5.4.69-rc1 review
Subsystems (10)
Greg Kroah-Hartman
maintainercover 5.4.69-rc1 review
This is the start of the stable review cycle for the 5.4.69 release. There are 388 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 01 Oct 2020 10:59:03 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.69-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.69-rc1
Jiri Slaby <[email protected]>
ata: sata_mv, avoid trigerrable BUG_ON
Jiri Slaby <[email protected]>
ata: make qc_prep return ata_completion_errors
Jiri Slaby <[email protected]>
ata: define AC_ERR_OK
Muchun Song <[email protected]>
kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE
Mike Snitzer <[email protected]>
dm: fix bio splitting and its bio completion order for regular IO
Marc Zyngier <[email protected]>
KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch
Christian Borntraeger <[email protected]>
s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl
Vasily Gorbik <[email protected]>
mm/gup: fix gup_fast with dynamic page table folding
Gao Xiang <[email protected]>
mm, THP, swap: fix allocating cluster for swapfile by mistake
Charan Teja Reddy <[email protected]>
dmabuf: fix NULL pointer dereference in dma_buf_release()
Johannes Thumshirn <[email protected]>
btrfs: fix overflow when copying corrupt csums for a message
Masami Hiramatsu <[email protected]>
kprobes: tracing/kprobes: Fix to kill kprobes on initmem after boot
Masami Hiramatsu <[email protected]>
kprobes: Fix to check probe enabled before disarm_kprobe_ftrace()
Jan Höppner <[email protected]>
s390/dasd: Fix zero write for FBA devices
Tom Rix <[email protected]>
tracing: fix double free
Nick Desaulniers <[email protected]>
lib/string.c: implement stpcpy
Kai-Heng Feng <[email protected]>
ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520
Hui Wang <[email protected]>
ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged
Joakim Tjernlund <[email protected]>
ALSA: usb-audio: Add delay quirk for H570e USB headsets
James Smart <[email protected]>
scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported
Thomas Gleixner <[email protected]>
x86/ioapic: Unbreak check_timer()
Mikulas Patocka <[email protected]>
arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback
Minchan Kim <[email protected]>
mm: validate pmd after splitting
Tom Lendacky <[email protected]>
KVM: SVM: Add a dedicated INVD intercept routine
Sean Christopherson <[email protected]>
KVM: x86: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE
Icenowy Zheng <[email protected]>
regulator: axp20x: fix LDO2/4 description
Wei Li <[email protected]>
MIPS: Add the missing 'CPU_1074K' into __get_cpu_type()
Dmitry Baryshkov <[email protected]>
regmap: fix page selection for noinc writes
Dmitry Baryshkov <[email protected]>
regmap: fix page selection for noinc reads
Tom Rix <[email protected]>
ALSA: asihpi: fix iounmap in error handler
Necip Fazil Yildiran <[email protected]>
lib80211: fix unmet direct dependendices config warning when !CRYPTO
Yonghong Song <[email protected]>
bpf: Fix a rcu warning for bpffs map pretty-print
Linus Lüssing <[email protected]>
batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
Linus Lüssing <[email protected]>
batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh
Linus Lüssing <[email protected]>
batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
Necip Fazil Yildiran <[email protected]>
nvme-tcp: fix kconfig dependency warning when !CRYPTO
Sven Eckelmann <[email protected]>
batman-adv: Add missing include for in_interrupt()
Martin Cerveny <[email protected]>
drm/sun4i: sun8i-csc: Secondary CSC register correction
Dmitry Bogdanov <[email protected]>
net: qed: RDMA personality shouldn't fail VF load
Dmitry Bogdanov <[email protected]>
net: qede: Disable aRFS for NPAR and 100G
Dmitry Bogdanov <[email protected]>
net: qed: Disable aRFS for NPAR and 100G
Marek Szyprowski <[email protected]>
drm/vc4/vc4_hdmi: fill ASoC card owner
Daniel Borkmann <[email protected]>
bpf: Fix clobbering of r2 in bpf_gen_ld_abs
Eric Dumazet <[email protected]>
mac802154: tx: fix use-after-free
Eelco Chaudron <[email protected]>
netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled
Linus Lüssing <[email protected]>
batman-adv: mcast/TT: fix wrongly dropped or rerouted packets
Jing Xiangfeng <[email protected]>
atm: eni: fix the missed pci_disable_device() for eni_init_one()
Linus Lüssing <[email protected]>
batman-adv: bla: fix type misuse for backbone_gw hash indexing
Maximilian Luz <[email protected]>
mwifiex: Increase AES key storage size to 256 bits
Tianjia Zhang <[email protected]>
clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init()
Tom Rix <[email protected]>
ieee802154/adf7242: check status of adf7242_read_reg
Liu Jian <[email protected]>
ieee802154: fix one possible memleak in ca8210_dev_com_init
Josh Poimboeuf <[email protected]>
objtool: Fix noreturn detection for ignored functions
Hans de Goede <[email protected]>
i2c: core: Call i2c_acpi_install_space_handler() before i2c_acpi_register_devices()
Michel Dänzer <[email protected]>
drm/amdgpu/dc: Require primary plane to be enabled whenever the CRTC is
Jun Lei <[email protected]>
drm/amd/display: update nv1x stutter latencies
Dennis Li <[email protected]>
drm/amdkfd: fix a memory leak issue
Borislav Petkov <[email protected]>
EDAC/ghes: Check whether the driver is on the safe list correctly
Sven Schnelle <[email protected]>
lockdep: fix order in trace_hardirqs_off_caller()
Ilya Leoshkevich <[email protected]>
s390/init: add missing __init annotations
Eddie James <[email protected]>
i2c: aspeed: Mask IRQ status to relevant bits
Palmer Dabbelt <[email protected]>
RISC-V: Take text_mutex in ftrace_init_nop()
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1
Sylwester Nawrocki <[email protected]>
ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions
Sylwester Nawrocki <[email protected]>
ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811
Kuninori Morimoto <[email protected]>
ASoC: pcm3168a: ignore 0 Hz settings
Amol Grover <[email protected]>
device_cgroup: Fix RCU list debugging warning
Anthony Iliopoulos <[email protected]>
nvme: explicitly update mpath disk capacity on revalidation
Tonghao Zhang <[email protected]>
net: openvswitch: use div_u64() for 64-by-32 divisions
Takashi Iwai <[email protected]>
ALSA: hda: Workaround for spurious wakeups on some Intel platforms
Takashi Iwai <[email protected]>
ALSA: hda: Always use jackpoll helper for jack update after resume
Jin Yao <[email protected]>
perf parse-events: Use strcmp() to compare the PMU name
Walter Lozano <[email protected]>
opp: Increase parsed_static_opps in _of_add_opp_table_v1()
Arnd Bergmann <[email protected]>
mt76: fix LED link time failure
Hou Tao <[email protected]>
ubi: fastmap: Free unused fastmap anchor peb during detach
Quinn Tran <[email protected]>
scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure
Thomas Richter <[email protected]>
perf tests: Fix test 68 zstd compression for s390
Qu Wenruo <[email protected]>
btrfs: qgroup: fix data leak caused by race between writeback and truncate
Zeng Tao <[email protected]>
vfio/pci: fix racy on error and request eventfd ctx
Andy Lutomirski <[email protected]>
selftests/x86/syscall_nt: Clear weird flags after each test
Javed Hasan <[email protected]>
scsi: libfc: Skip additional kref updating work event
Javed Hasan <[email protected]>
scsi: libfc: Handling of extra kref
Markus Theil <[email protected]>
mac80211: skip mpath lookup also for control port tx
Sagi Grimberg <[email protected]>
nvme: fix possible deadlock when I/O is blocked
Zhang Xiaoxu <[email protected]>
cifs: Fix double add page to memcg when cifs_readpages
Alex Williamson <[email protected]>
vfio/pci: Clear error and request eventfd ctx after releasing
Chuck Lever <[email protected]>
NFS: nfs_xdr_status should record the procedure name
Thomas Gleixner <[email protected]>
x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline
Boris Brezillon <[email protected]>
mtd: parser: cmdline: Support MTD names containing one or more colons
Madhuparna Bhowmik <[email protected]>
rapidio: avoid data race between file operation callbacks and mport_cdev_add().
Johannes Weiner <[email protected]>
mm: memcontrol: fix stat-corrupting race in charge moving
Qian Cai <[email protected]>
mm/swap_state: fix a data race in swapin_nr_pages
Jeff Layton <[email protected]>
ceph: fix potential race in ceph_check_caps
Dinghao Liu <[email protected]>
PCI: tegra: Fix runtime PM imbalance on error
Dinghao Liu <[email protected]>
mtd: rawnand: omap_elm: Fix runtime PM imbalance on error
Dinghao Liu <[email protected]>
mtd: rawnand: gpmi: Fix runtime PM imbalance on error
Dinghao Liu <[email protected]>
wlcore: fix runtime pm imbalance in wlcore_regdomain_config
Dinghao Liu <[email protected]>
wlcore: fix runtime pm imbalance in wl1271_tx_work
Dinghao Liu <[email protected]>
ASoC: img-i2s-out: Fix runtime PM imbalance on error
Dinghao Liu <[email protected]>
PCI: tegra194: Fix runtime PM imbalance on error
Adrian Hunter <[email protected]>
perf kcore_copy: Fix module map when there are no modules loaded
Ian Rogers <[email protected]>
perf metricgroup: Free metric_events on error
Xie XiuQi <[email protected]>
perf util: Fix memory leak of prefix_if_not_in
Jiri Olsa <[email protected]>
perf stat: Fix duration_time value for higher intervals
Ian Rogers <[email protected]>
perf trace: Fix the selection for architectures to generate the errno name tables
Ian Rogers <[email protected]>
perf evsel: Fix 2 memory leaks
Paul Mackerras <[email protected]>
KVM: PPC: Book3S HV: Close race with page faults around memslot flushes
Qian Cai <[email protected]>
vfio/pci: fix memory leaks of eventfd ctx
Dinghao Liu <[email protected]>
gpio: rcar: Fix runtime PM imbalance on error
Omar Sandoval <[email protected]>
btrfs: fix double __endio_write_update_ordered in direct I/O
David Sterba <[email protected]>
btrfs: don't force read-only after error in drop snapshot
Yu Chen <[email protected]>
usb: dwc3: Increase timeout for CmdAct cleared by device controller
Shreyas Joshi <[email protected]>
printk: handle blank console arguments passed in.
Dinghao Liu <[email protected]>
drm/nouveau/dispnv50: fix runtime pm imbalance on error
Dinghao Liu <[email protected]>
drm/nouveau: fix runtime pm imbalance on error
Dinghao Liu <[email protected]>
drm/nouveau/debugfs: fix runtime pm imbalance on error
Alexander Duyck <[email protected]>
e1000: Do not perform reset in reset_task if we are already down
Philip Yang <[email protected]>
drm/amdkfd: fix restore worker race condition
Anshuman Khandual <[email protected]>
arm64/cpufeature: Drop TraceFilt feature exposure from ID_DFR0 register
Wei Yongjun <[email protected]>
scsi: cxlflash: Fix error return code in cxlflash_probe()
James Morse <[email protected]>
arm64: acpi: Make apei_claim_sea() synchronise with APEI's irq work
Suzuki K Poulose <[email protected]>
coresight: etm4x: Fix use-after-free of per-cpu etm drvdata
Colin Ian King <[email protected]>
USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int
Miklos Szeredi <[email protected]>
fuse: update attr_version counter on fuse_notify_inval_inode()
Miklos Szeredi <[email protected]>
fuse: don't check refcount after stealing page
Chuck Lever <[email protected]>
svcrdma: Fix backchannel return code
Nicholas Piggin <[email protected]>
powerpc/traps: Make unrecoverable NMIs die instead of panic
Tang Bin <[email protected]>
ipmi:bt-bmc: Fix error handling and status check
Christophe JAILLET <[email protected]>
drm/exynos: dsi: Remove bridge node reference in error handling path in probe function
Takashi Iwai <[email protected]>
ALSA: hda: Fix potential race in unsol event handler
Jonathan Bakker <[email protected]>
tty: serial: samsung: Correct clock selection logic
Tuong Lien <[email protected]>
tipc: fix memory leak in service subscripting
Paolo Bonzini <[email protected]>
KVM: x86: handle wrap around 32-bit address space
Tang Bin <[email protected]>
USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe()
Sonny Sasaka <[email protected]>
Bluetooth: Handle Inquiry Cancel error after Inquiry Complete
Jonathan Bakker <[email protected]>
phy: samsung: s5pv210-usb2: Add delay after reset
Jonathan Bakker <[email protected]>
power: supply: max17040: Correct voltage reading
Thierry Reding <[email protected]>
i2c: tegra: Restore pinmux on system resume
Waiman Long <[email protected]>
mm/slub: fix incorrect interpretation of s->offset
Ian Rogers <[email protected]>
perf mem2node: Avoid double free related to realloc
Stanimir Varbanov <[email protected]>
media: venus: vdec: Init registered list unconditionally
Cong Wang <[email protected]>
atm: fix a memory leak of vcc->user_back
Aya Levin <[email protected]>
devlink: Fix reporter's recovery condition
Krzysztof Kozlowski <[email protected]>
dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion
Wei Yongjun <[email protected]>
dpaa2-eth: fix error return code in setup_dpni()
Paul Turner <[email protected]>
sched/fair: Eliminate bandwidth race between throttling and distribution
Will Deacon <[email protected]>
arm64: cpufeature: Relax checks for AArch32 support at EL[0-2]
Wei Yongjun <[email protected]>
sparc64: vcc: Fix error return code in vcc_probe()
Ivan Safonov <[email protected]>
staging:r8188eu: avoid skb_clone for amsdu to msdu conversion
Christophe JAILLET <[email protected]>
scsi: aacraid: Fix error handling paths in aac_probe_one()
Tonghao Zhang <[email protected]>
net: openvswitch: use u64 for meter bucket
Zenghui Yu <[email protected]>
KVM: arm64: vgic-its: Fix memory leak on the error path of vgic_add_lpi()
Zenghui Yu <[email protected]>
KVM: arm64: vgic-v3: Retire all pending LPIs on vcpu destroy
Madhuparna Bhowmik <[email protected]>
drivers: char: tlclk.c: Avoid data race between init and interrupt handler
Douglas Anderson <[email protected]>
bdev: Reduce time holding bd_mutex in sync in blkdev_close()
Stephane Eranian <[email protected]>
perf stat: Force error in fallback on :k events
Steve Rutherford <[email protected]>
KVM: Remove CREATE_IRQCHIP/SET_PIT2 race
Josef Bacik <[email protected]>
btrfs: fix setting last_trans for reloc roots
Raviteja Narayanam <[email protected]>
serial: uartps: Wait for tx_empty in console setup
Nilesh Javali <[email protected]>
scsi: qedi: Fix termination timeouts in session logout
Takashi Iwai <[email protected]>
ALSA: hda: Skip controller resume if not needed
Jaewon Kim <[email protected]>
mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area
Jack Zhang <[email protected]>
drm/amdgpu/sriov add amdgpu_amdkfd_pre_reset in gpu reset
Sebastian Andrzej Siewior <[email protected]>
workqueue: Remove the warning in wq_worker_sleeping()
Israel Rukshin <[email protected]>
nvmet-rdma: fix double free of rdma queue
Trond Myklebust <[email protected]>
SUNRPC: Don't start a timer on an already queued rpc task
Qian Cai <[email protected]>
mm/vmscan.c: fix data races using kswapd_classzone_idx
Qian Cai <[email protected]>
mm/swapfile: fix data races in try_to_unuse()
Xianting Tian <[email protected]>
mm/filemap.c: clear page error before actual read
Nathan Chancellor <[email protected]>
mm/kmemleak.c: use address-of operator on section symbols
Anju T Sudhakar <[email protected]>
powerpc/perf: Implement a global lock to avoid races between trace, core and thread imc events.
