5.8.6-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 5.8.6-rc1 review
This is the start of the stable review cycle for the 5.8.6 release. There are 255 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.8.6-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.8.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.8.6-rc1
Hector Martin <[email protected]>
ALSA: usb-audio: Update documentation comment for MS2109 quirk
Dan Carpenter <[email protected]>
dma-pool: Fix an uninitialized variable bug in atomic_pool_expand()
Andrii Nakryiko <[email protected]>
libbpf: Fix build on ppc64le architecture
Roland Scheidegger <[email protected]>
drm/vmwgfx/ldu: Use drm_mode_config_reset
Roland Scheidegger <[email protected]>
drm/vmwgfx/sou: Use drm_mode_config_reset
Daniel Vetter <[email protected]>
drm/vmwgfx/stdu: Use drm_mode_config_reset
Peilin Ye <[email protected]>
HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
Qian Cai <[email protected]>
mm/page_counter: fix various data races at memsw
Tetsuo Handa <[email protected]>
fbmem: pull fbcon_update_vcs() out of fb_set_var()
Daniel Vetter <[email protected]>
drm/atomic-helper: reset vblank on crtc reset
Jens Axboe <[email protected]>
io_uring: make offset == -1 consistent with preadv2/pwritev2
Jens Axboe <[email protected]>
io_uring: don't use poll handler if file can't be nonblocking read/written
Jens Axboe <[email protected]>
io_uring: don't recurse on tsk->sighand->siglock with signalfd
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Fix Fix source hard reset response for TDA 2.3.1.1 and TDA 2.3.1.2 failures
Hans de Goede <[email protected]>
usb: typec: ucsi: Hold con->lock for the entire duration of ucsi_register_port()
Hans de Goede <[email protected]>
usb: typec: ucsi: Rework ppm_lock handling
Hans de Goede <[email protected]>
usb: typec: ucsi: Fix 2 unlocked ucsi_run_command calls
Hans de Goede <[email protected]>
usb: typec: ucsi: Fix AB BA lock inversion
Bastien Nocera <[email protected]>
USB: Fix device driver race
Bastien Nocera <[email protected]>
USB: Also match device drivers using the ->match vfunc
Alan Stern <[email protected]>
usb: storage: Add unusual_uas entry for Sony PSZ drives
Tom Rix <[email protected]>
USB: cdc-acm: rework notification_buffer resizing
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Handle ZLP for sg requests
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix handling ZLP
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Don't setup more than requested
Andy Shevchenko <[email protected]>
USB: gadget: u_f: Unbreak offset calculation in VLAs
Brooke Basile <[email protected]>
USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
Brooke Basile <[email protected]>
USB: gadget: u_f: add overflow checks to VLA macros
Tang Bin <[email protected]>
usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
Cyril Roelandt <[email protected]>
USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
Alan Stern <[email protected]>
USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
Kai-Heng Feng <[email protected]>
USB: quirks: Add no-lpm quirk for another Raydium touchscreen
Thinh Nguyen <[email protected]>
usb: uas: Add quirk for PNY Pro Elite
Alan Stern <[email protected]>
USB: yurex: Fix bad gfp argument
Evan Quan <[email protected]>
drm/amd/pm: correct the thermal alert temperature limit settings
Evan Quan <[email protected]>
drm/amd/pm: correct Vega20 swctf limit setting
Evan Quan <[email protected]>
drm/amd/pm: correct Vega12 swctf limit setting
Evan Quan <[email protected]>
drm/amd/pm: correct Vega10 swctf limit setting
Nicholas Kazlauskas <[email protected]>
drm/amd/powerplay: Fix hardmins not being sent to SMU for RV
Jiansong Chen <[email protected]>
drm/amdgpu/gfx10: refine mgcg setting
Alexander Monakov <[email protected]>
drm/amd/display: use correct scale for actual_brightness
Alex Deucher <[email protected]>
drm/amdgpu: Fix buffer overflow in INFO ioctl
Daniel Vetter <[email protected]>
drm/modeset-lock: Take the modeset BKL for legacy drivers
Bhawanpreet Lakha <[email protected]>
drm/dp_mst: Don't return error code when crtc is null
Christian Gmeiner <[email protected]>
drm/etnaviv: fix external abort seen on GC600 rev 0x19
Mika Kuoppala <[email protected]>
drm/i915: Fix cmd parser desc matching with masks
Ashok Raj <[email protected]>
x86/hotplug: Silence APIC only after all interrupts are migrated
Thomas Gleixner <[email protected]>
x86/irq: Unbreak interrupt affinity setting
qiuguorui1 <[email protected]>
irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake
Thomas Gleixner <[email protected]>
genirq/matrix: Deal with the sillyness of for_each_cpu() on UP
M. Vefa Bicakci <[email protected]>
usbip: Implement a match function to fix usbip
Herbert Xu <[email protected]>
crypto: af_alg - Work around empty control messages without MSG_MORE
Heikki Krogerus <[email protected]>
device property: Fix the secondary firmware node handling in set_primary_fwnode()
Alexey Kardashevskiy <[email protected]>
powerpc/perf: Fix crashes with generic_compat_pmu & BHRB
Christophe Leroy <[email protected]>
powerpc/32s: Disable VMAP stack which CONFIG_ADB_PMU
Rafael J. Wysocki <[email protected]>
PM: sleep: core: Fix the handling of pending runtime resume requests
Frank van der Linden <[email protected]>
arm64: vdso32: make vdso32 install conditional
James Morse <[email protected]>
KVM: arm64: Set HCR_EL2.PTW to prevent AT taking synchronous exception
Pavel Begunkov <[email protected]>
io-wq: fix hang after cancelling pending hashed work
Ding Hui <[email protected]>
xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed
Kai-Heng Feng <[email protected]>
xhci: Do warm-reset when both CAS and XDEV_RESUME are set
Li Jun <[email protected]>
usb: host: xhci: fix ep context print mismatch in debugfs
JC Kuo <[email protected]>
usb: host: xhci-tegra: fix tegra_xusb_get_phy()
JC Kuo <[email protected]>
usb: host: xhci-tegra: otg usb2/usb3 port init
Vinod Koul <[email protected]>
usb: renesas-xhci: remove version check
Thomas Gleixner <[email protected]>
XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
Jan Kara <[email protected]>
writeback: Fix sync livelock due to b_dirty_time processing
Jan Kara <[email protected]>
writeback: Avoid skipping inode writeback
Jan Kara <[email protected]>
writeback: Protect inode->i_io_list with inode->i_lock
Jens Axboe <[email protected]>
io_uring: clear req->result on IOPOLL re-issue
Sergey Senozhatsky <[email protected]>
serial: 8250: change lock order in serial8250_do_startup()
Valmer Huhn <[email protected]>
serial: 8250_exar: Fix number of ports for Commtech PCIe cards
Holger Assmann <[email protected]>
serial: stm32: avoid kernel warning on absence of optional IRQ
Lukas Wunner <[email protected]>
serial: pl011: Don't leak amba_ports entry on driver register error
Lukas Wunner <[email protected]>
serial: pl011: Fix oops on -EPROBE_DEFER
Tamseel Shams <[email protected]>
serial: samsung: Removes the IRQ not found warning
George Kennedy <[email protected]>
vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize()
Tetsuo Handa <[email protected]>
vt: defer kfree() of vc_screenbuf in vc_do_resize()
Evgeny Novikov <[email protected]>
USB: lvtest: return proper error code in probe
George Kennedy <[email protected]>
fbcon: prevent user font height or width change from causing potential out-of-bounds access
Boris Burkov <[email protected]>
btrfs: detect nocow for swap after snapshot delete
Filipe Manana <[email protected]>
btrfs: fix space cache memory leak after transaction abort
Josef Bacik <[email protected]>
btrfs: check the right error variable in btrfs_del_dir_entries_in_log
Marcos Paulo de Souza <[email protected]>
btrfs: reset compression level for lzo on remount
Ming Lei <[email protected]>
blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART
Hans de Goede <[email protected]>
HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands
Ming Lei <[email protected]>
block: loop: set discard granularity and alignment for block device backed loop
Keith Busch <[email protected]>
block: fix get_max_io_size()
Tim Harvey <[email protected]>
hwmon: (gsc-hwmon) Scale temperature to millidegrees
Marc Zyngier <[email protected]>
arm64: Allow booting of late CPUs affected by erratum 1418040
Marc Zyngier <[email protected]>
arm64: Move handling of erratum 1418040 into C code
Yauheni Kaliuta <[email protected]>
bpf: selftests: global_funcs: Check err_str before strstr
Toke Høiland-Jørgensen <[email protected]>
libbpf: Fix map index used in error message
Athira Rajeev <[email protected]>
powerpc/perf: Fix soft lockups due to missed interrupt accounting
brookxu <[email protected]>
ext4: limit the length of per-inode prealloc list
Yonghong Song <[email protected]>
bpf: Avoid visit same object multiple times
Yonghong Song <[email protected]>
bpf: Fix a rcu_sched stall issue with bpf task/task_file iterator
Huang Rui <[email protected]>
drm/amdkfd: fix the wrong sdma instance query for renoir
Guchun Chen <[email protected]>
drm/amdgpu: fix NULL pointer access issue when unloading driver
Sumera Priyadarsini <[email protected]>
net: gianfar: Add of_node_put() before goto statement
Alvin Šipraga <[email protected]>
macvlan: validate setting of multiple remote source MAC addresses
Saurav Kashyap <[email protected]>
Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command"
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix null pointer access during disconnect from subsystem
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Check if FW supports MQ before enabling
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix login timeout
Quinn Tran <[email protected]>
scsi: qla2xxx: Indicate correct supported speeds for Mezz card
Quinn Tran <[email protected]>
scsi: qla2xxx: Flush I/O on zone disable
Quinn Tran <[email protected]>
scsi: qla2xxx: Flush all sessions on zone disable
Douglas Gilbert <[email protected]>
scsi: scsi_debug: Fix scp is NULL errors
Stanley Chu <[email protected]>
scsi: ufs: Clean up completed request without interrupt notification
Adrian Hunter <[email protected]>
scsi: ufs: Improve interrupt handling for shared interrupts
Stanley Chu <[email protected]>
scsi: ufs: Fix possible infinite loop in ufshcd_hold
Mike Christie <[email protected]>
scsi: fcoe: Fix I/O path allocation
David Ahern <[email protected]>
selftests: disable rp_filter for icmp_redirect.sh
Tom Yan <[email protected]>
ALSA: usb-audio: ignore broken processing/extension unit
Sylwester Nawrocki <[email protected]>
ASoC: wm8994: Avoid attempts to read unreadable registers
Vineeth Vijayan <[email protected]>
s390/cio: add cond_resched() in the slow_eval_known_fn() loop
Mike Pozulp <[email protected]>
ALSA: hda/realtek: Add model alc298-samsung-headphone
Xie He <[email protected]>
drivers/net/wan/hdlc_x25: Added needed_headroom and a skb->len check
Nicolas Saenz Julienne <[email protected]>
dma-pool: Only allocate from CMA when in same memory zone
Christoph Hellwig <[email protected]>
dma-pool: fix coherent pool allocations for IOMMU mappings
Oleksij Rempel <[email protected]>
can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to detect corruptions
Andrii Nakryiko <[email protected]>
selftests/bpf: Correct various core_reloc 64-bit assumptions
Andrii Nakryiko <[email protected]>
selftests/bpf: Fix btf_dump test cases on 32-bit arches
Andrii Nakryiko <[email protected]>
selftest/bpf: Fix compilation warnings in 32-bit mode
Andrii Nakryiko <[email protected]>
tools/bpftool: Fix compilation warnings in 32-bit mode
Toke Høiland-Jørgensen <[email protected]>
libbpf: Prevent overriding errno when logging errors
Florian Westphal <[email protected]>
netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
Jean-Philippe Brucker <[email protected]>
libbpf: Handle GCC built-in types for Arm NEON
Jianlin Lv <[email protected]>
selftests/bpf: Fix segmentation fault in test_progs
Anthony Koo <[email protected]>
drm/amd/display: Switch to immediate mode for updating infopackets
Anthony Koo <[email protected]>
drm/amd/display: Fix LFC multiplier changing erratically
Evan Quan <[email protected]>
drm/amd/powerplay: correct UVD/VCE PG state on custom pptable uploading
Evan Quan <[email protected]>
drm/amd/powerplay: correct Vega20 cached smu feature state
Alain Volmat <[email protected]>
spi: stm32: always perform registers configuration prior to transfer
Amelie Delaunay <[email protected]>
spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
Amelie Delaunay <[email protected]>
spi: stm32: fix fifo threshold level in case of short transfer
Antonio Borneo <[email protected]>
spi: stm32h7: fix race condition at end of transfer
Xianting Tian <[email protected]>
fs: prevent BUG_ON in submit_bh_wbc()
Jan Kara <[email protected]>
ext4: correctly restore system zone info when remount fails
Jan Kara <[email protected]>
ext4: handle error of ext4_setup_system_zone() on remount
Lukas Czerner <[email protected]>
ext4: handle option set by mount flags correctly
zhangyi (F) <[email protected]>
jbd2: abort journal if free a async write error metadata buffer
zhangyi (F) <[email protected]>
ext4: abort the filesystem if failed to async write metadata buffer
Xin He <[email protected]>
drm/virtio: fix memory leak in virtio_gpu_cleanup_object()
Alex Zhuravlev <[email protected]>
ext4: skip non-loaded groups at cr=0/1 when scanning for good groups
Lukas Czerner <[email protected]>
ext4: handle read only external journal device
Jan Kara <[email protected]>
ext4: don't BUG on inconsistent journal feature
Lukas Czerner <[email protected]>
jbd2: make sure jh have b_transaction set in refile/unfile_buffer
Tobias Schramm <[email protected]>
spi: stm32: clear only asserted irq flags on interrupt
Michael Ellerman <[email protected]>
video: fbdev: controlfb: Fix build for COMPILE_TEST=y && PPC_PMAC=n
Christophe JAILLET <[email protected]>
usb: gadget: f_tcm: Fix some resource leaks in some error paths
Jason Wang <[email protected]>
vdpa: ifcvf: free config irq in ifcvf_free_irq()
Jason Wang <[email protected]>
vdpa: ifcvf: return err when fail to request config irq
Wolfram Sang <[email protected]>
i2c: rcar: in slave mode, clear NACK earlier
Andy Shevchenko <[email protected]>
i2c: core: Don't fail PRP0001 enumeration when no ID table exist
Lucas Stach <[email protected]>
drm/etnaviv: always start/stop scheduler in timeout processing
Dan Carpenter <[email protected]>
habanalabs: Fix memory corruption in debugfs
Hou Pu <[email protected]>
null_blk: fix passing of REQ_FUA flag in null_handle_rq
Martin Wilck <[email protected]>
nvme: multipath: round-robin: fix single non-optimized path case
Tianjia Zhang <[email protected]>
nvme-fc: Fix wrong return value in __nvme_fc_init_request()
Sagi Grimberg <[email protected]>
nvmet: fix a memory leak
Yufen Yu <[email protected]>
blkcg: fix memleak for iolatency
Ming Lei <[email protected]>
blk-mq: insert request not through ->queue_rq into sw/scheduler queue
Jason Baron <[email protected]>
hwmon: (nct7904) Correct divide by 0
Dmitry Monakhov <[email protected]>
bfq: fix blkio cgroup leakage v4
Matthew Wilcox (Oracle) <[email protected]>
block: Fix page_is_mergeable() for compound pages
Rob Clark <[email protected]>
drm/msm/adreno: fix updating ring fence
Ming Lei <[email protected]>
block: virtio_blk: fix handling single range discard request
Ming Lei <[email protected]>
block: respect queue limit of max discard segment
J. Bruce Fields <[email protected]>
nfsd: fix oops on mixed NFSv4/NFSv3 client access
Alexander Tsoy <[email protected]>
ALSA: usb-audio: Add capture support for Saffire 6 (USB 1.1)
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix EPP setting via sysfs in active mode
Chanwoo Choi <[email protected]>
PM / devfreq: Fix the wrong end with semicolon
Ansuel Smith <[email protected]>
PCI: qcom: Add missing reset for ipq806x
Abhishek Sahu <[email protected]>
PCI: qcom: Change duplicate PCI reset to phy reset
Ansuel Smith <[email protected]>
PCI: qcom: Add missing ipq806x clocks in PCIe driver
Tonghao Zhang <[email protected]>
net: openvswitch: introduce common code for flushing flows
Kefeng Wang <[email protected]>
arm64: Fix __cpu_logical_map undefined issue
Andrey Konovalov <[email protected]>
efi: provide empty efi_enter_virtual_mode implementation
Randy Dunlap <[email protected]>
pinctrl: mediatek: fix build for tristate changes
Hanks Chen <[email protected]>
pinctrl: mediatek: avoid virtual gpio trying to set reg
Nicolas Saenz Julienne <[email protected]>
brcmfmac: Set timeout value when configuring power save
Manish Narani <[email protected]>
mmc: sdhci-of-arasan: fix timings allocation code
Changming Liu <[email protected]>
USB: sisusbvga: Fix a potential UB casued by left shifting a negative value
Sasha Levin <[email protected]>
dmaengine: idxd: fix PCI_MSI build errors
Arnd Bergmann <[email protected]>
powerpc/spufs: add CONFIG_COREDUMP dependency
David Brazdil <[email protected]>
KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe
Qingqing Zhuo <[email protected]>
drm/amd/display: fix compilation error on allmodconfig
Lewis Huang <[email protected]>
drm/amd/display: change global buffer to local buffer
Andrey Konovalov <[email protected]>
media: i2c: imx290: fix reset GPIO pin handling
Evgeny Novikov <[email protected]>
media: davinci: vpif_capture: fix potential double free
Mike Kravetz <[email protected]>
hugetlbfs: prevent filesystem stacking of hugetlbfs
Jason Baron <[email protected]>
EDAC/ie31200: Fallback if host bridge device is already initialized
Jarkko Nikula <[email protected]>
i2c: i801: Add support for Intel Tiger Lake PCH-H
Javed Hasan <[email protected]>
scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
Xiubo Li <[email protected]>
ceph: do not access the kiocb after aio requests
Xiubo Li <[email protected]>
ceph: fix potential mdsc use-after-free crash
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: report EEXIST on overlaps
Jing Xiangfeng <[email protected]>
scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
Nikolay Borisov <[email protected]>
btrfs: make btrfs_qgroup_check_reserved_leak take btrfs_inode
Qu Wenruo <[email protected]>
btrfs: file: reserve qgroup space after the hole punch range is locked
Chris Wilson <[email protected]>
locking/lockdep: Fix overflow in presentation of average lock-time
Aditya Pakki <[email protected]>
drm/nouveau: Fix reference count leak in nouveau_connector_detect
Aditya Pakki <[email protected]>
drm/nouveau: fix reference count leak in nv50_disp_atomic_commit
Aditya Pakki <[email protected]>
drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open
Li Guifu <[email protected]>
f2fs: fix use-after-free issue
Ikjoon Jang <[email protected]>
HID: quirks: add NOGET quirk for Logitech GROUP
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: sof_sdw_rt711: remove properties in card remove
Hans Verkuil <[email protected]>
cec-api: prevent leaking memory through hole in structure
Dmitry Osipenko <[email protected]>
gpu: host1x: Put gather's BO on pinning error
Kaige Li <[email protected]>
ALSA: hda: Add support for Loongson 7A1000 controller
Peng Fan <[email protected]>
mips/vdso: Fix resource leaks in genvdso.c
Reto Schneider <[email protected]>
rtlwifi: rtl8192cu: Prevent leaking urb
Yangbo Lu <[email protected]>
ARM: dts: ls1021a: output PPS signal on FIPER2
Qiushi Wu <[email protected]>
PCI: Fix pci_create_slot() reference count leak
Aditya Pakki <[email protected]>
omapfb: fix multiple reference count leaks due to pm_runtime_get_sync
Jiaxun Yang <[email protected]>
MIPS: KVM: Limit Trap-and-Emulate to MIPS32R2 only
Chao Yu <[email protected]>
f2fs: fix error path in do_recover_data()
Dehe Gu <[email protected]>
f2fs: remove write attribute of main_blkaddr sysfs node
Desnes A. Nunes do Rosario <[email protected]>
selftests/powerpc: Purge extra count_pmc() calls of ebb selftests
Mike Christie <[email protected]>
scsi: target: Fix xcopy sess release leak
Dave Chinner <[email protected]>
xfs: Don't allow logging of XFS_ISTALE inodes
Dick Kennedy <[email protected]>
scsi: lpfc: Fix shost refcount mismatch when deleting vport
Alex Deucher <[email protected]>
drm/amdgpu/pm: fix ref count leak when pm_runtime_get_sync fails
Alex Deucher <[email protected]>
drm/amdkfd: fix ref count leak when pm_runtime_get_sync fails
Alex Deucher <[email protected]>
drm/amdgpu/fence: fix ref count leak when pm_runtime_get_sync fails
Navid Emamdoost <[email protected]>
drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails
Navid Emamdoost <[email protected]>
drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config
Navid Emamdoost <[email protected]>
drm/amd/display: fix ref count leak in amdgpu_drm_ioctl
Navid Emamdoost <[email protected]>
drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms
Aditya Pakki <[email protected]>
drm/radeon: fix multiple reference count leak
Qiushi Wu <[email protected]>
drm/amdkfd: Fix reference count leaks.
Gwendal Grignou <[email protected]>
platform/chrome: cros_ec_sensorhub: Fix EC timestamp overflow
Robin Murphy <[email protected]>
iommu/iova: Don't BUG on invalid PFNs
Andy Shevchenko <[email protected]>
mfd: intel-lpss: Add Intel Tiger Lake PCH-H PCI IDs
Bodo Stroesser <[email protected]>
scsi: target: tcmu: Fix crash on ARM during cmd completion
Evgeny Novikov <[email protected]>
staging: rts5208: fix memleaks on error handling paths in probe
Luis Chamberlain <[email protected]>
blktrace: ensure our debugfs dir exists
Alexander Popov <[email protected]>
gcc-plugins/stackleak: Don't instrument itself
Jia-Ju Bai <[email protected]>
media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
Alexey Kardashevskiy <[email protected]>
powerpc/xive: Ignore kmemleak false positives
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep
Andy Shevchenko <[email protected]>
mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs
Qiushi Wu <[email protected]>
ASoC: tegra: Fix reference count leaks.
Qiushi Wu <[email protected]>
ASoC: img-parallel-out: Fix a reference count leak
Qiushi Wu <[email protected]>
ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt
Zhenzhong Duan <[email protected]>
EDAC/mc: Call edac_inc_ue_error() before panic
Guchun Chen <[email protected]>
drm/amdgpu: fix RAS memory leak in error case
Kai-Heng Feng <[email protected]>
ALSA: hda/hdmi: Use force connectivity quirk on another HP desktop
Kai-Heng Feng <[email protected]>
ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged
Randy Dunlap <[email protected]>
ALSA: pci: delete repeated words in comments
Kai-Heng Feng <[email protected]>
ALSA: hda/hdmi: Add quirk to force connectivity
Kai Vehmanen <[email protected]>
ASoC: intel/skl/hda - fix probe regression on systems without i915
Hugh Dickins <[email protected]>
khugepaged: khugepaged_test_exit() check mmget_still_valid()
-------------
Diffstat:
Documentation/admin-guide/ext4.rst | 3 + Makefile | 4 +- arch/arm/boot/dts/ls1021a.dtsi | 2 +- arch/arm64/Makefile | 3 +- arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | 2 +- arch/arm64/include/asm/kvm_arm.h | 3 +- arch/arm64/include/asm/smp.h | 7 +- arch/arm64/kernel/cpu_errata.c | 2 + arch/arm64/kernel/entry.S | 21 -- arch/arm64/kernel/process.c | 34 ++++ arch/arm64/kernel/setup.c | 8 +- arch/arm64/kernel/smp.c | 6 +- arch/arm64/kvm/hyp/switch.c | 2 +- arch/mips/Kconfig | 1 + arch/mips/kvm/Kconfig | 3 +- arch/mips/vdso/genvdso.c | 10 + arch/powerpc/perf/core-book3s.c | 23 ++- arch/powerpc/platforms/Kconfig.cputype | 2 +- arch/powerpc/platforms/cell/Kconfig | 1 + arch/powerpc/sysdev/xive/native.c | 2 + arch/x86/kernel/apic/vector.c | 16 +- arch/x86/kernel/smpboot.c | 26 ++- block/bfq-cgroup.c | 2 +- block/bfq-iosched.h | 1 - block/bfq-wf2q.c | 12 +- block/bio.c | 10 +- block/blk-cgroup.c | 8 +- block/blk-merge.c | 13 +- block/blk-mq-sched.c | 9 + block/blk-mq.c | 12 +- crypto/af_alg.c | 13 +- drivers/base/core.c | 12 +- drivers/base/power/main.c | 16 +- drivers/block/loop.c | 33 ++-- drivers/block/null_blk_main.c | 2 +- drivers/block/virtio_blk.c | 31 ++- drivers/cpufreq/intel_pstate.c | 18 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/Kconfig | 1 + drivers/edac/edac_mc.c | 4 +- drivers/edac/ie31200_edac.c | 50 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c | 31 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 220 +++++++++++++++------ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 21 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 81 ++++---- .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 10 +- .../amd/display/dc/dcn10/dcn10_stream_encoder.c | 16 +- .../amd/display/dc/dcn10/dcn10_stream_encoder.h | 14 ++ drivers/gpu/drm/amd/display/modules/color/Makefile | 2 +- .../drm/amd/display/modules/color/color_gamma.c | 115 ++++++----- .../drm/amd/display/modules/color/color_gamma.h | 18 +- .../drm/amd/display/modules/color/color_table.c | 48 +++++ .../drm/amd/display/modules/color/color_table.h | 47 +++++ .../drm/amd/display/modules/freesync/freesync.c | 36 +++- drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 9 +- .../gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 22 ++- .../gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c | 21 +- drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 44 ++--- .../gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c | 21 +- drivers/gpu/drm/arm/display/komeda/komeda_crtc.c | 7 +- drivers/gpu/drm/arm/malidp_drv.c | 1 - drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c | 7 +- drivers/gpu/drm/drm_atomic_helper.c | 7 +- drivers/gpu/drm/drm_atomic_state_helper.c | 4 + drivers/gpu/drm/drm_color_mgmt.c | 2 +- drivers/gpu/drm/drm_crtc.c | 4 +- drivers/gpu/drm/drm_dp_mst_topology.c | 4 +- drivers/gpu/drm/drm_mode_object.c | 4 +- drivers/gpu/drm/drm_plane.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 11 +- drivers/gpu/drm/etnaviv/etnaviv_sched.c | 11 +- drivers/gpu/drm/i915/i915_cmd_parser.c | 14 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 2 - drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 +- drivers/gpu/drm/omapdrm/omap_crtc.c | 8 +- drivers/gpu/drm/omapdrm/omap_drv.c | 4 - drivers/gpu/drm/radeon/radeon_connectors.c | 20 +- drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 6 +- drivers/gpu/drm/tegra/dc.c | 1 - drivers/gpu/drm/tidss/tidss_crtc.c | 3 +- drivers/gpu/drm/tidss/tidss_kms.c | 5 - drivers/gpu/drm/virtio/virtgpu_object.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 9 +- drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 9 +- drivers/gpu/host1x/job.c | 13 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + drivers/hid/i2c-hid/i2c-hid-core.c | 22 ++- drivers/hid/usbhid/hiddev.c | 4 + drivers/hwmon/gsc-hwmon.c | 1 + drivers/hwmon/nct7904.c | 4 +- drivers/i2c/busses/i2c-i801.c | 4 + drivers/i2c/busses/i2c-rcar.c | 1 + drivers/i2c/i2c-core-base.c | 2 +- drivers/iommu/dma-iommu.c | 4 +- drivers/iommu/iova.c | 4 +- drivers/irqchip/irq-stm32-exti.c | 14 +- drivers/media/cec/core/cec-api.c | 8 +- drivers/media/i2c/imx290.c | 7 +- drivers/media/pci/ttpci/av7110.c | 5 +- drivers/media/platform/davinci/vpif_capture.c | 2 - drivers/mfd/intel-lpss-pci.c | 19 ++ drivers/misc/habanalabs/debugfs.c | 8 +- drivers/mmc/host/sdhci-of-arasan.c | 25 +-- drivers/net/ethernet/freescale/gianfar.c | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 2 +- drivers/net/macvlan.c | 21 +- drivers/net/wan/hdlc.c | 1 + drivers/net/wan/hdlc_x25.c | 17 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 8 + drivers/net/wireless/realtek/rtlwifi/usb.c | 5 +- drivers/nvme/host/fc.c | 4 +- drivers/nvme/host/multipath.c | 15 +- drivers/nvme/target/configfs.c | 1 + drivers/pci/controller/dwc/pcie-qcom.c | 58 +++++- drivers/pci/slot.c | 6 +- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 26 +++ drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h | 1 + drivers/pinctrl/mediatek/pinctrl-paris.c | 7 + drivers/platform/chrome/cros_ec_sensorhub_ring.c | 4 +- drivers/s390/cio/css.c | 5 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/lpfc/lpfc_vport.c | 26 +-- drivers/scsi/qla2xxx/qla_gs.c | 48 ++++- drivers/scsi/qla2xxx/qla_mbx.c | 8 - drivers/scsi/qla2xxx/qla_nvme.c | 5 + drivers/scsi/qla2xxx/qla_os.c | 5 + drivers/scsi/qla2xxx/qla_target.c | 2 +- drivers/scsi/scsi_debug.c | 2 + drivers/scsi/scsi_transport_iscsi.c | 2 +- drivers/scsi/ufs/ufshcd.c | 14 +- drivers/spi/spi-stm32.c | 73 +++---- drivers/staging/rts5208/rtsx.c | 1 + drivers/target/target_core_internal.h | 1 + drivers/target/target_core_transport.c | 7 +- drivers/target/target_core_user.c | 9 +- drivers/target/target_core_xcopy.c | 11 +- drivers/tty/serial/8250/8250_exar.c | 24 ++- drivers/tty/serial/8250/8250_port.c | 9 +- drivers/tty/serial/amba-pl011.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 +- drivers/tty/serial/stm32-usart.c | 2 +- drivers/tty/vt/vt.c | 5 +- drivers/tty/vt/vt_ioctl.c | 12 +- drivers/usb/class/cdc-acm.c | 22 +-- drivers/usb/core/driver.c | 40 +++- drivers/usb/core/generic.c | 5 +- drivers/usb/core/quirks.c | 7 + drivers/usb/dwc3/gadget.c | 107 ++++++++-- drivers/usb/gadget/function/f_ncm.c | 81 ++++++-- drivers/usb/gadget/function/f_tcm.c | 7 +- drivers/usb/gadget/u_f.h | 38 ++-- drivers/usb/host/ohci-exynos.c | 5 +- drivers/usb/host/xhci-debugfs.c | 8 +- drivers/usb/host/xhci-hub.c | 19 +- drivers/usb/host/xhci-pci-renesas.c | 19 +- drivers/usb/host/xhci-tegra.c | 4 +- drivers/usb/host/xhci.c | 3 +- drivers/usb/misc/lvstest.c | 2 +- drivers/usb/misc/sisusbvga/sisusb.c | 2 +- drivers/usb/misc/yurex.c | 2 +- drivers/usb/storage/unusual_devs.h | 2 +- drivers/usb/storage/unusual_uas.h | 14 ++ drivers/usb/typec/tcpm/tcpm.c | 28 ++- drivers/usb/typec/ucsi/displayport.c | 9 +- drivers/usb/typec/ucsi/ucsi.c | 103 +++++----- drivers/usb/usbip/stub_dev.c | 6 + drivers/vdpa/ifcvf/ifcvf_base.h | 2 +- drivers/vdpa/ifcvf/ifcvf_main.c | 9 +- drivers/video/fbdev/controlfb.c | 2 + drivers/video/fbdev/core/fbcon.c | 25 ++- drivers/video/fbdev/core/fbmem.c | 8 +- drivers/video/fbdev/core/fbsysfs.c | 4 +- drivers/video/fbdev/omap2/omapfb/dss/dispc.c | 7 +- drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 7 +- drivers/video/fbdev/omap2/omapfb/dss/dss.c | 7 +- drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c | 5 +- drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c | 5 +- drivers/video/fbdev/omap2/omapfb/dss/venc.c | 7 +- drivers/video/fbdev/ps3fb.c | 5 +- drivers/xen/events/events_base.c | 16 +- fs/btrfs/ctree.h | 4 +- fs/btrfs/disk-io.c | 1 + fs/btrfs/extent-tree.c | 17 +- fs/btrfs/file.c | 10 +- fs/btrfs/free-space-cache.c | 2 +- fs/btrfs/inode.c | 18 +- fs/btrfs/qgroup.c | 14 +- fs/btrfs/qgroup.h | 2 +- fs/btrfs/super.c | 1 + fs/btrfs/tree-log.c | 10 +- fs/buffer.c | 9 + fs/ceph/file.c | 5 +- fs/ceph/mds_client.c | 14 +- fs/ext4/block_validity.c | 8 - fs/ext4/ext4.h | 7 +- fs/ext4/ext4_jbd2.c | 25 +++ fs/ext4/extents.c | 10 +- fs/ext4/file.c | 2 +- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 6 +- fs/ext4/ioctl.c | 2 +- fs/ext4/mballoc.c | 95 ++++++++- fs/ext4/mballoc.h | 4 + fs/ext4/move_extent.c | 4 +- fs/ext4/super.c | 195 ++++++++++++------ fs/ext4/sysfs.c | 2 + fs/f2fs/f2fs.h | 4 +- fs/f2fs/inline.c | 19 +- fs/f2fs/node.c | 6 +- fs/f2fs/recovery.c | 10 +- fs/f2fs/super.c | 5 +- fs/f2fs/sysfs.c | 9 +- fs/fs-writeback.c | 83 ++++---- fs/hugetlbfs/inode.c | 6 + fs/io-wq.c | 21 +- fs/io_uring.c | 40 +++- fs/jbd2/transaction.c | 26 +++ fs/nfsd/nfs4state.c | 2 + fs/xfs/libxfs/xfs_trans_inode.c | 2 + fs/xfs/xfs_icache.c | 3 +- fs/xfs/xfs_inode.c | 25 ++- include/drm/drm_modeset_lock.h | 9 +- include/linux/dma-direct.h | 3 - include/linux/dma-mapping.h | 5 +- include/linux/efi.h | 4 + include/linux/fb.h | 2 - include/linux/fs.h | 8 +- include/linux/netfilter_ipv6.h | 18 -- include/trace/events/ext4.h | 17 +- include/trace/events/writeback.h | 13 +- kernel/Makefile | 1 + kernel/bpf/bpf_iter.c | 15 +- kernel/bpf/task_iter.c | 3 +- kernel/dma/direct.c | 13 +- kernel/dma/pool.c | 147 +++++++------- kernel/irq/matrix.c | 7 + kernel/locking/lockdep_proc.c | 2 +- kernel/trace/blktrace.c | 12 ++ mm/khugepaged.c | 5 +- mm/page_counter.c | 13 +- net/bridge/netfilter/nf_conntrack_bridge.c | 8 +- net/can/j1939/transport.c | 15 +- net/ipv6/netfilter.c | 3 - net/netfilter/nf_tables_api.c | 16 +- net/openvswitch/datapath.c | 10 +- net/openvswitch/flow_table.c | 35 ++-- net/openvswitch/flow_table.h | 3 + sound/pci/cs46xx/cs46xx_lib.c | 2 +- sound/pci/cs46xx/dsp_spos_scb_lib.c | 2 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/hda/hda_generic.c | 2 +- sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_hdmi.c | 17 +- sound/pci/hda/patch_realtek.c | 12 ++ sound/pci/hda/patch_sigmatel.c | 2 +- sound/pci/ice1712/prodigy192.c | 2 +- sound/pci/oxygen/xonar_dg.c | 2 +- sound/soc/codecs/wm8958-dsp2.c | 4 + sound/soc/img/img-i2s-in.c | 4 +- sound/soc/img/img-parallel-out.c | 4 +- sound/soc/intel/boards/skl_hda_dsp_common.h | 1 + sound/soc/intel/boards/skl_hda_dsp_generic.c | 17 +- sound/soc/intel/boards/sof_sdw.c | 1 + sound/soc/intel/boards/sof_sdw_common.h | 1 + sound/soc/intel/boards/sof_sdw_rt711.c | 15 ++ sound/soc/tegra/tegra30_ahub.c | 4 +- sound/soc/tegra/tegra30_i2s.c | 4 +- sound/usb/mixer.c | 8 +- sound/usb/quirks-table.h | 34 +++- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/link.c | 4 +- tools/bpf/bpftool/main.h | 10 +- tools/bpf/bpftool/prog.c | 16 +- tools/lib/bpf/btf_dump.c | 35 +++- tools/lib/bpf/libbpf.c | 14 +- .../testing/selftests/bpf/prog_tests/bpf_obj_id.c | 8 +- tools/testing/selftests/bpf/prog_tests/btf_dump.c | 27 ++- .../testing/selftests/bpf/prog_tests/core_extern.c | 4 +- .../testing/selftests/bpf/prog_tests/core_reloc.c | 20 +- .../selftests/bpf/prog_tests/fexit_bpf2bpf.c | 6 +- .../selftests/bpf/prog_tests/flow_dissector.c | 2 +- .../testing/selftests/bpf/prog_tests/global_data.c | 6 +- tools/testing/selftests/bpf/prog_tests/mmap.c | 19 +- .../selftests/bpf/prog_tests/prog_run_xattr.c | 2 +- tools/testing/selftests/bpf/prog_tests/skb_ctx.c | 2 +- .../selftests/bpf/prog_tests/test_global_funcs.c | 2 +- .../testing/selftests/bpf/progs/core_reloc_types.h | 69 ++++--- tools/testing/selftests/bpf/test_btf.c | 8 +- tools/testing/selftests/bpf/test_progs.h | 5 + tools/testing/selftests/net/icmp_redirect.sh | 2 + .../powerpc/pmu/ebb/back_to_back_ebbs_test.c | 2 - .../selftests/powerpc/pmu/ebb/cycles_test.c | 2 - .../powerpc/pmu/ebb/cycles_with_freeze_test.c | 2 - .../powerpc/pmu/ebb/cycles_with_mmcr2_test.c | 2 - tools/testing/selftests/powerpc/pmu/ebb/ebb.c | 2 - .../powerpc/pmu/ebb/ebb_on_willing_child_test.c | 2 - .../powerpc/pmu/ebb/lost_exception_test.c | 1 - .../selftests/powerpc/pmu/ebb/multi_counter_test.c | 7 - .../powerpc/pmu/ebb/multi_ebb_procs_test.c | 2 - .../selftests/powerpc/pmu/ebb/pmae_handling_test.c | 2 - .../powerpc/pmu/ebb/pmc56_overflow_test.c | 2 - 314 files changed, 2904 insertions(+), 1353 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/255 khugepaged: khugepaged_test_exit() check mmget_still_valid()
From: Hugh Dickins <[email protected]>
[ Upstream commit bbe98f9cadff58cdd6a4acaeba0efa8565dabe65 ]
Move collapse_huge_page()'s mmget_still_valid() check into khugepaged_test_exit() itself. collapse_huge_page() is used for anon THP only, and earned its mmget_still_valid() check because it inserts a huge pmd entry in place of the page table's pmd entry; whereas collapse_file()'s retract_page_tables() or collapse_pte_mapped_thp() merely clears the page table's pmd entry. But core dumping without mmap lock must have been as open to mistaking a racily cleared pmd entry for a page table at physical page 0, as exit_mmap() was. And we certainly have no interest in mapping as a THP once dumping core.
--- mm/khugepaged.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
mm/khugepaged.c +1 -4
@@ -431,7 +431,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm,static inline int khugepaged_test_exit (struct mm_struct *mm) { -return atomic_read (&mm->mm_users) ==0 ; +return atomic_read (&mm->mm_users) ==0 || !mmget_still_valid (mm); } static bool hugepage_vma_check(struct vm_area_struct *vma,
@@ -1100,9 +1100,6 @@ static void collapse_huge_page(struct mm_struct *mm,* handled by the anon_vma lock + PG_lock. */ mmap_write_lock (mm); - result =SCAN_ANY_PROCESS ; -if (!mmget_still_valid (mm)) - goto out; result =hugepage_vma_revalidate (mm, address, &vma);if (result) goto out;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 2/255 ASoC: intel/skl/hda - fix probe regression on systems without i915
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit ffc6d45d96f07a32700cb6b7be2d3459e63c255a ]
Starting in commit cbc7a6b5a87a ("ASoC: soc-card: add snd_soc_card_add_dai_link()"), error value from ASoc add_dai_link() is no longer ignored.
The generic HDA machine driver relied on the old semantics to disable i915 HDMI/DP audio codec at runtime. If no display codec was present, add_dai_link() returned an error, but this was ignored and rest of the card was successfully probed.
Fix the problem by changing the machine driver add_dai_link() to not return an error in this case.
