4.9.220-rc1 review
Greg Kroah-Hartman
maintainercover 4.9.220-rc1 review
This is the start of the stable review cycle for the 4.9.220 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 24 Apr 2020 09:48:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.220-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.220-rc1
Samuel Neves <[email protected]>
x86/vdso: Fix lsl operand order
Evalds Iodzevics <[email protected]>
x86/microcode/intel: replace sync_core() with native_cpuid_reg(eax)
Borislav Petkov <[email protected]>
x86/CPU: Add native CPUID variants returning a single datum
Wen Yang <[email protected]>
mtd: phram: fix a double free issue in error path
Dan Carpenter <[email protected]>
mtd: lpddr: Fix a double free in probe()
Paul E. McKenney <[email protected]>
locktorture: Print ratio of acquisitions, not failures
Stephen Rothwell <[email protected]>
tty: evh_bytechan: Fix out of bounds accesses
Dan Carpenter <[email protected]>
fbdev: potential information leak in do_fb_ioctl()
Adrian Huang <[email protected]>
iommu/amd: Fix the configuration of GCR3 table root pointer
Dan Carpenter <[email protected]>
libnvdimm: Out of bounds read in __nd_ioctl()
Jan Kara <[email protected]>
ext2: fix debug reference to ext2_xattr_cache
Randy Dunlap <[email protected]>
ext2: fix empty body warnings when -Wextra is used
Trond Myklebust <[email protected]>
NFS: Fix memory leaks in nfs_pageio_stop_mirroring()
David Hildenbrand <[email protected]>
KVM: s390: vsie: Fix possible race when shadowing region 3 tables
Vegard Nossum <[email protected]>
compiler.h: fix error in BUILD_BUG_ON() reporting
Qian Cai <[email protected]>
percpu_counter: fix a data race at vm_committed_as
Eric Sandeen <[email protected]>
ext4: do not commit super on read-only bdev
Nathan Chancellor <[email protected]>
powerpc/maple: Fix declaration made after definition
Alexander Gordeev <[email protected]>
s390/cpuinfo: fix wrong output when CPU0 is offline
Misono Tomohiro <[email protected]>
NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails
Sowjanya Komatineni <[email protected]>
clk: tegra: Fix Tegra PMC clock out parents
Dmitry Osipenko <[email protected]>
power: supply: bq27xxx_battery: Silence deferred-probe error
Claudiu Beznea <[email protected]>
clk: at91: usb: continue if clk_hw_round_rate() return zero
Frank Rowand <[email protected]>
of: unittest: kmemleak in of_unittest_platform_populate()
Arnd Bergmann <[email protected]>
arm64: cpu_errata: include required headers
Rob Herring <[email protected]>
of: fix missing kobject init for !SYSFS && OF_DYNAMIC config
Chris Lew <[email protected]>
soc: qcom: smem: Use le32_to_cpu for comparison
Lior David <[email protected]>
wil6210: fix length check in __wmi_send
Mohit Aggarwal <[email protected]>
rtc: pm8xxx: Fix issue in RTC write path
Dedy Lansky <[email protected]>
wil6210: rate limit wil_rx_refill error
Subhash Jadavani <[email protected]>
scsi: ufs: ufs-qcom: remove broken hci version quirk
Venkat Gopalakrishnan <[email protected]>
scsi: ufs: make sure all interrupts are processed
Dedy Lansky <[email protected]>
wil6210: fix temperature debugfs
Hamad Kadmany <[email protected]>
wil6210: increase firmware ready timeout
Timur Tabi <[email protected]>
Revert "gpio: set up initial state from .get_direction()"
Joe Moriarty <[email protected]>
drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem
Nathan Chancellor <[email protected]>
video: fbdev: sis: Remove unnecessary parentheses and commented code
Frank Rowand <[email protected]>
of: unittest: kmemleak on changeset destroy
Takashi Iwai <[email protected]>
ALSA: hda: Don't release card at firmware loading error
Li Bin <[email protected]>
scsi: sg: add sg_remove_request in sg_common_write
Josh Poimboeuf <[email protected]>
objtool: Fix switch table detection in .text.unlikely
Xiao Yang <[email protected]>
tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation
Maurizio Lombardi <[email protected]>
scsi: target: fix hang when multiple threads try to destroy the same iscsi session
Maurizio Lombardi <[email protected]>
scsi: target: remove boilerplate code
Jim Mattson <[email protected]>
kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD
Goldwyn Rodrigues <[email protected]>
dm flakey: check for null arg_name in parse_features()
Jan Kara <[email protected]>
ext4: do not zeroout extents beyond i_disksize
Tuomas Tynkkynen <[email protected]>
mac80211_hwsim: Use kstrndup() in place of kasprintf()
Josef Bacik <[email protected]>
btrfs: check commit root generation in should_ignore_root
Takashi Iwai <[email protected]>
ALSA: usb-audio: Don't override ignore_ctl_error value from the map
Colin Ian King <[email protected]>
ASoC: Intel: mrfld: return error codes when an error occurs
Colin Ian King <[email protected]>
ASoC: Intel: mrfld: fix incorrect check on p->sink
Josh Triplett <[email protected]>
ext4: fix incorrect inodes per group in error message
Josh Triplett <[email protected]>
ext4: fix incorrect group count in ext4_fill_super error message
zhangyi (F) <[email protected]>
jbd2: improve comments about freeing data buffers whose page mapping is NULL
Can Guo <[email protected]>
scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic
Tim Stallard <[email protected]>
net: ipv6: do not consider routes via gateways for anycast address check
Wang Wenhu <[email protected]>
net: qrtr: send msgs from local of same id as broadcast
Taras Chornyi <[email protected]>
net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
Taehee Yoo <[email protected]>
hsr: check protocol version in hsr_newlink()
Andy Shevchenko <[email protected]>
mfd: dln2: Fix sanity checking for endpoints
Nathan Chancellor <[email protected]>
misc: echo: Remove unnecessary parentheses and simplify check for zero
Laurentiu Tudor <[email protected]>
powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
Wen Yang <[email protected]>
ipmi: fix hung processes in __get_guid()
Chris Wilson <[email protected]>
drm: Remove PageReserved manipulation from drm_pci_alloc
Lyude Paul <[email protected]>
drm/dp_mst: Fix clearing payload state on topology disable
Filipe Manana <[email protected]>
Btrfs: fix crash during unmount due to race with delayed inode workers
Michael Ellerman <[email protected]>
powerpc/64/tm: Don't let userspace set regs->trap via sigreturn
Kai-Heng Feng <[email protected]>
libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
Simon Gander <[email protected]>
hfsplus: fix crash and filesystem corruption when deleting files
Oliver O'Halloran <[email protected]>
cpufreq: powernv: Fix use-after-free
Eric Biggers <[email protected]>
kmod: make request_module() return an error when autoloading is disabled
Hans de Goede <[email protected]>
Input: i8042 - add Acer Aspire 5738z to nomux list
Michael Mueller <[email protected]>
s390/diag: fix display of diagnose call statistics
Changwei Ge <[email protected]>
ocfs2: no need try to truncate file beyond i_size
Qian Cai <[email protected]>
ext4: fix a data race at inode->i_blocks
Nathan Chancellor <[email protected]>
rtc: omap: Use define directive for PIN_CONFIG_ACTIVE_HIGH
Fredrik Strupe <[email protected]>
arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
Steffen Maier <[email protected]>
scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
Shetty, Harshini X (EXT-Sony Mobile) <[email protected]>
dm verity fec: fix memory leak in verity_fec_dtr
Alexander Duyck <[email protected]>
mm: Use fixed constant in page_frag_alloc instead of size + 1
Anssi Hannula <[email protected]>
tools: gpio: Fix out-of-tree build regression
Zhenzhong Duan <[email protected]>
x86/speculation: Remove redundant arch_smt_update() invocation
Takashi Iwai <[email protected]>
ALSA: hda: Initialize power_state field properly
Rosioru Dragos <[email protected]>
crypto: mxs-dcp - fix scatterlist linearization for hash
Josef Bacik <[email protected]>
btrfs: drop block from cache on error in relocation
Vitaly Kuznetsov <[email protected]>
KVM: VMX: fix crash cleanup when KVM wasn't used
Sean Christopherson <[email protected]>
KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
Sean Christopherson <[email protected]>
KVM: x86: Allocate new rmap and large page tracking when moving memslot
David Hildenbrand <[email protected]>
KVM: s390: vsie: Fix delivery of addressing exceptions
David Hildenbrand <[email protected]>
KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
Thomas Gleixner <[email protected]>
x86/entry/32: Add missing ASM_CLAC to general_protection entry
Eric W. Biederman <[email protected]>
signal: Extend exec_id to 64bits
Remi Pommarel <[email protected]>
ath9k: Handle txpower changes even when TPC is disabled
Gustavo A. R. Silva <[email protected]>
MIPS: OCTEON: irq: Fix potential NULL pointer dereference
Sungbo Eo <[email protected]>
irqchip/versatile-fpga: Apply clear-mask earlier
Yang Xu <[email protected]>
KEYS: reaching the keys quotas correctly
Martin Blumenstingl <[email protected]>
thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
Jan Engelhardt <[email protected]>
acpi/x86: ignore unspecified bit positions in the ACPI global lock field
Benoit Parrot <[email protected]>
media: ti-vpe: cal: fix disable_irqs to only the intended target
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Fix regression by buffer overflow fix
Takashi Iwai <[email protected]>
ALSA: ice1724: Fix invalid access for enumerated ctl items
Takashi Iwai <[email protected]>
ALSA: hda: Fix potential access overflow in beep helper
Takashi Iwai <[email protected]>
ALSA: hda: Add driver blacklist
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add mixer workaround for TRX40 and co
Thinh Nguyen <[email protected]>
usb: gadget: composite: Inform controller driver of self-powered
Sriharsha Allenki <[email protected]>
usb: gadget: f_fs: Fix use after free issue as part of queue failure
이경택 <[email protected]>
ASoC: topology: use name_prefix for new kcontrol
이경택 <[email protected]>
ASoC: dpcm: allow start or stop during pause for backend
이경택 <[email protected]>
ASoC: dapm: connect virtual mux with default value
이경택 <[email protected]>
ASoC: fix regwmask
YueHaibing <[email protected]>
misc: rtsx: set correct pcr_ops for rts522A
Josef Bacik <[email protected]>
btrfs: track reloc roots based on their commit root bytenr
Josef Bacik <[email protected]>
btrfs: remove a BUG_ON() from merge_reloc_roots()
Boqun Feng <[email protected]>
locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
Arvind Sankar <[email protected]>
x86/boot: Use unsigned comparison for addresses
Bob Peterson <[email protected]>
gfs2: Don't demote a glock until its revokes are written
John Garry <[email protected]>
libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
Andy Lutomirski <[email protected]>
selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
Michael Wang <[email protected]>
sched: Avoid scale real weight down to zero
Sungbo Eo <[email protected]>
irqchip/versatile-fpga: Handle chained IRQs properly
Alain Volmat <[email protected]>
i2c: st: fix missing struct parameter description
Xu Wang <[email protected]>
qlcnic: Fix bad kzalloc null test
Zheng Wei <[email protected]>
net: vxge: fix wrong __VA_ARGS__ usage
Ondrej Jirman <[email protected]>
bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
-------------
Diffstat:
Makefile | 4 +- arch/arm64/kernel/armv8_deprecated.c | 2 +- arch/arm64/kernel/cpu_errata.c | 2 + arch/mips/cavium-octeon/octeon-irq.c | 3 + arch/powerpc/kernel/signal_64.c | 4 +- arch/powerpc/mm/tlb_nohash_low.S | 12 +++- arch/powerpc/platforms/maple/setup.c | 34 +++++----- arch/s390/kernel/diag.c | 2 +- arch/s390/kernel/processor.c | 5 +- arch/s390/kvm/vsie.c | 1 + arch/s390/mm/gmap.c | 7 +- arch/x86/boot/compressed/head_32.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 +- arch/x86/entry/entry_32.S | 1 + arch/x86/include/asm/microcode_intel.h | 2 +- arch/x86/include/asm/processor.h | 18 +++++ arch/x86/include/asm/vgtod.h | 2 +- arch/x86/kernel/acpi/boot.c | 2 +- arch/x86/kvm/cpuid.c | 3 +- arch/x86/kvm/vmx.c | 79 +++++++--------------- arch/x86/kvm/x86.c | 11 +++ drivers/ata/libata-pmp.c | 1 + drivers/ata/libata-scsi.c | 9 +-- drivers/bus/sunxi-rsb.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/clk/at91/clk-usb.c | 3 + drivers/clk/tegra/clk-tegra-pmc.c | 12 ++-- drivers/cpufreq/powernv-cpufreq.c | 6 ++ drivers/crypto/mxs-dcp.c | 58 ++++++++-------- drivers/gpio/gpiolib.c | 31 ++------- drivers/gpu/drm/drm_dp_mst_topology.c | 15 ++-- drivers/gpu/drm/drm_pci.c | 25 +------ drivers/i2c/busses/i2c-st.c | 1 + drivers/input/serio/i8042-x86ia64io.h | 11 +++ drivers/iommu/amd_iommu_types.h | 2 +- drivers/irqchip/irq-versatile-fpga.c | 18 +++-- drivers/md/dm-flakey.c | 5 ++ drivers/md/dm-verity-fec.c | 1 + drivers/media/platform/ti-vpe/cal.c | 16 ++--- drivers/mfd/dln2.c | 9 ++- drivers/mfd/rts5227.c | 1 + drivers/misc/echo/echo.c | 2 +- drivers/mtd/devices/phram.c | 15 ++-- drivers/mtd/lpddr/lpddr_cmds.c | 1 - drivers/net/ethernet/neterion/vxge/vxge-config.h | 2 +- drivers/net/ethernet/neterion/vxge/vxge-main.h | 14 ++-- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 3 + drivers/net/wireless/ath/wil6210/debugfs.c | 7 +- drivers/net/wireless/ath/wil6210/interrupt.c | 22 +++++- drivers/net/wireless/ath/wil6210/main.c | 2 +- drivers/net/wireless/ath/wil6210/txrx.c | 4 +- drivers/net/wireless/ath/wil6210/wmi.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 12 ++-- drivers/nvdimm/bus.c | 6 +- drivers/of/base.c | 3 - drivers/of/unittest.c | 11 ++- drivers/power/supply/bq27xxx_battery.c | 5 +- drivers/rtc/rtc-omap.c | 4 +- drivers/rtc/rtc-pm8xxx.c | 49 +++++++++++--- drivers/s390/scsi/zfcp_erp.c | 2 +- drivers/scsi/sg.c | 4 +- drivers/scsi/ufs/ufs-qcom.c | 2 +- drivers/scsi/ufs/ufshcd.c | 32 ++++++--- drivers/soc/qcom/smem.c | 2 +- drivers/target/iscsi/iscsi_target.c | 79 +++++++--------------- drivers/target/iscsi/iscsi_target.h | 1 - drivers/target/iscsi/iscsi_target_configfs.c | 5 +- drivers/target/iscsi/iscsi_target_login.c | 5 +- drivers/tty/ehv_bytechan.c | 21 +++++- drivers/usb/gadget/composite.c | 9 +++ drivers/usb/gadget/function/f_fs.c | 1 + drivers/video/fbdev/core/fbmem.c | 2 +- drivers/video/fbdev/sis/init301.c | 4 +- fs/btrfs/async-thread.c | 8 +++ fs/btrfs/async-thread.h | 2 + fs/btrfs/disk-io.c | 13 ++++ fs/btrfs/relocation.c | 39 +++++++---- fs/exec.c | 2 +- fs/ext2/xattr.c | 8 +-- fs/ext4/extents.c | 8 +-- fs/ext4/inode.c | 2 +- fs/ext4/super.c | 9 +-- fs/gfs2/glock.c | 3 + fs/hfsplus/attributes.c | 4 ++ fs/jbd2/commit.c | 7 +- fs/nfs/direct.c | 2 + fs/nfs/pagelist.c | 17 +++-- fs/ocfs2/alloc.c | 4 ++ include/linux/compiler.h | 2 +- include/linux/devfreq_cooling.h | 2 +- include/linux/percpu_counter.h | 4 +- include/linux/sched.h | 4 +- include/net/ip6_route.h | 1 + include/target/iscsi/iscsi_target_core.h | 2 +- kernel/cpu.c | 5 +- kernel/kmod.c | 4 +- kernel/locking/lockdep.c | 4 ++ kernel/locking/locktorture.c | 8 +-- kernel/sched/sched.h | 8 ++- kernel/signal.c | 2 +- kernel/trace/trace_events_trigger.c | 10 +-- mm/page_alloc.c | 8 +-- net/hsr/hsr_netlink.c | 9 ++- net/ipv4/devinet.c | 13 ++-- net/qrtr/qrtr.c | 7 +- security/keys/key.c | 2 +- security/keys/keyctl.c | 4 +- sound/core/oss/pcm_plugin.c | 32 ++++++--- sound/pci/hda/hda_beep.c | 6 +- sound/pci/hda/hda_codec.c | 1 + sound/pci/hda/hda_intel.c | 35 ++++++---- sound/pci/ice1712/prodigy_hifi.c | 4 +- sound/soc/intel/atom/sst-atom-controls.c | 2 +- sound/soc/intel/atom/sst/sst_pci.c | 2 +- sound/soc/soc-dapm.c | 8 ++- sound/soc/soc-ops.c | 4 +- sound/soc/soc-pcm.c | 6 +- sound/soc/soc-topology.c | 2 +- sound/usb/mixer.c | 2 +- sound/usb/mixer_maps.c | 28 ++++++++ tools/gpio/Makefile | 2 +- tools/objtool/check.c | 5 +- tools/testing/selftests/x86/ptrace_syscall.c | 8 ++- 124 files changed, 685 insertions(+), 454 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/125 bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
From: Ondrej Jirman <[email protected]>
[ Upstream commit a43ab30dcd4a1abcdd0d2461bf1cf7c0817f6cd3 ]
When doing a 16-bit read that returns data in the MSB byte, the RSB_DATA register will keep the MSB byte unchanged when doing the following 8-bit read. sunxi_rsb_read() will then return a result that contains high byte from 16-bit read mixed with the 8-bit result.
The consequence is that after this happens the PMIC's regmap will look like this: (0x33 is the high byte from the 16-bit read)
% cat /sys/kernel/debug/regmap/sunxi-rsb-3a3/registers 00: 33
01: 33
02: 33
03: 33
04: 33
05: 33
06: 33
07: 33
08: 33
09: 33
0a: 33
0b: 33
0c: 33
0d: 33
0e: 33
[snip]
Fix this by masking the result of the read with the correct mask based on the size of the read. There are no 16-bit users in the mainline kernel, so this doesn't need to get into the stable tree.
--- drivers/bus/sunxi-rsb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bus/sunxi-rsb.c +1 -1
@@ -345,7 +345,7 @@ static int sunxi_rsb_read(struct sunxi_rsb *rsb, u8 rtaddr, u8 addr,if (ret) goto unlock; - *buf =readl (rsb->regs +RSB_DATA ); + *buf =readl (rsb->regs +RSB_DATA ) &GENMASK (len *8 -1 ,0 ); unlock:mutex_unlock (&rsb->lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/125 net: vxge: fix wrong __VA_ARGS__ usage
In reply to Greg Kroah-HartmanFrom: Zheng Wei <[email protected]>
[ Upstream commit b317538c47943f9903860d83cc0060409e12d2ff ]
printk in macro vxge_debug_ll uses __VA_ARGS__ without "##" prefix, it causes a build error when there is no variable arguments(e.g. only fmt is specified.).
--- drivers/net/ethernet/neterion/vxge/vxge-config.h | 2 +- drivers/net/ethernet/neterion/vxge/vxge-main.h | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/neterion/vxge/vxge-config.h +1 -1
@@ -2065,7 +2065,7 @@ vxge_hw_vpath_strip_fcs_check(struct __vxge_hw_device *hldev, u64 vpath_mask);if ((level >=VXGE_ERR &&VXGE_COMPONENT_LL &VXGE_DEBUG_ERR_MASK ) || \ (level >=VXGE_TRACE &&VXGE_COMPONENT_LL &VXGE_DEBUG_TRACE_MASK ))\if ((mask &VXGE_DEBUG_MASK ) == mask) \ -printk (fmt"\n" , __VA_ARGS__); \ + printk(fmt "\n", ##__VA_ARGS__); \ } while (0) #else#define vxge_debug_ll (level, mask, fmt, ...)
drivers/net/ethernet/neterion/vxge/vxge-main.h +7 -7
@@ -454,49 +454,49 @@ int vxge_fw_upgrade(struct vxgedev *vdev, char *fw_name, int override);#if (VXGE_DEBUG_LL_CONFIG &VXGE_DEBUG_MASK )#define vxge_debug_ll_config (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_LL_CONFIG, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_LL_CONFIG, fmt, ##__VA_ARGS__)#else #define vxge_debug_ll_config (level, fmt, ...)#endif #if (VXGE_DEBUG_INIT &VXGE_DEBUG_MASK )#define vxge_debug_init (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_INIT, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_INIT, fmt, ##__VA_ARGS__)#else #define vxge_debug_init (level, fmt, ...)#endif #if (VXGE_DEBUG_TX &VXGE_DEBUG_MASK )#define vxge_debug_tx (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_TX, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_TX, fmt, ##__VA_ARGS__)#else #define vxge_debug_tx (level, fmt, ...)#endif #if (VXGE_DEBUG_RX &VXGE_DEBUG_MASK )#define vxge_debug_rx (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_RX, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_RX, fmt, ##__VA_ARGS__)#else #define vxge_debug_rx (level, fmt, ...)#endif #if (VXGE_DEBUG_MEM &VXGE_DEBUG_MASK )#define vxge_debug_mem (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_MEM, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_MEM, fmt, ##__VA_ARGS__)#else #define vxge_debug_mem (level, fmt, ...)#endif #if (VXGE_DEBUG_ENTRYEXIT &VXGE_DEBUG_MASK )#define vxge_debug_entryexit (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_ENTRYEXIT, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_ENTRYEXIT, fmt, ##__VA_ARGS__)#else #define vxge_debug_entryexit (level, fmt, ...)#endif #if (VXGE_DEBUG_INTR &VXGE_DEBUG_MASK )#define vxge_debug_intr (level, fmt, ...) \ - vxge_debug_ll(level, VXGE_DEBUG_INTR, fmt, __VA_ARGS__) + vxge_debug_ll(level, VXGE_DEBUG_INTR, fmt, ##__VA_ARGS__)#else #define vxge_debug_intr (level, fmt, ...)#endif
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/125 qlcnic: Fix bad kzalloc null test
In reply to Greg Kroah-HartmanFrom: Xu Wang <[email protected]>
[ Upstream commit bcaeb886ade124331a6f3a5cef34a3f1484c0a03 ]
In qlcnic_83xx_get_reset_instruction_template, the variable of null test is bad, so correct it.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +1 -1
@@ -1720,7 +1720,7 @@ static int qlcnic_83xx_get_reset_instruction_template(struct qlcnic_adapter *p_d ahw->reset.seq_error =0 ; ahw->reset.buff =kzalloc (QLC_83XX_RESTART_TEMPLATE_SIZE ,GFP_KERNEL ); -if (p_dev->ahw->reset.buff ==NULL ) +if (ahw->reset.buff ==NULL )return -ENOMEM ; p_buff = p_dev->ahw->reset.buff;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/125 i2c: st: fix missing struct parameter description
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
[ Upstream commit f491c6687332920e296d0209e366fe2ca7eab1c6 ]
Fix a missing struct parameter description to allow warning free W=1 compilation.
--- drivers/i2c/busses/i2c-st.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-st.c +1 -0
@@ -437,6 +437,7 @@ static void st_i2c_wr_fill_tx_fifo(struct st_i2c_dev *i2c_dev)/** * st_i2c_rd_fill_tx_fifo() - Fill the Tx FIFO in read mode * @i2c_dev: Controller's private data +* @max: Maximum amount of data to fill into the Tx FIFO * * This functions fills the Tx FIFO with fixed pattern when * in read mode to trigger clock.
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/125 irqchip/versatile-fpga: Handle chained IRQs properly
In reply to Greg Kroah-HartmanFrom: Sungbo Eo <[email protected]>
[ Upstream commit 486562da598c59e9f835b551d7cf19507de2d681 ]
Enclose the chained handler with chained_irq_{enter,exit}(), so that the muxed interrupts get properly acked.
This patch also fixes a reboot bug on OX820 SoC, where the jiffies timer interrupt is never acked. The kernel waits a clock tick forever in calibrate_delay_converge(), which leads to a boot hang.
--- drivers/irqchip/irq-versatile-fpga.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/irqchip/irq-versatile-fpga.c +10 -2
@@ -5,6 +5,7 @@#include <linux/irq.h> #include <linux/io.h> #include <linux/irqchip.h> +#include <linux/irqchip/chained_irq.h> #include <linux/irqchip/versatile-fpga.h> #include <linux/irqdomain.h> #include <linux/module.h>
@@ -67,12 +68,16 @@ static void fpga_irq_unmask(struct irq_data *d)static void fpga_irq_handle (struct irq_desc *desc) { +struct irq_chip *chip =irq_desc_get_chip (desc);struct fpga_irq_data *f =irq_desc_get_handler_data (desc); -u32 status =readl (f->base +IRQ_STATUS ); +u32 status; + +chained_irq_enter (chip, desc); + status =readl (f->base +IRQ_STATUS );if (status ==0 ) {do_bad_IRQ (desc); -return ; + goto out; } do {
@@ -81,6 +86,9 @@ static void fpga_irq_handle(struct irq_desc *desc) status &= ~(1 << irq);generic_handle_irq (irq_find_mapping (f->domain, irq)); }while (status); + +out: +chained_irq_exit (chip, desc); }/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/125 sched: Avoid scale real weight down to zero
In reply to Greg Kroah-HartmanFrom: Michael Wang <[email protected]>
[ Upstream commit 26cf52229efc87e2effa9d788f9b33c40fb3358a ]
During our testing, we found a case that shares no longer working correctly, the cgroup topology is like:
/sys/fs/cgroup/cpu/A (shares=102400)
/sys/fs/cgroup/cpu/A/B (shares=2)
/sys/fs/cgroup/cpu/A/B/C (shares=1024)
/sys/fs/cgroup/cpu/D (shares=1024)
/sys/fs/cgroup/cpu/D/E (shares=1024)
/sys/fs/cgroup/cpu/D/E/F (shares=1024)
The same benchmark is running in group C & F, no other tasks are running, the benchmark is capable to consumed all the CPUs.
We suppose the group C will win more CPU resources since it could enjoy all the shares of group A, but it's F who wins much more.
The reason is because we have group B with shares as 2, since A->cfs_rq.load.weight == B->se.load.weight == B->shares/nr_cpus, so A->cfs_rq.load.weight become very small.
And in calc_group_shares() we calculate shares as:
load = max(scale_load_down(cfs_rq->load.weight), cfs_rq->avg.load_avg); shares = (tg_shares * load) / tg_weight;
Since the 'cfs_rq->load.weight' is too small, the load become 0 after scale down, although 'tg_shares' is 102400, shares of the se which stand for group A on root cfs_rq become 2.
While the se of D on root cfs_rq is far more bigger than 2, so it wins the battle.
Thus when scale_load_down() scale real weight down to 0, it's no longer telling the real story, the caller will have the wrong information and the calculation will be buggy.
This patch add check in scale_load_down(), so the real weight will be >= MIN_SHARES after scale, after applied the group C wins as expected.
--- kernel/sched/sched.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/sched/sched.h +7 -1
@@ -73,7 +73,13 @@ static inline void update_idle_core(struct rq *rq) { }#ifdef CONFIG_64BIT # define NICE_0_LOAD_SHIFT (SCHED_FIXEDPOINT_SHIFT + SCHED_FIXEDPOINT_SHIFT)# define scale_load (w) ((w) << SCHED_FIXEDPOINT_SHIFT) -# define scale_load_down (w) ((w) >> SCHED_FIXEDPOINT_SHIFT) +# define scale_load_down (w) \ +({ \ + unsigned long __w = (w); \ + if (__w) \ + __w = max(2UL, __w >> SCHED_FIXEDPOINT_SHIFT); \ + __w; \ +})#else # define NICE_0_LOAD_SHIFT (SCHED_FIXEDPOINT_SHIFT)# define scale_load (w) (w)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/125 selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
In reply to Greg Kroah-HartmanFrom: Andy Lutomirski <[email protected]>
[ Upstream commit 630b99ab60aa972052a4202a1ff96c7e45eb0054 ]
If AT_SYSINFO is not present, don't try to call a NULL pointer.
--- tools/testing/selftests/x86/ptrace_syscall.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
tools/testing/selftests/x86/ptrace_syscall.c +6 -2
@@ -413,8 +413,12 @@ int main()#if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ >2 || __GLIBC_MINOR__ >=16 ) vsyscall32 = (void *)getauxval (AT_SYSINFO ); -printf ("[RUN]\tCheck AT_SYSINFO return regs\n" ); -test_sys32_regs (do_full_vsyscall32); +if (vsyscall32) { +printf ("[RUN]\tCheck AT_SYSINFO return regs\n" ); +test_sys32_regs (do_full_vsyscall32); + }else { +printf ("[SKIP]\tAT_SYSINFO is not available\n" ); + }#endif test_ptrace_syscall_restart ();
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/125 libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
In reply to Greg Kroah-HartmanFrom: John Garry <[email protected]>
[ Upstream commit 1d72f7aec3595249dbb83291ccac041a2d676c57 ]
If the call to scsi_add_host_with_dma() in ata_scsi_add_hosts() fails, then we may get use-after-free KASAN warns:
==================================================================
BUG: KASAN: use-after-free in kobject_put+0x24/0x180 Read of size 1 at addr ffff0026b8c80364 by task swapper/0/1 CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 5.6.0-rc3-00004-g5a71b206ea82-dirty #1765 Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDD, BIOS 2280-V2 CS V3.B160.01 02/24/2020 Call trace: dump_backtrace+0x0/0x298 show_stack+0x14/0x20 dump_stack+0x118/0x190 print_address_description.isra.9+0x6c/0x3b8 __kasan_report+0x134/0x23c kasan_report+0xc/0x18 __asan_load1+0x5c/0x68 kobject_put+0x24/0x180 put_device+0x10/0x20 scsi_host_put+0x10/0x18 ata_devres_release+0x74/0xb0 release_nodes+0x2d0/0x470 devres_release_all+0x50/0x78 really_probe+0x2d4/0x560 driver_probe_device+0x7c/0x148 device_driver_attach+0x94/0xa0 __driver_attach+0xa8/0x110 bus_for_each_dev+0xe8/0x158 driver_attach+0x30/0x40 bus_add_driver+0x220/0x2e0 driver_register+0xbc/0x1d0 __pci_register_driver+0xbc/0xd0 ahci_pci_driver_init+0x20/0x28 do_one_initcall+0xf0/0x608 kernel_init_freeable+0x31c/0x384 kernel_init+0x10/0x118 ret_from_fork+0x10/0x18 Allocated by task 5: save_stack+0x28/0xc8 __kasan_kmalloc.isra.8+0xbc/0xd8 kasan_kmalloc+0xc/0x18 __kmalloc+0x1a8/0x280 scsi_host_alloc+0x44/0x678 ata_scsi_add_hosts+0x74/0x268 ata_host_register+0x228/0x488 ahci_host_activate+0x1c4/0x2a8 ahci_init_one+0xd18/0x1298 local_pci_probe+0x74/0xf0 work_for_cpu_fn+0x2c/0x48 process_one_work+0x488/0xc08 worker_thread+0x330/0x5d0 kthread+0x1c8/0x1d0 ret_from_fork+0x10/0x18 Freed by task 5: save_stack+0x28/0xc8 __kasan_slab_free+0x118/0x180 kasan_slab_free+0x10/0x18 slab_free_freelist_hook+0xa4/0x1a0 kfree+0xd4/0x3a0 scsi_host_dev_release+0x100/0x148 device_release+0x7c/0xe0 kobject_put+0xb0/0x180 put_device+0x10/0x20 scsi_host_put+0x10/0x18 ata_scsi_add_hosts+0x210/0x268 ata_host_register+0x228/0x488 ahci_host_activate+0x1c4/0x2a8 ahci_init_one+0xd18/0x1298 local_pci_probe+0x74/0xf0 work_for_cpu_fn+0x2c/0x48 process_one_work+0x488/0xc08 worker_thread+0x330/0x5d0 kthread+0x1c8/0x1d0 ret_from_fork+0x10/0x18
There is also refcount issue, as well:
WARNING: CPU: 1 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0xf8/0x170
The issue is that we make an erroneous extra call to scsi_host_put() for that host:
So in ahci_init_one()->ata_host_alloc_pinfo()->ata_host_alloc(), we setup a device release method - ata_devres_release() - which intends to release the SCSI hosts:
static void ata_devres_release(struct device *gendev, void *res)
{
...
for (i = 0; i < host->n_ports; i++) {
struct ata_port *ap = host->ports[i];
if (!ap)
continue;
if (ap->scsi_host)
scsi_host_put(ap->scsi_host);
}
...
