacace6dbbb6b6ce4e177e6c7ea901f389c0472 ]
In attach_node_and_children memory is allocated for full_name via kasprintf. If the condition of the 1st if is not met the function returns early without freeing the memory. Add a kfree() to fix that.
This has been detected with kmemleak:
It looks like the leak was introduced by this commit:
--- drivers/of/unittest.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/of/unittest.c +3 -1
@@ -1146,8 +1146,10 @@ static void attach_node_and_children(struct device_node *np) full_name =kasprintf (GFP_KERNEL ,"%pOF" , np);if (!strcmp (full_name,"/__local_fixups__" ) || - !strcmp (full_name,"/__fixups__" )) + !strcmp (full_name,"/__fixups__" )) { +kfree (full_name);return ; + } dup =of_find_node_by_path (full_name);kfree (full_name);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 113/191 cdrom: respect device capabilities during opening action
In reply to Greg Kroah-HartmanFrom: Diego Elio Pettenò <[email protected]>
[ Upstream commit 366ba7c71ef77c08d06b18ad61b26e2df7352338 ]
Reading the TOC only works if the device can play audio, otherwise these commands fail (and possibly bring the device to an unhealthy state.)
Similarly, cdrom_mmc3_profile() should only be called if the device supports generic packet commands.
To: Jens Axboe <[email protected]>
--- drivers/cdrom/cdrom.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/cdrom/cdrom.c +11 -1
@@ -996,6 +996,12 @@ static void cdrom_count_tracks(struct cdrom_device_info *cdi, tracktype *tracks) tracks->xa =0 ; tracks->error =0 ;cd_dbg (CD_COUNT_TRACKS ,"entering cdrom_count_tracks\n" ); + +if (!CDROM_CAN (CDC_PLAY_AUDIO )) { + tracks->error =CDS_NO_INFO ; +return ; + } +/* Grab the TOC header so we can see how many tracks there are */ ret = cdi->ops->audio_ioctl (cdi,CDROMREADTOCHDR , &header);if (ret) {
@@ -1162,7 +1168,8 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev, ret =open_for_data (cdi);if (ret) goto err; -cdrom_mmc3_profile (cdi); +if (CDROM_CAN (CDC_GENERIC_PACKET )) +cdrom_mmc3_profile (cdi);if (mode &FMODE_WRITE ) { ret = -EROFS ;if (cdrom_open_write (cdi))
@@ -2882,6 +2889,9 @@ int cdrom_get_last_written(struct cdrom_device_info *cdi, long *last_written)it doesn't give enough information or fails. then we return the toc contents. */ use_toc: +if (!CDROM_CAN (CDC_PLAY_AUDIO )) +return -ENOSYS ; + toc.cdte_format =CDROM_MSF ; toc.cdte_track =CDROM_LEADOUT ;if ((ret = cdi->ops->audio_ioctl (cdi,CDROMREADTOCENTRY , &toc)))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 114/191 cifs: move cifsFileInfo_put logic into a work-queue
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
[ Upstream commit 32546a9586aa4565035bb557e191648e022b29e8 ]
This patch moves the final part of the cifsFileInfo_put() logic where we need a write lock on lock_sem to be processed in a separate thread that holds no other locks.
This is to prevent deadlocks like the one below:
Quoted 232 lines
there are 6 processes looping to while trying to
down_writecinode->lock_sem, 5 of them from_cifsFileInfo_put, and one fromcifs_new_fileinfoand there are 5 other processes which are blocked, several of them waiting on either
PG_writebackorPG_locked(which are both set), all for the same page of the file2
inode_lock()(inode->i_rwsem) for the file
1wait_on_page_writeback()for the page
1down_read(inode->i_rwsem)for the inode of the directory 1 inode_lock()(inode->i_rwsem) for the inode of the directory 1__lock_pageso processes are blocked waiting on:
page flagsPG_lockedandPG_writebackfor one specific pageinode->i_rwsemfor the directory
inode->i_rwsemfor the file
cifsInodeInflock_semhere are the more gory details (let me know if I need to provide anything more/better):
[0 00:48:22.765] [UN] PID: 8863 TASK:
ffff8c691547c5c0CPU: 3
COMMAND: "reopen_file"
#0 [ffff9965007e3ba8]__scheduleatffffffff9b6e6095
#1 [ffff9965007e3c38] schedule atffffffff9b6e64df
#2 [ffff9965007e3c48]rwsem_down_write_slowpathatffffffff9af283d7#3 [ffff9965007e3cb8]legitimize_pathatffffffff9b0f975d#4 [ffff9965007e3d08]path_openatatffffffff9b0fe55d
#5 [ffff9965007e3dd8]do_filp_openatffffffff9b100a33#6 [ffff9965007e3ee0]do_sys_openatffffffff9b0eb2d6
#7 [ffff9965007e3f38]do_syscall_64atffffffff9ae04315
* (I thinklegitimize_pathis bogus)in
path_openat} else { const char *s = path_init(nd, flags); while (!(error = link_path_walk(s, nd)) && (error = do_last(nd, file, op)) > 0) { <<<<
do_last:
if (open_flag&O_CREAT)
inode_lock(dir->d_inode); <<<<
else
so it's trying to takeinode->i_rwsemfor the directoryDENTRY INODE SUPERBLK TYPE PATH
ffff8c68bb8e79c0ffff8c691158ef20ffff8c6915bf9000DIR/mnt/vm1_smb/inode.i_rwsem isffff8c691158efc0<struct
rw_semaphore0xffff8c691158efc0>:owner: <struct task_struct 0xffff8c6914275d00> (UN - 8856 - reopen_file), counter: 0x0000000000000003 waitlist: 2 0xffff9965007e3c90 8863 reopen_file UN 0 1:29:22.926 RWSEM_WAITING_FOR_WRITE 0xffff996500393e00 9802 ls UN 0 1:17:26.700
RWSEM_WAITING_FOR_READthe owner of the inode.i_rwsem of the directory is:
[0 00:00:00.109] [UN] PID: 8856 TASK:
ffff8c6914275d00CPU: 3
COMMAND: "reopen_file"
#0 [ffff99650065b828]__scheduleatffffffff9b6e6095
#1 [ffff99650065b8b8] schedule atffffffff9b6e64df
#2 [ffff99650065b8c8]schedule_timeoutatffffffff9b6e9f89
#3 [ffff99650065b940] msleep atffffffff9af573a9
#4 [ffff99650065b948] _cifsFileInfo_put.cold.63 atffffffffc0a42dd6[cifs] #5 [ffff99650065ba38]cifs_writepage_lockedatffffffffc0a0b8f3[cifs] #6 [ffff99650065bab0]cifs_launder_pageatffffffffc0a0bb72[cifs] #7 [ffff99650065bb30]invalidate_inode_pages2_rangeatffffffff9b04d4bd#8 [ffff99650065bcb8]cifs_invalidate_mappingatffffffffc0a11339[cifs] #9 [ffff99650065bcd0]cifs_revalidate_mappingatffffffffc0a1139a[cifs]
#10 [ffff99650065bcf0]cifs_d_revalidateatffffffffc0a014f6[cifs] #11 [ffff99650065bd08]path_openatatffffffff9b0fe7f7
#12 [ffff99650065bdd8]do_filp_openatffffffff9b100a33
#13 [ffff99650065bee0]do_sys_openatffffffff9b0eb2d6
#14 [ffff99650065bf38]do_syscall_64atffffffff9ae04315
cifs_launder_pageis for page0xffffd1e2c07d2480crash> page.index,mapping,flags
0xffffd1e2c07d2480index = 0x8 mapping = 0xffff8c68f3cd0db0flags =
0xfffffc0008095PAGE-FLAG BIT VALUE PG_locked 0 0000001 PG_uptodate 2 0000004 PG_lru 4 0000010 PG_waiters 7 0000080 PG_writeback 15 0008000inode is
ffff8c68f3cd0c40
inode.i_rwsem isffff8c68f3cd0ce0
DENTRY INODE SUPERBLK TYPE PATHffff8c68a1f1b480ffff8c68f3cd0c40ffff8c6915bf9000REG/mnt/vm1_smb/testfile.8853this process holds the
inode->i_rwsemfor the parent directory, is laundering a page attached to the inode of the file it's opening, and in_cifsFileInfo_putis trying todown_writethecifsInodeInflock_semfor the file itself.<struct
rw_semaphore0xffff8c68f3cd0ce0>:owner: <struct task_struct 0xffff8c6914272e80> (UN - 8854 - reopen_file), counter: 0x0000000000000003 waitlist: 1 0xffff9965005dfd80 8855 reopen_file UN 0 1:29:22.912
RWSEM_WAITING_FOR_WRITEthis is the inode.i_rwsem for the file
the owner:
[0 00:48:22.739] [UN] PID: 8854 TASK:
ffff8c6914272e80CPU: 2
COMMAND: "reopen_file"
#0 [ffff99650054fb38]__scheduleatffffffff9b6e6095
#1 [ffff99650054fbc8] schedule atffffffff9b6e64df
#2 [ffff99650054fbd8]io_scheduleatffffffff9b6e68e2
#3 [ffff99650054fbe8]__lock_pageatffffffff9b03c56f
#4 [ffff99650054fc80]pagecache_get_pageatffffffff9b03dcdf
#5 [ffff99650054fcc0]grab_cache_page_write_beginatffffffff9b03ef4c#6 [ffff99650054fcd0]cifs_write_beginatffffffffc0a064ec[cifs] #7 [ffff99650054fd30]generic_perform_writeatffffffff9b03bba4#8 [ffff99650054fda8]__generic_file_write_iteratffffffff9b04060a#9 [ffff99650054fdf0] cifs_strict_writev.cold.70 atffffffffc0a4469b[cifs]
#10 [ffff99650054fe48]new_sync_writeatffffffff9b0ec1dd
#11 [ffff99650054fed0]vfs_writeatffffffff9b0eed35
#12 [ffff99650054ff00]ksys_writeatffffffff9b0eefd9
#13 [ffff99650054ff38]do_syscall_64atffffffff9ae04315the process holds the
inode->i_rwsemfor the file to which it's writing, and is trying to__lock_pagefor the same page as in the other processesthe other tasks:
[0 00:00:00.028] [UN] PID: 8859 TASK:ffff8c6915479740CPU: 2
COMMAND: "reopen_file"
#0 [ffff9965007b39d8]__scheduleatffffffff9b6e6095
#1 [ffff9965007b3a68] schedule atffffffff9b6e64df
#2 [ffff9965007b3a78]schedule_timeoutatffffffff9b6e9f89
#3 [ffff9965007b3af0] msleep atffffffff9af573a9
#4 [ffff9965007b3af8] cifs_new_fileinfo.cold.61 atffffffffc0a42a07[cifs] #5 [ffff9965007b3b78]cifs_openatffffffffc0a0709d[cifs]
#6 [ffff9965007b3cd8]do_dentry_openatffffffff9b0e9b7a
#7 [ffff9965007b3d08]path_openatatffffffff9b0fe34f
#8 [ffff9965007b3dd8]do_filp_openatffffffff9b100a33
#9 [ffff9965007b3ee0]do_sys_openatffffffff9b0eb2d6
#10 [ffff9965007b3f38]do_syscall_64atffffffff9ae04315this is opening the file, and is trying to
down_writecinode->lock_sem[0 00:00:00.041] [UN] PID: 8860 TASK:
ffff8c691547ae80CPU: 2
COMMAND: "reopen_file"
[0 00:00:00.057] [UN] PID: 8861 TASK:ffff8c6915478000CPU: 3
COMMAND: "reopen_file"
[0 00:00:00.059] [UN] PID: 8858 TASK:ffff8c6914271740CPU: 2
COMMAND: "reopen_file"
[0 00:00:00.109] [UN] PID: 8862 TASK:ffff8c691547dd00CPU: 6
COMMAND: "reopen_file"
#0 [ffff9965007c3c78]__scheduleatffffffff9b6e6095
#1 [ffff9965007c3d08] schedule atffffffff9b6e64df
#2 [ffff9965007c3d18]schedule_timeoutatffffffff9b6e9f89
#3 [ffff9965007c3d90] msleep atffffffff9af573a9
#4 [ffff9965007c3d98] _cifsFileInfo_put.cold.63 atffffffffc0a42dd6[cifs] #5 [ffff9965007c3e88]cifs_closeatffffffffc0a07aaf[cifs]
#6 [ffff9965007c3ea0]__fputatffffffff9b0efa6e
#7 [ffff9965007c3ee8]task_work_runatffffffff9aef1614
#8 [ffff9965007c3f20]exit_to_usermode_loopatffffffff9ae03d6f#9 [ffff9965007c3f38]do_syscall_64atffffffff9ae0444cclosing the file, and trying to
down_writecifsi->lock_sem[0 00:48:22.839] [UN] PID: 8857 TASK:
ffff8c6914270000CPU: 7
COMMAND: "reopen_file"
#0 [ffff9965006a7cc8]__scheduleatffffffff9b6e6095
#1 [ffff9965006a7d58] schedule atffffffff9b6e64df
#2 [ffff9965006a7d68]io_scheduleatffffffff9b6e68e2
#3 [ffff9965006a7d78]wait_on_page_bitatffffffff9b03cac6#4 [ffff9965006a7e10]__filemap_fdatawait_rangeatffffffff9b03b028#5 [ffff9965006a7ed8]filemap_write_and_waitatffffffff9b040165#6 [ffff9965006a7ef0]cifs_flushatffffffffc0a0c2fa[cifs] #7 [ffff9965006a7f10]filp_closeatffffffff9b0e93f1
#8 [ffff9965006a7f30]__x64_sys_closeatffffffff9b0e9a0e#9 [ffff9965006a7f38]do_syscall_64atffffffff9ae04315in
__filemap_fdatawait_rangewait_on_page_writeback(page);for the same page of the file
[0 00:48:22.718] [UN] PID: 8855 TASK:
ffff8c69142745c0CPU: 7
COMMAND: "reopen_file"
#0 [ffff9965005dfc98]__scheduleatffffffff9b6e6095
#1 [ffff9965005dfd28] schedule atffffffff9b6e64df
#2 [ffff9965005dfd38]rwsem_down_write_slowpathatffffffff9af283d7#3 [ffff9965005dfdf0]cifs_strict_writevatffffffffc0a0c40a[cifs] #4 [ffff9965005dfe48]new_sync_writeatffffffff9b0ec1dd#5 [ffff9965005dfed0]vfs_writeatffffffff9b0eed35
#6 [ffff9965005dff00]ksys_writeatffffffff9b0eefd9
#7 [ffff9965005dff38]do_syscall_64atffffffff9ae04315inode_lock(inode);and one 'ls' later on, to see whether the rest of the mount is available (the test file is in the root, so we get blocked up on the directory ->i_rwsem), so the entire mount is unavailable
[0 00:36:26.473] [UN] PID: 9802 TASK:
ffff8c691436ae80CPU: 4
COMMAND: "ls"
#0 [ffff996500393d28]__scheduleatffffffff9b6e6095
#1 [ffff996500393db8] schedule atffffffff9b6e64df
#2 [ffff996500393dc8]rwsem_down_read_slowpathatffffffff9b6e9421#3 [ffff996500393e78]down_read_killableatffffffff9b6e95e2#4 [ffff996500393e88]iterate_diratffffffff9b103c56#5 [ffff996500393ec8]ksys_getdents64atffffffff9b104b0c#6 [ffff996500393f30]__x64_sys_getdents64atffffffff9b104bb6#7 [ffff996500393f38]do_syscall_64atffffffff9ae04315
Quoted 6 lines
in
iterate_dir:if (shared) res = down_read_killable(&inode->i_rwsem); <<<< else res = down_write_killable(&inode->i_rwsem);
--- fs/cifs/cifsfs.c | 13 +++++++- fs/cifs/cifsglob.h | 5 +++- fs/cifs/file.c | 74 ++++++++++++++++++++++++++++++---------------- 3 files changed, 65 insertions(+), 27 deletions(-)
fs/cifs/cifsfs.c +12 -1
@@ -119,6 +119,7 @@ extern mempool_t *cifs_mid_poolp;struct workqueue_struct *cifsiod_wq;struct workqueue_struct *decrypt_wq; +struct workqueue_struct *fileinfo_put_wq;struct workqueue_struct *cifsoplockd_wq;__u32 cifs_lock_secret;
@@ -1554,11 +1555,18 @@ init_cifs(void) goto out_destroy_cifsiod_wq; } + fileinfo_put_wq =alloc_workqueue ("cifsfileinfoput" , +WQ_UNBOUND |WQ_FREEZABLE |WQ_MEM_RECLAIM ,0 ); +if (!fileinfo_put_wq) { + rc = -ENOMEM ; + goto out_destroy_decrypt_wq; + } + cifsoplockd_wq =alloc_workqueue ("cifsoplockd" ,WQ_FREEZABLE |WQ_MEM_RECLAIM ,0 );if (!cifsoplockd_wq) { rc = -ENOMEM ; - goto out_destroy_decrypt_wq; + goto out_destroy_fileinfo_put_wq; } rc =cifs_fscache_register ();