James Zhu <[email protected]>
drm/amdgpu/vcn2.0: stall DPG when WPTR/RPTR reset
Trond Myklebust <[email protected]>
NFS: Fix races nfs_page_group_destroy() vs nfs_destroy_unlinked_subrequests()
Stuart Hayes <[email protected]>
PCI: pciehp: Fix MSI interrupt race
Andreas Steinmetz <[email protected]>
ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor
Liu Song <[email protected]>
ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len
Zhihao Cheng <[email protected]>
ubifs: ubifs_add_orphan: Fix a memory leak bug
Zhihao Cheng <[email protected]>
ubifs: ubifs_jnl_write_inode: Fix a memory leak bug
Mikel Rychliski <[email protected]>
PCI: Use ioremap(), not phys_to_virt() for platform ROM
Qian Cai <[email protected]>
netfilter: nf_tables: silence a RCU-list warning in nft_table_lookup()
Chuck Lever <[email protected]>
svcrdma: Fix leak of transport addresses
Christophe JAILLET <[email protected]>
SUNRPC: Fix a potential buffer overflow in 'svc_print_xprts()'
Don Brace <[email protected]>
scsi: hpsa: correct race condition in offload enabled
Sergey Gorenko <[email protected]>
IB/iser: Always check sig MR before putting it to the free pool
Zhu Yanjun <[email protected]>
RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices
Darrick J. Wong <[email protected]>
xfs: prohibit fs freezing when using empty transactions
Raveendran Somu <[email protected]>
brcmfmac: Fix double freeing in the fmac usb data path
Israel Rukshin <[email protected]>
nvme: Fix controller creation races with teardown flow
Israel Rukshin <[email protected]>
nvme: Fix ctrl use-after-free during sysfs deletion
John Meneghini <[email protected]>
nvme-multipath: do not reset on unknown status
Bernd Edlinger <[email protected]>
perf: Use new infrastructure to fix deadlocks in execve
Bernd Edlinger <[email protected]>
proc: io_accounting: Use new infrastructure to fix deadlocks in execve
Bernd Edlinger <[email protected]>
proc: Use new infrastructure to fix deadlocks in execve
Bernd Edlinger <[email protected]>
kernel/kcmp.c: Use new infrastructure to fix deadlocks in execve
Bernd Edlinger <[email protected]>
selftests/ptrace: add test cases for dead-locks
Bernd Edlinger <[email protected]>
exec: Fix a deadlock in strace
Eric W. Biederman <[email protected]>
exec: Add exec_update_mutex to replace cred_guard_mutex
Gabriel Ravier <[email protected]>
tools: gpio-hammer: Avoid potential overflow in main
Pratik Rajesh Sampat <[email protected]>
cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_work_fn
Andre Przywara <[email protected]>
net: axienet: Propagate failure of DMA descriptor setup
Andre Przywara <[email protected]>
net: axienet: Convert DMA error handler to a work queue
Christophe JAILLET <[email protected]>
perf cpumap: Fix snprintf overflow check
Vignesh Raghavendra <[email protected]>
serial: 8250: 8250_omap: Terminate DMA before pushing data on RX timeout
Peter Ujfalusi <[email protected]>
serial: 8250_omap: Fix sleeping function called from invalid context during probe
Vignesh Raghavendra <[email protected]>
serial: 8250_port: Don't service RX FIFO if throttled
Heiner Kallweit <[email protected]>
r8169: improve RTL8168b FIFO overflow workaround
Josef Bacik <[email protected]>
btrfs: free the reloc_control in a consistent way
Josef Bacik <[email protected]>
btrfs: do not init a reloc root if we aren't relocating
Ian Rogers <[email protected]>
perf parse-events: Fix 3 use after frees found with clang ASAN
He Zhe <[email protected]>
KVM: LAPIC: Mark hrtimer for period or oneshot mode to expire in hard interrupt context
Niklas Söderlund <[email protected]>
thermal: rcar_thermal: Handle probe error gracefully
Nathan Chancellor <[email protected]>
tracing: Use address-of operator on section symbols
Jordan Crouse <[email protected]>
drm/msm/a5xx: Always set an OPP supported hardware value
Pavel Machek <[email protected]>
drm/msm: fix leaks if initialization fails
Gustavo Romero <[email protected]>
KVM: PPC: Book3S HV: Treat TM-related invalid form instructions on P9 like the valid ones
Alexander Shishkin <[email protected]>
intel_th: Disallow multi mode on devices where it's broken
Jason Gunthorpe <[email protected]>
RDMA/cm: Remove a race freeing timewait_info
Trond Myklebust <[email protected]>
nfsd: Don't add locks to closed or closing open stateids
Alexandre Belloni <[email protected]>
rtc: ds1374: fix possible race condition
Alexandre Belloni <[email protected]>
rtc: sa1100: fix possible race condition
Stefan Berger <[email protected]>
tpm: ibmvtpm: Wait for buffer to be set before proceeding
Dmitry Monakhov <[email protected]>
ext4: mark block bitmap corrupted when found instead of BUGON
Darrick J. Wong <[email protected]>
xfs: mark dir corrupt when lookup-by-hash fails
Darrick J. Wong <[email protected]>
xfs: don't ever return a stale pointer from __xfs_dir3_free_read
Palmer Dabbelt <[email protected]>
tty: sifive: Finish transmission before changing the clock
Colin Ian King <[email protected]>
media: tda10071: fix unsigned sign extension overflow
Howard Chung <[email protected]>
Bluetooth: L2CAP: handle l2cap config request during open state
Sagar Biradar <[email protected]>
scsi: aacraid: Disabling TM path and only processing IOP reset
Wen Gong <[email protected]>
ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read
Leo Yan <[email protected]>
perf cs-etm: Correct synthesizing instruction samples
Leo Yan <[email protected]>
perf cs-etm: Swap packets for instruction samples
afzal mohammed <[email protected]>
s390/irq: replace setup_irq() by request_irq()
Zeng Tao <[email protected]>
cpu-topology: Fix the potential data corruption
Anson Huang <[email protected]>
clk: imx: Fix division by zero warning on pfdv2
Rodrigo Siqueira <[email protected]>
drm/amd/display: Stop if retimer is not available
Tony Lindgren <[email protected]>
ARM: OMAP2+: Handle errors for cpu_pm
John Clements <[email protected]>
drm/amdgpu: increase atombios cmd timeout
Kirill A. Shutemov <[email protected]>
mm: avoid data corruption on CoW fault into PFN-mapped VMA
John Garry <[email protected]>
perf jevents: Fix leak of mapfile memory
Qiujun Huang <[email protected]>
ext4: fix a data race at inode->i_disksize
Wenjing Liu <[email protected]>
drm/amd/display: fix image corruption with ODM 2:1 DSC 2 slice
Alexey Kardashevskiy <[email protected]>
powerpc/book3s64: Fix error handling in mm_iommu_do_alloc()
Wen Yang <[email protected]>
timekeeping: Prevent 32bit truncation in scale64_check_overflow()
Alain Michaud <[email protected]>
Bluetooth: guard against controllers sending zero'd events
Takashi Iwai <[email protected]>
media: go7007: Fix URB type for interrupt handling
Jaska Uimonen <[email protected]>
ASoC: SOF: ipc: check ipc return value before data copy
John Garry <[email protected]>
bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal
Qian Cai <[email protected]>
random: fix data races at timer_rand_state
James Morse <[email protected]>
firmware: arm_sdei: Use cpus_read_lock() to avoid races with cpuhp
Jiri Pirko <[email protected]>
iavf: use tc_cls_can_offload_and_chain0() instead of chain check
Laurent Pinchart <[email protected]>
drm/omap: dss: Cleanup DSS ports on initialisation failure
Aric Cyr <[email protected]>
drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic
Pierre-Louis Bossart <[email protected]>
soundwire: bus: disable pm_runtime in sdw_slave_delete
Dmitry Osipenko <[email protected]>
dmaengine: tegra-apb: Prevent race conditions on channel's freeing
Amelie Delaunay <[email protected]>
dmaengine: stm32-dma: use vchan_terminate_vdesc() in .terminate_all
Thomas Gleixner <[email protected]>
bpf: Remove recursion prevention from rcu free callback
Dave Hansen <[email protected]>
x86/pkeys: Add check for pkey "overflow"
Dan Carpenter <[email protected]>
media: staging/imx: Missing assignment in imx_media_capture_device_register()
Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: use vchan_terminate_vdesc() in .terminate_all
wanpeng li <[email protected]>
KVM: nVMX: Hold KVM's srcu lock when syncing vmcs12->shadow
Paolo Bonzini <[email protected]>
KVM: x86: fix incorrect comparison in trace event
Bart Van Assche <[email protected]>
RDMA/rxe: Fix configuration of atomic queue pair attributes
Thomas Richter <[email protected]>
perf test: Fix test trace+probe_vfs_getname.sh on s390
Takashi Iwai <[email protected]>
ALSA: usb-audio: Don't create a mixer element with bogus volume range
Felix Fietkau <[email protected]>
mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw
Felix Fietkau <[email protected]>
mt76: clear skb pointers from rx aggregation reorder buffer during cleanup
Ayush Sawal <[email protected]>
crypto: chelsio - This fixes the kernel panic which occurs during a libkcapi test
Dinh Nguyen <[email protected]>
clk: stratix10: use do_div() for 64-bit calculation
Waiman Long <[email protected]>
locking/lockdep: Decrement IRQ context counters when removing lock chain
Wen Yang <[email protected]>
drm/omap: fix possible object reference leak
James Smart <[email protected]>
scsi: lpfc: Fix coverity errors in fmdi attribute handling
James Smart <[email protected]>
scsi: lpfc: Fix release of hwq to clear the eq relationship
James Smart <[email protected]>
scsi: lpfc: Fix RQ buffer leakage when no IOCBs available
Vasily Averin <[email protected]>
selinux: sel_avc_get_stat_idx should increase position index
Steve Grubb <[email protected]>
audit: CONFIG_CHANGE don't log internal bookkeeping as an event
Tony Cheng <[email protected]>
drm/amd/display: fix workaround for incorrect double buffer register for DLG ADL and TTU
Trond Myklebust <[email protected]>
nfsd: Fix a perf warning
Qian Cai <[email protected]>
skbuff: fix a data race in skb_queue_len()
Mohan Kumar <[email protected]>
ALSA: hda: Clear RIRB status before reading WP
Zhuang Yanying <[email protected]>
KVM: fix overflow of zero page refcount with ksm running
Hillf Danton <[email protected]>
Bluetooth: prefetch channel before killing sock
Steven Price <[email protected]>
mm: pagewalk: fix termination condition in walk_pte_range()
Vasily Averin <[email protected]>
mm/swapfile.c: swap_next should increase position index
Manish Mandlik <[email protected]>
Bluetooth: Fix refcount use-after-free issue
Doug Smythies <[email protected]>
tools/power/x86/intel_pstate_tracer: changes for python 3 compatibility
Sven Schnelle <[email protected]>
selftests/ftrace: fix glob selftest
Jeff Layton <[email protected]>
ceph: ensure we have a new cap before continuing in fill_inode
Mert Dirik <[email protected]>
ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter
Vincent Whitchurch <[email protected]>
ARM: 8948/1: Prevent OOB access in stacktrace
Josef Bacik <[email protected]>
tracing: Set kernel_stack's caller size properly
Maxim Mikityanskiy <[email protected]>
Bluetooth: btrtl: Use kvmalloc for FW allocations
Oliver O'Halloran <[email protected]>
powerpc/eeh: Only dump stack once if an MMIO loop is detected
Trond Myklebust <[email protected]>
nfsd: Fix a soft lockup race in nfsd_file_mark_find_or_create()
Thomas Richter <[email protected]>
s390/cpum_sf: Use kzalloc and minor changes
Matthias Fend <[email protected]>
dmaengine: zynqmp_dma: fix burst length configuration
Qu Wenruo <[email protected]>
btrfs: tree-checker: Check leaf chunk item size
Dmitry Osipenko <[email protected]>
i2c: tegra: Prevent interrupt triggering after transfer timeout
David Francis <[email protected]>
drm/amd/display: Initialize DSC PPS variables to 0
Bart Van Assche <[email protected]>
scsi: ufs: Fix a race condition in the tracing code
Bart Van Assche <[email protected]>
scsi: ufs: Make ufshcd_add_command_trace() easier to read
Rafael J. Wysocki <[email protected]>
ACPI: EC: Reference count query handlers under lock
Kevin Kou <[email protected]>
sctp: move trace_sctp_probe_path into sctp_outq_sack
James Smart <[email protected]>
scsi: lpfc: Fix incomplete NVME discovery when target
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix stuck session in GNL
Viresh Kumar <[email protected]>
opp: Replace list_kref with a local counter
Nikhil Devshatwar <[email protected]>
media: ti-vpe: cal: Restrict DMA to avoid memory corruption
Andrey Grodzovsky <[email protected]>
drm/scheduler: Avoid accessing freed bad job.