}However in the ata_scsi_add_hosts() error path, we also call scsi_host_put() for the SCSI hosts.
Fix by removing the the scsi_host_put() calls in ata_scsi_add_hosts() and leave this to ata_devres_release().
--- drivers/ata/libata-scsi.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/ata/libata-scsi.c +3 -6
@@ -4444,22 +4444,19 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)*/ shost->max_host_blocked =1 ; - rc =scsi_add_host_with_dma (ap->scsi_host, - &ap->tdev, ap->host->dev); + rc =scsi_add_host_with_dma (shost, &ap->tdev, ap->host->dev);if (rc) - goto err_add; + goto err_alloc; }return 0 ; - err_add: -scsi_host_put (host->ports[i]->scsi_host); err_alloc:while (--i >=0 ) {struct Scsi_Host *shost = host->ports[i]->scsi_host; +/* scsi_host_put() is in ata_devres_release() */ scsi_remove_host (shost); -scsi_host_put (shost); }return rc; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 9/125 gfs2: Dont demote a glock until its revokes are written
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit df5db5f9ee112e76b5202fbc331f990a0fc316d6 ]
Before this patch, run_queue would demote glocks based on whether there are any more holders. But if the glock has pending revokes that haven't been written to the media, giving up the glock might end in file system corruption if the revokes never get written due to io errors, node crashes and fences, etc. In that case, another node will replay the metadata blocks associated with the glock, but because the revoke was never written, it could replay that block even though the glock had since been granted to another node who might have made changes.
This patch changes the logic in run_queue so that it never demotes a glock until its count of pending revokes reaches zero.
--- fs/gfs2/glock.c | 3 +++ 1 file changed, 3 insertions(+)
fs/gfs2/glock.c +3 -0
@@ -548,6 +548,9 @@ __acquires(&gl->gl_lockref.lock) goto out_unlock;if (nonblock) goto out_sched; +smp_mb (); +if (atomic_read (&gl->gl_revokes) !=0 ) + goto out_sched;set_bit (GLF_DEMOTE_IN_PROGRESS , &gl->gl_flags);GLOCK_BUG_ON (gl, gl->gl_demote_state ==LM_ST_EXCLUSIVE ); gl->gl_target = gl->gl_demote_state;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 10/125 x86/boot: Use unsigned comparison for addresses
In reply to Greg Kroah-HartmanFrom: Arvind Sankar <[email protected]>
[ Upstream commit 81a34892c2c7c809f9c4e22c5ac936ae673fb9a2 ]
The load address is compared with LOAD_PHYSICAL_ADDR using a signed comparison currently (using jge instruction).
When loading a 64-bit kernel using the new efi32_pe_entry() point added by:
97aa276579b2 ("efi/x86: Add true mixed mode entry point into .compat section")
using Qemu with -m 3072, the firmware actually loads us above 2Gb, resulting in a very early crash.
Use the JAE instruction to perform a unsigned comparison instead, as physical addresses should be considered unsigned.
--- arch/x86/boot/compressed/head_32.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/x86/boot/compressed/head_32.S +1 -1
@@ -170,7 +170,7 @@ preferred_addr: notl %eax andl %eax, %ebx cmpl $LOAD_PHYSICAL_ADDR, %ebx - jge 1f + jae 1f #endif movl $LOAD_PHYSICAL_ADDR, %ebx 1:
arch/x86/boot/compressed/head_64.S +2 -2
@@ -104,7 +104,7 @@ ENTRY(startup_32) notl %eax andl %eax, %ebx cmpl $LOAD_PHYSICAL_ADDR, %ebx - jge 1f + jae 1f #endif movl $LOAD_PHYSICAL_ADDR, %ebx 1:
@@ -339,7 +339,7 @@ preferred_addr: notq %rax andq %rax, %rbp cmpq $LOAD_PHYSICAL_ADDR, %rbp - jge 1f + jae 1f #endif movq $LOAD_PHYSICAL_ADDR, %rbp 1:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 11/125 locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
In reply to Greg Kroah-HartmanFrom: Boqun Feng <[email protected]>
[ Upstream commit 25016bd7f4caf5fc983bbab7403d08e64cba3004 ]
Qian Cai reported a bug when PROVE_RCU_LIST=y, and read on /proc/lockdep triggered a warning:
[ ] DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled)
...
[ ] Call Trace:
[ ] lock_is_held_type+0x5d/0x150 [ ] ? rcu_lockdep_current_cpu_online+0x64/0x80 [ ] rcu_read_lock_any_held+0xac/0x100 [ ] ? rcu_read_lock_held+0xc0/0xc0 [ ] ? __slab_free+0x421/0x540 [ ] ? kasan_kmalloc+0x9/0x10 [ ] ? __kmalloc_node+0x1d7/0x320 [ ] ? kvmalloc_node+0x6f/0x80 [ ] __bfs+0x28a/0x3c0 [ ] ? class_equal+0x30/0x30 [ ] lockdep_count_forward_deps+0x11a/0x1a0
The warning got triggered because lockdep_count_forward_deps() call __bfs() without current->lockdep_recursion being set, as a result a lockdep internal function (__bfs()) is checked by lockdep, which is unexpected, and the inconsistency between the irq-off state and the state traced by lockdep caused the warning.
Apart from this warning, lockdep internal functions like __bfs() should always be protected by current->lockdep_recursion to avoid potential deadlocks and data inconsistency, therefore add the current->lockdep_recursion on-and-off section to protect __bfs() in both lockdep_count_forward_deps() and lockdep_count_backward_deps()
--- kernel/locking/lockdep.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/locking/lockdep.c +4 -0
@@ -1241,9 +1241,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class) this.class = class;raw_local_irq_save (flags); + current->lockdep_recursion =1 ;arch_spin_lock (&lockdep_lock); ret =__lockdep_count_forward_deps (&this);arch_spin_unlock (&lockdep_lock); + current->lockdep_recursion =0 ;raw_local_irq_restore (flags);return ret;
@@ -1268,9 +1270,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class) this.class = class;raw_local_irq_save (flags); + current->lockdep_recursion =1 ;arch_spin_lock (&lockdep_lock); ret =__lockdep_count_backward_deps (&this);arch_spin_unlock (&lockdep_lock); + current->lockdep_recursion =0 ;raw_local_irq_restore (flags);return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 12/125 btrfs: remove a BUG_ON() from merge_reloc_roots()
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 7b7b74315b24dc064bc1c683659061c3d48f8668 ]
This was pretty subtle, we default to reloc roots having 0 root refs, so if we crash in the middle of the relocation they can just be deleted. If we successfully complete the relocation operations we'll set our root refs to 1 in prepare_to_merge() and then go on to merge_reloc_roots().
At prepare_to_merge() time if any of the reloc roots have a 0 reference still, we will remove that reloc root from our reloc root rb tree, and then clean it up later.
However this only happens if we successfully start a transaction. If we've aborted previously we will skip this step completely, and only have reloc roots with a reference count of 0, but were never properly removed from the reloc control's rb tree.
This isn't a problem per-se, our references are held by the list the reloc roots are on, and by the original root the reloc root belongs to. If we end up in this situation all the reloc roots will be added to the dirty_reloc_list, and then properly dropped at that point. The reloc control will be free'd and the rb tree is no longer used.
There were two options when fixing this, one was to remove the BUG_ON(), the other was to make prepare_to_merge() handle the case where we couldn't start a trans handle.
IMO this is the cleaner solution. I started with handling the error in prepare_to_merge(), but it turned out super ugly. And in the end this BUG_ON() simply doesn't matter, the cleanup was happening properly, we were just panicing because this BUG_ON() only matters in the success case. So I've opted to just remove it and add a comment where it was.
--- fs/btrfs/relocation.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
fs/btrfs/relocation.c +15 -1
@@ -2457,7 +2457,21 @@ out:free_reloc_roots (&reloc_roots); } -BUG_ON (!RB_EMPTY_ROOT (&rc->reloc_root_tree.rb_root)); +/* +* We used to have +* +* BUG_ON(!RB_EMPTY_ROOT(&rc->reloc_root_tree.rb_root)); +* +* here, but it's wrong. If we fail to start the transaction in +* prepare_to_merge() we will have only 0 ref reloc roots, none of which +* have actually been removed from the reloc_root_tree rb tree. This is +* fine because we're bailing here, and we hold a reference on the root +* for the list that holds it, so these roots will be cleaned up when we +* do the reloc_dirty_list afterwards. Meanwhile the root->reloc_root +* will be cleaned up on unmount. +* +* The remaining nodes will be cleaned up by free_reloc_control. +*/ }static void free_block_list (struct rb_root *blocks)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 13/125 btrfs: track reloc roots based on their commit root bytenr
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit ea287ab157c2816bf12aad4cece41372f9d146b4 ]
We always search the commit root of the extent tree for looking up back references, however we track the reloc roots based on their current bytenr.
This is wrong, if we commit the transaction between relocating tree blocks we could end up in this code in build_backref_tree
if (key.objectid == key.offset) {
/*
* Only root blocks of reloc trees use backref
* pointing to itself.
*/
root = find_reloc_root(rc, cur->bytenr);
ASSERT(root);
cur->root = root;
break;}
find_reloc_root() is looking based on the bytenr we had in the commit root, but if we've COWed this reloc root we will not find that bytenr, and we will trip over the ASSERT(root).
Fix this by using the commit_root->start bytenr for indexing the commit root. Then we change the __update_reloc_root() caller to be used when we switch the commit root for the reloc root during commit.
This fixes the panic I was seeing when we started throttling relocation for delayed refs.
--- fs/btrfs/relocation.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
fs/btrfs/relocation.c +7 -10
@@ -1296,7 +1296,7 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)if (!node)return -ENOMEM ; - node->bytenr = root->node->start; + node->bytenr = root->commit_root->start; node->data = root;spin_lock (&rc->reloc_root_tree.lock);
@@ -1328,10 +1328,11 @@ static void __del_reloc_root(struct btrfs_root *root)if (rc && root->node) {spin_lock (&rc->reloc_root_tree.lock); rb_node =tree_search (&rc->reloc_root_tree.rb_root, - root->node->start); + root->commit_root->start);if (rb_node) { node = rb_entry(rb_node, struct mapping_node, rb_node);rb_erase (&node->rb_node, &rc->reloc_root_tree.rb_root); +RB_CLEAR_NODE (&node->rb_node); }spin_unlock (&rc->reloc_root_tree.lock);if (!node)
@@ -1349,7 +1350,7 @@ static void __del_reloc_root(struct btrfs_root *root)* helper to update the 'address of tree root -> reloc tree' * mapping */ -static int __update_reloc_root (struct btrfs_root *root,u64 new_bytenr) +static int __update_reloc_root (struct btrfs_root *root) {struct rb_node *rb_node;struct mapping_node *node =NULL ;
@@ -1357,7 +1358,7 @@ static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)spin_lock (&rc->reloc_root_tree.lock); rb_node =tree_search (&rc->reloc_root_tree.rb_root, - root->node->start); + root->commit_root->start);if (rb_node) { node = rb_entry(rb_node, struct mapping_node, rb_node);rb_erase (&node->rb_node, &rc->reloc_root_tree.rb_root);
@@ -1369,7 +1370,7 @@ static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)BUG_ON ((struct btrfs_root *)node->data != root);spin_lock (&rc->reloc_root_tree.lock); - node->bytenr = new_bytenr; + node->bytenr = root->node->start; rb_node =tree_insert (&rc->reloc_root_tree.rb_root, node->bytenr, &node->rb_node);spin_unlock (&rc->reloc_root_tree.lock);
@@ -1519,6 +1520,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans, }if (reloc_root->commit_root != reloc_root->node) { +__update_reloc_root (reloc_root);btrfs_set_root_node (root_item, reloc_root->node);free_extent_buffer (reloc_root->commit_root); reloc_root->commit_root =btrfs_root_node (reloc_root);
@@ -4717,11 +4719,6 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,BUG_ON (rc->stage ==UPDATE_DATA_PTRS && root->root_key.objectid ==BTRFS_DATA_RELOC_TREE_OBJECTID ); -if (root->root_key.objectid ==BTRFS_TREE_RELOC_OBJECTID ) { -if (buf == root->node) -__update_reloc_root (root, cow->start); - } - level =btrfs_header_level (buf);if (btrfs_header_generation (buf) <=btrfs_root_last_snapshot (&root->root_item))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 14/125 misc: rtsx: set correct pcr_ops for rts522A
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
[ Upstream commit 10cea23b6aae15e8324f4101d785687f2c514fe5 ]
rts522a should use rts522a_pcr_ops, which is
diffrent with rts5227 in phy/hw init setting.
--- drivers/mfd/rts5227.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/rts5227.c +1 -0
@@ -369,6 +369,7 @@ static const struct pcr_ops rts522a_pcr_ops = {void rts522a_init_params (struct rtsx_pcr *pcr) {rts5227_init_params (pcr); + pcr->ops = &rts522a_pcr_ops; pcr->reg_pm_ctrl3 =RTS522A_PM_CTRL3 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 15/125 ASoC: fix regwmask
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 0ab070917afdc93670c2d0ea02ab6defb6246a7c upstream.
If regwshift is 32 and the selected architecture compiles '<<' operator for signed int literal into rotating shift, '1<<regwshift' became 1 and it makes regwmask to 0x0.
The literal is set to unsigned long to get intended regwmask.
--- sound/soc/soc-ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/soc-ops.c +2 -2
@@ -837,7 +837,7 @@ int snd_soc_get_xr_sx(struct snd_kcontrounsigned int regbase = mc->regbase;unsigned int regcount = mc->regcount;unsigned int regwshift = component->val_bytes *BITS_PER_BYTE ; -unsigned int regwmask = (1 <<regwshift)-1 ; +unsigned int regwmask = (1UL <<regwshift)-1 ;unsigned int invert = mc->invert;unsigned long mask = (1UL <<mc->nbits)-1 ;long min = mc->min;
@@ -886,7 +886,7 @@ int snd_soc_put_xr_sx(struct snd_kcontrounsigned int regbase = mc->regbase;unsigned int regcount = mc->regcount;unsigned int regwshift = component->val_bytes *BITS_PER_BYTE ; -unsigned int regwmask = (1 <<regwshift)-1 ; +unsigned int regwmask = (1UL <<regwshift)-1 ;unsigned int invert = mc->invert;unsigned long mask = (1UL <<mc->nbits)-1 ;long max = mc->max;
Greg Kroah-Hartman
maintainerPATCH 16/125 ASoC: dapm: connect virtual mux with default value
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 3bbbb7728fc853d71dbce4073fef9f281fbfb4dd upstream.
Since a virtual mixer has no backing registers
to decide which path to connect,
it will try to match with initial state.
This is to ensure that the default mixer choice will be correctly powered up during initialization.
Invert flag is used to select initial state of the virtual switch. Since actual hardware can't be disconnected by virtual switch, connected is better choice as initial state in many cases.
--- sound/soc/soc-dapm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/soc-dapm.c +7 -1
@@ -751,7 +751,13 @@ static void dapm_set_mixer_path_status(s val = max - val; p->connect = !!val; }else { - p->connect =0 ; +/* since a virtual mixer has no backing registers to +* decide which path to connect, it will try to match +* with initial state. This is to ensure +* that the default mixer choice will be +* correctly powered up during initialization. +*/ + p->connect = invert; } }
Greg Kroah-Hartman
maintainerPATCH 17/125 ASoC: dpcm: allow start or stop during pause for backend
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit 21fca8bdbb64df1297e8c65a746c4c9f4a689751 upstream.
soc_compr_trigger_fe() allows start or stop after pause_push. In dpcm_be_dai_trigger(), however, only pause_release is allowed command after pause_push.
So, start or stop after pause in compress offload is always returned as error if the compress offload is used with dpcm. To fix the problem, SND_SOC_DPCM_STATE_PAUSED should be allowed for start or stop command.
--- sound/soc/soc-pcm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/soc-pcm.c +4 -2
@@ -2062,7 +2062,8 @@ int dpcm_be_dai_trigger(struct snd_soc_pswitch (cmd) {case SNDRV_PCM_TRIGGER_START :if ((be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PREPARE ) && - (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP )) + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP ) && + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ))continue ; ret =dpcm_do_trigger (dpcm, be_substream, cmd);
@@ -2092,7 +2093,8 @@ int dpcm_be_dai_trigger(struct snd_soc_p be->dpcm[stream].state =SND_SOC_DPCM_STATE_START ;break ;case SNDRV_PCM_TRIGGER_STOP : -if (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_START ) +if ((be->dpcm[stream].state !=SND_SOC_DPCM_STATE_START ) && + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ))continue ;if (!snd_soc_dpcm_can_be_free_stop (fe, be, stream))
Greg Kroah-Hartman
maintainerPATCH 18/125 ASoC: topology: use name_prefix for new kcontrol
In reply to Greg Kroah-HartmanFrom: 이경택 <[email protected]>
commit abca9e4a04fbe9c6df4d48ca7517e1611812af25 upstream.
Current topology doesn't add prefix of component to new kcontrol.
--- sound/soc/soc-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-topology.c +1 -1
@@ -344,7 +344,7 @@ static int soc_tplg_add_kcontrol(structstruct snd_soc_component *comp = tplg->comp;return soc_tplg_add_dcontrol (comp->card->snd_card, - comp->dev, k,NULL , comp, kcontrol); + comp->dev, k, comp->name_prefix, comp, kcontrol); }/* remove a mixer kcontrol */
Greg Kroah-Hartman
maintainerPATCH 19/125 usb: gadget: f_fs: Fix use after free issue as part of queue failure
In reply to Greg Kroah-HartmanFrom: Sriharsha Allenki <[email protected]>
commit f63ec55ff904b2f2e126884fcad93175f16ab4bb upstream.
In AIO case, the request is freed up if ep_queue fails. However, io_data->req still has the reference to this freed request. In the case of this failure if there is aio_cancel call on this io_data it will lead to an invalid dequeue operation and a potential use after free issue.
Fix this by setting the io_data->req to NULL when the request is freed as part of queue failure.
--- drivers/usb/gadget/function/f_fs.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/function/f_fs.c +1 -0
@@ -1036,6 +1036,7 @@ static ssize_t ffs_epfile_io(struct file ret =usb_ep_queue (ep->ep, req,GFP_ATOMIC );if (unlikely (ret)) { + io_data->req =NULL ;usb_ep_free_request (ep->ep, req); goto error_lock; }
Greg Kroah-Hartman
maintainerPATCH 20/125 usb: gadget: composite: Inform controller driver of self-powered
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
commit 5e5caf4fa8d3039140b4548b6ab23dd17fce9b2c upstream.
Different configuration/condition may draw different power. Inform the controller driver of the change so it can respond properly (e.g. GET_STATUS request). This fixes an issue with setting MaxPower from configfs. The composite driver doesn't check this value when setting self-powered.
--- drivers/usb/gadget/composite.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/gadget/composite.c +9 -0
@@ -842,6 +842,11 @@ static int set_config(struct usb_composielse power =min (power,900U ); done: +if (power <=USB_SELF_POWER_VBUS_MAX_DRAW ) +usb_gadget_set_selfpowered (gadget); +else +usb_gadget_clear_selfpowered (gadget); +usb_gadget_vbus_draw (gadget, power);if (result >=0 && cdev->delayed_status) result =USB_GADGET_DELAYED_STATUS ;
@@ -2273,6 +2278,7 @@ void composite_suspend(struct usb_gadget cdev->suspended =1 ; +usb_gadget_set_selfpowered (gadget);usb_gadget_vbus_draw (gadget,2 ); }
@@ -2301,6 +2307,9 @@ void composite_resume(struct usb_gadgetelse maxpower =min (maxpower,900U ); +if (maxpower >USB_SELF_POWER_VBUS_MAX_DRAW ) +usb_gadget_clear_selfpowered (gadget); +usb_gadget_vbus_draw (gadget, maxpower); }
Greg Kroah-Hartman
maintainerPATCH 21/125 ALSA: usb-audio: Add mixer workaround for TRX40 and co
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 2a48218f8e23d47bd3e23cfdfb8aa9066f7dc3e6 upstream.
Some recent boards (supposedly with a new AMD platform) contain the USB audio class 2 device that is often tied with HD-audio. The device exposes an Input Gain Pad control (id=19, control=12) but this node doesn't behave correctly, returning an error for each inquiry of GET_MIN and GET_MAX that should have been mandatory.
As a workaround, simply ignore this node by adding a usbmix_name_map table entry. The currently known devices are:
* 0414:a002 - Gigabyte TRX40 Aorus Pro WiFi
* 0b05:1916 - ASUS ROG Zenith II
* 0b05:1917 - ASUS ROG Strix
* 0db0:0d64 - MSI TRX40 Creator
* 0db0:543d - MSI TRX40
--- sound/usb/mixer_maps.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
sound/usb/mixer_maps.c +28 -0
@@ -363,6 +363,14 @@ static const struct usbmix_name_map dell { 0 } }; +/* Some mobos shipped with a dummy HD-audio show the invalid GET_MIN/GET_MAX +* response for Input Gain Pad (id=19, control=12). Skip it. +*/ +static const struct usbmix_name_map asus_rog_map[] = { + {19 ,NULL ,12 },/* FU, Input Gain Pad */ + {} +}; +/* * Control map entries */
@@ -482,6 +490,26 @@ static struct usbmix_ctl_map usbmix_ctl_ .id = USB_ID(0x05a7, 0x1020), .map = bose_companion5_map, }, + { /* Gigabyte TRX40 Aorus Pro WiFi */ + .id = USB_ID(0x0414, 0xa002), + .map = asus_rog_map, + }, + { /* ASUS ROG Zenith II */ + .id = USB_ID(0x0b05, 0x1916), + .map = asus_rog_map, + }, + { /* ASUS ROG Strix */ + .id = USB_ID(0x0b05, 0x1917), + .map = asus_rog_map, + }, + { /* MSI TRX40 Creator */ + .id = USB_ID(0x0db0, 0x0d64), + .map = asus_rog_map, + }, + { /* MSI TRX40 */ + .id = USB_ID(0x0db0, 0x543d), + .map = asus_rog_map, + }, { 0 } /* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 22/125 ALSA: hda: Add driver blacklist
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 3c6fd1f07ed03a04debbb9a9d782205f1ef5e2ab upstream.
The recent AMD platform exposes an HD-audio bus but without any actual codecs, which is internally tied with a USB-audio device, supposedly. It results in "no codecs" error of HD-audio bus driver, and it's nothing but a waste of resources.
This patch introduces a static blacklist table for skipping such a known bogus PCI SSID entry. As of writing this patch, the known SSIDs are:
* 1043:874f - ASUS ROG Zenith II / Strix
* 1462:cb59 - MSI TRX40 Creator
* 1462:cb60 - MSI TRX40
--- sound/pci/hda/hda_intel.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
sound/pci/hda/hda_intel.c +16 -0
@@ -1971,6 +1971,17 @@ static const struct hdac_io_ops pci_hda_ .dma_free_pages = dma_free_pages, }; +/* Blacklist for skipping the whole probe: +* some HD-audio PCI entries are exposed without any codecs, and such devices +* should be ignored from the beginning. +*/ +static const struct snd_pci_quirk driver_blacklist[] = { +SND_PCI_QUIRK (0x1043 ,0x874f ,"ASUS ROG Zenith II / Strix" ,0 ), +SND_PCI_QUIRK (0x1462 ,0xcb59 ,"MSI TRX40 Creator" ,0 ), +SND_PCI_QUIRK (0x1462 ,0xcb60 ,"MSI TRX40" ,0 ), + {} +}; +static const struct hda_controller_ops pci_hda_ops = { .disable_msi_reset_irq = disable_msi_reset_irq, .substream_alloc_pages = substream_alloc_pages,
@@ -1990,6 +2001,11 @@ static int azx_probe(struct pci_dev *pcibool schedule_probe;int err; +if (snd_pci_quirk_lookup (pci, driver_blacklist)) { +dev_info (&pci->dev,"Skipping the blacklisted device\n" ); +return -ENODEV ; + } +if (dev >=SNDRV_CARDS )return -ENODEV ;if (!enable[dev]) {
Greg Kroah-Hartman
maintainerPATCH 23/125 ALSA: hda: Fix potential access overflow in beep helper
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a upstream.
The beep control helper function blindly stores the values in two stereo channels no matter whether the actual control is mono or stereo. This is practically harmless, but it annoys the recently introduced sanity check, resulting in an error when the checker is enabled.
This patch corrects the behavior to store only on the defined array member.
--- sound/pci/hda/hda_beep.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/hda/hda_beep.c +5 -1
@@ -310,8 +310,12 @@ int snd_hda_mixer_amp_switch_get_beep(st {struct hda_codec *codec =snd_kcontrol_chip (kcontrol);struct hda_beep *beep = codec->beep; +int chs =get_amp_channels (kcontrol); +if (beep && (!beep->enabled || !ctl_has_mute (kcontrol))) { - ucontrol->value.integer.value[0 ] = +if (chs &1 ) + ucontrol->value.integer.value[0 ] = beep->enabled; +if (chs &2 ) ucontrol->value.integer.value[1 ] = beep->enabled;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 24/125 ALSA: ice1724: Fix invalid access for enumerated ctl items
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit c47914c00be346bc5b48c48de7b0da5c2d1a296c upstream.
The access to Analog Capture Source control value implemented in prodigy_hifi.c is wrong, as caught by the recently introduced sanity check; it should be accessing value.enumerated.item[] instead of value.integer.value[]. This patch corrects the wrong access pattern.
--- sound/pci/ice1712/prodigy_hifi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/ice1712/prodigy_hifi.c +2 -2
@@ -569,7 +569,7 @@ static int wm_adc_mux_enum_get(struct snstruct snd_ice1712 *ice =snd_kcontrol_chip (kcontrol);mutex_lock (&ice->gpio_mutex); - ucontrol->value.integer.value[0 ] =wm_get (ice,WM_ADC_MUX ) &0x1f ; + ucontrol->value.enumerated.item[0 ] =wm_get (ice,WM_ADC_MUX ) &0x1f ;mutex_unlock (&ice->gpio_mutex);return 0 ; }
@@ -583,7 +583,7 @@ static int wm_adc_mux_enum_put(struct snmutex_lock (&ice->gpio_mutex); oval =wm_get (ice,WM_ADC_MUX ); - nval = (oval &0xe0 ) | ucontrol->value.integer.value[0 ]; + nval = (oval &0xe0 ) | ucontrol->value.enumerated.item[0 ];if (nval != oval) {wm_put (ice,WM_ADC_MUX , nval); change =1 ;
Greg Kroah-Hartman
maintainerPATCH 25/125 ALSA: pcm: oss: Fix regression by buffer overflow fix
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit ae769d3556644888c964635179ef192995f40793 upstream.
The recent fix for the OOB access in PCM OSS plugins (commitf2ecf903ef06: "ALSA: pcm: oss: Avoid plugin buffer overflow") caused a regression on OSS applications. The patch introduced the size check in client and slave size calculations to limit to each plugin's buffer size, but I overlooked that some code paths call those without allocating the buffer but just for estimation.
This patch fixes the bug by skipping the size check for those code paths while keeping checking in the actual transfer calls.
--- sound/core/oss/pcm_plugin.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-)
sound/core/oss/pcm_plugin.c +24 -8
@@ -196,7 +196,9 @@ int snd_pcm_plugin_free(struct snd_pcm_preturn 0 ; } -snd_pcm_sframes_t snd_pcm_plug_client_size (struct snd_pcm_substream *plug,snd_pcm_uframes_t drv_frames) +static snd_pcm_sframes_t plug_client_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t drv_frames, +bool check_size) {struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;int stream;
@@ -209,7 +211,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_siif (stream ==SNDRV_PCM_STREAM_PLAYBACK ) { plugin =snd_pcm_plug_last (plug);while (plugin && drv_frames >0 ) { -if (drv_frames > plugin->buf_frames) +if (check_size && drv_frames > plugin->buf_frames) drv_frames = plugin->buf_frames; plugin_prev = plugin->prev;if (plugin->src_frames)
@@ -222,7 +224,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_si plugin_next = plugin->next;if (plugin->dst_frames) drv_frames = plugin->dst_frames (plugin, drv_frames); -if (drv_frames > plugin->buf_frames) +if (check_size && drv_frames > plugin->buf_frames) drv_frames = plugin->buf_frames; plugin = plugin_next; }
@@ -231,7 +233,9 @@ snd_pcm_sframes_t snd_pcm_plug_client_sireturn drv_frames; } -snd_pcm_sframes_t snd_pcm_plug_slave_size (struct snd_pcm_substream *plug,snd_pcm_uframes_t clt_frames) +static snd_pcm_sframes_t plug_slave_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t clt_frames, +bool check_size) {struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;snd_pcm_sframes_t frames;
@@ -252,14 +256,14 @@ snd_pcm_sframes_t snd_pcm_plug_slave_sizif (frames <0 )return frames; } -if (frames > plugin->buf_frames) +if (check_size && frames > plugin->buf_frames) frames = plugin->buf_frames; plugin = plugin_next; } }else if (stream ==SNDRV_PCM_STREAM_CAPTURE ) { plugin =snd_pcm_plug_last (plug);while (plugin) { -if (frames > plugin->buf_frames) +if (check_size && frames > plugin->buf_frames) frames = plugin->buf_frames; plugin_prev = plugin->prev;if (plugin->src_frames) {
@@ -274,6 +278,18 @@ snd_pcm_sframes_t snd_pcm_plug_slave_sizreturn frames; } +snd_pcm_sframes_t snd_pcm_plug_client_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t drv_frames) +{ +return plug_client_size (plug, drv_frames, false); +} + +snd_pcm_sframes_t snd_pcm_plug_slave_size (struct snd_pcm_substream *plug, +snd_pcm_uframes_t clt_frames) +{ +return plug_slave_size (plug, clt_frames, false); +} +static int snd_pcm_plug_formats (struct snd_mask *mask,snd_pcm_format_t format) {struct snd_mask formats = *mask;
@@ -628,7 +644,7 @@ snd_pcm_sframes_t snd_pcm_plug_write_tra src_channels = dst_channels; plugin = next; } -return snd_pcm_plug_client_size (plug, frames); +return plug_client_size (plug, frames, true); }snd_pcm_sframes_t snd_pcm_plug_read_transfer (struct snd_pcm_substream *plug,struct snd_pcm_plugin_channel *dst_channels_final,snd_pcm_uframes_t size)
@@ -638,7 +654,7 @@ snd_pcm_sframes_t snd_pcm_plug_read_transnd_pcm_sframes_t frames = size;int err; - frames =snd_pcm_plug_slave_size (plug, frames); + frames =plug_slave_size (plug, frames, true);if (frames <0 )return frames;
Greg Kroah-Hartman
maintainerPATCH 26/125 media: ti-vpe: cal: fix disable_irqs to only the intended target
In reply to Greg Kroah-HartmanFrom: Benoit Parrot <[email protected]>
commit 1db56284b9da9056093681f28db48a09a243274b upstream.
disable_irqs() was mistakenly disabling all interrupts when called. This cause all port stream to stop even if only stopping one of them.
