5.4.64-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.4.64-rc1 review
This is the start of the stable review cycle for the 5.4.64 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Sep 2020 15:21:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.64-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.64-rc1
Himadri Pandya <[email protected]>
net: usb: Fix uninit-was-stored issue in asix_read_phy_addr()
Johannes Berg <[email protected]>
cfg80211: regulatory: reject invalid hints
David Howells <[email protected]>
mm/khugepaged.c: fix khugepaged's request size in collapse_file
Muchun Song <[email protected]>
mm/hugetlb: fix a race between hugetlb sysctl handlers
Mrinal Pandey <[email protected]>
checkpatch: fix the usage of capture group ( ... )
Sowjanya Komatineni <[email protected]>
sdhci: tegra: Add missing TMCLK for data timeout
Wei Li <[email protected]>
perf record: Correct the help info of option "--no-bpf-event"
Alex Williamson <[email protected]>
vfio/pci: Fix SR-IOV VF handling with MMIO blocking
Yang Shi <[email protected]>
mm: madvise: fix vma user-after-free
Eugeniu Rosca <[email protected]>
mm: slub: fix conversion of freelist_corrupted()
Ye Bin <[email protected]>
dm thin metadata: Fix use-after-free in dm_bm_set_read_only
Ye Bin <[email protected]>
dm thin metadata: Avoid returning cmd->bm wild pointer on error
Ye Bin <[email protected]>
dm cache metadata: Avoid returning cmd->bm wild pointer on error
Damien Le Moal <[email protected]>
dm crypt: Initialize crypto wait structures
Mikulas Patocka <[email protected]>
dm integrity: fix error reporting in bitmap mode after creation
Mike Snitzer <[email protected]>
dm mpath: fix racey management of PG initialization
Mikulas Patocka <[email protected]>
dm writecache: handle DAX to partitions on persistent memory correctly
Evan Quan <[email protected]>
drm/amd/pm: avoid false alarm due to confusing softwareshutdowntemp setting
Gustavo Pimentel <[email protected]>
dmaengine: dw-edma: Fix scatter-gather address calculation
Tejun Heo <[email protected]>
blk-iocost: ioc_pd_free() shouldn't assume irq disabled
Tejun Heo <[email protected]>
libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
Jens Axboe <[email protected]>
block: ensure bdi->io_pages is always initialized
Ming Lei <[email protected]>
block: allow for_each_bvec to support zero len bvec
Max Staudt <[email protected]>
affs: fix basic permission bits to actually work
Sean Young <[email protected]>
media: rc: uevent sysfs file races with rc_unregister_device()
Sean Young <[email protected]>
media: rc: do not access device via sysfs after rc_unregister_device()
Adrian Hunter <[email protected]>
mmc: sdhci-pci: Fix SDHCI_RESET_ALL for CQHCI for Intel GLK-based controllers
Adrian Hunter <[email protected]>
mmc: cqhci: Add cqhci_deactivate()
Wenbin Mei <[email protected]>
mmc: dt-bindings: Add resets/reset-names for Mediatek MMC bindings
Wenbin Mei <[email protected]>
mmc: mediatek: add optional module reset property
Wenbin Mei <[email protected]>
arm64: dts: mt7622: add reset node for mmc device
Takashi Iwai <[email protected]>
ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen
Adrien Crivelli <[email protected]>
ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A
Takashi Sakamoto <[email protected]>
ALSA; firewire-tascam: exclude Tascam FE-8 from detection
Dan Crawford <[email protected]>
ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO
Takashi Sakamoto <[email protected]>
ALSA: firewire-digi00x: exclude Avid Adrenaline from detection
Kai Vehmanen <[email protected]>
ALSA: hda/hdmi: always check pin power status in i915 pin fixup
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
Joshua Sivec <[email protected]>
ALSA: usb-audio: Add implicit feedback quirk for UR22C
Tong Zhang <[email protected]>
ALSA: ca0106: fix error code handling
Tiezhu Yang <[email protected]>
Revert "ALSA: hda: Add support for Loongson 7A1000 controller"
Sasha Levin <[email protected]>
Revert "net: dsa: microchip: set the correct number of ports"
Josef Bacik <[email protected]>
btrfs: fix potential deadlock in the search ioctl
Alexander Lobakin <[email protected]>
net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()
Qu Wenruo <[email protected]>
btrfs: tree-checker: fix the error message for transid error
Josef Bacik <[email protected]>
btrfs: set the lockdep class for log tree extent buffers
Josef Bacik <[email protected]>
btrfs: set the correct lockdep class for new nodes
Josef Bacik <[email protected]>
btrfs: allocate scrub workqueues outside of locks
Josef Bacik <[email protected]>
btrfs: drop path before adding new uuid tree entry
Vineet Gupta <[email protected]>
ARC: perf: don't bail setup if pct irq missing in device-tree
Mikulas Patocka <[email protected]>
xfs: don't update mtime on COW faults
Mikulas Patocka <[email protected]>
ext2: don't update mtime on COW faults
Vamshi K Sthambamkadi <[email protected]>
tracing/kprobes, x86/ptrace: Fix regs argument order for i386
Chris Wilson <[email protected]>
iommu/vt-d: Handle 36bit addressing for x86-32
Ajay Kaher <[email protected]>
vfio-pci: Invalidate mmaps and block MMIO access on disabled memory
Ajay Kaher <[email protected]>
vfio-pci: Fault mmaps to enable vma tracking
Ajay Kaher <[email protected]>
vfio/type1: Support faulting PFNMAP vmas
Jason Gunthorpe <[email protected]>
include/linux/log2.h: add missing () around n in roundup_pow_of_two()
Or Cohen <[email protected]>
net/packet: fix overflow in tpacket_rcv
Suravee Suthikulpanit <[email protected]>
iommu/amd: Restore IRTE.RemapEn bit after programming IRTE
Veera Vegivada <[email protected]>
thermal: qcom-spmi-temp-alarm: Don't suppress negative temp
Tony Lindgren <[email protected]>
thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
Lu Baolu <[email protected]>
iommu/vt-d: Serialize IOMMU GCMD register modifications
Huang Ying <[email protected]>
x86, fakenuma: Fix invalid starting node ID
Michael Chan <[email protected]>
tg3: Fix soft lockup when tg3_reset_task() fails.
Namhyung Kim <[email protected]>
perf jevents: Fix suspicious code in fixregex()
Darrick J. Wong <[email protected]>
xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt files
Huang Pei <[email protected]>
MIPS: add missing MSACSR and upper MSA initialization
Kai-Heng Feng <[email protected]>
drm/radeon: Prefer lower feedback dividers
Dan Carpenter <[email protected]>
net: gemini: Fix another missing clk_disable_unprepare() in probe
Al Viro <[email protected]>
fix regression in "epoll: Keep a reference on files added to the check list"
Shung-Hsi Yu <[email protected]>
net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
Al Grant <[email protected]>
perf tools: Correct SNOOPX field offset
Potnuri Bharat Teja <[email protected]>
cxgb4: fix thermal zone device registration
Keith Busch <[email protected]>
nvme: fix controller instance leak
Christophe JAILLET <[email protected]>
nvmet-fc: Fix a missed _irqsave version of spin_lock in 'nvmet_fc_fod_op_done()'
Pablo Neira Ayuso <[email protected]>
netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
Landen Chao <[email protected]>
net: dsa: mt7530: fix advertising unsupported 1000baseT_Half
Jesper Dangaard Brouer <[email protected]>
selftests/bpf: Fix massive output from test_maps
Ezequiel Garcia <[email protected]>
media: cedrus: Add missing v4l2_ctrl_request_hdl_put()
Hans Verkuil <[email protected]>
media: vicodec: add missing v4l2_ctrl_request_hdl_put()
Jakub Kicinski <[email protected]>
bnxt: don't enable NAPI until rings are ready
Eric Sandeen <[email protected]>
xfs: fix boundary test in xfs_attr_shortform_verify
Edwin Peer <[email protected]>
bnxt_en: fix HWRM error when querying VF temperature
Michael Chan <[email protected]>
bnxt_en: Fix possible crash in bnxt_fw_reset_task().
Vasundhara Volam <[email protected]>
bnxt_en: Fix PCI AER error recovery flow
Vasundhara Volam <[email protected]>
bnxt_en: Check for zero dir entries in NVRAM.
Pavan Chebbi <[email protected]>
bnxt_en: Don't query FW when netif_running() is false.
Murali Karicheri <[email protected]>
net: ethernet: ti: cpsw: fix clean up of vlan mc entries for host port
Nicolas Dichtel <[email protected]>
gtp: add GTPA_LINK info to msg sent to userspace
Marek Szyprowski <[email protected]>
dmaengine: pl330: Fix burst length if burst size is smaller than bus width
Dinghao Liu <[email protected]>
net: arc_emac: Fix memleak in arc_mdio_probe
Yuusuke Ashizuka <[email protected]>
ravb: Fixed to be able to unload modules
Dinghao Liu <[email protected]>
net: systemport: Fix memleak in bcm_sysport_probe
Dinghao Liu <[email protected]>
net: hns: Fix memleak in hns_nic_dev_probe
Florian Westphal <[email protected]>
netfilter: nf_tables: fix destination register zeroing
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: incorrect enum nft_list_attributes definition
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: add NFTA_SET_USERDATA if not null
Raul E Rangel <[email protected]>
mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040
Florian Fainelli <[email protected]>
MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores
Florian Fainelli <[email protected]>
MIPS: mm: BMIPS5000 has inclusive physical caches
David Howells <[email protected]>
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
David Howells <[email protected]>
rxrpc: Keep the ACK serial in a var in rxrpc_input_ack()
Yu Kuai <[email protected]>
dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate()
Jussi Kivilinna <[email protected]>
batman-adv: bla: use netif_rx_ni when not in interrupt context
Linus Lüssing <[email protected]>
batman-adv: Fix own OGM check in aggregated OGMs
Sven Eckelmann <[email protected]>
batman-adv: Avoid uninitialized chaddr when handling DHCP
Peter Ujfalusi <[email protected]>
dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling
Linus Torvalds <[email protected]>
fsldma: fix very broken 32-bit ppc ioread64 functionality
Simon Leiner <[email protected]>
xen/xenbus: Fix granting of vmalloc'd memory
Dinghao Liu <[email protected]>
drm/amd/display: Fix memleak in amdgpu_dm_mode_config_init
Wayne Lin <[email protected]>
drm/amd/display: Retry AUX write when fail occurs
Furquan Shaikh <[email protected]>
drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Reject overlay plane configurations in multi-display scenarios
Sven Schnelle <[email protected]>
s390: don't trace preemption in percpu macros
Hou Pu <[email protected]>
nbd: restore default timeout when setting it to zero
Peter Zijlstra <[email protected]>
cpuidle: Fixup IRQ state
Tomi Valkeinen <[email protected]>
drm/omap: fix incorrect lock state
Jeff Layton <[email protected]>
ceph: don't allow setlease on cephfs
Dmitry Baryshkov <[email protected]>
drm/msm/a6xx: fix gmu start on newer firmware
Ofir Bitton <[email protected]>
habanalabs: check correct vmalloc return code
Ofir Bitton <[email protected]>
habanalabs: validate FW file size
Rob Clark <[email protected]>
drm/msm: enable vblank during atomic commits
Amit Engel <[email protected]>
nvmet: Disable keep-alive timer when kato is cleared to 0h
Tom Rix <[email protected]>
hwmon: (applesmc) check status earlier.
Krishna Manikandan <[email protected]>
drm/msm: add shutdown support for display platform_driver
John Stultz <[email protected]>
tty: serial: qcom_geni_serial: Drop __init from qcom_geni_console_setup
Kalyan Thota <[email protected]>
drm/msm/dpu: Fix scale params in plane validation
Sebastian Parschauer <[email protected]>
HID: quirks: Always poll three more Lenovo PixArt mice
-------------
Diffstat:
Documentation/devicetree/bindings/mmc/mtk-sd.txt | 2 + Documentation/filesystems/affs.txt | 16 +- Makefile | 4 +- arch/arc/kernel/perf_event.c | 14 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 + arch/mips/kernel/smp-bmips.c | 2 + arch/mips/kernel/traps.c | 12 + arch/mips/mm/c-r4k.c | 4 + arch/s390/include/asm/percpu.h | 28 +- arch/x86/include/asm/ptrace.h | 2 +- arch/x86/mm/numa_emulation.c | 2 +- block/blk-core.c | 1 + block/blk-iocost.c | 5 +- drivers/ata/libata-core.c | 5 +- drivers/ata/libata-scsi.c | 8 +- drivers/block/nbd.c | 2 + drivers/cpuidle/cpuidle.c | 3 +- drivers/dma/at_hdmac.c | 2 + drivers/dma/dw-edma/dw-edma-core.c | 11 +- drivers/dma/fsldma.h | 12 +- drivers/dma/of-dma.c | 8 +- drivers/dma/pl330.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- .../gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 8 + .../gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 14 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 12 +- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 +- drivers/gpu/drm/msm/msm_atomic.c | 36 +++ drivers/gpu/drm/msm/msm_drv.c | 8 + drivers/gpu/drm/omapdrm/omap_crtc.c | 3 +- drivers/gpu/drm/radeon/radeon_display.c | 2 +- drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 3 + drivers/hwmon/applesmc.c | 31 +- drivers/iommu/amd_iommu.c | 2 + drivers/iommu/intel-iommu.c | 14 +- drivers/iommu/intel_irq_remapping.c | 10 +- drivers/md/dm-cache-metadata.c | 8 +- drivers/md/dm-crypt.c | 2 +- drivers/md/dm-integrity.c | 12 + drivers/md/dm-mpath.c | 22 +- drivers/md/dm-thin-metadata.c | 10 +- drivers/md/dm-writecache.c | 12 +- drivers/md/persistent-data/dm-block-manager.c | 14 +- drivers/media/platform/vicodec/vicodec-core.c | 1 + drivers/media/rc/rc-main.c | 44 ++- drivers/misc/habanalabs/firmware_if.c | 9 + drivers/misc/habanalabs/memory.c | 9 +- drivers/misc/habanalabs/mmu.c | 2 +- drivers/mmc/host/cqhci.c | 6 +- drivers/mmc/host/cqhci.h | 6 +- drivers/mmc/host/mtk-sd.c | 13 + drivers/mmc/host/sdhci-acpi.c | 67 +++- drivers/mmc/host/sdhci-pci-core.c | 10 +- drivers/mmc/host/sdhci-tegra.c | 53 +++- drivers/net/dsa/microchip/ksz8795.c | 3 - drivers/net/dsa/microchip/ksz9477.c | 3 - drivers/net/dsa/mt7530.c | 2 +- drivers/net/ethernet/arc/emac_mdio.c | 1 + drivers/net/ethernet/broadcom/bcmsysport.c | 6 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 36 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 +- drivers/net/ethernet/broadcom/tg3.c | 17 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c | 8 +- drivers/net/ethernet/cortina/gemini.c | 34 +- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 9 +- drivers/net/ethernet/mellanox/mlx4/mr.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 110 +++---- drivers/net/ethernet/ti/cpsw.c | 2 +- drivers/net/gtp.c | 1 + drivers/net/usb/asix_common.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/target/core.c | 6 + drivers/nvme/target/fc.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 7 +- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 4 +- .../thermal/ti-soc-thermal/omap4-thermal-data.c | 23 +- drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h | 10 +- drivers/tty/serial/qcom_geni_serial.c | 2 +- drivers/vfio/pci/vfio_pci.c | 349 +++++++++++++++++++-- drivers/vfio/pci/vfio_pci_config.c | 51 ++- drivers/vfio/pci/vfio_pci_intrs.c | 14 + drivers/vfio/pci/vfio_pci_private.h | 15 + drivers/vfio/pci/vfio_pci_rdwr.c | 24 +- drivers/vfio/vfio_iommu_type1.c | 36 ++- drivers/xen/xenbus/xenbus_client.c | 10 +- fs/affs/amigaffs.c | 27 ++ fs/affs/file.c | 26 +- fs/afs/fs_probe.c | 4 +- fs/afs/vl_probe.c | 4 +- fs/btrfs/ctree.c | 6 +- fs/btrfs/extent-tree.c | 2 +- fs/btrfs/extent_io.c | 8 +- fs/btrfs/extent_io.h | 6 +- fs/btrfs/ioctl.c | 27 +- fs/btrfs/scrub.c | 122 ++++--- fs/btrfs/tree-checker.c | 2 +- fs/btrfs/volumes.c | 3 +- fs/ceph/file.c | 1 + fs/eventpoll.c | 6 +- fs/ext2/file.c | 6 +- fs/xfs/libxfs/xfs_attr_leaf.c | 4 +- fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/xfs_file.c | 12 +- include/linux/bvec.h | 9 +- include/linux/libata.h | 1 + include/linux/log2.h | 2 +- include/linux/netfilter/nfnetlink.h | 3 +- include/net/af_rxrpc.h | 2 +- include/net/netfilter/nf_tables.h | 2 + include/uapi/linux/netfilter/nf_tables.h | 2 +- mm/hugetlb.c | 26 +- mm/khugepaged.c | 2 +- mm/madvise.c | 2 +- mm/slub.c | 12 +- net/batman-adv/bat_v_ogm.c | 11 +- net/batman-adv/bridge_loop_avoidance.c | 5 +- net/batman-adv/gateway_client.c | 6 +- net/core/dev.c | 9 +- net/netfilter/nf_tables_api.c | 64 ++-- net/netfilter/nfnetlink.c | 11 +- net/netfilter/nfnetlink_log.c | 3 +- net/netfilter/nfnetlink_queue.c | 2 +- net/netfilter/nft_payload.c | 4 +- net/packet/af_packet.c | 7 +- net/rxrpc/input.c | 21 +- net/rxrpc/peer_object.c | 16 +- net/wireless/reg.c | 3 + scripts/checkpatch.pl | 4 +- sound/core/oss/mulaw.c | 4 +- sound/firewire/digi00x/digi00x.c | 5 + sound/firewire/tascam/tascam.c | 33 +- sound/pci/ca0106/ca0106_main.c | 3 +- sound/pci/hda/hda_intel.c | 2 - sound/pci/hda/patch_hdmi.c | 1 + sound/pci/hda/patch_realtek.c | 46 ++- sound/usb/pcm.c | 1 + tools/include/uapi/linux/perf_event.h | 2 +- tools/perf/builtin-record.c | 2 +- tools/perf/pmu-events/jevents.c | 2 +- tools/testing/selftests/bpf/test_maps.c | 2 + 142 files changed, 1505 insertions(+), 504 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/129 HID: quirks: Always poll three more Lenovo PixArt mice
From: Sebastian Parschauer <[email protected]>
[ Upstream commit 627a49975bdc3220f360a8237603a6344ee6a588 ]
The PixArt OEM mice are known for disconnecting every minute in runlevel 1 or 3 if they are not always polled. One Lenovo PixArt mouse is already fixed. Got two references for 17ef:602e and three references for 17ef:6019 misbehaving like this. Got one direct bug report for 17ef:6093 from Wyatt Ward (wyatt8740). So add HID_QUIRK_ALWAYS_POLL for all of them.
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-quirks.c | 3 +++ 2 files changed, 6 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -730,6 +730,9 @@#define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d +#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019 +#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E 0x602e +#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093 0x6093#define USB_VENDOR_ID_LG 0x1fd2#define USB_DEVICE_ID_LG_MULTITOUCH 0x0064
drivers/hid/hid-quirks.c +3 -0
@@ -105,6 +105,9 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M406XE), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS), HID_QUIRK_NOGET },
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 2/129 drm/msm/dpu: Fix scale params in plane validation
In reply to Greg Kroah-HartmanFrom: Kalyan Thota <[email protected]>
[ Upstream commit 4c978caf08aa155bdeadd9e2d4b026d4ce97ebd0 ]
Plane validation uses an API drm_calc_scale which will return src/dst value as a scale ratio.
when viewing the range on a scale the values should fall in as
Upscale ratio < Unity scale < Downscale ratio for src/dst formula
Fix the min and max scale ratios to suit the API accordingly.
--- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +2 -2
@@ -853,9 +853,9 @@ static int dpu_plane_atomic_check(struct drm_plane *plane, crtc_state =drm_atomic_get_new_crtc_state (state->state, state->crtc); - min_scale =FRAC_16_16 (1 , pdpu->pipe_sblk->maxdwnscale); + min_scale =FRAC_16_16 (1 , pdpu->pipe_sblk->maxupscale); ret =drm_atomic_helper_check_plane_state (state, crtc_state, min_scale, - pdpu->pipe_sblk->maxupscale <<16 , + pdpu->pipe_sblk->maxdwnscale <<16 , true, true);if (ret) {DPU_ERROR_PLANE (pdpu,"Check plane state failed (%d)\n" , ret);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/129 tty: serial: qcom_geni_serial: Drop __init from qcom_geni_console_setup
In reply to Greg Kroah-HartmanFrom: John Stultz <[email protected]>
[ Upstream commit 975efc66d4e654207c17f939eb737ac591ac38fe ]
When booting with heavily modularized config, the serial console may not be able to load until after init when modules that satisfy needed dependencies have time to load.
Unfortunately, as qcom_geni_console_setup is marked as __init, the function may have been freed before we get to run it, causing boot time crashes such as:
[ 6.469057] Unable to handle kernel paging request at virtual address ffffffe645d4e6cc [ 6.481623] Mem abort info: [ 6.484466] ESR = 0x86000007 [ 6.487557] EC = 0x21: IABT (current EL), IL = 32 bits [ 6.492929] SET = 0, FnV = 0g [ 6.496016] EA = 0, S1PTW = 0 [ 6.499202] swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000008151e000 [ 6.501286] ufshcd-qcom 1d84000.ufshc: ufshcd_print_pwr_info:[RX, TX]: gear=[3, 3], lane[2, 2], pwr[FAST MODE, FAST MODE], rate = 2 [ 6.505977] [ffffffe645d4e6cc] pgd=000000017df9f003, p4d=000000017df9f003, pud=000000017df9f003, pmd=000000017df9c003, pte=0000000000000000 [ 6.505990] Internal error: Oops: 86000007 [#1] PREEMPT SMP [ 6.505995] Modules linked in: zl10353 zl10039 zl10036 zd1301_demod xc5000 xc4000 ves1x93 ves1820 tuner_xc2028 tuner_simple tuner_types tua9001 tua6100 1 [ 6.506152] isl6405 [ 6.518104] ufshcd-qcom 1d84000.ufshc: ufshcd_find_max_sup_active_icc_level: Regulator capability was not set, actvIccLevel=0 [ 6.530549] horus3a helene fc2580 fc0013 fc0012 fc0011 ec100 e4000 dvb_pll ds3000 drxk drxd drx39xyj dib9000 dib8000 dib7000p dib7000m dib3000mc dibx003 [ 6.624271] CPU: 7 PID: 148 Comm: kworker/7:2 Tainted: G W 5.8.0-mainline-12021-g6defd37ba1cd #3455 [ 6.624273] Hardware name: Thundercomm Dragonboard 845c (DT) [ 6.624290] Workqueue: events deferred_probe_work_func [ 6.624296] pstate: 40c00005 (nZcv daif +PAN +UAO BTYPE=--) [ 6.624307] pc : qcom_geni_console_setup+0x0/0x110 [ 6.624316] lr : try_enable_new_console+0xa0/0x140 [ 6.624318] sp : ffffffc010843a30 [ 6.624320] x29: ffffffc010843a30 x28: ffffffe645c3e7d0 [ 6.624325] x27: ffffff80f8022180 x26: ffffffc010843b28 [ 6.637937] x25: 0000000000000000 x24: ffffffe6462a2000 [ 6.637941] x23: ffffffe646398000 x22: 0000000000000000 [ 6.637945] x21: 0000000000000000 x20: ffffffe6462a5ce8 [ 6.637952] x19: ffffffe646398e38 x18: ffffffffffffffff [ 6.680296] x17: 0000000000000000 x16: ffffffe64492b900 [ 6.680300] x15: ffffffe6461e9d08 x14: 69202930203d2064 [ 6.680305] x13: 7561625f65736162 x12: 202c363331203d20 [ 6.696434] x11: 0000000000000030 x10: 0101010101010101 [ 6.696438] x9 : 4d4d20746120304d x8 : 7f7f7f7f7f7f7f7f [ 6.707249] x7 : feff4c524c787373 x6 : 0000000000008080 [ 6.707253] x5 : 0000000000000000 x4 : 8080000000000000 [ 6.707257] x3 : 0000000000000000 x2 : ffffffe645d4e6cc [ 6.744223] qcom_geni_serial 898000.serial: dev_pm_opp_set_rate: failed to find OPP for freq 102400000 (-34) [ 6.744966] x1 : fffffffefe74e174 x0 : ffffffe6462a5ce8 [ 6.753580] qcom_geni_serial 898000.serial: dev_pm_opp_set_rate: failed to find OPP for freq 102400000 (-34) [ 6.761634] Call trace: [ 6.761639] qcom_geni_console_setup+0x0/0x110 [ 6.761645] register_console+0x29c/0x2f8 [ 6.767981] Bluetooth: hci0: Frame reassembly failed (-84) [ 6.775252] uart_add_one_port+0x438/0x500 [ 6.775258] qcom_geni_serial_probe+0x2c4/0x4a8 [ 6.775266] platform_drv_probe+0x58/0xa8 [ 6.855359] really_probe+0xec/0x398 [ 6.855362] driver_probe_device+0x5c/0xb8 [ 6.855367] __device_attach_driver+0x98/0xb8 [ 7.184945] bus_for_each_drv+0x74/0xd8 [ 7.188825] __device_attach+0xec/0x148 [ 7.192705] device_initial_probe+0x24/0x30 [ 7.196937] bus_probe_device+0x9c/0xa8 [ 7.200816] deferred_probe_work_func+0x7c/0xb8 [ 7.205398] process_one_work+0x20c/0x4b0 [ 7.209456] worker_thread+0x48/0x460 [ 7.213157] kthread+0x14c/0x158 [ 7.216432] ret_from_fork+0x10/0x18 [ 7.220049] Code: bad PC value [ 7.223139] ---[ end trace 73f3b21e251d5a70 ]---
Thus this patch removes the __init avoiding crash in such configs.
--- drivers/tty/serial/qcom_geni_serial.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/qcom_geni_serial.c +1 -1
@@ -1063,7 +1063,7 @@ static unsigned int qcom_geni_serial_tx_empty(struct uart_port *uport) }#ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE -static int __init qcom_geni_console_setup (struct console *co,char *options) +static int qcom_geni_console_setup (struct console *co,char *options) {struct uart_port *uport;struct qcom_geni_serial_port *port;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/129 drm/msm: add shutdown support for display platform_driver
In reply to Greg Kroah-HartmanFrom: Krishna Manikandan <[email protected]>
[ Upstream commit 9d5cbf5fe46e350715389d89d0c350d83289a102 ]
Define shutdown callback for display drm driver, so as to disable all the CRTCS when shutdown notification is received by the driver.
This change will turn off the timing engine so that no display transactions are requested while mmu translations are getting disabled during reboot sequence.
Changes in v2:
- Remove NULL check from msm_pdev_shutdown (Stephen Boyd)
- Change commit text to reflect when this issue was uncovered (Sai Prakash Ranjan)
--- drivers/gpu/drm/msm/msm_drv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/msm/msm_drv.c +8 -0
@@ -1321,6 +1321,13 @@ static int msm_pdev_remove(struct platform_device *pdev)return 0 ; } +static void msm_pdev_shutdown (struct platform_device *pdev) +{ +struct drm_device *drm =platform_get_drvdata (pdev); + +drm_atomic_helper_shutdown (drm); +} +static const struct of_device_id dt_match[] = { { .compatible ="qcom,mdp4" , .data = (void *)KMS_MDP4 }, { .compatible ="qcom,mdss" , .data = (void *)KMS_MDP5 },
@@ -1332,6 +1339,7 @@ MODULE_DEVICE_TABLE(of, dt_match);static struct platform_driver msm_platform_driver = { .probe = msm_pdev_probe, .remove = msm_pdev_remove, + .shutdown = msm_pdev_shutdown, .driver = { .name ="msm" , .of_match_table = dt_match,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/129 hwmon: (applesmc) check status earlier.
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit cecf7560f00a8419396a2ed0f6e5d245ccb4feac ]
clang static analysis reports this representative problem
applesmc.c:758:10: warning: 1st function call argument is an
uninitialized value
left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2;
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~buffer is filled by the earlier call
ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, ...
This problem is reported because a goto skips the status check. Other similar problems use data from applesmc_read_key before checking the status. So move the checks to before the use.
--- drivers/hwmon/applesmc.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-)
drivers/hwmon/applesmc.c +16 -15
@@ -748,15 +748,18 @@ static ssize_t applesmc_light_show(struct device *dev, } ret =applesmc_read_key (LIGHT_SENSOR_LEFT_KEY , buffer, data_length); +if (ret) + goto out;/* newer macbooks report a single 10-bit bigendian value */ if (data_length ==10 ) { left =be16_to_cpu (*(__be16 *)(buffer +6 )) >>2 ; goto out; } left = buffer[2 ]; + + ret =applesmc_read_key (LIGHT_SENSOR_RIGHT_KEY , buffer, data_length);if (ret) goto out; - ret =applesmc_read_key (LIGHT_SENSOR_RIGHT_KEY , buffer, data_length); right = buffer[2 ]; out:
@@ -805,12 +808,11 @@ static ssize_t applesmc_show_fan_speed(struct device *dev, to_index(attr)); ret =applesmc_read_key (newkey, buffer,2 ); - speed = ((buffer[0 ] <<8 | buffer[1 ]) >>2 ); -if (ret)return ret; -else -return snprintf (sysfsbuf,PAGE_SIZE ,"%u\n" , speed); + + speed = ((buffer[0 ] <<8 | buffer[1 ]) >>2 ); +return snprintf (sysfsbuf,PAGE_SIZE ,"%u\n" , speed); } static ssize_t applesmc_store_fan_speed(struct device *dev,
@@ -846,12 +848,11 @@ static ssize_t applesmc_show_fan_manual(struct device *dev,u8 buffer[2 ]; ret =applesmc_read_key (FANS_MANUAL , buffer,2 ); - manual = ((buffer[0 ] <<8 | buffer[1 ]) >>to_index (attr)) &0x01 ; -if (ret)return ret; -else -return snprintf (sysfsbuf,PAGE_SIZE ,"%d\n" , manual); + + manual = ((buffer[0 ] <<8 | buffer[1 ]) >>to_index (attr)) &0x01 ; +return snprintf (sysfsbuf,PAGE_SIZE ,"%d\n" , manual); } static ssize_t applesmc_store_fan_manual(struct device *dev,
@@ -867,10 +868,11 @@ static ssize_t applesmc_store_fan_manual(struct device *dev,return -EINVAL ; ret =applesmc_read_key (FANS_MANUAL , buffer,2 ); - val = (buffer[0 ] <<8 | buffer[1 ]);if (ret) goto out; + val = (buffer[0 ] <<8 | buffer[1 ]); +if (input) val = val | (0x01 <<to_index (attr));else
@@ -946,13 +948,12 @@ static ssize_t applesmc_key_count_show(struct device *dev,u32 count; ret =applesmc_read_key (KEY_COUNT_KEY , buffer,4 ); - count = ((u32 )buffer[0 ]<<24 ) + ((u32 )buffer[1 ]<<16 ) + - ((u32 )buffer[2 ]<<8 ) + buffer[3 ]; -if (ret)return ret; -else -return snprintf (sysfsbuf,PAGE_SIZE ,"%d\n" , count); + + count = ((u32 )buffer[0 ]<<24 ) + ((u32 )buffer[1 ]<<16 ) + + ((u32 )buffer[2 ]<<8 ) + buffer[3 ]; +return snprintf (sysfsbuf,PAGE_SIZE ,"%d\n" , count); } static ssize_t applesmc_key_at_index_read_show(struct device *dev,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/129 nvmet: Disable keep-alive timer when kato is cleared to 0h
In reply to Greg Kroah-HartmanFrom: Amit Engel <[email protected]>
[ Upstream commit 0d3b6a8d213a30387b5104b2fb25376d18636f23 ]
Based on nvme spec, when keep alive timeout is set to zero the keep-alive timer should be disabled.
--- drivers/nvme/target/core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/nvme/target/core.c +6 -0
@@ -369,6 +369,9 @@ static void nvmet_keep_alive_timer(struct work_struct *work)static void nvmet_start_keep_alive_timer (struct nvmet_ctrl *ctrl) { +if (unlikely (ctrl->kato ==0 )) +return ; +pr_debug ("ctrl %d start keep-alive timer for %d secs\n" , ctrl->cntlid, ctrl->kato);
@@ -378,6 +381,9 @@ static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl)static void nvmet_stop_keep_alive_timer (struct nvmet_ctrl *ctrl) { +if (unlikely (ctrl->kato ==0 )) +return ; +pr_debug ("ctrl %d stop keep-alive\n" , ctrl->cntlid);cancel_delayed_work_sync (&ctrl->ka_work);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/129 drm/msm: enable vblank during atomic commits
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
[ Upstream commit 43906812eaab06423f56af5cca9a9fcdbb4ac454 ]
This has roughly the same effect as drm_atomic_helper_wait_for_vblanks(), basically just ensuring that vblank accounting is enabled so that we get valid timestamp/seqn on pageflip events.
--- drivers/gpu/drm/msm/msm_atomic.c | 36 ++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)
drivers/gpu/drm/msm/msm_atomic.c +36 -0
@@ -27,6 +27,34 @@ int msm_atomic_prepare_fb(struct drm_plane *plane,return msm_framebuffer_prepare (new_state->fb, kms->aspace); } +/* +* Helpers to control vblanks while we flush.. basically just to ensure +* that vblank accounting is switched on, so we get valid seqn/timestamp +* on pageflip events (if requested) +*/ + +static void vblank_get (struct msm_kms *kms,unsigned crtc_mask) +{ +struct drm_crtc *crtc; + +for_each_crtc_mask (kms->dev, crtc, crtc_mask) { +if (!crtc->state->active) +continue ; +drm_crtc_vblank_get (crtc); + } +} + +static void vblank_put (struct msm_kms *kms,unsigned crtc_mask) +{ +struct drm_crtc *crtc; + +for_each_crtc_mask (kms->dev, crtc, crtc_mask) { +if (!crtc->state->active) +continue ; +drm_crtc_vblank_put (crtc); + } +} +static void msm_atomic_async_commit (struct msm_kms *kms,int crtc_idx) {unsigned crtc_mask =BIT (crtc_idx);
@@ -44,6 +72,8 @@ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx) kms->funcs->enable_commit (kms); +vblank_get (kms, crtc_mask); +/* * Flush hardware updates: */
@@ -58,6 +88,8 @@ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx) kms->funcs->wait_flush (kms, crtc_mask);trace_msm_atomic_wait_flush_finish (crtc_mask); +vblank_put (kms, crtc_mask); +mutex_lock (&kms->commit_lock); kms->funcs->complete_commit (kms, crtc_mask);mutex_unlock (&kms->commit_lock);
@@ -221,6 +253,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)*/ kms->pending_crtc_mask &= ~crtc_mask; +vblank_get (kms, crtc_mask); +/* * Flush hardware updates: */
@@ -235,6 +269,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state) kms->funcs->wait_flush (kms, crtc_mask);trace_msm_atomic_wait_flush_finish (crtc_mask); +vblank_put (kms, crtc_mask); +mutex_lock (&kms->commit_lock); kms->funcs->complete_commit (kms, crtc_mask);mutex_unlock (&kms->commit_lock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/129 habanalabs: validate FW file size
In reply to Greg Kroah-HartmanFrom: Ofir Bitton <[email protected]>
[ Upstream commit bce382a8bb080ed5f2f3a06754526dc58b91cca2 ]
We must validate FW size in order not to corrupt memory in case a malicious FW file will be present in system.
--- drivers/misc/habanalabs/firmware_if.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/misc/habanalabs/firmware_if.c +9 -0
@@ -11,6 +11,7 @@#include <linux/genalloc.h> #include <linux/io-64-nonatomic-lo-hi.h> +#define FW_FILE_MAX_SIZE 0x1400000/* maximum size of 20MB */ /** * hl_fw_push_fw_to_device() - Push FW code to device. * @hdev: pointer to hl_device structure.
@@ -43,6 +44,14 @@ int hl_fw_push_fw_to_device(struct hl_device *hdev, const char *fw_name,dev_dbg (hdev->dev,"%s firmware size == %zu\n" , fw_name, fw_size); +if (fw_size >FW_FILE_MAX_SIZE ) { +dev_err (hdev->dev, +"FW file size %zu exceeds maximum of %u bytes\n" , + fw_size,FW_FILE_MAX_SIZE ); + rc = -EINVAL ; + goto out; + } + fw_data = (const u64 *) fw->data;memcpy_toio (dst, fw_data, fw_size);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/129 habanalabs: check correct vmalloc return code
In reply to Greg Kroah-HartmanFrom: Ofir Bitton <[email protected]>
[ Upstream commit 0839152f8c1efc1cc2d515d1ff1e253ca9402ad3 ]
vmalloc can return different return code than NULL and a valid pointer. We must validate it in order to dereference a non valid pointer.