@@ -1624,6 +1632,8 @@ out_unreg_fscache:cifs_fscache_unregister (); out_destroy_cifsoplockd_wq:destroy_workqueue (cifsoplockd_wq); +out_destroy_fileinfo_put_wq: +destroy_workqueue (fileinfo_put_wq); out_destroy_decrypt_wq:destroy_workqueue (decrypt_wq); out_destroy_cifsiod_wq:
@@ -1653,6 +1663,7 @@ exit_cifs(void)cifs_fscache_unregister ();destroy_workqueue (cifsoplockd_wq);destroy_workqueue (decrypt_wq); +destroy_workqueue (fileinfo_put_wq);destroy_workqueue (cifsiod_wq);cifs_proc_clean (); }
fs/cifs/cifsglob.h +4 -1
@@ -1265,6 +1265,7 @@ struct cifsFileInfo {struct mutex fh_mutex;/* prevents reopen race after dead ses*/ struct cifs_search_info srch_inf;struct work_struct oplock_break;/* work for oplock breaks */ +struct work_struct put;/* work for the final part of _put */ };struct cifs_io_parms {
@@ -1370,7 +1371,8 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file) }struct cifsFileInfo *cifsFileInfo_get (struct cifsFileInfo *cifs_file); -void _cifsFileInfo_put (struct cifsFileInfo *cifs_file,bool wait_oplock_hdlr); +void _cifsFileInfo_put (struct cifsFileInfo *cifs_file,bool wait_oplock_hdlr, +bool offload);void cifsFileInfo_put (struct cifsFileInfo *cifs_file);#define CIFS_CACHE_READ_FLG 1
@@ -1908,6 +1910,7 @@ void cifs_queue_oplock_break(struct cifsFileInfo *cfile);extern const struct slow_work_ops cifs_oplock_break_ops;extern struct workqueue_struct *cifsiod_wq;extern struct workqueue_struct *decrypt_wq; +extern struct workqueue_struct *fileinfo_put_wq;extern struct workqueue_struct *cifsoplockd_wq;extern __u32 cifs_lock_secret;
fs/cifs/file.c +49 -25
134 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 115/191 perf diff: Use llabs() with 64-bit values
In reply to Greg Kroah-HartmanFrom: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 98e93245113d0f5c279ef77f4a9e7d097323ad71 ]
To fix these build errors on a debian mipsel cross build environment:
builtin-diff.c: In function 'block_cycles_diff_cmp':
builtin-diff.c:550:6: error: absolute value function 'labs' given an argument of type 's64' {aka 'long long int'} but has parameter of type 'long int' which may cause truncation of value [-Werror=absolute-value]
550 | l = labs(left->diff.cycles);
| ^~~~
builtin-diff.c:551:6: error: absolute value function 'labs' given an argument of type 's64' {aka 'long long int'} but has parameter of type 'long int' which may cause truncation of value [-Werror=absolute-value]
551 | r = labs(right->diff.cycles);
| ^~~~--- tools/perf/builtin-diff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/builtin-diff.c +2 -2
@@ -575,8 +575,8 @@ static int64_t block_cycles_diff_cmp(struct hist_entry *left,if (!pairs_left && !pairs_right)return 0 ; - l =labs (left->diff.cycles); - r =labs (right->diff.cycles); + l =llabs (left->diff.cycles); + r =llabs (right->diff.cycles);return r - l; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 116/191 perf script: Fix brstackinsn for AUXTRACE
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
[ Upstream commit 0cd032d3b5fcebf5454315400ab310746a81ca53 ]
brstackinsn must be allowed to be set by the user when AUX area data has been captured because, in that case, the branch stack might be synthesized on the fly. This fixes the following error:
Before:
$ perf record -e '{intel_pt//,cpu/mem_inst_retired.all_loads,aux-sample-size=8192/pp}:u' grep -rqs jhgjhg /boot
[ perf record: Woken up 19 times to write data ]
[ perf record: Captured and wrote 2.274 MB perf.data ]
$ perf script -F +brstackinsn --xed --itrace=i1usl100 | head
Display of branch stack assembler requested, but non all-branch filter set
Hint: run 'perf record -b ...'After:
$ perf record -e '{intel_pt//,cpu/mem_inst_retired.all_loads,aux-sample-size=8192/pp}:u' grep -rqs jhgjhg /boot
[ perf record: Woken up 19 times to write data ]
[ perf record: Captured and wrote 2.274 MB perf.data ]
$ perf script -F +brstackinsn --xed --itrace=i1usl100 | head
grep 13759 [002] 8091.310257: 1862 instructions:uH: 5641d58069eb bmexec+0x86b (/bin/grep)
bmexec+2485:
00005641d5806b35 jnz 0x5641d5806bd0 # MISPRED
00005641d5806bd0 movzxb (%r13,%rdx,1), %eax
00005641d5806bd6 add %rdi, %rax
00005641d5806bd9 movzxb -0x1(%rax), %edx
00005641d5806bdd cmp %rax, %r14
00005641d5806be0 jnb 0x5641d58069c0 # MISPRED
mismatch of LBR data and executable
00005641d58069c0 movzxb (%r13,%rdx,1), %edi--- tools/perf/builtin-script.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-script.c +1 -1
@@ -448,7 +448,7 @@ static int perf_evsel__check_attr(struct evsel *evsel, "selected. Hence, no address to lookup the source line number.\n");return -EINVAL ; } -if (PRINT_FIELD (BRSTACKINSN ) && +if (PRINT_FIELD (BRSTACKINSN ) && !allow_user_set && !(perf_evlist__combined_branch_type (session->evlist) &PERF_SAMPLE_BRANCH_ANY )) { pr_err("Display of branch stack assembler requested, but non all-branch filter set\n"
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 117/191 perf regs: Make perf_reg_name() return "unknown" instead of NULL
In reply to Greg Kroah-HartmanFrom: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 5b596e0ff0e1852197d4c82d3314db5e43126bf7 ]
To avoid breaking the build on arches where this is not wired up, at least all the other features should be made available and when using this specific routine, the "unknown" should point the user/developer to the need to wire this up on this particular hardware architecture.
Detected in a container mipsel debian cross build environment, where it shows up as:
In file included from /usr/mipsel-linux-gnu/include/stdio.h:867,
from /git/linux/tools/perf/lib/include/perf/cpumap.h:6,
from util/session.c:13:
In function 'printf',
inlined from 'regs_dump__printf' at util/session.c:1103:3,
inlined from 'regs__printf' at util/session.c:1131:2:
/usr/mipsel-linux-gnu/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=]
107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cross compiler details:
mipsel-linux-gnu-gcc (Debian 9.2.1-8) 9.2.1 20190909
Also on mips64:
In file included from /usr/mips64-linux-gnuabi64/include/stdio.h:867,
from /git/linux/tools/perf/lib/include/perf/cpumap.h:6,
from util/session.c:13:
In function 'printf',
inlined from 'regs_dump__printf' at util/session.c:1103:3,
inlined from 'regs__printf' at util/session.c:1131:2,
inlined from 'regs_user__printf' at util/session.c:1139:3,
inlined from 'dump_sample' at util/session.c:1246:3,
inlined from 'machines__deliver_event' at util/session.c:1421:3:
/usr/mips64-linux-gnuabi64/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=]
107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function 'printf',
inlined from 'regs_dump__printf' at util/session.c:1103:3,
inlined from 'regs__printf' at util/session.c:1131:2,
inlined from 'regs_intr__printf' at util/session.c:1147:3,
inlined from 'dump_sample' at util/session.c:1249:3,
inlined from 'machines__deliver_event' at util/session.c:1421:3:
/usr/mips64-linux-gnuabi64/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=]
107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cross compiler details:
mips64-linux-gnuabi64-gcc (Debian 9.2.1-8) 9.2.1 20190909
--- tools/perf/util/perf_regs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/perf_regs.h +1 -1
@@ -41,7 +41,7 @@ int perf_reg_value(u64 *valp, struct regs_dump *regs, int id);static inline const char *perf_reg_name (int id__maybe_unused ) { -return NULL ; +return "unknown" ; } static inline int perf_reg_value(u64 *valp __maybe_unused,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 118/191 s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
In reply to Greg Kroah-HartmanFrom: Harald Freudenberger <[email protected]>
[ Upstream commit 6733775a92eacd612ac88afa0fd922e4ffeb2bc7 ]
This patch introduces support for a new architectured reply code 0x8B indicating that a hypervisor layer (if any) has rejected an ap message.
Linux may run as a guest on top of a hypervisor like zVM or KVM. So the crypto hardware seen by the ap bus may be restricted by the hypervisor for example only a subset like only clear key crypto requests may be supported. Other requests will be filtered out - rejected by the hypervisor. The new reply code 0x8B will appear in such cases and needs to get recognized by the ap bus and zcrypt device driver zoo.
--- drivers/s390/crypto/zcrypt_error.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/s390/crypto/zcrypt_error.h +2 -0
@@ -61,6 +61,7 @@ struct error_hdr {#define REP82_ERROR_EVEN_MOD_IN_OPND 0x85#define REP82_ERROR_RESERVED_FIELD 0x88#define REP82_ERROR_INVALID_DOMAIN_PENDING 0x8A +#define REP82_ERROR_FILTERED_BY_HYPERVISOR 0x8B#define REP82_ERROR_TRANSPORT_FAIL 0x90#define REP82_ERROR_PACKET_TRUNCATED 0xA0#define REP82_ERROR_ZERO_BUFFER_LEN 0xB0
@@ -91,6 +92,7 @@ static inline int convert_error(struct zcrypt_queue *zq,case REP82_ERROR_INVALID_DOMAIN_PRECHECK :case REP82_ERROR_INVALID_DOMAIN_PENDING :case REP82_ERROR_INVALID_SPECIAL_CMD : +case REP82_ERROR_FILTERED_BY_HYPERVISOR :// REP88_ERROR_INVALID_KEY // '82' CEX2A // REP88_ERROR_OPERAND // '84' CEX2A // REP88_ERROR_OPERAND_EVEN_MOD // '85' CEX2A
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 119/191 mailbox: imx: Clear the right interrupts at shutdown
In reply to Greg Kroah-HartmanFrom: Daniel Baluta <[email protected]>
[ Upstream commit 5f0af07e89199ac51cdd4f25bc303bdc703f4e9c ]
Make sure to only clear enabled interrupts keeping count of the connection type.
--- drivers/mailbox/imx-mailbox.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/mailbox/imx-mailbox.c +13 -2
@@ -217,8 +217,19 @@ static void imx_mu_shutdown(struct mbox_chan *chan)if (cp->type ==IMX_MU_TYPE_TXDB )tasklet_kill (&cp->txdb_tasklet); -imx_mu_xcr_rmw (priv,0 ,IMX_MU_xCR_TIEn (cp->idx) | -IMX_MU_xCR_RIEn (cp->idx) |IMX_MU_xCR_GIEn (cp->idx)); +switch (cp->type) { +case IMX_MU_TYPE_TX : +imx_mu_xcr_rmw (priv,0 ,IMX_MU_xCR_TIEn (cp->idx)); +break ; +case IMX_MU_TYPE_RX : +imx_mu_xcr_rmw (priv,0 ,IMX_MU_xCR_RIEn (cp->idx)); +break ; +case IMX_MU_TYPE_RXDB : +imx_mu_xcr_rmw (priv,0 ,IMX_MU_xCR_GIEn (cp->idx)); +break ; +default : +break ; + }free_irq (priv->irq, chan); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 120/191 libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit a8de1304b7df30e3a14f2a8b9709bb4ff31a0385 ]
The DTC v1.5.1 added references to (U)INT32_MAX.
This is no problem for user-space programs since <stdint.h> defines (U)INT32_MAX along with (u)int32_t.
For the kernel space, libfdt_env.h needs to be adjusted before we pull in the changes.
In the kernel, we usually use s/u32 instead of (u)int32_t for the fixed-width types.
Accordingly, we already have S/U32_MAX for their max values. So, we should not add (U)INT32_MAX to <linux/limits.h> any more.
Instead, add them to the in-kernel libfdt_env.h to compile the latest libfdt.
--- arch/arm/boot/compressed/libfdt_env.h | 4 +++- arch/powerpc/boot/libfdt_env.h | 2 ++ include/linux/libfdt_env.h | 3 +++ 3 files changed, 8 insertions(+), 1 deletion(-)
arch/arm/boot/compressed/libfdt_env.h +3 -1
@@ -2,11 +2,13 @@#ifndef _ARM_LIBFDT_ENV_H#define _ARM_LIBFDT_ENV_H +#include <linux/limits.h> #include <linux/types.h> #include <linux/string.h> #include <asm/byteorder.h> -#define INT_MAX ((int)(~0U>>1)) +#define INT32_MAX S32_MAX +#define UINT32_MAX U32_MAXtypedef __be16 fdt16_t ;typedef __be32 fdt32_t ;
arch/powerpc/boot/libfdt_env.h +2 -0
@@ -6,6 +6,8 @@#include <string.h> #define INT_MAX ((int)(~0U>>1)) +#define UINT32_MAX ((u32)~0U) +#define INT32_MAX ((s32)(UINT32_MAX >> 1))#include "of.h"
include/linux/libfdt_env.h +3 -0
@@ -7,6 +7,9 @@#include <asm/byteorder.h> +#define INT32_MAX S32_MAX +#define UINT32_MAX U32_MAX +typedef __be16 fdt16_t ;typedef __be32 fdt32_t ;typedef __be64 fdt64_t ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 121/191 s390/unwind: filter out unreliable bogus %r14
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
[ Upstream commit bf018ee644897d7982e1b8dd8b15e97db6e1a4da ]
Currently unwinder unconditionally returns %r14 from the first frame pointed by %r15 from pt_regs. A task could be interrupted when a function already allocated this frame (if it needs it) for its callees or to store local variables. In that case this frame would contain random values from stack or values stored there by a callee. As we are only interested in %r14 to get potential return address, skip bogus return addresses which doesn't belong to kernel text.
This helps to avoid duplicating filtering logic in unwider users, most of which use unwind_get_return_address() and would choke on bogus 0 address returned by it otherwise.