--- drivers/media/platform/ti-vpe/cal.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/media/platform/ti-vpe/cal.c +8 -8
@@ -548,16 +548,16 @@ static void enable_irqs(struct cal_ctx *static void disable_irqs (struct cal_ctx *ctx) { +u32 val; +/* Disable IRQ_WDMA_END 0/1 */ -reg_write_field (ctx->dev, -CAL_HL_IRQENABLE_CLR (2 ), -CAL_HL_IRQ_CLEAR , -CAL_HL_IRQ_MASK (ctx->csi2_port)); + val =0 ; +set_field (&val,CAL_HL_IRQ_CLEAR ,CAL_HL_IRQ_MASK (ctx->csi2_port)); +reg_write (ctx->dev,CAL_HL_IRQENABLE_CLR (2 ), val);/* Disable IRQ_WDMA_START 0/1 */ -reg_write_field (ctx->dev, -CAL_HL_IRQENABLE_CLR (3 ), -CAL_HL_IRQ_CLEAR , -CAL_HL_IRQ_MASK (ctx->csi2_port)); + val =0 ; +set_field (&val,CAL_HL_IRQ_CLEAR ,CAL_HL_IRQ_MASK (ctx->csi2_port)); +reg_write (ctx->dev,CAL_HL_IRQENABLE_CLR (3 ), val);/* Todo: Add VC_IRQ and CSI2_COMPLEXIO_IRQ handling */ reg_write (ctx->dev,CAL_CSI2_VC_IRQENABLE (1 ),0 ); }
Greg Kroah-Hartman
maintainerPATCH 27/125 acpi/x86: ignore unspecified bit positions in the ACPI global lock field
In reply to Greg Kroah-HartmanFrom: Jan Engelhardt <[email protected]>
commit ecb9c790999fd6c5af0f44783bd0217f0b89ec2b upstream.
The value in "new" is constructed from "old" such that all bits defined as reserved by the ACPI spec[1] are left untouched. But if those bits do not happen to be all zero, "new < 3" will not evaluate to true.
The firmware of the laptop(s) Medion MD63490 / Akoya P15648 comes with garbage inside the "FACS" ACPI table. The starting value is old=0x4944454d, therefore new=0x4944454e, which is >= 3. Mask off the reserved bits.
[1] https://uefi.org/sites/default/files/resources/ACPI_6_2.pdf
--- arch/x86/kernel/acpi/boot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/acpi/boot.c +1 -1
@@ -1717,7 +1717,7 @@ int __acpi_acquire_global_lock(unsigned new = (((old & ~0x3 ) +2 ) + ((old >>1 ) &0x1 )); val =cmpxchg (lock, old, new); }while (unlikely (val != old)); -return (new <3 ) ?-1 :0 ; +return ((new &0x3 ) <3 ) ?-1 :0 ; }int __acpi_release_global_lock (unsigned int *lock)
Greg Kroah-Hartman
maintainerPATCH 28/125 thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
commit 3f5b9959041e0db6dacbea80bb833bff5900999f upstream.
When CONFIG_DEVFREQ_THERMAL is disabled all functions except of_devfreq_cooling_register_power() were already inlined. Also inline the last function to avoid compile errors when multiple drivers call of_devfreq_cooling_register_power() when CONFIG_DEVFREQ_THERMAL is not set. Compilation failed with the following message:
multiple definition of `of_devfreq_cooling_register_power'
(which then lists all usages of of_devfreq_cooling_register_power())
Thomas Zimmermann reported this problem [0] on a kernel config with CONFIG_DRM_LIMA={m,y}, CONFIG_DRM_PANFROST={m,y} and CONFIG_DEVFREQ_THERMAL=n after both, the lima and panfrost drivers gained devfreq cooling support.
[0] https://www.spinics.net/lists/dri-devel/msg252825.html
--- include/linux/devfreq_cooling.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/devfreq_cooling.h +1 -1
@@ -53,7 +53,7 @@ void devfreq_cooling_unregister(struct t#else /* !CONFIG_DEVFREQ_THERMAL */ -struct thermal_cooling_device * +static inline struct thermal_cooling_device *of_devfreq_cooling_register_power (struct device_node *np,struct devfreq *df,struct devfreq_cooling_power *dfc_power) {
Greg Kroah-Hartman
maintainerPATCH 29/125 KEYS: reaching the keys quotas correctly
In reply to Greg Kroah-HartmanFrom: Yang Xu <[email protected]>
commit 2e356101e72ab1361821b3af024d64877d9a798d upstream.
Currently, when we add a new user key, the calltrace as below:
add_key()
key_create_or_update()
key_alloc()
__key_instantiate_and_link
generic_key_instantiate
key_payload_reserve
......Since commit a08bf91ce28e ("KEYS: allow reaching the keys quotas exactly"), we can reach max bytes/keys in key_alloc, but we forget to remove this limit when we reserver space for payload in key_payload_reserve. So we can only reach max keys but not max bytes when having delta between plen and type->def_datalen. Remove this limit when instantiating the key, so we can keep consistent with key_alloc.
Also, fix the similar problem in keyctl_chown_key().
--- security/keys/key.c | 2 +- security/keys/keyctl.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
security/keys/key.c +1 -1
@@ -382,7 +382,7 @@ int key_payload_reserve(struct key *key,spin_lock (&key->user->lock);if (delta >0 && - (key->user->qnbytes + delta >= maxbytes || + (key->user->qnbytes + delta > maxbytes || key->user->qnbytes + delta < key->user->qnbytes)) { ret = -EDQUOT ; }
security/keys/keyctl.c +2 -2
@@ -881,8 +881,8 @@ long keyctl_chown_key(key_serial_t id, u key_quota_root_maxbytes : key_quota_maxbytes;spin_lock (&newowner->lock); -if (newowner->qnkeys +1 >= maxkeys || - newowner->qnbytes + key->quotalen >= maxbytes || +if (newowner->qnkeys +1 > maxkeys || + newowner->qnbytes + key->quotalen > maxbytes || newowner->qnbytes + key->quotalen < newowner->qnbytes) goto quota_overrun;
Greg Kroah-Hartman
maintainerPATCH 30/125 irqchip/versatile-fpga: Apply clear-mask earlier
In reply to Greg Kroah-HartmanFrom: Sungbo Eo <[email protected]>
commit 6a214a28132f19ace3d835a6d8f6422ec80ad200 upstream.
Clear its own IRQs before the parent IRQ get enabled, so that the remaining IRQs do not accidentally interrupt the parent IRQ controller.
This patch also fixes a reboot bug on OX820 SoC, where the remaining rps-timer IRQ raises a GIC interrupt that is left pending. After that, the rps-timer IRQ is cleared during driver initialization, and there's no IRQ left in rps-irq when local_irq_enable() is called, which evokes an error message "unexpected IRQ trap".
--- drivers/irqchip/irq-versatile-fpga.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/irqchip/irq-versatile-fpga.c +3 -3
@@ -211,6 +211,9 @@ int __init fpga_irq_of_init(struct devicif (of_property_read_u32 (node,"valid-mask" , &valid_mask)) valid_mask =0 ; +writel (clear_mask, base +IRQ_ENABLE_CLEAR ); +writel (clear_mask, base +FIQ_ENABLE_CLEAR ); +/* Some chips are cascaded from a parent IRQ */ parent_irq =irq_of_parse_and_map (node,0 );if (!parent_irq) {
@@ -220,9 +223,6 @@ int __init fpga_irq_of_init(struct devicfpga_irq_init (base, node->name,0 , parent_irq, valid_mask, node); -writel (clear_mask, base +IRQ_ENABLE_CLEAR ); -writel (clear_mask, base +FIQ_ENABLE_CLEAR ); -/* * On Versatile AB/PB, some secondary interrupts have a direct * pass-thru to the primary controller for IRQs 20 and 22-31 which need
Greg Kroah-Hartman
maintainerPATCH 31/125 MIPS: OCTEON: irq: Fix potential NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 792a402c2840054533ef56279c212ef6da87d811 upstream.
There is a potential NULL pointer dereference in case kzalloc() fails and returns NULL.
Fix this by adding a NULL check on *cd*
This bug was detected with the help of Coccinelle.
--- arch/mips/cavium-octeon/octeon-irq.c | 3 +++ 1 file changed, 3 insertions(+)
arch/mips/cavium-octeon/octeon-irq.c +3 -0
@@ -2199,6 +2199,9 @@ static int octeon_irq_cib_map(struct irq } cd =kzalloc (sizeof (*cd),GFP_KERNEL ); +if (!cd) +return -ENOMEM ; + cd->host_data = host_data; cd->bit = hw;
Greg Kroah-Hartman
maintainerPATCH 32/125 ath9k: Handle txpower changes even when TPC is disabled
In reply to Greg Kroah-HartmanFrom: Remi Pommarel <[email protected]>
commit 968ae2caad0782db5dbbabb560d3cdefd2945d38 upstream.
When TPC is disabled IEEE80211_CONF_CHANGE_POWER event can be handled to reconfigure HW's maximum txpower.
This fixes 0dBm txpower setting when user attaches to an interface for the first time with the following scenario:
ieee80211_do_open()
ath9k_add_interface()
ath9k_set_txpower() /* Set TX power with not yet initialized
sc->hw->conf.power_level */
ieee80211_hw_config() /* Iniatilize sc->hw->conf.power_level and
raise IEEE80211_CONF_CHANGE_POWER */
ath9k_config() /* IEEE80211_CONF_CHANGE_POWER is ignored */This issue can be reproduced with the following:
$ modprobe -r ath9k
$ modprobe ath9k
$ wpa_supplicant -i wlan0 -c /tmp/wpa.conf &
$ iw dev /* Here TX power is either 0 or 3 depending on RF chain */
$ killall wpa_supplicant
$ iw dev /* TX power goes back to calibrated value and subsequent
calls will be fine */--- drivers/net/wireless/ath/ath9k/main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath9k/main.c +3 -0
@@ -1455,6 +1455,9 @@ static int ath9k_config(struct ieee80211ath_chanctx_set_channel (sc, ctx, &hw->conf.chandef); } +if (changed &IEEE80211_CONF_CHANGE_POWER ) +ath9k_set_txpower (sc,NULL ); +mutex_unlock (&sc->mutex);ath9k_ps_restore (sc);
Greg Kroah-Hartman
maintainerPATCH 33/125 signal: Extend exec_id to 64bits
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit d1e7fd6462ca9fc76650fbe6ca800e35b24267da upstream.
Replace the 32bit exec_id with a 64bit exec_id to make it impossible to wrap the exec_id counter. With care an attacker can cause exec_id wrap and send arbitrary signals to a newly exec'd parent. This bypasses the signal sending checks if the parent changes their credentials during exec.
The severity of this problem can been seen that in my limited testing of a 32bit exec_id it can take as little as 19s to exec 65536 times. Which means that it can take as little as 14 days to wrap a 32bit exec_id. Adam Zabrocki has succeeded wrapping the self_exe_id in 7 days. Even my slower timing is in the uptime of a typical server. Which means self_exec_id is simply a speed bump today, and if exec gets noticably faster self_exec_id won't even be a speed bump.
Extending self_exec_id to 64bits introduces a problem on 32bit architectures where reading self_exec_id is no longer atomic and can take two read instructions. Which means that is is possible to hit a window where the read value of exec_id does not match the written value. So with very lucky timing after this change this still remains expoiltable.
I have updated the update of exec_id on exec to use WRITE_ONCE and the read of exec_id in do_notify_parent to use READ_ONCE to make it clear that there is no locking between these two locations.
--- fs/exec.c | 2 +- include/linux/sched.h | 4 ++-- kernel/signal.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
fs/exec.c +1 -1
@@ -1353,7 +1353,7 @@ void setup_new_exec(struct linux_binprm/* An exec changes our domain. We are no longer part of the thread group */ - current->self_exec_id++; +WRITE_ONCE (current->self_exec_id, current->self_exec_id +1 );flush_signal_handlers (current,0 ); }EXPORT_SYMBOL (setup_new_exec);
include/linux/sched.h +2 -2
@@ -1720,8 +1720,8 @@ struct task_struct {struct seccomp seccomp;/* Thread group tracking */ -u32 parent_exec_id; -u32 self_exec_id; +u64 parent_exec_id; +u64 self_exec_id;/* Protection of (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed, * mempolicy */ spinlock_t alloc_lock;
kernel/signal.c +1 -1
@@ -1660,7 +1660,7 @@ bool do_notify_parent(struct task_struct* This is only possible if parent == real_parent. * Check if it has changed security domain. */ -if (tsk->parent_exec_id != tsk->parent->self_exec_id) +if (tsk->parent_exec_id !=READ_ONCE (tsk->parent->self_exec_id)) sig =SIGCHLD ; }
Greg Kroah-Hartman
maintainerPATCH 34/125 x86/entry/32: Add missing ASM_CLAC to general_protection entry
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 3d51507f29f2153a658df4a0674ec5b592b62085 upstream.
All exception entry points must have ASM_CLAC right at the beginning. The general_protection entry is missing one.
--- arch/x86/entry/entry_32.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/entry/entry_32.S +1 -0
@@ -1195,6 +1195,7 @@ ENTRY(int3) END(int3) ENTRY(general_protection) + ASM_CLAC pushl $do_general_protection jmp error_code END(general_protection)
Greg Kroah-Hartman
maintainerPATCH 35/125 KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit a1d032a49522cb5368e5dfb945a85899b4c74f65 upstream.
In case we have a region 1 the following calculation
(31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11)
results in 64. As shifts beyond the size are undefined the compiler is free to use instructions like sllg. sllg will only use 6 bits of the shift value (here 64) resulting in no shift at all. That means that ALL addresses will be rejected.
The can result in endless loops, e.g. when prefix cannot get mapped.
--- arch/s390/mm/gmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/s390/mm/gmap.c +5 -1
@@ -759,14 +759,18 @@ static void gmap_call_notifier(struct gmstatic inline unsigned long *gmap_table_walk (struct gmap *gmap,unsigned long gaddr,int level) { +const int asce_type = gmap->asce & _ASCE_TYPE_MASK;unsigned long *table;if ((gmap->asce & _ASCE_TYPE_MASK) +4 < (level *4 ))return NULL ;if (gmap_is_shadow (gmap) && gmap->removed)return NULL ; -if (gaddr & (-1UL << (31 + ((gmap->asce & _ASCE_TYPE_MASK) >>2 )*11 ))) + +if (asce_type != _ASCE_TYPE_REGION1 && + gaddr & (-1UL << (31 + (asce_type >>2 ) *11 )))return NULL ; + table = gmap->table;switch (gmap->asce & _ASCE_TYPE_MASK) {case _ASCE_TYPE_REGION1:
Greg Kroah-Hartman
maintainerPATCH 36/125 KVM: s390: vsie: Fix delivery of addressing exceptions
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 4d4cee96fb7a3cc53702a9be8299bf525be4ee98 upstream.
Whenever we get an -EFAULT, we failed to read in guest 2 physical address space. Such addressing exceptions are reported via a program intercept to the nested hypervisor.
We faked the intercept, we have to return to guest 2. Instead, right now we would be returning -EFAULT from the intercept handler, eventually crashing the VM.
the correct thing to do is to return 1 as rc == 1 is the internal representation of "we have to go back into g2".
Addressing exceptions can only happen if the g2->g3 page tables reference invalid g2 addresses (say, either a table or the final page is not accessible - so something that basically never happens in sane environments.
Identified by manual code inspection.
--- arch/s390/kvm/vsie.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kvm/vsie.c +1 -0
@@ -947,6 +947,7 @@ static int vsie_run(struct kvm_vcpu *vcp scb_s->iprcc =PGM_ADDRESSING ; scb_s->pgmilc =4 ; scb_s->gpsw.addr =__rewind_psw (scb_s->gpsw,4 ); + rc =1 ; }return rc; }
Greg Kroah-Hartman
maintainerPATCH 37/125 KVM: x86: Allocate new rmap and large page tracking when moving memslot
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit edd4fa37baa6ee8e44dc65523b27bd6fe44c94de upstream.
Reallocate a rmap array and recalcuate large page compatibility when moving an existing memslot to correctly handle the alignment properties of the new memslot. The number of rmap entries required at each level is dependent on the alignment of the memslot's base gfn with respect to that level, e.g. moving a large-page aligned memslot so that it becomes unaligned will increase the number of rmap entries needed at the now unaligned level.
Not updating the rmap array is the most obvious bug, as KVM accesses garbage data beyond the end of the rmap. KVM interprets the bad data as pointers, leading to non-canonical #GPs, unexpected #PFs, etc...
general protection fault: 0000 [#1] SMP CPU: 0 PID: 1909 Comm: move_memory_reg Not tainted 5.4.0-rc7+ #139 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:rmap_get_first+0x37/0x50 [kvm] Code: <48> 8b 3b 48 85 ff 74 ec e8 6c f4 ff ff 85 c0 74 e3 48 89 d8 5b c3 RSP: 0018:ffffc9000021bbc8 EFLAGS: 00010246 RAX: ffff00617461642e RBX: ffff00617461642e RCX: 0000000000000012 RDX: ffff88827400f568 RSI: ffffc9000021bbe0 RDI: ffff88827400f570 RBP: 0010000000000000 R08: ffffc9000021bd00 R09: ffffc9000021bda8 R10: ffffc9000021bc48 R11: 0000000000000000 R12: 0030000000000000 R13: 0000000000000000 R14: ffff88827427d700 R15: ffffc9000021bce8 FS: 00007f7eda014700(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7ed9216ff8 CR3: 0000000274391003 CR4: 0000000000162eb0 Call Trace: kvm_mmu_slot_set_dirty+0xa1/0x150 [kvm] __kvm_set_memory_region.part.64+0x559/0x960 [kvm] kvm_set_memory_region+0x45/0x60 [kvm] kvm_vm_ioctl+0x30f/0x920 [kvm] do_vfs_ioctl+0xa1/0x620 ksys_ioctl+0x66/0x70 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x4c/0x170 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f7ed9911f47 Code: <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 21 6f 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc00937498 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000001ab0010 RCX: 00007f7ed9911f47 RDX: 0000000001ab1350 RSI: 000000004020ae46 RDI: 0000000000000004 RBP: 000000000000000a R08: 0000000000000000 R09: 00007f7ed9214700 R10: 00007f7ed92149d0 R11: 0000000000000246 R12: 00000000bffff000 R13: 0000000000000003 R14: 00007f7ed9215000 R15: 0000000000000000 Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0c5f570b3358ca89 ]---
The disallow_lpage tracking is more subtle. Failure to update results in KVM creating large pages when it shouldn't, either due to stale data or again due to indexing beyond the end of the metadata arrays, which can lead to memory corruption and/or leaking data to guest/userspace.
Note, the arrays for the old memslot are freed by the unconditional call to kvm_free_memslot() in __kvm_set_memory_region().
--- arch/x86/kvm/x86.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/kvm/x86.c +11 -0
@@ -8319,6 +8319,13 @@ int kvm_arch_create_memslot(struct kvm * {int i; +/* +* Clear out the previous array pointers for the KVM_MR_MOVE case. The +* old arrays will be freed by __kvm_set_memory_region() if installing +* the new memslot is successful. +*/ +memset (&slot->arch,0 ,sizeof (slot->arch)); +for (i =0 ; i <KVM_NR_PAGE_SIZES ; ++i) {struct kvm_lpage_info *linfo;unsigned long ugfn;
@@ -8392,6 +8399,10 @@ int kvm_arch_prepare_memory_region(struc const struct kvm_userspace_memory_region *mem, enum kvm_mr_change change) { + if (change == KVM_MR_MOVE) + return kvm_arch_create_memslot(kvm, memslot, + mem->memory_size >> PAGE_SHIFT); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 38/125 KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 31603d4fc2bb4f0815245d496cb970b27b4f636a upstream.
VMCLEAR all in-use VMCSes during a crash, even if kdump's NMI shootdown interrupted a KVM update of the percpu in-use VMCS list.
Because NMIs are not blocked by disabling IRQs, it's possible that crash_vmclear_local_loaded_vmcss() could be called while the percpu list of VMCSes is being modified, e.g. in the middle of list_add() in vmx_vcpu_load_vmcs(). This potential corner case was called out in the original commit[*], but the analysis of its impact was wrong.
Skipping the VMCLEARs is wrong because it all but guarantees that a loaded, and therefore cached, VMCS will live across kexec and corrupt memory in the new kernel. Corruption will occur because the CPU's VMCS cache is non-coherent, i.e. not snooped, and so the writeback of VMCS memory on its eviction will overwrite random memory in the new kernel. The VMCS will live because the NMI shootdown also disables VMX, i.e. the in-progress VMCLEAR will #UD, and existing Intel CPUs do not flush the VMCS cache on VMXOFF.
Furthermore, interrupting list_add() and list_del() is safe due to crash_vmclear_local_loaded_vmcss() using forward iteration. list_add() ensures the new entry is not visible to forward iteration unless the entire add completes, via WRITE_ONCE(prev->next, new). A bad "prev" pointer could be observed if the NMI shootdown interrupted list_del() or list_add(), but list_for_each_entry() does not consume ->prev.
In addition to removing the temporary disabling of VMCLEAR, open code loaded_vmcs_init() in __loaded_vmcs_clear() and reorder VMCLEAR so that the VMCS is deleted from the list only after it's been VMCLEAR'd. Deleting the VMCS before VMCLEAR would allow a race where the NMI shootdown could arrive between list_del() and vmcs_clear() and thus neither flow would execute a successful VMCLEAR. Alternatively, more code could be moved into loaded_vmcs_init(), but that gets rather silly as the only other user, alloc_loaded_vmcs(), doesn't need the smp_wmb() and would need to work around the list_del().
Update the smp_*() comments related to the list manipulation, and opportunistically reword them to improve clarity.
[*] https://patchwork.kernel.org/patch/1675731/#3720461
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx.c | 67 ++++++++++++----------------------------------------- 1 file changed, 16 insertions(+), 51 deletions(-)
arch/x86/kvm/vmx.c +16 -51
@@ -1619,43 +1619,15 @@ static void vmcs_load(struct vmcs *vmcs) }#ifdef CONFIG_KEXEC_CORE -/* -* This bitmap is used to indicate whether the vmclear -* operation is enabled on all cpus. All disabled by -* default. -*/ -static cpumask_t crash_vmclear_enabled_bitmap =CPU_MASK_NONE ; - -static inline void crash_enable_local_vmclear (int cpu) -{ -cpumask_set_cpu (cpu, &crash_vmclear_enabled_bitmap); -} - -static inline void crash_disable_local_vmclear (int cpu) -{ -cpumask_clear_cpu (cpu, &crash_vmclear_enabled_bitmap); -} - -static inline int crash_local_vmclear_enabled (int cpu) -{ -return cpumask_test_cpu (cpu, &crash_vmclear_enabled_bitmap); -} -static void crash_vmclear_local_loaded_vmcss (void ) {int cpu =raw_smp_processor_id ();struct loaded_vmcs *v; -if (!crash_local_vmclear_enabled (cpu)) -return ; -list_for_each_entry (v, &per_cpu (loaded_vmcss_on_cpu, cpu), loaded_vmcss_on_cpu_link)vmcs_clear (v->vmcs); } -#else -static inline void crash_enable_local_vmclear (int cpu) { } -static inline void crash_disable_local_vmclear (int cpu) { }#endif /* CONFIG_KEXEC_CORE */ static void __loaded_vmcs_clear (void *arg)
@@ -1667,19 +1639,24 @@ static void __loaded_vmcs_clear(void *arreturn ;/* vcpu migration can race with cpu offline */ if (per_cpu (current_vmcs, cpu) == loaded_vmcs->vmcs)per_cpu (current_vmcs, cpu) =NULL ; -crash_disable_local_vmclear (cpu); + +vmcs_clear (loaded_vmcs->vmcs); +if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched) +vmcs_clear (loaded_vmcs->shadow_vmcs); +list_del (&loaded_vmcs->loaded_vmcss_on_cpu_link);/* -* we should ensure updating loaded_vmcs->loaded_vmcss_on_cpu_link -* is before setting loaded_vmcs->vcpu to -1 which is done in -* loaded_vmcs_init. Otherwise, other cpu can see vcpu = -1 fist -* then adds the vmcs into percpu list before it is deleted. +* Ensure all writes to loaded_vmcs, including deleting it from its +* current percpu list, complete before setting loaded_vmcs->vcpu to +* -1, otherwise a different cpu can see vcpu == -1 first and add +* loaded_vmcs to its percpu list before it's deleted from this cpu's +* list. Pairs with the smp_rmb() in vmx_vcpu_load_vmcs(). */ smp_wmb (); -loaded_vmcs_init (loaded_vmcs); -crash_enable_local_vmclear (cpu); + loaded_vmcs->cpu =-1 ; + loaded_vmcs->launched =0 ; }static void loaded_vmcs_clear (struct loaded_vmcs *loaded_vmcs)
@@ -2471,18 +2448,17 @@ static void vmx_vcpu_load(struct kvm_vcpif (!already_loaded) {local_irq_disable (); -crash_disable_local_vmclear (cpu);/* -* Read loaded_vmcs->cpu should be before fetching -* loaded_vmcs->loaded_vmcss_on_cpu_link. -* See the comments in __loaded_vmcs_clear(). +* Ensure loaded_vmcs->cpu is read before adding loaded_vmcs to +* this cpu's percpu list, otherwise it may not yet be deleted +* from its previous cpu's percpu list. Pairs with the +* smb_wmb() in __loaded_vmcs_clear(). */ smp_rmb ();list_add (&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link, &per_cpu (loaded_vmcss_on_cpu, cpu)); -crash_enable_local_vmclear (cpu);local_irq_enable (); }
@@ -3510,17 +3486,6 @@ static int hardware_enable(void)INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu));spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); -/* -* Now we can enable the vmclear operation in kdump -* since the loaded_vmcss_on_cpu list on this cpu -* has been initialized. -* -* Though the cpu is not in VMX operation now, there -* is no problem to enable the vmclear operation -* for the loaded_vmcss_on_cpu list is empty! -*/ -crash_enable_local_vmclear (cpu); -rdmsrl (MSR_IA32_FEATURE_CONTROL , old); test_bits =FEATURE_CONTROL_LOCKED ;
Greg Kroah-Hartman
maintainerPATCH 39/125 KVM: VMX: fix crash cleanup when KVM wasnt used
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit dbef2808af6c594922fe32833b30f55f35e9da6d upstream.
If KVM wasn't used at all before we crash the cleanup procedure fails with
BUG: unable to handle page fault for address: ffffffffffffffc8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23215067 P4D 23215067 PUD 23217067 PMD 0 Oops: 0000 [#8] SMP PTI CPU: 0 PID: 3542 Comm: bash Kdump: loaded Tainted: G D 5.6.0-rc2+ #823 RIP: 0010:crash_vmclear_local_loaded_vmcss.cold+0x19/0x51 [kvm_intel]
The root cause is that loaded_vmcss_on_cpu list is not yet initialized, we initialize it in hardware_enable() but this only happens when we start a VM.
Previously, we used to have a bitmap with enabled CPUs and that was preventing [masking] the issue.
Initialized loaded_vmcss_on_cpu list earlier, right before we assign crash_vmclear_loaded_vmcss pointer. blocked_vcpu_on_cpu list and blocked_vcpu_on_cpu_lock are moved altogether for consistency.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx.c +7 -5
@@ -3482,10 +3482,6 @@ static int hardware_enable(void)if (cr4_read_shadow () &X86_CR4_VMXE )return -EBUSY ; -INIT_LIST_HEAD (&per_cpu (loaded_vmcss_on_cpu, cpu)); -INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu)); -spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); -rdmsrl (MSR_IA32_FEATURE_CONTROL , old); test_bits =FEATURE_CONTROL_LOCKED ;
@@ -11860,7 +11856,7 @@ module_exit(vmx_exit)static int __init vmx_init (void ) { -int r; +int r, cpu; r =kvm_init (&vmx_x86_ops,sizeof (struct vcpu_vmx ), __alignof__(struct vcpu_vmx ),THIS_MODULE );
@@ -11882,6 +11878,12 @@ static int __init vmx_init(void) } } +for_each_possible_cpu (cpu) { +INIT_LIST_HEAD (&per_cpu (loaded_vmcss_on_cpu, cpu)); +INIT_LIST_HEAD (&per_cpu (blocked_vcpu_on_cpu, cpu)); +spin_lock_init (&per_cpu (blocked_vcpu_on_cpu_lock, cpu)); + } +#ifdef CONFIG_KEXEC_CORE rcu_assign_pointer (crash_vmclear_loaded_vmcss, crash_vmclear_local_loaded_vmcss);
Greg Kroah-Hartman
maintainerPATCH 40/125 btrfs: drop block from cache on error in relocation
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 8e19c9732ad1d127b5575a10f4fbcacf740500ff upstream.
If we have an error while building the backref tree in relocation we'll process all the pending edges and then free the node. However if we integrated some edges into the cache we'll lose our link to those edges by simply freeing this node, which means we'll leak memory and references to any roots that we've found.
Instead we need to use remove_backref_node(), which walks through all of the edges that are still linked to this node and free's them up and drops any root references we may be holding.
--- fs/btrfs/relocation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/relocation.c +1 -1
@@ -1185,7 +1185,7 @@ out:free_backref_node (cache, lower); } -free_backref_node (cache, node); +remove_backref_node (cache, node);return ERR_PTR (err); }ASSERT (!node || !node->detached);
Greg Kroah-Hartman
maintainerPATCH 41/125 crypto: mxs-dcp - fix scatterlist linearization for hash
In reply to Greg Kroah-HartmanFrom: Rosioru Dragos <[email protected]>
commit fa03481b6e2e82355c46644147b614f18c7a8161 upstream.
The incorrect traversal of the scatterlist, during the linearization phase lead to computing the hash value of the wrong input buffer. New implementation uses scatterwalk_map_and_copy()
to address this issue.
--- drivers/crypto/mxs-dcp.c | 54 ++++++++++++++++++++++------------------------- 1 file changed, 26 insertions(+), 28 deletions(-)
drivers/crypto/mxs-dcp.c +26 -28
@@ -25,6 +25,7 @@#include <crypto/sha.h> #include <crypto/internal/hash.h> #include <crypto/internal/skcipher.h> +#include <crypto/scatterwalk.h> #define DCP_MAX_CHANS 4#define DCP_BUF_SZ PAGE_SIZE
@@ -621,49 +622,46 @@ static int dcp_sha_req_to_buf(struct crystruct dcp_async_ctx *actx =crypto_ahash_ctx (tfm);struct dcp_sha_req_ctx *rctx =ahash_request_ctx (req);struct hash_alg_common *halg =crypto_hash_alg_common (tfm); -const int nents =sg_nents (req->src);uint8_t *in_buf = sdcp->coh->sha_in_buf;uint8_t *out_buf = sdcp->coh->sha_out_buf; -uint8_t *src_buf; -struct scatterlist *src; -unsigned int i, len, clen; +unsigned int i, len, clen, oft =0 ;int ret;int fin = rctx->fini;if (fin) rctx->fini =0 ; -for_each_sg (req->src, src, nents, i) { - src_buf =sg_virt (src); - len =sg_dma_len (src); + src = req->src; + len = req->nbytes; -do { -if (actx->fill + len >DCP_BUF_SZ ) - clen =DCP_BUF_SZ - actx->fill; -else - clen = len; +while (len) { +if (actx->fill + len >DCP_BUF_SZ ) + clen =DCP_BUF_SZ - actx->fill; +else + clen = len; -memcpy (in_buf + actx->fill, src_buf, clen); - len -= clen; - src_buf += clen; - actx->fill += clen; +scatterwalk_map_and_copy (in_buf + actx->fill, src, oft, clen, +0 ); -/* -* If we filled the buffer and still have some -* more data, submit the buffer. -*/ -if (len && actx->fill ==DCP_BUF_SZ ) { - ret =mxs_dcp_run_sha (req); -if (ret) -return ret; - actx->fill =0 ; - rctx->init =0 ; - } - }while (len); + len -= clen; + oft += clen; + actx->fill += clen; + +/* +* If we filled the buffer and still have some +* more data, submit the buffer. +*/ +if (len && actx->fill ==DCP_BUF_SZ ) { + ret =mxs_dcp_run_sha (req); +if (ret) +return ret; + actx->fill =0 ; + rctx->init =0 ; + } }if (fin) {
Greg Kroah-Hartman
maintainerPATCH 42/125 ALSA: hda: Initialize power_state field properly
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 183ab39eb0ea9879bb68422a83e65f750f3192f0 upstream.