--- drivers/misc/habanalabs/memory.c | 9 +++++++-- drivers/misc/habanalabs/mmu.c | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/misc/habanalabs/memory.c +7 -2
@@ -67,6 +67,11 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args, num_pgs = (args->alloc.mem_size + (page_size -1 )) >> page_shift; total_size = num_pgs << page_shift; +if (!total_size) { +dev_err (hdev->dev,"Cannot allocate 0 bytes\n" ); +return -EINVAL ; + } + contiguous = args->flags &HL_MEM_CONTIGUOUS ;if (contiguous) {
@@ -94,7 +99,7 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args, phys_pg_pack->contiguous = contiguous; phys_pg_pack->pages =kvmalloc_array (num_pgs,sizeof (u64),GFP_KERNEL ); -if (!phys_pg_pack->pages) { +if (ZERO_OR_NULL_PTR (phys_pg_pack->pages)) { rc = -ENOMEM ; goto pages_arr_err; }
@@ -689,7 +694,7 @@ static int init_phys_pg_pack_from_userptr(struct hl_ctx *ctx, phys_pg_pack->pages =kvmalloc_array (total_npages,sizeof (u64),GFP_KERNEL ); -if (!phys_pg_pack->pages) { +if (ZERO_OR_NULL_PTR (phys_pg_pack->pages)) { rc = -ENOMEM ; goto page_pack_arr_mem_err; }
drivers/misc/habanalabs/mmu.c +1 -1
@@ -422,7 +422,7 @@ int hl_mmu_init(struct hl_device *hdev) hdev->mmu_shadow_hop0 =kvmalloc_array (prop->max_asid, prop->mmu_hop_table_size,GFP_KERNEL | __GFP_ZERO); -if (!hdev->mmu_shadow_hop0) { +if (ZERO_OR_NULL_PTR (hdev->mmu_shadow_hop0)) { rc = -ENOMEM ; goto err_pool_add; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/129 drm/msm/a6xx: fix gmu start on newer firmware
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit f5749d6181fa7df5ae741788e5d96f593d3a60b6 ]
New Qualcomm firmware has changed a way it reports back the 'started' event. Support new register values.
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +11 -1
@@ -199,12 +199,22 @@ static int a6xx_gmu_start(struct a6xx_gmu *gmu) {int ret;u32 val; +u32 mask, reset_val; + + val =gmu_read (gmu,REG_A6XX_GMU_CM3_DTCM_START +0xff8 ); +if (val <=0x20010004 ) { + mask =0xffffffff ; + reset_val =0xbabeface ; + }else { + mask =0x1ff ; + reset_val =0x100 ; + }gmu_write (gmu,REG_A6XX_GMU_CM3_SYSRESET ,1 );gmu_write (gmu,REG_A6XX_GMU_CM3_SYSRESET ,0 ); ret =gmu_poll_timeout (gmu,REG_A6XX_GMU_CM3_FW_INIT_RESULT , val, - val ==0xbabeface ,100 ,10000 ); + (val & mask) == reset_val,100 ,10000 );if (ret)DRM_DEV_ERROR (gmu->dev,"GMU firmware initialization timed out\n" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 11/129 ceph: dont allow setlease on cephfs
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
[ Upstream commit 496ceaf12432b3d136dcdec48424312e71359ea7 ]
Leases don't currently work correctly on kcephfs, as they are not broken when caps are revoked. They could eventually be implemented similarly to how we did them in libcephfs, but for now don't allow them.
[ idryomov: no need for simple_nosetlease() in ceph_dir_fops and
ceph_snapdir_fops ]
--- fs/ceph/file.c | 1 + 1 file changed, 1 insertion(+)
fs/ceph/file.c +1 -0
@@ -2198,6 +2198,7 @@ const struct file_operations ceph_file_fops = { .mmap = ceph_mmap, .fsync = ceph_fsync, .lock = ceph_lock, + .setlease = simple_nosetlease, .flock = ceph_flock, .splice_read = generic_file_splice_read, .splice_write = iter_file_splice_write,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 12/129 drm/omap: fix incorrect lock state
In reply to Greg Kroah-HartmanFrom: Tomi Valkeinen <[email protected]>
[ Upstream commit 7fd5b25499bcec157dd4de9a713425efcf4571cd ]
After commit 92cc68e35863c1c61c449efa2b2daef6e9926048 ("drm/vblank: Use spin_(un)lock_irq() in drm_crtc_vblank_on()") omapdrm locking is broken:
WARNING: inconsistent lock state
5.8.0-rc2-00483-g92cc68e35863 #13 Tainted: G W
--------------------------------
inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
swapper/0/0 [HC1[1]:SC0[0]:HE0:SE1] takes:ea98222c (&dev->event_lock#2){?.+.}-{2:2}, at: drm_handle_vblank+0x4c/0x520 [drm] {HARDIRQ-ON-W} state was registered at:
trace_hardirqs_on+0x9c/0x1ec _raw_spin_unlock_irq+0x20/0x58 omap_crtc_atomic_enable+0x54/0xa0 [omapdrm] drm_atomic_helper_commit_modeset_enables+0x218/0x270 [drm_kms_helper] omap_atomic_commit_tail+0x48/0xc4 [omapdrm] commit_tail+0x9c/0x190 [drm_kms_helper] drm_atomic_helper_commit+0x154/0x188 [drm_kms_helper] drm_client_modeset_commit_atomic+0x228/0x268 [drm] drm_client_modeset_commit_locked+0x60/0x1d0 [drm] drm_client_modeset_commit+0x24/0x40 [drm] drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0xa8 [drm_kms_helper] drm_fb_helper_set_par+0x2c/0x5c [drm_kms_helper] drm_fb_helper_hotplug_event.part.0+0xa0/0xbc [drm_kms_helper] drm_kms_helper_hotplug_event+0x24/0x30 [drm_kms_helper] output_poll_execute+0x1a8/0x1c0 [drm_kms_helper] process_one_work+0x268/0x800 worker_thread+0x30/0x4e0 kthread+0x164/0x190 ret_from_fork+0x14/0x20
The reason for this is that omapdrm calls drm_crtc_vblank_on() while holding event_lock taken with spin_lock_irq().
It is not clear why drm_crtc_vblank_on() and drm_crtc_vblank_get() are called while holding event_lock. I don't see any problem with moving those calls outside the lock, which is what this patch does.
--- drivers/gpu/drm/omapdrm/omap_crtc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/omapdrm/omap_crtc.c +2 -1
@@ -451,11 +451,12 @@ static void omap_crtc_atomic_enable(struct drm_crtc *crtc,if (omap_state->manually_updated)return ; -spin_lock_irq (&crtc->dev->event_lock);drm_crtc_vblank_on (crtc); + ret =drm_crtc_vblank_get (crtc);WARN_ON (ret !=0 ); +spin_lock_irq (&crtc->dev->event_lock);omap_crtc_arm_event (crtc);spin_unlock_irq (&crtc->dev->event_lock); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 13/129 cpuidle: Fixup IRQ state
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 49d9c5936314e44d314c605c39cce0fd947f9c3a ]
Match the pattern elsewhere in this file.
--- drivers/cpuidle/cpuidle.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpuidle/cpuidle.c +2 -1
@@ -148,7 +148,8 @@ static void enter_s2idle_proper(struct cpuidle_driver *drv,*/ stop_critical_timings (); drv->states[index].enter_s2idle (dev, drv, index); -WARN_ON (!irqs_disabled ()); +if (WARN_ON_ONCE (!irqs_disabled ())) +local_irq_disable ();/* * timekeeping_resume() that will be called by tick_unfreeze() for the * first CPU executing it calls functions containing RCU read-side
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 14/129 nbd: restore default timeout when setting it to zero
In reply to Greg Kroah-HartmanFrom: Hou Pu <[email protected]>
[ Upstream commit acb19e17c5134dd78668c429ecba5b481f038e6a ]
If we configured io timeout of nbd0 to 100s. Later after we finished using it, we configured nbd0 again and set the io timeout to 0. We expect it would timeout after 30 seconds and keep retry. But in fact we could not change the timeout when we set it to 0. the timeout is still the original 100s.
So change the timeout to default 30s when we set it to zero. It also behaves same as commit 2da22da57348 ("nbd: fix zero cmd timeout handling v2").
It becomes more important if we were reconfigure a nbd device and the io timeout it set to zero. Because it could take 30s to detect the new socket and thus io could be completed more quickly compared to 100s.
--- drivers/block/nbd.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/block/nbd.c +2 -0
@@ -1349,6 +1349,8 @@ static void nbd_set_cmd_timeout(struct nbd_device *nbd, u64 timeout) nbd->tag_set.timeout = timeout *HZ ;if (timeout)blk_queue_rq_timeout (nbd->disk->queue, timeout *HZ ); +else +blk_queue_rq_timeout (nbd->disk->queue,30 *HZ ); }/* Must be called with config_lock held */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 15/129 s390: dont trace preemption in percpu macros
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
[ Upstream commit 1196f12a2c960951d02262af25af0bb1775ebcc2 ]
Since commit a21ee6055c30 ("lockdep: Change hardirq{s_enabled,_context} to per-cpu variables") the lockdep code itself uses percpu variables. This leads to recursions because the percpu macros are calling preempt_enable() which might call trace_preempt_on().
--- arch/s390/include/asm/percpu.h | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
arch/s390/include/asm/percpu.h +14 -14
@@ -29,7 +29,7 @@typedef typeof (pcp)pcp_op_T__ ; \pcp_op_T__ old__, new__, prev__; \pcp_op_T__ *ptr__; \ -preempt_disable (); \ +preempt_disable_notrace (); \ ptr__ =raw_cpu_ptr (&(pcp)); \ prev__ = *ptr__; \ do { \
@@ -37,7 +37,7 @@ new__ = old__ op (val); \ prev__ =cmpxchg (ptr__, old__, new__); \ }while (prev__ != old__); \ -preempt_enable (); \ +preempt_enable_notrace (); \ new__; \ })
@@ -68,7 +68,7 @@typedef typeof (pcp)pcp_op_T__ ; \pcp_op_T__ val__ = (val); \pcp_op_T__ old__, *ptr__; \ -preempt_disable (); \ +preempt_disable_notrace (); \ ptr__ =raw_cpu_ptr (&(pcp)); \if (__builtin_constant_p (val__) && \ ((szcast )val__ >-129 ) && ((szcast )val__ <128 )) { \
@@ -84,7 +84,7 @@ : [val__] "d" (val__) \ : "cc"); \ } \ -preempt_enable (); \ +preempt_enable_notrace (); \ }#define this_cpu_add_4 (pcp, val) arch_this_cpu_add(pcp, val, "laa", "asi", int)
@@ -95,14 +95,14 @@typedef typeof (pcp)pcp_op_T__ ; \pcp_op_T__ val__ = (val); \pcp_op_T__ old__, *ptr__; \ -preempt_disable (); \ +preempt_disable_notrace (); \ ptr__ =raw_cpu_ptr (&(pcp)); \ asmvolatile ( \ op" %[old__],%[val__],%[ptr__]\n" \ : [old__]"=d" (old__), [ptr__]"+Q" (*ptr__) \ : [val__]"d" (val__) \ :"cc" ); \ -preempt_enable (); \ +preempt_enable_notrace (); \ old__ + val__; \ })
@@ -114,14 +114,14 @@typedef typeof (pcp)pcp_op_T__ ; \pcp_op_T__ val__ = (val); \pcp_op_T__ old__, *ptr__; \ -preempt_disable (); \ +preempt_disable_notrace (); \ ptr__ =raw_cpu_ptr (&(pcp)); \ asmvolatile ( \ op" %[old__],%[val__],%[ptr__]\n" \ : [old__]"=d" (old__), [ptr__]"+Q" (*ptr__) \ : [val__]"d" (val__) \ :"cc" ); \ -preempt_enable (); \ +preempt_enable_notrace (); \ }#define this_cpu_and_4 (pcp, val) arch_this_cpu_to_op(pcp, val, "lan")
@@ -136,10 +136,10 @@typedef typeof (pcp)pcp_op_T__ ; \pcp_op_T__ ret__; \pcp_op_T__ *ptr__; \ -preempt_disable (); \ +preempt_disable_notrace (); \ ptr__ =raw_cpu_ptr (&(pcp)); \ ret__ =cmpxchg (ptr__, oval, nval); \ -preempt_enable (); \ +preempt_enable_notrace (); \ ret__; \ })
@@ -152,10 +152,10 @@ ({ \typeof (pcp) *ptr__; \typeof (pcp) ret__; \ -preempt_disable (); \ +preempt_disable_notrace (); \ ptr__ =raw_cpu_ptr (&(pcp)); \ ret__ =xchg (ptr__, nval); \ -preempt_enable (); \ +preempt_enable_notrace (); \ ret__; \ })
@@ -171,11 +171,11 @@typeof (pcp1) *p1__; \typeof (pcp2) *p2__; \int ret__; \ -preempt_disable (); \ +preempt_disable_notrace (); \ p1__ =raw_cpu_ptr (&(pcp1)); \ p2__ =raw_cpu_ptr (&(pcp2)); \ ret__ =__cmpxchg_double (p1__, p2__, o1__, o2__, n1__, n2__); \ -preempt_enable (); \ +preempt_enable_notrace (); \ ret__; \ })
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 16/129 drm/amd/display: Reject overlay plane configurations in multi-display scenarios
In reply to Greg Kroah-HartmanFrom: Nicholas Kazlauskas <[email protected]>
[ Upstream commit 168f09cdadbd547c2b202246ef9a8183da725f13 ]
[Why]
These aren't stable on some platform configurations when driving multiple displays, especially on higher resolution.
In particular the delay in asserting p-state and validating from x86 outweights any power or performance benefit from the hardware composition.
Under some configurations this will manifest itself as extreme stutter or unresponsiveness especially when combined with cursor movement.
[How]
Disable these for now. Exposing overlays to userspace doesn't guarantee that they'll be able to use them in any and all configurations and it's part of the DRM contract to have userspace gracefully handle validation failures when they occur.
Valdiation occurs as part of DC and this in particular affects RV, so disable this in dcn10_global_validation.
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c +8 -0
@@ -1151,6 +1151,7 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *contbool video_large = false;bool desktop_large = false;bool dcc_disabled = false; +bool mpo_enabled = false;for (i =0 ; i < context->stream_count; i++) {if (context->stream_status[i].plane_count ==0 )
@@ -1159,6 +1160,9 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *contif (context->stream_status[i].plane_count >2 )return DC_FAIL_UNSUPPORTED_1 ; +if (context->stream_status[i].plane_count >1 ) + mpo_enabled = true; +for (j =0 ; j < context->stream_status[i].plane_count; j++) {struct dc_plane_state *plane = context->stream_status[i].plane_states[j];
@@ -1182,6 +1186,10 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *cont } } +/* Disable MPO in multi-display configurations. */ +if (context->stream_count >1 && mpo_enabled) +return DC_FAIL_UNSUPPORTED_1 ; +/* * Workaround: On DCN10 there is UMC issue that causes underflow when * playing 4k video on 4k desktop with video downscaled and single channel
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 17/129 drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps
In reply to Greg Kroah-HartmanFrom: Furquan Shaikh <[email protected]>
[ Upstream commit 5896585512e5156482335e902f7c7393b940da51 ]
In amdgpu_dm_update_backlight_caps(), there is a local amdgpu_dm_backlight_caps object that is filled in by amdgpu_acpi_get_backlight_caps(). However, this object is uninitialized before the call and hence the subsequent check for aux_support can fail since it is not initialized by amdgpu_acpi_get_backlight_caps() as well. This change initializes this local amdgpu_dm_backlight_caps object to 0.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -0
@@ -2064,6 +2064,8 @@ static void amdgpu_dm_update_backlight_caps(struct amdgpu_display_manager *dm)#if defined(CONFIG_ACPI )struct amdgpu_dm_backlight_caps caps; +memset (&caps,0 ,sizeof (caps)); +if (dm->backlight_caps.caps_valid)return ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 18/129 drm/amd/display: Retry AUX write when fail occurs
In reply to Greg Kroah-HartmanFrom: Wayne Lin <[email protected]>
[ Upstream commit ef67d792a2fc578319399f605fbec2f99ecc06ea ]
[Why]
In dm_dp_aux_transfer() now, we forget to handle AUX_WR fail cases. We suppose every write wil get done successfully and hence some AUX commands might not sent out indeed.
[How]
Check if AUX_WR success. If not, retry it.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +1 -1
@@ -101,7 +101,7 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, result =dc_link_aux_transfer_raw (TO_DM_AUX (aux)->ddc_service, &payload, &operation_result); -if (payload.write) +if (payload.write && result >=0 ) result = msg->size;if (result <0 )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 19/129 drm/amd/display: Fix memleak in amdgpu_dm_mode_config_init
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit b67a468a4ccef593cd8df6a02ba3d167b77f0c81 ]
When amdgpu_display_modeset_create_props() fails, state and state->context should be freed to prevent memleak. It's the same when amdgpu_dm_audio_init() fails.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +8 -2
@@ -2043,12 +2043,18 @@ static int amdgpu_dm_mode_config_init(struct amdgpu_device *adev) &dm_atomic_state_funcs); r =amdgpu_display_modeset_create_props (adev); -if (r) +if (r) { +dc_release_state (state->context); +kfree (state);return r; + } r =amdgpu_dm_audio_init (adev); -if (r) +if (r) { +dc_release_state (state->context); +kfree (state);return r; + }return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 20/129 xen/xenbus: Fix granting of vmallocd memory
In reply to Greg Kroah-HartmanFrom: Simon Leiner <[email protected]>
[ Upstream commit d742db70033c745e410523e00522ee0cfe2aa416 ]
On some architectures (like ARM), virt_to_gfn cannot be used for vmalloc'd memory because of its reliance on virt_to_phys. This patch introduces a check for vmalloc'd addresses and obtains the PFN using vmalloc_to_pfn in that case.
--- drivers/xen/xenbus/xenbus_client.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/xen/xenbus/xenbus_client.c +8 -2
@@ -363,8 +363,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr,int i, j;for (i =0 ; i < nr_pages; i++) { - err =gnttab_grant_foreign_access (dev->otherend_id, -virt_to_gfn (vaddr),0 ); +unsigned long gfn; + +if (is_vmalloc_addr (vaddr)) + gfn =pfn_to_gfn (vmalloc_to_pfn (vaddr)); +else + gfn =virt_to_gfn (vaddr); + + err =gnttab_grant_foreign_access (dev->otherend_id, gfn,0 );if (err <0 ) {xenbus_dev_fatal (dev, err,"granting access to ring page" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 21/129 fsldma: fix very broken 32-bit ppc ioread64 functionality
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
[ Upstream commit 0a4c56c80f90797e9b9f8426c6aae4c0cf1c9785 ]
Commit ef91bb196b0d ("kernel.h: Silence sparse warning in lower_32_bits") caused new warnings to show in the fsldma driver, but that commit was not to blame: it only exposed some very incorrect code that tried to take the low 32 bits of an address.
That made no sense for multiple reasons, the most notable one being that that code was intentionally limited to only 32-bit ppc builds, so "only low 32 bits of an address" was completely nonsensical. There were no high bits to mask off to begin with.
But even more importantly fropm a correctness standpoint, turning the address into an integer then caused the subsequent address arithmetic to be completely wrong too, and the "+1" actually incremented the address by one, rather than by four.
Which again was incorrect, since the code was reading two 32-bit values and trying to make a 64-bit end result of it all. Surprisingly, the iowrite64() did not suffer from the same odd and incorrect model.
This code has never worked, but it's questionable whether anybody cared:
of the two users that actually read the 64-bit value (by way of some C preprocessor hackery and eventually the 'get_cdar()' inline function), one of them explicitly ignored the value, and the other one might just happen to work despite the incorrect value being read.
This patch at least makes it not fail the build any more, and makes the logic superficially sane. Whether it makes any difference to the code _working_ or not shall remain a mystery.
--- drivers/dma/fsldma.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/dma/fsldma.h +6 -6
@@ -205,10 +205,10 @@ struct fsldma_chan {#else static u64 fsl_ioread64 (const u64 __iomem *addr) { -u32 fsl_addr =lower_32_bits (addr); -u64 fsl_addr_hi = (u64 )in_le32 ((u32 *)(fsl_addr +1 )) <<32 ; +u32 val_lo =in_le32 ((u32 __iomem *)addr); +u32 val_hi =in_le32 ((u32 __iomem *)addr +1 ); -return fsl_addr_hi |in_le32 ((u32 *)fsl_addr); +return ((u64 )val_hi <<32 ) + val_lo; }static void fsl_iowrite64 (u64 val,u64 __iomem *addr)
@@ -219,10 +219,10 @@ static void fsl_iowrite64(u64 val, u64 __iomem *addr)static u64 fsl_ioread64be (const u64 __iomem *addr) { -u32 fsl_addr =lower_32_bits (addr); -u64 fsl_addr_hi = (u64 )in_be32 ((u32 *)fsl_addr) <<32 ; +u32 val_hi =in_be32 ((u32 __iomem *)addr); +u32 val_lo =in_be32 ((u32 __iomem *)addr +1 ); -return fsl_addr_hi |in_be32 ((u32 *)(fsl_addr +1 )); +return ((u64 )val_hi <<32 ) + val_lo; }static void fsl_iowrite64be (u64 val,u64 __iomem *addr)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 22/129 dmaengine: of-dma: Fix of_dma_router_xlates of_dma_xlate handling
In reply to Greg Kroah-HartmanFrom: Peter Ujfalusi <[email protected]>
[ Upstream commit 5b2aa9f918f6837ae943557f8cec02c34fcf80e7 ]
of_dma_xlate callback can return ERR_PTR as well NULL in case of failure.
If error code is returned (not NULL) then the route should be released and the router should not be registered for the channel.
--- drivers/dma/of-dma.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/dma/of-dma.c +4 -4
@@ -69,12 +69,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,return NULL ; chan = ofdma_target->of_dma_xlate (&dma_spec_target, ofdma_target); -if (chan) { - chan->router = ofdma->dma_router; - chan->route_data = route_data; - }else { +if (IS_ERR_OR_NULL (chan)) { ofdma->dma_router->route_free (ofdma->dma_router->dev, route_data); + }else { + chan->router = ofdma->dma_router; + chan->route_data = route_data; }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 23/129 batman-adv: Avoid uninitialized chaddr when handling DHCP
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
[ Upstream commit 303216e76dcab6049c9d42390b1032f0649a8206 ]
The gateway client code can try to optimize the delivery of DHCP packets to avoid broadcasting them through the whole mesh. But also transmissions to the client can be optimized by looking up the destination via the chaddr of the DHCP packet.
But the chaddr is currently only done when chaddr is fully inside the non-paged area of the skbuff. Otherwise it will not be initialized and the unoptimized path should have been taken.
But the implementation didn't handle this correctly. It didn't retrieve the correct chaddr but still tried to perform the TT lookup with this uninitialized memory.
--- net/batman-adv/gateway_client.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/batman-adv/gateway_client.c +4 -2
@@ -703,8 +703,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len, chaddr_offset = *header_len +BATADV_DHCP_CHADDR_OFFSET ;/* store the client address if the message is going to a client */ -if (ret ==BATADV_DHCP_TO_CLIENT && -pskb_may_pull (skb, chaddr_offset +ETH_ALEN )) { +if (ret ==BATADV_DHCP_TO_CLIENT ) { +if (!pskb_may_pull (skb, chaddr_offset +ETH_ALEN )) +return BATADV_DHCP_NO ; +/* check if the DHCP packet carries an Ethernet DHCP */ p = skb->data + *header_len +BATADV_DHCP_HTYPE_OFFSET ;if (*p !=BATADV_DHCP_HTYPE_ETHERNET )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 24/129 batman-adv: Fix own OGM check in aggregated OGMs
In reply to Greg Kroah-HartmanFrom: Linus Lüssing <[email protected]>
[ Upstream commit d8bf0c01642275c7dca1e5d02c34e4199c200b1f ]
The own OGM check is currently misplaced and can lead to the following issues:
For one thing we might receive an aggregated OGM from a neighbor node which has our own OGM in the first place. We would then not only skip our own OGM but erroneously also any other, following OGM in the aggregate.
For another, we might receive an OGM aggregate which has our own OGM in a place other then the first one. Then we would wrongly not skip this OGM, leading to populating the orginator and gateway table with ourself.
--- net/batman-adv/bat_v_ogm.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/batman-adv/bat_v_ogm.c +6 -5
@@ -878,6 +878,12 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset,ntohl (ogm_packet->seqno), ogm_throughput, ogm_packet->ttl, ogm_packet->version, ntohs(ogm_packet->tvlv_len)); +if (batadv_is_my_mac (bat_priv, ogm_packet->orig)) { +batadv_dbg (BATADV_DBG_BATMAN , bat_priv, +"Drop packet: originator packet from ourself\n" ); +return ; + } +/* If the throughput metric is 0, immediately drop the packet. No need * to create orig_node / neigh_node for an unusable route. */
@@ -1005,11 +1011,6 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,if (batadv_is_my_mac (bat_priv, ethhdr->h_source)) goto free_skb; - ogm_packet = (struct batadv_ogm2_packet *)skb->data; - -if (batadv_is_my_mac (bat_priv, ogm_packet->orig)) - goto free_skb; -batadv_inc_counter (bat_priv,BATADV_CNT_MGMT_RX );batadv_add_counter (bat_priv,BATADV_CNT_MGMT_RX_BYTES , skb->len +ETH_HLEN );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 25/129 batman-adv: bla: use netif_rx_ni when not in interrupt context
In reply to Greg Kroah-HartmanFrom: Jussi Kivilinna <[email protected]>
[ Upstream commit 279e89b2281af3b1a9f04906e157992c19c9f163 ]
batadv_bla_send_claim() gets called from worker thread context through batadv_bla_periodic_work(), thus netif_rx_ni needs to be used in that case. This fixes "NOHZ: local_softirq_pending 08" log messages seen when batman-adv is enabled.
--- net/batman-adv/bridge_loop_avoidance.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/batman-adv/bridge_loop_avoidance.c +4 -1
@@ -437,7 +437,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac,batadv_add_counter (bat_priv,BATADV_CNT_RX_BYTES , skb->len +ETH_HLEN ); -netif_rx (skb); +if (in_interrupt ()) +netif_rx (skb); +else +netif_rx_ni (skb); out:if (primary_if)batadv_hardif_put (primary_if);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 26/129 dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 0cef8e2c5a07d482ec907249dbd6687e8697677f ]
The reurn value of of_find_device_by_node() is not checked, thus null pointer dereference will be triggered if of_find_device_by_node() failed.
--- drivers/dma/at_hdmac.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/at_hdmac.c +2 -0
@@ -1667,6 +1667,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,return NULL ; dmac_pdev =of_find_device_by_node (dma_spec->np); +if (!dmac_pdev) +return NULL ;dma_cap_zero (mask);dma_cap_set (DMA_SLAVE , mask);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 27/129 rxrpc: Keep the ACK serial in a var in rxrpc_input_ack()
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 68528d937dcd675e79973061c1a314db598162d1 ]
Keep the ACK serial number in a variable in rxrpc_input_ack() as it's used frequently.
--- net/rxrpc/input.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
net/rxrpc/input.c +11 -10
@@ -844,7 +844,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)struct rxrpc_ackinfo info;u8 acks[RXRPC_MAXACKS ]; } buf; -rxrpc_serial_t acked_serial; +rxrpc_serial_t ack_serial, acked_serial;rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt;int nr_acks, offset, ioffset;
@@ -857,6 +857,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) } offset +=sizeof (buf.ack); + ack_serial = sp->hdr.serial; acked_serial =ntohl (buf.ack.serial); first_soft_ack =ntohl (buf.ack.firstPacket); prev_pkt =ntohl (buf.ack.previousPacket);
@@ -865,31 +866,31 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) summary.ack_reason = (buf.ack.reason <RXRPC_ACK__INVALID ? buf.ack.reason :RXRPC_ACK__INVALID ); -trace_rxrpc_rx_ack (call, sp->hdr.serial, acked_serial, +trace_rxrpc_rx_ack (call, ack_serial, acked_serial, first_soft_ack, prev_pkt, summary.ack_reason, nr_acks);if (buf.ack.reason ==RXRPC_ACK_PING_RESPONSE )rxrpc_input_ping_response (call, skb->tstamp, acked_serial, - sp->hdr.serial); + ack_serial);if (buf.ack.reason ==RXRPC_ACK_REQUESTED )rxrpc_input_requested_ack (call, skb->tstamp, acked_serial, - sp->hdr.serial); + ack_serial);if (buf.ack.reason ==RXRPC_ACK_PING ) { -_proto ("Rx ACK %%%u PING Request" , sp->hdr.serial); +_proto ("Rx ACK %%%u PING Request" , ack_serial);rxrpc_propose_ACK (call,RXRPC_ACK_PING_RESPONSE , - sp->hdr.serial, true, true, + ack_serial, true, true, rxrpc_propose_ack_respond_to_ping); }else if (sp->hdr.flags &RXRPC_REQUEST_ACK ) {rxrpc_propose_ACK (call,RXRPC_ACK_REQUESTED , - sp->hdr.serial, true, true, + ack_serial, true, true, rxrpc_propose_ack_respond_to_ack); }/* Discard any out-of-order or duplicate ACKs (outside lock). */ if (!rxrpc_is_ack_valid (call, first_soft_ack, prev_pkt)) { -trace_rxrpc_rx_discard_ack (call->debug_id, sp->hdr.serial, +trace_rxrpc_rx_discard_ack (call->debug_id, ack_serial, first_soft_ack, call->ackr_first_seq, prev_pkt, call->ackr_prev_seq);return ;
@@ -905,7 +906,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)/* Discard any out-of-order or duplicate ACKs (inside lock). */ if (!rxrpc_is_ack_valid (call, first_soft_ack, prev_pkt)) { -trace_rxrpc_rx_discard_ack (call->debug_id, sp->hdr.serial, +trace_rxrpc_rx_discard_ack (call->debug_id, ack_serial, first_soft_ack, call->ackr_first_seq, prev_pkt, call->ackr_prev_seq); goto out;
@@ -965,7 +966,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) RXRPC_TX_ANNO_LAST && summary.nr_acks == call->tx_top - hard_ack && rxrpc_is_client_call(call)) -rxrpc_propose_ACK (call,RXRPC_ACK_PING , sp->hdr.serial, +rxrpc_propose_ACK (call,RXRPC_ACK_PING , ack_serial, false, true, rxrpc_propose_ack_ping_for_lost_reply);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 28/129 rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 1d4adfaf65746203861c72d9d78de349eb97d528 ]
Fix rxrpc_kernel_get_srtt() to indicate the validity of the returned smoothed RTT. If we haven't had any valid samples yet, the SRTT isn't useful.
--- fs/afs/fs_probe.c | 4 ++-- fs/afs/vl_probe.c | 4 ++-- include/net/af_rxrpc.h | 2 +- net/rxrpc/peer_object.c | 16 +++++++++++++--- 4 files changed, 18 insertions(+), 8 deletions(-)
fs/afs/fs_probe.c +2 -2
@@ -92,8 +92,8 @@ responded: } } - rtt_us =rxrpc_kernel_get_srtt (call->net->socket, call->rxcall); -if (rtt_us < server->probe.rtt) { +if (rxrpc_kernel_get_srtt (call->net->socket, call->rxcall, &rtt_us) && + rtt_us < server->probe.rtt) { server->probe.rtt = rtt_us; alist->preferred = index; have_result = true;
fs/afs/vl_probe.c +2 -2
@@ -92,8 +92,8 @@ responded: } } - rtt_us =rxrpc_kernel_get_srtt (call->net->socket, call->rxcall); -if (rtt_us < server->probe.rtt) { +if (rxrpc_kernel_get_srtt (call->net->socket, call->rxcall, &rtt_us) && + rtt_us < server->probe.rtt) { server->probe.rtt = rtt_us; alist->preferred = index; have_result = true;
include/net/af_rxrpc.h +1 -1
@@ -59,7 +59,7 @@ bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *,void rxrpc_kernel_end_call (struct socket *,struct rxrpc_call *);void rxrpc_kernel_get_peer (struct socket *,struct rxrpc_call *,struct sockaddr_rxrpc *); -u32 rxrpc_kernel_get_srtt (struct socket *,struct rxrpc_call *); +bool rxrpc_kernel_get_srtt (struct socket *,struct rxrpc_call *,u32 *);int rxrpc_kernel_charge_accept (struct socket *,rxrpc_notify_rx_t ,rxrpc_user_attach_call_t ,unsigned long ,gfp_t ,unsigned int );
net/rxrpc/peer_object.c +13 -3
@@ -500,11 +500,21 @@ EXPORT_SYMBOL(rxrpc_kernel_get_peer);* rxrpc_kernel_get_srtt - Get a call's peer smoothed RTT * @sock: The socket on which the call is in progress. * @call: The call to query +* @_srtt: Where to store the SRTT value. * -* Get the call's peer smoothed RTT. +* Get the call's peer smoothed RTT in uS. */ -u32 rxrpc_kernel_get_srtt (struct socket *sock,struct rxrpc_call *call) +bool rxrpc_kernel_get_srtt (struct socket *sock,struct rxrpc_call *call, +u32 *_srtt) { -return call->peer->srtt_us >>3 ; +struct rxrpc_peer *peer = call->peer; + +if (peer->rtt_count ==0 ) { + *_srtt =1000000 ;/* 1S */ +return false; + } + + *_srtt = call->peer->srtt_us >>3 ; +return true; }EXPORT_SYMBOL (rxrpc_kernel_get_srtt);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 29/129 MIPS: mm: BMIPS5000 has inclusive physical caches
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit dbfc95f98f0158958d1f1e6bf06d74be38dbd821 ]
When the BMIPS generic cpu-feature-overrides.h file was introduced, cpu_has_inclusive_caches/MIPS_CPU_INCLUSIVE_CACHES was not set for BMIPS5000 CPUs. Correct this when we have initialized the MIPS secondary cache successfully.
--- arch/mips/mm/c-r4k.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/mips/mm/c-r4k.c +4 -0
@@ -1676,7 +1676,11 @@ static void setup_scache(void)printk ("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n" , scache_size >>10 , way_string[c->scache.ways], c->scache.linesz); + +if (current_cpu_type () ==CPU_BMIPS5000 ) + c->options |= MIPS_CPU_INCLUSIVE_CACHES; } +#else if (!(c->scache.flags &MIPS_CACHE_NOT_PRESENT ))panic ("Dunno how to handle MIPS32 / MIPS64 second level cache" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 30/129 MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit e14f633b66902615cf7faa5d032b45ab8b6fb158 ]
The initialization done by bmips_cpu_setup() typically affects both threads of a given core, on 7435 which supports 2 cores and 2 threads, logical CPU number 2 and 3 would not run this initialization.
--- arch/mips/kernel/smp-bmips.c | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/kernel/smp-bmips.c +2 -0
@@ -241,6 +241,8 @@ static int bmips_boot_secondary(int cpu, struct task_struct *idle)*/ static void bmips_init_secondary (void ) { +bmips_cpu_setup (); +switch (current_cpu_type ()) {case CPU_BMIPS4350 :case CPU_BMIPS4380 :
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 31/129 mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040
In reply to Greg Kroah-HartmanFrom: Raul E Rangel <[email protected]>
[ Upstream commit 61d7437ed13906984c44697970ee792ac6271a31 ]
The AMD eMMC Controller can only use the tuned clock while in HS200 and HS400 mode. If we switch to a different mode, we need to disable the tuned clock. If we have previously performed tuning and switch back to HS200 or HS400, we can re-enable the tuned clock.
Previously the tuned clock was not getting disabled when switching to DDR52 which is part of the HS400 tuning sequence.
--- drivers/mmc/host/sdhci-acpi.c | 67 +++++++++++++++++++++++++++++------ 1 file changed, 57 insertions(+), 10 deletions(-)
drivers/mmc/host/sdhci-acpi.c +57 -10
@@ -532,6 +532,11 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_qcom_sd = { .caps = MMC_CAP_NONREMOVABLE, }; +struct amd_sdhci_host { +bool tuned_clock; +bool dll_enabled; +}; +/* AMD sdhci reset dll register. */ #define SDHCI_AMD_RESET_DLL_REGISTER 0x908
@@ -551,26 +556,66 @@ static void sdhci_acpi_amd_hs400_dll(struct sdhci_host *host) }/* -* For AMD Platform it is required to disable the tuning -* bit first controller to bring to HS Mode from HS200 -* mode, later enable to tune to HS400 mode. +* The initialization sequence for HS400 is: +* HS->HS200->Perform Tuning->HS->HS400 +* +* The re-tuning sequence is: +* HS400->DDR52->HS->HS200->Perform Tuning->HS->HS400 +* +* The AMD eMMC Controller can only use the tuned clock while in HS200 and HS400 +* mode. If we switch to a different mode, we need to disable the tuned clock. +* If we have previously performed tuning and switch back to HS200 or +* HS400, we can re-enable the tuned clock. +* */ static void amd_set_ios (struct mmc_host *mmc,struct mmc_ios *ios) {struct sdhci_host *host =mmc_priv (mmc); +struct sdhci_acpi_host *acpi_host =sdhci_priv (host); +struct amd_sdhci_host *amd_host =sdhci_acpi_priv (acpi_host);unsigned int old_timing = host->timing; +u16 val;sdhci_set_ios (mmc, ios); -if (old_timing ==MMC_TIMING_MMC_HS200 && - ios->timing ==MMC_TIMING_MMC_HS ) -sdhci_writew (host,0x9 ,SDHCI_HOST_CONTROL2 ); -if (old_timing !=MMC_TIMING_MMC_HS400 && - ios->timing ==MMC_TIMING_MMC_HS400 ) { -sdhci_writew (host,0x80 ,SDHCI_HOST_CONTROL2 ); -sdhci_acpi_amd_hs400_dll (host); + +if (old_timing != host->timing && amd_host->tuned_clock) { +if (host->timing ==MMC_TIMING_MMC_HS400 || + host->timing ==MMC_TIMING_MMC_HS200 ) { + val =sdhci_readw (host,SDHCI_HOST_CONTROL2 ); + val |=SDHCI_CTRL_TUNED_CLK ; +sdhci_writew (host, val,SDHCI_HOST_CONTROL2 ); + }else { + val =sdhci_readw (host,SDHCI_HOST_CONTROL2 ); + val &= ~SDHCI_CTRL_TUNED_CLK ; +sdhci_writew (host, val,SDHCI_HOST_CONTROL2 ); + } + +/* DLL is only required for HS400 */ +if (host->timing ==MMC_TIMING_MMC_HS400 && + !amd_host->dll_enabled) { +sdhci_acpi_amd_hs400_dll (host); + amd_host->dll_enabled = true; + } } } +static int amd_sdhci_execute_tuning (struct mmc_host *mmc,u32 opcode) +{ +int err; +struct sdhci_host *host =mmc_priv (mmc); +struct sdhci_acpi_host *acpi_host =sdhci_priv (host); +struct amd_sdhci_host *amd_host =sdhci_acpi_priv (acpi_host); + + amd_host->tuned_clock = false; + + err =sdhci_execute_tuning (mmc, opcode); + +if (!err && !host->tuning_err) + amd_host->tuned_clock = true; + +return err; +} +static const struct sdhci_ops sdhci_acpi_ops_amd = { .set_clock = sdhci_set_clock, .set_bus_width = sdhci_set_bus_width,
@@ -598,6 +643,7 @@ static int sdhci_acpi_emmc_amd_probe_slot(struct platform_device *pdev, host->mmc_host_ops.select_drive_strength = amd_select_drive_strength; host->mmc_host_ops.set_ios = amd_set_ios; + host->mmc_host_ops.execute_tuning = amd_sdhci_execute_tuning;return 0 ; }
@@ -609,6 +655,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_amd_emmc = { SDHCI_QUIRK_32BIT_ADMA_SIZE, .quirks2 = SDHCI_QUIRK2_BROKEN_64_BIT_DMA, .probe_slot = sdhci_acpi_emmc_amd_probe_slot, + .priv_size = sizeof(struct amd_sdhci_host), };struct sdhci_acpi_uid_slot {
Signature · 1 line
2.25.1
A message that is not in the archive (sent off-list or not yet received): CAHQZ30B5JzOwUhiyLsbbYpFJdWQeH6vR3Ze-Gtr5-BCnw1AVBw@mail.gmail.com
Greg Kroah-Hartman
maintainerRe: [PATCH 5.4 031/129] mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040
Quoted 6 lines · Raul Rangel
So this patch had a bug in it. It was fixed with
https://patchwork.kernel.org/patch/11747031/
Commitd9fcc7130245d79a75e3f0348d3ef7297055cfd4from
https://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc.gitShould we pull that in too, or is it fine to wait for the next merge?
