5.4.13-stable review
Subsystems (11)
Greg Kroah-Hartman
maintainerPATCH 164/203 ubifs: do_kill_orphans: Fix a memory leak bug
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
commit 10256f000932f12596dc043cf880ecf488a32510 upstream.
If there are more than one valid snod on the sleb->nodes list, do_kill_orphans will malloc ino more than once without releasing previous ino's memory. Finally, it will trigger memory leak.
--- fs/ubifs/orphan.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
fs/ubifs/orphan.c +10 -7
@@ -631,12 +631,17 @@ static int do_kill_orphans(struct ubifs_ino_t inum;int i, n, err, first =1 ; + ino =kmalloc (UBIFS_MAX_INO_NODE_SZ ,GFP_NOFS ); +if (!ino) +return -ENOMEM ; +list_for_each_entry (snod, &sleb->nodes, list) {if (snod->type !=UBIFS_ORPH_NODE ) {ubifs_err (c,"invalid node type %d in orphan area at %d:%d" , snod->type, sleb->lnum, snod->offs);ubifs_dump_node (c, snod->node); -return -EINVAL ; + err = -EINVAL ; + goto out_free; } orph = snod->node;
@@ -663,20 +668,18 @@ static int do_kill_orphans(struct ubifs_ubifs_err (c,"out of order commit number %llu in orphan node at %d:%d" , cmt_no, sleb->lnum, snod->offs);ubifs_dump_node (c, snod->node); -return -EINVAL ; + err = -EINVAL ; + goto out_free; }dbg_rcvry ("out of date LEB %d" , sleb->lnum); *outofdate =1 ; -return 0 ; + err =0 ; + goto out_free; }if (first) first =0 ; - ino =kmalloc (UBIFS_MAX_INO_NODE_SZ ,GFP_NOFS ); -if (!ino) -return -ENOMEM ; - n = (le32_to_cpu (orph->ch.len) -UBIFS_ORPH_NODE_SZ ) >>3 ;for (i =0 ; i < n; i++) {union ubifs_key key1, key2;
Greg Kroah-Hartman
maintainerPATCH 165/203 spi: sprd: Fix the incorrect SPI register
In reply to Greg Kroah-HartmanFrom: Huanpeng Xin <[email protected]>
commit 5e9c5236b7b86779b53b762f7e66240c3f18314b upstream.
The original code used an incorrect SPI register to initialize the SPI controller in sprd_spi_init_hw(), thus fix it.
--- drivers/spi/spi-sprd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-sprd.c +1 -1
@@ -674,7 +674,7 @@ static void sprd_spi_init_hw(struct sprdu16 word_delay, interval;u32 val; - val =readl_relaxed (ss->base +SPRD_SPI_CTL7 ); + val =readl_relaxed (ss->base +SPRD_SPI_CTL0 ); val &= ~(SPRD_SPI_SCK_REV |SPRD_SPI_NG_TX |SPRD_SPI_NG_RX );/* Set default chip selection, clock phase and clock polarity */ val |= ss->hw_mode &SPI_CPHA ?SPRD_SPI_NG_RX :SPRD_SPI_NG_TX ;
Greg Kroah-Hartman
maintainerPATCH 166/203 mtd: spi-nor: fix silent truncation in spi_nor_read()
In reply to Greg Kroah-HartmanFrom: Sergei Shtylyov <[email protected]>
commit a719a75a7761e4139dd099330d9fe3589d844f9b upstream.
spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' to the 'int ret' variable, while 'ssize_t' is a 64-bit type and *int* is a 32-bit type on the 64-bit machines. This silent truncation isn't really valid, so fix up the variable's type.
--- drivers/mtd/spi-nor/spi-nor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/spi-nor/spi-nor.c +1 -1
@@ -2544,7 +2544,7 @@ static int spi_nor_read(struct mtd_info size_t *retlen, u_char *buf) { struct spi_nor *nor = mtd_to_spi_nor(mtd); -int ret; +ssize_t ret;dev_dbg (nor->dev,"from 0x%08x, len %zd\n" , (u32 )from, len);
Greg Kroah-Hartman
maintainerPATCH 167/203 mtd: spi-nor: fix silent truncation in spi_nor_read_raw()
In reply to Greg Kroah-HartmanFrom: Sergei Shtylyov <[email protected]>
commit 3d63ee5deb466fd66ed6ffb164a87ce36425cf36 upstream.
spi_nor_read_raw() assigns the result of 'ssize_t spi_nor_read_data()' to the 'int ret' variable, while 'ssize_t' is a 64-bit type and *int* is a 32-bit type on the 64-bit machines. This silent truncation isn't really valid, so fix up the variable's type.
--- drivers/mtd/spi-nor/spi-nor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/spi-nor/spi-nor.c +1 -1
@@ -2865,7 +2865,7 @@ static int spi_nor_hwcaps_pp2cmd(u32 hwc*/ static int spi_nor_read_raw (struct spi_nor *nor,u32 addr,size_t len,u8 *buf) { -int ret; +ssize_t ret;while (len) { ret =spi_nor_read_data (nor, addr, len, buf);
Greg Kroah-Hartman
maintainerPATCH 168/203 spi: pxa2xx: Set controller->max_transfer_size in dma mode
In reply to Greg Kroah-HartmanFrom: Daniel Vetter <daniel.vetter-/[email protected]>
commit b2662a164f9dc48da8822e56600686d639056282 upstream.
In DMA mode we have a maximum transfer size, past that the driver falls back to PIO (see the check at the top of pxa2xx_spi_transfer_one). Falling back to PIO for big transfers defeats the point of a dma engine, hence set the max transfer size to inform spi clients that they need to do something smarter.
This was uncovered by the drm_mipi_dbi spi panel code, which does large spi transfers, but stopped splitting them after:
commit e143364b4c1774f68e923a5a0bb0fca28ac25888
Author: Noralf Trønnes <[email protected]> Date: Fri Jul 19 17:59:10 2019 +0200
drm/tinydrm: Remove tinydrm_spi_max_transfer_size()
After this commit the code relied on the spi core to split transfers into max dma-able blocks, which also papered over the PIO fallback issue.
Fix this by setting the overall max transfer size to the DMA limit, but only when the controller runs in DMA mode.
--- drivers/spi/spi-pxa2xx.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/spi/spi-pxa2xx.c +7 -0
@@ -1612,6 +1612,11 @@ static int pxa2xx_spi_fw_translate_cs(streturn cs; } +static size_t pxa2xx_spi_max_dma_transfer_size (struct spi_device *spi) +{ +return MAX_DMA_LEN ; +} +static int pxa2xx_spi_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -1717,6 +1722,8 @@ static int pxa2xx_spi_probe(struct platf }else { controller->can_dma = pxa2xx_spi_can_dma; controller->max_dma_len =MAX_DMA_LEN ; + controller->max_transfer_size = + pxa2xx_spi_max_dma_transfer_size; } }
Greg Kroah-Hartman
maintainerPATCH 169/203 spi: atmel: fix handling of cs_change set on non-last xfer
In reply to Greg Kroah-HartmanFrom: Mans Rullgard <[email protected]>
commit fed8d8c7a6dc2a76d7764842853d81c770b0788e upstream.
The driver does the wrong thing when cs_change is set on a non-last xfer in a message. When cs_change is set, the driver deactivates the CS and leaves it off until a later xfer again has cs_change set whereas it should be briefly toggling CS off and on again.
This patch brings the behaviour of the driver back in line with the documentation and common sense. The delay of 10 us is the same as is used by the default spi_transfer_one_message() function in spi.c.
--- drivers/spi/spi-atmel.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/spi/spi-atmel.c +3 -7
@@ -302,7 +302,6 @@ struct atmel_spi {bool use_cs_gpios;bool keep_cs; -bool cs_active;u32 fifo_size; };
@@ -1374,11 +1373,9 @@ static int atmel_spi_one_transfer(struct &msg->transfers)) { as->keep_cs = true; }else { - as->cs_active = !as->cs_active; -if (as->cs_active) -cs_activate (as, msg->spi); -else -cs_deactivate (as, msg->spi); +cs_deactivate (as, msg->spi); +udelay (10 ); +cs_activate (as, msg->spi); } }
@@ -1401,7 +1398,6 @@ static int atmel_spi_transfer_one_messagatmel_spi_lock (as);cs_activate (as, spi); - as->cs_active = true; as->keep_cs = false; msg->status =0 ;
Greg Kroah-Hartman
maintainerPATCH 170/203 spi: rspi: Use platform_get_irq_byname_optional() for optional irqs
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit 2de860b4a7a0bd5a4b5bd3bff0e6a615495df4ba upstream.
As platform_get_irq_byname() now prints an error when the interrupt does not exist, scary warnings may be printed for optional interrupts:
renesas_spi e6b10000.spi: IRQ rx not found
renesas_spi e6b10000.spi: IRQ mux not found
Fix this by calling platform_get_irq_byname_optional() instead. Remove the no longer needed printing of platform_get_irq errors, as the remaining calls to platform_get_irq() and platform_get_irq_byname() take care of that.
--- drivers/spi/spi-rspi.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/spi/spi-rspi.c +2 -6
@@ -1257,9 +1257,9 @@ static int rspi_probe(struct platform_de ctlr->flags = ops->flags; ctlr->dev.of_node = pdev->dev.of_node; - ret =platform_get_irq_byname (pdev,"rx" ); + ret =platform_get_irq_byname_optional (pdev,"rx" );if (ret <0 ) { - ret =platform_get_irq_byname (pdev,"mux" ); + ret =platform_get_irq_byname_optional (pdev,"mux" );if (ret <0 ) ret =platform_get_irq (pdev,0 );if (ret >=0 )
@@ -1270,10 +1270,6 @@ static int rspi_probe(struct platform_deif (ret >=0 ) rspi->tx_irq = ret; } -if (ret <0 ) { -dev_err (&pdev->dev,"platform_get_irq error\n" ); - goto error2; - }if (rspi->rx_irq == rspi->tx_irq) {/* Single multiplexed interrupt */
Greg Kroah-Hartman
maintainerPATCH 171/203 spi: lpspi: fix memory leak in fsl_lpspi_probe
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
commit 057b8945f78f76d0b04eeb5c27cd9225e5e7ad86 upstream.
In fsl_lpspi_probe an SPI controller is allocated either via spi_alloc_slave or spi_alloc_master. In all but one error cases this controller is put by going to error handling code. This commit fixes the case when pm_runtime_get_sync fails and it should go to the error handling path.