The recent commit 98081ca62cba ("ALSA: hda - Record the current power state before suspend/resume calls") made the HD-audio driver to store the PM state in power_state field. This forgot, however, the initialization at power up. Although the codec drivers usually don't need to refer to this field in the normal operation, let's initialize it properly for consistency.
--- sound/pci/hda/hda_codec.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/hda_codec.c +1 -0
@@ -876,6 +876,7 @@ int snd_hda_codec_new(struct hda_bus *bu/* power-up all before initialization */ hda_set_power_state (codec,AC_PWRST_D0 ); + codec->core.dev.power.power_state =PMSG_ON ;snd_hda_codec_proc_new (codec);
Greg Kroah-Hartman
maintainerPATCH 43/125 x86/speculation: Remove redundant arch_smt_update() invocation
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
commit 34d66caf251df91ff27b24a3a786810d29989eca upstream.
With commit a74cfffb03b7 ("x86/speculation: Rework SMT state change"), arch_smt_update() is invoked from each individual CPU hotplug function.
Therefore the extra arch_smt_update() call in the sysfs SMT control is redundant.
--- kernel/cpu.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
kernel/cpu.c +1 -4
@@ -2027,10 +2027,8 @@ int cpuhp_smt_disable(enum cpuhp_smt_con*/ cpuhp_offline_cpu_device (cpu); } -if (!ret) { +if (!ret) cpu_smt_control = ctrlval; -arch_smt_update (); - }cpu_maps_update_done ();return ret; }
@@ -2041,7 +2039,6 @@ int cpuhp_smt_enable(void)cpu_maps_update_begin (); cpu_smt_control =CPU_SMT_ENABLED ; -arch_smt_update ();for_each_present_cpu (cpu) {/* Skip online CPUs and CPUs on offline nodes */ if (cpu_online (cpu) || !node_online (cpu_to_node (cpu)))
Greg Kroah-Hartman
maintainerPATCH 44/125 tools: gpio: Fix out-of-tree build regression
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit 82f04bfe2aff428b063eefd234679b2d693228ed upstream.
Commit 0161a94e2d1c7 ("tools: gpio: Correctly add make dependencies for gpio_utils") added a make rule for gpio-utils-in.o but used $(output) instead of the correct $(OUTPUT) for the output directory, breaking out-of-tree build (O=xx) with the following error:
No rule to make target 'out/tools/gpio/gpio-utils-in.o', needed by 'out/tools/gpio/lsgpio-in.o'. Stop.
Fix that.
--- tools/gpio/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/gpio/Makefile +1 -1
@@ -32,7 +32,7 @@ $(OUTPUT)include/linux/gpio.h: ../../inc prepare: $(OUTPUT)include/linux/gpio.h -GPIO_UTILS_IN := $(output)gpio-utils-in.o +GPIO_UTILS_IN := $(OUTPUT)gpio-utils-in.o $(GPIO_UTILS_IN): prepare FORCE $(Q)$(MAKE) $(build)=gpio-utils
Greg Kroah-Hartman
maintainerPATCH 45/125 mm: Use fixed constant in page_frag_alloc instead of size + 1
In reply to Greg Kroah-HartmanFrom: Alexander Duyck <[email protected]>
commit 8644772637deb121f7ac2df690cbf83fa63d3b70 upstream.
This patch replaces the size + 1 value introduced with the recent fix for 1 byte allocs with a constant value.
The idea here is to reduce code overhead as the previous logic would have to read size into a register, then increment it, and write it back to whatever field was being used. By using a constant we can avoid those memory reads and arithmetic operations in favor of just encoding the maximum value into the operation itself.
--- mm/page_alloc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
mm/page_alloc.c +4 -4
@@ -3955,11 +3955,11 @@ refill:/* Even if we own the page, we do not use atomic_set(). * This would break get_page_unless_zero() users. */ -page_ref_add (page, size); +page_ref_add (page,PAGE_FRAG_CACHE_MAX_SIZE );/* reset page count bias and offset to start of new frag */ nc->pfmemalloc =page_is_pfmemalloc (page); - nc->pagecnt_bias = size +1 ; + nc->pagecnt_bias =PAGE_FRAG_CACHE_MAX_SIZE +1 ; nc->offset = size; }
@@ -3975,10 +3975,10 @@ refill: size = nc->size;#endif /* OK, page count is 0, we can safely set it */ -set_page_count (page, size +1 ); +set_page_count (page,PAGE_FRAG_CACHE_MAX_SIZE +1 );/* reset page count bias and offset to start of new frag */ - nc->pagecnt_bias = size +1 ; + nc->pagecnt_bias =PAGE_FRAG_CACHE_MAX_SIZE +1 ; offset = size - fragsz; }
Greg Kroah-Hartman
maintainerPATCH 46/125 dm verity fec: fix memory leak in verity_fec_dtr
In reply to Greg Kroah-HartmanFrom: Shetty, Harshini X (EXT-Sony Mobile) <[email protected]>
commit 75fa601934fda23d2f15bf44b09c2401942d8e15 upstream.
Fix below kmemleak detected in verity_fec_ctr. output_pool is allocated for each dm-verity-fec device. But it is not freed when dm-table for the verity target is removed. Hence free the output mempool in destructor function verity_fec_dtr.
unreferenced object 0xffffffffa574d000 (size 4096):
comm "init", pid 1667, jiffies 4294894890 (age 307.168s) hex dump (first 32 bytes):
8e 36 00 98 66 a8 0b 9b 00 00 00 00 00 00 00 00 .6..f...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000060e82407>] __kmalloc+0x2b4/0x340
[<00000000dd99488f>] mempool_kmalloc+0x18/0x20
[<000000002560172b>] mempool_init_node+0x98/0x118
[<000000006c3574d2>] mempool_init+0x14/0x20
[<0000000008cb266e>] verity_fec_ctr+0x388/0x3b0
[<000000000887261b>] verity_ctr+0x87c/0x8d0
[<000000002b1e1c62>] dm_table_add_target+0x174/0x348
[<000000002ad89eda>] table_load+0xe4/0x328
[<000000001f06f5e9>] dm_ctl_ioctl+0x3b4/0x5a0
[<00000000bee5fbb7>] do_vfs_ioctl+0x5dc/0x928
[<00000000b475b8f5>] __arm64_sys_ioctl+0x70/0x98
[<000000005361e2e8>] el0_svc_common+0xa0/0x158
[<000000001374818f>] el0_svc_handler+0x6c/0x88
[<000000003364e9f4>] el0_svc+0x8/0xc
[<000000009d84cec9>] 0xffffffffffffffffDepends-on: 6f1c819c219f7 ("dm: convert to bioset_init()/mempool_init()")
--- drivers/md/dm-verity-fec.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-verity-fec.c +1 -0
@@ -563,6 +563,7 @@ void verity_fec_dtr(struct dm_verity *v)mempool_destroy (f->rs_pool);mempool_destroy (f->prealloc_pool);mempool_destroy (f->extra_pool); +mempool_destroy (f->output_pool);kmem_cache_destroy (f->cache);if (f->data_bufio)
Greg Kroah-Hartman
maintainerPATCH 47/125 scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
In reply to Greg Kroah-HartmanFrom: Steffen Maier <[email protected]>
commit 819732be9fea728623e1ed84eba28def7384ad1f upstream.
v2.6.27 commit cc8c282963bd ("[SCSI] zfcp: Automatically attach remote ports") introduced zfcp automatic port scan.
Before that, the user had to use the sysfs attribute "port_add" of an FCP device (adapter) to add and open remote (target) ports, even for the remote peer port in point-to-point topology. That code path did a proper port open recovery trigger taking the erp_lock.
Since above commit, a new helper function zfcp_erp_open_ptp_port() performed an UNlocked port open recovery trigger. This can race with other parallel recovery triggers. In zfcp_erp_action_enqueue() this could corrupt e.g. adapter->erp_total_count or adapter->erp_ready_head.
As already found for fabric topology in v4.17 commit fa89adba1941 ("scsi:
zfcp: fix infinite iteration on ERP ready list"), there was an endless loop during tracing of rport (un)block. A subsequent v4.18 commit 9e156c54ace3 ("scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger") introduced a lockdep assertion for that case.
As a side effect, that lockdep assertion now uncovered the unlocked code path for PtP. It is from within an adapter ERP action:
zfcp_erp_strategy[1479] intentionally DROPs erp lock around
zfcp_erp_strategy_do_action()
zfcp_erp_strategy_do_action[1441] NO erp lock zfcp_erp_adapter_strategy[876] NO erp lock zfcp_erp_adapter_strategy_open[855] NO erp lock
zfcp_erp_adapter_strategy_open_fsf[806]NO erp lock zfcp_erp_adapter_strat_fsf_xconf[772] erp lock only around
zfcp_erp_action_to_running(), BUT *_not_* around zfcp_erp_enqueue_ptp_port()
zfcp_erp_enqueue_ptp_port[728] BUG: *_not_* taking erp lock _zfcp_erp_port_reopen[432] assumes to be called with erp lock zfcp_erp_action_enqueue[314] assumes to be called with erp lock zfcp_dbf_rec_trig[288] _checks_ to be called with erp lock: lockdep_assert_held(&adapter->erp_lock);
It causes the following lockdep warning:
WARNING: CPU: 2 PID: 775 at drivers/s390/scsi/zfcp_dbf.c:288
zfcp_dbf_rec_trig+0x16a/0x188
no locks held by zfcperp0.0.17c0/775.Fix this by using the proper locked recovery trigger helper function.
--- drivers/s390/scsi/zfcp_erp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/scsi/zfcp_erp.c +1 -1
@@ -747,7 +747,7 @@ static void zfcp_erp_enqueue_ptp_port(st adapter->peer_d_id);if (IS_ERR (port))/* error or port already attached */ return ; -_zfcp_erp_port_reopen (port,0 ,"ereptp1" ); +zfcp_erp_port_reopen (port,0 ,"ereptp1" ); }static int zfcp_erp_adapter_strat_fsf_xconf (struct zfcp_erp_action *erp_action)
Greg Kroah-Hartman
maintainerPATCH 48/125 arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
In reply to Greg Kroah-HartmanFrom: Fredrik Strupe <[email protected]>
commit fc2266011accd5aeb8ebc335c381991f20e26e33 upstream.
For thumb instructions, call_undef_hook() in traps.c first reads a u16, and if the u16 indicates a T32 instruction (u16 >= 0xe800), a second u16 is read, which then makes up the the lower half-word of a T32 instruction. For T16 instructions, the second u16 is not read, which makes the resulting u32 opcode always have the upper half set to 0.
However, having the upper half of instr_mask in the undef_hook set to 0 masks out the upper half of all thumb instructions - both T16 and T32. This results in trapped T32 instructions with the lower half-word equal to the T16 encoding of setend (b650) being matched, even though the upper half-word is not 0000 and thus indicates a T32 opcode.
An example of such a T32 instruction is eaa0b650, which should raise a SIGILL since T32 instructions with an eaa prefix are unallocated as per Arm ARM, but instead works as a SETEND because the second half-word is set to b650.
This patch fixes the issue by extending instr_mask to include the upper u32 half, which will still match T16 instructions where the upper half is 0, but not T32 instructions.
--- arch/arm64/kernel/armv8_deprecated.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/armv8_deprecated.c +1 -1
@@ -604,7 +604,7 @@ static struct undef_hook setend_hooks[] }, {/* Thumb mode */ - .instr_mask = 0x0000fff7, + .instr_mask = 0xfffffff7, .instr_val = 0x0000b650, .pstate_mask = (COMPAT_PSR_T_BIT | COMPAT_PSR_MODE_MASK), .pstate_val = (COMPAT_PSR_T_BIT | COMPAT_PSR_MODE_USR),
Greg Kroah-Hartman
maintainerPATCH 49/125 rtc: omap: Use define directive for PIN_CONFIG_ACTIVE_HIGH
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit c50156526a2f7176b50134e3e5fb108ba09791b2 upstream.
Clang warns when one enumerated type is implicitly converted to another:
drivers/rtc/rtc-omap.c:574:21: warning: implicit conversion from enumeration type 'enum rtc_pin_config_param' to different enumeration type 'enum pin_config_param' [-Wenum-conversion]
{"ti,active-high", PIN_CONFIG_ACTIVE_HIGH, 0},
~ ^~~~~~~~~~~~~~~~~~~~~~drivers/rtc/rtc-omap.c:579:12: warning: implicit conversion from enumeration type 'enum rtc_pin_config_param' to different enumeration type 'enum pin_config_param' [-Wenum-conversion]
PCONFDUMP(PIN_CONFIG_ACTIVE_HIGH, "input active high", NULL, false), ~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~./include/linux/pinctrl/pinconf-generic.h:163:11: note: expanded from macro 'PCONFDUMP'
.param = a, .display = b, .format = c, .has_arg = d \
^2 warnings generated.
It is expected that pinctrl drivers can extend pin_config_param because of the gap between PIN_CONFIG_END and PIN_CONFIG_MAX so this conversion isn't an issue. Most drivers that take advantage of this define the PIN_CONFIG variables as constants, rather than enumerated values. Do the same thing here so that Clang no longer warns.
--- drivers/rtc/rtc-omap.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/rtc/rtc-omap.c +1 -3
@@ -559,9 +559,7 @@ static const struct pinctrl_ops rtc_pinc .dt_free_map = pinconf_generic_dt_free_map, }; -enum rtc_pin_config_param { -PIN_CONFIG_ACTIVE_HIGH =PIN_CONFIG_END +1 , -}; +#define PIN_CONFIG_ACTIVE_HIGH (PIN_CONFIG_END + 1)static const struct pinconf_generic_params rtc_params[] = { {"ti,active-high" ,PIN_CONFIG_ACTIVE_HIGH ,0 },
Greg Kroah-Hartman
maintainerPATCH 50/125 ext4: fix a data race at inode->i_blocks
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
commit 28936b62e71e41600bab319f262ea9f9b1027629 upstream.
inode->i_blocks could be accessed concurrently as noticed by KCSAN,
BUG: KCSAN: data-race in ext4_do_update_inode [ext4] / inode_add_bytes
write to 0xffff9a00d4b982d0 of 8 bytes by task 22100 on cpu 118:
inode_add_bytes+0x65/0xf0 __inode_add_bytes at fs/stat.c:689 (inlined by) inode_add_bytes at fs/stat.c:702 ext4_mb_new_blocks+0x418/0xca0 [ext4] ext4_ext_map_blocks+0x1a6b/0x27b0 [ext4] ext4_map_blocks+0x1a9/0x950 [ext4] _ext4_get_block+0xfc/0x270 [ext4] ext4_get_block_unwritten+0x33/0x50 [ext4] __block_write_begin_int+0x22e/0xae0 __block_write_begin+0x39/0x50 ext4_write_begin+0x388/0xb50 [ext4] ext4_da_write_begin+0x35f/0x8f0 [ext4] generic_perform_write+0x15d/0x290 ext4_buffered_write_iter+0x11f/0x210 [ext4] ext4_file_write_iter+0xce/0x9e0 [ext4] new_sync_write+0x29c/0x3b0 __vfs_write+0x92/0xa0 vfs_write+0x103/0x260 ksys_write+0x9d/0x130 __x64_sys_write+0x4c/0x60 do_syscall_64+0x91/0xb05 entry_SYSCALL_64_after_hwframe+0x49/0xbe
read to 0xffff9a00d4b982d0 of 8 bytes by task 8 on cpu 65:
ext4_do_update_inode+0x4a0/0xf60 [ext4] ext4_inode_blocks_set at fs/ext4/inode.c:4815 ext4_mark_iloc_dirty+0xaf/0x160 [ext4] ext4_mark_inode_dirty+0x129/0x3e0 [ext4] ext4_convert_unwritten_extents+0x253/0x2d0 [ext4] ext4_convert_unwritten_io_end_vec+0xc5/0x150 [ext4] ext4_end_io_rsv_work+0x22c/0x350 [ext4] process_one_work+0x54f/0xb90 worker_thread+0x80/0x5f0 kthread+0x1cd/0x1f0 ret_from_fork+0x27/0x50
4 locks held by kworker/u256:0/8:
#0: ffff9a025abc4328 ((wq_completion)ext4-rsv-conversion){+.+.}, at: process_one_work+0x443/0xb90 #1: ffffab5a862dbe20 ((work_completion)(&ei->i_rsv_conversion_work)){+.+.}, at: process_one_work+0x443/0xb90 #2: ffff9a025a9d0f58 (jbd2_handle){++++}, at: start_this_handle+0x1c1/0x9d0 [jbd2]
#3: ffff9a00d4b985d8 (&(&ei->i_raw_lock)->rlock){+.+.}, at: ext4_do_update_inode+0xaa/0xf60 [ext4]
irq event stamp: 3009267 hardirqs last enabled at (3009267): [<ffffffff980da9b7>] __find_get_block+0x107/0x790 hardirqs last disabled at (3009266): [<ffffffff980da8f9>] __find_get_block+0x49/0x790 softirqs last enabled at (3009230): [<ffffffff98a0034c>] __do_softirq+0x34c/0x57c softirqs last disabled at (3009223): [<ffffffff97cc67a2>] irq_exit+0xa2/0xc0
Reported by Kernel Concurrency Sanitizer on:
CPU: 65 PID: 8 Comm: kworker/u256:0 Tainted: G L 5.6.0-rc2-next-20200221+ #7 Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019 Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work [ext4]
The plain read is outside of inode->i_lock critical section which results in a data race. Fix it by adding READ_ONCE() there.
--- fs/ext4/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/inode.c +1 -1
@@ -4754,7 +4754,7 @@ static int ext4_inode_blocks_set(handle_ struct ext4_inode_info *ei) {struct inode *inode = &(ei->vfs_inode); -u64 i_blocks = inode->i_blocks; +u64 i_blocks =READ_ONCE (inode->i_blocks);struct super_block *sb = inode->i_sb;if (i_blocks <= ~0U ) {
Greg Kroah-Hartman
maintainerPATCH 51/125 ocfs2: no need try to truncate file beyond i_size
In reply to Greg Kroah-HartmanFrom: Changwei Ge <[email protected]>
commit 783fda856e1034dee90a873f7654c418212d12d7 upstream.
Linux fallocate(2) with FALLOC_FL_PUNCH_HOLE mode set, its offset can exceed the inode size. Ocfs2 now doesn't allow that offset beyond inode size. This restriction is not necessary and violates fallocate(2) semantics.
If fallocate(2) offset is beyond inode size, just return success and do nothing further.
Otherwise, ocfs2 will crash the kernel.
kernel BUG at fs/ocfs2//alloc.c:7264!
ocfs2_truncate_inline+0x20f/0x360 [ocfs2] ocfs2_remove_inode_range+0x23c/0xcb0 [ocfs2] __ocfs2_change_file_space+0x4a5/0x650 [ocfs2] ocfs2_fallocate+0x83/0xa0 [ocfs2] vfs_fallocate+0x148/0x230 SyS_fallocate+0x48/0x80 do_syscall_64+0x79/0x170
--- fs/ocfs2/alloc.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ocfs2/alloc.c +4 -0
@@ -7246,6 +7246,10 @@ int ocfs2_truncate_inline(struct inode *struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;struct ocfs2_inline_data *idata = &di->id2.i_data; +/* No need to punch hole beyond i_size. */ +if (start >=i_size_read (inode)) +return 0 ; +if (end >i_size_read (inode)) end =i_size_read (inode);
Greg Kroah-Hartman
maintainerPATCH 52/125 s390/diag: fix display of diagnose call statistics
In reply to Greg Kroah-HartmanFrom: Michael Mueller <[email protected]>
commit 6c7c851f1b666a8a455678a0b480b9162de86052 upstream.
Show the full diag statistic table and not just parts of it.
The issue surfaced in a KVM guest with a number of vcpus defined smaller than NR_DIAG_STAT.
--- arch/s390/kernel/diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/diag.c +1 -1
@@ -76,7 +76,7 @@ static int show_diag_stat(struct seq_filstatic void *show_diag_stat_start (struct seq_file *m,loff_t *pos) { -return *pos <= nr_cpu_ids ? (void *)((unsigned long ) *pos +1 ) :NULL ; +return *pos <=NR_DIAG_STAT ? (void *)((unsigned long ) *pos +1 ) :NULL ; }static void *show_diag_stat_next (struct seq_file *m,void *v,loff_t *pos)
Greg Kroah-Hartman
maintainerPATCH 53/125 Input: i8042 - add Acer Aspire 5738z to nomux list
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit ebc68cedec4aead47d8d11623d013cca9bf8e825 upstream.
The Acer Aspire 5738z has a button to disable (and re-enable) the touchpad next to the touchpad.
When this button is pressed a LED underneath indicates that the touchpad is disabled (and an event is send to userspace and GNOME shows its touchpad enabled / disable OSD thingie).
So far so good, but after re-enabling the touchpad it no longer works.
The laptop does not have an external ps2 port, so mux mode is not needed and disabling mux mode fixes the touchpad no longer working after toggling it off and back on again, so lets add this laptop model to the nomux list.
--- drivers/input/serio/i8042-x86ia64io.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +11 -0
@@ -534,6 +534,17 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"), }, }, + { + /* + * Acer Aspire 5738z + * Touchpad stops working in mux mode when dis- + re-enabled + * with the touchpad enable/disable toggle hotkey + */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 54/125 kmod: make request_module() return an error when autoloading is disabled
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit d7d27cfc5cf0766a26a8f56868c5ad5434735126 upstream.
Patch series "module autoloading fixes and cleanups", v5.
This series fixes a bug where request_module() was reporting success to kernel code when module autoloading had been completely disabled via 'echo > /proc/sys/kernel/modprobe'.
It also addresses the issues raised on the original thread
(https://lkml.kernel.org/lkml/[email protected]/T/#u)
bydocumenting the modprobe sysctl, adding a self-test for the empty path case, and downgrading a user-reachable WARN_ONCE().
This patch (of 4):
It's long been possible to disable kernel module autoloading completely (while still allowing manual module insertion) by setting /proc/sys/kernel/modprobe to the empty string.
This can be preferable to setting it to a nonexistent file since it avoids the overhead of an attempted execve(), avoids potential deadlocks, and avoids the call to security_kernel_module_request() and thus on SELinux-based systems eliminates the need to write SELinux rules to dontaudit module_request.
However, when module autoloading is disabled in this way, request_module() returns 0. This is broken because callers expect 0 to mean that the module was successfully loaded.
Apparently this was never noticed because this method of disabling module autoloading isn't used much, and also most callers don't use the return value of request_module() since it's always necessary to check whether the module registered its functionality or not anyway.
But improperly returning 0 can indeed confuse a few callers, for example get_fs_type() in fs/filesystems.c where it causes a WARNING to be hit:
if (!fs && (request_module("fs-%.*s", len, name) == 0)) {
fs = __get_fs_type(name, len);
WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name);
}This is easily reproduced with:
echo > /proc/sys/kernel/modprobe
mount -t NONEXISTENT none /
It causes:
request_module fs-NONEXISTENT succeeded, but still no fs? WARNING: CPU: 1 PID: 1106 at fs/filesystems.c:275 get_fs_type+0xd6/0xf0 [...]
This should actually use pr_warn_once() rather than WARN_ONCE(), since it's also user-reachable if userspace immediately unloads the module. Regardless, request_module() should correctly return an error when it fails. So let's make it return -ENOENT, which matches the error when the modprobe binary doesn't exist.
I've also sent patches to document and test this case.
--- kernel/kmod.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/kmod.c +2 -2
@@ -119,7 +119,7 @@ out:* invoke it. * * If module auto-loading support is disabled then this function -* becomes a no-operation. +* simply returns -ENOENT. */ int __request_module (bool wait,const char *fmt, ...) {
@@ -140,7 +140,7 @@ int __request_module(bool wait, const chWARN_ON_ONCE (wait &¤t_is_async ());if (!modprobe_path[0 ]) -return 0 ; +return -ENOENT ;va_start (args, fmt); ret =vsnprintf (module_name,MODULE_NAME_LEN , fmt, args);
Greg Kroah-Hartman
maintainerPATCH 55/125 cpufreq: powernv: Fix use-after-free
In reply to Greg Kroah-HartmanFrom: Oliver O'Halloran <[email protected]>
commit d0a72efac89d1c35ac55197895201b7b94c5e6ef upstream.
The cpufreq driver has a use-after-free that we can hit if:
a) There's an OCC message pending when the notifier is registered, and
b) The cpufreq driver fails to register with the core.
When a) occurs the notifier schedules a workqueue item to handle the message. The backing work_struct is located on chips[].throttle and when b) happens we clean up by freeing the array. Once we get to the (now free) queued item and the kernel crashes.
--- drivers/cpufreq/powernv-cpufreq.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/cpufreq/powernv-cpufreq.c +6 -0
@@ -955,6 +955,12 @@ static int init_chip_info(void)static inline void clean_chip_info (void ) { +int i; + +/* flush any pending work items */ +if (chips) +for (i =0 ; i < nr_chips; i++) +cancel_work_sync (&chips[i].throttle);kfree (chips); }
Greg Kroah-Hartman
maintainerPATCH 56/125 hfsplus: fix crash and filesystem corruption when deleting files
In reply to Greg Kroah-HartmanFrom: Simon Gander <[email protected]>
commit 25efb2ffdf991177e740b2f63e92b4ec7d310a92 upstream.
When removing files containing extended attributes, the hfsplus driver may remove the wrong entries from the attributes b-tree, causing major filesystem damage and in some cases even kernel crashes.
To remove a file, all its extended attributes have to be removed as well. The driver does this by looking up all keys in the attributes b-tree with the cnid of the file. Each of these entries then gets deleted using the key used for searching, which doesn't contain the attribute's name when it should. Since the key doesn't contain the name, the deletion routine will not find the correct entry and instead remove the one in front of it. If parent nodes have to be modified, these become corrupt as well. This causes invalid links and unsorted entries that not even macOS's fsck_hfs is able to fix.
To fix this, modify the search key before an entry is deleted from the attributes b-tree by copying the found entry's key into the search key, therefore ensuring that the correct entry gets removed from the tree.
--- fs/hfsplus/attributes.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/hfsplus/attributes.c +4 -0
@@ -291,6 +291,10 @@ static int __hfsplus_delete_attr(structreturn -ENOENT ; } +/* Avoid btree corruption */ +hfs_bnode_read (fd->bnode, fd->search_key, + fd->keyoffset, fd->keylength); + err =hfs_brec_remove (fd);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 57/125 libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit 8305f72f952cff21ce8109dc1ea4b321c8efc5af upstream.
During system resume from suspend, this can be observed on ASM1062 PMP controller:
ata10.01: SATA link down (SStatus 0 SControl 330)
ata10.02: hard resetting link
ata10.02: SATA link down (SStatus 0 SControl 330)
ata10.00: configured for UDMA/133
Kernel panic - not syncing: stack-protector: Kernel in: sata_pmp_eh_recover+0xa2b/0xa40 CPU: 2 PID: 230 Comm: scsi_eh_9 Tainted: P OE #49-Ubuntu Hardware name: System manufacturer System Product 1001 12/10/2017 Call Trace: dump_stack+0x63/0x8b panic+0xe4/0x244 ? sata_pmp_eh_recover+0xa2b/0xa40 __stack_chk_fail+0x19/0x20 sata_pmp_eh_recover+0xa2b/0xa40 ? ahci_do_softreset+0x260/0x260 [libahci] ? ahci_do_hardreset+0x140/0x140 [libahci] ? ata_phys_link_offline+0x60/0x60 ? ahci_stop_engine+0xc0/0xc0 [libahci] sata_pmp_error_handler+0x22/0x30 ahci_error_handler+0x45/0x80 [libahci] ata_scsi_port_error_handler+0x29b/0x770 ? ata_scsi_cmd_error_handler+0x101/0x140 ata_scsi_error+0x95/0xd0 ? scsi_try_target_reset+0x90/0x90 scsi_error_handler+0xd0/0x5b0 kthread+0x121/0x140 ? scsi_eh_get_sense+0x200/0x200 ? kthread_create_worker_on_cpu+0x70/0x70 ret_from_fork+0x22/0x40
Kernel Offset: 0xcc00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
Since sata_pmp_eh_recover_pmp() doens't set rc when ATA_DFLAG_DETACH is set, sata_pmp_eh_recover() continues to run. During retry it triggers the stack protector.
Set correct rc in sata_pmp_eh_recover_pmp() to let sata_pmp_eh_recover() jump to pmp_fail directly.
--- drivers/ata/libata-pmp.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-pmp.c +1 -0
@@ -764,6 +764,7 @@ static int sata_pmp_eh_recover_pmp(strucif (dev->flags &ATA_DFLAG_DETACH ) { detach =1 ; + rc = -ENODEV ; goto fail; }
Greg Kroah-Hartman
maintainerPATCH 58/125 powerpc/64/tm: Dont let userspace set regs->trap via sigreturn
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit c7def7fbdeaa25feaa19caf4a27c5d10bd8789e4 upstream.
In restore_tm_sigcontexts() we take the trap value directly from the user sigcontext with no checking:
err |= __get_user(regs->trap, &sc->gp_regs[PT_TRAP]);
This means we can be in the kernel with an arbitrary regs->trap value.
Although that's not immediately problematic, there is a risk we could trigger one of the uses of CHECK_FULL_REGS():
#define CHECK_FULL_REGS(regs) BUG_ON(regs->trap & 1)
It can also cause us to unnecessarily save non-volatile GPRs again in save_nvgprs(), which shouldn't be problematic but is still wrong.
It's also possible it could trick the syscall restart machinery, which relies on regs->trap not being == 0xc00 (see 9a81c16b5275 ("powerpc:
fix double syscall restarts")), though I haven't been able to make that happen.
Finally it doesn't match the behaviour of the non-TM case, in restore_sigcontext() which zeroes regs->trap.
So change restore_tm_sigcontexts() to zero regs->trap.
This was discovered while testing Nick's upcoming rewrite of the syscall entry path. In that series the call to save_nvgprs() prior to signal handling (do_notify_resume()) is removed, which leaves the low-bit of regs->trap uncleared which can then trigger the FULL_REGS() WARNs in setup_tm_sigcontexts().
--- arch/powerpc/kernel/signal_64.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kernel/signal_64.c +3 -1
@@ -469,8 +469,10 @@ static long restore_tm_sigcontexts(struc err |=__get_user (tsk->thread.ckpt_regs.ccr, &sc->gp_regs[PT_CCR ]); +/* Don't allow userspace to set the trap value */ + regs->trap =0 ; +/* These regs are not checkpointed; they can go in 'regs'. */ - err |=__get_user (regs->trap, &sc->gp_regs[PT_TRAP ]); err |=__get_user (regs->dar, &sc->gp_regs[PT_DAR ]); err |=__get_user (regs->dsisr, &sc->gp_regs[PT_DSISR ]); err |=__get_user (regs->result, &sc->gp_regs[PT_RESULT ]);
Greg Kroah-Hartman
maintainerPATCH 59/125 Btrfs: fix crash during unmount due to race with delayed inode workers
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit f0cc2cd70164efe8f75c5d99560f0f69969c72e4 ]
During unmount we can have a job from the delayed inode items work queue still running, that can lead to at least two bad things:
1) A crash, because the worker can try to create a transaction just after the fs roots were freed;
2) A transaction leak, because the worker can create a transaction before the fs roots are freed and just after we committed the last transaction and after we stopped the transaction kthread.