--- arch/s390/kernel/unwind_bc.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/s390/kernel/unwind_bc.c +5 -0
@@ -60,6 +60,11 @@ bool unwind_next_frame(struct unwind_state *state) ip =READ_ONCE_NOCHECK (sf->gprs[8 ]); reliable = false; regs =NULL ; +if (!__kernel_text_address (ip)) { +/* skip bogus %r14 */ + state->regs =NULL ; +return unwind_next_frame (state); + } }else { sf = (struct stack_frame *) state->sp; sp =READ_ONCE_NOCHECK (sf->back_chain);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 122/191 s390/cpum_sf: Check for SDBT and SDB consistency
In reply to Greg Kroah-HartmanFrom: Thomas Richter <[email protected]>
[ Upstream commit 247f265fa502e7b17a0cb0cc330e055a36aafce4 ]
Each SBDT is located at a 4KB page and contains 512 entries. Each entry of a SDBT points to a SDB, a 4KB page containing sampled data. The last entry is a link to another SDBT page.
When an event is created the function sequence executed is:
__hw_perf_event_init()
+--> allocate_buffers()
+--> realloc_sampling_buffers()
+---> alloc_sample_data_block()Both functions realloc_sampling_buffers() and alloc_sample_data_block() allocate pages and the allocation can fail. This is handled correctly and all allocated pages are freed and error -ENOMEM is returned to the top calling function. Finally the event is not created.
Once the event has been created, the amount of initially allocated SDBT and SDB can be too low. This is detected during measurement interrupt handling, where the amount of lost samples is calculated. If the number of lost samples is too high considering sampling frequency and already allocated SBDs, the number of SDBs is enlarged during the next execution of cpumsf_pmu_enable().
If more SBDs need to be allocated, functions
realloc_sampling_buffers()
+---> alloc-sample_data_block()are called to allocate more pages. Page allocation may fail and the returned error is ignored. A SDBT and SDB setup already exists.
However the modified SDBTs and SDBs might end up in a situation where the first entry of an SDBT does not point to an SDB, but another SDBT, basicly an SBDT without payload. This can not be handled by the interrupt handler, where an SDBT must have at least one entry pointing to an SBD.
Add a check to avoid SDBTs with out payload (SDBs) when enlarging the buffer setup.
--- arch/s390/kernel/perf_cpum_sf.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
arch/s390/kernel/perf_cpum_sf.c +15 -2
@@ -193,7 +193,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, unsigned long num_sdb, gfp_t gfp_flags) { int i, rc; -unsigned long *new, *tail; +unsigned long *new, *tail, *tail_prev =NULL ;if (!sfb->sdbt || !sfb->tail)return -EINVAL ;
@@ -232,6 +232,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, sfb->num_sdbt++;/* Link current page to tail of chain */ *tail = (unsigned long )(void *) new +1 ; + tail_prev = tail; tail = new; }
@@ -241,10 +242,22 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb,* issue, a new realloc call (if required) might succeed. */ rc =alloc_sample_data_block (tail, gfp_flags); -if (rc) +if (rc) { +/* Undo last SDBT. An SDBT with no SDB at its first +* entry but with an SDBT entry instead can not be +* handled by the interrupt handler code. +* Avoid this situation. +*/ +if (tail_prev) { + sfb->num_sdbt--; +free_page ((unsigned long ) new); + tail = tail_prev; + }break ; + } sfb->num_sdb++; tail++; + tail_prev = new =NULL ;/* Allocated at least one SBD */ }/* Link sampling buffer to its origin */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 123/191 ocfs2: fix passing zero to PTR_ERR warning
In reply to Greg Kroah-HartmanFrom: Ding Xiang <[email protected]>
[ Upstream commit 188c523e1c271d537f3c9f55b6b65bf4476de32f ]
Fix a static code checker warning:fs/ocfs2/acl.c:331
ocfs2_acl_chmod() warn: passing zero to 'PTR_ERR'
--- fs/ocfs2/acl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ocfs2/acl.c +2 -2
@@ -327,8 +327,8 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh)down_read (&OCFS2_I (inode)->ip_xattr_sem); acl =ocfs2_get_acl_nolock (inode,ACL_TYPE_ACCESS , bh);up_read (&OCFS2_I (inode)->ip_xattr_sem); -if (IS_ERR (acl) || !acl) -return PTR_ERR (acl); +if (IS_ERR_OR_NULL (acl)) +return PTR_ERR_OR_ZERO (acl); ret =__posix_acl_chmod (&acl,GFP_KERNEL , inode->i_mode);if (ret)return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 124/191 mailbox: imx: Fix Tx doorbell shutdown path
In reply to Greg Kroah-HartmanFrom: Daniel Baluta <[email protected]>
[ Upstream commit bf159d151a0b844be28882f39e316b5800acaa2b ]
Tx doorbell is handled by txdb_tasklet and doesn't have an associated IRQ.
Anyhow, imx_mu_shutdown ignores this and tries to free an IRQ that wasn't requested for Tx DB resulting in the following warning:
[ 1.967644] Trying to free already-free IRQ 26 [ 1.972108] WARNING: CPU: 2 PID: 157 at kernel/irq/manage.c:1708 __free_irq+0xc0/0x358 [ 1.980024] Modules linked in: [ 1.983088] CPU: 2 PID: 157 Comm: kworker/2:1 Tainted: G [ 1.993524] Hardware name: Freescale i.MX8QXP MEK (DT) [ 1.998668] Workqueue: events deferred_probe_work_func [ 2.003812] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 2.008607] pc : __free_irq+0xc0/0x358 [ 2.012364] lr : __free_irq+0xc0/0x358 [ 2.016111] sp : ffff00001179b7e0 [ 2.019422] x29: ffff00001179b7e0 x28: 0000000000000018 [ 2.024736] x27: ffff000011233000 x26: 0000000000000004 [ 2.030053] x25: 000000000000001a x24: ffff80083bec74d4 [ 2.035369] x23: 0000000000000000 x22: ffff80083bec7588 [ 2.040686] x21: ffff80083b1fe8d8 x20: ffff80083bec7400 [ 2.046003] x19: 0000000000000000 x18: ffffffffffffffff [ 2.051320] x17: 0000000000000000 x16: 0000000000000000 [ 2.056637] x15: ffff0000111296c8 x14: ffff00009179b517 [ 2.061953] x13: ffff00001179b525 x12: ffff000011142000 [ 2.067270] x11: ffff000011129f20 x10: ffff0000105da970 [ 2.072587] x9 : 00000000ffffffd0 x8 : 0000000000000194 [ 2.077903] x7 : 612065657266206f x6 : ffff0000111e7b09 [ 2.083220] x5 : 0000000000000003 x4 : 0000000000000000 [ 2.088537] x3 : 0000000000000000 x2 : 00000000ffffffff [ 2.093854] x1 : 28b70f0a2b60a500 x0 : 0000000000000000 [ 2.099173] Call trace: [ 2.101618] __free_irq+0xc0/0x358 [ 2.105021] free_irq+0x38/0x98 [ 2.108170] imx_mu_shutdown+0x90/0xb0 [ 2.111921] mbox_free_channel.part.2+0x24/0xb8 [ 2.116453] mbox_free_channel+0x18/0x28
This bug is present from the beginning of times.
--- drivers/mailbox/imx-mailbox.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mailbox/imx-mailbox.c +3 -1
@@ -214,8 +214,10 @@ static void imx_mu_shutdown(struct mbox_chan *chan)struct imx_mu_priv *priv =to_imx_mu_priv (chan->mbox);struct imx_mu_con_priv *cp = chan->con_priv; -if (cp->type ==IMX_MU_TYPE_TXDB ) +if (cp->type ==IMX_MU_TYPE_TXDB ) {tasklet_kill (&cp->txdb_tasklet); +return ; + }switch (cp->type) {case IMX_MU_TYPE_TX :
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 125/191 s390: disable preemption when switching to nodat stack with CALL_ON_STACK
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
[ Upstream commit 7f28dad395243c5026d649136823bbc40029a828 ]
Make sure preemption is disabled when temporary switching to nodat stack with CALL_ON_STACK helper, because nodat stack is per cpu.
--- arch/s390/kernel/machine_kexec.c | 2 ++ arch/s390/mm/maccess.c | 12 +++++++++--- 2 files changed, 11 insertions(+), 3 deletions(-)
arch/s390/kernel/machine_kexec.c +2 -0
@@ -164,7 +164,9 @@ static bool kdump_csum_valid(struct kimage *image)#ifdef CONFIG_CRASH_DUMP int rc; +preempt_disable (); rc =CALL_ON_STACK (do_start_kdump, S390_lowcore.nodat_stack,1 , image); +preempt_enable ();return rc ==0 ;#else return false;
arch/s390/mm/maccess.c +9 -3
@@ -119,9 +119,15 @@ static unsigned long __no_sanitize_address _memcpy_real(unsigned long dest,*/ int memcpy_real (void *dest,void *src,size_t count) { -if (S390_lowcore.nodat_stack !=0 ) -return CALL_ON_STACK (_memcpy_real, S390_lowcore.nodat_stack, -3 , dest, src, count); +int rc; + +if (S390_lowcore.nodat_stack !=0 ) { +preempt_disable (); + rc =CALL_ON_STACK (_memcpy_real, S390_lowcore.nodat_stack,3 , + dest, src, count); +preempt_enable (); +return rc; + }/* * This is a really early memcpy_real call, the stacks are * not set up yet. Just call _memcpy_real on the early boot
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 126/191 selftests: vm: add fragment CONFIG_TEST_VMALLOC
In reply to Greg Kroah-HartmanFrom: Anders Roxell <[email protected]>
[ Upstream commit 746dd4012d215b53152f0001a48856e41ea31730 ]
When running test_vmalloc.sh smoke the following print out states that the fragment is missing.
# ./test_vmalloc.sh: You must have the following enabled in your kernel:
# CONFIG_TEST_VMALLOC=m
Rework to add the fragment 'CONFIG_TEST_VMALLOC=m' to the config file.
--- tools/testing/selftests/vm/config | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/vm/config +1 -0
@@ -1,2 +1,3 @@ CONFIG_SYSVIPC=y CONFIG_USERFAULTFD=y +CONFIG_TEST_VMALLOC=m
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 127/191 mm/hugetlbfs: fix error handling when setting up mounts
In reply to Greg Kroah-HartmanFrom: Mike Kravetz <[email protected]>
[ Upstream commit 8fc312b32b25c6b0a8b46fab4df8c68df5af1223 ]
It is assumed that the hugetlbfs_vfsmount[] array will contain either a valid vfsmount pointer or NULL for each hstate after initialization. Changes made while converting to use fs_context broke this assumption.
While fixing the hugetlbfs_vfsmount issue, it was discovered that init_hugetlbfs_fs never did correctly clean up when encountering a vfs mount error.
It was found during code inspection. A small memory allocation failure would be the most likely cause of taking a error path with the bug. This is unlikely to happen as this is early init code.
--- fs/hugetlbfs/inode.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-)
fs/hugetlbfs/inode.c +22 -9
@@ -1461,28 +1461,41 @@ static int __init init_hugetlbfs_fs(void)sizeof (struct hugetlbfs_inode_info ), 0, SLAB_ACCOUNT, init_once);if (hugetlbfs_inode_cachep ==NULL ) - goto out2; + goto out; error =register_filesystem (&hugetlbfs_fs_type);if (error) - goto out; + goto out_free; +/* default hstate mount is required */ + mnt =mount_one_hugetlbfs (&hstates[default_hstate_idx]); +if (IS_ERR (mnt)) { + error =PTR_ERR (mnt); + goto out_unreg; + } + hugetlbfs_vfsmount[default_hstate_idx] = mnt; + +/* other hstates are optional */ i =0 ;for_each_hstate (h) { +if (i == default_hstate_idx) +continue ; + mnt =mount_one_hugetlbfs (h); -if (IS_ERR (mnt) && i ==0 ) { - error =PTR_ERR (mnt); - goto out; - } - hugetlbfs_vfsmount[i] = mnt; +if (IS_ERR (mnt)) + hugetlbfs_vfsmount[i] =NULL ; +else + hugetlbfs_vfsmount[i] = mnt; i++; }return 0 ; - out: + out_unreg: + (void )unregister_filesystem (&hugetlbfs_fs_type); + out_free:kmem_cache_destroy (hugetlbfs_inode_cachep); - out2: + out:return error; }fs_initcall (init_hugetlbfs_fs)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 128/191 kernel: sysctl: make drop_caches write-only
In reply to Greg Kroah-HartmanFrom: Johannes Weiner <[email protected]>
[ Upstream commit 204cb79ad42f015312a5bbd7012d09c93d9b46fb ]
Currently, the drop_caches proc file and sysctl read back the last value written, suggesting this is somehow a stateful setting instead of a one-time command. Make it write-only, like e.g. compact_memory.
While mitigating a VM problem at scale in our fleet, there was confusion about whether writing to this file will permanently switch the kernel into a non-caching mode. This influences the decision making in a tense situation, where tens of people are trying to fix tens of thousands of affected machines: Do we need a rollback strategy? What are the performance implications of operating in a non-caching state for several days? It also caused confusion when the kernel team said we may need to write the file several times to make sure it's effective ("But it already reads back 3?").
--- kernel/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sysctl.c +1 -1
@@ -1466,7 +1466,7 @@ static struct ctl_table vm_table[] = { .procname = "drop_caches", .data = &sysctl_drop_caches, .maxlen = sizeof(int), - .mode = 0644, + .mode = 0200, .proc_handler = drop_caches_sysctl_handler, .extra1 = SYSCTL_ONE, .extra2 = &four,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 129/191 userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
In reply to Greg Kroah-HartmanFrom: Mike Rapoport <[email protected]>
[ Upstream commit 3c1c24d91ffd536de0a64688a9df7f49e58fadbc ]
A while ago Andy noticed
(http://lkml.kernel.org/r/CALCETrWY+5ynDct7eU_nDUqx=okQvjm=Y5wJvA4ahBja=CQXGw@mail.gmail.com)
that UFFD_FEATURE_EVENT_FORK used by an unprivileged user may have security implications.
As the first step of the solution the following patch limits the availably of UFFD_FEATURE_EVENT_FORK only for those having CAP_SYS_PTRACE.
The usage of CAP_SYS_PTRACE ensures compatibility with CRIU.
Yet, if there are other users of non-cooperative userfaultfd that run without CAP_SYS_PTRACE, they would be broken :(
Current implementation of UFFD_FEATURE_EVENT_FORK modifies the file descriptor table from the read() implementation of uffd, which may have security implications for unprivileged use of the userfaultfd.
Limit availability of UFFD_FEATURE_EVENT_FORK only for callers that have CAP_SYS_PTRACE.
--- fs/userfaultfd.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
fs/userfaultfd.c +11 -7
@@ -1834,13 +1834,12 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,if (copy_from_user (&uffdio_api, buf,sizeof (uffdio_api))) goto out; features = uffdio_api.features; -if (uffdio_api.api !=UFFD_API || (features & ~UFFD_API_FEATURES )) { -memset (&uffdio_api,0 ,sizeof (uffdio_api)); -if (copy_to_user (buf, &uffdio_api,sizeof (uffdio_api))) - goto out; - ret = -EINVAL ; - goto out; - } + ret = -EINVAL ; +if (uffdio_api.api !=UFFD_API || (features & ~UFFD_API_FEATURES )) + goto err_out; + ret = -EPERM ; +if ((features &UFFD_FEATURE_EVENT_FORK ) && !capable (CAP_SYS_PTRACE )) + goto err_out;/* report all available features and ioctls to userland */ uffdio_api.features =UFFD_API_FEATURES ; uffdio_api.ioctls =UFFD_API_IOCTLS ;
@@ -1853,6 +1852,11 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, ret =0 ; out:return ret; +err_out: +memset (&uffdio_api,0 ,sizeof (uffdio_api)); +if (copy_to_user (buf, &uffdio_api,sizeof (uffdio_api))) + ret = -EFAULT ; + goto out; } static long userfaultfd_ioctl(struct file *file, unsigned cmd,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 130/191 Revert "powerpc/vcpu: Assume dedicated processors as non-preempt"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
This reverts commit 8332dbe5157a0056d8ab409957dfa89930066d87 which is commit 14c73bd344da60abaf7da3ea2e7733ddda35bbac upstream.