It depends on wha tyou want to do. I can drop this now and add both later, or just be "bug compatible" with Linus's tree until this patch gets merged into it, and then I can take it.
Your call...
thanks,
greg k-h
Re: [PATCH 5.4 031/129] mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040
Quoted 9 lines
Quoted 2 lines
Should we pull that in too, or is it fine to wait for the next merge?
It depends on wha tyou want to do. I can drop this now and add both later, or just be "bug compatible" with Linus's tree until this patch gets merged into it, and then I can take it.
Your call...
The patch got pulled into a few branches, so not sure how easy it is to drop it from all of them. I guess let's just leave it and be "bug compatible".
Thanks,
Raul
Greg Kroah-Hartman
maintainerPATCH 32/129 netfilter: nf_tables: add NFTA_SET_USERDATA if not null
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 6f03bf43ee05b31d3822def2a80f11b3591c55b3 ]
Kernel sends an empty NFTA_SET_USERDATA attribute with no value if userspace adds a set with no NFTA_SET_USERDATA attribute.
--- net/netfilter/nf_tables_api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +2 -1
@@ -3353,7 +3353,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, goto nla_put_failure; } -if (nla_put (skb,NFTA_SET_USERDATA , set->udlen, set->udata)) +if (set->udata && +nla_put (skb,NFTA_SET_USERDATA , set->udlen, set->udata)) goto nla_put_failure; desc =nla_nest_start_noflag (skb,NFTA_SET_DESC );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 33/129 netfilter: nf_tables: incorrect enum nft_list_attributes definition
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit da9125df854ea48a6240c66e8a67be06e2c12c03 ]
This should be NFTA_LIST_UNSPEC instead of NFTA_LIST_UNPEC, all other similar attribute definitions are postfixed with _UNSPEC.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -132,7 +132,7 @@ enum nf_tables_msg_types {* @NFTA_LIST_ELEM: list element (NLA_NESTED) */ enum nft_list_attributes { -NFTA_LIST_UNPEC , +NFTA_LIST_UNSPEC ,NFTA_LIST_ELEM , __NFTA_LIST_MAX };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 34/129 netfilter: nf_tables: fix destination register zeroing
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 1e105e6afa6c3d32bfb52c00ffa393894a525c27 ]
Following bug was reported via irc:
nft list ruleset
set knock_candidates_ipv4 {
type ipv4_addr . inet_service
size 65535
elements = { 127.0.0.1 . 123,
127.0.0.1 . 123 }
} ..
udp dport 123 add @knock_candidates_ipv4 { ip saddr . 123 } udp dport 123 add @knock_candidates_ipv4 { ip saddr . udp dport }
It should not have been possible to add a duplicate set entry.
After some debugging it turned out that the problem is the immediate value (123) in the second-to-last rule.
Concatenations use 32bit registers, i.e. the elements are 8 bytes each, not 6 and it turns out the kernel inserted
inet firewall @knock_candidates_ipv4
element 0100007f ffff7b00 : 0 [end]
element 0100007f 00007b00 : 0 [end]Note the non-zero upper bits of the first element. It turns out that nft_immediate doesn't zero the destination register, but this is needed when the length isn't a multiple of 4.
Furthermore, the zeroing in nft_payload is broken. We can't use [len / 4] = 0 -- if len is a multiple of 4, index is off by one.
Skip zeroing in this case and use a conditional instead of (len -1) / 4.
--- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nft_payload.c | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-)
include/net/netfilter/nf_tables.h +2 -0
@@ -143,6 +143,8 @@ static inline u64 nft_reg_load64(u32 *sreg)static inline void nft_data_copy (u32 *dst,const struct nft_data *src,unsigned int len) { +if (len %NFT_REG32_SIZE ) + dst[len /NFT_REG32_SIZE ] =0 ;memcpy (dst, src, len); }
net/netfilter/nft_payload.c +3 -1
@@ -79,7 +79,9 @@ void nft_payload_eval(const struct nft_expr *expr,u32 *dest = ®s->data[priv->dreg];int offset; - dest[priv->len /NFT_REG32_SIZE ] =0 ; +if (priv->len %NFT_REG32_SIZE ) + dest[priv->len /NFT_REG32_SIZE ] =0 ; +switch (priv->base) {case NFT_PAYLOAD_LL_HEADER :if (!skb_mac_header_was_set (skb))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 35/129 net: hns: Fix memleak in hns_nic_dev_probe
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 100e3345c6e719d2291e1efd5de311cc24bb9c0b ]
hns_nic_dev_probe allocates ndev, but not free it on two error handling paths, which may lead to memleak.
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +6 -3
@@ -2296,8 +2296,10 @@ static int hns_nic_dev_probe(struct platform_device *pdev) priv->enet_ver =AE_VERSION_1 ; else if (acpi_dev_found(hns_enet_acpi_match[1].id)) priv->enet_ver = AE_VERSION_2; - else - return -ENXIO; + else { + ret = -ENXIO ; + goto out_read_prop_fail; + }/* try to find port-idx-in-ae first */ ret = acpi_node_get_property_reference(dev->fwnode,
@@ -2313,7 +2315,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev) priv->fwnode = args.fwnode; }else {dev_err (dev,"cannot read cfg data from OF or acpi\n" ); -return -ENXIO ; + ret = -ENXIO ; + goto out_read_prop_fail; } ret =device_property_read_u32 (dev,"port-idx-in-ae" , &port_id);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 36/129 net: systemport: Fix memleak in bcm_sysport_probe
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 7ef1fc57301f3cef7201497aa27e89ccb91737fe ]
When devm_kcalloc() fails, dev should be freed just like what we've done in the subsequent error paths.
--- drivers/net/ethernet/broadcom/bcmsysport.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bcmsysport.c +4 -2
@@ -2453,8 +2453,10 @@ static int bcm_sysport_probe(struct platform_device *pdev) priv->tx_rings =devm_kcalloc (&pdev->dev, txq,sizeof (struct bcm_sysport_tx_ring ),GFP_KERNEL ); -if (!priv->tx_rings) -return -ENOMEM ; +if (!priv->tx_rings) { + ret = -ENOMEM ; + goto err_free_netdev; + } priv->is_lite = params->is_lite; priv->num_rx_desc_words = params->num_rx_desc_words;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 37/129 ravb: Fixed to be able to unload modules
In reply to Greg Kroah-HartmanFrom: Yuusuke Ashizuka <[email protected]>
[ Upstream commit 1838d6c62f57836639bd3d83e7855e0ee4f6defc ]
When this driver is built as a module, I cannot rmmod it after insmoding it.
This is because that this driver calls ravb_mdio_init() at the time of probe, and module->refcnt is incremented by alloc_mdio_bitbang() called after that.
Therefore, even if ifup is not performed, the driver is in use and rmmod cannot be performed.
$ lsmod Module Size Used by ravb 40960 1 $ rmmod ravb rmmod: ERROR: Module ravb is in use
Call ravb_mdio_init() at open and free_mdio_bitbang() at close, thereby rmmod is possible in the ifdown state.
--- drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++++------------ 1 file changed, 55 insertions(+), 55 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +55 -55
@@ -1336,6 +1336,51 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler,return error; } +/* MDIO bus init function */ +static int ravb_mdio_init (struct ravb_private *priv) +{ +struct platform_device *pdev = priv->pdev; +struct device *dev = &pdev->dev; +int error; + +/* Bitbang init */ + priv->mdiobb.ops = &bb_ops; + +/* MII controller setting */ + priv->mii_bus =alloc_mdio_bitbang (&priv->mdiobb); +if (!priv->mii_bus) +return -ENOMEM ; + +/* Hook up MII support for ethtool */ + priv->mii_bus->name ="ravb_mii" ; + priv->mii_bus->parent = dev; +snprintf (priv->mii_bus->id,MII_BUS_ID_SIZE ,"%s-%x" , + pdev->name, pdev->id); + +/* Register MDIO bus */ + error =of_mdiobus_register (priv->mii_bus, dev->of_node); +if (error) + goto out_free_bus; + +return 0 ; + +out_free_bus: +free_mdio_bitbang (priv->mii_bus); +return error; +} + +/* MDIO bus release function */ +static int ravb_mdio_release (struct ravb_private *priv) +{ +/* Unregister mdio bus */ +mdiobus_unregister (priv->mii_bus); + +/* Free bitbang info */ +free_mdio_bitbang (priv->mii_bus); + +return 0 ; +} +/* Network device open function for Ethernet AVB */ static int ravb_open (struct net_device *ndev) {
@@ -1344,6 +1389,13 @@ static int ravb_open(struct net_device *ndev)struct device *dev = &pdev->dev;int error; +/* MDIO bus init */ + error =ravb_mdio_init (priv); +if (error) { +netdev_err (ndev,"failed to initialize MDIO\n" ); +return error; + } +napi_enable (&priv->napi[RAVB_BE ]);napi_enable (&priv->napi[RAVB_NC ]);
@@ -1421,6 +1473,7 @@ out_free_irq: out_napi_off:napi_disable (&priv->napi[RAVB_NC ]);napi_disable (&priv->napi[RAVB_BE ]); +ravb_mdio_release (priv);return error; }
@@ -1730,6 +1783,8 @@ static int ravb_close(struct net_device *ndev)ravb_ring_free (ndev,RAVB_BE );ravb_ring_free (ndev,RAVB_NC ); +ravb_mdio_release (priv); +return 0 ; }
@@ -1881,51 +1936,6 @@ static const struct net_device_ops ravb_netdev_ops = { .ndo_set_features = ravb_set_features, }; -/* MDIO bus init function */ -static int ravb_mdio_init (struct ravb_private *priv) -{ -struct platform_device *pdev = priv->pdev; -struct device *dev = &pdev->dev; -int error; - -/* Bitbang init */ - priv->mdiobb.ops = &bb_ops; - -/* MII controller setting */ - priv->mii_bus =alloc_mdio_bitbang (&priv->mdiobb); -if (!priv->mii_bus) -return -ENOMEM ; - -/* Hook up MII support for ethtool */ - priv->mii_bus->name ="ravb_mii" ; - priv->mii_bus->parent = dev; -snprintf (priv->mii_bus->id,MII_BUS_ID_SIZE ,"%s-%x" , - pdev->name, pdev->id); - -/* Register MDIO bus */ - error =of_mdiobus_register (priv->mii_bus, dev->of_node); -if (error) - goto out_free_bus; - -return 0 ; - -out_free_bus: -free_mdio_bitbang (priv->mii_bus); -return error; -} - -/* MDIO bus release function */ -static int ravb_mdio_release (struct ravb_private *priv) -{ -/* Unregister mdio bus */ -mdiobus_unregister (priv->mii_bus); - -/* Free bitbang info */ -free_mdio_bitbang (priv->mii_bus); - -return 0 ; -} -static const struct of_device_id ravb_match_table[] = { { .compatible ="renesas,etheravb-r8a7790" , .data = (void *)RCAR_GEN2 }, { .compatible ="renesas,etheravb-r8a7794" , .data = (void *)RCAR_GEN2 },
@@ -2166,13 +2176,6 @@ static int ravb_probe(struct platform_device *pdev)eth_hw_addr_random (ndev); } -/* MDIO bus init */ - error =ravb_mdio_init (priv); -if (error) { -dev_err (&pdev->dev,"failed to initialize MDIO\n" ); - goto out_dma_free; - } -netif_napi_add (ndev, &priv->napi[RAVB_BE ], ravb_poll,64 );netif_napi_add (ndev, &priv->napi[RAVB_NC ], ravb_poll,64 );
@@ -2194,8 +2197,6 @@ static int ravb_probe(struct platform_device *pdev) out_napi_del:netif_napi_del (&priv->napi[RAVB_NC ]);netif_napi_del (&priv->napi[RAVB_BE ]); -ravb_mdio_release (priv); -out_dma_free:dma_free_coherent (ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, priv->desc_bat_dma);
@@ -2227,7 +2228,6 @@ static int ravb_remove(struct platform_device *pdev)unregister_netdev (ndev);netif_napi_del (&priv->napi[RAVB_NC ]);netif_napi_del (&priv->napi[RAVB_BE ]); -ravb_mdio_release (priv);pm_runtime_disable (&pdev->dev);free_netdev (ndev);platform_set_drvdata (pdev,NULL );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 38/129 net: arc_emac: Fix memleak in arc_mdio_probe
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit e2d79cd8875fa8c3cc7defa98a8cc99a1ed0c62f ]
When devm_gpiod_get_optional() fails, bus should be freed just like when of_mdiobus_register() fails.
--- drivers/net/ethernet/arc/emac_mdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/arc/emac_mdio.c +1 -0
@@ -153,6 +153,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv)if (IS_ERR (data->reset_gpio)) { error =PTR_ERR (data->reset_gpio);dev_err (priv->dev,"Failed to request gpio: %d\n" , error); +mdiobus_free (bus);return error; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 39/129 dmaengine: pl330: Fix burst length if burst size is smaller than bus width
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit 0661cef675d37e2c4b66a996389ebeae8568e49e ]
Move the burst len fixup after setting the generic value for it. This finally enables the fixup introduced by commit 137bd11090d8 ("dmaengine:
pl330: Align DMA memcpy operations to MFIFO width"), which otherwise was overwritten by the generic value.
--- drivers/dma/pl330.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/pl330.c +1 -1
@@ -2788,6 +2788,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,while (burst != (1 << desc->rqcfg.brst_size)) desc->rqcfg.brst_size++; + desc->rqcfg.brst_len =get_burst_len (desc, len);/* * If burst size is smaller than bus width then make sure we only * transfer one at a time to avoid a burst stradling an MFIFO entry.
@@ -2795,7 +2796,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,if (desc->rqcfg.brst_size *8 < pl330->pcfg.data_bus_width) desc->rqcfg.brst_len =1 ; - desc->rqcfg.brst_len =get_burst_len (desc, len); desc->bytes_requested = len; desc->txd.flags = flags;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 40/129 gtp: add GTPA_LINK info to msg sent to userspace
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
[ Upstream commit b274e47d9e3f4dcd4ad4028a316ec22dc4533ac7 ]
During a dump, this attribute is essential, it enables the userspace to know on which interface the context is linked to.
--- drivers/net/gtp.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/gtp.c +1 -0
@@ -1182,6 +1182,7 @@ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, goto nlmsg_failure;if (nla_put_u32 (skb,GTPA_VERSION , pctx->gtp_version) || +nla_put_u32 (skb,GTPA_LINK , pctx->dev->ifindex) ||nla_put_be32 (skb,GTPA_PEER_ADDRESS , pctx->peer_addr_ip4.s_addr) ||nla_put_be32 (skb,GTPA_MS_ADDRESS , pctx->ms_addr_ip4.s_addr)) goto nla_put_failure;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 41/129 net: ethernet: ti: cpsw: fix clean up of vlan mc entries for host port
In reply to Greg Kroah-HartmanFrom: Murali Karicheri <[email protected]>
[ Upstream commit 99d469fc64d06f0c81c0fe2a1c01645a67e0cbf0 ]
To flush the vid + mc entries from ALE, which is required when a VLAN interface is removed, driver needs to call cpsw_ale_flush_multicast() with ALE_PORT_HOST for port mask as these entries are added only for host port. Without this, these entries remain in the ALE table even after removing the VLAN interface. cpsw_ale_flush_multicast() calls cpsw_ale_flush_mcast which expects a port mask to do the job.
--- drivers/net/ethernet/ti/cpsw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/ti/cpsw.c +1 -1
@@ -2209,7 +2209,7 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev, HOST_PORT_NUM, ALE_VLAN, vid); ret |=cpsw_ale_del_mcast (cpsw->ale, priv->ndev->broadcast,0 ,ALE_VLAN , vid); - ret |=cpsw_ale_flush_multicast (cpsw->ale,0 , vid); + ret |=cpsw_ale_flush_multicast (cpsw->ale,ALE_PORT_HOST , vid); err:pm_runtime_put (cpsw->dev);return ret;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 42/129 bnxt_en: Dont query FW when netif_running() is false.
In reply to Greg Kroah-HartmanFrom: Pavan Chebbi <[email protected]>
[ Upstream commit c1c2d77408022a398a1a7c51cf20488c922629de ]
In rare conditions like two stage OS installation, the ethtool's get_channels function may be called when the device is in D3 state, leading to uncorrectable PCI error. Check netif_running() first before making any query to FW which involves writing to BAR.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +1 -1
@@ -769,7 +769,7 @@ static void bnxt_get_channels(struct net_device *dev,int max_tx_sch_inputs;/* Get the most up-to-date max_tx_sch_inputs. */ -if (BNXT_NEW_RM (bp)) +if (netif_running (dev) &&BNXT_NEW_RM (bp))bnxt_hwrm_func_resc_qcaps (bp, false); max_tx_sch_inputs = hw_resc->max_tx_sch_inputs;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 43/129 bnxt_en: Check for zero dir entries in NVRAM.
In reply to Greg Kroah-HartmanFrom: Vasundhara Volam <[email protected]>
[ Upstream commit dbbfa96ad920c50d58bcaefa57f5f33ceef9d00e ]
If firmware goes into unstable state, HWRM_NVM_GET_DIR_INFO firmware command may return zero dir entries. Return error in such case to avoid zero length dma buffer request.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +3 -0
@@ -2161,6 +2161,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data)if (rc !=0 )return rc; +if (!dir_entries || !entry_length) +return -EIO ; +/* Insert 2 bytes of directory info (count and size of entries) */ if (len <2 )return -EINVAL ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 44/129 bnxt_en: Fix PCI AER error recovery flow
In reply to Greg Kroah-HartmanFrom: Vasundhara Volam <[email protected]>
[ Upstream commit df3875ec550396974b1d8a518bd120d034738236 ]
When a PCI error is detected the PCI state could be corrupt, save the PCI state after initialization and restore it after the slot reset.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +3 -0
@@ -11900,6 +11900,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) (long)pci_resource_start(pdev, 0), dev->dev_addr);pcie_print_link_status (pdev); +pci_save_state (pdev);return 0 ; init_err_cleanup:
@@ -12066,6 +12067,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) "Cannot re-enable PCI device after reset.\n"); }else {pci_set_master (pdev); +pci_restore_state (pdev); +pci_save_state (pdev); err =bnxt_hwrm_func_reset (bp);if (!err &&netif_running (netdev))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 45/129 bnxt_en: Fix possible crash in bnxt_fw_reset_task().
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit b148bb238c02f0c7797efed026e9bba5892d2172 ]
bnxt_fw_reset_task() is run from a delayed workqueue. The current code is not cancelling the workqueue in the driver's .remove() method and it can potentially crash if the device is removed with the workqueue still pending.
The fix is to clear the BNXT_STATE_IN_FW_RESET flag and then cancel the delayed workqueue in bnxt_remove_one(). bnxt_queue_fw_reset_work() also needs to check that this flag is set before scheduling. This will guarantee that no rescheduling will be done after it is cancelled.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +8 -2
@@ -1143,6 +1143,9 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,static void bnxt_queue_fw_reset_work (struct bnxt *bp,unsigned long delay) { +if (!(test_bit (BNXT_STATE_IN_FW_RESET , &bp->state))) +return ; +if (BNXT_PF (bp))queue_delayed_work (bnxt_pf_wq, &bp->fw_reset_task, delay);else
@@ -1159,10 +1162,12 @@ static void bnxt_queue_sp_work(struct bnxt *bp)static void bnxt_cancel_sp_work (struct bnxt *bp) { -if (BNXT_PF (bp)) +if (BNXT_PF (bp)) {flush_workqueue (bnxt_pf_wq); -else + }else {cancel_work_sync (&bp->sp_task); +cancel_delayed_work_sync (&bp->fw_reset_task); + } }static void bnxt_sched_reset (struct bnxt *bp,struct bnxt_rx_ring_info *rxr)
@@ -11386,6 +11391,7 @@ static void bnxt_remove_one(struct pci_dev *pdev)unregister_netdev (dev);bnxt_dl_unregister (bp);bnxt_shutdown_tc (bp); +clear_bit (BNXT_STATE_IN_FW_RESET , &bp->state);bnxt_cancel_sp_work (bp); bp->sp_event =0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 46/129 bnxt_en: fix HWRM error when querying VF temperature
In reply to Greg Kroah-HartmanFrom: Edwin Peer <[email protected]>
[ Upstream commit 12cce90b934bf2b0ed9c339b4d5503e69954351a ]
Firmware returns RESOURCE_ACCESS_DENIED for HWRM_TEMP_MONITORY_QUERY for VFs. This produces unpleasing error messages in the log when temp1_input is queried via the hwmon sysfs interface from a VF.
The error is harmless and expected, so silence it and return unknown as the value. Since the device temperature is not particularly sensitive information, provide flexibility to change this policy in future by silencing the error rather than avoiding the HWRM call entirely for VFs.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +7 -4
@@ -8938,16 +8938,19 @@ static ssize_t bnxt_show_temp(struct device *dev,struct hwrm_temp_monitor_query_input req = {0 };struct hwrm_temp_monitor_query_output *resp;struct bnxt *bp =dev_get_drvdata (dev); -u32 temp =0 ; +u32 len =0 ; resp = bp->hwrm_cmd_resp_addr;bnxt_hwrm_cmd_hdr_init (bp, &req,HWRM_TEMP_MONITOR_QUERY ,-1 ,-1 );mutex_lock (&bp->hwrm_cmd_lock); -if (!_hwrm_send_message (bp, &req,sizeof (req),HWRM_CMD_TIMEOUT )) - temp = resp->temp *1000 ;/* display millidegree */ +if (!_hwrm_send_message_silent (bp, &req,sizeof (req),HWRM_CMD_TIMEOUT )) + len =sprintf (buf,"%u\n" , resp->temp *1000 );/* display millidegree */ mutex_unlock (&bp->hwrm_cmd_lock); -return sprintf (buf,"%u\n" , temp); +if (len) +return len; + +return sprintf (buf,"unknown\n" ); } static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 47/129 xfs: fix boundary test in xfs_attr_shortform_verify
In reply to Greg Kroah-HartmanFrom: Eric Sandeen <[email protected]>
[ Upstream commit f4020438fab05364018c91f7e02ebdd192085933 ]
The boundary test for the fixed-offset parts of xfs_attr_sf_entry in xfs_attr_shortform_verify is off by one, because the variable array at the end is defined as nameval[1] not nameval[].
Hence we need to subtract 1 from the calculation.
This can be shown by:
# touch file # setfattr -n root.a file
and verifications will fail when it's written to disk.
This only matters for a last attribute which has a single-byte name and no value, otherwise the combination of namelen & valuelen will push endp further out and this test won't fail.
--- fs/xfs/libxfs/xfs_attr_leaf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/xfs/libxfs/xfs_attr_leaf.c +3 -1
@@ -946,8 +946,10 @@ xfs_attr_shortform_verify(* struct xfs_attr_sf_entry has a variable length. * Check the fixed-offset parts of the structure are * within the data buffer. +* xfs_attr_sf_entry is defined with a 1-byte variable +* array at the end, so we must subtract that off. */ -if (((char *)sfep +sizeof (*sfep)) >= endp) +if (((char *)sfep +sizeof (*sfep) -1 ) >= endp)return __this_address;/* Don't allow names with known bad length. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 48/129 bnxt: dont enable NAPI until rings are ready
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 96ecdcc992eb7f468b2cf829b0f5408a1fad4668 ]
Netpoll can try to poll napi as soon as napi_enable() is called. It crashes trying to access a doorbell which is still NULL:
BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 59 PID: 6039 Comm: ethtool Kdump: loaded Tainted: G S 5.9.0-rc1-00469-g5fd99b5d9950-dirty #26 RIP: 0010:bnxt_poll+0x121/0x1c0 Code: c4 20 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 41 8b 86 a0 01 00 00 41 23 85 18 01 00 00 49 8b 96 a8 01 00 00 0d 00 00 00 24 <89> 02 41 f6 45 77 02 74 cb 49 8b ae d8 01 00 00 31 c0 c7 44 24 1a netpoll_poll_dev+0xbd/0x1a0 __netpoll_send_skb+0x1b2/0x210 netpoll_send_udp+0x2c9/0x406 write_ext_msg+0x1d7/0x1f0 console_unlock+0x23c/0x520 vprintk_emit+0xe0/0x1d0 printk+0x58/0x6f x86_vector_activate.cold+0xf/0x46 __irq_domain_activate_irq+0x50/0x80 __irq_domain_activate_irq+0x32/0x80 __irq_domain_activate_irq+0x32/0x80 irq_domain_activate_irq+0x25/0x40 __setup_irq+0x2d2/0x700 request_threaded_irq+0xfb/0x160 __bnxt_open_nic+0x3b1/0x750 bnxt_open_nic+0x19/0x30 ethtool_set_channels+0x1ac/0x220 dev_ethtool+0x11ba/0x2240 dev_ioctl+0x1cf/0x390 sock_do_ioctl+0x95/0x130
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +4 -8
@@ -9132,15 +9132,15 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) } } -bnxt_enable_napi (bp); -bnxt_debug_dev_init (bp); - rc =bnxt_init_nic (bp, irq_re_init);if (rc) {netdev_err (bp->dev,"bnxt_init_nic err: %x\n" , rc); - goto open_err; + goto open_err_irq; } +bnxt_enable_napi (bp); +bnxt_debug_dev_init (bp); +if (link_re_init) {mutex_lock (&bp->link_lock); rc =bnxt_update_phy_setting (bp);
@@ -9171,10 +9171,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)bnxt_vf_reps_open (bp);return 0 ; -open_err: -bnxt_debug_dev_exit (bp); -bnxt_disable_napi (bp); - open_err_irq:bnxt_del_napi (bp);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 49/129 media: vicodec: add missing v4l2_ctrl_request_hdl_put()
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 2e7c8fb8942773f412fe12f3b63e8bb92c18ab3f ]
The check for a required control in the request was missing a call to v4l2_ctrl_request_hdl_put(), so the control request object was never released.
--- drivers/media/platform/vicodec/vicodec-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/vicodec/vicodec-core.c +1 -0
@@ -2052,6 +2052,7 @@ static int vicodec_request_validate(struct media_request *req) } ctrl =v4l2_ctrl_request_hdl_ctrl_find (hdl, vicodec_ctrl_stateless_state.id); +v4l2_ctrl_request_hdl_put (hdl);if (!ctrl) {v4l2_info (&ctx->dev->v4l2_dev,"Missing required codec control\n" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 50/129 media: cedrus: Add missing v4l2_ctrl_request_hdl_put()
In reply to Greg Kroah-HartmanFrom: Ezequiel Garcia <[email protected]>
[ Upstream commit b30063976f29fc221a99d18d37d22ca035068aa9 ]
The check for a required control in the request was missing a call to v4l2_ctrl_request_hdl_put() in the error path. Fix it.
--- drivers/staging/media/sunxi/cedrus/cedrus.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/staging/media/sunxi/cedrus/cedrus.c +6 -1
@@ -159,6 +159,7 @@ static int cedrus_request_validate(struct media_request *req)struct v4l2_ctrl *ctrl_test;unsigned int count;unsigned int i; +int ret =0 ;list_for_each_entry (obj, &req->objects, list) {struct vb2_buffer *vb;
@@ -203,12 +204,16 @@ static int cedrus_request_validate(struct media_request *req)if (!ctrl_test) {v4l2_info (&ctx->dev->v4l2_dev,"Missing required codec control\n" ); -return -ENOENT ; + ret = -ENOENT ; +break ; } }v4l2_ctrl_request_hdl_put (hdl); +if (ret) +return ret; +return vb2_request_validate (req); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 51/129 selftests/bpf: Fix massive output from test_maps
In reply to Greg Kroah-HartmanFrom: Jesper Dangaard Brouer <[email protected]>
[ Upstream commit fa4505675e093e895b7ec49a76d44f6b5ad9602e ]
When stdout output from the selftests tool 'test_maps' gets redirected into e.g file or pipe, then the output lines increase a lot (from 21 to 33949 lines). This is caused by the printf that happens before the fork() call, and there are user-space buffered printf data that seems to be duplicated into the forked process.
To fix this fflush() stdout before the fork loop in __run_parallel().
--- tools/testing/selftests/bpf/test_maps.c | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/bpf/test_maps.c +2 -0
@@ -1282,6 +1282,8 @@ static void __run_parallel(unsigned int tasks,pid_t pid[tasks];int i; +fflush (stdout); +for (i =0 ; i < tasks; i++) { pid[i] =fork ();if (pid[i] ==0 ) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 52/129 net: dsa: mt7530: fix advertising unsupported 1000baseT_Half
In reply to Greg Kroah-HartmanFrom: Landen Chao <[email protected]>
[ Upstream commit f272285f6abb9178d029375599626baf3d5f4e8a ]
Remove 1000baseT_Half to advertise correct hardware capability in phylink_validate() callback function.
--- drivers/net/dsa/mt7530.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mt7530.c +1 -1
@@ -1456,7 +1456,7 @@ unsupported: phylink_set(mask, 100baseT_Full);if (state->interface !=PHY_INTERFACE_MODE_MII ) { - phylink_set(mask, 1000baseT_Half); +/* This switch only supports 1G full-duplex. */ phylink_set(mask, 1000baseT_Full);if (port ==5 ) phylink_set(mask, 1000baseX_Full);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 53/129 netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit ee921183557af39c1a0475f982d43b0fcac25e2e ]
Frontend callback reports EAGAIN to nfnetlink to retry a command, this is used to signal that module autoloading is required. Unfortunately, nlmsg_unicast() reports EAGAIN in case the receiver socket buffer gets full, so it enters a busy-loop.
This patch updates nfnetlink_unicast() to turn EAGAIN into ENOBUFS and to use nlmsg_unicast(). Remove the flags field in nfnetlink_unicast() since this is always MSG_DONTWAIT in the existing code which is exactly what nlmsg_unicast() passes to netlink_unicast() as parameter.
--- include/linux/netfilter/nfnetlink.h | 3 +- net/netfilter/nf_tables_api.c | 61 ++++++++++++++--------------- net/netfilter/nfnetlink.c | 11 ++++-- net/netfilter/nfnetlink_log.c | 3 +- net/netfilter/nfnetlink_queue.c | 2 +- 5 files changed, 40 insertions(+), 40 deletions(-)
include/linux/netfilter/nfnetlink.h +1 -2
@@ -43,8 +43,7 @@ int nfnetlink_has_listeners(struct net *net, unsigned int group);int nfnetlink_send (struct sk_buff *skb,struct net *net,u32 portid,unsigned int group,int echo,gfp_t flags);int nfnetlink_set_err (struct net *net,u32 portid,u32 group,int error); -int nfnetlink_unicast (struct sk_buff *skb,struct net *net,u32 portid, -int flags); +int nfnetlink_unicast (struct sk_buff *skb,struct net *net,u32 portid);static inline u16 nfnl_msg_type (u8 subsys,u8 msg_type) {
net/netfilter/nf_tables_api.c +29 -32
127 lines not on this page · raw message
net/netfilter/nfnetlink.c +8 -3
@@ -148,10 +148,15 @@ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error) }EXPORT_SYMBOL_GPL (nfnetlink_set_err); -int nfnetlink_unicast (struct sk_buff *skb,struct net *net,u32 portid, -int flags) +int nfnetlink_unicast (struct sk_buff *skb,struct net *net,u32 portid) { -return netlink_unicast (net->nfnl, skb, portid, flags); +int err; + + err =nlmsg_unicast (net->nfnl, skb, portid); +if (err == -EAGAIN ) + err = -ENOBUFS ; + +return err; }EXPORT_SYMBOL_GPL (nfnetlink_unicast);
net/netfilter/nfnetlink_log.c +1 -2
@@ -356,8 +356,7 @@ __nfulnl_send(struct nfulnl_instance *inst) goto out; } } -nfnetlink_unicast (inst->skb, inst->net, inst->peer_portid, -MSG_DONTWAIT ); +nfnetlink_unicast (inst->skb, inst->net, inst->peer_portid); out: inst->qlen =0 ; inst->skb =NULL ;
net/netfilter/nfnetlink_queue.c +1 -1
@@ -681,7 +681,7 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue, *packet_id_ptr =htonl (entry->id);/* nfnetlink_unicast will either free the nskb or add it to a socket */ - err =nfnetlink_unicast (nskb, net, queue->peer_portid,MSG_DONTWAIT ); + err =nfnetlink_unicast (nskb, net, queue->peer_portid);if (err <0 ) {if (queue->flags &NFQA_CFG_F_FAIL_OPEN ) { failopen =1 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 54/129 nvmet-fc: Fix a missed _irqsave version of spin_lock in nvmet_fc_fod_op_done()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 70e37988db94aba607d5491a94f80ba08e399b6b ]
The way 'spin_lock()' and 'spin_lock_irqsave()' are used is not consistent in this function.
Use 'spin_lock_irqsave()' also here, as there is no guarantee that interruptions are disabled at that point, according to surrounding code.
--- drivers/nvme/target/fc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/target/fc.c +2 -2
@@ -1994,9 +1994,9 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod)return ;if (fcpreq->fcp_error || fcpreq->transferred_length != fcpreq->transfer_length) { -spin_lock (&fod->flock); +spin_lock_irqsave (&fod->flock, flags); fod->abort = true; -spin_unlock (&fod->flock); +spin_unlock_irqrestore (&fod->flock, flags);nvmet_req_complete (&fod->req,NVME_SC_INTERNAL );return ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 55/129 nvme: fix controller instance leak
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 192f6c29bb28bfd0a17e6ad331d09f1ec84143d0 ]
If the driver has to unbind from the controller for an early failure before the subsystem has been set up, there won't be a subsystem holding the controller's instance, so the controller needs to free its own instance in this case.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -4012,7 +4012,7 @@ static void nvme_free_ctrl(struct device *dev) container_of(dev, struct nvme_ctrl, ctrl_device);struct nvme_subsystem *subsys = ctrl->subsys; -if (subsys && ctrl->instance != subsys->instance) +if (!subsys || ctrl->instance != subsys->instance)ida_simple_remove (&nvme_instance_ida, ctrl->instance);kfree (ctrl->effects);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 56/129 cxgb4: fix thermal zone device registration
In reply to Greg Kroah-HartmanFrom: Potnuri Bharat Teja <[email protected]>
[ Upstream commit 6b6382a857d824c0866056d5736bbcb597a922ed ]
When multiple adapters are present in the system, pci hot-removing second adapter leads to the following warning as both the adapters registered thermal zone device with same thermal zone name/type. Therefore, use unique thermal zone name during thermal zone device initialization. Also mark thermal zone dev NULL once unregistered.