A stack trace example of the crash:
[79011.691214] kernel BUG at lib/radix-tree.c:982! [79011.692056] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [79011.693180] CPU: 3 PID: 1394 Comm: kworker/u8:2 Tainted: G W 5.6.0-rc2-btrfs-next-54 #2 (...) [79011.696789] Workqueue: btrfs-delayed-meta btrfs_work_helper [btrfs] [79011.697904] RIP: 0010:radix_tree_tag_set+0xe7/0x170 (...) [79011.702014] RSP: 0018:ffffb3c84a317ca0 EFLAGS: 00010293 [79011.702949] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [79011.704202] RDX: ffffb3c84a317cb0 RSI: ffffb3c84a317ca8 RDI: ffff8db3931340a0 [79011.705463] RBP: 0000000000000005 R08: 0000000000000005 R09: ffffffff974629d0 [79011.706756] R10: ffffb3c84a317bc0 R11: 0000000000000001 R12: ffff8db393134000 [79011.708010] R13: ffff8db3931340a0 R14: ffff8db393134068 R15: 0000000000000001 [79011.709270] FS: 0000000000000000(0000) GS:ffff8db3b6a00000(0000) knlGS:0000000000000000 [79011.710699] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [79011.711710] CR2: 00007f22c2a0a000 CR3: 0000000232ad4005 CR4: 00000000003606e0 [79011.712958] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [79011.714205] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [79011.715448] Call Trace: [79011.715925] record_root_in_trans+0x72/0xf0 [btrfs] [79011.716819] btrfs_record_root_in_trans+0x4b/0x70 [btrfs] [79011.717925] start_transaction+0xdd/0x5c0 [btrfs] [79011.718829] btrfs_async_run_delayed_root+0x17e/0x2b0 [btrfs] [79011.719915] btrfs_work_helper+0xaa/0x720 [btrfs] [79011.720773] process_one_work+0x26d/0x6a0 [79011.721497] worker_thread+0x4f/0x3e0 [79011.722153] ? process_one_work+0x6a0/0x6a0 [79011.722901] kthread+0x103/0x140 [79011.723481] ? kthread_create_worker_on_cpu+0x70/0x70 [79011.724379] ret_from_fork+0x3a/0x50 (...)
The following diagram shows a sequence of steps that lead to the crash during ummount of the filesystem:
CPU 1 CPU 2 CPU 3
btrfs_punch_hole()
btrfs_btree_balance_dirty()
btrfs_balance_delayed_items()
--> sees
fs_info->delayed_root->items
with value 200, which is greater
than
BTRFS_DELAYED_BACKGROUND (128)
and smaller than
BTRFS_DELAYED_WRITEBACK (512)
btrfs_wq_run_delayed_node()
--> queues a job for
fs_info->delayed_workers to run
btrfs_async_run_delayed_root()
btrfs_async_run_delayed_root()
--> job queued by CPU 1
--> starts picking and running
delayed nodes from the
prepare_list list
close_ctree()
btrfs_delete_unused_bgs()
btrfs_commit_super()
btrfs_join_transaction()
--> gets transaction N
btrfs_commit_transaction(N)
--> set transaction state
to TRANTS_STATE_COMMIT_START
btrfs_first_prepared_delayed_node()
--> picks delayed node X through
the prepared_list list
btrfs_run_delayed_items()
btrfs_first_delayed_node()
--> also picks delayed node X
but through the node_list
list
__btrfs_commit_inode_delayed_items()
--> runs all delayed items from
this node and drops the
node's item count to 0
through call to
btrfs_release_delayed_inode()
--> finishes running any remaining
delayed nodes
--> finishes transaction commit
--> stops cleaner and transaction threads
btrfs_free_fs_roots()
--> frees all roots and removes them
from the radix tree
fs_info->fs_roots_radix
btrfs_join_transaction()
start_transaction()
btrfs_record_root_in_trans()
record_root_in_trans()
radix_tree_tag_set()
--> crashes because
the root is not in
the radix tree
anymoreIf the worker is able to call btrfs_join_transaction() before the unmount task frees the fs roots, we end up leaking a transaction and all its resources, since after the call to btrfs_commit_super() and stopping the transaction kthread, we don't expect to have any transaction open anymore.
When this situation happens the worker has a delayed node that has no more items to run, since the task calling btrfs_run_delayed_items(), which is doing a transaction commit, picks the same node and runs all its items first.
We can not wait for the worker to complete when running delayed items through btrfs_run_delayed_items(), because we call that function in several phases of a transaction commit, and that could cause a deadlock because the worker calls btrfs_join_transaction() and the task doing the transaction commit may have already set the transaction state to TRANS_STATE_COMMIT_DOING.
Also it's not possible to get into a situation where only some of the items of a delayed node are added to the fs/subvolume tree in the current transaction and the remaining ones in the next transaction, because when running the items of a delayed inode we lock its mutex, effectively waiting for the worker if the worker is running the items of the delayed node already.
Since this can only cause issues when unmounting a filesystem, fix it in a simple way by waiting for any jobs on the delayed workers queue before calling btrfs_commit_supper() at close_ctree(). This works because at this point no one can call btrfs_btree_balance_dirty() or btrfs_balance_delayed_items(), and if we end up waiting for any worker to complete, btrfs_commit_super() will commit the transaction created by the worker.
--- fs/btrfs/async-thread.c | 8 ++++++++ fs/btrfs/async-thread.h | 2 ++ fs/btrfs/disk-io.c | 13 +++++++++++++ 3 files changed, 23 insertions(+)
fs/btrfs/async-thread.c +8 -0
@@ -447,3 +447,11 @@ void btrfs_set_work_high_priority(struct btrfs_work *work) {set_bit (WORK_HIGH_PRIO_BIT , &work->flags); } + +void btrfs_flush_workqueue (struct btrfs_workqueue *wq) +{ +if (wq->high) +flush_workqueue (wq->high->normal_wq); + +flush_workqueue (wq->normal->normal_wq); +}
fs/btrfs/async-thread.h +2 -0
@@ -85,4 +85,6 @@ void btrfs_set_work_high_priority(struct btrfs_work *work);struct btrfs_fs_info *btrfs_work_owner (struct btrfs_work *work);struct btrfs_fs_info *btrfs_workqueue_owner (struct __btrfs_workqueue *wq);bool btrfs_workqueue_normal_congested (struct btrfs_workqueue *wq); +void btrfs_flush_workqueue (struct btrfs_workqueue *wq); +#endif
fs/btrfs/disk-io.c +13 -0
@@ -3825,6 +3825,19 @@ void close_ctree(struct btrfs_root *root)*/ btrfs_delete_unused_bgs (root->fs_info); +/* +* There might be existing delayed inode workers still running +* and holding an empty delayed inode item. We must wait for +* them to complete first because they can create a transaction. +* This happens when someone calls btrfs_balance_delayed_items() +* and then a transaction commit runs the same delayed nodes +* before any delayed worker has done something with the nodes. +* We must wait for any worker here and not at transaction +* commit time since that could cause a deadlock. +* This is a very rare case. +*/ +btrfs_flush_workqueue (fs_info->delayed_workers); + ret =btrfs_commit_super (root);if (ret)btrfs_err (fs_info,"commit super ret %d" , ret);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/125 drm/dp_mst: Fix clearing payload state on topology disable
In reply to Greg Kroah-HartmanFrom: Lyude Paul <[email protected]>
[ Upstream commit 8732fe46b20c951493bfc4dba0ad08efdf41de81 ]
The issues caused by:
commit 64e62bdf04ab ("drm/dp_mst: Remove VCPI while disabling topology mgr")
Prompted me to take a closer look at how we clear the payload state in general when disabling the topology, and it turns out there's actually two subtle issues here.
The first is that we're not grabbing &mgr.payload_lock when clearing the payloads in drm_dp_mst_topology_mgr_set_mst(). Seeing as the canonical lock order is &mgr.payload_lock -> &mgr.lock (because we always want &mgr.lock to be the inner-most lock so topology validation always works), this makes perfect sense. It also means that -technically- there could be racing between someone calling drm_dp_mst_topology_mgr_set_mst() to disable the topology, along with a modeset occurring that's modifying the payload state at the same time.
The second is the more obvious issue that Wayne Lin discovered, that we're not clearing proposed_payloads when disabling the topology.
I actually can't see any obvious places where the racing caused by the first issue would break something, and it could be that some of our higher-level locks already prevent this by happenstance, but better safe then sorry. So, let's make it so that drm_dp_mst_topology_mgr_set_mst() first grabs &mgr.payload_lock followed by &mgr.lock so that we never race when modifying the payload state. Then, we also clear proposed_payloads to fix the original issue of enabling a new topology with a dirty payload state. This doesn't clear any of the drm_dp_vcpi structures, but those are getting destroyed along with the ports anyway.
Changes since v1:
* Use sizeof(mgr->payloads[0])/sizeof(mgr->proposed_vcpis[0]) instead - vsyrjala
--- drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_dp_mst_topology.c +6 -1
@@ -2034,6 +2034,7 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool msint ret =0 ;struct drm_dp_mst_branch *mstb =NULL ; +mutex_lock (&mgr->payload_lock);mutex_lock (&mgr->lock);if (mst_state == mgr->mst_state) goto out_unlock;
@@ -2096,7 +2097,10 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms/* this can fail if the device is gone */ drm_dp_dpcd_writeb (mgr->aux,DP_MSTM_CTRL ,0 ); ret =0 ; -memset (mgr->payloads,0 , mgr->max_payloads *sizeof (struct drm_dp_payload )); +memset (mgr->payloads,0 , + mgr->max_payloads *sizeof (mgr->payloads[0 ])); +memset (mgr->proposed_vcpis,0 , + mgr->max_payloads *sizeof (mgr->proposed_vcpis[0 ])); mgr->payload_mask =0 ;set_bit (0 , &mgr->payload_mask); mgr->vcpi_mask =0 ;
@@ -2104,6 +2108,7 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms out_unlock:mutex_unlock (&mgr->lock); +mutex_unlock (&mgr->payload_lock);if (mstb)drm_dp_put_mst_branch_device (mstb);return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/125 drm: Remove PageReserved manipulation from drm_pci_alloc
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit ea36ec8623f56791c6ff6738d0509b7920f85220 ]
drm_pci_alloc/drm_pci_free are very thin wrappers around the core dma facilities, and we have no special reason within the drm layer to behave differently. In particular, since
commit de09d31dd38a50fdce106c15abd68432eebbd014
Author: Kirill A. Shutemov <[email protected]> Date: Fri Jan 15 16:51:42 2016 -0800
page-flags: define PG_reserved behavior on compound pages
As far as I can see there's no users of PG_reserved on compound pages. Let's use PF_NO_COMPOUND here.
it has been illegal to combine GFP_COMP with SetPageReserved, so lets stop doing both and leave the dma layer to its own devices.
--- drivers/gpu/drm/drm_pci.c | 25 ++----------------------- 1 file changed, 2 insertions(+), 23 deletions(-)
drivers/gpu/drm/drm_pci.c +2 -23
@@ -42,8 +42,6 @@drm_dma_handle_t *drm_pci_alloc (struct drm_device * dev,size_t size,size_t align) {drm_dma_handle_t *dmah; -unsigned long addr; -size_t sz;/* pci_alloc_consistent only guarantees alignment to the smallest * PAGE_SIZE order which is greater than or equal to the requested size.
@@ -57,22 +55,13 @@ drm_dma_handle_t *drm_pci_alloc(struct drm_device * dev, size_t size, size_t alireturn NULL ; dmah->size = size; - dmah->vaddr =dma_alloc_coherent (&dev->pdev->dev, size, &dmah->busaddr,GFP_KERNEL | __GFP_COMP); + dmah->vaddr =dma_alloc_coherent (&dev->pdev->dev, size, &dmah->busaddr,GFP_KERNEL );if (dmah->vaddr ==NULL ) {kfree (dmah);return NULL ; } -memset (dmah->vaddr,0 , size); - -/* XXX - Is virt_to_page() legal for consistent mem? */ -/* Reserve */ -for (addr = (unsigned long )dmah->vaddr, sz = size; - sz >0 ; addr +=PAGE_SIZE , sz -=PAGE_SIZE ) { -SetPageReserved (virt_to_page ((void *)addr)); - } -return dmah; }
@@ -85,19 +74,9 @@ EXPORT_SYMBOL(drm_pci_alloc);*/ void __drm_legacy_pci_free (struct drm_device * dev,drm_dma_handle_t * dmah) { -unsigned long addr; -size_t sz; - -if (dmah->vaddr) { -/* XXX - Is virt_to_page() legal for consistent mem? */ -/* Unreserve */ -for (addr = (unsigned long )dmah->vaddr, sz = dmah->size; - sz >0 ; addr +=PAGE_SIZE , sz -=PAGE_SIZE ) { -ClearPageReserved (virt_to_page ((void *)addr)); - } +if (dmah->vaddr)dma_free_coherent (&dev->pdev->dev, dmah->size, dmah->vaddr, dmah->busaddr); - } }/**
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/125 ipmi: fix hung processes in __get_guid()
In reply to Greg Kroah-HartmanFrom: Wen Yang <[email protected]>
[ Upstream commit 32830a0534700f86366f371b150b17f0f0d140d7 ]
The wait_event() function is used to detect command completion. When send_guid_cmd() returns an error, smi_send() has not been called to send data. Therefore, wait_event() should not be used on the error path, otherwise it will cause the following warning:
[ 1361.588808] systemd-udevd D 0 1501 1436 0x00000004 [ 1361.588813] ffff883f4b1298c0 0000000000000000 ffff883f4b188000 ffff887f7e3d9f40 [ 1361.677952] ffff887f64bd4280 ffffc90037297a68 ffffffff8173ca3b ffffc90000000010 [ 1361.767077] 00ffc90037297ad0 ffff887f7e3d9f40 0000000000000286 ffff883f4b188000 [ 1361.856199] Call Trace: [ 1361.885578] [<ffffffff8173ca3b>] ? __schedule+0x23b/0x780 [ 1361.951406] [<ffffffff8173cfb6>] schedule+0x36/0x80 [ 1362.010979] [<ffffffffa071f178>] get_guid+0x118/0x150 [ipmi_msghandler] [ 1362.091281] [<ffffffff810d5350>] ? prepare_to_wait_event+0x100/0x100 [ 1362.168533] [<ffffffffa071f755>] ipmi_register_smi+0x405/0x940 [ipmi_msghandler] [ 1362.258337] [<ffffffffa0230ae9>] try_smi_init+0x529/0x950 [ipmi_si] [ 1362.334521] [<ffffffffa022f350>] ? std_irq_setup+0xd0/0xd0 [ipmi_si] [ 1362.411701] [<ffffffffa0232bd2>] init_ipmi_si+0x492/0x9e0 [ipmi_si] [ 1362.487917] [<ffffffffa0232740>] ? ipmi_pci_probe+0x280/0x280 [ipmi_si] [ 1362.568219] [<ffffffff810021a0>] do_one_initcall+0x50/0x180 [ 1362.636109] [<ffffffff812231b2>] ? kmem_cache_alloc_trace+0x142/0x190 [ 1362.714330] [<ffffffff811b2ae1>] do_init_module+0x5f/0x200 [ 1362.781208] [<ffffffff81123ca8>] load_module+0x1898/0x1de0 [ 1362.848069] [<ffffffff811202e0>] ? __symbol_put+0x60/0x60 [ 1362.913886] [<ffffffff8130696b>] ? security_kernel_post_read_file+0x6b/0x80 [ 1362.998514] [<ffffffff81124465>] SYSC_finit_module+0xe5/0x120 [ 1363.068463] [<ffffffff81124465>] ? SYSC_finit_module+0xe5/0x120 [ 1363.140513] [<ffffffff811244be>] SyS_finit_module+0xe/0x10 [ 1363.207364] [<ffffffff81003c04>] do_syscall_64+0x74/0x180
Message-Id: <[email protected]>
--- drivers/char/ipmi/ipmi_msghandler.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/char/ipmi/ipmi_msghandler.c +3 -1
@@ -2646,7 +2646,9 @@ get_guid(ipmi_smi_t intf)if (rv)/* Send failed, no GUID available. */ intf->bmc->guid_set =0 ; -wait_event (intf->waitq, intf->bmc->guid_set !=2 ); +else +wait_event (intf->waitq, intf->bmc->guid_set !=2 ); + intf->null_user_handler =NULL ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/125 powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
In reply to Greg Kroah-HartmanFrom: Laurentiu Tudor <[email protected]>
[ Upstream commit aa4113340ae6c2811e046f08c2bc21011d20a072 ]
In the current implementation, the call to loadcam_multi() is wrapped between switch_to_as1() and restore_to_as0() calls so, when it tries to create its own temporary AS=1 TLB1 entry, it ends up duplicating the existing one created by switch_to_as1(). Add a check to skip creating the temporary entry if already running in AS=1.
--- arch/powerpc/mm/tlb_nohash_low.S | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
arch/powerpc/mm/tlb_nohash_low.S +11 -1
@@ -400,7 +400,7 @@ _GLOBAL(set_context) * extern void loadcam_entry(unsigned int index) * * Load TLBCAM[index] entry in to the L2 CAM MMU - * Must preserve r7, r8, r9, and r10 + * Must preserve r7, r8, r9, r10 and r11 */ _GLOBAL(loadcam_entry) mflr r5
@@ -436,6 +436,10 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_BIG_PHYS) */ _GLOBAL(loadcam_multi) mflr r8 + /* Don't switch to AS=1 if already there */ + mfmsr r11 + andi. r11,r11,MSR_IS + bne 10f /* * Set up temporary TLB entry that is the same as what we're
@@ -461,6 +465,7 @@ _GLOBAL(loadcam_multi) mtmsr r6 isync +10: mr r9,r3 add r10,r3,r4 2: bl loadcam_entry
@@ -469,6 +474,10 @@ _GLOBAL(loadcam_multi) mr r3,r9 blt 2b + /* Don't return to AS=0 if we were in AS=1 at function start */ + andi. r11,r11,MSR_IS + bne 3f + /* Return to AS=0 and clear the temporary entry */ mfmsr r6 rlwinm. r6,r6,0,~(MSR_IS|MSR_DS)
@@ -484,6 +493,7 @@ _GLOBAL(loadcam_multi) tlbwe isync +3: mtlr r8 blr #endif
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/125 misc: echo: Remove unnecessary parentheses and simplify check for zero
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 85dc2c65e6c975baaf36ea30f2ccc0a36a8c8add ]
Clang warns when multiple pairs of parentheses are used for a single conditional statement.
drivers/misc/echo/echo.c:384:27: warning: equality comparison with extraneous parentheses [-Wparentheses-equality]
if ((ec->nonupdate_dwell == 0)) {
~~~~~~~~~~~~~~~~~~~~^~~~drivers/misc/echo/echo.c:384:27: note: remove extraneous parentheses around the comparison to silence this warning
if ((ec->nonupdate_dwell == 0)) {
~ ^ ~drivers/misc/echo/echo.c:384:27: note: use '=' to turn this equality comparison into an assignment
if ((ec->nonupdate_dwell == 0)) {
^~
=1 warning generated.
Remove them and while we're at it, simplify the zero check as '!var' is used more than 'var == 0'.
--- drivers/misc/echo/echo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/echo/echo.c +1 -1
@@ -454,7 +454,7 @@ int16_t oslec_update(struct oslec_state *ec, int16_t tx, int16_t rx)*/ ec->factor =0 ; ec->shift =0 ; -if ((ec->nonupdate_dwell ==0 )) { +if (!ec->nonupdate_dwell) {int p, logp, shift;/* Determine:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/125 mfd: dln2: Fix sanity checking for endpoints
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit fb945c95a482200876993977008b67ea658bd938 ]
While the commit 2b8bd606b1e6 ("mfd: dln2: More sanity checking for endpoints") tries to harden the sanity checks it made at the same time a regression, i.e. mixed in and out endpoints. Obviously it should have been not tested on real hardware at that time, but unluckily it didn't happen.
So, fix above mentioned typo and make device being enumerated again.
While here, introduce an enumerator for magic values to prevent similar issue to happen in the future.
--- drivers/mfd/dln2.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/mfd/dln2.c +7 -2
@@ -93,6 +93,11 @@ struct dln2_mod_rx_slots {spinlock_t lock; }; +enum dln2_endpoint { +DLN2_EP_OUT =0 , +DLN2_EP_IN =1 , +}; +struct dln2_dev {struct usb_device *usb_dev;struct usb_interface *interface;
@@ -740,10 +745,10 @@ static int dln2_probe(struct usb_interface *interface, hostif->desc.bNumEndpoints < 2)return -ENODEV ; - epin = &hostif->endpoint[0 ].desc; - epout = &hostif->endpoint[1 ].desc; + epout = &hostif->endpoint[DLN2_EP_OUT ].desc;if (!usb_endpoint_is_bulk_out (epout))return -ENODEV ; + epin = &hostif->endpoint[DLN2_EP_IN ].desc;if (!usb_endpoint_is_bulk_in (epin))return -ENODEV ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/125 hsr: check protocol version in hsr_newlink()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 4faab8c446def7667adf1f722456c2f4c304069c ]
In the current hsr code, only 0 and 1 protocol versions are valid. But current hsr code doesn't check the version, which is received by userspace.
Test commands:
ip link add dummy0 type dummy
ip link add dummy1 type dummy
ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1 version 4
In the test commands, version 4 is invalid.
So, the command should be failed.
After this patch, following error will occur.
"Error: hsr: Only versions 0..1 are supported."
--- net/hsr/hsr_netlink.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/hsr/hsr_netlink.c +7 -2
@@ -63,10 +63,15 @@ static int hsr_newlink(struct net *src_nelse multicast_spec =nla_get_u8 (data[IFLA_HSR_MULTICAST_SPEC ]); -if (!data[IFLA_HSR_VERSION ]) +if (!data[IFLA_HSR_VERSION ]) { hsr_version =0 ; -else + }else { hsr_version =nla_get_u8 (data[IFLA_HSR_VERSION ]); +if (hsr_version >1 ) { +netdev_info (dev,"Only versions 0..1 are supported" ); +return -EINVAL ; + } + }return hsr_dev_finalize (dev, link, multicast_spec, hsr_version); }
Greg Kroah-Hartman
maintainerPATCH 67/125 net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
In reply to Greg Kroah-HartmanFrom: Taras Chornyi <[email protected]>
[ Upstream commit 690cc86321eb9bcee371710252742fb16fe96824 ]
When CONFIG_IP_MULTICAST is not set and multicast ip is added to the device with autojoin flag or when multicast ip is deleted kernel will crash.
steps to reproduce:
ip addr add 224.0.0.0/32 dev eth0
ip addr del 224.0.0.0/32 dev eth0
or
ip addr add 224.0.0.0/32 dev eth0 autojoin
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088 pc : _raw_write_lock_irqsave+0x1e0/0x2ac lr : lock_sock_nested+0x1c/0x60 Call trace: _raw_write_lock_irqsave+0x1e0/0x2ac lock_sock_nested+0x1c/0x60 ip_mc_config.isra.28+0x50/0xe0 inet_rtm_deladdr+0x1a8/0x1f0 rtnetlink_rcv_msg+0x120/0x350 netlink_rcv_skb+0x58/0x120 rtnetlink_rcv+0x14/0x20 netlink_unicast+0x1b8/0x270 netlink_sendmsg+0x1a0/0x3b0 ____sys_sendmsg+0x248/0x290 ___sys_sendmsg+0x80/0xc0 __sys_sendmsg+0x68/0xc0 __arm64_sys_sendmsg+0x20/0x30 el0_svc_common.constprop.2+0x88/0x150 do_el0_svc+0x20/0x80 el0_sync_handler+0x118/0x190 el0_sync+0x140/0x180
--- net/ipv4/devinet.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/ipv4/devinet.c +9 -4
@@ -560,12 +560,15 @@ struct in_ifaddr *inet_ifa_byprefix(strureturn NULL ; } -static int ip_mc_config (struct sock *sk,bool join,const struct in_ifaddr *ifa) +static int ip_mc_autojoin_config (struct net *net,bool join, +const struct in_ifaddr *ifa) { +#if defined(CONFIG_IP_MULTICAST )struct ip_mreqn mreq = { .imr_multiaddr.s_addr = ifa->ifa_address, .imr_ifindex = ifa->ifa_dev->dev->ifindex, }; +struct sock *sk = net->ipv4.mc_autojoin_sk;int ret;ASSERT_RTNL ();
@@ -578,6 +581,9 @@ static int ip_mc_config(struct sock *sk,release_sock (sk);return ret; +#else +return -EOPNOTSUPP ; +#endif }static int inet_rtm_deladdr (struct sk_buff *skb,struct nlmsghdr *nlh)
@@ -617,7 +623,7 @@ static int inet_rtm_deladdr(struct sk_bucontinue ;if (ipv4_is_multicast (ifa->ifa_address)) -ip_mc_config (net->ipv4.mc_autojoin_sk, false, ifa); +ip_mc_autojoin_config (net, false, ifa);__inet_del_ifa (in_dev, ifap,1 , nlh,NETLINK_CB (skb).portid);return 0 ; }
@@ -873,8 +879,7 @@ static int inet_rtm_newaddr(struct sk_bu*/ set_ifa_lifetime (ifa, valid_lft, prefered_lft);if (ifa->ifa_flags &IFA_F_MCAUTOJOIN ) { -int ret =ip_mc_config (net->ipv4.mc_autojoin_sk, - true, ifa); +int ret =ip_mc_autojoin_config (net, true, ifa);if (ret <0 ) {inet_free_ifa (ifa);
Greg Kroah-Hartman
maintainerPATCH 68/125 net: qrtr: send msgs from local of same id as broadcast
In reply to Greg Kroah-HartmanFrom: Wang Wenhu <[email protected]>
[ Upstream commit 6dbf02acef69b0742c238574583b3068afbd227c ]
If the local node id(qrtr_local_nid) is not modified after its initialization, it equals to the broadcast node id(QRTR_NODE_BCAST). So the messages from local node should not be taken as broadcast and keep the process going to send them out anyway.
The definitions are as follow:
static unsigned int qrtr_local_nid = NUMA_NO_NODE;
--- net/qrtr/qrtr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/qrtr/qrtr.c +4 -3
@@ -621,20 +621,21 @@ static int qrtr_sendmsg(struct socket *s node =NULL ;if (addr->sq_node ==QRTR_NODE_BCAST ) { - enqueue_fn = qrtr_bcast_enqueue; -if (addr->sq_port !=QRTR_PORT_CTRL ) { +if (addr->sq_port !=QRTR_PORT_CTRL && + qrtr_local_nid !=QRTR_NODE_BCAST ) {release_sock (sk);return -ENOTCONN ; } + enqueue_fn = qrtr_bcast_enqueue; }else if (addr->sq_node == ipc->us.sq_node) { enqueue_fn = qrtr_local_enqueue; }else { - enqueue_fn = qrtr_node_enqueue; node =qrtr_node_lookup (addr->sq_node);if (!node) {release_sock (sk);return -ECONNRESET ; } + enqueue_fn = qrtr_node_enqueue; } plen = (len +3 ) & ~3 ;
Greg Kroah-Hartman
maintainerPATCH 69/125 net: ipv6: do not consider routes via gateways for anycast address check
In reply to Greg Kroah-HartmanFrom: Tim Stallard <[email protected]>
[ Upstream commit 03e2a984b6165621f287fadf5f4b5cd8b58dcaba ]
The behaviour for what is considered an anycast address changed in commit 45e4fd26683c ("ipv6: Only create RTF_CACHE routes after encountering pmtu exception"). This now considers the first address in a subnet where there is a route via a gateway to be an anycast address.
This breaks path MTU discovery and traceroutes when a host in a remote network uses the address at the start of a prefix (eg 2600:: advertised as 2600::/48 in the DFZ) as ICMP errors will not be sent to anycast addresses.
This patch excludes any routes with a gateway, or via point to point links, like the behaviour previously from rt6_is_gw_or_nonexthop in net/ipv6/route.c.
This can be tested with:
ip link add v1 type veth peer name v2
ip netns add test
ip netns exec test ip link set lo up
ip link set v2 netns test
ip link set v1 up
ip netns exec test ip link set v2 up
ip addr add 2001:db8::1/64 dev v1 nodad
ip addr add 2001:db8:100:: dev lo nodad
ip netns exec test ip addr add 2001:db8::2/64 dev v2 nodad ip netns exec test ip route add unreachable 2001:db8:1::1 ip netns exec test ip route add 2001:db8:100::/64 via 2001:db8::1 ip netns exec test sysctl net.ipv6.conf.all.forwarding=1 ip route add 2001:db8:1::1 via 2001:db8::2
ping -I 2001:db8::1 2001:db8:1::1 -c1
ping -I 2001:db8:100:: 2001:db8:1::1 -c1
ip addr delete 2001:db8:100:: dev lo
ip netns delete test
Currently the first ping will get back a destination unreachable ICMP error, but the second will never get a response, with "icmp6_send:
acast source" logged. After this patch, both get destination unreachable ICMP replies.
--- include/net/ip6_route.h | 1 + 1 file changed, 1 insertion(+)
include/net/ip6_route.h +1 -0
@@ -195,6 +195,7 @@ static inline bool ipv6_anycast_destinatreturn rt->rt6i_flags &RTF_ANYCAST || (rt->rt6i_dst.plen !=128 && + !(rt->rt6i_flags & (RTF_GATEWAY |RTF_NONEXTHOP )) &&ipv6_addr_equal (&rt->rt6i_dst.addr, daddr)); }
Greg Kroah-Hartman
maintainerPATCH 70/125 scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic
In reply to Greg Kroah-HartmanFrom: Can Guo <[email protected]>
commit c63d6099a7959ecc919b2549dc6b71f53521f819 upstream.
The async version of ufshcd_hold(async == true), which is only called in queuecommand path as for now, is expected to work in atomic context, thus it should not sleep or schedule out. When it runs into the condition that clocks are ON but link is still in hibern8 state, it should bail out without flushing the clock ungate work.
--- drivers/scsi/ufs/ufshcd.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/scsi/ufs/ufshcd.c +5 -0
@@ -682,6 +682,11 @@ start:*/ if (ufshcd_can_hibern8_during_gating (hba) &&ufshcd_is_link_hibern8 (hba)) { +if (async) { + rc = -EAGAIN ; + hba->clk_gating.active_reqs--; +break ; + }spin_unlock_irqrestore (hba->host->host_lock, flags);flush_work (&hba->clk_gating.ungate_work);spin_lock_irqsave (hba->host->host_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 71/125 jbd2: improve comments about freeing data buffers whose page mapping is NULL
In reply to Greg Kroah-HartmanFrom: zhangyi (F) <[email protected]>
commit 780f66e59231fcf882f36c63f287252ee47cc75a upstream.
Improve comments in jbd2_journal_commit_transaction() to describe why we don't need to clear the buffer_mapped bit for freeing file mapping buffers whose page mapping is NULL.
--- fs/jbd2/commit.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/jbd2/commit.c +4 -3
@@ -990,9 +990,10 @@ restart_loop:* journalled data) we need to unmap buffer and clear * more bits. We also need to be careful about the check * because the data page mapping can get cleared under -* out hands, which alse need not to clear more bits -* because the page and buffers will be freed and can -* never be reused once we are done with them. +* our hands. Note that if mapping == NULL, we don't +* need to make buffer unmapped because the page is +* already detached from the mapping and buffers cannot +* get reused. */ mapping =READ_ONCE (bh->b_page->mapping);if (mapping && !sb_is_blkdev_sb (mapping->host->i_sb)) {
Greg Kroah-Hartman
maintainerPATCH 72/125 ext4: fix incorrect group count in ext4_fill_super error message
In reply to Greg Kroah-HartmanFrom: Josh Triplett <[email protected]>
commit df41460a21b06a76437af040d90ccee03888e8e5 upstream.
ext4_fill_super doublechecks the number of groups before mounting; if that check fails, the resulting error message prints the group count from the ext4_sb_info sbi, which hasn't been set yet. Print the freshly computed group count instead (which at that point has just been computed in "blocks_count").