It breaks the build.
--- arch/powerpc/include/asm/spinlock.h | 4 +--- arch/powerpc/platforms/pseries/setup.c | 7 ------- 2 files changed, 1 insertion(+), 10 deletions(-)
arch/powerpc/include/asm/spinlock.h +1 -3
@@ -36,12 +36,10 @@#endif #ifdef CONFIG_PPC_PSERIES -DECLARE_STATIC_KEY_FALSE (shared_processor); -#define vcpu_is_preempted vcpu_is_preemptedstatic inline bool vcpu_is_preempted (int cpu) { -if (!static_branch_unlikely (&shared_processor)) +if (!firmware_has_feature (FW_FEATURE_SPLPAR ))return false;return !!(be32_to_cpu (lppaca_of (cpu).yield_count) &1 ); }
arch/powerpc/platforms/pseries/setup.c +0 -7
@@ -74,9 +74,6 @@#include "pseries.h" #include "../../../../drivers/pci/pci.h" -DEFINE_STATIC_KEY_FALSE (shared_processor); -EXPORT_SYMBOL_GPL (shared_processor); -int CMO_PrPSP =-1 ;int CMO_SecPSP =-1 ;unsigned long CMO_PageSize = (ASM_CONST (1 ) <<IOMMU_PAGE_SHIFT_4K );
@@ -761,10 +758,6 @@ static void __init pSeries_setup_arch(voif (firmware_has_feature (FW_FEATURE_LPAR )) {vpa_init (boot_cpuid); - -if (lppaca_shared_proc (get_lppaca ())) -static_branch_enable (&shared_processor); - ppc_md.power_save = pseries_lpar_idle; ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;#ifdef CONFIG_PCI_IOV
Greg Kroah-Hartman
maintainerPATCH 131/191 sctp: fix err handling of stream initialization
In reply to Greg Kroah-HartmanFrom: Marcelo Ricardo Leitner <[email protected]>
[ Upstream commit 61d5d4062876e21331c3d0ba4b02dbd50c06a658 ]
The fix on 951c6db954a1 fixed the issued reported there but introduced another. When the allocation fails within sctp_stream_init() it is okay/necessary to free the genradix. But it is also called when adding new streams, from sctp_send_add_streams() and sctp_process_strreset_addstrm_in() and in those situations it cannot just free the genradix because by then it is a fully operational association.
The fix here then is to only free the genradix in sctp_stream_init() and on those other call sites move on with what it already had and let the subsequent error handling to handle it.
Tested with the reproducers from this report and the previous one, with lksctp-tools and sctp-tests.
--- net/sctp/stream.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
net/sctp/stream.c +15 -15
@@ -84,10 +84,8 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,return 0 ; ret =genradix_prealloc (&stream->out, outcnt, gfp); -if (ret) { -genradix_free (&stream->out); +if (ret)return ret; - } stream->outcnt = outcnt;return 0 ;
@@ -102,10 +100,8 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt,return 0 ; ret =genradix_prealloc (&stream->in, incnt, gfp); -if (ret) { -genradix_free (&stream->in); +if (ret)return ret; - } stream->incnt = incnt;return 0 ;
@@ -123,7 +119,7 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt,* a new one with new outcnt to save memory if needed. */ if (outcnt == stream->outcnt) - goto in; + goto handle_in;/* Filter out chunks queued on streams that won't exist anymore */ sched->unsched_all (stream);
@@ -132,24 +128,28 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt, ret =sctp_stream_alloc_out (stream, outcnt, gfp);if (ret) - goto out; + goto out_err;for (i =0 ; i < stream->outcnt; i++)SCTP_SO (stream, i)->state =SCTP_STREAM_OPEN ; -in: +handle_in:sctp_stream_interleave_init (stream);if (!incnt) goto out; ret =sctp_stream_alloc_in (stream, incnt, gfp); -if (ret) { - sched->free (stream); -genradix_free (&stream->out); - stream->outcnt =0 ; - goto out; - } +if (ret) + goto in_err; + + goto out; +in_err: + sched->free (stream); +genradix_free (&stream->in); +out_err: +genradix_free (&stream->out); + stream->outcnt =0 ; out:return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 132/191 md: make sure desc_nr less than MD_SB_DISKS
In reply to Greg Kroah-HartmanFrom: Yufen Yu <[email protected]>
[ Upstream commit 3b7436cc9449d5ff7fa1c1fd5bc3edb6402ff5b8 ]
For super_90_load, we need to make sure 'desc_nr' less than MD_SB_DISKS, avoiding invalid memory access of 'sb->disks'.
--- drivers/md/md.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/md.c +1 -0
@@ -1159,6 +1159,7 @@ static int super_90_load(struct md_rdev/* not spare disk, or LEVEL_MULTIPATH */ if (sb->level ==LEVEL_MULTIPATH || (rdev->desc_nr >=0 && + rdev->desc_nr <MD_SB_DISKS && sb->disks[rdev->desc_nr].state & ((1 <<MD_DISK_SYNC ) | (1 <<MD_DISK_ACTIVE )))) spare_disk = false;
Greg Kroah-Hartman
maintainerPATCH 133/191 Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection"
In reply to Greg Kroah-HartmanFrom: Anders Kaseorg <[email protected]>
commit db5cce1afc8d2475d2c1c37c2a8267dd0e151526 upstream.
This reverts commit 968dcfb4905245dc64d65312c0d17692fa087b99.
Both that commit and commit 809805a820c6445f7a701ded24fdc6bbc841d1e4 attempted to fix the same bug (dead assignments to the local variable cfg), but they did so in incompatible ways. When they were both merged, independently of each other, the combination actually caused the bug to reappear, leading to a firmware crash on boot for some cards.
https://bugzilla.kernel.org/show_bug.cgi?id=205719
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +12 -12
@@ -1111,18 +1111,18 @@ static int iwl_pci_probe(struct pci_dev/* same thing for QuZ... */ if (iwl_trans->hw_rev ==CSR_HW_REV_TYPE_QUZ ) { -if (iwl_trans->cfg == &iwl_ax101_cfg_qu_hr) - iwl_trans->cfg = &iwl_ax101_cfg_quz_hr; -else if (iwl_trans->cfg == &iwl_ax201_cfg_qu_hr) - iwl_trans->cfg = &iwl_ax201_cfg_quz_hr; -else if (iwl_trans->cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0) - iwl_trans->cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc; -else if (iwl_trans->cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0) - iwl_trans->cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc; -else if (iwl_trans->cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0) - iwl_trans->cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc; -else if (iwl_trans->cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0) - iwl_trans->cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc; +if (cfg == &iwl_ax101_cfg_qu_hr) + cfg = &iwl_ax101_cfg_quz_hr; +else if (cfg == &iwl_ax201_cfg_qu_hr) + cfg = &iwl_ax201_cfg_quz_hr; +else if (cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0) + cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc; +else if (cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0) + cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc; +else if (cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0) + cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc; +else if (cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0) + cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc; }#endif
Greg Kroah-Hartman
maintainerPATCH 134/191 netfilter: ebtables: compat: reject all padding in matches/watchers
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit e608f631f0ba5f1fc5ee2e260a3a35d13107cbfe upstream.
syzbot reported following splat:
BUG: KASAN: vmalloc-out-of-bounds in size_entry_mwt net/bridge/netfilter/ebtables.c:2063 [inline] BUG: KASAN: vmalloc-out-of-bounds in compat_copy_entries+0x128b/0x1380 net/bridge/netfilter/ebtables.c:2155 Read of size 4 at addr ffffc900004461f4 by task syz-executor267/7937 CPU: 1 PID: 7937 Comm: syz-executor267 Not tainted 5.5.0-rc1-syzkaller #0 size_entry_mwt net/bridge/netfilter/ebtables.c:2063 [inline] compat_copy_entries+0x128b/0x1380 net/bridge/netfilter/ebtables.c:2155 compat_do_replace+0x344/0x720 net/bridge/netfilter/ebtables.c:2249 compat_do_ebt_set_ctl+0x22f/0x27e net/bridge/netfilter/ebtables.c:2333 [..]
Because padding isn't considered during computation of ->buf_user_offset, "total" is decremented by fewer bytes than it should.
Therefore, the first part of
if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
will pass, -- it should not have. This causes oob access:entry->next_offset is past the vmalloced size.
Reject padding and check that computed user offset (sum of ebt_entry structure plus all individual matches/watchers/targets) is same value that userspace gave us as the offset of the next entry.
--- net/bridge/netfilter/ebtables.c | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-)
net/bridge/netfilter/ebtables.c +16 -17
@@ -1867,7 +1867,7 @@ static int ebt_buf_count(struct ebt_entr }static int ebt_buf_add (struct ebt_entries_buf_state *state, -void *data,unsigned int sz) +const void *data,unsigned int sz) {if (state->buf_kern_start ==NULL ) goto count_only;
@@ -1901,7 +1901,7 @@ enum compat_mwt { EBT_COMPAT_TARGET, }; -static int compat_mtw_from_user (struct compat_ebt_entry_mwt *mwt, +static int compat_mtw_from_user (const struct compat_ebt_entry_mwt *mwt,enum compat_mwt compat_mwt,struct ebt_entries_buf_state *state,const unsigned char *base)
@@ -1979,22 +1979,23 @@ static int compat_mtw_from_user(struct c/* return size of all matches, watchers or target, including necessary * alignment and padding. */ -static int ebt_size_mwt (struct compat_ebt_entry_mwt *match32, +static int ebt_size_mwt (const struct compat_ebt_entry_mwt *match32,unsigned int size_left,enum compat_mwt type,struct ebt_entries_buf_state *state,const void *base) { +const char *buf = (const char *)match32;int growth =0 ; -char *buf;if (size_left ==0 )return 0 ; - buf = (char *) match32; - -while (size_left >=sizeof (*match32)) { + do { struct ebt_entry_match *match_kern; int ret; + if (size_left < sizeof(*match32)) + return -EINVAL; + match_kern = (struct ebt_entry_match *) state->buf_kern_start; if (match_kern) { char *tmp;
@@ -2031,22 +2032,18 @@ static int ebt_size_mwt(struct compat_ebif (match_kern) match_kern->match_size = ret; -/* rule should have no remaining data after target */ -if (type ==EBT_COMPAT_TARGET && size_left) -return -EINVAL ; - match32 = (struct compat_ebt_entry_mwt *) buf; - } + }while (size_left);return growth; }/* called for all ebt_entry structures. */ -static int size_entry_mwt (struct ebt_entry *entry,const unsigned char *base, +static int size_entry_mwt (const struct ebt_entry *entry,const unsigned char *base,unsigned int *total,struct ebt_entries_buf_state *state) { -unsigned int i, j, startoff, new_offset =0 ; +unsigned int i, j, startoff, next_expected_off, new_offset =0 ;/* stores match/watchers/targets & offset of next struct ebt_entry: */ unsigned int offsets[4 ];unsigned int *offsets_update =NULL ;
@@ -2132,11 +2129,13 @@ static int size_entry_mwt(struct ebt_entreturn ret; } - startoff = state->buf_user_offset - startoff; + next_expected_off = state->buf_user_offset - startoff; +if (next_expected_off != entry->next_offset) +return -EINVAL ; -if (WARN_ON (*total < startoff)) +if (*total < entry->next_offset)return -EINVAL ; - *total -= startoff; + *total -= entry->next_offset;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 135/191 6pack,mkiss: fix possible deadlock
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 5c9934b6767b16ba60be22ec3cbd4379ad64170d upstream.
We got another syzbot report [1] that tells us we must use write_lock_irq()/write_unlock_irq() to avoid possible deadlock.
[1]
WARNING: inconsistent lock state
5.5.0-rc1-syzkaller #0 Not tainted
--------------------------------
inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-R} usage.
