4.19.135-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.19.135-rc1 review
This is the start of the stable review cycle for the 4.19.135 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.135-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.135-rc1
Mark O'Donovan <[email protected]>
ath9k: Fix regression with Atheros 9271
Qiujun Huang <[email protected]>
ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
Mikulas Patocka <[email protected]>
dm integrity: fix integrity recalculation that is improperly skipped
Geert Uytterhoeven <[email protected]>
ASoC: qcom: Drop HAS_DMA dependency to fix link failure
Hans de Goede <[email protected]>
ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10
Joerg Roedel <[email protected]>
x86, vmlinux.lds: Page-align end of ..page_aligned sections
John David Anglin <[email protected]>
parisc: Add atomic64_set_release() define to avoid CPU soft lockups
Qiu Wenbo <[email protected]>
drm/amd/powerplay: fix a crash when overclocking Vega M
Paweł Gronowski <[email protected]>
drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
Michael J. Ruhl <[email protected]>
io-mapping: indicate mapping failure
Muchun Song <[email protected]>
mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
Hugh Dickins <[email protected]>
mm/memcg: fix refcount error while moving and swapping
Fangrui Song <[email protected]>
Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
Tetsuo Handa <[email protected]>
vt: Reject zero-sized screen buffer size.
Tetsuo Handa <[email protected]>
fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
Serge Semin <[email protected]>
serial: 8250_mtk: Fix high-speed baud rates clamping
Yang Yingliang <[email protected]>
serial: 8250: fix null-ptr-deref in serial8250_start_tx()
Ian Abbott <[email protected]>
staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
Ian Abbott <[email protected]>
staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
Ian Abbott <[email protected]>
staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
Ian Abbott <[email protected]>
staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
Rustam Kovhaev <[email protected]>
staging: wlan-ng: properly check endpoint types
Steve French <[email protected]>
Revert "cifs: Fix the target file was deleted when rename failed."
Forest Crossman <[email protected]>
usb: xhci: Fix ASM2142/ASM3142 DMA addressing
Chunfeng Yun <[email protected]>
usb: xhci-mtk: fix the failure of bandwidth allocation
Tetsuo Handa <[email protected]>
binder: Don't use mmput() from shrinker function.
Palmer Dabbelt <[email protected]>
RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw
Arnd Bergmann <[email protected]>
x86: math-emu: Fix up 'cmp' insn for clang ias
Will Deacon <[email protected]>
arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
Cristian Marussi <[email protected]>
hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
Chu Lin <[email protected]>
hwmon: (adm1275) Make sure we are reading enough data for different chips
Evgeny Novikov <[email protected]>
usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
Derek Basehore <[email protected]>
Input: elan_i2c - only increment wakeup count on touch
Ilya Katsnelson <[email protected]>
Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
Leonid Ravich <[email protected]>
dmaengine: ioat setting ioat timeout as module parameter
Evgeny Novikov <[email protected]>
hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
Marc Kleine-Budde <[email protected]>
regmap: dev_get_regmap_match(): fix string comparison
leilk.liu <[email protected]>
spi: mediatek: use correct SPI_CFG2_REG MACRO
Merlijn Wajer <[email protected]>
Input: add SW_MACHINE_COVER
Dinghao Liu <[email protected]>
dmaengine: tegra210-adma: Fix runtime PM imbalance on error
Hans de Goede <[email protected]>
HID: apple: Disable Fn-key key-re-mapping on clone keyboards
Rodrigo Rivas Costa <[email protected]>
HID: steam: fixes race in handling device list.
Caiyuan Xie <[email protected]>
HID: alps: support devices with report id 2
Federico Ricchiuto <[email protected]>
HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
Stefano Garzarella <[email protected]>
scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
Pi-Hsun Shih <[email protected]>
scripts/decode_stacktrace: strip basepath from all paths
Matthew Howell <[email protected]>
serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
Cong Wang <[email protected]>
bonding: check return value of register_netdevice() in bond_newlink()
Wolfram Sang <[email protected]>
i2c: rcar: always clear ICSAR to avoid side effects
Wang Hai <[email protected]>
net: ethernet: ave: Fix error returns in ave_init
guodeqing <[email protected]>
ipvs: fix the connection sync failed in some cases
Alexander Lobakin <[email protected]>
qed: suppress "don't support RoCE & iWARP" flooding on HW init
Liu Jian <[email protected]>
mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
Taehee Yoo <[email protected]>
bonding: check error value of register_netdevice() immediately
Wang Hai <[email protected]>
net: smc91x: Fix possible memory leak in smc_drv_probe()
Chen-Yu Tsai <[email protected]>
drm: sun4i: hdmi: Fix inverted HPD result
Liu Jian <[email protected]>
ieee802154: fix one possible memleak in adf7242_probe
Sergey Organov <[email protected]>
net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration
George Kennedy <[email protected]>
ax88172a: fix ax88172a_unbind() failures
Christophe JAILLET <[email protected]>
hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path
Matthew Gerlach <[email protected]>
fpga: dfl: fix bug in port reset handshake
Vasundhara Volam <[email protected]>
bnxt_en: Fix race when modifying pause settings.
Robbie Ko <[email protected]>
btrfs: fix page leaks after failure to lock page for delalloc
Boris Burkov <[email protected]>
btrfs: fix mount failure caused by race with umount
Filipe Manana <[email protected]>
btrfs: fix double free on ulist after backref resolution failure
Hans de Goede <[email protected]>
ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
Takashi Iwai <[email protected]>
ALSA: info: Drop WARN_ON() from buffer NULL sanity check
Oleg Nesterov <[email protected]>
uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
Yang Yingliang <[email protected]>
IB/umem: fix reference count leak in ib_umem_odp_get()
Jon Maloy <[email protected]>
tipc: clean up skb list lock handling on send path
Vladimir Oltean <[email protected]>
spi: spi-fsl-dspi: Exit the ISR with IRQ_NONE when it's not ours
Olga Kornievskaia <[email protected]>
SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion")
Thomas Gleixner <[email protected]>
irqdomain/treewide: Keep firmware node unconditionally allocated
Miklos Szeredi <[email protected]>
fuse: fix weird page warning
Gavin Shan <[email protected]>
drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups()
Ben Skeggs <[email protected]>
drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
Tom Rix <[email protected]>
net: sky2: initialize return of gm_phy_read
Xie He <[email protected]>
drivers/net/wan/lapbether: Fixed the value of hard_header_len
Max Filippov <[email protected]>
xtensa: update *pos in cpuinfo_op.next
Max Filippov <[email protected]>
xtensa: fix __sync_fetch_and_{and,or}_4 declarations
Tom Rix <[email protected]>
scsi: scsi_transport_spi: Fix function pointer check
Markus Theil <[email protected]>
mac80211: allow rx of mesh eapol frames with default rx key
Jacky Hu <[email protected]>
pinctrl: amd: fix npins for uart0 in kerncz_groups
Navid Emamdoost <[email protected]>
gpio: arizona: put pm_runtime in case of failure
Navid Emamdoost <[email protected]>
gpio: arizona: handle pm_runtime_get_sync failure case
Douglas Anderson <[email protected]>
soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner
-------------
Diffstat:
Makefile | 6 +- arch/arm64/kernel/debug-monitors.c | 4 +- arch/parisc/include/asm/atomic.h | 2 + arch/riscv/include/asm/barrier.h | 10 ++- arch/x86/kernel/apic/io_apic.c | 10 +-- arch/x86/kernel/apic/msi.c | 18 ++++-- arch/x86/kernel/apic/vector.c | 1 - arch/x86/kernel/vmlinux.lds.S | 1 + arch/x86/math-emu/wm_sqrt.S | 2 +- arch/x86/platform/uv/uv_irq.c | 3 +- arch/xtensa/kernel/setup.c | 3 +- arch/xtensa/kernel/xtensa_ksyms.c | 4 +- drivers/android/binder_alloc.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/dma/ioat/dma.c | 12 ++++ drivers/dma/ioat/dma.h | 2 - drivers/dma/tegra210-adma.c | 5 +- drivers/firmware/psci_checker.c | 5 +- drivers/fpga/dfl-afu-main.c | 3 +- drivers/gpio/gpio-arizona.c | 7 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 +-- .../gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c | 10 +-- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 4 +- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +- drivers/hid/hid-alps.c | 2 + drivers/hid/hid-apple.c | 18 ++++++ drivers/hid/hid-steam.c | 6 +- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 +++ drivers/hwmon/aspeed-pwm-tacho.c | 2 + drivers/hwmon/pmbus/adm1275.c | 10 ++- drivers/hwmon/scmi-hwmon.c | 2 +- drivers/i2c/busses/i2c-rcar.c | 3 + drivers/infiniband/core/umem_odp.c | 3 +- drivers/input/mouse/elan_i2c_core.c | 7 ++- drivers/input/mouse/synaptics.c | 1 + drivers/iommu/amd_iommu.c | 5 +- drivers/iommu/intel_irq_remapping.c | 2 +- drivers/md/dm-integrity.c | 4 +- drivers/md/dm.c | 17 ++++++ drivers/net/bonding/bond_main.c | 10 ++- drivers/net/bonding/bond_netlink.c | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 +- drivers/net/ethernet/marvell/sky2.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 +- drivers/net/ethernet/smsc/smc91x.c | 4 +- drivers/net/ethernet/socionext/sni_ave.c | 2 +- drivers/net/hippi/rrunner.c | 2 +- drivers/net/ieee802154/adf7242.c | 4 +- drivers/net/phy/dp83640.c | 4 ++ drivers/net/usb/ax88172a.c | 1 + drivers/net/wan/lapbether.c | 9 ++- drivers/net/wireless/ath/ath9k/hif_usb.c | 52 ++++++++++++---- drivers/net/wireless/ath/ath9k/hif_usb.h | 5 ++ drivers/pci/controller/vmd.c | 5 +- drivers/pinctrl/pinctrl-amd.h | 2 +- drivers/scsi/scsi_transport_spi.c | 2 +- drivers/soc/qcom/rpmh.c | 8 +-- drivers/spi/spi-fsl-dspi.c | 4 +- drivers/spi/spi-mt65xx.c | 15 ++--- drivers/staging/comedi/drivers/addi_apci_1032.c | 20 ++++-- drivers/staging/comedi/drivers/addi_apci_1500.c | 24 ++++++-- drivers/staging/comedi/drivers/addi_apci_1564.c | 20 ++++-- drivers/staging/comedi/drivers/ni_6527.c | 2 +- drivers/staging/wlan-ng/prism2usb.c | 16 ++++- drivers/tty/serial/8250/8250_core.c | 2 +- drivers/tty/serial/8250/8250_exar.c | 12 +++- drivers/tty/serial/8250/8250_mtk.c | 18 ++++++ drivers/tty/vt/vt.c | 29 +++++---- drivers/usb/gadget/udc/gr_udc.c | 7 ++- drivers/usb/host/xhci-mtk-sch.c | 4 ++ drivers/usb/host/xhci-pci.c | 3 + drivers/video/fbdev/core/bitblit.c | 4 +- drivers/video/fbdev/core/fbcon_ccw.c | 4 +- drivers/video/fbdev/core/fbcon_cw.c | 4 +- drivers/video/fbdev/core/fbcon_ud.c | 4 +- fs/btrfs/backref.c | 1 + fs/btrfs/extent_io.c | 3 +- fs/btrfs/volumes.c | 8 +++ fs/cifs/inode.c | 10 +-- fs/fuse/dev.c | 3 +- fs/nfs/direct.c | 13 ++-- fs/nfs/file.c | 1 - include/asm-generic/vmlinux.lds.h | 5 +- include/linux/device-mapper.h | 1 + include/linux/io-mapping.h | 5 +- include/linux/mod_devicetable.h | 2 +- include/sound/rt5670.h | 1 + include/uapi/linux/input-event-codes.h | 3 +- kernel/events/uprobes.c | 2 +- mm/memcontrol.c | 4 +- mm/slab_common.c | 35 ++++++++--- net/mac80211/rx.c | 26 ++++++++ net/netfilter/ipvs/ip_vs_sync.c | 12 ++-- net/tipc/bcast.c | 8 +-- net/tipc/group.c | 4 +- net/tipc/link.c | 12 ++-- net/tipc/node.c | 7 ++- net/tipc/socket.c | 12 ++-- scripts/decode_stacktrace.sh | 4 +- scripts/gdb/linux/symbols.py | 2 +- sound/core/info.c | 4 +- sound/soc/codecs/rt5670.c | 71 +++++++++++++++++----- sound/soc/codecs/rt5670.h | 2 +- sound/soc/qcom/Kconfig | 2 +- 106 files changed, 578 insertions(+), 225 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/86 soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner
From: Douglas Anderson <[email protected]>
commit 35bb4b22f606c0cc8eedf567313adc18161b1af4 upstream.
Adding an item into the cache should never be able to make the cache cleaner. Use "|=" rather than "=" to update the dirty flag.
--- drivers/soc/qcom/rpmh.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soc/qcom/rpmh.c +4 -4
@@ -150,10 +150,10 @@ existing:break ; } - ctrlr->dirty = (req->sleep_val != old_sleep_val || - req->wake_val != old_wake_val) && - req->sleep_val !=UINT_MAX && - req->wake_val !=UINT_MAX ; + ctrlr->dirty |= (req->sleep_val != old_sleep_val || + req->wake_val != old_wake_val) && + req->sleep_val !=UINT_MAX && + req->wake_val !=UINT_MAX ; unlock:spin_unlock_irqrestore (&ctrlr->cache_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 2/86 gpio: arizona: handle pm_runtime_get_sync failure case
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit e6f390a834b56583e6fc0949822644ce92fbb107 ]
Calling pm_runtime_get_sync increments the counter even in case of failure, causing incorrect ref count. Call pm_runtime_put if pm_runtime_get_sync fails.
--- drivers/gpio/gpio-arizona.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpio/gpio-arizona.c +1 -0
@@ -111,6 +111,7 @@ static int arizona_gpio_direction_out(struct gpio_chip *chip, ret =pm_runtime_get_sync (chip->parent);if (ret <0 ) {dev_err (chip->parent,"Failed to resume: %d\n" , ret); +pm_runtime_put (chip->parent);return ret; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/86 gpio: arizona: put pm_runtime in case of failure
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit 861254d826499944cb4d9b5a15f5a794a6b99a69 ]
Calling pm_runtime_get_sync increments the counter even in case of failure, causing incorrect ref count if pm_runtime_put is not called in error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.
--- drivers/gpio/gpio-arizona.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpio/gpio-arizona.c +5 -1
@@ -69,6 +69,7 @@ static int arizona_gpio_get(struct gpio_chip *chip, unsigned offset) ret =pm_runtime_get_sync (chip->parent);if (ret <0 ) {dev_err (chip->parent,"Failed to resume: %d\n" , ret); +pm_runtime_put_autosuspend (chip->parent);return ret; }
@@ -77,12 +78,15 @@ static int arizona_gpio_get(struct gpio_chip *chip, unsigned offset)if (ret <0 ) {dev_err (chip->parent,"Failed to drop cache: %d\n" , ret); +pm_runtime_put_autosuspend (chip->parent);return ret; } ret =regmap_read (arizona->regmap, reg, &val); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (chip->parent);return ret; + }pm_runtime_mark_last_busy (chip->parent);pm_runtime_put_autosuspend (chip->parent);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/86 pinctrl: amd: fix npins for uart0 in kerncz_groups
In reply to Greg Kroah-HartmanFrom: Jacky Hu <[email protected]>
[ Upstream commit 69339d083dfb7786b0e0b3fc19eaddcf11fabdfb ]
uart0_pins is defined as:
static const unsigned uart0_pins[] = {135, 136, 137, 138, 139};
which npins is wronly specified as 9 later
{
.name = "uart0",
.pins = uart0_pins,
.npins = 9,
},npins should be 5 instead of 9 according to the definition.
--- drivers/pinctrl/pinctrl-amd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinctrl-amd.h +1 -1
@@ -256,7 +256,7 @@ static const struct amd_pingroup kerncz_groups[] = { { .name = "uart0", .pins = uart0_pins, - .npins = 9, + .npins = 5, }, { .name = "uart1",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/86 mac80211: allow rx of mesh eapol frames with default rx key
In reply to Greg Kroah-HartmanFrom: Markus Theil <[email protected]>
[ Upstream commit 0b467b63870d9c05c81456aa9bfee894ab2db3b6 ]
Without this patch, eapol frames cannot be received in mesh mode, when 802.1X should be used. Initially only a MGTK is defined, which is found and set as rx->key, when there are no other keys set. ieee80211_drop_unencrypted would then drop these eapol frames, as they are data frames without encryption and there exists some rx->key.
Fix this by differentiating between mesh eapol frames and other data frames with existing rx->key. Allow mesh mesh eapol frames only if they are for our vif address.
With this patch in-place, ieee80211_rx_h_mesh_fwding continues after the ieee80211_drop_unencrypted check and notices, that these eapol frames have to be delivered locally, as they should.
--- net/mac80211/rx.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
net/mac80211/rx.c +26 -0
@@ -2230,6 +2230,7 @@ static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)static int ieee80211_drop_unencrypted (struct ieee80211_rx_data *rx,__le16 fc) { +struct ieee80211_hdr *hdr = (void *)rx->skb->data;struct sk_buff *skb = rx->skb;struct ieee80211_rx_status *status =IEEE80211_SKB_RXCB (skb);
@@ -2240,6 +2241,31 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)if (status->flag &RX_FLAG_DECRYPTED )return 0 ; +/* check mesh EAPOL frames first */ +if (unlikely (rx->sta &&ieee80211_vif_is_mesh (&rx->sdata->vif) && +ieee80211_is_data (fc))) { +struct ieee80211s_hdr *mesh_hdr; +u16 hdr_len =ieee80211_hdrlen (fc); +u16 ethertype_offset; +__be16 ethertype; + +if (!ether_addr_equal (hdr->addr1, rx->sdata->vif.addr)) + goto drop_check; + +/* make sure fixed part of mesh header is there, also checks skb len */ +if (!pskb_may_pull (rx->skb, hdr_len +6 )) + goto drop_check; + + mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len); + ethertype_offset = hdr_len +ieee80211_get_mesh_hdrlen (mesh_hdr) + +sizeof (rfc1042_header); + +if (skb_copy_bits (rx->skb, ethertype_offset, ðertype,2 ) ==0 && + ethertype == rx->sdata->control_port_protocol) +return 0 ; + } + +drop_check:/* Drop unencrypted frames if key is set. */ if (unlikely(!ieee80211_has_protected(fc) && !ieee80211_is_any_nullfunc(fc) &&
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/86 scsi: scsi_transport_spi: Fix function pointer check
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit 5aee52c44d9170591df65fafa1cd408acc1225ce ]
clang static analysis flags several null function pointer problems.
drivers/scsi/scsi_transport_spi.c:374:1: warning: Called function pointer is null (null dereference) [core.CallAndMessage] spi_transport_max_attr(offset, "%d\n");
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Reviewing the store_spi_store_max macro
if (i->f->set_##field) return -EINVAL;
should be
if (!i->f->set_##field) return -EINVAL;
--- drivers/scsi/scsi_transport_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_transport_spi.c +1 -1
@@ -352,7 +352,7 @@ store_spi_transport_##field(struct device *dev, \struct spi_transport_attrs *tp \ = (struct spi_transport_attrs *)&starget->starget_data; \ \ - if (i->f->set_##field) \ + if (!i->f->set_##field) \ return -EINVAL; \ val = simple_strtoul(buf, NULL, 0); \ if (val > tp->max_##field) \
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/86 xtensa: fix __sync_fetch_and_{and,or}_4 declarations
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
[ Upstream commit 73f9941306d5ce030f3ffc7db425c7b2a798cf8e ]
Building xtensa kernel with gcc-10 produces the following warnings:
arch/xtensa/kernel/xtensa_ksyms.c:90:15: warning: conflicting types
for built-in function ‘__sync_fetch_and_and_4’; expected ‘unsigned int(volatile void *, unsigned int)’ [-Wbuiltin-declaration-mismatch]
arch/xtensa/kernel/xtensa_ksyms.c:96:15: warning: conflicting types
for built-in function ‘__sync_fetch_and_or_4’; expected ‘unsigned int(volatile void *, unsigned int)’ [-Wbuiltin-declaration-mismatch]
Fix declarations of these functions to avoid the warning.
--- arch/xtensa/kernel/xtensa_ksyms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/xtensa/kernel/xtensa_ksyms.c +2 -2
@@ -87,13 +87,13 @@ void __xtensa_libgcc_window_spill(void) }EXPORT_SYMBOL (__xtensa_libgcc_window_spill); -unsigned long __sync_fetch_and_and_4 (unsigned long *p,unsigned long v) +unsigned int __sync_fetch_and_and_4 (volatile void *p,unsigned int v) {BUG (); }EXPORT_SYMBOL (__sync_fetch_and_and_4); -unsigned long __sync_fetch_and_or_4 (unsigned long *p,unsigned long v) +unsigned int __sync_fetch_and_or_4 (volatile void *p,unsigned int v) {BUG (); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/86 xtensa: update *pos in cpuinfo_op.next
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
[ Upstream commit 0d5ab144429e8bd80889b856a44d56ab4a5cd59b ]
Increment *pos in the cpuinfo_op.next to fix the following warning triggered by cat /proc/cpuinfo:
seq_file: buggy .next function c_next did not update position index
--- arch/xtensa/kernel/setup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/xtensa/kernel/setup.c +2 -1
@@ -720,7 +720,8 @@ c_start(struct seq_file *f, loff_t *pos)static void *c_next (struct seq_file *f,void *v,loff_t *pos) { -return NULL ; + ++*pos; +return c_start (f, pos); } static void
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/86 drivers/net/wan/lapbether: Fixed the value of hard_header_len
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit 9dc829a135fb5927f1519de11286e2bbb79f5b66 ]
When this driver transmits data,
first this driver will remove a pseudo header of 1 byte, then the lapb module will prepend the LAPB header of 2 or 3 bytes, then this driver will prepend a length field of 2 bytes, then the underlying Ethernet device will prepend its own header.
So, the header length required should be:
-1 + 3 + 2 + "the header length needed by the underlying device".
This patch fixes kernel panic when this driver is used with AF_PACKET SOCK_DGRAM sockets.
--- drivers/net/wan/lapbether.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/wan/lapbether.c +8 -1
@@ -308,7 +308,6 @@ static void lapbeth_setup(struct net_device *dev) dev->netdev_ops = &lapbeth_netdev_ops; dev->needs_free_netdev = true; dev->type =ARPHRD_X25 ; - dev->hard_header_len =3 ; dev->mtu =1000 ; dev->addr_len =0 ; }
@@ -329,6 +328,14 @@ static int lapbeth_new_device(struct net_device *dev)if (!ndev) goto out; +/* When transmitting data: +* first this driver removes a pseudo header of 1 byte, +* then the lapb module prepends an LAPB header of at most 3 bytes, +* then this driver prepends a length field of 2 bytes, +* then the underlying Ethernet device prepends its own header. +*/ + ndev->hard_header_len =-1 +3 +2 + dev->hard_header_len; + lapbeth =netdev_priv (ndev); lapbeth->axdev = ndev;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/86 net: sky2: initialize return of gm_phy_read
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit 28b18e4eb515af7c6661c3995c6e3c34412c2874 ]
clang static analysis flags this garbage return
drivers/net/ethernet/marvell/sky2.c:208:2: warning: Undefined or garbage value returned to caller [core.uninitialized.UndefReturn]
return v;
^~~~~~~~static inline u16 gm_phy_read( ...
{
u16 v;
__gm_phy_read(hw, port, reg, &v);
return v;
}__gm_phy_read can return without setting v.
So handle similar to skge.c's gm_phy_read, initialize v.
--- drivers/net/ethernet/marvell/sky2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/sky2.c +1 -1
@@ -215,7 +215,7 @@ io_error:static inline u16 gm_phy_read (struct sky2_hw *hw,unsigned port,u16 reg) { -u16 v; +u16 v =0 ;__gm_phy_read (hw, port, reg, &v);return v; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 11/86 drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
[ Upstream commit 0156e76d388310a490aeb0f2fbb5b284ded3aecc ]
Tegra TRM says worst-case reply time is 1216us, and this should fix some spurious timeouts that have been popping up.
--- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c | 4 ++-- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c +2 -2
@@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,if (retries)udelay (400 ); -/* transaction request, wait up to 1ms for it to complete */ +/* transaction request, wait up to 2ms for it to complete */ nvkm_wr32 (device,0x00e4e4 + base,0x00010000 | ctrl); - timeout =1000 ; + timeout =2000 ; do { ctrl = nvkm_rd32(device, 0x00e4e4 + base); udelay(1);
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c +2 -2
@@ -118,10 +118,10 @@ gm200_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,if (retries)udelay (400 ); -/* transaction request, wait up to 1ms for it to complete */ +/* transaction request, wait up to 2ms for it to complete */ nvkm_wr32 (device,0x00d954 + base,0x00010000 | ctrl); - timeout =1000 ; + timeout =2000 ; do { ctrl = nvkm_rd32(device, 0x00d954 + base); udelay(1);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 12/86 drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups()
In reply to Greg Kroah-HartmanFrom: Gavin Shan <[email protected]>
[ Upstream commit c377e67c6271954969384f9be1b1b71de13eba30 ]
The CPU mask (@tmp) should be released on failing to allocate @cpu_groups or any of its elements. Otherwise, it leads to memory leakage because the CPU mask variable is dynamically allocated when CONFIG_CPUMASK_OFFSTACK is enabled.
--- drivers/firmware/psci_checker.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/firmware/psci_checker.c +4 -1
@@ -164,8 +164,10 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups) cpu_groups =kcalloc (nb_available_cpus,sizeof (cpu_groups),GFP_KERNEL ); -if (!cpu_groups) +if (!cpu_groups) { +free_cpumask_var (tmp);return -ENOMEM ; + }cpumask_copy (tmp, cpu_online_mask);
@@ -174,6 +176,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)topology_core_cpumask (cpumask_any (tmp));if (!alloc_cpumask_var (&cpu_groups[num_groups],GFP_KERNEL )) { +free_cpumask_var (tmp);free_cpu_groups (num_groups, &cpu_groups);return -ENOMEM ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 13/86 fuse: fix weird page warning
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit a5005c3cda6eeb6b95645e6cc32f58dafeffc976 upstream.