--- fs/ext4/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/super.c +2 -2
@@ -3951,9 +3951,9 @@ static int ext4_fill_super(struct super_ EXT4_BLOCKS_PER_GROUP(sb) - 1);do_div (blocks_count,EXT4_BLOCKS_PER_GROUP (sb));if (blocks_count > ((uint64_t )1 <<32 ) -EXT4_DESC_PER_BLOCK (sb)) { -ext4_msg (sb,KERN_WARNING ,"groups count too large: %u " +ext4_msg (sb,KERN_WARNING ,"groups count too large: %llu " "(block count %llu, first data block %u, " -"blocks per group %lu)" , sbi->s_groups_count, +"blocks per group %lu)" , blocks_count,ext4_blocks_count (es),le32_to_cpu (es->s_first_data_block),EXT4_BLOCKS_PER_GROUP (sb));
Greg Kroah-Hartman
maintainerPATCH 73/125 ext4: fix incorrect inodes per group in error message
In reply to Greg Kroah-HartmanFrom: Josh Triplett <[email protected]>
commit b9c538da4e52a7b79dfcf4cfa487c46125066dfb upstream.
If ext4_fill_super detects an invalid number of inodes per group, the resulting error message printed the number of blocks per group, rather than the number of inodes per group. Fix it to print the correct value.
--- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/super.c +1 -1
@@ -3820,7 +3820,7 @@ static int ext4_fill_super(struct super_if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || sbi->s_inodes_per_group > blocksize *8 ) {ext4_msg (sb,KERN_ERR ,"invalid inodes per group: %lu\n" , - sbi->s_blocks_per_group); + sbi->s_inodes_per_group); goto failed_mount; } sbi->s_itb_per_group = sbi->s_inodes_per_group /
Greg Kroah-Hartman
maintainerPATCH 74/125 ASoC: Intel: mrfld: fix incorrect check on p->sink
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit f5e056e1e46fcbb5f74ce560792aeb7d57ce79e6 upstream.
The check on p->sink looks bogus, I believe it should be p->source since the following code blocks are related to p->source. Fix this by replacing p->sink with p->source.
Addresses-Coverity: ("Copy-paste error")
--- sound/soc/intel/atom/sst-atom-controls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/atom/sst-atom-controls.c +1 -1
@@ -1343,7 +1343,7 @@ int sst_send_pipe_gains(struct snd_soc_d dai->capture_widget->name); w = dai->capture_widget;snd_soc_dapm_widget_for_each_source_path (w, p) { -if (p->connected && !p->connected (w, p->sink)) +if (p->connected && !p->connected (w, p->source))continue ; if (p->connect && p->source->power &&
Greg Kroah-Hartman
maintainerPATCH 75/125 ASoC: Intel: mrfld: return error codes when an error occurs
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 3025571edd9df653e1ad649f0638368a39d1bbb5 upstream.
Currently function sst_platform_get_resources always returns zero and error return codes set by the function are never returned. Fix this by returning the error return code in variable ret rather than the hard coded zero.
Addresses-Coverity: ("Unused value")
--- sound/soc/intel/atom/sst/sst_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/atom/sst/sst_pci.c +1 -1
@@ -107,7 +107,7 @@ static int sst_platform_get_resources(stdev_dbg (ctx->dev,"DRAM Ptr %p\n" , ctx->dram); do_release_regions:pci_release_regions (pci); -return 0 ; +return ret; }/*
Greg Kroah-Hartman
maintainerPATCH 76/125 ALSA: usb-audio: Dont override ignore_ctl_error value from the map
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 3507245b82b4362dc9721cbc328644905a3efa22 upstream.
The mapping table may contain also ignore_ctl_error flag for devices that are known to behave wild. Since this flag always writes the card's own ignore_ctl_error flag, it overrides the value already set by the module option, so it doesn't follow user's expectation. Let's fix the code not to clear the flag that has been set by user.
--- sound/usb/mixer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/mixer.c +1 -1
@@ -2336,7 +2336,7 @@ static int snd_usb_mixer_controls(structif (map->id == state.chip->usb_id) { state.map = map->map; state.selector_map = map->selector_map; - mixer->ignore_ctl_error = map->ignore_ctl_error; + mixer->ignore_ctl_error |= map->ignore_ctl_error;break ; } }
Greg Kroah-Hartman
maintainerPATCH 77/125 btrfs: check commit root generation in should_ignore_root
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 4d4225fc228e46948486d8b8207955f0c031b92e upstream.
Previously we would set the reloc root's last snapshot to transid - 1. However there was a problem with doing this, and we changed it to setting the last snapshot to the generation of the commit node of the fs root.
This however broke should_ignore_root(). The assumption is that if we are in a generation newer than when the reloc root was created, then we would find the reloc root through normal backref lookups, and thus can ignore any fs roots we find with an old enough reloc root.
Now that the last snapshot could be considerably further in the past than before, we'd end up incorrectly ignoring an fs root. Thus we'd find no nodes for the bytenr we were searching for, and we'd fail to relocate anything. We'd loop through the relocate code again and see that there were still used space in that block group, attempt to relocate those bytenr's again, fail in the same way, and just loop like this forever. This is tricky in that we have to not modify the fs root at all during this time, so we need to have a block group that has data in this fs root that is not shared by any other root, which is why this has been difficult to reproduce.
--- fs/btrfs/relocation.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/relocation.c +2 -2
@@ -537,8 +537,8 @@ static int should_ignore_root(struct btrif (!reloc_root)return 0 ; -if (btrfs_root_last_snapshot (&reloc_root->root_item) == - root->fs_info->running_transaction->transid -1 ) +if (btrfs_header_generation (reloc_root->commit_root) == + root->fs_info->running_transaction->transid)return 0 ;/* * if there is reloc tree and it was created in previous
Greg Kroah-Hartman
maintainerPATCH 78/125 mac80211_hwsim: Use kstrndup() in place of kasprintf()
In reply to Greg Kroah-HartmanFrom: Tuomas Tynkkynen <[email protected]>
commit 7ea862048317aa76d0f22334202779a25530980c upstream.
syzbot reports a warning:
precision 33020 too large
WARNING: CPU: 0 PID: 9618 at lib/vsprintf.c:2471 set_precision+0x150/0x180 lib/vsprintf.c:2471 vsnprintf+0xa7b/0x19a0 lib/vsprintf.c:2547 kvasprintf+0xb2/0x170 lib/kasprintf.c:22 kasprintf+0xbb/0xf0 lib/kasprintf.c:59 hwsim_del_radio_nl+0x63a/0x7e0 drivers/net/wireless/mac80211_hwsim.c:3625 genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline] ... entry_SYSCALL_64_after_hwframe+0x49/0xbe
Thus it seems that kasprintf() with "%.*s" format can not be used for duplicating a string with arbitrary length. Replace it with kstrndup().
Note that later this string is limited to NL80211_WIPHY_NAME_MAXLEN == 64, but the code is simpler this way.
--- drivers/net/wireless/mac80211_hwsim.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/wireless/mac80211_hwsim.c +6 -6
@@ -3060,9 +3060,9 @@ static int hwsim_new_radio_nl(struct sk_ param.no_vif = true;if (info->attrs[HWSIM_ATTR_RADIO_NAME ]) { - hwname =kasprintf (GFP_KERNEL ,"%.*s" , -nla_len (info->attrs[HWSIM_ATTR_RADIO_NAME ]), - (char *)nla_data (info->attrs[HWSIM_ATTR_RADIO_NAME ])); + hwname =kstrndup ((char *)nla_data (info->attrs[HWSIM_ATTR_RADIO_NAME ]), +nla_len (info->attrs[HWSIM_ATTR_RADIO_NAME ]), +GFP_KERNEL );if (!hwname)return -ENOMEM ; param.hwname = hwname;
@@ -3101,9 +3101,9 @@ static int hwsim_del_radio_nl(struct sk_if (info->attrs[HWSIM_ATTR_RADIO_ID ]) { idx =nla_get_u32 (info->attrs[HWSIM_ATTR_RADIO_ID ]); }else if (info->attrs[HWSIM_ATTR_RADIO_NAME ]) { - hwname =kasprintf (GFP_KERNEL ,"%.*s" , -nla_len (info->attrs[HWSIM_ATTR_RADIO_NAME ]), - (char *)nla_data (info->attrs[HWSIM_ATTR_RADIO_NAME ])); + hwname =kstrndup ((char *)nla_data (info->attrs[HWSIM_ATTR_RADIO_NAME ]), +nla_len (info->attrs[HWSIM_ATTR_RADIO_NAME ]), +GFP_KERNEL );if (!hwname)return -ENOMEM ; }else
Greg Kroah-Hartman
maintainerPATCH 79/125 ext4: do not zeroout extents beyond i_disksize
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 801674f34ecfed033b062a0f217506b93c8d5e8a upstream.
We do not want to create initialized extents beyond end of file because for e2fsck it is impossible to distinguish them from a case of corrupted file size / extent tree and so it complains like:
Inode 12, i_size is 147456, should be 163840. Fix? no
Code in ext4_ext_convert_to_initialized() and ext4_split_convert_extents() try to make sure it does not create initialized extents beyond inode size however they check against inode->i_size which is wrong. They should instead check against EXT4_I(inode)->i_disksize which is the current inode size on disk. That's what e2fsck is going to see in case of crash before all dirty data is written. This bug manifests as generic/456 test failure (with recent enough fstests where fsx got fixed to properly pass FALLOC_KEEP_SIZE_FL flags to the kernel) when run with dioread_lock mount option.
--- fs/ext4/extents.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/ext4/extents.c +4 -4
@@ -3445,8 +3445,8 @@ static int ext4_ext_convert_to_initializ (unsigned long long)map->m_lblk, map_len); sbi =EXT4_SB (inode->i_sb); - eof_block = (inode->i_size + inode->i_sb->s_blocksize -1 ) >> - inode->i_sb->s_blocksize_bits; + eof_block = (EXT4_I (inode)->i_disksize + inode->i_sb->s_blocksize -1 ) + >> inode->i_sb->s_blocksize_bits;if (eof_block < map->m_lblk + map_len) eof_block = map->m_lblk + map_len;
@@ -3701,8 +3701,8 @@ static int ext4_split_convert_extents(ha __func__, inode->i_ino, (unsigned long long)map->m_lblk, map->m_len); - eof_block = (inode->i_size + inode->i_sb->s_blocksize -1 ) >> - inode->i_sb->s_blocksize_bits; + eof_block = (EXT4_I (inode)->i_disksize + inode->i_sb->s_blocksize -1 ) + >> inode->i_sb->s_blocksize_bits;if (eof_block < map->m_lblk + map->m_len) eof_block = map->m_lblk + map->m_len;/*
Greg Kroah-Hartman
maintainerPATCH 80/125 dm flakey: check for null arg_name in parse_features()
In reply to Greg Kroah-HartmanFrom: Goldwyn Rodrigues <[email protected]>
[ Upstream commit 7690e25302dc7d0cd42b349e746fe44b44a94f2b ]
One can crash dm-flakey by specifying more feature arguments than the number of features supplied. Checking for null in arg_name avoids this.
dmsetup create flakey-test --table "0 66076080 flakey /dev/sdb9 0 0 180 2 drop_writes"
--- drivers/md/dm-flakey.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/md/dm-flakey.c +5 -0
@@ -69,6 +69,11 @@ static int parse_features(struct dm_arg_set *as, struct flakey_c *fc, arg_name =dm_shift_arg (as); argc--; +if (!arg_name) { + ti->error ="Insufficient feature arguments" ; +return -EINVAL ; + } +/* * drop_writes */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 81/125 kvm: x86: Host feature SSBD doesnt imply guest feature SPEC_CTRL_SSBD
In reply to Greg Kroah-HartmanFrom: Jim Mattson <[email protected]>
commit 396d2e878f92ec108e4293f1c77ea3bc90b414ff upstream.
The host reports support for the synthetic feature X86_FEATURE_SSBD when any of the three following hardware features are set:
CPUID.(EAX=7,ECX=0):EDX.SSBD[bit 31] CPUID.80000008H:EBX.AMD_SSBD[bit 24] CPUID.80000008H:EBX.VIRT_SSBD[bit 25]
Either of the first two hardware features implies the existence of the IA32_SPEC_CTRL MSR, but CPUID.80000008H:EBX.VIRT_SSBD[bit 25] does not. Therefore, CPUID.(EAX=7,ECX=0):EDX.SSBD[bit 31] should only be set in the guest if CPUID.(EAX=7,ECX=0):EDX.SSBD[bit 31] or CPUID.80000008H:EBX.AMD_SSBD[bit 24] is set on the host.
--- arch/x86/kvm/cpuid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kvm/cpuid.c +2 -1
@@ -479,7 +479,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, entry->edx |=F (SPEC_CTRL );if (boot_cpu_has (X86_FEATURE_STIBP )) entry->edx |=F (INTEL_STIBP ); -if (boot_cpu_has (X86_FEATURE_SSBD )) +if (boot_cpu_has (X86_FEATURE_SPEC_CTRL_SSBD ) || +boot_cpu_has (X86_FEATURE_AMD_SSBD )) entry->edx |=F (SPEC_CTRL_SSBD );/* * We emulate ARCH_CAPABILITIES in software even
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 82/125 scsi: target: remove boilerplate code
In reply to Greg Kroah-HartmanFrom: Maurizio Lombardi <[email protected]>
[ Upstream commit e49a7d994379278d3353d7ffc7994672752fb0ad ]
iscsit_free_session() is equivalent to iscsit_stop_session() followed by a call to iscsit_close_session().
--- drivers/target/iscsi/iscsi_target.c | 46 ++--------------------------- drivers/target/iscsi/iscsi_target.h | 1 - 2 files changed, 2 insertions(+), 45 deletions(-)
drivers/target/iscsi/iscsi_target.c +2 -44
@@ -4590,49 +4590,6 @@ void iscsit_fail_session(struct iscsi_session *sess) sess->session_state =TARG_SESS_STATE_FAILED ; } -int iscsit_free_session (struct iscsi_session *sess) -{ -u16 conn_count =atomic_read (&sess->nconn); -struct iscsi_conn *conn, *conn_tmp =NULL ; -int is_last; - -spin_lock_bh (&sess->conn_lock); -atomic_set (&sess->sleep_on_sess_wait_comp,1 ); - -list_for_each_entry_safe (conn, conn_tmp, &sess->sess_conn_list, - conn_list) { -if (conn_count ==0 ) -break ; - -if (list_is_last (&conn->conn_list, &sess->sess_conn_list)) { - is_last =1 ; - }else { -iscsit_inc_conn_usage_count (conn_tmp); - is_last =0 ; - } -iscsit_inc_conn_usage_count (conn); - -spin_unlock_bh (&sess->conn_lock); -iscsit_cause_connection_reinstatement (conn,1 ); -spin_lock_bh (&sess->conn_lock); - -iscsit_dec_conn_usage_count (conn); -if (is_last ==0 ) -iscsit_dec_conn_usage_count (conn_tmp); - - conn_count--; - } - -if (atomic_read (&sess->nconn)) { -spin_unlock_bh (&sess->conn_lock); -wait_for_completion (&sess->session_wait_comp); - }else -spin_unlock_bh (&sess->conn_lock); - -iscsit_close_session (sess); -return 0 ; -} - void iscsit_stop_session( struct iscsi_session *sess, int session_sleep,
@@ -4717,7 +4674,8 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)list_for_each_entry_safe (se_sess, se_sess_tmp, &free_list, sess_list) { sess = (struct iscsi_session *)se_sess->fabric_sess_ptr; -iscsit_free_session (sess); +iscsit_stop_session (sess,1 ,1 ); +iscsit_close_session (sess); session_count++; }
drivers/target/iscsi/iscsi_target.h +0 -1
@@ -30,7 +30,6 @@ extern int iscsi_target_rx_thread(void *);extern int iscsit_close_connection (struct iscsi_conn *);extern int iscsit_close_session (struct iscsi_session *);extern void iscsit_fail_session (struct iscsi_session *); -extern int iscsit_free_session (struct iscsi_session *);extern void iscsit_stop_session (struct iscsi_session *,int ,int );extern int iscsit_release_sessions_for_tpg (struct iscsi_portal_group *,int );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 83/125 scsi: target: fix hang when multiple threads try to destroy the same iscsi session
In reply to Greg Kroah-HartmanFrom: Maurizio Lombardi <[email protected]>
[ Upstream commit 57c46e9f33da530a2485fa01aa27b6d18c28c796 ]
A number of hangs have been reported against the target driver; they are due to the fact that multiple threads may try to destroy the iscsi session at the same time. This may be reproduced for example when a "targetcli iscsi/iqn.../tpg1 disable" command is executed while a logout operation is underway.
When this happens, two or more threads may end up sleeping and waiting for iscsit_close_connection() to execute "complete(session_wait_comp)". Only one of the threads will wake up and proceed to destroy the session structure, the remaining threads will hang forever.
Note that if the blocked threads are somehow forced to wake up with complete_all(), they will try to free the same iscsi session structure destroyed by the first thread, causing double frees, memory corruptions etc...
With this patch, the threads that want to destroy the iscsi session will increase the session refcount and will set the "session_close" flag to 1; then they wait for the driver to close the remaining active connections. When the last connection is closed, iscsit_close_connection() will wake up all the threads and will wait for the session's refcount to reach zero; when this happens, iscsit_close_connection() will destroy the session structure because no one is referencing it anymore.
INFO: task targetcli:5971 blocked for more than 120 seconds.
Tainted: P OE 4.15.0-72-generic #81~16.04.1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
targetcli D 0 5971 1 0x00000080
Call Trace:
__schedule+0x3d6/0x8b0
? vprintk_func+0x44/0xe0
schedule+0x36/0x80
schedule_timeout+0x1db/0x370
? __dynamic_pr_debug+0x8a/0xb0
wait_for_completion+0xb4/0x140
? wake_up_q+0x70/0x70
iscsit_free_session+0x13d/0x1a0 [iscsi_target_mod]
iscsit_release_sessions_for_tpg+0x16b/0x1e0 [iscsi_target_mod]
iscsit_tpg_disable_portal_group+0xca/0x1c0 [iscsi_target_mod]
lio_target_tpg_enable_store+0x66/0xe0 [iscsi_target_mod]
configfs_write_file+0xb9/0x120
__vfs_write+0x1b/0x40
vfs_write+0xb8/0x1b0
SyS_write+0x5c/0xe0
do_syscall_64+0x73/0x130
entry_SYSCALL_64_after_hwframe+0x3d/0xa2--- drivers/target/iscsi/iscsi_target.c | 35 ++++++++++++++++----------- drivers/target/iscsi/iscsi_target_configfs.c | 5 +++ drivers/target/iscsi/iscsi_target_login.c | 5 ++- include/target/iscsi/iscsi_target_core.h | 2 - 4 files changed, 30 insertions(+), 17 deletions(-)
drivers/target/iscsi/iscsi_target.c +22 -13
@@ -4321,30 +4321,37 @@ int iscsit_close_connection(if (!atomic_read (&sess->session_reinstatement) &&atomic_read (&sess->session_fall_back_to_erl0)) {spin_unlock_bh (&sess->conn_lock); +complete_all (&sess->session_wait_comp);iscsit_close_session (sess);return 0 ; }else if (atomic_read (&sess->session_logout)) {pr_debug ("Moving to TARG_SESS_STATE_FREE.\n" ); sess->session_state =TARG_SESS_STATE_FREE ; -spin_unlock_bh (&sess->conn_lock); -if (atomic_read (&sess->sleep_on_sess_wait_comp)) -complete (&sess->session_wait_comp); +if (atomic_read (&sess->session_close)) { +spin_unlock_bh (&sess->conn_lock); +complete_all (&sess->session_wait_comp); +iscsit_close_session (sess); + }else { +spin_unlock_bh (&sess->conn_lock); + }return 0 ; }else {pr_debug ("Moving to TARG_SESS_STATE_FAILED.\n" ); sess->session_state =TARG_SESS_STATE_FAILED ; -if (!atomic_read (&sess->session_continuation)) { -spin_unlock_bh (&sess->conn_lock); +if (!atomic_read (&sess->session_continuation))iscsit_start_time2retain_handler (sess); - }else -spin_unlock_bh (&sess->conn_lock); -if (atomic_read (&sess->sleep_on_sess_wait_comp)) -complete (&sess->session_wait_comp); +if (atomic_read (&sess->session_close)) { +spin_unlock_bh (&sess->conn_lock); +complete_all (&sess->session_wait_comp); +iscsit_close_session (sess); + }else { +spin_unlock_bh (&sess->conn_lock); + }return 0 ; }
@@ -4453,9 +4460,9 @@ static void iscsit_logout_post_handler_ccomplete (&conn->conn_logout_comp);iscsit_dec_conn_usage_count (conn); +atomic_set (&sess->session_close,1 );iscsit_stop_session (sess, sleep, sleep);iscsit_dec_session_usage_count (sess); -iscsit_close_session (sess); } static void iscsit_logout_post_handler_samecid(
@@ -4600,8 +4607,6 @@ void iscsit_stop_session(int is_last;spin_lock_bh (&sess->conn_lock); -if (session_sleep) -atomic_set (&sess->sleep_on_sess_wait_comp,1 );if (connection_sleep) { list_for_each_entry_safe(conn, conn_tmp, &sess->sess_conn_list,
@@ -4659,12 +4664,15 @@ int iscsit_release_sessions_for_tpg(struspin_lock (&sess->conn_lock);if (atomic_read (&sess->session_fall_back_to_erl0) ||atomic_read (&sess->session_logout) || +atomic_read (&sess->session_close) || (sess->time2retain_timer_flags &ISCSI_TF_EXPIRED )) {spin_unlock (&sess->conn_lock);continue ; } +iscsit_inc_session_usage_count (sess);atomic_set (&sess->session_reinstatement,1 );atomic_set (&sess->session_fall_back_to_erl0,1 ); +atomic_set (&sess->session_close,1 );spin_unlock (&sess->conn_lock);list_move_tail (&se_sess->sess_list, &free_list);
@@ -4674,8 +4682,9 @@ int iscsit_release_sessions_for_tpg(strulist_for_each_entry_safe (se_sess, se_sess_tmp, &free_list, sess_list) { sess = (struct iscsi_session *)se_sess->fabric_sess_ptr; +list_del_init (&se_sess->sess_list);iscsit_stop_session (sess,1 ,1 ); -iscsit_close_session (sess); +iscsit_dec_session_usage_count (sess); session_count++; }
drivers/target/iscsi/iscsi_target_configfs.c +4 -1
@@ -1527,20 +1527,23 @@ static void lio_tpg_close_session(structspin_lock (&sess->conn_lock);if (atomic_read (&sess->session_fall_back_to_erl0) ||atomic_read (&sess->session_logout) || +atomic_read (&sess->session_close) || (sess->time2retain_timer_flags &ISCSI_TF_EXPIRED )) {spin_unlock (&sess->conn_lock);spin_unlock_bh (&se_tpg->session_lock);return ; } +iscsit_inc_session_usage_count (sess);atomic_set (&sess->session_reinstatement,1 );atomic_set (&sess->session_fall_back_to_erl0,1 ); +atomic_set (&sess->session_close,1 );spin_unlock (&sess->conn_lock);iscsit_stop_time2retain_timer (sess);spin_unlock_bh (&se_tpg->session_lock);iscsit_stop_session (sess,1 ,1 ); -iscsit_close_session (sess); +iscsit_dec_session_usage_count (sess); }static u32 lio_tpg_get_inst_index (struct se_portal_group *se_tpg)
drivers/target/iscsi/iscsi_target_login.c +3 -2
@@ -195,6 +195,7 @@ int iscsi_check_for_session_reinstatemenspin_lock (&sess_p->conn_lock);if (atomic_read (&sess_p->session_fall_back_to_erl0) ||atomic_read (&sess_p->session_logout) || +atomic_read (&sess_p->session_close) || (sess_p->time2retain_timer_flags &ISCSI_TF_EXPIRED )) {spin_unlock (&sess_p->conn_lock);continue ;
@@ -205,6 +206,7 @@ int iscsi_check_for_session_reinstatemen (sess_p->sess_ops->SessionType == sessiontype))) {atomic_set (&sess_p->session_reinstatement,1 );atomic_set (&sess_p->session_fall_back_to_erl0,1 ); +atomic_set (&sess_p->session_close,1 );spin_unlock (&sess_p->conn_lock);iscsit_inc_session_usage_count (sess_p);iscsit_stop_time2retain_timer (sess_p);
@@ -229,7 +231,6 @@ int iscsi_check_for_session_reinstatemenif (sess->session_state ==TARG_SESS_STATE_FAILED ) {spin_unlock_bh (&sess->conn_lock);iscsit_dec_session_usage_count (sess); -iscsit_close_session (sess);return 0 ; }spin_unlock_bh (&sess->conn_lock);
@@ -237,7 +238,6 @@ int iscsi_check_for_session_reinstatemeniscsit_stop_session (sess,1 ,1 );iscsit_dec_session_usage_count (sess); -iscsit_close_session (sess);return 0 ; }
@@ -525,6 +525,7 @@ static int iscsi_login_non_zero_tsih_s2( sess_p = (struct iscsi_session *)se_sess->fabric_sess_ptr;if (atomic_read (&sess_p->session_fall_back_to_erl0) ||atomic_read (&sess_p->session_logout) || +atomic_read (&sess_p->session_close) || (sess_p->time2retain_timer_flags &ISCSI_TF_EXPIRED ))continue ; if (!memcmp(sess_p->isid, pdu->isid, 6) &&
include/target/iscsi/iscsi_target_core.h +1 -1
@@ -671,7 +671,7 @@ struct iscsi_session {atomic_t session_logout;atomic_t session_reinstatement;atomic_t session_stop_active; -atomic_t sleep_on_sess_wait_comp; +atomic_t session_close;/* connection list */ struct list_head sess_conn_list;struct list_head cr_active_list;
Greg Kroah-Hartman
maintainerPATCH 84/125 tracing: Fix the race between registering snapshot event trigger and triggering snapshot operation
In reply to Greg Kroah-HartmanFrom: Xiao Yang <[email protected]>
commit 0bbe7f719985efd9adb3454679ecef0984cb6800 upstream.
Traced event can trigger 'snapshot' operation(i.e. calls snapshot_trigger() or snapshot_count_trigger()) when register_snapshot_trigger() has completed registration but doesn't allocate buffer for 'snapshot' event trigger. In the rare case, 'snapshot' operation always detects the lack of allocated buffer so make register_snapshot_trigger() allocate buffer first.
trigger-snapshot.tc in kselftest reproduces the issue on slow vm:
-----------------------------------------------------------
cat trace
...
ftracetest-3028 [002] .... 236.784290: sched_process_fork: comm=ftracetest pid=3028 child_comm=ftracetest child_pid=3036
<...>-2875 [003] .... 240.460335: tracing_snapshot_instance_cond: *** SNAPSHOT NOT ALLOCATED ***
<...>-2875 [003] .... 240.460338: tracing_snapshot_instance_cond: *** stopping trace here! ***-----------------------------------------------------------
--- kernel/trace/trace_events_trigger.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
kernel/trace/trace_events_trigger.c +3 -7
@@ -1068,14 +1068,10 @@ register_snapshot_trigger(char *glob, st struct event_trigger_data *data, struct trace_event_file *file) { - int ret = register_trigger(glob, ops, data, file); + if (tracing_alloc_snapshot() != 0) + return 0; -if (ret >0 &&tracing_alloc_snapshot () !=0 ) { -unregister_trigger (glob, ops, data, file); - ret =0 ; - } - -return ret; + return register_trigger(glob, ops, data, file); } static int
Greg Kroah-Hartman
maintainerPATCH 85/125 objtool: Fix switch table detection in .text.unlikely
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
commit b401efc120a399dfda1f4d2858a4de365c9b08ef upstream.
If a switch jump table's indirect branch is in a ".cold" subfunction in .text.unlikely, objtool doesn't detect it, and instead prints a false warning:
drivers/media/v4l2-core/v4l2-ioctl.o: warning: objtool: v4l_print_format.cold()+0xd6: sibling call from callable instruction with modified stack frame drivers/hwmon/max6650.o: warning: objtool: max6650_probe.cold()+0xa5: sibling call from callable instruction with modified stack frame drivers/media/dvb-frontends/drxk_hard.o: warning: objtool: init_drxk.cold()+0x16f: sibling call from callable instruction with modified stack frame
Fix it by comparing the function, instead of the section and offset.
--- tools/objtool/check.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
tools/objtool/check.c +1 -4
@@ -914,10 +914,7 @@ static struct rela *find_switch_table(st* it. */ for (; - &insn->list != &file->insn_list && - insn->sec == func->sec && - insn->offset >= func->offset; - + &insn->list != &file->insn_list && insn->func && insn->func->pfunc == func; insn = insn->first_jump_src ?:list_prev_entry (insn, list)) {if (insn != orig_insn && insn->type ==INSN_JUMP_DYNAMIC )
Greg Kroah-Hartman
maintainerPATCH 86/125 scsi: sg: add sg_remove_request in sg_common_write
In reply to Greg Kroah-HartmanFrom: Li Bin <[email protected]>
commit 849f8583e955dbe3a1806e03ecacd5e71cce0a08 upstream.
If the dxfer_len is greater than 256M then the request is invalid and we need to call sg_remove_request in sg_common_write.
--- drivers/scsi/sg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/sg.c +3 -1
@@ -809,8 +809,10 @@ sg_common_write(Sg_fd * sfp, Sg_request"sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n" , (int) cmnd[0], (int) hp->cmd_len)); -if (hp->dxfer_len >=SZ_256M ) +if (hp->dxfer_len >=SZ_256M ) { +sg_remove_request (sfp, srp);return -EINVAL ; + } k =sg_start_req (srp, cmnd);if (k) {
Greg Kroah-Hartman
maintainerPATCH 87/125 ALSA: hda: Dont release card at firmware loading error
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 25faa4bd37c10f19e4b848b9032a17a3d44c6f09 upstream.
At the error path of the firmware loading error, the driver tries to release the card object and set NULL to drvdata. This may be referred badly at the possible PM action, as the driver itself is still bound and the PM callbacks read the card object.
Instead, we continue the probing as if it were no option set. This is often a better choice than the forced abort, too.
--- sound/pci/hda/hda_intel.c | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-)
sound/pci/hda/hda_intel.c +5 -14
@@ -1828,24 +1828,15 @@ static void azx_firmware_cb(const struct {struct snd_card *card = context;struct azx *chip = card->private_data; -struct pci_dev *pci = chip->pci; -if (!fw) { -dev_err (card->dev,"Cannot load firmware, aborting\n" ); - goto error; - } - - chip->fw = fw; +if (fw) + chip->fw = fw; +else +dev_err (card->dev,"Cannot load firmware, continue without patching\n" );if (!chip->disabled) {/* continue probing */ -if (azx_probe_continue (chip)) - goto error; +azx_probe_continue (chip); } -return ;/* OK */ - - error: -snd_card_free (card); -pci_set_drvdata (pci,NULL ); }#endif
Greg Kroah-Hartman
maintainerPATCH 88/125 of: unittest: kmemleak on changeset destroy
In reply to Greg Kroah-HartmanFrom: Frank Rowand <[email protected]>
commit b3fb36ed694b05738d45218ea72cf7feb10ce2b1 upstream.
kmemleak reports several memory leaks from devicetree unittest. This is the fix for problem 1 of 5.
of_unittest_changeset() reaches deeply into the dynamic devicetree functions. Several nodes were left with an elevated reference count and thus were not properly cleaned up. Fix the reference counts so that the memory will be freed.