[ 414.370143] ------------[ cut here ]------------ [ 414.370944] sysfs group 'power' not found for kobject 'hwmon0' [ 414.371747] WARNING: CPU: 9 PID: 2661 at fs/sysfs/group.c:281 sysfs_remove_group+0x76/0x80 [ 414.382550] CPU: 9 PID: 2661 Comm: bash Not tainted 5.8.0-rc6+ #33 [ 414.383593] Hardware name: Supermicro X10SRA-F/X10SRA-F, BIOS 2.0a 06/23/2016 [ 414.384669] RIP: 0010:sysfs_remove_group+0x76/0x80 [ 414.385738] Code: 48 89 df 5b 5d 41 5c e9 d8 b5 ff ff 48 89 df e8 60 b0 ff ff eb cb 49 8b 14 24 48 8b 75 00 48 c7 c7 90 ae 13 bb e8 6a 27 d0 ff <0f> 0b 5b 5d 41 5c c3 0f 1f 00 0f 1f 44 00 00 48 85 f6 74 31 41 54 [ 414.388404] RSP: 0018:ffffa22bc080fcb0 EFLAGS: 00010286 [ 414.389638] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 414.390829] RDX: 0000000000000001 RSI: ffff8ee2de3e9510 RDI: ffff8ee2de3e9510 [ 414.392064] RBP: ffffffffbaef2ee0 R08: 0000000000000000 R09: 0000000000000000 [ 414.393224] R10: 0000000000000000 R11: 000000002b30006c R12: ffff8ee260720008 [ 414.394388] R13: ffff8ee25e0a40e8 R14: ffffa22bc080ff08 R15: ffff8ee2c3be5020 [ 414.395661] FS: 00007fd2a7171740(0000) GS:ffff8ee2de200000(0000) knlGS:0000000000000000 [ 414.396825] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 414.398011] CR2: 00007f178ffe5020 CR3: 000000084c5cc003 CR4: 00000000003606e0 [ 414.399172] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 414.400352] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 414.401473] Call Trace: [ 414.402685] device_del+0x89/0x400 [ 414.403819] device_unregister+0x16/0x60 [ 414.405024] hwmon_device_unregister+0x44/0xa0 [ 414.406112] thermal_remove_hwmon_sysfs+0x196/0x200 [ 414.407256] thermal_zone_device_unregister+0x1b5/0x1f0 [ 414.408415] cxgb4_thermal_remove+0x3c/0x4f [cxgb4] [ 414.409668] remove_one+0x212/0x290 [cxgb4] [ 414.410875] pci_device_remove+0x36/0xb0 [ 414.412004] device_release_driver_internal+0xe2/0x1c0 [ 414.413276] pci_stop_bus_device+0x64/0x90 [ 414.414433] pci_stop_and_remove_bus_device_locked+0x16/0x30 [ 414.415609] remove_store+0x75/0x90 [ 414.416790] kernfs_fop_write+0x114/0x1b0 [ 414.417930] vfs_write+0xcf/0x210 [ 414.419059] ksys_write+0xa7/0xe0 [ 414.420120] do_syscall_64+0x4c/0xa0 [ 414.421278] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 414.422335] RIP: 0033:0x7fd2a686afd0 [ 414.423396] Code: Bad RIP value. [ 414.424549] RSP: 002b:00007fffc1446148 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 414.425638] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd2a686afd0 [ 414.426830] RDX: 0000000000000002 RSI: 00007fd2a7196000 RDI: 0000000000000001 [ 414.427927] RBP: 00007fd2a7196000 R08: 000000000000000a R09: 00007fd2a7171740 [ 414.428923] R10: 00007fd2a7171740 R11: 0000000000000246 R12: 00007fd2a6b43400 [ 414.430082] R13: 0000000000000002 R14: 0000000000000001 R15: 0000000000000000 [ 414.431027] irq event stamp: 76300 [ 414.435678] ---[ end trace 13865acb4d5ab00f ]---
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c +6 -2
@@ -62,6 +62,7 @@ static struct thermal_zone_device_ops cxgb4_thermal_ops = {int cxgb4_thermal_init (struct adapter *adap) {struct ch_thermal *ch_thermal = &adap->ch_thermal; +char ch_tz_name[THERMAL_NAME_LENGTH ];int num_trip =CXGB4_NUM_TRIPS ;u32 param, val;int ret;
@@ -82,7 +83,8 @@ int cxgb4_thermal_init(struct adapter *adap) ch_thermal->trip_type =THERMAL_TRIP_CRITICAL ; } - ch_thermal->tzdev =thermal_zone_device_register ("cxgb4" , num_trip, +snprintf (ch_tz_name,sizeof (ch_tz_name),"cxgb4_%s" , adap->name); + ch_thermal->tzdev =thermal_zone_device_register (ch_tz_name, num_trip,0 , adap, &cxgb4_thermal_ops,NULL ,0 ,0 );
@@ -97,7 +99,9 @@ int cxgb4_thermal_init(struct adapter *adap)int cxgb4_thermal_remove (struct adapter *adap) { -if (adap->ch_thermal.tzdev) +if (adap->ch_thermal.tzdev) {thermal_zone_device_unregister (adap->ch_thermal.tzdev); + adap->ch_thermal.tzdev =NULL ; + }return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 57/129 perf tools: Correct SNOOPX field offset
In reply to Greg Kroah-HartmanFrom: Al Grant <[email protected]>
[ Upstream commit 39c0a53b114d0317e5c4e76b631f41d133af5cb0 ]
perf_event.h has macros that define the field offsets in the data_src bitmask in perf records. The SNOOPX and REMOTE offsets were both 37.
These are distinct fields, and the bitfield layout in perf_mem_data_src confirms that SNOOPX should be at offset 38.
Committer notes:
This was extracted from a larger patch that also contained kernel changes.
--- tools/include/uapi/linux/perf_event.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/include/uapi/linux/perf_event.h +1 -1
@@ -1131,7 +1131,7 @@ union perf_mem_data_src {#define PERF_MEM_SNOOPX_FWD 0x01/* forward */ /* 1 free */ -#define PERF_MEM_SNOOPX_SHIFT 37 +#define PERF_MEM_SNOOPX_SHIFT 38/* locked instruction */ #define PERF_MEM_LOCK_NA 0x01/* not available */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 58/129 net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
In reply to Greg Kroah-HartmanFrom: Shung-Hsi Yu <[email protected]>
[ Upstream commit cbedcb044e9cc4e14bbe6658111224bb923094f4 ]
On machines with much memory (> 2 TByte) and log_mtts_per_seg == 0, a max_order of 31 will be passed to mlx_buddy_init(), which results in s = BITS_TO_LONGS(1 << 31) becoming a negative value, leading to kvmalloc_array() failure when it is converted to size_t.
mlx4_core 0000:b1:00.0: Failed to initialize memory region table, aborting
mlx4_core: probe of 0000:b1:00.0 failed with error -12
Fix this issue by changing the left shifting operand from a signed literal to an unsigned one.
--- drivers/net/ethernet/mellanox/mlx4/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/mr.c +1 -1
@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order) goto err_out;for (i =0 ; i <= buddy->max_order; ++i) { - s =BITS_TO_LONGS (1 << (buddy->max_order - i)); + s =BITS_TO_LONGS (1UL << (buddy->max_order - i)); buddy->bits[i] =kvmalloc_array (s,sizeof (long ),GFP_KERNEL | __GFP_ZERO);if (!buddy->bits[i]) goto err_out_free;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 59/129 fix regression in "epoll: Keep a reference on files added to the check list"
In reply to Greg Kroah-HartmanFrom: Al Viro <[email protected]>
[ Upstream commit 77f4689de17c0887775bb77896f4cc11a39bf848 ]
epoll_loop_check_proc() can run into a file already committed to destruction; we can't grab a reference on those and don't need to add them to the set for reverse path check anyway.
--- fs/eventpoll.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/eventpoll.c +3 -3
@@ -1992,9 +1992,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)* during ep_insert(). */ if (list_empty (&epi->ffd.file->f_tfile_llink)) { -get_file (epi->ffd.file); -list_add (&epi->ffd.file->f_tfile_llink, - &tfile_check_list); +if (get_file_rcu (epi->ffd.file)) +list_add (&epi->ffd.file->f_tfile_llink, + &tfile_check_list); } } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 60/129 net: gemini: Fix another missing clk_disable_unprepare() in probe
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit eb0f3bc463d59d86402f19c59aa44e82dc3fab6d ]
We recently added some calls to clk_disable_unprepare() but we missed the last error path if register_netdev() fails.
I made a couple cleanups so we avoid mistakes like this in the future. First I reversed the "if (!ret)" condition and pulled the code in one indent level. Also, the "port->netdev = NULL;" is not required because "port" isn't used again outside this function so I deleted that line.
--- drivers/net/ethernet/cortina/gemini.c | 34 +++++++++++++-------------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/net/ethernet/cortina/gemini.c +17 -17
@@ -2445,8 +2445,8 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) port->reset =devm_reset_control_get_exclusive (dev,NULL );if (IS_ERR (port->reset)) {dev_err (dev,"no reset\n" ); -clk_disable_unprepare (port->pclk); -return PTR_ERR (port->reset); + ret =PTR_ERR (port->reset); + goto unprepare; }reset_control_reset (port->reset);usleep_range (100 ,500 );
@@ -2501,25 +2501,25 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)IRQF_SHARED , port_names[port->id], port); -if (ret) { -clk_disable_unprepare (port->pclk); -return ret; - } +if (ret) + goto unprepare; ret =register_netdev (netdev); -if (!ret) { +if (ret) + goto unprepare; + +netdev_info (netdev, +"irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n" , + port->irq, &dmares->start, + &gmacres->start); + ret =gmac_setup_phy (netdev); +if (ret)netdev_info (netdev, -"irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n" , - port->irq, &dmares->start, - &gmacres->start); - ret =gmac_setup_phy (netdev); -if (ret) -netdev_info (netdev, -"PHY init failed, deferring to ifup time\n" ); -return 0 ; - } +"PHY init failed, deferring to ifup time\n" ); +return 0 ; - port->netdev =NULL ; +unprepare: +clk_disable_unprepare (port->pclk);return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 61/129 drm/radeon: Prefer lower feedback dividers
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit fc8c70526bd30733ea8667adb8b8ffebea30a8ed ]
Commit 2e26ccb119bd ("drm/radeon: prefer lower reference dividers") fixed screen flicker for HP Compaq nx9420 but breaks other laptops like Asus X50SL.
Turns out we also need to favor lower feedback dividers.
Users confirmed this change fixes the regression and doesn't regress the original fix.
--- drivers/gpu/drm/radeon/radeon_display.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_display.c +1 -1
@@ -932,7 +932,7 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,/* get matching reference and feedback divider */ *ref_div =min (max (den/post_div,1u ), ref_div_max); - *fb_div =DIV_ROUND_CLOSEST (nom * *ref_div * post_div, den); + *fb_div =max (nom * *ref_div * post_div / den,1u );/* limit fb divider to its maximum */ if (*fb_div > fb_div_max) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 62/129 MIPS: add missing MSACSR and upper MSA initialization
In reply to Greg Kroah-HartmanFrom: Huang Pei <[email protected]>
[ Upstream commit bb06748207cfb1502d11b90325eba7f8c44c9f02 ]
In cc97ab235f3f ("MIPS: Simplify FP context initialization), init_fp_ctx just initialize the fp/msa context, and own_fp_inatomic just restore FCSR and 64bit FP regs from it, but miss MSACSR and upper MSA regs for MSA, so MSACSR and MSA upper regs's value from previous task on current cpu can leak into current task and cause unpredictable behavior when MSA context not initialized.
--- arch/mips/kernel/traps.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/mips/kernel/traps.c +12 -0
@@ -1240,6 +1240,18 @@ static int enable_restore_fp_context(int msa) err =own_fpu_inatomic (1 );if (msa && !err) {enable_msa (); +/* +* with MSA enabled, userspace can see MSACSR +* and MSA regs, but the values in them are from +* other task before current task, restore them +* from saved fp/msa context +*/ +write_msa_csr (current->thread.fpu.msacsr); +/* +* own_fpu_inatomic(1) just restore low 64bit, +* fix the high 64bit +*/ +init_msa_upper ();set_thread_flag (TIF_USEDMSA );set_thread_flag (TIF_MSA_CTX_LIVE ); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 63/129 xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt files
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit d0c20d38af135b2b4b90aa59df7878ef0c8fbef4 ]
The realtime flag only applies to the data fork, so don't use the realtime block number checks on the attr fork of a realtime file.
--- fs/xfs/libxfs/xfs_bmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/libxfs/xfs_bmap.c +1 -1
@@ -6179,7 +6179,7 @@ xfs_bmap_validate_extent( isrt =XFS_IS_REALTIME_INODE (ip); endfsb = irec->br_startblock + irec->br_blockcount -1 ; -if (isrt) { +if (isrt && whichfork ==XFS_DATA_FORK ) {if (!xfs_verify_rtbno (mp, irec->br_startblock))return __this_address;if (!xfs_verify_rtbno (mp, endfsb))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 64/129 perf jevents: Fix suspicious code in fixregex()
In reply to Greg Kroah-HartmanFrom: Namhyung Kim <[email protected]>
[ Upstream commit e62458e3940eb3dfb009481850e140fbee183b04 ]
The new string should have enough space for the original string and the back slashes IMHO.
--- tools/perf/pmu-events/jevents.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/pmu-events/jevents.c +1 -1
@@ -137,7 +137,7 @@ static char *fixregex(char *s)return s;/* allocate space for a new string */ - fixed = (char *)malloc (len +1 ); + fixed = (char *)malloc (len + esc_count +1 );if (!fixed)return NULL ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 65/129 tg3: Fix soft lockup when tg3_reset_task() fails.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit 556699341efa98243e08e34401b3f601da91f5a3 ]
If tg3_reset_task() fails, the device state is left in an inconsistent state with IFF_RUNNING still set but NAPI state not enabled. A subsequent operation, such as ifdown or AER error can cause it to soft lock up when it tries to disable NAPI state.
Fix it by bringing down the device to !IFF_RUNNING state when tg3_reset_task() fails. tg3_reset_task() running from workqueue will now call tg3_close() when the reset fails. We need to modify tg3_reset_task_cancel() slightly to avoid tg3_close() calling cancel_work_sync() to cancel tg3_reset_task(). Otherwise cancel_work_sync() will wait forever for tg3_reset_task() to finish.
--- drivers/net/ethernet/broadcom/tg3.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +13 -4
@@ -7227,8 +7227,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp)static inline void tg3_reset_task_cancel (struct tg3 *tp) { -cancel_work_sync (&tp->reset_task); -tg3_flag_clear (tp,RESET_TASK_PENDING ); +if (test_and_clear_bit (TG3_FLAG_RESET_TASK_PENDING , tp->tg3_flags)) +cancel_work_sync (&tp->reset_task);tg3_flag_clear (tp,TX_RECOVERY_PENDING ); }
@@ -11219,18 +11219,27 @@ static void tg3_reset_task(struct work_struct *work)tg3_halt (tp,RESET_KIND_SHUTDOWN ,0 ); err =tg3_init_hw (tp, true); -if (err) +if (err) { +tg3_full_unlock (tp); + tp->irq_sync =0 ; +tg3_napi_enable (tp); +/* Clear this flag so that tg3_reset_task_cancel() will not +* call cancel_work_sync() and wait forever. +*/ +tg3_flag_clear (tp,RESET_TASK_PENDING ); +dev_close (tp->dev); goto out; + }tg3_netif_start (tp); -out:tg3_full_unlock (tp);if (!err)tg3_phy_start (tp);tg3_flag_clear (tp,RESET_TASK_PENDING ); +out:rtnl_unlock (); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 66/129 x86, fakenuma: Fix invalid starting node ID
In reply to Greg Kroah-HartmanFrom: Huang Ying <[email protected]>
[ Upstream commit ccae0f36d500aef727f98acd8d0601e6b262a513 ]
Commit:
cc9aec03e58f ("x86/numa_emulation: Introduce uniform split capability")
uses "-1" as the starting node ID, which causes the strange kernel log as follows, when "numa=fake=32G" is added to the kernel command line:
Faking node -1 at [mem 0x0000000000000000-0x0000000893ffffff] (35136MB)
Faking node 0 at [mem 0x0000001840000000-0x000000203fffffff] (32768MB)
Faking node 1 at [mem 0x0000000894000000-0x000000183fffffff] (64192MB)
Faking node 2 at [mem 0x0000002040000000-0x000000283fffffff] (32768MB)
Faking node 3 at [mem 0x0000002840000000-0x000000303fffffff] (32768MB)And finally the kernel crashes:
BUG: Bad page state in process swapper pfn:00011
page:(____ptrval____) refcount:0 mapcount:1 mapping:(____ptrval____) index:0x55cd7e44b270 pfn:0x11
failed to read mapping contents, not a valid kernel address?
flags: 0x5(locked|uptodate)
raw: 0000000000000005 000055cd7e44af30 000055cd7e44af50 0000000100000006
raw: 000055cd7e44b270 000055cd7e44b290 0000000000000000 000055cd7e44b510
page dumped because: page still charged to cgroup
page->mem_cgroup:000055cd7e44b510
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.9.0-rc2 #1
Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019
Call Trace:
dump_stack+0x57/0x80
bad_page.cold+0x63/0x94
__free_pages_ok+0x33f/0x360
memblock_free_all+0x127/0x195
mem_init+0x23/0x1f5
start_kernel+0x219/0x4f5
secondary_startup_64+0xb6/0xc0Fix this bug via using 0 as the starting node ID. This restores the original behavior before cc9aec03e58f.
[ mingo: Massaged the changelog. ]
--- arch/x86/mm/numa_emulation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/numa_emulation.c +1 -1
@@ -321,7 +321,7 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei, u64 addr, u64 max_addr, u64 size) { return split_nodes_size_interleave_uniform(ei, pi, addr, max_addr, size, - 0, NULL, NUMA_NO_NODE); + 0, NULL, 0); }int __init setup_emu2phys_nid (int *dfl_phys_nid)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 67/129 iommu/vt-d: Serialize IOMMU GCMD register modifications
In reply to Greg Kroah-HartmanFrom: Lu Baolu <[email protected]>
[ Upstream commit 6e4e9ec65078093165463c13d4eb92b3e8d7b2e8 ]
The VT-d spec requires (10.4.4 Global Command Register, GCMD_REG General Description) that:
If multiple control fields in this register need to be modified, software must serialize the modifications through multiple writes to this register.
However, in irq_remapping.c, modifications of IRE and CFI are done in one write. We need to do two separate writes with STS checking after each. It also checks the status register before writing command register to avoid unnecessary register write.
--- drivers/iommu/intel_irq_remapping.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/iommu/intel_irq_remapping.c +8 -2
@@ -507,12 +507,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu)/* Enable interrupt-remapping */ iommu->gcmd |=DMA_GCMD_IRE ; - iommu->gcmd &= ~DMA_GCMD_CFI ;/* Block compatibility-format MSIs */ writel (iommu->gcmd, iommu->reg +DMAR_GCMD_REG ); -IOMMU_WAIT_OP (iommu,DMAR_GSTS_REG , readl, (sts &DMA_GSTS_IRES ), sts); +/* Block compatibility-format MSIs */ +if (sts &DMA_GSTS_CFIS ) { + iommu->gcmd &= ~DMA_GCMD_CFI ; +writel (iommu->gcmd, iommu->reg +DMAR_GCMD_REG ); +IOMMU_WAIT_OP (iommu,DMAR_GSTS_REG , + readl, !(sts &DMA_GSTS_CFIS ), sts); + } +/* * With CFI clear in the Global Command register, we should be * protected from dangerous (i.e. compatibility) interrupts
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 68/129 thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 30d24faba0532d6972df79a1bf060601994b5873 ]
We can sometimes get bogus thermal shutdowns on omap4430 at least with droid4 running idle with a battery charger connected:
thermal thermal_zone0: critical temperature reached (143 C), shutting down
Dumping out the register values shows we can occasionally get a 0x7f value that is outside the TRM listed values in the ADC conversion table. And then we get a normal value when reading again after that. Reading the register multiple times does not seem help avoiding the bogus values as they stay until the next sample is ready.
Looking at the TRM chapter "18.4.10.2.3 ADC Codes Versus Temperature", we should have values from 13 to 107 listed with a total of 95 values. But looking at the omap4430_adc_to_temp array, the values are off, and the end values are missing. And it seems that the 4430 ADC table is similar to omap3630 rather than omap4460.
Let's fix the issue by using values based on the omap3630 table and just ignoring invalid values. Compared to the 4430 TRM, the omap3630 table has the missing values added while the TRM table only shows every second value.
Note that sometimes the ADC register values within the valid table can also be way off for about 1 out of 10 values. But it seems that those just show about 25 C too low values rather than too high values. So those do not cause a bogus thermal shutdown.
--- .../ti-soc-thermal/omap4-thermal-data.c | 23 ++++++++++--------- .../thermal/ti-soc-thermal/omap4xxx-bandgap.h | 10 +++++--- 2 files changed, 19 insertions(+), 14 deletions(-)
drivers/thermal/ti-soc-thermal/omap4-thermal-data.c +12 -11
@@ -37,20 +37,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = {/* * Temperature values in milli degree celsius -* ADC code values from 530 to 923 +* ADC code values from 13 to 107, see TRM +* "18.4.10.2.3 ADC Codes Versus Temperature". */ static const int omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE -OMAP4430_ADC_START_VALUE +1 ] = { --38000 ,-35000 ,-34000 ,-32000 ,-30000 ,-28000 ,-26000 ,-24000 ,-22000 , --20000 ,-18000 ,-17000 ,-15000 ,-13000 ,-12000 ,-10000 ,-8000 ,-6000 , --5000 ,-3000 ,-1000 ,0 ,2000 ,3000 ,5000 ,6000 ,8000 ,10000 ,12000 , -13000 ,15000 ,17000 ,19000 ,21000 ,23000 ,25000 ,27000 ,28000 ,30000 , -32000 ,33000 ,35000 ,37000 ,38000 ,40000 ,42000 ,43000 ,45000 ,47000 , -48000 ,50000 ,52000 ,53000 ,55000 ,57000 ,58000 ,60000 ,62000 ,64000 , -66000 ,68000 ,70000 ,71000 ,73000 ,75000 ,77000 ,78000 ,80000 ,82000 , -83000 ,85000 ,87000 ,88000 ,90000 ,92000 ,93000 ,95000 ,97000 ,98000 , -100000 ,102000 ,103000 ,105000 ,107000 ,109000 ,111000 ,113000 ,115000 , -117000 ,118000 ,120000 ,122000 ,123000 , +-40000 ,-38000 ,-35000 ,-34000 ,-32000 ,-30000 ,-28000 ,-26000 ,-24000 , +-22000 ,-20000 ,-18500 ,-17000 ,-15000 ,-13500 ,-12000 ,-10000 ,-8000 , +-6500 ,-5000 ,-3500 ,-1500 ,0 ,2000 ,3500 ,5000 ,6500 ,8500 ,10000 , +12000 ,13500 ,15000 ,17000 ,19000 ,21000 ,23000 ,25000 ,27000 ,28500 , +30000 ,32000 ,33500 ,35000 ,37000 ,38500 ,40000 ,42000 ,43500 ,45000 , +47000 ,48500 ,50000 ,52000 ,53500 ,55000 ,57000 ,58500 ,60000 ,62000 , +64000 ,66000 ,68000 ,70000 ,71500 ,73500 ,75000 ,77000 ,78500 ,80000 , +82000 ,83500 ,85000 ,87000 ,88500 ,90000 ,92000 ,93500 ,95000 ,97000 , +98500 ,100000 ,102000 ,103500 ,105000 ,107000 ,109000 ,111000 ,113000 , +115000 ,117000 ,118500 ,120000 ,122000 ,123500 ,125000 , };/* OMAP4430 data */
drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h +7 -3
@@ -53,9 +53,13 @@* and thresholds for OMAP4430. */ -/* ADC conversion table limits */ -#define OMAP4430_ADC_START_VALUE 0 -#define OMAP4430_ADC_END_VALUE 127 +/* +* ADC conversion table limits. Ignore values outside the TRM listed +* range to avoid bogus thermal shutdowns. See omap4430 TRM chapter +* "18.4.10.2.3 ADC Codes Versus Temperature". +*/ +#define OMAP4430_ADC_START_VALUE 13 +#define OMAP4430_ADC_END_VALUE 107/* bandgap clock limits (no control on 4430) */ #define OMAP4430_MAX_FREQ 32768#define OMAP4430_MIN_FREQ 32768
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 69/129 thermal: qcom-spmi-temp-alarm: Dont suppress negative temp
In reply to Greg Kroah-HartmanFrom: Veera Vegivada <[email protected]>
[ Upstream commit 0ffdab6f2dea9e23ec33230de24e492ff0b186d9 ]
Currently driver is suppressing the negative temperature readings from the vadc. Consumers of the thermal zones need to read the negative temperature too. Don't suppress the readings.
--- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/thermal/qcom/qcom-spmi-temp-alarm.c +2 -2
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Copyright (c) 2011-2015, 2017, The Linux Foundation. All rights reserved. +* Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved. */ #include <linux/bitops.h>
@@ -191,7 +191,7 @@ static int qpnp_tm_get_temp(void *data, int *temp) chip->temp = mili_celsius; } - *temp = chip->temp <0 ?0 : chip->temp; + *temp = chip->temp;return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 70/129 iommu/amd: Restore IRTE.RemapEn bit after programming IRTE
In reply to Greg Kroah-HartmanFrom: Suravee Suthikulpanit <[email protected]>
[ Upstream commit 26e495f341075c09023ba16dee9a7f37a021e745 ]
Currently, the RemapEn (valid) bit is accidentally cleared when programming IRTE w/ guestMode=0. It should be restored to the prior state.
--- drivers/iommu/amd_iommu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iommu/amd_iommu.c +2 -0
@@ -4431,6 +4431,7 @@ int amd_iommu_deactivate_guest_mode(void *data)struct amd_ir_data *ir_data = (struct amd_ir_data *)data;struct irte_ga *entry = (struct irte_ga *) ir_data->entry;struct irq_cfg *cfg = ir_data->cfg; +u64 valid = entry->lo.fields_remap.valid;if (!AMD_IOMMU_GUEST_IR_VAPIC (amd_iommu_guest_ir) || !entry || !entry->lo.fields_vapic.guest_mode)
@@ -4439,6 +4440,7 @@ int amd_iommu_deactivate_guest_mode(void *data) entry->lo.val =0 ; entry->hi.val =0 ; + entry->lo.fields_remap.valid = valid; entry->lo.fields_remap.dm = apic->irq_dest_mode; entry->lo.fields_remap.int_type = apic->irq_delivery_mode; entry->hi.fields.vector = cfg->vector;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 71/129 net/packet: fix overflow in tpacket_rcv
In reply to Greg Kroah-HartmanFrom: Or Cohen <[email protected]>
[ Upstream commit acf69c946233259ab4d64f8869d4037a198c7f06 ]
Using tp_reserve to calculate netoff can overflow as tp_reserve is unsigned int and netoff is unsigned short.
This may lead to macoff receving a smaller value then sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr is set, an out-of-bounds write will occur when calling virtio_net_hdr_from_skb.
The bug is fixed by converting netoff to unsigned int and checking if it exceeds USHRT_MAX.
This addresses CVE-2020-14386
--- net/packet/af_packet.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/packet/af_packet.c +6 -1
@@ -2169,7 +2169,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,int skb_len = skb->len;unsigned int snaplen, res;unsigned long status =TP_STATUS_USER ; -unsigned short macoff, netoff, hdrlen; +unsigned short macoff, hdrlen; +unsigned int netoff;struct sk_buff *copy_skb =NULL ;struct timespec ts;__u32 ts_status;
@@ -2238,6 +2239,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, } macoff = netoff - maclen; } +if (netoff >USHRT_MAX ) { +atomic_inc (&po->tp_drops); + goto drop_n_restore; + }if (po->tp_version <=TPACKET_V2 ) {if (macoff + snaplen > po->rx_ring.frame_size) { if (po->copy_thresh &&
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 72/129 include/linux/log2.h: add missing () around n in roundup_pow_of_two()
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit 428fc0aff4e59399ec719ffcc1f7a5d29a4ee476 ]
Otherwise gcc generates warnings if the expression is complicated.
--- include/linux/log2.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/log2.h +1 -1
@@ -173,7 +173,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)#define roundup_pow_of_two (n) \ ( \ __builtin_constant_p(n) ? ( \ - (n == 1) ? 1 : \ + ((n) == 1) ? 1 : \ (1UL << (ilog2((n) - 1) + 1)) \ ) : \ __roundup_pow_of_two(n) \
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 73/129 vfio/type1: Support faulting PFNMAP vmas
In reply to Greg Kroah-HartmanFrom: Ajay Kaher <[email protected]>
commit 41311242221e3482b20bfed10fa4d9db98d87016 upstream.
With conversion to follow_pfn(), DMA mapping a PFNMAP range depends on the range being faulted into the vma. Add support to manually provide that, in the same way as done on KVM with hva_to_pfn_remapped().
--- drivers/vfio/vfio_iommu_type1.c | 36 ++++++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-)
drivers/vfio/vfio_iommu_type1.c +33 -3
@@ -335,6 +335,32 @@ static int put_pfn(unsigned long pfn, int prot)return 0 ; } +static int follow_fault_pfn (struct vm_area_struct *vma,struct mm_struct *mm, +unsigned long vaddr,unsigned long *pfn, +bool write_fault) +{ +int ret; + + ret =follow_pfn (vma, vaddr, pfn); +if (ret) { +bool unlocked = false; + + ret =fixup_user_fault (NULL , mm, vaddr, +FAULT_FLAG_REMOTE | + (write_fault ?FAULT_FLAG_WRITE :0 ), + &unlocked); +if (unlocked) +return -EAGAIN ; + +if (ret) +return ret; + + ret =follow_pfn (vma, vaddr, pfn); + } + +return ret; +} +static int vaddr_get_pfn (struct mm_struct *mm,unsigned long vaddr,int prot,unsigned long *pfn) {
@@ -377,12 +403,16 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, vaddr =untagged_addr (vaddr); +retry: vma =find_vma_intersection (mm, vaddr, vaddr +1 );if (vma && vma->vm_flags &VM_PFNMAP ) { -if (!follow_pfn (vma, vaddr, pfn) && -is_invalid_reserved_pfn (*pfn)) - ret =0 ; + ret =follow_fault_pfn (vma, mm, vaddr, pfn, prot &IOMMU_WRITE ); +if (ret == -EAGAIN ) + goto retry; + +if (!ret && !is_invalid_reserved_pfn (*pfn)) + ret = -EFAULT ; }up_read (&mm->mmap_sem);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 74/129 vfio-pci: Fault mmaps to enable vma tracking
In reply to Greg Kroah-HartmanFrom: Ajay Kaher <[email protected]>
commit 11c4cd07ba111a09f49625f9e4c851d83daf0a22 upstream.
Rather than calling remap_pfn_range() when a region is mmap'd, setup a vm_ops handler to support dynamic faulting of the range on access. This allows us to manage a list of vmas actively mapping the area that we can later use to invalidate those mappings. The open callback invalidates the vma range so that all tracking is inserted in the fault handler and removed in the close handler.
--- drivers/vfio/pci/vfio_pci.c | 76 ++++++++++++++++++++++++++++- drivers/vfio/pci/vfio_pci_private.h | 7 +++ 2 files changed, 81 insertions(+), 2 deletions(-)
drivers/vfio/pci/vfio_pci.c +74 -2
@@ -1192,6 +1192,70 @@ static ssize_t vfio_pci_write(void *device_data, const char __user *buf,return vfio_pci_rw (device_data, (char __user *)buf, count, ppos, true); } +static int vfio_pci_add_vma (struct vfio_pci_device *vdev, +struct vm_area_struct *vma) +{ +struct vfio_pci_mmap_vma *mmap_vma; + + mmap_vma =kmalloc (sizeof (*mmap_vma),GFP_KERNEL ); +if (!mmap_vma) +return -ENOMEM ; + + mmap_vma->vma = vma; + +mutex_lock (&vdev->vma_lock); +list_add (&mmap_vma->vma_next, &vdev->vma_list); +mutex_unlock (&vdev->vma_lock); + +return 0 ; +} + +/* +* Zap mmaps on open so that we can fault them in on access and therefore +* our vma_list only tracks mappings accessed since last zap. +*/ +static void vfio_pci_mmap_open (struct vm_area_struct *vma) +{ +zap_vma_ptes (vma, vma->vm_start, vma->vm_end - vma->vm_start); +} + +static void vfio_pci_mmap_close (struct vm_area_struct *vma) +{ +struct vfio_pci_device *vdev = vma->vm_private_data; +struct vfio_pci_mmap_vma *mmap_vma; + +mutex_lock (&vdev->vma_lock); +list_for_each_entry (mmap_vma, &vdev->vma_list, vma_next) { +if (mmap_vma->vma == vma) { +list_del (&mmap_vma->vma_next); +kfree (mmap_vma); +break ; + } + } +mutex_unlock (&vdev->vma_lock); +} + +static vm_fault_t vfio_pci_mmap_fault (struct vm_fault *vmf) +{ +struct vm_area_struct *vma = vmf->vma; +struct vfio_pci_device *vdev = vma->vm_private_data; + +if (vfio_pci_add_vma (vdev, vma)) +return VM_FAULT_OOM ; + +if (remap_pfn_range (vma, vma->vm_start, vma->vm_pgoff, + vma->vm_end - vma->vm_start, vma->vm_page_prot)) +return VM_FAULT_SIGBUS ; + +return VM_FAULT_NOPAGE ; +} + +static const struct vm_operations_struct vfio_pci_mmap_ops = { + .open = vfio_pci_mmap_open, + .close = vfio_pci_mmap_close, + .fault = vfio_pci_mmap_fault, +}; +static int vfio_pci_mmap (void *device_data,struct vm_area_struct *vma) {struct vfio_pci_device *vdev = device_data;
@@ -1250,8 +1314,14 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) vma->vm_page_prot =pgprot_noncached (vma->vm_page_prot); vma->vm_pgoff = (pci_resource_start (pdev, index) >>PAGE_SHIFT ) + pgoff; -return remap_pfn_range (vma, vma->vm_start, vma->vm_pgoff, - req_len, vma->vm_page_prot); +/* +* See remap_pfn_range(), called from vfio_pci_fault() but we can't +* change vm_flags within the fault handler. Set them now. +*/ + vma->vm_flags |=VM_IO |VM_PFNMAP |VM_DONTEXPAND |VM_DONTDUMP ; + vma->vm_ops = &vfio_pci_mmap_ops; + +return 0 ; }static void vfio_pci_request (void *device_data,unsigned int count)
@@ -1327,6 +1397,8 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)spin_lock_init (&vdev->irqlock);mutex_init (&vdev->ioeventfds_lock);INIT_LIST_HEAD (&vdev->ioeventfds_list); +mutex_init (&vdev->vma_lock); +INIT_LIST_HEAD (&vdev->vma_list); ret =vfio_add_group_dev (&pdev->dev, &vfio_pci_ops, vdev);if (ret) {
drivers/vfio/pci/vfio_pci_private.h +7 -0
@@ -84,6 +84,11 @@ struct vfio_pci_reflck {struct mutex lock; }; +struct vfio_pci_mmap_vma { +struct vm_area_struct *vma; +struct list_head vma_next; +}; +struct vfio_pci_device {struct pci_dev *pdev;void __iomem *barmap[PCI_STD_RESOURCE_END +1 ];
@@ -122,6 +127,8 @@ struct vfio_pci_device {struct list_head dummy_resources_list;struct mutex ioeventfds_lock;struct list_head ioeventfds_list; +struct mutex vma_lock; +struct list_head vma_list; };#define is_intx (vdev) (vdev->irq_type == VFIO_PCI_INTX_IRQ_INDEX)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 75/129 vfio-pci: Invalidate mmaps and block MMIO access on disabled memory
In reply to Greg Kroah-HartmanFrom: Ajay Kaher <[email protected]>
commit abafbc551fddede3e0a08dee1dcde08fc0eb8476 upstream.
Accessing the disabled memory space of a PCI device would typically result in a master abort response on conventional PCI, or an unsupported request on PCI express. The user would generally see these as a -1 response for the read return data and the write would be silently discarded, possibly with an uncorrected, non-fatal AER error triggered on the host. Some systems however take it upon themselves to bring down the entire system when they see something that might indicate a loss of data, such as this discarded write to a disabled memory space.
To avoid this, we want to try to block the user from accessing memory spaces while they're disabled. We start with a semaphore around the memory enable bit, where writers modify the memory enable state and must be serialized, while readers make use of the memory region and can access in parallel. Writers include both direct manipulation via the command register, as well as any reset path where the internal mechanics of the reset may both explicitly and implicitly disable memory access, and manipulation of the MSI-X configuration, where the MSI-X vector table resides in MMIO space of the device. Readers include the read and write file ops to access the vfio device fd offsets as well as memory mapped access. In the latter case, we make use of our new vma list support to zap, or invalidate, those memory mappings in order to force them to be faulted back in on access.
Our semaphore usage will stall user access to MMIO spaces across internal operations like reset, but the user might experience new behavior when trying to access the MMIO space while disabled via the PCI command register. Access via read or write while disabled will return -EIO and access via memory maps will result in a SIGBUS. This is expected to be compatible with known use cases and potentially provides better error handling capabilities than present in the hardware, while avoiding the more readily accessible and severe platform error responses that might otherwise occur.