When PageWaiters was added, updating this check was missed.
--- fs/fuse/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/fuse/dev.c +2 -1
@@ -838,7 +838,8 @@ static int fuse_check_page(struct page *page) 1 << PG_uptodate | 1 << PG_lru | 1 << PG_active | - 1 << PG_reclaim))) { + 1 << PG_reclaim | + 1 << PG_waiters))) {printk (KERN_WARNING "fuse: trying to steal weird page\n" );printk (KERN_WARNING " page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n" , page, page->index, page->flags,page_count (page),page_mapcount (page), page->mapping);return 1 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 14/86 irqdomain/treewide: Keep firmware node unconditionally allocated
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
[ Upstream commit e3beca48a45b5e0e6e6a4e0124276b8248dcc9bb ]
Quite some non OF/ACPI users of irqdomains allocate firmware nodes of type IRQCHIP_FWNODE_NAMED or IRQCHIP_FWNODE_NAMED_ID and free them right after creating the irqdomain. The only purpose of these FW nodes is to convey name information. When this was introduced the core code did not store the pointer to the node in the irqdomain. A recent change stored the firmware node pointer in irqdomain for other reasons and missed to notice that the usage sites which do the alloc_fwnode/create_domain/free_fwnode sequence are broken by this. Storing a dangling pointer is dangerous itself, but in case that the domain is destroyed later on this leads to a double free.
Remove the freeing of the firmware node after creating the irqdomain from all affected call sites to cure this.
--- arch/x86/kernel/apic/io_apic.c | 10 +++++----- arch/x86/kernel/apic/msi.c | 18 ++++++++++++------ arch/x86/kernel/apic/vector.c | 1 - arch/x86/platform/uv/uv_irq.c | 3 ++- drivers/iommu/amd_iommu.c | 5 +++-- drivers/iommu/intel_irq_remapping.c | 2 +- drivers/pci/controller/vmd.c | 5 +++-- 7 files changed, 26 insertions(+), 18 deletions(-)
arch/x86/kernel/apic/io_apic.c +5 -5
@@ -2323,12 +2323,12 @@ static int mp_irqdomain_create(int ioapic) ip->irqdomain =irq_domain_create_linear (fn, hwirqs, cfg->ops, (void *)(long )ioapic); -/* Release fw handle if it was allocated above */ -if (!cfg->dev) -irq_domain_free_fwnode (fn); - -if (!ip->irqdomain) +if (!ip->irqdomain) { +/* Release fw handle if it was allocated above */ +if (!cfg->dev) +irq_domain_free_fwnode (fn);return -ENOMEM ; + } ip->irqdomain->parent = parent;
arch/x86/kernel/apic/msi.c +12 -6
@@ -265,12 +265,13 @@ void __init arch_init_msi_domain(struct irq_domain *parent) msi_default_domain =pci_msi_create_irq_domain (fn, &pci_msi_domain_info, parent); -irq_domain_free_fwnode (fn); } -if (!msi_default_domain) +if (!msi_default_domain) { +irq_domain_free_fwnode (fn);pr_warn ("failed to initialize irqdomain for MSI/MSI-x.\n" ); -else + }else { msi_default_domain->flags |=IRQ_DOMAIN_MSI_NOMASK_QUIRK ; + } }#ifdef CONFIG_IRQ_REMAP
@@ -303,7 +304,8 @@ struct irq_domain *arch_create_remap_msi_irq_domain(struct irq_domain *parent,if (!fn)return NULL ; d =pci_msi_create_irq_domain (fn, &pci_msi_ir_domain_info, parent); -irq_domain_free_fwnode (fn); +if (!d) +irq_domain_free_fwnode (fn); return d; }#endif
@@ -366,7 +368,8 @@ static struct irq_domain *dmar_get_irq_domain(void)if (fn) { dmar_domain =msi_create_irq_domain (fn, &dmar_msi_domain_info, x86_vector_domain); -irq_domain_free_fwnode (fn); +if (!dmar_domain) +irq_domain_free_fwnode (fn); } out:mutex_unlock (&dmar_lock);
@@ -491,7 +494,10 @@ struct irq_domain *hpet_create_irq_domain(int hpet_id) } d =msi_create_irq_domain (fn, domain_info, parent); -irq_domain_free_fwnode (fn); +if (!d) { +irq_domain_free_fwnode (fn); +kfree (domain_info); + }return d; }
arch/x86/kernel/apic/vector.c +0 -1
@@ -703,7 +703,6 @@ int __init arch_early_irq_init(void) x86_vector_domain =irq_domain_create_tree (fn, &x86_vector_domain_ops,NULL );BUG_ON (x86_vector_domain ==NULL ); -irq_domain_free_fwnode (fn);irq_set_default_host (x86_vector_domain);arch_init_msi_domain (x86_vector_domain);
arch/x86/platform/uv/uv_irq.c +2 -1
@@ -167,9 +167,10 @@ static struct irq_domain *uv_get_irq_domain(void) goto out; uv_domain =irq_domain_create_tree (fn, &uv_domain_ops,NULL ); -irq_domain_free_fwnode (fn);if (uv_domain) uv_domain->parent = x86_vector_domain; +else +irq_domain_free_fwnode (fn); out:mutex_unlock (&uv_lock);
drivers/iommu/amd_iommu.c +3 -2
@@ -4508,9 +4508,10 @@ int amd_iommu_create_irq_domain(struct amd_iommu *iommu)if (!fn)return -ENOMEM ; iommu->ir_domain =irq_domain_create_tree (fn, &amd_ir_domain_ops, iommu); -irq_domain_free_fwnode (fn); -if (!iommu->ir_domain) +if (!iommu->ir_domain) { +irq_domain_free_fwnode (fn);return -ENOMEM ; + } iommu->ir_domain->parent =arch_get_ir_parent_domain (); iommu->msi_domain = arch_create_remap_msi_irq_domain(iommu->ir_domain,
drivers/iommu/intel_irq_remapping.c +1 -1
@@ -536,8 +536,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)0 ,INTR_REMAP_TABLE_ENTRIES , fn, &intel_ir_domain_ops, iommu); -irq_domain_free_fwnode (fn);if (!iommu->ir_domain) { +irq_domain_free_fwnode (fn);pr_err ("IR%d: failed to allocate irqdomain\n" , iommu->seq_id); goto out_free_bitmap; }
drivers/pci/controller/vmd.c +3 -2
@@ -704,9 +704,10 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features) vmd->irq_domain =pci_msi_create_irq_domain (fn, &vmd_msi_domain_info, x86_vector_domain); -irq_domain_free_fwnode (fn); -if (!vmd->irq_domain) +if (!vmd->irq_domain) { +irq_domain_free_fwnode (fn);return -ENODEV ; + }pci_add_resource (&resources, &vmd->resources[0 ]);pci_add_resource_offset (&resources, &vmd->resources[1 ], offset[0 ]);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 15/86 SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion")
In reply to Greg Kroah-HartmanFrom: Olga Kornievskaia <[email protected]>
commit 65caafd0d2145d1dd02072c4ced540624daeab40 upstream.
Reverting commit d03727b248d0 "NFSv4 fix CLOSE not waiting for direct IO compeletion". This patch made it so that fput() by calling inode_dio_done() in nfs_file_release() would wait uninterruptably for any outstanding directIO to the file (but that wait on IO should be killable).
The problem the patch was also trying to address was REMOVE returning ERR_ACCESS because the file is still opened, is supposed to be resolved by server returning ERR_FILE_OPEN and not ERR_ACCESS.
--- fs/nfs/direct.c | 13 ++++--------- fs/nfs/file.c | 1 - 2 files changed, 4 insertions(+), 10 deletions(-)
fs/nfs/direct.c +4 -9
@@ -396,6 +396,8 @@ static void nfs_direct_complete(struct n {struct inode *inode = dreq->inode; +inode_dio_end (inode); +if (dreq->iocb) {long res = (long ) dreq->error;if (dreq->count !=0 ) {
@@ -407,10 +409,7 @@ static void nfs_direct_complete(struct ncomplete (&dreq->completion); -igrab (inode);nfs_direct_req_release (dreq); -inode_dio_end (inode); -iput (inode); }static void nfs_direct_read_completion (struct nfs_pgio_header *hdr)
@@ -540,10 +539,8 @@ static ssize_t nfs_direct_read_schedule_* generic layer handle the completion. */ if (requested_bytes ==0 ) { -igrab (inode); -nfs_direct_req_release (dreq);inode_dio_end (inode); -iput (inode); +nfs_direct_req_release (dreq);return result <0 ? result : -EIO ; }
@@ -960,10 +957,8 @@ static ssize_t nfs_direct_write_schedule* generic layer handle the completion. */ if (requested_bytes ==0 ) { -igrab (inode); -nfs_direct_req_release (dreq);inode_dio_end (inode); -iput (inode); +nfs_direct_req_release (dreq);return result <0 ? result : -EIO ; }
fs/nfs/file.c +0 -1
@@ -82,7 +82,6 @@ nfs_file_release(struct inode *inode, stdprintk ("NFS: release(%pD2)\n" , filp);nfs_inc_stats (inode,NFSIOS_VFSRELEASE ); -inode_dio_wait (inode);nfs_file_clear_open_context (filp);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 16/86 spi: spi-fsl-dspi: Exit the ISR with IRQ_NONE when its not ours
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
commit d41f36a6464a85c06ad920703d878e4491d2c023 upstream.
The DSPI interrupt can be shared between two controllers at least on the LX2160A. In that case, the driver for one controller might misbehave and consume the other's interrupt. Fix this by actually checking if any of the bits in the status register have been asserted.
--- drivers/spi/spi-fsl-dspi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/spi/spi-fsl-dspi.c +3 -1
@@ -878,9 +878,11 @@ static irqreturn_t dspi_interrupt(int ir trans_mode); } } + +return IRQ_HANDLED ; } -return IRQ_HANDLED ; +return IRQ_NONE ; }static const struct of_device_id fsl_dspi_dt_ids[] = {
Greg Kroah-Hartman
maintainerPATCH 17/86 tipc: clean up skb list lock handling on send path
In reply to Greg Kroah-HartmanFrom: Jon Maloy <[email protected]>
commit e654f9f53b45fde3fcc8051830b212c7a8f36148 upstream.
The policy for handling the skb list locks on the send and receive paths is simple.
- On the send path we never need to grab the lock on the 'xmitq' list when the destination is an exernal node.
- On the receive path we always need to grab the lock on the 'inputq' list, irrespective of source node.
However, when transmitting node local messages those will eventually end up on the receive path of a local socket, meaning that the argument 'xmitq' in tipc_node_xmit() will become the 'ínputq' argument in the function tipc_sk_rcv(). This has been handled by always initializing the spinlock of the 'xmitq' list at message creation, just in case it may end up on the receive path later, and despite knowing that the lock in most cases never will be used.
This approach is inaccurate and confusing, and has also concealed the fact that the stated 'no lock grabbing' policy for the send path is violated in some cases.
We now clean up this by never initializing the lock at message creation, instead doing this at the moment we find that the message actually will enter the receive path. At the same time we fix the four locations where we incorrectly access the spinlock on the send/error path.
This patch also reverts commit d12cffe9329f ("tipc: ensure head->lock is initialised") which has now become redundant.
[acj: backport v4.19 -stable
- adjust context
- skipped the hunk modifying non-existent function tipc_mcast_send_sync
- additional comment ]
--- net/tipc/bcast.c | 8 ++++---- net/tipc/group.c | 4 ++-- net/tipc/link.c | 12 ++++++------ net/tipc/node.c | 7 ++++--- net/tipc/socket.c | 12 ++++++------ 5 files changed, 22 insertions(+), 21 deletions(-)
net/tipc/bcast.c +4 -4
@@ -181,7 +181,7 @@ static void tipc_bcbase_xmit(struct net }/* We have to transmit across all bearers */ -skb_queue_head_init (&_xmitq); +__skb_queue_head_init (&_xmitq);for (bearer_id =0 ; bearer_id <MAX_BEARERS ; bearer_id++) {if (!bb->dests[bearer_id])continue ;
@@ -237,7 +237,7 @@ static int tipc_bcast_xmit(struct net *nstruct sk_buff_head xmitq;int rc =0 ; -skb_queue_head_init (&xmitq); +__skb_queue_head_init (&xmitq);tipc_bcast_lock (net);if (tipc_link_bc_peers (l)) rc =tipc_link_xmit (l, pkts, &xmitq);
@@ -267,7 +267,7 @@ static int tipc_rcast_xmit(struct net *nu32 dnode, selector; selector =msg_link_selector (buf_msg (skb_peek (pkts))); -skb_queue_head_init (&_pkts); +__skb_queue_head_init (&_pkts);list_for_each_entry_safe (dst, tmp, &dests->list, list) { dnode = dst->node;
@@ -299,7 +299,7 @@ int tipc_mcast_xmit(struct net *net, strint rc =0 ;skb_queue_head_init (&inputq); -skb_queue_head_init (&localq); +__skb_queue_head_init (&localq);/* Clone packets before they are consumed by next call */ if (dests->local && !tipc_msg_reassemble (pkts, &localq)) {
net/tipc/group.c +2 -2
@@ -199,7 +199,7 @@ void tipc_group_join(struct net *net, ststruct tipc_member *m, *tmp;struct sk_buff_head xmitq; -skb_queue_head_init (&xmitq); +__skb_queue_head_init (&xmitq);rbtree_postorder_for_each_entry_safe (m, tmp, tree, tree_node) {tipc_group_proto_xmit (grp, m,GRP_JOIN_MSG , &xmitq);tipc_group_update_member (m,0 );
@@ -435,7 +435,7 @@ bool tipc_group_cong(struct tipc_group *return true;if (state ==MBR_PENDING && adv ==ADV_IDLE )return true; -skb_queue_head_init (&xmitq); +__skb_queue_head_init (&xmitq);tipc_group_proto_xmit (grp, m,GRP_ADV_MSG , &xmitq);tipc_node_distr_xmit (grp->net, &xmitq);return true;
net/tipc/link.c +6 -6
@@ -928,7 +928,7 @@ int tipc_link_xmit(struct tipc_link *l,int rc =0 ;if (unlikely (msg_size (hdr) > mtu)) { -skb_queue_purge (list); +__skb_queue_purge (list);return -EMSGSIZE ; }
@@ -957,7 +957,7 @@ int tipc_link_xmit(struct tipc_link *l,if (likely (skb_queue_len (transmq) < maxwin)) { _skb =skb_clone (skb,GFP_ATOMIC );if (!_skb) { -skb_queue_purge (list); +__skb_queue_purge (list);return -ENOBUFS ; }__skb_dequeue (list);
@@ -1429,7 +1429,7 @@ void tipc_link_create_dummy_tnl_msg(strustruct sk_buff *skb;u32 dnode = l->addr; -skb_queue_head_init (&tnlq); +__skb_queue_head_init (&tnlq); skb =tipc_msg_create (TUNNEL_PROTOCOL ,FAILOVER_MSG ,INT_H_SIZE ,BASIC_H_SIZE , dnode, onode,0 ,0 ,0 );
@@ -1465,8 +1465,8 @@ void tipc_link_tnl_prepare(struct tipc_lif (!tnl)return ; -skb_queue_head_init (&tnlq); -skb_queue_head_init (&tmpxq); +__skb_queue_head_init (&tnlq); +__skb_queue_head_init (&tmpxq);/* At least one packet required for safe algorithm => add dummy */ skb = tipc_msg_create(TIPC_LOW_IMPORTANCE, TIPC_DIRECT_MSG,
@@ -1476,7 +1476,7 @@ void tipc_link_tnl_prepare(struct tipc_lpr_warn ("%sunable to create tunnel packet\n" , link_co_err);return ; } -skb_queue_tail (&tnlq, skb); +__skb_queue_tail (&tnlq, skb);tipc_link_xmit (l, &tnlq, &tmpxq);__skb_queue_purge (&tmpxq);
net/tipc/node.c +4 -3
@@ -1368,13 +1368,14 @@ int tipc_node_xmit(struct net *net, struint rc;if (in_own_node (net, dnode)) { +spin_lock_init (&list->lock);tipc_sk_rcv (net, list);return 0 ; } n =tipc_node_find (net, dnode);if (unlikely (!n)) { -skb_queue_purge (list); +__skb_queue_purge (list);return -EHOSTUNREACH ; }
@@ -1383,7 +1384,7 @@ int tipc_node_xmit(struct net *net, struif (unlikely (bearer_id ==INVALID_BEARER_ID )) {tipc_node_read_unlock (n);tipc_node_put (n); -skb_queue_purge (list); +__skb_queue_purge (list);return -EHOSTUNREACH ; }
@@ -1415,7 +1416,7 @@ int tipc_node_xmit_skb(struct net *net, {struct sk_buff_head head; -skb_queue_head_init (&head); +__skb_queue_head_init (&head);__skb_queue_tail (&head, skb);tipc_node_xmit (net, &head, dnode, selector);return 0 ;
net/tipc/socket.c +6 -6
@@ -800,7 +800,7 @@ static int tipc_sendmcast(struct socketmsg_set_nameupper (hdr, seq->upper);/* Build message as chain of buffers */ -skb_queue_head_init (&pkts); +__skb_queue_head_init (&pkts); rc =tipc_msg_build (hdr, msg,0 , dlen, mtu, &pkts);/* Send message if build was successful */
@@ -841,7 +841,7 @@ static int tipc_send_group_msg(struct nemsg_set_grp_bc_seqno (hdr, bc_snd_nxt);/* Build message as chain of buffers */ -skb_queue_head_init (&pkts); +__skb_queue_head_init (&pkts); mtu =tipc_node_get_mtu (net, dnode, tsk->portid); rc =tipc_msg_build (hdr, m,0 , dlen, mtu, &pkts);if (unlikely (rc != dlen))
@@ -1046,7 +1046,7 @@ static int tipc_send_group_bcast(structmsg_set_grp_bc_ack_req (hdr, ack);/* Build message as chain of buffers */ -skb_queue_head_init (&pkts); +__skb_queue_head_init (&pkts); rc =tipc_msg_build (hdr, m,0 , dlen, mtu, &pkts);if (unlikely (rc != dlen))return rc;
@@ -1372,7 +1372,7 @@ static int __tipc_sendmsg(struct socketif (unlikely (rc))return rc; -skb_queue_head_init (&pkts); +__skb_queue_head_init (&pkts); mtu =tipc_node_get_mtu (net, dnode, tsk->portid); rc =tipc_msg_build (hdr, m,0 , dlen, mtu, &pkts);if (unlikely (rc != dlen))
@@ -1427,7 +1427,7 @@ static int __tipc_sendstream(struct sockint send, sent =0 ;int rc =0 ; -skb_queue_head_init (&pkts); +__skb_queue_head_init (&pkts);if (unlikely (dlen >INT_MAX ))return -EMSGSIZE ;
@@ -1782,7 +1782,7 @@ static int tipc_recvmsg(struct socket *s/* Send group flow control advertisement when applicable */ if (tsk->group &&msg_in_group (hdr) && !grp_evt) { -skb_queue_head_init (&xmitq); +__skb_queue_head_init (&xmitq);tipc_group_update_rcv_win (tsk->group,tsk_blocks (hlen + dlen),msg_orignode (hdr),msg_origport (hdr), &xmitq);
Greg Kroah-Hartman
maintainerPATCH 18/86 IB/umem: fix reference count leak in ib_umem_odp_get()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
Add missing mmput() on error path to avoid ref-count leak.
This problem is introduced by 79bb5b7ee177 ("RDMA/umem: Fix missing mmap_sem in get umem ODP call") and resolved by f27a0d50a4bc ("RDMA/umem: Use umem->owning_mm inside ODP").
So, it's only needed in stable-4.14 and stable-4.19.
--- drivers/infiniband/core/umem_odp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/core/umem_odp.c +2 -1
@@ -356,7 +356,8 @@ int ib_umem_odp_get(struct ib_ucontext * vma =find_vma (mm,ib_umem_start (umem));if (!vma || !is_vm_hugetlb_page (vma)) {up_read (&mm->mmap_sem); -return -EINVAL ; + ret_val = -EINVAL ; + goto out_mm; } h =hstate_vma (vma); umem->page_shift =huge_page_shift (h);
Greg Kroah-Hartman
maintainerPATCH 19/86 uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
In reply to Greg Kroah-HartmanFrom: Oleg Nesterov <[email protected]>
commit fe5ed7ab99c656bd2f5b79b49df0e9ebf2cead8a upstream.
If a tracee is uprobed and it hits int3 inserted by debugger, handle_swbp() does send_sig(SIGTRAP, current, 0) which means si_code == SI_USER. This used to work when this code was written, but then GDB started to validate si_code and now it simply can't use breakpoints if the tracee has an active uprobe:
# cat test.c
void unused_func(void)
{
}
int main(void)
{
return 0;
}# gcc -g test.c -o test # perf probe -x ./test -a unused_func # perf record -e probe_test:unused_func gdb ./test -ex run GNU gdb (GDB) 10.0.50.20200714-git ... Program received signal SIGTRAP, Trace/breakpoint trap. 0x00007ffff7ddf909 in dl_main () from /lib64/ld-linux-x86-64.so.2 (gdb)
The tracee hits the internal breakpoint inserted by GDB to monitor shared library events but GDB misinterprets this SIGTRAP and reports a signal.
Change handle_swbp() to use force_sig(SIGTRAP), this matches do_int3_user() and fixes the problem.
This is the minimal fix for -stable, arch/x86/kernel/uprobes.c is equally wrong; it should use send_sigtrap(TRAP_TRACE) instead of send_sig(SIGTRAP), but this doesn't confuse GDB and needs another x86-specific patch.
--- kernel/events/uprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/uprobes.c +1 -1
@@ -1897,7 +1897,7 @@ static void handle_swbp(struct pt_regs *if (!uprobe) {if (is_swbp >0 ) {/* No matching uprobe; signal SIGTRAP. */ -send_sig (SIGTRAP , current,0 ); +force_sig (SIGTRAP , current); }else {/* * Either we raced with uprobe_unregister() or we can't
Greg Kroah-Hartman
maintainerPATCH 20/86 ALSA: info: Drop WARN_ON() from buffer NULL sanity check
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 60379ba08532eca861e933b389526a4dc89e0c42 upstream.
snd_info_get_line() has a sanity check of NULL buffer -- both buffer itself being NULL and buffer->buffer being NULL. Basically both checks are valid and necessary, but the problem is that it's with snd_BUG_ON() macro that triggers WARN_ON(). The latter condition (NULL buffer->buffer) can be met arbitrarily by user since the buffer is allocated at the first write, so it means that user can trigger WARN_ON() at will.
This patch addresses it by simply moving buffer->buffer NULL check out of snd_BUG_ON() so that spurious WARNING is no longer triggered.
--- sound/core/info.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/core/info.c +3 -1
@@ -634,7 +634,9 @@ int snd_info_get_line(struct snd_info_bu {int c =-1 ; -if (snd_BUG_ON (!buffer || !buffer->buffer)) +if (snd_BUG_ON (!buffer)) +return 1 ; +if (!buffer->buffer)return 1 ;if (len <=0 || buffer->stop || buffer->error)return 1 ;
Greg Kroah-Hartman
maintainerPATCH 21/86 ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 5cacc6f5764e94fa753b2c1f5f7f1f3f74286e82 upstream.
The RT5670_PWR_ANLG1 register has 3 bits to select the LDO voltage, so the correct mask is 0x7 not 0x3.
Because of this wrong mask we were programming the ldo bits to a setting of binary 001 (0x05 & 0x03) instead of binary 101 when moving to SND_SOC_BIAS_PREPARE.
According to the datasheet 001 is a reserved value, so no idea what it did, since the driver was working fine before I guess we got lucky and it does something which is ok.
--- sound/soc/codecs/rt5670.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/rt5670.h +1 -1
@@ -760,7 +760,7 @@#define RT5670_PWR_VREF2_BIT 4#define RT5670_PWR_FV2 (0x1 << 3)#define RT5670_PWR_FV2_BIT 3 -#define RT5670_LDO_SEL_MASK (0x3) +#define RT5670_LDO_SEL_MASK (0x7)#define RT5670_LDO_SEL_SFT 0/* Power Management for Analog 2 (0x64) */
Greg Kroah-Hartman
maintainerPATCH 22/86 btrfs: fix double free on ulist after backref resolution failure
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 580c079b5766ac706f56eec5c79aee4bf929fef6 upstream.
At btrfs_find_all_roots_safe() we allocate a ulist and set the **roots argument to point to it. However if later we fail due to an error returned by find_parent_nodes(), we free that ulist but leave a dangling pointer in the **roots argument. Upon receiving the error, a caller of this function can attempt to free the same ulist again, resulting in an invalid memory access.