Marco Elver <[email protected]>
seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier
Stephan Gerhold <[email protected]>
drm/mcde: Handle pending vblank while disabling display
Vasily Averin <[email protected]>
ipv6_route_seq_next should increase position index
Vasily Averin <[email protected]>
rt_cpu_seq_next should increase position index
Vasily Averin <[email protected]>
neigh_stat_seq_next() should increase position index
Vasily Averin <[email protected]>
vcc_seq_next should increase position index
Tuong Lien <[email protected]>
tipc: fix link overflow issue at socket shutdown
Kai Vehmanen <[email protected]>
ALSA: hda: enable regmap internal locking
Darrick J. Wong <[email protected]>
xfs: fix log reservation overflows when allocating large rt extents
Steven Rostedt (VMware) <[email protected]>
module: Remove accidental change of module_enable_x()
Miaohe Lin <[email protected]>
KVM: arm/arm64: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy()
Joe Perches <[email protected]>
kernel/sys.c: avoid copying possible padding bytes in copy_to_user
Xiaoming Ni <[email protected]>
kernel/notifier.c: intercept duplicate registrations to avoid infinite loops
Stanislav Fomichev <[email protected]>
selftests/bpf: De-flake test_tcpbpf
Mark Rutland <[email protected]>
arm64: insn: consistently handle exit text
Monk Liu <[email protected]>
drm/amdgpu: fix calltrace during kmd unload(v3)
Omar Sandoval <[email protected]>
xfs: fix realtime file data space leak
Vasily Gorbik <[email protected]>
s390: avoid misusing CALL_ON_STACK for task stack setup
Max Filippov <[email protected]>
xtensa: fix system_call interaction with ptrace
Tzung-Bi Shih <[email protected]>
ASoC: max98090: remove msleep in PLL unlocked workaround
Jaegeuk Kim <[email protected]>
f2fs: stop GC when the victim becomes fully valid
Pavel Shilovsky <[email protected]>
CIFS: Properly process SMB3 lease breaks
Markus Elfring <[email protected]>
CIFS: Use common error handling code in smb2_ioctl_query_info()
Chuck Lever <[email protected]>
SUNRPC: Capture completion of all RPC tasks
Kusanagi Kouichi <[email protected]>
debugfs: Fix !DEBUG_FS debugfs_create_automount
Felix Fietkau <[email protected]>
mt76: add missing locking around ampdu action
Felix Fietkau <[email protected]>
mt76: do not use devm API for led classdev
peter chang <[email protected]>
scsi: pm80xx: Cleanup command when a reset times out
Bob Peterson <[email protected]>
gfs2: clean up iopen glock mess in gfs2_create_inode
Bradley Bolen <[email protected]>
mmc: core: Fix size overflow for mmc partitions
Sascha Hauer <[email protected]>
ubi: Fix producing anchor PEBs
Christophe JAILLET <[email protected]>
RDMA/iw_cgxb4: Fix an error handling path in 'c4iw_connect()'
Brian Foster <[email protected]>
xfs: fix attr leaf header freemap.size underflow
Al Viro <[email protected]>
fix dget_parent() fastpath race
Nicholas Johnson <[email protected]>
PCI: Avoid double hpmemsize MMIO window assignment
Pan Bian <[email protected]>
RDMA/i40iw: Fix potential use after free
Pan Bian <[email protected]>
RDMA/qedr: Fix potential use after free
Lianbo Jiang <[email protected]>
x86/kdump: Always reserve the low 1M when the crashkernel option is specified
Satendra Singh Thakur <[email protected]>
dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails
Guoju Fang <[email protected]>
bcache: fix a lost wake-up problem caused by mca_cannibalize_lock
Divya Indi <[email protected]>
tracing: Adding NULL checks for trace_array descriptor pointer
Divya Indi <[email protected]>
tracing: Verify if trace array exists before destroying it.
Ivan Lazeev <[email protected]>
tpm_crb: fix fTPM on AMD Zen+ CPUs
Alex Deucher <[email protected]>
drm/amdgpu/powerplay/smu7: fix AVFS handling with custom powerplay table
Lee Jones <[email protected]>
mfd: mfd-core: Protect against NULL call-back function pointer
Hou Tao <[email protected]>
mtd: cfi_cmdset_0002: don't free cfi->cfiq in error path of cfi_amdstd_setup()
Usha Ketineni <[email protected]>
ice: Fix to change Rx/Tx ring descriptor size via ethtool with DCBx
Alex Deucher <[email protected]>
drm/amdgpu/powerplay: fix AVFS handling with custom powerplay table
Stephen Kitt <[email protected]>
clk/ti/adpll: allocate room for terminating null
Jaegeuk Kim <[email protected]>
f2fs: avoid kernel panic on corruption test
Andreas Gruenbacher <[email protected]>
iomap: Fix overflow in iomap_page_mkwrite
Dan Williams <[email protected]>
dax: Fix alloc_dax_region() compile warning
Eric Dumazet <[email protected]>
net: silence data-races on sk_backlog.tail
Michael Ellerman <[email protected]>
powerpc/64s: Always disable branch profiling for prom_init.o
James Smart <[email protected]>
scsi: lpfc: Fix kernel crash at lpfc_nvme_info_show during remote port bounce
Pan Bian <[email protected]>
scsi: fnic: fix use after free
Dmitry Osipenko <[email protected]>
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
Mike Snitzer <[email protected]>
dm table: do not allow request-based DM to stack on partitions
Oleh Kravchenko <[email protected]>
leds: mlxreg: Fix possible buffer overflow
Dave Chinner <[email protected]>
xfs: properly serialise fallocate against AIO+DIO
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Free gamma after calculating legacy transfer function
Sakari Ailus <[email protected]>
media: smiapp: Fix error handling at NVM reading
Pierre-Louis Bossart <[email protected]>
soundwire: intel/cadence: fix startup sequence
Russell King <[email protected]>
ASoC: kirkwood: fix IRQ error handling
Kangjie Lu <[email protected]>
gma/gma500: fix a memory disclosure bug due to uninitialized bytes
Dave Chinner <[email protected]>
xfs: fix inode fork extent count overflow
Fuqian Huang <[email protected]>
m68k: q40: Fix info-leak in rtc_ioctl
Balsundar P <[email protected]>
scsi: aacraid: fix illegal IO beyond last LBA
Jia He <[email protected]>
mm: fix double page fault on arm64 if PTE_AF is cleared
Pierre Crégut <[email protected]>
PCI/IOV: Serialize sysfs sriov_numvfs reads vs writes
Miaoqing Pan <[email protected]>
ath10k: fix memory leak for tpc_stats_final
Miaoqing Pan <[email protected]>
ath10k: fix array out-of-bounds access
Quinn Tran <[email protected]>
scsi: qla2xxx: Add error handling for PLOGI ELS passthrough
Chris Wilson <[email protected]>
dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling)
Jay Cornwall <[email protected]>
drm/amdkfd: Fix race in gfx10 context restore handler
Wesley Chalmers <[email protected]>
drm/amd/display: Do not double-buffer DTO adjustments
zhengbin <[email protected]>
media: mc-device.c: fix memleak in media_device_register_entity
Jonathan Lebon <[email protected]>
selinux: allow labeling before policy is loaded
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Free diag buffer without any status check
James Smart <[email protected]>
scsi: lpfc: Fix pt2pt discovery on SLI3 HBAs
Iurii Zaikin <[email protected]>
kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()
-------------
Diffstat:
Documentation/devicetree/bindings/sound/wm8994.txt | 18 +- Documentation/driver-api/libata.rst | 2 +- Makefile | 4 +- arch/arm/include/asm/kvm_emulate.h | 11 +- arch/arm/kernel/stacktrace.c | 2 + arch/arm/kernel/traps.c | 6 +- arch/arm/mach-omap2/cpuidle34xx.c | 9 +- arch/arm/mach-omap2/cpuidle44xx.c | 26 +- arch/arm/mach-omap2/pm34xx.c | 8 +- arch/arm64/include/asm/kvm_emulate.h | 12 +- arch/arm64/include/asm/sections.h | 1 + arch/arm64/kernel/acpi.c | 25 ++ arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/insn.c | 22 +- arch/arm64/kernel/vmlinux.lds.S | 3 + arch/arm64/kvm/hyp/switch.c | 2 +- arch/arm64/mm/fault.c | 12 +- arch/m68k/q40/config.c | 1 + arch/mips/include/asm/cpu-type.h | 1 + arch/powerpc/include/asm/kvm_asm.h | 3 + arch/powerpc/kernel/Makefile | 2 +- arch/powerpc/kernel/eeh.c | 2 +- arch/powerpc/kernel/traps.c | 6 +- arch/powerpc/kvm/book3s_64_mmu_radix.c | 5 + arch/powerpc/kvm/book3s_hv_tm.c | 28 +- arch/powerpc/kvm/book3s_hv_tm_builtin.c | 16 +- arch/powerpc/mm/book3s64/iommu_api.c | 39 +- arch/powerpc/perf/imc-pmu.c | 173 +++++++-- arch/riscv/include/asm/ftrace.h | 7 + arch/riscv/kernel/ftrace.c | 19 + arch/s390/include/asm/pgtable.h | 44 ++- arch/s390/include/asm/stacktrace.h | 11 + arch/s390/kernel/irq.c | 8 +- arch/s390/kernel/perf_cpum_sf.c | 9 +- arch/s390/kernel/setup.c | 15 +- arch/s390/kernel/smp.c | 2 +- arch/x86/include/asm/crash.h | 6 + arch/x86/include/asm/nospec-branch.h | 4 +- arch/x86/include/asm/pkeys.h | 5 + arch/x86/kernel/apic/io_apic.c | 1 + arch/x86/kernel/crash.c | 15 + arch/x86/kernel/fpu/xstate.c | 9 +- arch/x86/kvm/emulate.c | 2 + arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/mmutrace.h | 2 +- arch/x86/kvm/svm.c | 11 +- arch/x86/kvm/vmx/vmx.c | 26 +- arch/x86/kvm/x86.c | 13 +- arch/x86/lib/usercopy_64.c | 2 +- arch/x86/realmode/init.c | 2 + arch/xtensa/kernel/entry.S | 4 +- arch/xtensa/kernel/ptrace.c | 18 +- drivers/acpi/ec.c | 16 +- drivers/ata/acard-ahci.c | 6 +- drivers/ata/libahci.c | 6 +- drivers/ata/libata-core.c | 9 +- drivers/ata/libata-sff.c | 12 +- drivers/ata/pata_macio.c | 6 +- drivers/ata/pata_pxa.c | 8 +- drivers/ata/pdc_adma.c | 7 +- drivers/ata/sata_fsl.c | 4 +- drivers/ata/sata_inic162x.c | 4 +- drivers/ata/sata_mv.c | 34 +- drivers/ata/sata_nv.c | 18 +- drivers/ata/sata_promise.c | 6 +- drivers/ata/sata_qstor.c | 8 +- drivers/ata/sata_rcar.c | 6 +- drivers/ata/sata_sil.c | 8 +- drivers/ata/sata_sil24.c | 6 +- drivers/ata/sata_sx4.c | 6 +- drivers/atm/eni.c | 2 +- drivers/base/arch_topology.c | 4 +- drivers/base/regmap/internal.h | 2 +- drivers/base/regmap/regcache.c | 2 +- drivers/base/regmap/regmap.c | 33 +- drivers/bluetooth/btrtl.c | 20 +- drivers/bus/hisi_lpc.c | 27 +- drivers/char/ipmi/bt-bmc.c | 12 +- drivers/char/random.c | 12 +- drivers/char/tlclk.c | 17 +- drivers/char/tpm/tpm_crb.c | 123 +++++-- drivers/char/tpm/tpm_ibmvtpm.c | 9 + drivers/char/tpm/tpm_ibmvtpm.h | 1 + drivers/clk/imx/clk-pfdv2.c | 6 + drivers/clk/socfpga/clk-pll-s10.c | 4 +- drivers/clk/ti/adpll.c | 11 +- drivers/clocksource/h8300_timer8.c | 2 +- drivers/cpufreq/powernv-cpufreq.c | 13 +- drivers/crypto/chelsio/chcr_algo.c | 5 +- drivers/crypto/chelsio/chtls/chtls_io.c | 10 +- drivers/dax/bus.c | 2 +- drivers/dax/bus.h | 2 +- drivers/dax/dax-private.h | 2 +- drivers/devfreq/tegra30-devfreq.c | 4 +- drivers/dma-buf/dma-buf.c | 2 + drivers/dma-buf/dma-fence.c | 78 ++-- drivers/dma/mediatek/mtk-hsdma.c | 4 +- drivers/dma/stm32-dma.c | 9 +- drivers/dma/stm32-mdma.c | 9 +- drivers/dma/tegra20-apb-dma.c | 3 +- drivers/dma/xilinx/zynqmp_dma.c | 24 +- drivers/edac/ghes_edac.c | 4 + drivers/firmware/arm_sdei.c | 26 +- drivers/gpio/gpio-rcar.