--- drivers/spi/spi-fsl-lpspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +1 -1
@@ -938,7 +938,7 @@ static int fsl_lpspi_probe(struct platfo ret =pm_runtime_get_sync (fsl_lpspi->dev);if (ret <0 ) {dev_err (fsl_lpspi->dev,"failed to enable clock\n" ); -return ret; + goto out_controller_put; } temp =readl (fsl_lpspi->base +IMX7ULP_PARAM );
Greg Kroah-Hartman
maintainerPATCH 172/203 iwlwifi: mvm: consider ieee80211 station max amsdu value
In reply to Greg Kroah-HartmanFrom: Mordechay Goodstein <[email protected]>
commit ee4cce9b9d6421d037ffc002536b918fd7f4aff3 upstream.
debugfs amsdu_len sets only the max_amsdu_len for ieee80211 station so take it into consideration while getting max amsdu
--- drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 8 +++++++- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 7 ++++++- 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c +7 -1
@@ -350,7 +350,13 @@ void iwl_mvm_tlc_update_notif(struct iwlu16 size =le32_to_cpu (notif->amsdu_size);int i; -if (WARN_ON (sta->max_amsdu_len < size)) +/* +* In debug sta->max_amsdu_len < size +* so also check with orig_amsdu_len which holds the original +* data before debugfs changed the value +*/ +if (WARN_ON (sta->max_amsdu_len < size && + mvmsta->orig_amsdu_len < size)) goto out; mvmsta->amsdu_enabled =le32_to_cpu (notif->amsdu_enabled);
drivers/net/wireless/intel/iwlwifi/mvm/tx.c +6 -1
@@ -935,7 +935,12 @@ static int iwl_mvm_tx_tso(struct iwl_mvm !(mvmsta->amsdu_enabled & BIT(tid)))return iwl_mvm_tx_tso_segment (skb,1 , netdev_flags, mpdus_skb); - max_amsdu_len =iwl_mvm_max_amsdu_size (mvm, sta, tid); +/* +* Take the min of ieee80211 station and mvm station +*/ + max_amsdu_len = + min_t(unsigned int, sta->max_amsdu_len, +iwl_mvm_max_amsdu_size (mvm, sta, tid));/* * Limit A-MSDU in A-MPDU to 4095 bytes when VHT is not
Greg Kroah-Hartman
maintainerPATCH 173/203 rtlwifi: Remove unnecessary NULL check in rtl_regd_init
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 091c6e9c083f7ebaff00b37ad13562d51464d175 upstream.
When building with Clang + -Wtautological-pointer-compare:
drivers/net/wireless/realtek/rtlwifi/regd.c:389:33: warning: comparison of address of 'rtlpriv->regd' equal to a null pointer is always false [-Wtautological-pointer-compare]
if (wiphy == NULL || &rtlpriv->regd == NULL)
~~~~~~~~~^~~~ ~~~~1 warning generated.
The address of an array member is never NULL unless it is the first struct member so remove the unnecessary check. This was addressed in the staging version of the driver in commit f986978b32b3 ("Staging:
rtlwifi: remove unnecessary NULL check").
While we are here, fix the following checkpatch warning:
CHECK: Comparison to NULL could be written "!wiphy" 35: FILE: drivers/net/wireless/realtek/rtlwifi/regd.c:389:
+ if (wiphy == NULL)
--- drivers/net/wireless/realtek/rtlwifi/regd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/regd.c +1 -1
@@ -386,7 +386,7 @@ int rtl_regd_init(struct ieee80211_hw *hstruct wiphy *wiphy = hw->wiphy;struct country_code_to_enum_rd *country =NULL ; -if (wiphy ==NULL || &rtlpriv->regd ==NULL ) +if (!wiphy)return -EINVAL ;/* init country_code from efuse channel plan */
Greg Kroah-Hartman
maintainerPATCH 174/203 iwlwifi: mvm: fix support for single antenna diversity
In reply to Greg Kroah-HartmanFrom: Luca Coelho <[email protected]>
commit bb99ff9baa02beb9216c86678999342197c849cc upstream.
When the single antenna diversity support was sent upstream, only some definitions were sent, due to a bad revert.
Fix this by adding the actual code.
--- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c +16 -4
@@ -514,6 +514,18 @@ static int iwl_send_phy_cfg_cmd(struct istruct iwl_phy_cfg_cmd phy_cfg_cmd;enum iwl_ucode_type ucode_type = mvm->fwrt.cur_fw_img; +if (iwl_mvm_has_unified_ucode (mvm) && + !mvm->trans->cfg->tx_with_siso_diversity) { +return 0 ; + }else if (mvm->trans->cfg->tx_with_siso_diversity) { +/* +* TODO: currently we don't set the antenna but letting the NIC +* to decide which antenna to use. This should come from BIOS. +*/ + phy_cfg_cmd.phy_cfg = +cpu_to_le32 (FW_PHY_CFG_CHAIN_SAD_ENABLED ); + } +/* Set parameters */ phy_cfg_cmd.phy_cfg =cpu_to_le32 (iwl_mvm_get_phy_config (mvm));
@@ -1344,12 +1356,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm) ret =iwl_send_phy_db_data (mvm->phy_db);if (ret) goto error; - - ret =iwl_send_phy_cfg_cmd (mvm); -if (ret) - goto error; } + ret =iwl_send_phy_cfg_cmd (mvm); +if (ret) + goto error; + ret =iwl_mvm_send_bt_init_conf (mvm);if (ret) goto error;
Greg Kroah-Hartman
maintainerPATCH 175/203 sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO
In reply to Greg Kroah-HartmanFrom: Victorien Molle <[email protected]>
commit b3c424eb6a1a3c485de64619418a471dee6ce849 upstream.
This field has never been checked since introduction in mainline kernel
--- net/sched/sch_cake.c | 1 + 1 file changed, 1 insertion(+)
net/sched/sch_cake.c +1 -0
@@ -2184,6 +2184,7 @@ static const struct nla_policy cake_poli [TCA_CAKE_MPU] = { .type = NLA_U32 }, [TCA_CAKE_INGRESS] = { .type = NLA_U32 }, [TCA_CAKE_ACK_FILTER] = { .type = NLA_U32 }, + [TCA_CAKE_SPLIT_GSO] = { .type = NLA_U32 }, [TCA_CAKE_FWMARK] = { .type = NLA_U32 }, };
Greg Kroah-Hartman
maintainerPATCH 176/203 f2fs: fix potential overflow
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
commit 1f0d5c911b64165c9754139a26c8c2fad352c132 upstream.
We expect 64-bit calculation result from below statement, however in 32-bit machine, looped left shift operation on pgoff_t type variable may cause overflow issue, fix it by forcing type cast.
page->index << PAGE_SHIFT;
--- fs/f2fs/data.c | 2 +- fs/f2fs/file.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/data.c +1 -1
@@ -2098,7 +2098,7 @@ static int __write_data_page(struct pageloff_t i_size =i_size_read (inode);const pgoff_t end_index = ((unsigned long long ) i_size) >>PAGE_SHIFT ; -loff_t psize = (page->index +1 ) <<PAGE_SHIFT ; +loff_t psize = (loff_t)(page->index +1 ) <<PAGE_SHIFT ;unsigned offset =0 ;bool need_balance_fs = false;int err =0 ;
fs/f2fs/file.c +1 -1
@@ -1139,7 +1139,7 @@ static int __clone_blkaddrs(struct inode } dn.ofs_in_node++; i++; - new_size = (dst + i) <<PAGE_SHIFT ; + new_size = (loff_t)(dst + i) <<PAGE_SHIFT ;if (dst_inode->i_size < new_size)f2fs_i_size_write (dst_inode, new_size); }while (--ilen && (do_replace[i] || blkaddr[i] ==NULL_ADDR ));
Greg Kroah-Hartman
maintainerPATCH 177/203 NFSD fixing possible null pointer derefering in copy offload
In reply to Greg Kroah-HartmanFrom: Olga Kornievskaia <[email protected]>
commit 18f428d4e2f7eff162d80b2b21689496c4e82afd upstream.
Static checker revealed possible error path leading to possible NULL pointer dereferencing.
--- fs/nfsd/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +2 -1
@@ -1298,7 +1298,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struc out:return status; out_err: -cleanup_async_copy (async_copy); +if (async_copy) +cleanup_async_copy (async_copy); goto out; }
Greg Kroah-Hartman
maintainerPATCH 178/203 rtc: msm6242: Fix reading of 10-hour digit
In reply to Greg Kroah-HartmanFrom: Kars de Jong <[email protected]>
commit e34494c8df0cd96fc432efae121db3212c46ae48 upstream.
The driver was reading the wrong register as the 10-hour digit due to a misplaced ')'. It was in fact reading the 1-second digit register due to this bug.
Also remove the use of a magic number for the hour mask and use the define for it which was already present.
--- drivers/rtc/rtc-msm6242.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/rtc/rtc-msm6242.c +2 -1
@@ -133,7 +133,8 @@ static int msm6242_read_time(struct devimsm6242_read (priv,MSM6242_SECOND1 ); tm->tm_min =msm6242_read (priv,MSM6242_MINUTE10 ) *10 +msm6242_read (priv,MSM6242_MINUTE1 ); - tm->tm_hour = (msm6242_read (priv,MSM6242_HOUR10 &3 )) *10 + + tm->tm_hour = (msm6242_read (priv,MSM6242_HOUR10 ) & +MSM6242_HOUR10_HR_MASK ) *10 +msm6242_read (priv,MSM6242_HOUR1 ); tm->tm_mday =msm6242_read (priv,MSM6242_DAY10 ) *10 +msm6242_read (priv,MSM6242_DAY1 );
Greg Kroah-Hartman
maintainerPATCH 179/203 rtc: brcmstb-waketimer: add missed clk_disable_unprepare
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
commit 94303f8930ed78aea0f189b703c9d79fff9555d7 upstream.
This driver forgets to disable and unprepare clock when remove. Add a call to clk_disable_unprepare to fix it.