One such scenario is during qgroup accounting:
btrfs_qgroup_account_extents()
--> calls btrfs_find_all_roots() passes &new_roots (a stack allocated
pointer) to btrfs_find_all_roots()
--> btrfs_find_all_roots() just calls btrfs_find_all_roots_safe()
passing &new_roots to it
--> allocates ulist and assigns its address to **roots (which
points to new_roots from btrfs_qgroup_account_extents())
--> find_parent_nodes() returns an error, so we free the ulist
and leave **roots pointing to it after returning
--> btrfs_qgroup_account_extents() sees btrfs_find_all_roots() returned
an error and jumps to the label 'cleanup', which just tries to free again the same ulist
Stack trace example:
------------[ cut here ]------------ BTRFS: tree first key check failed WARNING: CPU: 1 PID: 1763215 at fs/btrfs/disk-io.c:422 btrfs_verify_level_key+0xe0/0x180 [btrfs] Modules linked in: dm_snapshot dm_thin_pool (...) CPU: 1 PID: 1763215 Comm: fsstress Tainted: G W 5.8.0-rc3-btrfs-next-64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:btrfs_verify_level_key+0xe0/0x180 [btrfs] Code: 28 5b 5d (...) RSP: 0018:ffffb89b473779a0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff90397759bf08 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000027 RDI: 00000000ffffffff RBP: ffff9039a419c000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: ffffb89b43301000 R12: 000000000000005e R13: ffffb89b47377a2e R14: ffffb89b473779af R15: 0000000000000000 FS: 00007fc47e1e1000(0000) GS:ffff9039ac200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc47e1df000 CR3: 00000003d9e4e001 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: read_block_for_search+0xf6/0x350 [btrfs] btrfs_next_old_leaf+0x242/0x650 [btrfs] resolve_indirect_refs+0x7cf/0x9e0 [btrfs] find_parent_nodes+0x4ea/0x12c0 [btrfs] btrfs_find_all_roots_safe+0xbf/0x130 [btrfs] btrfs_qgroup_account_extents+0x9d/0x390 [btrfs] btrfs_commit_transaction+0x4f7/0xb20 [btrfs] btrfs_sync_file+0x3d4/0x4d0 [btrfs] do_fsync+0x38/0x70 __x64_sys_fdatasync+0x13/0x20 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fc47e2d72e3 Code: Bad RIP value. RSP: 002b:00007fffa32098c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004b RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc47e2d72e3 RDX: 00007fffa3209830 RSI: 00007fffa3209830 RDI: 0000000000000003 RBP: 000000000000072e R08: 0000000000000001 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000003e8 R13: 0000000051eb851f R14: 00007fffa3209970 R15: 00005607c4ac8b50 irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<ffffffffb8eb5e85>] copy_process+0x755/0x1eb0 softirqs last enabled at (0): [<ffffffffb8eb5e85>] copy_process+0x755/0x1eb0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ---[ end trace 8639237550317b48 ]--- BTRFS error (device sdc): tree first key mismatch detected, bytenr=62324736 parent_transid=94 key expected=(262,108,1351680) has=(259,108,1921024) general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI CPU: 2 PID: 1763215 Comm: fsstress Tainted: G W 5.8.0-rc3-btrfs-next-64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:ulist_release+0x14/0x60 [btrfs] Code: c7 07 00 (...) RSP: 0018:ffffb89b47377d60 EFLAGS: 00010282 RAX: 6b6b6b6b6b6b6b6b RBX: ffff903959b56b90 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000270024 RDI: ffff9036e2adc840 RBP: ffff9036e2adc848 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9036e2adc840 R13: 0000000000000015 R14: ffff9039a419ccf8 R15: ffff90395d605840 FS: 00007fc47e1e1000(0000) GS:ffff9039ac600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8c1c0a51c8 CR3: 00000003d9e4e004 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ulist_free+0x13/0x20 [btrfs] btrfs_qgroup_account_extents+0xf3/0x390 [btrfs] btrfs_commit_transaction+0x4f7/0xb20 [btrfs] btrfs_sync_file+0x3d4/0x4d0 [btrfs] do_fsync+0x38/0x70 __x64_sys_fdatasync+0x13/0x20 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fc47e2d72e3 Code: Bad RIP value. RSP: 002b:00007fffa32098c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004b RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc47e2d72e3 RDX: 00007fffa3209830 RSI: 00007fffa3209830 RDI: 0000000000000003 RBP: 000000000000072e R08: 0000000000000001 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000003e8 R13: 0000000051eb851f R14: 00007fffa3209970 R15: 00005607c4ac8b50 Modules linked in: dm_snapshot dm_thin_pool (...) ---[ end trace 8639237550317b49 ]--- RIP: 0010:ulist_release+0x14/0x60 [btrfs] Code: c7 07 00 (...) RSP: 0018:ffffb89b47377d60 EFLAGS: 00010282 RAX: 6b6b6b6b6b6b6b6b RBX: ffff903959b56b90 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000270024 RDI: ffff9036e2adc840 RBP: ffff9036e2adc848 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9036e2adc840 R13: 0000000000000015 R14: ffff9039a419ccf8 R15: ffff90395d605840 FS: 00007fc47e1e1000(0000) GS:ffff9039ad200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6a776f7d40 CR3: 00000003d9e4e002 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Fix this by making btrfs_find_all_roots_safe() set *roots to NULL after it frees the ulist.
--- fs/btrfs/backref.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/backref.c +1 -0
@@ -1419,6 +1419,7 @@ static int btrfs_find_all_roots_safe(strif (ret <0 && ret != -ENOENT ) {ulist_free (tmp);ulist_free (*roots); + *roots =NULL ;return ret; } node =ulist_next (tmp, &uiter);
Greg Kroah-Hartman
maintainerPATCH 23/86 btrfs: fix mount failure caused by race with umount
In reply to Greg Kroah-HartmanFrom: Boris Burkov <[email protected]>
commit 48cfa61b58a1fee0bc49eef04f8ccf31493b7cdd upstream.
It is possible to cause a btrfs mount to fail by racing it with a slow umount. The crux of the sequence is generic_shutdown_super not yet calling sop->put_super before btrfs_mount_root calls btrfs_open_devices. If that occurs, btrfs_open_devices will decide the opened counter is non-zero, increment it, and skip resetting fs_devices->total_rw_bytes to
0. From here, mount will call sget which will result in grab_super trying to take the super block umount semaphore. That semaphore will be held by the slow umount, so mount will block. Before up-ing the semaphore, umount will delete the super block, resulting in mount's sget reliably allocating a new one, which causes the mount path to dutifully fill it out, and increment total_rw_bytes a second time, which causes the mount to fail, as we see double the expected bytes.
Here is the sequence laid out in greater detail:
CPU0 CPU1down_write sb->s_umountbtrfs_kill_super
kill_anon_super(sb)
generic_shutdown_super(sb);
shrink_dcache_for_umount(sb);
sync_filesystem(sb);
evict_inodes(sb); // SLOW
btrfs_mount_root
btrfs_scan_one_device
fs_devices = device->fs_devices
fs_info->fs_devices = fs_devices
// fs_devices-opened makes this a no-op
btrfs_open_devices(fs_devices, mode, fs_type)
s = sget(fs_type, test, set, flags, fs_info);
find sb in s_instances
grab_super(sb);
down_write(&s->s_umount); // blocks
sop->put_super(sb)
// sb->fs_devices->opened == 2; no-op
spin_lock(&sb_lock);
hlist_del_init(&sb->s_instances);
spin_unlock(&sb_lock);
up_write(&sb->s_umount);
return 0;
retry lookup
don't find sb in s_instances (deleted by CPU0)
s = alloc_super
return s;
btrfs_fill_super(s, fs_devices, data)
open_ctree // fs_devices total_rw_bytes improperly set!
btrfs_read_chunk_tree
read_one_dev // increment total_rw_bytes again!!
super_total_bytes < fs_devices->total_rw_bytes // ERROR!!!To fix this, we clear total_rw_bytes from within btrfs_read_chunk_tree before the calls to read_one_dev, while holding the sb umount semaphore and the uuid mutex.
To reproduce, it is sufficient to dirty a decent number of inodes, then quickly umount and mount.
for i in $(seq 0 500)
do
dd if=/dev/zero of="/mnt/foo/$i" bs=1M count=1
done
umount /mnt/foo&
mount /mnt/foodoes the trick for me.
--- fs/btrfs/volumes.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/btrfs/volumes.c +8 -0
@@ -6935,6 +6935,14 @@ int btrfs_read_chunk_tree(struct btrfs_fmutex_lock (&fs_info->chunk_mutex);/* +* It is possible for mount and umount to race in such a way that +* we execute this code path, but open_fs_devices failed to clear +* total_rw_bytes. We certainly want it cleared before reading the +* device items, so clear it here. +*/ + fs_info->fs_devices->total_rw_bytes =0 ; + +/* * Read all device items, and then all the chunk items. All * device items are found before any chunk item (their object id * is smaller than the lowest possible object id for a chunk
Greg Kroah-Hartman
maintainerPATCH 24/86 btrfs: fix page leaks after failure to lock page for delalloc
In reply to Greg Kroah-HartmanFrom: Robbie Ko <[email protected]>
commit 5909ca110b29aa16b23b52b8de8d3bb1035fd738 upstream.
When locking pages for delalloc, we check if it's dirty and mapping still matches. If it does not match, we need to return -EAGAIN and release all pages. Only the current page was put though, iterate over all the remaining pages too.
--- fs/btrfs/extent_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/extent_io.c +2 -1
@@ -1707,7 +1707,8 @@ static int __process_pages_contig(structif (!PageDirty (pages[i]) || pages[i]->mapping != mapping) {unlock_page (pages[i]); -put_page (pages[i]); +for (; i < ret; i++) +put_page (pages[i]); err = -EAGAIN ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 25/86 bnxt_en: Fix race when modifying pause settings.
In reply to Greg Kroah-HartmanFrom: Vasundhara Volam <[email protected]>
[ Upstream commit 163e9ef63641a02de4c95cd921577265c52e1ce2 ]
The driver was modified to not rely on rtnl lock to protect link settings about 2 years ago. The pause setting was missed when making that change. Fix it by acquiring link_lock mutex before calling bnxt_hwrm_set_pause().
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +4 -1
@@ -1392,8 +1392,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,if (epause->tx_pause) link_info->req_flow_ctrl |=BNXT_LINK_PAUSE_TX ; -if (netif_running (dev)) +if (netif_running (dev)) { +mutex_lock (&bp->link_lock); rc =bnxt_hwrm_set_pause (bp); +mutex_unlock (&bp->link_lock); + }return rc; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 26/86 fpga: dfl: fix bug in port reset handshake
In reply to Greg Kroah-HartmanFrom: Matthew Gerlach <[email protected]>
[ Upstream commit 8614afd689df59d9ce019439389be20bd788a897 ]
When putting the port in reset, driver must wait for the soft reset acknowledgment bit instead of the soft reset bit.
--- drivers/fpga/dfl-afu-main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/fpga/dfl-afu-main.c +2 -1
@@ -79,7 +79,8 @@ static int port_disable(struct platform_device *pdev)* on this port and minimum soft reset pulse width has elapsed. * Driver polls port_soft_reset_ack to determine if reset done by HW. */ -if (readq_poll_timeout (base +PORT_HDR_CTRL , v, v &PORT_CTRL_SFTRST , +if (readq_poll_timeout (base +PORT_HDR_CTRL , v, + v &PORT_CTRL_SFTRST_ACK ,RST_POLL_INVL ,RST_POLL_TIMEOUT )) {dev_err (&pdev->dev,"timeout, fail to reset device\n" );return -ETIMEDOUT ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 27/86 hippi: Fix a size used in a pci_free_consistent() in an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ]
The size used when calling 'pci_alloc_consistent()' and 'pci_free_consistent()' should match.
Fix it and have it consistent with the corresponding call in 'rr_close()'.
--- drivers/net/hippi/rrunner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/hippi/rrunner.c +1 -1
@@ -1248,7 +1248,7 @@ static int rr_open(struct net_device *dev) rrpriv->info =NULL ; }if (rrpriv->rx_ctrl) { -pci_free_consistent (pdev,sizeof (struct ring_ctrl ), +pci_free_consistent (pdev,256 *sizeof (struct ring_ctrl ), rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma); rrpriv->rx_ctrl =NULL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 28/86 ax88172a: fix ax88172a_unbind() failures
In reply to Greg Kroah-HartmanFrom: George Kennedy <[email protected]>
[ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ]
If ax88172a_unbind() fails, make sure that the return code is less than zero so that cleanup is done properly and avoid UAF.
--- drivers/net/usb/ax88172a.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/ax88172a.c +1 -0
@@ -210,6 +210,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) ret =asix_read_cmd (dev,AX_CMD_READ_NODE_ID ,0 ,0 ,ETH_ALEN , buf,0 );if (ret <ETH_ALEN ) {netdev_err (dev->net,"Failed to read MAC address: %d\n" , ret); + ret = -EIO ; goto free; }memcpy (dev->net->dev_addr, buf,ETH_ALEN );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 29/86 net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration
In reply to Greg Kroah-HartmanFrom: Sergey Organov <[email protected]>
[ Upstream commit 473309fb8372365ad211f425bca760af800e10a7 ]
Quoted 1 line
From
Documentation/networking/timestamping.txt:
A driver which supports hardware time stamping shall update the struct with the actual, possibly more permissive configuration.
Do update the struct passed when we upscale the requested time stamping mode.
--- drivers/net/phy/dp83640.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/phy/dp83640.c +4 -0
@@ -1343,6 +1343,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) dp83640->hwts_rx_en =1 ; dp83640->layer =PTP_CLASS_L4 ; dp83640->version =PTP_CLASS_V1 ; + cfg.rx_filter =HWTSTAMP_FILTER_PTP_V1_L4_EVENT ;break ;case HWTSTAMP_FILTER_PTP_V2_L4_EVENT :case HWTSTAMP_FILTER_PTP_V2_L4_SYNC :
@@ -1350,6 +1351,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) dp83640->hwts_rx_en =1 ; dp83640->layer =PTP_CLASS_L4 ; dp83640->version =PTP_CLASS_V2 ; + cfg.rx_filter =HWTSTAMP_FILTER_PTP_V2_L4_EVENT ;break ;case HWTSTAMP_FILTER_PTP_V2_L2_EVENT :case HWTSTAMP_FILTER_PTP_V2_L2_SYNC :
@@ -1357,6 +1359,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) dp83640->hwts_rx_en =1 ; dp83640->layer =PTP_CLASS_L2 ; dp83640->version =PTP_CLASS_V2 ; + cfg.rx_filter =HWTSTAMP_FILTER_PTP_V2_L2_EVENT ;break ;case HWTSTAMP_FILTER_PTP_V2_EVENT :case HWTSTAMP_FILTER_PTP_V2_SYNC :
@@ -1364,6 +1367,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) dp83640->hwts_rx_en =1 ; dp83640->layer =PTP_CLASS_L4 |PTP_CLASS_L2 ; dp83640->version =PTP_CLASS_V2 ; + cfg.rx_filter =HWTSTAMP_FILTER_PTP_V2_EVENT ;break ;default :return -ERANGE ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 30/86 ieee802154: fix one possible memleak in adf7242_probe
In reply to Greg Kroah-HartmanFrom: Liu Jian <[email protected]>
[ Upstream commit 66673f96f0f968b991dc38be06102246919c663c ]
When probe fail, we should destroy the workqueue.
--- drivers/net/ieee802154/adf7242.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ieee802154/adf7242.c +3 -1
@@ -1270,7 +1270,7 @@ static int adf7242_probe(struct spi_device *spi) WQ_MEM_RECLAIM);if (unlikely (!lp->wqueue)) { ret = -ENOMEM ; - goto err_hw_init; + goto err_alloc_wq; } ret =adf7242_hw_init (lp);
@@ -1302,6 +1302,8 @@ static int adf7242_probe(struct spi_device *spi)return ret; err_hw_init: +destroy_workqueue (lp->wqueue); +err_alloc_wq:mutex_destroy (&lp->bmux);ieee802154_free_hw (lp->hw);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 31/86 drm: sun4i: hdmi: Fix inverted HPD result
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit baa1841eb797eadce6c907bdaed7cd6f01815404 ]
When the extra HPD polling in sun4i_hdmi was removed, the result of HPD was accidentally inverted.
Fix this by inverting the check.
--- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +1 -1
@@ -243,7 +243,7 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)unsigned long reg; reg =readl (hdmi->base +SUN4I_HDMI_HPD_REG ); -if (reg &SUN4I_HDMI_HPD_HIGH ) { +if (!(reg &SUN4I_HDMI_HPD_HIGH )) {cec_phys_addr_invalidate (hdmi->cec_adap);return connector_status_disconnected; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 32/86 net: smc91x: Fix possible memory leak in smc_drv_probe()
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit bca9749b1aa23d964d3ab930938af66dbf887f15 ]
If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev) should be called to free the ndev created earlier. Otherwise, a memleak will occur.
--- drivers/net/ethernet/smsc/smc91x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/smsc/smc91x.c +2 -2
@@ -2287,7 +2287,7 @@ static int smc_drv_probe(struct platform_device *pdev) ret =try_toggle_control_gpio (&pdev->dev, &lp->power_gpio,"power" ,0 ,0 ,100 );if (ret) -return ret; + goto out_free_netdev;/* * Optional reset GPIO configured? Minimum 100 ns reset needed
@@ -2296,7 +2296,7 @@ static int smc_drv_probe(struct platform_device *pdev) ret =try_toggle_control_gpio (&pdev->dev, &lp->reset_gpio,"reset" ,0 ,0 ,100 );if (ret) -return ret; + goto out_free_netdev;/* * Need to wait for optional EEPROM to load, max 750 us according
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 33/86 bonding: check error value of register_netdevice() immediately
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 544f287b84959203367cd29e16e772717612fab4 ]
If register_netdevice() is failed, net_device should not be used because variables are uninitialized or freed.
So, the routine should be stopped immediately.
But, bond_create() doesn't check return value of register_netdevice() immediately. That will result in a panic because of using uninitialized or freed memory.
Test commands:
modprobe netdev-notifier-error-inject
echo -22 > /sys/kernel/debug/notifier-error-inject/netdev/\actions/NETDEV_REGISTER/error
modprobe bonding max_bonds=3
Splat looks like:
[ 375.028492][ T193] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 375.033207][ T193] CPU: 2 PID: 193 Comm: kworker/2:2 Not tainted 5.8.0-rc4+ #645 [ 375.036068][ T193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 375.039673][ T193] Workqueue: events linkwatch_event [ 375.041557][ T193] RIP: 0010:dev_activate+0x4a/0x340 [ 375.043381][ T193] Code: 40 a8 04 0f 85 db 00 00 00 8b 83 08 04 00 00 85 c0 0f 84 0d 01 00 00 31 d2 89 d0 48 8d 04 40 48 c1 e0 07 48 03 83 00 04 00 00 <48> 8b 48 10 f6 41 10 01 75 08 f0 80 a1 a0 01 00 00 fd 48 89 48 08 [ 375.050267][ T193] RSP: 0018:ffff9f8facfcfdd8 EFLAGS: 00010202 [ 375.052410][ T193] RAX: 6b6b6b6b6b6b6b6b RBX: ffff9f8fae6ea000 RCX: 0000000000000006 [ 375.055178][ T193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f8fae6ea000 [ 375.057762][ T193] RBP: ffff9f8fae6ea000 R08: 0000000000000000 R09: 0000000000000000 [ 375.059810][ T193] R10: 0000000000000001 R11: 0000000000000000 R12: ffff9f8facfcfe08 [ 375.061892][ T193] R13: ffffffff883587e0 R14: 0000000000000000 R15: ffff9f8fae6ea580 [ 375.063931][ T193] FS: 0000000000000000(0000) GS:ffff9f8fbae00000(0000) knlGS:0000000000000000 [ 375.066239][ T193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 375.067841][ T193] CR2: 00007f2f542167a0 CR3: 000000012cee6002 CR4: 00000000003606e0 [ 375.069657][ T193] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 375.071471][ T193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 375.073269][ T193] Call Trace: [ 375.074005][ T193] linkwatch_do_dev+0x4d/0x50 [ 375.075052][ T193] __linkwatch_run_queue+0x10b/0x200 [ 375.076244][ T193] linkwatch_event+0x21/0x30 [ 375.077274][ T193] process_one_work+0x252/0x600 [ 375.078379][ T193] ? process_one_work+0x600/0x600 [ 375.079518][ T193] worker_thread+0x3c/0x380 [ 375.080534][ T193] ? process_one_work+0x600/0x600 [ 375.081668][ T193] kthread+0x139/0x150 [ 375.082567][ T193] ? kthread_park+0x90/0x90 [ 375.083567][ T193] ret_from_fork+0x22/0x30
--- drivers/net/bonding/bond_main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/bonding/bond_main.c +7 -3
@@ -4817,15 +4817,19 @@ int bond_create(struct net *net, const char *name) bond_dev->rtnl_link_ops = &bond_link_ops; res =register_netdevice (bond_dev); +if (res <0 ) { +free_netdev (bond_dev); +rtnl_unlock (); + +return res; + }netif_carrier_off (bond_dev);bond_work_init_all (bond);rtnl_unlock (); -if (res <0 ) -free_netdev (bond_dev); -return res; +return 0 ; }static int __net_init bond_net_init (struct net *net)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 34/86 mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
In reply to Greg Kroah-HartmanFrom: Liu Jian <[email protected]>
[ Upstream commit 5dbaeb87f2b309936be0aeae00cbc9e7f20ab296 ]
When mlxsw_core_trap_register fails in mlxsw_emad_init, destroy_workqueue() shouled be called to destroy mlxsw_core->emad_wq.
--- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/core.c +2 -1
@@ -587,7 +587,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) err =mlxsw_core_trap_register (mlxsw_core, &mlxsw_emad_rx_listener, mlxsw_core);if (err) -return err; + goto err_trap_register; err = mlxsw_core->driver->basic_trap_groups_set (mlxsw_core);if (err)
@@ -599,6 +599,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) err_emad_trap_set:mlxsw_core_trap_unregister (mlxsw_core, &mlxsw_emad_rx_listener, mlxsw_core); +err_trap_register:destroy_workqueue (mlxsw_core->emad_wq);return err; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 35/86 qed: suppress "dont support RoCE & iWARP" flooding on HW init
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit 1ea999039fe7c7953da2fbb7ca7c3ef00064d328 ]
Change the verbosity of the "don't support RoCE & iWARP simultaneously" warning to debug level to stop flooding on driver/hardware initialization:
[ 4.783230] qede 01:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth0] [ 4.810020] [qed_rdma_set_pf_params:2076()]Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only [ 4.861186] qede 01:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth1] [ 4.893311] [qed_rdma_set_pf_params:2076()]Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only [ 5.181713] qede a1:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth2] [ 5.224740] [qed_rdma_set_pf_params:2076()]Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only [ 5.276449] qede a1:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth3] [ 5.318671] [qed_rdma_set_pf_params:2076()]Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only [ 5.369548] qede a1:00.02: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth4] [ 5.411645] [qed_rdma_set_pf_params:2076()]Current day drivers don't
support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only
--- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_cxt.c +2 -2
@@ -2074,8 +2074,8 @@ static void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn, num_srqs =min_t (u32,QED_RDMA_MAX_SRQS , p_params->num_srqs);if (p_hwfn->mcp_info->func_info.protocol ==QED_PCI_ETH_RDMA ) { -DP_NOTICE (p_hwfn, -"Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n" ); +DP_VERBOSE (p_hwfn,QED_MSG_SP , +"Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n" ); p_hwfn->hw_info.personality =QED_PCI_ETH_ROCE ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 36/86 ipvs: fix the connection sync failed in some cases
In reply to Greg Kroah-HartmanFrom: guodeqing <[email protected]>
[ Upstream commit 8210e344ccb798c672ab237b1a4f241bda08909b ]
The sync_thread_backup only checks sk_receive_queue is empty or not, there is a situation which cannot sync the connection entries when sk_receive_queue is empty and sk_rmem_alloc is larger than sk_rcvbuf, the sync packets are dropped in __udp_enqueue_schedule_skb, this is because the packets in reader_queue is not read, so the rmem is not reclaimed.
Here I add the check of whether the reader_queue of the udp sock is empty or not to solve this problem.
--- net/netfilter/ipvs/ip_vs_sync.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/netfilter/ipvs/ip_vs_sync.c +8 -4
@@ -1717,6 +1717,8 @@ static int sync_thread_backup(void *data) {struct ip_vs_sync_thread_data *tinfo = data;struct netns_ipvs *ipvs = tinfo->ipvs; +struct sock *sk = tinfo->sock->sk; +struct udp_sock *up =udp_sk (sk);int len; pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, "
@@ -1724,12 +1726,14 @@ static int sync_thread_backup(void *data) ipvs->bcfg.mcast_ifn, ipvs->bcfg.syncid, tinfo->id);while (!kthread_should_stop ()) { -wait_event_interruptible (*sk_sleep (tinfo->sock->sk), - !skb_queue_empty (&tinfo->sock->sk->sk_receive_queue) - ||kthread_should_stop ()); +wait_event_interruptible (*sk_sleep (sk), + !skb_queue_empty_lockless (&sk->sk_receive_queue) || + !skb_queue_empty_lockless (&up->reader_queue) || +kthread_should_stop ());/* do we have data now? */ -while (!skb_queue_empty (&(tinfo->sock->sk->sk_receive_queue))) { +while (!skb_queue_empty_lockless (&sk->sk_receive_queue) || + !skb_queue_empty_lockless (&up->reader_queue)) { len =ip_vs_receive (tinfo->sock, tinfo->buf, ipvs->bcfg.sync_maxlen);if (len <=0 ) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 37/86 net: ethernet: ave: Fix error returns in ave_init
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 1264d7fa3a64d8bea7aebb77253f917947ffda25 ]
When regmap_update_bits failed in ave_init(), calls of the functions reset_control_assert() and clk_disable_unprepare() were missed. Add goto out_reset_assert to do this.
--- drivers/net/ethernet/socionext/sni_ave.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/socionext/sni_ave.c +1 -1
@@ -1196,7 +1196,7 @@ static int ave_init(struct net_device *ndev) ret =regmap_update_bits (priv->regmap,SG_ETPINMODE , priv->pinmode_mask, priv->pinmode_val);if (ret) -return ret; + goto out_reset_assert;ave_global_reset (ndev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 38/86 i2c: rcar: always clear ICSAR to avoid side effects
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit eb01597158ffb1853a7a7fc2c57d4c844640f75e ]
On R-Car Gen2, we get a timeout when reading from the address set in ICSAR, even though the slave interface is disabled. Clearing it fixes this situation. Note that Gen3 is not affected.
To reproduce: bind and undbind an I2C slave on some bus, run 'i2cdetect' on that bus.
--- drivers/i2c/busses/i2c-rcar.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/i2c/busses/i2c-rcar.c +3 -0
@@ -863,6 +863,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)/* disable irqs and ensure none is running before clearing ptr */ rcar_i2c_write (priv,ICSIER ,0 );rcar_i2c_write (priv,ICSCR ,0 ); +rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ synchronize_irq (priv->irq); priv->slave =NULL ;
@@ -966,6 +967,8 @@ static int rcar_i2c_probe(struct platform_device *pdev)if (ret <0 ) goto out_pm_put; +rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ +if (priv->devtype ==I2C_RCAR_GEN3 ) { priv->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );if (!IS_ERR (priv->rstc)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 39/86 bonding: check return value of register_netdevice() in bond_newlink()
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit c75d1d5248c0c97996051809ad0e9f154ba5d76e ]
Very similar to commit 544f287b8495
("bonding: check error value of register_netdevice() immediately"), we should immediately check the return value of register_netdevice() before doing anything else.