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 31 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.c | 10 +- drivers/gpu/drm/amd/amdgpu/atom.c | 4 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 58 +-- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 40 +-- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 40 +-- drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 16 + drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h | 139 ++++---- .../gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx10.asm | 1 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 32 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 2 + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 67 ++-- drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c | 52 ++- drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c | 5 + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c | 26 -- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c | 5 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 5 +- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c | 35 +- drivers/gpu/drm/amd/display/dc/inc/hw/dsc.h | 1 + drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 7 + drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 7 + drivers/gpu/drm/exynos/exynos_drm_dsi.c | 20 +- drivers/gpu/drm/gma500/cdv_intel_display.c | 2 + drivers/gpu/drm/mcde/mcde_display.c | 10 + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 27 +- drivers/gpu/drm/msm/msm_drv.c | 6 +- drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +- drivers/gpu/drm/nouveau/nouveau_debugfs.c | 5 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +- .../gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c | 17 +- drivers/gpu/drm/omapdrm/dss/dss.c | 43 ++- drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c | 4 +- drivers/gpu/drm/radeon/radeon_bios.c | 30 +- drivers/gpu/drm/scheduler/sched_main.c | 27 ++ drivers/gpu/drm/sun4i/sun8i_csc.h | 2 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 1 + drivers/hwtracing/coresight/coresight-etm4x.c | 1 + drivers/hwtracing/intel_th/intel_th.h | 2 + drivers/hwtracing/intel_th/msu.c | 11 +- drivers/hwtracing/intel_th/pci.c | 8 +- drivers/i2c/busses/i2c-aspeed.c | 2 + drivers/i2c/busses/i2c-tegra.c | 93 +++-- drivers/i2c/i2c-core-base.c | 2 +- drivers/infiniband/core/cm.c | 25 +- drivers/infiniband/hw/cxgb4/cm.c | 4 +- drivers/infiniband/hw/i40iw/i40iw_cm.c | 2 +- drivers/infiniband/hw/qedr/qedr_iw_cm.c | 2 +- drivers/infiniband/sw/rxe/rxe.c | 2 + drivers/infiniband/sw/rxe/rxe_qp.c | 7 +- drivers/infiniband/ulp/iser/iser_memory.c | 21 +- drivers/leds/leds-mlxreg.c | 4 +- drivers/md/bcache/bcache.h | 1 + drivers/md/bcache/btree.c | 12 +- drivers/md/bcache/super.c | 1 + drivers/md/dm-table.c | 27 +- drivers/md/dm.c | 23 +- drivers/media/dvb-frontends/tda10071.c | 9 +- drivers/media/i2c/smiapp/smiapp-core.c | 3 +- drivers/media/mc/mc-device.c | 65 ++-- drivers/media/platform/qcom/venus/vdec.c | 5 +- drivers/media/platform/ti-vpe/cal.c | 6 +- drivers/media/usb/go7007/go7007-usb.c | 4 +- drivers/mfd/mfd-core.c | 10 + drivers/mmc/core/mmc.c | 9 +- drivers/mtd/chips/cfi_cmdset_0002.c | 1 - drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 4 +- drivers/mtd/nand/raw/omap_elm.c | 1 + drivers/mtd/parsers/cmdlinepart.c | 23 +- drivers/mtd/ubi/fastmap-wl.c | 46 ++- drivers/mtd/ubi/fastmap.c | 14 +- drivers/mtd/ubi/ubi.h | 6 +- drivers/mtd/ubi/wl.c | 32 +- drivers/mtd/ubi/wl.h | 1 - drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 18 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 8 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 11 +- drivers/net/ethernet/qlogic/qed/qed_l2.c | 3 + drivers/net/ethernet/qlogic/qed/qed_main.c | 2 + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + drivers/net/ethernet/qlogic/qede/qede_filter.c | 3 + drivers/net/ethernet/qlogic/qede/qede_main.c | 11 +- drivers/net/ethernet/realtek/r8169_main.c | 3 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 2 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 50 ++- drivers/net/ieee802154/adf7242.c | 4 +- drivers/net/ieee802154/ca8210.c | 1 + drivers/net/wireless/ath/ar5523/ar5523.c | 2 + drivers/net/wireless/ath/ath10k/debug.c | 3 +- drivers/net/wireless/ath/ath10k/sdio.c | 18 +- drivers/net/wireless/ath/ath10k/wmi.c | 49 ++- .../broadcom/brcm80211/brcmfmac/fwsignal.c | 3 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 4 +- drivers/net/wireless/mediatek/mt76/agg-rx.c | 1 + drivers/net/wireless/mediatek/mt76/dma.c | 9 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7603/main.c | 2 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 2 + drivers/net/wireless/mediatek/mt76/mt76x02_util.c | 2 + drivers/net/wireless/ti/wlcore/main.c | 4 +- drivers/net/wireless/ti/wlcore/tx.c | 1 + drivers/nvme/host/Kconfig | 1 + drivers/nvme/host/core.c | 14 +- drivers/nvme/host/fc.c | 4 +- drivers/nvme/host/multipath.c | 21 +- drivers/nvme/host/nvme.h | 19 +- drivers/nvme/host/pci.c | 1 - drivers/nvme/host/rdma.c | 3 +- drivers/nvme/host/tcp.c | 3 +- drivers/nvme/target/loop.c | 3 +- drivers/nvme/target/rdma.c | 30 +- drivers/opp/core.c | 48 +-- drivers/opp/of.c | 30 +- drivers/opp/opp.h | 6 +- drivers/pci/controller/dwc/pcie-tegra194.c | 5 +- drivers/pci/controller/pci-tegra.c | 3 +- drivers/pci/hotplug/pciehp_hpc.c | 26 +- drivers/pci/iov.c | 8 +- drivers/pci/rom.c | 17 - drivers/pci/setup-bus.c | 38 +- drivers/phy/samsung/phy-s5pv210-usb2.c | 4 + drivers/power/supply/max17040_battery.c | 2 +- drivers/rapidio/devices/rio_mport_cdev.c | 14 +- drivers/regulator/axp20x-regulator.c | 7 +- drivers/rtc/rtc-ds1374.c | 15 +- drivers/rtc/rtc-sa1100.c | 18 +- drivers/s390/block/dasd_fba.c | 9 +- drivers/s390/cio/airq.c | 8 +- drivers/s390/cio/cio.c | 8 +- drivers/s390/crypto/zcrypt_api.c | 3 +- drivers/scsi/aacraid/aachba.c | 8 +- drivers/scsi/aacraid/commsup.c | 2 +- drivers/scsi/aacraid/linit.c | 46 ++- drivers/scsi/cxlflash/main.c | 1 + drivers/scsi/fnic/fnic_scsi.c | 3 +- drivers/scsi/hpsa.c | 80 +++-- drivers/scsi/libfc/fc_rport.c | 13 +- drivers/scsi/lpfc/lpfc_attr.c | 40 +-- drivers/scsi/lpfc/lpfc_ct.c | 137 +++---- drivers/scsi/lpfc/lpfc_hbadisc.c | 76 ++-- drivers/scsi/lpfc/lpfc_hw.h | 36 +- drivers/scsi/lpfc/lpfc_init.c | 1 + drivers/scsi/lpfc/lpfc_nportdisc.c | 233 ++++++++++-- drivers/scsi/lpfc/lpfc_sli.c | 4 + drivers/scsi/mpt3sas/mpt3sas_ctl.c | 6 - drivers/scsi/pm8001/pm8001_sas.c | 50 ++- drivers/scsi/qedi/qedi_iscsi.c | 3 + drivers/scsi/qla2xxx/qla_init.c | 43 +-- drivers/scsi/qla2xxx/qla_iocb.c | 101 +++++- drivers/scsi/qla2xxx/qla_target.c | 21 +- drivers/scsi/ufs/ufshcd.c | 14 +- drivers/soundwire/bus.c | 2 + drivers/soundwire/cadence_master.c | 80 +++-- drivers/soundwire/cadence_master.h | 1 + drivers/soundwire/intel.c | 14 +- drivers/staging/media/imx/imx-media-capture.c | 2 +- drivers/staging/rtl8188eu/core/rtw_recv.c | 19 +- drivers/thermal/rcar_thermal.c | 6 +- drivers/tty/serial/8250/8250_omap.c | 8 +- drivers/tty/serial/8250/8250_port.c | 16 +- drivers/tty/serial/samsung.c | 8 +- drivers/tty/serial/sifive.c | 28 +- drivers/tty/serial/xilinx_uartps.c | 8 + drivers/tty/vcc.c | 1 + drivers/usb/dwc3/gadget.c | 2 +- drivers/usb/host/ehci-mv.c | 8 +- drivers/vfio/pci/vfio_pci.c | 13 + fs/block_dev.c | 10 + fs/btrfs/disk-io.c | 11 +- fs/btrfs/extent-tree.c | 2 - fs/btrfs/inode.c | 201 +++++------ fs/btrfs/relocation.c | 45 ++- fs/btrfs/tree-checker.c | 40 ++- fs/ceph/caps.c | 14 +- fs/ceph/inode.c | 5 +- fs/cifs/cifsglob.h | 9 +- fs/cifs/file.c | 21 +- fs/cifs/misc.c | 17 +- fs/cifs/smb1ops.c | 8 +- fs/cifs/smb2misc.c | 32 +- fs/cifs/smb2ops.c | 89 +++-- fs/cifs/smb2pdu.h | 2 +- fs/dcache.c | 4 +- fs/exec.c | 22 +- fs/ext4/inode.c | 2 +- fs/ext4/mballoc.c | 11 +- fs/f2fs/gc.c | 10 +- fs/f2fs/node.c | 1 - fs/fuse/dev.c | 1 - fs/fuse/inode.c | 7 + fs/gfs2/inode.c | 13 +- fs/iomap/buffered-io.c | 7 +- fs/nfs/nfstrace.h | 15 +- fs/nfs/pagelist.c | 67 ++-- fs/nfs/write.c | 10 +- fs/nfsd/filecache.c | 8 +- fs/nfsd/nfs4state.c | 73 ++-- fs/nfsd/trace.h | 12 +- fs/proc/base.c | 10 +- fs/ubifs/io.c | 16 +- fs/ubifs/journal.c | 1 + fs/ubifs/orphan.c | 9 +- fs/xfs/libxfs/xfs_attr_leaf.c | 22 +- fs/xfs/libxfs/xfs_bmap.c | 25 +- fs/xfs/libxfs/xfs_dir2_node.c | 1 + fs/xfs/libxfs/xfs_dir2_sf.c | 2 +- fs/xfs/libxfs/xfs_iext_tree.c | 2 +- fs/xfs/libxfs/xfs_inode_fork.c | 8 +- fs/xfs/libxfs/xfs_inode_fork.h | 14 +- fs/xfs/libxfs/xfs_trans_resv.c | 96 ++++- fs/xfs/scrub/dir.c | 3 + fs/xfs/scrub/scrub.c | 9 + fs/xfs/xfs_bmap_util.c | 8 +- fs/xfs/xfs_file.c | 30 ++ fs/xfs/xfs_fsmap.c | 9 + fs/xfs/xfs_ioctl.c | 1 + fs/xfs/xfs_trans.c | 5 + include/asm-generic/pgtable.h | 10 + include/linux/binfmts.h | 8 +- include/linux/debugfs.h | 5 +- include/linux/kprobes.h | 5 + include/linux/libata.h | 13 +- include/linux/mmc/card.h | 2 +- include/linux/nfs_page.h | 2 + include/linux/pci.h | 1 - include/linux/qed/qed_if.h | 1 + include/linux/sched/signal.h | 9 +- include/linux/seqlock.h | 11 +- include/linux/skbuff.h | 14 +- include/linux/sunrpc/svc_rdma.h | 5 +- include/net/sock.h | 4 +- include/sound/hda_codec.h | 5 + include/trace/events/sctp.h | 9 - include/trace/events/sunrpc.h | 1 + init/init_task.c | 1 + init/main.c | 2 + kernel/Makefile | 2 + kernel/audit_watch.c | 2 - kernel/bpf/hashtab.c | 8 - kernel/bpf/inode.c | 4 +- kernel/events/core.c | 12 +- kernel/fork.c | 5 +- kernel/kcmp.c | 8 +- kernel/kprobes.c | 44 ++- kernel/locking/lockdep.c | 40 ++- kernel/locking/lockdep_internals.h | 6 + kernel/notifier.c | 5 +- kernel/printk/printk.c | 3 + kernel/sched/core.c | 3 +- kernel/sched/fair.c | 79 +++-- kernel/sys.c | 4 +- kernel/sysctl-test.c | 392 +++++++++++++++++++++ kernel/time/timekeeping.c | 3 +- kernel/trace/trace.c | 20 +- kernel/trace/trace_entries.h | 2 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 1 - kernel/trace/trace_preemptirq.c | 4 +- kernel/workqueue.c | 6 +- lib/Kconfig.debug | 11 + lib/string.c | 24 ++ mm/filemap.c | 8 + mm/gup.c | 18 +- mm/kmemleak.c | 2 +- mm/madvise.c | 2 +- mm/memcontrol.c | 26 +- mm/memory.c | 121 ++++++- mm/mmap.c | 2 + mm/pagewalk.c | 4 +- mm/slub.c | 45 ++- mm/swap_state.c | 5 +- mm/swapfile.c | 12 +- mm/vmscan.c | 45 ++- net/atm/lec.c | 6 + net/atm/proc.c | 3 +- net/batman-adv/bridge_loop_avoidance.c | 145 ++++++-- net/batman-adv/bridge_loop_avoidance.h | 4 +- net/batman-adv/multicast.c | 46 ++- net/batman-adv/multicast.h | 15 + net/batman-adv/routing.c | 4 + net/batman-adv/soft-interface.c | 11 +- net/bluetooth/hci_event.c | 25 +- net/bluetooth/l2cap_core.c | 29 +- net/bluetooth/l2cap_sock.c | 18 +- net/core/devlink.c | 7 +- net/core/filter.c | 4 +- net/core/neighbour.c | 1 + net/ipv4/route.c | 1 + net/ipv4/tcp.c | 2 +- net/ipv6/ip6_fib.c | 7 +- net/llc/af_llc.c | 2 +- net/mac80211/tx.c | 6 +- net/mac802154/tx.c | 8 +- net/netfilter/nf_conntrack_proto.c | 2 + net/netfilter/nf_tables_api.c | 3 +- net/openvswitch/meter.c | 4 +- net/openvswitch/meter.h | 2 +- net/sctp/outqueue.c | 6 + net/sunrpc/sched.c | 20 +- net/sunrpc/svc_xprt.c | 19 +- net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 39 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 11 +- net/tipc/socket.c | 53 +-- net/tipc/topsrv.c | 4 +- net/unix/af_unix.c | 11 +- net/wireless/Kconfig | 1 + security/device_cgroup.c | 3 +- security/selinux/hooks.c | 12 + security/selinux/selinuxfs.c | 1 + sound/hda/hdac_bus.c | 4 + sound/hda/hdac_regmap.c | 1 - sound/pci/asihpi/hpioctl.c | 4 +- sound/pci/hda/hda_codec.c | 28 +- sound/pci/hda/hda_controller.c | 11 +- sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_intel.c | 40 ++- sound/pci/hda/patch_realtek.c | 13 +- sound/soc/codecs/max98090.c | 8 +- sound/soc/codecs/pcm3168a.c | 7 + sound/soc/codecs/wm8994.c | 10 + sound/soc/codecs/wm_hubs.c | 3 + sound/soc/codecs/wm_hubs.h | 1 + sound/soc/img/img-i2s-out.c | 8 +- sound/soc/intel/boards/bytcr_rt5640.c | 10 + sound/soc/kirkwood/kirkwood-dma.c | 2 +- sound/soc/sof/ipc.c | 12 +- sound/usb/midi.c | 29 +- sound/usb/mixer.c | 10 + sound/usb/quirks.c | 7 +- tools/gpio/gpio-hammer.c | 17 +- tools/objtool/check.c | 2 +- tools/perf/builtin-stat.c | 2 +- tools/perf/pmu-events/jevents.c | 15 +- tools/perf/tests/shell/lib/probe_vfs_getname.sh | 2 +- tools/perf/tests/shell/record+zstd_comp_decomp.sh | 3 +- tools/perf/trace/beauty/arch_errno_names.sh | 2 +- tools/perf/util/cpumap.c | 10 +- tools/perf/util/cs-etm.c | 126 +++++-- tools/perf/util/evsel.c | 7 + tools/perf/util/mem2node.c | 3 +- tools/perf/util/metricgroup.c | 3 + tools/perf/util/parse-events.c | 9 +- tools/perf/util/sort.c | 2 +- tools/perf/util/symbol-elf.c | 7 + .../x86/intel_pstate_tracer/intel_pstate_tracer.py | 22 +- .../testing/selftests/bpf/progs/test_tcpbpf_kern.c | 1 + tools/testing/selftests/bpf/test_tcpbpf.h | 1 + tools/testing/selftests/bpf/test_tcpbpf_user.c | 25 +- .../ftrace/test.d/ftrace/func-filter-glob.tc | 2 +- tools/testing/selftests/ptrace/Makefile | 4 +- tools/testing/selftests/ptrace/vmaccess.c | 86 +++++ tools/testing/selftests/x86/syscall_nt.c | 1 + virt/kvm/arm/mmio.c | 2 +- virt/kvm/arm/mmu.c | 2 +- virt/kvm/arm/vgic/vgic-init.c | 11 +- virt/kvm/arm/vgic/vgic-its.c | 11 +- virt/kvm/kvm_main.c | 1 + 469 files changed, 5174 insertions(+), 2467 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/388 kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()
From: Iurii Zaikin <[email protected]>
[ Upstream commit 2cb80dbbbaba4f2f86f686c34cb79ea5cbfb0edb ]
KUnit tests for initialized data behavior of proc_dointvec that is explicitly checked in the code. Includes basic parsing tests including int min/max overflow.