--- drivers/of/unittest.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/of/unittest.c +4 -0
@@ -539,6 +539,10 @@ static void __init of_unittest_changesetunittest (!of_changeset_revert (&chgset),"revert failed\n" );of_changeset_destroy (&chgset); + +of_node_put (n1); +of_node_put (n2); +of_node_put (n21);#endif }
Greg Kroah-Hartman
maintainerPATCH 89/125 video: fbdev: sis: Remove unnecessary parentheses and commented code
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 864eb1afc60cb43e7df879b97f8ca0d719bbb735 upstream.
Clang warns when multiple pairs of parentheses are used for a single conditional statement.
drivers/video/fbdev/sis/init301.c:851:42: warning: equality comparison with extraneous parentheses [-Wparentheses-equality]
} else if((SiS_Pr->SiS_IF_DEF_LVDS == 1) /* ||
~~~~~~~~~~~~~~~~~~~~~~~~^~~~drivers/video/fbdev/sis/init301.c:851:42: note: remove extraneous parentheses around the comparison to silence this warning
} else if((SiS_Pr->SiS_IF_DEF_LVDS == 1) /* ||
~ ^ ~drivers/video/fbdev/sis/init301.c:851:42: note: use '=' to turn this equality comparison into an assignment
} else if((SiS_Pr->SiS_IF_DEF_LVDS == 1) /* ||
^~
=1 warning generated.
Remove the parentheses and while we're at it, clean up the commented code, which has been here since the beginning of git history.
--- drivers/video/fbdev/sis/init301.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/video/fbdev/sis/init301.c +1 -3
@@ -522,9 +522,7 @@ SiS_PanelDelay(struct SiS_Private *SiS_PSiS_DDC2Delay (SiS_Pr,0x4000 ); } - }else if ((SiS_Pr->SiS_IF_DEF_LVDS ==1 )/* || -(SiS_Pr->SiS_CustomT == CUT_COMPAQ1280) || -(SiS_Pr->SiS_CustomT == CUT_CLEVO1400) */ ) {/* 315 series, LVDS; Special */ + }else if (SiS_Pr->SiS_IF_DEF_LVDS ==1 ) {/* 315 series, LVDS; Special */ if (SiS_Pr->SiS_IF_DEF_CH70xx ==0 ) { PanelID =SiS_GetReg (SiS_Pr->SiS_P3d4,0x36 );
Greg Kroah-Hartman
maintainerPATCH 90/125 drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem
In reply to Greg Kroah-HartmanFrom: Joe Moriarty <[email protected]>
commit 22a07038c0eaf4d1315a493ce66dcd255accba19 upstream.
The Parfait (version 2.1.0) static code analysis tool found the following NULL pointer derefernce problem.
- drivers/gpu/drm/drm_dp_mst_topology.c
The call to drm_dp_calculate_rad() in function drm_dp_port_setup_pdt() could result in a NULL pointer being returned to port->mstb due to a failure to allocate memory for port->mstb.
--- drivers/gpu/drm/drm_dp_mst_topology.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_dp_mst_topology.c +5 -3
@@ -1041,10 +1041,12 @@ static bool drm_dp_port_setup_pdt(struct lct =drm_dp_calculate_rad (port, rad); port->mstb =drm_dp_add_mst_branch_device (lct, rad); - port->mstb->mgr = port->mgr; - port->mstb->port_parent = port; +if (port->mstb) { + port->mstb->mgr = port->mgr; + port->mstb->port_parent = port; - send_link = true; + send_link = true; + }break ; }return send_link;
Greg Kroah-Hartman
maintainerPATCH 91/125 Revert "gpio: set up initial state from .get_direction()"
In reply to Greg Kroah-HartmanFrom: Timur Tabi <[email protected]>
[ Upstream commit 1ca2a92b2a99323f666f1b669b7484df4bda05e4 ]
This reverts commit 72d3200061776264941be1b5a9bb8e926b3b30a5.
We cannot blindly query the direction of all GPIOs when the pins are first registered. The get_direction callback normally triggers a read/write to hardware, but we shouldn't be touching the hardware for an individual GPIO until after it's been properly claimed.
--- drivers/gpio/gpiolib.c | 31 +++++++------------------------ 1 file changed, 7 insertions(+), 24 deletions(-)
drivers/gpio/gpiolib.c +7 -24
@@ -1232,31 +1232,14 @@ int gpiochip_add_data(struct gpio_chip *struct gpio_desc *desc = &gdev->descs[i]; desc->gdev = gdev; -/* -* REVISIT: most hardware initializes GPIOs as inputs -* (often with pullups enabled) so power usage is -* minimized. Linux code should set the gpio direction -* first thing; but until it does, and in case -* chip->get_direction is not set, we may expose the -* wrong direction in sysfs. -*/ - -if (chip->get_direction) { -/* -* If we have .get_direction, set up the initial -* direction flag from the hardware. -*/ -int dir = chip->get_direction (chip, i); -if (!dir) -set_bit (FLAG_IS_OUT , &desc->flags); - }else if (!chip->direction_input) { -/* -* If the chip lacks the .direction_input callback -* we logically assume all lines are outputs. -*/ -set_bit (FLAG_IS_OUT , &desc->flags); - } +/* REVISIT: most hardware initializes GPIOs as inputs (often +* with pullups enabled) so power usage is minimized. Linux +* code should set the gpio direction first thing; but until +* it does, and in case chip->get_direction is not set, we may +* expose the wrong direction in sysfs. +*/ + desc->flags = !chip->direction_input ? (1 <<FLAG_IS_OUT ) :0 ; }#ifdef CONFIG_PINCTRL
Greg Kroah-Hartman
maintainerPATCH 92/125 wil6210: increase firmware ready timeout
In reply to Greg Kroah-HartmanFrom: Hamad Kadmany <[email protected]>
[ Upstream commit 6ccae584014ef7074359eb4151086beef66ecfa9 ]
Firmware ready event may take longer than current timeout in some scenarios, for example with multiple RFs connected where each requires an initial calibration.
Increase the timeout to support these scenarios.
--- drivers/net/wireless/ath/wil6210/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/wil6210/main.c +1 -1
@@ -803,7 +803,7 @@ static void wil_bl_crash_info(struct wilstatic int wil_wait_for_fw_ready (struct wil6210_priv *wil) { -ulong to =msecs_to_jiffies (1000 ); +ulong to =msecs_to_jiffies (2000 );ulong left =wait_for_completion_timeout (&wil->wmi_ready, to);if (0 == left) {
Greg Kroah-Hartman
maintainerPATCH 93/125 wil6210: fix temperature debugfs
In reply to Greg Kroah-HartmanFrom: Dedy Lansky <[email protected]>
[ Upstream commit 6d9eb7ebae3d7e951bc0999235ae7028eb4cae4f ]
For negative temperatures, "temp" debugfs is showing wrong values. Use signed types so proper calculations is done for sub zero temperatures.
--- drivers/net/wireless/ath/wil6210/debugfs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/wil6210/debugfs.c +4 -3
@@ -1091,7 +1091,7 @@ static const struct file_operations fops };/*---------temp------------*/ -static void print_temp (struct seq_file *s,const char *prefix,u32 t) +static void print_temp (struct seq_file *s,const char *prefix,s32 t) {switch (t) {case 0 :
@@ -1099,7 +1099,8 @@ static void print_temp(struct seq_file *seq_printf (s,"%s N/A\n" , prefix);break ;default : -seq_printf (s,"%s %d.%03d\n" , prefix, t /1000 , t %1000 ); +seq_printf (s,"%s %s%d.%03d\n" , prefix, (t <0 ?"-" :"" ), +abs (t /1000 ),abs (t %1000 ));break ; } }
@@ -1107,7 +1108,7 @@ static void print_temp(struct seq_file *static int wil_temp_debugfs_show (struct seq_file *s,void *data) {struct wil6210_priv *wil = s->private; -u32 t_m, t_r; +s32 t_m, t_r;int rc =wmi_get_temperature (wil, &t_m, &t_r);if (rc) {
Greg Kroah-Hartman
maintainerPATCH 94/125 scsi: ufs: make sure all interrupts are processed
In reply to Greg Kroah-HartmanFrom: Venkat Gopalakrishnan <[email protected]>
[ Upstream commit 7f6ba4f12e6cbfdefbb95cfd8fc67ece6c15d799 ]
As multiple requests are submitted to the ufs host controller in parallel there could be instances where the command completion interrupt arrives later for a request that is already processed earlier as the corresponding doorbell was cleared when handling the previous interrupt. Read the interrupt status in a loop after processing the received interrupt to catch such interrupts and handle it.
--- drivers/scsi/ufs/ufshcd.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-)
drivers/scsi/ufs/ufshcd.c +19 -8
@@ -4397,19 +4397,30 @@ static irqreturn_t ufshcd_intr(int irq,u32 intr_status, enabled_intr_status;irqreturn_t retval =IRQ_NONE ;struct ufs_hba *hba = __hba; +int retries = hba->nutrs;spin_lock (hba->host->host_lock); intr_status =ufshcd_readl (hba,REG_INTERRUPT_STATUS ); - enabled_intr_status = - intr_status &ufshcd_readl (hba,REG_INTERRUPT_ENABLE ); -if (intr_status) -ufshcd_writel (hba, intr_status,REG_INTERRUPT_STATUS ); +/* +* There could be max of hba->nutrs reqs in flight and in worst case +* if the reqs get finished 1 by 1 after the interrupt status is +* read, make sure we handle them by checking the interrupt status +* again in a loop until we process all of the reqs before returning. +*/ +do { + enabled_intr_status = + intr_status &ufshcd_readl (hba,REG_INTERRUPT_ENABLE ); +if (intr_status) +ufshcd_writel (hba, intr_status,REG_INTERRUPT_STATUS ); +if (enabled_intr_status) { +ufshcd_sl_intr (hba, enabled_intr_status); + retval =IRQ_HANDLED ; + } + + intr_status =ufshcd_readl (hba,REG_INTERRUPT_STATUS ); + }while (intr_status && --retries); -if (enabled_intr_status) { -ufshcd_sl_intr (hba, enabled_intr_status); - retval =IRQ_HANDLED ; - }spin_unlock (hba->host->host_lock);return retval; }
Greg Kroah-Hartman
maintainerPATCH 95/125 scsi: ufs: ufs-qcom: remove broken hci version quirk
In reply to Greg Kroah-HartmanFrom: Subhash Jadavani <[email protected]>
[ Upstream commit 69a6fff068567469c0ef1156ae5ac8d3d71701f0 ]
UFSHCD_QUIRK_BROKEN_UFS_HCI_VERSION is only applicable for QCOM UFS host controller version 2.x.y and this has been fixed from version 3.x.y onwards, hence this change removes this quirk for version 3.x.y onwards.
[mkp: applied by hand]
--- drivers/scsi/ufs/ufs-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ufs/ufs-qcom.c +1 -1
@@ -1094,7 +1094,7 @@ static void ufs_qcom_advertise_quirks(st hba->quirks |=UFSHCD_QUIRK_BROKEN_LCC ; } -if (host->hw_ver.major >=0x2 ) { +if (host->hw_ver.major ==0x2 ) { hba->quirks |=UFSHCD_QUIRK_BROKEN_UFS_HCI_VERSION ;if (!ufs_qcom_cap_qunipro (host))
Greg Kroah-Hartman
maintainerPATCH 96/125 wil6210: rate limit wil_rx_refill error
In reply to Greg Kroah-HartmanFrom: Dedy Lansky <[email protected]>
[ Upstream commit 3d6b72729cc2933906de8d2c602ae05e920b2122 ]
wil_err inside wil_rx_refill can flood the log buffer. Replace it with wil_err_ratelimited.
--- drivers/net/wireless/ath/wil6210/txrx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/wil6210/txrx.c +2 -2
@@ -546,8 +546,8 @@ static int wil_rx_refill(struct wil6210_ v->swtail = next_tail) { rc =wil_vring_alloc_skb (wil, v, v->swtail, headroom);if (unlikely (rc)) { -wil_err (wil,"Error %d in wil_rx_refill[%d]\n" , - rc, v->swtail); +wil_err_ratelimited (wil,"Error %d in rx refill[%d]\n" , + rc, v->swtail);break ; } }
Greg Kroah-Hartman
maintainerPATCH 97/125 rtc: pm8xxx: Fix issue in RTC write path
In reply to Greg Kroah-HartmanFrom: Mohit Aggarwal <[email protected]>
[ Upstream commit 83220bf38b77a830f8e62ab1a0d0408304f9b966 ]
In order to set time in rtc, need to disable
rtc hw before writing into rtc registers.
Also fixes disabling of alarm while setting
rtc time.
--- drivers/rtc/rtc-pm8xxx.c | 49 ++++++++++++++++++++++++++++++++++++----------- 1 file changed, 38 insertions(+), 11 deletions(-)
drivers/rtc/rtc-pm8xxx.c +38 -11
@@ -74,16 +74,18 @@ struct pm8xxx_rtc {/* * Steps to write the RTC registers. * 1. Disable alarm if enabled. -* 2. Write 0x00 to LSB. -* 3. Write Byte[1], Byte[2], Byte[3] then Byte[0]. -* 4. Enable alarm if disabled in step 1. +* 2. Disable rtc if enabled. +* 3. Write 0x00 to LSB. +* 4. Write Byte[1], Byte[2], Byte[3] then Byte[0]. +* 5. Enable rtc if disabled in step 2. +* 6. Enable alarm if disabled in step 1. */ static int pm8xxx_rtc_set_time (struct device *dev,struct rtc_time *tm) {int rc, i;unsigned long secs, irq_flags; -u8 value[NUM_8_BIT_RTC_REGS ], alarm_enabled =0 ; -unsigned int ctrl_reg; +u8 value[NUM_8_BIT_RTC_REGS ], alarm_enabled =0 , rtc_disabled =0 ; +unsigned int ctrl_reg, rtc_ctrl_reg;struct pm8xxx_rtc *rtc_dd =dev_get_drvdata (dev);const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
@@ -92,23 +94,38 @@ static int pm8xxx_rtc_set_time(struct dertc_tm_to_time (tm, &secs); +dev_dbg (dev,"Seconds value to be written to RTC = %lu\n" , secs); +for (i =0 ; i <NUM_8_BIT_RTC_REGS ; i++) { value[i] = secs &0xFF ; secs >>=8 ; } -dev_dbg (dev,"Seconds value to be written to RTC = %lu\n" , secs); -spin_lock_irqsave (&rtc_dd->ctrl_reg_lock, irq_flags); - rc =regmap_read (rtc_dd->regmap, regs->ctrl, &ctrl_reg); + rc =regmap_read (rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);if (rc) goto rtc_rw_fail;if (ctrl_reg & regs->alarm_en) { alarm_enabled =1 ; ctrl_reg &= ~regs->alarm_en; - rc =regmap_write (rtc_dd->regmap, regs->ctrl, ctrl_reg); + rc =regmap_write (rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg); +if (rc) { +dev_err (dev,"Write to RTC Alarm control register failed\n" ); + goto rtc_rw_fail; + } + } + +/* Disable RTC H/w before writing on RTC register */ + rc =regmap_read (rtc_dd->regmap, regs->ctrl, &rtc_ctrl_reg); +if (rc) + goto rtc_rw_fail; + +if (rtc_ctrl_reg & PM8xxx_RTC_ENABLE) { + rtc_disabled =1 ; + rtc_ctrl_reg &= ~PM8xxx_RTC_ENABLE; + rc =regmap_write (rtc_dd->regmap, regs->ctrl, rtc_ctrl_reg);if (rc) {dev_err (dev,"Write to RTC control register failed\n" ); goto rtc_rw_fail;
@@ -137,11 +154,21 @@ static int pm8xxx_rtc_set_time(struct de goto rtc_rw_fail; } +/* Enable RTC H/w after writing on RTC register */ +if (rtc_disabled) { + rtc_ctrl_reg |= PM8xxx_RTC_ENABLE; + rc =regmap_write (rtc_dd->regmap, regs->ctrl, rtc_ctrl_reg); +if (rc) { +dev_err (dev,"Write to RTC control register failed\n" ); + goto rtc_rw_fail; + } + } +if (alarm_enabled) { ctrl_reg |= regs->alarm_en; - rc =regmap_write (rtc_dd->regmap, regs->ctrl, ctrl_reg); + rc =regmap_write (rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);if (rc) { -dev_err (dev,"Write to RTC control register failed\n" ); +dev_err (dev,"Write to RTC Alarm control register failed\n" ); goto rtc_rw_fail; } }
Greg Kroah-Hartman
maintainerPATCH 98/125 wil6210: fix length check in __wmi_send
In reply to Greg Kroah-HartmanFrom: Lior David <[email protected]>
[ Upstream commit 26a6d5274865532502c682ff378ac8ebe2886238 ]
The current length check:
sizeof(cmd) + len > r->entry_size
will allow very large values of len (> U16_MAX - sizeof(cmd)) and can cause a buffer overflow. Fix the check to cover this case. In addition, ensure the mailbox entry_size is not too small, since this can also bypass the above check.
--- drivers/net/wireless/ath/wil6210/interrupt.c | 22 +++++++++++++++++++++- drivers/net/wireless/ath/wil6210/wmi.c | 2 +- 2 files changed, 22 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/wil6210/interrupt.c +21 -1
@@ -356,6 +356,25 @@ static void wil_cache_mbox_regs(struct wwil_mbox_ring_le2cpus (&wil->mbox_ctl.tx); } +static bool wil_validate_mbox_regs (struct wil6210_priv *wil) +{ +size_t min_size =sizeof (struct wil6210_mbox_hdr ) + +sizeof (struct wmi_cmd_hdr ); + +if (wil->mbox_ctl.rx.entry_size < min_size) { +wil_err (wil,"rx mbox entry too small (%d)\n" , + wil->mbox_ctl.rx.entry_size); +return false; + } +if (wil->mbox_ctl.tx.entry_size < min_size) { +wil_err (wil,"tx mbox entry too small (%d)\n" , + wil->mbox_ctl.tx.entry_size); +return false; + } + +return true; +} +static irqreturn_t wil6210_irq_misc (int irq,void *cookie) {struct wil6210_priv *wil = cookie;
@@ -391,7 +410,8 @@ static irqreturn_t wil6210_irq_misc(intif (isr &ISR_MISC_FW_READY ) {wil_dbg_irq (wil,"IRQ: FW ready\n" );wil_cache_mbox_regs (wil); -set_bit (wil_status_mbox_ready, wil->status); +if (wil_validate_mbox_regs (wil)) +set_bit (wil_status_mbox_ready, wil->status);/** * Actual FW ready indicated by the * WMI_FW_READY_EVENTID
drivers/net/wireless/ath/wil6210/wmi.c +1 -1
@@ -209,7 +209,7 @@ static int __wmi_send(struct wil6210_priuint retry;int rc =0 ; -if (sizeof (cmd) + len > r->entry_size) { +if (len > r->entry_size -sizeof (cmd)) {wil_err (wil,"WMI size too large: %d bytes, max is %d\n" , (int )(sizeof (cmd) + len), r->entry_size);return -ERANGE ;
Greg Kroah-Hartman
maintainerPATCH 99/125 soc: qcom: smem: Use le32_to_cpu for comparison
In reply to Greg Kroah-HartmanFrom: Chris Lew <[email protected]>
[ Upstream commit a216000f0140f415cec96129f777b5234c9d142f ]
Endianness can vary in the system, add le32_to_cpu when comparing partition sizes from smem.
--- drivers/soc/qcom/smem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/smem.c +1 -1
@@ -646,7 +646,7 @@ static int qcom_smem_enumerate_partitionreturn -EINVAL ; } -if (header->size != entry->size) { +if (le32_to_cpu (header->size) !=le32_to_cpu (entry->size)) {dev_err (smem->dev,"Partition %d has invalid size\n" , i);return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 100/125 of: fix missing kobject init for !SYSFS && OF_DYNAMIC config
In reply to Greg Kroah-HartmanFrom: Rob Herring <[email protected]>
[ Upstream commit bd82bbf38cbe27f2c65660da801900d71bcc5cc8 ]
The ref counting is broken for OF_DYNAMIC when sysfs is disabled because the kobject initialization is skipped. Only the properties add/remove/update should be skipped for !SYSFS config.
--- drivers/of/base.c | 3 --- 1 file changed, 3 deletions(-)
drivers/of/base.c +0 -3
@@ -170,9 +170,6 @@ int __of_attach_node_sysfs(struct devicestruct property *pp;int rc; -if (!IS_ENABLED (CONFIG_SYSFS )) -return 0 ; -if (!of_kset)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 101/125 arm64: cpu_errata: include required headers
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 94a5d8790e79ab78f499d2d9f1ff2cab63849d9f upstream.
Without including psci.h and arm-smccc.h, we now get a build failure in some configurations:
arch/arm64/kernel/cpu_errata.c: In function 'arm64_update_smccc_conduit':arch/arm64/kernel/cpu_errata.c:278:10: error: 'psci_ops' undeclared (first use in this function); did you mean 'sysfs_ops'?
arch/arm64/kernel/cpu_errata.c: In function 'arm64_set_ssbd_mitigation':arch/arm64/kernel/cpu_errata.c:311:3: error: implicit declaration of function 'arm_smccc_1_1_hvc' [-Werror=implicit-function-declaration]
arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_2, state, NULL);
--- arch/arm64/kernel/cpu_errata.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/kernel/cpu_errata.c +2 -0
@@ -16,6 +16,8 @@* along with this program. If not, see <http://www.gnu.org/licenses/>. */ +#include <linux/arm-smccc.h> +#include <linux/psci.h> #include <linux/types.h> #include <asm/cachetype.h> #include <asm/cpu.h>
Greg Kroah-Hartman
maintainerPATCH 102/125 of: unittest: kmemleak in of_unittest_platform_populate()
In reply to Greg Kroah-HartmanFrom: Frank Rowand <[email protected]>
[ Upstream commit 216830d2413cc61be3f76bc02ffd905e47d2439e ]
kmemleak reports several memory leaks from devicetree unittest. This is the fix for problem 2 of 5.
of_unittest_platform_populate() left an elevated reference count for grandchild nodes (which are platform devices). Fix the platform device reference counts so that the memory will be freed.
--- drivers/of/unittest.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/of/unittest.c +5 -2
@@ -825,10 +825,13 @@ static void __init of_unittest_platform_populate(void)of_platform_populate (np, match,NULL , &test_bus->dev);for_each_child_of_node (np, child) { -for_each_child_of_node (child, grandchild) -unittest (of_find_device_by_node (grandchild), +for_each_child_of_node (child, grandchild) { + pdev =of_find_device_by_node (grandchild); +unittest (pdev,"Could not create device for node '%s'\n" , grandchild->name); +of_dev_put (pdev); + } }of_platform_depopulate (&test_bus->dev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 103/125 clk: at91: usb: continue if clk_hw_round_rate() return zero
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit b0ecf1c6c6e82da4847900fad0272abfd014666d ]
clk_hw_round_rate() may call round rate function of its parents. In case of SAM9X60 two of USB parrents are PLLA and UPLL. These clocks are controlled by clk-sam9x60-pll.c driver. The round rate function for this driver is sam9x60_pll_round_rate() which call in turn sam9x60_pll_get_best_div_mul(). In case the requested rate is not in the proper range (rate < characteristics->output[0].min &&
rate > characteristics->output[0].max) the sam9x60_pll_round_rate() will return a negative number to its caller (called by clk_core_round_rate_nolock()). clk_hw_round_rate() will return zero in case a negative number is returned by clk_core_round_rate_nolock(). With this, the USB clock will continue its rate computation even caller of clk_hw_round_rate() returned an error. With this, the USB clock on SAM9X60 may not chose the best parent. I detected this after a suspend/resume cycle on SAM9X60.
--- drivers/clk/at91/clk-usb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/at91/clk-usb.c +3 -0
@@ -78,6 +78,9 @@ static int at91sam9x5_clk_usb_determine_rate(struct clk_hw *hw, tmp_parent_rate = req->rate * div; tmp_parent_rate =clk_hw_round_rate (parent, tmp_parent_rate); +if (!tmp_parent_rate) +continue ; + tmp_rate =DIV_ROUND_CLOSEST (tmp_parent_rate, div);if (tmp_rate < req->rate) tmp_diff = req->rate - tmp_rate;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 104/125 power: supply: bq27xxx_battery: Silence deferred-probe error
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 583b53ece0b0268c542a1eafadb62e3d4b0aab8c ]
The driver fails to probe with -EPROBE_DEFER if battery's power supply (charger driver) isn't ready yet and this results in a bit noisy error message in KMSG during kernel's boot up. Let's silence the harmless error message.
--- drivers/power/supply/bq27xxx_battery.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/power/supply/bq27xxx_battery.c +4 -1
@@ -1031,7 +1031,10 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di) di->bat =power_supply_register_no_ws (di->dev, psy_desc, &psy_cfg);if (IS_ERR (di->bat)) { -dev_err (di->dev,"failed to register battery\n" ); +if (PTR_ERR (di->bat) == -EPROBE_DEFER ) +dev_dbg (di->dev,"failed to register battery, deferring probe\n" ); +else +dev_err (di->dev,"failed to register battery\n" );return PTR_ERR (di->bat); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 105/125 clk: tegra: Fix Tegra PMC clock out parents
In reply to Greg Kroah-HartmanFrom: Sowjanya Komatineni <[email protected]>
[ Upstream commit 6fe38aa8cac3a5db38154331742835a4d9740788 ]
Tegra PMC clocks clk_out_1, clk_out_2, and clk_out_3 supported parents are osc, osc_div2, osc_div4 and extern clock.
Clock driver is using incorrect parents clk_m, clk_m_div2, clk_m_div4 for PMC clocks.
This patch fixes this.
--- drivers/clk/tegra/clk-tegra-pmc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/clk/tegra/clk-tegra-pmc.c +6 -6
@@ -60,16 +60,16 @@ struct pmc_clk_init_data {static DEFINE_SPINLOCK (clk_out_lock); -static const char *clk_out1_parents[] = {"clk_m" ,"clk_m_div2" , -"clk_m_div4" ,"extern1" , +static const char *clk_out1_parents[] = {"osc" ,"osc_div2" , +"osc_div4" ,"extern1" , }; -static const char *clk_out2_parents[] = {"clk_m" ,"clk_m_div2" , -"clk_m_div4" ,"extern2" , +static const char *clk_out2_parents[] = {"osc" ,"osc_div2" , +"osc_div4" ,"extern2" , }; -static const char *clk_out3_parents[] = {"clk_m" ,"clk_m_div2" , -"clk_m_div4" ,"extern3" , +static const char *clk_out3_parents[] = {"osc" ,"osc_div2" , +"osc_div4" ,"extern3" , };static struct pmc_clk_init_data pmc_clks[] = {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 106/125 NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails
In reply to Greg Kroah-HartmanFrom: Misono Tomohiro <[email protected]>
[ Upstream commit 8605cf0e852af3b2c771c18417499dc4ceed03d5 ]
When dreq is allocated by nfs_direct_req_alloc(), dreq->kref is initialized to 2. Therefore we need to call nfs_direct_req_release() twice to release the allocated dreq. Usually it is called in nfs_file_direct_{read, write}() and nfs_direct_complete().
However, current code only calls nfs_direct_req_relese() once if nfs_get_lock_context() fails in nfs_file_direct_{read, write}(). So, that case would result in memory leak.
Fix this by adding the missing call.
--- fs/nfs/direct.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/direct.c +2 -0
@@ -595,6 +595,7 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) l_ctx =nfs_get_lock_context (dreq->ctx);if (IS_ERR (l_ctx)) { result =PTR_ERR (l_ctx); +nfs_direct_req_release (dreq); goto out_release; } dreq->l_ctx = l_ctx;
@@ -1019,6 +1020,7 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) l_ctx =nfs_get_lock_context (dreq->ctx);if (IS_ERR (l_ctx)) { result =PTR_ERR (l_ctx); +nfs_direct_req_release (dreq); goto out_release; } dreq->l_ctx = l_ctx;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 107/125 s390/cpuinfo: fix wrong output when CPU0 is offline
In reply to Greg Kroah-HartmanFrom: Alexander Gordeev <[email protected]>
[ Upstream commit 872f27103874a73783aeff2aac2b41a489f67d7c ]
/proc/cpuinfo should not print information about CPU 0 when it is offline.
--- arch/s390/kernel/processor.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/s390/kernel/processor.c +4 -1
@@ -139,8 +139,9 @@ static void show_cpu_mhz(struct seq_file *m, unsigned long n)static int show_cpuinfo (struct seq_file *m,void *v) {unsigned long n = (unsigned long ) v -1 ; +unsigned long first =cpumask_first (cpu_online_mask); -if (!n) +if (n == first)show_cpu_summary (m, v);if (!machine_has_cpu_mhz)return 0 ;
@@ -153,6 +154,8 @@ static inline void *c_update(loff_t *pos) {if (*pos) *pos =cpumask_next (*pos -1 , cpu_online_mask); +else + *pos =cpumask_first (cpu_online_mask);return *pos < nr_cpu_ids ? (void *)*pos +1 :NULL ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 108/125 powerpc/maple: Fix declaration made after definition
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit af6cf95c4d003fccd6c2ecc99a598fb854b537e7 ]
When building ppc64 defconfig, Clang errors (trimmed for brevity):
arch/powerpc/platforms/maple/setup.c:365:1: error: attribute declaration must precede definition [-Werror,-Wignored-attributes] machine_device_initcall(maple, maple_cpc925_edac_setup); ^
machine_device_initcall expands to __define_machine_initcall, which in turn has the macro machine_is used in it, which declares mach_##name with an __attribute__((weak)). define_machine actually defines mach_##name, which in this file happens before the declaration, hence the warning.
To fix this, move define_machine after machine_device_initcall so that the declaration occurs before the definition, which matches how machine_device_initcall and define_machine work throughout arch/powerpc.
While we're here, remove some spaces before tabs.
--- arch/powerpc/platforms/maple/setup.c | 34 ++++++++++++++-------------- 1 file changed, 17 insertions(+), 17 deletions(-)
arch/powerpc/platforms/maple/setup.c +17 -17
@@ -299,23 +299,6 @@ static int __init maple_probe(void)return 1 ; } -define_machine (maple) { - .name = "Maple", - .probe = maple_probe, - .setup_arch = maple_setup_arch, - .init_IRQ = maple_init_IRQ, - .pci_irq_fixup = maple_pci_irq_fixup, - .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq, - .restart = maple_restart, - .halt = maple_halt, - .get_boot_time = maple_get_boot_time, - .set_rtc_time = maple_set_rtc_time, - .get_rtc_time = maple_get_rtc_time, - .calibrate_decr = generic_calibrate_decr, - .progress = maple_progress, - .power_save = power4_idle, -}; -#ifdef CONFIG_EDAC /* * Register a platform device for CPC925 memory controller on
@@ -372,3 +355,20 @@ static int __init maple_cpc925_edac_setup(void) }machine_device_initcall (maple, maple_cpc925_edac_setup);#endif + +define_machine (maple) { + .name = "Maple", + .probe = maple_probe, + .setup_arch = maple_setup_arch, + .init_IRQ = maple_init_IRQ, + .pci_irq_fixup = maple_pci_irq_fixup, + .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq, + .restart = maple_restart, + .halt = maple_halt, + .get_boot_time = maple_get_boot_time, + .set_rtc_time = maple_set_rtc_time, + .get_rtc_time = maple_get_rtc_time, + .calibrate_decr = generic_calibrate_decr, + .progress = maple_progress, + .power_save = power4_idle, +};
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 109/125 ext4: do not commit super on read-only bdev
In reply to Greg Kroah-HartmanFrom: Eric Sandeen <[email protected]>
[ Upstream commit c96e2b8564adfb8ac14469ebc51ddc1bfecb3ae2 ]
Under some circumstances we may encounter a filesystem error on a read-only block device, and if we try to save the error info to the superblock and commit it, we'll wind up with a noisy error and backtrace, i.e.:
[ 3337.146838] EXT4-fs error (device pmem1p2): ext4_get_journal_inode:4634: comm mount: inode #0: comm mount: iget: illegal inode # ------------[ cut here ]------------ generic_make_request: Trying to write to read-only block-device pmem1p2 (partno 2) WARNING: CPU: 107 PID: 115347 at block/blk-core.c:788 generic_make_request_checks+0x6b4/0x7d0
...