--- drivers/rtc/rtc-brcmstb-waketimer.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-brcmstb-waketimer.c +1 -0
@@ -277,6 +277,7 @@ static int brcmstb_waketmr_remove(structstruct brcmstb_waketmr *timer =dev_get_drvdata (&pdev->dev);unregister_reboot_notifier (&timer->reboot_notifier); +clk_disable_unprepare (timer->clk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 180/203 rtc: bd70528: Add MODULE ALIAS to autoload module
In reply to Greg Kroah-HartmanFrom: Matti Vaittinen <[email protected]>
commit c3e12e66b14a043daac6b3d0559df80b9ed7679c upstream.
The bd70528 RTC driver is probed by MFD driver. Add MODULE_ALIAS in order to allow udev to load the module when MFD sub-device cell for RTC is added.
I'm not sure if this is a bugfix or feature addition but I guess fixes tag won't harm in this case.
--- drivers/rtc/rtc-bd70528.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-bd70528.c +1 -0
@@ -491,3 +491,4 @@ module_platform_driver(bd70528_rtc);MODULE_AUTHOR ("Matti Vaittinen <[email protected]>" );MODULE_DESCRIPTION ("BD70528 RTC driver" );MODULE_LICENSE ("GPL" ); +MODULE_ALIAS ("platofrm:bd70528-rtc" );
Greg Kroah-Hartman
maintainerPATCH 181/203 gpio: mpc8xxx: Add platform device to gpiochip->parent
In reply to Greg Kroah-HartmanFrom: Johnson CH Chen (陳昭勳) <[email protected]>
[ Upstream commit 322f6a3182d42df18059a89c53b09d33919f755e ]
Dear Linus Walleij,
In old kernels, some APIs still try to use parent->of_node from struct gpio_chip, and it could be resulted in kernel panic because parent is NULL. Adding platform device to gpiochip->parent can fix this problem.
--- drivers/gpio/gpio-mpc8xxx.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpio/gpio-mpc8xxx.c +1 -0
@@ -346,6 +346,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)return -ENOMEM ; gc = &mpc8xxx_gc->gc; + gc->parent = &pdev->dev;if (of_property_read_bool (np,"little-endian" )) { ret = bgpio_init(gc, &pdev->dev, 4,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 182/203 scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy()
In reply to Greg Kroah-HartmanFrom: Varun Prakash <[email protected]>
[ Upstream commit 71482fde704efdd8c3abe0faf34d922c61e8d76b ]
If cxgb4i_ddp_init() fails then cdev->cdev2ppm will be NULL, so add a check for NULL pointer before dereferencing it.
--- drivers/scsi/cxgbi/libcxgbi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/cxgbi/libcxgbi.c +2 -1
@@ -121,7 +121,8 @@ static inline void cxgbi_device_destroy(struct cxgbi_device *cdev) "cdev 0x%p, p# %u.\n", cdev, cdev->nports);cxgbi_hbas_remove (cdev);cxgbi_device_portmap_cleanup (cdev); -cxgbi_ppm_release (cdev->cdev2ppm (cdev)); +if (cdev->cdev2ppm) +cxgbi_ppm_release (cdev->cdev2ppm (cdev));if (cdev->pmap.max_connect)cxgbi_free_big_mem (cdev->pmap.port_csk);kfree (cdev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 183/203 scsi: target/iblock: Fix protection error with blocks greater than 512B
In reply to Greg Kroah-HartmanFrom: Israel Rukshin <[email protected]>
[ Upstream commit e4dc9a4c31fe10d1751c542702afc85be8a5c56a ]
The sector size of the block layer is 512 bytes, but integrity interval size might be different (in case of 4K block size of the media). At the initiator side the virtual start sector is the one that was originally submitted by the block layer (512 bytes) for the Reftag usage. The initiator converts the Reftag to integrity interval units and sends it to the target. So the target virtual start sector should be calculated at integrity interval units. prepare_fn() and complete_fn() don't remap correctly the Reftag when using incorrect units of the virtual start sector, which leads to the following protection error at the device:
"blk_update_request: protection error, dev sdb, sector 2048 op 0x0:(READ) flags 0x10000 phys_seg 1 prio class 0"
To fix that, set the seed in integrity interval units.
--- drivers/target/target_core_iblock.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/target/target_core_iblock.c +3 -1
@@ -646,7 +646,9 @@ iblock_alloc_bip(struct se_cmd *cmd, struct bio *bio, } bip->bip_iter.bi_size =bio_integrity_bytes (bi,bio_sectors (bio)); -bip_set_seed (bip, bio->bi_iter.bi_sector); +/* virtual start sector must be in integrity interval units */ +bip_set_seed (bip, bio->bi_iter.bi_sector >> + (bi->interval_exp -SECTOR_SHIFT ));pr_debug ("IBLOCK BIP Size: %u Sector: %llu\n" , bip->bip_iter.bi_size, (unsigned long long )bip->bip_iter.bi_sector);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 184/203 selftests: firmware: Fix it to do root uid check and skip
In reply to Greg Kroah-HartmanFrom: Shuah Khan <[email protected]>
[ Upstream commit c65e41538b04e0d64a673828745a00cb68a24371 ]
firmware attempts to load test modules that require root access and fail. Fix it to check for root uid and exit with skip code instead.
Before this fix:
selftests: firmware: fw_run_tests.sh
modprobe: ERROR: could not insert 'test_firmware': Operation not permitted You must have the following enabled in your kernel:CONFIG_TEST_FIRMWARE=yCONFIG_FW_LOADER=yCONFIG_FW_LOADER_USER_HELPER=yCONFIG_IKCONFIG=yCONFIG_IKCONFIG_PROC=y
not ok 1 selftests: firmware: fw_run_tests.sh # SKIP
With this fix:
selftests: firmware: fw_run_tests.sh
skip all tests: must be run as root
not ok 1 selftests: firmware: fw_run_tests.sh # SKIP
--- tools/testing/selftests/firmware/fw_lib.sh | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/firmware/fw_lib.sh +6 -0
@@ -34,6 +34,12 @@ test_modprobe() check_mods() { + local uid=$(id -u) + if [ $uid -ne 0 ]; then + echo "skip all tests: must be run as root" >&2 + exit $ksft_skip + fi + trap "test_modprobe" EXIT if [ ! -d $DIR ]; then modprobe test_firmware
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 185/203 rseq/selftests: Turn off timeout setting
In reply to Greg Kroah-HartmanFrom: Mathieu Desnoyers <[email protected]>
[ Upstream commit af9cb29c5488381083b0b5ccdfb3cd931063384a ]
As the rseq selftests can run for a long period of time, disable the timeout that the general selftests have.
--- tools/testing/selftests/rseq/settings | 1 + 1 file changed, 1 insertion(+) create mode 100644 tools/testing/selftests/rseq/settings
tools/testing/selftests/rseq/settings new file +1 -0
@@ -0,0 +1 @@ +timeout=0
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 186/203 riscv: export flush_icache_all to modules
In reply to Greg Kroah-HartmanFrom: Olof Johansson <[email protected]>
[ Upstream commit 1833e327a5ea1d1f356fbf6ded0760c9ff4b0594 ]
This is needed by LKDTM (crash dump test module), it calls flush_icache_range(), which on RISC-V turns into flush_icache_all(). On other architectures, the actual implementation is exported, so follow that precedence and export it here too.
Fixes build of CONFIG_LKDTM that fails with:
ERROR: "flush_icache_all" [drivers/misc/lkdtm/lkdtm.ko] undefined!
--- arch/riscv/mm/cacheflush.c | 1 + 1 file changed, 1 insertion(+)
arch/riscv/mm/cacheflush.c +1 -0
@@ -14,6 +14,7 @@ void flush_icache_all(void) {sbi_remote_fence_i (NULL ); } +EXPORT_SYMBOL (flush_icache_all);/* * Performs an icache flush for the given MM context. RISC-V has no direct
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 187/203 mips: cacheinfo: report shared CPU map
In reply to Greg Kroah-HartmanFrom: Vladimir Kondratiev <[email protected]>
[ Upstream commit 3b1313eb32c499d46dc4c3e896d19d9564c879c4 ]
Report L1 caches as shared per core; L2 - per cluster.
This fixes "perf" that went crazy if shared_cpu_map attribute not reported on sysfs, in form of
/sys/devices/system/cpu/cpu*/cache/index*/shared_cpu_list /sys/devices/system/cpu/cpu*/cache/index*/shared_cpu_map
--- arch/mips/kernel/cacheinfo.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-)
arch/mips/kernel/cacheinfo.c +26 -1
@@ -50,6 +50,25 @@ static int __init_cache_level(unsigned int cpu)return 0 ; } +static void fill_cpumask_siblings (int cpu,cpumask_t *cpu_map) +{ +int cpu1; + +for_each_possible_cpu (cpu1) +if (cpus_are_siblings (cpu, cpu1)) +cpumask_set_cpu (cpu1, cpu_map); +} + +static void fill_cpumask_cluster (int cpu,cpumask_t *cpu_map) +{ +int cpu1; +int cluster =cpu_cluster (&cpu_data[cpu]); + +for_each_possible_cpu (cpu1) +if (cpu_cluster (&cpu_data[cpu1]) == cluster) +cpumask_set_cpu (cpu1, cpu_map); +} +static int __populate_cache_leaves (unsigned int cpu) {struct cpuinfo_mips *c = ¤t_cpu_data;
@@ -57,14 +76,20 @@ static int __populate_cache_leaves(unsigned int cpu)struct cacheinfo *this_leaf = this_cpu_ci->info_list;if (c->icache.waysize) { +/* L1 caches are per core */ +fill_cpumask_siblings (cpu, &this_leaf->shared_cpu_map);populate_cache (dcache, this_leaf,1 ,CACHE_TYPE_DATA ); +fill_cpumask_siblings (cpu, &this_leaf->shared_cpu_map);populate_cache (icache, this_leaf,1 ,CACHE_TYPE_INST ); }else {populate_cache (dcache, this_leaf,1 ,CACHE_TYPE_UNIFIED ); } -if (c->scache.waysize) +if (c->scache.waysize) { +/* L2 cache is per cluster */ +fill_cpumask_cluster (cpu, &this_leaf->shared_cpu_map);populate_cache (scache, this_leaf,2 ,CACHE_TYPE_UNIFIED ); + }if (c->tcache.waysize)populate_cache (tcache, this_leaf,3 ,CACHE_TYPE_UNIFIED );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 188/203 mips: Fix gettimeofday() in the vdso library
In reply to Greg Kroah-HartmanFrom: Vincenzo Frascino <[email protected]>
[ Upstream commit 7d2aa4bb90f5f6f1b8de8848c26042403f2d7bf9 ]
The libc provides a discovery mechanism for vDSO library and its symbols. When a symbol is not exposed by the vDSOs the libc falls back on the system calls.