--- drivers/net/bonding/bond_netlink.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/bonding/bond_netlink.c +1 -2
@@ -451,11 +451,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,return err; err =register_netdevice (bond_dev); - -netif_carrier_off (bond_dev);if (!err) {struct bonding *bond =netdev_priv (bond_dev); +netif_carrier_off (bond_dev);bond_work_init_all (bond); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 40/86 serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
In reply to Greg Kroah-HartmanFrom: Matthew Howell <[email protected]>
[ Upstream commit 5fdbe136ae19ab751daaa4d08d9a42f3e30d17f9 ]
Sealevel XR17V35X based devices are inoperable on kernel versions 4.11 and above due to a change in the GPIO preconfiguration introduced in commit7dea8165f1d. This patch fixes this by preconfiguring the GPIO on Sealevel cards to the value (0x00) used prior to commit 7dea8165f1d
With GPIOs preconfigured as per commit 7dea8165f1d all ports on Sealevel XR17V35X based devices become stuck in high impedance mode, regardless of dip-switch or software configuration. This causes the device to become effectively unusable. This patch (in various forms) has been distributed to our customers and no issues related to it have been reported.
--- drivers/tty/serial/8250/8250_exar.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_exar.c +11 -1
@@ -227,7 +227,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p)* devices will export them as GPIOs, so we pre-configure them safely * as inputs. */ -u8 dir = pcidev->vendor ==PCI_VENDOR_ID_EXAR ?0xff :0x00 ; + +u8 dir =0x00 ; + +if ((pcidev->vendor ==PCI_VENDOR_ID_EXAR ) && + (pcidev->subsystem_vendor !=PCI_VENDOR_ID_SEALEVEL )) { +// Configure GPIO as inputs for Commtech adapters + dir =0xff ; + }else { +// Configure GPIO as outputs for SeaLevel adapters + dir =0x00 ; + }writeb (0x00 , p +UART_EXAR_MPIOINT_7_0 );writeb (0x00 , p +UART_EXAR_MPIOLVL_7_0 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 41/86 scripts/decode_stacktrace: strip basepath from all paths
In reply to Greg Kroah-HartmanFrom: Pi-Hsun Shih <[email protected]>
[ Upstream commit d178770d8d21489abf5bafefcbb6d5243b482e9a ]
Currently the basepath is removed only from the beginning of the string. When the symbol is inlined and there's multiple line outputs of addr2line, only the first line would have basepath removed.
Change to remove the basepath prefix from all lines.
--- scripts/decode_stacktrace.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/decode_stacktrace.sh +2 -2
@@ -77,8 +77,8 @@ parse_symbol() { return fi - # Strip out the base of the path - code=${code#$basepath/} + # Strip out the base of the path on each line + code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code") # In the case of inlines, move everything to same line code=${code//$'\n'/' '}
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 42/86 scripts/gdb: fix lx-symbols gdb.error while loading modules
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
[ Upstream commit 7359608a271ce81803de148befefd309baf88c76 ]
Commit ed66f991bb19 ("module: Refactor section attr into bin attribute") removed the 'name' field from 'struct module_sect_attr' triggering the following error when invoking lx-symbols:
(gdb) lx-symbols
loading vmlinux
scanning for modules in linux/build
loading @0xffffffffc014f000: linux/build/drivers/net/tun.ko Python Exception <class 'gdb.error'> There is no member named name.:
Error occurred in Python: There is no member named name.
This patch fixes the issue taking the module name from the 'struct attribute'.
--- scripts/gdb/linux/symbols.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/gdb/linux/symbols.py +1 -1
@@ -96,7 +96,7 @@ lx-symbols command.""" return "" attrs = sect_attrs['attrs'] section_name_to_address = { - attrs[n]['name'].string(): attrs[n]['address'] + attrs[n]['battr']['attr']['name'].string(): attrs[n]['address'] for n in range(int(sect_attrs['nsections']))} args = [] for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
Signature · 1 line
2.25.1
Re: [PATCH 4.19 42/86] scripts/gdb: fix lx-symbols gdb.error while loading modules
Hi Greg, Sasha,
Quoted 7 lines · Greg Kroah-Hartman
From: Stefano Garzarella <[email protected]>
[ Upstream commit
7359608a271ce81803de148befefd309baf88c76]Commit
ed66f991bb19("module: Refactor section attr into bin attribute") removed the 'name' field from 'structmodule_sect_attr' triggering the following error when invoking lx-symbols:
Has ed66f991bb19 ("module: Refactor section attr into bin attribute") been backported to 4.19? It doesn't /sound/ like something that would require backporting unless something else depended up on it, but if it hasn't been ... then *this* patch shouldn't be either...
Same for 5.4, and 5.7 that's just come in.
This patch will 'apply' cleanly, and not hit any compilation errors, as it only changes python code... so my reason to highlight is in case some automated system picked it up based on those assumptions.
If ed66f991bb19 has also been backported, then I'm sorry for the noise ;-)
--
Kieran
Quoted 37 lines
(gdb) lx-symbols
loading vmlinux
scanning for modules in linux/build
loading @0xffffffffc014f000:linux/build/drivers/net/tun.koPython Exception <class 'gdb.error'> There is no member named name.:
Error occurred in Python: There is no member named name.This patch fixes the issue taking the module name from the 'struct attribute'.
Fixes ed66f991bb19 ("module: Refactor section attr into bin attribute")Signed-off-by Stefano Garzarella <[email protected]>Signed-off-by Andrew Morton <[email protected]>Reviewed-by Jan Kiszka <[email protected]>Reviewed-by Kieran Bingham <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- scripts/gdb/linux/symbols.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)scripts/gdb/linux/symbols.py +1
-1@@ -96,7 +96,7 @@ lx-symbols command.""" return "" attrs = sect_attrs['attrs'] section_name_to_address = { - attrs[n]['name'].string(): attrs[n]['address'] + attrs[n]['battr']['attr']['name'].string(): attrs[n]['address'] for n in range(int(sect_attrs['nsections']))} args = [] for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
Signature · 2 lines
-- Kieran
Re: [PATCH 4.19 42/86] scripts/gdb: fix lx-symbols gdb.error while loading modules
Quoted 17 lines · Kieran Bingham
Hi Greg, Sasha,
Quoted 7 lines · Greg Kroah-Hartman
From: Stefano Garzarella <[email protected]>
[ Upstream commit
7359608a271ce81803de148befefd309baf88c76]Commit
ed66f991bb19("module: Refactor section attr into bin attribute") removed the 'name' field from 'structmodule_sect_attr' triggering the following error when invoking lx-symbols:Has
ed66f991bb19("module: Refactor section attr into bin attribute") been backported to 4.19? It doesn't /sound/ like something that would require backporting unless something else depended up on it, but if it hasn't been ... then *this* patch shouldn't be either...
Quoted 8 lines
Same for 5.4, and 5.7 that's just come in.
This patch will 'apply' cleanly, and not hit any compilation errors, as it only changes python code... so my reason to highlight is in case some automated system picked it up based on those assumptions.
If
ed66f991bb19has also been backported, then I'm sorry for the noise ;-)
I had the same doubt, but I just saw that ed66f991bb19 was backported to the stable branches (4.19, 5.4 and 5.7), so I think this backport is correct.
Thanks,
Stefano
Re: [PATCH 4.19 42/86] scripts/gdb: fix lx-symbols gdb.error while loading modules
Hi Stefano,
Quoted 24 lines · Stefano Garzarella
Quoted 23 lines · Kieran Bingham
Hi Greg, Sasha,
Quoted 7 lines · Greg Kroah-Hartman
From: Stefano Garzarella <[email protected]>
[ Upstream commit
7359608a271ce81803de148befefd309baf88c76]Commit
ed66f991bb19("module: Refactor section attr into bin attribute") removed the 'name' field from 'structmodule_sect_attr' triggering the following error when invoking lx-symbols:Has
ed66f991bb19("module: Refactor section attr into bin attribute") been backported to 4.19? It doesn't /sound/ like something that would require backporting unless something else depended up on it, but if it hasn't been ... then *this* patch shouldn't be either...Same for 5.4, and 5.7 that's just come in.
This patch will 'apply' cleanly, and not hit any compilation errors, as it only changes python code... so my reason to highlight is in case some automated system picked it up based on those assumptions.
Quoted 5 lines
Quoted 2 lines
If
ed66f991bb19has also been backported, then I'm sorry for the noise ;-)I had the same doubt, but I just saw that
ed66f991bb19was backported to the stable branches (4.19, 5.4 and 5.7), so I think this backport is> correct.
Perfect, thanks for confirming.
--
Kieran
Greg Kroah-Hartman
maintainerRe: [PATCH 4.19 42/86] scripts/gdb: fix lx-symbols gdb.error while loading modules
In reply to Kieran BinghamQuoted 12 lines · Kieran Bingham
Hi Greg, Sasha,
Quoted 7 lines · Greg Kroah-Hartman
From: Stefano Garzarella <[email protected]>
[ Upstream commit
7359608a271ce81803de148befefd309baf88c76]Commit
ed66f991bb19("module: Refactor section attr into bin attribute") removed the 'name' field from 'structmodule_sect_attr' triggering the following error when invoking lx-symbols:
Quoted 4 lines
Has
ed66f991bb19("module: Refactor section attr into bin attribute") been backported to 4.19? It doesn't /sound/ like something that would require backporting unless something else depended up on it, but if it hasn't been ... then *this* patch shouldn't be either...
It was released in 4.19.133, 5.4.52, and 5.7.9.
Quoted 7 lines
Same for 5.4, and 5.7 that's just come in.
This patch will 'apply' cleanly, and not hit any compilation errors, as it only changes python code... so my reason to highlight is in case some automated system picked it up based on those assumptions.
If
ed66f991bb19has also been backported, then I'm sorry for the noise ;-)
It was, but thanks for the review!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 43/86 HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
In reply to Greg Kroah-HartmanFrom: Federico Ricchiuto <[email protected]>
[ Upstream commit 43e666acb79f3d355dd89bf20f4d25d3b15da13e ]
The Mediacom FlexBook edge13 uses the SIPODEV SP1064 touchpad, which does not supply descriptors, so it has to be added to the override list.
--- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +8 -0
@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { }, .driver_data = (void *)&sipodev_desc }, + { + .ident = "Mediacom FlexBook edge 13", + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"MEDIACOM" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"), + }, + .driver_data = (void *)&sipodev_desc + }, { .ident ="Odys Winbook 13" , .matches = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 44/86 HID: alps: support devices with report id 2
In reply to Greg Kroah-HartmanFrom: Caiyuan Xie <[email protected]>
[ Upstream commit aa3c439c144f0a465ed1f28f11c772886fb02b35 ]
Add support for devices which that have reports with id == 2
--- drivers/hid/hid-alps.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-alps.c +2 -0
@@ -29,6 +29,7 @@#define U1_MOUSE_REPORT_ID 0x01/* Mouse data ReportID */ #define U1_ABSOLUTE_REPORT_ID 0x03/* Absolute data ReportID */ +#define U1_ABSOLUTE_REPORT_ID_SECD 0x02/* FW-PTP Absolute data ReportID */ #define U1_FEATURE_REPORT_ID 0x05/* Feature ReportID */ #define U1_SP_ABSOLUTE_REPORT_ID 0x06/* Feature ReportID */
@@ -372,6 +373,7 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size)case U1_FEATURE_REPORT_ID :break ;case U1_ABSOLUTE_REPORT_ID : +case U1_ABSOLUTE_REPORT_ID_SECD :for (i =0 ; i < hdata->max_fingers; i++) {u8 *contact = &data[i *5 ];
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 45/86 HID: steam: fixes race in handling device list.
In reply to Greg Kroah-HartmanFrom: Rodrigo Rivas Costa <[email protected]>
[ Upstream commit 2d3f53a80e4eed078669853a178ed96d88f74143 ]
Using uhid and KASAN this driver crashed because it was getting several connection events where it only expected one. Then the device was added several times to the static device list and it got corrupted.
This patch checks if the device is already in the list before adding it.
--- drivers/hid/hid-steam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/hid/hid-steam.c +4 -2
@@ -526,7 +526,8 @@ static int steam_register(struct steam_device *steam)steam_battery_register (steam);mutex_lock (&steam_devices_lock); -list_add (&steam->list, &steam_devices); +if (list_empty (&steam->list)) +list_add (&steam->list, &steam_devices);mutex_unlock (&steam_devices_lock); }
@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam)hid_info (steam->hdev,"Steam Controller '%s' disconnected" , steam->serial_no);mutex_lock (&steam_devices_lock); -list_del (&steam->list); +list_del_init (&steam->list);mutex_unlock (&steam_devices_lock); steam->serial_no[0 ] =0 ; }
@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev,mutex_init (&steam->mutex); steam->quirks = id->driver_data;INIT_WORK (&steam->work_connect, steam_work_connect_cb); +INIT_LIST_HEAD (&steam->list); steam->client_hdev =steam_create_client_hid (hdev);if (IS_ERR (steam->client_hdev)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 46/86 HID: apple: Disable Fn-key key-re-mapping on clone keyboards
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit a5d81646fa294eed57786a9310b06ca48902adf8 ]
The Maxxter KB-BT-001 Bluetooth keyboard, which looks somewhat like the Apple Wireless Keyboard, is using the vendor and product IDs (05AC:0239) of the Apple Wireless Keyboard (2009 ANSI version) <sigh>.
But its F1 - F10 keys are marked as sending F1 - F10, not the special functions hid-apple.c maps them too; and since its descriptors do not contain the HID_UP_CUSTOM | 0x0003 usage apple-hid looks for for the Fn-key, apple_setup_input() never gets called, so F1 - F6 are mapped to key-codes which have not been set in the keybit array causing them to not send any events at all.
The lack of a usage code matching the Fn key in the clone is actually useful as this allows solving this problem in a generic way.
This commits adds a fn_found flag and it adds a input_configured callback which checks if this flag is set once all usages have been mapped. If it is not set, then assume this is a clone and clear the quirks bitmap so that the hid-apple code does not add any special handling to this keyboard.
This fixes F1 - F6 not sending anything at all and F7 - F12 sending the wrong codes on the Maxxter KB-BT-001 Bluetooth keyboard and on similar clones.
--- drivers/hid/hid-apple.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/hid/hid-apple.c +18 -0
@@ -57,6 +57,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")struct apple_sc {unsigned long quirks;unsigned int fn_on; +unsigned int fn_found; DECLARE_BITMAP(pressed_numlock, KEY_CNT); };
@@ -342,12 +343,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, struct hid_field *field, struct hid_usage *usage, unsigned long **bit, int *max) { + struct apple_sc *asc = hid_get_drvdata(hdev); +if (usage->hid == (HID_UP_CUSTOM |0x0003 ) || usage->hid == (HID_UP_MSVENDOR |0x0003 ) || usage->hid == (HID_UP_HPVENDOR2 |0x0003 )) {/* The fn key on Apple USB keyboards */ set_bit (EV_REP , hi->input->evbit);hid_map_usage_clear (hi, usage, bit, max,EV_KEY ,KEY_FN ); + asc->fn_found = true;apple_setup_input (hi->input);return 1 ; }
@@ -374,6 +378,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi,return 0 ; } +static int apple_input_configured (struct hid_device *hdev, +struct hid_input *hidinput) +{ +struct apple_sc *asc =hid_get_drvdata (hdev); + +if ((asc->quirks &APPLE_HAS_FN ) && !asc->fn_found) { +hid_info (hdev,"Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n" ); + asc->quirks =0 ; + } + +return 0 ; +} +static int apple_probe (struct hid_device *hdev,const struct hid_device_id *id) {
@@ -588,6 +605,7 @@ static struct hid_driver apple_driver = { .event = apple_event, .input_mapping = apple_input_mapping, .input_mapped = apple_input_mapped, + .input_configured = apple_input_configured, };module_hid_driver (apple_driver);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 47/86 dmaengine: tegra210-adma: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 5b78fac4b1ba731cf4177fdbc1e3a4661521bcd0 ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code. Thus a pairing decrement is needed on the error handling path to keep the counter balanced.
--- drivers/dma/tegra210-adma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/dma/tegra210-adma.c +4 -1
@@ -583,6 +583,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc) ret =pm_runtime_get_sync (tdc2dev (tdc));if (ret <0 ) { +pm_runtime_put_noidle (tdc2dev (tdc));free_irq (tdc->irq, tdc);return ret; }
@@ -764,8 +765,10 @@ static int tegra_adma_probe(struct platform_device *pdev)pm_runtime_enable (&pdev->dev); ret =pm_runtime_get_sync (&pdev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (&pdev->dev); goto rpm_disable; + } ret =tegra_adma_init (tdma);if (ret)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 48/86 Input: add `SW_MACHINE_COVER`
In reply to Greg Kroah-HartmanFrom: Merlijn Wajer <[email protected]>
[ Upstream commit c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df ]
This event code represents the state of a removable cover of a device. Value 0 means that the cover is open or removed, value 1 means that the cover is closed.
--- include/linux/mod_devicetable.h | 2 +- include/uapi/linux/input-event-codes.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
include/linux/mod_devicetable.h +1 -1
@@ -299,7 +299,7 @@ struct pcmcia_device_id {#define INPUT_DEVICE_ID_LED_MAX 0x0f#define INPUT_DEVICE_ID_SND_MAX 0x07#define INPUT_DEVICE_ID_FF_MAX 0x7f -#define INPUT_DEVICE_ID_SW_MAX 0x0f +#define INPUT_DEVICE_ID_SW_MAX 0x10#define INPUT_DEVICE_ID_PROP_MAX 0x1f#define INPUT_DEVICE_ID_MATCH_BUS 1
include/uapi/linux/input-event-codes.h +2 -1
@@ -795,7 +795,8 @@#define SW_LINEIN_INSERT 0x0d/* set = inserted */ #define SW_MUTE_DEVICE 0x0e/* set = device disabled */ #define SW_PEN_INSERTED 0x0f/* set = pen inserted */ -#define SW_MAX 0x0f +#define SW_MACHINE_COVER 0x10/* set = cover closed */ +#define SW_MAX 0x10#define SW_CNT (SW_MAX+1)/*
Signature · 1 line
2.25.1
Re: [PATCH 4.19 48/86] Input: add `SW_MACHINE_COVER`
Hi!
Quoted 5 lines
[ Upstream commit
c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df]This event code represents the state of a removable cover of a device. Value 0 means that the cover is open or removed, value 1 means that the cover is closed.
This is only needed for N900 cover changes. I don't see them in stable, so I believe this should be dropped.
Best regards,
Pavel
Quoted 17 lines
index
61a5799b440b9..c3e84f7c8261a100644include/uapi/linux/input-event-codes.h +2
-1@@ -795,7 +795,8 @@#define SW_LINEIN_INSERT 0x0d/* set = inserted */ #define SW_MUTE_DEVICE 0x0e/* set = device disabled */ #define SW_PEN_INSERTED 0x0f/* set = pen inserted */ -#define SW_MAX 0x0f +#define SW_MACHINE_COVER 0x10/* set = cover closed */ +#define SW_MAX 0x10#define SW_CNT (SW_MAX+1)/* Signature · 1 line
2.25.1
Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Re: [PATCH 4.19 48/86] Input: add `SW_MACHINE_COVER`
Quoted 10 lines · Pavel Machek
Hi!
Quoted 5 lines
[ Upstream commit
c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df]This event code represents the state of a removable cover of a device. Value 0 means that the cover is open or removed, value 1 means that the cover is closed.
This is only needed for N900 cover changes. I don't see them in stable, so I believe this should be dropped.
I guess there is no harm in adding the new switch definition to stable releases. It is now part of ABI and is set in stone.
Thanks.
Signature · 1 line
Dmitry
Greg Kroah-Hartman
maintainerPATCH 49/86 spi: mediatek: use correct SPI_CFG2_REG MACRO
In reply to Greg Kroah-HartmanFrom: leilk.liu <[email protected]>
[ Upstream commit 44b37eb79e16a56cb30ba55b2da452396b941e7a ]
this patch use correct SPI_CFG2_REG offset.
--- drivers/spi/spi-mt65xx.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/spi/spi-mt65xx.c +8 -7
@@ -41,7 +41,6 @@#define SPI_CFG0_SCK_LOW_OFFSET 8#define SPI_CFG0_CS_HOLD_OFFSET 16#define SPI_CFG0_CS_SETUP_OFFSET 24 -#define SPI_ADJUST_CFG0_SCK_LOW_OFFSET 16#define SPI_ADJUST_CFG0_CS_HOLD_OFFSET 0#define SPI_ADJUST_CFG0_CS_SETUP_OFFSET 16
@@ -53,6 +52,8 @@#define SPI_CFG1_CS_IDLE_MASK 0xff#define SPI_CFG1_PACKET_LOOP_MASK 0xff00#define SPI_CFG1_PACKET_LENGTH_MASK 0x3ff0000 +#define SPI_CFG2_SCK_HIGH_OFFSET 0 +#define SPI_CFG2_SCK_LOW_OFFSET 16#define SPI_CMD_ACT BIT(0)#define SPI_CMD_RESUME BIT(1)
@@ -259,7 +260,7 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable)static void mtk_spi_prepare_transfer (struct spi_master *master,struct spi_transfer *xfer) { -u32 spi_clk_hz, div, sck_time, cs_time, reg_val =0 ; +u32 spi_clk_hz, div, sck_time, cs_time, reg_val;struct mtk_spi *mdata =spi_master_get_devdata (master); spi_clk_hz =clk_get_rate (mdata->spi_clk);
@@ -272,18 +273,18 @@ static void mtk_spi_prepare_transfer(struct spi_master *master, cs_time = sck_time *2 ;if (mdata->dev_comp->enhance_timing) { + reg_val = (((sck_time -1 ) &0xffff ) + <<SPI_CFG2_SCK_HIGH_OFFSET ); reg_val |= (((sck_time -1 ) &0xffff ) - <<SPI_CFG0_SCK_HIGH_OFFSET ); - reg_val |= (((sck_time -1 ) &0xffff ) - <<SPI_ADJUST_CFG0_SCK_LOW_OFFSET ); + <<SPI_CFG2_SCK_LOW_OFFSET );writel (reg_val, mdata->base +SPI_CFG2_REG ); - reg_val |= (((cs_time -1 ) &0xffff ) + reg_val = (((cs_time -1 ) &0xffff ) <<SPI_ADJUST_CFG0_CS_HOLD_OFFSET ); reg_val |= (((cs_time -1 ) &0xffff ) <<SPI_ADJUST_CFG0_CS_SETUP_OFFSET );writel (reg_val, mdata->base +SPI_CFG0_REG ); }else { - reg_val |= (((sck_time -1 ) &0xff ) + reg_val = (((sck_time -1 ) &0xff ) <<SPI_CFG0_SCK_HIGH_OFFSET ); reg_val |= (((sck_time -1 ) &0xff ) <<SPI_CFG0_SCK_LOW_OFFSET ); reg_val |= (((cs_time -1 ) &0xff ) <<SPI_CFG0_CS_HOLD_OFFSET );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 50/86 regmap: dev_get_regmap_match(): fix string comparison
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ]
This function is used by dev_get_regmap() to retrieve a regmap for the specified device. If the device has more than one regmap, the name parameter can be used to specify one.
The code here uses a pointer comparison to check for equal strings. This however will probably always fail, as the regmap->name is allocated via kstrdup_const() from the regmap's config->name.
Fix this by using strcmp() instead.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -1343,7 +1343,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)/* If the user didn't specify a name match any */ if (data) -return (*r)->name == data; +return !strcmp ((*r)->name, data);else return 1 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 51/86 hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit bc4071aafcf4d0535ee423b69167696d6c03207d ]
aspeed_create_fan() reads a pwm_port value using of_property_read_u32(). If pwm_port will be more than ARRAY_SIZE(pwm_port_params), there will be a buffer overflow in aspeed_create_pwm_port()->aspeed_set_pwm_port_enable(). The patch fixes the potential buffer overflow.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hwmon/aspeed-pwm-tacho.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hwmon/aspeed-pwm-tacho.c +2 -0
@@ -880,6 +880,8 @@ static int aspeed_create_fan(struct device *dev, ret =of_property_read_u32 (child,"reg" , &pwm_port);if (ret)return ret; +if (pwm_port >=ARRAY_SIZE (pwm_port_params)) +return -EINVAL ;aspeed_create_pwm_port (priv, (u8 )pwm_port); ret =of_property_count_u8_elems (child,"cooling-levels" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 52/86 dmaengine: ioat setting ioat timeout as module parameter
In reply to Greg Kroah-HartmanFrom: Leonid Ravich <[email protected]>
[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ]
DMA transaction time to completion is a function of PCI bandwidth, transaction size and a queue depth. So hard coded value for timeouts might be wrong for some scenarios.
--- drivers/dma/ioat/dma.c | 12 ++++++++++++ drivers/dma/ioat/dma.h | 2 -- 2 files changed, 12 insertions(+), 2 deletions(-)
drivers/dma/ioat/dma.c +12 -0
@@ -38,6 +38,18 @@#include "../dmaengine.h" +int completion_timeout =200 ; +module_param (completion_timeout, int,0644 ); +MODULE_PARM_DESC (completion_timeout, +"set ioat completion timeout [msec] (default 200 [msec])" ); +int idle_timeout =2000 ; +module_param (idle_timeout, int,0644 ); +MODULE_PARM_DESC (idle_timeout, +"set ioat idel timeout [msec] (default 2000 [msec])" ); + +#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout) +#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout) +static char *chanerr_str[] = {"DMA Transfer Source Address Error" ,"DMA Transfer Destination Address Error" ,
drivers/dma/ioat/dma.h +0 -2
@@ -111,8 +111,6 @@ struct ioatdma_chan {#define IOAT_RUN 5#define IOAT_CHAN_ACTIVE 6struct timer_list timer; -#define COMPLETION_TIMEOUT msecs_to_jiffies(100) -#define IDLE_TIMEOUT msecs_to_jiffies(2000)#define RESET_DELAY msecs_to_jiffies(100)struct ioatdma_device *ioat_dma;dma_addr_t completion_dma;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 53/86 Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
In reply to Greg Kroah-HartmanFrom: Ilya Katsnelson <[email protected]>
[ Upstream commit dcb00fc799dc03fd320e123e4c81b3278c763ea5 ]
Tested on my own laptop, touchpad feels slightly more responsive with this on, though it might just be placebo.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -182,6 +182,7 @@ static const char * const smbus_pnp_ids[] = {"LEN0093" ,/* T480 */ "LEN0096" ,/* X280 */ "LEN0097" ,/* X280 -> ALPS trackpoint */ +"LEN0099" ,/* X1 Extreme 1st */ "LEN009b" ,/* T580 */ "LEN200f" ,/* T450s */ "LEN2044", /* L470 */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 54/86 Input: elan_i2c - only increment wakeup count on touch
In reply to Greg Kroah-HartmanFrom: Derek Basehore <[email protected]>
[ Upstream commit 966334dfc472bdfa67bed864842943b19755d192 ]
This moves the wakeup increment for elan devices to the touch report. This prevents the drivers from incorrectly reporting a wakeup when the resume callback resets then device, which causes an interrupt to occur.