To avoid this, commit the error info in the superblock only if the block device is writable.
--- fs/ext4/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/super.c +2 -1
@@ -344,7 +344,8 @@ static void save_error_info(struct super_block *sb, const char *func, unsigned int line) {__save_error_info (sb, func, line); -ext4_commit_super (sb,1 ); +if (!bdev_read_only (sb->s_bdev)) +ext4_commit_super (sb,1 ); }/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 110/125 percpu_counter: fix a data race at vm_committed_as
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit 7e2345200262e4a6056580f0231cccdaffc825f3 ]
"vm_committed_as.count" could be accessed concurrently as reported by KCSAN,
BUG: KCSAN: data-race in __vm_enough_memory / percpu_counter_add_batch
write to 0xffffffff9451c538 of 8 bytes by task 65879 on cpu 35:
percpu_counter_add_batch+0x83/0xd0 percpu_counter_add_batch at lib/percpu_counter.c:91 __vm_enough_memory+0xb9/0x260 dup_mm+0x3a4/0x8f0 copy_process+0x2458/0x3240 _do_fork+0xaa/0x9f0 __do_sys_clone+0x125/0x160 __x64_sys_clone+0x70/0x90 do_syscall_64+0x91/0xb05 entry_SYSCALL_64_after_hwframe+0x49/0xbe
read to 0xffffffff9451c538 of 8 bytes by task 66773 on cpu 19:
__vm_enough_memory+0x199/0x260 percpu_counter_read_positive at include/linux/percpu_counter.h:81 (inlined by) __vm_enough_memory at mm/util.c:839 mmap_region+0x1b2/0xa10 do_mmap+0x45c/0x700 vm_mmap_pgoff+0xc0/0x130 ksys_mmap_pgoff+0x6e/0x300 __x64_sys_mmap+0x33/0x40 do_syscall_64+0x91/0xb05 entry_SYSCALL_64_after_hwframe+0x49/0xbe
The read is outside percpu_counter::lock critical section which results in a data race. Fix it by adding a READ_ONCE() in percpu_counter_read_positive() which could also service as the existing compiler memory barrier.
--- include/linux/percpu_counter.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/percpu_counter.h +2 -2
@@ -76,9 +76,9 @@ static inline s64 percpu_counter_read(struct percpu_counter *fbc)*/ static inline s64 percpu_counter_read_positive (struct percpu_counter *fbc) { -s64 ret = fbc->count; +/* Prevent reloads of fbc->count */ +s64 ret =READ_ONCE (fbc->count); -barrier ();/* Prevent reloads of fbc->count */ if (ret >=0 )return ret;return 0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 111/125 compiler.h: fix error in BUILD_BUG_ON() reporting
In reply to Greg Kroah-HartmanFrom: Vegard Nossum <[email protected]>
[ Upstream commit af9c5d2e3b355854ff0e4acfbfbfadcd5198a349 ]
compiletime_assert() uses __LINE__ to create a unique function name. This means that if you have more than one BUILD_BUG_ON() in the same source line (which can happen if they appear e.g. in a macro), then the error message from the compiler might output the wrong condition.
For this source file:
#include <linux/build_bug.h>
#define macro() \
BUILD_BUG_ON(1); \
BUILD_BUG_ON(0);
void foo()
{
macro();
}gcc would output:
./include/linux/compiler.h:350:38: error: call to `__compiletime_assert_9' declared with attribute error: BUILD_BUG_ON failed: 0
_compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
However, it was not the BUILD_BUG_ON(0) that failed, so it should say 1 instead of 0. With this patch, we use __COUNTER__ instead of __LINE__, so each BUILD_BUG_ON() gets a different function name and the correct condition is printed:
./include/linux/compiler.h:350:38: error: call to `__compiletime_assert_0' declared with attribute error: BUILD_BUG_ON failed: 1
_compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
--- include/linux/compiler.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/compiler.h +1 -1
@@ -546,7 +546,7 @@ unsigned long read_word_at_a_time(const void *addr)* compiler has support to do so. */ #define compiletime_assert (condition, msg) \ - _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__) + _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)#define compiletime_assert_atomic_type (t) \ compiletime_assert(__native_word(t), \
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 112/125 KVM: s390: vsie: Fix possible race when shadowing region 3 tables
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
[ Upstream commit 1493e0f944f3c319d11e067c185c904d01c17ae5 ]
We have to properly retry again by returning -EINVAL immediately in case somebody else instantiated the table concurrently. We missed to add the goto in this function only. The code now matches the other, similar shadowing functions.
We are overwriting an existing region 2 table entry. All allocated pages are added to the crst_list to be freed later, so they are not lost forever. However, when unshadowing the region 2 table, we wouldn't trigger unshadowing of the original shadowed region 3 table that we replaced. It would get unshadowed when the original region 3 table is modified. As it's not connected to the page table hierarchy anymore, it's not going to get used anymore. However, for a limited time, this page table will stick around, so it's in some sense a temporary memory leak.
Identified by manual code inspection. I don't think this classifies as stable material.
--- arch/s390/mm/gmap.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/mm/gmap.c +1 -0
@@ -1684,6 +1684,7 @@ int gmap_shadow_r3t(struct gmap *sg, unsigned long saddr, unsigned long r3t, goto out_free; }else if (*table & _REGION_ENTRY_ORIGIN) { rc = -EAGAIN ;/* Race with shadow */ + goto out_free; }crst_table_init (s_r3t, _REGION3_ENTRY_EMPTY);/* mark as invalid as long as the parent table is not protected */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 113/125 NFS: Fix memory leaks in nfs_pageio_stop_mirroring()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 862f35c94730c9270833f3ad05bd758a29f204ed ]
If we just set the mirror count to 1 without first clearing out the mirrors, we can leak queued up requests.
--- fs/nfs/pagelist.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
fs/nfs/pagelist.c +8 -9
@@ -851,15 +851,6 @@ static int nfs_pageio_setup_mirroring(struct nfs_pageio_descriptor *pgio,return 0 ; } -/* -* nfs_pageio_stop_mirroring - stop using mirroring (set mirror count to 1) -*/ -void nfs_pageio_stop_mirroring (struct nfs_pageio_descriptor *pgio) -{ - pgio->pg_mirror_count =1 ; - pgio->pg_mirror_idx =0 ; -} -static void nfs_pageio_cleanup_mirroring (struct nfs_pageio_descriptor *pgio) { pgio->pg_mirror_count =1 ;
@@ -1285,6 +1276,14 @@ void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *desc, pgoff_t index) } } +/* +* nfs_pageio_stop_mirroring - stop using mirroring (set mirror count to 1) +*/ +void nfs_pageio_stop_mirroring (struct nfs_pageio_descriptor *pgio) +{ +nfs_pageio_complete (pgio); +} +int __init nfs_init_nfspagecache (void ) { nfs_page_cachep = kmem_cache_create("nfs_page",
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 114/125 ext2: fix empty body warnings when -Wextra is used
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 44a52022e7f15cbaab957df1c14f7a4f527ef7cf ]
When EXT2_ATTR_DEBUG is not defined, modify the 2 debug macros to use the no_printk() macro instead of <nothing>. This fixes gcc warnings when -Wextra is used:
../fs/ext2/xattr.c:252:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] ../fs/ext2/xattr.c:258:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] ../fs/ext2/xattr.c:330:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] ../fs/ext2/xattr.c:872:45: warning: suggest braces around empty body in an ‘else’ statement [-Wempty-body]
I have verified that the only object code change (with gcc 7.5.0) is the reversal of some instructions from 'cmp a,b' to 'cmp b,a'.
--- fs/ext2/xattr.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/ext2/xattr.c +3 -2
@@ -55,6 +55,7 @@#include <linux/buffer_head.h> #include <linux/init.h> +#include <linux/printk.h> #include <linux/slab.h> #include <linux/mbcache.h> #include <linux/quotaops.h>
@@ -83,8 +84,8 @@printk ("\n" ); \ } while (0) #else -# define ea_idebug(f...) -# define ea_bdebug(f...) +# define ea_idebug(inode, f...) no_printk(f) +# define ea_bdebug(bh, f...) no_printk(f)#endif static int ext2_xattr_set2(struct inode *, struct buffer_head *,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 115/125 ext2: fix debug reference to ext2_xattr_cache
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 32302085a8d90859c40cf1a5e8313f575d06ec75 ]
Fix a debug-only build error in ext2/xattr.c:
When building without extra debugging, (and with another patch that uses no_printk() instead of <empty> for the ext2-xattr debug-print macros, this build error happens:
../fs/ext2/xattr.c: In function ‘ext2_xattr_cache_insert’:../fs/ext2/xattr.c:869:18: error: ‘ext2_xattr_cache’ undeclared (first use in this function); did you mean ‘ext2_xattr_list’?
atomic_read(&ext2_xattr_cache->c_entry_count));
Fix the problem by removing cached entry count from the debug message since otherwise we'd have to export the mbcache structure just for that.
--- fs/ext2/xattr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/ext2/xattr.c +1 -2
@@ -836,8 +836,7 @@ ext2_xattr_cache_insert(struct mb_cache *cache, struct buffer_head *bh) error =mb_cache_entry_create (cache,GFP_NOFS , hash, bh->b_blocknr,1 );if (error) {if (error == -EBUSY ) { -ea_bdebug (bh,"already in cache (%d cache entries)" , -atomic_read (&ext2_xattr_cache->c_entry_count)); +ea_bdebug (bh,"already in cache" ); error =0 ; } }else
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 116/125 libnvdimm: Out of bounds read in __nd_ioctl()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit f84afbdd3a9e5e10633695677b95422572f920dc ]
The "cmd" comes from the user and it can be up to 255. It it's more than the number of bits in long, it results out of bounds read when we check test_bit(cmd, &cmd_mask). The highest valid value for "cmd" is ND_CMD_CALL (10) so I added a compare against that.
--- drivers/nvdimm/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/nvdimm/bus.c +4 -2
@@ -851,8 +851,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,return -EFAULT ; } -if (!desc || (desc->out_num + desc->in_num ==0 ) || - !test_bit (cmd, &cmd_mask)) +if (!desc || + (desc->out_num + desc->in_num ==0 ) || + cmd >ND_CMD_CALL || + !test_bit (cmd, &cmd_mask))return -ENOTTY ;/* fail write commands (when read-only) */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 117/125 iommu/amd: Fix the configuration of GCR3 table root pointer
In reply to Greg Kroah-HartmanFrom: Adrian Huang <[email protected]>
[ Upstream commit c20f36534666e37858a14e591114d93cc1be0d34 ]
The SPA of the GCR3 table root pointer[51:31] masks 20 bits. However, this requires 21 bits (Please see the AMD IOMMU specification). This leads to the potential failure when the bit 51 of SPA of the GCR3 table root pointer is 1'.
--- drivers/iommu/amd_iommu_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd_iommu_types.h +1 -1
@@ -329,7 +329,7 @@#define DTE_GCR3_VAL_A (x) (((x) >> 12) & 0x00007ULL)#define DTE_GCR3_VAL_B (x) (((x) >> 15) & 0x0ffffULL) -#define DTE_GCR3_VAL_C (x) (((x) >> 31) & 0xfffffULL) +#define DTE_GCR3_VAL_C (x) (((x) >> 31) & 0x1fffffULL)#define DTE_GCR3_INDEX_A 0#define DTE_GCR3_INDEX_B 1
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 118/125 fbdev: potential information leak in do_fb_ioctl()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit d3d19d6fc5736a798b118971935ce274f7deaa82 upstream.
The "fix" struct has a 2 byte hole after ->ywrapstep and the "fix = info->fix;" assignment doesn't necessarily clear it. It depends on the compiler. The solution is just to replace the assignment with an memcpy().
--- drivers/video/fbdev/core/fbmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/core/fbmem.c +1 -1
@@ -1132,7 +1132,7 @@ static long do_fb_ioctl(struct fb_info *case FBIOGET_FSCREENINFO :if (!lock_fb_info (info))return -ENODEV ; - fix = info->fix; +memcpy (&fix, &info->fix,sizeof (fix));unlock_fb_info (info); ret =copy_to_user (argp, &fix,sizeof (fix)) ? -EFAULT :0 ;
Greg Kroah-Hartman
maintainerPATCH 119/125 tty: evh_bytechan: Fix out of bounds accesses
In reply to Greg Kroah-HartmanFrom: Stephen Rothwell <[email protected]>
commit 3670664b5da555a2a481449b3baafff113b0ac35 upstream.
ev_byte_channel_send() assumes that its third argument is a 16 byte array. Some places where it is called it may not be (or we can't easily tell if it is). Newer compilers have started producing warnings about this, so make sure we actually pass a 16 byte array.
There may be more elegant solutions to this, but the driver is quite old and hasn't been updated in many years.
The warnings (from a powerpc allyesconfig build) are:
In file included from include/linux/byteorder/big_endian.h:5,
from arch/powerpc/include/uapi/asm/byteorder.h:14,
from include/asm-generic/bitops/le.h:6,
from arch/powerpc/include/asm/bitops.h:250,
from include/linux/bitops.h:29,
from include/linux/kernel.h:12,
from include/asm-generic/bug.h:19,
from arch/powerpc/include/asm/bug.h:109,
from include/linux/bug.h:5,
from include/linux/mmdebug.h:5,
from include/linux/gfp.h:5,
from include/linux/slab.h:15,
from drivers/tty/ehv_bytechan.c:24:
drivers/tty/ehv_bytechan.c: In function ‘ehv_bc_udbg_putc’:
arch/powerpc/include/asm/epapr_hcalls.h:298:20: warning: array subscript 1 is outside array bounds of ‘const char[1]’ [-Warray-bounds]
298 | r6 = be32_to_cpu(p[1]);
include/uapi/linux/byteorder/big_endian.h:40:51: note: in definition of macro ‘__be32_to_cpu’
40 | #define __be32_to_cpu(x) ((__force __u32)(__be32)(x))
| ^
arch/powerpc/include/asm/epapr_hcalls.h:298:7: note: in expansion of macro ‘be32_to_cpu’
298 | r6 = be32_to_cpu(p[1]);
| ^~~~~~~~~~~ drivers/tty/ehv_bytechan.c:166:13: note: while referencing ‘data’
166 | static void ehv_bc_udbg_putc(char c)
| ^~~~~~~~~~~~~~~~
--- drivers/tty/ehv_bytechan.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/tty/ehv_bytechan.c +18 -3
@@ -139,6 +139,21 @@ static int find_console_handle(void)return 1 ; } +static unsigned int local_ev_byte_channel_send (unsigned int handle, +unsigned int *count, +const char *p) +{ +char buffer[EV_BYTE_CHANNEL_MAX_BYTES ]; +unsigned int c = *count; + +if (c <sizeof (buffer)) { +memcpy (buffer, p, c); +memset (&buffer[c],0 ,sizeof (buffer) - c); + p = buffer; + } +return ev_byte_channel_send (handle, count, p); +} +/*************************** EARLY CONSOLE DRIVER ***************************/ #ifdef CONFIG_PPC_EARLY_DEBUG_EHV_BC
@@ -157,7 +172,7 @@ static void byte_channel_spin_send(constdo { count =1 ; - ret =ev_byte_channel_send (CONFIG_PPC_EARLY_DEBUG_EHV_BC_HANDLE , + ret =local_ev_byte_channel_send (CONFIG_PPC_EARLY_DEBUG_EHV_BC_HANDLE , &count, &data); }while (ret ==EV_EAGAIN ); }
@@ -224,7 +239,7 @@ static int ehv_bc_console_byte_channel_swhile (count) { len = min_t(unsigned int, count, EV_BYTE_CHANNEL_MAX_BYTES);do { - ret =ev_byte_channel_send (handle, &len, s); + ret =local_ev_byte_channel_send (handle, &len, s); }while (ret ==EV_EAGAIN ); count -= len; s += len;
@@ -404,7 +419,7 @@ static void ehv_bc_tx_dequeue(struct ehvCIRC_CNT_TO_END (bc->head, bc->tail,BUF_SIZE ), EV_BYTE_CHANNEL_MAX_BYTES); - ret =ev_byte_channel_send (bc->handle, &len, bc->buf + bc->tail); + ret =local_ev_byte_channel_send (bc->handle, &len, bc->buf + bc->tail);/* 'len' is valid only if the return code is 0 or EV_EAGAIN */ if (!ret || (ret ==EV_EAGAIN ))
Greg Kroah-Hartman
maintainerPATCH 120/125 locktorture: Print ratio of acquisitions, not failures
In reply to Greg Kroah-HartmanFrom: Paul E. McKenney <[email protected]>
commit 80c503e0e68fbe271680ab48f0fe29bc034b01b7 upstream.
The __torture_print_stats() function in locktorture.c carefully initializes local variable "min" to statp[0].n_lock_acquired, but then compares it to statp[i].n_lock_fail. Given that the .n_lock_fail field should normally be zero, and given the initialization, it seems reasonable to display the maximum and minimum number acquisitions instead of miscomputing the maximum and minimum number of failures. This commit therefore switches from failures to acquisitions.
And this turns out to be not only a day-zero bug, but entirely my own fault. I hate it when that happens!
--- kernel/locking/locktorture.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/locking/locktorture.c +4 -4
@@ -649,10 +649,10 @@ static void __torture_print_stats(char *if (statp[i].n_lock_fail) fail = true; sum += statp[i].n_lock_acquired; -if (max < statp[i].n_lock_fail) - max = statp[i].n_lock_fail; -if (min > statp[i].n_lock_fail) - min = statp[i].n_lock_fail; +if (max < statp[i].n_lock_acquired) + max = statp[i].n_lock_acquired; +if (min > statp[i].n_lock_acquired) + min = statp[i].n_lock_acquired; } page += sprintf(page, "%s: Total: %lld Max/Min: %ld/%ld %s Fail: %d %s\n",
Greg Kroah-Hartman
maintainerPATCH 121/125 mtd: lpddr: Fix a double free in probe()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 4da0ea71ea934af18db4c63396ba2af1a679ef02 upstream.
This function is only called from lpddr_probe(). We free "lpddr" both here and in the caller, so it's a double free. The best place to free "lpddr" is in lpddr_probe() so let's delete this one.
--- drivers/mtd/lpddr/lpddr_cmds.c | 1 - 1 file changed, 1 deletion(-)
drivers/mtd/lpddr/lpddr_cmds.c +0 -1
@@ -81,7 +81,6 @@ struct mtd_info *lpddr_cmdset(struct map shared =kmalloc (sizeof (struct flchip_shared ) * lpddr->numchips,GFP_KERNEL );if (!shared) { -kfree (lpddr);kfree (mtd);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 122/125 mtd: phram: fix a double free issue in error path
In reply to Greg Kroah-HartmanFrom: Wen Yang <[email protected]>
commit 49c64df880570034308e4a9a49c4bc95cf8cdb33 upstream.
The variable 'name' is released multiple times in the error path, which may cause double free issues.
This problem is avoided by adding a goto label to release the memory uniformly. And this change also makes the code a bit more cleaner.
--- drivers/mtd/devices/phram.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/mtd/devices/phram.c +9 -6
@@ -247,22 +247,25 @@ static int phram_setup(const char *val) ret =parse_num64 (&start, token[1 ]);if (ret) { -kfree (name);parse_err ("illegal start address\n" ); + goto error; } ret =parse_num64 (&len, token[2 ]);if (ret) { -kfree (name);parse_err ("illegal device length\n" ); + goto error; } ret =register_device (name, start, len); -if (!ret) -pr_info ("%s device: %#llx at %#llx\n" , name, len, start); -else -kfree (name); +if (ret) + goto error; +pr_info ("%s device: %#llx at %#llx\n" , name, len, start); +return 0 ; + +error: +kfree (name);return ret; }
Greg Kroah-Hartman
maintainerPATCH 123/125 x86/CPU: Add native CPUID variants returning a single datum
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
commit 5dedade6dfa243c130b85d1e4daba6f027805033 upstream.
... similarly to the cpuid_<reg>() variants.
--- arch/x86/include/asm/processor.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/x86/include/asm/processor.h +18 -0
@@ -213,6 +213,24 @@ static inline void native_cpuid(unsigned : "memory"); } +#define native_cpuid_reg (reg) \ +static inline unsigned int native_cpuid_##reg(unsigned int op) \ +{ \ + unsigned int eax = op, ebx, ecx = 0, edx; \ + \ + native_cpuid(&eax, &ebx, &ecx, &edx); \ + \ + return reg; \ +} + +/* +* Native CPUID functions returning a single datum. +*/ +native_cpuid_reg (eax) +native_cpuid_reg (ebx ) +native_cpuid_reg (ecx) +native_cpuid_reg (edx) + static inline voidload_cr3 (pgd_t *pgdir) {write_cr3 (__pa (pgdir));
Greg Kroah-Hartman
maintainerPATCH 124/125 x86/microcode/intel: replace sync_core() with native_cpuid_reg(eax)
In reply to Greg Kroah-HartmanFrom: Evalds Iodzevics <[email protected]>
On Intel it is required to do CPUID(1) before reading the microcode revision MSR. Current code in 4.4 an 4.9 relies on sync_core() to call CPUID, unfortunately on 32 bit machines code inside sync_core() always jumps past CPUID instruction as it depends on data structure boot_cpu_data witch are not populated correctly so early in boot sequence.
It depends on:
commit 5dedade6dfa2 ("x86/CPU: Add native CPUID variants returning a single datum")
This patch is for 4.4 but also should apply to 4.9
--- arch/x86/include/asm/microcode_intel.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/microcode_intel.h +1 -1
@@ -59,7 +59,7 @@ static inline u32 intel_get_microcode_renative_wrmsrl (MSR_IA32_UCODE_REV ,0 );/* As documented in the SDM: Do a CPUID 1 here */ -sync_core (); +native_cpuid_eax (1 );/* get the current revision from MSR 0x8B */ native_rdmsr (MSR_IA32_UCODE_REV , dummy, rev);
Greg Kroah-Hartman
maintainerPATCH 125/125 x86/vdso: Fix lsl operand order
In reply to Greg Kroah-HartmanFrom: Samuel Neves <[email protected]>
commit e78e5a91456fcecaa2efbb3706572fe043766f4d upstream.
In the __getcpu function, lsl is using the wrong target and destination registers. Luckily, the compiler tends to choose %eax for both variables, so it has been working so far.
--- arch/x86/include/asm/vgtod.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/vgtod.h +1 -1
@@ -92,7 +92,7 @@ static inline unsigned int __getcpu(void* * If RDPID is available, use it. */ -alternative_io ("lsl %[p],%[seg]" , +alternative_io ("lsl %[seg],%[p]" ,".byte 0xf3,0x0f,0xc7,0xf8" ,/* RDPID %eax/rax */ X86_FEATURE_RDPID, [p] "=a" (p), [seg] "r" (__PER_CPU_SEG));
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.220 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 24 Apr 2020 09:48:23 +0000. Anything received after that time might be too late.
I see a number of unit test crashes in ppc images. Looks like UAF. This affects 4.4.y, 4.9.y, and 4.14.y. I'll bisect.
Guenter
---
BUG: Unable to handle kernel data access at 0x6b6b6b6b6b6b6b6b Faulting instruction address: 0xc0000000006651dc Oops: Kernel access of bad area, sig: 11 [#1] PREEMPT SMP NR_CPUS=32 PowerMac Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.9.220-rc1-00126-gf6cef26 #1
task: c00000003c1c8010 task.stack: c00000003c1c4000
NIP: c0000000006651dc LR: c00000000066824c CTR: c000000000668230
REGS: c00000003c1c7320 TRAP: 0380 Not tainted (4.9.220-rc1-00126-gf6cef26)
MSR: 800000000000b032 <SF,EE,FP,ME,IR,DR,RI> CR: 28004448 XER: 00000000
SOFTE: 0
GPR00: 00000000743a2027 c00000003c1c75a0 c0000000011e1000 c000000001e926cc
GPR04: c000000001e92aa0 c000000001e92aa0 04ffffff000affff 0000000000000000
GPR08: c0000000006646b0 ffffffffffffffff 6b6b6b6b6b6b6b6b 0000000000000001
GPR12: 0000000044004448 c00000000fff9000 c00000000000ffc0 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: c00000003c1c7878 0000000000000000 0000000000000002 c00000003c1c7880
GPR24: c000000000e506ae 0000000000000025 c000000001e926c0 0000000000000020
GPR28: 00000000000003e0 c000000001e92aa0 c000000000e506ae c000000001e926cc NIP [c0000000006651dc] .string+0x1c/0xe0
LR [c00000000066824c] .vsnprintf+0x1ac/0x490
Call Trace:
[c00000003c1c75a0] [c00000003a512af8] 0xc00000003a512af8 (unreliable) [c00000003c1c7670] [c000000000668548] .vscnprintf+0x18/0x60 [c00000003c1c76f0] [c0000000001386cc] .vprintk_emit+0x12c/0x6d0 [c00000003c1c77c0] [c000000000bc3d84] .printk+0xa0/0xbc [c00000003c1c7840] [c00000000065a9b0] .kobject_put+0x150/0x170 [c00000003c1c78d0] [c0000000009819bc] .of_node_put+0x2c/0x50 [c00000003c1c7950] [c000000000f7998c] .of_unittest_changeset+0x710/0x75c [c00000003c1c7b00] [c000000000f7c280] .of_unittest+0x22b8/0x2978 [c00000003c1c7c20] [c00000000000f554] .do_one_initcall+0x64/0x1e0 [c00000003c1c7d00] [c000000000f236a8] .kernel_init_freeable+0x298/0x38c [c00000003c1c7db0] [c00000000000ffe4] .kernel_init+0x24/0x160 [c00000003c1c7e30] [c00000000000c330] .ret_from_kernel_thread+0x58/0x68 Instruction dump:4b9f3c45 60000000 e80100a0 7c0803a6 4bffffd4 2ba50fff 7caa2b78 7cc90734 7c852378 409d0030 2fa90000 419e00b8 <890a0000> 394a0001 2fa80000 419e00a8
---[ end trace f5bca90605285cbd ]---
Quoted 6 lines · Guenter Roeck
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.220 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Quoted 3 lines
Responses should be made by Fri, 24 Apr 2020 09:48:23 +0000. Anything received after that time might be too late.
I see a number of unit test crashes in ppc images. Looks like UAF. This affects 4.4.y, 4.9.y, and 4.14.y. I'll bisect.
Bisect log attached. I suspect the real culprit is commit a4f91f0de905 ("of: unittest: clean up changeset test"), or at least it changes the code enough for the offending patch not to work in v4.14.y and older. Either case, reverting upstream commit b3fb36ed694b ("of: unittest:
kmemleak on changeset destroy") fixes the problem and thus needs to be dropped from v4.4.y, v4.9.y, and v4.14.y.
Guenter
---
# bad: [f6cef26090da1763de1a7fc87205c8442d57bc80] Linux 4.9.220-rc1
# good: [5188957a315f664d46ff58fedecbc0f7503f1b22] Linux 4.9.219
git bisect start 'HEAD' 'v4.9.219'
# good: [0a499a93529e488ccccf83493c48e82b0bdea615] powerpc/fsl_booke: Avoid creating duplicate tlb1 entry git bisect good 0a499a93529e488ccccf83493c48e82b0bdea615
# bad: [f0b256f314141838039a084b81750d7a9dbc1e16] scsi: ufs: make sure all interrupts are processed git bisect bad f0b256f314141838039a084b81750d7a9dbc1e16
# good: [9eb52f304182868156a97244618a09898d2dc37b] mac80211_hwsim: Use kstrndup() in place of kasprintf() git bisect good 9eb52f304182868156a97244618a09898d2dc37b
# good: [cddafffc473da45d9eb419000ab9409824ef8f20] scsi: sg: add sg_remove_request in sg_common_write git bisect good cddafffc473da45d9eb419000ab9409824ef8f20
# bad: [19976f5df09c19ce1bb0563055586998dda609dd] drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem git bisect bad 19976f5df09c19ce1bb0563055586998dda609dd
# bad: [9dbcfb15960da712fc134b5d4a133386721497c5] of: unittest: kmemleak on changeset destroy
git bisect bad 9dbcfb15960da712fc134b5d4a133386721497c5
# good: [52b90d68b8c200b86e66434e0bc86e87510863f3] ALSA: hda: Don't release card at firmware loading error git bisect good 52b90d68b8c200b86e66434e0bc86e87510863f3
# first bad commit: [9dbcfb15960da712fc134b5d4a133386721497c5] of: unittest: kmemleak on changeset destroy
Greg Kroah-Hartman
maintainerQuoted 15 lines · Guenter Roeck
Quoted 6 lines · Guenter Roeck
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.220 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Quoted 3 lines
Responses should be made by Fri, 24 Apr 2020 09:48:23 +0000. Anything received after that time might be too late.
I see a number of unit test crashes in ppc images. Looks like UAF. This affects 4.4.y, 4.9.y, and 4.14.y. I'll bisect.
Quoted 6 lines
Bisect log attached. I suspect the real culprit is commit
a4f91f0de905("of: unittest: clean up changeset test"), or at least it changes the code enough for the offending patch not to work in v4.14.y and older. Either case, reverting upstream commitb3fb36ed694b("of: unittest:
kmemleak on changeset destroy") fixes the problem and thus needs to be dropped from v4.4.y, v4.9.y, and v4.14.y.
Thanks for letting me know, I've now dropped it from all of those trees.
greg k-h
Quoted 16 lines · Greg Kroah-Hartman
Quoted 15 lines · Guenter Roeck
Quoted 13 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.220 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 24 Apr 2020 09:48:23 +0000. Anything received after that time might be too late.
I see a number of unit test crashes in ppc images. Looks like UAF. This affects 4.4.y, 4.9.y, and 4.14.y. I'll bisect.
Quoted 9 lines
Quoted 6 lines
Bisect log attached. I suspect the real culprit is commit
a4f91f0de905("of: unittest: clean up changeset test"), or at least it changes the code enough for the offending patch not to work in v4.14.y and older. Either case, reverting upstream commitb3fb36ed694b("of: unittest:
kmemleak on changeset destroy") fixes the problem and thus needs to be dropped from v4.4.y, v4.9.y, and v4.14.y.Thanks for letting me know, I've now dropped it from all of those trees.
Did you (or do you plan to) push the updated branches ? My builders didn't pick it up yet.
Guenter
Greg Kroah-Hartman
maintainerQuoted 24 lines · Guenter Roeck
Quoted 23 lines · Greg Kroah-Hartman
Quoted 21 lines · Guenter Roeck
Quoted 6 lines · Guenter Roeck
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.220 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Quoted 3 lines
Responses should be made by Fri, 24 Apr 2020 09:48:23 +0000. Anything received after that time might be too late.
I see a number of unit test crashes in ppc images. Looks like UAF. This affects 4.4.y, 4.9.y, and 4.14.y. I'll bisect.
Bisect log attached. I suspect the real culprit is commit
a4f91f0de905("of: unittest: clean up changeset test"), or at least it changes the code enough for the offending patch not to work in v4.14.y and older. Either case, reverting upstream commitb3fb36ed694b("of: unittest:
kmemleak on changeset destroy") fixes the problem and thus needs to be dropped from v4.4.y, v4.9.y, and v4.14.y.
Quoted 5 lines
Quoted 2 lines
Thanks for letting me know, I've now dropped it from all of those trees.
Did you (or do you plan to) push the updated branches ? My builders didn't pick it up yet.
Sorry about that, have now pushed out a -rc2 for all of those 3 branches.
greg k-h
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.220 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 24 Apr 2020 09:48:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.220-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra
Test results for stable-v4.9:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
24 tests: 24 pass, 0 failLinux version: 4.9.220-rc1-gf6cef26090da
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Cheers
Jon
Signature · 1 line
nvpublic