syz-executor826/9605 [HC1[1]:SC0[0]:HE0:SE1] takes:ffffffff8a128718 (disc_data_lock){+-..}, at: sp_get.isra.0+0x1d/0xf0 drivers/net/ppp/ppp_synctty.c:138 {HARDIRQ-ON-W} state was registered at:
lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4485 __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline] _raw_write_lock_bh+0x33/0x50 kernel/locking/spinlock.c:319 sixpack_close+0x1d/0x250 drivers/net/hamradio/6pack.c:657 tty_ldisc_close.isra.0+0x119/0x1a0 drivers/tty/tty_ldisc.c:489 tty_set_ldisc+0x230/0x6b0 drivers/tty/tty_ldisc.c:585 tiocsetd drivers/tty/tty_io.c:2337 [inline] tty_ioctl+0xe8d/0x14f0 drivers/tty/tty_io.c:2597 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe irq event stamp: 3946 hardirqs last enabled at (3945): [<ffffffff87c86e43>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline] hardirqs last enabled at (3945): [<ffffffff87c86e43>] _raw_spin_unlock_irq+0x23/0x80 kernel/locking/spinlock.c:199 hardirqs last disabled at (3946): [<ffffffff8100675f>] trace_hardirqs_off_thunk+0x1a/0x1c arch/x86/entry/thunk_64.S:42 softirqs last enabled at (2658): [<ffffffff86a8b4df>] spin_unlock_bh include/linux/spinlock.h:383 [inline] softirqs last enabled at (2658): [<ffffffff86a8b4df>] clusterip_netdev_event+0x46f/0x670 net/ipv4/netfilter/ipt_CLUSTERIP.c:222 softirqs last disabled at (2656): [<ffffffff86a8b22b>] spin_lock_bh include/linux/spinlock.h:343 [inline] softirqs last disabled at (2656): [<ffffffff86a8b22b>] clusterip_netdev_event+0x1bb/0x670 net/ipv4/netfilter/ipt_CLUSTERIP.c:196
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(disc_data_lock);
<Interrupt>
lock(disc_data_lock);*** DEADLOCK ***
5 locks held by syz-executor826/9605:
#0: ffff8880a905e198 (&tty->legacy_mutex){+.+.}, at: tty_lock+0xc7/0x130 drivers/tty/tty_mutex.c:19
#1: ffffffff899a56c0 (rcu_read_lock){....}, at: mutex_spin_on_owner+0x0/0x330 kernel/locking/mutex.c:413
#2: ffff8880a496a2b0 (&(&i->lock)->rlock){-.-.}, at: spin_lock include/linux/spinlock.h:338 [inline]
#2: ffff8880a496a2b0 (&(&i->lock)->rlock){-.-.}, at: serial8250_interrupt+0x2d/0x1a0 drivers/tty/serial/8250/8250_core.c:116 #3: ffffffff8c104048 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x24/0x330 drivers/tty/serial/8250/8250_port.c:1823 #4: ffff8880a905e090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref+0x22/0x90 drivers/tty/tty_ldisc.c:288
stack backtrace: CPU: 1 PID: 9605 Comm: syz-executor826 Not tainted 5.5.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_usage_bug.cold+0x327/0x378 kernel/locking/lockdep.c:3101 valid_state kernel/locking/lockdep.c:3112 [inline] mark_lock_irq kernel/locking/lockdep.c:3309 [inline] mark_lock+0xbb4/0x1220 kernel/locking/lockdep.c:3666 mark_usage kernel/locking/lockdep.c:3554 [inline] __lock_acquire+0x1e55/0x4a00 kernel/locking/lockdep.c:3909 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4485 __raw_read_lock include/linux/rwlock_api_smp.h:149 [inline] _raw_read_lock+0x32/0x50 kernel/locking/spinlock.c:223 sp_get.isra.0+0x1d/0xf0 drivers/net/ppp/ppp_synctty.c:138 sixpack_write_wakeup+0x25/0x340 drivers/net/hamradio/6pack.c:402 tty_wakeup+0xe9/0x120 drivers/tty/tty_io.c:536 tty_port_default_wakeup+0x2b/0x40 drivers/tty/tty_port.c:50 tty_port_tty_wakeup+0x57/0x70 drivers/tty/tty_port.c:387 uart_write_wakeup+0x46/0x70 drivers/tty/serial/serial_core.c:104 serial8250_tx_chars+0x495/0xaf0 drivers/tty/serial/8250/8250_port.c:1761 serial8250_handle_irq.part.0+0x2a2/0x330 drivers/tty/serial/8250/8250_port.c:1834 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1820 [inline] serial8250_default_handle_irq+0xc0/0x150 drivers/tty/serial/8250/8250_port.c:1850 serial8250_interrupt+0xf1/0x1a0 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x15d/0x970 kernel/irq/handle.c:149 handle_irq_event_percpu+0x74/0x160 kernel/irq/handle.c:189 handle_irq_event+0xa7/0x134 kernel/irq/handle.c:206 handle_edge_irq+0x25e/0x8d0 kernel/irq/chip.c:830 generic_handle_irq_desc include/linux/irqdesc.h:156 [inline] do_IRQ+0xde/0x280 arch/x86/kernel/irq.c:250 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:607 </IRQ> RIP: 0010:cpu_relax arch/x86/include/asm/processor.h:685 [inline] RIP: 0010:mutex_spin_on_owner+0x247/0x330 kernel/locking/mutex.c:579 Code: c3 be 08 00 00 00 4c 89 e7 e8 e5 06 59 00 4c 89 e0 48 c1 e8 03 42 80 3c 38 00 0f 85 e1 00 00 00 49 8b 04 24 a8 01 75 96 f3 90 <e9> 2f fe ff ff 0f 0b e8 0d 19 09 00 84 c0 0f 85 ff fd ff ff 48 c7 RSP: 0018:ffffc90001eafa20 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffd7 RAX: 0000000000000000 RBX: ffff88809fd9e0c0 RCX: 1ffffffff13266dd RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 RBP: ffffc90001eafa60 R08: 1ffff11013d22898 R09: ffffed1013d22899 R10: ffffed1013d22898 R11: ffff88809e9144c7 R12: ffff8880a905e138 R13: ffff88809e9144c0 R14: 0000000000000000 R15: dffffc0000000000 mutex_optimistic_spin kernel/locking/mutex.c:673 [inline] __mutex_lock_common kernel/locking/mutex.c:962 [inline] __mutex_lock+0x32b/0x13c0 kernel/locking/mutex.c:1106 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1121 tty_lock+0xc7/0x130 drivers/tty/tty_mutex.c:19 tty_release+0xb5/0xe90 drivers/tty/tty_io.c:1665 __fput+0x2ff/0x890 fs/file_table.c:280 ____fput+0x16/0x20 fs/file_table.c:313 task_work_run+0x145/0x1c0 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x8e7/0x2ef0 kernel/exit.c:797 do_group_exit+0x135/0x360 kernel/exit.c:895 __do_sys_exit_group kernel/exit.c:906 [inline] __se_sys_exit_group kernel/exit.c:904 [inline] __x64_sys_exit_group+0x44/0x50 kernel/exit.c:904 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x43fef8 Code: Bad RIP value. RSP: 002b:00007ffdb07d2338 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043fef8 RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 RBP: 00000000004bf730 R08: 00000000000000e7 R09: ffffffffffffffd0 R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000000001 R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000
--- drivers/net/hamradio/6pack.c | 4 ++-- drivers/net/hamradio/mkiss.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/net/hamradio/6pack.c +2 -2
@@ -654,10 +654,10 @@ static void sixpack_close(struct tty_str {struct sixpack *sp; -write_lock_bh (&disc_data_lock); +write_lock_irq (&disc_data_lock); sp = tty->disc_data; tty->disc_data =NULL ; -write_unlock_bh (&disc_data_lock); +write_unlock_irq (&disc_data_lock);if (!sp)return ;
drivers/net/hamradio/mkiss.c +2 -2
@@ -773,10 +773,10 @@ static void mkiss_close(struct tty_struc {struct mkiss *ax; -write_lock_bh (&disc_data_lock); +write_lock_irq (&disc_data_lock); ax = tty->disc_data; tty->disc_data =NULL ; -write_unlock_bh (&disc_data_lock); +write_unlock_irq (&disc_data_lock);if (!ax)return ;
Greg Kroah-Hartman
maintainerPATCH 136/191 powerpc: Fix __clear_user() with KUAP enabled
In reply to Greg Kroah-HartmanFrom: Andrew Donnellan <[email protected]>
commit 61e3acd8c693a14fc69b824cb5b08d02cb90a6e7 upstream.
The KUAP implementation adds calls in clear_user() to enable and disable access to userspace memory. However, it doesn't add these to __clear_user(), which is used in the ptrace regset code.
As there's only one direct user of __clear_user() (the regset code), and the time taken to set the AMR for KUAP purposes is going to dominate the cost of a quick access_ok(), there's not much point having a separate path.
Rename __clear_user() to __arch_clear_user(), and make __clear_user() just call clear_user().
--- arch/powerpc/include/asm/uaccess.h | 9 +++++++-- arch/powerpc/lib/string_32.S | 4 ++-- arch/powerpc/lib/string_64.S | 6 +++--- 3 files changed, 12 insertions(+), 7 deletions(-)
arch/powerpc/include/asm/uaccess.h +7 -2
@@ -401,7 +401,7 @@ copy_to_user_mcsafe(void __user *to, conreturn n; } -extern unsigned long __clear_user (void __user *addr,unsigned long size); +unsigned long __arch_clear_user (void __user *addr,unsigned long size);static inline unsigned long clear_user (void __user *addr,unsigned long size) {
@@ -409,12 +409,17 @@ static inline unsigned long clear_user(vmight_fault ();if (likely (access_ok (addr, size))) {allow_write_to_user (addr, size); - ret =__clear_user (addr, size); + ret =__arch_clear_user (addr, size);prevent_write_to_user (addr, size); }return ret; } +static inline unsigned long __clear_user (void __user *addr,unsigned long size) +{ +return clear_user (addr, size); +} +extern long strncpy_from_user (char *dst,const char __user *src,long count);extern __must_check long strnlen_user (const char __user *str,long n);
arch/powerpc/lib/string_32.S +2 -2
@@ -17,7 +17,7 @@ CACHELINE_BYTES = L1_CACHE_BYTES LG_CACHELINE_BYTES = L1_CACHE_SHIFT CACHELINE_MASK = (L1_CACHE_BYTES-1) -_GLOBAL(__clear_user) +_GLOBAL(__arch_clear_user) /* * Use dcbz on the complete cache lines in the destination * to set them to zero. This requires that the destination
@@ -87,4 +87,4 @@ _GLOBAL(__clear_user) EX_TABLE(8b, 91b) EX_TABLE(9b, 91b) -EXPORT_SYMBOL(__clear_user) +EXPORT_SYMBOL(__arch_clear_user)
arch/powerpc/lib/string_64.S +3 -3
@@ -17,7 +17,7 @@ PPC64_CACHES: .section ".text" /** - * __clear_user: - Zero a block of memory in user space, with less checking. + * __arch_clear_user: - Zero a block of memory in user space, with less checking. * @to: Destination address, in user space. * @n: Number of bytes to zero. *
@@ -58,7 +58,7 @@ err3; stb r0,0(r3) mr r3,r4 blr -_GLOBAL_TOC(__clear_user) +_GLOBAL_TOC(__arch_clear_user) cmpdi r4,32 neg r6,r3 li r0,0
@@ -181,4 +181,4 @@ err1; dcbz 0,r3 cmpdi r4,32 blt .Lshort_clear b .Lmedium_clear -EXPORT_SYMBOL(__clear_user) +EXPORT_SYMBOL(__arch_clear_user)
Greg Kroah-Hartman
maintainerPATCH 137/191 net/smc: add fallback check to connect()
In reply to Greg Kroah-HartmanFrom: Ursula Braun <[email protected]>
commit 86434744fedf0cfe07a9eee3f4632c0e25c1d136 upstream.
FASTOPEN setsockopt() or sendmsg() may switch the SMC socket to fallback mode. Once fallback mode is active, the native TCP socket functions are called. Nevertheless there is a small race window, when FASTOPEN setsockopt/sendmsg runs in parallel to a connect(), and switch the socket into fallback mode before connect() takes the sock lock. Make sure the SMC-specific connect setup is omitted in this case.
This way a syzbot-reported refcount problem is fixed, triggered by different threads running non-blocking connect() and FASTOPEN_KEY setsockopt.
--- net/smc/af_smc.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/smc/af_smc.c +8 -6
@@ -854,6 +854,8 @@ static int smc_connect(struct socket *so goto out;sock_hold (&smc->sk);/* sock put in passive closing */ +if (smc->use_fallback) + goto out;if (flags &O_NONBLOCK ) {if (schedule_work (&smc->connect_work)) smc->connect_nonblock =1 ;
@@ -1716,8 +1718,6 @@ static int smc_setsockopt(struct socket sk->sk_err = smc->clcsock->sk->sk_err; sk->sk_error_report (sk); } -if (rc) -return rc;if (optlen <sizeof (int ))return -EINVAL ;
@@ -1725,6 +1725,8 @@ static int smc_setsockopt(struct socketreturn -EFAULT ;lock_sock (sk); +if (rc || smc->use_fallback) + goto out;switch (optname) {case TCP_ULP :case TCP_FASTOPEN :
@@ -1736,15 +1738,14 @@ static int smc_setsockopt(struct socketsmc_switch_to_fallback (smc); smc->fallback_rsn =SMC_CLC_DECL_OPTUNSUPP ; }else { -if (!smc->use_fallback) - rc = -EINVAL ; + rc = -EINVAL ; }break ;case TCP_NODELAY :if (sk->sk_state !=SMC_INIT && sk->sk_state !=SMC_LISTEN && sk->sk_state !=SMC_CLOSED ) { -if (val && !smc->use_fallback) +if (val)mod_delayed_work (system_wq, &smc->conn.tx_work,0 ); }
@@ -1753,7 +1754,7 @@ static int smc_setsockopt(struct socketif (sk->sk_state !=SMC_INIT && sk->sk_state !=SMC_LISTEN && sk->sk_state !=SMC_CLOSED ) { -if (!val && !smc->use_fallback) +if (!val)mod_delayed_work (system_wq, &smc->conn.tx_work,0 ); }
@@ -1764,6 +1765,7 @@ static int smc_setsockopt(struct socketdefault :break ; } +out:release_sock (sk);return rc;
Greg Kroah-Hartman
maintainerPATCH 138/191 netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 5604285839aaedfb23ebe297799c6e558939334d upstream.
syzbot is kind enough to remind us we need to call skb_may_pull()
BUG: KMSAN: uninit-value in br_nf_forward_arp+0xe61/0x1230 net/bridge/br_netfilter_hooks.c:665 CPU: 1 PID: 11631 Comm: syz-executor.1 Not tainted 5.4.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 __msan_warning+0x64/0xc0 mm/kmsan/kmsan_instr.c:245 br_nf_forward_arp+0xe61/0x1230 net/bridge/br_netfilter_hooks.c:665 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline] nf_hook_slow+0x18b/0x3f0 net/netfilter/core.c:512 nf_hook include/linux/netfilter.h:260 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] __br_forward+0x78f/0xe30 net/bridge/br_forward.c:109 br_flood+0xef0/0xfe0 net/bridge/br_forward.c:234 br_handle_frame_finish+0x1a77/0x1c20 net/bridge/br_input.c:162 nf_hook_bridge_pre net/bridge/br_input.c:245 [inline] br_handle_frame+0xfb6/0x1eb0 net/bridge/br_input.c:348 __netif_receive_skb_core+0x20b9/0x51a0 net/core/dev.c:4830 __netif_receive_skb_one_core net/core/dev.c:4927 [inline] __netif_receive_skb net/core/dev.c:5043 [inline] process_backlog+0x610/0x13c0 net/core/dev.c:5874 napi_poll net/core/dev.c:6311 [inline] net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6379 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 do_softirq_own_stack+0x49/0x80 arch/x86/entry/entry_64.S:1091 </IRQ> do_softirq kernel/softirq.c:338 [inline] __local_bh_enable_ip+0x184/0x1d0 kernel/softirq.c:190 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:688 [inline] __dev_queue_xmit+0x38e8/0x4200 net/core/dev.c:3819 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3825 packet_snd net/packet/af_packet.c:2959 [inline] packet_sendmsg+0x8234/0x9100 net/packet/af_packet.c:2984 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] __sys_sendto+0xc44/0xc70 net/socket.c:1952 __do_sys_sendto net/socket.c:1964 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1960 __x64_sys_sendto+0x6e/0x90 net/socket.c:1960 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45a679 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f0a3c9e5c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045a679 RDX: 000000000000000e RSI: 0000000020000200 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 00000000200000c0 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0a3c9e66d4 R13: 00000000004c8ec1 R14: 00000000004dfe28 R15: 00000000ffffffff
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline] kmsan_internal_poison_shadow+0x5c/0x110 mm/kmsan/kmsan.c:132 kmsan_slab_alloc+0x97/0x100 mm/kmsan/kmsan_hooks.c:86 slab_alloc_node mm/slub.c:2773 [inline] __kmalloc_node_track_caller+0xe27/0x11a0 mm/slub.c:4381 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x306/0xa10 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] alloc_skb_with_frags+0x18c/0xa80 net/core/skbuff.c:5662 sock_alloc_send_pskb+0xafd/0x10a0 net/core/sock.c:2244 packet_alloc_skb net/packet/af_packet.c:2807 [inline] packet_snd net/packet/af_packet.c:2902 [inline] packet_sendmsg+0x63a6/0x9100 net/packet/af_packet.c:2984 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] __sys_sendto+0xc44/0xc70 net/socket.c:1952 __do_sys_sendto net/socket.c:1964 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1960 __x64_sys_sendto+0x6e/0x90 net/socket.c:1960 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- net/bridge/br_netfilter_hooks.c | 3 +++ 1 file changed, 3 insertions(+)
net/bridge/br_netfilter_hooks.c +3 -0
@@ -662,6 +662,9 @@ static unsigned int br_nf_forward_arp(vonf_bridge_pull_encap_header (skb); } +if (unlikely (!pskb_may_pull (skb,sizeof (struct arphdr )))) +return NF_DROP ; +if (arp_hdr (skb)->ar_pln !=4 ) {if (is_vlan_arp (skb, state->net))nf_bridge_push_encap_header (skb);
Greg Kroah-Hartman
maintainerPATCH 139/191 inetpeer: fix data-race in inet_putpeer / inet_putpeer
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 71685eb4ce80ae9c49eff82ca4dd15acab215de9 upstream.
We need to explicitely forbid read/store tearing in inet_peer_gc() and inet_putpeer().
The following syzbot report reminds us about inet_putpeer() running without a lock held.