--- sound/soc/intel/boards/skl_hda_dsp_common.h | 1 + sound/soc/intel/boards/skl_hda_dsp_generic.c | 17 +++++++++++------ 2 files changed, 12 insertions(+), 6 deletions(-)
sound/soc/intel/boards/skl_hda_dsp_common.h +1 -0
@@ -33,6 +33,7 @@ struct skl_hda_private {int dai_index;const char *platform_name;bool common_hdmi_codec_drv; +bool idisp_codec; };extern struct snd_soc_dai_link skl_hda_be_dai_links[HDA_DSP_MAX_BE_DAI_LINKS ];
sound/soc/intel/boards/skl_hda_dsp_generic.c +11 -6
@@ -79,6 +79,9 @@ skl_hda_add_dai_link(struct snd_soc_card *card, struct snd_soc_dai_link *link) link->platforms->name = ctx->platform_name; link->nonatomic =1 ; +if (!ctx->idisp_codec) +return 0 ; +if (strstr (link->name,"HDMI" )) { ret =skl_hda_hdmi_add_pcm (card, ctx->pcm_count);
@@ -118,19 +121,20 @@ static char hda_soc_components[30];static int skl_hda_fill_card_info (struct snd_soc_acpi_mach_params *mach_params) {struct snd_soc_card *card = &hda_soc_card; +struct skl_hda_private *ctx =snd_soc_card_get_drvdata (card);struct snd_soc_dai_link *dai_link; -u32 codec_count, codec_mask, idisp_mask; +u32 codec_count, codec_mask;int i, num_links, num_route; codec_mask = mach_params->codec_mask; codec_count =hweight_long (codec_mask); - idisp_mask = codec_mask &IDISP_CODEC_MASK ; + ctx->idisp_codec = !!(codec_mask &IDISP_CODEC_MASK );if (!codec_count || codec_count >2 || - (codec_count ==2 && !idisp_mask)) + (codec_count ==2 && !ctx->idisp_codec))return -EINVAL ; -if (codec_mask == idisp_mask) { +if (codec_mask ==IDISP_CODEC_MASK ) {/* topology with iDisp as the only HDA codec */ num_links =IDISP_DAI_COUNT +DMIC_DAI_COUNT ; num_route =IDISP_ROUTE_COUNT ;
@@ -152,7 +156,7 @@ static int skl_hda_fill_card_info(struct snd_soc_acpi_mach_params *mach_params) num_route =ARRAY_SIZE (skl_hda_map); card->dapm_widgets = skl_hda_widgets; card->num_dapm_widgets =ARRAY_SIZE (skl_hda_widgets); -if (!idisp_mask) { +if (!ctx->idisp_codec) {for (i =0 ; i <IDISP_DAI_COUNT ; i++) { skl_hda_be_dai_links[i].codecs = dummy_codec; skl_hda_be_dai_links[i].num_codecs =
@@ -211,6 +215,8 @@ static int skl_hda_audio_probe(struct platform_device *pdev)if (!mach)return -EINVAL ; +snd_soc_card_set_drvdata (&hda_soc_card, ctx); + ret =skl_hda_fill_card_info (&mach->mach_params);if (ret <0 ) {dev_err (&pdev->dev,"Unsupported HDAudio/iDisp configuration found\n" );
@@ -223,7 +229,6 @@ static int skl_hda_audio_probe(struct platform_device *pdev) ctx->common_hdmi_codec_drv = mach->mach_params.common_hdmi_codec_drv; hda_soc_card.dev = &pdev->dev; -snd_soc_card_set_drvdata (&hda_soc_card, ctx);if (mach->mach_params.dmic_num >0 ) { snprintf(hda_soc_components, sizeof(hda_soc_components),
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/255 ALSA: hda/hdmi: Add quirk to force connectivity
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit cd72c317a0a11f64225b9a3f1fe503bb8c7327b5 ]
HDMI on some platforms doesn't enable audio support because its Port Connectivity [31:30] is set to AC_JACK_PORT_NONE:
Node 0x05 [Pin Complex] wcaps 0x40778d: 8-Channels Digital Amp-Out CP
Amp-Out caps: ofs=0x00, nsteps=0x00, stepsize=0x00, mute=1 Amp-Out vals: [0x00 0x00]
Pincap 0x0b000094: OUT Detect HBR HDMI DP
Pin Default 0x58560010: [N/A] Digital Out at Int HDMI
Conn = Digital, Color = Unknown
DefAssociation = 0x1, Sequence = 0x0
Pin-ctls: 0x40: OUT
Unsolicited: tag=00, enabled=0
Power states: D0 D3 EPSS
Power: setting=D0, actual=D0
Devices: 0
Connection: 3
0x02 0x03* 0x04
For now, use a quirk to force connectivity based on SSID. If there are more platforms affected by the same issue, we can eye for a more generic solution.
--- sound/pci/hda/patch_hdmi.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
sound/pci/hda/patch_hdmi.c +15 -1
@@ -160,6 +160,7 @@ struct hdmi_spec {bool use_acomp_notifier;/* use eld_notify callback for hotplug */ bool acomp_registered;/* audio component registered in this driver */ +bool force_connect;/* force connectivity */ struct drm_audio_component_audio_ops drm_audio_ops;int (*port2pin)(struct hda_codec *,int );/* reverse port/pin mapping */
@@ -1701,7 +1702,8 @@ static int hdmi_add_pin(struct hda_codec *codec, hda_nid_t pin_nid)* all device entries on the same pin */ config =snd_hda_codec_get_pincfg (codec, pin_nid); -if (get_defcfg_connect (config) ==AC_JACK_PORT_NONE ) +if (get_defcfg_connect (config) ==AC_JACK_PORT_NONE && + !spec->force_connect)return 0 ;/*
@@ -1803,11 +1805,18 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid)return 0 ; } +static const struct snd_pci_quirk force_connect_list[] = { +SND_PCI_QUIRK (0x103c ,0x871a ,"HP" ,1 ), + {} +}; +static int hdmi_parse_codec (struct hda_codec *codec) { +struct hdmi_spec *spec = codec->spec;hda_nid_t start_nid;unsigned int caps;int i, nodes; +const struct snd_pci_quirk *q; nodes =snd_hda_get_sub_nodes (codec, codec->core.afg, &start_nid);if (!start_nid || nodes <0 ) {
@@ -1815,6 +1824,11 @@ static int hdmi_parse_codec(struct hda_codec *codec)return -EINVAL ; } + q =snd_pci_quirk_lookup (codec->bus->pci, force_connect_list); + +if (q && q->value) + spec->force_connect = true; +/* * hdmi_add_pin() assumes total amount of converters to * be known, so first discover all converters
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/255 ALSA: pci: delete repeated words in comments
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit c7fabbc51352f50cc58242a6dc3b9c1a3599849b ]
Drop duplicated words in sound/pci/.
{and, the, at}
--- sound/pci/cs46xx/cs46xx_lib.c | 2 +- sound/pci/cs46xx/dsp_spos_scb_lib.c | 2 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/hda/hda_generic.c | 2 +- sound/pci/hda/patch_sigmatel.c | 2 +- sound/pci/ice1712/prodigy192.c | 2 +- sound/pci/oxygen/xonar_dg.c | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-)
sound/pci/cs46xx/cs46xx_lib.c +1 -1
@@ -766,7 +766,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned rate =48000 /9 ;/* -* We can not capture at at rate greater than the Input Rate (48000). +* We can not capture at a rate greater than the Input Rate (48000). * Return an error if an attempt is made to stray outside that limit. */ if (rate >48000 )
sound/pci/cs46xx/dsp_spos_scb_lib.c +1 -1
@@ -1716,7 +1716,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip)struct dsp_spos_instance * ins = chip->dsp_spos_instance;if ( ins->spdif_status_out &DSP_SPDIF_STATUS_OUTPUT_ENABLED ) { -/* remove AsynchFGTxSCB and and PCMSerialInput_II */ +/* remove AsynchFGTxSCB and PCMSerialInput_II */ cs46xx_dsp_disable_spdif_out (chip);/* save state */
sound/pci/hda/hda_codec.c +1 -1
@@ -3427,7 +3427,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save);* @nid: NID to check / update * * Check whether the given NID is in the amp list. If it's in the list, -* check the current AMP status, and update the the power-status according +* check the current AMP status, and update the power-status according * to the mute status. * * This function is supposed to be set or called from the check_power_status
sound/pci/hda/hda_generic.c +1 -1
@@ -813,7 +813,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path, } } -/* sync power of each widget in the the given path */ +/* sync power of each widget in the given path */ static hda_nid_t path_power_update (struct hda_codec *codec,struct nid_path *path,bool allow_powerdown)
sound/pci/hda/patch_sigmatel.c +1 -1
@@ -832,7 +832,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec,static const struct snd_kcontrol_new beep_vol_ctl =HDA_CODEC_VOLUME (NULL ,0 ,0 ,0 ); -/* check for mute support for the the amp */ +/* check for mute support for the amp */ if ((caps &AC_AMPCAP_MUTE ) >>AC_AMPCAP_MUTE_SHIFT ) {const struct snd_kcontrol_new *temp;if (spec->anabeep_nid == nid)
sound/pci/ice1712/prodigy192.c +1 -1
@@ -32,7 +32,7 @@* Experimentally I found out that only a combination of * OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 - * VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct -* sampling rate. That means the the FPGA doubles the +* sampling rate. That means that the FPGA doubles the * MCK01 rate. * * Copyright (c) 2003 Takashi Iwai <[email protected]>
sound/pci/oxygen/xonar_dg.c +1 -1
@@ -29,7 +29,7 @@* GPIO 4 <- headphone detect * GPIO 5 -> enable ADC analog circuit for the left channel * GPIO 6 -> enable ADC analog circuit for the right channel -* GPIO 7 -> switch green rear output jack between CS4245 and and the first +* GPIO 7 -> switch green rear output jack between CS4245 and the first * channel of CS4361 (mechanical relay) * GPIO 8 -> enable output to speakers *
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/255 ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit e2d2fded6bdf3f7bb40718a208140dba8b4ec574 ]
The jack on Intel NUC 8 Rugged rear panel doesn't work.
The spec [1] states that the jack supports both headphone and microphone, so override a Pin Complex which has both Amp-In and Amp-Out to make the jack work.
Node 0x1b fits the requirement, and user confirmed the jack now works with new pin config.
[1] https://www.intel.com/content/dam/support/us/en/documents/mini-pcs/NUC8CCH_TechProdSpec.pdf
--- sound/pci/hda/patch_realtek.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/pci/hda/patch_realtek.c +11 -0
@@ -6167,6 +6167,7 @@ enum {ALC269_FIXUP_CZC_L101 ,ALC269_FIXUP_LEMOTE_A1802 ,ALC269_FIXUP_LEMOTE_A190X , + ALC256_FIXUP_INTEL_NUC8_RUGGED, }; static const struct hda_fixup alc269_fixups[] = {
@@ -7488,6 +7489,15 @@ static const struct hda_fixup alc269_fixups[] = { }, .chain_id = ALC269_FIXUP_DMIC, }, + [ALC256_FIXUP_INTEL_NUC8_RUGGED] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x1b ,0x01a1913c },/* use as headset mic, without its own jack detect */ + { } + }, + .chained = true, + .chain_id =ALC269_FIXUP_HEADSET_MODE + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7787,6 +7797,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x10ec ,0x118c ,"Medion EE4254 MD62100" ,ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE ),SND_PCI_QUIRK (0x1c06 ,0x2013 ,"Lemote A1802" ,ALC269_FIXUP_LEMOTE_A1802 ),SND_PCI_QUIRK (0x1c06 ,0x2015 ,"Lemote A190X" ,ALC269_FIXUP_LEMOTE_A190X ), +SND_PCI_QUIRK (0x8086 ,0x2080 ,"Intel NUC 8 Rugged" ,ALC256_FIXUP_INTEL_NUC8_RUGGED ), #if 0/* Below is a quirk table taken from the old code.
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/255 ALSA: hda/hdmi: Use force connectivity quirk on another HP desktop
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit d96f27c80b65437a7b572647ecb4717ec9a50c98 ]
There's another HP desktop has buggy BIOS which flags the Port Connectivity bit as no connection.
Apply force connectivity quirk to enable DP/HDMI audio.
--- sound/pci/hda/patch_hdmi.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_hdmi.c +1 -0
@@ -1806,6 +1806,7 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid) }static const struct snd_pci_quirk force_connect_list[] = { +SND_PCI_QUIRK (0x103c ,0x870f ,"HP" ,1 ),SND_PCI_QUIRK (0x103c ,0x871a ,"HP" ,1 ), {} };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/255 drm/amdgpu: fix RAS memory leak in error case
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
[ Upstream commit 5e91160ac0b5cfbbaeb62cbff8b069262095f744 ]
RAS context memory needs to freed in failure case.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +10 -9
@@ -1914,9 +1914,8 @@ int amdgpu_ras_init(struct amdgpu_device *adev)amdgpu_ras_check_supported (adev, &con->hw_supported, &con->supported);if (!con->hw_supported) { -amdgpu_ras_set_context (adev,NULL ); -kfree (con); -return 0 ; + r =0 ; + goto err_out; } con->features =0 ;
@@ -1927,29 +1926,31 @@ int amdgpu_ras_init(struct amdgpu_device *adev)if (adev->nbio.funcs->init_ras_controller_interrupt) { r = adev->nbio.funcs->init_ras_controller_interrupt (adev);if (r) -return r; + goto err_out; }if (adev->nbio.funcs->init_ras_err_event_athub_interrupt) { r = adev->nbio.funcs->init_ras_err_event_athub_interrupt (adev);if (r) -return r; + goto err_out; } amdgpu_ras_mask &=AMDGPU_RAS_BLOCK_MASK ; -if (amdgpu_ras_fs_init (adev)) - goto fs_out; +if (amdgpu_ras_fs_init (adev)) { + r = -EINVAL ; + goto err_out; + }dev_info (adev->dev,"RAS INFO: ras initialized successfully, " "hardware ability[%x] ras_mask[%x]\n" , con->hw_supported, con->supported);return 0 ; -fs_out: +err_out:amdgpu_ras_set_context (adev,NULL );kfree (con); -return -EINVAL ; +return r; }/* helper function to handle common stuff in ip late init phase */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/255 EDAC/mc: Call edac_inc_ue_error() before panic
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
[ Upstream commit e9ff6636d3f97a764487999754c0bfee9d2c231e ]
By calling edac_inc_ue_error() before panic, we get a correct UE error count for core dump analysis.
--- drivers/edac/edac_mc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/edac/edac_mc.c +2 -2
@@ -950,6 +950,8 @@ static void edac_ue_error(struct edac_raw_error_desc *e) e->other_detail); } +edac_inc_ue_error (e); +if (edac_mc_get_panic_on_ue ()) { panic("UE %s%son %s (%s page:0x%lx offset:0x%lx grain:%ld%s%s)\n", e->msg,
@@ -959,8 +961,6 @@ static void edac_ue_error(struct edac_raw_error_desc *e) *e->other_detail ?" - " :"" , e->other_detail); } - -edac_inc_ue_error (e); }static void edac_inc_csrow (struct edac_raw_error_desc *e,int row,int chan)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/255 ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit c4c59b95b7f7d4cef5071b151be2dadb33f3287b ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code, causing incorrect ref count if pm_runtime_put_noidle() is not called in error handling paths. Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
--- sound/soc/img/img-i2s-in.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/img/img-i2s-in.c +3 -1
@@ -343,8 +343,10 @@ static int img_i2s_in_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) chan_control_mask =IMG_I2S_IN_CH_CTL_CLK_TRANS_MASK ; ret =pm_runtime_get_sync (i2s->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (i2s->dev);return ret; + }for (i =0 ; i < i2s->active_channels; i++)img_i2s_in_ch_disable (i2s, i);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/255 ASoC: img-parallel-out: Fix a reference count leak
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit 6b9fbb073636906eee9fe4d4c05a4f445b9e2a23 ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code, causing incorrect ref count if pm_runtime_put_noidle() is not called in error handling paths. Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
--- sound/soc/img/img-parallel-out.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/img/img-parallel-out.c +3 -1
@@ -163,8 +163,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) } ret =pm_runtime_get_sync (prl->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (prl->dev);return ret; + } reg =img_prl_out_readl (prl,IMG_PRL_OUT_CTL ); reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK ) | control_set;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 11/255 ASoC: tegra: Fix reference count leaks.
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit deca195383a6085be62cb453079e03e04d618d6e ]
Calling pm_runtime_get_sync increments the counter even in case of failure, causing incorrect ref count if pm_runtime_put is not called in error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.
--- sound/soc/tegra/tegra30_ahub.c | 4 +++- sound/soc/tegra/tegra30_i2s.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-)
sound/soc/tegra/tegra30_ahub.c +3 -1
@@ -643,8 +643,10 @@ static int tegra30_ahub_resume(struct device *dev)int ret; ret =pm_runtime_get_sync (dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put (dev);return ret; + } ret =regcache_sync (ahub->regmap_ahub); ret |=regcache_sync (ahub->regmap_apbif);pm_runtime_put (dev);
sound/soc/tegra/tegra30_i2s.c +3 -1
@@ -567,8 +567,10 @@ static int tegra30_i2s_resume(struct device *dev)int ret; ret =pm_runtime_get_sync (dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put (dev);return ret; + } ret =regcache_sync (i2s->regmap);pm_runtime_put (dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 12/255 mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 3ea2e4eab64cefa06055bb0541fcdedad4b48565 ]
Intel Emmitsburg PCH has the same LPSS than Intel Ice Lake. Add the new IDs to the list of supported devices.
--- drivers/mfd/intel-lpss-pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mfd/intel-lpss-pci.c +3 -0
@@ -201,6 +201,9 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { { PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_info }, { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info }, { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info }, +/* EBG */ + { PCI_VDEVICE(INTEL, 0x1bad), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x1bae), (kernel_ulong_t)&bxt_uart_info },/* GLK */ { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info }, { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 13/255 arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit e2ee9edc282961783d519c760bbaa20fed4dec38 ]
The original qcom kernel changed the PDM GPIOs to be pull-down during sleep at some point. Reportedly this was done because there was some "leakage at PDM outputs during sleep":
I cannot say how effective this is, but everything seems to work fine with this change so let's apply the same to mainline just to be sure.
--- arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8916-pins.dtsi +1 -1
@@ -569,7 +569,7 @@ pins = "gpio63", "gpio64", "gpio65", "gpio66", "gpio67", "gpio68"; drive-strength = <2>; - bias-disable; + bias-pull-down; }; }; };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 14/255 powerpc/xive: Ignore kmemleak false positives
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
[ Upstream commit f0993c839e95dd6c7f054a1015e693c87e33e4fb ]
xive_native_provision_pages() allocates memory and passes the pointer to OPAL so kmemleak cannot find the pointer usage in the kernel memory and produces a false positive report (below) (even if the kernel did scan OPAL memory, it is unable to deal with __pa() addresses anyway).
This silences the warning.
unreferenced object 0xc000200350c40000 (size 65536):
comm "qemu-system-ppc", pid 2725, jiffies 4294946414 (age 70776.530s) hex dump (first 32 bytes):
02 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 ....P...........
01 00 08 07 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000081ff046c>] xive_native_alloc_vp_block+0x120/0x250
[<00000000d555d524>] kvmppc_xive_compute_vp_id+0x248/0x350 [kvm]
[<00000000d69b9c9f>] kvmppc_xive_connect_vcpu+0xc0/0x520 [kvm]
[<000000006acbc81c>] kvm_arch_vcpu_ioctl+0x308/0x580 [kvm]
[<0000000089c69580>] kvm_vcpu_ioctl+0x19c/0xae0 [kvm]
[<00000000902ae91e>] ksys_ioctl+0x184/0x1b0
[<00000000f3e68bd7>] sys_ioctl+0x48/0xb0
[<0000000001b2c127>] system_call_exception+0x124/0x1f0
[<00000000d2b2ee40>] system_call_common+0xe8/0x214--- arch/powerpc/sysdev/xive/native.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/sysdev/xive/native.c +2 -0
@@ -18,6 +18,7 @@#include <linux/delay.h> #include <linux/cpumask.h> #include <linux/mm.h> +#include <linux/kmemleak.h> #include <asm/machdep.h> #include <asm/prom.h>
@@ -647,6 +648,7 @@ static bool xive_native_provision_pages(void)pr_err ("Failed to allocate provisioning page\n" );return false; } +kmemleak_ignore (p);opal_xive_donate_page (chip,__pa (p)); }return true;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 15/255 media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
The value av7110->debi_virt is stored in DMA memory, and it is assigned to data, and thus data[0] can be modified at any time by malicious hardware. In this case, "if (data[0] < 2)" can be passed, but then data[0] can be changed into a large number, which may cause buffer overflow when the code "av7110->ci_slot[data[0]]" is used.
To fix this possible bug, data[0] is assigned to a local variable, which replaces the use of data[0].
--- drivers/media/pci/ttpci/av7110.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/pci/ttpci/av7110.c +3 -2
@@ -406,14 +406,15 @@ static void debiirq(unsigned long cookie)case DATA_CI_GET : {u8 *data = av7110->debi_virt; +u8 data_0 = data[0 ]; -if ((data[0 ] <2 ) && data[2 ] ==0xff ) { +if (data_0 <2 && data[2 ] ==0xff ) {int flags =0 ;if (data[5 ] >0 ) flags |=CA_CI_MODULE_PRESENT ;if (data[5 ] >5 ) flags |=CA_CI_MODULE_READY ; - av7110->ci_slot[data[0 ]].flags = flags; + av7110->ci_slot[data_0].flags = flags; }else ci_get_data(&av7110->ci_rbuffer, av7110->debi_virt,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 16/255 gcc-plugins/stackleak: Dont instrument itself
In reply to Greg Kroah-HartmanFrom: Alexander Popov <[email protected]>
[ Upstream commit 005e696df65d0ff90468ecf38a50aa584dc82421 ]
There is no need to try instrumenting functions in kernel/stackleak.c. Otherwise that can cause issues if the cleanup pass of stackleak gcc plugin is disabled.
--- kernel/Makefile | 1 + 1 file changed, 1 insertion(+)
kernel/Makefile +1 -0
@@ -125,6 +125,7 @@ obj-$(CONFIG_WATCH_QUEUE) += watch_queue.o obj-$(CONFIG_SYSCTL_KUNIT_TEST) += sysctl-test.o +CFLAGS_stackleak.o += $(DISABLE_STACKLEAK_PLUGIN) obj-$(CONFIG_GCC_PLUGIN_STACKLEAK) += stackleak.o KASAN_SANITIZE_stackleak.o := n KCSAN_SANITIZE_stackleak.o := n
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 17/255 blktrace: ensure our debugfs dir exists
In reply to Greg Kroah-HartmanFrom: Luis Chamberlain <[email protected]>
[ Upstream commit b431ef837e3374da0db8ff6683170359aaa0859c ]
We make an assumption that a debugfs directory exists, but since this can fail ensure it exists before allowing blktrace setup to complete. Otherwise we end up stuffing blktrace files on the debugfs root directory. In the worst case scenario this *in theory* can create an eventual panic *iff* in the future a similarly named file is created prior on the debugfs root directory. This theoretical crash can happen due to a recursive removal followed by a specific dentry removal.
This doesn't fix any known crash, however I have seen the files go into the main debugfs root directory in cases where the debugfs directory was not created due to other internal bugs with blktrace now fixed.
blktrace is also completely useless without this directory, so this ensures to userspace we only setup blktrace if the kernel can stuff files where they are supposed to go into.
debugfs directory creations typically aren't checked for, and we have maintainers doing sweep removals of these checks, but since we need this check to ensure proper userspace blktrace functionality we make sure to annotate the justification for the check.
--- kernel/trace/blktrace.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
kernel/trace/blktrace.c +12 -0
@@ -536,6 +536,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,#endif bt->dir = dir =debugfs_create_dir (buts->name, blk_debugfs_root); +/* +* As blktrace relies on debugfs for its interface the debugfs directory +* is required, contrary to the usual mantra of not checking for debugfs +* files or directories. +*/ +if (IS_ERR_OR_NULL (dir)) { +pr_warn ("debugfs_dir not present for %s so skipping\n" , + buts->name); + ret = -ENOENT ; + goto err; + } + bt->dev = dev;atomic_set (&bt->dropped,0 );INIT_LIST_HEAD (&bt->running_list);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 18/255 staging: rts5208: fix memleaks on error handling paths in probe
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 11507bf9a8832741db69efd32bf09a2ab26426bf ]
rtsx_probe() allocates host, but does not free it on error handling paths. The patch adds missed scsi_host_put().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/staging/rts5208/rtsx.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/rts5208/rtsx.c +1 -0
@@ -972,6 +972,7 @@ ioremap_fail:kfree (dev->chip); chip_alloc_fail:dev_err (&pci->dev,"%s failed\n" , __func__); +scsi_host_put (host); scsi_host_alloc_fail:pci_release_regions (pci);return err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 19/255 scsi: target: tcmu: Fix crash on ARM during cmd completion
In reply to Greg Kroah-HartmanFrom: Bodo Stroesser <[email protected]>
[ Upstream commit 5a0c256d96f020e4771f6fd5524b80f89a2d3132 ]
If tcmu_handle_completions() has to process a padding shorter than sizeof(struct tcmu_cmd_entry), the current call to tcmu_flush_dcache_range() with sizeof(struct tcmu_cmd_entry) as length param is wrong and causes crashes on e.g. ARM, because tcmu_flush_dcache_range() in this case calls flush_dcache_page(vmalloc_to_page(start)); with start being an invalid address above the end of the vmalloc'ed area.
The fix is to use the minimum of remaining ring space and sizeof(struct tcmu_cmd_entry) as the length param.
The patch was tested on kernel 4.19.118.
See https://bugzilla.kernel.org/show_bug.cgi?id=208045#c10
--- drivers/target/target_core_user.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/target/target_core_user.c +8 -1
@@ -1220,7 +1220,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)struct tcmu_cmd_entry *entry = (void *) mb +CMDR_OFF + udev->cmdr_last_cleaned; -tcmu_flush_dcache_range (entry,sizeof (*entry)); +/* +* Flush max. up to end of cmd ring since current entry might +* be a padding that is shorter than sizeof(*entry) +*/ +size_t ring_left =head_to_end (udev->cmdr_last_cleaned, + udev->cmdr_size); +tcmu_flush_dcache_range (entry, ring_left <sizeof (*entry) ? + ring_left :sizeof (*entry));if (tcmu_hdr_get_op (entry->hdr.len_op) ==TCMU_OP_PAD ) { UPDATE_HEAD(udev->cmdr_last_cleaned,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 20/255 mfd: intel-lpss: Add Intel Tiger Lake PCH-H PCI IDs
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit bb7fcad48d3804d814b97c785514e2d1657e157f ]
Intel Tiger Lake PCH-H has the same LPSS than Intel Broxton. Add the new IDs to the list of supported devices.
--- drivers/mfd/intel-lpss-pci.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/mfd/intel-lpss-pci.c +16 -0
@@ -233,6 +233,22 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { { PCI_VDEVICE(INTEL, 0x34ea), (kernel_ulong_t)&bxt_i2c_info }, { PCI_VDEVICE(INTEL, 0x34eb), (kernel_ulong_t)&bxt_i2c_info }, { PCI_VDEVICE(INTEL, 0x34fb), (kernel_ulong_t)&spt_info }, +/* TGL-H */ + { PCI_VDEVICE(INTEL, 0x43a7), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x43a8), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x43a9), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x43aa), (kernel_ulong_t)&bxt_info }, + { PCI_VDEVICE(INTEL, 0x43ab), (kernel_ulong_t)&bxt_info }, + { PCI_VDEVICE(INTEL, 0x43ad), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x43ae), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x43d8), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x43da), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x43e8), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x43e9), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x43ea), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x43eb), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x43fb), (kernel_ulong_t)&bxt_info }, + { PCI_VDEVICE(INTEL, 0x43fd), (kernel_ulong_t)&bxt_info },/* EHL */ { PCI_VDEVICE(INTEL, 0x4b28), (kernel_ulong_t)&bxt_uart_info }, { PCI_VDEVICE(INTEL, 0x4b29), (kernel_ulong_t)&bxt_uart_info },
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 21/255 iommu/iova: Dont BUG on invalid PFNs
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit d3e3d2be688b4b5864538de61e750721a311e4fc ]
Unlike the other instances which represent a complete loss of consistency within the rcache mechanism itself, or a fundamental and obvious misconfiguration by an IOMMU driver, the BUG_ON() in iova_magazine_free_pfns() can be provoked at more or less any time in a "spooky action-at-a-distance" manner by any old device driver passing nonsense to dma_unmap_*() which then propagates through to queue_iova().
Not only is this well outside the IOVA layer's control, it's also nowhere near fatal enough to justify panicking anyway - all that really achieves is to make debugging the offending driver more difficult. Let's simply WARN and otherwise ignore bogus PFNs.
--- drivers/iommu/iova.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iommu/iova.c +3 -1
@@ -811,7 +811,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad)for (i =0 ; i < mag->size; ++i) {struct iova *iova =private_find_iova (iovad, mag->pfns[i]); -BUG_ON (!iova); +if (WARN_ON (!iova)) +continue ; +private_free_iova (iovad, iova); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 22/255 platform/chrome: cros_ec_sensorhub: Fix EC timestamp overflow
In reply to Greg Kroah-HartmanFrom: Gwendal Grignou <[email protected]>
[ Upstream commit e48bc01ed5adec203676c735365373b31c3c7600 ]
EC is using 32 bit timestamps (us), and before converting it to 64bit they were not casted, so it would overflow every 4s. Regular overflow every ~70 minutes was not taken into account either.
--- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/platform/chrome/cros_ec_sensorhub_ring.c +1 -3
@@ -419,9 +419,7 @@ cros_ec_sensor_ring_process_event(struct cros_ec_sensorhub *sensorhub,* Disable filtering since we might add more jitter * if b is in a random point in time. */ - new_timestamp = fifo_timestamp - - fifo_info->timestamp *1000 + - in->timestamp *1000 ; + new_timestamp = c - b *1000 + a *1000 ;/* * The timestamp can be stale if we had to use the fifo * info timestamp.
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 23/255 drm/amdkfd: Fix reference count leaks.
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit 20eca0123a35305e38b344d571cf32768854168c ]
kobject_init_and_add() takes reference even when it fails. If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object.
--- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_topology.c +15 -5
@@ -632,8 +632,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, ret =kobject_init_and_add (dev->kobj_node, &node_type, sys_props.kobj_nodes,"%d" , id); -if (ret <0 ) +if (ret <0 ) { +kobject_put (dev->kobj_node);return ret; + } dev->kobj_mem =kobject_create_and_add ("mem_banks" , dev->kobj_node);if (!dev->kobj_mem)
@@ -680,8 +682,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,return -ENOMEM ; ret =kobject_init_and_add (mem->kobj, &mem_type, dev->kobj_mem,"%d" , i); -if (ret <0 ) +if (ret <0 ) { +kobject_put (mem->kobj);return ret; + } mem->attr.name ="properties" ; mem->attr.mode =KFD_SYSFS_FILE_MODE ;
@@ -699,8 +703,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,return -ENOMEM ; ret =kobject_init_and_add (cache->kobj, &cache_type, dev->kobj_cache,"%d" , i); -if (ret <0 ) +if (ret <0 ) { +kobject_put (cache->kobj);return ret; + } cache->attr.name ="properties" ; cache->attr.mode =KFD_SYSFS_FILE_MODE ;
@@ -718,8 +724,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,return -ENOMEM ; ret =kobject_init_and_add (iolink->kobj, &iolink_type, dev->kobj_iolink,"%d" , i); -if (ret <0 ) +if (ret <0 ) { +kobject_put (iolink->kobj);return ret; + } iolink->attr.name ="properties" ; iolink->attr.mode =KFD_SYSFS_FILE_MODE ;
@@ -798,8 +806,10 @@ static int kfd_topology_update_sysfs(void) ret =kobject_init_and_add (sys_props.kobj_topology, &sysprops_type, &kfd_device->kobj,"topology" ); -if (ret <0 ) +if (ret <0 ) { +kobject_put (sys_props.kobj_topology);return ret; + } sys_props.kobj_nodes =kobject_create_and_add ("nodes" , sys_props.kobj_topology);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 24/255 drm/radeon: fix multiple reference count leak
In reply to Greg Kroah-HartmanFrom: Aditya Pakki <[email protected]>
[ Upstream commit 6f2e8acdb48ed166b65d47837c31b177460491ec ]
On calling pm_runtime_get_sync() the reference count of the device is incremented. In case of failure, decrement the reference count before returning the error.
--- drivers/gpu/drm/radeon/radeon_connectors.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/gpu/drm/radeon/radeon_connectors.c +15 -5
@@ -879,8 +879,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } }if (encoder) {
@@ -1025,8 +1027,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } } encoder =radeon_best_single_encoder (connector);
@@ -1163,8 +1167,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } } encoder =radeon_best_single_encoder (connector);
@@ -1247,8 +1253,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } }if (radeon_connector->detected_hpd_without_ddc) {
@@ -1657,8 +1665,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } }if (!force &&radeon_check_hpd_status_unchanged (connector)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 25/255 drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit 9ba8923cbbe11564dd1bf9f3602add9a9cfbb5c6 ]
in amdgpu_driver_open_kms the call to pm_runtime_get_sync increments the counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +2 -1
@@ -992,7 +992,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) r =pm_runtime_get_sync (dev->dev);if (r <0 ) -return r; + goto pm_put; fpriv =kzalloc (sizeof (*fpriv),GFP_KERNEL );if (unlikely (!fpriv)) {
@@ -1043,6 +1043,7 @@ error_pasid: out_suspend:pm_runtime_mark_last_busy (dev->dev); +pm_put:pm_runtime_put_autosuspend (dev->dev);return r;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 26/255 drm/amd/display: fix ref count leak in amdgpu_drm_ioctl
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit 5509ac65f2fe5aa3c0003237ec629ca55024307c ]
in amdgpu_drm_ioctl the call to pm_runtime_get_sync increments the counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +2 -1
@@ -1373,11 +1373,12 @@ long amdgpu_drm_ioctl(struct file *filp, dev = file_priv->minor->dev; ret =pm_runtime_get_sync (dev->dev);if (ret <0 ) -return ret; + goto out; ret =drm_ioctl (filp, cmd, arg);pm_runtime_mark_last_busy (dev->dev); +out:pm_runtime_put_autosuspend (dev->dev);return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 27/255 drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit e008fa6fb41544b63973a529b704ef342f47cc65 ]
in amdgpu_display_crtc_set_config, the call to pm_runtime_get_sync increments the counter even in case of failure, leading to incorrect ref count. In case of failure, decrement the ref count before returning.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +3 -2
@@ -282,7 +282,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set, ret =pm_runtime_get_sync (dev->dev);if (ret <0 ) -return ret; + goto out; ret =drm_crtc_helper_set_config (set, ctx);
@@ -297,7 +297,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,take the current one */ if (active && !adev->have_disp_power_ref) { adev->have_disp_power_ref = true; -return ret; + goto out; }/* if we have no active crtcs, then drop the power ref we got before */
@@ -306,6 +306,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set, adev->have_disp_power_ref = false; } +out:/* drop the power reference we got coming in here */ pm_runtime_put_autosuspend (dev->dev);return ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 28/255 drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit f79f94765f8c39db0b7dec1d335ab046aac03f20 ]
The call to pm_runtime_get_sync increments the counter even in case of failure, leading to incorrect ref count.
In case of failure, decrement the ref count before returning.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +12 -4
@@ -716,8 +716,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } }if (encoder) {
@@ -854,8 +856,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } } encoder =amdgpu_connector_best_single_encoder (connector);
@@ -977,8 +981,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } }if (!force &&amdgpu_connector_check_hpd_status_unchanged (connector)) {
@@ -1328,8 +1334,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)if (!drm_kms_helper_is_poll_worker ()) { r =pm_runtime_get_sync (connector->dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (connector->dev->dev);return connector_status_disconnected; + } }if (!force &&amdgpu_connector_check_hpd_status_unchanged (connector)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 29/255 drm/amdgpu/fence: fix ref count leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
[ Upstream commit e520d3e0d2818aafcdf9d8b60916754d8fedc366 ]
The call to pm_runtime_get_sync increments the counter even in case of failure, leading to incorrect ref count.
In case of failure, decrement the ref count before returning.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +3 -1
@@ -754,8 +754,10 @@ static int amdgpu_debugfs_gpu_recover(struct seq_file *m, void *data)int r; r =pm_runtime_get_sync (dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (dev->dev);return 0 ; + }seq_printf (m,"gpu recover\n" );amdgpu_device_gpu_recover (adev,NULL );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 30/255 drm/amdkfd: fix ref count leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
[ Upstream commit 1c1ada37af6ee6fb9cfc8da6a56cc83208cd8d6f ]
The call to pm_runtime_get_sync increments the counter even in case of failure, leading to incorrect ref count.
In case of failure, decrement the ref count before returning.
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +3 -1
@@ -1003,8 +1003,10 @@ struct kfd_process_device *kfd_bind_process_to_device(struct kfd_dev *dev,*/ if (!pdd->runtime_inuse) { err =pm_runtime_get_sync (dev->ddev->dev); -if (err <0 ) +if (err <0 ) { +pm_runtime_put_autosuspend (dev->ddev->dev);return ERR_PTR (err); + } } err =kfd_iommu_bind_process_to_device (pdd);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 31/255 drm/amdgpu/pm: fix ref count leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
[ Upstream commit 66429300e1bd9cdfbe96cfc475e4964db2a36921 ]
The call to pm_runtime_get_sync increments the counter even in case of failure, leading to incorrect ref count.
In case of failure, decrement the ref count before returning.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 220 ++++++++++++++++++------- 1 file changed, 165 insertions(+), 55 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +165 -55
@@ -167,8 +167,10 @@ static ssize_t amdgpu_get_power_dpm_state(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) {if (adev->smu.ppt_funcs->get_current_power_state)
@@ -212,8 +214,10 @@ static ssize_t amdgpu_set_power_dpm_state(struct device *dev,return -EINVAL ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) {mutex_lock (&adev->pm.mutex);
@@ -307,8 +311,10 @@ static ssize_t amdgpu_get_power_dpm_force_performance_level(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) level =smu_get_performance_level (&adev->smu);
@@ -369,8 +375,10 @@ static ssize_t amdgpu_set_power_dpm_force_performance_level(struct device *dev, } ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) current_level =smu_get_performance_level (&adev->smu);
@@ -449,8 +457,10 @@ static ssize_t amdgpu_get_pp_num_states(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { ret =smu_get_power_num_states (&adev->smu, &data);
@@ -491,8 +501,10 @@ static ssize_t amdgpu_get_pp_cur_state(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { pm =smu_get_current_power_state (smu);
@@ -567,8 +579,10 @@ static ssize_t amdgpu_set_pp_force_state(struct device *dev, state = data.states[idx]; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }/* only set user selected power states */ if (state != POWER_STATE_TYPE_INTERNAL_BOOT &&
@@ -608,8 +622,10 @@ static ssize_t amdgpu_get_pp_table(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { size =smu_sys_get_pp_table (&adev->smu, (void **)&table);
@@ -650,8 +666,10 @@ static ssize_t amdgpu_set_pp_table(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { ret =smu_sys_set_pp_table (&adev->smu, (void *)buf, count);
@@ -790,8 +808,10 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev, } ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { ret = smu_od_edit_dpm_table(&adev->smu, type,
@@ -847,8 +867,10 @@ static ssize_t amdgpu_get_pp_od_clk_voltage(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { size =smu_print_clk_levels (&adev->smu,SMU_OD_SCLK , buf);
@@ -905,8 +927,10 @@ static ssize_t amdgpu_set_pp_features(struct device *dev,pr_debug ("featuremask = 0x%llx\n" , featuremask); ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { ret =smu_sys_set_pp_feature_mask (&adev->smu, featuremask);
@@ -942,8 +966,10 @@ static ssize_t amdgpu_get_pp_features(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) size =smu_sys_get_pp_feature_mask (&adev->smu, buf);
@@ -1001,8 +1027,10 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) size =smu_print_clk_levels (&adev->smu,SMU_SCLK , buf);
@@ -1071,8 +1099,10 @@ static ssize_t amdgpu_set_pp_dpm_sclk(struct device *dev,return ret; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) ret =smu_force_clk_levels (&adev->smu,SMU_SCLK , mask, true);
@@ -1101,8 +1131,10 @@ static ssize_t amdgpu_get_pp_dpm_mclk(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) size =smu_print_clk_levels (&adev->smu,SMU_MCLK , buf);
@@ -1135,8 +1167,10 @@ static ssize_t amdgpu_set_pp_dpm_mclk(struct device *dev,return ret; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) ret =smu_force_clk_levels (&adev->smu,SMU_MCLK , mask, true);
@@ -1165,8 +1199,10 @@ static ssize_t amdgpu_get_pp_dpm_socclk(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) size =smu_print_clk_levels (&adev->smu,SMU_SOCCLK , buf);
@@ -1199,8 +1235,10 @@ static ssize_t amdgpu_set_pp_dpm_socclk(struct device *dev,return ret; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) ret =smu_force_clk_levels (&adev->smu,SMU_SOCCLK , mask, true);
@@ -1231,8 +1269,10 @@ static ssize_t amdgpu_get_pp_dpm_fclk(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) size =smu_print_clk_levels (&adev->smu,SMU_FCLK , buf);
@@ -1265,8 +1305,10 @@ static ssize_t amdgpu_set_pp_dpm_fclk(struct device *dev,return ret; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) ret =smu_force_clk_levels (&adev->smu,SMU_FCLK , mask, true);
@@ -1297,8 +1339,10 @@ static ssize_t amdgpu_get_pp_dpm_dcefclk(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) size =smu_print_clk_levels (&adev->smu,SMU_DCEFCLK , buf);
@@ -1331,8 +1375,10 @@ static ssize_t amdgpu_set_pp_dpm_dcefclk(struct device *dev,return ret; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) ret =smu_force_clk_levels (&adev->smu,SMU_DCEFCLK , mask, true);
@@ -1363,8 +1409,10 @@ static ssize_t amdgpu_get_pp_dpm_pcie(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) size =smu_print_clk_levels (&adev->smu,SMU_PCIE , buf);
@@ -1397,8 +1445,10 @@ static ssize_t amdgpu_set_pp_dpm_pcie(struct device *dev,return ret; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) ret =smu_force_clk_levels (&adev->smu,SMU_PCIE , mask, true);
@@ -1429,8 +1479,10 @@ static ssize_t amdgpu_get_pp_sclk_od(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) value =smu_get_od_percentage (&(adev->smu),SMU_OD_SCLK );
@@ -1462,8 +1514,10 @@ static ssize_t amdgpu_set_pp_sclk_od(struct device *dev,return -EINVAL ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { value =smu_set_od_percentage (&(adev->smu),SMU_OD_SCLK , (uint32_t )value);
@@ -1498,8 +1552,10 @@ static ssize_t amdgpu_get_pp_mclk_od(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) value =smu_get_od_percentage (&(adev->smu),SMU_OD_MCLK );
@@ -1531,8 +1587,10 @@ static ssize_t amdgpu_set_pp_mclk_od(struct device *dev,return -EINVAL ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { value =smu_set_od_percentage (&(adev->smu),SMU_OD_MCLK , (uint32_t )value);
@@ -1587,8 +1645,10 @@ static ssize_t amdgpu_get_pp_power_profile_mode(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) size =smu_get_power_profile_mode (&adev->smu, buf);
@@ -1650,8 +1710,10 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev, parameter[parameter_size] = profile_mode; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }if (is_support_sw_smu (adev)) ret =smu_set_power_profile_mode (&adev->smu, parameter, parameter_size, true);
@@ -1687,8 +1749,10 @@ static ssize_t amdgpu_get_gpu_busy_percent(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return r; + }/* read the IP busy sensor */ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GPU_LOAD,
@@ -1723,8 +1787,10 @@ static ssize_t amdgpu_get_mem_busy_percent(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return r; + }/* read the IP busy sensor */ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_MEM_LOAD,
@@ -1770,8 +1836,10 @@ static ssize_t amdgpu_get_pcie_bw(struct device *dev,return -ENODATA ; ret =pm_runtime_get_sync (ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (ddev->dev);return ret; + }amdgpu_asic_get_pcie_usage (adev, &count0, &count1);
@@ -2003,8 +2071,10 @@ static ssize_t amdgpu_hwmon_show_temp(struct device *dev,return -EINVAL ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + }switch (channel) {case PP_TEMP_JUNCTION :
@@ -2134,8 +2204,10 @@ static ssize_t amdgpu_hwmon_get_pwm1_enable(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (adev->ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { pwm_mode =smu_get_fan_control_mode (&adev->smu);
@@ -2172,8 +2244,10 @@ static ssize_t amdgpu_hwmon_set_pwm1_enable(struct device *dev,return err; ret =pm_runtime_get_sync (adev->ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return ret; + }if (is_support_sw_smu (adev)) {smu_set_fan_control_mode (&adev->smu, value);
@@ -2220,8 +2294,10 @@ static ssize_t amdgpu_hwmon_set_pwm1(struct device *dev,return -EPERM ; err =pm_runtime_get_sync (adev->ddev->dev); -if (err <0 ) +if (err <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return err; + }if (is_support_sw_smu (adev)) pwm_mode =smu_get_fan_control_mode (&adev->smu);
@@ -2272,8 +2348,10 @@ static ssize_t amdgpu_hwmon_get_pwm1(struct device *dev,return -EPERM ; err =pm_runtime_get_sync (adev->ddev->dev); -if (err <0 ) +if (err <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return err; + }if (is_support_sw_smu (adev)) err =smu_get_fan_speed_percent (&adev->smu, &speed);
@@ -2305,8 +2383,10 @@ static ssize_t amdgpu_hwmon_get_fan1_input(struct device *dev,return -EPERM ; err =pm_runtime_get_sync (adev->ddev->dev); -if (err <0 ) +if (err <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return err; + }if (is_support_sw_smu (adev)) err =smu_get_fan_speed_rpm (&adev->smu, &speed);
@@ -2337,8 +2417,10 @@ static ssize_t amdgpu_hwmon_get_fan1_min(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + } r =amdgpu_dpm_read_sensor (adev,AMDGPU_PP_SENSOR_MIN_FAN_RPM , (void *)&min_rpm, &size);
@@ -2365,8 +2447,10 @@ static ssize_t amdgpu_hwmon_get_fan1_max(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + } r =amdgpu_dpm_read_sensor (adev,AMDGPU_PP_SENSOR_MAX_FAN_RPM , (void *)&max_rpm, &size);
@@ -2392,8 +2476,10 @@ static ssize_t amdgpu_hwmon_get_fan1_target(struct device *dev,return -EPERM ; err =pm_runtime_get_sync (adev->ddev->dev); -if (err <0 ) +if (err <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return err; + }if (is_support_sw_smu (adev)) err =smu_get_fan_speed_rpm (&adev->smu, &rpm);
@@ -2424,8 +2510,10 @@ static ssize_t amdgpu_hwmon_set_fan1_target(struct device *dev,return -EPERM ; err =pm_runtime_get_sync (adev->ddev->dev); -if (err <0 ) +if (err <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return err; + }if (is_support_sw_smu (adev)) pwm_mode =smu_get_fan_control_mode (&adev->smu);
@@ -2473,8 +2561,10 @@ static ssize_t amdgpu_hwmon_get_fan1_enable(struct device *dev,return -EPERM ; ret =pm_runtime_get_sync (adev->ddev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return ret; + }if (is_support_sw_smu (adev)) { pwm_mode =smu_get_fan_control_mode (&adev->smu);
@@ -2519,8 +2609,10 @@ static ssize_t amdgpu_hwmon_set_fan1_enable(struct device *dev,return -EINVAL ; err =pm_runtime_get_sync (adev->ddev->dev); -if (err <0 ) +if (err <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return err; + }if (is_support_sw_smu (adev)) {smu_set_fan_control_mode (&adev->smu, pwm_mode);
@@ -2551,8 +2643,10 @@ static ssize_t amdgpu_hwmon_show_vddgfx(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + }/* get the voltage */ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VDDGFX,
@@ -2590,8 +2684,10 @@ static ssize_t amdgpu_hwmon_show_vddnb(struct device *dev,return -EINVAL ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + }/* get the voltage */ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_VDDNB,
@@ -2626,8 +2722,10 @@ static ssize_t amdgpu_hwmon_show_power_avg(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + }/* get the voltage */ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GPU_POWER,
@@ -2665,8 +2763,10 @@ static ssize_t amdgpu_hwmon_show_power_cap_max(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + }if (is_support_sw_smu (adev)) {smu_get_power_limit (&adev->smu, &limit, true, true);
@@ -2697,8 +2797,10 @@ static ssize_t amdgpu_hwmon_show_power_cap(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + }if (is_support_sw_smu (adev)) {smu_get_power_limit (&adev->smu, &limit, false, true);
@@ -2740,8 +2842,10 @@ static ssize_t amdgpu_hwmon_set_power_cap(struct device *dev, err =pm_runtime_get_sync (adev->ddev->dev); -if (err <0 ) +if (err <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return err; + }if (is_support_sw_smu (adev)) err =smu_set_power_limit (&adev->smu, value);
@@ -2771,8 +2875,10 @@ static ssize_t amdgpu_hwmon_show_sclk(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + }/* get the sclk */ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GFX_SCLK,
@@ -2806,8 +2912,10 @@ static ssize_t amdgpu_hwmon_show_mclk(struct device *dev,return -EPERM ; r =pm_runtime_get_sync (adev->ddev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (adev->ddev->dev);return r; + }/* get the sclk */ r = amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GFX_MCLK,
@@ -3669,8 +3777,10 @@ static int amdgpu_debugfs_pm_info(struct seq_file *m, void *data)return -EPERM ; r =pm_runtime_get_sync (dev->dev); -if (r <0 ) +if (r <0 ) { +pm_runtime_put_autosuspend (dev->dev);return r; + }amdgpu_device_ip_get_clockgating_state (adev, &flags);seq_printf (m,"Clock Gating Flags Mask: 0x%x\n" , flags);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 32/255 scsi: lpfc: Fix shost refcount mismatch when deleting vport
In reply to Greg Kroah-HartmanFrom: Dick Kennedy <[email protected]>
[ Upstream commit 03dbfe0668e6692917ac278883e0586cd7f7d753 ]
When vports are deleted, it is observed that there is memory/kthread leakage as the vport isn't fully being released.