With the introduction of the unified vDSO library on mips this behavior is not honored anymore by the kernel in the case of gettimeofday().
The issue has been noticed and reported due to a dhclient failure on the CI20 board:
root@letux:~# dhclient ../../../../lib/isc/unix/time.c:200: Operation not permitted root@letux:~#
Restore the original behavior fixing gettimeofday() in the vDSO library.
--- arch/mips/include/asm/vdso/gettimeofday.h | 13 ------------- arch/mips/vdso/vgettimeofday.c | 20 ++++++++++++++++++++ 2 files changed, 20 insertions(+), 13 deletions(-)
arch/mips/include/asm/vdso/gettimeofday.h +0 -13
@@ -26,8 +26,6 @@#define __VDSO_USE_SYSCALL ULLONG_MAX -#ifdef CONFIG_MIPS_CLOCK_VSYSCALL -static __always_inline long gettimeofday_fallback (struct __kernel_old_timeval *_tv,struct timezone *_tz)
@@ -48,17 +46,6 @@ static __always_inline long gettimeofday_fallback(return error ? -ret : ret; } -#else - -static __always_inline long gettimeofday_fallback ( -struct __kernel_old_timeval *_tv, -struct timezone *_tz) -{ -return -1 ; -} - -#endif -static __always_inline long clock_gettime_fallback (clockid_t _clkid,struct __kernel_timespec *_ts)
arch/mips/vdso/vgettimeofday.c +20 -0
@@ -17,12 +17,22 @@ int __vdso_clock_gettime(clockid_t clock,return __cvdso_clock_gettime32 (clock, ts); } +#ifdef CONFIG_MIPS_CLOCK_VSYSCALL + +/* +* This is behind the ifdef so that we don't provide the symbol when there's no +* possibility of there being a usable clocksource, because there's nothing we +* can do without it. When libc fails the symbol lookup it should fall back on +* the standard syscall path. +*/ int __vdso_gettimeofday (struct __kernel_old_timeval *tv,struct timezone *tz) {return __cvdso_gettimeofday (tv, tz); } +#endif /* CONFIG_MIPS_CLOCK_VSYSCALL */ +int __vdso_clock_getres (clockid_t clock_id,struct old_timespec32 *res) {
@@ -43,12 +53,22 @@ int __vdso_clock_gettime(clockid_t clock,return __cvdso_clock_gettime (clock, ts); } +#ifdef CONFIG_MIPS_CLOCK_VSYSCALL + +/* +* This is behind the ifdef so that we don't provide the symbol when there's no +* possibility of there being a usable clocksource, because there's nothing we +* can do without it. When libc fails the symbol lookup it should fall back on +* the standard syscall path. +*/ int __vdso_gettimeofday (struct __kernel_old_timeval *tv,struct timezone *tz) {return __cvdso_gettimeofday (tv, tz); } +#endif /* CONFIG_MIPS_CLOCK_VSYSCALL */ +int __vdso_clock_getres (clockid_t clock_id,struct __kernel_timespec *res) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 189/203 tomoyo: Suppress RCU warning at list_for_each_entry_rcu().
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit 6bd5ce6089b561f5392460bfb654dea89356ab1b ]
John Garry has reported that allmodconfig kernel on arm64 causes flood of "RCU-list traversed in non-reader section!!" warning. I don't know what change caused this warning, but this warning is safe because TOMOYO uses SRCU lock instead. Let's suppress this warning by explicitly telling that the caller is holding SRCU lock.
--- security/tomoyo/common.c | 9 ++++++--- security/tomoyo/domain.c | 15 ++++++++++----- security/tomoyo/group.c | 9 ++++++--- security/tomoyo/util.c | 6 ++++-- 4 files changed, 26 insertions(+), 13 deletions(-)
security/tomoyo/common.c +6 -3
@@ -951,7 +951,8 @@ static bool tomoyo_manager(void) exe =tomoyo_get_exe ();if (!exe)return false; -list_for_each_entry_rcu (ptr, &tomoyo_kernel_namespace.policy_list[TOMOYO_ID_MANAGER ], head.list) { +list_for_each_entry_rcu (ptr, &tomoyo_kernel_namespace.policy_list[TOMOYO_ID_MANAGER ], head.list, +srcu_read_lock_held (&tomoyo_ss)) {if (!ptr->head.is_deleted && (!tomoyo_pathcmp (domainname, ptr->manager) || !strcmp (exe, ptr->manager->name))) {
@@ -1095,7 +1096,8 @@ static int tomoyo_delete_domain(char *domainname)if (mutex_lock_interruptible (&tomoyo_policy_lock))return -EINTR ;/* Is there an active domain? */ -list_for_each_entry_rcu (domain, &tomoyo_domain_list, list) { +list_for_each_entry_rcu (domain, &tomoyo_domain_list, list, +srcu_read_lock_held (&tomoyo_ss)) {/* Never delete tomoyo_kernel_domain */ if (domain == &tomoyo_kernel_domain)continue ;
@@ -2778,7 +2780,8 @@ void tomoyo_check_profile(void) tomoyo_policy_loaded = true;pr_info ("TOMOYO: 2.6.0\n" ); -list_for_each_entry_rcu (domain, &tomoyo_domain_list, list) { +list_for_each_entry_rcu (domain, &tomoyo_domain_list, list, +srcu_read_lock_held (&tomoyo_ss)) {const u8 profile = domain->profile;struct tomoyo_policy_namespace *ns = domain->ns;
security/tomoyo/domain.c +10 -5
@@ -41,7 +41,8 @@ int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,if (mutex_lock_interruptible (&tomoyo_policy_lock))return -ENOMEM ; -list_for_each_entry_rcu (entry, list, list) { +list_for_each_entry_rcu (entry, list, list, +srcu_read_lock_held (&tomoyo_ss)) {if (entry->is_deleted ==TOMOYO_GC_IN_PROGRESS )continue ;if (!check_duplicate (entry, new_entry))
@@ -119,7 +120,8 @@ int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, }if (mutex_lock_interruptible (&tomoyo_policy_lock)) goto out; -list_for_each_entry_rcu (entry, list, list) { +list_for_each_entry_rcu (entry, list, list, +srcu_read_lock_held (&tomoyo_ss)) {if (entry->is_deleted ==TOMOYO_GC_IN_PROGRESS )continue ; if (!tomoyo_same_acl_head(entry, new_entry) ||
@@ -166,7 +168,8 @@ void tomoyo_check_acl(struct tomoyo_request_info *r,u16 i =0 ; retry: -list_for_each_entry_rcu (ptr, list, list) { +list_for_each_entry_rcu (ptr, list, list, +srcu_read_lock_held (&tomoyo_ss)) {if (ptr->is_deleted || ptr->type != r->param_type)continue ;if (!check_entry (r, ptr))
@@ -298,7 +301,8 @@ static inline bool tomoyo_scan_transition {const struct tomoyo_transition_control *ptr; -list_for_each_entry_rcu (ptr, list, head.list) { +list_for_each_entry_rcu (ptr, list, head.list, +srcu_read_lock_held (&tomoyo_ss)) {if (ptr->head.is_deleted || ptr->type != type)continue ;if (ptr->domainname) {
@@ -735,7 +739,8 @@ retry:/* Check 'aggregator' directive. */ candidate = &exename; -list_for_each_entry_rcu (ptr, list, head.list) { +list_for_each_entry_rcu (ptr, list, head.list, +srcu_read_lock_held (&tomoyo_ss)) {if (ptr->head.is_deleted || !tomoyo_path_matches_pattern (&exename, ptr->original_name))
security/tomoyo/group.c +6 -3
@@ -133,7 +133,8 @@ tomoyo_path_matches_group(const struct tomoyo_path_info *pathname, {struct tomoyo_path_group *member; -list_for_each_entry_rcu (member, &group->member_list, head.list) { +list_for_each_entry_rcu (member, &group->member_list, head.list, +srcu_read_lock_held (&tomoyo_ss)) {if (member->head.is_deleted)continue ;if (!tomoyo_path_matches_pattern (pathname, member->member_name))
@@ -161,7 +162,8 @@ bool tomoyo_number_matches_group(const unsigned long min,struct tomoyo_number_group *member;bool matched = false; -list_for_each_entry_rcu (member, &group->member_list, head.list) { +list_for_each_entry_rcu (member, &group->member_list, head.list, +srcu_read_lock_held (&tomoyo_ss)) {if (member->head.is_deleted)continue ; if (min > member->number.values[1] ||
@@ -191,7 +193,8 @@ bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,bool matched = false;const u8 size = is_ipv6 ?16 :4 ; -list_for_each_entry_rcu (member, &group->member_list, head.list) { +list_for_each_entry_rcu (member, &group->member_list, head.list, +srcu_read_lock_held (&tomoyo_ss)) {if (member->head.is_deleted)continue ;if (member->address.is_ipv6 != is_ipv6)
security/tomoyo/util.c +4 -2
@@ -594,7 +594,8 @@ struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname) name.name = domainname;tomoyo_fill_path_info (&name); -list_for_each_entry_rcu (domain, &tomoyo_domain_list, list) { +list_for_each_entry_rcu (domain, &tomoyo_domain_list, list, +srcu_read_lock_held (&tomoyo_ss)) {if (!domain->is_deleted && !tomoyo_pathcmp (&name, domain->domainname))return domain;
@@ -1028,7 +1029,8 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r)return false;if (!domain)return true; -list_for_each_entry_rcu (ptr, &domain->acl_info_list, list) { +list_for_each_entry_rcu (ptr, &domain->acl_info_list, list, +srcu_read_lock_held (&tomoyo_ss)) {u16 perm;u8 i;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 190/203 MIPS: Prevent link failure with kcov instrumentation
In reply to Greg Kroah-HartmanFrom: Jouni Hogander <[email protected]>
[ Upstream commit a4a3893114a41e365274d5fab5d9ff5acc235ff0 ]
__sanitizer_cov_trace_pc() is not linked in and causing link failure if KCOV_INSTRUMENT is enabled. Fix this by disabling instrumentation for compressed image.