BUG: KCSAN: data-race in inet_putpeer / inet_putpeer
write to 0xffff888121fb2ed0 of 4 bytes by interrupt on cpu 0:
inet_putpeer+0x37/0xa0 net/ipv4/inetpeer.c:240 ip4_frag_free+0x3d/0x50 net/ipv4/ip_fragment.c:102 inet_frag_destroy_rcu+0x58/0x80 net/ipv4/inet_fragment.c:228 __rcu_reclaim kernel/rcu/rcu.h:222 [inline] rcu_do_batch+0x256/0x5b0 kernel/rcu/tree.c:2157 rcu_core+0x369/0x4d0 kernel/rcu/tree.c:2377 rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2386 __do_softirq+0x115/0x33f kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0xbb/0xe0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71 arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94 cpuidle_idle_call kernel/sched/idle.c:154 [inline] do_idle+0x1af/0x280 kernel/sched/idle.c:263
write to 0xffff888121fb2ed0 of 4 bytes by interrupt on cpu 1:
inet_putpeer+0x37/0xa0 net/ipv4/inetpeer.c:240 ip4_frag_free+0x3d/0x50 net/ipv4/ip_fragment.c:102 inet_frag_destroy_rcu+0x58/0x80 net/ipv4/inet_fragment.c:228 __rcu_reclaim kernel/rcu/rcu.h:222 [inline] rcu_do_batch+0x256/0x5b0 kernel/rcu/tree.c:2157 rcu_core+0x369/0x4d0 kernel/rcu/tree.c:2377 rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2386 __do_softirq+0x115/0x33f kernel/softirq.c:292 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- net/ipv4/inetpeer.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
net/ipv4/inetpeer.c +10 -2
@@ -160,7 +160,12 @@ static void inet_peer_gc(struct inet_pee base->total / inet_peer_threshold *HZ ;for (i =0 ; i < gc_cnt; i++) { p = gc_stack[i]; - delta = (__u32 )jiffies - p->dtime; + +/* The READ_ONCE() pairs with the WRITE_ONCE() +* in inet_putpeer() +*/ + delta = (__u32 )jiffies -READ_ONCE (p->dtime); +if (delta < ttl || !refcount_dec_if_one (&p->refcnt)) gc_stack[i] =NULL ; }
@@ -237,7 +242,10 @@ EXPORT_SYMBOL_GPL(inet_getpeer);void inet_putpeer (struct inet_peer *p) { - p->dtime = (__u32 )jiffies; +/* The WRITE_ONCE() pairs with itself (we run lockless) +* and the READ_ONCE() in inet_peer_gc() +*/ +WRITE_ONCE (p->dtime, (__u32 )jiffies);if (refcount_dec_and_test (&p->refcnt))call_rcu (&p->rcu, inetpeer_free_rcu);
Greg Kroah-Hartman
maintainerPATCH 140/191 net: add a READ_ONCE() in skb_peek_tail()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit f8cc62ca3e660ae3fdaee533b1d554297cd2ae82 upstream.
skb_peek_tail() can be used without protection of a lock, as spotted by KCSAN [1]
In order to avoid load-stearing, add a READ_ONCE()
Note that the corresponding WRITE_ONCE() are already there.
[1]
BUG: KCSAN: data-race in sk_wait_data / skb_queue_tail
read to 0xffff8880b36a4118 of 8 bytes by task 20426 on cpu 1:
skb_peek_tail include/linux/skbuff.h:1784 [inline] sk_wait_data+0x15b/0x250 net/core/sock.c:2477 kcm_wait_data+0x112/0x1f0 net/kcm/kcmsock.c:1103 kcm_recvmsg+0xac/0x320 net/kcm/kcmsock.c:1130 sock_recvmsg_nosec net/socket.c:871 [inline] sock_recvmsg net/socket.c:889 [inline] sock_recvmsg+0x92/0xb0 net/socket.c:885 ___sys_recvmsg+0x1a0/0x3e0 net/socket.c:2480 do_recvmmsg+0x19a/0x5c0 net/socket.c:2601 __sys_recvmmsg+0x1ef/0x200 net/socket.c:2680 __do_sys_recvmmsg net/socket.c:2703 [inline] __se_sys_recvmmsg net/socket.c:2696 [inline] __x64_sys_recvmmsg+0x89/0xb0 net/socket.c:2696 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9
write to 0xffff8880b36a4118 of 8 bytes by task 451 on cpu 0:
__skb_insert include/linux/skbuff.h:1852 [inline] __skb_queue_before include/linux/skbuff.h:1958 [inline] __skb_queue_tail include/linux/skbuff.h:1991 [inline] skb_queue_tail+0x7e/0xc0 net/core/skbuff.c:3145 kcm_queue_rcv_skb+0x202/0x310 net/kcm/kcmsock.c:206 kcm_rcv_strparser+0x74/0x4b0 net/kcm/kcmsock.c:370 __strp_recv+0x348/0xf50 net/strparser/strparser.c:309 strp_recv+0x84/0xa0 net/strparser/strparser.c:343 tcp_read_sock+0x174/0x5c0 net/ipv4/tcp.c:1639 strp_read_sock+0xd4/0x140 net/strparser/strparser.c:366 do_strp_work net/strparser/strparser.c:414 [inline] strp_work+0x9a/0xe0 net/strparser/strparser.c:423 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269 worker_thread+0xa0/0x800 kernel/workqueue.c:2415 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 451 Comm: kworker/u4:3 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: kstrp strp_work
--- include/linux/skbuff.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
include/linux/skbuff.h +4 -2
@@ -1795,7 +1795,7 @@ static inline struct sk_buff *skb_peek_n*/ static inline struct sk_buff *skb_peek_tail (const struct sk_buff_head *list_) { -struct sk_buff *skb = list_->prev; +struct sk_buff *skb =READ_ONCE (list_->prev);if (skb == (struct sk_buff *)list_) skb =NULL ;
@@ -1861,7 +1861,9 @@ static inline void __skb_insert(struct s struct sk_buff *prev, struct sk_buff *next, struct sk_buff_head *list) { -/* see skb_queue_empty_lockless() for the opposite READ_ONCE() */ +/* See skb_queue_empty_lockless() and skb_peek_tail() +* for the opposite READ_ONCE() +*/ WRITE_ONCE(newsk->next, next);WRITE_ONCE (newsk->prev, prev);WRITE_ONCE (next->prev, newsk);
Greg Kroah-Hartman
maintainerPATCH 141/191 net: icmp: fix data-race in cmp_global_allow()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit bbab7ef235031f6733b5429ae7877bfa22339712 upstream.
This code reads two global variables without protection of a lock. We need READ_ONCE()/WRITE_ONCE() pairs to avoid load/store-tearing and better document the intent.
KCSAN reported :
BUG: KCSAN: data-race in icmp_global_allow / icmp_global_allow
read to 0xffffffff861a8014 of 4 bytes by task 11201 on cpu 0:
icmp_global_allow+0x36/0x1b0 net/ipv4/icmp.c:254 icmpv6_global_allow net/ipv6/icmp.c:184 [inline] icmpv6_global_allow net/ipv6/icmp.c:179 [inline] icmp6_send+0x493/0x1140 net/ipv6/icmp.c:514 icmpv6_send+0x71/0xb0 net/ipv6/ip6_icmp.c:43 ip6_link_failure+0x43/0x180 net/ipv6/route.c:2640 dst_link_failure include/net/dst.h:419 [inline] vti_xmit net/ipv4/ip_vti.c:243 [inline] vti_tunnel_xmit+0x27f/0xa50 net/ipv4/ip_vti.c:279 __netdev_start_xmit include/linux/netdevice.h:4420 [inline] netdev_start_xmit include/linux/netdevice.h:4434 [inline] xmit_one net/core/dev.c:3280 [inline] dev_hard_start_xmit+0xef/0x430 net/core/dev.c:3296 __dev_queue_xmit+0x14c9/0x1b60 net/core/dev.c:3873 dev_queue_xmit+0x21/0x30 net/core/dev.c:3906 neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530 neigh_output include/net/neighbour.h:511 [inline] ip6_finish_output2+0x7a6/0xec0 net/ipv6/ip6_output.c:116 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline] __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175 dst_output include/net/dst.h:436 [inline] ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
write to 0xffffffff861a8014 of 4 bytes by task 11183 on cpu 1:
icmp_global_allow+0x174/0x1b0 net/ipv4/icmp.c:272 icmpv6_global_allow net/ipv6/icmp.c:184 [inline] icmpv6_global_allow net/ipv6/icmp.c:179 [inline] icmp6_send+0x493/0x1140 net/ipv6/icmp.c:514 icmpv6_send+0x71/0xb0 net/ipv6/ip6_icmp.c:43 ip6_link_failure+0x43/0x180 net/ipv6/route.c:2640 dst_link_failure include/net/dst.h:419 [inline] vti_xmit net/ipv4/ip_vti.c:243 [inline] vti_tunnel_xmit+0x27f/0xa50 net/ipv4/ip_vti.c:279 __netdev_start_xmit include/linux/netdevice.h:4420 [inline] netdev_start_xmit include/linux/netdevice.h:4434 [inline] xmit_one net/core/dev.c:3280 [inline] dev_hard_start_xmit+0xef/0x430 net/core/dev.c:3296 __dev_queue_xmit+0x14c9/0x1b60 net/core/dev.c:3873 dev_queue_xmit+0x21/0x30 net/core/dev.c:3906 neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530 neigh_output include/net/neighbour.h:511 [inline] ip6_finish_output2+0x7a6/0xec0 net/ipv6/ip6_output.c:116 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline] __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 11183 Comm: syz-executor.2 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- net/ipv4/icmp.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/ipv4/icmp.c +6 -5
@@ -249,10 +249,11 @@ bool icmp_global_allow(void)bool rc = false;/* Check if token bucket is empty and cannot be refilled -* without taking the spinlock. +* without taking the spinlock. The READ_ONCE() are paired +* with the following WRITE_ONCE() in this same function. */ -if (!icmp_global.credit) { - delta =min_t (u32, now - icmp_global.stamp,HZ ); +if (!READ_ONCE (icmp_global.credit)) { + delta =min_t (u32, now -READ_ONCE (icmp_global.stamp),HZ );if (delta <HZ /50 )return false; }
@@ -262,14 +263,14 @@ bool icmp_global_allow(void)if (delta >=HZ /50 ) { incr = sysctl_icmp_msgs_per_sec * delta /HZ ;if (incr) - icmp_global.stamp = now; +WRITE_ONCE (icmp_global.stamp, now); } credit =min_t (u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);if (credit) { credit--; rc = true; } - icmp_global.credit = credit; +WRITE_ONCE (icmp_global.credit, credit);spin_unlock (&icmp_global.lock);return rc; }
Greg Kroah-Hartman
maintainerPATCH 142/191 hrtimer: Annotate lockless access to timer->state
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 56144737e67329c9aaed15f942d46a6302e2e3d8 upstream.
syzbot reported various data-race caused by hrtimer_is_queued() reading timer->state. A READ_ONCE() is required there to silence the warning.
Also add the corresponding WRITE_ONCE() when timer->state is set.
In remove_hrtimer() the hrtimer_is_queued() helper is open coded to avoid loading timer->state twice.
KCSAN reported these cases:
BUG: KCSAN: data-race in __remove_hrtimer / tcp_pacing_check
write to 0xffff8880b2a7d388 of 1 bytes by interrupt on cpu 0:
__remove_hrtimer+0x52/0x130 kernel/time/hrtimer.c:991 __run_hrtimer kernel/time/hrtimer.c:1496 [inline] __hrtimer_run_queues+0x250/0x600 kernel/time/hrtimer.c:1576 hrtimer_run_softirq+0x10e/0x150 kernel/time/hrtimer.c:1593 __do_softirq+0x115/0x33f kernel/softirq.c:292 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
read to 0xffff8880b2a7d388 of 1 bytes by task 24652 on cpu 1:
tcp_pacing_check net/ipv4/tcp_output.c:2235 [inline] tcp_pacing_check+0xba/0x130 net/ipv4/tcp_output.c:2225 tcp_xmit_retransmit_queue+0x32c/0x5a0 net/ipv4/tcp_output.c:3044 tcp_xmit_recovery+0x7c/0x120 net/ipv4/tcp_input.c:3558 tcp_ack+0x17b6/0x3170 net/ipv4/tcp_input.c:3717 tcp_rcv_established+0x37e/0xf50 net/ipv4/tcp_input.c:5696 tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1561 sk_backlog_rcv include/net/sock.h:945 [inline] __release_sock+0x135/0x1e0 net/core/sock.c:2435 release_sock+0x61/0x160 net/core/sock.c:2951 sk_stream_wait_memory+0x3d7/0x7c0 net/core/stream.c:145 tcp_sendmsg_locked+0xb47/0x1f30 net/ipv4/tcp.c:1393 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1434 inet_sendmsg+0x6d/0x90 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0x9f/0xc0 net/socket.c:657 BUG: KCSAN: data-race in __remove_hrtimer / __tcp_ack_snd_check
write to 0xffff8880a3a65588 of 1 bytes by interrupt on cpu 0:
__remove_hrtimer+0x52/0x130 kernel/time/hrtimer.c:991 __run_hrtimer kernel/time/hrtimer.c:1496 [inline] __hrtimer_run_queues+0x250/0x600 kernel/time/hrtimer.c:1576 hrtimer_run_softirq+0x10e/0x150 kernel/time/hrtimer.c:1593 __do_softirq+0x115/0x33f kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0xbb/0xe0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
read to 0xffff8880a3a65588 of 1 bytes by task 22891 on cpu 1:
__tcp_ack_snd_check+0x415/0x4f0 net/ipv4/tcp_input.c:5265 tcp_ack_snd_check net/ipv4/tcp_input.c:5287 [inline] tcp_rcv_established+0x750/0xf50 net/ipv4/tcp_input.c:5708 tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1561 sk_backlog_rcv include/net/sock.h:945 [inline] __release_sock+0x135/0x1e0 net/core/sock.c:2435 release_sock+0x61/0x160 net/core/sock.c:2951 sk_stream_wait_memory+0x3d7/0x7c0 net/core/stream.c:145 tcp_sendmsg_locked+0xb47/0x1f30 net/ipv4/tcp.c:1393 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1434 inet_sendmsg+0x6d/0x90 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0x9f/0xc0 net/socket.c:657 __sys_sendto+0x21f/0x320 net/socket.c:1952 __do_sys_sendto net/socket.c:1964 [inline] __se_sys_sendto net/socket.c:1960 [inline] __x64_sys_sendto+0x89/0xb0 net/socket.c:1960 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 24652 Comm: syz-executor.3 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ tglx: Added comments ]
--- include/linux/hrtimer.h | 14 ++++++++++---- kernel/time/hrtimer.c | 11 +++++++---- 2 files changed, 17 insertions(+), 8 deletions(-)
include/linux/hrtimer.h +10 -4
@@ -456,12 +456,18 @@ extern u64 hrtimer_next_event_without(coextern bool hrtimer_active (const struct hrtimer *timer); -/* -* Helper function to check, whether the timer is on one of the queues +/** +* hrtimer_is_queued = check, whether the timer is on one of the queues +* @timer: Timer to check +* +* Returns: True if the timer is queued, false otherwise +* +* The function can be used lockless, but it gives only a current snapshot. */ -static inline int hrtimer_is_queued (struct hrtimer *timer) +static inline bool hrtimer_is_queued (struct hrtimer *timer) { -return timer->state &HRTIMER_STATE_ENQUEUED ; +/* The READ_ONCE pairs with the update functions of timer->state */ +return !!(READ_ONCE (timer->state) &HRTIMER_STATE_ENQUEUED ); }/*
kernel/time/hrtimer.c +7 -4
@@ -966,7 +966,8 @@ static int enqueue_hrtimer(struct hrtime base->cpu_base->active_bases |=1 << base->index; - timer->state =HRTIMER_STATE_ENQUEUED ; +/* Pairs with the lockless read in hrtimer_is_queued() */ +WRITE_ONCE (timer->state,HRTIMER_STATE_ENQUEUED );return timerqueue_add (&base->active, &timer->node); }
@@ -988,7 +989,8 @@ static void __remove_hrtimer(struct hrtistruct hrtimer_cpu_base *cpu_base = base->cpu_base;u8 state = timer->state; - timer->state = newstate; +/* Pairs with the lockless read in hrtimer_is_queued() */ +WRITE_ONCE (timer->state, newstate);if (!(state &HRTIMER_STATE_ENQUEUED ))return ;
@@ -1013,8 +1015,9 @@ static void __remove_hrtimer(struct hrtistatic inline int remove_hrtimer (struct hrtimer *timer,struct hrtimer_clock_base *base,bool restart) { -if (hrtimer_is_queued (timer)) { -u8 state = timer->state; +u8 state = timer->state; + +if (state &HRTIMER_STATE_ENQUEUED ) {int reprogram;/*
Greg Kroah-Hartman
maintainerPATCH 143/191 tomoyo: Dont use nifty names on sockets.