There is a shost reference taken in scsi_add_host_dma that is not released during scsi_remove_host. It was noticed that other drivers resolve this by doing a scsi_host_put after calling scsi_remove_host.
The vport_delete routine is taking two references one that corresponds to an access to the scsi_host in the vport_delete routine and another that is released after the adapter mailbox command completes that destroys the VPI that corresponds to the vport.
Remove one of the references taken such that the second reference that is put will complete the missing scsi_add_host_dma reference and the shost will be terminated.
--- drivers/scsi/lpfc/lpfc_vport.c | 26 ++++++++------------------ 1 file changed, 8 insertions(+), 18 deletions(-)
drivers/scsi/lpfc/lpfc_vport.c +8 -18
@@ -642,27 +642,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport) vport->port_state < LPFC_VPORT_READY)return -EAGAIN ; } +/* -* This is a bit of a mess. We want to ensure the shost doesn't get -* torn down until we're done with the embedded lpfc_vport structure. -* -* Beyond holding a reference for this function, we also need a -* reference for outstanding I/O requests we schedule during delete -* processing. But once we scsi_remove_host() we can no longer obtain -* a reference through scsi_host_get(). -* -* So we take two references here. We release one reference at the -* bottom of the function -- after delinking the vport. And we -* release the other at the completion of the unreg_vpi that get's -* initiated after we've disposed of all other resources associated -* with the port. +* Take early refcount for outstanding I/O requests we schedule during +* delete processing for unreg_vpi. Always keep this before +* scsi_remove_host() as we can no longer obtain a reference through +* scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL. */ if (!scsi_host_get (shost))return VPORT_INVAL ; -if (!scsi_host_get (shost)) { -scsi_host_put (shost); -return VPORT_INVAL ; - } +lpfc_free_sysfs_attr (vport);lpfc_debugfs_terminate (vport);
@@ -809,8 +798,9 @@ skip_logo:if (!(vport->vpi_state &LPFC_VPI_REGISTERED ) ||lpfc_mbx_unreg_vpi (vport))scsi_host_put (shost); - }else + }else {scsi_host_put (shost); + }lpfc_free_vpi (phba, vport->vpi); vport->work_port_events =0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 33/255 xfs: Dont allow logging of XFS_ISTALE inodes
In reply to Greg Kroah-HartmanFrom: Dave Chinner <[email protected]>
[ Upstream commit 96355d5a1f0ee6dcc182c37db4894ec0c29f1692 ]
In tracking down a problem in this patchset, I discovered we are reclaiming dirty stale inodes. This wasn't discovered until inodes were always attached to the cluster buffer and then the rcu callback that freed inodes was assert failing because the inode still had an active pointer to the cluster buffer after it had been reclaimed.
Debugging the issue indicated that this was a pre-existing issue resulting from the way the inodes are handled in xfs_inactive_ifree. When we free a cluster buffer from xfs_ifree_cluster, all the inodes in cache are marked XFS_ISTALE. Those that are clean have nothing else done to them and so eventually get cleaned up by background reclaim. i.e. it is assumed we'll never dirty/relog an inode marked XFS_ISTALE.
On journal commit dirty stale inodes as are handled by both buffer and inode log items to run though xfs_istale_done() and removed from the AIL (buffer log item commit) or the log item will simply unpin it because the buffer log item will clean it. What happens to any specific inode is entirely dependent on which log item wins the commit race, but the result is the same - stale inodes are clean, not attached to the cluster buffer, and not in the AIL. Hence inode reclaim can just free these inodes without further care.
However, if the stale inode is relogged, it gets dirtied again and relogged into the CIL. Most of the time this isn't an issue, because relogging simply changes the inode's location in the current checkpoint. Problems arise, however, when the CIL checkpoints between two transactions in the xfs_inactive_ifree() deferops processing. This results in the XFS_ISTALE inode being redirtied and inserted into the CIL without any of the other stale cluster buffer infrastructure being in place.
Hence on journal commit, it simply gets unpinned, so it remains dirty in memory. Everything in inode writeback avoids XFS_ISTALE inodes so it can't be written back, and it is not tracked in the AIL so there's not even a trigger to attempt to clean the inode. Hence the inode just sits dirty in memory until inode reclaim comes along, sees that it is XFS_ISTALE, and goes to reclaim it. This reclaiming of a dirty inode caused use after free, list corruptions and other nasty issues later in this patchset.
Hence this patch addresses a violation of the "never log XFS_ISTALE inodes" caused by the deferops processing rolling a transaction and relogging a stale inode in xfs_inactive_free. It also adds a bunch of asserts to catch this problem in debug kernels so that we don't reintroduce this problem in future.
Reproducer for this issue was generic/558 on a v4 filesystem.
--- fs/xfs/libxfs/xfs_trans_inode.c | 2 ++ fs/xfs/xfs_icache.c | 3 ++- fs/xfs/xfs_inode.c | 25 ++++++++++++++++++++++--- 3 files changed, 26 insertions(+), 4 deletions(-)
fs/xfs/libxfs/xfs_trans_inode.c +2 -0
@@ -36,6 +36,7 @@ xfs_trans_ijoin(ASSERT (iip->ili_lock_flags ==0 ); iip->ili_lock_flags = lock_flags; +ASSERT (!xfs_iflags_test (ip,XFS_ISTALE ));/* * Get a log_item_desc to point at the new item.
@@ -89,6 +90,7 @@ xfs_trans_log_inode(ASSERT (ip->i_itemp !=NULL );ASSERT (xfs_isilocked (ip,XFS_ILOCK_EXCL )); +ASSERT (!xfs_iflags_test (ip,XFS_ISTALE ));/* * Don't bother with i_lock for the I_DIRTY_TIME check here, as races
fs/xfs/xfs_icache.c +2 -1
@@ -1141,7 +1141,7 @@ restart: goto out_ifunlock;xfs_iunpin_wait (ip); } -if (xfs_iflags_test (ip,XFS_ISTALE ) ||xfs_inode_clean (ip)) { +if (xfs_inode_clean (ip)) {xfs_ifunlock (ip); goto reclaim; }
@@ -1228,6 +1228,7 @@ reclaim:xfs_ilock (ip,XFS_ILOCK_EXCL );xfs_qm_dqdetach (ip);xfs_iunlock (ip,XFS_ILOCK_EXCL ); +ASSERT (xfs_inode_clean (ip));__xfs_inode_free (ip);return error;
fs/xfs/xfs_inode.c +22 -3
@@ -1740,10 +1740,31 @@ xfs_inactive_ifree(return error; } +/* +* We do not hold the inode locked across the entire rolling transaction +* here. We only need to hold it for the first transaction that +* xfs_ifree() builds, which may mark the inode XFS_ISTALE if the +* underlying cluster buffer is freed. Relogging an XFS_ISTALE inode +* here breaks the relationship between cluster buffer invalidation and +* stale inode invalidation on cluster buffer item journal commit +* completion, and can result in leaving dirty stale inodes hanging +* around in memory. +* +* We have no need for serialising this inode operation against other +* operations - we freed the inode and hence reallocation is required +* and that will serialise on reallocating the space the deferops need +* to free. Hence we can unlock the inode on the first commit of +* the transaction rather than roll it right through the deferops. This +* avoids relogging the XFS_ISTALE inode. +* +* We check that xfs_ifree() hasn't grown an internal transaction roll +* by asserting that the inode is still locked when it returns. +*/ xfs_ilock (ip,XFS_ILOCK_EXCL ); -xfs_trans_ijoin (tp, ip,0 ); +xfs_trans_ijoin (tp, ip,XFS_ILOCK_EXCL ); error =xfs_ifree (tp, ip); +ASSERT (xfs_isilocked (ip,XFS_ILOCK_EXCL ));if (error) {/* * If we fail to free the inode, shut down. The cancel
@@ -1756,7 +1777,6 @@ xfs_inactive_ifree(xfs_force_shutdown (mp,SHUTDOWN_META_IO_ERROR ); }xfs_trans_cancel (tp); -xfs_iunlock (ip,XFS_ILOCK_EXCL );return error; }
@@ -1774,7 +1794,6 @@ xfs_inactive_ifree(xfs_notice (mp,"%s: xfs_trans_commit returned error %d" , __func__, error); -xfs_iunlock (ip,XFS_ILOCK_EXCL );return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 34/255 scsi: target: Fix xcopy sess release leak
In reply to Greg Kroah-HartmanFrom: Mike Christie <[email protected]>
[ Upstream commit 3c006c7d23aac928279f7cbe83bbac4361255d53 ]
transport_init_session can allocate memory via percpu_ref_init, and target_xcopy_release_pt never frees it. This adds a transport_uninit_session function to handle cleanup of resources allocated in the init function.
--- drivers/target/target_core_internal.h | 1 + drivers/target/target_core_transport.c | 7 ++++++- drivers/target/target_core_xcopy.c | 11 +++++++++-- 3 files changed, 16 insertions(+), 3 deletions(-)
drivers/target/target_core_internal.h +1 -0
@@ -138,6 +138,7 @@ int init_se_kmem_caches(void);void release_se_kmem_caches (void );u32 scsi_get_new_index (scsi_index_t );void transport_subsystem_check_init (void ); +void transport_uninit_session (struct se_session *);unsigned char *transport_dump_cmd_direction (struct se_cmd *);void transport_dump_dev_state (struct se_device *,char *,int *); void transport_dump_dev_info(struct se_device *, struct se_lun *,
drivers/target/target_core_transport.c +6 -1
@@ -236,6 +236,11 @@ int transport_init_session(struct se_session *se_sess) }EXPORT_SYMBOL (transport_init_session); +void transport_uninit_session (struct se_session *se_sess) +{ +percpu_ref_exit (&se_sess->cmd_count); +} +/** * transport_alloc_session - allocate a session object and initialize it * @sup_prot_ops: bitmask that defines which T10-PI modes are supported.
@@ -579,7 +584,7 @@ void transport_free_session(struct se_session *se_sess)sbitmap_queue_free (&se_sess->sess_tag_pool);kvfree (se_sess->sess_cmd_map); } -percpu_ref_exit (&se_sess->cmd_count); +transport_uninit_session (se_sess);kmem_cache_free (se_sess_cache, se_sess); }EXPORT_SYMBOL (transport_free_session);
drivers/target/target_core_xcopy.c +9 -2
@@ -474,7 +474,7 @@ int target_xcopy_setup_pt(void)memset (&xcopy_pt_sess,0 ,sizeof (struct se_session )); ret =transport_init_session (&xcopy_pt_sess);if (ret <0 ) -return ret; + goto destroy_wq; xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg; xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess;
@@ -483,12 +483,19 @@ int target_xcopy_setup_pt(void) xcopy_pt_sess.se_node_acl = &xcopy_pt_nacl;return 0 ; + +destroy_wq: +destroy_workqueue (xcopy_wq); + xcopy_wq =NULL ; +return ret; }void target_xcopy_release_pt (void ) { -if (xcopy_wq) +if (xcopy_wq) {destroy_workqueue (xcopy_wq); +transport_uninit_session (&xcopy_pt_sess); + } }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 35/255 selftests/powerpc: Purge extra count_pmc() calls of ebb selftests
In reply to Greg Kroah-HartmanFrom: Desnes A. Nunes do Rosario <[email protected]>
[ Upstream commit 3337bf41e0dd70b4064cdf60acdfcdc2d050066c ]
An extra count on ebb_state.stats.pmc_count[PMC_INDEX(pmc)] is being per- formed when count_pmc() is used to reset PMCs on a few selftests. This extra pmc_count can occasionally invalidate results, such as the ones from cycles_test shown hereafter. The ebb_check_count() failed with an above the upper limit error due to the extra value on ebb_state.stats.pmc_count.
Furthermore, this extra count is also indicated by extra PMC1 trace_log on the output of the cycle test (as well as on pmc56_overflow_test):
==========
...
[21]: counter = 8
[22]: register SPRN_MMCR0 = 0x0000000080000080
[23]: register SPRN_PMC1 = 0x0000000080000004
[24]: counter = 9
[25]: register SPRN_MMCR0 = 0x0000000080000080
[26]: register SPRN_PMC1 = 0x0000000080000004
[27]: counter = 10
[28]: register SPRN_MMCR0 = 0x0000000080000080
[29]: register SPRN_PMC1 = 0x0000000080000004
Quoted 1 line
Quoted 1 line
[30]: register
SPRN_PMC1=0x000000004000051e
PMC1 count (0x280000546) above upper limit 0x2800003e8 (+0x15e) [FAIL] Test FAILED on line 52
failure: cycles
==========
--- .../selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c | 2 -- tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c | 2 -- .../selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c | 2 -- .../selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c | 2 -- tools/testing/selftests/powerpc/pmu/ebb/ebb.c | 2 -- .../selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c | 2 -- .../selftests/powerpc/pmu/ebb/lost_exception_test.c | 1 - .../testing/selftests/powerpc/pmu/ebb/multi_counter_test.c | 7 ------- .../selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c | 2 -- .../testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c | 2 -- .../selftests/powerpc/pmu/ebb/pmc56_overflow_test.c | 2 -- 11 files changed, 26 deletions(-)
tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c +0 -2
@@ -91,8 +91,6 @@ int back_to_back_ebbs(void)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -dump_ebb_state ();event_close (&event);
tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c +0 -2
@@ -42,8 +42,6 @@ int cycles(void)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -dump_ebb_state ();event_close (&event);
tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c +0 -2
@@ -99,8 +99,6 @@ int cycles_with_freeze(void)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -dump_ebb_state ();printf ("EBBs while frozen %d\n" , ebbs_while_frozen);
tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c +0 -2
@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -dump_ebb_state ();event_close (&event);
tools/testing/selftests/powerpc/pmu/ebb/ebb.c +0 -2
@@ -396,8 +396,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -dump_ebb_state ();event_close (&event);
tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c +0 -2
@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -dump_ebb_state ();FAIL_IF (ebb_state.stats.ebb_count ==0 );
tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c +0 -1
@@ -75,7 +75,6 @@ static int test_body(void)ebb_freeze_pmcs ();ebb_global_disable (); -count_pmc (4 , sample_period);mtspr (SPRN_PMC4 ,0xdead );dump_summary_ebb_state ();
tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c +0 -7
@@ -70,13 +70,6 @@ int multi_counter(void)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -count_pmc (2 , sample_period); -count_pmc (3 , sample_period); -count_pmc (4 , sample_period); -count_pmc (5 , sample_period); -count_pmc (6 , sample_period); -dump_ebb_state ();for (i =0 ; i <6 ; i++)
tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c +0 -2
@@ -61,8 +61,6 @@ static int cycles_child(void)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -dump_summary_ebb_state ();event_close (&event);
tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c +0 -2
@@ -82,8 +82,6 @@ static int test_body(void)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (1 , sample_period); -dump_ebb_state ();if (mmcr0_mismatch)
tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c +0 -2
@@ -76,8 +76,6 @@ int pmc56_overflow(void)ebb_global_disable ();ebb_freeze_pmcs (); -count_pmc (2 , sample_period); -dump_ebb_state ();printf ("PMC5/6 overflow %d\n" , pmc56_overflowed);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 36/255 f2fs: remove write attribute of main_blkaddr sysfs node
In reply to Greg Kroah-HartmanFrom: Dehe Gu <[email protected]>
[ Upstream commit ffcde4b29a5f20ddca6fe559b48f345818bf1d91 ]
Fuzzing main_blkaddr sysfs node will corrupt this field's value, causing kernel panic, remove its write attribute to avoid potential security risk.
[Chao Yu: add description]
--- fs/f2fs/sysfs.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/f2fs/sysfs.c +8 -1
@@ -223,6 +223,13 @@ static ssize_t avg_vblocks_show(struct f2fs_attr *a, }#endif +static ssize_t main_blkaddr_show (struct f2fs_attr *a, +struct f2fs_sb_info *sbi,char *buf) +{ +return snprintf (buf,PAGE_SIZE ,"%llu\n" , + (unsigned long long )MAIN_BLKADDR (sbi)); +} +static ssize_t f2fs_sbi_show (struct f2fs_attr *a,struct f2fs_sb_info *sbi,char *buf) {
@@ -522,7 +529,6 @@ F2FS_RW_ATTR(GC_THREAD, f2fs_gc_kthread, gc_no_gc_sleep_time, no_gc_sleep_time);F2FS_RW_ATTR (F2FS_SBI , f2fs_sb_info, gc_idle, gc_mode);F2FS_RW_ATTR (F2FS_SBI , f2fs_sb_info, gc_urgent, gc_mode);F2FS_RW_ATTR (SM_INFO , f2fs_sm_info, reclaim_segments, rec_prefree_segments); -F2FS_RW_ATTR (SM_INFO , f2fs_sm_info, main_blkaddr, main_blkaddr);F2FS_RW_ATTR (DCC_INFO , discard_cmd_control, max_small_discards, max_discards);F2FS_RW_ATTR (DCC_INFO , discard_cmd_control, discard_granularity, discard_granularity);F2FS_RW_ATTR (RESERVED_BLOCKS , f2fs_sb_info, reserved_blocks, reserved_blocks);
@@ -565,6 +571,7 @@ F2FS_GENERAL_RO_ATTR(current_reserved_blocks);F2FS_GENERAL_RO_ATTR (unusable);F2FS_GENERAL_RO_ATTR (encoding);F2FS_GENERAL_RO_ATTR (mounted_time_sec); +F2FS_GENERAL_RO_ATTR (main_blkaddr);#ifdef CONFIG_F2FS_STAT_FS F2FS_STAT_ATTR (STAT_INFO , f2fs_stat_info, cp_foreground_calls, cp_count);F2FS_STAT_ATTR (STAT_INFO , f2fs_stat_info, cp_background_calls, bg_cp_count);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 37/255 f2fs: fix error path in do_recover_data()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 9627a7b31f3c4ff8bc8f3be3683983ffe6eaebe6 ]
- don't panic kernel if f2fs_get_node_page() fails in f2fs_recover_inline_data() or f2fs_recover_inline_xattr();
- return error number of f2fs_truncate_blocks() to f2fs_recover_inline_data()'s caller;
--- fs/f2fs/f2fs.h | 4 ++-- fs/f2fs/inline.c | 19 ++++++++++++------- fs/f2fs/node.c | 6 ++++-- fs/f2fs/recovery.c | 10 ++++++++-- 4 files changed, 26 insertions(+), 13 deletions(-)
fs/f2fs/f2fs.h +2 -2
@@ -3287,7 +3287,7 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid);void f2fs_alloc_nid_done (struct f2fs_sb_info *sbi,nid_t nid);void f2fs_alloc_nid_failed (struct f2fs_sb_info *sbi,nid_t nid);int f2fs_try_to_free_nids (struct f2fs_sb_info *sbi,int nr_shrink); -void f2fs_recover_inline_xattr (struct inode *inode,struct page *page); +int f2fs_recover_inline_xattr (struct inode *inode,struct page *page);int f2fs_recover_xattr_data (struct inode *inode,struct page *page);int f2fs_recover_inode_page (struct f2fs_sb_info *sbi,struct page *page); int f2fs_restore_node_summary(struct f2fs_sb_info *sbi,
@@ -3750,7 +3750,7 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page);int f2fs_convert_inline_inode (struct inode *inode);int f2fs_try_convert_inline_dir (struct inode *dir,struct dentry *dentry);int f2fs_write_inline_data (struct inode *inode,struct page *page); -bool f2fs_recover_inline_data (struct inode *inode,struct page *npage); +int f2fs_recover_inline_data (struct inode *inode,struct page *npage);struct f2fs_dir_entry *f2fs_find_in_inline_dir (struct inode *dir,const struct f2fs_filename *fname,struct page **res_page);
fs/f2fs/inline.c +12 -7
@@ -253,7 +253,7 @@ int f2fs_write_inline_data(struct inode *inode, struct page *page)return 0 ; } -bool f2fs_recover_inline_data (struct inode *inode,struct page *npage) +int f2fs_recover_inline_data (struct inode *inode,struct page *npage) {struct f2fs_sb_info *sbi =F2FS_I_SB (inode);struct f2fs_inode *ri =NULL ;
@@ -275,7 +275,8 @@ bool f2fs_recover_inline_data(struct inode *inode, struct page *npage) ri && (ri->i_inline & F2FS_INLINE_DATA)) { process_inline: ipage =f2fs_get_node_page (sbi, inode->i_ino); -f2fs_bug_on (sbi,IS_ERR (ipage)); +if (IS_ERR (ipage)) +return PTR_ERR (ipage);f2fs_wait_on_page_writeback (ipage,NODE , true, true);
@@ -288,21 +289,25 @@ process_inline:set_page_dirty (ipage);f2fs_put_page (ipage,1 ); -return true; +return 1 ; }if (f2fs_has_inline_data (inode)) { ipage =f2fs_get_node_page (sbi, inode->i_ino); -f2fs_bug_on (sbi,IS_ERR (ipage)); +if (IS_ERR (ipage)) +return PTR_ERR (ipage);f2fs_truncate_inline_inode (inode, ipage,0 );clear_inode_flag (inode,FI_INLINE_DATA );f2fs_put_page (ipage,1 ); }else if (ri && (ri->i_inline &F2FS_INLINE_DATA )) { -if (f2fs_truncate_blocks (inode,0 , false)) -return false; +int ret; + + ret =f2fs_truncate_blocks (inode,0 , false); +if (ret) +return ret; goto process_inline; } -return false; +return 0 ; } struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
fs/f2fs/node.c +4 -2
@@ -2576,7 +2576,7 @@ int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink)return nr - nr_shrink; } -void f2fs_recover_inline_xattr (struct inode *inode,struct page *page) +int f2fs_recover_inline_xattr (struct inode *inode,struct page *page) {void *src_addr, *dst_addr;size_t inline_size;
@@ -2584,7 +2584,8 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)struct f2fs_inode *ri; ipage =f2fs_get_node_page (F2FS_I_SB (inode), inode->i_ino); -f2fs_bug_on (F2FS_I_SB (inode),IS_ERR (ipage)); +if (IS_ERR (ipage)) +return PTR_ERR (ipage); ri =F2FS_INODE (page);if (ri->i_inline &F2FS_INLINE_XATTR ) {
@@ -2603,6 +2604,7 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page) update_inode:f2fs_update_inode (inode, ipage);f2fs_put_page (ipage,1 ); +return 0 ; }int f2fs_recover_xattr_data (struct inode *inode,struct page *page)
fs/f2fs/recovery.c +8 -2
@@ -544,7 +544,9 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,/* step 1: recover xattr */ if (IS_INODE (page)) { -f2fs_recover_inline_xattr (inode, page); + err =f2fs_recover_inline_xattr (inode, page); +if (err) + goto out; }else if (f2fs_has_xattr_block (ofs_of_node (page))) { err =f2fs_recover_xattr_data (inode, page);if (!err)
@@ -553,8 +555,12 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode, }/* step 2: recover inline data */ -if (f2fs_recover_inline_data (inode, page)) + err =f2fs_recover_inline_data (inode, page); +if (err) { +if (err ==1 ) + err =0 ; goto out; + }/* step 3: recover data indices */ start =f2fs_start_bidx_of_node (ofs_of_node (page), inode);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 38/255 MIPS: KVM: Limit Trap-and-Emulate to MIPS32R2 only
In reply to Greg Kroah-HartmanFrom: Jiaxun Yang <[email protected]>
[ Upstream commit 01edc5e76ecfecf9a79eec2658f6146ef47bc816 ]
After tons of fixes to get Trap-and-Emulate build on Loongson64, I've got panic on host machine when trying to run a VM.
I found that it can never work on 64bit systems. Revewing the code, it looks like R6 can't supportrd by TE as well.
Message-Id: <[email protected]>
--- arch/mips/Kconfig | 1 + arch/mips/kvm/Kconfig | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
arch/mips/Kconfig +1 -0
@@ -2203,6 +2203,7 @@ endchoice config KVM_GUEST bool "KVM Guest Kernel" + depends on CPU_MIPS32_R2 depends on BROKEN_ON_SMP help Select this option if building a guest kernel for KVM (Trap & Emulate)
arch/mips/kvm/Kconfig +2 -1
@@ -37,10 +37,11 @@ choice config KVM_MIPS_TE bool "Trap & Emulate" + depends on CPU_MIPS32_R2 help Use trap and emulate to virtualize 32-bit guests in user mode. This does not require any special hardware Virtualization support beyond - standard MIPS32/64 r2 or later, but it does require the guest kernel + standard MIPS32 r2 or later, but it does require the guest kernel to be configured with CONFIG_KVM_GUEST=y so that it resides in the user address segment.
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 39/255 omapfb: fix multiple reference count leaks due to pm_runtime_get_sync
In reply to Greg Kroah-HartmanFrom: Aditya Pakki <[email protected]>
[ Upstream commit 78c2ce9bde70be5be7e3615a2ae7024ed8173087 ]
On calling pm_runtime_get_sync() the reference count of the device is incremented. In case of failure, decrement the reference count before returning the error.
--- drivers/video/fbdev/omap2/omapfb/dss/dispc.c | 7 +++++-- drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 7 +++++-- drivers/video/fbdev/omap2/omapfb/dss/dss.c | 7 +++++-- drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c | 5 +++-- drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c | 5 +++-- drivers/video/fbdev/omap2/omapfb/dss/venc.c | 7 +++++-- 6 files changed, 26 insertions(+), 12 deletions(-)
drivers/video/fbdev/omap2/omapfb/dss/dispc.c +5 -2
@@ -520,8 +520,11 @@ int dispc_runtime_get(void)DSSDBG ("dispc_runtime_get\n" ); r =pm_runtime_get_sync (&dispc.pdev->dev); -WARN_ON (r <0 ); -return r <0 ? r :0 ; +if (WARN_ON (r <0 )) { +pm_runtime_put_sync (&dispc.pdev->dev); +return r; + } +return 0 ; }EXPORT_SYMBOL (dispc_runtime_get);
drivers/video/fbdev/omap2/omapfb/dss/dsi.c +5 -2
@@ -1137,8 +1137,11 @@ static int dsi_runtime_get(struct platform_device *dsidev)DSSDBG ("dsi_runtime_get\n" ); r =pm_runtime_get_sync (&dsi->pdev->dev); -WARN_ON (r <0 ); -return r <0 ? r :0 ; +if (WARN_ON (r <0 )) { +pm_runtime_put_sync (&dsi->pdev->dev); +return r; + } +return 0 ; }static void dsi_runtime_put (struct platform_device *dsidev)
drivers/video/fbdev/omap2/omapfb/dss/dss.c +5 -2
@@ -768,8 +768,11 @@ int dss_runtime_get(void)DSSDBG ("dss_runtime_get\n" ); r =pm_runtime_get_sync (&dss.pdev->dev); -WARN_ON (r <0 ); -return r <0 ? r :0 ; +if (WARN_ON (r <0 )) { +pm_runtime_put_sync (&dss.pdev->dev); +return r; + } +return 0 ; }void dss_runtime_put (void )
drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c +3 -2
@@ -39,9 +39,10 @@ static int hdmi_runtime_get(void)DSSDBG ("hdmi_runtime_get\n" ); r =pm_runtime_get_sync (&hdmi.pdev->dev); -WARN_ON (r <0 ); -if (r <0 ) +if (WARN_ON (r <0 )) { +pm_runtime_put_sync (&hdmi.pdev->dev);return r; + }return 0 ; }
drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c +3 -2
@@ -43,9 +43,10 @@ static int hdmi_runtime_get(void)DSSDBG ("hdmi_runtime_get\n" ); r =pm_runtime_get_sync (&hdmi.pdev->dev); -WARN_ON (r <0 ); -if (r <0 ) +if (WARN_ON (r <0 )) { +pm_runtime_put_sync (&hdmi.pdev->dev);return r; + }return 0 ; }
drivers/video/fbdev/omap2/omapfb/dss/venc.c +5 -2
@@ -348,8 +348,11 @@ static int venc_runtime_get(void)DSSDBG ("venc_runtime_get\n" ); r =pm_runtime_get_sync (&venc.pdev->dev); -WARN_ON (r <0 ); -return r <0 ? r :0 ; +if (WARN_ON (r <0 )) { +pm_runtime_put_sync (&venc.pdev->dev); +return r; + } +return 0 ; }static void venc_runtime_put (void )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 40/255 PCI: Fix pci_create_slot() reference count leak
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit 8a94644b440eef5a7b9c104ac8aa7a7f413e35e5 ]
kobject_init_and_add() takes a reference even when it fails. If it returns an error, kobject_put() must be called to clean up the memory associated with the object.
When kobject_init_and_add() fails, call kobject_put() instead of kfree().
b8eb718348b8 ("net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject") fixed a similar problem.
--- drivers/pci/slot.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pci/slot.c +4 -2
@@ -268,13 +268,16 @@ placeholder: slot_name =make_slot_name (name);if (!slot_name) { err = -ENOMEM ; +kfree (slot); goto err; } err =kobject_init_and_add (&slot->kobj, &pci_slot_ktype,NULL ,"%s" , slot_name); -if (err) +if (err) { +kobject_put (&slot->kobj); goto err; + }INIT_LIST_HEAD (&slot->list);list_add (&slot->list, &parent->slots);
@@ -293,7 +296,6 @@ out:mutex_unlock (&pci_slot_mutex);return slot; err: -kfree (slot); slot =ERR_PTR (err); goto out; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 41/255 ARM: dts: ls1021a: output PPS signal on FIPER2
In reply to Greg Kroah-HartmanFrom: Yangbo Lu <[email protected]>
[ Upstream commit 5656bb3857c4904d1dec6e1b8f876c1c0337274e ]
The timer fixed interval period pulse generator register is used to generate periodic pulses. The down count register loads the value programmed in the fixed period interval (FIPER). At every tick of the timer accumulator overflow, the counter decrements by the value of TMR_CTRL[TCLK_PERIOD]. It generates a pulse when the down counter value reaches zero. It reloads the down counter in the cycle following a pulse.
To use the TMR_FIPER register to generate desired periodic pulses. The value should programmed is, desired_period - tclk_period
Current tmr-fiper2 value is to generate 100us periodic pulses. (But the value should have been 99995, not 99990. The tclk_period is 5.) This patch is to generate 1 second periodic pulses with value 999999995 programmed which is more desired by user.
--- arch/arm/boot/dts/ls1021a.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/ls1021a.dtsi +1 -1
@@ -772,7 +772,7 @@ fsl,tmr-prsc = <2>; fsl,tmr-add = <0xaaaaaaab>; fsl,tmr-fiper1 = <999999995>; - fsl,tmr-fiper2 = <99990>; + fsl,tmr-fiper2 = <999999995>; fsl,max-adj = <499999999>; fsl,extts-fifo; };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 42/255 rtlwifi: rtl8192cu: Prevent leaking urb
In reply to Greg Kroah-HartmanFrom: Reto Schneider <[email protected]>
[ Upstream commit 03128643eb5453a798db5770952c73dc64fcaf00 ]
If usb_submit_urb fails the allocated urb should be unanchored and released.
--- drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/usb.c +4 -1
@@ -718,8 +718,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)usb_anchor_urb (urb, &rtlusb->rx_submitted); err =usb_submit_urb (urb,GFP_KERNEL ); -if (err) +if (err) { +usb_unanchor_urb (urb); +usb_free_urb (urb); goto err_out; + }usb_free_urb (urb); }return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 43/255 mips/vdso: Fix resource leaks in genvdso.c
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit a859647b4e6bfeb192284d27d24b6a0c914cae1d ]
Close "fd" before the return of map_vdso() and close "out_file" in main().
--- arch/mips/vdso/genvdso.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/mips/vdso/genvdso.c +10 -0
@@ -122,6 +122,7 @@ static void *map_vdso(const char *path, size_t *_size)if (fstat (fd, &stat) !=0 ) {fprintf (stderr,"%s: Failed to stat '%s': %s\n" , program_name, path,strerror (errno)); +close (fd);return NULL ; }
@@ -130,6 +131,7 @@ static void *map_vdso(const char *path, size_t *_size)if (addr ==MAP_FAILED ) {fprintf (stderr,"%s: Failed to map '%s': %s\n" , program_name, path,strerror (errno)); +close (fd);return NULL ; }
@@ -139,6 +141,7 @@ static void *map_vdso(const char *path, size_t *_size)if (memcmp (ehdr->e_ident,ELFMAG ,SELFMAG ) !=0 ) {fprintf (stderr,"%s: '%s' is not an ELF file\n" , program_name, path); +close (fd);return NULL ; }
@@ -150,6 +153,7 @@ static void *map_vdso(const char *path, size_t *_size)default :fprintf (stderr,"%s: '%s' has invalid ELF class\n" , program_name, path); +close (fd);return NULL ; }
@@ -161,6 +165,7 @@ static void *map_vdso(const char *path, size_t *_size)default :fprintf (stderr,"%s: '%s' has invalid ELF data order\n" , program_name, path); +close (fd);return NULL ; }
@@ -168,15 +173,18 @@ static void *map_vdso(const char *path, size_t *_size)fprintf (stderr,"%s: '%s' has invalid ELF machine (expected EM_MIPS)\n" , program_name, path); +close (fd);return NULL ; }else if (swap_uint16 (ehdr->e_type) !=ET_DYN ) {fprintf (stderr,"%s: '%s' has invalid ELF type (expected ET_DYN)\n" , program_name, path); +close (fd);return NULL ; } *_size = stat.st_size; +close (fd);return addr; }
@@ -293,10 +301,12 @@ int main(int argc, char **argv)/* Calculate and write symbol offsets to <output file> */ if (!get_symbols (dbg_vdso_path, dbg_vdso)) {unlink (out_path); +fclose (out_file);return EXIT_FAILURE ; }fprintf (out_file,"};\n" ); +fclose (out_file);return EXIT_SUCCESS ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 44/255 ALSA: hda: Add support for Loongson 7A1000 controller
In reply to Greg Kroah-HartmanFrom: Kaige Li <[email protected]>
[ Upstream commit 61eee4a7fc406f94e441778c3cecbbed30373c89 ]
Add the new PCI ID 0x0014 0x7a07 to support Loongson 7A1000 controller.
--- sound/pci/hda/hda_intel.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/hda_intel.c +2 -0
@@ -2747,6 +2747,8 @@ static const struct pci_device_id azx_ids[] = { .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_HDMI },/* Zhaoxin */ { PCI_DEVICE(0x1d17, 0x3288), .driver_data = AZX_DRIVER_ZHAOXIN }, + /* Loongson */ + { PCI_DEVICE(0x0014, 0x7a07), .driver_data = AZX_DRIVER_GENERIC }, { 0, } };MODULE_DEVICE_TABLE (pci, azx_ids);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 45/255 gpu: host1x: Put gathers BO on pinning error
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit fd323e9ef0a19112c0c85b85afc4848c0518174b ]
This patch fixes gather's BO refcounting on a pinning error. Gather's BO won't be leaked now if something goes wrong.
--- drivers/gpu/host1x/job.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/host1x/job.c +8 -5
@@ -102,6 +102,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job) {struct host1x_client *client = job->client;struct device *dev = client->dev; +struct host1x_job_gather *g;struct iommu_domain *domain;unsigned int i;int err;
@@ -184,7 +185,6 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job) }for (i =0 ; i < job->num_gathers; i++) { -struct host1x_job_gather *g = &job->gathers[i];size_t gather_size =0 ;struct scatterlist *sg;struct sg_table *sgt;
@@ -194,6 +194,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)dma_addr_t *phys;unsigned int j; + g = &job->gathers[i]; g->bo =host1x_bo_get (g->bo);if (!g->bo) { err = -EINVAL ;
@@ -213,7 +214,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job) sgt =host1x_bo_pin (host->dev, g->bo, phys);if (IS_ERR (sgt)) { err =PTR_ERR (sgt); - goto unpin; + goto put; }if (!IS_ENABLED (CONFIG_TEGRA_HOST1X_FIREWALL ) && host->domain) {
@@ -226,7 +227,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job) host->iova_end >> shift, true);if (!alloc) { err = -ENOMEM ; - goto unpin; + goto put; } err = iommu_map_sg(host->domain,
@@ -235,7 +236,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)if (err ==0 ) {__free_iova (&host->iova, alloc); err = -EINVAL ; - goto unpin; + goto put; } job->unpins[job->num_unpins].size = gather_size;
@@ -245,7 +246,7 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job) DMA_TO_DEVICE);if (!err) { err = -ENOMEM ; - goto unpin; + goto put; } job->unpins[job->num_unpins].dir =DMA_TO_DEVICE ;
@@ -263,6 +264,8 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)return 0 ; +put: +host1x_bo_put (g->bo); unpin:host1x_job_unpin (job);return err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 46/255 cec-api: prevent leaking memory through hole in structure
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 6c42227c3467549ddc65efe99c869021d2f4a570 ]
Fix this smatch warning:
drivers/media/cec/core/cec-api.c:156 cec_adap_g_log_addrs() warn: check that 'log_addrs' doesn't leak information (struct has a hole after 'features')
--- drivers/media/cec/core/cec-api.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/cec/core/cec-api.c +7 -1
@@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap,struct cec_log_addrs log_addrs;mutex_lock (&adap->lock); - log_addrs = adap->log_addrs; +/* +* We use memcpy here instead of assignment since there is a +* hole at the end of struct cec_log_addrs that an assignment +* might ignore. So when we do copy_to_user() we could leak +* one byte of memory. +*/ +memcpy (&log_addrs, &adap->log_addrs,sizeof (log_addrs));if (!adap->is_configured)memset (log_addrs.log_addr,CEC_LOG_ADDR_INVALID ,sizeof (log_addrs.log_addr));
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 47/255 ASoC: Intel: sof_sdw_rt711: remove properties in card remove
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit cf0418cd06ce42fcf35beb33e315b5a77e596926 ]
The rt711 jack detection properties are set from the machine drivers during the card probe, as done in other ASoC examples.
KASAN reports a use-after-free error when unbinding drivers due to a confusing sequence between the ACPI core, the device core and the SoundWire device cleanups.