--- arch/mips/boot/compressed/Makefile | 3 +++ 1 file changed, 3 insertions(+)
arch/mips/boot/compressed/Makefile +3 -0
@@ -29,6 +29,9 @@ KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__ASSEMBLY__ \ -DBOOT_HEAP_SIZE=$(BOOT_HEAP_SIZE) \ -DKERNEL_ENTRY=$(VMLINUX_ENTRY_ADDRESS) +# Prevents link failures: __sanitizer_cov_trace_pc() is not linked in. +KCOV_INSTRUMENT := n + # decompressor objects (linked with vmlinuz) vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 191/203 drm/arm/mali: make malidp_mw_connector_helper_funcs static
In reply to Greg Kroah-HartmanFrom: Ben Dooks (Codethink) <[email protected]>
[ Upstream commit ac2917b01992c098b8d4e6837115e3ca347fdd90 ]
The malidp_mw_connector_helper_funcs is not referenced by name outside of the file it is in, so make it static to avoid the following warning:
drivers/gpu/drm/arm/malidp_mw.c:59:41: warning: symbol 'malidp_mw_connector_helper_funcs' was not declared. Should it be static?
--- drivers/gpu/drm/arm/malidp_mw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/arm/malidp_mw.c +1 -1
@@ -56,7 +56,7 @@ malidp_mw_connector_mode_valid(struct drm_connector *connector,return MODE_OK ; } -const struct drm_connector_helper_funcs malidp_mw_connector_helper_funcs = { +static const struct drm_connector_helper_funcs malidp_mw_connector_helper_funcs = { .get_modes = malidp_mw_connector_get_modes, .mode_valid = malidp_mw_connector_mode_valid, };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 192/203 rxrpc: Unlock new call in rxrpc_new_incoming_call() rather than the caller
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit f33121cbe91973a08e68e4bde8c3f7e6e4e351c1 ]
Move the unlock and the ping transmission for a new incoming call into rxrpc_new_incoming_call() rather than doing it in the caller. This makes it clearer to see what's going on.
--- net/rxrpc/call_accept.c | 36 ++++++++++++++++++++++++++++-------- net/rxrpc/input.c | 18 ------------------ 2 files changed, 28 insertions(+), 26 deletions(-)
net/rxrpc/call_accept.c +28 -8
@@ -239,6 +239,22 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)kfree (b); } +/* +* Ping the other end to fill our RTT cache and to retrieve the rwind +* and MTU parameters. +*/ +static void rxrpc_send_ping (struct rxrpc_call *call,struct sk_buff *skb) +{ +struct rxrpc_skb_priv *sp =rxrpc_skb (skb); +ktime_t now = skb->tstamp; + +if (call->peer->rtt_usage <3 || +ktime_before (ktime_add_ms (call->peer->rtt_last_req,1000 ), now)) +rxrpc_propose_ACK (call,RXRPC_ACK_PING , sp->hdr.serial, + true, true, + rxrpc_propose_ack_ping_for_params); +} +/* * Allocate a new incoming call from the prealloc pool, along with a connection * and a peer as necessary.
@@ -346,9 +362,7 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, sp->hdr.seq, RX_INVALID_OPERATION, ESHUTDOWN); skb->mark =RXRPC_SKB_MARK_REJECT_ABORT ; skb->priority =RX_INVALID_OPERATION ; -_leave (" = NULL [close]" ); - call =NULL ; - goto out; + goto no_call; }/* The peer, connection and call may all have sprung into existence due
@@ -361,9 +375,7 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, call =rxrpc_alloc_incoming_call (rx, local, peer, conn, skb);if (!call) { skb->mark =RXRPC_SKB_MARK_REJECT_BUSY ; -_leave (" = NULL [busy]" ); - call =NULL ; - goto out; + goto no_call; } trace_rxrpc_receive(call, rxrpc_receive_incoming,
@@ -432,10 +444,18 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local,*/ rxrpc_put_call (call, rxrpc_call_put); -_leave (" = %p{%d}" , call, call->debug_id); -out:spin_unlock (&rx->incoming_lock); + +rxrpc_send_ping (call, skb); +mutex_unlock (&call->user_mutex); + +_leave (" = %p{%d}" , call, call->debug_id);return call; + +no_call: +spin_unlock (&rx->incoming_lock); +_leave (" = NULL [%u]" , skb->mark); +return NULL ; }/*
net/rxrpc/input.c +0 -18
@@ -192,22 +192,6 @@ send_extra_data: goto out_no_clear_ca; } -/* -* Ping the other end to fill our RTT cache and to retrieve the rwind -* and MTU parameters. -*/ -static void rxrpc_send_ping (struct rxrpc_call *call,struct sk_buff *skb) -{ -struct rxrpc_skb_priv *sp =rxrpc_skb (skb); -ktime_t now = skb->tstamp; - -if (call->peer->rtt_usage <3 || -ktime_before (ktime_add_ms (call->peer->rtt_last_req,1000 ), now)) -rxrpc_propose_ACK (call,RXRPC_ACK_PING , sp->hdr.serial, - true, true, - rxrpc_propose_ack_ping_for_params); -} -/* * Apply a hard ACK by advancing the Tx window. */
@@ -1396,8 +1380,6 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb) call =rxrpc_new_incoming_call (local, rx, skb);if (!call) goto reject_packet; -rxrpc_send_ping (call, skb); -mutex_unlock (&call->user_mutex); }/* Process a call packet; this either discards or passes on the ref
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 193/203 rxrpc: Dont take call->user_mutex in rxrpc_new_incoming_call()
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 13b7955a0252e15265386b229b814152f109b234 ]
Standard kernel mutexes cannot be used in any way from interrupt or softirq context, so the user_mutex which manages access to a call cannot be a mutex since on a new call the mutex must start off locked and be unlocked within the softirq handler to prevent userspace interfering with a call we're setting up.
Commit a0855d24fc22d49cdc25664fb224caee16998683 ("locking/mutex: Complain upon mutex API misuse in IRQ contexts") causes big warnings to be splashed in dmesg for each a new call that comes in from the server. Whilst it *seems* like it should be okay, since the accept path uses trylock, there are issues with PI boosting and marking the wrong task as the owner.
Fix this by not taking the mutex in the softirq path at all. It's not obvious that there should be any need for it as the state is set before the first notification is generated for the new call.
There's also no particular reason why the link-assessing ping should be triggered inside the mutex. It's not actually transmitted there anyway, but rather it has to be deferred to a workqueue.
Further, I don't think that there's any particular reason that the socket notification needs to be done from within rx->incoming_lock, so the amount of time that lock is held can be shortened too and the ping prepared before the new call notification is sent.
--- net/rxrpc/call_accept.c | 20 +++----------------- 1 file changed, 3 insertions(+), 17 deletions(-)
net/rxrpc/call_accept.c +3 -17
@@ -381,18 +381,6 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local,trace_rxrpc_receive (call, rxrpc_receive_incoming, sp->hdr.serial, sp->hdr.seq); -/* Lock the call to prevent rxrpc_kernel_send/recv_data() and -* sendmsg()/recvmsg() inconveniently stealing the mutex once the -* notification is generated. -* -* The BUG should never happen because the kernel should be well -* behaved enough not to access the call before the first notification -* event and userspace is prevented from doing so until the state is -* appropriate. -*/ -if (!mutex_trylock (&call->user_mutex)) -BUG (); -/* Make the call live. */ rxrpc_incoming_call (rx, call, skb); conn = call->conn;
@@ -433,6 +421,9 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local,BUG (); }spin_unlock (&conn->state_lock); +spin_unlock (&rx->incoming_lock); + +rxrpc_send_ping (call, skb);if (call->state ==RXRPC_CALL_SERVER_ACCEPTING )rxrpc_notify_socket (call);
@@ -444,11 +435,6 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local,*/ rxrpc_put_call (call, rxrpc_call_put); -spin_unlock (&rx->incoming_lock); - -rxrpc_send_ping (call, skb); -mutex_unlock (&call->user_mutex); -_leave (" = %p{%d}" , call, call->debug_id);return call;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 194/203 rxrpc: Fix missing security check on incoming calls
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 063c60d39180cec7c9317f5acfc3071f8fecd705 ]
Fix rxrpc_new_incoming_call() to check that we have a suitable service key available for the combination of service ID and security class of a new incoming call - and to reject calls for which we don't.
This causes an assertion like the following to appear:
rxrpc: Assertion failed - 6(0x6) == 12(0xc) is false kernel BUG at net/rxrpc/call_object.c:456!
Where call->state is RXRPC_CALL_SERVER_SECURING (6) rather than RXRPC_CALL_COMPLETE (12).