--- kernel/Makefile | 2 + kernel/sysctl-test.c | 392 +++++++++++++++++++++++++++++++++++++++++++ lib/Kconfig.debug | 11 ++ 3 files changed, 405 insertions(+) create mode 100644 kernel/sysctl-test.c
kernel/Makefile +2 -0
@@ -115,6 +115,8 @@ obj-$(CONFIG_TORTURE_TEST) += torture.o obj-$(CONFIG_HAS_IOMEM) += iomem.o obj-$(CONFIG_RSEQ) += rseq.o +obj-$(CONFIG_SYSCTL_KUNIT_TEST) += sysctl-test.o + obj-$(CONFIG_GCC_PLUGIN_STACKLEAK) += stackleak.o KASAN_SANITIZE_stackleak.o := n KCOV_INSTRUMENT_stackleak.o := n
kernel/sysctl-test.c new file +392 -0
392 lines not on this page · raw message
lib/Kconfig.debug +11 -0
@@ -1939,6 +1939,17 @@ config TEST_SYSCTL If unsure, say N. +config SYSCTL_KUNIT_TEST + bool "KUnit test for sysctl" + depends on KUNIT + help + This builds the proc sysctl unit test, which runs on boot. + Tests the API contract and implementation correctness of sysctl. + For more information on KUnit and unit tests in general please refer + to the KUnit documentation in Documentation/dev-tools/kunit/. + + If unsure, say N. + config TEST_UDELAY tristate "udelay test driver" help
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 2/388 scsi: lpfc: Fix pt2pt discovery on SLI3 HBAs
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 359e10f087dbb7b9c9f3035a8cc4391af45bd651 ]
After exchanging PLOGI on an SLI-3 adapter, the PRLI exchange failed. Link trace showed the port was assigned a non-zero n_port_id, but didn't use the address on the PRLI. The assigned address is set on the port by the CONFIG_LINK mailbox command. The driver responded to the PRLI before the mailbox command completed. Thus the PRLI response used the old n_port_id.
Defer the PRLI response until CONFIG_LINK completes.
--- drivers/scsi/lpfc/lpfc_nportdisc.c | 141 +++++++++++++++++++++++------ 1 file changed, 115 insertions(+), 26 deletions(-)
drivers/scsi/lpfc/lpfc_nportdisc.c +115 -26
@@ -279,6 +279,55 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)lpfc_cancel_retry_delay_tmo (phba->pport, ndlp); } +/* lpfc_defer_pt2pt_acc - Complete SLI3 pt2pt processing on link up +* @phba: pointer to lpfc hba data structure. +* @link_mbox: pointer to CONFIG_LINK mailbox object +* +* This routine is only called if we are SLI3, direct connect pt2pt +* mode and the remote NPort issues the PLOGI after link up. +*/ +void +lpfc_defer_pt2pt_acc (struct lpfc_hba *phba,LPFC_MBOXQ_t *link_mbox) +{ +LPFC_MBOXQ_t *login_mbox; +MAILBOX_t *mb = &link_mbox->u.mb; +struct lpfc_iocbq *save_iocb; +struct lpfc_nodelist *ndlp; +int rc; + + ndlp = link_mbox->ctx_ndlp; + login_mbox = link_mbox->context3; + save_iocb = login_mbox->context3; + link_mbox->context3 =NULL ; + login_mbox->context3 =NULL ; + +/* Check for CONFIG_LINK error */ +if (mb->mbxStatus) { +lpfc_printf_log (phba,KERN_ERR ,LOG_DISCOVERY , +"4575 CONFIG_LINK fails pt2pt discovery: %x\n" , + mb->mbxStatus); +mempool_free (login_mbox, phba->mbox_mem_pool); +mempool_free (link_mbox, phba->mbox_mem_pool); +lpfc_sli_release_iocbq (phba, save_iocb); +return ; + } + +/* Now that CONFIG_LINK completed, and our SID is configured, +* we can now proceed with sending the PLOGI ACC. +*/ + rc =lpfc_els_rsp_acc (link_mbox->vport,ELS_CMD_PLOGI , + save_iocb, ndlp, login_mbox); +if (rc) { +lpfc_printf_log (phba,KERN_ERR ,LOG_DISCOVERY , +"4576 PLOGI ACC fails pt2pt discovery: %x\n" , + rc); +mempool_free (login_mbox, phba->mbox_mem_pool); + } + +mempool_free (link_mbox, phba->mbox_mem_pool); +lpfc_sli_release_iocbq (phba, save_iocb); +} +static int lpfc_rcv_plogi (struct lpfc_vport *vport,struct lpfc_nodelist *ndlp,struct lpfc_iocbq *cmdiocb)
@@ -291,10 +340,12 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,IOCB_t *icmd;struct serv_parm *sp;uint32_t ed_tov; -LPFC_MBOXQ_t *mbox; +LPFC_MBOXQ_t *link_mbox; +LPFC_MBOXQ_t *login_mbox; +struct lpfc_iocbq *save_iocb;struct ls_rjt stat;uint32_t vid, flag; -int rc; +int rc, defer_acc;memset (&stat,0 ,sizeof (struct ls_rjt )); pcmd = (struct lpfc_dmabuf *) cmdiocb->context2;
@@ -343,6 +394,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,else ndlp->nlp_fcp_info |=CLASS3 ; + defer_acc =0 ; ndlp->nlp_class_sup =0 ;if (sp->cls1.classValid) ndlp->nlp_class_sup |=FC_COS_CLASS1 ;
@@ -354,7 +406,6 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, ndlp->nlp_class_sup |=FC_COS_CLASS4 ; ndlp->nlp_maxframe = ((sp->cmn.bbRcvSizeMsb &0x0F ) <<8 ) | sp->cmn.bbRcvSizeLsb; -/* if already logged in, do implicit logout */ switch (ndlp->nlp_state) {case NLP_STE_NPR_NODE :
@@ -396,6 +447,10 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE ; ndlp->nlp_flag &= ~NLP_FIRSTBURST ; + login_mbox =NULL ; + link_mbox =NULL ; + save_iocb =NULL ; +/* Check for Nport to NPort pt2pt protocol */ if ((vport->fc_flag &FC_PT2PT ) && !(vport->fc_flag &FC_PT2PT_PLOGI )) {
@@ -423,17 +478,22 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,if (phba->sli_rev ==LPFC_SLI_REV4 )lpfc_issue_reg_vfi (vport);else { - mbox =mempool_alloc (phba->mbox_mem_pool,GFP_KERNEL ); -if (mbox ==NULL ) + defer_acc =1 ; + link_mbox =mempool_alloc (phba->mbox_mem_pool, +GFP_KERNEL ); +if (!link_mbox) goto out; -lpfc_config_link (phba, mbox); - mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl; - mbox->vport = vport; - rc =lpfc_sli_issue_mbox (phba, mbox,MBX_NOWAIT ); -if (rc ==MBX_NOT_FINISHED ) { -mempool_free (mbox, phba->mbox_mem_pool); +lpfc_config_link (phba, link_mbox); + link_mbox->mbox_cmpl = lpfc_defer_pt2pt_acc; + link_mbox->vport = vport; + link_mbox->ctx_ndlp = ndlp; + + save_iocb =lpfc_sli_get_iocbq (phba); +if (!save_iocb) goto out; - } +/* Save info from cmd IOCB used in rsp */ +memcpy ((uint8_t *)save_iocb, (uint8_t *)cmdiocb, +sizeof (struct lpfc_iocbq )); }lpfc_can_disctmo (vport);
@@ -448,8 +508,8 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, ndlp->nlp_flag |=NLP_SUPPRESS_RSP ; } - mbox =mempool_alloc (phba->mbox_mem_pool,GFP_KERNEL ); -if (!mbox) + login_mbox =mempool_alloc (phba->mbox_mem_pool,GFP_KERNEL ); +if (!login_mbox) goto out;/* Registering an existing RPI behaves differently for SLI3 vs SLI4 */
@@ -457,21 +517,19 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,lpfc_unreg_rpi (vport, ndlp); rc =lpfc_reg_rpi (phba, vport->vpi, icmd->un.rcvels.remoteID, - (uint8_t *) sp, mbox, ndlp->nlp_rpi); -if (rc) { -mempool_free (mbox, phba->mbox_mem_pool); + (uint8_t *)sp, login_mbox, ndlp->nlp_rpi); +if (rc) goto out; - }/* ACC PLOGI rsp command needs to execute first, -* queue this mbox command to be processed later. +* queue this login_mbox command to be processed later. */ - mbox->mbox_cmpl = lpfc_mbx_cmpl_reg_login; + login_mbox->mbox_cmpl = lpfc_mbx_cmpl_reg_login;/* -* mbox->ctx_ndlp = lpfc_nlp_get(ndlp) deferred until mailbox +* login_mbox->ctx_ndlp = lpfc_nlp_get(ndlp) deferred until mailbox * command issued in lpfc_cmpl_els_acc(). */ - mbox->vport = vport; + login_mbox->vport = vport;spin_lock_irq (shost->host_lock); ndlp->nlp_flag |= (NLP_ACC_REGLOGIN |NLP_RCV_PLOGI );spin_unlock_irq (shost->host_lock);
@@ -506,16 +564,47 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, stat.un.b.lsRjtRsnCode =LSRJT_INVALID_CMD ; stat.un.b.lsRjtRsnCodeExp =LSEXP_NOTHING_MORE ; rc =lpfc_els_rsp_reject (vport, stat.un.lsRjtError, cmdiocb, - ndlp, mbox); + ndlp, login_mbox);if (rc) -mempool_free (mbox, phba->mbox_mem_pool); +mempool_free (login_mbox, phba->mbox_mem_pool);return 1 ; } - rc =lpfc_els_rsp_acc (vport,ELS_CMD_PLOGI , cmdiocb, ndlp, mbox); +if (defer_acc) { +/* So the order here should be: +* Issue CONFIG_LINK mbox +* CONFIG_LINK cmpl +* Issue PLOGI ACC +* PLOGI ACC cmpl +* Issue REG_LOGIN mbox +*/ + +/* Save the REG_LOGIN mbox for and rcv IOCB copy later */ + link_mbox->context3 = login_mbox; + login_mbox->context3 = save_iocb; + +/* Start the ball rolling by issuing CONFIG_LINK here */ + rc =lpfc_sli_issue_mbox (phba, link_mbox,MBX_NOWAIT ); +if (rc ==MBX_NOT_FINISHED ) + goto out; +return 1 ; + } + + rc =lpfc_els_rsp_acc (vport,ELS_CMD_PLOGI , cmdiocb, ndlp, login_mbox);if (rc) -mempool_free (mbox, phba->mbox_mem_pool); +mempool_free (login_mbox, phba->mbox_mem_pool);return 1 ; out: +if (defer_acc) +lpfc_printf_log (phba,KERN_ERR ,LOG_DISCOVERY , +"4577 pt2pt discovery failure: %p %p %p\n" , + save_iocb, link_mbox, login_mbox); +if (save_iocb) +lpfc_sli_release_iocbq (phba, save_iocb); +if (link_mbox) +mempool_free (link_mbox, phba->mbox_mem_pool); +if (login_mbox) +mempool_free (login_mbox, phba->mbox_mem_pool); + stat.un.b.lsRjtRsnCode =LSRJT_UNABLE_TPC ; stat.un.b.lsRjtRsnCodeExp =LSEXP_OUT_OF_RESOURCE ;lpfc_els_rsp_reject (vport, stat.un.lsRjtError, cmdiocb, ndlp,NULL );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/388 scsi: mpt3sas: Free diag buffer without any status check
In reply to Greg Kroah-HartmanFrom: Sreekanth Reddy <[email protected]>
[ Upstream commit 764f472ba4a7a0c18107ebfbe1a9f1f5f5a1e411 ]
Memory leak can happen when diag buffer is released but not unregistered (where buffer is deallocated) by the user. During module unload time driver is not deallocating the buffer if the buffer is in released state.
Deallocate the diag buffer during module unload time without any diag buffer status checks.
--- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_ctl.c +0 -6
@@ -3717,12 +3717,6 @@ mpt3sas_ctl_exit(ushort hbas_to_enumerate)for (i =0 ; i <MPI2_DIAG_BUF_TYPE_COUNT ; i++) {if (!ioc->diag_buffer[i])continue ; -if (!(ioc->diag_buffer_status[i] & -MPT3_DIAG_BUFFER_IS_REGISTERED )) -continue ; -if ((ioc->diag_buffer_status[i] & -MPT3_DIAG_BUFFER_IS_RELEASED )) -continue ; dma_free_coherent(&ioc->pdev->dev, ioc->diag_buffer_sz[i], ioc->diag_buffer[i],
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/388 selinux: allow labeling before policy is loaded
In reply to Greg Kroah-HartmanFrom: Jonathan Lebon <[email protected]>
[ Upstream commit 3e3e24b42043eceb97ed834102c2d094dfd7aaa6 ]
Currently, the SELinux LSM prevents one from setting the security.selinux xattr on an inode without a policy first being loaded. However, this restriction is problematic: it makes it impossible to have newly created files with the correct label before actually loading the policy.
This is relevant in distributions like Fedora, where the policy is loaded by systemd shortly after pivoting out of the initrd. In such instances, all files created prior to pivoting will be unlabeled. One then has to relabel them after pivoting, an operation which inherently races with other processes trying to access those same files.