--- drivers/vfio/pci/vfio_pci.c | 291 ++++++++++++++++++++++++---- drivers/vfio/pci/vfio_pci_config.c | 36 +++- drivers/vfio/pci/vfio_pci_intrs.c | 14 ++ drivers/vfio/pci/vfio_pci_private.h | 8 + drivers/vfio/pci/vfio_pci_rdwr.c | 24 ++- 5 files changed, 330 insertions(+), 43 deletions(-)
drivers/vfio/pci/vfio_pci.c +258 -33
@@ -27,6 +27,7 @@#include <linux/vfio.h> #include <linux/vgaarb.h> #include <linux/nospec.h> +#include <linux/sched/mm.h> #include "vfio_pci_private.h"
@@ -177,6 +178,7 @@ no_mmap:static void vfio_pci_try_bus_reset (struct vfio_pci_device *vdev);static void vfio_pci_disable (struct vfio_pci_device *vdev); +static int vfio_pci_try_zap_and_vma_lock_cb (struct pci_dev *pdev,void *data);/* * INTx masking requires the ability to disable INTx signaling via PCI_COMMAND
@@ -688,6 +690,12 @@ int vfio_pci_register_dev_region(struct vfio_pci_device *vdev,return 0 ; } +struct vfio_devices { +struct vfio_device **devices; +int cur_index; +int max_index; +}; +static long vfio_pci_ioctl (void *device_data,unsigned int cmd,unsigned long arg) {
@@ -761,7 +769,7 @@ static long vfio_pci_ioctl(void *device_data, {void __iomem *io;size_t size; -u16 orig_cmd; +u16 cmd; info.offset =VFIO_PCI_INDEX_TO_OFFSET (info.index); info.flags =0 ;
@@ -781,10 +789,7 @@ static long vfio_pci_ioctl(void *device_data,* Is it really there? Enable memory decode for * implicit access in pci_map_rom(). */ -pci_read_config_word (pdev,PCI_COMMAND , &orig_cmd); -pci_write_config_word (pdev,PCI_COMMAND , - orig_cmd |PCI_COMMAND_MEMORY ); - + cmd =vfio_pci_memory_lock_and_enable (vdev); io =pci_map_rom (pdev, &size);if (io) { info.flags =VFIO_REGION_INFO_FLAG_READ ;
@@ -792,8 +797,8 @@ static long vfio_pci_ioctl(void *device_data, }else { info.size =0 ; } +vfio_pci_memory_unlock_and_restore (vdev, cmd); -pci_write_config_word (pdev,PCI_COMMAND , orig_cmd);break ; }case VFIO_PCI_VGA_REGION_INDEX :
@@ -936,8 +941,16 @@ static long vfio_pci_ioctl(void *device_data,return ret; }else if (cmd ==VFIO_DEVICE_RESET ) { -return vdev->reset_works ? -pci_try_reset_function (vdev->pdev) : -EINVAL ; +int ret; + +if (!vdev->reset_works) +return -EINVAL ; + +vfio_pci_zap_and_down_write_memory_lock (vdev); + ret =pci_try_reset_function (vdev->pdev); +up_write (&vdev->memory_lock); + +return ret; }else if (cmd ==VFIO_DEVICE_GET_PCI_HOT_RESET_INFO ) {struct vfio_pci_hot_reset_info hdr;
@@ -1017,8 +1030,9 @@ reset_info_exit:int32_t *group_fds;struct vfio_pci_group_entry *groups;struct vfio_pci_group_info info; +struct vfio_devices devs = { .cur_index =0 };bool slot = false; -int i, count =0 , ret =0 ; +int i, group_idx, mem_idx =0 , count =0 , ret =0 ; minsz = offsetofend(struct vfio_pci_hot_reset, count);
@@ -1070,9 +1084,9 @@ reset_info_exit:* user interface and store the group and iommu ID. This * ensures the group is held across the reset. */ -for (i =0 ; i < hdr.count; i++) { +for (group_idx =0 ; group_idx < hdr.count; group_idx++) {struct vfio_group *group; -struct fd f =fdget (group_fds[i]); +struct fd f =fdget (group_fds[group_idx]);if (!f.file) { ret = -EBADF ;break ;
@@ -1085,8 +1099,9 @@ reset_info_exit:break ; } - groups[i].group = group; - groups[i].id =vfio_external_user_iommu_id (group); + groups[group_idx].group = group; + groups[group_idx].id = +vfio_external_user_iommu_id (group); }kfree (group_fds);
@@ -1105,13 +1120,63 @@ reset_info_exit: ret =vfio_pci_for_each_slot_or_bus (vdev->pdev, vfio_pci_validate_devs, &info, slot); -if (!ret) -/* User has access, do the reset */ - ret =pci_reset_bus (vdev->pdev); +if (ret) + goto hot_reset_release; + + devs.max_index = count; + devs.devices =kcalloc (count,sizeof (struct vfio_device *), +GFP_KERNEL ); +if (!devs.devices) { + ret = -ENOMEM ; + goto hot_reset_release; + } + +/* +* We need to get memory_lock for each device, but devices +* can share mmap_sem, therefore we need to zap and hold +* the vma_lock for each device, and only then get each +* memory_lock. +*/ + ret =vfio_pci_for_each_slot_or_bus (vdev->pdev, + vfio_pci_try_zap_and_vma_lock_cb, + &devs, slot); +if (ret) + goto hot_reset_release; + +for (; mem_idx < devs.cur_index; mem_idx++) { +struct vfio_pci_device *tmp; + + tmp =vfio_device_data (devs.devices[mem_idx]); + + ret =down_write_trylock (&tmp->memory_lock); +if (!ret) { + ret = -EBUSY ; + goto hot_reset_release; + } +mutex_unlock (&tmp->vma_lock); + } + +/* User has access, do the reset */ + ret =pci_reset_bus (vdev->pdev); hot_reset_release: -for (i--; i >=0 ; i--) -vfio_group_put_external_user (groups[i].group); +for (i =0 ; i < devs.cur_index; i++) { +struct vfio_device *device; +struct vfio_pci_device *tmp; + + device = devs.devices[i]; + tmp =vfio_device_data (device); + +if (i < mem_idx) +up_write (&tmp->memory_lock); +else +mutex_unlock (&tmp->vma_lock); +vfio_device_put (device); + } +kfree (devs.devices); + +for (group_idx--; group_idx >=0 ; group_idx--) +vfio_group_put_external_user (groups[group_idx].group);kfree (groups);return ret;
@@ -1192,8 +1257,126 @@ static ssize_t vfio_pci_write(void *device_data, const char __user *buf,return vfio_pci_rw (device_data, (char __user *)buf, count, ppos, true); } -static int vfio_pci_add_vma (struct vfio_pci_device *vdev, -struct vm_area_struct *vma) +/* Return 1 on zap and vma_lock acquired, 0 on contention (only with @try) */ +static int vfio_pci_zap_and_vma_lock (struct vfio_pci_device *vdev,bool try) +{ +struct vfio_pci_mmap_vma *mmap_vma, *tmp; + +/* +* Lock ordering: +* vma_lock is nested under mmap_sem for vm_ops callback paths. +* The memory_lock semaphore is used by both code paths calling +* into this function to zap vmas and the vm_ops.fault callback +* to protect the memory enable state of the device. +* +* When zapping vmas we need to maintain the mmap_sem => vma_lock +* ordering, which requires using vma_lock to walk vma_list to +* acquire an mm, then dropping vma_lock to get the mmap_sem and +* reacquiring vma_lock. This logic is derived from similar +* requirements in uverbs_user_mmap_disassociate(). +* +* mmap_sem must always be the top-level lock when it is taken. +* Therefore we can only hold the memory_lock write lock when +* vma_list is empty, as we'd need to take mmap_sem to clear +* entries. vma_list can only be guaranteed empty when holding +* vma_lock, thus memory_lock is nested under vma_lock. +* +* This enables the vm_ops.fault callback to acquire vma_lock, +* followed by memory_lock read lock, while already holding +* mmap_sem without risk of deadlock. +*/ +while (1 ) { +struct mm_struct *mm =NULL ; + +if (try) { +if (!mutex_trylock (&vdev->vma_lock)) +return 0 ; + }else { +mutex_lock (&vdev->vma_lock); + } +while (!list_empty (&vdev->vma_list)) { + mmap_vma =list_first_entry (&vdev->vma_list, + struct vfio_pci_mmap_vma, + vma_next); + mm = mmap_vma->vma->vm_mm; +if (mmget_not_zero (mm)) +break ; + +list_del (&mmap_vma->vma_next); +kfree (mmap_vma); + mm =NULL ; + } +if (!mm) +return 1 ; +mutex_unlock (&vdev->vma_lock); + +if (try) { +if (!down_read_trylock (&mm->mmap_sem)) { +mmput (mm); +return 0 ; + } + }else { +down_read (&mm->mmap_sem); + } +if (mmget_still_valid (mm)) { +if (try) { +if (!mutex_trylock (&vdev->vma_lock)) { +up_read (&mm->mmap_sem); +mmput (mm); +return 0 ; + } + }else { +mutex_lock (&vdev->vma_lock); + } +list_for_each_entry_safe (mmap_vma, tmp, + &vdev->vma_list, vma_next) { +struct vm_area_struct *vma = mmap_vma->vma; + +if (vma->vm_mm != mm) +continue ; + +list_del (&mmap_vma->vma_next); +kfree (mmap_vma); + +zap_vma_ptes (vma, vma->vm_start, + vma->vm_end - vma->vm_start); + } +mutex_unlock (&vdev->vma_lock); + } +up_read (&mm->mmap_sem); +mmput (mm); + } +} + +void vfio_pci_zap_and_down_write_memory_lock (struct vfio_pci_device *vdev) +{ +vfio_pci_zap_and_vma_lock (vdev, false); +down_write (&vdev->memory_lock); +mutex_unlock (&vdev->vma_lock); +} + +u16 vfio_pci_memory_lock_and_enable (struct vfio_pci_device *vdev) +{ +u16 cmd; + +down_write (&vdev->memory_lock); +pci_read_config_word (vdev->pdev,PCI_COMMAND , &cmd); +if (!(cmd &PCI_COMMAND_MEMORY )) +pci_write_config_word (vdev->pdev,PCI_COMMAND , + cmd |PCI_COMMAND_MEMORY ); + +return cmd; +} + +void vfio_pci_memory_unlock_and_restore (struct vfio_pci_device *vdev,u16 cmd) +{ +pci_write_config_word (vdev->pdev,PCI_COMMAND , cmd); +up_write (&vdev->memory_lock); +} + +/* Caller holds vma_lock */ +static int __vfio_pci_add_vma (struct vfio_pci_device *vdev, +struct vm_area_struct *vma) {struct vfio_pci_mmap_vma *mmap_vma;
@@ -1202,10 +1385,7 @@ static int vfio_pci_add_vma(struct vfio_pci_device *vdev,return -ENOMEM ; mmap_vma->vma = vma; - -mutex_lock (&vdev->vma_lock);list_add (&mmap_vma->vma_next, &vdev->vma_list); -mutex_unlock (&vdev->vma_lock);return 0 ; }
@@ -1239,15 +1419,32 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf) {struct vm_area_struct *vma = vmf->vma;struct vfio_pci_device *vdev = vma->vm_private_data; +vm_fault_t ret =VM_FAULT_NOPAGE ; + +mutex_lock (&vdev->vma_lock); +down_read (&vdev->memory_lock); + +if (!__vfio_pci_memory_enabled (vdev)) { + ret =VM_FAULT_SIGBUS ; +mutex_unlock (&vdev->vma_lock); + goto up_out; + } + +if (__vfio_pci_add_vma (vdev, vma)) { + ret =VM_FAULT_OOM ; +mutex_unlock (&vdev->vma_lock); + goto up_out; + } -if (vfio_pci_add_vma (vdev, vma)) -return VM_FAULT_OOM ; +mutex_unlock (&vdev->vma_lock);if (remap_pfn_range (vma, vma->vm_start, vma->vm_pgoff, vma->vm_end - vma->vm_start, vma->vm_page_prot)) -return VM_FAULT_SIGBUS ; + ret =VM_FAULT_SIGBUS ; -return VM_FAULT_NOPAGE ; +up_out: +up_read (&vdev->memory_lock); +return ret; }static const struct vm_operations_struct vfio_pci_mmap_ops = {
@@ -1399,6 +1596,7 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)INIT_LIST_HEAD (&vdev->ioeventfds_list);mutex_init (&vdev->vma_lock);INIT_LIST_HEAD (&vdev->vma_list); +init_rwsem (&vdev->memory_lock); ret =vfio_add_group_dev (&pdev->dev, &vfio_pci_ops, vdev);if (ret) {
@@ -1588,12 +1786,6 @@ static void vfio_pci_reflck_put(struct vfio_pci_reflck *reflck)kref_put_mutex (&reflck->kref, vfio_pci_reflck_release, &reflck_lock); } -struct vfio_devices { -struct vfio_device **devices; -int cur_index; -int max_index; -}; -static int vfio_pci_get_unused_devs (struct pci_dev *pdev,void *data) {struct vfio_devices *devs = data;
@@ -1624,6 +1816,39 @@ static int vfio_pci_get_unused_devs(struct pci_dev *pdev, void *data)return 0 ; } +static int vfio_pci_try_zap_and_vma_lock_cb (struct pci_dev *pdev,void *data) +{ +struct vfio_devices *devs = data; +struct vfio_device *device; +struct vfio_pci_device *vdev; + +if (devs->cur_index == devs->max_index) +return -ENOSPC ; + + device =vfio_device_get_from_dev (&pdev->dev); +if (!device) +return -EINVAL ; + +if (pci_dev_driver (pdev) != &vfio_pci_driver) { +vfio_device_put (device); +return -EBUSY ; + } + + vdev =vfio_device_data (device); + +/* +* Locking multiple devices is prone to deadlock, runaway and +* unwind if we hit contention. +*/ +if (!vfio_pci_zap_and_vma_lock (vdev, true)) { +vfio_device_put (device); +return -EBUSY ; + } + + devs->devices[devs->cur_index++] = device; +return 0 ; +} +/* * If a bus or slot reset is available for the provided device and: * - All of the devices affected by that bus or slot reset are unused
drivers/vfio/pci/vfio_pci_config.c +30 -6
@@ -395,6 +395,14 @@ static inline void p_setd(struct perm_bits *p, int off, u32 virt, u32 write) *(__le32 *)(&p->write[off]) =cpu_to_le32 (write); } +/* Caller should hold memory_lock semaphore */ +bool __vfio_pci_memory_enabled (struct vfio_pci_device *vdev) +{ +u16 cmd =le16_to_cpu (*(__le16 *)&vdev->vconfig[PCI_COMMAND ]); + +return cmd &PCI_COMMAND_MEMORY ; +} +/* * Restore the *real* BARs after we detect a FLR or backdoor reset. * (backdoor = some device specific technique that we didn't catch)
@@ -554,13 +562,18 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, new_cmd =le32_to_cpu (val); + phys_io = !!(phys_cmd &PCI_COMMAND_IO ); + virt_io = !!(le16_to_cpu (*virt_cmd) &PCI_COMMAND_IO ); + new_io = !!(new_cmd &PCI_COMMAND_IO ); + phys_mem = !!(phys_cmd &PCI_COMMAND_MEMORY ); virt_mem = !!(le16_to_cpu (*virt_cmd) &PCI_COMMAND_MEMORY ); new_mem = !!(new_cmd &PCI_COMMAND_MEMORY ); - phys_io = !!(phys_cmd &PCI_COMMAND_IO ); - virt_io = !!(le16_to_cpu (*virt_cmd) &PCI_COMMAND_IO ); - new_io = !!(new_cmd &PCI_COMMAND_IO ); +if (!new_mem) +vfio_pci_zap_and_down_write_memory_lock (vdev); +else +down_write (&vdev->memory_lock);/* * If the user is writing mem/io enable (new_mem/io) and we
@@ -577,8 +590,11 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, } count =vfio_default_config_write (vdev, pos, count, perm, offset, val); -if (count <0 ) +if (count <0 ) { +if (offset ==PCI_COMMAND ) +up_write (&vdev->memory_lock);return count; + }/* * Save current memory/io enable bits in vconfig to allow for
@@ -589,6 +605,8 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, *virt_cmd &=cpu_to_le16 (~mask); *virt_cmd |=cpu_to_le16 (new_cmd & mask); + +up_write (&vdev->memory_lock); }/* Emulate INTx disable */
@@ -826,8 +844,11 @@ static int vfio_exp_config_write(struct vfio_pci_device *vdev, int pos, pos - offset +PCI_EXP_DEVCAP , &cap); -if (!ret && (cap &PCI_EXP_DEVCAP_FLR )) +if (!ret && (cap &PCI_EXP_DEVCAP_FLR )) { +vfio_pci_zap_and_down_write_memory_lock (vdev);pci_try_reset_function (vdev->pdev); +up_write (&vdev->memory_lock); + } }/*
@@ -905,8 +926,11 @@ static int vfio_af_config_write(struct vfio_pci_device *vdev, int pos, pos - offset +PCI_AF_CAP , &cap); -if (!ret && (cap &PCI_AF_CAP_FLR ) && (cap &PCI_AF_CAP_TP )) +if (!ret && (cap &PCI_AF_CAP_FLR ) && (cap &PCI_AF_CAP_TP )) { +vfio_pci_zap_and_down_write_memory_lock (vdev);pci_try_reset_function (vdev->pdev); +up_write (&vdev->memory_lock); + } }return count;
drivers/vfio/pci/vfio_pci_intrs.c +14 -0
@@ -249,6 +249,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)struct pci_dev *pdev = vdev->pdev;unsigned int flag = msix ?PCI_IRQ_MSIX :PCI_IRQ_MSI ;int ret; +u16 cmd;if (!is_irq_none (vdev))return -EINVAL ;
@@ -258,13 +259,16 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)return -ENOMEM ;/* return the number of supported vectors if we can't get all: */ + cmd =vfio_pci_memory_lock_and_enable (vdev); ret =pci_alloc_irq_vectors (pdev,1 , nvec, flag);if (ret < nvec) {if (ret >0 )pci_free_irq_vectors (pdev); +vfio_pci_memory_unlock_and_restore (vdev, cmd);kfree (vdev->ctx);return ret; } +vfio_pci_memory_unlock_and_restore (vdev, cmd); vdev->num_ctx = nvec; vdev->irq_type = msix ? VFIO_PCI_MSIX_IRQ_INDEX :
@@ -287,6 +291,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,struct pci_dev *pdev = vdev->pdev;struct eventfd_ctx *trigger;int irq, ret; +u16 cmd;if (vector <0 || vector >= vdev->num_ctx)return -EINVAL ;
@@ -295,7 +300,11 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,if (vdev->ctx[vector].trigger) {irq_bypass_unregister_producer (&vdev->ctx[vector].producer); + + cmd =vfio_pci_memory_lock_and_enable (vdev);free_irq (irq, vdev->ctx[vector].trigger); +vfio_pci_memory_unlock_and_restore (vdev, cmd); +kfree (vdev->ctx[vector].name);eventfd_ctx_put (vdev->ctx[vector].trigger); vdev->ctx[vector].trigger =NULL ;
@@ -323,6 +332,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,* such a reset it would be unsuccessful. To avoid this, restore the * cached value of the message prior to enabling. */ + cmd =vfio_pci_memory_lock_and_enable (vdev);if (msix) {struct msi_msg msg;
@@ -332,6 +342,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, ret =request_irq (irq, vfio_msihandler,0 , vdev->ctx[vector].name, trigger); +vfio_pci_memory_unlock_and_restore (vdev, cmd);if (ret) {kfree (vdev->ctx[vector].name);eventfd_ctx_put (trigger);
@@ -376,6 +387,7 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix) {struct pci_dev *pdev = vdev->pdev;int i; +u16 cmd;for (i =0 ; i < vdev->num_ctx; i++) {vfio_virqfd_disable (&vdev->ctx[i].unmask);
@@ -384,7 +396,9 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix)vfio_msi_set_block (vdev,0 , vdev->num_ctx,NULL , msix); + cmd =vfio_pci_memory_lock_and_enable (vdev);pci_free_irq_vectors (pdev); +vfio_pci_memory_unlock_and_restore (vdev, cmd);/* * Both disable paths above use pci_intx_for_msi() to clear DisINTx
drivers/vfio/pci/vfio_pci_private.h +8 -0
@@ -129,6 +129,7 @@ struct vfio_pci_device {struct list_head ioeventfds_list;struct mutex vma_lock;struct list_head vma_list; +struct rw_semaphore memory_lock; };#define is_intx (vdev) (vdev->irq_type == VFIO_PCI_INTX_IRQ_INDEX)
@@ -171,6 +172,13 @@ extern int vfio_pci_register_dev_region(struct vfio_pci_device *vdev,extern int vfio_pci_set_power_state (struct vfio_pci_device *vdev,pci_power_t state); +extern bool __vfio_pci_memory_enabled (struct vfio_pci_device *vdev); +extern void vfio_pci_zap_and_down_write_memory_lock (struct vfio_pci_device + *vdev); +extern u16 vfio_pci_memory_lock_and_enable (struct vfio_pci_device *vdev); +extern void vfio_pci_memory_unlock_and_restore (struct vfio_pci_device *vdev, +u16 cmd); +#ifdef CONFIG_VFIO_PCI_IGD extern int vfio_pci_igd_init (struct vfio_pci_device *vdev);#else
drivers/vfio/pci/vfio_pci_rdwr.c +20 -4
@@ -162,6 +162,7 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf,size_t x_start =0 , x_end =0 ;resource_size_t end;void __iomem *io; +struct resource *res = &vdev->pdev->resource[bar];ssize_t done;if (pci_resource_start (pdev, bar))
@@ -177,6 +178,14 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, count =min (count, (size_t )(end - pos)); +if (res->flags &IORESOURCE_MEM ) { +down_read (&vdev->memory_lock); +if (!__vfio_pci_memory_enabled (vdev)) { +up_read (&vdev->memory_lock); +return -EIO ; + } + } +if (bar ==PCI_ROM_RESOURCE ) {/* * The ROM can fill less space than the BAR, so we start the
@@ -184,13 +193,17 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf,* filling large ROM BARs much faster. */ io =pci_map_rom (pdev, &x_start); -if (!io) -return -ENOMEM ; +if (!io) { + done = -ENOMEM ; + goto out; + } x_end = end; }else {int ret =vfio_pci_setup_barmap (vdev, bar); -if (ret) -return ret; +if (ret) { + done = ret; + goto out; + } io = vdev->barmap[bar]; }
@@ -207,6 +220,9 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf,if (bar ==PCI_ROM_RESOURCE )pci_unmap_rom (pdev, io); +out: +if (res->flags &IORESOURCE_MEM ) +up_read (&vdev->memory_lock);return done; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 76/129 iommu/vt-d: Handle 36bit addressing for x86-32
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 29aaebbca4abc4cceb38738483051abefafb6950 upstream.
Beware that the address size for x86-32 may exceed unsigned long.
[ 0.368971] UBSAN: shift-out-of-bounds in drivers/iommu/intel/iommu.c:128:14 [ 0.369055] shift exponent 36 is too large for 32-bit type 'long unsigned int'
If we don't handle the wide addresses, the pages are mismapped and the device read/writes go astray, detected as DMAR faults and leading to device failure. The behaviour changed (from working to broken) in commit fa954e683178 ("iommu/vt-d: Delegate the dma domain to upper layer"), but the error looks older.
--- drivers/iommu/intel-iommu.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/iommu/intel-iommu.c +7 -7
@@ -123,29 +123,29 @@ static inline unsigned int level_to_offsreturn (level -1 ) *LEVEL_STRIDE ; } -static inline int pfn_level_offset (unsigned long pfn,int level) +static inline int pfn_level_offset (u64 pfn,int level) {return (pfn >>level_to_offset_bits (level)) &LEVEL_MASK ; } -static inline unsigned long level_mask (int level) +static inline u64 level_mask (int level) { -return -1UL <<level_to_offset_bits (level); +return -1ULL <<level_to_offset_bits (level); } -static inline unsigned long level_size (int level) +static inline u64 level_size (int level) { -return 1UL <<level_to_offset_bits (level); +return 1ULL <<level_to_offset_bits (level); } -static inline unsigned long align_to_level (unsigned long pfn,int level) +static inline u64 align_to_level (u64 pfn,int level) {return (pfn +level_size (level) -1 ) &level_mask (level); }static inline unsigned long lvl_to_nr_pages (unsigned int lvl) { -return 1 <<min_t (int, (lvl -1 ) *LEVEL_STRIDE ,MAX_AGAW_PFN_WIDTH ); +return 1UL <<min_t (int, (lvl -1 ) *LEVEL_STRIDE ,MAX_AGAW_PFN_WIDTH ); }/* VT-d pages must always be _smaller_ than MM pages. Otherwise things
Greg Kroah-Hartman
maintainerPATCH 77/129 tracing/kprobes, x86/ptrace: Fix regs argument order for i386
In reply to Greg Kroah-HartmanFrom: Vamshi K Sthambamkadi <[email protected]>
commit 2356bb4b8221d7dc8c7beb810418122ed90254c9 upstream.
On i386, the order of parameters passed on regs is eax,edx,and ecx (as per regparm(3) calling conventions).
Change the mapping in regs_get_kernel_argument(), so that arg1=ax arg2=dx, and arg3=cx.
Running the selftests testcase kprobes_args_use.tc shows the result as passed.
--- arch/x86/include/asm/ptrace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/ptrace.h +1 -1
@@ -309,8 +309,8 @@ static inline unsigned long regs_get_kerstatic const unsigned int argument_offs[] = { #ifdef __i386__ offsetof(struct pt_regs , ax), - offsetof(struct pt_regs , cx), offsetof(struct pt_regs , dx), + offsetof(struct pt_regs , cx), #define NR_REG_ARGUMENTS 3 #else offsetof(struct pt_regs, di),
Greg Kroah-Hartman
maintainerPATCH 78/129 ext2: dont update mtime on COW faults
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 1ef6ea0efe8e68d0299dad44c39dc6ad9e5d1f39 upstream.
When running in a dax mode, if the user maps a page with MAP_PRIVATE and PROT_WRITE, the ext2 filesystem would incorrectly update ctime and mtime when the user hits a COW fault.
This breaks building of the Linux kernel. How to reproduce:
1. extract the Linux kernel tree on dax-mounted ext2 filesystem
2. run make clean
3. run make -j12
4. run make -j12
at step 4, make would incorrectly rebuild the whole kernel (although it was already built in step 3).
The reason for the breakage is that almost all object files depend on objtool. When we run objtool, it takes COW page fault on its .data section, and these faults will incorrectly update the timestamp of the objtool binary. The updated timestamp causes make to rebuild the whole tree.
--- fs/ext2/file.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ext2/file.c +4 -2
@@ -93,8 +93,10 @@ static vm_fault_t ext2_dax_fault(structstruct inode *inode =file_inode (vmf->vma->vm_file);struct ext2_inode_info *ei =EXT2_I (inode);vm_fault_t ret; +bool write = (vmf->flags &FAULT_FLAG_WRITE ) && + (vmf->vma->vm_flags &VM_SHARED ); -if (vmf->flags &FAULT_FLAG_WRITE ) { +if (write) {sb_start_pagefault (inode->i_sb);file_update_time (vmf->vma->vm_file); }
@@ -103,7 +105,7 @@ static vm_fault_t ext2_dax_fault(struct ret =dax_iomap_fault (vmf,PE_SIZE_PTE ,NULL ,NULL , &ext2_iomap_ops);up_read (&ei->dax_sem); -if (vmf->flags &FAULT_FLAG_WRITE ) +if (write)sb_end_pagefault (inode->i_sb);return ret; }
Greg Kroah-Hartman
maintainerPATCH 79/129 xfs: dont update mtime on COW faults
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit b17164e258e3888d376a7434415013175d637377 upstream.
When running in a dax mode, if the user maps a page with MAP_PRIVATE and PROT_WRITE, the xfs filesystem would incorrectly update ctime and mtime when the user hits a COW fault.
This breaks building of the Linux kernel. How to reproduce:
1. extract the Linux kernel tree on dax-mounted xfs filesystem
2. run make clean
3. run make -j12
4. run make -j12
at step 4, make would incorrectly rebuild the whole kernel (although it was already built in step 3).
The reason for the breakage is that almost all object files depend on objtool. When we run objtool, it takes COW page fault on its .data section, and these faults will incorrectly update the timestamp of the objtool binary. The updated timestamp causes make to rebuild the whole tree.
--- fs/xfs/xfs_file.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/xfs/xfs_file.c +10 -2
@@ -1172,6 +1172,14 @@ __xfs_filemap_fault(return ret; } +static inline bool +xfs_is_write_fault ( +struct vm_fault *vmf) +{ +return (vmf->flags &FAULT_FLAG_WRITE ) && + (vmf->vma->vm_flags &VM_SHARED ); +} +static vm_fault_t xfs_filemap_fault (struct vm_fault *vmf)
@@ -1179,7 +1187,7 @@ xfs_filemap_fault(/* DAX can shortcut the normal fault path on write faults! */ return __xfs_filemap_fault (vmf,PE_SIZE_PTE ,IS_DAX (file_inode (vmf->vma->vm_file)) && - (vmf->flags &FAULT_FLAG_WRITE )); +xfs_is_write_fault (vmf)); } static vm_fault_t
@@ -1192,7 +1200,7 @@ xfs_filemap_huge_fault(/* DAX can shortcut the normal fault path on write faults! */ return __xfs_filemap_fault (vmf, pe_size, - (vmf->flags &FAULT_FLAG_WRITE )); +xfs_is_write_fault (vmf)); } static vm_fault_t
Greg Kroah-Hartman
maintainerPATCH 80/129 ARC: perf: dont bail setup if pct irq missing in device-tree
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
commit feb92d7d3813456c11dce215b3421801a78a8986 upstream.
Current code inadventely bails if hardware supports sampling/overflow interrupts, but the irq is missing from device tree.
| | # perf stat -e cycles,instructions,major-faults,minor-faults ../hackbench | Running with 10 groups 400 process | Time: 0.921 | | Performance counter stats for '../hackbench': | | <not supported> cycles | <not supported> instructions | 0 major-faults | 8679 minor-faults
This need not be as we can still do simple counting based perf stat. This unborks perf on HSDK-4xD
--- arch/arc/kernel/perf_event.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
arch/arc/kernel/perf_event.c +4 -10
@@ -562,7 +562,7 @@ static int arc_pmu_device_probe(struct p {struct arc_reg_pct_build pct_bcr;struct arc_reg_cc_build cc_bcr; -int i, has_interrupts; +int i, has_interrupts, irq;int counter_size;/* in bits */ union cc_name {
@@ -637,13 +637,7 @@ static int arc_pmu_device_probe(struct p .attr_groups = arc_pmu->attr_groups, }; -if (has_interrupts) { -int irq =platform_get_irq (pdev,0 ); - -if (irq <0 ) { -pr_err ("Cannot get IRQ number for the platform\n" ); -return -ENODEV ; - } +if (has_interrupts && (irq =platform_get_irq (pdev,0 ) >=0 )) { arc_pmu->irq = irq;
@@ -652,9 +646,9 @@ static int arc_pmu_device_probe(struct p this_cpu_ptr(&arc_pmu_cpu));on_each_cpu (arc_cpu_pmu_irq_init, &irq,1 ); - - }else + }else { arc_pmu->pmu.capabilities |=PERF_PMU_CAP_NO_INTERRUPT ; + }/* * perf parser doesn't really like '-' symbol in events name, so let's
Greg Kroah-Hartman
maintainerPATCH 81/129 btrfs: drop path before adding new uuid tree entry
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 9771a5cf937129307d9f58922d60484d58ababe7 upstream.
With the conversion of the tree locks to rwsem I got the following lockdep splat:
======================================================
WARNING: possible circular locking dependency detected 5.8.0-rc7-00167-g0d7ba0c5b375-dirty #925 Not tainted
------------------------------------------------------
btrfs-uuid/7955 is trying to acquire lock:
ffff88bfbafec0f8 (btrfs-root-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180
but task is already holding lock:
ffff88bfbafef2a8 (btrfs-uuid-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (btrfs-uuid-00){++++}-{3:3}:
down_read_nested+0x3e/0x140 __btrfs_tree_read_lock+0x39/0x180 __btrfs_read_lock_root_node+0x3a/0x50 btrfs_search_slot+0x4bd/0x990 btrfs_uuid_tree_add+0x89/0x2d0 btrfs_uuid_scan_kthread+0x330/0x390 kthread+0x133/0x150 ret_from_fork+0x1f/0x30
-> #0 (btrfs-root-00){++++}-{3:3}:
__lock_acquire+0x1272/0x2310 lock_acquire+0x9e/0x360 down_read_nested+0x3e/0x140 __btrfs_tree_read_lock+0x39/0x180 __btrfs_read_lock_root_node+0x3a/0x50 btrfs_search_slot+0x4bd/0x990 btrfs_find_root+0x45/0x1b0 btrfs_read_tree_root+0x61/0x100 btrfs_get_root_ref.part.50+0x143/0x630 btrfs_uuid_tree_iterate+0x207/0x314 btrfs_uuid_rescan_kthread+0x12/0x50 kthread+0x133/0x150 ret_from_fork+0x1f/0x30
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(btrfs-uuid-00);
lock(btrfs-root-00);
lock(btrfs-uuid-00);
lock(btrfs-root-00);*** DEADLOCK ***
1 lock held by btrfs-uuid/7955:
#0: ffff88bfbafef2a8 (btrfs-uuid-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180
stack backtrace: CPU: 73 PID: 7955 Comm: btrfs-uuid Kdump: loaded Not tainted 5.8.0-rc7-00167-g0d7ba0c5b375-dirty #925 Hardware name: Quanta Tioga Pass Single Side 01-0030993006/Tioga Pass Single Side, BIOS F08_3A18 12/20/2018 Call Trace: dump_stack+0x78/0xa0 check_noncircular+0x165/0x180 __lock_acquire+0x1272/0x2310 lock_acquire+0x9e/0x360 ? __btrfs_tree_read_lock+0x39/0x180 ? btrfs_root_node+0x1c/0x1d0 down_read_nested+0x3e/0x140 ? __btrfs_tree_read_lock+0x39/0x180 __btrfs_tree_read_lock+0x39/0x180 __btrfs_read_lock_root_node+0x3a/0x50 btrfs_search_slot+0x4bd/0x990 btrfs_find_root+0x45/0x1b0 btrfs_read_tree_root+0x61/0x100 btrfs_get_root_ref.part.50+0x143/0x630 btrfs_uuid_tree_iterate+0x207/0x314 ? btree_readpage+0x20/0x20 btrfs_uuid_rescan_kthread+0x12/0x50 kthread+0x133/0x150 ? kthread_create_on_node+0x60/0x60 ret_from_fork+0x1f/0x30
This problem exists because we have two different rescan threads, btrfs_uuid_scan_kthread which creates the uuid tree, and btrfs_uuid_tree_iterate that goes through and updates or deletes any out of date roots. The problem is they both do things in different order. btrfs_uuid_scan_kthread() reads the tree_root, and then inserts entries into the uuid_root. btrfs_uuid_tree_iterate() scans the uuid_root, but then does a btrfs_get_fs_root() which can read from the tree_root.
It's actually easy enough to not be holding the path in btrfs_uuid_scan_kthread() when we add a uuid entry, as we already drop it further down and re-start the search when we loop. So simply move the path release before we add our entry to the uuid tree.
This also fixes a problem where we're holding a path open after we do btrfs_end_transaction(), which has it's own problems.
--- fs/btrfs/volumes.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/volumes.c +2 -1
@@ -4568,6 +4568,7 @@ static int btrfs_uuid_scan_kthread(void goto skip; } update_tree: +btrfs_release_path (path);if (!btrfs_is_empty_uuid (root_item.uuid)) { ret = btrfs_uuid_tree_add(trans, root_item.uuid, BTRFS_UUID_KEY_SUBVOL,
@@ -4592,6 +4593,7 @@ update_tree: } skip: +btrfs_release_path (path);if (trans) { ret =btrfs_end_transaction (trans); trans =NULL ;
@@ -4599,7 +4601,6 @@ skip:break ; } -btrfs_release_path (path);if (key.offset < (u64)-1 ) { key.offset++; }else if (key.type <BTRFS_ROOT_ITEM_KEY ) {
Greg Kroah-Hartman
maintainerPATCH 82/129 btrfs: allocate scrub workqueues outside of locks
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit e89c4a9c8e6ce3a84cab4f342687d3fbbb1234eb upstream.