Rather than fixing this sequence, follow the recommendation to have the same caller add and remove properties, add an explicit device_remove_properties() in the card .remove() callback.
In future patches the use of device_add/remove_properties will be replaced by a direct handling of a swnode, but the sequence will remain the same.
--- sound/soc/intel/boards/sof_sdw.c | 1 + sound/soc/intel/boards/sof_sdw_common.h | 1 + sound/soc/intel/boards/sof_sdw_rt711.c | 15 +++++++++++++++ 3 files changed, 17 insertions(+)
sound/soc/intel/boards/sof_sdw.c +1 -0
@@ -184,6 +184,7 @@ static struct sof_sdw_codec_info codec_info_list[] = { .direction = {true, true}, .dai_name = "rt711-aif1", .init = sof_sdw_rt711_init, + .exit = sof_sdw_rt711_exit, }, { .id = 0x1308,
sound/soc/intel/boards/sof_sdw_common.h +1 -0
@@ -84,6 +84,7 @@ int sof_sdw_rt711_init(const struct snd_soc_acpi_link_adr *link,struct snd_soc_dai_link *dai_links, struct sof_sdw_codec_info *info, bool playback); +int sof_sdw_rt711_exit (struct device *dev,struct snd_soc_dai_link *dai_link);/* RT700 support */ int sof_sdw_rt700_init(const struct snd_soc_acpi_link_adr *link,
sound/soc/intel/boards/sof_sdw_rt711.c +15 -0
@@ -133,6 +133,21 @@ static int rt711_rtd_init(struct snd_soc_pcm_runtime *rtd)return ret; } +int sof_sdw_rt711_exit (struct device *dev,struct snd_soc_dai_link *dai_link) +{ +struct device *sdw_dev; + + sdw_dev =bus_find_device_by_name (&sdw_bus_type,NULL , + dai_link->codecs[0 ].name); +if (!sdw_dev) +return -EINVAL ; + +device_remove_properties (sdw_dev); +put_device (sdw_dev); + +return 0 ; +} + int sof_sdw_rt711_init(const struct snd_soc_acpi_link_adr *link, struct snd_soc_dai_link *dai_links, struct sof_sdw_codec_info *info,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 48/255 HID: quirks: add NOGET quirk for Logitech GROUP
In reply to Greg Kroah-HartmanFrom: Ikjoon Jang <[email protected]>
[ Upstream commit 68f775ddd2a6f513e225f9a565b054ab48fef142 ]
Add HID_QUIRK_NOGET for Logitech GROUP device.
Logitech GROUP is a compound with camera and audio. When the HID interface in an audio device is requested to get specific report id, all following control transfers are stalled and never be restored back.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -773,6 +773,7 @@#define USB_DEVICE_ID_LOGITECH_G27_WHEEL 0xc29b#define USB_DEVICE_ID_LOGITECH_WII_WHEEL 0xc29c#define USB_DEVICE_ID_LOGITECH_ELITE_KBD 0xc30a +#define USB_DEVICE_ID_LOGITECH_GROUP_AUDIO 0x0882#define USB_DEVICE_ID_S510_RECEIVER 0xc50c#define USB_DEVICE_ID_S510_RECEIVER_2 0xc517#define USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500 0xc512
drivers/hid/hid-quirks.c +1 -0
@@ -179,6 +179,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET }, { 0 } };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 49/255 f2fs: fix use-after-free issue
In reply to Greg Kroah-HartmanFrom: Li Guifu <[email protected]>
[ Upstream commit 99c787cfd2bd04926f1f553b30bd7dcea2caaba1 ]
During umount, f2fs_put_super() unregisters procfs entries after f2fs_destroy_segment_manager(), it may cause use-after-free issue when umount races with procfs accessing, fix it by relocating f2fs_unregister_sysfs().
[Chao Yu: change commit title/message a bit]
--- fs/f2fs/super.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/f2fs/super.c +3 -2
@@ -1173,6 +1173,9 @@ static void f2fs_put_super(struct super_block *sb)int i;bool dropped; +/* unregister procfs/sysfs entries in advance to avoid race case */ +f2fs_unregister_sysfs (sbi); +f2fs_quota_off_umount (sb);/* prevent remaining shrinker jobs */
@@ -1238,8 +1241,6 @@ static void f2fs_put_super(struct super_block *sb)kvfree (sbi->ckpt); -f2fs_unregister_sysfs (sbi); - sb->s_fs_info =NULL ;if (sbi->s_chksum_driver)crypto_free_shash (sbi->s_chksum_driver);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 50/255 drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open
In reply to Greg Kroah-HartmanFrom: Aditya Pakki <[email protected]>
[ Upstream commit bfad51c7633325b5d4b32444efe04329d53297b2 ]
nouveau_fbcon_open() calls calls pm_runtime_get_sync() that increments the reference count. In case of failure, decrement the ref count before returning the error.
--- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_fbcon.c +3 -1
@@ -189,8 +189,10 @@ nouveau_fbcon_open(struct fb_info *info, int user)struct nouveau_fbdev *fbcon = info->par;struct nouveau_drm *drm =nouveau_drm (fbcon->helper.dev);int ret =pm_runtime_get_sync (drm->dev->dev); -if (ret <0 && ret != -EACCES ) +if (ret <0 && ret != -EACCES ) { +pm_runtime_put (drm->dev->dev);return ret; + }return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 51/255 drm/nouveau: fix reference count leak in nv50_disp_atomic_commit
In reply to Greg Kroah-HartmanFrom: Aditya Pakki <[email protected]>
[ Upstream commit a2cdf39536b0d21fb06113f5e16692513d7bcb9c ]
nv50_disp_atomic_commit() calls calls pm_runtime_get_sync and in turn increments the reference count. In case of failure, decrement the ref count before returning the error.
--- drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/dispnv50/disp.c +3 -1
@@ -2160,8 +2160,10 @@ nv50_disp_atomic_commit(struct drm_device *dev,int ret, i; ret =pm_runtime_get_sync (dev->dev); -if (ret <0 && ret != -EACCES ) +if (ret <0 && ret != -EACCES ) { +pm_runtime_put_autosuspend (dev->dev);return ret; + } ret =drm_atomic_helper_setup_commit (state, nonblock);if (ret)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 52/255 drm/nouveau: Fix reference count leak in nouveau_connector_detect
In reply to Greg Kroah-HartmanFrom: Aditya Pakki <[email protected]>
[ Upstream commit 990a1162986e8eff7ca18cc5a0e03b4304392ae2 ]
nouveau_connector_detect() calls pm_runtime_get_sync and in turn increments the reference count. In case of failure, decrement the ref count before returning the error.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +3 -1
@@ -572,8 +572,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)pm_runtime_get_noresume (dev->dev); }else { ret =pm_runtime_get_sync (dev->dev); -if (ret <0 && ret != -EACCES ) +if (ret <0 && ret != -EACCES ) { +pm_runtime_put_autosuspend (dev->dev);return conn_status; + } } nv_encoder =nouveau_connector_ddc_detect (connector);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 53/255 locking/lockdep: Fix overflow in presentation of average lock-time
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit a7ef9b28aa8d72a1656fa6f0a01bbd1493886317 ]
Though the number of lock-acquisitions is tracked as unsigned long, this is passed as the divisor to div_s64() which interprets it as a s32, giving nonsense values with more than 2 billion acquisitons. E.g.
acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg
-------------------------------------------------------------------------
2350439395 0.07 353.38 649647067.36 0.-32
--- kernel/locking/lockdep_proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/locking/lockdep_proc.c +1 -1
@@ -423,7 +423,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt)seq_time (m, lt->min);seq_time (m, lt->max);seq_time (m, lt->total); -seq_time (m, lt->nr ?div_s64 (lt->total, lt->nr) :0 ); +seq_time (m, lt->nr ?div64_u64 (lt->total, lt->nr) :0 ); }static void seq_stats (struct seq_file *m,struct lock_stat_data *data)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 54/255 btrfs: file: reserve qgroup space after the hole punch range is locked
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit a7f8b1c2ac21bf081b41264c9cfd6260dffa6246 ]
The incoming qgroup reserved space timing will move the data reservation to ordered extent completely.
However in btrfs_punch_hole_lock_range() will call btrfs_invalidate_page(), which will clear QGROUP_RESERVED bit for the range.
In current stage it's OK, but if we're making ordered extents handle the reserved space, then btrfs_punch_hole_lock_range() can clear the QGROUP_RESERVED bit before we submit ordered extent, leading to qgroup reserved space leakage.
So here change the timing to make reserve data space after btrfs_punch_hole_lock_range().
The new timing is fine for either current code or the new code.
--- fs/btrfs/file.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/btrfs/file.c +4 -4
@@ -3176,14 +3176,14 @@ reserve_space:if (ret <0 ) goto out; space_reserved = true; - ret =btrfs_qgroup_reserve_data (inode, &data_reserved, - alloc_start, bytes_to_reserve); -if (ret) - goto out; ret =btrfs_punch_hole_lock_range (inode, lockstart, lockend, &cached_state);if (ret) goto out; + ret =btrfs_qgroup_reserve_data (inode, &data_reserved, + alloc_start, bytes_to_reserve); +if (ret) + goto out; ret = btrfs_prealloc_file_range(inode, mode, alloc_start, alloc_end - alloc_start, i_blocksize(inode),
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 55/255 btrfs: make btrfs_qgroup_check_reserved_leak take btrfs_inode
In reply to Greg Kroah-HartmanFrom: Nikolay Borisov <[email protected]>
[ Upstream commit cfdd45921571eb24073e0737fa0bd44b4218f914 ]
vfs_inode is used only for the inode number everything else requires btrfs_inode.
--- fs/btrfs/inode.c | 2 +- fs/btrfs/qgroup.c | 14 +++++++------- fs/btrfs/qgroup.h | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-)
fs/btrfs/inode.c +1 -1
@@ -8640,7 +8640,7 @@ void btrfs_destroy_inode(struct inode *inode)btrfs_put_ordered_extent (ordered); } } -btrfs_qgroup_check_reserved_leak (inode); +btrfs_qgroup_check_reserved_leak (BTRFS_I (inode));inode_tree_del (inode);btrfs_drop_extent_cache (BTRFS_I (inode),0 , (u64)-1 ,0 );btrfs_inode_clear_file_extent_range (BTRFS_I (inode),0 , (u64)-1 );
fs/btrfs/qgroup.c +7 -7
@@ -3742,7 +3742,7 @@ void btrfs_qgroup_convert_reserved_meta(struct btrfs_root *root, int num_bytes)* Check qgroup reserved space leaking, normally at destroy inode * time */ -void btrfs_qgroup_check_reserved_leak (struct inode *inode) +void btrfs_qgroup_check_reserved_leak (struct btrfs_inode *inode) {struct extent_changeset changeset;struct ulist_node *unode;
@@ -3750,19 +3750,19 @@ void btrfs_qgroup_check_reserved_leak(struct inode *inode)int ret;extent_changeset_init (&changeset); - ret =clear_record_extent_bits (&BTRFS_I (inode)->io_tree,0 , (u64)-1 , + ret =clear_record_extent_bits (&inode->io_tree,0 , (u64)-1 ,EXTENT_QGROUP_RESERVED , &changeset);WARN_ON (ret <0 );if (WARN_ON (changeset.bytes_changed)) {ULIST_ITER_INIT (&iter);while ((unode =ulist_next (&changeset.range_changed, &iter))) { -btrfs_warn (BTRFS_I (inode)->root->fs_info, -"leaking qgroup reserved space, ino: %lu, start: %llu, end: %llu" , - inode->i_ino, unode->val, unode->aux); +btrfs_warn (inode->root->fs_info, +"leaking qgroup reserved space, ino: %llu, start: %llu, end: %llu" , +btrfs_ino (inode), unode->val, unode->aux); } -btrfs_qgroup_free_refroot (BTRFS_I (inode)->root->fs_info, -BTRFS_I (inode)->root->root_key.objectid, +btrfs_qgroup_free_refroot (inode->root->fs_info, + inode->root->root_key.objectid, changeset.bytes_changed,BTRFS_QGROUP_RSV_DATA ); }
fs/btrfs/qgroup.h +1 -1
@@ -399,7 +399,7 @@ void btrfs_qgroup_free_meta_all_pertrans(struct btrfs_root *root);*/ void btrfs_qgroup_convert_reserved_meta (struct btrfs_root *root,int num_bytes); -void btrfs_qgroup_check_reserved_leak (struct inode *inode); +void btrfs_qgroup_check_reserved_leak (struct btrfs_inode *inode);/* btrfs_qgroup_swapped_blocks related functions */ void btrfs_qgroup_init_swapped_blocks(
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 56/255 scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
In reply to Greg Kroah-HartmanFrom: Jing Xiangfeng <[email protected]>
[ Upstream commit 68e12e5f61354eb42cfffbc20a693153fc39738e ]
If scsi_host_lookup() fails we will jump to put_host which may cause a panic. Jump to exit_set_fnode instead.
--- drivers/scsi/scsi_transport_iscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_transport_iscsi.c +1 -1
@@ -3291,7 +3291,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.set_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_set_fnode; } idx = ev->u.set_flashnode.flashnode_idx;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 57/255 netfilter: nf_tables: report EEXIST on overlaps
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 77a92189ecfd061616ad531d386639aab7baaad9 ]
Replace EBUSY by EEXIST in the following cases:
- If the user adds a chain with a different configuration such as different type, hook and priority.
- If the user adds a non-base chain that clashes with an existing basechain.
- If the user adds a { key : value } mapping element and the key exists but the value differs.
- If the device already belongs to an existing flowtable.
User describe that this error reporting is confusing:
- https://bugzilla.netfilter.org/show_bug.cgi?id=1176
- https://bugzilla.netfilter.org/show_bug.cgi?id=1413
--- net/netfilter/nf_tables_api.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
net/netfilter/nf_tables_api.c +7 -9
@@ -2037,7 +2037,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,if (nla[NFTA_CHAIN_HOOK ]) {if (!nft_is_base_chain (chain)) -return -EBUSY ; +return -EEXIST ; err =nft_chain_parse_hook (ctx->net, nla, &hook, ctx->family, false);
@@ -2047,21 +2047,21 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, basechain =nft_base_chain (chain);if (basechain->type != hook.type) {nft_chain_release_hook (&hook); -return -EBUSY ; +return -EEXIST ; }if (ctx->family ==NFPROTO_NETDEV ) {if (!nft_hook_list_equal (&basechain->hook_list, &hook.list)) {nft_chain_release_hook (&hook); -return -EBUSY ; +return -EEXIST ; } }else { ops = &basechain->ops;if (ops->hooknum != hook.num || ops->priority != hook.priority) {nft_chain_release_hook (&hook); -return -EBUSY ; +return -EEXIST ; } }nft_chain_release_hook (&hook);
@@ -5160,10 +5160,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (nft_set_ext_exists (ext,NFT_SET_EXT_DATA ) ^nft_set_ext_exists (ext2,NFT_SET_EXT_DATA ) ||nft_set_ext_exists (ext,NFT_SET_EXT_OBJREF ) ^ -nft_set_ext_exists (ext2,NFT_SET_EXT_OBJREF )) { - err = -EBUSY ; +nft_set_ext_exists (ext2,NFT_SET_EXT_OBJREF )) goto err_element_clash; - } if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && memcmp(nft_set_ext_data(ext),
@@ -5171,7 +5169,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, (nft_set_ext_exists (ext,NFT_SET_EXT_OBJREF ) &&nft_set_ext_exists (ext2,NFT_SET_EXT_OBJREF ) && *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2))) - err = -EBUSY; + goto err_element_clash; else if (!(nlmsg_flags & NLM_F_EXCL)) err =0 ; }else if (err == -ENOTEMPTY ) {
@@ -6308,7 +6306,7 @@ static int nft_register_flowtable_net_hooks(struct net *net,list_for_each_entry (hook2, &ft->hook_list, list) {if (hook->ops.dev == hook2->ops.dev && hook->ops.pf == hook2->ops.pf) { - err = -EBUSY ; + err = -EEXIST ; goto err_unregister_net_hooks; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 58/255 ceph: fix potential mdsc use-after-free crash
In reply to Greg Kroah-HartmanFrom: Xiubo Li <[email protected]>
[ Upstream commit fa9967734227b44acb1b6918033f9122dc7825b9 ]
Make sure the delayed work stopped before releasing the resources.
cancel_delayed_work_sync() will only guarantee that the work finishes executing if the work is already in the ->worklist. That means after the cancel_delayed_work_sync() returns, it will leave the work requeued if it was rearmed at the end. That can lead to a use after free once the work struct is freed.
Fix it by flushing the delayed work instead of trying to cancel it, and ensure that the work doesn't rearm if the mdsc is stopping.
URL: https://tracker.ceph.com/issues/46293
--- fs/ceph/mds_client.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
fs/ceph/mds_client.c +13 -1
@@ -4285,6 +4285,9 @@ static void delayed_work(struct work_struct *work)dout ("mdsc delayed_work\n" ); +if (mdsc->stopping) +return ; +mutex_lock (&mdsc->mutex); renew_interval = mdsc->mdsmap->m_session_timeout >>2 ; renew_caps = time_after_eq(jiffies, HZ*renew_interval +
@@ -4660,7 +4663,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)static void ceph_mdsc_stop (struct ceph_mds_client *mdsc) {dout ("stop\n" ); -cancel_delayed_work_sync (&mdsc->delayed_work);/* cancel timer */ +/* +* Make sure the delayed work stopped before releasing +* the resources. +* +* Because the cancel_delayed_work_sync() will only +* guarantee that the work finishes executing. But the +* delayed work will re-arm itself again after that. +*/ +flush_delayed_work (&mdsc->delayed_work); +if (mdsc->mdsmap)ceph_mdsmap_destroy (mdsc->mdsmap);kfree (mdsc->sessions);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 59/255 ceph: do not access the kiocb after aio requests
In reply to Greg Kroah-HartmanFrom: Xiubo Li <[email protected]>
[ Upstream commit d1d9655052606fd9078e896668ec90191372d513 ]
In aio case, if the completion comes very fast just before the ceph_read_iter() returns to fs/aio.c, the kiocb will be freed in the completion callback, then if ceph_read_iter() access again we will potentially hit the use-after-free bug.
[ jlayton: initialize direct_lock early, and use it everywhere ]
URL: https://tracker.ceph.com/issues/45649
--- fs/ceph/file.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/ceph/file.c +3 -2
@@ -1538,6 +1538,7 @@ static ssize_t ceph_read_iter(struct kiocb *iocb, struct iov_iter *to)struct inode *inode =file_inode (filp);struct ceph_inode_info *ci =ceph_inode (inode);struct page *pinned_page =NULL ; +bool direct_lock = iocb->ki_flags &IOCB_DIRECT ;ssize_t ret;int want, got =0 ;int retry_op =0 , read =0 ;
@@ -1546,7 +1547,7 @@ again:dout ("aio_read %p %llx.%llx %llu~%u trying to get caps on %p\n" , inode,ceph_vinop (inode), iocb->ki_pos, (unsigned )len, inode); -if (iocb->ki_flags &IOCB_DIRECT ) +if (direct_lock)ceph_start_io_direct (inode);else ceph_start_io_read (inode);
@@ -1603,7 +1604,7 @@ again: }ceph_put_cap_refs (ci, got); -if (iocb->ki_flags &IOCB_DIRECT ) +if (direct_lock)ceph_end_io_direct (inode);else ceph_end_io_read (inode);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 60/255 scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
In reply to Greg Kroah-HartmanFrom: Javed Hasan <[email protected]>
[ Upstream commit e95b4789ff4380733006836d28e554dc296b2298 ]
In fcoe_sysfs_fcf_del(), we first deleted the fcf from the list and then freed it if ctlr_dev was not NULL. This was causing a memory leak.
Free the fcf even if ctlr_dev is NULL.
--- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/fcoe/fcoe_ctlr.c +1 -1
@@ -255,9 +255,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new)WARN_ON (!fcf_dev); new->fcf_dev =NULL ;fcoe_fcf_device_delete (fcf_dev); -kfree (new);mutex_unlock (&cdev->lock); } +kfree (new); }/**
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 61/255 i2c: i801: Add support for Intel Tiger Lake PCH-H
In reply to Greg Kroah-HartmanFrom: Jarkko Nikula <[email protected]>
[ Upstream commit f46efbcad97bfb2caded0397eccce7c71402868c ]
Add SMBus PCI ID on Intel Tiger Lake PCH-H.
--- drivers/i2c/busses/i2c-i801.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i2c/busses/i2c-i801.c +4 -0
@@ -67,6 +67,7 @@* Comet Lake-H (PCH) 0x06a3 32 hard yes yes yes * Elkhart Lake (PCH) 0x4b23 32 hard yes yes yes * Tiger Lake-LP (PCH) 0xa0a3 32 hard yes yes yes +* Tiger Lake-H (PCH) 0x43a3 32 hard yes yes yes * Jasper Lake (SOC) 0x4da3 32 hard yes yes yes * Comet Lake-V (PCH) 0xa3a3 32 hard yes yes yes *
@@ -221,6 +222,7 @@#define PCI_DEVICE_ID_INTEL_GEMINILAKE_SMBUS 0x31d4#define PCI_DEVICE_ID_INTEL_ICELAKE_LP_SMBUS 0x34a3#define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30 +#define PCI_DEVICE_ID_INTEL_TIGERLAKE_H_SMBUS 0x43a3#define PCI_DEVICE_ID_INTEL_ELKHART_LAKE_SMBUS 0x4b23#define PCI_DEVICE_ID_INTEL_JASPER_LAKE_SMBUS 0x4da3#define PCI_DEVICE_ID_INTEL_BROXTON_SMBUS 0x5ad4
@@ -1074,6 +1076,7 @@ static const struct pci_device_id i801_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_COMETLAKE_V_SMBUS) }, { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ELKHART_LAKE_SMBUS) }, { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TIGERLAKE_LP_SMBUS) }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TIGERLAKE_H_SMBUS) }, { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_JASPER_LAKE_SMBUS) }, { 0, } };
@@ -1748,6 +1751,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)case PCI_DEVICE_ID_INTEL_COMETLAKE_H_SMBUS :case PCI_DEVICE_ID_INTEL_ELKHART_LAKE_SMBUS :case PCI_DEVICE_ID_INTEL_TIGERLAKE_LP_SMBUS : +case PCI_DEVICE_ID_INTEL_TIGERLAKE_H_SMBUS :case PCI_DEVICE_ID_INTEL_JASPER_LAKE_SMBUS : priv->features |=FEATURE_BLOCK_PROC ; priv->features |=FEATURE_I2C_BLOCK_READ ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 62/255 EDAC/ie31200: Fallback if host bridge device is already initialized
In reply to Greg Kroah-HartmanFrom: Jason Baron <[email protected]>
[ Upstream commit 709ed1bcef12398ac1a35c149f3e582db04456c2 ]
The Intel uncore driver may claim some of the pci ids from ie31200 which means that the ie31200 edac driver will not initialize them as part of pci_register_driver().
Let's add a fallback for this case to 'pci_get_device()' to get a reference on the device such that it can still be configured. This is similar in approach to other edac drivers.
--- drivers/edac/ie31200_edac.c | 50 ++++++++++++++++++++++++++++++++++--- 1 file changed, 47 insertions(+), 3 deletions(-)
drivers/edac/ie31200_edac.c +47 -3
@@ -170,6 +170,8 @@ (n << (28 + (2 * skl) - PAGE_SHIFT))static int nr_channels; +static struct pci_dev *mci_pdev; +static int ie31200_registered =1 ;struct ie31200_priv {void __iomem *window;
@@ -538,12 +540,16 @@ fail_free:static int ie31200_init_one (struct pci_dev *pdev,const struct pci_device_id *ent) { -edac_dbg (0 ,"MC:\n" ); +int rc; +edac_dbg (0 ,"MC:\n" );if (pci_enable_device (pdev) <0 )return -EIO ; + rc =ie31200_probe1 (pdev, ent->driver_data); +if (rc ==0 && !mci_pdev) + mci_pdev =pci_dev_get (pdev); -return ie31200_probe1 (pdev, ent->driver_data); +return rc; }static void ie31200_remove_one (struct pci_dev *pdev)
@@ -552,6 +558,8 @@ static void ie31200_remove_one(struct pci_dev *pdev)struct ie31200_priv *priv;edac_dbg (0 ,"\n" ); +pci_dev_put (mci_pdev); + mci_pdev =NULL ; mci =edac_mc_del_mc (&pdev->dev);if (!mci)return ;
@@ -593,17 +601,53 @@ static struct pci_driver ie31200_driver = {static int __init ie31200_init (void ) { +int pci_rc, i; +edac_dbg (3 ,"MC:\n" );/* Ensure that the OPSTATE is set correctly for POLL or NMI */ opstate_init (); -return pci_register_driver (&ie31200_driver); + pci_rc =pci_register_driver (&ie31200_driver); +if (pci_rc <0 ) + goto fail0; + +if (!mci_pdev) { + ie31200_registered =0 ; +for (i =0 ; ie31200_pci_tbl[i].vendor !=0 ; i++) { + mci_pdev =pci_get_device (ie31200_pci_tbl[i].vendor, + ie31200_pci_tbl[i].device, +NULL ); +if (mci_pdev) +break ; + } +if (!mci_pdev) { +edac_dbg (0 ,"ie31200 pci_get_device fail\n" ); + pci_rc = -ENODEV ; + goto fail1; + } + pci_rc =ie31200_init_one (mci_pdev, &ie31200_pci_tbl[i]); +if (pci_rc <0 ) { +edac_dbg (0 ,"ie31200 init fail\n" ); + pci_rc = -ENODEV ; + goto fail1; + } + } +return 0 ; + +fail1: +pci_unregister_driver (&ie31200_driver); +fail0: +pci_dev_put (mci_pdev); + +return pci_rc; } static void __exit ie31200_exit(void) {edac_dbg (3 ,"MC:\n" );pci_unregister_driver (&ie31200_driver); +if (!ie31200_registered) +ie31200_remove_one (mci_pdev); }module_init (ie31200_init);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 63/255 hugetlbfs: prevent filesystem stacking of hugetlbfs
In reply to Greg Kroah-HartmanFrom: Mike Kravetz <[email protected]>
[ Upstream commit 15568299b7d9988063afce60731df605ab236e2a ]
syzbot found issues with having hugetlbfs on a union/overlay as reported in [1]. Due to the limitations (no write) and special functionality of hugetlbfs, it does not work well in filesystem stacking. There are no know use cases for hugetlbfs stacking. Rather than making modifications to get hugetlbfs working in such environments, simply prevent stacking.
[1] https://lore.kernel.org/linux-mm/[email protected]/
--- fs/hugetlbfs/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/hugetlbfs/inode.c +6 -0
@@ -1364,6 +1364,12 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc) sb->s_magic =HUGETLBFS_MAGIC ; sb->s_op = &hugetlbfs_ops; sb->s_time_gran =1 ; + +/* +* Due to the special and limited functionality of hugetlbfs, it does +* not work well as a stacking filesystem. +*/ + sb->s_stack_depth =FILESYSTEM_MAX_STACK_DEPTH ; sb->s_root =d_make_root (hugetlbfs_get_root (sb, ctx));if (!sb->s_root) goto out_free;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 64/255 media: davinci: vpif_capture: fix potential double free
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 602649eadaa0c977e362e641f51ec306bc1d365d ]
In case of errors vpif_probe_complete() releases memory for vpif_obj.sd and unregisters the V4L2 device. But then this is done again by vpif_probe() itself. The patch removes the cleaning from vpif_probe_complete().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/media/platform/davinci/vpif_capture.c | 2 -- 1 file changed, 2 deletions(-)
drivers/media/platform/davinci/vpif_capture.c +0 -2
@@ -1482,8 +1482,6 @@ probe_out:/* Unregister video device */ video_unregister_device (&ch->video_dev); } -kfree (vpif_obj.sd); -v4l2_device_unregister (&vpif_obj.v4l2_dev);return err; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 65/255 media: i2c: imx290: fix reset GPIO pin handling
In reply to Greg Kroah-HartmanFrom: Andrey Konovalov <[email protected]>
[ Upstream commit 3909a92d7df622b41b9ceeeea694e641cad7667b ]
According to https://www.kernel.org/doc/Documentation/gpio/consumer.txt,
- all of the gpiod_set_value_xxx() functions operate with the *logical* value. So in imx290_power_on() the reset signal should be cleared (de-asserted) with gpiod_set_value_cansleep(imx290->rst_gpio, 0), and in imx290_power_off() the value of 1 must be used to apply/assert the reset to the sensor. In the device tree the reset pin is described as GPIO_ACTIVE_LOW, and gpiod_set_value_xxx() functions take this into account,
- when devm_gpiod_get_optional() is called with GPIOD_ASIS, the GPIO is not initialized, and the direction must be set later; using a GPIO without setting its direction first is illegal and will result in undefined behavior. Fix this by using GPIOD_OUT_HIGH instead of GPIOD_ASIS (this asserts the reset signal to the sensor initially).
--- drivers/media/i2c/imx290.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/media/i2c/imx290.c +4 -3
@@ -628,7 +628,7 @@ static int imx290_power_on(struct device *dev) }usleep_range (1 ,2 ); -gpiod_set_value_cansleep (imx290->rst_gpio,1 ); +gpiod_set_value_cansleep (imx290->rst_gpio,0 );usleep_range (30000 ,31000 );return 0 ;
@@ -641,7 +641,7 @@ static int imx290_power_off(struct device *dev)struct imx290 *imx290 =to_imx290 (sd);clk_disable_unprepare (imx290->xclk); -gpiod_set_value_cansleep (imx290->rst_gpio,0 ); +gpiod_set_value_cansleep (imx290->rst_gpio,1 );regulator_bulk_disable (IMX290_NUM_SUPPLIES , imx290->supplies);return 0 ;
@@ -760,7 +760,8 @@ static int imx290_probe(struct i2c_client *client) goto free_err; } - imx290->rst_gpio =devm_gpiod_get_optional (dev,"reset" ,GPIOD_ASIS ); + imx290->rst_gpio =devm_gpiod_get_optional (dev,"reset" , +GPIOD_OUT_HIGH );if (IS_ERR (imx290->rst_gpio)) {dev_err (dev,"Cannot get reset gpio\n" ); ret =PTR_ERR (imx290->rst_gpio);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 66/255 drm/amd/display: change global buffer to local buffer
In reply to Greg Kroah-HartmanFrom: Lewis Huang <[email protected]>
[ Upstream commit 8ae5b155928c9183c2f37b5c4eec21037d958699 ]
[Why]
Multi-adapter calculate regamma table at the same time. Two thread used the same global variable cause race condition.
[How]
Change global buffer to local buffer
--- .../amd/display/amdgpu_dm/amdgpu_dm_color.c | 10 +- .../drm/amd/display/modules/color/Makefile | 4 + .../amd/display/modules/color/color_gamma.c | 115 ++++++++++-------- .../amd/display/modules/color/color_gamma.h | 18 ++- .../amd/display/modules/color/color_table.c | 48 ++++++++ .../amd/display/modules/color/color_table.h | 47 +++++++ 6 files changed, 183 insertions(+), 59 deletions(-) create mode 100644 drivers/gpu/drm/amd/display/modules/color/color_table.c create mode 100644 drivers/gpu/drm/amd/display/modules/color/color_table.h
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c +8 -2
@@ -195,10 +195,13 @@ static int __set_legacy_tf(struct dc_transfer_func *func, bool has_rom) {struct dc_gamma *gamma =NULL ; +struct calculate_buffer cal_buffer = {0 };bool res;ASSERT (lut && lut_size ==MAX_COLOR_LEGACY_LUT_ENTRIES ); + cal_buffer.buffer_index =-1 ; + gamma =dc_create_gamma ();if (!gamma)return -ENOMEM ;
@@ -208,7 +211,7 @@ static int __set_legacy_tf(struct dc_transfer_func *func,__drm_lut_to_dc_gamma (lut, gamma, true); res =mod_color_calculate_regamma_params (func, gamma, true, has_rom, -NULL ); +NULL , &cal_buffer);dc_gamma_release (&gamma);
@@ -221,10 +224,13 @@ static int __set_output_tf(struct dc_transfer_func *func, bool has_rom) {struct dc_gamma *gamma =NULL ; +struct calculate_buffer cal_buffer = {0 };bool res;ASSERT (lut && lut_size ==MAX_COLOR_LUT_ENTRIES ); + cal_buffer.buffer_index =-1 ; + gamma =dc_create_gamma ();if (!gamma)return -ENOMEM ;
@@ -248,7 +254,7 @@ static int __set_output_tf(struct dc_transfer_func *func,*/ gamma->type =GAMMA_CS_TFM_1D ; res =mod_color_calculate_regamma_params (func, gamma, false, - has_rom,NULL ); + has_rom,NULL , &cal_buffer); }dc_gamma_release (&gamma);
drivers/gpu/drm/amd/display/modules/color/Makefile +4 -0
@@ -25,6 +25,10 @@ MOD_COLOR = color_gamma.o +ifdef CONFIG_DRM_AMD_DC_DCN +MOD_COLOR += color_table.o +endif + AMD_DAL_MOD_COLOR = $(addprefix $(AMDDALPATH)/modules/color/,$(MOD_COLOR)) #$(info ************ DAL COLOR MODULE MAKEFILE ************)
drivers/gpu/drm/amd/display/modules/color/color_gamma.c +61 -54
326 lines not on this page · raw message
drivers/gpu/drm/amd/display/modules/color/color_gamma.h +15 -3
@@ -26,6 +26,8 @@#ifndef COLOR_MOD_COLOR_GAMMA_H_ #define COLOR_MOD_COLOR_GAMMA_H_ +#include "color_table.h" +struct dc_transfer_func ;struct dc_gamma ;struct dc_transfer_func_distributed_points ;
@@ -83,6 +85,12 @@ struct freesync_hdr_tf_params {unsigned int skip_tm;// skip tm }; +struct calculate_buffer { +int buffer_index; +struct fixed31_32 buffer[NUM_PTS_IN_REGION ]; +struct fixed31_32 gamma_of_2; +}; +struct translate_from_linear_space_args {struct fixed31_32 arg;struct fixed31_32 a0;
@@ -90,6 +98,7 @@ struct translate_from_linear_space_args {struct fixed31_32 a2;struct fixed31_32 a3;struct fixed31_32 gamma; +struct calculate_buffer *cal_buffer; };void setup_x_points_distribution (void );
@@ -99,7 +108,8 @@ void precompute_de_pq(void);bool mod_color_calculate_regamma_params (struct dc_transfer_func *output_tf,const struct dc_gamma *ramp,bool mapUserRamp,bool canRomBeUsed, -const struct freesync_hdr_tf_params *fs_params); +const struct freesync_hdr_tf_params *fs_params, +struct calculate_buffer *cal_buffer); bool mod_color_calculate_degamma_params(struct dc_color_caps *dc_caps, struct dc_transfer_func *output_tf,
@@ -109,10 +119,12 @@ bool mod_color_calculate_degamma_curve(enum dc_transfer_func_predefined trans, struct dc_transfer_func_distributed_points *points);bool calculate_user_regamma_coeff (struct dc_transfer_func *output_tf, -const struct regamma_lut *regamma); +const struct regamma_lut *regamma, +struct calculate_buffer *cal_buffer);bool calculate_user_regamma_ramp (struct dc_transfer_func *output_tf, -const struct regamma_lut *regamma); +const struct regamma_lut *regamma, +struct calculate_buffer *cal_buffer);#endif /* COLOR_MOD_COLOR_GAMMA_H_ */
drivers/gpu/drm/amd/display/modules/color/color_table.c new file +48 -0
48 lines not on this page · raw message
drivers/gpu/drm/amd/display/modules/color/color_table.h new file +47 -0
47 lines not on this page · raw message
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 67/255 drm/amd/display: fix compilation error on allmodconfig
In reply to Greg Kroah-HartmanFrom: Qingqing Zhuo <[email protected]>
[ Upstream commit 8c823e4ff67c78659ab403d63d071103416f49eb ]
when compiled with allmodconfig option, there are error messages as below:
ERROR: modpost:
"mod_color_is_table_init"
[drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost:
"mod_color_get_table"
[drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost:
"mod_color_set_table_init_state"
[drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
To fix the issue, this commits removesCONFIG_DRM_AMD_DC_DCN guard in color/makefile.
--- drivers/gpu/drm/amd/display/modules/color/Makefile | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/gpu/drm/amd/display/modules/color/Makefile +1 -5
@@ -23,11 +23,7 @@ # Makefile for the color sub-module of DAL. # -MOD_COLOR = color_gamma.o - -ifdef CONFIG_DRM_AMD_DC_DCN -MOD_COLOR += color_table.o -endif +MOD_COLOR = color_gamma.o color_table.o AMD_DAL_MOD_COLOR = $(addprefix $(AMDDALPATH)/modules/color/,$(MOD_COLOR)) #$(info ************ DAL COLOR MODULE MAKEFILE ************)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 68/255 KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe
In reply to Greg Kroah-HartmanFrom: David Brazdil <[email protected]>
[ Upstream commit b38b298aa4397e2dc74a89b4dd3eac9e59b64c96 ]
__hyp_call_panic_nvhe contains inline assembly which did not declare its dependency on the __hyp_panic_string symbol.
The static-declared string has previously been kept alive because of a use in __hyp_call_panic_vhe. Fix this in preparation for separating the source files between VHE and nVHE when the two users land in two different compilation units. The static variable otherwise gets dropped when compiling the nVHE source file, causing an undefined symbol linker error later.
--- arch/arm64/kvm/hyp/switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kvm/hyp/switch.c +1 -1
@@ -897,7 +897,7 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par,* making sure it is a kernel address and not a PC-relative * reference. */ - asmvolatile ("ldr %0, =__hyp_panic_string" :"=r" (str_va)); + asmvolatile ("ldr %0, =%1" :"=r" (str_va) :"S" (__hyp_panic_string)); __hyp_do_panic(str_va, spsr, elr,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 69/255 powerpc/spufs: add CONFIG_COREDUMP dependency
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit b648a5132ca3237a0f1ce5d871fff342b0efcf8a ]
The kernel test robot pointed out a slightly different error message after recent commit 5456ffdee666 ("powerpc/spufs: simplify spufs core dumping") to spufs for a configuration that never worked:
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_proxydma_info_dump':
Quoted 1 line
Quoted 1 line
file.c:(.text+0x4c68): undefined reference to `.dump_emit'
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_dma_info_dump':
file.c:(.text+0x4d70): undefined reference to `.dump_emit'
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_wbox_info_dump':
file.c:(.text+0x4df4): undefined reference to `.dump_emit'
Add a Kconfig dependency to prevent this from happening again.
--- arch/powerpc/platforms/cell/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/cell/Kconfig +1 -0
@@ -44,6 +44,7 @@ config SPU_FS tristate "SPU file system" default m depends on PPC_CELL + depends on COREDUMP select SPU_BASE help The SPU file system is used to access Synergistic Processing
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 70/255 dmaengine: idxd: fix PCI_MSI build errors
In reply to Greg Kroah-Hartman[ Upstream commit d6a7bb869dd8a516901591136a9a895fd829d6c6 ]
Fix build errors when CONFIG_PCI_MSI is not enabled by making the driver depend on PCI_MSI:
ld: drivers/dma/idxd/device.o: in function `idxd_mask_msix_vector':
device.c:(.text+0x26f): undefined reference to `pci_msi_mask_irq'
ld: drivers/dma/idxd/device.o: in function `idxd_unmask_msix_vector':
device.c:(.text+0x2af): undefined reference to `pci_msi_unmask_irq'
--- drivers/dma/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/dma/Kconfig +1 -0
@@ -285,6 +285,7 @@ config INTEL_IDMA64 config INTEL_IDXD tristate "Intel Data Accelerators support" depends on PCI && X86_64 + depends on PCI_MSI select DMA_ENGINE select SBITMAP help
Signature · 1 line
2.25.1
Re: [PATCH 5.8 070/255] dmaengine: idxd: fix PCI_MSI build errors
Quoted 10 lines · Greg Kroah-Hartman
[ Upstream commit
d6a7bb869dd8a516901591136a9a895fd829d6c6]Fix build errors when
CONFIG_PCI_MSIis not enabled by making the driver depend onPCI_MSI:ld:
drivers/dma/idxd/device.o: in function `idxd_mask_msix_vector':
device.c:(.text+0x26f): undefined reference to `pci_msi_mask_irq'
ld:drivers/dma/idxd/device.o: in function `idxd_unmask_msix_vector':
device.c:(.text+0x2af): undefined reference to `pci_msi_unmask_irq'
Quoted 7 lines
Signed-off-by Randy Dunlap <[email protected]>Cc Dave Jiang <[email protected]>Cc Vinod Koul <[email protected]>Signed-off-by Vinod Koul <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 17 lines
--- drivers/dma/Kconfig | 1 + 1 file changed, 1 insertion(+)drivers/dma/Kconfig +1
-0@@ -285,6 +285,7 @@ config INTEL_IDMA64 config INTEL_IDXD tristate "Intel Data Accelerators support" depends on PCI && X86_64 + depends on PCI_MSI select DMA_ENGINE select SBITMAP help
Greg Kroah-Hartman
maintainerPATCH 71/255 USB: sisusbvga: Fix a potential UB casued by left shifting a negative value
In reply to Greg Kroah-HartmanFrom: Changming Liu <[email protected]>
[ Upstream commit 2b53a19284f537168fb506f2f40d7fda40a01162 ]
The char buffer buf, receives data directly from user space, so its content might be negative and its elements are left shifted to form an unsigned integer.
Since left shifting a negative value is undefined behavior, thus change the char to u8 to elimintate this UB.
--- drivers/usb/misc/sisusbvga/sisusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/sisusbvga/sisusb.c +1 -1
@@ -761,7 +761,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr,u8 swap8, fromkern = kernbuffer ?1 :0 ;u16 swap16;u32 swap32, flag = (length >>28 ) &1 ; -char buf[4 ]; +u8 buf[4 ];/* if neither kernbuffer not userbuffer are given, assume * data in obuf
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 72/255 mmc: sdhci-of-arasan: fix timings allocation code
In reply to Greg Kroah-HartmanFrom: Manish Narani <[email protected]>
[ Upstream commit 88e1d0b175ec0bfa775c8629eae2a728726e2c6a ]
The initial code that was adding delays was doing a cast over undefined memory. This meant that the delays would be all gibberish.
This change, allocates all delays on the stack, and assigns them from the ZynqMP & Versal macros/phase-list. And then finally copies them over the common iclk_phase & oclk_phase variables.