Going further, there are use cases for creating the entire root filesystem on first boot from the initrd (e.g. Container Linux supports this today[1], and we'd like to support it in Fedora CoreOS as well[2]). One can imagine doing this in two ways: at the block device level (e.g. laying down a disk image), or at the filesystem level. In the former, labeling can simply be part of the image. But even in the latter scenario, one still really wants to be able to set the right labels when populating the new filesystem.
This patch enables this by changing behaviour in the following two ways:
1. allow setxattr if we're not initialized
2. don't try to set the in-core inode SID if we're not initialized; instead leave it as LABEL_INVALID so that revalidation may be attempted at a later time
Note the first hunk of this patch is mostly the same as a previously discussed one[3], though it was part of a larger series which wasn't accepted.
[1] https://coreos.com/os/docs/latest/root-filesystem-placement.html
[2] https://github.com/coreos/fedora-coreos-tracker/issues/94
[3] https://www.spinics.net/lists/linux-initramfs/msg04593.html
--- security/selinux/hooks.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
security/selinux/hooks.c +12 -0
@@ -3156,6 +3156,9 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,return dentry_has_perm (current_cred (), dentry,FILE__SETATTR ); } +if (!selinux_state.initialized) +return (inode_owner_or_capable (inode) ?0 : -EPERM ); + sbsec = inode->i_sb->s_security;if (!(sbsec->flags &SBLABEL_MNT ))return -EOPNOTSUPP ;
@@ -3239,6 +3242,15 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,return ; } +if (!selinux_state.initialized) { +/* If we haven't even been initialized, then we can't validate +* against a policy, so leave the label as invalid. It may +* resolve to a valid label on the next revalidation try if +* we've since initialized. +*/ +return ; + } + rc =security_context_to_sid_force (&selinux_state, value, size, &newsid);if (rc) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/388 media: mc-device.c: fix memleak in media_device_register_entity
In reply to Greg Kroah-HartmanFrom: zhengbin <[email protected]>
[ Upstream commit 713f871b30a66dc4daff4d17b760c9916aaaf2e1 ]
In media_device_register_entity, if media_graph_walk_init fails, need to free the previously memory.
--- drivers/media/mc/mc-device.c | 65 ++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 32 deletions(-)
drivers/media/mc/mc-device.c +33 -32
@@ -575,6 +575,38 @@ static void media_device_release(struct media_devnode *devnode)dev_dbg (devnode->parent,"Media device released\n" ); } +static void __media_device_unregister_entity (struct media_entity *entity) +{ +struct media_device *mdev = entity->graph_obj.mdev; +struct media_link *link, *tmp; +struct media_interface *intf; +unsigned int i; + +ida_free (&mdev->entity_internal_idx, entity->internal_idx); + +/* Remove all interface links pointing to this entity */ +list_for_each_entry (intf, &mdev->interfaces, graph_obj.list) { +list_for_each_entry_safe (link, tmp, &intf->links, list) { +if (link->entity == entity) +__media_remove_intf_link (link); + } + } + +/* Remove all data links that belong to this entity */ +__media_entity_remove_links (entity); + +/* Remove all pads that belong to this entity */ +for (i =0 ; i < entity->num_pads; i++) +media_gobj_destroy (&entity->pads[i].graph_obj); + +/* Remove the entity */ +media_gobj_destroy (&entity->graph_obj); + +/* invoke entity_notify callbacks to handle entity removal?? */ + + entity->graph_obj.mdev =NULL ; +} +/** * media_device_register_entity - Register an entity with a media device * @mdev: The media device
@@ -632,6 +664,7 @@ int __must_check media_device_register_entity(struct media_device *mdev,*/ ret =media_graph_walk_init (&new, mdev);if (ret) { +__media_device_unregister_entity (entity);mutex_unlock (&mdev->graph_mutex);return ret; }
@@ -644,38 +677,6 @@ int __must_check media_device_register_entity(struct media_device *mdev, }EXPORT_SYMBOL_GPL (media_device_register_entity); -static void __media_device_unregister_entity (struct media_entity *entity) -{ -struct media_device *mdev = entity->graph_obj.mdev; -struct media_link *link, *tmp; -struct media_interface *intf; -unsigned int i; - -ida_free (&mdev->entity_internal_idx, entity->internal_idx); - -/* Remove all interface links pointing to this entity */ -list_for_each_entry (intf, &mdev->interfaces, graph_obj.list) { -list_for_each_entry_safe (link, tmp, &intf->links, list) { -if (link->entity == entity) -__media_remove_intf_link (link); - } - } - -/* Remove all data links that belong to this entity */ -__media_entity_remove_links (entity); - -/* Remove all pads that belong to this entity */ -for (i =0 ; i < entity->num_pads; i++) -media_gobj_destroy (&entity->pads[i].graph_obj); - -/* Remove the entity */ -media_gobj_destroy (&entity->graph_obj); - -/* invoke entity_notify callbacks to handle entity removal?? */ - - entity->graph_obj.mdev =NULL ; -} -void media_device_unregister_entity (struct media_entity *entity) {struct media_device *mdev = entity->graph_obj.mdev;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/388 drm/amd/display: Do not double-buffer DTO adjustments
In reply to Greg Kroah-HartmanFrom: Wesley Chalmers <[email protected]>
[ Upstream commit 6bd0a112ec129615d23aa5d8d3dd0be0243989aa ]
[WHY]
When changing DPP global ref clock, DTO adjustments must take effect immediately, or else underflow may occur.
It appears the original decision to double-buffer DTO adjustments was made to prevent underflows that occur when raising DPP ref clock (which is not double-buffered), but that same decision causes similar issues when lowering DPP global ref clock. The better solution is to order the adjustments according to whether clocks are being raised or lowered.
--- .../gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c | 26 ------------------- 1 file changed, 26 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c +0 -26
@@ -119,32 +119,6 @@ void dccg2_get_dccg_ref_freq(struct dccg *dccg,void dccg2_init (struct dccg *dccg) { -struct dcn_dccg *dccg_dcn =TO_DCN_DCCG (dccg); - -// Fallthrough intentional to program all available dpp_dto's -switch (dccg_dcn->base.ctx->dc->res_pool->pipe_count) { -case 6 : -REG_UPDATE (DPPCLK_DTO_CTRL ,DPPCLK_DTO_DB_EN [5 ],1 ); -/* Fall through */ -case 5 : -REG_UPDATE (DPPCLK_DTO_CTRL ,DPPCLK_DTO_DB_EN [4 ],1 ); -/* Fall through */ -case 4 : -REG_UPDATE (DPPCLK_DTO_CTRL ,DPPCLK_DTO_DB_EN [3 ],1 ); -/* Fall through */ -case 3 : -REG_UPDATE (DPPCLK_DTO_CTRL ,DPPCLK_DTO_DB_EN [2 ],1 ); -/* Fall through */ -case 2 : -REG_UPDATE (DPPCLK_DTO_CTRL ,DPPCLK_DTO_DB_EN [1 ],1 ); -/* Fall through */ -case 1 : -REG_UPDATE (DPPCLK_DTO_CTRL ,DPPCLK_DTO_DB_EN [0 ],1 ); -break ; -default : -ASSERT (false); -break ; - } }static const struct dccg_funcs dccg2_funcs = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/388 drm/amdkfd: Fix race in gfx10 context restore handler
In reply to Greg Kroah-HartmanFrom: Jay Cornwall <[email protected]>
[ Upstream commit c18cc2bb9e064d3a613d8276f2cab3984926a779 ]
Missing synchronization with VGPR restore leads to intermittent VGPR trashing in the user shader.
--- .../gpu/drm/amd/amdkfd/cwsr_trap_handler.h | 139 +++++++++--------- .../amd/amdkfd/cwsr_trap_handler_gfx10.asm | 1 + 2 files changed, 71 insertions(+), 69 deletions(-)
drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h +70 -69
@@ -905,7 +905,7 @@ static const uint32_t cwsr_trap_gfx10_hex[] = {0x7a5d0000 ,0x807c817c ,0x807aff7a ,0x00000080 ,0xbf0a717c ,0xbf85fff8 , -0xbf820141 ,0xbef4037e , +0xbf820142 ,0xbef4037e ,0x8775ff7f ,0x0000ffff ,0x8875ff75 ,0x00040000 , 0xbef60380, 0xbef703ff,
@@ -967,7 +967,7 @@ static const uint32_t cwsr_trap_gfx10_hex[] = {0x725d0000 ,0xe0304080 ,0x725d0100 ,0xe0304100 ,0x725d0200 ,0xe0304180 , -0x725d0300 ,0xbf820031 , +0x725d0300 ,0xbf820032 ,0xbef603ff ,0x01000000 ,0xbef20378 ,0x8078ff78 , 0x00000400, 0xbefc0384,
@@ -992,83 +992,84 @@ static const uint32_t cwsr_trap_gfx10_hex[] = {0x725d0000 ,0xe0304100 ,0x725d0100 ,0xe0304200 ,0x725d0200 ,0xe0304300 , -0x725d0300 ,0xb9782a05 , -0x80788178 ,0x907c9973 , -0x877c817c ,0xbf06817c , -0xbf850002 ,0x8f788978 , -0xbf820001 ,0x8f788a78 , -0xb9721e06 ,0x8f728a72 , -0x80787278 ,0x8078ff78 , -0x00000200 ,0x80f8ff78 , -0x00000050 ,0xbef603ff , -0x01000000 ,0xbefc03ff , -0x0000006c ,0x80f89078 , -0xf429003a ,0xf0000000 , -0xbf8cc07f ,0x80fc847c , -0xbf800000 ,0xbe803100 , -0xbe823102 ,0x80f8a078 , -0xf42d003a ,0xf0000000 , -0xbf8cc07f ,0x80fc887c , -0xbf800000 ,0xbe803100 , -0xbe823102 ,0xbe843104 , -0xbe863106 ,0x80f8c078 , -0xf431003a ,0xf0000000 , -0xbf8cc07f ,0x80fc907c , -0xbf800000 ,0xbe803100 , -0xbe823102 ,0xbe843104 , -0xbe863106 ,0xbe883108 , -0xbe8a310a ,0xbe8c310c , -0xbe8e310e ,0xbf06807c , -0xbf84fff0 ,0xb9782a05 , -0x80788178 ,0x907c9973 , -0x877c817c ,0xbf06817c , -0xbf850002 ,0x8f788978 , -0xbf820001 ,0x8f788a78 , -0xb9721e06 ,0x8f728a72 , -0x80787278 ,0x8078ff78 , -0x00000200 ,0xbef603ff , -0x01000000 ,0xf4211bfa , +0x725d0300 ,0xbf8c3f70 , +0xb9782a05 ,0x80788178 , +0x907c9973 ,0x877c817c , +0xbf06817c ,0xbf850002 , +0x8f788978 ,0xbf820001 , +0x8f788a78 ,0xb9721e06 , +0x8f728a72 ,0x80787278 , +0x8078ff78 ,0x00000200 , +0x80f8ff78 ,0x00000050 , +0xbef603ff ,0x01000000 , +0xbefc03ff ,0x0000006c , +0x80f89078 ,0xf429003a , +0xf0000000 ,0xbf8cc07f , +0x80fc847c ,0xbf800000 , +0xbe803100 ,0xbe823102 , +0x80f8a078 ,0xf42d003a , +0xf0000000 ,0xbf8cc07f , +0x80fc887c ,0xbf800000 , +0xbe803100 ,0xbe823102 , +0xbe843104 ,0xbe863106 , +0x80f8c078 ,0xf431003a , +0xf0000000 ,0xbf8cc07f , +0x80fc907c ,0xbf800000 , +0xbe803100 ,0xbe823102 , +0xbe843104 ,0xbe863106 , +0xbe883108 ,0xbe8a310a , +0xbe8c310c ,0xbe8e310e , +0xbf06807c ,0xbf84fff0 , +0xb9782a05 ,0x80788178 , +0x907c9973 ,0x877c817c , +0xbf06817c ,0xbf850002 , +0x8f788978 ,0xbf820001 , +0x8f788a78 ,0xb9721e06 , +0x8f728a72 ,0x80787278 , +0x8078ff78 ,0x00000200 , +0xbef603ff ,0x01000000 , +0xf4211bfa ,0xf0000000 , +0x80788478 ,0xf4211b3a ,0xf0000000 ,0x80788478 , -0xf4211b3a ,0xf0000000 , -0x80788478 ,0xf4211b7a , +0xf4211b7a ,0xf0000000 , +0x80788478 ,0xf4211eba ,0xf0000000 ,0x80788478 , -0xf4211eba ,0xf0000000 , -0x80788478 ,0xf4211efa , +0xf4211efa ,0xf0000000 , +0x80788478 ,0xf4211c3a ,0xf0000000 ,0x80788478 , -0xf4211c3a ,0xf0000000 , -0x80788478 ,0xf4211c7a , +0xf4211c7a ,0xf0000000 , +0x80788478 ,0xf4211e7a ,0xf0000000 ,0x80788478 , -0xf4211e7a ,0xf0000000 , -0x80788478 ,0xf4211cfa , +0xf4211cfa ,0xf0000000 , +0x80788478 ,0xf4211bba ,0xf0000000 ,0x80788478 , +0xbf8cc07f ,0xb9eef814 ,0xf4211bba ,0xf0000000 ,0x80788478 ,0xbf8cc07f , -0xb9eef814 ,0xf4211bba , -0xf0000000 ,0x80788478 , -0xbf8cc07f ,0xb9eef815 , -0xbef2036d ,0x876dff72 , -0x0000ffff ,0xbefc036f , -0xbefe037a ,0xbeff037b , -0x876f71ff ,0x000003ff , -0xb9ef4803 ,0xb9f9f816 , -0x876f71ff ,0xfffff800 , -0x906f8b6f ,0xb9efa2c3 , -0xb9f3f801 ,0x876fff72 , -0xfc000000 ,0x906f9a6f , -0x8f6f906f ,0xbef30380 , +0xb9eef815 ,0xbef2036d , +0x876dff72 ,0x0000ffff , +0xbefc036f ,0xbefe037a , +0xbeff037b ,0x876f71ff , +0x000003ff ,0xb9ef4803 , +0xb9f9f816 ,0x876f71ff , +0xfffff800 ,0x906f8b6f , +0xb9efa2c3 ,0xb9f3f801 , +0x876fff72 ,0xfc000000 , +0x906f9a6f ,0x8f6f906f , +0xbef30380 ,0x88736f73 , +0x876fff72 ,0x02000000 , +0x906f996f ,0x8f6f8f6f ,0x88736f73 ,0x876fff72 , -0x02000000 ,0x906f996f , -0x8f6f8f6f ,0x88736f73 , -0x876fff72 ,0x01000000 , -0x906f986f ,0x8f6f996f , -0x88736f73 ,0x876fff70 , -0x00800000 ,0x906f976f , -0xb9f3f807 ,0x87fe7e7e , -0x87ea6a6a ,0xb9f0f802 , -0xbf8a0000 ,0xbe80226c , -0xbf810000 ,0xbf9f0000 , +0x01000000 ,0x906f986f , +0x8f6f996f ,0x88736f73 , +0x876fff70 ,0x00800000 , +0x906f976f ,0xb9f3f807 , +0x87fe7e7e ,0x87ea6a6a , +0xb9f0f802 ,0xbf8a0000 , +0xbe80226c ,0xbf810000 ,0xbf9f0000 ,0xbf9f0000 ,0xbf9f0000 ,0xbf9f0000 , + 0xbf9f0000, 0x00000000, };static const uint32_t cwsr_trap_arcturus_hex[] = { 0xbf820001, 0xbf8202c4,
drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx10.asm +1 -0
@@ -758,6 +758,7 @@ L_RESTORE_V0: buffer_load_dword v1, v0, s_restore_buf_rsrc0, s_restore_mem_offset_save slc:1 glc:1 offset:256 buffer_load_dword v2, v0, s_restore_buf_rsrc0, s_restore_mem_offset_save slc:1 glc:1 offset:256*2 buffer_load_dword v3, v0, s_restore_buf_rsrc0, s_restore_mem_offset_save slc:1 glc:1 offset:256*3 + s_waitcnt vmcnt(0) /* restore SGPRs */ //will be 2+8+16*6
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/388 dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling)
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit 9c98f021e4e717ffd9948fa65340ea3ef12b7935 ]
Make dma_fence_enable_sw_signaling() behave like its dma_fence_add_callback() and dma_fence_default_wait() counterparts and perform the test to enable signaling under the fence->lock, along with the action to do so. This ensure that should an implementation be trying to flush the cb_list (by signaling) on retirement before freeing the fence, it can do so in a race-free manner.