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit 6f7c41374b62fd80bbd8aae3536c43688c54d95e upstream.
syzbot is reporting that use of SOCKET_I()->sk from open() can result in use after free problem [1], for socket's inode is still reachable via /proc/pid/fd/n despite destruction of SOCKET_I()->sk already completed.
At first I thought that this race condition applies to only open/getattr permission checks. But James Morris has pointed out that there are more permission checks where this race condition applies to. Thus, get rid of tomoyo_get_socket_name() instead of conditionally bypassing permission checks on sockets. As a side effect of this patch, "socket:[family=\$:type=\$:protocol=\$]" in the policy files has to be rewritten to "socket:[\$]".
[1] https://syzkaller.appspot.com/bug?id=73d590010454403d55164cca23bd0565b1eb3b74
--- security/tomoyo/realpath.c | 32 +------------------------------- 1 file changed, 1 insertion(+), 31 deletions(-)
security/tomoyo/realpath.c +1 -31
@@ -218,31 +218,6 @@ out: }/** -* tomoyo_get_socket_name - Get the name of a socket. -* -* @path: Pointer to "struct path". -* @buffer: Pointer to buffer to return value in. -* @buflen: Sizeof @buffer. -* -* Returns the buffer. -*/ -static char *tomoyo_get_socket_name (const struct path *path,char *const buffer, -const int buflen) -{ -struct inode *inode =d_backing_inode (path->dentry); -struct socket *sock = inode ?SOCKET_I (inode) :NULL ; -struct sock *sk = sock ? sock->sk :NULL ; - -if (sk) { -snprintf (buffer, buflen,"socket:[family=%u:type=%u:protocol=%u]" , - sk->sk_family, sk->sk_type, sk->sk_protocol); - }else { -snprintf (buffer, buflen,"socket:[unknown]" ); - } -return buffer; -} - -/** * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root. * * @path: Pointer to "struct path".
@@ -279,12 +254,7 @@ char *tomoyo_realpath_from_path(const stbreak ;/* To make sure that pos is '\0' terminated. */ buf[buf_len -1 ] ='\0' ; -/* Get better name for socket. */ -if (sb->s_magic ==SOCKFS_MAGIC ) { - pos =tomoyo_get_socket_name (path, buf, buf_len -1 ); - goto encode; - } -/* For "pipe:[\$]". */ +/* For "pipe:[\$]" and "socket:[\$]". */ if (dentry->d_op && dentry->d_op->d_dname) { pos = dentry->d_op->d_dname (dentry, buf, buf_len -1 ); goto encode;
Greg Kroah-Hartman
maintainerPATCH 144/191 uaccess: disallow > INT_MAX copy sizes
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 6d13de1489b6bf539695f96d945de3860e6d5e17 upstream.
As we've done with VFS, string operations, etc, reject usercopy sizes larger than INT_MAX, which would be nice to have for catching bugs related to size calculation overflows[1].
This adds 10 bytes to x86_64 defconfig text and 1980 bytes to the data section:
text data bss dec hex filename
19691167 5134320 1646664 26472151 193eed7 vmlinux.before 19691177 5136300 1646664 26474141 193f69d vmlinux.after
[1] https://marc.info/?l=linux-s390&m=156631939010493&w=2
--- include/linux/thread_info.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/thread_info.h +2 -0
@@ -147,6 +147,8 @@ check_copy_size(const void *addr, size_t__bad_copy_to ();return false; } +if (WARN_ON_ONCE (bytes >INT_MAX )) +return false;check_object_size (addr, bytes, is_source);return true; }
Greg Kroah-Hartman
maintainerPATCH 145/191 drm: limit to INT_MAX in create_blob ioctl
In reply to Greg Kroah-HartmanFrom: Daniel Vetter <[email protected]>
commit 5bf8bec3f4ce044a223c40cbce92590d938f0e9c upstream.
The hardened usercpy code is too paranoid ever since commit 6a30afa8c1fb ("uaccess: disallow > INT_MAX copy sizes")
Code itself should have been fine as-is.
--- drivers/gpu/drm/drm_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_property.c +1 -1
@@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_devistruct drm_property_blob *blob;int ret; -if (!length || length >ULONG_MAX -sizeof (struct drm_property_blob )) +if (!length || length >INT_MAX -sizeof (struct drm_property_blob ))return ERR_PTR (-EINVAL ); blob =kvzalloc (sizeof (struct drm_property_blob )+length,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 146/191 xfs: fix mount failure crash on invalid iclog memory access
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
commit 798a9cada4694ca8d970259f216cec47e675bfd5 upstream.
syzbot (via KASAN) reports a use-after-free in the error path of xlog_alloc_log(). Specifically, the iclog freeing loop doesn't handle the case of a fully initialized ->l_iclog linked list. Instead, it assumes that the list is partially constructed and NULL terminated.
This bug manifested because there was no possible error scenario after iclog list setup when the original code was added. Subsequent code and associated error conditions were added some time later, while the original error handling code was never updated. Fix up the error loop to terminate either on a NULL iclog or reaching the end of the list.
--- fs/xfs/xfs_log.c | 2 ++ 1 file changed, 2 insertions(+)
fs/xfs/xfs_log.c +2 -0
@@ -1495,6 +1495,8 @@ out_free_iclog: prev_iclog = iclog->ic_next;kmem_free (iclog->ic_data);kmem_free (iclog); +if (prev_iclog == log->l_iclog) +break ; } out_free_log:kmem_free (log);
Greg Kroah-Hartman
maintainerPATCH 147/191 cxgb4/cxgb4vf: fix flow control display for auto negotiation
In reply to Greg Kroah-HartmanFrom: Rahul Lakkireddy <[email protected]>
[ Upstream commit 0caeaf6ad532f9be5a768a158627cb31921cc8b7 ]
As per 802.3-2005, Section Two, Annex 28B, Table 28B-2 [1], when _only_ Rx pause is enabled, both symmetric and asymmetric pause towards local device must be enabled. Also, firmware returns the local device's flow control pause params as part of advertised capabilities and negotiated params as part of current link attributes. So, fix up ethtool's flow control pause params fetch logic to read from acaps, instead of linkattr.
[1] https://standards.ieee.org/standard/802_3-2005.html
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 1 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 4 +-- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 21 ++++++++++++-------- drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 4 +-- drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h | 1 drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c | 18 ++++++++++------- 6 files changed, 30 insertions(+), 19 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4.h +1 -0
@@ -503,6 +503,7 @@ struct link_config {enum cc_pause requested_fc;/* flow control user has requested */ enum cc_pause fc;/* actual link flow control */ +enum cc_pause advertised_fc;/* actual advertised flow control */ enum cc_fec requested_fec;/* Forward Error Correction: */ enum cc_fec fec;/* requested and actual in use */
drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +2 -2
@@ -793,8 +793,8 @@ static void get_pauseparam(struct net_destruct port_info *p =netdev_priv (dev); epause->autoneg = (p->link_cfg.requested_fc &PAUSE_AUTONEG ) !=0 ; - epause->rx_pause = (p->link_cfg.fc &PAUSE_RX ) !=0 ; - epause->tx_pause = (p->link_cfg.fc &PAUSE_TX ) !=0 ; + epause->rx_pause = (p->link_cfg.advertised_fc &PAUSE_RX ) !=0 ; + epause->tx_pause = (p->link_cfg.advertised_fc &PAUSE_TX ) !=0 ; } static int set_pauseparam(struct net_device *dev,
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +13 -8
@@ -4089,7 +4089,8 @@ static inline fw_port_cap32_t cc_to_fwcaif (cc_pause &PAUSE_TX ) fw_pause |=FW_PORT_CAP32_802_3_PAUSE ;else - fw_pause |=FW_PORT_CAP32_802_3_ASM_DIR ; + fw_pause |=FW_PORT_CAP32_802_3_ASM_DIR | +FW_PORT_CAP32_802_3_PAUSE ; }else if (cc_pause &PAUSE_TX ) { fw_pause |=FW_PORT_CAP32_802_3_ASM_DIR ; }
@@ -8563,17 +8564,17 @@ static fw_port_cap32_t lstatus_to_fwcap(void t4_handle_get_port_info (struct port_info *pi,const __be64 *rpl) {const struct fw_port_cmd *cmd = (const void *)rpl; -int action =FW_PORT_CMD_ACTION_G (be32_to_cpu (cmd->action_to_len16)); -struct adapter *adapter = pi->adapter; +fw_port_cap32_t pcaps, acaps, lpacaps, linkattr;struct link_config *lc = &pi->link_cfg; -int link_ok, linkdnrc; -enum fw_port_type port_type; +struct adapter *adapter = pi->adapter; +unsigned int speed, fc, fec, adv_fc;enum fw_port_module_type mod_type; -unsigned int speed, fc, fec; -fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; +int action, link_ok, linkdnrc; +enum fw_port_type port_type;/* Extract the various fields from the Port Information message. */ + action =FW_PORT_CMD_ACTION_G (be32_to_cpu (cmd->action_to_len16));switch (action) {case FW_PORT_ACTION_GET_PORT_INFO : {u32 lstatus =be32_to_cpu (cmd->u.info.lstatus_to_modtype);
@@ -8611,6 +8612,7 @@ void t4_handle_get_port_info(struct port } fec =fwcap_to_cc_fec (acaps); + adv_fc =fwcap_to_cc_pause (acaps); fc =fwcap_to_cc_pause (linkattr); speed =fwcap_to_speed (linkattr);
@@ -8667,7 +8669,9 @@ void t4_handle_get_port_info(struct port }if (link_ok != lc->link_ok || speed != lc->speed || - fc != lc->fc || fec != lc->fec) {/* something changed */ + fc != lc->fc || adv_fc != lc->advertised_fc || + fec != lc->fec) { +/* something changed */ if (!link_ok && lc->link_ok) { lc->link_down_rc = linkdnrc; dev_warn_ratelimited(adapter->pdev_dev,
@@ -8677,6 +8681,7 @@ void t4_handle_get_port_info(struct port } lc->link_ok = link_ok; lc->speed = speed; + lc->advertised_fc = adv_fc; lc->fc = fc; lc->fec = fec;
drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +2 -2
@@ -1690,8 +1690,8 @@ static void cxgb4vf_get_pauseparam(strucstruct port_info *pi =netdev_priv (dev); pauseparam->autoneg = (pi->link_cfg.requested_fc &PAUSE_AUTONEG ) !=0 ; - pauseparam->rx_pause = (pi->link_cfg.fc &PAUSE_RX ) !=0 ; - pauseparam->tx_pause = (pi->link_cfg.fc &PAUSE_TX ) !=0 ; + pauseparam->rx_pause = (pi->link_cfg.advertised_fc &PAUSE_RX ) !=0 ; + pauseparam->tx_pause = (pi->link_cfg.advertised_fc &PAUSE_TX ) !=0 ; }/*
drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h +1 -0
@@ -135,6 +135,7 @@ struct link_config {enum cc_pause requested_fc;/* flow control user has requested */ enum cc_pause fc;/* actual link flow control */ +enum cc_pause advertised_fc;/* actual advertised flow control */ enum cc_fec auto_fec;/* Forward Error Correction: */ enum cc_fec requested_fec;/* "automatic" (IEEE 802.3), */
drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c +11 -7
@@ -1913,16 +1913,16 @@ static const char *t4vf_link_down_rc_strstatic void t4vf_handle_get_port_info (struct port_info *pi,const struct fw_port_cmd *cmd) { -int action =FW_PORT_CMD_ACTION_G (be32_to_cpu (cmd->action_to_len16)); -struct adapter *adapter = pi->adapter; +fw_port_cap32_t pcaps, acaps, lpacaps, linkattr;struct link_config *lc = &pi->link_cfg; -int link_ok, linkdnrc; -enum fw_port_type port_type; +struct adapter *adapter = pi->adapter; +unsigned int speed, fc, fec, adv_fc;enum fw_port_module_type mod_type; -unsigned int speed, fc, fec; -fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; +int action, link_ok, linkdnrc; +enum fw_port_type port_type;/* Extract the various fields from the Port Information message. */ + action =FW_PORT_CMD_ACTION_G (be32_to_cpu (cmd->action_to_len16));switch (action) {case FW_PORT_ACTION_GET_PORT_INFO : {u32 lstatus =be32_to_cpu (cmd->u.info.lstatus_to_modtype);
@@ -1982,6 +1982,7 @@ static void t4vf_handle_get_port_info(st } fec =fwcap_to_cc_fec (acaps); + adv_fc =fwcap_to_cc_pause (acaps); fc =fwcap_to_cc_pause (linkattr); speed =fwcap_to_speed (linkattr);
@@ -2012,7 +2013,9 @@ static void t4vf_handle_get_port_info(st }if (link_ok != lc->link_ok || speed != lc->speed || - fc != lc->fc || fec != lc->fec) {/* something changed */ + fc != lc->fc || adv_fc != lc->advertised_fc || + fec != lc->fec) { +/* something changed */ if (!link_ok && lc->link_ok) { lc->link_down_rc = linkdnrc; dev_warn_ratelimited(adapter->pdev_dev,
@@ -2022,6 +2025,7 @@ static void t4vf_handle_get_port_info(st } lc->link_ok = link_ok; lc->speed = speed; + lc->advertised_fc = adv_fc; lc->fc = fc; lc->fec = fec;
Greg Kroah-Hartman
maintainerPATCH 148/191 net: dsa: bcm_sf2: Fix IP fragment location and behavior
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 7c3125f0a6ebc17846c5908ad7d6056d66c1c426 ]
The IP fragment is specified through user-defined field as the first bit of the first user-defined word. We were previously trying to extract it from the user-defined mask which could not possibly work. The ip_frag is also supposed to be a boolean, if we do not cast it as such, we risk overwriting the next fields in CFP_DATA(6) which would render the rule inoperative.
--- drivers/net/dsa/bcm_sf2_cfp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/dsa/bcm_sf2_cfp.c +3 -3
@@ -358,7 +358,7 @@ static int bcm_sf2_cfp_ipv4_rule_set(strreturn -EINVAL ; } - ip_frag =be32_to_cpu (fs->m_ext.data[0 ]); + ip_frag = !!(be32_to_cpu (fs->h_ext.data[0 ]) &1 );/* Locate the first rule available */ if (fs->location ==RX_CLS_LOC_ANY )
@@ -569,7 +569,7 @@ static int bcm_sf2_cfp_rule_cmp(struct bif (rule->fs.flow_type != fs->flow_type || rule->fs.ring_cookie != fs->ring_cookie || - rule->fs.m_ext.data[0 ] != fs->m_ext.data[0 ]) + rule->fs.h_ext.data[0 ] != fs->h_ext.data[0 ])continue ;switch (fs->flow_type & ~FLOW_EXT ) {
@@ -621,7 +621,7 @@ static int bcm_sf2_cfp_ipv6_rule_set(strreturn -EINVAL ; } - ip_frag =be32_to_cpu (fs->m_ext.data[0 ]); + ip_frag = !!(be32_to_cpu (fs->h_ext.data[0 ]) &1 ); layout = &udf_tcpip6_layout; slice_num =bcm_sf2_get_slice_number (layout,0 );
Greg Kroah-Hartman
maintainerPATCH 149/191 net/mlxfw: Fix out-of-memory error in mfa2 flash burning
In reply to Greg Kroah-HartmanFrom: Vladyslav Tarasiuk <[email protected]>
[ Upstream commit a5bcd72e054aabb93ddc51ed8cde36a5bfc50271 ]
The burning process requires to perform internal allocations of large chunks of memory. This memory doesn't need to be contiguous and can be safely allocated by vzalloc() instead of kzalloc(). This patch changes such allocation to avoid possible out-of-memory failure.
--- drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c +4 -3
@@ -6,6 +6,7 @@#include <linux/kernel.h> #include <linux/module.h> #include <linux/netlink.h> +#include <linux/vmalloc.h> #include <linux/xz.h> #include "mlxfw_mfa2.h" #include "mlxfw_mfa2_file.h"
@@ -548,7 +549,7 @@ mlxfw_mfa2_file_component_get(const stru comp_size =be32_to_cpu (comp->size); comp_buf_size = comp_size + mlxfw_mfa2_comp_magic_len; - comp_data =kmalloc (sizeof (*comp_data) + comp_buf_size,GFP_KERNEL ); + comp_data =vzalloc (sizeof (*comp_data) + comp_buf_size);if (!comp_data)return ERR_PTR (-ENOMEM ); comp_data->comp.data_size = comp_size;
@@ -570,7 +571,7 @@ mlxfw_mfa2_file_component_get(const stru comp_data->comp.data = comp_data->buff + mlxfw_mfa2_comp_magic_len;return &comp_data->comp; err_out: -kfree (comp_data); +vfree (comp_data);return ERR_PTR (err); }
@@ -579,7 +580,7 @@ void mlxfw_mfa2_file_component_put(strucconst struct mlxfw_mfa2_comp_data *comp_data; comp_data = container_of(comp, struct mlxfw_mfa2_comp_data, comp); -kfree (comp_data); +vfree (comp_data); }void mlxfw_mfa2_file_fini (struct mlxfw_mfa2_file *mfa2_file)
Greg Kroah-Hartman
maintainerPATCH 150/191 net: phy: aquantia: add suspend / resume ops for AQR105
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 1c93fb45761e79b3c00080e71523886cefaf351c ]
The suspend/resume code for AQR107 works on AQR105 too. This patch fixes issues with the partner not seeing the link down when the interface using AQR105 is brought down.
--- drivers/net/phy/aquantia_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/aquantia_main.c +2 -0
@@ -627,6 +627,8 @@ static struct phy_driver aqr_driver[] = .config_intr = aqr_config_intr, .ack_interrupt = aqr_ack_interrupt, .read_status = aqr_read_status, + .suspend = aqr107_suspend, + .resume = aqr107_resume, }, { PHY_ID_MATCH_MODEL(PHY_ID_AQR106),
Greg Kroah-Hartman
maintainerPATCH 151/191 net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device
In reply to Greg Kroah-HartmanFrom: Shmulik Ladkani <[email protected]>
[ Upstream commit 70cf3dc7313207816255b9acb0dffb19dae78144 ]
There's no skb_pull performed when a mirred action is set at egress of a mac device, with a target device/action that expects skb->data to point at the network header.
As a result, either the target device is errornously given an skb with data pointing to the mac (egress case), or the net stack receives the skb with data pointing to the mac (ingress case).
E.g:
# tc qdisc add dev eth9 root handle 1: prio # tc filter add dev eth9 parent 1: prio 9 protocol ip handle 9 basic \ action mirred egress redirect dev tun0
(tun0 is a tun device. result: tun0 errornously gets the eth header
instead of the iph)
Revise the push/pull logic of tcf_mirred_act() to not rely on the skb_at_tc_ingress() vs tcf_mirred_act_wants_ingress() comparison, as it does not cover all "pull" cases.
Instead, calculate whether the required action on the target device requires the data to point at the network header, and compare this to whether skb->data points to network header - and make the push/pull adjustments as necessary.
--- net/sched/act_mirred.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
net/sched/act_mirred.c +12 -10
@@ -219,8 +219,10 @@ static int tcf_mirred_act(struct sk_buffbool use_reinsert;bool want_ingress;bool is_redirect; +bool expects_nh;int m_eaction;int mac_len; +bool at_nh; rec_level =__this_cpu_inc_return (mirred_rec_level);if (unlikely (rec_level >MIRRED_RECURSION_LIMIT )) {
@@ -261,19 +263,19 @@ static int tcf_mirred_act(struct sk_buff goto out; } -/* If action's target direction differs than filter's direction, -* and devices expect a mac header on xmit, then mac push/pull is -* needed. -*/ want_ingress =tcf_mirred_act_wants_ingress (m_eaction); -if (skb_at_tc_ingress (skb) != want_ingress && m_mac_header_xmit) { -if (!skb_at_tc_ingress (skb)) { -/* caught at egress, act ingress: pull mac */ - mac_len =skb_network_header (skb) -skb_mac_header (skb); + + expects_nh = want_ingress || !m_mac_header_xmit; + at_nh = skb->data ==skb_network_header (skb); +if (at_nh != expects_nh) { + mac_len =skb_at_tc_ingress (skb) ? skb->mac_len : +skb_network_header (skb) -skb_mac_header (skb); +if (expects_nh) { +/* target device/action expect data at nh */ skb_pull_rcsum (skb2, mac_len); }else { -/* caught at ingress, act egress: push mac */ -skb_push_rcsum (skb2, skb->mac_len); +/* target device/action expect data at mac */ +skb_push_rcsum (skb2, mac_len); } }
Greg Kroah-Hartman
maintainerPATCH 152/191 net/sched: add delete_empty() to filters and use it in cls_flower
In reply to Greg Kroah-HartmanFrom: Davide Caratti <[email protected]>
[ Upstream commit a5b72a083da197b493c7ed1e5730d62d3199f7d6 ]
Revert "net/sched: cls_u32: fix refcount leak in the error path of u32_change()", and fix the u32 refcount leak in a more generic way that preserves the semantic of rule dumping.
On tc filters that don't support lockless insertion/removal, there is no need to guard against concurrent insertion when a removal is in progress. Therefore, for most of them we can avoid a full walk() when deleting, and just decrease the refcount, like it was done on older Linux kernels. This fixes situations where walk() was wrongly detecting a non-empty filter, like it happened with cls_u32 in the error path of change(), thus leading to failures in the following tdc selftests:
6aa7: (filter, u32) Add/Replace u32 with source match and invalid indev 6658: (filter, u32) Add/Replace u32 with custom hash table and invalid handle 74c2: (filter, u32) Add/Replace u32 filter with invalid hash table id
On cls_flower, and on (future) lockless filters, this check is necessary:
move all the check_empty() logic in a callback so that each filter can have its own implementation. For cls_flower, it's sufficient to check if no IDRs have been allocated.
This reverts commit 275c44aa194b7159d1191817b20e076f55f0e620.
Changes since v1:
- document the need for delete_empty() when TCF_PROTO_OPS_DOIT_UNLOCKED is used, thanks to Vlad Buslov
- implement delete_empty() without doing fl_walk(), thanks to Vlad Buslov
- squash revert and new fix in a single patch, to be nice with bisect tests that run tdc on u32 filter, thanks to Dave Miller
--- include/net/sch_generic.h | 5 +++++ net/sched/cls_api.c | 31 +++++-------------------------- net/sched/cls_flower.c | 12 ++++++++++++ 3 files changed, 22 insertions(+), 26 deletions(-)
include/net/sch_generic.h +5 -0
@@ -308,6 +308,7 @@ struct tcf_proto_ops {int (*delete)(struct tcf_proto *tp,void *arg,bool *last,bool rtnl_held,struct netlink_ext_ack *); +bool (*delete_empty)(struct tcf_proto *tp);void (*walk)(struct tcf_proto *tp,struct tcf_walker *arg,bool rtnl_held); int (*reoffload)(struct tcf_proto *tp, bool add,
@@ -336,6 +337,10 @@ struct tcf_proto_ops {int flags; }; +/* Classifiers setting TCF_PROTO_OPS_DOIT_UNLOCKED in tcf_proto_ops->flags +* are expected to implement tcf_proto_ops->delete_empty(), otherwise race +* conditions can occur when filters are inserted/deleted simultaneously. +*/ enum tcf_proto_ops_flags {TCF_PROTO_OPS_DOIT_UNLOCKED =1 , };
net/sched/cls_api.c +5 -26
@@ -308,33 +308,12 @@ static void tcf_proto_put(struct tcf_protcf_proto_destroy (tp, rtnl_held, true, extack); } -static int walker_check_empty (struct tcf_proto *tp,void *fh, -struct tcf_walker *arg) +static bool tcf_proto_check_delete (struct tcf_proto *tp) { -if (fh) { - arg->nonempty = true; -return -1 ; - } -return 0 ; -} - -static bool tcf_proto_is_empty (struct tcf_proto *tp,bool rtnl_held) -{ -struct tcf_walker walker = { .fn = walker_check_empty, }; - -if (tp->ops->walk) { - tp->ops->walk (tp, &walker, rtnl_held); -return !walker.nonempty; - } -return true; -} +if (tp->ops->delete_empty) +return tp->ops->delete_empty (tp); -static bool tcf_proto_check_delete (struct tcf_proto *tp,bool rtnl_held) -{ -spin_lock (&tp->lock); -if (tcf_proto_is_empty (tp, rtnl_held)) - tp->deleting = true; -spin_unlock (&tp->lock); + tp->deleting = true;return tp->deleting; }
@@ -1751,7 +1730,7 @@ static void tcf_chain_tp_delete_empty(st* concurrently. * Mark tp for deletion if it is empty. */ -if (!tp_iter || !tcf_proto_check_delete (tp, rtnl_held)) { +if (!tp_iter || !tcf_proto_check_delete (tp)) {mutex_unlock (&chain->filter_chain_lock);return ; }
net/sched/cls_flower.c +12 -0
@@ -2519,6 +2519,17 @@ static void fl_bind_class(void *fh, u32 f->res.class = cl; } +static bool fl_delete_empty (struct tcf_proto *tp) +{ +struct cls_fl_head *head =fl_head_dereference (tp); + +spin_lock (&tp->lock); + tp->deleting =idr_is_empty (&head->handle_idr); +spin_unlock (&tp->lock); + +return tp->deleting; +} +static struct tcf_proto_ops cls_fl_ops__read_mostly = { .kind ="flower" , .classify = fl_classify,
@@ -2528,6 +2539,7 @@ static struct tcf_proto_ops cls_fl_ops _ .put = fl_put, .change = fl_change, .delete = fl_delete, + .delete_empty = fl_delete_empty, .walk = fl_walk, .reoffload = fl_reoffload, .hw_add = fl_hw_add,
Greg Kroah-Hartman
maintainerPATCH 153/191 net_sched: sch_fq: properly set sk->sk_pacing_status
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit bb3d0b8bf5be61ab1d6f472c43cbf34de17e796b ]
If fq_classify() recycles a struct fq_flow because a socket structure has been reallocated, we do not set sk->sk_pacing_status immediately, but later if the flow becomes detached.
This means that any flow requiring pacing (BBR, or SO_MAX_PACING_RATE) might fallback to TCP internal pacing, which requires a per-socket high resolution timer, and therefore more cpu cycles.
--- net/sched/sch_fq.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
net/sched/sch_fq.c +8 -9
@@ -301,6 +301,9 @@ static struct fq_flow *fq_classify(struc f->socket_hash != sk->sk_hash)) { f->credit = q->initial_quantum; f->socket_hash = sk->sk_hash; +if (q->rate_enable) +smp_store_release (&sk->sk_pacing_status, +SK_PACING_FQ );if (fq_flow_is_throttled (f))fq_flow_unset_throttled (q, f); f->time_next_packet =0ULL ;
@@ -322,8 +325,12 @@ static struct fq_flow *fq_classify(strucfq_flow_set_detached (f); f->sk = sk; -if (skb->sk == sk) +if (skb->sk == sk) { f->socket_hash = sk->sk_hash; +if (q->rate_enable) +smp_store_release (&sk->sk_pacing_status, +SK_PACING_FQ ); + } f->credit = q->initial_quantum;rb_link_node (&f->fq_node, parent, p);
@@ -428,17 +435,9 @@ static int fq_enqueue(struct sk_buff *sk f->qlen++;qdisc_qstats_backlog_inc (sch, skb);if (fq_flow_is_detached (f)) { -struct sock *sk = skb->sk; -fq_flow_add_tail (&q->new_flows, f);if (time_after (jiffies, f->age + q->flow_refill_delay)) f->credit =max_t (u32, f->credit, q->quantum); -if (sk && q->rate_enable) { -if (unlikely (smp_load_acquire (&sk->sk_pacing_status) != -SK_PACING_FQ )) -smp_store_release (&sk->sk_pacing_status, -SK_PACING_FQ ); - } q->inactive_flows--; }
Greg Kroah-Hartman
maintainerPATCH 154/191 net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit bd6f48546b9cb7a785344fc78058c420923d7ed8 ]
GXBB and newer SoCs use the fixed FCLK_DIV2 (1GHz) clock as input for the m250_sel clock. Meson8b and Meson8m2 use MPLL2 instead, whose rate can be adjusted at runtime.
So far we have been running MPLL2 with ~250MHz (and the internal m250_div with value 1), which worked enough that we could transfer data with an TX delay of 4ns. Unfortunately there is high packet loss with an RGMII PHY when transferring data (receiving data works fine though). Odroid-C1's u-boot is running with a TX delay of only 2ns as well as the internal m250_div set to 2 - no lost (TX) packets can be observed with that setting in u-boot.
Manual testing has shown that the TX packet loss goes away when using the following settings in Linux (the vendor kernel uses the same settings):
- MPLL2 clock set to ~500MHz
- m250_div set to 2
- TX delay set to 2ns on the MAC side
Update the m250_div divider settings to only accept dividers greater or equal 2 to fix the TX delay generated by the MAC.
iperf3 results before the change:
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 182 MBytes 153 Mbits/sec 514 sender [ 5] 0.00-10.00 sec 182 MBytes 152 Mbits/sec receiver
iperf3 results after the change (including an updated TX delay of 2ns):
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 5] 0.00-10.00 sec 927 MBytes 778 Mbits/sec 0 sender [ 5] 0.00-10.01 sec 927 MBytes 777 Mbits/sec receiver
--- drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +11 -3
@@ -112,6 +112,14 @@ static int meson8b_init_rgmii_tx_clk(strstruct device *dev = dwmac->dev;const char *parent_name, *mux_parent_names[MUX_CLK_NUM_PARENTS ];struct meson8b_dwmac_clk_configs *clk_configs; +static const struct clk_div_table div_table[] = { + { .div =2 , .val =2 , }, + { .div =3 , .val =3 , }, + { .div =4 , .val =4 , }, + { .div =5 , .val =5 , }, + { .div =6 , .val =6 , }, + { .div =7 , .val =7 , }, + }; clk_configs =devm_kzalloc (dev,sizeof (*clk_configs),GFP_KERNEL );if (!clk_configs)
@@ -146,9 +154,9 @@ static int meson8b_init_rgmii_tx_clk(str clk_configs->m250_div.reg = dwmac->regs +PRG_ETH0 ; clk_configs->m250_div.shift =PRG_ETH0_CLK_M250_DIV_SHIFT ; clk_configs->m250_div.width =PRG_ETH0_CLK_M250_DIV_WIDTH ; - clk_configs->m250_div.flags =CLK_DIVIDER_ONE_BASED | -CLK_DIVIDER_ALLOW_ZERO | -CLK_DIVIDER_ROUND_CLOSEST ; + clk_configs->m250_div.table = div_table; + clk_configs->m250_div.flags =CLK_DIVIDER_ALLOW_ZERO | +CLK_DIVIDER_ROUND_CLOSEST ; clk =meson8b_dwmac_register_clk (dwmac,"m250_div" , &parent_name,1 , &clk_divider_ops, &clk_configs->m250_div.hw);