I got the following lockdep splat while testing:
======================================================
WARNING: possible circular locking dependency detected 5.8.0-rc7-00172-g021118712e59 #932 Not tainted
------------------------------------------------------
btrfs/229626 is trying to acquire lock:
ffffffff828513f0 (cpu_hotplug_lock){++++}-{0:0}, at: alloc_workqueue+0x378/0x450
but task is already holding lock:
ffff889dd3889518 (&fs_info->scrub_lock){+.+.}-{3:3}, at: btrfs_scrub_dev+0x11c/0x630
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #7 (&fs_info->scrub_lock){+.+.}-{3:3}:
__mutex_lock+0x9f/0x930 btrfs_scrub_dev+0x11c/0x630 btrfs_dev_replace_by_ioctl.cold.21+0x10a/0x1d4 btrfs_ioctl+0x2799/0x30a0 ksys_ioctl+0x83/0xc0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x50/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
-> #6 (&fs_devs->device_list_mutex){+.+.}-{3:3}:
__mutex_lock+0x9f/0x930 btrfs_run_dev_stats+0x49/0x480 commit_cowonly_roots+0xb5/0x2a0 btrfs_commit_transaction+0x516/0xa60 sync_filesystem+0x6b/0x90 generic_shutdown_super+0x22/0x100 kill_anon_super+0xe/0x30 btrfs_kill_super+0x12/0x20 deactivate_locked_super+0x29/0x60 cleanup_mnt+0xb8/0x140 task_work_run+0x6d/0xb0 __prepare_exit_to_usermode+0x1cc/0x1e0 do_syscall_64+0x5c/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
-> #5 (&fs_info->tree_log_mutex){+.+.}-{3:3}:
__mutex_lock+0x9f/0x930 btrfs_commit_transaction+0x4bb/0xa60 sync_filesystem+0x6b/0x90 generic_shutdown_super+0x22/0x100 kill_anon_super+0xe/0x30 btrfs_kill_super+0x12/0x20 deactivate_locked_super+0x29/0x60 cleanup_mnt+0xb8/0x140 task_work_run+0x6d/0xb0 __prepare_exit_to_usermode+0x1cc/0x1e0 do_syscall_64+0x5c/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
-> #4 (&fs_info->reloc_mutex){+.+.}-{3:3}:
__mutex_lock+0x9f/0x930 btrfs_record_root_in_trans+0x43/0x70 start_transaction+0xd1/0x5d0 btrfs_dirty_inode+0x42/0xd0 touch_atime+0xa1/0xd0 btrfs_file_mmap+0x3f/0x60 mmap_region+0x3a4/0x640 do_mmap+0x376/0x580 vm_mmap_pgoff+0xd5/0x120 ksys_mmap_pgoff+0x193/0x230 do_syscall_64+0x50/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
-> #3 (&mm->mmap_lock#2){++++}-{3:3}:
__might_fault+0x68/0x90 _copy_to_user+0x1e/0x80 perf_read+0x141/0x2c0 vfs_read+0xad/0x1b0 ksys_read+0x5f/0xe0 do_syscall_64+0x50/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
-> #2 (&cpuctx_mutex){+.+.}-{3:3}:
__mutex_lock+0x9f/0x930 perf_event_init_cpu+0x88/0x150 perf_event_init+0x1db/0x20b start_kernel+0x3ae/0x53c secondary_startup_64+0xa4/0xb0
-> #1 (pmus_lock){+.+.}-{3:3}:
__mutex_lock+0x9f/0x930 perf_event_init_cpu+0x4f/0x150 cpuhp_invoke_callback+0xb1/0x900 _cpu_up.constprop.26+0x9f/0x130 cpu_up+0x7b/0xc0 bringup_nonboot_cpus+0x4f/0x60 smp_init+0x26/0x71 kernel_init_freeable+0x110/0x258 kernel_init+0xa/0x103 ret_from_fork+0x1f/0x30
-> #0 (cpu_hotplug_lock){++++}-{0:0}:
__lock_acquire+0x1272/0x2310 lock_acquire+0x9e/0x360 cpus_read_lock+0x39/0xb0 alloc_workqueue+0x378/0x450 __btrfs_alloc_workqueue+0x15d/0x200 btrfs_alloc_workqueue+0x51/0x160 scrub_workers_get+0x5a/0x170 btrfs_scrub_dev+0x18c/0x630 btrfs_dev_replace_by_ioctl.cold.21+0x10a/0x1d4 btrfs_ioctl+0x2799/0x30a0 ksys_ioctl+0x83/0xc0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x50/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
other info that might help us debug this:
Chain exists of:
cpu_hotplug_lock --> &fs_devs->device_list_mutex --> &fs_info->scrub_lock
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(&fs_info->scrub_lock);
lock(&fs_devs->device_list_mutex);
lock(&fs_info->scrub_lock);
lock(cpu_hotplug_lock);*** DEADLOCK ***
2 locks held by btrfs/229626:
#0: ffff88bfe8bb86e0 (&fs_devs->device_list_mutex){+.+.}-{3:3}, at: btrfs_scrub_dev+0xbd/0x630 #1: ffff889dd3889518 (&fs_info->scrub_lock){+.+.}-{3:3}, at: btrfs_scrub_dev+0x11c/0x630
stack backtrace: CPU: 15 PID: 229626 Comm: btrfs Kdump: loaded Not tainted 5.8.0-rc7-00172-g021118712e59 #932 Hardware name: Quanta Tioga Pass Single Side 01-0030993006/Tioga Pass Single Side, BIOS F08_3A18 12/20/2018 Call Trace: dump_stack+0x78/0xa0 check_noncircular+0x165/0x180 __lock_acquire+0x1272/0x2310 lock_acquire+0x9e/0x360 ? alloc_workqueue+0x378/0x450 cpus_read_lock+0x39/0xb0 ? alloc_workqueue+0x378/0x450 alloc_workqueue+0x378/0x450 ? rcu_read_lock_sched_held+0x52/0x80 __btrfs_alloc_workqueue+0x15d/0x200 btrfs_alloc_workqueue+0x51/0x160 scrub_workers_get+0x5a/0x170 btrfs_scrub_dev+0x18c/0x630 ? start_transaction+0xd1/0x5d0 btrfs_dev_replace_by_ioctl.cold.21+0x10a/0x1d4 btrfs_ioctl+0x2799/0x30a0 ? do_sigaction+0x102/0x250 ? lockdep_hardirqs_on_prepare+0xca/0x160 ? _raw_spin_unlock_irq+0x24/0x30 ? trace_hardirqs_on+0x1c/0xe0 ? _raw_spin_unlock_irq+0x24/0x30 ? do_sigaction+0x102/0x250 ? ksys_ioctl+0x83/0xc0 ksys_ioctl+0x83/0xc0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x50/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
This happens because we're allocating the scrub workqueues under the scrub and device list mutex, which brings in a whole host of other dependencies.
Because the work queue allocation is done with GFP_KERNEL, it can trigger reclaim, which can lead to a transaction commit, which in turns needs the device_list_mutex, it can lead to a deadlock. A different problem for which this fix is a solution.
Fix this by moving the actual allocation outside of the scrub lock, and then only take the lock once we're ready to actually assign them to the fs_info. We'll now have to cleanup the workqueues in a few more places, so I've added a helper to do the refcount dance to safely free the workqueues.
--- fs/btrfs/scrub.c | 122 +++++++++++++++++++++++++++++++------------------------ 1 file changed, 70 insertions(+), 52 deletions(-)
fs/btrfs/scrub.c +70 -52
@@ -3742,50 +3742,84 @@ static noinline_for_stack int scrub_supereturn 0 ; } +static void scrub_workers_put (struct btrfs_fs_info *fs_info) +{ +if (refcount_dec_and_mutex_lock (&fs_info->scrub_workers_refcnt, + &fs_info->scrub_lock)) { +struct btrfs_workqueue *scrub_workers =NULL ; +struct btrfs_workqueue *scrub_wr_comp =NULL ; +struct btrfs_workqueue *scrub_parity =NULL ; + + scrub_workers = fs_info->scrub_workers; + scrub_wr_comp = fs_info->scrub_wr_completion_workers; + scrub_parity = fs_info->scrub_parity_workers; + + fs_info->scrub_workers =NULL ; + fs_info->scrub_wr_completion_workers =NULL ; + fs_info->scrub_parity_workers =NULL ; +mutex_unlock (&fs_info->scrub_lock); + +btrfs_destroy_workqueue (scrub_workers); +btrfs_destroy_workqueue (scrub_wr_comp); +btrfs_destroy_workqueue (scrub_parity); + } +} +/* * get a reference count on fs_info->scrub_workers. start worker if necessary */ static noinline_for_stack int scrub_workers_get(struct btrfs_fs_info *fs_info,int is_dev_replace) { +struct btrfs_workqueue *scrub_workers =NULL ; +struct btrfs_workqueue *scrub_wr_comp =NULL ; +struct btrfs_workqueue *scrub_parity =NULL ;unsigned int flags =WQ_FREEZABLE |WQ_UNBOUND ;int max_active = fs_info->thread_pool_size; +int ret = -ENOMEM ; -lockdep_assert_held (&fs_info->scrub_lock); +if (refcount_inc_not_zero (&fs_info->scrub_workers_refcnt)) +return 0 ; -if (refcount_read (&fs_info->scrub_workers_refcnt) ==0 ) { -ASSERT (fs_info->scrub_workers ==NULL ); - fs_info->scrub_workers =btrfs_alloc_workqueue (fs_info,"scrub" , - flags, is_dev_replace ?1 : max_active,4 ); -if (!fs_info->scrub_workers) - goto fail_scrub_workers; - -ASSERT (fs_info->scrub_wr_completion_workers ==NULL ); - fs_info->scrub_wr_completion_workers = -btrfs_alloc_workqueue (fs_info,"scrubwrc" , flags, - max_active,2 ); -if (!fs_info->scrub_wr_completion_workers) - goto fail_scrub_wr_completion_workers; + scrub_workers =btrfs_alloc_workqueue (fs_info,"scrub" , flags, + is_dev_replace ?1 : max_active,4 ); +if (!scrub_workers) + goto fail_scrub_workers; -ASSERT (fs_info->scrub_parity_workers ==NULL ); - fs_info->scrub_parity_workers = -btrfs_alloc_workqueue (fs_info,"scrubparity" , flags, + scrub_wr_comp =btrfs_alloc_workqueue (fs_info,"scrubwrc" , flags, max_active,2 ); -if (!fs_info->scrub_parity_workers) - goto fail_scrub_parity_workers; +if (!scrub_wr_comp) + goto fail_scrub_wr_completion_workers; + scrub_parity =btrfs_alloc_workqueue (fs_info,"scrubparity" , flags, + max_active,2 ); +if (!scrub_parity) + goto fail_scrub_parity_workers; + +mutex_lock (&fs_info->scrub_lock); +if (refcount_read (&fs_info->scrub_workers_refcnt) ==0 ) { +ASSERT (fs_info->scrub_workers ==NULL && + fs_info->scrub_wr_completion_workers ==NULL && + fs_info->scrub_parity_workers ==NULL ); + fs_info->scrub_workers = scrub_workers; + fs_info->scrub_wr_completion_workers = scrub_wr_comp; + fs_info->scrub_parity_workers = scrub_parity;refcount_set (&fs_info->scrub_workers_refcnt,1 ); - }else { -refcount_inc (&fs_info->scrub_workers_refcnt); +mutex_unlock (&fs_info->scrub_lock); +return 0 ; } -return 0 ; +/* Other thread raced in and created the workers for us */ +refcount_inc (&fs_info->scrub_workers_refcnt); +mutex_unlock (&fs_info->scrub_lock); + ret =0 ; +btrfs_destroy_workqueue (scrub_parity); fail_scrub_parity_workers: -btrfs_destroy_workqueue (fs_info->scrub_wr_completion_workers); +btrfs_destroy_workqueue (scrub_wr_comp); fail_scrub_wr_completion_workers: -btrfs_destroy_workqueue (fs_info->scrub_workers); +btrfs_destroy_workqueue (scrub_workers); fail_scrub_workers: -return -ENOMEM ; +return ret; } int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
@@ -3796,9 +3830,6 @@ int btrfs_scrub_dev(struct btrfs_fs_infoint ret;struct btrfs_device *dev;unsigned int nofs_flag; -struct btrfs_workqueue *scrub_workers =NULL ; -struct btrfs_workqueue *scrub_wr_comp =NULL ; -struct btrfs_workqueue *scrub_parity =NULL ;if (btrfs_fs_closing (fs_info))return -EAGAIN ;
@@ -3845,13 +3876,17 @@ int btrfs_scrub_dev(struct btrfs_fs_infoif (IS_ERR (sctx))return PTR_ERR (sctx); + ret =scrub_workers_get (fs_info, is_dev_replace); +if (ret) + goto out_free_ctx; +mutex_lock (&fs_info->fs_devices->device_list_mutex); dev =btrfs_find_device (fs_info->fs_devices, devid,NULL ,NULL , true);if (!dev || (test_bit (BTRFS_DEV_STATE_MISSING , &dev->dev_state) && !is_dev_replace)) {mutex_unlock (&fs_info->fs_devices->device_list_mutex); ret = -ENODEV ; - goto out_free_ctx; + goto out; } if (!is_dev_replace && !readonly &&
@@ -3860,7 +3895,7 @@ int btrfs_scrub_dev(struct btrfs_fs_infobtrfs_err_in_rcu (fs_info,"scrub: device %s is not writable" ,rcu_str_deref (dev->name)); ret = -EROFS ; - goto out_free_ctx; + goto out; }mutex_lock (&fs_info->scrub_lock);
@@ -3869,7 +3904,7 @@ int btrfs_scrub_dev(struct btrfs_fs_infomutex_unlock (&fs_info->scrub_lock);mutex_unlock (&fs_info->fs_devices->device_list_mutex); ret = -EIO ; - goto out_free_ctx; + goto out; }down_read (&fs_info->dev_replace.rwsem);
@@ -3880,17 +3915,10 @@ int btrfs_scrub_dev(struct btrfs_fs_infomutex_unlock (&fs_info->scrub_lock);mutex_unlock (&fs_info->fs_devices->device_list_mutex); ret = -EINPROGRESS ; - goto out_free_ctx; + goto out; }up_read (&fs_info->dev_replace.rwsem); - ret =scrub_workers_get (fs_info, is_dev_replace); -if (ret) { -mutex_unlock (&fs_info->scrub_lock); -mutex_unlock (&fs_info->fs_devices->device_list_mutex); - goto out_free_ctx; - } - sctx->readonly = readonly; dev->scrub_ctx = sctx;mutex_unlock (&fs_info->fs_devices->device_list_mutex);
@@ -3943,24 +3971,14 @@ int btrfs_scrub_dev(struct btrfs_fs_infomutex_lock (&fs_info->scrub_lock); dev->scrub_ctx =NULL ; -if (refcount_dec_and_test (&fs_info->scrub_workers_refcnt)) { - scrub_workers = fs_info->scrub_workers; - scrub_wr_comp = fs_info->scrub_wr_completion_workers; - scrub_parity = fs_info->scrub_parity_workers; - - fs_info->scrub_workers =NULL ; - fs_info->scrub_wr_completion_workers =NULL ; - fs_info->scrub_parity_workers =NULL ; - }mutex_unlock (&fs_info->scrub_lock); -btrfs_destroy_workqueue (scrub_workers); -btrfs_destroy_workqueue (scrub_wr_comp); -btrfs_destroy_workqueue (scrub_parity); +scrub_workers_put (fs_info);scrub_put_ctx (sctx);return ret; - +out: +scrub_workers_put (fs_info); out_free_ctx:scrub_free_ctx (sctx);
Greg Kroah-Hartman
maintainerPATCH 83/129 btrfs: set the correct lockdep class for new nodes
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit ad24466588ab7d7c879053c5afd919b0c555fec0 upstream.
When flipping over to the rw_semaphore I noticed I'd get a lockdep splat in replace_path(), which is weird because we're swapping the reloc root with the actual target root. Turns out this is because we're using the root->root_key.objectid as the root id for the newly allocated tree block when setting the lockdep class, however we need to be using the actual owner of this new block, which is saved in owner.
The affected path is through btrfs_copy_root as all other callers of btrfs_alloc_tree_block (which calls init_new_buffer) have root_objectid == root->root_key.objectid .
--- fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/extent-tree.c +1 -1
@@ -4446,7 +4446,7 @@ btrfs_init_new_buffer(struct btrfs_transreturn ERR_PTR (-EUCLEAN ); } -btrfs_set_buffer_lockdep_class (root->root_key.objectid, buf, level); +btrfs_set_buffer_lockdep_class (owner, buf, level);btrfs_tree_lock (buf);btrfs_clean_tree_block (buf);clear_bit (EXTENT_BUFFER_STALE , &buf->bflags);
Greg Kroah-Hartman
maintainerPATCH 84/129 btrfs: set the lockdep class for log tree extent buffers
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit d3beaa253fd6fa40b8b18a216398e6e5376a9d21 upstream.
These are special extent buffers that get rewound in order to lookup the state of the tree at a specific point in time. As such they do not go through the normal initialization paths that set their lockdep class, so handle them appropriately when they are created and before they are locked.
--- fs/btrfs/ctree.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/btrfs/ctree.c +5 -1
@@ -1339,6 +1339,8 @@ tree_mod_log_rewind(struct btrfs_fs_infobtrfs_tree_read_unlock_blocking (eb);free_extent_buffer (eb); +btrfs_set_buffer_lockdep_class (btrfs_header_owner (eb_rewin), + eb_rewin,btrfs_header_level (eb_rewin));btrfs_tree_read_lock (eb_rewin);__tree_mod_log_rewind (fs_info, eb_rewin, time_seq, tm); WARN_ON(btrfs_header_nritems(eb_rewin) >
@@ -1412,7 +1414,6 @@ get_old_root(struct btrfs_root *root, u6if (!eb)return NULL ; -btrfs_tree_read_lock (eb);if (old_root) {btrfs_set_header_bytenr (eb, eb->start);btrfs_set_header_backref_rev (eb,BTRFS_MIXED_BACKREF_REV );
@@ -1420,6 +1421,9 @@ get_old_root(struct btrfs_root *root, u6btrfs_set_header_level (eb, old_root->level);btrfs_set_header_generation (eb, old_generation); } +btrfs_set_buffer_lockdep_class (btrfs_header_owner (eb), eb, +btrfs_header_level (eb)); +btrfs_tree_read_lock (eb);if (tm)__tree_mod_log_rewind (fs_info, eb, time_seq, tm);else
Greg Kroah-Hartman
maintainerPATCH 85/129 btrfs: tree-checker: fix the error message for transid error
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit f96d6960abbc52e26ad124e69e6815283d3e1674 upstream.
The error message for inode transid is the same as for inode generation, which makes us unable to detect the real problem.
--- fs/btrfs/tree-checker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/tree-checker.c +1 -1
@@ -772,7 +772,7 @@ static int check_inode_item(struct exten/* Here we use super block generation + 1 to handle log tree */ if (btrfs_inode_generation (leaf, iitem) > super_gen +1 ) {inode_item_err (fs_info, leaf, slot, -"invalid inode generation: has %llu expect (0, %llu]" , +"invalid inode transid: has %llu expect [0, %llu]" ,btrfs_inode_generation (leaf, iitem), super_gen +1 );return -EUCLEAN ;
Greg Kroah-Hartman
maintainerPATCH 86/129 net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
commit 6570bc79c0dfff0f228b7afd2de720fb4e84d61d upstream.
Commit 323ebb61e32b4 ("net: use listified RX for handling GRO_NORMAL skbs") made use of listified skb processing for the users of napi_gro_frags().
The same technique can be used in a way more common napi_gro_receive() to speed up non-merged (GRO_NORMAL) skbs for a wide range of drivers including gro_cells and mac80211 users.
This slightly changes the return value in cases where skb is being dropped by the core stack, but it seems to have no impact on related drivers' functionality.gro_normal_batch is left untouched as it's very individual for every single system configuration and might be tuned in manual order to achieve an optimal performance.
--- net/core/dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/core/dev.c +5 -4
@@ -5602,12 +5602,13 @@ static void napi_skb_free_stolen_head(stkmem_cache_free (skbuff_head_cache, skb); } -static gro_result_t napi_skb_finish (gro_result_t ret,struct sk_buff *skb) +static gro_result_t napi_skb_finish (struct napi_struct *napi, +struct sk_buff *skb, +gro_result_t ret) {switch (ret) {case GRO_NORMAL : -if (netif_receive_skb_internal (skb)) - ret =GRO_DROP ; +gro_normal_one (napi, skb);break ;case GRO_DROP :
@@ -5639,7 +5640,7 @@ gro_result_t napi_gro_receive(struct napskb_gro_reset_offset (skb); - ret =napi_skb_finish (dev_gro_receive (napi, skb), skb); + ret =napi_skb_finish (napi, skb,dev_gro_receive (napi, skb));trace_napi_gro_receive_exit (ret);return ret;
Re: [PATCH 5.4 086/129] net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()
Quoted 17 lines · Greg Kroah-Hartman
From: Alexander Lobakin <[email protected]>
commit
6570bc79c0dfff0f228b7afd2de720fb4e84d61dupstream.Commit
323ebb61e32b4("net: use listified RX for handlingGRO_NORMALskbs") made use of listified skb processing for the users ofnapi_gro_frags().
The same technique can be used in a way more commonnapi_gro_receive()to speed up non-merged (GRO_NORMAL) skbs for a wide range of drivers includinggro_cellsand mac80211 users.
This slightly changes the return value in cases where skb is being dropped by the core stack, but it seems to have no impact on related drivers' functionality.gro_normal_batchis left untouched as it's very individual for every single system configuration and might be tuned in manual order to achieve an optimal performance.
Quoted 5 lines
Signed-off-by Alexander Lobakin <[email protected]>Acked-by Edward Cree <[email protected]>Signed-off-by David S. Miller <[email protected]>Signed-off-by Hyunsoon Kim <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
I'm not quite sure why this is stable material(it's a performance enhancement, rather than a fix). But if you do want to take it,
make sure you've also gotc80794323e82 ("net: Fix packet reordering caused by GRO and listified RX cooperation") b167191e2a85 ("net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling") in your tree, particularly the latter as without it this commit triggers a severe regression in iwlwifi.
-ed
Greg Kroah-Hartman
maintainerRe: [PATCH 5.4 086/129] net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()
Quoted 23 lines · Edward Cree
Quoted 17 lines · Greg Kroah-Hartman
From: Alexander Lobakin <[email protected]>
commit
6570bc79c0dfff0f228b7afd2de720fb4e84d61dupstream.Commit
323ebb61e32b4("net: use listified RX for handlingGRO_NORMALskbs") made use of listified skb processing for the users ofnapi_gro_frags().
The same technique can be used in a way more commonnapi_gro_receive()to speed up non-merged (GRO_NORMAL) skbs for a wide range of drivers includinggro_cellsand mac80211 users.
This slightly changes the return value in cases where skb is being dropped by the core stack, but it seems to have no impact on related drivers' functionality.gro_normal_batchis left untouched as it's very individual for every single system configuration and might be tuned in manual order to achieve an optimal performance.Quoted 5 lines
Signed-off-by Alexander Lobakin <[email protected]>Acked-by Edward Cree <[email protected]>Signed-off-by David S. Miller <[email protected]>Signed-off-by Hyunsoon Kim <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 7 lines
I'm not quite sure why this is stable
material(it's a performance enhancement, rather than a fix). But if you do want to take it,
make sure you've also gotc80794323e82("net: Fix packet reordering caused by GRO and listified RX cooperation")b167191e2a85("net: wireless: intel: iwlwifi: fixGRO_NORMALpacket stalling") in your tree, particularly the latter as without it this commit triggers a severe regression in iwlwifi.
Hm, that feels bad, I'll go drop this for now.
Hyunsoon was the one who asked for this, so I will let them defend the request. I thought they were asking for this because it was a bug fix, but if it is a performance issue, that's fine as long as it doesn't also cause problems :)
Hyunsoon, should all of these be taken, and if so, what exactly is the performance increase here?
thanks,
greg k-h
A message that is not in the archive (sent off-list or not yet received): CGME20200909063710epcas2p340688acd14fad9e0fe53a66d06fd14a7@epcms2p4
A message that is not in the archive (sent off-list or not yet received): 20200909072101epcms2p457639b69a22434d140c01aeecd3ef46e@epcms2p4
Greg Kroah-Hartman
maintainerRe: Re: [PATCH 5.4 086/129] net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()
Quoted 24 lines · 김현순
Dear Greg,
I didn't intent to gain performance from this patch. Indeed i requested this patch to resolve the bug we are experiencing.
Different from kernel 4.19, napi gro made additional data structure called
rx_list, and for some reason, the list is always used afternapi_gro_flush, which is intended to be created to flush all gro (both merged and non-merged) packets to network stack. Network packets received from network interface are passed torx_listonce, and therx_listis later flushed to network stack. However, on the other hand,napi_gro_receivedoesn't insert packet torx_list. Instead, it flushes to network stack directly. This causes out of order because there might be some packets inrx_list(which has groups of packets that are not flushed to network stack yet). If the packet from the same stream remains inrx_list, andnapi_gro_receiveon next packet (from the same stream) is called, this posterior packet will arrive to network stack first, which causes out of order.
Quoted 2 lines
And two patches mentioned by Edward are already in the branch. The patch i am requesting is somewhat missing in android kernel, not sure the reason why.
Ah, you are right, this is odd. Edward, those patches are already in the 5.4.y tree, which makes this patch not being present odd.
I'll go add it back....
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 87/129 btrfs: fix potential deadlock in the search ioctl
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit a48b73eca4ceb9b8a4b97f290a065335dbcd8a04 ]
With the conversion of the tree locks to rwsem I got the following lockdep splat:
======================================================
WARNING: possible circular locking dependency detected 5.8.0-rc7-00165-g04ec4da5f45f-dirty #922 Not tainted
------------------------------------------------------
compsize/11122 is trying to acquire lock:
ffff889fabca8768 (&mm->mmap_lock#2){++++}-{3:3}, at: __might_fault+0x3e/0x90
but task is already holding lock:
ffff889fe720fe40 (btrfs-fs-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (btrfs-fs-00){++++}-{3:3}:
down_write_nested+0x3b/0x70 __btrfs_tree_lock+0x24/0x120 btrfs_search_slot+0x756/0x990 btrfs_lookup_inode+0x3a/0xb4 __btrfs_update_delayed_inode+0x93/0x270 btrfs_async_run_delayed_root+0x168/0x230 btrfs_work_helper+0xd4/0x570 process_one_work+0x2ad/0x5f0 worker_thread+0x3a/0x3d0 kthread+0x133/0x150 ret_from_fork+0x1f/0x30
-> #1 (&delayed_node->mutex){+.+.}-{3:3}:
__mutex_lock+0x9f/0x930 btrfs_delayed_update_inode+0x50/0x440 btrfs_update_inode+0x8a/0xf0 btrfs_dirty_inode+0x5b/0xd0 touch_atime+0xa1/0xd0 btrfs_file_mmap+0x3f/0x60 mmap_region+0x3a4/0x640 do_mmap+0x376/0x580 vm_mmap_pgoff+0xd5/0x120 ksys_mmap_pgoff+0x193/0x230 do_syscall_64+0x50/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
-> #0 (&mm->mmap_lock#2){++++}-{3:3}:
__lock_acquire+0x1272/0x2310 lock_acquire+0x9e/0x360 __might_fault+0x68/0x90 _copy_to_user+0x1e/0x80 copy_to_sk.isra.32+0x121/0x300 search_ioctl+0x106/0x200 btrfs_ioctl_tree_search_v2+0x7b/0xf0 btrfs_ioctl+0x106f/0x30a0 ksys_ioctl+0x83/0xc0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x50/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
other info that might help us debug this:
Chain exists of:
&mm->mmap_lock#2 --> &delayed_node->mutex --> btrfs-fs-00
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(btrfs-fs-00);
lock(&delayed_node->mutex);
lock(btrfs-fs-00);
lock(&mm->mmap_lock#2);*** DEADLOCK ***
1 lock held by compsize/11122:
#0: ffff889fe720fe40 (btrfs-fs-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180
stack backtrace: CPU: 17 PID: 11122 Comm: compsize Kdump: loaded Not tainted 5.8.0-rc7-00165-g04ec4da5f45f-dirty #922 Hardware name: Quanta Tioga Pass Single Side 01-0030993006/Tioga Pass Single Side, BIOS F08_3A18 12/20/2018 Call Trace: dump_stack+0x78/0xa0 check_noncircular+0x165/0x180 __lock_acquire+0x1272/0x2310 lock_acquire+0x9e/0x360 ? __might_fault+0x3e/0x90 ? find_held_lock+0x72/0x90 __might_fault+0x68/0x90 ? __might_fault+0x3e/0x90 _copy_to_user+0x1e/0x80 copy_to_sk.isra.32+0x121/0x300 ? btrfs_search_forward+0x2a6/0x360 search_ioctl+0x106/0x200 btrfs_ioctl_tree_search_v2+0x7b/0xf0 btrfs_ioctl+0x106f/0x30a0 ? __do_sys_newfstat+0x5a/0x70 ? ksys_ioctl+0x83/0xc0 ksys_ioctl+0x83/0xc0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x50/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xa9
The problem is we're doing a copy_to_user() while holding tree locks, which can deadlock if we have to do a page fault for the copy_to_user(). This exists even without my locking changes, so it needs to be fixed. Rework the search ioctl to do the pre-fault and then copy_to_user_nofault for the copying.
--- fs/btrfs/extent_io.c | 8 ++++---- fs/btrfs/extent_io.h | 6 +++--- fs/btrfs/ioctl.c | 27 ++++++++++++++++++++------- 3 files changed, 27 insertions(+), 14 deletions(-)
fs/btrfs/extent_io.c +4 -4
@@ -5607,9 +5607,9 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv, } } -int read_extent_buffer_to_user (const struct extent_buffer *eb, -void __user *dstv, -unsigned long start,unsigned long len) +int read_extent_buffer_to_user_nofault (const struct extent_buffer *eb, +void __user *dstv, +unsigned long start,unsigned long len) {size_t cur;size_t offset;
@@ -5630,7 +5630,7 @@ int read_extent_buffer_to_user(const struct extent_buffer *eb, cur =min (len, (PAGE_SIZE - offset)); kaddr =page_address (page); -if (copy_to_user (dst, kaddr + offset, cur)) { +if (probe_user_write (dst, kaddr + offset, cur)) { ret = -EFAULT ;break ; }
fs/btrfs/extent_io.h +3 -3
@@ -457,9 +457,9 @@ int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv,void read_extent_buffer (const struct extent_buffer *eb,void *dst,unsigned long start,unsigned long len); -int read_extent_buffer_to_user (const struct extent_buffer *eb, -void __user *dst,unsigned long start, -unsigned long len); +int read_extent_buffer_to_user_nofault (const struct extent_buffer *eb, +void __user *dst,unsigned long start, +unsigned long len);void write_extent_buffer_fsid (struct extent_buffer *eb,const void *src);void write_extent_buffer_chunk_tree_uuid (struct extent_buffer *eb,const void *src);
fs/btrfs/ioctl.c +20 -7
@@ -2105,9 +2105,14 @@ static noinline int copy_to_sk(struct btrfs_path *path, sh.len = item_len; sh.transid = found_transid; -/* copy search result header */ -if (copy_to_user (ubuf + *sk_offset, &sh,sizeof (sh))) { - ret = -EFAULT ; +/* +* Copy search result header. If we fault then loop again so we +* can fault in the pages and -EFAULT there if there's a +* problem. Otherwise we'll fault and then copy the buffer in +* properly this next time through +*/ +if (probe_user_write (ubuf + *sk_offset, &sh,sizeof (sh))) { + ret =0 ; goto out; }
@@ -2115,10 +2120,14 @@ static noinline int copy_to_sk(struct btrfs_path *path,if (item_len) {char __user *up = ubuf + *sk_offset; -/* copy the item */ -if (read_extent_buffer_to_user (leaf, up, - item_off, item_len)) { - ret = -EFAULT ; +/* +* Copy the item, same behavior as above, but reset the +* * sk_offset so we copy the full thing again. +*/ +if (read_extent_buffer_to_user_nofault (leaf, up, + item_off, item_len)) { + ret =0 ; + *sk_offset -=sizeof (sh); goto out; }
@@ -2206,6 +2215,10 @@ static noinline int search_ioctl(struct inode *inode, key.offset = sk->min_offset;while (1 ) { + ret =fault_in_pages_writeable (ubuf, *buf_size - sk_offset); +if (ret) +break ; + ret =btrfs_search_forward (root, &key, path, sk->min_transid);if (ret !=0 ) {if (ret >0 )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 88/129 Revert "net: dsa: microchip: set the correct number of ports"
In reply to Greg Kroah-HartmanThis reverts commit d55dad8b1d893fae0c4e778abf2ace048bcbad86.
Upstream commit af199a1a9cb0 ("net: dsa: microchip: set the correct number of ports") seems to have been applied twice on top of the 5.4 branch. This revert the second instance of said commit.
--- drivers/net/dsa/microchip/ksz8795.c | 3 --- drivers/net/dsa/microchip/ksz9477.c | 3 --- 2 files changed, 6 deletions(-)
drivers/net/dsa/microchip/ksz8795.c +0 -3
@@ -1270,9 +1270,6 @@ static int ksz8795_switch_init(struct ksz_device *dev)/* set the real number of ports */ dev->ds->num_ports = dev->port_cnt; -/* set the real number of ports */ - dev->ds->num_ports = dev->port_cnt; -return 0 ; }
drivers/net/dsa/microchip/ksz9477.c +0 -3
@@ -515,9 +515,6 @@ static int ksz9477_port_vlan_filtering(struct dsa_switch *ds, int port, PORT_VLAN_LOOKUP_VID_0, false); } -/* set the real number of ports */ - dev->ds->num_ports = dev->port_cnt; -return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 89/129 Revert "ALSA: hda: Add support for Loongson 7A1000 controller"
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
commit eed8f88b109aa927fbf0d0c80ff9f8d00444ca7f upstream.
This reverts commit 61eee4a7fc40 ("ALSA: hda: Add support for Loongson 7A1000 controller") to fix the following error on the Loongson LS7A platform:
rcu: INFO: rcu_preempt self-detected stall on CPU <SNIP> NMI backtrace for cpu 0 CPU: 0 PID: 68 Comm: kworker/0:2 Not tainted 5.8.0+ #3 Hardware name: , BIOS Workqueue: events azx_probe_work [snd_hda_intel] <SNIP> Call Trace: [<ffffffff80211a64>] show_stack+0x9c/0x130 [<ffffffff8065a740>] dump_stack+0xb0/0xf0 [<ffffffff80665774>] nmi_cpu_backtrace+0x134/0x140 [<ffffffff80665910>] nmi_trigger_cpumask_backtrace+0x190/0x200 [<ffffffff802b1abc>] rcu_dump_cpu_stacks+0x12c/0x190 [<ffffffff802b08cc>] rcu_sched_clock_irq+0xa2c/0xfc8 [<ffffffff802b91d4>] update_process_times+0x2c/0xb8 [<ffffffff802cad80>] tick_sched_timer+0x40/0xb8 [<ffffffff802ba5f0>] __hrtimer_run_queues+0x118/0x1d0 [<ffffffff802bab74>] hrtimer_interrupt+0x12c/0x2d8 [<ffffffff8021547c>] c0_compare_interrupt+0x74/0xa0 [<ffffffff80296bd0>] __handle_irq_event_percpu+0xa8/0x198 [<ffffffff80296cf0>] handle_irq_event_percpu+0x30/0x90 [<ffffffff8029d958>] handle_percpu_irq+0x88/0xb8 [<ffffffff80296124>] generic_handle_irq+0x44/0x60 [<ffffffff80b3cfd0>] do_IRQ+0x18/0x28 [<ffffffff8067ace4>] plat_irq_dispatch+0x64/0x100 [<ffffffff80209a20>] handle_int+0x140/0x14c [<ffffffff802402e8>] irq_exit+0xf8/0x100
Because AZX_DRIVER_GENERIC can not work well for Loongson LS7A HDA controller, it needs some workarounds which are not merged into the upstream kernel at this time, so it should revert this patch now.
--- sound/pci/hda/hda_intel.c | 2 -- 1 file changed, 2 deletions(-)
sound/pci/hda/hda_intel.c +0 -2
@@ -2671,8 +2671,6 @@ static const struct pci_device_id azx_id .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_HDMI },/* Zhaoxin */ { PCI_DEVICE(0x1d17, 0x3288), .driver_data = AZX_DRIVER_ZHAOXIN }, - /* Loongson */ - { PCI_DEVICE(0x0014, 0x7a07), .driver_data = AZX_DRIVER_GENERIC }, { 0, } };MODULE_DEVICE_TABLE (pci, azx_ids);
Greg Kroah-Hartman
maintainerPATCH 90/129 ALSA: ca0106: fix error code handling
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
commit ee0761d1d8222bcc5c86bf10849dc86cf008557c upstream.
snd_ca0106_spi_write() returns 1 on error, snd_ca0106_pcm_power_dac() is returning the error code directly, and the caller is expecting an negative error code
--- sound/pci/ca0106/ca0106_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/ca0106/ca0106_main.c +2 -1
@@ -537,7 +537,8 @@ static int snd_ca0106_pcm_power_dac(struelse /* Power down */ chip->spi_dac_reg[reg] |= bit; -return snd_ca0106_spi_write (chip, chip->spi_dac_reg[reg]); +if (snd_ca0106_spi_write (chip, chip->spi_dac_reg[reg]) !=0 ) +return -ENXIO ; }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 91/129 ALSA: usb-audio: Add implicit feedback quirk for UR22C
In reply to Greg Kroah-HartmanFrom: Joshua Sivec <[email protected]>
commit 7c5b892e0871655fea3294ffac6fa3cc3400b60d upstream.
This uses the same quirk as the Motu and SSL2 devices. Tested on the UR22C.
Fixes bug 208851.
--- sound/usb/pcm.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/pcm.c +1 -0
@@ -356,6 +356,7 @@ static int set_sync_ep_implicit_fb_quirkcase USB_ID (0x07fd ,0x0008 ):/* MOTU M Series */ case USB_ID (0x31e9 ,0x0001 ):/* Solid State Logic SSL2 */ case USB_ID (0x31e9 ,0x0002 ):/* Solid State Logic SSL2+ */ +case USB_ID (0x0499 ,0x172f ):/* Steinberg UR22C */ case USB_ID (0x0d9a ,0x00df ):/* RTX6001 */ ep =0x81 ; ifnum =2 ;
Greg Kroah-Hartman
maintainerPATCH 92/129 ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 949a1ebe8cea7b342085cb6a4946b498306b9493 upstream.
The PCM OSS mulaw plugin has a check of the format of the counter part whether it's a linear format. The check is with snd_BUG_ON() that emits WARN_ON() when the debug config is set, and it confuses syzkaller as if it were a serious issue. Let's drop snd_BUG_ON() for avoiding that.
While we're at it, correct the error code to a more suitable, EINVAL.
--- sound/core/oss/mulaw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/oss/mulaw.c +2 -2
@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snsnd_BUG ();return -EINVAL ; } -if (snd_BUG_ON (!snd_pcm_format_linear (format->format))) -return -ENXIO ; +if (!snd_pcm_format_linear (format->format)) +return -EINVAL ; err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion", src_format, dst_format,
Greg Kroah-Hartman
maintainerPATCH 93/129 ALSA: hda/hdmi: always check pin power status in i915 pin fixup
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
commit 858e0ad9301d1270c02b5aca97537d2d6ee9dd68 upstream.
When system is suspended with active audio playback to HDMI/DP, two alternative sequences can happen at resume:
a) monitor is detected first and ALSA prepare follows normal stream setup sequence, or
b) ALSA prepare is called first, but monitor is not yet detected, so PCM is restarted without a pin,
In case of (b), on i915 systems, haswell_verify_D0() is not called at resume and the pin power state may be incorrect. Result is lack of audio after resume with no error reported back to user-space.
Fix the problem by always verifying converter and pin state in the i915_pin_cvt_fixup().