See also 0fc89b6802ba ("dma-fence: Simply wrap dma_fence_signal_locked with dma_fence_signal").
v2: Refactor all 3 enable_signaling paths to use a common function.
v3: Don't argue, just keep the tracepoint in the existing spot.
--- drivers/dma-buf/dma-fence.c | 78 +++++++++++++++++-------------------- 1 file changed, 35 insertions(+), 43 deletions(-)
drivers/dma-buf/dma-fence.c +35 -43
@@ -273,6 +273,30 @@ void dma_fence_free(struct dma_fence *fence) }EXPORT_SYMBOL (dma_fence_free); +static bool __dma_fence_enable_signaling (struct dma_fence *fence) +{ +bool was_set; + +lockdep_assert_held (fence->lock); + + was_set =test_and_set_bit (DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT , + &fence->flags); + +if (test_bit (DMA_FENCE_FLAG_SIGNALED_BIT , &fence->flags)) +return false; + +if (!was_set && fence->ops->enable_signaling) { +trace_dma_fence_enable_signal (fence); + +if (!fence->ops->enable_signaling (fence)) { +dma_fence_signal_locked (fence); +return false; + } + } + +return true; +} +/** * dma_fence_enable_sw_signaling - enable signaling on fence * @fence: the fence to enable
@@ -285,19 +309,12 @@ void dma_fence_enable_sw_signaling(struct dma_fence *fence) {unsigned long flags; -if (!test_and_set_bit (DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT , - &fence->flags) && - !test_bit (DMA_FENCE_FLAG_SIGNALED_BIT , &fence->flags) && - fence->ops->enable_signaling) { -trace_dma_fence_enable_signal (fence); - -spin_lock_irqsave (fence->lock, flags); - -if (!fence->ops->enable_signaling (fence)) -dma_fence_signal_locked (fence); +if (test_bit (DMA_FENCE_FLAG_SIGNALED_BIT , &fence->flags)) +return ; -spin_unlock_irqrestore (fence->lock, flags); - } +spin_lock_irqsave (fence->lock, flags); +__dma_fence_enable_signaling (fence); +spin_unlock_irqrestore (fence->lock, flags); }EXPORT_SYMBOL (dma_fence_enable_sw_signaling);
@@ -331,7 +348,6 @@ int dma_fence_add_callback(struct dma_fence *fence, struct dma_fence_cb *cb, {unsigned long flags;int ret =0 ; -bool was_set;if (WARN_ON (!fence || !func))return -EINVAL ;
@@ -343,25 +359,14 @@ int dma_fence_add_callback(struct dma_fence *fence, struct dma_fence_cb *cb,spin_lock_irqsave (fence->lock, flags); - was_set =test_and_set_bit (DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT , - &fence->flags); - -if (test_bit (DMA_FENCE_FLAG_SIGNALED_BIT , &fence->flags)) - ret = -ENOENT ; -else if (!was_set && fence->ops->enable_signaling) { -trace_dma_fence_enable_signal (fence); - -if (!fence->ops->enable_signaling (fence)) { -dma_fence_signal_locked (fence); - ret = -ENOENT ; - } - } - -if (!ret) { +if (__dma_fence_enable_signaling (fence)) { cb->func = func;list_add_tail (&cb->node, &fence->cb_list); - }else + }else {INIT_LIST_HEAD (&cb->node); + ret = -ENOENT ; + } +spin_unlock_irqrestore (fence->lock, flags);return ret;
@@ -461,7 +466,6 @@ dma_fence_default_wait(struct dma_fence *fence, bool intr, signed long timeout)struct default_wait_cb cb;unsigned long flags;signed long ret = timeout ? timeout :1 ; -bool was_set;if (test_bit (DMA_FENCE_FLAG_SIGNALED_BIT , &fence->flags))return ret;
@@ -473,21 +477,9 @@ dma_fence_default_wait(struct dma_fence *fence, bool intr, signed long timeout) goto out; } - was_set =test_and_set_bit (DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT , - &fence->flags); - -if (test_bit (DMA_FENCE_FLAG_SIGNALED_BIT , &fence->flags)) +if (!__dma_fence_enable_signaling (fence)) goto out; -if (!was_set && fence->ops->enable_signaling) { -trace_dma_fence_enable_signal (fence); - -if (!fence->ops->enable_signaling (fence)) { -dma_fence_signal_locked (fence); - goto out; - } - } -if (!timeout) { ret =0 ; goto out;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/388 scsi: qla2xxx: Add error handling for PLOGI ELS passthrough
In reply to Greg Kroah-HartmanFrom: Quinn Tran <[email protected]>
[ Upstream commit c76ae845ea836d6128982dcbd41ac35c81e2de63 ]
Add error handling logic to ELS Passthrough relating to NVME devices. Current code does not parse error code to take proper recovery action, instead it re-logins with the same login parameters that encountered the error. Ex: nport handle collision.
--- drivers/scsi/qla2xxx/qla_iocb.c | 95 +++++++++++++++++++++++++++++++-- 1 file changed, 92 insertions(+), 3 deletions(-)
drivers/scsi/qla2xxx/qla_iocb.c +92 -3
@@ -2749,6 +2749,10 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res)struct scsi_qla_host *vha = sp->vha;struct event_arg ea;struct qla_work_evt *e; +struct fc_port *conflict_fcport; +port_id_t cid;/* conflict Nport id */ +u32 *fw_status = sp->u.iocb_cmd.u.els_plogi.fw_status; +u16 lid; ql_dbg(ql_dbg_disc, vha, 0x3072, "%s ELS done rc %d hdl=%x, portid=%06x %8phC\n",
@@ -2760,14 +2764,99 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res)if (sp->flags &SRB_WAKEUP_ON_COMP )complete (&lio->u.els_plogi.comp);else { -if (res) { -set_bit (RELOGIN_NEEDED , &vha->dpc_flags); - }else { +switch (fw_status[0 ]) { +case CS_DATA_UNDERRUN : +case CS_COMPLETE :memset (&ea,0 ,sizeof (ea)); ea.fcport = fcport; ea.data[0 ] =MBS_COMMAND_COMPLETE ; ea.sp = sp;qla24xx_handle_plogi_done_event (vha, &ea); +break ; +case CS_IOCB_ERROR : +switch (fw_status[1 ]) { +case LSC_SCODE_PORTID_USED : + lid = fw_status[2 ] &0xffff ; +qlt_find_sess_invalidate_other (vha, +wwn_to_u64 (fcport->port_name), + fcport->d_id, lid, &conflict_fcport); +if (conflict_fcport) { +/* +* Another fcport shares the same +* loop_id & nport id; conflict +* fcport needs to finish cleanup +* before this fcport can proceed +* to login. +*/ + conflict_fcport->conflict = fcport; + fcport->login_pause =1 ; +ql_dbg (ql_dbg_disc, vha,0x20ed , +"%s %d %8phC pid %06x inuse with lid %#x post gidpn\n" , + __func__, __LINE__, + fcport->port_name, + fcport->d_id.b24, lid); + }else { +ql_dbg (ql_dbg_disc, vha,0x20ed , +"%s %d %8phC pid %06x inuse with lid %#x sched del\n" , + __func__, __LINE__, + fcport->port_name, + fcport->d_id.b24, lid); +qla2x00_clear_loop_id (fcport); +set_bit (lid, vha->hw->loop_id_map); + fcport->loop_id = lid; + fcport->keep_nport_handle =0 ; +qlt_schedule_sess_for_deletion (fcport); + } +break ; + +case LSC_SCODE_NPORT_USED : + cid.b.domain = (fw_status[2 ] >>16 ) &0xff ; + cid.b.area = (fw_status[2 ] >>8 ) &0xff ; + cid.b.al_pa = fw_status[2 ] &0xff ; + cid.b.rsvd_1 =0 ; + +ql_dbg (ql_dbg_disc, vha,0x20ec , +"%s %d %8phC lid %#x in use with pid %06x post gnl\n" , + __func__, __LINE__, fcport->port_name, + fcport->loop_id, cid.b24); +set_bit (fcport->loop_id, + vha->hw->loop_id_map); + fcport->loop_id =FC_NO_LOOP_ID ; +qla24xx_post_gnl_work (vha, fcport); +break ; + +case LSC_SCODE_NOXCB : + vha->hw->exch_starvation++; +if (vha->hw->exch_starvation >5 ) { +ql_log (ql_log_warn, vha,0xd046 , +"Exchange starvation. Resetting RISC\n" ); + vha->hw->exch_starvation =0 ; +set_bit (ISP_ABORT_NEEDED , + &vha->dpc_flags); +qla2xxx_wake_dpc (vha); + } +/* fall through */ +default : +ql_dbg (ql_dbg_disc, vha,0x20eb , +"%s %8phC cmd error fw_status 0x%x 0x%x 0x%x\n" , + __func__, sp->fcport->port_name, + fw_status[0 ], fw_status[1 ], fw_status[2 ]); + + fcport->flags &= ~FCF_ASYNC_SENT ; +set_bit (RELOGIN_NEEDED , &vha->dpc_flags); +break ; + } +break ; + +default : +ql_dbg (ql_dbg_disc, vha,0x20eb , +"%s %8phC cmd error 2 fw_status 0x%x 0x%x 0x%x\n" , + __func__, sp->fcport->port_name, + fw_status[0 ], fw_status[1 ], fw_status[2 ]); + + sp->fcport->flags &= ~FCF_ASYNC_SENT ; +set_bit (RELOGIN_NEEDED , &vha->dpc_flags); +break ; } e =qla2x00_alloc_work (vha,QLA_EVT_UNMAP );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/388 ath10k: fix array out-of-bounds access
In reply to Greg Kroah-HartmanFrom: Miaoqing Pan <[email protected]>
[ Upstream commit c5329b2d5b8b4e41be14d31ee8505b4f5607bf9b ]
If firmware reports rate_max > WMI_TPC_RATE_MAX(WMI_TPC_FINAL_RATE_MAX) or num_tx_chain > WMI_TPC_TX_N_CHAIN, it will cause array out-of-bounds access, so print a warning and reset to avoid memory corruption.
Tested HW: QCA9984
Tested FW: 10.4-3.9.0.2-00035
--- drivers/net/wireless/ath/ath10k/debug.c | 2 +- drivers/net/wireless/ath/ath10k/wmi.c | 49 ++++++++++++++++--------- 2 files changed, 32 insertions(+), 19 deletions(-)
drivers/net/wireless/ath/ath10k/debug.c +1 -1
@@ -1516,7 +1516,7 @@ static void ath10k_tpc_stats_print(struct ath10k_tpc_stats *tpc_stats, *len +=scnprintf (buf + *len, buf_len - *len,"No. Preamble Rate_code " ); -for (i =0 ; i <WMI_TPC_TX_N_CHAIN ; i++) +for (i =0 ; i < tpc_stats->num_tx_chain; i++) *len +=scnprintf (buf + *len, buf_len - *len,"tpc_value%d " , i);
drivers/net/wireless/ath/ath10k/wmi.c +31 -18
111 lines not on this page · raw message
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 11/388 ath10k: fix memory leak for tpc_stats_final
In reply to Greg Kroah-HartmanFrom: Miaoqing Pan <[email protected]>
[ Upstream commit 486a8849843455298d49e694cca9968336ce2327 ]
The memory of ar->debug.tpc_stats_final is reallocated every debugfs reading, it should be freed in ath10k_debug_destroy() for the last allocation.
Tested HW: QCA9984
Tested FW: 10.4-3.9.0.2-00035
--- drivers/net/wireless/ath/ath10k/debug.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath10k/debug.c +1 -0
@@ -2532,6 +2532,7 @@ void ath10k_debug_destroy(struct ath10k *ar)ath10k_debug_fw_stats_reset (ar);kfree (ar->debug.tpc_stats); +kfree (ar->debug.tpc_stats_final); }int ath10k_debug_register (struct ath10k *ar)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 12/388 PCI/IOV: Serialize sysfs sriov_numvfs reads vs writes
In reply to Greg Kroah-HartmanFrom: Pierre Crégut <[email protected]>
[ Upstream commit 35ff867b76576e32f34c698ccd11343f7d616204 ]
When sriov_numvfs is being updated, we call the driver->sriov_configure() function, which may enable VFs and call probe functions, which may make new devices visible. This all happens before before sriov_numvfs_store() updates sriov->num_VFs, so previously, concurrent sysfs reads of sriov_numvfs returned stale values.
Serialize the sysfs read vs the write so the read returns the correct num_VFs value.