--- net/rxrpc/ar-internal.h | 10 ++++-- net/rxrpc/call_accept.c | 14 ++++++-- net/rxrpc/conn_event.c | 16 +-------- net/rxrpc/conn_service.c | 4 +++ net/rxrpc/rxkad.c | 5 +-- net/rxrpc/security.c | 70 +++++++++++++++++++--------------------- 6 files changed, 59 insertions(+), 60 deletions(-)
net/rxrpc/ar-internal.h +7 -3
@@ -209,6 +209,7 @@ struct rxrpc_skb_priv {struct rxrpc_security {const char *name;/* name of this service */ u8 security_index;/* security type provided */ +u32 no_key_abort;/* Abort code indicating no key */ /* Initialise a security service */ int (*init)(void );
@@ -977,8 +978,9 @@ static inline void rxrpc_reduce_conn_timer(struct rxrpc_connection *conn,struct rxrpc_connection *rxrpc_find_service_conn_rcu (struct rxrpc_peer *,struct sk_buff *);struct rxrpc_connection *rxrpc_prealloc_service_connection (struct rxrpc_net *,gfp_t ); -void rxrpc_new_incoming_connection (struct rxrpc_sock *, -struct rxrpc_connection *,struct sk_buff *); +void rxrpc_new_incoming_connection (struct rxrpc_sock *,struct rxrpc_connection *, +const struct rxrpc_security *,struct key *, +struct sk_buff *);void rxrpc_unpublish_service_conn (struct rxrpc_connection *);/*
@@ -1103,7 +1105,9 @@ extern const struct rxrpc_security rxkad;int __init rxrpc_init_security (void );void rxrpc_exit_security (void );int rxrpc_init_client_conn_security (struct rxrpc_connection *); -int rxrpc_init_server_conn_security (struct rxrpc_connection *); +bool rxrpc_look_up_server_security (struct rxrpc_local *,struct rxrpc_sock *, +const struct rxrpc_security **,struct key **, +struct sk_buff *);/* * sendmsg.c
net/rxrpc/call_accept.c +11 -3
@@ -263,6 +263,8 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx,struct rxrpc_local *local, struct rxrpc_peer *peer, struct rxrpc_connection *conn, + const struct rxrpc_security *sec, + struct key *key, struct sk_buff *skb) { struct rxrpc_backlog *b = rx->backlog;
@@ -310,7 +312,7 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx, conn->params.local =rxrpc_get_local (local); conn->params.peer = peer;rxrpc_see_connection (conn); -rxrpc_new_incoming_connection (rx, conn, skb); +rxrpc_new_incoming_connection (rx, conn, sec, key, skb); }else {rxrpc_get_connection (conn); }
@@ -349,9 +351,11 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, struct sk_buff *skb) {struct rxrpc_skb_priv *sp =rxrpc_skb (skb); +const struct rxrpc_security *sec =NULL ;struct rxrpc_connection *conn;struct rxrpc_peer *peer =NULL ; -struct rxrpc_call *call; +struct rxrpc_call *call =NULL ; +struct key *key =NULL ;_enter ("" );
@@ -372,7 +376,11 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local,*/ conn =rxrpc_find_connection_rcu (local, skb, &peer); - call =rxrpc_alloc_incoming_call (rx, local, peer, conn, skb); +if (!conn && !rxrpc_look_up_server_security (local, rx, &sec, &key, skb)) + goto no_call; + + call =rxrpc_alloc_incoming_call (rx, local, peer, conn, sec, key, skb); +key_put (key);if (!call) { skb->mark =RXRPC_SKB_MARK_REJECT_BUSY ; goto no_call;
net/rxrpc/conn_event.c +1 -15
@@ -376,21 +376,7 @@ static void rxrpc_secure_connection(struct rxrpc_connection *conn)_enter ("{%d}" , conn->debug_id);ASSERT (conn->security_ix !=0 ); - -if (!conn->params.key) { -_debug ("set up security" ); - ret =rxrpc_init_server_conn_security (conn); -switch (ret) { -case 0 : -break ; -case -ENOENT : - abort_code =RX_CALL_DEAD ; - goto abort; -default : - abort_code =RXKADNOAUTH ; - goto abort; - } - } +ASSERT (conn->server_key);if (conn->security->issue_challenge (conn) <0 ) { abort_code =RX_CALL_DEAD ;
net/rxrpc/conn_service.c +4 -0
@@ -148,6 +148,8 @@ struct rxrpc_connection *rxrpc_prealloc_service_connection(struct rxrpc_net *rxn*/ void rxrpc_new_incoming_connection (struct rxrpc_sock *rx,struct rxrpc_connection *conn, +const struct rxrpc_security *sec, +struct key *key,struct sk_buff *skb) {struct rxrpc_skb_priv *sp =rxrpc_skb (skb);
@@ -160,6 +162,8 @@ void rxrpc_new_incoming_connection(struct rxrpc_sock *rx, conn->service_id = sp->hdr.serviceId; conn->security_ix = sp->hdr.securityIndex; conn->out_clientflag =0 ; + conn->security = sec; + conn->server_key =key_get (key);if (conn->security_ix) conn->state =RXRPC_CONN_SERVICE_UNSECURED ;else
net/rxrpc/rxkad.c +3 -2
@@ -648,9 +648,9 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)u32 serial;int ret; -_enter ("{%d,%x}" , conn->debug_id,key_serial (conn->params.key)); +_enter ("{%d,%x}" , conn->debug_id,key_serial (conn->server_key)); - ret =key_validate (conn->params.key); + ret =key_validate (conn->server_key);if (ret <0 )return ret;
@@ -1293,6 +1293,7 @@ static void rxkad_exit(void)const struct rxrpc_security rxkad = { .name ="rxkad" , .security_index =RXRPC_SECURITY_RXKAD , + .no_key_abort =RXKADUNKNOWNKEY , .init = rxkad_init, .exit = rxkad_exit, .init_connection_security = rxkad_init_connection_security,
net/rxrpc/security.c +33 -37
95 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 195/203 dmaengine: k3dma: Avoid null pointer traversal
In reply to Greg Kroah-HartmanFrom: John Stultz <[email protected]>
[ Upstream commit 2f42e05b942fe2fbfb9bbc6e34e1dd8c3ce4f3a4 ]
In some cases we seem to submit two transactions in a row, which causes us to lose track of the first. If we then cancel the request, we may still get an interrupt, which traverses a null ds_run value.
So try to avoid starting a new transaction if the ds_run value is set.
While this patch avoids the null pointer crash, I've had some reports of the k3dma driver still getting confused, which suggests the ds_run/ds_done value handling still isn't quite right. However, I've not run into an issue recently with it so I think this patch is worth pushing upstream to avoid the crash.
--- drivers/dma/k3dma.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/dma/k3dma.c +9 -3
@@ -229,9 +229,11 @@ static irqreturn_t k3_dma_int_handler(int irq, void *dev_id) c = p->vchan;if (c && (tc1 &BIT (i))) {spin_lock_irqsave (&c->vc.lock, flags); -vchan_cookie_complete (&p->ds_run->vd); - p->ds_done = p->ds_run; - p->ds_run =NULL ; +if (p->ds_run !=NULL ) { +vchan_cookie_complete (&p->ds_run->vd); + p->ds_done = p->ds_run; + p->ds_run =NULL ; + }spin_unlock_irqrestore (&c->vc.lock, flags); }if (c && (tc2 &BIT (i))) {
@@ -271,6 +273,10 @@ static int k3_dma_start_txd(struct k3_dma_chan *c)if (BIT (c->phy->idx) &k3_dma_get_chan_stat (d))return -EAGAIN ; +/* Avoid losing track of ds_run if a transaction is in flight */ +if (c->phy->ds_run) +return -EAGAIN ; +if (vd) {struct k3_dma_desc_sw *ds = container_of(vd, struct k3_dma_desc_sw, vd);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 196/203 s390/qeth: lock the card while changing its hsuid
In reply to Greg Kroah-HartmanFrom: Julian Wiedmann <[email protected]>
[ Upstream commit 5b6c7b55cfe26224b0f41b1c226d3534c542787f ]
qeth_l3_dev_hsuid_store() initially checks the card state, but doesn't take the conf_mutex to ensure that the card stays in this state while being reconfigured.
Rework the code to take this lock, and drop a redundant state check in a helper function.
--- drivers/s390/net/qeth_core_main.c | 5 ---- drivers/s390/net/qeth_l3_sys.c | 40 +++++++++++++++++++++---------- 2 files changed, 28 insertions(+), 17 deletions(-)
drivers/s390/net/qeth_core_main.c +0 -5
@@ -3378,11 +3378,6 @@ int qeth_configure_cq(struct qeth_card *card, enum qeth_cq cq) goto out; } -if (card->state !=CARD_STATE_DOWN ) { - rc =-1 ; - goto out; - } -qeth_free_qdio_queues (card); card->options.cq = cq; rc =0 ;
drivers/s390/net/qeth_l3_sys.c +28 -12
@@ -270,24 +270,36 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { struct qeth_card *card = dev_get_drvdata(dev); +int rc =0 ;char *tmp; -int rc;if (!card)return -EINVAL ;if (!IS_IQD (card))return -EPERM ; -if (card->state !=CARD_STATE_DOWN ) -return -EPERM ; -if (card->options.sniffer) -return -EPERM ; -if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) -return -EPERM ; + +mutex_lock (&card->conf_mutex); +if (card->state !=CARD_STATE_DOWN ) { + rc = -EPERM ; + goto out; + } + +if (card->options.sniffer) { + rc = -EPERM ; + goto out; + } + +if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) { + rc = -EPERM ; + goto out; + } tmp =strsep ((char **)&buf,"\n" ); -if (strlen (tmp) >8 ) -return -EINVAL ; +if (strlen (tmp) >8 ) { + rc = -EINVAL ; + goto out; + }if (card->options.hsuid[0 ])/* delete old ip address */
@@ -298,11 +310,13 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev, card->options.hsuid[0 ] ='\0' ;memcpy (card->dev->perm_addr, card->options.hsuid,9 );qeth_configure_cq (card,QETH_CQ_DISABLED ); -return count; + goto out; } -if (qeth_configure_cq (card,QETH_CQ_ENABLED )) -return -EPERM ; +if (qeth_configure_cq (card,QETH_CQ_ENABLED )) { + rc = -EPERM ; + goto out; + }snprintf (card->options.hsuid,sizeof (card->options.hsuid),"%-8s" , tmp);
@@ -311,6 +325,8 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev, rc =qeth_l3_modify_hsuid (card, true); +out: +mutex_unlock (&card->conf_mutex);return rc ? rc : count; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 197/203 ioat: ioat_alloc_ring() failure handling.
In reply to Greg Kroah-HartmanFrom: [email protected] <[email protected]>
[ Upstream commit b0b5ce1010ffc50015eaec72b0028aaae3f526bb ]
If dma_alloc_coherent() returns NULL in ioat_alloc_ring(), ring allocation must not proceed.
Until now, if the first call to dma_alloc_coherent() in ioat_alloc_ring() returned NULL, the processing could proceed, failing with NULL-pointer dereferencing further down the line.