--- drivers/mmc/host/sdhci-of-arasan.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/mmc/host/sdhci-of-arasan.c +14 -11
@@ -1025,7 +1025,6 @@ static void arasan_dt_read_clk_phase(struct device *dev,static void arasan_dt_parse_clk_phases (struct device *dev,struct sdhci_arasan_clk_data *clk_data) { -int *iclk_phase, *oclk_phase;u32 mio_bank =0 ;int i;
@@ -1037,28 +1036,32 @@ static void arasan_dt_parse_clk_phases(struct device *dev, clk_data->set_clk_delays = sdhci_arasan_set_clk_delays;if (of_device_is_compatible (dev->of_node,"xlnx,zynqmp-8.9a" )) { - iclk_phase = (int [MMC_TIMING_MMC_HS400 +1 ])ZYNQMP_ICLK_PHASE ; - oclk_phase = (int [MMC_TIMING_MMC_HS400 +1 ])ZYNQMP_OCLK_PHASE ; +u32 zynqmp_iclk_phase[MMC_TIMING_MMC_HS400 +1 ] = +ZYNQMP_ICLK_PHASE ; +u32 zynqmp_oclk_phase[MMC_TIMING_MMC_HS400 +1 ] = +ZYNQMP_OCLK_PHASE ;of_property_read_u32 (dev->of_node,"xlnx,mio-bank" , &mio_bank);if (mio_bank ==2 ) { - oclk_phase[MMC_TIMING_UHS_SDR104 ] =90 ; - oclk_phase[MMC_TIMING_MMC_HS200 ] =90 ; + zynqmp_oclk_phase[MMC_TIMING_UHS_SDR104 ] =90 ; + zynqmp_oclk_phase[MMC_TIMING_MMC_HS200 ] =90 ; }for (i =0 ; i <=MMC_TIMING_MMC_HS400 ; i++) { - clk_data->clk_phase_in[i] = iclk_phase[i]; - clk_data->clk_phase_out[i] = oclk_phase[i]; + clk_data->clk_phase_in[i] = zynqmp_iclk_phase[i]; + clk_data->clk_phase_out[i] = zynqmp_oclk_phase[i]; } }if (of_device_is_compatible (dev->of_node,"xlnx,versal-8.9a" )) { - iclk_phase = (int [MMC_TIMING_MMC_HS400 +1 ])VERSAL_ICLK_PHASE ; - oclk_phase = (int [MMC_TIMING_MMC_HS400 +1 ])VERSAL_OCLK_PHASE ; +u32 versal_iclk_phase[MMC_TIMING_MMC_HS400 +1 ] = +VERSAL_ICLK_PHASE ; +u32 versal_oclk_phase[MMC_TIMING_MMC_HS400 +1 ] = +VERSAL_OCLK_PHASE ;for (i =0 ; i <=MMC_TIMING_MMC_HS400 ; i++) { - clk_data->clk_phase_in[i] = iclk_phase[i]; - clk_data->clk_phase_out[i] = oclk_phase[i]; + clk_data->clk_phase_in[i] = versal_iclk_phase[i]; + clk_data->clk_phase_out[i] = versal_oclk_phase[i]; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 73/255 brcmfmac: Set timeout value when configuring power save
In reply to Greg Kroah-HartmanFrom: Nicolas Saenz Julienne <[email protected]>
[ Upstream commit 3dc05ffb04436020f63138186dbc4f37bd938552 ]
Set the timeout value as per cfg80211's set_power_mgmt() request. If the requested value value is left undefined we set it to 2 seconds, the maximum supported value.
--- .../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +8 -0
@@ -84,6 +84,8 @@#define BRCMF_ND_INFO_TIMEOUT msecs_to_jiffies(2000) +#define BRCMF_PS_MAX_TIMEOUT_MS 2000 +#define BRCMF_ASSOC_PARAMS_FIXED_SIZE \ (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
@@ -2941,6 +2943,12 @@ brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,else bphy_err (drvr,"error (%d)\n" , err); } + + err =brcmf_fil_iovar_int_set (ifp,"pm2_sleep_ret" , +min_t (u32, timeout,BRCMF_PS_MAX_TIMEOUT_MS )); +if (err) +bphy_err (drvr,"Unable to set pm timeout, (%d)\n" , err); + done:brcmf_dbg (TRACE ,"Exit\n" );return err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 74/255 pinctrl: mediatek: avoid virtual gpio trying to set reg
In reply to Greg Kroah-HartmanFrom: Hanks Chen <[email protected]>
[ Upstream commit edd546465002621665a3a275abe908a30efdce5b ]
for virtual gpios, they should not do reg setting and should behave as expected for eint function.
--- .../pinctrl/mediatek/pinctrl-mtk-common-v2.c | 25 +++++++++++++++++++ .../pinctrl/mediatek/pinctrl-mtk-common-v2.h | 1 + drivers/pinctrl/mediatek/pinctrl-paris.c | 7 ++++++ 3 files changed, 33 insertions(+)
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +25 -0
@@ -243,6 +243,28 @@ static int mtk_xt_find_eint_num(struct mtk_pinctrl *hw, unsigned long eint_n)return EINT_NA ; } +/* +* Virtual GPIO only used inside SOC and not being exported to outside SOC. +* Some modules use virtual GPIO as eint (e.g. pmif or usb). +* In MTK platform, external interrupt (EINT) and GPIO is 1-1 mapping +* and we can set GPIO as eint. +* But some modules use specific eint which doesn't have real GPIO pin. +* So we use virtual GPIO to map it. +*/ + +bool mtk_is_virt_gpio (struct mtk_pinctrl *hw,unsigned int gpio_n) +{ +const struct mtk_pin_desc *desc; +bool virt_gpio = false; + + desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio_n]; + +if (desc->funcs && !desc->funcs[desc->eint.eint_m].name) + virt_gpio = true; + +return virt_gpio; +} +static int mtk_xt_get_gpio_n (void *data,unsigned long eint_n,unsigned int *gpio_n,struct gpio_chip **gpio_chip)
@@ -295,6 +317,9 @@ static int mtk_xt_set_gpio_as_eint(void *data, unsigned long eint_n)if (err)return err; +if (mtk_is_virt_gpio (hw, gpio_n)) +return 0 ; + desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio_n]; err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_MODE,
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h +1 -0
@@ -315,4 +315,5 @@ int mtk_pinconf_adv_drive_set(struct mtk_pinctrl *hw,int mtk_pinconf_adv_drive_get (struct mtk_pinctrl *hw,const struct mtk_pin_desc *desc,u32 *val); +bool mtk_is_virt_gpio (struct mtk_pinctrl *hw,unsigned int gpio_n);#endif /* __PINCTRL_MTK_COMMON_V2_H */
drivers/pinctrl/mediatek/pinctrl-paris.c +7 -0
@@ -769,6 +769,13 @@ static int mtk_gpio_get_direction(struct gpio_chip *chip, unsigned int gpio)if (gpio >= hw->soc->npins)return -EINVAL ; +/* +* "Virtual" GPIOs are always and only used for interrupts +* Since they are only used for interrupts, they are always inputs +*/ +if (mtk_is_virt_gpio (hw, gpio)) +return 1 ; + desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio]; err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &value);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 75/255 pinctrl: mediatek: fix build for tristate changes
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 047cd9a6bd8a2a73e8d92eb97a1b50c7bcd59279 ]
Export mtk_is_virt_gpio() for the case whenCONFIG_PINCTRL_MTK=yCONFIG_PINCTRL_MTK_V2=yCONFIG_PINCTRL_MTK_MOORE=yCONFIG_PINCTRL_MTK_PARIS=m
to fix this build error:
ERROR: modpost: "mtk_is_virt_gpio" [drivers/pinctrl/mediatek/pinctrl-paris.ko] undefined!
--- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +1 -0
@@ -264,6 +264,7 @@ bool mtk_is_virt_gpio(struct mtk_pinctrl *hw, unsigned int gpio_n)return virt_gpio; } +EXPORT_SYMBOL_GPL (mtk_is_virt_gpio); static int mtk_xt_get_gpio_n(void *data, unsigned long eint_n, unsigned int *gpio_n,
Signature · 9 lines
2.25.1 _______________________________________________ Linux-mediatek mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-mediatek
Greg Kroah-Hartman
maintainerPATCH 76/255 efi: provide empty efi_enter_virtual_mode implementation
In reply to Greg Kroah-HartmanFrom: Andrey Konovalov <[email protected]>
[ Upstream commit 2c547f9da0539ad1f7ef7f08c8c82036d61b011a ]
When CONFIG_EFI is not enabled, we might get an undefined reference to efi_enter_virtual_mode() error, if this efi_enabled() call isn't inlined into start_kernel(). This happens in particular, if start_kernel() is annodated with __no_sanitize_address.
--- include/linux/efi.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/efi.h +4 -0
@@ -606,7 +606,11 @@ extern void *efi_get_pal_addr (void);extern void efi_map_pal_code (void );extern void efi_memmap_walk (efi_freemem_callback_t callback,void *arg);extern void efi_gettimeofday (struct timespec64 *ts); +#ifdef CONFIG_EFI extern void efi_enter_virtual_mode (void );/* switch EFI to virtual mode, if possible */ +#else +static inline void efi_enter_virtual_mode (void ) {} +#endif #ifdef CONFIG_X86 extern efi_status_t efi_query_variable_store(u32 attributes, unsigned long size,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 77/255 arm64: Fix __cpu_logical_map undefined issue
In reply to Greg Kroah-HartmanFrom: Kefeng Wang <[email protected]>
[ Upstream commit eaecca9e7710281be7c31d892c9f447eafd7ddd9 ]
The __cpu_logical_map undefined issue occued when the new tegra194-cpufreq drvier building as a module.
ERROR: modpost: "__cpu_logical_map" [drivers/cpufreq/tegra194-cpufreq.ko] undefined!
The driver using cpu_logical_map() macro which will expand to __cpu_logical_map, we can't access it in a drvier. Let's turn cpu_logical_map() into a C wrapper and export it to fix the build issue.
Also create a function set_cpu_logical_map(cpu, hwid) when assign a value to cpu_logical_map(cpu).
--- arch/arm64/include/asm/smp.h | 7 ++++++- arch/arm64/kernel/setup.c | 8 +++++++- arch/arm64/kernel/smp.c | 6 +++--- 3 files changed, 16 insertions(+), 5 deletions(-)
arch/arm64/include/asm/smp.h +6 -1
@@ -46,7 +46,12 @@ DECLARE_PER_CPU_READ_MOSTLY(int, cpu_number);* Logical CPU mapping. */ extern u64 __cpu_logical_map[NR_CPUS ]; -#define cpu_logical_map (cpu) __cpu_logical_map[cpu] +extern u64 cpu_logical_map (int cpu); + +static inline void set_cpu_logical_map (int cpu,u64 hwid) +{ + __cpu_logical_map[cpu] = hwid; +}struct seq_file ;
arch/arm64/kernel/setup.c +7 -1
@@ -85,7 +85,7 @@ u64 __cacheline_aligned boot_args[4];void __init smp_setup_processor_id (void ) {u64 mpidr =read_cpuid_mpidr () &MPIDR_HWID_BITMASK ; -cpu_logical_map (0 ) = mpidr; +set_cpu_logical_map (0 , mpidr);/* * clear __my_cpu_offset on boot CPU to avoid hang caused by
@@ -276,6 +276,12 @@ arch_initcall(reserve_memblock_reserved_regions);u64 __cpu_logical_map[NR_CPUS ] = { [0 ...NR_CPUS -1 ] =INVALID_HWID }; +u64 cpu_logical_map (int cpu) +{ +return __cpu_logical_map[cpu]; +} +EXPORT_SYMBOL_GPL (cpu_logical_map); +void __init setup_arch (char **cmdline_p) { init_mm.start_code = (unsigned long ) _text;
arch/arm64/kernel/smp.c +3 -3
@@ -567,7 +567,7 @@ acpi_map_gic_cpu_interface(struct acpi_madt_generic_interrupt *processor)return ;/* map the logical cpu id to cpu MPIDR */ -cpu_logical_map (cpu_count) = hwid; +set_cpu_logical_map (cpu_count, hwid); cpu_madt_gicc[cpu_count] = *processor;
@@ -681,7 +681,7 @@ static void __init of_parse_and_init_cpus(void) goto next;pr_debug ("cpu logical map 0x%llx\n" , hwid); -cpu_logical_map (cpu_count) = hwid; +set_cpu_logical_map (cpu_count, hwid);early_map_cpu_to_node (cpu_count,of_node_to_nid (dn)); next:
@@ -722,7 +722,7 @@ void __init smp_init_cpus(void)for (i =1 ; i < nr_cpu_ids; i++) {if (cpu_logical_map (i) !=INVALID_HWID ) {if (smp_cpu_setup (i)) -cpu_logical_map (i) =INVALID_HWID ; +set_cpu_logical_map (i,INVALID_HWID ); } } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 78/255 net: openvswitch: introduce common code for flushing flows
In reply to Greg Kroah-HartmanFrom: Tonghao Zhang <[email protected]>
[ Upstream commit 1f3a090b9033f69de380c03db3ea1a1015c850cf ]
To avoid some issues, for example RCU usage warning and double free, we should flush the flows under ovs_lock. This patch refactors table_instance_destroy and introduces table_instance_flow_flush which can be invoked by __dp_destroy or ovs_flow_tbl_flush.
Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2020-August/050489.html
--- net/openvswitch/datapath.c | 10 +++++++++- net/openvswitch/flow_table.c | 35 +++++++++++++++-------------------- net/openvswitch/flow_table.h | 3 +++ 3 files changed, 27 insertions(+), 21 deletions(-)
net/openvswitch/datapath.c +9 -1
@@ -1736,6 +1736,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)/* Called with ovs_mutex. */ static void __dp_destroy (struct datapath *dp) { +struct flow_table *table = &dp->table;int i;for (i =0 ; i <DP_VPORT_HASH_BUCKETS ; i++) {
@@ -1754,7 +1755,14 @@ static void __dp_destroy(struct datapath *dp)*/ ovs_dp_detach_port (ovs_vport_ovsl (dp,OVSP_LOCAL )); -/* RCU destroy the flow table */ +/* Flush sw_flow in the tables. RCU cb only releases resource +* such as dp, ports and tables. That may avoid some issues +* such as RCU usage warning. +*/ +table_instance_flow_flush (table,ovsl_dereference (table->ti), +ovsl_dereference (table->ufid_ti)); + +/* RCU destroy the ports, meters and flow tables. */ call_rcu (&dp->rcu, destroy_dp_rcu); }
net/openvswitch/flow_table.c +15 -20
@@ -345,19 +345,15 @@ static void table_instance_flow_free(struct flow_table *table,flow_mask_remove (table, flow->mask); } -static void table_instance_destroy (struct flow_table *table, -struct table_instance *ti, -struct table_instance *ufid_ti, -bool deferred) +/* Must be called with OVS mutex held. */ +void table_instance_flow_flush (struct flow_table *table, +struct table_instance *ti, +struct table_instance *ufid_ti) {int i; -if (!ti) -return ; - -BUG_ON (!ufid_ti);if (ti->keep_flows) - goto skip_flows; +return ;for (i =0 ; i < ti->n_buckets; i++) {struct sw_flow *flow;
@@ -369,18 +365,16 @@ static void table_instance_destroy(struct flow_table *table,table_instance_flow_free (table, ti, ufid_ti, flow, false); -ovs_flow_free (flow, deferred); +ovs_flow_free (flow, true); } } +} -skip_flows: -if (deferred) { -call_rcu (&ti->rcu, flow_tbl_destroy_rcu_cb); -call_rcu (&ufid_ti->rcu, flow_tbl_destroy_rcu_cb); - }else { -__table_instance_destroy (ti); -__table_instance_destroy (ufid_ti); - } +static void table_instance_destroy (struct table_instance *ti, +struct table_instance *ufid_ti) +{ +call_rcu (&ti->rcu, flow_tbl_destroy_rcu_cb); +call_rcu (&ufid_ti->rcu, flow_tbl_destroy_rcu_cb); }/* No need for locking this function is called from RCU callback or
@@ -393,7 +387,7 @@ void ovs_flow_tbl_destroy(struct flow_table *table)free_percpu (table->mask_cache);kfree_rcu (rcu_dereference_raw (table->mask_array), rcu); -table_instance_destroy (table, ti, ufid_ti, false); +table_instance_destroy (ti, ufid_ti); } struct sw_flow *ovs_flow_tbl_dump_next(struct table_instance *ti,
@@ -511,7 +505,8 @@ int ovs_flow_tbl_flush(struct flow_table *flow_table) flow_table->count =0 ; flow_table->ufid_count =0 ; -table_instance_destroy (flow_table, old_ti, old_ufid_ti, true); +table_instance_flow_flush (flow_table, old_ti, old_ufid_ti); +table_instance_destroy (old_ti, old_ufid_ti);return 0 ; err_free_ti:
net/openvswitch/flow_table.h +3 -0
@@ -86,4 +86,7 @@ bool ovs_flow_cmp(const struct sw_flow *, const struct sw_flow_match *);void ovs_flow_mask_key (struct sw_flow_key *dst,const struct sw_flow_key *src,bool full,const struct sw_flow_mask *mask); +void table_instance_flow_flush (struct flow_table *table, +struct table_instance *ti, +struct table_instance *ufid_ti);#endif /* flow_table.h */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 79/255 PCI: qcom: Add missing ipq806x clocks in PCIe driver
In reply to Greg Kroah-HartmanFrom: Ansuel Smith <[email protected]>
[ Upstream commit 8b6f0330b5f9a7543356bfa9e76d580f03aa2c1e ]
Aux and Ref clk are missing in PCIe qcom driver. Add support for this optional clks for ipq8064/apq8064 SoC.
--- drivers/pci/controller/dwc/pcie-qcom.c | 38 ++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 5 deletions(-)
drivers/pci/controller/dwc/pcie-qcom.c +33 -5
@@ -106,6 +106,8 @@ struct qcom_pcie_resources_2_1_0 {struct clk *iface_clk;struct clk *core_clk;struct clk *phy_clk; +struct clk *aux_clk; +struct clk *ref_clk;struct reset_control *pci_reset;struct reset_control *axi_reset;struct reset_control *ahb_reset;
@@ -264,6 +266,14 @@ static int qcom_pcie_get_resources_2_1_0(struct qcom_pcie *pcie)if (IS_ERR (res->phy_clk))return PTR_ERR (res->phy_clk); + res->aux_clk =devm_clk_get_optional (dev,"aux" ); +if (IS_ERR (res->aux_clk)) +return PTR_ERR (res->aux_clk); + + res->ref_clk =devm_clk_get_optional (dev,"ref" ); +if (IS_ERR (res->ref_clk)) +return PTR_ERR (res->ref_clk); + res->pci_reset =devm_reset_control_get_exclusive (dev,"pci" );if (IS_ERR (res->pci_reset))return PTR_ERR (res->pci_reset);
@@ -296,6 +306,8 @@ static void qcom_pcie_deinit_2_1_0(struct qcom_pcie *pcie)clk_disable_unprepare (res->iface_clk);clk_disable_unprepare (res->core_clk);clk_disable_unprepare (res->phy_clk); +clk_disable_unprepare (res->aux_clk); +clk_disable_unprepare (res->ref_clk);regulator_bulk_disable (ARRAY_SIZE (res->supplies), res->supplies); }
@@ -326,16 +338,28 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) goto err_assert_ahb; } + ret =clk_prepare_enable (res->core_clk); +if (ret) { +dev_err (dev,"cannot prepare/enable core clock\n" ); + goto err_clk_core; + } + ret =clk_prepare_enable (res->phy_clk);if (ret) {dev_err (dev,"cannot prepare/enable phy clock\n" ); goto err_clk_phy; } - ret =clk_prepare_enable (res->core_clk); + ret =clk_prepare_enable (res->aux_clk);if (ret) { -dev_err (dev,"cannot prepare/enable core clock\n" ); - goto err_clk_core; +dev_err (dev,"cannot prepare/enable aux clock\n" ); + goto err_clk_aux; + } + + ret =clk_prepare_enable (res->ref_clk); +if (ret) { +dev_err (dev,"cannot prepare/enable ref clock\n" ); + goto err_clk_ref; } ret =reset_control_deassert (res->ahb_reset);
@@ -411,10 +435,14 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie)return 0 ; err_deassert_ahb: -clk_disable_unprepare (res->core_clk); -err_clk_core: +clk_disable_unprepare (res->ref_clk); +err_clk_ref: +clk_disable_unprepare (res->aux_clk); +err_clk_aux:clk_disable_unprepare (res->phy_clk); err_clk_phy: +clk_disable_unprepare (res->core_clk); +err_clk_core:clk_disable_unprepare (res->iface_clk); err_assert_ahb:regulator_bulk_disable (ARRAY_SIZE (res->supplies), res->supplies);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 80/255 PCI: qcom: Change duplicate PCI reset to phy reset
In reply to Greg Kroah-HartmanFrom: Abhishek Sahu <[email protected]>
[ Upstream commit dd58318c019f10bc94db36df66af6c55d4c0cbba ]
The deinit issues reset_control_assert for PCI twice and does not contain phy reset.
--- drivers/pci/controller/dwc/pcie-qcom.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
drivers/pci/controller/dwc/pcie-qcom.c +8 -10
@@ -298,14 +298,14 @@ static void qcom_pcie_deinit_2_1_0(struct qcom_pcie *pcie) {struct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0; +clk_disable_unprepare (res->phy_clk);reset_control_assert (res->pci_reset);reset_control_assert (res->axi_reset);reset_control_assert (res->ahb_reset);reset_control_assert (res->por_reset); -reset_control_assert (res->pci_reset); +reset_control_assert (res->phy_reset);clk_disable_unprepare (res->iface_clk);clk_disable_unprepare (res->core_clk); -clk_disable_unprepare (res->phy_clk);clk_disable_unprepare (res->aux_clk);clk_disable_unprepare (res->ref_clk);regulator_bulk_disable (ARRAY_SIZE (res->supplies), res->supplies);
@@ -344,12 +344,6 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) goto err_clk_core; } - ret =clk_prepare_enable (res->phy_clk); -if (ret) { -dev_err (dev,"cannot prepare/enable phy clock\n" ); - goto err_clk_phy; - } - ret =clk_prepare_enable (res->aux_clk);if (ret) {dev_err (dev,"cannot prepare/enable aux clock\n" );
@@ -422,6 +416,12 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie)return ret; } + ret =clk_prepare_enable (res->phy_clk); +if (ret) { +dev_err (dev,"cannot prepare/enable phy clock\n" ); + goto err_deassert_ahb; + } +/* wait for clock acquisition */ usleep_range (1000 ,1500 );
@@ -439,8 +439,6 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) err_clk_ref:clk_disable_unprepare (res->aux_clk); err_clk_aux: -clk_disable_unprepare (res->phy_clk); -err_clk_phy:clk_disable_unprepare (res->core_clk); err_clk_core:clk_disable_unprepare (res->iface_clk);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 81/255 PCI: qcom: Add missing reset for ipq806x
In reply to Greg Kroah-HartmanFrom: Ansuel Smith <[email protected]>
[ Upstream commit ee367e2cdd2202b5714982739e684543cd2cee0e ]
Add missing ext reset used by ipq8064 SoC in PCIe qcom driver.
--- drivers/pci/controller/dwc/pcie-qcom.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/pci/controller/dwc/pcie-qcom.c +12 -0
@@ -113,6 +113,7 @@ struct qcom_pcie_resources_2_1_0 {struct reset_control *ahb_reset;struct reset_control *por_reset;struct reset_control *phy_reset; +struct reset_control *ext_reset;struct regulator_bulk_data supplies[QCOM_PCIE_2_1_0_MAX_SUPPLY ]; };
@@ -290,6 +291,10 @@ static int qcom_pcie_get_resources_2_1_0(struct qcom_pcie *pcie)if (IS_ERR (res->por_reset))return PTR_ERR (res->por_reset); + res->ext_reset =devm_reset_control_get_optional_exclusive (dev,"ext" ); +if (IS_ERR (res->ext_reset)) +return PTR_ERR (res->ext_reset); + res->phy_reset =devm_reset_control_get_exclusive (dev,"phy" );return PTR_ERR_OR_ZERO (res->phy_reset); }
@@ -303,6 +308,7 @@ static void qcom_pcie_deinit_2_1_0(struct qcom_pcie *pcie)reset_control_assert (res->axi_reset);reset_control_assert (res->ahb_reset);reset_control_assert (res->por_reset); +reset_control_assert (res->ext_reset);reset_control_assert (res->phy_reset);clk_disable_unprepare (res->iface_clk);clk_disable_unprepare (res->core_clk);
@@ -362,6 +368,12 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) goto err_deassert_ahb; } + ret =reset_control_deassert (res->ext_reset); +if (ret) { +dev_err (dev,"cannot deassert ext reset\n" ); + goto err_deassert_ahb; + } +/* enable PCIe clocks and resets */ val =readl (pcie->parf +PCIE20_PARF_PHY_CTRL ); val &= ~BIT (0 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 82/255 PM / devfreq: Fix the wrong end with semicolon
In reply to Greg Kroah-HartmanFrom: Chanwoo Choi <[email protected]>
[ Upstream commit 27a69714450f5c9288cec2b20f1ae4f7ad34dacf ]
Fix the wrong grammar at the end of code line by using semicolon.
--- drivers/devfreq/devfreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/devfreq/devfreq.c +2 -2
@@ -1690,9 +1690,9 @@ static int devfreq_summary_show(struct seq_file *s, void *data)#endif mutex_lock (&devfreq->lock); - cur_freq = devfreq->previous_freq, + cur_freq = devfreq->previous_freq;get_freq_range (devfreq, &min_freq, &max_freq); - polling_ms = devfreq->profile->polling_ms, + polling_ms = devfreq->profile->polling_ms;mutex_unlock (&devfreq->lock); seq_printf(s,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 83/255 cpufreq: intel_pstate: Fix EPP setting via sysfs in active mode
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit de002c55cadfc2f6cdf0ed427526f6085d240238 ]
Because intel_pstate_set_energy_pref_index() reads and writes the MSR_HWP_REQUEST register without using the cached value of it used by intel_pstate_hwp_boost_up() and intel_pstate_hwp_boost_down(), those functions may overwrite the value written by it and so the EPP value set via sysfs may be lost.
To avoid that, make intel_pstate_set_energy_pref_index() take the cached value of MSR_HWP_REQUEST just like the other two routines mentioned above and update it with the new EPP value coming from user space in addition to updating the MSR.
Note that the MSR itself still needs to be updated too in case hwp_boost is unset or the boosting mechanism is not active at the EPP change time.
--- drivers/cpufreq/intel_pstate.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/cpufreq/intel_pstate.c +12 -6
@@ -649,11 +649,12 @@ static int intel_pstate_set_energy_pref_index(struct cpudata *cpu_data,mutex_lock (&intel_pstate_limits_lock);if (boot_cpu_has (X86_FEATURE_HWP_EPP )) { -u64 value; - - ret =rdmsrl_on_cpu (cpu_data->cpu,MSR_HWP_REQUEST , &value); -if (ret) - goto return_pref; +/* +* Use the cached HWP Request MSR value, because the register +* itself may be updated by intel_pstate_hwp_boost_up() or +* intel_pstate_hwp_boost_down() at any time. +*/ +u64 value =READ_ONCE (cpu_data->hwp_req_cached); value &= ~GENMASK_ULL (31 ,24 );
@@ -661,13 +662,18 @@ static int intel_pstate_set_energy_pref_index(struct cpudata *cpu_data, epp = epp_values[pref_index -1 ]; value |= (u64 )epp <<24 ; +/* +* The only other updater of hwp_req_cached in the active mode, +* intel_pstate_hwp_set(), is called under the same lock as this +* function, so it cannot run in parallel with the update below. +*/ +WRITE_ONCE (cpu_data->hwp_req_cached, value); ret =wrmsrl_on_cpu (cpu_data->cpu,MSR_HWP_REQUEST , value); }else {if (epp == -EINVAL ) epp = (pref_index -1 ) <<2 ; ret =intel_pstate_set_epb (cpu_data->cpu, epp); } -return_pref:mutex_unlock (&intel_pstate_limits_lock);return ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 84/255 ALSA: usb-audio: Add capture support for Saffire 6 (USB 1.1)
In reply to Greg Kroah-HartmanFrom: Alexander Tsoy <[email protected]>
[ Upstream commit 470757f5b3a46bd85741bb0d8c1fd3f21048a2af ]
Capture and playback endpoints on Saffire 6 (USB 1.1) resides on the same interface. This was not supported by the composite quirk back in the day when initial support for this device was added, thus only playback was enabled until now.
--- sound/usb/quirks-table.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
sound/usb/quirks-table.h +30 -0
@@ -2678,6 +2678,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), .ifnum = QUIRK_ANY_INTERFACE, .type = QUIRK_COMPOSITE, .data = (const struct snd_usb_audio_quirk []) { + { + .ifnum =0 , + .type =QUIRK_AUDIO_STANDARD_MIXER , + }, { .ifnum =0 , .type =QUIRK_AUDIO_FIXED_ENDPOINT ,
@@ -2690,6 +2694,32 @@ YAMAHA_DEVICE(0x7010, "UB99"), .attributes = UAC_EP_CS_ATTR_SAMPLE_RATE, .endpoint = 0x01, .ep_attr = USB_ENDPOINT_XFER_ISOC, + .datainterval = 1, + .maxpacksize = 0x024c, + .rates =SNDRV_PCM_RATE_44100 | + SNDRV_PCM_RATE_48000, + .rate_min = 44100, + .rate_max = 48000, + .nr_rates = 2, + .rate_table = (unsigned int []) { +44100 ,48000 + } + } + }, + { + .ifnum = 0, + .type = QUIRK_AUDIO_FIXED_ENDPOINT, + .data = &(const struct audioformat ) { + .formats =SNDRV_PCM_FMTBIT_S24_3LE , + .channels =2 , + .iface =0 , + .altsetting =1 , + .altset_idx =1 , + .attributes =0 , + .endpoint =0x82 , + .ep_attr =USB_ENDPOINT_XFER_ISOC , + .datainterval =1 , + .maxpacksize =0x0126 , .rates =SNDRV_PCM_RATE_44100 |SNDRV_PCM_RATE_48000 , .rate_min =44100 ,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 85/255 nfsd: fix oops on mixed NFSv4/NFSv3 client access
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit 34b09af4f54e6485e28f138ccad159611a240cc1 ]
If an NFSv2/v3 client breaks an NFSv4 client's delegation, it will hit a NULL dereference in nfsd_breaker_owns_lease().
Easily reproduceable with for example
mount -overs=4.2 server:/export /mnt/
sleep 1h </mnt/file &
mount -overs=3 server:/export /mnt2/
touch /mnt2/file
--- fs/nfsd/nfs4state.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfsd/nfs4state.c +2 -0
@@ -4597,6 +4597,8 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl)if (!i_am_nfsd ())return NULL ; rqst =kthread_data (current); +if (!rqst->rq_lease_breaker) +return NULL ; clp = *(rqst->rq_lease_breaker);return dl->dl_stid.sc_client == clp; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 86/255 block: respect queue limit of max discard segment
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit 943b40c832beb71115e38a1c4d99b640b5342738 ]
When queue_max_discard_segments(q) is 1, blk_discard_mergable() will return false for discard request, then normal request merge is applied. However, only queue_max_segments() is checked, so max discard segment limit isn't respected.
Check max discard segment limit in the request merge code for fixing the issue.
Discard request failure of virtio_blk is fixed.
--- block/blk-merge.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
block/blk-merge.c +9 -2
@@ -534,10 +534,17 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq, }EXPORT_SYMBOL (__blk_rq_map_sg); +static inline unsigned int blk_rq_get_max_segments (struct request *rq) +{ +if (req_op (rq) ==REQ_OP_DISCARD ) +return queue_max_discard_segments (rq->q); +return queue_max_segments (rq->q); +} +static inline int ll_new_hw_segment (struct request *req,struct bio *bio,unsigned int nr_phys_segs) { -if (req->nr_phys_segments + nr_phys_segs >queue_max_segments (req->q)) +if (req->nr_phys_segments + nr_phys_segs >blk_rq_get_max_segments (req)) goto no_merge;if (blk_integrity_merge_bio (req->q, req, bio) == false)
@@ -625,7 +632,7 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req,return 0 ; total_phys_segments = req->nr_phys_segments + next->nr_phys_segments; -if (total_phys_segments >queue_max_segments (q)) +if (total_phys_segments >blk_rq_get_max_segments (req))return 0 ;if (blk_integrity_merge_rq (q, req, next) == false)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 87/255 block: virtio_blk: fix handling single range discard request
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit af822aa68fbdf0a480a17462ed70232998127453 ]
1f23816b8eb8 ("virtio_blk: add discard and write zeroes support") starts to support multi-range discard for virtio-blk. However, the virtio-blk disk may report max discard segment as 1, at least that is exactly what qemu is doing.
So far, block layer switches to normal request merge if max discard segment limit is 1, and multiple bios can be merged to single segment. This way may cause memory corruption in virtblk_setup_discard_write_zeroes().
Fix the issue by handling single max discard segment in straightforward way.
--- drivers/block/virtio_blk.c | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-)
drivers/block/virtio_blk.c +23 -8
@@ -126,16 +126,31 @@ static int virtblk_setup_discard_write_zeroes(struct request *req, bool unmap)if (!range)return -ENOMEM ; -__rq_for_each_bio (bio, req) { -u64 sector = bio->bi_iter.bi_sector; -u32 num_sectors = bio->bi_iter.bi_size >>SECTOR_SHIFT ; - - range[n].flags =cpu_to_le32 (flags); - range[n].num_sectors =cpu_to_le32 (num_sectors); - range[n].sector =cpu_to_le64 (sector); - n++; +/* +* Single max discard segment means multi-range discard isn't +* supported, and block layer only runs contiguity merge like +* normal RW request. So we can't reply on bio for retrieving +* each range info. +*/ +if (queue_max_discard_segments (req->q) ==1 ) { + range[0 ].flags =cpu_to_le32 (flags); + range[0 ].num_sectors =cpu_to_le32 (blk_rq_sectors (req)); + range[0 ].sector =cpu_to_le64 (blk_rq_pos (req)); + n =1 ; + }else { +__rq_for_each_bio (bio, req) { +u64 sector = bio->bi_iter.bi_sector; +u32 num_sectors = bio->bi_iter.bi_size >>SECTOR_SHIFT ; + + range[n].flags =cpu_to_le32 (flags); + range[n].num_sectors =cpu_to_le32 (num_sectors); + range[n].sector =cpu_to_le64 (sector); + n++; + } } +WARN_ON_ONCE (n != segments); + req->special_vec.bv_page =virt_to_page (range); req->special_vec.bv_offset =offset_in_page (range); req->special_vec.bv_len =sizeof (*range) * segments;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 88/255 drm/msm/adreno: fix updating ring fence
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
[ Upstream commit f228af11dfa1d1616bc67f3a4119ab77c36181f1 ]
We need to set it to the most recent completed fence, not the most recent submitted. Otherwise we have races where we think we can retire submits that the GPU is not finished with, if the GPU doesn't manage to overwrite the seqno before we look at it.
This can show up with hang recovery if one of the submits after the crashing submit also hangs after it is replayed.
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +1 -1
@@ -396,7 +396,7 @@ int adreno_hw_init(struct msm_gpu *gpu) ring->next = ring->start;/* reset completed fence seqno: */ - ring->memptrs->fence = ring->seqno; + ring->memptrs->fence = ring->fctx->completed_fence; ring->memptrs->rptr =0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 89/255 block: Fix page_is_mergeable() for compound pages
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit d81665198b83e55a28339d1f3e4890ed8a434556 ]
If we pass in an offset which is larger than PAGE_SIZE, then page_is_mergeable() thinks it's not mergeable with the previous bio_vec, leading to a large number of bio_vecs being used. Use a slightly more obvious test that the two pages are compatible with each other.
--- block/bio.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
block/bio.c +5 -5
@@ -738,8 +738,8 @@ static inline bool page_is_mergeable(const struct bio_vec *bv, struct page *page, unsigned int len, unsigned int off, bool *same_page) { - phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) + - bv->bv_offset + bv->bv_len -1 ; + size_t bv_end = bv->bv_offset + bv->bv_len; +phys_addr_t vec_end_addr =page_to_phys (bv->bv_page) + bv_end -1 ;phys_addr_t page_addr =page_to_phys (page);if (vec_end_addr +1 != page_addr + off)
@@ -748,9 +748,9 @@ static inline bool page_is_mergeable(const struct bio_vec *bv,return false; *same_page = ((vec_end_addr &PAGE_MASK ) == page_addr); -if (!*same_page &&pfn_to_page (PFN_DOWN (vec_end_addr)) +1 != page) -return false; -return true; +if (*same_page) +return true; +return (bv->bv_page + bv_end /PAGE_SIZE ) == (page + off /PAGE_SIZE ); }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 90/255 bfq: fix blkio cgroup leakage v4
In reply to Greg Kroah-HartmanFrom: Dmitry Monakhov <[email protected]>
[ Upstream commit 2de791ab4918969d8108f15238a701968375f235 ]
Changes from v1:
- update commit description with proper ref-accounting justification
commit db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree") introduce leak forbfq_group and blkcg_gq objects because of get/put imbalance.
In fact whole idea of original commit is wrong because bfq_group entity
can not dissapear under us because it is referenced by child bfq_queue's entities from here:
-> bfq_init_entity()
->bfqg_and_blkg_get(bfqg);
->entity->parent = bfqg->my_entity -> bfq_put_queue(bfqq)
FINAL_PUT
->bfqg_and_blkg_put(bfqq_group(bfqq))
->kmem_cache_free(bfq_pool, bfqq);So parent entity can not disappear while child entity is in tree,
and child entities already has proper protection.
This patch revert commit db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree")
bfq_group leak trace caused by bad commit:
-> blkg_alloc
-> bfq_pq_alloc
-> bfqg_get (+1)
->bfq_activate_bfqq
->bfq_activate_requeue_entity
-> __bfq_activate_entity
->bfq_get_entity
->bfqg_and_blkg_get (+1) <==== : Note1
->bfq_del_bfqq_busy
->bfq_deactivate_entity+0x53/0xc0 [bfq]
->__bfq_deactivate_entity+0x1b8/0x210 [bfq]
-> bfq_forget_entity(is_in_service = true)
entity->on_st_or_in_serv = false <=== :Note2
if (is_in_service)
return; ==> do not touch reference-> blkcg_css_offline
-> blkcg_destroy_blkgs
-> blkg_destroy
-> bfq_pd_offline
-> __bfq_deactivate_entity
if (!entity->on_st_or_in_serv) /* true, because (Note2)
return false;
-> bfq_pd_free
-> bfqg_put() (-1, byt bfqg->ref == 2) because of (Note2)So bfq_group and blkcg_gq will leak forever, see test-case below.
##TESTCASE_BEGIN:
#!/bin/bash
max_iters=${1:-100}
#prep cgroup mounts
mount -t tmpfs cgroup_root /sys/fs/cgroup mkdir /sys/fs/cgroup/blkio
mount -t cgroup -o blkio none /sys/fs/cgroup/blkio
# Prepare blkdev
grep blkio /proc/cgroups
truncate -s 1M img
losetup /dev/loop0 img
echo bfq > /sys/block/loop0/queue/scheduler
grep blkio /proc/cgroups
for ((i=0;i<max_iters;i++))
do
mkdir -p /sys/fs/cgroup/blkio/a
echo 0 > /sys/fs/cgroup/blkio/a/cgroup.procs
dd if=/dev/loop0 bs=4k count=1 of=/dev/null iflag=direct 2> /dev/null echo 0 > /sys/fs/cgroup/blkio/cgroup.procs
rmdir /sys/fs/cgroup/blkio/a
grep blkio /proc/cgroups
done
##TESTCASE_END:
--- block/bfq-cgroup.c | 2 +- block/bfq-iosched.h | 1 - block/bfq-wf2q.c | 12 ++---------- 3 files changed, 3 insertions(+), 12 deletions(-)
block/bfq-cgroup.c +1 -1
@@ -332,7 +332,7 @@ static void bfqg_put(struct bfq_group *bfqg)kfree (bfqg); } -void bfqg_and_blkg_get (struct bfq_group *bfqg) +static void bfqg_and_blkg_get (struct bfq_group *bfqg) {/* see comments in bfq_bic_update_cgroup for why refcounting bfqg */ bfqg_get (bfqg);
block/bfq-iosched.h +0 -1
@@ -986,7 +986,6 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,struct blkcg_gq *bfqg_to_blkg (struct bfq_group *bfqg);struct bfq_group *bfqq_group (struct bfq_queue *bfqq);struct bfq_group *bfq_create_group_hierarchy (struct bfq_data *bfqd,int node); -void bfqg_and_blkg_get (struct bfq_group *bfqg);void bfqg_and_blkg_put (struct bfq_group *bfqg);#ifdef CONFIG_BFQ_GROUP_IOSCHED
block/bfq-wf2q.c +2 -10
@@ -533,9 +533,7 @@ static void bfq_get_entity(struct bfq_entity *entity) bfqq->ref++;bfq_log_bfqq (bfqq->bfqd, bfqq,"get_entity: %p %d" , bfqq, bfqq->ref); - } else -bfqg_and_blkg_get (container_of (entity ,struct bfq_group , -entity )); + } }/**
@@ -649,14 +647,8 @@ static void bfq_forget_entity(struct bfq_service_tree *st, entity->on_st_or_in_serv = false; st->wsum -= entity->weight; -if (is_in_service) -return ; - -if (bfqq) +if (bfqq && !is_in_service)bfq_put_queue (bfqq); -else - bfqg_and_blkg_put(container_of(entity, struct bfq_group, - entity)); }/**
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 91/255 hwmon: (nct7904) Correct divide by 0
In reply to Greg Kroah-HartmanFrom: Jason Baron <[email protected]>
[ Upstream commit 8aebbbb2d573d0b4afc08b90ac7d73dba2d9da97 ]
We hit a kernel panic due to a divide by 0 in nct7904_read_fan() for the hwmon_fan_min case. Extend the check to hwmon_fan_input case as well for safety.
[ 1656.545650] divide error: 0000 [#1] SMP PTI [ 1656.545779] CPU: 12 PID: 18010 Comm: sensors Not tainted 5.4.47 #1 [ 1656.546065] RIP: 0010:nct7904_read+0x1e9/0x510 [nct7904] ... [ 1656.546549] RAX: 0000000000149970 RBX: ffffbd6b86bcbe08 RCX: 0000000000000000 ... [ 1656.547548] Call Trace: [ 1656.547665] hwmon_attr_show+0x32/0xd0 [hwmon] [ 1656.547783] dev_attr_show+0x18/0x50 [ 1656.547898] sysfs_kf_seq_show+0x99/0x120 [ 1656.548013] seq_read+0xd8/0x3e0 [ 1656.548127] vfs_read+0x89/0x130 [ 1656.548234] ksys_read+0x7d/0xb0 [ 1656.548342] do_syscall_64+0x48/0x110 [ 1656.548451] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/hwmon/nct7904.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/nct7904.c +2 -2
@@ -231,7 +231,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel,if (ret <0 )return ret; cnt = ((ret &0xff00 ) >>3 ) | (ret &0x1f ); -if (cnt ==0x1fff ) +if (cnt ==0 || cnt ==0x1fff ) rpm =0 ;else rpm =1350000 / cnt;
@@ -243,7 +243,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel,if (ret <0 )return ret; cnt = ((ret &0xff00 ) >>3 ) | (ret &0x1f ); -if (cnt ==0x1fff ) +if (cnt ==0 || cnt ==0x1fff ) rpm =0 ;else rpm =1350000 / cnt;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 92/255 blk-mq: insert request not through ->queue_rq into sw/scheduler queue
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit db03f88fae8a2c8007caafa70287798817df2875 ]
c616cbee97ae ("blk-mq: punt failed direct issue to dispatch list") supposed to add request which has been through ->queue_rq() to the hw queue dispatch list, however it adds request running out of budget or driver tag to hw queue too. This way basically bypasses request merge, and causes too many request dispatched to LLD, and system% is unnecessary increased.