--- drivers/input/mouse/elan_i2c_core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/input/mouse/elan_i2c_core.c +5 -2
@@ -917,6 +917,8 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet)u8 hover_info = packet[ETP_HOVER_INFO_OFFSET ];bool contact_valid, hover_event; +pm_wakeup_event (&data->client->dev,0 ); + hover_event = hover_info &0x40 ;for (i =0 ; i <ETP_MAX_FINGERS ; i++) { contact_valid = tp_info & (1U << (3 + i));
@@ -939,6 +941,8 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)u8 *packet = &report[ETP_REPORT_ID_OFFSET +1 ];int x, y; +pm_wakeup_event (&data->client->dev,0 ); +if (!data->tp_input) {dev_warn_once (&data->client->dev,"received a trackpoint report while no trackpoint device has been created. Please report upstream.\n" );
@@ -963,7 +967,6 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)static irqreturn_t elan_isr (int irq,void *dev_id) {struct elan_tp_data *data = dev_id; -struct device *dev = &data->client->dev;int error;u8 report[ETP_MAX_REPORT_LEN ];
@@ -989,7 +992,7 @@ static irqreturn_t elan_isr(int irq, void *dev_id)elan_report_trackpoint (data, report);break ;default : -dev_err (dev,"invalid report id data (%x)\n" , +dev_err (&data->client->dev,"invalid report id data (%x)\n" , report[ETP_REPORT_ID_OFFSET ]); }
Signature · 1 line
2.25.1
Re: [PATCH 4.19 54/86] Input: elan_i2c - only increment wakeup count on touch
Hi!
Quoted 8 lines
From: Derek Basehore <[email protected]>
[ Upstream commit
966334dfc472bdfa67bed864842943b19755d192]This moves the wakeup increment for elan devices to the touch report. This prevents the drivers from incorrectly reporting a wakeup when the resume callback resets then device, which causes an interrupt to occur.
Contrary to the changelog, this does not move anything... unlike mainline, it simply adds two pm_wakeup_events.
It may still be correct, but maybe someone wants to double-check?
Best regards,
Pavel
Quoted 43 lines
drivers/input/mouse/elan_i2c_core.c +5
-2@@ -917,6 +917,8 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet)u8 hover_info = packet[ETP_HOVER_INFO_OFFSET ];bool contact_valid, hover_event; +pm_wakeup_event (&data->client->dev,0 ); + hover_event = hover_info &0x40 ;for (i =0 ; i <ETP_MAX_FINGERS ; i++) { contact_valid = tp_info & (1U << (3 + i));@@ -939,6 +941,8 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)u8 *packet = &report[ETP_REPORT_ID_OFFSET +1 ];int x, y; +pm_wakeup_event (&data->client->dev,0 ); +if (!data->tp_input) {dev_warn_once (&data->client->dev,"received a trackpoint report while no trackpoint device has been created. Please report upstream.\n" );@@ -963,7 +967,6 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)static irqreturn_t elan_isr (int irq,void *dev_id) {struct elan_tp_data *data = dev_id; -struct device *dev = &data->client->dev;int error;u8 report[ETP_MAX_REPORT_LEN ];@@ -989,7 +992,7 @@ static irqreturn_t elan_isr(int irq, void *dev_id)elan_report_trackpoint (data, report);break ;default : -dev_err (dev,"invalid report id data (%x)\n" , +dev_err (&data->client->dev,"invalid report id data (%x)\n" , report[ETP_REPORT_ID_OFFSET ]); }Signature · 1 line
2.25.1
Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Re: [PATCH 4.19 54/86] Input: elan_i2c - only increment wakeup count on touch
Quoted 11 lines · Pavel Machek
Hi!
Quoted 8 lines
From: Derek Basehore <[email protected]>
[ Upstream commit
966334dfc472bdfa67bed864842943b19755d192]This moves the wakeup increment for elan devices to the touch report. This prevents the drivers from incorrectly reporting a wakeup when the resume callback resets then device, which causes an interrupt to occur.
Quoted 4 lines
Contrary to the changelog, this does not move anything... unlike mainline, it simply adds two
pm_wakeup_events.It may still be correct, but maybe someone wants to double-check?
Good catch, I believe the backport is busted.
Thanks.
Signature · 1 line
Dmitry
Re: [PATCH 4.19 54/86] Input: elan_i2c - only increment wakeup count on touch
Quoted 13 lines · Dmitry Torokhov
Quoted 11 lines · Pavel Machek
Hi!
Quoted 8 lines
From: Derek Basehore <[email protected]>
[ Upstream commit
966334dfc472bdfa67bed864842943b19755d192]This moves the wakeup increment for elan devices to the touch report. This prevents the drivers from incorrectly reporting a wakeup when the resume callback resets then device, which causes an interrupt to occur.
Quoted 6 lines
Quoted 4 lines
Contrary to the changelog, this does not move anything... unlike mainline, it simply adds two
pm_wakeup_events.It may still be correct, but maybe someone wants to double-check?
Good catch, I believe the backport is busted.
I don't believe it will break anything, but the backport isn't needed in 4.19 since "Input: elan_i2c - increment wakeup count if wake source" wasn't merged into 4.19. It's probably best to drop the backport.
Quoted 5 lines
Thanks.
--
Dmitry
Sasha Levin
maintainerRe: [PATCH 4.19 54/86] Input: elan_i2c - only increment wakeup count on touch
Quoted 18 lines · dbasehore .
Quoted 16 lines · Dmitry Torokhov
Quoted 14 lines · Pavel Machek
Hi!
Quoted 8 lines
From: Derek Basehore <[email protected]>
[ Upstream commit
966334dfc472bdfa67bed864842943b19755d192]This moves the wakeup increment for elan devices to the touch report. This prevents the drivers from incorrectly reporting a wakeup when the resume callback resets then device, which causes an interrupt to occur.
Contrary to the changelog, this does not move anything... unlike mainline, it simply adds two
pm_wakeup_events.
Quoted 8 lines
Quoted 3 lines
Quoted 1 line
It may still be correct, but maybe someone wants to double-check?
Good catch, I believe the backport is busted.
I don't believe it will break anything, but the backport isn't needed in 4.19 since "Input:
elan_i2c- increment wakeup count if wake source" wasn't merged into 4.19. It's probably best to drop the backport.
Hm, I wonder how this happened. It was just a cherry pick in this case :/
Either way, I've dropped it from 4.19, thanks!
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 55/86 usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ]
gr_ep_init() does not assign the allocated request anywhere if allocation of memory for the buffer fails. This is a memory leak fixed by the given patch.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/gadget/udc/gr_udc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/gr_udc.c +5 -2
@@ -1980,9 +1980,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)if (num ==0 ) { _req =gr_alloc_request (&ep->ep,GFP_ATOMIC ); +if (!_req) +return -ENOMEM ; + buf =devm_kzalloc (dev->dev,PAGE_SIZE ,GFP_DMA |GFP_ATOMIC ); -if (!_req || !buf) { -/* possible _req freed by gr_probe via gr_remove */ +if (!buf) { +gr_free_request (&ep->ep, _req);return -ENOMEM ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 56/86 hwmon: (adm1275) Make sure we are reading enough data for different chips
In reply to Greg Kroah-HartmanFrom: Chu Lin <[email protected]>
[ Upstream commit 6d1d41c075a1a54ba03370e268171fec20e06563 ]
Issue:
When PEC is enabled, binding adm1272 to the adm1275 would fail due to PEC error. See below:
adm1275: probe of xxxx failed with error -74
Diagnosis:
Per the datasheet of adm1272, adm1278, adm1293 and amd1294, PMON_CONFIG (0xd4) is 16bits wide. On the other hand, PMON_CONFIG (0xd4) for adm1275 is 8bits wide. The driver should not assume everything is 8bits wide and read only 8bits from it.
Solution:
If it is adm1272, adm1278, adm1293 and adm1294, use i2c_read_word. Else, use i2c_read_byte
Testing:
Binding adm1272 to the driver.
The change is only tested on adm1272.
--- drivers/hwmon/pmbus/adm1275.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/hwmon/pmbus/adm1275.c +8 -2
@@ -364,6 +364,7 @@ MODULE_DEVICE_TABLE(i2c, adm1275_id);static int adm1275_probe (struct i2c_client *client,const struct i2c_device_id *id) { +s32 (*config_read_fn)(const struct i2c_client *client,u8 reg);u8 block_buffer[I2C_SMBUS_BLOCK_MAX +1 ];int config, device_config;int ret;
@@ -408,11 +409,16 @@ static int adm1275_probe(struct i2c_client *client,"Device mismatch: Configured %s, detected %s\n" , id->name, mid->name); - config =i2c_smbus_read_byte_data (client,ADM1275_PMON_CONFIG ); +if (mid->driver_data == adm1272 || mid->driver_data == adm1278 || + mid->driver_data == adm1293 || mid->driver_data == adm1294) + config_read_fn = i2c_smbus_read_word_data; +else + config_read_fn = i2c_smbus_read_byte_data; + config =config_read_fn (client,ADM1275_PMON_CONFIG );if (config <0 )return config; - device_config =i2c_smbus_read_byte_data (client,ADM1275_DEVICE_CONFIG ); + device_config =config_read_fn (client,ADM1275_DEVICE_CONFIG );if (device_config <0 )return device_config;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 57/86 hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit 3ce17cd2b94907f6d91b81b32848044b84c97606 ]
SMATCH detected a potential buffer overflow in the manipulation of hwmon_attributes array inside the scmi_hwmon_probe function:
drivers/hwmon/scmi-hwmon.c:226
scmi_hwmon_probe() error: buffer overflow 'hwmon_attributes' 6 <= 9
Fix it by statically declaring the size of the array as the maximum possible as defined by hwmon_max define.
--- drivers/hwmon/scmi-hwmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/scmi-hwmon.c +1 -1
@@ -99,7 +99,7 @@ static enum hwmon_sensor_types scmi_types[] = { [ENERGY] = hwmon_energy, }; -static u32 hwmon_attributes[] = { +static u32 hwmon_attributes[hwmon_max] = { [hwmon_chip] =HWMON_C_REGISTER_TZ , [hwmon_temp] =HWMON_T_INPUT |HWMON_T_LABEL , [hwmon_in] =HWMON_I_INPUT |HWMON_I_LABEL ,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 58/86 arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ]
Rather than open-code test_tsk_thread_flag() at each callsite, simply replace the couple of offenders with calls to test_tsk_thread_flag() directly.
--- arch/arm64/kernel/debug-monitors.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/kernel/debug-monitors.c +2 -2
@@ -392,14 +392,14 @@ void user_rewind_single_step(struct task_struct *task)* If single step is active for this thread, then set SPSR.SS * to 1 to avoid returning to the active-pending state. */ -if (test_ti_thread_flag (task_thread_info (task),TIF_SINGLESTEP )) +if (test_tsk_thread_flag (task,TIF_SINGLESTEP ))set_regs_spsr_ss (task_pt_regs (task)); }NOKPROBE_SYMBOL (user_rewind_single_step);void user_fastforward_single_step (struct task_struct *task) { -if (test_ti_thread_flag (task_thread_info (task),TIF_SINGLESTEP )) +if (test_tsk_thread_flag (task,TIF_SINGLESTEP ))clear_regs_spsr_ss (task_pt_regs (task)); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 59/86 x86: math-emu: Fix up cmp insn for clang ias
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ]
The clang integrated assembler requires the 'cmp' instruction to have a length prefix here:
arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an explicit suffix (could be 'cmpb', 'cmpw', or 'cmpl')
cmp $0xffffffff,-24(%ebp)
^
Make this a 32-bit comparison, which it was clearly meant to be.
--- arch/x86/math-emu/wm_sqrt.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/math-emu/wm_sqrt.S +1 -1
@@ -209,7 +209,7 @@ sqrt_stage_2_finish: #ifdef PARANOID /* It should be possible to get here only if the arg is ffff....ffff */ - cmp $0xffffffff,FPU_fsqrt_arg_1 + cmpl $0xffffffff,FPU_fsqrt_arg_1 jnz sqrt_stage_2_error #endif /* PARANOID */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 60/86 RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw
In reply to Greg Kroah-HartmanFrom: Palmer Dabbelt <[email protected]>
[ Upstream commit 38b7c2a3ffb1fce8358ddc6006cfe5c038ff9963 ]
While digging through the recent mmiowb preemption issue it came up that we aren't actually preventing IO from crossing a scheduling boundary. While it's a bit ugly to overload smp_mb__after_spinlock() with this behavior, it's what PowerPC is doing so there's some precedent.
--- arch/riscv/include/asm/barrier.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/riscv/include/asm/barrier.h +9 -1
@@ -69,8 +69,16 @@ do { \* The AQ/RL pair provides a RCpc critical section, but there's not really any * way we can take advantage of that here because the ordering is only enforced * on that one lock. Thus, we're just doing a full fence. +* +* Since we allow writeX to be called from preemptive regions we need at least +* an "o" in the predecessor set to ensure device writes are visible before the +* task is marked as available for scheduling on a new hart. While I don't see +* any concrete reason we need a full IO fence, it seems safer to just upgrade +* this in order to avoid any IO crossing a scheduling boundary. In both +* instances the scheduler pairs this with an mb(), so nothing is necessary on +* the new hart. */ -#define smp_mb__after_spinlock () RISCV_FENCE(rw,rw) +#define smp_mb__after_spinlock () RISCV_FENCE(iorw,iorw)#include <asm-generic/barrier.h>
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 61/86 binder: Dont use mmput() from shrinker function.
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit f867c771f98891841c217fa8459244ed0dd28921 upstream.
syzbot is reporting that mmput() from shrinker function has a risk of deadlock [1], for delayed_uprobe_add() from update_ref_ctr() calls kzalloc(GFP_KERNEL) with delayed_uprobe_lock held, and uprobe_clear_state() from __mmput() also holds delayed_uprobe_lock.
Commit a1b2289cef92ef0e ("android: binder: drop lru lock in isolate callback") replaced mmput() with mmput_async() in order to avoid sleeping with spinlock held. But this patch replaces mmput() with mmput_async() in order not to start __mmput() from shrinker context.
[1] https://syzkaller.appspot.com/bug?id=bc9e7303f537c41b2b0cc2dfcea3fc42964c2d45
--- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/android/binder_alloc.c +1 -1
@@ -987,7 +987,7 @@ enum lru_status binder_alloc_free_page(strace_binder_unmap_user_end (alloc, index); }up_read (&mm->mmap_sem); -mmput (mm); +mmput_async (mm);trace_binder_unmap_kernel_start (alloc, index);
Greg Kroah-Hartman
maintainerPATCH 62/86 usb: xhci-mtk: fix the failure of bandwidth allocation
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit 5ce1a24dd98c00a57a8fa13660648abf7e08e3ef upstream.
The wMaxPacketSize field of endpoint descriptor may be zero as default value in alternate interface, and they are not actually selected when start stream, so skip them when try to allocate bandwidth.
--- drivers/usb/host/xhci-mtk-sch.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/host/xhci-mtk-sch.c +4 -0
@@ -275,6 +275,10 @@ static bool need_bw_sch(struct usb_host_if (is_fs_or_ls (speed) && !has_tt)return false; +/* skip endpoint with zero maxpkt */ +if (usb_endpoint_maxp (&ep->desc) ==0 ) +return false; +return true; }
Greg Kroah-Hartman
maintainerPATCH 63/86 usb: xhci: Fix ASM2142/ASM3142 DMA addressing
In reply to Greg Kroah-HartmanFrom: Forest Crossman <[email protected]>
commit dbb0897e805f2ab1b8bc358f6c3d878a376b8897 upstream.
The ASM2142/ASM3142 (same PCI IDs) does not support full 64-bit DMA addresses, which can cause silent memory corruption or IOMMU errors on platforms that use the upper bits. Add the XHCI_NO_64BIT_SUPPORT quirk to fix this issue.
--- drivers/usb/host/xhci-pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/xhci-pci.c +3 -0
@@ -231,6 +231,9 @@ static void xhci_pci_quirks(struct devicif (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==0x1142 ) xhci->quirks |=XHCI_TRUST_TX_LENGTH ; +if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && + pdev->device ==0x2142 ) + xhci->quirks |=XHCI_NO_64BIT_SUPPORT ;if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==PCI_DEVICE_ID_ASMEDIA_1042A_XHCI )
Greg Kroah-Hartman
maintainerPATCH 64/86 Revert "cifs: Fix the target file was deleted when rename failed."
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit 0e6705182d4e1b77248a93470d6d7b3013d59b30 upstream.
This reverts commit 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2.
Upon additional testing with older servers, it was found that the original commit introduced a regression when using the old SMB1 dialect and rsyncing over an existing file.
The patch will need to be respun to address this, likely including a larger refactoring of the SMB1 and SMB3 rename code paths to make it less confusing and also to address some additional rename error cases that SMB3 may be able to workaround.
--- fs/cifs/inode.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
fs/cifs/inode.c +2 -8
@@ -1783,7 +1783,6 @@ cifs_rename2(struct inode *source_dir, sFILE_UNIX_BASIC_INFO *info_buf_target;unsigned int xid;int rc, tmprc; -bool new_target =d_really_is_negative (target_dentry);if (flags & ~RENAME_NOREPLACE )return -EINVAL ;
@@ -1860,13 +1859,8 @@ cifs_rename2(struct inode *source_dir, s*/ unlink_target: -/* -* If the target dentry was created during the rename, try -* unlinking it if it's not negative -*/ -if (new_target && -d_really_is_positive (target_dentry) && - (rc == -EACCES || rc == -EEXIST )) { +/* Try unlinking the target dentry if it's not negative */ +if (d_really_is_positive (target_dentry) && (rc == -EACCES || rc == -EEXIST )) {if (d_is_dir (target_dentry)) tmprc =cifs_rmdir (target_dir, target_dentry);else
Greg Kroah-Hartman
maintainerPATCH 65/86 staging: wlan-ng: properly check endpoint types
In reply to Greg Kroah-HartmanFrom: Rustam Kovhaev <[email protected]>
commit faaff9765664009c1c7c65551d32e9ed3b1dda8f upstream.
As syzkaller detected, wlan-ng driver does not do sanity check of endpoints in prism2sta_probe_usb(), add check for xfer direction and type
--- drivers/staging/wlan-ng/prism2usb.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/staging/wlan-ng/prism2usb.c +15 -1
@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct us const struct usb_device_id *id) {struct usb_device *dev; - +const struct usb_endpoint_descriptor *epd; +const struct usb_host_interface *iface_desc = interface->cur_altsetting;struct wlandevice *wlandev =NULL ;struct hfa384x *hw =NULL ;int result =0 ; +if (iface_desc->desc.bNumEndpoints !=2 ) { + result = -ENODEV ; + goto failed; + } + + result = -EINVAL ; + epd = &iface_desc->endpoint[1 ].desc; +if (!usb_endpoint_is_bulk_in (epd)) + goto failed; + epd = &iface_desc->endpoint[2 ].desc; +if (!usb_endpoint_is_bulk_out (epd)) + goto failed; + dev =interface_to_usbdev (interface); wlandev =create_wlan ();if (!wlandev) {
Greg Kroah-Hartman
maintainerPATCH 66/86 staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit 0bd0db42a030b75c20028c7ba6e327b9cb554116 upstream.
The INSN_CONFIG comedi instruction with sub-instruction code INSN_CONFIG_DIGITAL_TRIG includes a base channel in data[3]. This is used as a right shift amount for other bitmask values without being checked. Shift amounts greater than or equal to 32 will result in undefined behavior. Add code to deal with this.
--- drivers/staging/comedi/drivers/addi_apci_1032.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1032.c +14 -6
@@ -106,14 +106,22 @@ static int apci1032_cos_insn_config(stru unsigned int *data) {struct apci1032_private *devpriv = dev->private; -unsigned int shift, oldmask; +unsigned int shift, oldmask, himask, lomask;switch (data[0 ]) {case INSN_CONFIG_DIGITAL_TRIG :if (data[1 ] !=0 )return -EINVAL ; shift = data[3 ]; - oldmask = (1U << shift) -1 ; +if (shift <32 ) { + oldmask = (1U << shift) -1 ; + himask = data[4 ] << shift; + lomask = data[5 ] << shift; + }else { + oldmask =0xffffffffu ; + himask =0 ; + lomask =0 ; + }switch (data[2 ]) {case COMEDI_DIGITAL_TRIG_DISABLE : devpriv->ctrl =0 ;
@@ -136,8 +144,8 @@ static int apci1032_cos_insn_config(stru devpriv->mode2 &= oldmask; }/* configure specified channels */ - devpriv->mode1 |= data[4 ] << shift; - devpriv->mode2 |= data[5 ] << shift; + devpriv->mode1 |= himask; + devpriv->mode2 |= lomask;break ;case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS : if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA |
@@ -154,8 +162,8 @@ static int apci1032_cos_insn_config(stru devpriv->mode2 &= oldmask; }/* configure specified channels */ - devpriv->mode1 |= data[4 ] << shift; - devpriv->mode2 |= data[5 ] << shift; + devpriv->mode1 |= himask; + devpriv->mode2 |= lomask;break ;default :return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 67/86 staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit f07804ec77d77f8a9dcf570a24154e17747bc82f upstream.
ni6527_intr_insn_config() processes INSN_CONFIG comedi instructions for the "interrupt" subdevice. When data[0] is INSN_CONFIG_DIGITAL_TRIG it is configuring the digital trigger. When data[2] is COMEDI_DIGITAL_TRIG_ENABLE_EDGES it is configuring rising and falling edge detection for the digital trigger, using a base channel number (or shift amount) in data[3], a rising edge bitmask in data[4] and falling edge bitmask in data[5].
If the base channel number (shift amount) is greater than or equal to the number of channels (24) of the digital input subdevice, there are no changes to the rising and falling edges, so the mask of channels to be changed can be set to 0, otherwise the mask of channels to be changed, and the rising and falling edge bitmasks are shifted by the base channel number before calling ni6527_set_edge_detection() to change the appropriate registers. Unfortunately, the code is comparing the base channel (shift amount) to the interrupt subdevice's number of channels
(1) instead of the digital input subdevice's number of channels (24). Fix it by comparing to 32 because all shift amounts for an unsigned int must be less than that and everything from bit 24 upwards is ignored by ni6527_set_edge_detection() anyway.
--- drivers/staging/comedi/drivers/ni_6527.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/ni_6527.c +1 -1
@@ -332,7 +332,7 @@ static int ni6527_intr_insn_config(struccase COMEDI_DIGITAL_TRIG_ENABLE_EDGES :/* check shift amount */ shift = data[3 ]; -if (shift >= s->n_chan) { +if (shift >=32 ) { mask =0 ; rising =0 ; falling =0 ;
Greg Kroah-Hartman
maintainerPATCH 68/86 staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit fc846e9db67c7e808d77bf9e2ef3d49e3820ce5d upstream.
The INSN_CONFIG comedi instruction with sub-instruction code INSN_CONFIG_DIGITAL_TRIG includes a base channel in data[3]. This is used as a right shift amount for other bitmask values without being checked. Shift amounts greater than or equal to 32 will result in undefined behavior. Add code to deal with this, adjusting the checks for invalid channels so that enabled channel bits that would have been lost by shifting are also checked for validity. Only channels 0 to 15 are valid.
--- drivers/staging/comedi/drivers/addi_apci_1500.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1500.c +19 -5
@@ -452,13 +452,14 @@ static int apci1500_di_cfg_trig(struct cstruct apci1500_private *devpriv = dev->private;unsigned int trig = data[1 ];unsigned int shift = data[3 ]; -unsigned int hi_mask = data[4 ] << shift; -unsigned int lo_mask = data[5 ] << shift; -unsigned int chan_mask = hi_mask | lo_mask; -unsigned int old_mask = (1 << shift) -1 ; +unsigned int hi_mask; +unsigned int lo_mask; +unsigned int chan_mask; +unsigned int old_mask;unsigned int pm;unsigned int pt;unsigned int pp; +unsigned int invalid_chan;if (trig >1 ) { dev_dbg(dev->class_dev,
@@ -466,7 +467,20 @@ static int apci1500_di_cfg_trig(struct creturn -EINVAL ; } -if (chan_mask >0xffff ) { +if (shift <=16 ) { + hi_mask = data[4 ] << shift; + lo_mask = data[5 ] << shift; + old_mask = (1U << shift) -1 ; + invalid_chan = (data[4 ] | data[5 ]) >> (16 - shift); + }else { + hi_mask =0 ; + lo_mask =0 ; + old_mask =0xffff ; + invalid_chan = data[4 ] | data[5 ]; + } + chan_mask = hi_mask | lo_mask; + +if (invalid_chan) {dev_dbg (dev->class_dev,"invalid digital trigger channel\n" );return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 69/86 staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit 926234f1b8434c4409aa4c53637aa3362ca07cea upstream.
The INSN_CONFIG comedi instruction with sub-instruction code INSN_CONFIG_DIGITAL_TRIG includes a base channel in data[3]. This is used as a right shift amount for other bitmask values without being checked. Shift amounts greater than or equal to 32 will result in undefined behavior. Add code to deal with this.