--- drivers/dma/ioat/dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/dma/ioat/dma.c +2 -1
@@ -377,10 +377,11 @@ ioat_alloc_ring(struct dma_chan *c, int order, gfp_t flags) descs->virt =dma_alloc_coherent (to_dev (ioat_chan),SZ_2M , &descs->hw, flags); -if (!descs->virt && (i >0 )) { +if (!descs->virt) {int idx;for (idx =0 ; idx < i; idx++) { + descs = &ioat_chan->descs[idx];dma_free_coherent (to_dev (ioat_chan),SZ_2M , descs->virt, descs->hw); descs->virt =NULL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 198/203 drm/amdgpu: enable gfxoff for raven1 refresh
In reply to Greg Kroah-HartmanFrom: changzhu <[email protected]>
[ Upstream commit e0c63812352298efbce2a71483c1dab627d0c288 ]
When smu version is larger than 0x41e2b, it will load raven_kicker_rlc.bin.To enable gfxoff for raven_kicker_rlc.bin,it needs to avoid adev->pm.pp_feature &= ~PP_GFXOFF_MASK when it loads raven_kicker_rlc.bin.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +4 -11
@@ -1038,17 +1038,10 @@ static void gfx_v9_0_check_if_need_gfxoff(struct amdgpu_device *adev)case CHIP_VEGA20 :break ;case CHIP_RAVEN : -/* Disable GFXOFF on original raven. There are combinations -* of sbios and platforms that are not stable. -*/ -if (!(adev->rev_id >=0x8 || adev->pdev->device ==0x15d8 )) - adev->pm.pp_feature &= ~PP_GFXOFF_MASK ; -else if (!(adev->rev_id >=0x8 || adev->pdev->device ==0x15d8 ) - &&((adev->gfx.rlc_fw_version !=106 && - adev->gfx.rlc_fw_version <531 ) || - (adev->gfx.rlc_fw_version ==53815 ) || - (adev->gfx.rlc_feature_version <1 ) || - !adev->gfx.rlc.is_rlc_v2_1)) +if (!(adev->rev_id >=0x8 || + adev->pdev->device ==0x15d8 ) && + (adev->pm.fw_version <0x41e2b ||/* not raven1 fresh */ + !adev->gfx.rlc.is_rlc_v2_1))/* without rlc save restore ucodes */ adev->pm.pp_feature &= ~PP_GFXOFF_MASK ;if (adev->pm.pp_feature &PP_GFXOFF_MASK )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 199/203 media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes
In reply to Greg Kroah-HartmanFrom: Sakari Ailus <[email protected]>
[ Upstream commit ce644cf3fa06504c2c71ab1b794160d54aaccbc0 ]
A struct that needs to be aligned to 32 bytes has a size of 28. Increase the size to 32.
This makes elements of arrays of this struct aligned to 32 as well, and other structs where members are aligned to 32 mixing ipu3_uapi_awb_fr_config_s as well as other types.
--- drivers/staging/media/ipu3/include/intel-ipu3.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/ipu3/include/intel-ipu3.h +1 -1
@@ -449,7 +449,7 @@ struct ipu3_uapi_awb_fr_config_s {__u16 reserved1;__u32 bayer_sign;__u8 bayer_nf; -__u8 reserved2[3 ]; +__u8 reserved2[7 ]; } __attribute__((aligned(32))) __packed;/**
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 200/203 kbuild/deb-pkg: annotate libelf-dev dependency as :native
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit 8ffdc54b6f4cd718a45802e645bb853e3a46a078 ]
Cross compiling the x86 kernel on a non-x86 build machine produces the following error when CONFIG_UNWINDER_ORC is enabled, regardless of whether libelf-dev is installed or not.
dpkg-checkbuilddeps: error: Unmet build dependencies: libelf-dev
dpkg-buildpackage: warning: build dependencies/conflicts unsatisfied; aborting
dpkg-buildpackage: warning: (Use -d flag to override.)
Since this is a build time dependency for a build tool, we need to depend on the native version of libelf-dev so add the appropriate annotation.
--- scripts/package/mkdebian | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/package/mkdebian +1 -1
@@ -136,7 +136,7 @@ mkdir -p debian/source/ echo "1.0" > debian/source/format echo $debarch > debian/arch -extra_build_depends=", $(if_enabled_echo CONFIG_UNWINDER_ORC libelf-dev)" +extra_build_depends=", $(if_enabled_echo CONFIG_UNWINDER_ORC libelf-dev:native)" extra_build_depends="$extra_build_depends, $(if_enabled_echo CONFIG_SYSTEM_TRUSTED_KEYRING libssl-dev:native)" # Generate a simple changelog template
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 201/203 hexagon: parenthesize registers in asm predicates
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
[ Upstream commit 780a0cfda9006a9a22d6473c2d4c527f5c68eb2e ]
Hexagon requires that register predicates in assembly be parenthesized.
--- arch/hexagon/include/asm/atomic.h | 8 ++++---- arch/hexagon/include/asm/bitops.h | 8 ++++---- arch/hexagon/include/asm/cmpxchg.h | 2 +- arch/hexagon/include/asm/futex.h | 6 +++--- arch/hexagon/include/asm/spinlock.h | 20 ++++++++++---------- arch/hexagon/kernel/vm_entry.S | 2 +- 6 files changed, 23 insertions(+), 23 deletions(-)
arch/hexagon/include/asm/atomic.h +4 -4
@@ -91,7 +91,7 @@ static inline void atomic_##op(int i, atomic_t *v) \"1: %0 = memw_locked(%1);\n" \ " %0 = "#op "(%0,%2);\n" \ " memw_locked(%1,P3)=%0;\n" \ - " if !P3 jump 1b;\n" \ + " if (!P3) jump 1b;\n" \ : "=&r" (output) \ : "r" (&v->counter), "r" (i) \ : "memory", "p3" \
@@ -107,7 +107,7 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \"1: %0 = memw_locked(%1);\n" \ " %0 = "#op "(%0,%2);\n" \ " memw_locked(%1,P3)=%0;\n" \ - " if !P3 jump 1b;\n" \ + " if (!P3) jump 1b;\n" \ : "=&r" (output) \ : "r" (&v->counter), "r" (i) \ : "memory", "p3" \
@@ -124,7 +124,7 @@ static inline int atomic_fetch_##op(int i, atomic_t *v) \"1: %0 = memw_locked(%2);\n" \ " %1 = "#op "(%0,%3);\n" \ " memw_locked(%2,P3)=%1;\n" \ - " if !P3 jump 1b;\n" \ + " if (!P3) jump 1b;\n" \ : "=&r" (output), "=&r" (val) \ : "r" (&v->counter), "r" (i) \ : "memory", "p3" \
@@ -173,7 +173,7 @@ static inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)" }" " memw_locked(%2, p3) = %1;" " {" -" if !p3 jump 1b;" +" if (!p3) jump 1b;" " }" "2:" : "=&r" (__oldval), "=&r" (tmp)
arch/hexagon/include/asm/bitops.h +4 -4
@@ -38,7 +38,7 @@ static inline int test_and_clear_bit(int nr, volatile void *addr)"1: R12 = memw_locked(R10);\n" " { P0 = tstbit(R12,R11); R12 = clrbit(R12,R11); }\n" " memw_locked(R10,P1) = R12;\n" -" {if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n" +" {if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n" : "=&r" (oldval) : "r" (addr), "r" (nr) : "r10", "r11", "r12", "p0", "p1", "memory"
@@ -62,7 +62,7 @@ static inline int test_and_set_bit(int nr, volatile void *addr)"1: R12 = memw_locked(R10);\n" " { P0 = tstbit(R12,R11); R12 = setbit(R12,R11); }\n" " memw_locked(R10,P1) = R12;\n" -" {if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n" +" {if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n" : "=&r" (oldval) : "r" (addr), "r" (nr) : "r10", "r11", "r12", "p0", "p1", "memory"
@@ -88,7 +88,7 @@ static inline int test_and_change_bit(int nr, volatile void *addr)"1: R12 = memw_locked(R10);\n" " { P0 = tstbit(R12,R11); R12 = togglebit(R12,R11); }\n" " memw_locked(R10,P1) = R12;\n" -" {if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n" +" {if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n" : "=&r" (oldval) : "r" (addr), "r" (nr) : "r10", "r11", "r12", "p0", "p1", "memory"
@@ -223,7 +223,7 @@ static inline int ffs(int x)int r; asm("{ P0 = cmp.eq(%1,#0); %0 = ct0(%1);}\n" -"{ if P0 %0 = #0; if !P0 %0 = add(%0,#1);}\n" +"{ if (P0) %0 = #0; if (!P0) %0 = add(%0,#1);}\n" :"=&r" (r) :"r" (x) :"p0" );
arch/hexagon/include/asm/cmpxchg.h +1 -1
@@ -30,7 +30,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, __asm__ __volatile__ ("1: %0 = memw_locked(%1);\n" /* load into retval */ " memw_locked(%1,P0) = %2;\n" /* store into memory */ -" if !P0 jump 1b;\n" +" if (!P0) jump 1b;\n" :"=&r" (retval) :"r" (ptr),"r" (x) : "memory", "p0"
arch/hexagon/include/asm/futex.h +3 -3
@@ -16,7 +16,7 @@/* For example: %1 = %4 */ \ insn \"2: memw_locked(%3,p2) = %1;\n" \ -" if !p2 jump 1b;\n" \ +" if (!p2) jump 1b;\n" \" %1 = #0;\n" \"3:\n" \".section .fixup,\"ax\"\n" \
@@ -84,10 +84,10 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, u32 oldval,"1: %1 = memw_locked(%3)\n" " {\n" " p2 = cmp.eq(%1,%4)\n" -" if !p2.new jump:NT 3f\n" +" if (!p2.new) jump:NT 3f\n" " }\n" "2: memw_locked(%3,p2) = %5\n" -" if !p2 jump 1b\n" +" if (!p2) jump 1b\n" "3:\n" ".section .fixup,\"ax\"\n" "4: %0 = #%6\n"
arch/hexagon/include/asm/spinlock.h +10 -10
@@ -30,9 +30,9 @@ static inline void arch_read_lock(arch_rwlock_t *lock) __asm__ __volatile__("1: R6 = memw_locked(%0);\n" " { P3 = cmp.ge(R6,#0); R6 = add(R6,#1);}\n" -" { if !P3 jump 1b; }\n" +" { if (!P3) jump 1b; }\n" " memw_locked(%0,P3) = R6;\n" -" { if !P3 jump 1b; }\n" +" { if (!P3) jump 1b; }\n" : :"r" (&lock->lock) : "memory", "r6", "p3"
@@ -46,7 +46,7 @@ static inline void arch_read_unlock(arch_rwlock_t *lock) "1: R6 = memw_locked(%0);\n" " R6 = add(R6,#-1);\n" " memw_locked(%0,P3) = R6\n" - " if !P3 jump 1b;\n" + " if (!P3) jump 1b;\n" : : "r" (&lock->lock) : "memory", "r6", "p3"
@@ -61,7 +61,7 @@ static inline int arch_read_trylock(arch_rwlock_t *lock) __asm__ __volatile__(" R6 = memw_locked(%1);\n" " { %0 = #0; P3 = cmp.ge(R6,#0); R6 = add(R6,#1);}\n" -" { if !P3 jump 1f; }\n" +" { if (!P3) jump 1f; }\n" " memw_locked(%1,P3) = R6;\n" " { %0 = P3 }\n" "1:\n"
@@ -78,9 +78,9 @@ static inline void arch_write_lock(arch_rwlock_t *lock) __asm__ __volatile__("1: R6 = memw_locked(%0)\n" " { P3 = cmp.eq(R6,#0); R6 = #-1;}\n" -" { if !P3 jump 1b; }\n" +" { if (!P3) jump 1b; }\n" " memw_locked(%0,P3) = R6;\n" -" { if !P3 jump 1b; }\n" +" { if (!P3) jump 1b; }\n" : :"r" (&lock->lock) : "memory", "r6", "p3"
@@ -94,7 +94,7 @@ static inline int arch_write_trylock(arch_rwlock_t *lock) __asm__ __volatile__(" R6 = memw_locked(%1)\n" " { %0 = #0; P3 = cmp.eq(R6,#0); R6 = #-1;}\n" -" { if !P3 jump 1f; }\n" +" { if (!P3) jump 1f; }\n" " memw_locked(%1,P3) = R6;\n" " %0 = P3;\n" "1:\n"
@@ -117,9 +117,9 @@ static inline void arch_spin_lock(arch_spinlock_t *lock) __asm__ __volatile__("1: R6 = memw_locked(%0);\n" " P3 = cmp.eq(R6,#0);\n" -" { if !P3 jump 1b; R6 = #1; }\n" +" { if (!P3) jump 1b; R6 = #1; }\n" " memw_locked(%0,P3) = R6;\n" -" { if !P3 jump 1b; }\n" +" { if (!P3) jump 1b; }\n" : :"r" (&lock->lock) : "memory", "r6", "p3"
@@ -139,7 +139,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock) __asm__ __volatile__(" R6 = memw_locked(%1);\n" " P3 = cmp.eq(R6,#0);\n" -" { if !P3 jump 1f; R6 = #1; %0 = #0; }\n" +" { if (!P3) jump 1f; R6 = #1; %0 = #0; }\n" " memw_locked(%1,P3) = R6;\n" " %0 = P3;\n" "1:\n"
arch/hexagon/kernel/vm_entry.S +1 -1
@@ -369,7 +369,7 @@ ret_from_fork: R26.L = #LO(do_work_pending); R0 = #VM_INT_DISABLE; } - if P0 jump check_work_pending + if (P0) jump check_work_pending { R0 = R25; callr R24
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 202/203 hexagon: work around compiler crash
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
[ Upstream commit 63e80314ab7cf4783526d2e44ee57a90514911c9 ]
Clang cannot translate the string "r30" into a valid register yet.