Fixes this issue by adding request not through ->queue_rq into sw/scheduler queue, and this way is safe because no ->queue_rq is called on this request yet.
High %system can be observed on Azure storvsc device, and even soft lock is observed. This patch reduces %system during heavy sequential IO, meantime decreases soft lockup risk.
--- block/blk-mq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/blk-mq.c +2 -1
@@ -1909,7 +1909,8 @@ insert:if (bypass_insert)return BLK_STS_RESOURCE ; -blk_mq_request_bypass_insert (rq, false, run_queue); +blk_mq_sched_insert_request (rq, false, run_queue, false); +return BLK_STS_OK ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 93/255 blkcg: fix memleak for iolatency
In reply to Greg Kroah-HartmanFrom: Yufen Yu <[email protected]>
[ Upstream commit 27029b4b18aa5d3b060f0bf2c26dae254132cfce ]
Normally, blkcg_iolatency_exit() will free related memory in iolatency when cleanup queue. But if blk_throtl_init() return error and queue init fail, blkcg_iolatency_exit() will not do that for us. Then it cause memory leak.
--- block/blk-cgroup.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
block/blk-cgroup.c +5 -3
@@ -1056,13 +1056,15 @@ int blkcg_init_queue(struct request_queue *q)if (preloaded)radix_tree_preload_end (); - ret =blk_iolatency_init (q); + ret =blk_throtl_init (q);if (ret) goto err_destroy_all; - ret =blk_throtl_init (q); -if (ret) + ret =blk_iolatency_init (q); +if (ret) { +blk_throtl_exit (q); goto err_destroy_all; + }return 0 ; err_destroy_all:
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 94/255 nvmet: fix a memory leak
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 382fee1a8b623e2546a3e15e80517389e0e0673e ]
We forgot to free new_model_number
--- drivers/nvme/target/configfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/target/configfs.c +1 -0
@@ -1035,6 +1035,7 @@ static ssize_t nvmet_subsys_attr_model_store(struct config_item *item,up_write (&nvmet_config_sem);kfree_rcu (new_model, rcuhead); +kfree (new_model_number);return count; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 95/255 nvme-fc: Fix wrong return value in __nvme_fc_init_request()
In reply to Greg Kroah-HartmanFrom: Tianjia Zhang <[email protected]>
[ Upstream commit f34448cd0dc697723fb5f4118f8431d9233b370d ]
On an error exit path, a negative error code should be returned instead of a positive return value.
--- drivers/nvme/host/fc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/fc.c +2 -2
@@ -2076,7 +2076,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,if (fc_dma_mapping_error (ctrl->lport->dev, op->fcp_req.cmddma)) {dev_err (ctrl->dev,"FCP Op failed - cmdiu dma mapping failed.\n" ); - ret =EFAULT ; + ret = -EFAULT ; goto out_on_error; }
@@ -2086,7 +2086,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,if (fc_dma_mapping_error (ctrl->lport->dev, op->fcp_req.rspdma)) {dev_err (ctrl->dev,"FCP Op failed - rspiu dma mapping failed.\n" ); - ret =EFAULT ; + ret = -EFAULT ; }atomic_set (&op->state,FCPOP_STATE_IDLE );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 96/255 nvme: multipath: round-robin: fix single non-optimized path case
In reply to Greg Kroah-HartmanFrom: Martin Wilck <[email protected]>
[ Upstream commit 93eb0381e13d249a18ed4aae203291ff977e7ffb ]
If there's only one usable, non-optimized path, nvme_round_robin_path() returns NULL, which is wrong. Fix it by falling back to "old", like in the single optimized path case. Also, if the active path isn't changed, there's no need to re-assign the pointer.
--- drivers/nvme/host/multipath.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/nvme/host/multipath.c +10 -5
@@ -255,12 +255,17 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head, fallback = ns; } -/* No optimized path found, re-check the current path */ +/* +* The loop above skips the current path for round-robin semantics. +* Fall back to the current path if either: +* - no other optimized path found and current is optimized, +* - no other usable path found and current is usable. +*/ if (!nvme_path_is_disabled (old) && - old->ana_state ==NVME_ANA_OPTIMIZED ) { - found = old; - goto out; - } + (old->ana_state ==NVME_ANA_OPTIMIZED || + (!fallback && old->ana_state ==NVME_ANA_NONOPTIMIZED ))) +return old; +if (!fallback)return NULL ; found = fallback;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 97/255 null_blk: fix passing of REQ_FUA flag in null_handle_rq
In reply to Greg Kroah-HartmanFrom: Hou Pu <[email protected]>
[ Upstream commit 2d62e6b038e729c3e4bfbfcfbd44800ef0883680 ]
REQ_FUA should be checked using rq->cmd_flags instead of req_op().
--- drivers/block/null_blk_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/null_blk_main.c +1 -1
@@ -1139,7 +1139,7 @@ static int null_handle_rq(struct nullb_cmd *cmd) len = bvec.bv_len; err =null_transfer (nullb, bvec.bv_page, len, bvec.bv_offset,op_is_write (req_op (rq)), sector, -req_op (rq) &REQ_FUA ); + rq->cmd_flags &REQ_FUA );if (err) {spin_unlock_irq (&nullb->lock);return err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 98/255 habanalabs: Fix memory corruption in debugfs
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit eeec23cd325ad4d83927b8ee162693579cf3813f ]
This has to be a long instead of a u32 because we write a long value. On 64 bit systems, this will cause memory corruption.
--- drivers/misc/habanalabs/debugfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/misc/habanalabs/debugfs.c +4 -4
@@ -19,7 +19,7 @@static struct dentry *hl_debug_root;static int hl_debugfs_i2c_read (struct hl_device *hdev,u8 i2c_bus,u8 i2c_addr, -u8 i2c_reg,u32 *val) +u8 i2c_reg,long *val) {struct armcp_packet pkt;int rc;
@@ -36,7 +36,7 @@ static int hl_debugfs_i2c_read(struct hl_device *hdev, u8 i2c_bus, u8 i2c_addr, pkt.i2c_reg = i2c_reg; rc = hdev->asic_funcs->send_cpu_message (hdev, (u32 *) &pkt,sizeof (pkt), -0 , (long *) val); +0 , val);if (rc)dev_err (hdev->dev,"Failed to read from I2C, error %d\n" , rc);
@@ -827,7 +827,7 @@ static ssize_t hl_i2c_data_read(struct file *f, char __user *buf,struct hl_dbg_device_entry *entry =file_inode (f)->i_private;struct hl_device *hdev = entry->hdev;char tmp_buf[32 ]; -u32 val; +long val;ssize_t rc;if (*ppos)
@@ -842,7 +842,7 @@ static ssize_t hl_i2c_data_read(struct file *f, char __user *buf,return rc; } -sprintf (tmp_buf,"0x%02x\n" , val); +sprintf (tmp_buf,"0x%02lx\n" , val); rc =simple_read_from_buffer (buf, count, ppos, tmp_buf,strlen (tmp_buf));
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 99/255 drm/etnaviv: always start/stop scheduler in timeout processing
In reply to Greg Kroah-HartmanFrom: Lucas Stach <[email protected]>
[ Upstream commit 50248a3ec0f5e5debd18033eb2a29f0b793a7000 ]
The drm scheduler currently expects that the stop/start sequence is always executed in the timeout handling, as the job at the head of the hardware execution list is always removed from the ring mirror before the driver function is called and only inserted back into the list when starting the scheduler.
This adds some unnecessary overhead if the timeout handler determines that the GPU is still executing jobs normally and just wished to extend the timeout, but a better solution requires a major rearchitecture of the scheduler, which is not applicable as a fix.
--- drivers/gpu/drm/etnaviv/etnaviv_sched.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_sched.c +6 -5
@@ -89,12 +89,15 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job)u32 dma_addr;int change; +/* block scheduler */ +drm_sched_stop (&gpu->sched, sched_job); +/* * If the GPU managed to complete this jobs fence, the timout is * spurious. Bail out. */ if (dma_fence_is_signaled (submit->out_fence)) -return ; + goto out_no_timeout;/* * If the GPU is still making forward progress on the front-end (which
@@ -105,12 +108,9 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job) change = dma_addr - gpu->hangcheck_dma_addr;if (change <0 || change >16 ) { gpu->hangcheck_dma_addr = dma_addr; -return ; + goto out_no_timeout; } -/* block scheduler */ -drm_sched_stop (&gpu->sched, sched_job); -if (sched_job)drm_sched_increase_karma (sched_job);
@@ -120,6 +120,7 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job)drm_sched_resubmit_jobs (&gpu->sched); +out_no_timeout:/* restart scheduler after GPU is usable again */ drm_sched_start (&gpu->sched, true); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 100/255 i2c: core: Dont fail PRP0001 enumeration when no ID table exist
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit e3cb82c6d6f6c27ab754e13ae29bdd6b949982e2 ]
When commit c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case as well") fixed the enumeration of I²C devices on ACPI enabled platforms when driver has no ID table, it missed the PRP0001 support.
i2c_device_match() and i2c_acpi_match_device() differently match driver against given device. Use acpi_driver_match_device(), that is used in the former, in i2c_device_probe() and don't fail PRP0001 enumeration when no ID table exist.
--- drivers/i2c/i2c-core-base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/i2c-core-base.c +1 -1
@@ -354,7 +354,7 @@ static int i2c_device_probe(struct device *dev)* or ACPI ID table is supplied for the probing device. */ if (!driver->id_table && - !i2c_acpi_match_device (dev->driver->acpi_match_table, client) && + !acpi_driver_match_device (dev, dev->driver) && !i2c_of_match_device (dev->driver->of_match_table, client)) { status = -ENODEV ; goto put_sync_adapter;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 101/255 i2c: rcar: in slave mode, clear NACK earlier
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 914a7b3563b8fb92f976619bbd0fa3a4a708baae ]
Currently, a NACK in slave mode is set/cleared when SCL is held low by the IP core right before the bit is about to be pushed out. This is too late for clearing and then a NACK from the previous byte is still used for the current one. Now, let's clear the NACK right after we detected the STOP condition following the NACK.
--- drivers/i2c/busses/i2c-rcar.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-rcar.c +1 -0
@@ -590,6 +590,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)/* master sent stop */ if (ssr_filtered &SSR ) {i2c_slave_event (priv->slave,I2C_SLAVE_STOP , &value); +rcar_i2c_write (priv,ICSCR ,SIE |SDBS );/* clear our NACK */ rcar_i2c_write (priv,ICSIER ,SAR );rcar_i2c_write (priv,ICSSR , ~SSR &0xff ); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 102/255 vdpa: ifcvf: return err when fail to request config irq
In reply to Greg Kroah-HartmanFrom: Jason Wang <[email protected]>
[ Upstream commit 9f4ce5d72b8e7a1f750598407c99f9e39dfb12fc ]
We ignore the err of requesting config interrupt, fix this.
--- drivers/vdpa/ifcvf/ifcvf_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/vdpa/ifcvf/ifcvf_main.c +4 -0
@@ -76,6 +76,10 @@ static int ifcvf_request_irq(struct ifcvf_adapter *adapter) ret =devm_request_irq (&pdev->dev, irq, ifcvf_config_changed,0 , vf->config_msix_name, vf); +if (ret) { +IFCVF_ERR (pdev,"Failed to request config irq\n" ); +return ret; + }for (i =0 ; i <IFCVF_MAX_QUEUE_PAIRS *2 ; i++) { snprintf(vf->vring[i].msix_name, 256, "ifcvf[%s]-%d\n",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 103/255 vdpa: ifcvf: free config irq in ifcvf_free_irq()
In reply to Greg Kroah-HartmanFrom: Jason Wang <[email protected]>
[ Upstream commit 2b9f28d5e8efad34f472542315911c5ee9a65b6c ]
We don't free config irq in ifcvf_free_irq() which will trigger a BUG() in pci core since we try to free the vectors that has an action. Fixing this by recording the config irq in ifcvf_hw structure and free it in ifcvf_free_irq().
--- drivers/vdpa/ifcvf/ifcvf_base.h | 2 +- drivers/vdpa/ifcvf/ifcvf_main.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/vdpa/ifcvf/ifcvf_base.h +1 -1
@@ -84,7 +84,7 @@ struct ifcvf_hw {void __iomem *const *base;char config_msix_name[256 ];struct vdpa_callback config_cb; - +unsigned int config_irq; };struct ifcvf_adapter {
drivers/vdpa/ifcvf/ifcvf_main.c +3 -2
@@ -53,6 +53,7 @@ static void ifcvf_free_irq(struct ifcvf_adapter *adapter, int queues)for (i =0 ; i < queues; i++)devm_free_irq (&pdev->dev, vf->vring[i].irq, &vf->vring[i]); +devm_free_irq (&pdev->dev, vf->config_irq, vf);ifcvf_free_irq_vectors (pdev); }
@@ -72,8 +73,8 @@ static int ifcvf_request_irq(struct ifcvf_adapter *adapter)snprintf (vf->config_msix_name,256 ,"ifcvf[%s]-config\n" ,pci_name (pdev)); vector =0 ; - irq =pci_irq_vector (pdev, vector); - ret =devm_request_irq (&pdev->dev, irq, + vf->config_irq =pci_irq_vector (pdev, vector); + ret =devm_request_irq (&pdev->dev, vf->config_irq, ifcvf_config_changed,0 , vf->config_msix_name, vf);if (ret) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 104/255 usb: gadget: f_tcm: Fix some resource leaks in some error paths
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 07c8434150f4eb0b65cae288721c8af1080fde17 ]
If a memory allocation fails within a 'usb_ep_alloc_request()' call, the already allocated memory must be released.
Fix a mix-up in the code and free the correct requests.
--- drivers/usb/gadget/function/f_tcm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/gadget/function/f_tcm.c +4 -3
@@ -753,12 +753,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream) goto err_sts;return 0 ; + err_sts: -usb_ep_free_request (fu->ep_status, stream->req_status); - stream->req_status =NULL ; -err_out:usb_ep_free_request (fu->ep_out, stream->req_out); stream->req_out =NULL ; +err_out: +usb_ep_free_request (fu->ep_in, stream->req_in); + stream->req_in =NULL ; out:return -ENOMEM ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 105/255 video: fbdev: controlfb: Fix build for COMPILE_TEST=y && PPC_PMAC=n
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit 4d618b9f3fcab84e9ec28c180de46fb2c929d096 ]
The build is currently broken, if COMPILE_TEST=y and PPC_PMAC=n:
linux/drivers/video/fbdev/controlfb.c: In function ‘control_set_hardware’:
linux/drivers/video/fbdev/controlfb.c:276:2: error: implicit declaration of function ‘btext_update_display’
276 | btext_update_display(p->frame_buffer_phys + CTRLFB_OFF,
| ^~~~~~~~~~~~~~~~~~~~Fix it by including btext.h whenever CONFIG_BOOTX_TEXT is enabled.
--- drivers/video/fbdev/controlfb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/controlfb.c +2 -0
@@ -49,6 +49,8 @@#include <linux/cuda.h> #ifdef CONFIG_PPC_PMAC #include <asm/prom.h> +#endif +#ifdef CONFIG_BOOTX_TEXT #include <asm/btext.h> #endif
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 106/255 spi: stm32: clear only asserted irq flags on interrupt
In reply to Greg Kroah-HartmanFrom: Tobias Schramm <[email protected]>
[ Upstream commit ae1ba50f1e706dfd7ce402ac52c1f1f10becad68 ]
Previously the stm32h7 interrupt thread cleared all non-masked interrupts. If an interrupt was to occur during the handling of another interrupt its flag would be unset, resulting in a lost interrupt.
This patches fixes the issue by clearing only the currently set interrupt flags.
--- drivers/spi/spi-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-stm32.c +1 -1
@@ -967,7 +967,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len >0 )))stm32h7_spi_read_rxfifo (spi, false); -writel_relaxed (mask, spi->base +STM32H7_SPI_IFCR ); +writel_relaxed (sr & mask, spi->base +STM32H7_SPI_IFCR );spin_unlock_irqrestore (&spi->lock, flags);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 107/255 jbd2: make sure jh have b_transaction set in refile/unfile_buffer
In reply to Greg Kroah-HartmanFrom: Lukas Czerner <[email protected]>
[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]
Callers of __jbd2_journal_unfile_buffer() and __jbd2_journal_refile_buffer() assume that the b_transaction is set. In fact if it's not, we can end up with journal_head refcounting errors leading to crash much later that might be very hard to track down. Add asserts to make sure that is the case.
We also make sure that b_next_transaction is NULL in __jbd2_journal_unfile_buffer() since the callers expect that as well and we should not get into that stage in this state anyway, leading to problems later on if we do.
Tested with fstests.
--- fs/jbd2/transaction.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/jbd2/transaction.c +10 -0
@@ -2026,6 +2026,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)*/ static void __jbd2_journal_unfile_buffer (struct journal_head *jh) { +J_ASSERT_JH (jh, jh->b_transaction !=NULL ); +J_ASSERT_JH (jh, jh->b_next_transaction ==NULL ); +__jbd2_journal_temp_unlink_buffer (jh); jh->b_transaction =NULL ; }
@@ -2572,6 +2575,13 @@ bool __jbd2_journal_refile_buffer(struct journal_head *jh) was_dirty =test_clear_buffer_jbddirty (bh);__jbd2_journal_temp_unlink_buffer (jh); + +/* +* b_transaction must be set, otherwise the new b_transaction won't +* be holding jh reference +*/ +J_ASSERT_JH (jh, jh->b_transaction !=NULL ); +/* * We set b_transaction here because b_next_transaction will inherit * our jh reference and thus __jbd2_journal_file_buffer() must not
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 108/255 ext4: dont BUG on inconsistent journal feature
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 11215630aada28307ba555a43138db6ac54fa825 ]
A customer has reported a BUG_ON in ext4_clear_journal_err() hitting during an LTP testing. Either this has been caused by a test setup issue where the filesystem was being overwritten while LTP was mounting it or the journal replay has overwritten the superblock with invalid data. In either case it is preferable we don't take the machine down with a BUG_ON. So handle the situation of unexpectedly missing has_journal feature more gracefully. We issue warning and fail the mount in the cases where the race window is narrow and the failed check is most likely a programming error. In cases where fs corruption is more likely, we do full ext4_error() handling before failing mount / remount.
--- fs/ext4/super.c | 68 ++++++++++++++++++++++++++++++++++--------------- 1 file changed, 47 insertions(+), 21 deletions(-)
fs/ext4/super.c +47 -21
@@ -66,10 +66,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *, unsigned long journal_devnum);static int ext4_show_options (struct seq_file *seq,struct dentry *root);static int ext4_commit_super (struct super_block *sb,int sync); -static void ext4_mark_recovery_complete (struct super_block *sb, +static int ext4_mark_recovery_complete (struct super_block *sb,struct ext4_super_block *es); -static void ext4_clear_journal_err (struct super_block *sb, -struct ext4_super_block *es); +static int ext4_clear_journal_err (struct super_block *sb, +struct ext4_super_block *es);static int ext4_sync_fs (struct super_block *sb,int wait);static int ext4_remount (struct super_block *sb,int *flags,char *data);static int ext4_statfs (struct dentry *dentry,struct kstatfs *buf);
@@ -4770,7 +4770,9 @@ no_journal:EXT4_SB (sb)->s_mount_state &= ~EXT4_ORPHAN_FS ;if (needs_recovery) {ext4_msg (sb,KERN_INFO ,"recovery complete" ); -ext4_mark_recovery_complete (sb, es); + err =ext4_mark_recovery_complete (sb, es); +if (err) + goto failed_mount8; }if (EXT4_SB (sb)->s_journal) {if (test_opt (sb,DATA_FLAGS ) ==EXT4_MOUNT_JOURNAL_DATA )
@@ -4813,10 +4815,8 @@ cantfind_ext4:ext4_msg (sb,KERN_ERR ,"VFS: Can't find ext4 filesystem" ); goto failed_mount; -#ifdef CONFIG_QUOTA failed_mount8:ext4_unregister_sysfs (sb); -#endif failed_mount7:ext4_unregister_li_request (sb); failed_mount6:
@@ -4956,7 +4956,8 @@ static journal_t *ext4_get_journal(struct super_block *sb,struct inode *journal_inode;journal_t *journal; -BUG_ON (!ext4_has_feature_journal (sb)); +if (WARN_ON_ONCE (!ext4_has_feature_journal (sb))) +return NULL ; journal_inode =ext4_get_journal_inode (sb, journal_inum);if (!journal_inode)
@@ -4986,7 +4987,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb,struct ext4_super_block *es;struct block_device *bdev; -BUG_ON (!ext4_has_feature_journal (sb)); +if (WARN_ON_ONCE (!ext4_has_feature_journal (sb))) +return NULL ; bdev =ext4_blkdev_get (j_dev, sb);if (bdev ==NULL )
@@ -5078,7 +5080,8 @@ static int ext4_load_journal(struct super_block *sb,int err =0 ;int really_read_only; -BUG_ON (!ext4_has_feature_journal (sb)); +if (WARN_ON_ONCE (!ext4_has_feature_journal (sb))) +return -EFSCORRUPTED ;if (journal_devnum && journal_devnum !=le32_to_cpu (es->s_journal_dev)) {
@@ -5148,7 +5151,12 @@ static int ext4_load_journal(struct super_block *sb, }EXT4_SB (sb)->s_journal = journal; -ext4_clear_journal_err (sb, es); + err =ext4_clear_journal_err (sb, es); +if (err) { +EXT4_SB (sb)->s_journal =NULL ; +jbd2_journal_destroy (journal); +return err; + }if (!really_read_only && journal_devnum && journal_devnum !=le32_to_cpu (es->s_journal_dev)) {
@@ -5244,26 +5252,32 @@ static int ext4_commit_super(struct super_block *sb, int sync)* remounting) the filesystem readonly, then we will end up with a * consistent fs on disk. Record that fact. */ -static void ext4_mark_recovery_complete (struct super_block *sb, -struct ext4_super_block *es) +static int ext4_mark_recovery_complete (struct super_block *sb, +struct ext4_super_block *es) { +int err;journal_t *journal =EXT4_SB (sb)->s_journal;if (!ext4_has_feature_journal (sb)) { -BUG_ON (journal !=NULL ); -return ; +if (journal !=NULL ) { +ext4_error (sb,"Journal got removed while the fs was " +"mounted!" ); +return -EFSCORRUPTED ; + } +return 0 ; }jbd2_journal_lock_updates (journal); -if (jbd2_journal_flush (journal) <0 ) + err =jbd2_journal_flush (journal); +if (err <0 ) goto out;if (ext4_has_feature_journal_needs_recovery (sb) &&sb_rdonly (sb)) {ext4_clear_feature_journal_needs_recovery (sb);ext4_commit_super (sb,1 ); } - out:jbd2_journal_unlock_updates (journal); +return err; }/*
@@ -5271,14 +5285,17 @@ out:* has recorded an error from a previous lifetime, move that error to the * main filesystem now. */ -static void ext4_clear_journal_err (struct super_block *sb, +static int ext4_clear_journal_err (struct super_block *sb,struct ext4_super_block *es) {journal_t *journal;int j_errno;const char *errstr; -BUG_ON (!ext4_has_feature_journal (sb)); +if (!ext4_has_feature_journal (sb)) { +ext4_error (sb,"Journal got removed while the fs was mounted!" ); +return -EFSCORRUPTED ; + } journal =EXT4_SB (sb)->s_journal;
@@ -5303,6 +5320,7 @@ static void ext4_clear_journal_err(struct super_block *sb,jbd2_journal_clear_err (journal);jbd2_journal_update_sb_errno (journal); } +return 0 ; }/*
@@ -5573,8 +5591,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) (sbi->s_mount_state & EXT4_VALID_FS)) es->s_state =cpu_to_le16 (sbi->s_mount_state); -if (sbi->s_journal) +if (sbi->s_journal) { +/* +* We let remount-ro finish even if marking fs +* as clean failed... +*/ ext4_mark_recovery_complete (sb, es); + }if (sbi->s_mmp_tsk)kthread_stop (sbi->s_mmp_tsk); }else {
@@ -5622,8 +5645,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)* been changed by e2fsck since we originally mounted * the partition.) */ -if (sbi->s_journal) -ext4_clear_journal_err (sb, es); +if (sbi->s_journal) { + err =ext4_clear_journal_err (sb, es); +if (err) + goto restore_opts; + } sbi->s_mount_state =le16_to_cpu (es->s_state); err =ext4_setup_super (sb, es,0 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 109/255 ext4: handle read only external journal device
In reply to Greg Kroah-HartmanFrom: Lukas Czerner <[email protected]>
[ Upstream commit 273108fa5015eeffc4bacfa5ce272af3434b96e4 ]
Ext4 uses blkdev_get_by_dev() to get the block_device for journal device which does check to see if the read-only block device was opened read-only.
As a result ext4 will hapily proceed mounting the file system with external journal on read-only device. This is bad as we would not be able to use the journal leading to errors later on.
Instead of simply failing to mount file system in this case, treat it in a similar way we treat internal journal on read-only device. Allow to mount with -o noload in read-only mode.
This can be reproduced easily like this:
mke2fs -F -O journal_dev $JOURNAL_DEV 100M
mkfs.$FSTYPE -F -J device=$JOURNAL_DEV $FS_DEV
blockdev --setro $JOURNAL_DEV
mount $FS_DEV $MNT
touch $MNT/file
umount $MNT
leading to error like this
[ 1307.318713] ------------[ cut here ]------------ [ 1307.323362] generic_make_request: Trying to write to read-only block-device dm-2 (partno 0) [ 1307.331741] WARNING: CPU: 36 PID: 3224 at block/blk-core.c:855 generic_make_request_checks+0x2c3/0x580 [ 1307.341041] Modules linked in: ext4 mbcache jbd2 rfkill intel_rapl_msr intel_rapl_common isst_if_commd [ 1307.419445] CPU: 36 PID: 3224 Comm: jbd2/dm-2 Tainted: G W I 5.8.0-rc5 #2 [ 1307.427359] Hardware name: Dell Inc. PowerEdge R740/01KPX8, BIOS 2.3.10 08/15/2019 [ 1307.434932] RIP: 0010:generic_make_request_checks+0x2c3/0x580 [ 1307.440676] Code: 94 03 00 00 48 89 df 48 8d 74 24 08 c6 05 cf 2b 18 01 01 e8 7f a4 ff ff 48 c7 c7 50e [ 1307.459420] RSP: 0018:ffffc0d70eb5fb48 EFLAGS: 00010286 [ 1307.464646] RAX: 0000000000000000 RBX: ffff9b33b2978300 RCX: 0000000000000000 [ 1307.471780] RDX: ffff9b33e12a81e0 RSI: ffff9b33e1298000 RDI: ffff9b33e1298000 [ 1307.478913] RBP: ffff9b7b9679e0c0 R08: 0000000000000837 R09: 0000000000000024 [ 1307.486044] R10: 0000000000000000 R11: ffffc0d70eb5f9f0 R12: 0000000000000400 [ 1307.493177] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 1307.500308] FS: 0000000000000000(0000) GS:ffff9b33e1280000(0000) knlGS:0000000000000000 [ 1307.508396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1307.514142] CR2: 000055eaf4109000 CR3: 0000003dee40a006 CR4: 00000000007606e0 [ 1307.521273] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1307.528407] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1307.535538] PKRU: 55555554 [ 1307.538250] Call Trace: [ 1307.540708] generic_make_request+0x30/0x340 [ 1307.544985] submit_bio+0x43/0x190 [ 1307.548393] ? bio_add_page+0x62/0x90 [ 1307.552068] submit_bh_wbc+0x16a/0x190 [ 1307.555833] jbd2_write_superblock+0xec/0x200 [jbd2] [ 1307.560803] jbd2_journal_update_sb_log_tail+0x65/0xc0 [jbd2] [ 1307.566557] jbd2_journal_commit_transaction+0x2ae/0x1860 [jbd2] [ 1307.572566] ? check_preempt_curr+0x7a/0x90 [ 1307.576756] ? update_curr+0xe1/0x1d0 [ 1307.580421] ? account_entity_dequeue+0x7b/0xb0 [ 1307.584955] ? newidle_balance+0x231/0x3d0 [ 1307.589056] ? __switch_to_asm+0x42/0x70 [ 1307.592986] ? __switch_to_asm+0x36/0x70 [ 1307.596918] ? lock_timer_base+0x67/0x80 [ 1307.600851] kjournald2+0xbd/0x270 [jbd2] [ 1307.604873] ? finish_wait+0x80/0x80 [ 1307.608460] ? commit_timeout+0x10/0x10 [jbd2] [ 1307.612915] kthread+0x114/0x130 [ 1307.616152] ? kthread_park+0x80/0x80 [ 1307.619816] ret_from_fork+0x22/0x30 [ 1307.623400] ---[ end trace 27490236265b1630 ]---
--- fs/ext4/super.c | 51 ++++++++++++++++++++++++++++++++----------------- 1 file changed, 33 insertions(+), 18 deletions(-)
fs/ext4/super.c +33 -18
@@ -5079,6 +5079,7 @@ static int ext4_load_journal(struct super_block *sb,dev_t journal_dev;int err =0 ;int really_read_only; +int journal_dev_ro;if (WARN_ON_ONCE (!ext4_has_feature_journal (sb)))return -EFSCORRUPTED ;
@@ -5091,7 +5092,31 @@ static int ext4_load_journal(struct super_block *sb, }else journal_dev =new_decode_dev (le32_to_cpu (es->s_journal_dev)); - really_read_only =bdev_read_only (sb->s_bdev); +if (journal_inum && journal_dev) { +ext4_msg (sb,KERN_ERR , +"filesystem has both journal inode and journal device!" ); +return -EINVAL ; + } + +if (journal_inum) { + journal =ext4_get_journal (sb, journal_inum); +if (!journal) +return -EINVAL ; + }else { + journal =ext4_get_dev_journal (sb, journal_dev); +if (!journal) +return -EINVAL ; + } + + journal_dev_ro =bdev_read_only (journal->j_dev); + really_read_only =bdev_read_only (sb->s_bdev) | journal_dev_ro; + +if (journal_dev_ro && !sb_rdonly (sb)) { +ext4_msg (sb,KERN_ERR , +"journal device read-only, try mounting with '-o ro'" ); + err = -EROFS ; + goto err_out; + }/* * Are we loading a blank journal or performing recovery after a
@@ -5106,27 +5131,14 @@ static int ext4_load_journal(struct super_block *sb,ext4_msg (sb,KERN_ERR ,"write access " "unavailable, cannot proceed " "(try mounting with noload)" ); -return -EROFS ; + err = -EROFS ; + goto err_out; }ext4_msg (sb,KERN_INFO ,"write access will " "be enabled during recovery" ); } } -if (journal_inum && journal_dev) { -ext4_msg (sb,KERN_ERR ,"filesystem has both journal " -"and inode journals!" ); -return -EINVAL ; - } - -if (journal_inum) { -if (!(journal =ext4_get_journal (sb, journal_inum))) -return -EINVAL ; - }else { -if (!(journal =ext4_get_dev_journal (sb, journal_dev))) -return -EINVAL ; - } -if (!(journal->j_flags &JBD2_BARRIER ))ext4_msg (sb,KERN_INFO ,"barriers disabled" );
@@ -5146,8 +5158,7 @@ static int ext4_load_journal(struct super_block *sb,if (err) {ext4_msg (sb,KERN_ERR ,"error loading journal" ); -jbd2_journal_destroy (journal); -return err; + goto err_out; }EXT4_SB (sb)->s_journal = journal;
@@ -5167,6 +5178,10 @@ static int ext4_load_journal(struct super_block *sb, }return 0 ; + +err_out: +jbd2_journal_destroy (journal); +return err; }static int ext4_commit_super (struct super_block *sb,int sync)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 110/255 ext4: skip non-loaded groups at cr=0/1 when scanning for good groups
In reply to Greg Kroah-HartmanFrom: Alex Zhuravlev <[email protected]>
[ Upstream commit c1d2c7d47e15482bb23cda83a5021e60f624a09c ]
cr=0 is supposed to be an optimization to save CPU cycles, but if buddy data (in memory) is not initialized then all this makes no sense as we have to do sync IO taking a lot of cycles. Also, at cr=0 mballoc doesn't choose any available chunk. cr=1 also skips groups using heuristic based on avg. fragment size. It's more useful to skip such groups and switch to cr=2 where groups will be scanned for available chunks. However, we always read the first block group in a flex_bg so metadata blocks will get read into the first flex_bg if possible.
Using sparse image and dm-slow virtual device of 120TB was simulated, then the image was formatted and filled using debugfs to mark ~85% of available space as busy. mount process w/o the patch couldn't complete in half an hour (according to vmstat it would take ~10-11 hours). With the patch applied mount took ~20 seconds.
Lustre-bug-id: https://jira.whamcloud.com/browse/LU-12988
--- fs/ext4/mballoc.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
fs/ext4/mballoc.c +20 -1
@@ -2177,6 +2177,7 @@ static int ext4_mb_good_group_nolock(struct ext4_allocation_context *ac, {struct ext4_group_info *grp =ext4_get_group_info (ac->ac_sb, group);struct super_block *sb = ac->ac_sb; +struct ext4_sb_info *sbi =EXT4_SB (sb);bool should_lock = ac->ac_flags &EXT4_MB_STRICT_CHECK ;ext4_grpblk_t free;int ret =0 ;
@@ -2195,7 +2196,25 @@ static int ext4_mb_good_group_nolock(struct ext4_allocation_context *ac,/* We only do this if the grp has never been initialized */ if (unlikely (EXT4_MB_GRP_NEED_INIT (grp))) { - ret =ext4_mb_init_group (ac->ac_sb, group,GFP_NOFS ); +struct ext4_group_desc *gdp = +ext4_get_group_desc (sb, group,NULL ); +int ret; + +/* cr=0/1 is a very optimistic search to find large +* good chunks almost for free. If buddy data is not +* ready, then this optimization makes no sense. But +* we never skip the first block group in a flex_bg, +* since this gets used for metadata block allocation, +* and we want to make sure we locate metadata blocks +* in the first block group in the flex_bg if possible. +*/ +if (cr <2 && + (!sbi->s_log_groups_per_flex || + ((group & ((1 << sbi->s_log_groups_per_flex) -1 )) !=0 )) && + !(ext4_has_group_desc_csum (sb) && + (gdp->bg_flags &cpu_to_le16 (EXT4_BG_BLOCK_UNINIT )))) +return 0 ; + ret =ext4_mb_init_group (sb, group,GFP_NOFS );if (ret)return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 111/255 drm/virtio: fix memory leak in virtio_gpu_cleanup_object()
In reply to Greg Kroah-HartmanFrom: Xin He <[email protected]>
[ Upstream commit 836b194d65782aaec4485a07d2aab52d3f698505 ]
Before setting shmem->pages to NULL, kfree() should be called.
--- drivers/gpu/drm/virtio/virtgpu_object.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/virtio/virtgpu_object.c +1 -0
@@ -79,6 +79,7 @@ void virtio_gpu_cleanup_object(struct virtio_gpu_object *bo) }sg_free_table (shmem->pages); +kfree (shmem->pages); shmem->pages =NULL ;drm_gem_shmem_unpin (&bo->base.base); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 112/255 ext4: abort the filesystem if failed to async write metadata buffer
In reply to Greg Kroah-HartmanFrom: zhangyi (F) <[email protected]>
[ Upstream commit bc71726c725767205757821df364acff87f92ac5 ]
There is a risk of filesystem inconsistency if we failed to async write back metadata buffer in the background. Because of current buffer's end io procedure is handled by end_buffer_async_write() in the block layer, and it only clear the buffer's uptodate flag and mark the write_io_error flag, so ext4 cannot detect such failure immediately. In most cases of getting metadata buffer (e.g. ext4_read_inode_bitmap()), although the buffer's data is actually uptodate, it may still read data from disk because the buffer's uptodate flag has been cleared. Finally, it may lead to on-disk filesystem inconsistency if reading old data from the disk successfully and write them out again.
This patch detect bdev mapping->wb_err when getting journal's write access and mark the filesystem error if bdev's mapping->wb_err was increased, this could prevent further writing and potential inconsistency.
--- fs/ext4/ext4.h | 3 +++ fs/ext4/ext4_jbd2.c | 25 +++++++++++++++++++++++++ fs/ext4/super.c | 17 +++++++++++++++++ 3 files changed, 45 insertions(+)
fs/ext4/ext4.h +3 -0
@@ -1585,6 +1585,9 @@ struct ext4_sb_info {#ifdef CONFIG_EXT4_DEBUG unsigned long s_simulate_fail;#endif +/* Record the errseq of the backing block device */ +errseq_t s_bdev_wb_err; +spinlock_t s_bdev_wb_lock; };static inline struct ext4_sb_info *EXT4_SB (struct super_block *sb)
fs/ext4/ext4_jbd2.c +25 -0
@@ -195,6 +195,28 @@ static void ext4_journal_abort_handle(const char *caller, unsigned int line,jbd2_journal_abort_handle (handle); } +static void ext4_check_bdev_write_error (struct super_block *sb) +{ +struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping; +struct ext4_sb_info *sbi =EXT4_SB (sb); +int err; + +/* +* If the block device has write error flag, it may have failed to +* async write out metadata buffers in the background. In this case, +* we could read old data from disk and write it out again, which +* may lead to on-disk filesystem inconsistency. +*/ +if (errseq_check (&mapping->wb_err,READ_ONCE (sbi->s_bdev_wb_err))) { +spin_lock (&sbi->s_bdev_wb_lock); + err =errseq_check_and_advance (&mapping->wb_err, &sbi->s_bdev_wb_err); +spin_unlock (&sbi->s_bdev_wb_lock); +if (err) +ext4_error_err (sb, -err, +"Error while async write back metadata" ); + } +} +int __ext4_journal_get_write_access (const char *where,unsigned int line,handle_t *handle,struct buffer_head *bh) {
@@ -202,6 +224,9 @@ int __ext4_journal_get_write_access(const char *where, unsigned int line,might_sleep (); +if (bh->b_bdev->bd_super) +ext4_check_bdev_write_error (bh->b_bdev->bd_super); +if (ext4_handle_valid (handle)) { err =jbd2_journal_get_write_access (handle, bh);if (err)
fs/ext4/super.c +17 -0
@@ -4765,6 +4765,15 @@ no_journal: }#endif /* CONFIG_QUOTA */ +/* +* Save the original bdev mapping's wb_err value which could be +* used to detect the metadata async write error. +*/ +spin_lock_init (&sbi->s_bdev_wb_lock); +if (!sb_rdonly (sb)) +errseq_check_and_advance (&sb->s_bdev->bd_inode->i_mapping->wb_err, + &sbi->s_bdev_wb_err); + sb->s_bdev->bd_super = sb;EXT4_SB (sb)->s_mount_state |=EXT4_ORPHAN_FS ;ext4_orphan_cleanup (sb, es);EXT4_SB (sb)->s_mount_state &= ~EXT4_ORPHAN_FS ;
@@ -5654,6 +5663,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) goto restore_opts; } +/* +* Update the original bdev mapping's wb_err value +* which could be used to detect the metadata async +* write error. +*/ +errseq_check_and_advance (&sb->s_bdev->bd_inode->i_mapping->wb_err, + &sbi->s_bdev_wb_err); +/* * Mounting a RDONLY partition read-write, so reread * and store the current valid flag. (It may have
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 113/255 jbd2: abort journal if free a async write error metadata buffer
In reply to Greg Kroah-HartmanFrom: zhangyi (F) <[email protected]>
[ Upstream commit c044f3d8360d2ecf831ba2cc9f08cf9fb2c699fb ]
If we free a metadata buffer which has been failed to async write out in the background, the jbd2 checkpoint procedure will not detect this failure in jbd2_log_do_checkpoint(), so it may lead to filesystem inconsistency after cleanup journal tail. This patch abort the journal if free a buffer has write_io_error flag to prevent potential further inconsistency.
--- fs/jbd2/transaction.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/jbd2/transaction.c +16 -0
@@ -2120,6 +2120,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, {struct buffer_head *head;struct buffer_head *bh; +bool has_write_io_error = false;int ret =0 ;J_ASSERT (PageLocked (page));
@@ -2144,11 +2145,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,jbd2_journal_put_journal_head (jh);if (buffer_jbd (bh)) goto busy; + +/* +* If we free a metadata buffer which has been failed to +* write out, the jbd2 checkpoint procedure will not detect +* this failure and may lead to filesystem inconsistency +* after cleanup journal tail. +*/ +if (buffer_write_io_error (bh)) { +pr_err ("JBD2: Error while async write back metadata bh %llu." , + (unsigned long long )bh->b_blocknr); + has_write_io_error = true; + } }while ((bh = bh->b_this_page) != head); ret =try_to_free_buffers (page); busy: +if (has_write_io_error) +jbd2_journal_abort (journal, -EIO ); +return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 114/255 ext4: handle option set by mount flags correctly
In reply to Greg Kroah-HartmanFrom: Lukas Czerner <[email protected]>
[ Upstream commit f25391ebb475d3ffb3aa61bb90e3594c841749ef ]
Currently there is a problem with mount options that can be both set by vfs using mount flags or by a string parsing in ext4.
i_version/iversion options gets lost after remount, for example
$ mount -o i_version /dev/pmem0 /mnt $ grep pmem0 /proc/self/mountinfo | grep i_version 310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,seclabel,i_version $ mount -o remount,ro /mnt $ grep pmem0 /proc/self/mountinfo | grep i_version
nolazytime gets ignored by ext4 on remount, for example
$ mount -o lazytime /dev/pmem0 /mnt $ grep pmem0 /proc/self/mountinfo | grep lazytime 310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel $ mount -o remount,nolazytime /mnt $ grep pmem0 /proc/self/mountinfo | grep lazytime 310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel
Fix it by applying the SB_LAZYTIME and SB_I_VERSION flags from *flags to s_flags before we parse the option and use the resulting state of the same flags in *flags at the end of successful remount.