--- drivers/staging/comedi/drivers/addi_apci_1564.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1564.c +14 -6
@@ -331,14 +331,22 @@ static int apci1564_cos_insn_config(stru unsigned int *data) {struct apci1564_private *devpriv = dev->private; -unsigned int shift, oldmask; +unsigned int shift, oldmask, himask, lomask;switch (data[0 ]) {case INSN_CONFIG_DIGITAL_TRIG :if (data[1 ] !=0 )return -EINVAL ; shift = data[3 ]; - oldmask = (1U << shift) -1 ; +if (shift <32 ) { + oldmask = (1U << shift) -1 ; + himask = data[4 ] << shift; + lomask = data[5 ] << shift; + }else { + oldmask =0xffffffffu ; + himask =0 ; + lomask =0 ; + }switch (data[2 ]) {case COMEDI_DIGITAL_TRIG_DISABLE : devpriv->ctrl =0 ;
@@ -362,8 +370,8 @@ static int apci1564_cos_insn_config(stru devpriv->mode2 &= oldmask; }/* configure specified channels */ - devpriv->mode1 |= data[4 ] << shift; - devpriv->mode2 |= data[5 ] << shift; + devpriv->mode1 |= himask; + devpriv->mode2 |= lomask;break ;case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS : if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA |
@@ -380,8 +388,8 @@ static int apci1564_cos_insn_config(stru devpriv->mode2 &= oldmask; }/* configure specified channels */ - devpriv->mode1 |= data[4 ] << shift; - devpriv->mode2 |= data[5 ] << shift; + devpriv->mode1 |= himask; + devpriv->mode2 |= lomask;break ;default :return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 70/86 serial: 8250: fix null-ptr-deref in serial8250_start_tx()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit f4c23a140d80ef5e6d3d1f8f57007649014b60fa upstream.
I got null-ptr-deref in serial8250_start_tx():
[ 78.114630] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 78.123778] Mem abort info: [ 78.126560] ESR = 0x86000007 [ 78.129603] EC = 0x21: IABT (current EL), IL = 32 bits [ 78.134891] SET = 0, FnV = 0 [ 78.137933] EA = 0, S1PTW = 0 [ 78.141064] user pgtable: 64k pages, 48-bit VAs, pgdp=00000027d41a8600 [ 78.147562] [0000000000000000] pgd=00000027893f0003, p4d=00000027893f0003, pud=00000027893f0003, pmd=00000027c9a20003, pte=0000000000000000 [ 78.160029] Internal error: Oops: 86000007 [#1] SMP [ 78.164886] Modules linked in: sunrpc vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce ses enclosure sg sbsa_gwdt ipmi_ssif spi_dw_mmio sch_fq_codel vhost_net tun vhost vhost_iotlb tap ip_tables ext4 mbcache jbd2 ahci hisi_sas_v3_hw libahci hisi_sas_main libsas hns3 scsi_transport_sas hclge libata megaraid_sas ipmi_si hnae3 ipmi_devintf ipmi_msghandler br_netfilter bridge stp llc nvme nvme_core xt_sctp sctp libcrc32c dm_mod nbd [ 78.207383] CPU: 11 PID: 23258 Comm: null-ptr Not tainted 5.8.0-rc6+ #48 [ 78.214056] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B210.01 03/12/2020 [ 78.222888] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--) [ 78.228435] pc : 0x0 [ 78.230618] lr : serial8250_start_tx+0x160/0x260 [ 78.235215] sp : ffff800062eefb80 [ 78.238517] x29: ffff800062eefb80 x28: 0000000000000fff [ 78.243807] x27: ffff800062eefd80 x26: ffff202fd83b3000 [ 78.249098] x25: ffff800062eefd80 x24: ffff202fd83b3000 [ 78.254388] x23: ffff002fc5e50be8 x22: 0000000000000002 [ 78.259679] x21: 0000000000000001 x20: 0000000000000000 [ 78.264969] x19: ffffa688827eecc8 x18: 0000000000000000 [ 78.270259] x17: 0000000000000000 x16: 0000000000000000 [ 78.275550] x15: ffffa68881bc67a8 x14: 00000000000002e6 [ 78.280841] x13: ffffa68881bc67a8 x12: 000000000000c539 [ 78.286131] x11: d37a6f4de9bd37a7 x10: ffffa68881cccff0 [ 78.291421] x9 : ffffa68881bc6000 x8 : ffffa688819daa88 [ 78.296711] x7 : ffffa688822a0f20 x6 : ffffa688819e0000 [ 78.302002] x5 : ffff800062eef9d0 x4 : ffffa68881e707a8 [ 78.307292] x3 : 0000000000000000 x2 : 0000000000000002 [ 78.312582] x1 : 0000000000000001 x0 : ffffa688827eecc8 [ 78.317873] Call trace: [ 78.320312] 0x0 [ 78.322147] __uart_start.isra.9+0x64/0x78 [ 78.326229] uart_start+0xb8/0x1c8 [ 78.329620] uart_flush_chars+0x24/0x30 [ 78.333442] n_tty_receive_buf_common+0x7b0/0xc30 [ 78.338128] n_tty_receive_buf+0x44/0x2c8 [ 78.342122] tty_ioctl+0x348/0x11f8 [ 78.345599] ksys_ioctl+0xd8/0xf8 [ 78.348903] __arm64_sys_ioctl+0x2c/0xc8 [ 78.352812] el0_svc_common.constprop.2+0x88/0x1b0 [ 78.357583] do_el0_svc+0x44/0xd0 [ 78.360887] el0_sync_handler+0x14c/0x1d0 [ 78.364880] el0_sync+0x140/0x180 [ 78.368185] Code: bad PC value
SERIAL_PORT_DFNS is not defined on each arch, if it's not defined, serial8250_set_defaults() won't be called in serial8250_isa_init_ports(), so the p->serial_in pointer won't be initialized, and it leads a null-ptr-deref. Fix this problem by calling serial8250_set_defaults() after init uart port.
--- drivers/tty/serial/8250/8250_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_core.c +1 -1
@@ -527,6 +527,7 @@ static void __init serial8250_isa_init_p*/ up->mcr_mask = ~ALPHA_KLUDGE_MCR ; up->mcr_force =ALPHA_KLUDGE_MCR ; +serial8250_set_defaults (up); }/* chain base port ops to support Remote Supervisor Adapter */
@@ -550,7 +551,6 @@ static void __init serial8250_isa_init_p port->membase = old_serial_port[i].iomem_base; port->iotype = old_serial_port[i].io_type; port->regshift = old_serial_port[i].iomem_reg_shift; -serial8250_set_defaults (up); port->irqflags |= irqflag;if (serial8250_isa_config !=NULL )
Greg Kroah-Hartman
maintainerPATCH 71/86 serial: 8250_mtk: Fix high-speed baud rates clamping
In reply to Greg Kroah-HartmanFrom: Serge Semin <[email protected]>
commit 551e553f0d4ab623e2a6f424ab5834f9c7b5229c upstream.
Commit 7b668c064ec3 ("serial: 8250: Fix max baud limit in generic 8250 port") fixed limits of a baud rate setting for a generic 8250 port. In other words since that commit the baud rate has been permitted to be within [uartclk / 16 / UART_DIV_MAX; uartclk / 16], which is absolutely normal for a standard 8250 UART port. But there are custom 8250 ports, which provide extended baud rate limits. In particular the Mediatek 8250 port can work with baud rates up to "uartclk" speed.
Normally that and any other peculiarity is supposed to be handled in a custom set_termios() callback implemented in the vendor-specific 8250-port glue-driver. Currently that is how it's done for the most of the vendor-specific 8250 ports, but for some reason for Mediatek a solution has been spread out to both the glue-driver and to the generic 8250-port code. Due to that a bug has been introduced, which permitted the extended baud rate limit for all even for standard 8250-ports. The bug has been fixed by the commit 7b668c064ec3 ("serial: 8250: Fix max baud limit in generic 8250 port") by narrowing the baud rates limit back down to the normal bounds. Unfortunately by doing so we also broke the Mediatek-specific extended bauds feature.
A fix of the problem described above is twofold. First since we can't get back the extended baud rate limits feature to the generic set_termios() function and that method supports only a standard baud rates range, the requested baud rate must be locally stored before calling it and then restored back to the new termios structure after the generic set_termios() finished its magic business. By doing so we still use the serial8250_do_set_termios() method to set the LCR/MCR/FCR/etc. registers, while the extended baud rate setting procedure will be performed later in the custom Mediatek-specific set_termios() callback. Second since a true baud rate is now fully calculated in the custom set_termios() method we need to locally update the port timeout by calling the uart_update_timeout() function. After the fixes described above are implemented in the 8250_mtk.c driver, the Mediatek 8250-port should get back to normally working with extended baud rates.
--- drivers/tty/serial/8250/8250_mtk.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/tty/serial/8250/8250_mtk.c +18 -0
@@ -36,8 +36,21 @@ mtk8250_set_termios(struct uart_port *pounsigned long flags;unsigned int baud, quot; +/* +* Store the requested baud rate before calling the generic 8250 +* set_termios method. Standard 8250 port expects bauds to be +* no higher than (uartclk / 16) so the baud will be clamped if it +* gets out of that bound. Mediatek 8250 port supports speed +* higher than that, therefore we'll get original baud rate back +* after calling the generic set_termios method and recalculate +* the speed later in this method. +*/ + baud =tty_termios_baud_rate (termios); +serial8250_do_set_termios (port, termios, old); +tty_termios_encode_baud_rate (termios, baud, baud); +/* * Mediatek UARTs use an extra highspeed register (UART_MTK_HIGHS) *
@@ -76,6 +89,11 @@ mtk8250_set_termios(struct uart_port *po*/ spin_lock_irqsave (&port->lock, flags); +/* +* Update the per-port timeout. +*/ +uart_update_timeout (port, termios->c_cflag, baud); +/* set DLAB we have cval saved in up->lcr from the call to the core */ serial_port_out (port,UART_LCR , up->lcr |UART_LCR_DLAB );serial_dl_write (up, quot);
Greg Kroah-Hartman
maintainerPATCH 72/86 fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit 033724d6864245a11f8e04c066002e6ad22b3fd0 upstream.
syzbot is reporting general protection fault in bitfill_aligned() [1] caused by integer underflow in bit_clear_margins(). The cause of this problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.
If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres is going to shrink, vc->vc_{cols,rows} will not be updated. This allows bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will try to overrun the __iomem region and causes general protection fault.
Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to
new_cols = (cols ? cols : vc->vc_cols); new_rows = (lines ? lines : vc->vc_rows);
exception. Since cols and lines are calculated as
cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= vc->vc_font.width; rows /= vc->vc_font.height; vc_resize(vc, cols, rows);
in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0 and var.yres < vc->vc_font.height makes rows = 0. This means that
const int fd = open("/dev/fb0", O_ACCMODE);
struct fb_var_screeninfo var = { };
ioctl(fd, FBIOGET_VSCREENINFO, &var);
var.xres = var.yres = 1;
ioctl(fd, FBIOPUT_VSCREENINFO, &var);easily reproduces integer underflow bug explained above.
Of course, callers of vc_resize() are not handling vc_do_resize() failure is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore, as a band-aid workaround, this patch checks integer underflow in "struct fbcon_ops"->clear_margins call, assuming that vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not cause integer overflow.
[1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6
--- drivers/video/fbdev/core/bitblit.c | 4 ++-- drivers/video/fbdev/core/fbcon_ccw.c | 4 ++-- drivers/video/fbdev/core/fbcon_cw.c | 4 ++-- drivers/video/fbdev/core/fbcon_ud.c | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-)
drivers/video/fbdev/core/bitblit.c +2 -2
@@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_ region.color = color; region.rop =ROP_COPY ; -if (rw && !bottom_only) { +if ((int ) rw >0 && !bottom_only) { region.dx = info->var.xoffset + rs; region.dy =0 ; region.width = rw;
@@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_ info->fbops->fb_fillrect (info, ®ion); } -if (bh) { +if ((int ) bh >0 ) { region.dx = info->var.xoffset; region.dy = info->var.yoffset + bs; region.width = rs;
drivers/video/fbdev/core/fbcon_ccw.c +2 -2
@@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_ region.color = color; region.rop =ROP_COPY ; -if (rw && !bottom_only) { +if ((int ) rw >0 && !bottom_only) { region.dx =0 ; region.dy = info->var.yoffset; region.height = rw;
@@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_ info->fbops->fb_fillrect (info, ®ion); } -if (bh) { +if ((int ) bh >0 ) { region.dx = info->var.xoffset + bs; region.dy =0 ; region.height = info->var.yres_virtual;
drivers/video/fbdev/core/fbcon_cw.c +2 -2
@@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_d region.color = color; region.rop =ROP_COPY ; -if (rw && !bottom_only) { +if ((int ) rw >0 && !bottom_only) { region.dx =0 ; region.dy = info->var.yoffset + rs; region.height = rw;
@@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_d info->fbops->fb_fillrect (info, ®ion); } -if (bh) { +if ((int ) bh >0 ) { region.dx = info->var.xoffset; region.dy = info->var.yoffset; region.height = info->var.yres;
drivers/video/fbdev/core/fbcon_ud.c +2 -2
@@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_d region.color = color; region.rop =ROP_COPY ; -if (rw && !bottom_only) { +if ((int ) rw >0 && !bottom_only) { region.dy =0 ; region.dx = info->var.xoffset; region.width = rw;
@@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_d info->fbops->fb_fillrect (info, ®ion); } -if (bh) { +if ((int ) bh >0 ) { region.dy = info->var.yoffset; region.dx = info->var.xoffset; region.height = bh;
Greg Kroah-Hartman
maintainerPATCH 73/86 vt: Reject zero-sized screen buffer size.
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit ce684552a266cb1c7cc2f7e623f38567adec6653 upstream.
syzbot is reporting general protection fault in do_con_write() [1] caused by vc->vc_screenbuf == ZERO_SIZE_PTR caused by vc->vc_screenbuf_size == 0 caused by vc->vc_cols == vc->vc_rows == vc->vc_size_row == 0 caused by fb_set_var() from ioctl(FBIOPUT_VSCREENINFO) on /dev/fb0 , for gotoxy(vc, 0, 0) from reset_terminal() from vc_init() from vc_allocate()
from con_install() from tty_init_dev() from tty_open() on such console
causes vc->vc_pos == 0x10000000e due to
((unsigned long) ZERO_SIZE_PTR) + -1U * 0 + (-1U << 1).
I don't think that a console with 0 column or 0 row makes sense. And it seems that vc_do_resize() does not intend to allow resizing a console to 0 column or 0 row due to
new_cols = (cols ? cols : vc->vc_cols); new_rows = (lines ? lines : vc->vc_rows);
exception.
Theoretically, cols and rows can be any range as long as 0 < cols * rows * 2 <= KMALLOC_MAX_SIZE is satisfied (e.g. cols == 1048576 && rows == 2 is possible) because of
vc->vc_size_row = vc->vc_cols << 1; vc->vc_screenbuf_size = vc->vc_rows * vc->vc_size_row;
in visual_init() and kzalloc(vc->vc_screenbuf_size) in vc_allocate().
Since we can detect cols == 0 or rows == 0 via screenbuf_size = 0 in visual_init(), we can reject kzalloc(0). Then, vc_allocate() will return an error, and con_write() will not be called on a console with 0 column or 0 row.
We need to make sure that integer overflow in visual_init() won't happen. Since vc_do_resize() restricts cols <= 32767 and rows <= 32767, applying 1 <= cols <= 32767 and 1 <= rows <= 32767 restrictions to vc_allocate() will be practically fine.
This patch does not touch con_init(), for returning -EINVAL there does not help when we are not returning -ENOMEM.
[1] https://syzkaller.appspot.com/bug?extid=017265e8553724e514e8
--- drivers/tty/vt/vt.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
drivers/tty/vt/vt.c +18 -11
@@ -1095,10 +1095,19 @@ static const struct tty_port_operations .destruct = vc_port_destruct, }; +/* +* Change # of rows and columns (0 means unchanged/the size of fg_console) +* [this is to be used together with some user program +* like resize that changes the hardware videomode] +*/ +#define VC_MAXCOL (32767) +#define VC_MAXROW (32767) +int vc_allocate (unsigned int currcons)/* return 0 on success */ {struct vt_notifier_param param;struct vc_data *vc; +int err;WARN_CONSOLE_UNLOCKED ();
@@ -1128,6 +1137,11 @@ int vc_allocate(unsigned int currcons) /if (!*vc->vc_uni_pagedir_loc)con_set_default_unimap (vc); + err = -EINVAL ; +if (vc->vc_cols >VC_MAXCOL || vc->vc_rows >VC_MAXROW || + vc->vc_screenbuf_size >KMALLOC_MAX_SIZE || !vc->vc_screenbuf_size) + goto err_free; + err = -ENOMEM ; vc->vc_screenbuf =kzalloc (vc->vc_screenbuf_size,GFP_KERNEL );if (!vc->vc_screenbuf) goto err_free;
@@ -1146,7 +1160,7 @@ err_free:visual_deinit (vc);kfree (vc); vc_cons[currcons].d =NULL ; -return -ENOMEM ; +return err; } static inline int resize_screen(struct vc_data *vc, int width, int height,
@@ -1161,14 +1175,6 @@ static inline int resize_screen(struct vreturn err; } -/* -* Change # of rows and columns (0 means unchanged/the size of fg_console) -* [this is to be used together with some user program -* like resize that changes the hardware videomode] -*/ -#define VC_RESIZE_MAXCOL (32767) -#define VC_RESIZE_MAXROW (32767) -/** * vc_do_resize - resizing method for the tty * @tty: tty being resized
@@ -1204,7 +1210,7 @@ static int vc_do_resize(struct tty_struc user = vc->vc_resize_user; vc->vc_resize_user =0 ; -if (cols >VC_RESIZE_MAXCOL || lines >VC_RESIZE_MAXROW ) +if (cols >VC_MAXCOL || lines >VC_MAXROW )return -EINVAL ; new_cols = (cols ? cols : vc->vc_cols);
@@ -1215,7 +1221,7 @@ static int vc_do_resize(struct tty_strucif (new_cols == vc->vc_cols && new_rows == vc->vc_rows)return 0 ; -if (new_screen_size >KMALLOC_MAX_SIZE ) +if (new_screen_size >KMALLOC_MAX_SIZE || !new_screen_size)return -EINVAL ; newscreen =kzalloc (new_screen_size,GFP_USER );if (!newscreen)
@@ -3371,6 +3377,7 @@ static int __init con_init(void)INIT_WORK (&vc_cons[currcons].SAK_work, vc_SAK);tty_port_init (&vc->port);visual_init (vc, currcons,1 ); +/* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */ vc->vc_screenbuf =kzalloc (vc->vc_screenbuf_size,GFP_NOWAIT );vc_init (vc, vc->vc_rows, vc->vc_cols, currcons || !vc->vc_sw->con_save_screen);
Greg Kroah-Hartman
maintainerPATCH 74/86 Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
In reply to Greg Kroah-HartmanFrom: Fangrui Song <[email protected]>
commit ca9b31f6bb9c6aa9b4e5f0792f39a97bbffb8c51 upstream.
When CROSS_COMPILE is set (e.g. aarch64-linux-gnu-), if $(CROSS_COMPILE)elfedit is found at /usr/bin/aarch64-linux-gnu-elfedit, GCC_TOOLCHAIN_DIR will be set to /usr/bin/. --prefix= will be set to /usr/bin/ and Clang as of 11 will search for both $(prefix)aarch64-linux-gnu-$needle and $(prefix)$needle.
GCC searchs for $(prefix)aarch64-linux-gnu/$version/$needle, $(prefix)aarch64-linux-gnu/$needle and $(prefix)$needle. In practice, $(prefix)aarch64-linux-gnu/$needle rarely contains executables.
To better model how GCC's -B/--prefix takes in effect in practice, newer Clang (since
https://github.com/llvm/llvm-project/commit/3452a0d8c17f7166f479706b293caf6ac76ffd90)
only searches for $(prefix)$needle. Currently it will find /usr/bin/as instead of /usr/bin/aarch64-linux-gnu-as.
Set --prefix= to $(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE)) (/usr/bin/aarch64-linux-gnu-) so that newer Clang can find the appropriate cross compiling GNU as (when -no-integrated-as is in effect).
--- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Makefile +1 -1
@@ -485,7 +485,7 @@ ifeq ($(cc-name),clang) ifneq ($(CROSS_COMPILE),) CLANG_FLAGS += --target=$(notdir $(CROSS_COMPILE:%-=%)) GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit)) -CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR) +CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE)) GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..) endif ifneq ($(GCC_TOOLCHAIN),)
Greg Kroah-Hartman
maintainerPATCH 75/86 mm/memcg: fix refcount error while moving and swapping
In reply to Greg Kroah-HartmanFrom: Hugh Dickins <[email protected]>
commit 8d22a9351035ef2ff12ef163a1091b8b8cf1e49c upstream.
It was hard to keep a test running, moving tasks between memcgs with move_charge_at_immigrate, while swapping: mem_cgroup_id_get_many()'s refcount is discovered to be 0 (supposedly impossible), so it is then forced to REFCOUNT_SATURATED, and after thousands of warnings in quick succession, the test is at last put out of misery by being OOM killed.
This is because of the way moved_swap accounting was saved up until the task move gets completed in __mem_cgroup_clear_mc(), deferred from when mem_cgroup_move_swap_account() actually exchanged old and new ids. Concurrent activity can free up swap quicker than the task is scanned, bringing id refcount down 0 (which should only be possible when offlining).
Just skip that optimization: do that part of the accounting immediately.
--- mm/memcontrol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/memcontrol.c +2 -2
@@ -5147,7 +5147,6 @@ static void __mem_cgroup_clear_mc(void)if (!mem_cgroup_is_root (mc.to))page_counter_uncharge (&mc.to->memory, mc.moved_swap); -mem_cgroup_id_get_many (mc.to, mc.moved_swap);css_put_many (&mc.to->css, mc.moved_swap); mc.moved_swap =0 ;
@@ -5338,7 +5337,8 @@ put: /* get_mctgt_type() gets the page ent = target.ent;if (!mem_cgroup_move_swap_account (ent, mc.from, mc.to)) { mc.precharge--; -/* we fixup refcnts and charges later. */ +mem_cgroup_id_get_many (mc.to,1 ); +/* we fixup other refcnts and charges later. */ mc.moved_swap++; }break ;
Greg Kroah-Hartman
maintainerPATCH 76/86 mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
commit d38a2b7a9c939e6d7329ab92b96559ccebf7b135 upstream.
If the kmem_cache refcount is greater than one, we should not mark the root kmem_cache as dying. If we mark the root kmem_cache dying incorrectly, the non-root kmem_cache can never be destroyed. It resulted in memory leak when memcg was destroyed. We can use the following steps to reproduce.
1) Use kmem_cache_create() to create a new kmem_cache named A.
2) Coincidentally, the kmem_cache A is an alias for kmem_cache B, so the refcount of B is just increased.
3) Use kmem_cache_destroy() to destroy the kmem_cache A, just decrease the B's refcount but mark the B as dying.
4) Create a new memory cgroup and alloc memory from the kmem_cache B. It leads to create a non-root kmem_cache for allocating memory.
5) When destroy the memory cgroup created in the step 4), the non-root kmem_cache can never be destroyed.
If we repeat steps 4) and 5), this will cause a lot of memory leak. So only when refcount reach zero, we mark the root kmem_cache as dying.
--- mm/slab_common.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-)
mm/slab_common.c +28 -7
@@ -310,6 +310,14 @@ int slab_unmergeable(struct kmem_cache *if (s->refcount <0 )return 1 ; +#ifdef CONFIG_MEMCG_KMEM +/* +* Skip the dying kmem_cache. +*/ +if (s->memcg_params.dying) +return 1 ; +#endif +return 0 ; }
@@ -832,12 +840,15 @@ static int shutdown_memcg_caches(structreturn 0 ; } -static void flush_memcg_workqueue (struct kmem_cache *s) +static void memcg_set_kmem_cache_dying (struct kmem_cache *s) {mutex_lock (&slab_mutex); s->memcg_params.dying = true;mutex_unlock (&slab_mutex); +} +static void flush_memcg_workqueue (struct kmem_cache *s) +{/* * SLUB deactivates the kmem_caches through call_rcu_sched. Make * sure all registered rcu callbacks have been invoked.
@@ -858,10 +869,6 @@ static inline int shutdown_memcg_caches( {return 0 ; } - -static inline void flush_memcg_workqueue (struct kmem_cache *s) -{ -}#endif /* CONFIG_MEMCG_KMEM */ void slab_kmem_cache_release (struct kmem_cache *s)
@@ -879,8 +886,6 @@ void kmem_cache_destroy(struct kmem_cachif (unlikely (!s))return ; -flush_memcg_workqueue (s); -get_online_cpus ();get_online_mems ();
@@ -890,6 +895,22 @@ void kmem_cache_destroy(struct kmem_cachif (s->refcount) goto out_unlock; +#ifdef CONFIG_MEMCG_KMEM +memcg_set_kmem_cache_dying (s); + +mutex_unlock (&slab_mutex); + +put_online_mems (); +put_online_cpus (); + +flush_memcg_workqueue (s); + +get_online_cpus (); +get_online_mems (); + +mutex_lock (&slab_mutex); +#endif + err =shutdown_memcg_caches (s);if (!err) err =shutdown_cache (s);
Re: [External] [PATCH 4.19 76/86] mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
Quoted 62 lines · Greg Kroah-Hartman
From: Muchun Song <[email protected]>
commit
d38a2b7a9c939e6d7329ab92b96559ccebf7b135upstream.If the
kmem_cacherefcount is greater than one, we should not mark the rootkmem_cacheas dying. If we mark the rootkmem_cachedying incorrectly, the non-rootkmem_cachecan never be destroyed. It resulted in memory leak when memcg was destroyed. We can use the following steps to reproduce.1) Use
kmem_cache_create()to create a newkmem_cachenamed A.
2) Coincidentally, thekmem_cacheA is an alias forkmem_cacheB, so the refcount of B is just increased.
3) Usekmem_cache_destroy()to destroy thekmem_cacheA, just decrease the B's refcount but mark the B as dying.
4) Create a new memory cgroup and alloc memory from thekmem_cacheB. It leads to create a non-rootkmem_cachefor allocating memory.