--- sound/pci/hda/patch_hdmi.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_hdmi.c +1 -0
@@ -2798,6 +2798,7 @@ static void i915_pin_cvt_fixup(struct hd hda_nid_t cvt_nid) {if (per_pin) { +haswell_verify_D0 (codec, per_pin->cvt_nid, per_pin->pin_nid);snd_hda_set_dev_select (codec, per_pin->pin_nid, per_pin->dev_id);intel_verify_pin_cvt_connect (codec, per_pin);
Greg Kroah-Hartman
maintainerPATCH 94/129 ALSA: firewire-digi00x: exclude Avid Adrenaline from detection
In reply to Greg Kroah-HartmanFrom: Takashi Sakamoto <[email protected]>
commit acd46a6b6de88569654567810acad2b0a0a25cea upstream.
Avid Adrenaline is reported that ALSA firewire-digi00x driver is bound to. However, as long as he investigated, the design of this model is hardly similar to the one of Digi 00x family. It's better to exclude the model from modalias of ALSA firewire-digi00x driver.
This commit changes device entries so that the model is excluded.
$ python3 crpp < ~/git/am-config-rom/misc/avid-adrenaline.img
ROM header and bus information block
-----------------------------------------------------------------
400 04203a9c bus_info_length 4, crc_length 32, crc 15004
404 31333934 bus_name "1394"
408 e064a002 irmc 1, cmc 1, isc 1, bmc 0, cyc_clk_acc 100, max_rec 10 (2048)
40c 00a07e01 company_id 00a07e |
410 00085257 device_id 0100085257 | EUI-64 00a07e0100085257 root directory
-----------------------------------------------------------------
414 0005d08c directory_length 5, crc 53388
418 0300a07e vendor
41c 8100000c --> descriptor leaf at 44c
420 0c008380 node capabilities
424 8d000002 --> eui-64 leaf at 42c
428 d1000004 --> unit directory at 438 eui-64 leaf at 42c
-----------------------------------------------------------------
42c 0002410f leaf_length 2, crc 16655
430 00a07e01 company_id 00a07e |
434 00085257 device_id 0100085257 | EUI-64 00a07e0100085257 unit directory at 438
-----------------------------------------------------------------
438 0004d6c9 directory_length 4, crc 54985 43c 1200a02d specifier id: 1394 TA 440 13014001 version: Vender Unique and AV/C 444 17000001 model 448 81000009 --> descriptor leaf at 46c
descriptor leaf at 44c
-----------------------------------------------------------------
44c 00077205 leaf_length 7, crc 29189 450 00000000 textual descriptor 454 00000000 minimal ASCII 458 41766964 "Avid" 45c 20546563 " Tec" 460 686e6f6c "hnol" 464 6f677900 "ogy" 468 00000000
descriptor leaf at 46c
-----------------------------------------------------------------
46c 000599a5 leaf_length 5, crc 39333 470 00000000 textual descriptor 474 00000000 minimal ASCII 478 41647265 "Adre" 47c 6e616c69 "nali" 480 6e650000 "ne"
--- sound/firewire/digi00x/digi00x.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/firewire/digi00x/digi00x.c +5 -0
@@ -14,6 +14,7 @@ MODULE_LICENSE("GPL v2");#define VENDOR_DIGIDESIGN 0x00a07e#define MODEL_CONSOLE 0x000001#define MODEL_RACK 0x000002 +#define SPEC_VERSION 0x000001static int name_card (struct snd_dg00x *dg00x) {
@@ -175,14 +176,18 @@ static const struct ieee1394_device_id s/* Both of 002/003 use the same ID. */ { .match_flags = IEEE1394_MATCH_VENDOR_ID | + IEEE1394_MATCH_VERSION | IEEE1394_MATCH_MODEL_ID, .vendor_id = VENDOR_DIGIDESIGN, + .version = SPEC_VERSION, .model_id = MODEL_CONSOLE, }, { .match_flags = IEEE1394_MATCH_VENDOR_ID | + IEEE1394_MATCH_VERSION | IEEE1394_MATCH_MODEL_ID, .vendor_id = VENDOR_DIGIDESIGN, + .version = SPEC_VERSION, .model_id = MODEL_RACK, }, {}
Greg Kroah-Hartman
maintainerPATCH 95/129 ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO
In reply to Greg Kroah-HartmanFrom: Dan Crawford <[email protected]>
commit 15cbff3fbbc631952c346744f862fb294504b5e2 upstream.
Following Christian Lachner's patch for Gigabyte X570-based motherboards, also patch the MSI X570-A PRO motherboard; the ALC1220 codec requires the same workaround for Clevo laptops to enforce the DAC/mixer connection path. Set up a quirk entry for that.
I suspect most if all X570 motherboards will require similar patches.
[ The entries reordered in the SSID order -- tiwai ]
Related buglink: https://bugzilla.kernel.org/show_bug.cgi?id=205275
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2466,6 +2466,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1462 ,0x1276 ,"MSI-GL73" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1293 ,"MSI-GP65" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x7350 ,"MSI-7350" ,ALC889_FIXUP_CD ), +SND_PCI_QUIRK (0x1462 ,0x9c37 ,"MSI X570-A PRO" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0xda57 ,"MSI Z270-Gaming" ,ALC1220_FIXUP_GB_DUAL_CODECS ),SND_PCI_QUIRK_VENDOR (0x1462 ,"MSI" ,ALC882_FIXUP_GPIO3 ), SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
Greg Kroah-Hartman
maintainerPATCH 96/129 ALSA; firewire-tascam: exclude Tascam FE-8 from detection
In reply to Greg Kroah-HartmanFrom: Takashi Sakamoto <[email protected]>
commit 0bd8bce897b6697bbc286b8ba473aa0705fe394b upstream.
Tascam FE-8 is known to support communication by asynchronous transaction only. The support can be implemented in userspace application and snd-firewire-ctl-services project has the support. However, ALSA firewire-tascam driver is bound to the model.
This commit changes device entries so that the model is excluded. In a commit 53b3ffee7885 ("ALSA: firewire-tascam: change device probing processing"), I addressed to the concern that version field in configuration differs depending on installed firmware. However, as long as I checked, the version number is fixed. It's safe to return version number back to modalias.
--- sound/firewire/tascam/tascam.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-)
sound/firewire/tascam/tascam.c +29 -4
@@ -39,9 +39,6 @@ static const struct snd_tscm_spec model_ .midi_capture_ports = 2, .midi_playback_ports = 4, }, -// This kernel module doesn't support FE-8 because the most of features -// can be implemented in userspace without any specific support of this -// module. };static int identify_model (struct snd_tscm *tscm)
@@ -211,11 +208,39 @@ static void snd_tscm_remove(struct fw_un }static const struct ieee1394_device_id snd_tscm_id_table[] = { +// Tascam, FW-1884. + { + .match_flags =IEEE1394_MATCH_VENDOR_ID | +IEEE1394_MATCH_SPECIFIER_ID | +IEEE1394_MATCH_VERSION , + .vendor_id =0x00022e , + .specifier_id =0x00022e , + .version =0x800000 , + }, +// Tascam, FE-8 (.version = 0x800001) +// This kernel module doesn't support FE-8 because the most of features +// can be implemented in userspace without any specific support of this +// module. +// +// .version = 0x800002 is unknown. +// +// Tascam, FW-1082. + { + .match_flags =IEEE1394_MATCH_VENDOR_ID | +IEEE1394_MATCH_SPECIFIER_ID | +IEEE1394_MATCH_VERSION , + .vendor_id =0x00022e , + .specifier_id =0x00022e , + .version =0x800003 , + }, +// Tascam, FW-1804. { .match_flags =IEEE1394_MATCH_VENDOR_ID | -IEEE1394_MATCH_SPECIFIER_ID , +IEEE1394_MATCH_SPECIFIER_ID | +IEEE1394_MATCH_VERSION , .vendor_id =0x00022e , .specifier_id =0x00022e , + .version =0x800004 , }, {} };
Greg Kroah-Hartman
maintainerPATCH 97/129 ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A
In reply to Greg Kroah-HartmanFrom: Adrien Crivelli <[email protected]>
commit 8bcea6cb2cbc1f749e574954569323dec5e2920e upstream.
The Galaxy Book Ion NT950XCJ-X716A (15 inches) uses the same ALC298 codec as other Samsung laptops which have the no headphone sound bug. I confirmed on my own hardware that this fixes the bug.
This also correct the model name for the 13 inches version. It was incorrectly referenced as NT950XCJ-X716A in commit e17f02d05. But it should have been NP930XCJ-K01US.
--- sound/pci/hda/patch_realtek.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +2 -1
@@ -7678,7 +7678,8 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x144d ,0xc169 ,"Samsung Notebook 9 Pen (NP930SBE-K01US)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ),SND_PCI_QUIRK (0x144d ,0xc176 ,"Samsung Notebook 9 Pro (NP930MBE-K04US)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ),SND_PCI_QUIRK (0x144d ,0xc189 ,"Samsung Galaxy Flex Book (NT950QCG-X716)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ), -SND_PCI_QUIRK (0x144d ,0xc18a ,"Samsung Galaxy Book Ion (NT950XCJ-X716A)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ), +SND_PCI_QUIRK (0x144d ,0xc18a ,"Samsung Galaxy Book Ion (NP930XCJ-K01US)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ), +SND_PCI_QUIRK (0x144d ,0xc830 ,"Samsung Galaxy Book Ion (NT950XCJ-X716A)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ),SND_PCI_QUIRK (0x144d ,0xc740 ,"Samsung Ativ book 8 (NP870Z5G)" ,ALC269_FIXUP_ATIV_BOOK_8 ),SND_PCI_QUIRK (0x144d ,0xc812 ,"Samsung Notebook Pen S (NT950SBE-X58)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ), SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 98/129 ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6a6660d049f88b89fd9a4b9db3581b245f7782fa upstream.
There've been quite a few regression reports about the lowered volume (reduced to ca 65% from the previous level) on Lenovo Thinkpad X1 after the commit d2cd795c4ece ("ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen"). Although the commit itself does the right thing from HD-audio POV in order to have a volume control for bass speakers, it seems that the machine has some secret recipe under the hood.
Through experiments, Benjamin Poirier found out that the following routing gives the best result:
* DAC1 (NID 0x02) -> Speaker pin (NID 0x14)
* DAC2 (NID 0x03) -> Shared by both Bass Speaker pin (NID 0x17) &
Headphone pin (0x21)
* DAC3 (NID 0x06) -> Unused
DAC1 seems to have some equalizer internally applied, and you'd get again the output in a bad quality if you connect this to the headphone pin. Hence the headphone is connected to DAC2, which is now shared with the bass speaker pin. DAC3 has no volume amp, hence it's not connected at all.
For achieving the routing above, this patch introduced a couple of workarounds:
* The connection list of bass speaker pin (NID 0x17) is reduced not to include DAC3 (NID 0x06)
* Pass preferred_pairs array to specify the fixed connection
Here, both workarounds are needed because the generic parser prefers the individual DAC assignment over others.
When the routing above is applied, the generic parser creates the two volume controls "Front" and "Bass Speaker". Since we have only two DACs for three output pins, those are not fully controlling each output individually, and it would confuse PulseAudio. For avoiding the pitfall, in this patch, we rename those volume controls to some unique ones ("DAC1" and "DAC2"). Then PulseAudio ignore them and concentrate only on the still good-working "Master" volume control. If a user still wants to control each DAC volume, they can still change manually via "DAC1" and "DAC2" volume controls.
--- sound/pci/hda/patch_realtek.c | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +41 -1
@@ -5850,6 +5850,39 @@ static void alc275_fixup_gpio4_off(struc } } +/* Quirk for Thinkpad X1 7th and 8th Gen +* The following fixed routing needed +* DAC1 (NID 0x02) -> Speaker (NID 0x14); some eq applied secretly +* DAC2 (NID 0x03) -> Bass (NID 0x17) & Headphone (NID 0x21); sharing a DAC +* DAC3 (NID 0x06) -> Unused, due to the lack of volume amp +*/ +static void alc285_fixup_thinkpad_x1_gen7 (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +static const hda_nid_t conn[] = {0x02 ,0x03 };/* exclude 0x06 */ +static const hda_nid_t preferred_pairs[] = { +0x14 ,0x02 ,0x17 ,0x03 ,0x21 ,0x03 ,0 + }; +struct alc_spec *spec = codec->spec; + +switch (action) { +case HDA_FIXUP_ACT_PRE_PROBE : +snd_hda_override_conn_list (codec,0x17 ,ARRAY_SIZE (conn), conn); + spec->gen.preferred_dacs = preferred_pairs; +break ; +case HDA_FIXUP_ACT_BUILD : +/* The generic parser creates somewhat unintuitive volume ctls +* with the fixed routing above, and the shared DAC2 may be +* confusing for PA. +* Rename those to unique names so that PA doesn't touch them +* and use only Master volume. +*/ +rename_ctl (codec,"Front Playback Volume" ,"DAC1 Playback Volume" ); +rename_ctl (codec,"Bass Speaker Playback Volume" ,"DAC2 Playback Volume" ); +break ; + } +} +static void alc233_alc662_fixup_lenovo_dual_codecs (struct hda_codec *codec,const struct hda_fixup *fix,int action)
@@ -6118,6 +6151,7 @@ enum {ALC289_FIXUP_DUAL_SPK ,ALC294_FIXUP_SPK2_TO_DAC1 ,ALC294_FIXUP_ASUS_DUAL_SPK , +ALC285_FIXUP_THINKPAD_X1_GEN7 ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ,ALC294_FIXUP_ASUS_HPE , ALC294_FIXUP_ASUS_COEF_1B,
@@ -7263,11 +7297,17 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC294_FIXUP_SPK2_TO_DAC1 }, + [ALC285_FIXUP_THINKPAD_X1_GEN7] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_thinkpad_x1_gen7, + .chained = true, + .chain_id =ALC269_FIXUP_THINKPAD_ACPI + }, [ALC285_FIXUP_THINKPAD_HEADSET_JACK] = { .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_headset_jack, .chained = true, - .chain_id =ALC285_FIXUP_SPEAKER2_TO_DAC1 + .chain_id =ALC285_FIXUP_THINKPAD_X1_GEN7 }, [ALC294_FIXUP_ASUS_HPE] = { .type = HDA_FIXUP_VERBS,
Greg Kroah-Hartman
maintainerPATCH 99/129 arm64: dts: mt7622: add reset node for mmc device
In reply to Greg Kroah-HartmanFrom: Wenbin Mei <[email protected]>
commit d6f6cbeee4e5ee6976792851e0461c19f1ede864 upstream.
This commit adds reset node for mmc device.
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +2 -0
@@ -686,6 +686,8 @@ clocks = <&pericfg CLK_PERI_MSDC30_0_PD>, <&topckgen CLK_TOP_MSDC50_0_SEL>; clock-names = "source", "hclk"; + resets = <&pericfg MT7622_PERI_MSDC0_SW_RST>; + reset-names = "hrst"; status = "disabled"; };
Greg Kroah-Hartman
maintainerPATCH 100/129 mmc: mediatek: add optional module reset property
In reply to Greg Kroah-HartmanFrom: Wenbin Mei <[email protected]>
commit 855d388df217989fbf1f18c781ae6490dbb48e86 upstream.
This patch fixs eMMC-Access on mt7622/Bpi-64. Before we got these Errors on mounting eMMC ion R64:
[ 48.664925] blk_update_request: I/O error, dev mmcblk0, sector 204800 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 48.676019] Buffer I/O error on dev mmcblk0p1, logical block 0, lost sync page write
This patch adds a optional reset management for msdc. Sometimes the bootloader does not bring msdc register to default state, so need reset the msdc controller.
--- drivers/mmc/host/mtk-sd.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/mmc/host/mtk-sd.c +13 -0
@@ -22,6 +22,7 @@#include <linux/slab.h> #include <linux/spinlock.h> #include <linux/interrupt.h> +#include <linux/reset.h> #include <linux/mmc/card.h> #include <linux/mmc/core.h>
@@ -412,6 +413,7 @@ struct msdc_host {struct pinctrl_state *pins_uhs;struct delayed_work req_timeout;int irq;/* host interrupt */ +struct reset_control *reset;struct clk *src_clk;/* msdc source clock */ struct clk *h_clk;/* msdc h_clk */
@@ -1474,6 +1476,12 @@ static void msdc_init_hw(struct msdc_hosu32 val;u32 tune_reg = host->dev_comp->pad_tune_reg; +if (host->reset) { +reset_control_assert (host->reset); +usleep_range (10 ,50 ); +reset_control_deassert (host->reset); + } +/* Configure to MMC/SD mode, clock free running */ sdr_set_bits (host->base +MSDC_CFG ,MSDC_CFG_MODE |MSDC_CFG_CKPDN );
@@ -2232,6 +2240,11 @@ static int msdc_drv_probe(struct platforif (IS_ERR (host->src_clk_cg)) host->src_clk_cg =NULL ; + host->reset =devm_reset_control_get_optional_exclusive (&pdev->dev, +"hrst" ); +if (IS_ERR (host->reset)) +return PTR_ERR (host->reset); + host->irq =platform_get_irq (pdev,0 );if (host->irq <0 ) { ret = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 101/129 mmc: dt-bindings: Add resets/reset-names for Mediatek MMC bindings
In reply to Greg Kroah-HartmanFrom: Wenbin Mei <[email protected]>
commit 65557383191de46611dd3d6b639cbcfbade43c4a upstream.
Add description for resets/reset-names.
--- Documentation/devicetree/bindings/mmc/mtk-sd.txt | 2 ++ 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/mmc/mtk-sd.txt +2 -0
@@ -49,6 +49,8 @@ Optional properties: error caused by stop clock(fifo full) Valid range = [0:0x7]. if not present, default value is 0. applied to compatible "mediatek,mt2701-mmc". +- resets: Phandle and reset specifier pair to softreset line of MSDC IP. +- reset-names: Should be "hrst". Examples: mmc0: mmc@11230000 {
Greg Kroah-Hartman
maintainerPATCH 102/129 mmc: cqhci: Add cqhci_deactivate()
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit 0ffa6cfbd94982e6c028a8924b06a96c1b91bed8 upstream.
Host controllers can reset CQHCI either directly or as a consequence of host controller reset. Add cqhci_deactivate() which puts the CQHCI driver into a state that is consistent with that.
--- drivers/mmc/host/cqhci.c | 6 +++--- drivers/mmc/host/cqhci.h | 6 +++++- 2 files changed, 8 insertions(+), 4 deletions(-)
drivers/mmc/host/cqhci.c +3 -3
@@ -299,16 +299,16 @@ static void __cqhci_disable(struct cqhci cq_host->activated = false; } -int cqhci_suspend (struct mmc_host *mmc) +int cqhci_deactivate (struct mmc_host *mmc) {struct cqhci_host *cq_host = mmc->cqe_private; -if (cq_host->enabled) +if (cq_host->enabled && cq_host->activated)__cqhci_disable (cq_host);return 0 ; } -EXPORT_SYMBOL (cqhci_suspend); +EXPORT_SYMBOL (cqhci_deactivate);int cqhci_resume (struct mmc_host *mmc) {
drivers/mmc/host/cqhci.h +5 -1
@@ -230,7 +230,11 @@ irqreturn_t cqhci_irq(struct mmc_host *m int data_error);int cqhci_init (struct cqhci_host *cq_host,struct mmc_host *mmc,bool dma64);struct cqhci_host *cqhci_pltfm_init (struct platform_device *pdev); -int cqhci_suspend (struct mmc_host *mmc); +int cqhci_deactivate (struct mmc_host *mmc); +static inline int cqhci_suspend (struct mmc_host *mmc) +{ +return cqhci_deactivate (mmc); +}int cqhci_resume (struct mmc_host *mmc);#endif
Greg Kroah-Hartman
maintainerPATCH 103/129 mmc: sdhci-pci: Fix SDHCI_RESET_ALL for CQHCI for Intel GLK-based controllers
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit df57d73276b863af1debc48546b0e59e44998a55 upstream.
For Intel controllers, SDHCI_RESET_ALL resets also CQHCI registers. Normally, SDHCI_RESET_ALL is not used while CQHCI is enabled, but that can happen on the error path. e.g. if mmc_cqe_recovery() fails, mmc_blk_reset() is called which, for a eMMC that does not support HW Reset, will cycle the bus power and the driver will perform SDHCI_RESET_ALL.
So whenever performing SDHCI_RESET_ALL ensure CQHCI is deactivated. That will force the driver to reinitialize CQHCI when it is next used.
A similar change was done already for sdhci-msm, and other drivers using CQHCI might benefit from a similar change, if they also have CQHCI reset by SDHCI_RESET_ALL.
--- drivers/mmc/host/sdhci-pci-core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci-pci-core.c +9 -1
@@ -232,6 +232,14 @@ static void sdhci_pci_dumpregs(struct mmsdhci_dumpregs (mmc_priv (mmc)); } +static void sdhci_cqhci_reset (struct sdhci_host *host,u8 mask) +{ +if ((host->mmc->caps2 &MMC_CAP2_CQE ) && (mask &SDHCI_RESET_ALL ) && + host->mmc->cqe_private) +cqhci_deactivate (host->mmc); +sdhci_reset (host, mask); +} +/*****************************************************************************\ * * * Hardware specific quirk handling *
@@ -722,7 +730,7 @@ static const struct sdhci_ops sdhci_inte .set_power = sdhci_intel_set_power, .enable_dma = sdhci_pci_enable_dma, .set_bus_width = sdhci_set_bus_width, - .reset = sdhci_reset, + .reset = sdhci_cqhci_reset, .set_uhs_signaling = sdhci_set_uhs_signaling, .hw_reset = sdhci_pci_hw_reset, .irq = sdhci_cqhci_irq,
Greg Kroah-Hartman
maintainerPATCH 104/129 media: rc: do not access device via sysfs after rc_unregister_device()
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit a2e2d73fa28136598e84db9d021091f1b98cbb1a upstream.
Device drivers do not expect to have change_protocol or wakeup re-programming to be accesed after rc_unregister_device(). This can cause the device driver to access deallocated resources.
--- drivers/media/rc/rc-main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/media/rc/rc-main.c +12 -0
@@ -1256,6 +1256,10 @@ static ssize_t store_protocols(struct de }mutex_lock (&dev->lock); +if (!dev->registered) { +mutex_unlock (&dev->lock); +return -ENODEV ; + } old_protocols = *current_protocols; new_protocols = old_protocols;
@@ -1394,6 +1398,10 @@ static ssize_t store_filter(struct devicreturn -EINVAL ;mutex_lock (&dev->lock); +if (!dev->registered) { +mutex_unlock (&dev->lock); +return -ENODEV ; + } new_filter = *filter;if (fattr->mask)
@@ -1508,6 +1516,10 @@ static ssize_t store_wakeup_protocols(stint i;mutex_lock (&dev->lock); +if (!dev->registered) { +mutex_unlock (&dev->lock); +return -ENODEV ; + } allowed = dev->allowed_wakeup_protocols;
Greg Kroah-Hartman
maintainerPATCH 105/129 media: rc: uevent sysfs file races with rc_unregister_device()
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 4f0835d6677dc69263f90f976524cb92b257d9f4 upstream.
Only report uevent file contents if device still registered, else we might read freed memory.
--- drivers/media/rc/rc-main.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-)
drivers/media/rc/rc-main.c +16 -16
@@ -1577,25 +1577,25 @@ static void rc_dev_release(struct devicekfree (dev); } -#define ADD_HOTPLUG_VAR(fmt, val...) \ - do { \ - int err = add_uevent_var(env, fmt, val); \ - if (err) \ - return err; \ - } while (0) -static int rc_dev_uevent (struct device *device,struct kobj_uevent_env *env) {struct rc_dev *dev =to_rc_dev (device); +int ret =0 ; -if (dev->rc_map.name) -ADD_HOTPLUG_VAR ("NAME=%s" , dev->rc_map.name); -if (dev->driver_name) -ADD_HOTPLUG_VAR ("DRV_NAME=%s" , dev->driver_name); -if (dev->device_name) -ADD_HOTPLUG_VAR ("DEV_NAME=%s" , dev->device_name); +mutex_lock (&dev->lock); -return 0 ; +if (!dev->registered) + ret = -ENODEV ; +if (ret ==0 && dev->rc_map.name) + ret =add_uevent_var (env,"NAME=%s" , dev->rc_map.name); +if (ret ==0 && dev->driver_name) + ret =add_uevent_var (env,"DRV_NAME=%s" , dev->driver_name); +if (ret ==0 && dev->device_name) + ret =add_uevent_var (env,"DEV_NAME=%s" , dev->device_name); + +mutex_unlock (&dev->lock); + +return ret; }/*
@@ -1987,14 +1987,14 @@ void rc_unregister_device(struct rc_devdel_timer_sync (&dev->timer_keyup);del_timer_sync (&dev->timer_repeat); -rc_free_rx_device (dev); -mutex_lock (&dev->lock);if (dev->users && dev->close) dev->close (dev); dev->registered = false;mutex_unlock (&dev->lock); +rc_free_rx_device (dev); +/* * lirc device should be freed with dev->registered = false, so * that userspace polling will get notified.
Greg Kroah-Hartman
maintainerPATCH 106/129 affs: fix basic permission bits to actually work
In reply to Greg Kroah-HartmanFrom: Max Staudt <[email protected]>
commit d3a84a8d0dde4e26bc084b36ffcbdc5932ac85e2 upstream.
The basic permission bits (protection bits in AmigaOS) have been broken in Linux' AFFS - it would only set bits, but never delete them. Also, contrary to the documentation, the Archived bit was not handled.
Let's fix this for good, and set the bits such that Linux and classic AmigaOS can coexist in the most peaceful manner.
Also, update the documentation to represent the current state of things.
--- Documentation/filesystems/affs.txt | 16 ++++++++++------ fs/affs/amigaffs.c | 27 +++++++++++++++++++++++++++ fs/affs/file.c | 26 +++++++++++++++++++++++++- 3 files changed, 62 insertions(+), 7 deletions(-)
Documentation/filesystems/affs.txt +10 -6
@@ -93,13 +93,15 @@ The Amiga protection flags RWEDRWEDHSPAR - R maps to r for user, group and others. On directories, R implies x. - - If both W and D are allowed, w will be set. + - W maps to w. - E maps to x. - - H and P are always retained and ignored under Linux. + - D is ignored. - - A is always reset when a file is written to. + - H, S and P are always retained and ignored under Linux. + + - A is cleared when a file is written to. User id and group id will be used unless set[gu]id are given as mount options. Since most of the Amiga file systems are single user systems
@@ -111,11 +113,13 @@ Linux -> Amiga: The Linux rwxrwxrwx file mode is handled as follows: - - r permission will set R for user, group and others. + - r permission will allow R for user, group and others. + + - w permission will allow W for user, group and others. - - w permission will set W and D for user, group and others. + - x permission of the user will allow E for plain files. - - x permission of the user will set E for plain files. + - D will be allowed for user, group and others. - All other flags (suid, sgid, ...) are ignored and will not be retained.
fs/affs/amigaffs.c +27 -0
@@ -420,24 +420,51 @@ affs_mode_to_prot(struct inode *inode)u32 prot =AFFS_I (inode)->i_protect;umode_t mode = inode->i_mode; +/* +* First, clear all RWED bits for owner, group, other. +* Then, recalculate them afresh. +* +* We'll always clear the delete-inhibit bit for the owner, as that is +* the classic single-user mode AmigaOS protection bit and we need to +* stay compatible with all scenarios. +* +* Since multi-user AmigaOS is an extension, we'll only set the +* delete-allow bit if any of the other bits in the same user class +* (group/other) are used. +*/ + prot &= ~(FIBF_NOEXECUTE |FIBF_NOREAD + |FIBF_NOWRITE |FIBF_NODELETE + |FIBF_GRP_EXECUTE |FIBF_GRP_READ + |FIBF_GRP_WRITE |FIBF_GRP_DELETE + |FIBF_OTR_EXECUTE |FIBF_OTR_READ + |FIBF_OTR_WRITE |FIBF_OTR_DELETE ); + +/* Classic single-user AmigaOS flags. These are inverted. */ if (!(mode &0100 )) prot |=FIBF_NOEXECUTE ;if (!(mode &0400 )) prot |=FIBF_NOREAD ;if (!(mode &0200 )) prot |=FIBF_NOWRITE ; + +/* Multi-user extended flags. Not inverted. */ if (mode &0010 ) prot |=FIBF_GRP_EXECUTE ;if (mode &0040 ) prot |=FIBF_GRP_READ ;if (mode &0020 ) prot |=FIBF_GRP_WRITE ; +if (mode &0070 ) + prot |=FIBF_GRP_DELETE ; +if (mode &0001 ) prot |=FIBF_OTR_EXECUTE ;if (mode &0004 ) prot |=FIBF_OTR_READ ;if (mode &0002 ) prot |=FIBF_OTR_WRITE ; +if (mode &0007 ) + prot |=FIBF_OTR_DELETE ;AFFS_I (inode)->i_protect = prot; }
fs/affs/file.c +25 -1
@@ -428,6 +428,24 @@ static int affs_write_begin(struct filereturn ret; } +static int affs_write_end (struct file *file,struct address_space *mapping, +loff_t pos,unsigned int len,unsigned int copied, +struct page *page,void *fsdata) +{ +struct inode *inode = mapping->host; +int ret; + + ret =generic_write_end (file, mapping, pos, len, copied, page, fsdata); + +/* Clear Archived bit on file writes, as AmigaOS would do */ +if (AFFS_I (inode)->i_protect &FIBF_ARCHIVED ) { +AFFS_I (inode)->i_protect &= ~FIBF_ARCHIVED ; +mark_inode_dirty (inode); + } + +return ret; +} +static sector_t _affs_bmap (struct address_space *mapping,sector_t block) {return generic_block_bmap (mapping,block,affs_get_block);
@@ -437,7 +455,7 @@ const struct address_space_operations af .readpage = affs_readpage, .writepage = affs_writepage, .write_begin = affs_write_begin, - .write_end = generic_write_end, + .write_end = affs_write_end, .direct_IO = affs_direct_IO, .bmap = _affs_bmap };
@@ -794,6 +812,12 @@ done:if (tmp > inode->i_size) inode->i_size =AFFS_I (inode)->mmu_private = tmp; +/* Clear Archived bit on file writes, as AmigaOS would do */ +if (AFFS_I (inode)->i_protect &FIBF_ARCHIVED ) { +AFFS_I (inode)->i_protect &= ~FIBF_ARCHIVED ; +mark_inode_dirty (inode); + } + err_first_bh:unlock_page (page);put_page (page);
Greg Kroah-Hartman
maintainerPATCH 107/129 block: allow for_each_bvec to support zero len bvec
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 7e24969022cbd61ddc586f14824fc205661bb124 upstream.
Block layer usually doesn't support or allow zero-length bvec. Since commit 1bdc76aea115 ("iov_iter: use bvec iterator to implement iterate_bvec()"), iterate_bvec() switches to bvec iterator. However, Al mentioned that 'Zero-length segments are not disallowed' in iov_iter.
Fixes for_each_bvec() so that it can move on after seeing one zero length bvec.
--- include/linux/bvec.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
include/linux/bvec.h +8 -1
@@ -110,11 +110,18 @@ static inline bool bvec_iter_advance(conreturn true; } +static inline void bvec_iter_skip_zero_bvec (struct bvec_iter *iter) +{ + iter->bi_bvec_done =0 ; + iter->bi_idx++; +} +#define for_each_bvec (bvl, bio_vec, iter, start) \ for (iter = (start); \ (iter).bi_size && \ ((bvl = bvec_iter_bvec((bio_vec), (iter))), 1); \ - bvec_iter_advance((bio_vec), &(iter), (bvl).bv_len)) + (bvl).bv_len ? (void)bvec_iter_advance((bio_vec), &(iter), \ + (bvl).bv_len) : bvec_iter_skip_zero_bvec(&(iter)))/* for iterating one bio from start to end */ #define BVEC_ITER_ALL_INIT (struct bvec_iter) \
Greg Kroah-Hartman
maintainerPATCH 108/129 block: ensure bdi->io_pages is always initialized
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit de1b0ee490eafdf65fac9eef9925391a8369f2dc upstream.
If a driver leaves the limit settings as the defaults, then we don't initialize bdi->io_pages. This means that file systems may need to work around bdi->io_pages == 0, which is somewhat messy.
Initialize the default value just like we do for ->ra_pages.
--- block/blk-core.c | 1 + 1 file changed, 1 insertion(+)
block/blk-core.c +1 -0
@@ -502,6 +502,7 @@ struct request_queue *blk_alloc_queue_no goto fail_stats; q->backing_dev_info->ra_pages =VM_READAHEAD_PAGES ; + q->backing_dev_info->io_pages =VM_READAHEAD_PAGES ; q->backing_dev_info->capabilities =BDI_CAP_CGROUP_WRITEBACK ; q->backing_dev_info->name ="block" ; q->node = node_id;
Greg Kroah-Hartman
maintainerPATCH 109/129 libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
In reply to Greg Kroah-HartmanFrom: Tejun Heo <[email protected]>
commit 3b5455636fe26ea21b4189d135a424a6da016418 upstream.
All three generations of Sandisk SSDs lock up hard intermittently. Experiments showed that disabling NCQ lowered the failure rate significantly and the kernel has been disabling NCQ for some models of SD7's and 8's, which is obviously undesirable.
Karthik worked with Sandisk to root cause the hard lockups to trim commands larger than 128M. This patch implements ATA_HORKAGE_MAX_TRIM_128M which limits max trim size to 128M and applies it to all three generations of Sandisk SSDs.
--- drivers/ata/libata-core.c | 5 ++--- drivers/ata/libata-scsi.c | 8 +++++++- include/linux/libata.h | 1 + 3 files changed, 10 insertions(+), 4 deletions(-)
drivers/ata/libata-core.c +2 -3
@@ -4474,9 +4474,8 @@ static const struct ata_blacklist_entry/* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */ { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, }, - /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on - SD7SN6S256G and SD8SN8U256G */ - { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, }, + /* Sandisk SD7/8/9s lock up hard on large trims */ + { "SanDisk SD[789]*", NULL, ATA_HORKAGE_MAX_TRIM_128M, }, /* devices which puke on READ_NATIVE_MAX */ { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, },
drivers/ata/libata-scsi.c +7 -1
@@ -2374,6 +2374,7 @@ static unsigned int ata_scsiop_inq_89(ststatic unsigned int ata_scsiop_inq_b0 (struct ata_scsi_args *args,u8 *rbuf) { +struct ata_device *dev = args->dev;u16 min_io_sectors; rbuf[1 ] =0xb0 ;
@@ -2399,7 +2400,12 @@ static unsigned int ata_scsiop_inq_b0(st* with the unmap bit set. */ if (ata_id_has_trim (args->id)) { -put_unaligned_be64 (65535 *ATA_MAX_TRIM_RNUM , &rbuf[36 ]); +u64 max_blocks =65535 *ATA_MAX_TRIM_RNUM ; + +if (dev->horkage &ATA_HORKAGE_MAX_TRIM_128M ) + max_blocks =128 << (20 -SECTOR_SHIFT ); + +put_unaligned_be64 (max_blocks, &rbuf[36 ]);put_unaligned_be32 (1 , &rbuf[28 ]); }
include/linux/libata.h +1 -0
@@ -422,6 +422,7 @@ enum {ATA_HORKAGE_NO_DMA_LOG = (1 <<23 ),/* don't use DMA for log read */ ATA_HORKAGE_NOTRIM = (1 <<24 ),/* don't use TRIM */ ATA_HORKAGE_MAX_SEC_1024 = (1 <<25 ),/* Limit max sects to 1024 */ + ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M *//* DMA mask for user DMA control: User visible values; DO NOT renumber */
Greg Kroah-Hartman
maintainerPATCH 110/129 blk-iocost: ioc_pd_free() shouldnt assume irq disabled
In reply to Greg Kroah-HartmanFrom: Tejun Heo <[email protected]>
commit 5aeac7c4b16069aae49005f0a8d4526baa83341b upstream.
ioc_pd_free() grabs irq-safe ioc->lock without ensuring that irq is disabled when it can be called with irq disabled or enabled. This has a small chance of causing A-A deadlocks and triggers lockdep splats. Use irqsave operations instead.
--- block/blk-iocost.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
block/blk-iocost.c +3 -2
@@ -2074,14 +2074,15 @@ static void ioc_pd_free(struct blkg_poli {struct ioc_gq *iocg =pd_to_iocg (pd);struct ioc *ioc = iocg->ioc; +unsigned long flags;if (ioc) { -spin_lock (&ioc->lock); +spin_lock_irqsave (&ioc->lock, flags);if (!list_empty (&iocg->active_list)) {propagate_active_weight (iocg,0 ,0 );list_del_init (&iocg->active_list); } -spin_unlock (&ioc->lock); +spin_unlock_irqrestore (&ioc->lock, flags);hrtimer_cancel (&iocg->waitq_timer);hrtimer_cancel (&iocg->delay_timer);
Greg Kroah-Hartman
maintainerPATCH 111/129 dmaengine: dw-edma: Fix scatter-gather address calculation
In reply to Greg Kroah-HartmanFrom: Gustavo Pimentel <[email protected]>
commit 05655541c9503bfd01af4e6cbd7f5a29ac748e6c upstream.
Fix the source and destination physical address calculation of a peripheral device on scatter-gather implementation.
This issue manifested during tests using a 64 bits architecture system. The abnormal behavior wasn't visible before due to all previous tests were done using 32 bits architecture system, that masked his effect.