--- fs/ext4/super.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
fs/ext4/super.c +16 -5
@@ -5487,7 +5487,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) {struct ext4_super_block *es;struct ext4_sb_info *sbi =EXT4_SB (sb); -unsigned long old_sb_flags; +unsigned long old_sb_flags, vfs_flags;struct ext4_mount_options old_opts;int enable_quota =0 ;ext4_group_t g;
@@ -5530,6 +5530,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)if (sbi->s_journal && sbi->s_journal->j_task->io_context) journal_ioprio = sbi->s_journal->j_task->io_context->ioprio; +/* +* Some options can be enabled by ext4 and/or by VFS mount flag +* either way we need to make sure it matches in both *flags and +* s_flags. Copy those selected flags from *flags to s_flags +*/ + vfs_flags =SB_LAZYTIME |SB_I_VERSION ; + sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags); +if (!parse_options (data, sb,NULL , &journal_ioprio,1 )) { err = -EINVAL ; goto restore_opts;
@@ -5583,9 +5591,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)set_task_ioprio (sbi->s_journal->j_task, journal_ioprio); } -if (*flags &SB_LAZYTIME ) - sb->s_flags |=SB_LAZYTIME ; -if ((bool )(*flags &SB_RDONLY ) !=sb_rdonly (sb)) {if (sbi->s_mount_flags &EXT4_MF_FS_ABORTED ) { err = -EROFS ;
@@ -5733,7 +5738,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) }#endif - *flags = (*flags & ~SB_LAZYTIME ) | (sb->s_flags &SB_LAZYTIME ); +/* +* Some options can be enabled by ext4 and/or by VFS mount flag +* either way we need to make sure it matches in both *flags and +* s_flags. Copy those selected flags from s_flags to *flags +*/ + *flags = (*flags & ~vfs_flags) | (sb->s_flags & vfs_flags); +ext4_msg (sb,KERN_INFO ,"re-mounted. Opts: %s" , orig_data);kfree (orig_data);return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 115/255 ext4: handle error of ext4_setup_system_zone() on remount
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit d176b1f62f242ab259ff665a26fbac69db1aecba ]
ext4_setup_system_zone() can fail. Handle the failure in ext4_remount().
--- fs/ext4/super.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ext4/super.c +4 -1
@@ -5716,7 +5716,10 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)ext4_register_li_request (sb, first_not_zeroed); } -ext4_setup_system_zone (sb); + err =ext4_setup_system_zone (sb); +if (err) + goto restore_opts; +if (sbi->s_journal ==NULL && !(old_sb_flags &SB_RDONLY )) { err =ext4_commit_super (sb,1 );if (err)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 116/255 ext4: correctly restore system zone info when remount fails
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 0f5bde1db174f6c471f0bd27198575719dabe3e5 ]
When remounting filesystem fails late during remount handling and block_validity mount option is also changed during the remount, we fail to restore system zone information to a state matching the mount option. This is mostly harmless, just the block validity checking will not match the situation described by the mount option. Make sure these two are always consistent.
--- fs/ext4/block_validity.c | 8 -------- fs/ext4/super.c | 29 +++++++++++++++++++++-------- 2 files changed, 21 insertions(+), 16 deletions(-)
fs/ext4/block_validity.c +0 -8
@@ -254,14 +254,6 @@ int ext4_setup_system_zone(struct super_block *sb)int flex_size =ext4_flex_bg_size (sbi);int ret; -if (!test_opt (sb,BLOCK_VALIDITY )) { -if (sbi->system_blks) -ext4_release_system_zone (sb); -return 0 ; - } -if (sbi->system_blks) -return 0 ; - system_blks =kzalloc (sizeof (*system_blks),GFP_KERNEL );if (!system_blks)return -ENOMEM ;
fs/ext4/super.c +21 -8
@@ -4698,11 +4698,13 @@ no_journal:ext4_set_resv_clusters (sb); - err =ext4_setup_system_zone (sb); -if (err) { -ext4_msg (sb,KERN_ERR ,"failed to initialize system " -"zone (%d)" , err); - goto failed_mount4a; +if (test_opt (sb,BLOCK_VALIDITY )) { + err =ext4_setup_system_zone (sb); +if (err) { +ext4_msg (sb,KERN_ERR ,"failed to initialize system " +"zone (%d)" , err); + goto failed_mount4a; + } }ext4_ext_init (sb);
@@ -5716,9 +5718,16 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)ext4_register_li_request (sb, first_not_zeroed); } - err =ext4_setup_system_zone (sb); -if (err) - goto restore_opts; +/* +* Handle creation of system zone data early because it can fail. +* Releasing of existing data is done when we are sure remount will +* succeed. +*/ +if (test_opt (sb,BLOCK_VALIDITY ) && !sbi->system_blks) { + err =ext4_setup_system_zone (sb); +if (err) + goto restore_opts; + }if (sbi->s_journal ==NULL && !(old_sb_flags &SB_RDONLY )) { err =ext4_commit_super (sb,1 );
@@ -5740,6 +5749,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) } }#endif +if (!test_opt (sb,BLOCK_VALIDITY ) && sbi->system_blks) +ext4_release_system_zone (sb);/* * Some options can be enabled by ext4 and/or by VFS mount flag
@@ -5761,6 +5772,8 @@ restore_opts: sbi->s_commit_interval = old_opts.s_commit_interval; sbi->s_min_batch_time = old_opts.s_min_batch_time; sbi->s_max_batch_time = old_opts.s_max_batch_time; +if (!test_opt (sb,BLOCK_VALIDITY ) && sbi->system_blks) +ext4_release_system_zone (sb);#ifdef CONFIG_QUOTA sbi->s_jquota_fmt = old_opts.s_jquota_fmt;for (i =0 ; i <EXT4_MAXQUOTAS ; i++) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 117/255 fs: prevent BUG_ON in submit_bh_wbc()
In reply to Greg Kroah-HartmanFrom: Xianting Tian <[email protected]>
[ Upstream commit 377254b2cd2252c7c3151b113cbdf93a7736c2e9 ]
If a device is hot-removed --- for example, when a physical device is unplugged from pcie slot or a nbd device's network is shutdown --- this can result in a BUG_ON() crash in submit_bh_wbc(). This is because the when the block device dies, the buffer heads will have their Buffer_Mapped flag get cleared, leading to the crash in submit_bh_wbc.
We had attempted to work around this problem in commit a17712c8 ("ext4: check superblock mapped prior to committing"). Unfortunately, it's still possible to hit the BUG_ON(!buffer_mapped(bh)) if the device dies between when the work-around check in ext4_commit_super() and when submit_bh_wbh() is finally called:
Code path:ext4_commit_super
judge if 'buffer_mapped(sbh)' is false, return <== commit a17712c8
lock_buffer(sbh)
...
unlock_buffer(sbh)
__sync_dirty_buffer(sbh,...
lock_buffer(sbh)
judge if 'buffer_mapped(sbh))' is false, return <== added by this patch
submit_bh(...,sbh)
submit_bh_wbc(...,sbh,...)[100722.966497] kernel BUG at fs/buffer.c:3095! <== BUG_ON(!buffer_mapped(bh))' in submit_bh_wbc() [100722.966503] invalid opcode: 0000 [#1] SMP [100722.966566] task: ffff8817e15a9e40 task.stack: ffffc90024744000 [100722.966574] RIP: 0010:submit_bh_wbc+0x180/0x190 [100722.966575] RSP: 0018:ffffc90024747a90 EFLAGS: 00010246 [100722.966576] RAX: 0000000000620005 RBX: ffff8818a80603a8 RCX: 0000000000000000 [100722.966576] RDX: ffff8818a80603a8 RSI: 0000000000020800 RDI: 0000000000000001 [100722.966577] RBP: ffffc90024747ac0 R08: 0000000000000000 R09: ffff88207f94170d [100722.966578] R10: 00000000000437c8 R11: 0000000000000001 R12: 0000000000020800 [100722.966578] R13: 0000000000000001 R14: 000000000bf9a438 R15: ffff88195f333000 [100722.966580] FS: 00007fa2eee27700(0000) GS:ffff88203d840000(0000) knlGS:0000000000000000 [100722.966580] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [100722.966581] CR2: 0000000000f0b008 CR3: 000000201a622003 CR4: 00000000007606e0 [100722.966582] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [100722.966583] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [100722.966583] PKRU: 55555554 [100722.966583] Call Trace: [100722.966588] __sync_dirty_buffer+0x6e/0xd0 [100722.966614] ext4_commit_super+0x1d8/0x290 [ext4] [100722.966626] __ext4_std_error+0x78/0x100 [ext4] [100722.966635] ? __ext4_journal_get_write_access+0xca/0x120 [ext4] [100722.966646] ext4_reserve_inode_write+0x58/0xb0 [ext4] [100722.966655] ? ext4_dirty_inode+0x48/0x70 [ext4] [100722.966663] ext4_mark_inode_dirty+0x53/0x1e0 [ext4] [100722.966671] ? __ext4_journal_start_sb+0x6d/0xf0 [ext4] [100722.966679] ext4_dirty_inode+0x48/0x70 [ext4] [100722.966682] __mark_inode_dirty+0x17f/0x350 [100722.966686] generic_update_time+0x87/0xd0 [100722.966687] touch_atime+0xa9/0xd0 [100722.966690] generic_file_read_iter+0xa09/0xcd0 [100722.966694] ? page_cache_tree_insert+0xb0/0xb0 [100722.966704] ext4_file_read_iter+0x4a/0x100 [ext4] [100722.966707] ? __inode_security_revalidate+0x4f/0x60 [100722.966709] __vfs_read+0xec/0x160 [100722.966711] vfs_read+0x8c/0x130 [100722.966712] SyS_pread64+0x87/0xb0 [100722.966716] do_syscall_64+0x67/0x1b0 [100722.966719] entry_SYSCALL64_slow_path+0x25/0x25
To address this, add the check of 'buffer_mapped(bh)' to __sync_dirty_buffer(). This also has the benefit of fixing this for other file systems.
With this addition, we can drop the workaround in ext4_commit_supper().
[ Commit description rewritten by tytso. ]
--- fs/buffer.c | 9 +++++++++ fs/ext4/super.c | 7 ------- 2 files changed, 9 insertions(+), 7 deletions(-)
fs/buffer.c +9 -0
@@ -3160,6 +3160,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags)WARN_ON (atomic_read (&bh->b_count) <1 );lock_buffer (bh);if (test_clear_buffer_dirty (bh)) { +/* +* The bh should be mapped, but it might not be if the +* device was hot-removed. Not much we can do but fail the I/O. +*/ +if (!buffer_mapped (bh)) { +unlock_buffer (bh); +return -EIO ; + } +get_bh (bh); bh->b_end_io = end_buffer_write_sync; ret =submit_bh (REQ_OP_WRITE , op_flags, bh);
fs/ext4/super.c +0 -7
@@ -5204,13 +5204,6 @@ static int ext4_commit_super(struct super_block *sb, int sync)if (!sbh ||block_device_ejected (sb))return error; -/* -* The superblock bh should be mapped, but it might not be if the -* device was hot-removed. Not much we can do but fail the I/O. -*/ -if (!buffer_mapped (sbh)) -return error; -/* * If the file system is mounted read-only, don't update the * superblock write time. This avoids updating the superblock
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 118/255 spi: stm32h7: fix race condition at end of transfer
In reply to Greg Kroah-HartmanFrom: Antonio Borneo <[email protected]>
[ Upstream commit 135dd873d3c76d812ae64c668adef3f2c59ed27f ]
The caller of stm32_spi_transfer_one(), spi_transfer_one_message(), is waiting for us to call spi_finalize_current_transfer() and will eventually schedule a new transfer, if available.
We should guarantee that the spi controller is really available before calling spi_finalize_current_transfer().
Move the call to spi_finalize_current_transfer() _after_ the call to stm32_spi_disable().
--- drivers/spi/spi-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-stm32.c +1 -1
@@ -972,8 +972,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)spin_unlock_irqrestore (&spi->lock, flags);if (end) { -spi_finalize_current_transfer (master);stm32h7_spi_disable (spi); +spi_finalize_current_transfer (master); }return IRQ_HANDLED ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 119/255 spi: stm32: fix fifo threshold level in case of short transfer
In reply to Greg Kroah-HartmanFrom: Amelie Delaunay <[email protected]>
[ Upstream commit 3373e9004acc0603242622b4378c64bc01d21b5f ]
When transfer is shorter than half of the fifo, set the data packet size up to transfer size instead of up to half of the fifo.
Check also that threshold is set at least to 1 data frame.
--- drivers/spi/spi-stm32.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/spi/spi-stm32.c +18 -8
@@ -468,20 +468,27 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz,/** * stm32h7_spi_prepare_fthlv - Determine FIFO threshold level * @spi: pointer to the spi controller data structure +* @xfer_len: length of the message to be transferred */ -static u32 stm32h7_spi_prepare_fthlv (struct stm32_spi *spi) +static u32 stm32h7_spi_prepare_fthlv (struct stm32_spi *spi,u32 xfer_len) { -u32 fthlv, half_fifo; +u32 fthlv, half_fifo, packet;/* data packet should not exceed 1/2 of fifo space */ half_fifo = (spi->fifo_size /2 ); +/* data_packet should not exceed transfer length */ +if (half_fifo > xfer_len) + packet = xfer_len; +else + packet = half_fifo; +if (spi->cur_bpw <=8 ) - fthlv = half_fifo; + fthlv = packet;else if (spi->cur_bpw <=16 ) - fthlv = half_fifo /2 ; + fthlv = packet /2 ;else - fthlv = half_fifo /4 ; + fthlv = packet /4 ;/* align packet size with data registers access */ if (spi->cur_bpw >8 )
@@ -489,6 +496,9 @@ static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi)else fthlv -= (fthlv %4 );/* multiple of 4 */ +if (!fthlv) + fthlv =1 ; +return fthlv; }
@@ -1394,7 +1404,7 @@ static void stm32h7_spi_set_bpw(struct stm32_spi *spi) cfg1_setb |= (bpw <<STM32H7_SPI_CFG1_DSIZE_SHIFT ) &STM32H7_SPI_CFG1_DSIZE ; - spi->cur_fthlv =stm32h7_spi_prepare_fthlv (spi); + spi->cur_fthlv =stm32h7_spi_prepare_fthlv (spi, spi->cur_xferlen); fthlv = spi->cur_fthlv -1 ; cfg1_clrb |=STM32H7_SPI_CFG1_FTHLV ;
@@ -1589,6 +1599,8 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi,spin_lock_irqsave (&spi->lock, flags); + spi->cur_xferlen = transfer->len; +if (spi->cur_bpw != transfer->bits_per_word) { spi->cur_bpw = transfer->bits_per_word; spi->cfg->set_bpw (spi);
@@ -1636,8 +1648,6 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, goto out; } - spi->cur_xferlen = transfer->len; -dev_dbg (spi->dev,"transfer communication mode set to %d\n" , spi->cur_comm); dev_dbg(spi->dev,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 120/255 spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
In reply to Greg Kroah-HartmanFrom: Amelie Delaunay <[email protected]>
[ Upstream commit 9cc61973bf9385b19ff5dda4a2a7e265fcba85e4 ]
Fix spi->clk_rate when it is odd to the nearest lowest even value because minimum SPI divider is 2.
--- drivers/spi/spi-stm32.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-stm32.c +2 -1
@@ -442,7 +442,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, {u32 div, mbrdiv; - div =DIV_ROUND_UP (spi->clk_rate, speed_hz); +/* Ensure spi->clk_rate is even */ + div =DIV_ROUND_UP (spi->clk_rate & ~0x1 , speed_hz);/* * SPI framework set xfer->speed_hz to master->max_speed_hz if
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 121/255 spi: stm32: always perform registers configuration prior to transfer
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
[ Upstream commit 60ccb3515fc61a0124c70aa37317f75b67560024 ]
SPI registers content may have been lost upon suspend/resume sequence. So, always compute and apply the necessary configuration in stm32_spi_transfer_one_setup routine.
--- drivers/spi/spi-stm32.c | 42 +++++++++++++++++------------------------ 1 file changed, 17 insertions(+), 25 deletions(-)
drivers/spi/spi-stm32.c +17 -25
@@ -1597,41 +1597,33 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi,unsigned long flags;unsigned int comm_type;int nb_words, ret =0 ; +int mbr;spin_lock_irqsave (&spi->lock, flags); spi->cur_xferlen = transfer->len; -if (spi->cur_bpw != transfer->bits_per_word) { - spi->cur_bpw = transfer->bits_per_word; - spi->cfg->set_bpw (spi); - } - -if (spi->cur_speed != transfer->speed_hz) { -int mbr; - -/* Update spi->cur_speed with real clock speed */ - mbr =stm32_spi_prepare_mbr (spi, transfer->speed_hz, - spi->cfg->baud_rate_div_min, - spi->cfg->baud_rate_div_max); -if (mbr <0 ) { - ret = mbr; - goto out; - } + spi->cur_bpw = transfer->bits_per_word; + spi->cfg->set_bpw (spi); - transfer->speed_hz = spi->cur_speed; -stm32_spi_set_mbr (spi, mbr); +/* Update spi->cur_speed with real clock speed */ + mbr =stm32_spi_prepare_mbr (spi, transfer->speed_hz, + spi->cfg->baud_rate_div_min, + spi->cfg->baud_rate_div_max); +if (mbr <0 ) { + ret = mbr; + goto out; } - comm_type =stm32_spi_communication_type (spi_dev, transfer); -if (spi->cur_comm != comm_type) { - ret = spi->cfg->set_mode (spi, comm_type); + transfer->speed_hz = spi->cur_speed; +stm32_spi_set_mbr (spi, mbr); -if (ret <0 ) - goto out; + comm_type =stm32_spi_communication_type (spi_dev, transfer); + ret = spi->cfg->set_mode (spi, comm_type); +if (ret <0 ) + goto out; - spi->cur_comm = comm_type; - } + spi->cur_comm = comm_type;if (spi->cfg->set_data_idleness) spi->cfg->set_data_idleness (spi, transfer->len);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 122/255 drm/amd/powerplay: correct Vega20 cached smu feature state
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 266d81d9eed30f4994d76a2b237c63ece062eefe ]
Correct the cached smu feature state on pp_features sysfs setting.
--- .../drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-)
drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +19 -19
@@ -979,10 +979,7 @@ static int vega20_disable_all_smu_features(struct pp_hwmgr *hwmgr) { struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend); - uint64_t features_enabled; - int i; - bool enabled; - int ret = 0; + int i, ret = 0; PP_ASSERT_WITH_CODE((ret = smum_send_msg_to_smc(hwmgr, PPSMC_MSG_DisableAllSmuFeatures,
@@ -990,17 +987,8 @@ static int vega20_disable_all_smu_features(struct pp_hwmgr *hwmgr)"[DisableAllSMUFeatures] Failed to disable all smu features!" , return ret); - ret =vega20_get_enabled_smc_features (hwmgr, &features_enabled); -PP_ASSERT_WITH_CODE (!ret, -"[DisableAllSMUFeatures] Failed to get enabled smc features!" , - return ret); - -for (i =0 ; i <GNLD_FEATURES_MAX ; i++) { - enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ? - true : false; - data->smu_features[i].enabled = enabled; - data->smu_features[i].supported = enabled; - } +for (i =0 ; i <GNLD_FEATURES_MAX ; i++) + data->smu_features[i].enabled =0 ;return 0 ; }
@@ -3230,10 +3218,11 @@ static int vega20_get_ppfeature_status(struct pp_hwmgr *hwmgr, char *buf)static int vega20_set_ppfeature_status (struct pp_hwmgr *hwmgr,uint64_t new_ppfeature_masks) { -uint64_t features_enabled; -uint64_t features_to_enable; -uint64_t features_to_disable; -int ret =0 ; +struct vega20_hwmgr *data = + (struct vega20_hwmgr *)(hwmgr->backend); +uint64_t features_enabled, features_to_enable, features_to_disable; +int i, ret =0 ; +bool enabled;if (new_ppfeature_masks >= (1ULL <<GNLD_FEATURES_MAX ))return -EINVAL ;
@@ -3262,6 +3251,17 @@ static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfereturn ret; } +/* Update the cached feature enablement state */ + ret =vega20_get_enabled_smc_features (hwmgr, &features_enabled); +if (ret) +return ret; + +for (i =0 ; i <GNLD_FEATURES_MAX ; i++) { + enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ? + true : false; + data->smu_features[i].enabled = enabled; + } +return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 123/255 drm/amd/powerplay: correct UVD/VCE PG state on custom pptable uploading
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 2c5b8080d810d98e3e59617680218499b17c84a1 ]
The UVD/VCE PG state is managed by UVD and VCE IP. It's error-prone to assume the bootup state in SMU based on the dpm status.
--- drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +0 -6
@@ -1640,12 +1640,6 @@ static void vega20_init_powergate_state(struct pp_hwmgr *hwmgr) data->uvd_power_gated = true; data->vce_power_gated = true; - -if (data->smu_features[GNLD_DPM_UVD ].enabled) - data->uvd_power_gated = false; - -if (data->smu_features[GNLD_DPM_VCE ].enabled) - data->vce_power_gated = false; }static int vega20_enable_dpm_tasks (struct pp_hwmgr *hwmgr)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 124/255 drm/amd/display: Fix LFC multiplier changing erratically
In reply to Greg Kroah-HartmanFrom: Anthony Koo <[email protected]>
[ Upstream commit e4ed4dbbc8383d42a197da8fe7ca6434b0f14def ]
[Why]
1. There is a calculation that is using frame_time_in_us instead of last_render_time_in_us to calculate whether choosing an LFC multiplier would cause the inserted frame duration to be outside of range.
2. We do not handle unsigned integer subtraction correctly and it underflows to a really large value, which causes some logic errors.
[How]
1. Fix logic to calculate 'within range' using last_render_time_in_us
2. Split out delta_from_mid_point_delta_in_us calculation to ensure we don't underflow and wrap around
--- .../amd/display/modules/freesync/freesync.c | 36 +++++++++++++++---- 1 file changed, 29 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/display/modules/freesync/freesync.c +29 -7
@@ -324,22 +324,44 @@ static void apply_below_the_range(struct core_freesync *core_freesync,/* Choose number of frames to insert based on how close it * can get to the mid point of the variable range. +* - Delta for CEIL: delta_from_mid_point_in_us_1 +* - Delta for FLOOR: delta_from_mid_point_in_us_2 */ -if ((frame_time_in_us / mid_point_frames_ceil) > in_out_vrr->min_duration_in_us && - (delta_from_mid_point_in_us_1 < delta_from_mid_point_in_us_2 || - mid_point_frames_floor <2 )) { +if ((last_render_time_in_us / mid_point_frames_ceil) < in_out_vrr->min_duration_in_us) { +/* Check for out of range. +* If using CEIL produces a value that is out of range, +* then we are forced to use FLOOR. +*/ + frames_to_insert = mid_point_frames_floor; + }else if (mid_point_frames_floor <2 ) { +/* Check if FLOOR would result in non-LFC. In this case +* choose to use CEIL +*/ + frames_to_insert = mid_point_frames_ceil; + }else if (delta_from_mid_point_in_us_1 < delta_from_mid_point_in_us_2) { +/* If choosing CEIL results in a frame duration that is +* closer to the mid point of the range. +* Choose CEIL +*/ frames_to_insert = mid_point_frames_ceil; - delta_from_mid_point_delta_in_us = delta_from_mid_point_in_us_2 - - delta_from_mid_point_in_us_1; }else { +/* If choosing FLOOR results in a frame duration that is +* closer to the mid point of the range. +* Choose FLOOR +*/ frames_to_insert = mid_point_frames_floor; - delta_from_mid_point_delta_in_us = delta_from_mid_point_in_us_1 - - delta_from_mid_point_in_us_2; }/* Prefer current frame multiplier when BTR is enabled unless it drifts * too far from the midpoint */ +if (delta_from_mid_point_in_us_1 < delta_from_mid_point_in_us_2) { + delta_from_mid_point_delta_in_us = delta_from_mid_point_in_us_2 - + delta_from_mid_point_in_us_1; + }else { + delta_from_mid_point_delta_in_us = delta_from_mid_point_in_us_1 - + delta_from_mid_point_in_us_2; + }if (in_out_vrr->btr.frames_to_insert !=0 && delta_from_mid_point_delta_in_us <BTR_DRIFT_MARGIN ) { if (((last_render_time_in_us / in_out_vrr->btr.frames_to_insert) <
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 125/255 drm/amd/display: Switch to immediate mode for updating infopackets
In reply to Greg Kroah-HartmanFrom: Anthony Koo <[email protected]>
[ Upstream commit abba907c7a20032c2d504fd5afe3af7d440a09d0 ]
[Why]
Using FRAME_UPDATE will result in infopacket to be potentially updated one frame late.
In commit stream scenarios for previously active stream, some stale infopacket data from previous config might be erroneously sent out on initial frame after stream is re-enabled.
[How]
Switch to using IMMEDIATE_UPDATE mode
--- .../amd/display/dc/dcn10/dcn10_stream_encoder.c | 16 ++++++++-------- .../amd/display/dc/dcn10/dcn10_stream_encoder.h | 14 ++++++++++++++ 2 files changed, 22 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c +8 -8
@@ -121,35 +121,35 @@ void enc1_update_generic_info_packet(switch (packet_index) {case 0 :REG_UPDATE (AFMT_VBI_PACKET_CONTROL1 , -AFMT_GENERIC0_FRAME_UPDATE ,1 ); +AFMT_GENERIC0_IMMEDIATE_UPDATE ,1 );break ;case 1 :REG_UPDATE (AFMT_VBI_PACKET_CONTROL1 , -AFMT_GENERIC1_FRAME_UPDATE ,1 ); +AFMT_GENERIC1_IMMEDIATE_UPDATE ,1 );break ;case 2 :REG_UPDATE (AFMT_VBI_PACKET_CONTROL1 , -AFMT_GENERIC2_FRAME_UPDATE ,1 ); +AFMT_GENERIC2_IMMEDIATE_UPDATE ,1 );break ;case 3 :REG_UPDATE (AFMT_VBI_PACKET_CONTROL1 , -AFMT_GENERIC3_FRAME_UPDATE ,1 ); +AFMT_GENERIC3_IMMEDIATE_UPDATE ,1 );break ;case 4 :REG_UPDATE (AFMT_VBI_PACKET_CONTROL1 , -AFMT_GENERIC4_FRAME_UPDATE ,1 ); +AFMT_GENERIC4_IMMEDIATE_UPDATE ,1 );break ;case 5 :REG_UPDATE (AFMT_VBI_PACKET_CONTROL1 , -AFMT_GENERIC5_FRAME_UPDATE ,1 ); +AFMT_GENERIC5_IMMEDIATE_UPDATE ,1 );break ;case 6 :REG_UPDATE (AFMT_VBI_PACKET_CONTROL1 , -AFMT_GENERIC6_FRAME_UPDATE ,1 ); +AFMT_GENERIC6_IMMEDIATE_UPDATE ,1 );break ;case 7 :REG_UPDATE (AFMT_VBI_PACKET_CONTROL1 , -AFMT_GENERIC7_FRAME_UPDATE ,1 ); +AFMT_GENERIC7_IMMEDIATE_UPDATE ,1 );break ;default :break ;
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h +14 -0
@@ -273,7 +273,14 @@ struct dcn10_stream_enc_registers {SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC2_FRAME_UPDATE , mask_sh),\SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC3_FRAME_UPDATE , mask_sh),\SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC4_FRAME_UPDATE , mask_sh),\ +SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC0_IMMEDIATE_UPDATE , mask_sh),\ +SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC1_IMMEDIATE_UPDATE , mask_sh),\ +SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC2_IMMEDIATE_UPDATE , mask_sh),\ +SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC3_IMMEDIATE_UPDATE , mask_sh),\SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC4_IMMEDIATE_UPDATE , mask_sh),\ +SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC5_IMMEDIATE_UPDATE , mask_sh),\ +SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC6_IMMEDIATE_UPDATE , mask_sh),\ +SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC7_IMMEDIATE_UPDATE , mask_sh),\SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC5_FRAME_UPDATE , mask_sh),\SE_SF (DIG0_AFMT_VBI_PACKET_CONTROL1 ,AFMT_GENERIC6_FRAME_UPDATE , mask_sh),\ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_FRAME_UPDATE, mask_sh),\
@@ -337,7 +344,14 @@ struct dcn10_stream_enc_registers {type AFMT_GENERIC2_FRAME_UPDATE ;\type AFMT_GENERIC3_FRAME_UPDATE ;\type AFMT_GENERIC4_FRAME_UPDATE ;\ +type AFMT_GENERIC0_IMMEDIATE_UPDATE ;\ +type AFMT_GENERIC1_IMMEDIATE_UPDATE ;\ +type AFMT_GENERIC2_IMMEDIATE_UPDATE ;\ +type AFMT_GENERIC3_IMMEDIATE_UPDATE ;\type AFMT_GENERIC4_IMMEDIATE_UPDATE ;\ +type AFMT_GENERIC5_IMMEDIATE_UPDATE ;\ +type AFMT_GENERIC6_IMMEDIATE_UPDATE ;\ +type AFMT_GENERIC7_IMMEDIATE_UPDATE ;\type AFMT_GENERIC5_FRAME_UPDATE ;\type AFMT_GENERIC6_FRAME_UPDATE ;\type AFMT_GENERIC7_FRAME_UPDATE ;\
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 126/255 selftests/bpf: Fix segmentation fault in test_progs
In reply to Greg Kroah-HartmanFrom: Jianlin Lv <[email protected]>
[ Upstream commit 0390c429dbed4068bd2cd8dded937d9a5ec24cd2 ]
test_progs reports the segmentation fault as below:
$ sudo ./test_progs -t mmap --verbose test_mmap:PASS:skel_open_and_load 0 nsec [...] test_mmap:PASS:adv_mmap1 0 nsec test_mmap:PASS:adv_mmap2 0 nsec test_mmap:PASS:adv_mmap3 0 nsec test_mmap:PASS:adv_mmap4 0 nsec Segmentation fault
This issue was triggered because mmap() and munmap() used inconsistent length parameters; mmap() creates a new mapping of 3 * page_size, but the length parameter set in the subsequent re-map and munmap() functions is 4 * page_size; this leads to the destruction of the process space.
To fix this issue, first create 4 pages of anonymous mapping, then do all the mmap() with MAP_FIXED.
Another issue is that when unmap the second page fails, the length parameter to delete tmp1 mappings should be 4 * page_size.
--- tools/testing/selftests/bpf/prog_tests/mmap.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
tools/testing/selftests/bpf/prog_tests/mmap.c +13 -6
@@ -21,7 +21,7 @@ void test_mmap(void)const long page_size =sysconf (_SC_PAGE_SIZE);int err, duration =0 , i, data_map_fd, data_map_id, tmp_fd, rdmap_fd;struct bpf_map *data_map, *bss_map; -void *bss_mmaped =NULL , *map_mmaped =NULL , *tmp1, *tmp2; +void *bss_mmaped =NULL , *map_mmaped =NULL , *tmp0, *tmp1, *tmp2;struct test_mmap__bss *bss_data;struct bpf_map_info map_info;__u32 map_info_sz =sizeof (map_info);
@@ -183,16 +183,23 @@ void test_mmap(void)/* check some more advanced mmap() manipulations */ + tmp0 =mmap (NULL ,4 * page_size,PROT_READ ,MAP_SHARED |MAP_ANONYMOUS , +-1 ,0 ); +if (CHECK (tmp0 ==MAP_FAILED ,"adv_mmap0" ,"errno %d\n" , errno)) + goto cleanup; +/* map all but last page: pages 1-3 mapped */ - tmp1 =mmap (NULL ,3 * page_size,PROT_READ ,MAP_SHARED , + tmp1 =mmap (tmp0,3 * page_size,PROT_READ ,MAP_SHARED |MAP_FIXED , data_map_fd,0 ); -if (CHECK (tmp1 ==MAP_FAILED ,"adv_mmap1" ,"errno %d\n" , errno)) +if (CHECK (tmp0 != tmp1,"adv_mmap1" ,"tmp0: %p, tmp1: %p\n" , tmp0, tmp1)) { +munmap (tmp0,4 * page_size); goto cleanup; + }/* unmap second page: pages 1, 3 mapped */ err =munmap (tmp1 + page_size, page_size);if (CHECK (err,"adv_mmap2" ,"errno %d\n" , errno)) { -munmap (tmp1, map_sz); +munmap (tmp1,4 * page_size); goto cleanup; }
@@ -201,7 +208,7 @@ void test_mmap(void) MAP_SHARED | MAP_FIXED, data_map_fd, 0);if (CHECK (tmp2 ==MAP_FAILED ,"adv_mmap3" ,"errno %d\n" , errno)) {munmap (tmp1, page_size); -munmap (tmp1 +2 *page_size, page_size); +munmap (tmp1 +2 *page_size,2 * page_size); goto cleanup; } CHECK(tmp1 + page_size != tmp2, "adv_mmap4",
@@ -211,7 +218,7 @@ void test_mmap(void) tmp2 =mmap (tmp1,4 * page_size,PROT_READ ,MAP_SHARED |MAP_FIXED , data_map_fd,0 );if (CHECK (tmp2 ==MAP_FAILED ,"adv_mmap5" ,"errno %d\n" , errno)) { -munmap (tmp1,3 * page_size);/* unmap page 1 */ +munmap (tmp1,4 * page_size);/* unmap page 1 */ goto cleanup; }CHECK (tmp1 != tmp2,"adv_mmap6" ,"tmp1: %p, tmp2: %p\n" , tmp1, tmp2);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 127/255 libbpf: Handle GCC built-in types for Arm NEON
In reply to Greg Kroah-HartmanFrom: Jean-Philippe Brucker <[email protected]>
[ Upstream commit 702eddc77a905782083b14ccd05b23840675fd18 ]
When building Arm NEON (SIMD) code from lib/raid6/neon.uc, GCC emits DWARF information using a base type "__Poly8_t", which is internal to GCC and not recognized by Clang. This causes build failures when building with Clang a vmlinux.h generated from an arm64 kernel that was built with GCC.
vmlinux.h:47284:9: error: unknown type name '__Poly8_t' typedef __Poly8_t poly8x16_t[16]; ^~~~~~~~~
The polyX_t types are defined as unsigned integers in the "Arm C Language Extension" document (101028_Q220_00_en). Emit typedefs based on standard integer types for the GCC internal types, similar to those emitted by Clang.
Including linux/kernel.h to use ARRAY_SIZE() incidentally redefined max(), causing a build bug due to different types, hence the seemingly unrelated change.
--- tools/lib/bpf/btf_dump.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-)
tools/lib/bpf/btf_dump.c +34 -1
@@ -13,6 +13,7 @@#include <errno.h> #include <linux/err.h> #include <linux/btf.h> +#include <linux/kernel.h> #include "btf.h" #include "hashmap.h" #include "libbpf.h"
@@ -548,6 +549,9 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr) } } +static void btf_dump_emit_missing_aliases (struct btf_dump *d,__u32 id, +const struct btf_type *t); +static void btf_dump_emit_struct_fwd (struct btf_dump *d,__u32 id,const struct btf_type *t); static void btf_dump_emit_struct_def(struct btf_dump *d, __u32 id,
@@ -670,6 +674,9 @@ static void btf_dump_emit_type(struct btf_dump *d, __u32 id, __u32 cont_id)switch (kind) {case BTF_KIND_INT : +/* Emit type alias definitions if necessary */ +btf_dump_emit_missing_aliases (d, id, t); + tstate->emit_state =EMITTED ;break ;case BTF_KIND_ENUM :
@@ -869,7 +876,7 @@ static void btf_dump_emit_struct_def(struct btf_dump *d,btf_dump_printf (d,": %d" , m_sz); off = m_off + m_sz; }else { - m_sz =max (0 ,btf__resolve_size (d->btf, m->type)); + m_sz =max (0LL ,btf__resolve_size (d->btf, m->type)); off = m_off + m_sz *8 ; }btf_dump_printf (d,";" );
@@ -889,6 +896,32 @@ static void btf_dump_emit_struct_def(struct btf_dump *d,btf_dump_printf (d," __attribute__((packed))" ); } +static const char *missing_base_types[][2 ] = { +/* +* GCC emits typedefs to its internal __PolyX_t types when compiling Arm +* SIMD intrinsics. Alias them to standard base types. +*/ + {"__Poly8_t" ,"unsigned char" }, + {"__Poly16_t" ,"unsigned short" }, + {"__Poly64_t" ,"unsigned long long" }, + {"__Poly128_t" ,"unsigned __int128" }, +}; + +static void btf_dump_emit_missing_aliases (struct btf_dump *d,__u32 id, +const struct btf_type *t) +{ +const char *name =btf_dump_type_name (d, id); +int i; + +for (i =0 ; i <ARRAY_SIZE (missing_base_types); i++) { +if (strcmp (name, missing_base_types[i][0 ]) ==0 ) { +btf_dump_printf (d,"typedef %s %s;\n\n" , + missing_base_types[i][1 ], name); +break ; + } + } +} +static void btf_dump_emit_enum_fwd (struct btf_dump *d,__u32 id,const struct btf_type *t) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 128/255 netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 2404b73c3f1a5f15726c6ecd226b56f6f992767f ]
nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core.
The current use of the netfilter ipv6 stub indirections causes a module dependency between ipv6 and nf_defrag_ipv6.
This prevents nf_defrag_ipv6 module from being removed because ipv6 can't be unloaded.
Remove the indirection and always use a direct call. This creates a depency from nf_conntrack_bridge to nf_defrag_ipv6 instead:
modinfo nf_conntrack
depends: nf_conntrack,nf_defrag_ipv6,bridge
.. and nf_conntrack already depends on nf_defrag_ipv6 anyway.
--- include/linux/netfilter_ipv6.h | 18 ------------------ net/bridge/netfilter/nf_conntrack_bridge.c | 8 ++++++-- net/ipv6/netfilter.c | 3 --- 3 files changed, 6 insertions(+), 23 deletions(-)
include/linux/netfilter_ipv6.h +0 -18
@@ -58,7 +58,6 @@ struct nf_ipv6_ops { int (*output)(struct net *, struct sock *, struct sk_buff *));int (*reroute)(struct sk_buff *skb,const struct nf_queue_entry *entry);#if IS_MODULE (CONFIG_IPV6 ) -int (*br_defrag)(struct net *net,struct sk_buff *skb,u32 user); int (*br_fragment)(struct net *net, struct sock *sk, struct sk_buff *skb, struct nf_bridge_frag_data *data,
@@ -117,23 +116,6 @@ static inline int nf_ip6_route(struct net *net, struct dst_entry **dst,#include <net/netfilter/ipv6/nf_defrag_ipv6.h> -static inline int nf_ipv6_br_defrag (struct net *net,struct sk_buff *skb, -u32 user) -{ -#if IS_MODULE (CONFIG_IPV6 ) -const struct nf_ipv6_ops *v6_ops =nf_get_ipv6_ops (); - -if (!v6_ops) -return 1 ; - -return v6_ops->br_defrag (net, skb, user); -#elif IS_BUILTIN (CONFIG_IPV6 ) -return nf_ct_frag6_gather (net, skb, user); -#else -return 1 ; -#endif -} - int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, struct nf_bridge_frag_data *data, int (*output)(struct net *, struct sock *sk,
net/bridge/netfilter/nf_conntrack_bridge.c +6 -2
@@ -168,6 +168,7 @@ static unsigned int nf_ct_br_defrag4(struct sk_buff *skb,static unsigned int nf_ct_br_defrag6 (struct sk_buff *skb,const struct nf_hook_state *state) { +#if IS_ENABLED (CONFIG_NF_DEFRAG_IPV6 )u16 zone_id =NF_CT_DEFAULT_ZONE_ID ;enum ip_conntrack_info ctinfo;struct br_input_skb_cb cb;
@@ -180,14 +181,17 @@ static unsigned int nf_ct_br_defrag6(struct sk_buff *skb,br_skb_cb_save (skb, &cb,sizeof (struct inet6_skb_parm )); - err =nf_ipv6_br_defrag (state->net, skb, -IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id); + err =nf_ct_frag6_gather (state->net, skb, +IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id);/* queued */ if (err == -EINPROGRESS )return NF_STOLEN ;br_skb_cb_restore (skb, &cb,IP6CB (skb)->frag_max_size);return err ==0 ?NF_ACCEPT :NF_DROP ; +#else +return NF_ACCEPT ; +#endif }static int nf_ct_br_ip_check (const struct sk_buff *skb)
net/ipv6/netfilter.c +0 -3
@@ -245,9 +245,6 @@ static const struct nf_ipv6_ops ipv6ops = { .route_input = ip6_route_input, .fragment = ip6_fragment, .reroute = nf_ip6_reroute, -#if IS_MODULE (CONFIG_IPV6 ) &&IS_ENABLED (CONFIG_NF_DEFRAG_IPV6 ) - .br_defrag = nf_ct_frag6_gather, -#endif #if IS_MODULE (CONFIG_IPV6 ) .br_fragment = br_ip6_fragment,#endif
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 129/255 libbpf: Prevent overriding errno when logging errors
In reply to Greg Kroah-HartmanFrom: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 23ab656be263813acc3c20623757d3cd1496d9e1 ]
Turns out there were a few more instances where libbpf didn't save the errno before writing an error message, causing errno to be overridden by the printf() return and the error disappearing if logging is enabled.
--- tools/lib/bpf/libbpf.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/lib/bpf/libbpf.c +7 -5
@@ -3319,10 +3319,11 @@ bpf_object__probe_global_data(struct bpf_object *obj) map =bpf_create_map_xattr (&map_attr);if (map <0 ) { - cp =libbpf_strerror_r (errno, errmsg,sizeof (errmsg)); + ret = -errno; + cp =libbpf_strerror_r (ret, errmsg,sizeof (errmsg));pr_warn ("Error in %s():%s(%d). Couldn't create simple array map.\n" , - __func__, cp, errno); -return -errno; + __func__, cp, -ret); +return ret; } insns[0 ].imm = map;
@@ -5779,9 +5780,10 @@ int bpf_program__pin_instance(struct bpf_program *prog, const char *path, }if (bpf_obj_pin (prog->instances.fds[instance], path)) { - cp =libbpf_strerror_r (errno, errmsg,sizeof (errmsg)); + err = -errno; + cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg));pr_warn ("failed to pin program: %s\n" , cp); -return -errno; +return err; }pr_debug ("pinned program '%s'\n" , path);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 130/255 tools/bpftool: Fix compilation warnings in 32-bit mode
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 09f44b753a7d120becc80213c3459183c8acd26b ]
Fix few compilation warnings in bpftool when compiling in 32-bit mode. Abstract away u64 to pointer conversion into a helper function.
--- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/link.c | 4 ++-- tools/bpf/bpftool/main.h | 10 +++++++++- tools/bpf/bpftool/prog.c | 16 ++++++++-------- 4 files changed, 20 insertions(+), 12 deletions(-)
tools/bpf/bpftool/btf_dumper.c +1 -1
@@ -67,7 +67,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,if (!info->btf_id || !info->nr_func_info ||btf__get_from_id (info->btf_id, &prog_btf)) goto print; - finfo = (struct bpf_func_info *)info->func_info; + finfo =u64_to_ptr (info->func_info); func_type =btf__type_by_id (prog_btf, finfo->type_id);if (!func_type || !btf_is_func (func_type)) goto print;
tools/bpf/bpftool/link.c +2 -2
@@ -101,7 +101,7 @@ static int show_link_close_json(int fd, struct bpf_link_info *info)switch (info->type) {case BPF_LINK_TYPE_RAW_TRACEPOINT :jsonw_string_field (json_wtr,"tp_name" , - (const char *)info->raw_tracepoint.tp_name); +u64_to_ptr (info->raw_tracepoint.tp_name));break ;case BPF_LINK_TYPE_TRACING : err =get_prog_info (info->prog_id, &prog_info);
@@ -177,7 +177,7 @@ static int show_link_close_plain(int fd, struct bpf_link_info *info)switch (info->type) {case BPF_LINK_TYPE_RAW_TRACEPOINT :printf ("\n\ttp '%s' " , - (const char *)info->raw_tracepoint.tp_name); + (const char *)u64_to_ptr (info->raw_tracepoint.tp_name));break ;case BPF_LINK_TYPE_TRACING : err =get_prog_info (info->prog_id, &prog_info);
tools/bpf/bpftool/main.h +9 -1
@@ -21,7 +21,15 @@/* Make sure we do not use kernel-only integer typedefs */ #pragma GCC poison u8 u16 u32 u64 s8 s16 s32 s64 -#define ptr_to_u64 (ptr) ((__u64)(unsigned long)(ptr)) +static inline __u64 ptr_to_u64 (const void *ptr) +{ +return (__u64 )(unsigned long )ptr; +} + +static inline void *u64_to_ptr (__u64 ptr) +{ +return (void *)(unsigned long )ptr; +}#define NEXT_ARG () ({ argc--; argv++; if (argc < 0) usage(); })#define NEXT_ARGP () ({ (*argc)--; (*argv)++; if (*argc < 0) usage(); })
tools/bpf/bpftool/prog.c +8 -8
@@ -537,14 +537,14 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,p_info ("no instructions returned" );return -1 ; } - buf = (unsigned char *)(info->jited_prog_insns); + buf =u64_to_ptr (info->jited_prog_insns); member_len = info->jited_prog_len; }else {/* DUMP_XLATED */ if (info->xlated_prog_len ==0 || !info->xlated_prog_insns) {p_err ("error retrieving insn dump: kernel.kptr_restrict set?" );return -1 ; } - buf = (unsigned char *)info->xlated_prog_insns; + buf =u64_to_ptr (info->xlated_prog_insns); member_len = info->xlated_prog_len; }
@@ -553,7 +553,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,return -1 ; } - func_info = (void *)info->func_info; + func_info =u64_to_ptr (info->func_info);if (info->nr_line_info) { prog_linfo =bpf_prog_linfo__new (info);
@@ -571,7 +571,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode, n =write (fd, buf, member_len);close (fd); -if (n != member_len) { +if (n != (ssize_t )member_len) {p_err ("error writing output file: %s" , n <0 ?strerror (errno) :"short write" );return -1 ;
@@ -601,13 +601,13 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,__u32 i;if (info->nr_jited_ksyms) {kernel_syms_load (&dd); - ksyms = (__u64 *) info->jited_ksyms; + ksyms =u64_to_ptr (info->jited_ksyms); }if (json_output)jsonw_start_array (json_wtr); - lens = (__u32 *) info->jited_func_lens; + lens =u64_to_ptr (info->jited_func_lens);for (i =0 ; i < info->nr_jited_func_lens; i++) {if (ksyms) { sym =kernel_syms_search (&dd, ksyms[i]);
@@ -668,7 +668,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode, }else {kernel_syms_load (&dd); dd.nr_jited_ksyms = info->nr_jited_ksyms; - dd.jited_ksyms = (__u64 *) info->jited_ksyms; + dd.jited_ksyms =u64_to_ptr (info->jited_ksyms); dd.btf = btf; dd.func_info = func_info; dd.finfo_rec_size = info->func_info_rec_size;
@@ -1790,7 +1790,7 @@ static char *profile_target_name(int tgt_fd) goto out; } - func_info = (struct bpf_func_info *)(info_linear->info.func_info); + func_info =u64_to_ptr (info_linear->info.func_info); t =btf__type_by_id (btf, func_info[0 ].type_id);if (!t) { p_err("btf %d doesn't have type %d",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 131/255 selftest/bpf: Fix compilation warnings in 32-bit mode
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 9028bbcc3e12510cac13a9554f1a1e39667a4387 ]
Fix compilation warnings emitted when compiling selftests for 32-bit platform (x86 in my case).
--- tools/testing/selftests/bpf/prog_tests/bpf_obj_id.c | 8 ++++---- tools/testing/selftests/bpf/prog_tests/core_extern.c | 4 ++-- tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c | 6 +++--- tools/testing/selftests/bpf/prog_tests/flow_dissector.c | 2 +- tools/testing/selftests/bpf/prog_tests/global_data.c | 6 +++--- tools/testing/selftests/bpf/prog_tests/prog_run_xattr.c | 2 +- tools/testing/selftests/bpf/prog_tests/skb_ctx.c | 2 +- tools/testing/selftests/bpf/test_btf.c | 8 ++++---- tools/testing/selftests/bpf/test_progs.h | 5 +++++ 9 files changed, 24 insertions(+), 19 deletions(-)
tools/testing/selftests/bpf/prog_tests/bpf_obj_id.c +4 -4
@@ -159,15 +159,15 @@ void test_bpf_obj_id(void)/* Check getting link info */ info_len =sizeof (struct bpf_link_info ) *2 ;bzero (&link_infos[i], info_len); - link_infos[i].raw_tracepoint.tp_name = (__u64)&tp_name; + link_infos[i].raw_tracepoint.tp_name =ptr_to_u64 (&tp_name); link_infos[i].raw_tracepoint.tp_name_len =sizeof (tp_name); err =bpf_obj_get_info_by_fd (bpf_link__fd (links[i]), &link_infos[i], &info_len); if (CHECK(err || link_infos[i].type != BPF_LINK_TYPE_RAW_TRACEPOINT || link_infos[i].prog_id != prog_infos[i].id || - link_infos[i].raw_tracepoint.tp_name != (__u64)&tp_name || - strcmp((char *)link_infos[i].raw_tracepoint.tp_name, + link_infos[i].raw_tracepoint.tp_name != ptr_to_u64(&tp_name) || + strcmp(u64_to_ptr(link_infos[i].raw_tracepoint.tp_name), "sys_enter") || info_len != sizeof(struct bpf_link_info), "get-link-info(fd)",
@@ -178,7 +178,7 @@ void test_bpf_obj_id(void) link_infos[i].type,BPF_LINK_TYPE_RAW_TRACEPOINT , link_infos[i].id, link_infos[i].prog_id, prog_infos[i].id, - (char *)link_infos[i].raw_tracepoint.tp_name, + (const char *)u64_to_ptr (link_infos[i].raw_tracepoint.tp_name), "sys_enter")) goto done;
tools/testing/selftests/bpf/prog_tests/core_extern.c +2 -2
@@ -159,8 +159,8 @@ void test_core_extern(void) exp = (uint64_t *)&t->data;for (j =0 ; j < n; j++) {CHECK (got[j] != exp[j],"check_res" , -"result #%d: expected %lx, but got %lx\n" , - j, exp[j], got[j]); +"result #%d: expected %llx, but got %llx\n" , + j, (__u64 )exp[j], (__u64 )got[j]); } cleanup:test_core_extern__destroy (skel);
tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c +3 -3
@@ -16,7 +16,7 @@ static void test_fexit_bpf2bpf_common(const char *obj_file,__u32 duration =0 , retval;struct bpf_map *data_map;const int zero =0 ; -u64 *result =NULL ; +__u64 *result =NULL ; err =bpf_prog_load (target_obj_file,BPF_PROG_TYPE_UNSPEC , &pkt_obj, &pkt_fd);
@@ -29,7 +29,7 @@ static void test_fexit_bpf2bpf_common(const char *obj_file, link =calloc (sizeof (struct bpf_link *), prog_cnt); prog =calloc (sizeof (struct bpf_program *), prog_cnt); - result =malloc ((prog_cnt +32 /* spare */ ) *sizeof (u64)); + result =malloc ((prog_cnt +32 /* spare */ ) *sizeof (__u64));if (CHECK (!link || !prog || !result,"alloc_memory" ,"failed to alloc memory" )) goto close_prog;
@@ -72,7 +72,7 @@ static void test_fexit_bpf2bpf_common(const char *obj_file, goto close_prog;for (i =0 ; i < prog_cnt; i++) -if (CHECK (result[i] !=1 ,"result" ,"fexit_bpf2bpf failed err %ld\n" , +if (CHECK (result[i] !=1 ,"result" ,"fexit_bpf2bpf failed err %llu\n" , result[i])) goto close_prog;
tools/testing/selftests/bpf/prog_tests/flow_dissector.c +1 -1
@@ -591,7 +591,7 @@ void test_flow_dissector(void)CHECK_ATTR (tattr.data_size_out !=sizeof (flow_keys) || err || tattr.retval !=1 , tests[i].name, -"err %d errno %d retval %d duration %d size %u/%lu\n" , +"err %d errno %d retval %d duration %d size %u/%zu\n" , err, errno, tattr.retval, tattr.duration, tattr.data_size_out,sizeof (flow_keys));CHECK_FLOW_KEYS (tests[i].name, flow_keys, tests[i].keys);
tools/testing/selftests/bpf/prog_tests/global_data.c +3 -3
@@ -5,7 +5,7 @@static void test_global_data_number (struct bpf_object *obj,__u32 duration) {int i, err, map_fd; -uint64_t num; +__u64 num; map_fd =bpf_find_map (__func__, obj,"result_number" );if (CHECK_FAIL (map_fd <0 ))
@@ -14,7 +14,7 @@ static void test_global_data_number(struct bpf_object *obj, __u32 duration)struct {char *name;uint32_t key; -uint64_t num; +__u64 num; } tests[] = { {"relocate .bss reference" ,0 ,0 }, {"relocate .data reference" ,1 ,42 },
@@ -32,7 +32,7 @@ static void test_global_data_number(struct bpf_object *obj, __u32 duration)for (i =0 ; i <sizeof (tests) /sizeof (tests[0 ]); i++) { err =bpf_map_lookup_elem (map_fd, &tests[i].key, &num);CHECK (err || num != tests[i].num, tests[i].name, -"err %d result %lx expected %lx\n" , +"err %d result %llx expected %llx\n" , err, num, tests[i].num); } }
tools/testing/selftests/bpf/prog_tests/prog_run_xattr.c +1 -1
@@ -28,7 +28,7 @@ void test_prog_run_xattr(void) "err %d errno %d retval %d\n", err, errno, tattr.retval);CHECK_ATTR (tattr.data_size_out !=sizeof (pkt_v4),"data_size_out" , -"incorrect output size, want %lu have %u\n" , +"incorrect output size, want %zu have %u\n" ,sizeof (pkt_v4), tattr.data_size_out); CHECK_ATTR(buf[5] != 0, "overflow",
tools/testing/selftests/bpf/prog_tests/skb_ctx.c +1 -1
@@ -80,7 +80,7 @@ void test_skb_ctx(void)CHECK_ATTR (tattr.ctx_size_out !=sizeof (skb),"ctx_size_out" , -"incorrect output size, want %lu have %u\n" , +"incorrect output size, want %zu have %u\n" ,sizeof (skb), tattr.ctx_size_out);for (i =0 ; i <5 ; i++)
tools/testing/selftests/bpf/test_btf.c +4 -4
@@ -3883,7 +3883,7 @@ static int test_big_btf_info(unsigned int test_num) info_garbage.garbage =0 ; err =bpf_obj_get_info_by_fd (btf_fd, info, &info_len);if (CHECK (err || info_len !=sizeof (*info), -"err:%d errno:%d info_len:%u sizeof(*info):%lu" , +"err:%d errno:%d info_len:%u sizeof(*info):%zu" , err, errno, info_len,sizeof (*info))) { err =-1 ; goto done;
@@ -4094,7 +4094,7 @@ static int do_test_get_info(unsigned int test_num)if (CHECK (err || !info.id || info_len !=sizeof (info) || info.btf_size != raw_btf_size || (ret =memcmp (raw_btf, user_btf, expected_nbytes)), -"err:%d errno:%d info.id:%u info_len:%u sizeof(info):%lu raw_btf_size:%u info.btf_size:%u expected_nbytes:%u memcmp:%d" , +"err:%d errno:%d info.id:%u info_len:%u sizeof(info):%zu raw_btf_size:%u info.btf_size:%u expected_nbytes:%u memcmp:%d" , err, errno, info.id, info_len,sizeof (info), raw_btf_size, info.btf_size, expected_nbytes, ret)) { err =-1 ;
@@ -4730,7 +4730,7 @@ ssize_t get_pprint_expected_line(enum pprint_mapv_kind_t mapv_kind, nexpected_line = snprintf(expected_line, line_size, "%s%u: {%u,0,%d,0x%x,0x%x,0x%x," - "{%lu|[%u,%u,%u,%u,%u,%u,%u,%u]},%s," + "{%llu|[%u,%u,%u,%u,%u,%u,%u,%u]},%s," "%u,0x%x,[[%d,%d],[%d,%d]]}\n", percpu_map ? "\tcpu" : "", percpu_map ? cpu : next_key,
@@ -4738,7 +4738,7 @@ ssize_t get_pprint_expected_line(enum pprint_mapv_kind_t mapv_kind, v->unused_bits2a, v->bits28, v->unused_bits2b, - v->ui64, + (__u64 )v->ui64, v->ui8a[0 ], v->ui8a[1 ], v->ui8a[2 ], v->ui8a[3 ], v->ui8a[4], v->ui8a[5],
tools/testing/selftests/bpf/test_progs.h +5 -0
@@ -133,6 +133,11 @@ static inline __u64 ptr_to_u64(const void *ptr)return (__u64 ) (unsigned long ) ptr; } +static inline void *u64_to_ptr (__u64 ptr) +{ +return (void *) (unsigned long ) ptr; +} +int bpf_find_map (const char *test,struct bpf_object *obj,const char *name);int compare_map_keys (int map1_fd,int map2_fd);int compare_stack_ips (int smap_fd,int amap_fd,int stack_trace_len);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 132/255 selftests/bpf: Fix btf_dump test cases on 32-bit arches
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit eed7818adf03e874994b966aa33bc00204dd275a ]
Fix btf_dump test cases by hard-coding BPF's pointer size of 8 bytes for cases where it's impossible to deterimne the pointer size (no long type in BTF). In cases where it's known, validate libbpf correctly determines it as 8.
--- .../selftests/bpf/prog_tests/btf_dump.c | 27 ++++++++++++++----- 1 file changed, 20 insertions(+), 7 deletions(-)
tools/testing/selftests/bpf/prog_tests/btf_dump.c +20 -7
@@ -12,15 +12,16 @@ void btf_dump_printf(void *ctx, const char *fmt, va_list args)static struct btf_dump_test_case {const char *name;const char *file; +bool known_ptr_sz;struct btf_dump_opts opts; } btf_dump_test_cases[] = { - {"btf_dump: syntax" ,"btf_dump_test_case_syntax" , {}}, - {"btf_dump: ordering" ,"btf_dump_test_case_ordering" , {}}, - {"btf_dump: padding" ,"btf_dump_test_case_padding" , {}}, - {"btf_dump: packing" ,"btf_dump_test_case_packing" , {}}, - {"btf_dump: bitfields" ,"btf_dump_test_case_bitfields" , {}}, - {"btf_dump: multidim" ,"btf_dump_test_case_multidim" , {}}, - {"btf_dump: namespacing" ,"btf_dump_test_case_namespacing" , {}}, + {"btf_dump: syntax" ,"btf_dump_test_case_syntax" , true, {}}, + {"btf_dump: ordering" ,"btf_dump_test_case_ordering" , false, {}}, + {"btf_dump: padding" ,"btf_dump_test_case_padding" , true, {}}, + {"btf_dump: packing" ,"btf_dump_test_case_packing" , true, {}}, + {"btf_dump: bitfields" ,"btf_dump_test_case_bitfields" , true, {}}, + {"btf_dump: multidim" ,"btf_dump_test_case_multidim" , false, {}}, + {"btf_dump: namespacing" ,"btf_dump_test_case_namespacing" , false, {}}, }; static int btf_dump_all_types(const struct btf *btf,
@@ -62,6 +63,18 @@ static int test_btf_dump_case(int n, struct btf_dump_test_case *t) goto done; } +/* tests with t->known_ptr_sz have no "long" or "unsigned long" type, +* so it's impossible to determine correct pointer size; but if they +* do, it should be 8 regardless of host architecture, becaues BPF +* target is always 64-bit +*/ +if (!t->known_ptr_sz) { +btf__set_pointer_size (btf,8 ); + }else { +CHECK (btf__pointer_size (btf) !=8 ,"ptr_sz" ,"exp %d, got %zu\n" , +8 ,btf__pointer_size (btf)); + } +snprintf (out_file,sizeof (out_file),"/tmp/%s.output.XXXXXX" , t->file); fd =mkstemp (out_file);if (CHECK (fd <0 ,"create_tmp" ,"failed to create file: %d\n" , fd)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 133/255 selftests/bpf: Correct various core_reloc 64-bit assumptions
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 5705d705832f74395c5465ce93192688f543006a ]
Ensure that types are memory layout- and field alignment-compatible regardless of 32/64-bitness mix of libbpf and BPF architecture.
--- .../selftests/bpf/prog_tests/core_reloc.c | 20 +++--- .../selftests/bpf/progs/core_reloc_types.h | 69 ++++++++++--------- 2 files changed, 47 insertions(+), 42 deletions(-)
tools/testing/selftests/bpf/prog_tests/core_reloc.c +10 -10
@@ -237,8 +237,8 @@ .union_sz = sizeof(((type *)0)->union_field), \ .arr_sz = sizeof(((type *)0)->arr_field), \ .arr_elem_sz = sizeof(((type *)0)->arr_field[0]), \ - .ptr_sz = sizeof(((type *)0)->ptr_field), \ - .enum_sz = sizeof(((type *)0)->enum_field), \ + .ptr_sz = 8, /* always 8-byte pointer for BPF */ \ + .enum_sz = sizeof(((type *)0)->enum_field), \ }#define SIZE_CASE (name) { \
@@ -432,20 +432,20 @@ static struct core_reloc_test_case test_cases[] = { .sb4 = -1, .sb20 = -0x17654321, .u32 = 0xBEEF, - .s32 =-0x3FEDCBA987654321 , + .s32 =-0x3FEDCBA987654321LL , }),BITFIELDS_CASE (bitfields___bitfield_vs_int, { - .ub1 = 0xFEDCBA9876543210, + .ub1 = 0xFEDCBA9876543210LL, .ub2 = 0xA6, - .ub7 = -0x7EDCBA987654321, - .sb4 = -0x6123456789ABCDE, - .sb20 = 0xD00D, + .ub7 = -0x7EDCBA987654321LL, + .sb4 = -0x6123456789ABCDELL, + .sb20 = 0xD00DLL, .u32 = -0x76543, - .s32 = 0x0ADEADBEEFBADB0B, + .s32 = 0x0ADEADBEEFBADB0BLL, }),BITFIELDS_CASE (bitfields___just_big_enough, { - .ub1 = 0xF, - .ub2 = 0x0812345678FEDCBA, + .ub1 = 0xFLL, + .ub2 = 0x0812345678FEDCBALL, }), BITFIELDS_ERR_CASE(bitfields___err_too_big_bitfield),
tools/testing/selftests/bpf/progs/core_reloc_types.h +37 -32
158 lines not on this page · raw message
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 134/255 can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to detect corruptions
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
[ Upstream commit e052d0540298bfe0f6cbbecdc7e2ea9b859575b2 ]
Since the stack relays on receiving own packets, it was overwriting own transmit buffer from received packets.
At least theoretically, the received echo buffer can be corrupt or changed and the session partner can request to resend previous data. In this case we will re-send bad data.
With this patch we will stop to overwrite own TX buffer and use it for sanity checking.
--- net/can/j1939/transport.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
net/can/j1939/transport.c +14 -1
@@ -1803,7 +1803,20 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, } tpdat = se_skb->data; -memcpy (&tpdat[offset], &dat[1 ], nbytes); +if (!session->transmission) { +memcpy (&tpdat[offset], &dat[1 ], nbytes); + }else { +int err; + + err =memcmp (&tpdat[offset], &dat[1 ], nbytes); +if (err) +netdev_err_once (priv->ndev, +"%s: 0x%p: Data of RX-looped back packet (%*ph) doesn't match TX data (%*ph)!\n" , + __func__, session, + nbytes, &dat[1 ], + nbytes, &tpdat[offset]); + } +if (packet == session->pkt.rx) session->pkt.rx++;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 135/255 dma-pool: fix coherent pool allocations for IOMMU mappings
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 9420139f516d7fbc248ce17f35275cb005ed98ea ]
When allocating coherent pool memory for an IOMMU mapping we don't care about the DMA mask. Move the guess for the initial GFP mask into the dma_direct_alloc_pages and pass dma_coherent_ok as a function pointer argument so that it doesn't get applied to the IOMMU case.
--- drivers/iommu/dma-iommu.c | 4 +- include/linux/dma-direct.h | 3 - include/linux/dma-mapping.h | 5 +- kernel/dma/direct.c | 13 ++-- kernel/dma/pool.c | 114 +++++++++++++++--------------------- 5 files changed, 62 insertions(+), 77 deletions(-)
drivers/iommu/dma-iommu.c +2 -2
@@ -1035,8 +1035,8 @@ static void *iommu_dma_alloc(struct device *dev, size_t size,if (IS_ENABLED (CONFIG_DMA_DIRECT_REMAP ) && !gfpflags_allow_blocking (gfp) && !coherent) - cpu_addr =dma_alloc_from_pool (dev,PAGE_ALIGN (size), &page, - gfp); + page =dma_alloc_from_pool (dev,PAGE_ALIGN (size), &cpu_addr, + gfp,NULL );else cpu_addr =iommu_dma_alloc_pages (dev, size, &page, gfp, attrs);if (!cpu_addr)
include/linux/dma-direct.h +0 -3
@@ -67,9 +67,6 @@ static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size, }u64 dma_direct_get_required_mask (struct device *dev); -gfp_t dma_direct_optimal_gfp_mask (struct device *dev,u64 dma_mask, -u64 *phys_mask); -bool dma_coherent_ok (struct device *dev,phys_addr_t phys,size_t size);void *dma_direct_alloc (struct device *dev,size_t size,dma_addr_t *dma_handle,gfp_t gfp,unsigned long attrs); void dma_direct_free(struct device *dev, size_t size, void *cpu_addr,
include/linux/dma-mapping.h +3 -2
@@ -715,8 +715,9 @@ void *dma_common_pages_remap(struct page **pages, size_t size, pgprot_t prot, const void *caller);void dma_common_free_remap (void *cpu_addr,size_t size); -void *dma_alloc_from_pool (struct device *dev,size_t size, -struct page **ret_page,gfp_t flags); +struct page *dma_alloc_from_pool (struct device *dev,size_t size, +void **cpu_addr,gfp_t flags, +bool (*phys_addr_ok)(struct device *,phys_addr_t ,size_t ));bool dma_free_from_pool (struct device *dev,void *start,size_t size);int
kernel/dma/direct.c +9 -4
@@ -45,7 +45,7 @@ u64 dma_direct_get_required_mask(struct device *dev)return (1ULL << (fls64 (max_dma) -1 )) *2 -1 ; } -gfp_t dma_direct_optimal_gfp_mask (struct device *dev,u64 dma_mask, +static gfp_t dma_direct_optimal_gfp_mask (struct device *dev,u64 dma_mask,u64 *phys_limit) {u64 dma_limit =min_not_zero (dma_mask, dev->bus_dma_limit);
@@ -70,7 +70,7 @@ gfp_t dma_direct_optimal_gfp_mask(struct device *dev, u64 dma_mask,return 0 ; } -bool dma_coherent_ok (struct device *dev,phys_addr_t phys,size_t size) +static bool dma_coherent_ok (struct device *dev,phys_addr_t phys,size_t size) {return phys_to_dma_direct (dev, phys) + size -1 <=min_not_zero (dev->coherent_dma_mask, dev->bus_dma_limit);
@@ -163,8 +163,13 @@ void *dma_direct_alloc_pages(struct device *dev, size_t size, size =PAGE_ALIGN (size);if (dma_should_alloc_from_pool (dev, gfp, attrs)) { - ret =dma_alloc_from_pool (dev, size, &page, gfp); -if (!ret) +u64 phys_mask; + + gfp |=dma_direct_optimal_gfp_mask (dev, dev->coherent_dma_mask, + &phys_mask); + page =dma_alloc_from_pool (dev, size, &ret, gfp, + dma_coherent_ok); +if (!page)return NULL ; goto done; }
kernel/dma/pool.c +48 -66
141 lines not on this page · raw message
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 136/255 dma-pool: Only allocate from CMA when in same memory zone
In reply to Greg Kroah-HartmanFrom: Nicolas Saenz Julienne <[email protected]>
[ Upstream commit d7e673ec2c8e0ea39c4c70fc490d67d7fbda869d ]
There is no guarantee to CMA's placement, so allocating a zone specific atomic pool from CMA might return memory from a completely different memory zone. To get around this double check CMA's placement before allocating from it.
--- kernel/dma/pool.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-)
kernel/dma/pool.c +30 -1
@@ -3,7 +3,9 @@* Copyright (C) 2012 ARM Ltd. * Copyright (C) 2020 Google LLC */ +#include <linux/cma.h> #include <linux/debugfs.h> +#include <linux/dma-contiguous.h> #include <linux/dma-direct.h> #include <linux/dma-noncoherent.h> #include <linux/init.h>
@@ -55,6 +57,29 @@ static void dma_atomic_pool_size_add(gfp_t gfp, size_t size) pool_size_kernel += size; } +static bool cma_in_zone (gfp_t gfp) +{ +unsigned long size; +phys_addr_t end; +struct cma *cma; + + cma =dev_get_cma_area (NULL ); +if (!cma) +return false; + + size =cma_get_size (cma); +if (!size) +return false; + +/* CMA can't cross zone boundaries, see cma_activate_area() */ + end =cma_get_base (cma) + size -1 ; +if (IS_ENABLED (CONFIG_ZONE_DMA ) && (gfp &GFP_DMA )) +return end <=DMA_BIT_MASK (zone_dma_bits); +if (IS_ENABLED (CONFIG_ZONE_DMA32 ) && (gfp &GFP_DMA32 )) +return end <=DMA_BIT_MASK (32 ); +return true; +} +static int atomic_pool_expand (struct gen_pool *pool,size_t pool_size,gfp_t gfp) {
@@ -68,7 +93,11 @@ static int atomic_pool_expand(struct gen_pool *pool, size_t pool_size,do { pool_size =1 << (PAGE_SHIFT + order); - page =alloc_pages (gfp, order); +if (cma_in_zone (gfp)) + page =dma_alloc_from_contiguous (NULL ,1 << order, + order, false); +if (!page) + page =alloc_pages (gfp, order); }while (!page && order-- >0 );if (!page) goto out;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 137/255 drivers/net/wan/hdlc_x25: Added needed_headroom and a skb->len check
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit 77b981c82c1df7c7ad32a046f17f007450b46954 ]
1. Added a skb->len check
This driver expects upper layers to include a pseudo header of 1 byte when passing down a skb for transmission. This driver will read this 1-byte header. This patch added a skb->len check before reading the header to make sure the header exists.
2. Added needed_headroom and set hard_header_len to 0
When this driver transmits data,
first this driver will remove a pseudo header of 1 byte, then the lapb module will prepend the LAPB header of 2 or 3 bytes.
So the value of needed_headroom in this driver should be 3 - 1.
Because this driver has no header_ops, according to the logic of af_packet.c, the value of hard_header_len should be 0.
Reason of setting needed_headroom and hard_header_len at this place:
This driver is written using the API of the hdlc module, the hdlc module enables this driver (the protocol driver) to run on any hardware that has a driver (the hardware driver) written using the API of the hdlc module.
Two other hdlc protocol drivers - hdlc_ppp and hdlc_raw_eth, also set things like hard_header_len at this place. In hdlc_ppp, it sets hard_header_len after attach_hdlc_protocol and before setting dev->type. In hdlc_raw_eth, it sets hard_header_len by calling ether_setup after attach_hdlc_protocol and after memcpy the settings.
3. Reset needed_headroom when detaching protocols (in hdlc.c)
When detaching a protocol from a hardware device, the hdlc module will reset various parameters of the device (including hard_header_len) to the default values. We add needed_headroom here so that needed_headroom will also be reset.
--- drivers/net/wan/hdlc.c | 1 + drivers/net/wan/hdlc_x25.c | 17 ++++++++++++++++- 2 files changed, 17 insertions(+), 1 deletion(-)
drivers/net/wan/hdlc.c +1 -0
@@ -230,6 +230,7 @@ static void hdlc_setup_dev(struct net_device *dev) dev->max_mtu =HDLC_MAX_MTU ; dev->type =ARPHRD_RAWHDLC ; dev->hard_header_len =16 ; + dev->needed_headroom =0 ; dev->addr_len =0 ; dev->header_ops = &hdlc_null_ops; }
drivers/net/wan/hdlc_x25.c +16 -1
@@ -107,8 +107,14 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) {int result; +/* There should be a pseudo header of 1 byte added by upper layers. +* Check to make sure it is there before reading it. +*/ +if (skb->len <1 ) { +kfree_skb (skb); +return NETDEV_TX_OK ; + } -/* X.25 to LAPB */ switch (skb->data[0 ]) {case X25_IFACE_DATA :/* Data to be transmitted */ skb_pull (skb,1 );
@@ -294,6 +300,15 @@ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr)return result;memcpy (&state (hdlc)->settings, &new_settings, size); + +/* There's no header_ops so hard_header_len should be 0. */ + dev->hard_header_len =0 ; +/* When transmitting data: +* first we'll remove a pseudo header of 1 byte, +* then we'll prepend an LAPB header of at most 3 bytes. +*/ + dev->needed_headroom =3 -1 ; + dev->type =ARPHRD_X25 ;call_netdevice_notifiers (NETDEV_POST_TYPE_CHANGE , dev);netif_dormant_off (dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 138/255 ALSA: hda/realtek: Add model alc298-samsung-headphone
In reply to Greg Kroah-HartmanFrom: Mike Pozulp <[email protected]>
[ Upstream commit 23dc958689449be85e39351a8c809c3d344b155b ]
The very quiet and distorted headphone output bug that afflicted my Samsung Notebook 9 is appearing in many other Samsung laptops. Expose the quirk which fixed my laptop as a model so other users can try it.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -7969,6 +7969,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"}, {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, + {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, {} };#define ALC225_STANDARD_PINS \
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 139/255 s390/cio: add cond_resched() in the slow_eval_known_fn() loop
In reply to Greg Kroah-HartmanFrom: Vineeth Vijayan <[email protected]>
[ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ]
The scanning through subchannels during the time of an event could take significant amount of time in case of platforms with lots of known subchannels. This might result in higher scheduling latencies for other tasks especially on systems with a single CPU. Add cond_resched() call, as the loop in slow_eval_known_fn() can be executed for a longer duration.
--- drivers/s390/cio/css.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/s390/cio/css.c +5 -0
@@ -677,6 +677,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data) rc =css_evaluate_known_subchannel (sch,1 );if (rc == -EAGAIN )css_schedule_eval (sch->schid); +/* +* The loop might take long time for platforms with lots of +* known devices. Allow scheduling here. +*/ +cond_resched (); }return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 140/255 ASoC: wm8994: Avoid attempts to read unreadable registers
In reply to Greg Kroah-HartmanFrom: Sylwester Nawrocki <[email protected]>
[ Upstream commit f082bb59b72039a2326ec1a44496899fb8aa6d0e ]
The driver supports WM1811, WM8994, WM8958 devices but according to documentation and the regmap definitions the WM8958_DSP2_* registers are only available on WM8958. In current code these registers are being accessed as if they were available on all the three chips.
When starting playback on WM1811 CODEC multiple errors like:
"wm8994-codec wm8994-codec: ASoC: error at soc_component_read_no_lock on wm8994-codec: -5" can be seen, which is caused by attempts to read an unavailable WM8958_DSP2_PROGRAM register. The issue has been uncovered by recent
commit "e2329ee ASoC: soc-component: add soc_component_err()".
This patch adds a check in wm8958_aif_ev() callback so the DSP2 handling is only done for WM8958.
--- sound/soc/codecs/wm8958-dsp2.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/codecs/wm8958-dsp2.c +4 -0
@@ -412,8 +412,12 @@ int wm8958_aif_ev(struct snd_soc_dapm_widget *w, struct snd_kcontrol *kcontrol, int event) {struct snd_soc_component *component =snd_soc_dapm_to_component (w->dapm); +struct wm8994 *control =dev_get_drvdata (component->dev->parent);int i; +if (control->type !=WM8958 ) +return 0 ; +switch (event) {case SND_SOC_DAPM_POST_PMU :case SND_SOC_DAPM_PRE_PMU :
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 141/255 ALSA: usb-audio: ignore broken processing/extension unit
In reply to Greg Kroah-HartmanFrom: Tom Yan <[email protected]>
[ Upstream commit d8d0db7bb358ef65d60726a61bfcd08eccff0bc0 ]
Some devices have broken extension unit where getting current value doesn't work. Attempt that once when creating mixer control for it. If it fails, just ignore it, so that it won't cripple the device entirely (and/or make the error floods).
--- sound/usb/mixer.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/usb/mixer.c +7 -1
@@ -2367,7 +2367,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,int num_ins;struct usb_mixer_elem_info *cval;struct snd_kcontrol *kctl; -int i, err, nameid, type, len; +int i, err, nameid, type, len, val;const struct procunit_info *info;const struct procunit_value_info *valinfo;const struct usbmix_name_map *map;
@@ -2470,6 +2470,12 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,break ; } + err =get_cur_ctl_value (cval, cval->control <<8 , &val); +if (err <0 ) { +usb_mixer_elem_info_free (cval); +return -EINVAL ; + } + kctl =snd_ctl_new1 (&mixer_procunit_ctl, cval);if (!kctl) {usb_mixer_elem_info_free (cval);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 142/255 selftests: disable rp_filter for icmp_redirect.sh
In reply to Greg Kroah-HartmanFrom: David Ahern <[email protected]>
[ Upstream commit bcf7ddb0186d366f761f86196b480ea6dd2dc18c ]
h1 is initially configured to reach h2 via r1 rather than the more direct path through r2. If rp_filter is set and inherited for r2, forwarding fails since the source address of h1 is reachable from eth0 vs the packet coming to it via r1 and eth1. Since rp_filter setting affects the test, explicitly reset it.
--- tools/testing/selftests/net/icmp_redirect.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/icmp_redirect.sh +2 -0
@@ -180,6 +180,8 @@ setup() ;; r[12]) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1 ip netns exec $ns sysctl -q -w net.ipv4.conf.all.send_redirects=1 + ip netns exec $ns sysctl -q -w net.ipv4.conf.default.rp_filter=0 + ip netns exec $ns sysctl -q -w net.ipv4.conf.all.rp_filter=0 ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1 ip netns exec $ns sysctl -q -w net.ipv6.route.mtu_expires=10
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 143/255 scsi: fcoe: Fix I/O path allocation
In reply to Greg Kroah-HartmanFrom: Mike Christie <[email protected]>
[ Upstream commit fa39ab5184d64563cd36f2fb5f0d3fbad83a432c ]
ixgbe_fcoe_ddp_setup() can be called from the main I/O path and is called with a spin_lock held, so we have to use GFP_ATOMIC allocation instead of GFP_KERNEL.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c +1 -1
@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid, }/* alloc the udl from per cpu ddp pool */ - ddp->udl =dma_pool_alloc (ddp_pool->pool,GFP_KERNEL , &ddp->udp); + ddp->udl =dma_pool_alloc (ddp_pool->pool,GFP_ATOMIC , &ddp->udp);if (!ddp->udl) {e_err (drv,"failed allocated ddp context\n" ); goto out_noddp_unmap;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 144/255 scsi: ufs: Fix possible infinite loop in ufshcd_hold
In reply to Greg Kroah-HartmanFrom: Stanley Chu <[email protected]>
[ Upstream commit 93b6c5db06028a3b55122bbb74d0715dd8ca4ae0 ]
In ufshcd_suspend(), after clk-gating is suspended and link is set as Hibern8 state, ufshcd_hold() is still possibly invoked before ufshcd_suspend() returns. For example, MediaTek's suspend vops may issue UIC commands which would call ufshcd_hold() during the command issuing flow.
Now if UFSHCD_CAP_HIBERN8_WITH_CLK_GATING capability is enabled, then ufshcd_hold() may enter infinite loops because there is no clk-ungating work scheduled or pending. In this case, ufshcd_hold() shall just bypass, and keep the link as Hibern8 state.
--- drivers/scsi/ufs/ufshcd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +4 -1
@@ -1566,6 +1566,7 @@ unblock_reqs:int ufshcd_hold (struct ufs_hba *hba,bool async) {int rc =0 ; +bool flush_result;unsigned long flags;if (!ufshcd_is_clkgating_allowed (hba))
@@ -1597,7 +1598,9 @@ start:break ; }spin_unlock_irqrestore (hba->host->host_lock, flags); -flush_work (&hba->clk_gating.ungate_work); + flush_result =flush_work (&hba->clk_gating.ungate_work); +if (hba->clk_gating.is_suspended && !flush_result) + goto out;spin_lock_irqsave (hba->host->host_lock, flags); goto start; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 145/255 scsi: ufs: Improve interrupt handling for shared interrupts
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
[ Upstream commit 127d5f7c4b653b8be5eb3b2c7bbe13728f9003ff ]
For shared interrupts, the interrupt status might be zero, so check that first.
--- drivers/scsi/ufs/ufshcd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/ufs/ufshcd.c +3 -3
@@ -5991,7 +5991,7 @@ static irqreturn_t ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status)*/ static irqreturn_t ufshcd_intr (int irq,void *__hba) { -u32 intr_status, enabled_intr_status; +u32 intr_status, enabled_intr_status =0 ;irqreturn_t retval =IRQ_NONE ;struct ufs_hba *hba = __hba;int retries = hba->nutrs;
@@ -6005,7 +6005,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)* read, make sure we handle them by checking the interrupt status * again in a loop until we process all of the reqs before returning. */ - do { +while (intr_status && retries--) { enabled_intr_status = intr_status &ufshcd_readl (hba,REG_INTERRUPT_ENABLE );if (intr_status)
@@ -6014,7 +6014,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) retval |=ufshcd_sl_intr (hba, enabled_intr_status); intr_status =ufshcd_readl (hba,REG_INTERRUPT_STATUS ); - }while (intr_status && --retries); + }if (enabled_intr_status && retval ==IRQ_NONE ) { dev_err(hba->dev, "%s: Unhandled interrupt 0x%08x\n",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 146/255 scsi: ufs: Clean up completed request without interrupt notification
In reply to Greg Kroah-HartmanFrom: Stanley Chu <[email protected]>
[ Upstream commit b10178ee7fa88b68a9e8adc06534d2605cb0ec23 ]
If somehow no interrupt notification is raised for a completed request and its doorbell bit is cleared by host, UFS driver needs to cleanup its outstanding bit in ufshcd_abort(). Otherwise, system may behave abnormally in the following scenario:
After ufshcd_abort() returns, this request will be requeued by SCSI layer with its outstanding bit set. Any future completed request will trigger ufshcd_transfer_req_compl() to handle all "completed outstanding bits". At this time the "abnormal outstanding bit" will be detected and the "requeued request" will be chosen to execute request post-processing flow. This is wrong because this request is still "alive".
--- drivers/scsi/ufs/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +2 -1
@@ -6541,7 +6541,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)/* command completed already */ dev_err (hba->dev,"%s: cmd at tag %d successfully cleared from DB.\n" , __func__, tag); - goto out; + goto cleanup; }else { dev_err(hba->dev, "%s: no response from device. tag = %d, err %d\n",
@@ -6575,6 +6575,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) goto out; } +cleanup:scsi_dma_unmap (cmd);spin_lock_irqsave (host->host_lock, flags);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 147/255 scsi: scsi_debug: Fix scp is NULL errors
In reply to Greg Kroah-HartmanFrom: Douglas Gilbert <[email protected]>
[ Upstream commit 223f91b48079227f914657f07d2d686f7b60aa26 ]
John Garry reported 'sdebug_q_cmd_complete: scp is NULL' failures that were mainly seen on aarch64 machines (e.g. RPi 4 with four A72 CPUs). The problem was tracked down to a missing critical section on a "short circuit" path. Namely, the time to process the current command so far has already exceeded the requested command duration (i.e. the number of nanoseconds in the ndelay parameter).
The random=1 parameter setting was pivotal in finding this error. The failure scenario involved first taking that "short circuit" path (due to a very short command duration) and then taking the more likely hrtimer_start() path (due to a longer command duration). With random=1 each command's duration is taken from the uniformly distributed [0..ndelay) interval. The fio utility also helped by reliably generating the error scenario at about once per minute on a RPi 4 (64 bit OS).
--- drivers/scsi/scsi_debug.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/scsi_debug.c +2 -0
@@ -5486,9 +5486,11 @@ static int schedule_resp(struct scsi_cmnd *cmnd, struct sdebug_dev_info *devip,u64 d =ktime_get_boottime_ns () - ns_from_boot;if (kt <= d) {/* elapsed duration >= kt */ +spin_lock_irqsave (&sqp->qc_lock, iflags); sqcp->a_cmnd =NULL ;atomic_dec (&devip->num_in_q);clear_bit (k, sqp->in_use_bm); +spin_unlock_irqrestore (&sqp->qc_lock, iflags);if (new_sd_dp)kfree (sd_dp);/* call scsi_done() from this thread */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 148/255 scsi: qla2xxx: Flush all sessions on zone disable
In reply to Greg Kroah-HartmanFrom: Quinn Tran <[email protected]>
[ Upstream commit 10ae30ba664822f62de169a61628e31c999c7cc8 ]
On Zone Disable, certain switches would ignore all commands. This causes timeout for both switch scan command and abort of that command. On detection of this condition, all sessions will be shutdown.
--- drivers/scsi/qla2xxx/qla_gs.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/scsi/qla2xxx/qla_gs.c +12 -0
@@ -3736,6 +3736,18 @@ static void qla2x00_async_gpnft_gnnft_sp_done(srb_t *sp, int res)unsigned long flags;const char *name = sp->name; +if (res ==QLA_OS_TIMER_EXPIRED ) { +/* switch is ignoring all commands. +* This might be a zone disable behavior. +* This means we hit 64s timeout. +* 22s GPNFT + 44s Abort = 64s +*/ +ql_dbg (ql_dbg_disc, vha,0xffff , +"%s: Switch Zone check please .\n" , + name); +qla2x00_mark_all_devices_lost (vha); + } +/* * We are in an Interrupt context, queue up this * sp for GNNFT_DONE work. This will allow all
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 149/255 scsi: qla2xxx: Flush I/O on zone disable
In reply to Greg Kroah-HartmanFrom: Quinn Tran <[email protected]>
[ Upstream commit a117579d0205b5a0592a3a98493e2b875e4da236 ]
Perform implicit logout to flush I/O on zone disable.
--- drivers/scsi/qla2xxx/qla_gs.c | 1 - 1 file changed, 1 deletion(-)
drivers/scsi/qla2xxx/qla_gs.c +0 -1
@@ -3436,7 +3436,6 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)list_for_each_entry (fcport, &vha->vp_fcports, list) {if ((fcport->flags &FCF_FABRIC_DEVICE ) !=0 ) { fcport->scan_state =QLA_FCPORT_SCAN ; - fcport->logout_on_delete =0 ; } } goto login_logout;
Signature · 1 line
2.25.1