5) When destroy the memory cgroup created in the step 4), the non-rootkmem_cachecan never be destroyed.If we repeat steps 4) and 5), this will cause a lot of memory leak. So only when refcount reach zero, we mark the root
kmem_cacheas dying.Fixes 92ee383f6daa ("mm: fix race between kmem_cache destroy, create and deactivate")Signed-off-by Muchun Song <[email protected]>Signed-off-by Andrew Morton <[email protected]>Reviewed-by Shakeel Butt <[email protected]>Acked-by Roman Gushchin <[email protected]>Cc Vlastimil Babka <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc David Rientjes <[email protected]>Cc Joonsoo Kim <[email protected]>Cc Shakeel Butt <[email protected]>Cc <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- mm/slab_common.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-)mm/slab_common.c +8
-0@@ -310,6 +310,14 @@ int slab_unmergeable(struct kmem_cache *if (s->refcount <0 )return 1 ; +#ifdef CONFIG_MEMCG_KMEM +/* +* Skip the dying kmem_cache. +*/ +if (s->memcg_params.dying) +return 1 ; +#endif +return 0 ; }
mm/slab_common.c static int shutdown_memcg_caches(struct · line 847
Quoted 9 lines
mm/slab_common.c +1
-1@@ -832,12 +840,15 @@ static int shutdown_memcg_caches(structreturn 0 ; } -static void flush_memcg_workqueue (struct kmem_cache *s) +static void memcg_set_kmem_cache_dying (struct kmem_cache *s) {mutex_lock (&slab_mutex); s->memcg_params.dying = true;mutex_unlock (&slab_mutex);
We should remove mutex_lock/unlock(&slab_mutex) here, because we already hold the slab_mutex from kmem_cache_destroy().
Quoted 42 lines
mm/slab_common.c +12
-6+} +static void flush_memcg_workqueue (struct kmem_cache *s) +{/* * SLUB deactivates the kmem_caches through call_rcu_sched. Make * sure all registered rcu callbacks have been invoked. @@ -858,10 +869,6 @@ static inline int shutdown_memcg_caches( {return 0 ; } - -static inline void flush_memcg_workqueue (struct kmem_cache *s) -{ -}#endif /* CONFIG_MEMCG_KMEM */ void slab_kmem_cache_release (struct kmem_cache *s)@@ -879,8 +886,6 @@ void kmem_cache_destroy(struct kmem_cachif (unlikely (!s))return ; -flush_memcg_workqueue (s); -get_online_cpus ();get_online_mems ();@@ -890,6 +895,22 @@ void kmem_cache_destroy(struct kmem_cachif (s->refcount) goto out_unlock; +#ifdef CONFIG_MEMCG_KMEM +memcg_set_kmem_cache_dying (s); + +mutex_unlock (&slab_mutex); + +put_online_mems (); +put_online_cpus (); + +flush_memcg_workqueue (s);
mm/slab_common.c void kmem_cache_destroy(struct kmem_cach · line 916
Quoted 10 lines
mm/slab_common.c +7
-0+ +get_online_cpus (); +get_online_mems (); + +mutex_lock (&slab_mutex); +#endif + err =shutdown_memcg_caches (s);if (!err) err =shutdown_cache (s);
--
Yours,
Muchun
Greg Kroah-Hartman
maintainerRe: [External] [PATCH 4.19 76/86] mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
Quoted 67 lines · Muchun Song
Quoted 65 lines · Greg Kroah-Hartman
From: Muchun Song <[email protected]>
commit
d38a2b7a9c939e6d7329ab92b96559ccebf7b135upstream.If the
kmem_cacherefcount is greater than one, we should not mark the rootkmem_cacheas dying. If we mark the rootkmem_cachedying incorrectly, the non-rootkmem_cachecan never be destroyed. It resulted in memory leak when memcg was destroyed. We can use the following steps to reproduce.1) Use
kmem_cache_create()to create a newkmem_cachenamed A.
2) Coincidentally, thekmem_cacheA is an alias forkmem_cacheB, so the refcount of B is just increased.
3) Usekmem_cache_destroy()to destroy thekmem_cacheA, just decrease the B's refcount but mark the B as dying.
4) Create a new memory cgroup and alloc memory from thekmem_cacheB. It leads to create a non-rootkmem_cachefor allocating memory.
5) When destroy the memory cgroup created in the step 4), the non-rootkmem_cachecan never be destroyed.If we repeat steps 4) and 5), this will cause a lot of memory leak. So only when refcount reach zero, we mark the root
kmem_cacheas dying.Fixes 92ee383f6daa ("mm: fix race between kmem_cache destroy, create and deactivate")Signed-off-by Muchun Song <[email protected]>Signed-off-by Andrew Morton <[email protected]>Reviewed-by Shakeel Butt <[email protected]>Acked-by Roman Gushchin <[email protected]>Cc Vlastimil Babka <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc David Rientjes <[email protected]>Cc Joonsoo Kim <[email protected]>Cc Shakeel Butt <[email protected]>Cc <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- mm/slab_common.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-)mm/slab_common.c +8
-0@@ -310,6 +310,14 @@ int slab_unmergeable(struct kmem_cache *if (s->refcount <0 )return 1 ; +#ifdef CONFIG_MEMCG_KMEM +/* +* Skip the dying kmem_cache. +*/ +if (s->memcg_params.dying) +return 1 ; +#endif +return 0 ; }@@ -832,12 +840,15 @@ static int shutdown_memcg_caches(structreturn 0 ; }
Quoted 9 lines
mm/slab_common.c static int shutdown_memcg_caches(struct · line 847
Quoted 6 lines
mm/slab_common.c +1
-1-static void flush_memcg_workqueue (struct kmem_cache *s) +static void memcg_set_kmem_cache_dying (struct kmem_cache *s) {mutex_lock (&slab_mutex); s->memcg_params.dying = true;mutex_unlock (&slab_mutex);We should remove mutex_lock/unlock(&slab_mutex) here, because we already hold the
slab_mutexfromkmem_cache_destroy().
Good catch. I'll go make this change and push out a -rc2.
thanks,
greg k-h
Sasha Levin
maintainerRe: [External] [PATCH 4.19 76/86] mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
In reply to Muchun SongQuoted 67 lines · Muchun Song
Quoted 65 lines · Greg Kroah-Hartman
From: Muchun Song <[email protected]>
commit
d38a2b7a9c939e6d7329ab92b96559ccebf7b135upstream.If the
kmem_cacherefcount is greater than one, we should not mark the rootkmem_cacheas dying. If we mark the rootkmem_cachedying incorrectly, the non-rootkmem_cachecan never be destroyed. It resulted in memory leak when memcg was destroyed. We can use the following steps to reproduce.1) Use
kmem_cache_create()to create a newkmem_cachenamed A.
2) Coincidentally, thekmem_cacheA is an alias forkmem_cacheB, so the refcount of B is just increased.
3) Usekmem_cache_destroy()to destroy thekmem_cacheA, just decrease the B's refcount but mark the B as dying.
4) Create a new memory cgroup and alloc memory from thekmem_cacheB. It leads to create a non-rootkmem_cachefor allocating memory.
5) When destroy the memory cgroup created in the step 4), the non-rootkmem_cachecan never be destroyed.If we repeat steps 4) and 5), this will cause a lot of memory leak. So only when refcount reach zero, we mark the root
kmem_cacheas dying.Fixes 92ee383f6daa ("mm: fix race between kmem_cache destroy, create and deactivate")Signed-off-by Muchun Song <[email protected]>Signed-off-by Andrew Morton <[email protected]>Reviewed-by Shakeel Butt <[email protected]>Acked-by Roman Gushchin <[email protected]>Cc Vlastimil Babka <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc David Rientjes <[email protected]>Cc Joonsoo Kim <[email protected]>Cc Shakeel Butt <[email protected]>Cc <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- mm/slab_common.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-)mm/slab_common.c +8
-0@@ -310,6 +310,14 @@ int slab_unmergeable(struct kmem_cache *if (s->refcount <0 )return 1 ; +#ifdef CONFIG_MEMCG_KMEM +/* +* Skip the dying kmem_cache. +*/ +if (s->memcg_params.dying) +return 1 ; +#endif +return 0 ; }@@ -832,12 +840,15 @@ static int shutdown_memcg_caches(structreturn 0 ; }
Quoted 9 lines
mm/slab_common.c static int shutdown_memcg_caches(struct · line 847
Quoted 6 lines
mm/slab_common.c +1
-1-static void flush_memcg_workqueue (struct kmem_cache *s) +static void memcg_set_kmem_cache_dying (struct kmem_cache *s) {mutex_lock (&slab_mutex); s->memcg_params.dying = true;mutex_unlock (&slab_mutex);We should remove mutex_lock/unlock(&slab_mutex) here, because we already hold the
slab_mutexfromkmem_cache_destroy().
Good catch! I backported 63b02ef7dc4e ("mm: memcg/slab: synchronize access to kmem_cache dying flag using a spinlock") instead of changing this patch.
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerRe: [External] [PATCH 4.19 76/86] mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
Quoted 78 lines · Sasha Levin
Quoted 67 lines · Muchun Song
Quoted 65 lines · Greg Kroah-Hartman
From: Muchun Song <[email protected]>
commit
d38a2b7a9c939e6d7329ab92b96559ccebf7b135upstream.If the
kmem_cacherefcount is greater than one, we should not mark the rootkmem_cacheas dying. If we mark the rootkmem_cachedying incorrectly, the non-rootkmem_cachecan never be destroyed. It resulted in memory leak when memcg was destroyed. We can use the following steps to reproduce.1) Use
kmem_cache_create()to create a newkmem_cachenamed A.
2) Coincidentally, thekmem_cacheA is an alias forkmem_cacheB, so the refcount of B is just increased.
3) Usekmem_cache_destroy()to destroy thekmem_cacheA, just decrease the B's refcount but mark the B as dying.
4) Create a new memory cgroup and alloc memory from thekmem_cacheB. It leads to create a non-rootkmem_cachefor allocating memory.
5) When destroy the memory cgroup created in the step 4), the non-rootkmem_cachecan never be destroyed.If we repeat steps 4) and 5), this will cause a lot of memory leak. So only when refcount reach zero, we mark the root
kmem_cacheas dying.Fixes 92ee383f6daa ("mm: fix race between kmem_cache destroy, create and deactivate")Signed-off-by Muchun Song <[email protected]>Signed-off-by Andrew Morton <[email protected]>Reviewed-by Shakeel Butt <[email protected]>Acked-by Roman Gushchin <[email protected]>Cc Vlastimil Babka <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc David Rientjes <[email protected]>Cc Joonsoo Kim <[email protected]>Cc Shakeel Butt <[email protected]>Cc <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- mm/slab_common.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-)mm/slab_common.c +8
-0@@ -310,6 +310,14 @@ int slab_unmergeable(struct kmem_cache *if (s->refcount <0 )return 1 ; +#ifdef CONFIG_MEMCG_KMEM +/* +* Skip the dying kmem_cache. +*/ +if (s->memcg_params.dying) +return 1 ; +#endif +return 0 ; }@@ -832,12 +840,15 @@ static int shutdown_memcg_caches(structreturn 0 ; }Quoted 9 lines
mm/slab_common.c static int shutdown_memcg_caches(struct · line 847
Quoted 6 lines
mm/slab_common.c +1
-1-static void flush_memcg_workqueue (struct kmem_cache *s) +static void memcg_set_kmem_cache_dying (struct kmem_cache *s) {mutex_lock (&slab_mutex); s->memcg_params.dying = true;mutex_unlock (&slab_mutex);We should remove mutex_lock/unlock(&slab_mutex) here, because we already hold the
slab_mutexfromkmem_cache_destroy().
Quoted 3 lines
Good catch! I backported
63b02ef7dc4e("mm: memcg/slab: synchronize access tokmem_cachedying flag using a spinlock") instead of changing this patch.
Ah, much better, let me roll my change back and then push out -rc3 with this all fixed up like this.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 77/86 io-mapping: indicate mapping failure
In reply to Greg Kroah-HartmanFrom: Michael J. Ruhl <[email protected]>
commit e0b3e0b1a04367fc15c07f44e78361545b55357c upstream.
The !ATOMIC_IOMAP version of io_maping_init_wc will always return success, even when the ioremap fails.
Since the ATOMIC_IOMAP version returns NULL when the init fails, and callers check for a NULL return on error this is unexpected.
During a device probe, where the ioremap failed, a crash can look like this:
BUG: unable to handle page fault for address: 0000000000210000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] PREEMPT SMP
CPU: 0 PID: 177 Comm:
RIP: 0010:fill_page_dma [i915]
gen8_ppgtt_create [i915]
i915_ppgtt_create [i915]
intel_gt_init [i915]
i915_gem_init [i915]
i915_driver_probe [i915]
pci_device_probe
really_probe
driver_probe_deviceThe remap failure occurred much earlier in the probe. If it had been propagated, the driver would have exited with an error.
Return NULL on ioremap failure.
[[email protected]: detect ioremap_wc() errors earlier]
--- include/linux/io-mapping.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/io-mapping.h +4 -1
@@ -120,9 +120,12 @@ io_mapping_init_wc(struct io_mapping *io resource_size_t base, unsigned long size) { + iomap->iomem =ioremap_wc (base, size); +if (!iomap->iomem) +return NULL ; + iomap->base = base; iomap->size = size; - iomap->iomem =ioremap_wc (base, size);#if defined(pgprot_noncached_wc)/* archs can't agree on a name ... */ iomap->prot =pgprot_noncached_wc (PAGE_KERNEL );#elif defined(pgprot_writecombine)
Greg Kroah-Hartman
maintainerPATCH 78/86 drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
In reply to Greg Kroah-HartmanFrom: Paweł Gronowski <[email protected]>
commit 38e0c89a19fd13f28d2b4721035160a3e66e270b upstream.
NULL dereference occurs when string that is not ended with space or newline is written to some dpm sysfs interface (for example pp_dpm_sclk). This happens because strsep replaces the tmp with NULL if the delimiter is not present in string, which is then dereferenced by tmp[0].
Reproduction example:
sudo sh -c 'echo -n 1 > /sys/class/drm/card0/device/pp_dpm_sclk'
--- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +3 -6
@@ -529,8 +529,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltwhile (isspace (*++tmp_str)); -while (tmp_str[0 ]) { - sub_str =strsep (&tmp_str, delimiter); +while ((sub_str =strsep (&tmp_str, delimiter)) !=NULL ) { ret =kstrtol (sub_str,0 , ¶meter[parameter_size]);if (ret)return -EINVAL ;
@@ -630,8 +629,7 @@ static ssize_t amdgpu_read_mask(const chmemcpy (buf_cpy, buf, bytes); buf_cpy[bytes] ='\0' ; tmp = buf_cpy; -while (tmp[0 ]) { - sub_str =strsep (&tmp, delimiter); +while ((sub_str =strsep (&tmp, delimiter)) !=NULL ) {if (strlen (sub_str)) { ret =kstrtol (sub_str,0 , &level);if (ret)
@@ -882,8 +880,7 @@ static ssize_t amdgpu_set_pp_power_profi i++;memcpy (buf_cpy, buf, count-i); tmp_str = buf_cpy; -while (tmp_str[0 ]) { - sub_str =strsep (&tmp_str, delimiter); +while ((sub_str =strsep (&tmp_str, delimiter)) !=NULL ) { ret =kstrtol (sub_str,0 , ¶meter[parameter_size]);if (ret) { count = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 79/86 drm/amd/powerplay: fix a crash when overclocking Vega M
In reply to Greg Kroah-HartmanFrom: Qiu Wenbo <[email protected]>
commit 88bb16ad998a0395fe4b346b7d3f621aaa0a2324 upstream.
Avoid kernel crash when vddci_control is SMU7_VOLTAGE_CONTROL_NONE and vddci_voltage_table is empty. It has been tested on Intel Hades Canyon (i7-8809G).
--- drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c +6 -4
@@ -643,9 +643,6 @@ static int vegam_get_dependency_volt_by_/* sclk is bigger than max sclk in the dependence table */ *voltage |= (dep_table->entries[i -1 ].vddc *VOLTAGE_SCALE ) <<VDDC_SHIFT ; - vddci =phm_find_closest_vddci (&(data->vddci_voltage_table), - (dep_table->entries[i -1 ].vddc - - (uint16_t )VDDC_VDDCI_DELTA ));if (SMU7_VOLTAGE_CONTROL_NONE == data->vddci_control) *voltage |= (data->vbios_boot_state.vddci_bootup_value *
@@ -653,8 +650,13 @@ static int vegam_get_dependency_volt_by_else if (dep_table->entries[i -1 ].vddci) *voltage |= (dep_table->entries[i -1 ].vddci *VOLTAGE_SCALE ) <<VDDC_SHIFT ; -else +else { + vddci =phm_find_closest_vddci (&(data->vddci_voltage_table), + (dep_table->entries[i -1 ].vddc - + (uint16_t )VDDC_VDDCI_DELTA )); + *voltage |= (vddci *VOLTAGE_SCALE ) <<VDDCI_SHIFT ; + }if (SMU7_VOLTAGE_CONTROL_NONE == data->mvdd_control) *mvdd = data->vbios_boot_state.mvdd_bootup_value *VOLTAGE_SCALE ;
Greg Kroah-Hartman
maintainerPATCH 80/86 parisc: Add atomic64_set_release() define to avoid CPU soft lockups
In reply to Greg Kroah-HartmanFrom: John David Anglin <[email protected]>
commit be6577af0cef934ccb036445314072e8cb9217b9 upstream.
Stalls are quite frequent with recent kernels. I enabled CONFIG_SOFTLOCKUP_DETECTOR and I caught the following stall:
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [cc1:22803] CPU: 0 PID: 22803 Comm: cc1 Not tainted 5.6.17+ #3 Hardware name: 9000/800/rp3440 IAOQ[0]: d_alloc_parallel+0x384/0x688 IAOQ[1]: d_alloc_parallel+0x388/0x688 RP(r2): d_alloc_parallel+0x134/0x688 Backtrace: [<000000004036974c>] __lookup_slow+0xa4/0x200 [<0000000040369fc8>] walk_component+0x288/0x458 [<000000004036a9a0>] path_lookupat+0x88/0x198 [<000000004036e748>] filename_lookup+0xa0/0x168 [<000000004036e95c>] user_path_at_empty+0x64/0x80 [<000000004035d93c>] vfs_statx+0x104/0x158 [<000000004035dfcc>] __do_sys_lstat64+0x44/0x80 [<000000004035e5a0>] sys_lstat64+0x20/0x38 [<0000000040180054>] syscall_exit+0x0/0x14
The code was stuck in this loop in d_alloc_parallel:
4037d414: 0e 00 10 dc ldd 0(r16),ret0
4037d418: c7 fc 5f ed bb,< ret0,1f,4037d414 <d_alloc_parallel+0x384>
4037d41c: 08 00 02 40 nopThis is the inner loop of bit_spin_lock which is called by hlist_bl_unlock in d_alloc_parallel:
static inline void bit_spin_lock(int bitnum, unsigned long *addr) {
/*
* Assuming the lock is uncontended, this never enters
* the body of the outer loop. If it is contended, then
* within the inner loop a non-atomic test is used to
* busywait with less bus contention for a good time to
* attempt to acquire the lock bit.
*/
preempt_disable();
#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
while (unlikely(test_and_set_bit_lock(bitnum, addr))) {
preempt_enable();
do {
cpu_relax();
} while (test_bit(bitnum, addr));
preempt_disable();
}
#endif
__acquire(bitlock);
}After consideration, I realized that we must be losing bit unlocks. Then, I noticed that we missed defining atomic64_set_release(). Adding this define fixes the stalls in bit operations.
--- arch/parisc/include/asm/atomic.h | 2 ++ 1 file changed, 2 insertions(+)
arch/parisc/include/asm/atomic.h +2 -0
@@ -212,6 +212,8 @@ atomic64_set(atomic64_t *v, s64 i)_atomic_spin_unlock_irqrestore (v, flags); } +#define atomic64_set_release (v, i) atomic64_set((v), (i)) +static __inline__s64 atomic64_read (const atomic64_t *v) {
Greg Kroah-Hartman
maintainerPATCH 81/86 x86, vmlinux.lds: Page-align end of ..page_aligned sections
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
commit de2b41be8fcccb2f5b6c480d35df590476344201 upstream.
On x86-32 the idt_table with 256 entries needs only 2048 bytes. It is page-aligned, but the end of the .bss..page_aligned section is not guaranteed to be page-aligned.
As a result, objects from other .bss sections may end up on the same 4k page as the idt_table, and will accidentially get mapped read-only during boot, causing unexpected page-faults when the kernel writes to them.
This could be worked around by making the objects in the page aligned sections page sized, but that's wrong.
Explicit sections which store only page aligned objects have an implicit guarantee that the object is alone in the page in which it is placed. That works for all objects except the last one. That's inconsistent.
Enforcing page sized objects for these sections would wreckage memory sanitizers, because the object becomes artificially larger than it should be and out of bound access becomes legit.
Align the end of the .bss..page_aligned and .data..page_aligned section on page-size so all objects places in these sections are guaranteed to have their own page.
[ tglx: Amended changelog ]
--- arch/x86/kernel/vmlinux.lds.S | 1 + include/asm-generic/vmlinux.lds.h | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)
arch/x86/kernel/vmlinux.lds.S +1 -0
@@ -372,6 +372,7 @@ SECTIONS .bss : AT(ADDR(.bss) - LOAD_OFFSET) { __bss_start = .; *(.bss..page_aligned) + . = ALIGN(PAGE_SIZE); *(BSS_MAIN) BSS_DECRYPTED . = ALIGN(PAGE_SIZE);
include/asm-generic/vmlinux.lds.h +4 -1
@@ -279,7 +279,8 @@#define PAGE_ALIGNED_DATA (page_align) \ . = ALIGN(page_align); \ - *(.data..page_aligned) + *(.data..page_aligned) \ + . = ALIGN(page_align);#define READ_MOSTLY_DATA (align) \ . = ALIGN(align); \
@@ -650,7 +651,9 @@ . = ALIGN(bss_align); \ .bss : AT(ADDR(.bss) - LOAD_OFFSET) { \BSS_FIRST_SECTIONS \ + . = ALIGN(PAGE_SIZE); \ *(.bss..page_aligned) \ + . = ALIGN(PAGE_SIZE); \ *(.dynbss) \ *(BSS_MAIN ) \ *(COMMON ) \
Greg Kroah-Hartman
maintainerPATCH 82/86 ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 85ca6b17e2bb96b19caac3b02c003d670b66de96 upstream.
The Lenovo Miix 2 10 has a keyboard dock with extra speakers in the dock. Rather then the ACL5672's GPIO1 pin being used as IRQ to the CPU, it is actually used to enable the amplifier for these speakers
(the IRQ to the CPU comes directly from the jack-detect switch).
Add a quirk for having an ext speaker-amplifier enable pin on GPIO1 and replace the Lenovo Miix 2 10's dmi_system_id table entry's wrong GPIO_DEV quirk (which needs to be renamed to GPIO1_IS_IRQ) with the new RT5670_GPIO1_IS_EXT_SPK_EN quirk, so that we enable the external speaker-amplifier as necessary.
Also update the ident field for the dmi_system_id table entry, the Miix models are not Thinkpads.
--- include/sound/rt5670.h | 1 sound/soc/codecs/rt5670.c | 71 ++++++++++++++++++++++++++++++++++++---------- 2 files changed, 57 insertions(+), 15 deletions(-)
include/sound/rt5670.h +1 -0
@@ -15,6 +15,7 @@ struct rt5670_platform_data {int jd_mode;bool in2_diff;bool dev_gpio; +bool gpio1_is_ext_spk_en;bool dmic_en;unsigned int dmic1_data_pin;
sound/soc/codecs/rt5670.c +56 -15
113 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 83/86 ASoC: qcom: Drop HAS_DMA dependency to fix link failure
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit b6aa06de7757667bac88997a8807b143b8436035 upstream.
When building on allyesconfig kernel for a NO_DMA=y platform (e.g. Sun-3), CONFIG_SND_SOC_QCOM_COMMON=y, but CONFIG_SND_SOC_QDSP6_AFE=n, leading to a link failure:
sound/soc/qcom/common.o: In function `qcom_snd_parse_of':
common.c:(.text+0x2e2): undefined reference to `q6afe_is_rx_port'
While SND_SOC_QDSP6 depends on HAS_DMA, SND_SOC_MSM8996 and SND_SOC_SDM845 don't, so the following warning is seen:
WARNING: unmet direct dependencies detected for SND_SOC_QDSP6
Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && QCOM_APR [=y] && HAS_DMA [=n]
Selected by [y]:
- SND_SOC_MSM8996 [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && QCOM_APR [=y]
- SND_SOC_SDM845 [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && QCOM_APR [=y] && CROS_EC [=y] && I2C [=y] && SOUNDWIRE [=y]
Until recently, this warning was harmless (from a compile-testing point-of-view), but the new user of q6afe_is_rx_port() turned this into a hard failure.
As the QDSP6 driver itself builds fine if NO_DMA=y, and it depends on QCOM_APR (which in turns depends on ARCH_QCOM || COMPILE_TEST), it is safe to increase compile testing coverage. Hence fix the link failure by dropping the HAS_DMA dependency of SND_SOC_QDSP6.
--- sound/soc/qcom/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/qcom/Kconfig +1 -1
@@ -70,7 +70,7 @@ config SND_SOC_QDSP6_ASM_DAI config SND_SOC_QDSP6 tristate "SoC ALSA audio driver for QDSP6" - depends on QCOM_APR && HAS_DMA + depends on QCOM_APR select SND_SOC_QDSP6_COMMON select SND_SOC_QDSP6_CORE select SND_SOC_QDSP6_AFE
Greg Kroah-Hartman
maintainerPATCH 84/86 dm integrity: fix integrity recalculation that is improperly skipped
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 5df96f2b9f58a5d2dc1f30fe7de75e197f2c25f2 upstream.
Commit adc0daad366b62ca1bce3e2958a40b0b71a8b8b3 ("dm: report suspended device during destroy") broke integrity recalculation.