--- drivers/dma/dw-edma/dw-edma-core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/dma/dw-edma/dw-edma-core.c +6 -5
@@ -391,7 +391,7 @@ dw_edma_device_transfer(struct dw_edma_tif (xfer->cyclic) { burst->dar = xfer->xfer.cyclic.paddr; }else { - burst->dar =sg_dma_address (sg); + burst->dar = dst_addr;/* Unlike the typical assumption by other * drivers/IPs the peripheral memory isn't * a FIFO memory, in this case, it's a
@@ -399,14 +399,13 @@ dw_edma_device_transfer(struct dw_edma_t* and destination addresses are increased * by the same portion (data length) */ - src_addr +=sg_dma_len (sg); } }else { burst->dar = dst_addr;if (xfer->cyclic) { burst->sar = xfer->xfer.cyclic.paddr; }else { - burst->sar =sg_dma_address (sg); + burst->sar = src_addr;/* Unlike the typical assumption by other * drivers/IPs the peripheral memory isn't * a FIFO memory, in this case, it's a
@@ -414,12 +413,14 @@ dw_edma_device_transfer(struct dw_edma_t* and destination addresses are increased * by the same portion (data length) */ - dst_addr +=sg_dma_len (sg); } } -if (!xfer->cyclic) +if (!xfer->cyclic) { + src_addr +=sg_dma_len (sg); + dst_addr +=sg_dma_len (sg); sg =sg_next (sg); + } }return vchan_tx_prep (&chan->vc, &desc->vd, xfer->flags);
Greg Kroah-Hartman
maintainerPATCH 112/129 drm/amd/pm: avoid false alarm due to confusing softwareshutdowntemp setting
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
commit 971df65cbf32da9bc9af52c1196ca504dd316086 upstream.
Normally softwareshutdowntemp should be greater than Thotspotlimit. However, on some VEGA10 ASIC, the softwareshutdowntemp is 91C while Thotspotlimit is 105C. This seems not right and may trigger some false alarms.
--- drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c +12 -2
@@ -375,8 +375,18 @@ static int vega10_thermal_set_temperatur/* compare them in unit celsius degree */ if (low < range->min /PP_TEMPERATURE_UNITS_PER_CENTIGRADES ) low = range->min /PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; -if (high > tdp_table->usSoftwareShutdownTemp) - high = tdp_table->usSoftwareShutdownTemp; + +/* +* As a common sense, usSoftwareShutdownTemp should be bigger +* than ThotspotLimit. For any invalid usSoftwareShutdownTemp, +* we will just use the max possible setting VEGA10_THERMAL_MAXIMUM_ALERT_TEMP +* to avoid false alarms. +*/ +if ((tdp_table->usSoftwareShutdownTemp > + range->hotspot_crit_max /PP_TEMPERATURE_UNITS_PER_CENTIGRADES )) { +if (high > tdp_table->usSoftwareShutdownTemp) + high = tdp_table->usSoftwareShutdownTemp; + }if (low > high)return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 113/129 dm writecache: handle DAX to partitions on persistent memory correctly
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit f9e040efcc28309e5c592f7e79085a9a52e31f58 upstream.
The function dax_direct_access doesn't take partitions into account, it always maps pages from the beginning of the device. Therefore, persistent_memory_claim() must get the partition offset using get_start_sect() and add it to the page offsets passed to dax_direct_access().
--- drivers/md/dm-writecache.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/md/dm-writecache.c +10 -2
@@ -224,6 +224,7 @@ static int persistent_memory_claim(strucpfn_t pfn;int id;struct page **pages; +sector_t offset; wc->memory_vmapped = false;
@@ -242,9 +243,16 @@ static int persistent_memory_claim(struc goto err1; } + offset =get_start_sect (wc->ssd_dev->bdev); +if (offset & (PAGE_SIZE /512 -1 )) { + r = -EINVAL ; + goto err1; + } + offset >>=PAGE_SHIFT -9 ; + id =dax_read_lock (); - da =dax_direct_access (wc->ssd_dev->dax_dev,0 , p, &wc->memory_map, &pfn); + da =dax_direct_access (wc->ssd_dev->dax_dev, offset, p, &wc->memory_map, &pfn);if (da <0 ) { wc->memory_map =NULL ; r = da;
@@ -266,7 +274,7 @@ static int persistent_memory_claim(struc i =0 ; do { long daa; - daa = dax_direct_access(wc->ssd_dev->dax_dev, i, p - i, + daa = dax_direct_access(wc->ssd_dev->dax_dev, offset + i, p - i, NULL, &pfn); if (daa <= 0) { r = daa ? daa : -EINVAL;
Greg Kroah-Hartman
maintainerPATCH 114/129 dm mpath: fix racey management of PG initialization
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
commit c322ee9320eaa4013ca3620b1130992916b19b31 upstream.
Commit 935fcc56abc3 ("dm mpath: only flush workqueue when needed") changed flush_multipath_work() to avoid needless workqueue flushing (of a multipath global workqueue). But that change didn't realize the surrounding flush_multipath_work() code should also only run if 'pg_init_in_progress' is set.
Fix this by only doing all of flush_multipath_work()'s PG init related work if 'pg_init_in_progress' is set.
Otherwise multipath_wait_for_pg_init_completion() will run unconditionally but the preceeding flush_workqueue(kmpath_handlerd) may not. This could lead to deadlock (though only if kmpath_handlerd never runs a corresponding work to decrement 'pg_init_in_progress').
It could also be, though highly unlikely, that the kmpath_handlerd work that does PG init completes before 'pg_init_in_progress' is set, and then an intervening DM table reload's multipath_postsuspend() triggers flush_multipath_work().
--- drivers/md/dm-mpath.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/md/dm-mpath.c +15 -7
@@ -1190,17 +1190,25 @@ static void multipath_wait_for_pg_init_cstatic void flush_multipath_work (struct multipath *m) {if (m->hw_handler_name) { -set_bit (MPATHF_PG_INIT_DISABLED , &m->flags); -smp_mb__after_atomic (); +unsigned long flags; + +if (!atomic_read (&m->pg_init_in_progress)) + goto skip; + +spin_lock_irqsave (&m->lock, flags); +if (atomic_read (&m->pg_init_in_progress) && + !test_and_set_bit (MPATHF_PG_INIT_DISABLED , &m->flags)) { +spin_unlock_irqrestore (&m->lock, flags); -if (atomic_read (&m->pg_init_in_progress))flush_workqueue (kmpath_handlerd); -multipath_wait_for_pg_init_completion (m); +multipath_wait_for_pg_init_completion (m); -clear_bit (MPATHF_PG_INIT_DISABLED , &m->flags); -smp_mb__after_atomic (); +spin_lock_irqsave (&m->lock, flags); +clear_bit (MPATHF_PG_INIT_DISABLED , &m->flags); + } +spin_unlock_irqrestore (&m->lock, flags); } - +skip:if (m->queue_mode ==DM_TYPE_BIO_BASED )flush_work (&m->process_queued_bios);flush_work (&m->trigger_event);
Greg Kroah-Hartman
maintainerPATCH 115/129 dm integrity: fix error reporting in bitmap mode after creation
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit e27fec66f0a94e35a35548bd0b29ae616e62ec62 upstream.
The dm-integrity target did not report errors in bitmap mode just after creation. The reason is that the function integrity_recalc didn't clean up ic->recalc_bitmap as it proceeded with recalculation.
Fix this by updating the bitmap accordingly -- the double shift serves to rounddown.
--- drivers/md/dm-integrity.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/md/dm-integrity.c +12 -0
@@ -2365,6 +2365,7 @@ next_chunk: range.logical_sector =le64_to_cpu (ic->sb->recalc_sector);if (unlikely (range.logical_sector >= ic->provided_data_sectors)) {if (ic->mode =='B' ) { +block_bitmap_op (ic, ic->recalc_bitmap,0 , ic->provided_data_sectors,BITMAP_OP_CLEAR );DEBUG_print ("queue_delayed_work: bitmap_flush_work\n" );queue_delayed_work (ic->commit_wq, &ic->bitmap_flush_work,0 ); }
@@ -2442,6 +2443,17 @@ next_chunk: goto err; } +if (ic->mode =='B' ) { +sector_t start, end; + start = (range.logical_sector >> + (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)) << + (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit); + end = ((range.logical_sector + range.n_sectors) >> + (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)) << + (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit); +block_bitmap_op (ic, ic->recalc_bitmap, start, end - start,BITMAP_OP_CLEAR ); + } + advance_and_next:cond_resched ();
Greg Kroah-Hartman
maintainerPATCH 116/129 dm crypt: Initialize crypto wait structures
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit 7785a9e4c228db6d01086a52d5685cd7336a08b7 upstream.
Use the DECLARE_CRYPTO_WAIT() macro to properly initialize the crypto wait structures declared on stack before their use with crypto_wait_req().
--- drivers/md/dm-crypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-crypt.c +1 -1
@@ -720,7 +720,7 @@ static int crypt_iv_eboiv_gen(struct cryu8 buf[MAX_CIPHER_BLOCKSIZE ]__aligned(__alignof__(__le64)) ;struct skcipher_request *req;struct scatterlist src, dst; -struct crypto_wait wait; +DECLARE_CRYPTO_WAIT (wait);int err; req =skcipher_request_alloc (any_tfm (cc),GFP_NOIO );
Greg Kroah-Hartman
maintainerPATCH 117/129 dm cache metadata: Avoid returning cmd->bm wild pointer on error
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit d16ff19e69ab57e08bf908faaacbceaf660249de upstream.
Maybe __create_persistent_data_objects() caller will use PTR_ERR as a pointer, it will lead to some strange things.
--- drivers/md/dm-cache-metadata.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/md/dm-cache-metadata.c +6 -2
@@ -537,12 +537,16 @@ static int __create_persistent_data_obje CACHE_MAX_CONCURRENT_LOCKS);if (IS_ERR (cmd->bm)) {DMERR ("could not create block manager" ); -return PTR_ERR (cmd->bm); + r =PTR_ERR (cmd->bm); + cmd->bm =NULL ; +return r; } r =__open_or_format_metadata (cmd, may_format_device); -if (r) +if (r) {dm_block_manager_destroy (cmd->bm); + cmd->bm =NULL ; + }return r; }
Greg Kroah-Hartman
maintainerPATCH 118/129 dm thin metadata: Avoid returning cmd->bm wild pointer on error
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit 219403d7e56f9b716ad80ab87db85d29547ee73e upstream.
Maybe __create_persistent_data_objects() caller will use PTR_ERR as a pointer, it will lead to some strange things.
--- drivers/md/dm-thin-metadata.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/md/dm-thin-metadata.c +6 -2
@@ -739,12 +739,16 @@ static int __create_persistent_data_obje THIN_MAX_CONCURRENT_LOCKS);if (IS_ERR (pmd->bm)) {DMERR ("could not create block manager" ); -return PTR_ERR (pmd->bm); + r =PTR_ERR (pmd->bm); + pmd->bm =NULL ; +return r; } r =__open_or_format_metadata (pmd, format_device); -if (r) +if (r) {dm_block_manager_destroy (pmd->bm); + pmd->bm =NULL ; + }return r; }
Greg Kroah-Hartman
maintainerPATCH 119/129 dm thin metadata: Fix use-after-free in dm_bm_set_read_only
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit 3a653b205f29b3f9827a01a0c88bfbcb0d169494 upstream.
The following error ocurred when testing disk online/offline:
[ 301.798344] device-mapper: thin: 253:5: aborting current metadata transaction [ 301.848441] device-mapper: thin: 253:5: failed to abort metadata transaction [ 301.849206] Aborting journal on device dm-26-8. [ 301.850489] EXT4-fs error (device dm-26) in __ext4_new_inode:943: Journal has aborted [ 301.851095] EXT4-fs (dm-26): Delayed block allocation failed for inode 398742 at logical offset 181 with max blocks 19 with error 30 [ 301.854476] BUG: KASAN: use-after-free in dm_bm_set_read_only+0x3a/0x40 [dm_persistent_data]
Reason is:
metadata_operation_failed
abort_transaction
dm_pool_abort_metadata
__create_persistent_data_objects
r = __open_or_format_metadata
if (r) --> If failed will free pmd->bm but pmd->bm not set NULL
dm_block_manager_destroy(pmd->bm);
set_pool_mode
dm_pool_metadata_read_only(pool->pmd);
dm_bm_set_read_only(pmd->bm); --> use-after-freeAdd checks to see if pmd->bm is NULL in dm_bm_set_read_only and dm_bm_set_read_write functions. If bm is NULL it means creating the bm failed and so dm_bm_is_read_only must return true.
--- drivers/md/dm-thin-metadata.c | 2 +- drivers/md/persistent-data/dm-block-manager.c | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-)
drivers/md/dm-thin-metadata.c +1 -1
@@ -958,7 +958,7 @@ int dm_pool_metadata_close(struct dm_poo }pmd_write_lock_in_core (pmd); -if (!dm_bm_is_read_only (pmd->bm) && !pmd->fail_io) { +if (!pmd->fail_io && !dm_bm_is_read_only (pmd->bm)) { r =__commit_transaction (pmd);if (r <0 ) DMWARN("%s: __commit_transaction() failed, error = %d",
drivers/md/persistent-data/dm-block-manager.c +8 -6
@@ -493,7 +493,7 @@ int dm_bm_write_lock(struct dm_block_manvoid *p;int r; -if (bm->read_only) +if (dm_bm_is_read_only (bm))return -EPERM ; p =dm_bufio_read (bm->bufio, b, (struct dm_buffer **) result);
@@ -562,7 +562,7 @@ int dm_bm_write_lock_zero(struct dm_blocstruct buffer_aux *aux;void *p; -if (bm->read_only) +if (dm_bm_is_read_only (bm))return -EPERM ; p =dm_bufio_new (bm->bufio, b, (struct dm_buffer **) result);
@@ -602,7 +602,7 @@ EXPORT_SYMBOL_GPL(dm_bm_unlock);int dm_bm_flush (struct dm_block_manager *bm) { -if (bm->read_only) +if (dm_bm_is_read_only (bm))return -EPERM ;return dm_bufio_write_dirty_buffers (bm->bufio);
@@ -616,19 +616,21 @@ void dm_bm_prefetch(struct dm_block_manabool dm_bm_is_read_only (struct dm_block_manager *bm) { -return bm->read_only; +return (bm ? bm->read_only : true); }EXPORT_SYMBOL_GPL (dm_bm_is_read_only);void dm_bm_set_read_only (struct dm_block_manager *bm) { - bm->read_only = true; +if (bm) + bm->read_only = true; }EXPORT_SYMBOL_GPL (dm_bm_set_read_only);void dm_bm_set_read_write (struct dm_block_manager *bm) { - bm->read_only = false; +if (bm) + bm->read_only = false; }EXPORT_SYMBOL_GPL (dm_bm_set_read_write);
Greg Kroah-Hartman
maintainerPATCH 120/129 mm: slub: fix conversion of freelist_corrupted()
In reply to Greg Kroah-HartmanFrom: Eugeniu Rosca <[email protected]>
commit dc07a728d49cf025f5da2c31add438d839d076c0 upstream.
Commit 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in deactivate_slab()") suffered an update when picked up from LKML [1].
Specifically, relocating 'freelist = NULL' into 'freelist_corrupted()' created a no-op statement. Fix it by sticking to the behavior intended in the original patch [1]. In addition, make freelist_corrupted() immune to passing NULL instead of &freelist.
The issue has been spotted via static analysis and code review.
[1] https://lore.kernel.org/linux-mm/[email protected]/
--- mm/slub.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
mm/slub.c +6 -6
@@ -645,12 +645,12 @@ static void slab_fix(struct kmem_cache * }static bool freelist_corrupted (struct kmem_cache *s,struct page *page, -void *freelist,void *nextfree) +void **freelist,void *nextfree) {if ((s->flags &SLAB_CONSISTENCY_CHECKS ) && - !check_valid_pointer (s, page, nextfree)) { -object_err (s, page, freelist,"Freechain corrupt" ); - freelist =NULL ; + !check_valid_pointer (s, page, nextfree) && freelist) { +object_err (s, page, *freelist,"Freechain corrupt" ); + *freelist =NULL ;slab_fix (s,"Isolate corrupted freechain" );return true; }
@@ -1394,7 +1394,7 @@ static inline void dec_slabs_node(struct int objects) {}static bool freelist_corrupted (struct kmem_cache *s,struct page *page, -void *freelist,void *nextfree) +void **freelist,void *nextfree) {return false; }
@@ -2086,7 +2086,7 @@ static void deactivate_slab(struct kmem_* 'freelist' is already corrupted. So isolate all objects * starting at 'freelist'. */ -if (freelist_corrupted (s, page, freelist, nextfree)) +if (freelist_corrupted (s, page, &freelist, nextfree))break ; do {
Greg Kroah-Hartman
maintainerPATCH 121/129 mm: madvise: fix vma user-after-free
In reply to Greg Kroah-HartmanFrom: Yang Shi <[email protected]>
commit 7867fd7cc44e63c6673cd0f8fea155456d34d0de upstream.
The syzbot reported the below use-after-free:
BUG: KASAN: use-after-free in madvise_willneed mm/madvise.c:293 [inline]
BUG: KASAN: use-after-free in madvise_vma mm/madvise.c:942 [inline]
BUG: KASAN: use-after-free in do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145
Read of size 8 at addr ffff8880a6163eb0 by task syz-executor.0/9996
CPU: 0 PID: 9996 Comm: syz-executor.0 Not tainted 5.9.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x18f/0x20d lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
__kasan_report mm/kasan/report.c:513 [inline]
kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
madvise_willneed mm/madvise.c:293 [inline]
madvise_vma mm/madvise.c:942 [inline]
do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145
do_madvise mm/madvise.c:1169 [inline]
__do_sys_madvise mm/madvise.c:1171 [inline]
__se_sys_madvise mm/madvise.c:1169 [inline]
__x64_sys_madvise+0xd9/0x110 mm/madvise.c:1169
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Allocated by task 9992:
kmem_cache_alloc+0x138/0x3a0 mm/slab.c:3482
vm_area_alloc+0x1c/0x110 kernel/fork.c:347
mmap_region+0x8e5/0x1780 mm/mmap.c:1743
do_mmap+0xcf9/0x11d0 mm/mmap.c:1545
vm_mmap_pgoff+0x195/0x200 mm/util.c:506
ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 9992:
kmem_cache_free.part.0+0x67/0x1f0 mm/slab.c:3693
remove_vma+0x132/0x170 mm/mmap.c:184
remove_vma_list mm/mmap.c:2613 [inline]
__do_munmap+0x743/0x1170 mm/mmap.c:2869
do_munmap mm/mmap.c:2877 [inline]
mmap_region+0x257/0x1780 mm/mmap.c:1716
do_mmap+0xcf9/0x11d0 mm/mmap.c:1545
vm_mmap_pgoff+0x195/0x200 mm/util.c:506
ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9It is because vma is accessed after releasing mmap_lock, but someone else acquired the mmap_lock and the vma is gone.
Releasing mmap_lock after accessing vma should fix the problem.
--- mm/madvise.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/madvise.c +1 -1
@@ -288,9 +288,9 @@ static long madvise_willneed(struct vm_a*/ *prev =NULL ;/* tell sys_madvise we drop mmap_sem */ get_file (file); -up_read (¤t->mm->mmap_sem); offset = (loff_t)(start - vma->vm_start) + ((loff_t )vma->vm_pgoff <<PAGE_SHIFT ); +up_read (¤t->mm->mmap_sem);vfs_fadvise (file, offset, end - start,POSIX_FADV_WILLNEED );fput (file);down_read (¤t->mm->mmap_sem);
Greg Kroah-Hartman
maintainerPATCH 122/129 vfio/pci: Fix SR-IOV VF handling with MMIO blocking
In reply to Greg Kroah-HartmanFrom: Alex Williamson <[email protected]>
commit ebfa440ce38b7e2e04c3124aa89c8a9f4094cf21 upstream.
SR-IOV VFs do not implement the memory enable bit of the command register, therefore this bit is not set in config space after pci_enable_device(). This leads to an unintended difference between PF and VF in hand-off state to the user. We can correct this by setting the initial value of the memory enable bit in our virtualized config space. There's really no need however to ever fault a user on a VF though as this would only indicate an error in the user's management of the enable bit, versus a PF where the same access could trigger hardware faults.
--- drivers/vfio/pci/vfio_pci_config.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/vfio/pci/vfio_pci_config.c +16 -1
@@ -398,9 +398,15 @@ static inline void p_setd(struct perm_bi/* Caller should hold memory_lock semaphore */ bool __vfio_pci_memory_enabled (struct vfio_pci_device *vdev) { +struct pci_dev *pdev = vdev->pdev;u16 cmd =le16_to_cpu (*(__le16 *)&vdev->vconfig[PCI_COMMAND ]); -return cmd &PCI_COMMAND_MEMORY ; +/* +* SR-IOV VF memory enable is handled by the MSE bit in the +* PF SR-IOV capability, there's therefore no need to trigger +* faults based on the virtual value. +*/ +return pdev->is_virtfn || (cmd &PCI_COMMAND_MEMORY ); }/*
@@ -1726,6 +1732,15 @@ int vfio_config_init(struct vfio_pci_dev vconfig[PCI_INTERRUPT_PIN]); vconfig[PCI_INTERRUPT_PIN ] =0 ;/* Gratuitous for good VFs */ + +/* +* VFs do no implement the memory enable bit of the COMMAND +* register therefore we'll not have it set in our initial +* copy of config space after pci_enable_device(). For +* consistency with PFs, set the virtual enable bit here. +*/ + *(__le16 *)&vconfig[PCI_COMMAND ] |= +cpu_to_le16 (PCI_COMMAND_MEMORY ); }if (!IS_ENABLED (CONFIG_VFIO_PCI_INTX ) || vdev->nointx)
Greg Kroah-Hartman
maintainerPATCH 123/129 perf record: Correct the help info of option "--no-bpf-event"
In reply to Greg Kroah-HartmanFrom: Wei Li <[email protected]>
commit a060c1f12b525ba828f871eff3127dabf8daa1e6 upstream.
The help info of option "--no-bpf-event" is wrongly described as "record bpf events", correct it.
Committer testing:
$ perf record -h bpf
Usage: perf record [<options>] [<command>]
or: perf record [<options>] -- <command> [<options>]
--clang-opt <clang options>
options passed to clang when compiling BPF scriptlets
--clang-path <clang path>
clang binary to use for compiling BPF scriptlets
--no-bpf-event do not record bpf events
$
--- tools/perf/builtin-record.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-record.c +1 -1
@@ -2137,7 +2137,7 @@ static struct option __record_options[]OPT_BOOLEAN (0 ,"tail-synthesize" , &record.opts.tail_synthesize,"synthesize non-sample events at the end of output" ),OPT_BOOLEAN (0 ,"overwrite" , &record.opts.overwrite,"use overwrite mode" ), -OPT_BOOLEAN (0 ,"no-bpf-event" , &record.opts.no_bpf_event,"record bpf events" ), +OPT_BOOLEAN (0 ,"no-bpf-event" , &record.opts.no_bpf_event,"do not record bpf events" ),OPT_BOOLEAN (0 ,"strict-freq" , &record.opts.strict_freq,"Fail if the specified frequency can't be used" ), OPT_CALLBACK('F', "freq", &record.opts, "freq or 'max'",
Greg Kroah-Hartman
maintainerPATCH 124/129 sdhci: tegra: Add missing TMCLK for data timeout
In reply to Greg Kroah-HartmanFrom: Sowjanya Komatineni <[email protected]>
commit 8048822bac01936fda2c7b924a52131da81e6198 upstream.
commit b5a84ecf025a ("mmc: tegra: Add Tegra210 support")
Tegra210 and later has a separate sdmmc_legacy_tm (TMCLK) used by Tegra SDMMC hawdware for data timeout to achive better timeout than using SDCLK and using TMCLK is recommended.
USE_TMCLK_FOR_DATA_TIMEOUT bit in Tegra SDMMC register SDHCI_TEGRA_VENDOR_SYS_SW_CTRL can be used to choose either TMCLK or SDCLK for data timeout.
Default USE_TMCLK_FOR_DATA_TIMEOUT bit is set to 1 and TMCLK is used for data timeout by Tegra SDMMC hardware and having TMCLK not enabled is not recommended.
So, this patch adds quirk NVQUIRK_HAS_TMCLK for SoC having separate timeout clock and keeps TMCLK enabled all the time.
--- drivers/mmc/host/sdhci-tegra.c | 53 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 51 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-tegra.c +51 -2
@@ -100,6 +100,12 @@#define NVQUIRK_DIS_CARD_CLK_CONFIG_TAP BIT(8)#define NVQUIRK_CQHCI_DCMD_R1B_CMD_TIMING BIT(9) +/* +* NVQUIRK_HAS_TMCLK is for SoC's having separate timeout clock for Tegra +* SDMMC hardware data timeout. +*/ +#define NVQUIRK_HAS_TMCLK BIT(10) +/* SDMMC CQE Base Address for Tegra Host Ver 4.1 and Higher */ #define SDHCI_TEGRA_CQE_BASE_ADDR 0xF000
@@ -130,6 +136,7 @@ struct sdhci_tegra_autocal_offsets {struct sdhci_tegra {const struct sdhci_tegra_soc_data *soc_data;struct gpio_desc *power_gpio; +struct clk *tmclk;bool ddr_signaling;bool pad_calib_required;bool pad_control_available;
@@ -1385,7 +1392,8 @@ static const struct sdhci_tegra_soc_dataNVQUIRK_HAS_PADCALIB |NVQUIRK_DIS_CARD_CLK_CONFIG_TAP |NVQUIRK_ENABLE_SDR50 | - NVQUIRK_ENABLE_SDR104, +NVQUIRK_ENABLE_SDR104 | + NVQUIRK_HAS_TMCLK, .min_tap_delay = 106, .max_tap_delay = 185, };
@@ -1422,6 +1430,7 @@ static const struct sdhci_tegra_soc_dataNVQUIRK_DIS_CARD_CLK_CONFIG_TAP |NVQUIRK_ENABLE_SDR50 |NVQUIRK_ENABLE_SDR104 | +NVQUIRK_HAS_TMCLK | NVQUIRK_CQHCI_DCMD_R1B_CMD_TIMING, .min_tap_delay = 84, .max_tap_delay = 136,
@@ -1434,7 +1443,8 @@ static const struct sdhci_tegra_soc_dataNVQUIRK_HAS_PADCALIB |NVQUIRK_DIS_CARD_CLK_CONFIG_TAP |NVQUIRK_ENABLE_SDR50 | - NVQUIRK_ENABLE_SDR104, +NVQUIRK_ENABLE_SDR104 | + NVQUIRK_HAS_TMCLK, .min_tap_delay = 96, .max_tap_delay = 139, };
@@ -1562,6 +1572,43 @@ static int sdhci_tegra_probe(struct plat goto err_power_req; } +/* +* Tegra210 has a separate SDMMC_LEGACY_TM clock used for host +* timeout clock and SW can choose TMCLK or SDCLK for hardware +* data timeout through the bit USE_TMCLK_FOR_DATA_TIMEOUT of +* the register SDHCI_TEGRA_VENDOR_SYS_SW_CTRL. +* +* USE_TMCLK_FOR_DATA_TIMEOUT bit default is set to 1 and SDMMC uses +* 12Mhz TMCLK which is advertised in host capability register. +* With TMCLK of 12Mhz provides maximum data timeout period that can +* be achieved is 11s better than using SDCLK for data timeout. +* +* So, TMCLK is set to 12Mhz and kept enabled all the time on SoC's +* supporting separate TMCLK. +*/ + +if (soc_data->nvquirks &NVQUIRK_HAS_TMCLK ) { + clk =devm_clk_get (&pdev->dev,"tmclk" ); +if (IS_ERR (clk)) { + rc =PTR_ERR (clk); +if (rc == -EPROBE_DEFER ) + goto err_power_req; + +dev_warn (&pdev->dev,"failed to get tmclk: %d\n" , rc); + clk =NULL ; + } + +clk_set_rate (clk,12000000 ); + rc =clk_prepare_enable (clk); +if (rc) { +dev_err (&pdev->dev, +"failed to enable tmclk: %d\n" , rc); + goto err_power_req; + } + + tegra_host->tmclk = clk; + } + clk =devm_clk_get (mmc_dev (host->mmc),NULL );if (IS_ERR (clk)) { rc =PTR_ERR (clk);
@@ -1605,6 +1652,7 @@ err_add_host: err_rst_get:clk_disable_unprepare (pltfm_host->clk); err_clk_get: +clk_disable_unprepare (tegra_host->tmclk); err_power_req: err_parse_dt:sdhci_pltfm_free (pdev);
@@ -1622,6 +1670,7 @@ static int sdhci_tegra_remove(struct plareset_control_assert (tegra_host->rst);usleep_range (2000 ,4000 );clk_disable_unprepare (pltfm_host->clk); +clk_disable_unprepare (tegra_host->tmclk);sdhci_pltfm_free (pdev);
Greg Kroah-Hartman
maintainerPATCH 125/129 checkpatch: fix the usage of capture group ( ... )
In reply to Greg Kroah-HartmanFrom: Mrinal Pandey <[email protected]>
commit 13e45417cedbfc44b1926124b1846f5ee8c6ba4a upstream.
The usage of "capture group (...)" in the immediate condition after && results in $1 being uninitialized. This issues a warning "Use of uninitialized value $1 in regexp compilation at ./scripts/checkpatch.pl line 2638".
I noticed this bug while running checkpatch on the set of commits from v5.7 to v5.8-rc1 of the kernel on the commits with a diff content in their commit message.
This bug was introduced in the script by commit e518e9a59ec3 ("checkpatch: emit an error when there's a diff in a changelog"). It has been in the script since then.
The author intended to store the match made by capture group in variable $1. This should have contained the name of the file as [\w/]+ matched. However, this couldn't be accomplished due to usage of capture group and $1 in the same regular expression.
Fix this by placing the capture group in the condition before &&. Thus, $1 can be initialized to the text that capture group matches thereby setting it to the desired and required value.
--- scripts/checkpatch.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/checkpatch.pl +2 -2
@@ -2576,8 +2576,8 @@ sub process { # Check if the commit log has what seems like a diff which can confuse patch if ($in_commit_log && !$commit_log_has_diff && - (($line =~ m@^\s+diff\b.*a/[\w/]+@ && - $line =~ m@^\s+diff\b.*a/([\w/]+)\s+b/$1\b@) || + (($line =~ m@^\s+diff\b.*a/([\w/]+)@ && + $line =~ m@^\s+diff\b.*a/[\w/]+\s+b/$1\b@) || $line =~ m@^\s*(?:\-\-\-\s+a/|\+\+\+\s+b/)@ || $line =~ m/^\s*\@\@ \-\d+,\d+ \+\d+,\d+ \@\@/)) { ERROR("DIFF_IN_COMMIT_MSG",
Greg Kroah-Hartman
maintainerPATCH 126/129 mm/hugetlb: fix a race between hugetlb sysctl handlers
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
commit 17743798d81238ab13050e8e2833699b54e15467 upstream.
There is a race between the assignment of table->data and write value to the pointer of table->data in the __do_proc_doulongvec_minmax() on the other thread.
CPU0: CPU1:
proc_sys_write
hugetlb_sysctl_handler proc_sys_call_handler
hugetlb_sysctl_handler_common hugetlb_sysctl_handler
table->data = &tmp; hugetlb_sysctl_handler_common
table->data = &tmp;
proc_doulongvec_minmax
do_proc_doulongvec_minmax sysctl_head_finish
__do_proc_doulongvec_minmax unuse_table
i = table->data;
*i = val; // corrupt CPU1's stackFix this by duplicating the table, and only update the duplicate of it. And introduce a helper of proc_hugetlb_doulongvec_minmax() to simplify the code.
The following oops was seen:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
Code: Bad RIP value.
...
Call Trace:
? set_max_huge_pages+0x3da/0x4f0
? alloc_pool_huge_page+0x150/0x150
? proc_doulongvec_minmax+0x46/0x60
? hugetlb_sysctl_handler_common+0x1c7/0x200
? nr_hugepages_store+0x20/0x20
? copy_fd_bitmaps+0x170/0x170
? hugetlb_sysctl_handler+0x1e/0x20
? proc_sys_call_handler+0x2f1/0x300
? unregister_sysctl_table+0xb0/0xb0
? __fd_install+0x78/0x100
? proc_sys_write+0x14/0x20
? __vfs_write+0x4d/0x90
? vfs_write+0xef/0x240
? ksys_write+0xc0/0x160
? __ia32_sys_read+0x50/0x50
? __close_fd+0x129/0x150
? __x64_sys_write+0x43/0x50
? do_syscall_64+0x6c/0x200
? entry_SYSCALL_64_after_hwframe+0x44/0xa9--- mm/hugetlb.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-)
mm/hugetlb.c +20 -6
@@ -3082,6 +3082,22 @@ static unsigned int cpuset_mems_nr(unsig }#ifdef CONFIG_SYSCTL +static int proc_hugetlb_doulongvec_minmax (struct ctl_table *table,int write, +void *buffer,size_t *length, +loff_t *ppos,unsigned long *out) +{ +struct ctl_table dup_table; + +/* +* In order to avoid races with __do_proc_doulongvec_minmax(), we +* can duplicate the @table and alter the duplicate of it. +*/ + dup_table = *table; + dup_table.data = out; + +return proc_doulongvec_minmax (&dup_table, write, buffer, length, ppos); +} +static int hugetlb_sysctl_handler_common (bool obey_mempolicy,struct ctl_table *table,int write,void __user *buffer,size_t *length,loff_t *ppos)
@@ -3093,9 +3109,8 @@ static int hugetlb_sysctl_handler_commonif (!hugepages_supported ())return -EOPNOTSUPP ; - table->data = &tmp; - table->maxlen =sizeof (unsigned long ); - ret =proc_doulongvec_minmax (table, write, buffer, length, ppos); + ret =proc_hugetlb_doulongvec_minmax (table, write, buffer, length, ppos, + &tmp);if (ret) goto out;
@@ -3139,9 +3154,8 @@ int hugetlb_overcommit_handler(struct ctif (write &&hstate_is_gigantic (h))return -EINVAL ; - table->data = &tmp; - table->maxlen =sizeof (unsigned long ); - ret =proc_doulongvec_minmax (table, write, buffer, length, ppos); + ret =proc_hugetlb_doulongvec_minmax (table, write, buffer, length, ppos, + &tmp);if (ret) goto out;
Greg Kroah-Hartman
maintainerPATCH 127/129 mm/khugepaged.c: fix khugepageds request size in collapse_file
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
commit e5a59d308f52bb0052af5790c22173651b187465 upstream.
collapse_file() in khugepaged passes PAGE_SIZE as the number of pages to be read to page_cache_sync_readahead(). The intent was probably to read a single page. Fix it to use the number of pages to the end of the window instead.
--- mm/khugepaged.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/khugepaged.c +1 -1
@@ -1592,7 +1592,7 @@ static void collapse_file(struct mm_struxas_unlock_irq (&xas);page_cache_sync_readahead (mapping, &file->f_ra, file, index, -PAGE_SIZE ); + end - index);/* drain pagevecs to help isolate_lru_page() */ lru_add_drain (); page =find_lock_page (mapping, index);
Greg Kroah-Hartman
maintainerPATCH 128/129 cfg80211: regulatory: reject invalid hints
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 47caf685a6854593348f216e0b489b71c10cbe03 upstream.
Reject invalid hints early in order to not cause a kernel WARN later if they're restored to or similar.
--- net/wireless/reg.c | 3 +++ 1 file changed, 3 insertions(+)
net/wireless/reg.c +3 -0
@@ -2941,6 +2941,9 @@ int regulatory_hint_user(const char *alpif (WARN_ON (!alpha2))return -EINVAL ; +if (!is_world_regdom (alpha2) && !is_an_alpha2 (alpha2)) +return -EINVAL ; + request =kzalloc (sizeof (struct regulatory_request ),GFP_KERNEL );if (!request)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 129/129 net: usb: Fix uninit-was-stored issue in asix_read_phy_addr()
In reply to Greg Kroah-HartmanFrom: Himadri Pandya <[email protected]>
commit a092b7233f0e000cc6f2c71a49e2ecc6f917a5fc upstream.
The buffer size is 2 Bytes and we expect to receive the same amount of data. But sometimes we receive less data and run into uninit-was-stored issue upon read. Hence modify the error check on the return value to match with the buffer size as a prevention.
Reported-and-tested by: [email protected]
--- drivers/net/usb/asix_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/asix_common.c +1 -1
@@ -296,7 +296,7 @@ int asix_read_phy_addr(struct usbnet *denetdev_dbg (dev->net,"asix_get_phy_addr()\n" ); -if (ret <0 ) { +if (ret <2 ) {netdev_err (dev->net,"Error reading PHYID register: %02x\n" , ret); goto out; }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.64 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Sep 2020 15:21:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.64-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.64 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Sep 2020 15:21:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.64-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 5.4.64-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.4.y
git commit: be965cc6b079fbac3bf73ce195ae06aa5314fd99
git describe: v5.4.63-130-gbe965cc6b079
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.4-oe/build/v5.4.63-130-gbe965cc6b079
No regressions (compared to build v5.4.63)
No fixes (compared to build v5.4.63)
Ran 34523 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- juno-r2-compat
- juno-r2-kasan
- nxp-ls2088
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15
- x86
- x86-kasan
Test Suites
-----------
* build
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest
* kselftest/drivers
* kselftest/filesystems
* kselftest/net
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-tracing-tests
* perf
* v4l2-compliance
* ltp-commands-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-syscalls-tests
* network-basic-tests
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-native/drivers
* kselftest-vsyscall-mode-native/filesystems
* kselftest-vsyscall-mode-native/net
* kselftest-vsyscall-mode-none
* kselftest-vsyscall-mode-none/drivers
* kselftest-vsyscall-mode-none/filesystems
* kselftest-vsyscall-mode-none/net
* ssuite
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.64 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Sep 2020 15:21:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.64-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.4:
14 builds: 14 pass, 0 fail
26 boots: 26 pass, 0 fail
56 tests: 56 pass, 0 failLinux version: 5.4.64-rc1-gbe965cc6b079
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.64 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Sep 2020 15:21:57 +0000. Anything received after that time might be too late.
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 430 pass: 430 fail: 0
Guenter