--- arch/hexagon/kernel/stacktrace.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/hexagon/kernel/stacktrace.c +1 -3
@@ -11,8 +11,6 @@#include <linux/thread_info.h> #include <linux/module.h> -registerunsigned long current_frame_pointer asm("r30" ); -struct stackframe {unsigned long fp;unsigned long rets;
@@ -30,7 +28,7 @@ void save_stack_trace(struct stack_trace *trace) low = (unsigned long )task_stack_page (current); high = low +THREAD_SIZE ; - fp = current_frame_pointer; + fp = (unsigned long )__builtin_frame_address (0 );while (fp >= low && fp <= (high -sizeof (*frame))) { frame = (struct stackframe *)fp;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 203/203 ocfs2: call journal flush to mark journal as empty after journal recovery when mount
In reply to Greg Kroah-HartmanFrom: Kai Li <[email protected]>
[ Upstream commit 397eac17f86f404f5ba31d8c3e39ec3124b39fd3 ]
If journal is dirty when mount, it will be replayed but jbd2 sb log tail cannot be updated to mark a new start because journal->j_flag has already been set with JBD2_ABORT first in journal_init_common.
When a new transaction is committed, it will be recored in block 1 first(journal->j_tail is set to 1 in journal_reset). If emergency restart happens again before journal super block is updated unfortunately, the new recorded trans will not be replayed in the next mount.
The following steps describe this procedure in detail.
1. mount and touch some files
2. these transactions are committed to journal area but not checkpointed
3. emergency restart
4. mount again and its journals are replayed
5. journal super block's first s_start is 1, but its s_seq is not updated
6. touch a new file and its trans is committed but not checkpointed
7. emergency restart again
8. mount and journal is dirty, but trans committed in 6 will not be replayed.
This exception happens easily when this lun is used by only one node. If it is used by multi-nodes, other node will replay its journal and its journal super block will be updated after recovery like what this patch does.
ocfs2_recover_node->ocfs2_replay_journal.
The following jbd2 journal can be generated by touching a new file after journal is replayed, and seq 15 is the first valid commit, but first seq is 13 in journal super block.
logdump:
Block 0: Journal Superblock
Seq: 0 Type: 4 (JBD2_SUPERBLOCK_V2)
Blocksize: 4096 Total Blocks: 32768 First Block: 1
First Commit ID: 13 Start Log Blknum: 1
Error: 0
Feature Compat: 0
Feature Incompat: 2 block64
Feature RO compat: 0
Journal UUID: 4ED3822C54294467A4F8E87D2BA4BC36
FS Share Cnt: 1 Dynamic Superblk Blknum: 0
Per Txn Block Limit Journal: 0 Data: 0
Block 1: Journal Commit Block
Seq: 14 Type: 2 (JBD2_COMMIT_BLOCK)
Block 2: Journal Descriptor
Seq: 15 Type: 1 (JBD2_DESCRIPTOR_BLOCK)
No. Blocknum Flags
0. 587 none
UUID: 00000000000000000000000000000000
1. 8257792 JBD2_FLAG_SAME_UUID 2. 619 JBD2_FLAG_SAME_UUID 3. 24772864 JBD2_FLAG_SAME_UUID 4. 8257802 JBD2_FLAG_SAME_UUID 5. 513 JBD2_FLAG_SAME_UUID JBD2_FLAG_LAST_TAG ... Block 7: Inode Inode: 8257802 Mode: 0640 Generation: 57157641 (0x3682809) FS Generation: 2839773110 (0xa9437fb6) CRC32: 00000000 ECC: 0000 Type: Regular Attr: 0x0 Flags: Valid Dynamic Features: (0x1) InlineData User: 0 (root) Group: 0 (root) Size: 7 Links: 1 Clusters: 0 ctime: 0x5de5d870 0x11104c61 -- Tue Dec 3 11:37:20.286280801 2019 atime: 0x5de5d870 0x113181a1 -- Tue Dec 3 11:37:20.288457121 2019 mtime: 0x5de5d870 0x11104c61 -- Tue Dec 3 11:37:20.286280801 2019
dtime: 0x0 -- Thu Jan 1 08:00:00 1970
...
Block 9: Journal Commit Block
Seq: 15 Type: 2 (JBD2_COMMIT_BLOCK)
The following is journal recovery log when recovering the upper jbd2 journal when mount again.
syslog:
ocfs2: File system on device (252,1) was not unmounted cleanly, recovering it. fs/jbd2/recovery.c:(do_one_pass, 449): Starting recovery pass 0 fs/jbd2/recovery.c:(do_one_pass, 449): Starting recovery pass 1 fs/jbd2/recovery.c:(do_one_pass, 449): Starting recovery pass 2 fs/jbd2/recovery.c:(jbd2_journal_recover, 278): JBD2: recovery, exit status 0, recovered transactions 13 to 13
Due to first commit seq 13 recorded in journal super is not consistent with the value recorded in block 1(seq is 14), journal recovery will be terminated before seq 15 even though it is an unbroken commit, inode 8257802 is a new file and it will be lost.
--- fs/ocfs2/journal.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ocfs2/journal.c +8 -0
@@ -1066,6 +1066,14 @@ int ocfs2_journal_load(struct ocfs2_journal *journal, int local, int replayed)ocfs2_clear_journal_error (osb->sb, journal->j_journal, osb->slot_num); +if (replayed) { +jbd2_journal_lock_updates (journal->j_journal); + status =jbd2_journal_flush (journal->j_journal); +jbd2_journal_unlock_updates (journal->j_journal); +if (status <0 ) +mlog_errno (status); + } + status =ocfs2_journal_toggle_dirty (osb,1 , replayed);if (status <0 ) {mlog_errno (status);
Signature · 1 line
2.20.1
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v5.4:
13 builds: 13 pass, 0 fail
22 boots: 22 pass, 0 fail
38 tests: 38 pass, 0 failLinux version: 5.4.13-rc1-g3c8b6cdc962e
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Cheers
Jon
Signature · 1 line
nvpublic
Greg Kroah-Hartman
maintainerQuoted 23 lines · Jon Hunter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v5.4:
Quoted 9 lines
13 builds: 13 pass, 0 fail 22 boots: 22 pass, 0 fail 38 tests: 38 pass, 0 failLinux version: 5.4.13-rc1-g3c8b6cdc962e
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,tegra194-p2972-0000, tegra20-ventana, tegra210-p2371-2180, tegra30-cardhu-a04
Wonderful, thanks for testing these and letting me know.
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 5.4.13-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.4.y
git commit: 3c8b6cdc962e6e3a21ee5786133fdab225fa26b9
git describe: v5.4.12-204-g3c8b6cdc962e
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.4-oe/build/v5.4.12-204-g3c8b6cdc962e
No regressions (compared to build v5.4.12)
No fixes (compared to build v5.4.12)
Ran 23712 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15
- x86
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* kselftest
* ltp-hugetlb-tests
* ltp-mm-tests
* ltp-open-posix-tests
* kvm-unit-tests
* ssuite
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 17 lines · Naresh Kamboju
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 3 lines
thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm,x86_64, and i386.
Thanks for testing all of these and letting me know.
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
Build results:
total: 158 pass: 158 fail: 0 Qemu test results: total: 389 pass: 389 fail: 0
Guenter
Greg Kroah-Hartman
maintainerQuoted 6 lines · Guenter Roeck
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Quoted 3 lines
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
Build results:
total: 158 pass: 158 fail: 0 Qemu test results: total: 389 pass: 389 fail: 0
Great, thanks for testing all of these and letting me know.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 15 lines · shuah
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 4 lines
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all of these and letting me know.
greg k-h
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.13 release. There are 203 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines
Responses should be made by Sat, 18 Jan 2020 23:16:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.13-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.
hello,
compiled and booted 5.4.13-rc1+ . No regressions according to "sudo dmesg -l err"
--
software engineer
rajagiri school of engineering and technology