The problem is dm_suspended() returns true not only during suspend, but also during resume. So this race condition could occur:
1. dm_integrity_resume calls queue_work(ic->recalc_wq, &ic->recalc_work)
2. integrity_recalc (&ic->recalc_work) preempts the current thread
3. integrity_recalc calls if (unlikely(dm_suspended(ic->ti))) goto unlock_ret;
4. integrity_recalc exits and no recalculating is done.
To fix this race condition, add a function dm_post_suspending that is only true during the postsuspend phase and use it instead of dm_suspended().
--- drivers/md/dm-integrity.c | 4 ++-- drivers/md/dm.c | 17 +++++++++++++++++ include/linux/device-mapper.h | 1 + 3 files changed, 20 insertions(+), 2 deletions(-)
drivers/md/dm-integrity.c +2 -2
@@ -2068,7 +2068,7 @@ static void integrity_writer(struct workunsigned prev_free_sectors;/* the following test is not needed, but it tests the replay code */ -if (unlikely (dm_suspended (ic->ti)) && !ic->meta_dev) +if (unlikely (dm_post_suspending (ic->ti)) && !ic->meta_dev)return ;spin_lock_irq (&ic->endio_wait.lock);
@@ -2127,7 +2127,7 @@ static void integrity_recalc(struct work next_chunk: -if (unlikely (dm_suspended (ic->ti))) +if (unlikely (dm_post_suspending (ic->ti))) goto unlock_ret; range.logical_sector =le64_to_cpu (ic->sb->recalc_sector);
drivers/md/dm.c +17 -0
@@ -141,6 +141,7 @@ EXPORT_SYMBOL_GPL(dm_bio_get_target_bio_#define DMF_NOFLUSH_SUSPENDING 5#define DMF_DEFERRED_REMOVE 6#define DMF_SUSPENDED_INTERNALLY 7 +#define DMF_POST_SUSPENDING 8#define DM_NUMA_NODE NUMA_NO_NODEstatic int dm_numa_node =DM_NUMA_NODE ;
@@ -2355,6 +2356,7 @@ static void __dm_destroy(struct mapped_dif (!dm_suspended_md (md)) {dm_table_presuspend_targets (map);set_bit (DMF_SUSPENDED , &md->flags); +set_bit (DMF_POST_SUSPENDING , &md->flags);dm_table_postsuspend_targets (map); }/* dm_put_live_table must be before msleep, otherwise deadlock is possible */
@@ -2680,7 +2682,9 @@ retry:if (r) goto out_unlock; +set_bit (DMF_POST_SUSPENDING , &md->flags);dm_table_postsuspend_targets (map); +clear_bit (DMF_POST_SUSPENDING , &md->flags); out_unlock:mutex_unlock (&md->suspend_lock);
@@ -2777,7 +2781,9 @@ static void __dm_internal_suspend(struct (void )__dm_suspend (md, map, suspend_flags,TASK_UNINTERRUPTIBLE ,DMF_SUSPENDED_INTERNALLY ); +set_bit (DMF_POST_SUSPENDING , &md->flags);dm_table_postsuspend_targets (map); +clear_bit (DMF_POST_SUSPENDING , &md->flags); }static void __dm_internal_resume (struct mapped_device *md)
@@ -2938,6 +2944,11 @@ int dm_suspended_md(struct mapped_devicereturn test_bit (DMF_SUSPENDED , &md->flags); } +static int dm_post_suspending_md (struct mapped_device *md) +{ +return test_bit (DMF_POST_SUSPENDING , &md->flags); +} +int dm_suspended_internally_md (struct mapped_device *md) {return test_bit (DMF_SUSPENDED_INTERNALLY , &md->flags);
@@ -2954,6 +2965,12 @@ int dm_suspended(struct dm_target *ti) }EXPORT_SYMBOL_GPL (dm_suspended); +int dm_post_suspending (struct dm_target *ti) +{ +return dm_post_suspending_md (dm_table_get_md (ti->table)); +} +EXPORT_SYMBOL_GPL (dm_post_suspending); +int dm_noflush_suspending (struct dm_target *ti) {return __noflush_suspending (dm_table_get_md (ti->table));
include/linux/device-mapper.h +1 -0
@@ -419,6 +419,7 @@ const char *dm_device_name(struct mappedint dm_copy_name_and_uuid (struct mapped_device *md,char *name,char *uuid);struct gendisk *dm_disk (struct mapped_device *md);int dm_suspended (struct dm_target *ti); +int dm_post_suspending (struct dm_target *ti);int dm_noflush_suspending (struct dm_target *ti);void dm_accept_partial_bio (struct bio *bio,unsigned n_sectors); void dm_remap_zone_report(struct dm_target *ti, struct bio *bio,
Re: [PATCH 4.19 84/86] dm integrity: fix integrity recalculation that is improperly skipped
Hi!
Quoted 14 lines
From: Mikulas Patocka <[email protected]>
commit
5df96f2b9f58a5d2dc1f30fe7de75e197f2c25f2upstream.Commit
adc0daad366b62ca1bce3e2958a40b0b71a8b8b3("dm: report suspended device during destroy") broke integrity recalculation.The problem is
dm_suspended()returns true not only during suspend, but also during resume. So this race condition could occur:
1.dm_integrity_resumecallsqueue_work(ic->recalc_wq, &ic->recalc_work)
2.integrity_recalc(&ic->recalc_work) preempts the current thread
3.integrity_recalccalls if (unlikely(dm_suspended(ic->ti))) gotounlock_ret;
4.integrity_recalcexits and no recalculating is done.
Quoted 5 lines
To fix this race condition, add a function
dm_post_suspendingthat is only true during the postsuspend phase and use it instead ofdm_suspended().Signed-off-by Mikulas Patocka <mpatocka redhat com>
Something is wrong with signoff here...
Best regards,
Pavel
Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Sasha Levin
maintainerRe: [PATCH 4.19 84/86] dm integrity: fix integrity recalculation that is improperly skipped
Quoted 16 lines · Pavel Machek
Hi!
Quoted 14 lines
From: Mikulas Patocka <[email protected]>
commit
5df96f2b9f58a5d2dc1f30fe7de75e197f2c25f2upstream.Commit
adc0daad366b62ca1bce3e2958a40b0b71a8b8b3("dm: report suspended device during destroy") broke integrity recalculation.The problem is
dm_suspended()returns true not only during suspend, but also during resume. So this race condition could occur:
1.dm_integrity_resumecallsqueue_work(ic->recalc_wq, &ic->recalc_work)
2.integrity_recalc(&ic->recalc_work) preempts the current thread
3.integrity_recalccalls if (unlikely(dm_suspended(ic->ti))) gotounlock_ret;
4.integrity_recalcexits and no recalculating is done.
Quoted 7 lines
Quoted 5 lines
To fix this race condition, add a function
dm_post_suspendingthat is only true during the postsuspend phase and use it instead ofdm_suspended().Signed-off-by Mikulas Patocka <mpatocka redhat com>Something is wrong with signoff here...
Heh, and the same thing happened with the stable tag:
But given that this is the way the upstream commit looks like we can't do much here.
Signature · 2 lines
Thanks, Sasha
Re: [PATCH 4.19 84/86] dm integrity: fix integrity recalculation that is improperly skipped
Quoted 23 lines · Sasha Levin
Quoted 22 lines · Pavel Machek
Hi!
Quoted 19 lines
From: Mikulas Patocka <[email protected]>
commit
5df96f2b9f58a5d2dc1f30fe7de75e197f2c25f2upstream.Commit
adc0daad366b62ca1bce3e2958a40b0b71a8b8b3("dm: report suspended device during destroy") broke integrity recalculation.The problem is
dm_suspended()returns true not only during suspend, but also during resume. So this race condition could occur:
1.dm_integrity_resumecallsqueue_work(ic->recalc_wq, &ic->recalc_work)
2.integrity_recalc(&ic->recalc_work) preempts the current thread
3.integrity_recalccalls if (unlikely(dm_suspended(ic->ti))) gotounlock_ret;
4.integrity_recalcexits and no recalculating is done.To fix this race condition, add a function
dm_post_suspendingthat is only true during the postsuspend phase and use it instead ofdm_suspended().Signed-off-by Mikulas Patocka <mpatocka redhat com>
Quoted 8 lines
Quoted 1 line
Something is wrong with signoff here...
Heh, and the same thing happened with the stable tag:
Cc stable vger kernel org # v4.18+But given that this is the way the upstream commit looks like we can't do much here.
Hmm, not sure what happened on the Signed-off-by and Cc for commit 5df96f2b9f. Sorry about this!
Greg Kroah-Hartman
maintainerPATCH 85/86 ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.
In ath9k_hif_usb_rx_cb interface number is assumed to be 0. usb_ifnum_to_if(urb->dev, 0)
But it isn't always true.
The case reported by syzbot:
https://lore.kernel.org/linux-usb/[email protected]
usb 2-1: new high-speed USB device number 2 using dummy_hcd usb 2-1: config 1 has an invalid interface number: 2 but max is 0 usb 2-1: config 1 has no interface number 0
usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
general protection fault, probably for non-canonical address 0xdffffc0000000015: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc5-syzkaller #0
Call Trace
__usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716 dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966 call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786 __do_softirq+0x21e/0x950 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x178/0x1a0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x141/0x540 arch/x86/kernel/apic/apic.c:1146 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 48 +++++++++++++++++++++++-------- drivers/net/wireless/ath/ath9k/hif_usb.h | 5 +++ 2 files changed, 42 insertions(+), 11 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +37 -11
@@ -643,9 +643,9 @@ err:static void ath9k_hif_usb_rx_cb (struct urb *urb) { -struct sk_buff *skb = (struct sk_buff *) urb->context; -struct hif_device_usb *hif_dev = -usb_get_intfdata (usb_ifnum_to_if (urb->dev,0 )); +struct rx_buf *rx_buf = (struct rx_buf *)urb->context; +struct hif_device_usb *hif_dev = rx_buf->hif_dev; +struct sk_buff *skb = rx_buf->skb;int ret;if (!skb)
@@ -685,14 +685,15 @@ resubmit:return ; free:kfree_skb (skb); +kfree (rx_buf); }static void ath9k_hif_usb_reg_in_cb (struct urb *urb) { -struct sk_buff *skb = (struct sk_buff *) urb->context; +struct rx_buf *rx_buf = (struct rx_buf *)urb->context; +struct hif_device_usb *hif_dev = rx_buf->hif_dev; +struct sk_buff *skb = rx_buf->skb;struct sk_buff *nskb; -struct hif_device_usb *hif_dev = -usb_get_intfdata (usb_ifnum_to_if (urb->dev,0 ));int ret;if (!skb)
@@ -750,6 +751,7 @@ resubmit:return ; free:kfree_skb (skb); +kfree (rx_buf); urb->context =NULL ; }
@@ -795,7 +797,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(sinit_usb_anchor (&hif_dev->mgmt_submitted);for (i =0 ; i <MAX_TX_URB_NUM ; i++) { - tx_buf =kzalloc (sizeof (struct tx_buf ),GFP_KERNEL ); + tx_buf =kzalloc (sizeof (*tx_buf),GFP_KERNEL );if (!tx_buf) goto err;
@@ -832,8 +834,9 @@ static void ath9k_hif_usb_dealloc_rx_urbstatic int ath9k_hif_usb_alloc_rx_urbs (struct hif_device_usb *hif_dev) { -struct urb *urb =NULL ; +struct rx_buf *rx_buf =NULL ;struct sk_buff *skb =NULL ; +struct urb *urb =NULL ;int i, ret;init_usb_anchor (&hif_dev->rx_submitted);
@@ -841,6 +844,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(sfor (i =0 ; i <MAX_RX_URB_NUM ; i++) { + rx_buf =kzalloc (sizeof (*rx_buf),GFP_KERNEL ); +if (!rx_buf) { + ret = -ENOMEM ; + goto err_rxb; + } +/* Allocate URB */ urb =usb_alloc_urb (0 ,GFP_KERNEL );if (urb ==NULL ) {
@@ -855,11 +864,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(s goto err_skb; } + rx_buf->hif_dev = hif_dev; + rx_buf->skb = skb; +usb_fill_bulk_urb (urb, hif_dev->udev,usb_rcvbulkpipe (hif_dev->udev,USB_WLAN_RX_PIPE ), skb->data,MAX_RX_BUF_SIZE , - ath9k_hif_usb_rx_cb, skb); + ath9k_hif_usb_rx_cb, rx_buf);/* Anchor URB */ usb_anchor_urb (urb, &hif_dev->rx_submitted);
@@ -885,6 +897,8 @@ err_submit: err_skb:usb_free_urb (urb); err_urb: +kfree (rx_buf); +err_rxb:ath9k_hif_usb_dealloc_rx_urbs (hif_dev);return ret; }
@@ -896,14 +910,21 @@ static void ath9k_hif_usb_dealloc_reg_instatic int ath9k_hif_usb_alloc_reg_in_urbs (struct hif_device_usb *hif_dev) { -struct urb *urb =NULL ; +struct rx_buf *rx_buf =NULL ;struct sk_buff *skb =NULL ; +struct urb *urb =NULL ;int i, ret;init_usb_anchor (&hif_dev->reg_in_submitted);for (i =0 ; i <MAX_REG_IN_URB_NUM ; i++) { + rx_buf =kzalloc (sizeof (*rx_buf),GFP_KERNEL ); +if (!rx_buf) { + ret = -ENOMEM ; + goto err_rxb; + } +/* Allocate URB */ urb =usb_alloc_urb (0 ,GFP_KERNEL );if (urb ==NULL ) {
@@ -918,11 +939,14 @@ static int ath9k_hif_usb_alloc_reg_in_ur goto err_skb; } + rx_buf->hif_dev = hif_dev; + rx_buf->skb = skb; +usb_fill_int_urb (urb, hif_dev->udev,usb_rcvintpipe (hif_dev->udev,USB_REG_IN_PIPE ), skb->data,MAX_REG_IN_BUF_SIZE , - ath9k_hif_usb_reg_in_cb, skb,1 ); + ath9k_hif_usb_reg_in_cb, rx_buf,1 );/* Anchor URB */ usb_anchor_urb (urb, &hif_dev->reg_in_submitted);
@@ -948,6 +972,8 @@ err_submit: err_skb:usb_free_urb (urb); err_urb: +kfree (rx_buf); +err_rxb:ath9k_hif_usb_dealloc_reg_in_urbs (hif_dev);return ret; }
drivers/net/wireless/ath/ath9k/hif_usb.h +5 -0
@@ -86,6 +86,11 @@ struct tx_buf {struct list_head list; }; +struct rx_buf { +struct sk_buff *skb; +struct hif_device_usb *hif_dev; +}; +#define HIF_USB_TX_STOP BIT(0)#define HIF_USB_TX_FLUSH BIT(1)
Greg Kroah-Hartman
maintainerPATCH 86/86 ath9k: Fix regression with Atheros 9271
In reply to Greg Kroah-HartmanFrom: Mark O'Donovan <[email protected]>
commit 92f53e2fda8bb9a559ad61d57bfb397ce67ed0ab upstream.
This fix allows ath9k_htc modules to connect to WLAN once again.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +3 -1
@@ -733,11 +733,13 @@ static void ath9k_hif_usb_reg_in_cb(strureturn ; } + rx_buf->skb = nskb; +usb_fill_int_urb (urb, hif_dev->udev,usb_rcvintpipe (hif_dev->udev,USB_REG_IN_PIPE ), nskb->data,MAX_REG_IN_BUF_SIZE , - ath9k_hif_usb_reg_in_cb, nskb,1 ); + ath9k_hif_usb_reg_in_cb, rx_buf,1 ); } resubmit:
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.135 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.135-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.19:
11 builds: 11 pass, 0 fail
22 boots: 22 pass, 0 fail
38 tests: 38 pass, 0 failLinux version: 4.19.135-rc1-ge61bf6def734
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Thierry
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.135 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.135-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.135 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.135-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.
Quoted 6 lines
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
<trim>
Results from Linaro’s test farm.
Regressions detected on x86_64.
Boot failures on x86_64 devices running 4.19.135-rc1 kernel.
Summary
------------------------------------------------------------------------
kernel: 4.19.135-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: e11702667f84474535b156dbb194deffa0a6cdb4
git describe: v4.19.134-87-ge11702667f84
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.134-87-ge11702667f84
Quoted 2 lines
Muchun Song <[email protected]>
mm: memcg/slab: fix memory leak at non-rootkmem_cachedestroy
[ 2.510884] ============================================
[ 2.510884] WARNING: possible recursive locking detected
[ 2.510884] 4.19.135-rc1 #1 Not tainted
[ 2.510884] --------------------------------------------
[ 2.510884] swapper/0/1 is trying to acquire lock:
[ 2.510884] 0000000088703397 (slab_mutex){+.+.}, at:
kmem_cache_destroy+0x9a/0x2b0
[ 2.510884]
[ 2.510884] but task is already holding lock:
[ 2.510884] 0000000088703397 (slab_mutex){+.+.}, at:
kmem_cache_destroy+0x45/0x2b0
[ 2.510884]
[ 2.510884] other info that might help us debug this:
[ 2.510884] Possible unsafe locking scenario:
[ 2.510884]
[ 2.510884] CPU0
[ 2.510884] ----
[ 2.510884] lock(slab_mutex);
[ 2.510884] lock(slab_mutex);
[ 2.510884]
[ 2.510884] *** DEADLOCK ***
[ 2.510884]
[ 2.510884] May be due to missing lock nesting notation
[ 2.510884]
[ 2.510884] 3 locks held by swapper/0/1:
[ 2.510884] #0: 000000008702dddc (cpu_hotplug_lock.rw_sem){++++},
at: kmem_cache_destroy+0x32/0x2b0
[ 2.510884] #1: 0000000050103e4d (mem_hotplug_lock.rw_sem){++++},
at: kmem_cache_destroy+0x37/0x2b0
[ 2.510884] #2: 0000000088703397 (slab_mutex){+.+.}, at:
kmem_cache_destroy+0x45/0x2b0
[ 2.510884]
[ 2.510884] stack backtrace:
[ 2.510884] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.19.135-rc1 #1
[ 2.510884] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS
2.0b 07/27/2017
[ 2.510884] Call Trace:
[ 2.510884] dump_stack+0x7a/0xa5
[ 2.510884] __lock_acquire+0x6f1/0x1380
[ 2.510884] ? ret_from_fork+0x3a/0x50
[ 2.510884] lock_acquire+0x95/0x190
[ 2.510884] ? lock_acquire+0x95/0x190
[ 2.510884] ? kmem_cache_destroy+0x9a/0x2b0
[ 2.510884] ? kmem_cache_destroy+0x9a/0x2b0
[ 2.510884] __mutex_lock+0x83/0x990
[ 2.510884] ? kmem_cache_destroy+0x9a/0x2b0
[ 2.510884] ? kmem_cache_destroy+0x60/0x2b0
[ 2.510884] ? set_debug_rodata+0x17/0x17
[ 2.510884] ? set_debug_rodata+0x17/0x17
[ 2.510884] mutex_lock_nested+0x1b/0x20
[ 2.510884] ? get_online_mems+0x5f/0x90
[ 2.510884] ? mutex_lock_nested+0x1b/0x20
[ 2.510884] kmem_cache_destroy+0x9a/0x2b0
[ 2.510884] ? set_debug_rodata+0x17/0x17
[ 2.510884] intel_iommu_init+0x11c6/0x1326
[ 2.510884] ? kfree+0xc4/0x240
[ 2.510884] ? lockdep_hardirqs_on+0xef/0x180
[ 2.510884] ? kfree+0xc4/0x240
[ 2.510884] ? trace_hardirqs_on+0x4c/0x100
[ 2.510884] ? unpack_to_rootfs+0x272/0x29a
[ 2.510884] ? e820__memblock_setup+0x64/0x64
[ 2.510884] ? set_debug_rodata+0x17/0x17
[ 2.510884] pci_iommu_init+0x1a/0x44
[ 2.510884] ? e820__memblock_setup+0x64/0x64
[ 2.510884] ? pci_iommu_init+0x1a/0x44
[ 2.510884] do_one_initcall+0x61/0x2b4
[ 2.510884] ? set_debug_rodata+0xa/0x17
[ 2.510884] ? rcu_read_lock_sched_held+0x81/0x90
[ 2.510884] kernel_init_freeable+0x1d8/0x270
[ 2.510884] ? rest_init+0x190/0x190
[ 2.510884] kernel_init+0xe/0x110
[ 2.510884] ret_from_fork+0x3a/0x50Full test log:
https://pastebin.com/PWkk0YaF
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Thanks for your test. I have reviewed the patch:
[PATCH 4.19 76/86] mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
There is a backport problem and I have pointed out the problem in that email.
Quoted 118 lines · Naresh Kamboju
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.135 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.135-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.Quoted 6 lines
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:<trim>
Results from Linaro’s test farm.
Regressions detected onx86_64.Boot failures on
x86_64devices running 4.19.135-rc1 kernel.Summary
------------------------------------------------------------------------kernel: 4.19.135-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit:e11702667f84474535b156dbb194deffa0a6cdb4
git describe: v4.19.134-87-ge11702667f84
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.134-87-ge11702667f84Quoted 2 lines
Muchun Song <[email protected]>
mm: memcg/slab: fix memory leak at non-rootkmem_cachedestroy[ 2.510884] ============================================ [ 2.510884] WARNING: possible recursive locking detected [ 2.510884] 4.19.135-rc1 #1 Not tainted [ 2.510884] -------------------------------------------- [ 2.510884] swapper/0/1 is trying to acquire lock: [ 2.510884] 0000000088703397 (slab_mutex){+.+.}, at: kmem_cache_destroy+0x9a/0x2b0 [ 2.510884] [ 2.510884] but task is already holding lock: [ 2.510884] 0000000088703397 (slab_mutex){+.+.}, at: kmem_cache_destroy+0x45/0x2b0 [ 2.510884] [ 2.510884] other info that might help us debug this: [ 2.510884] Possible unsafe locking scenario: [ 2.510884] [ 2.510884] CPU0 [ 2.510884] ---- [ 2.510884] lock(slab_mutex); [ 2.510884] lock(slab_mutex); [ 2.510884] [ 2.510884] *** DEADLOCK *** [ 2.510884] [ 2.510884] May be due to missing lock nesting notation [ 2.510884] [ 2.510884] 3 locks held by swapper/0/1: [ 2.510884] #0: 000000008702dddc (cpu_hotplug_lock.rw_sem){++++}, at: kmem_cache_destroy+0x32/0x2b0 [ 2.510884] #1: 0000000050103e4d (mem_hotplug_lock.rw_sem){++++}, at: kmem_cache_destroy+0x37/0x2b0 [ 2.510884] #2: 0000000088703397 (slab_mutex){+.+.}, at: kmem_cache_destroy+0x45/0x2b0 [ 2.510884] [ 2.510884] stack backtrace: [ 2.510884] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.19.135-rc1 #1 [ 2.510884] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.0b 07/27/2017 [ 2.510884] Call Trace: [ 2.510884] dump_stack+0x7a/0xa5 [ 2.510884] __lock_acquire+0x6f1/0x1380 [ 2.510884] ? ret_from_fork+0x3a/0x50 [ 2.510884] lock_acquire+0x95/0x190 [ 2.510884] ? lock_acquire+0x95/0x190 [ 2.510884] ? kmem_cache_destroy+0x9a/0x2b0 [ 2.510884] ? kmem_cache_destroy+0x9a/0x2b0 [ 2.510884] __mutex_lock+0x83/0x990 [ 2.510884] ? kmem_cache_destroy+0x9a/0x2b0 [ 2.510884] ? kmem_cache_destroy+0x60/0x2b0 [ 2.510884] ? set_debug_rodata+0x17/0x17 [ 2.510884] ? set_debug_rodata+0x17/0x17 [ 2.510884] mutex_lock_nested+0x1b/0x20 [ 2.510884] ? get_online_mems+0x5f/0x90 [ 2.510884] ? mutex_lock_nested+0x1b/0x20 [ 2.510884] kmem_cache_destroy+0x9a/0x2b0 [ 2.510884] ? set_debug_rodata+0x17/0x17 [ 2.510884] intel_iommu_init+0x11c6/0x1326 [ 2.510884] ? kfree+0xc4/0x240 [ 2.510884] ? lockdep_hardirqs_on+0xef/0x180 [ 2.510884] ? kfree+0xc4/0x240 [ 2.510884] ? trace_hardirqs_on+0x4c/0x100 [ 2.510884] ? unpack_to_rootfs+0x272/0x29a [ 2.510884] ? e820__memblock_setup+0x64/0x64 [ 2.510884] ? set_debug_rodata+0x17/0x17 [ 2.510884] pci_iommu_init+0x1a/0x44 [ 2.510884] ? e820__memblock_setup+0x64/0x64 [ 2.510884] ? pci_iommu_init+0x1a/0x44 [ 2.510884] do_one_initcall+0x61/0x2b4 [ 2.510884] ? set_debug_rodata+0xa/0x17 [ 2.510884] ? rcu_read_lock_sched_held+0x81/0x90 [ 2.510884] kernel_init_freeable+0x1d8/0x270 [ 2.510884] ? rest_init+0x190/0x190 [ 2.510884] kernel_init+0xe/0x110 [ 2.510884] ret_from_fork+0x3a/0x50
Quoted 6 lines
Full test log:
https://pastebin.com/PWkk0YaF--
Linaro LKFT
https://lkft.linaro.org
--
Yours,
Muchun
Quoted 7 lines · Muchun Song
Thanks for your test. I have reviewed the patch:
[PATCH 4.19 76/86] mm: memcg/slab: fix memory leak at non-root
kmem_cachedestroyThere is a backport problem and I have pointed out the problem in that email.
Thanks for your suggestions on the other email thread. I have made changes as you said and boot test pass on x86 now.
mm/slab_common.c +0 -2
@@ -842,9 +842,7 @@ static int shutdown_memcg_caches(struct kmem_cache *s)static void memcg_set_kmem_cache_dying (struct kmem_cache *s) { -mutex_lock (&slab_mutex); s->memcg_params.dying = true; -mutex_unlock (&slab_mutex); }static void flush_memcg_workqueue (struct kmem_cache *s)
- Naresh
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.135 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.135-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.
It passes tests on CIP test farm:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.19.y
Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html