--- drivers/pci/iov.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/pci/iov.c +7 -1
@@ -253,8 +253,14 @@ static ssize_t sriov_numvfs_show(struct device *dev, char *buf) {struct pci_dev *pdev =to_pci_dev (dev); +u16 num_vfs; + +/* Serialize vs sriov_numvfs_store() so readers see valid num_VFs */ +device_lock (&pdev->dev); + num_vfs = pdev->sriov->num_VFs; +device_unlock (&pdev->dev); -return sprintf (buf,"%u\n" , pdev->sriov->num_VFs); +return sprintf (buf,"%u\n" , num_vfs); }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 13/388 mm: fix double page fault on arm64 if PTE_AF is cleared
In reply to Greg Kroah-HartmanFrom: Jia He <[email protected]>
[ Upstream commit 83d116c53058d505ddef051e90ab27f57015b025 ]
When we tested pmdk unit test [1] vmmalloc_fork TEST3 on arm64 guest, there will be a double page fault in __copy_from_user_inatomic of cow_user_page.
To reproduce the bug, the cmd is as follows after you deployed everything:
make -C src/test/vmmalloc_fork/ TEST_TIME=60m check
Below call trace is from arm64 do_page_fault for debugging purpose:
[ 110.016195] Call trace: [ 110.016826] do_page_fault+0x5a4/0x690 [ 110.017812] do_mem_abort+0x50/0xb0 [ 110.018726] el1_da+0x20/0xc4 [ 110.019492] __arch_copy_from_user+0x180/0x280 [ 110.020646] do_wp_page+0xb0/0x860 [ 110.021517] __handle_mm_fault+0x994/0x1338 [ 110.022606] handle_mm_fault+0xe8/0x180 [ 110.023584] do_page_fault+0x240/0x690 [ 110.024535] do_mem_abort+0x50/0xb0 [ 110.025423] el0_da+0x20/0x24
The pte info before __copy_from_user_inatomic is (PTE_AF is cleared):
[ffff9b007000] pgd=000000023d4f8003, pud=000000023da9b003,
pmd=000000023d4b3003, pte=360000298607bd3
As told by Catalin: "On arm64 without hardware Access Flag, copying from user will fail because the pte is old and cannot be marked young. So we always end up with zeroed page after fork() + CoW for pfn mappings. we don't always have a hardware-managed access flag on arm64."
This patch fixes it by calling pte_mkyoung. Also, the parameter is changed because vmf should be passed to cow_user_page()
Add a WARN_ON_ONCE when __copy_from_user_inatomic() returns error in case there can be some obscure use-case (by Kirill).
[1] https://github.com/pmem/pmdk/tree/master/src/test/vmmalloc_fork
--- mm/memory.c | 104 ++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 89 insertions(+), 15 deletions(-)
mm/memory.c +89 -15
@@ -118,6 +118,18 @@ int randomize_va_space __read_mostly =2 ;#endif +#ifndef arch_faults_on_old_pte +static inline bool arch_faults_on_old_pte (void ) +{ +/* +* Those arches which don't have hw access flag feature need to +* implement their own helper. By default, "true" means pagefault +* will be hit on old pte. +*/ +return true; +} +#endif +static int __init disable_randmaps (char *s) { randomize_va_space =0 ;
@@ -2145,32 +2157,82 @@ static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd,return same; } -static inline void cow_user_page (struct page *dst,struct page *src,unsigned long va,struct vm_area_struct *vma) +static inline bool cow_user_page (struct page *dst,struct page *src, +struct vm_fault *vmf) { +bool ret; +void *kaddr; +void __user *uaddr; +bool force_mkyoung; +struct vm_area_struct *vma = vmf->vma; +struct mm_struct *mm = vma->vm_mm; +unsigned long addr = vmf->address; +debug_dma_assert_idle (src); +if (likely (src)) { +copy_user_highpage (dst, src, addr, vma); +return true; + } +/* * If the source page was a PFN mapping, we don't have * a "struct page" for it. We do a best-effort copy by * just copying from the original user address. If that * fails, we just zero-fill it. Live with it. */ -if (unlikely (!src)) { -void *kaddr =kmap_atomic (dst); -void __user *uaddr = (void __user *)(va &PAGE_MASK ); + kaddr =kmap_atomic (dst); + uaddr = (void __user *)(addr &PAGE_MASK ); + +/* +* On architectures with software "accessed" bits, we would +* take a double page fault, so mark it accessed here. +*/ + force_mkyoung =arch_faults_on_old_pte () && !pte_young (vmf->orig_pte); +if (force_mkyoung) { +pte_t entry; + + vmf->pte =pte_offset_map_lock (mm, vmf->pmd, addr, &vmf->ptl); +if (!likely (pte_same (*vmf->pte, vmf->orig_pte))) { +/* +* Other thread has already handled the fault +* and we don't need to do anything. If it's +* not the case, the fault will be triggered +* again on the same address. +*/ + ret = false; + goto pte_unlock; + } + entry =pte_mkyoung (vmf->orig_pte); +if (ptep_set_access_flags (vma, addr, vmf->pte, entry,0 )) +update_mmu_cache (vma, addr, vmf->pte); + } + +/* +* This really shouldn't fail, because the page is there +* in the page tables. But it might just be unreadable, +* in which case we just give up and fill the result with +* zeroes. +*/ +if (__copy_from_user_inatomic (kaddr, uaddr,PAGE_SIZE )) {/* -* This really shouldn't fail, because the page is there -* in the page tables. But it might just be unreadable, -* in which case we just give up and fill the result with -* zeroes. +* Give a warn in case there can be some obscure +* use-case */ -if (__copy_from_user_inatomic (kaddr, uaddr,PAGE_SIZE )) -clear_page (kaddr); -kunmap_atomic (kaddr); -flush_dcache_page (dst); - }else -copy_user_highpage (dst, src, va, vma); +WARN_ON_ONCE (1 ); +clear_page (kaddr); + } + + ret = true; + +pte_unlock: +if (force_mkyoung) +pte_unmap_unlock (vmf->pte, vmf->ptl); +kunmap_atomic (kaddr); +flush_dcache_page (dst); + +return ret; }static gfp_t __get_fault_gfp_mask (struct vm_area_struct *vma)
@@ -2342,7 +2404,19 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf) vmf->address);if (!new_page) goto oom; -cow_user_page (new_page, old_page, vmf->address, vma); + +if (!cow_user_page (new_page, old_page, vmf)) { +/* +* COW failed, if the fault was solved by other, +* it's fine. If not, userspace would re-fault on +* the same address and we will handle the fault +* from the second attempt. +*/ +put_page (new_page); +if (old_page) +put_page (old_page); +return 0 ; + } }if (mem_cgroup_try_charge_delay (new_page, mm,GFP_KERNEL , &memcg, false))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 14/388 scsi: aacraid: fix illegal IO beyond last LBA
In reply to Greg Kroah-HartmanFrom: Balsundar P <[email protected]>
[ Upstream commit c86fbe484c10b2cd1e770770db2d6b2c88801c1d ]
The driver fails to handle data when read or written beyond device reported LBA, which triggers kernel panic
--- drivers/scsi/aacraid/aachba.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/aacraid/aachba.c +4 -4
@@ -2467,13 +2467,13 @@ static int aac_read(struct scsi_cmnd * scsicmd) scsicmd->result =DID_OK <<16 |COMMAND_COMPLETE <<8 |SAM_STAT_CHECK_CONDITION ;set_sense (&dev->fsa_dev[cid].sense_data, -HARDWARE_ERROR ,SENCODE_INTERNAL_TARGET_FAILURE , +ILLEGAL_REQUEST ,SENCODE_LBA_OUT_OF_RANGE ,ASENCODE_INTERNAL_TARGET_FAILURE ,0 ,0 );memcpy (scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,min_t (size_t,sizeof (dev->fsa_dev[cid].sense_data),SCSI_SENSE_BUFFERSIZE )); scsicmd->scsi_done (scsicmd); -return 1 ; +return 0 ; } dprintk((KERN_DEBUG "aac_read[cpu %d]: lba = %llu, t = %ld.\n",
@@ -2559,13 +2559,13 @@ static int aac_write(struct scsi_cmnd * scsicmd) scsicmd->result =DID_OK <<16 |COMMAND_COMPLETE <<8 |SAM_STAT_CHECK_CONDITION ;set_sense (&dev->fsa_dev[cid].sense_data, -HARDWARE_ERROR ,SENCODE_INTERNAL_TARGET_FAILURE , +ILLEGAL_REQUEST ,SENCODE_LBA_OUT_OF_RANGE ,ASENCODE_INTERNAL_TARGET_FAILURE ,0 ,0 );memcpy (scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,min_t (size_t,sizeof (dev->fsa_dev[cid].sense_data),SCSI_SENSE_BUFFERSIZE )); scsicmd->scsi_done (scsicmd); -return 1 ; +return 0 ; } dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %llu, t = %ld.\n",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 15/388 m68k: q40: Fix info-leak in rtc_ioctl
In reply to Greg Kroah-HartmanFrom: Fuqian Huang <[email protected]>
[ Upstream commit 7cf78b6b12fd5550545e4b73b35dca18bd46b44c ]
When the option is RTC_PLL_GET, pll will be copied to userland via copy_to_user. pll is initialized using mach_get_rtc_pll indirect call and mach_get_rtc_pll is only assigned with function q40_get_rtc_pll in arch/m68k/q40/config.c.
In function q40_get_rtc_pll, the field pll_ctrl is not initialized. This will leak uninitialized stack content to userland. Fix this by zeroing the uninitialized field.
--- arch/m68k/q40/config.c | 1 + 1 file changed, 1 insertion(+)
arch/m68k/q40/config.c +1 -0
@@ -264,6 +264,7 @@ static int q40_get_rtc_pll(struct rtc_pll_info *pll) {int tmp =Q40_RTC_CTRL ; + pll->pll_ctrl =0 ; pll->pll_value = tmp &Q40_RTC_PLL_MASK ;if (tmp &Q40_RTC_PLL_SIGN ) pll->pll_value = -pll->pll_value;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 16/388 xfs: fix inode fork extent count overflow
In reply to Greg Kroah-HartmanFrom: Dave Chinner <[email protected]>
[ Upstream commit 3f8a4f1d876d3e3e49e50b0396eaffcc4ba71b08 ]
[commit message is verbose for discussion purposes - will trim it down later. Some questions about implementation details at the end.]
Zorro Lang recently ran a new test to stress single inode extent counts now that they are no longer limited by memory allocation. The test was simply:
# xfs_io -f -c "falloc 0 40t" /mnt/scratch/big-file # ~/src/xfstests-dev/punch-alternating /mnt/scratch/big-file
This test uncovered a problem where the hole punching operation appeared to finish with no error, but apparently only created 268M extents instead of the 10 billion it was supposed to.
Further, trying to punch out extents that should have been present resulted in success, but no change in the extent count. It looked like a silent failure.
While running the test and observing the behaviour in real time, I observed the extent coutn growing at ~2M extents/minute, and saw this after about an hour:
# xfs_io -f -c "stat" /mnt/scratch/big-file |grep next ; \
Quoted 2 lines
sleep 60 ; \
xfs_io-f -c "stat"/mnt/scratch/big-file|grep next
fsxattr.nextents = 127657993
fsxattr.nextents = 129683339
#
And a few minutes later this:
# xfs_io -f -c "stat" /mnt/scratch/big-file |grep next fsxattr.nextents = 4177861124 #
Ah, what? Where did that 4 billion extra extents suddenly come from?
Stop the workload, unmount, mount:
# xfs_io -f -c "stat" /mnt/scratch/big-file |grep next fsxattr.nextents = 166044375 #
And it's back at the expected number. i.e. the extent count is correct on disk, but it's screwed up in memory. I loaded up the extent list, and immediately:
# xfs_io -f -c "stat" /mnt/scratch/big-file |grep next fsxattr.nextents = 4192576215 #
It's bad again. So, where does that number come from? xfs_fill_fsxattr():
if (ip->i_df.if_flags & XFS_IFEXTENTS)
fa->fsx_nextents = xfs_iext_count(&ip->i_df);
else
fa->fsx_nextents = ip->i_d.di_nextents;And that's the behaviour I just saw in a nutshell. The on disk count is correct, but once the tree is loaded into memory, it goes whacky. Clearly there's something wrong with xfs_iext_count():
inline xfs_extnum_t xfs_iext_count(struct xfs_ifork *ifp)
{
return ifp->if_bytes / sizeof(struct xfs_iext_rec);
}Simple enough, but 134M extents is 2**27, and that's right about where things went wrong. A struct xfs_iext_rec is 16 bytes in size, which means 2**27 * 2**4 = 2**31 and we're right on target for an integer overflow. And, sure enough:
struct xfs_ifork {
int if_bytes; /* bytes in if_u1 */
....
Once we get 2**27 extents in a file, we overflow if_bytes and the in-core extent count goes wrong. And when we reach 2**28 extents, if_bytes wraps back to zero and things really start to go wrong there. This is where the silent failure comes from - only the first 2**28 extents can be looked up directly due to the overflow, all the extents above this index wrap back to somewhere in the first 2**28 extents. Hence with a regular pattern, trying to punch a hole in the range that didn't have holes mapped to a hole in the first 2**28 extents and so "succeeded" without changing anything. Hence "silent failure"...
Fix this by converting if_bytes to a int64_t and converting all the index variables and size calculations to use int64_t types to avoid overflows in future. Signed integers are still used to enable easy detection of extent count underflows. This enables scalability of extent counts to the limits of the on-disk format - MAXEXTNUM (2**31) extents.
Current testing is at over 500M extents and still going:
fsxattr.nextents = 517310478
--- fs/xfs/libxfs/xfs_attr_leaf.c | 18 ++++++++++-------- fs/xfs/libxfs/xfs_dir2_sf.c | 2 +- fs/xfs/libxfs/xfs_iext_tree.c | 2 +- fs/xfs/libxfs/xfs_inode_fork.c | 8 ++++---- fs/xfs/libxfs/xfs_inode_fork.h | 14 ++++++++------ 5 files changed, 24 insertions(+), 20 deletions(-)
fs/xfs/libxfs/xfs_attr_leaf.c +10 -8
@@ -453,13 +453,15 @@ xfs_attr_copy_value(* special case for dev/uuid inodes, they have fixed size data forks. */ int -xfs_attr_shortform_bytesfit (xfs_inode_t *dp,int bytes) +xfs_attr_shortform_bytesfit ( +struct xfs_inode *dp, +int bytes) { -int offset; -int minforkoff;/* lower limit on valid forkoff locations */ -int maxforkoff;/* upper limit on valid forkoff locations */ -int dsize; -xfs_mount_t *mp = dp->i_mount; +struct xfs_mount *mp = dp->i_mount; +int64_t dsize; +int minforkoff; +int maxforkoff; +int offset;/* rounded down */ offset = (XFS_LITINO (mp, dp->i_d.di_version) - bytes) >>3 ;
@@ -525,7 +527,7 @@ xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes)* A data fork btree root must have space for at least * MINDBTPTRS key/ptr pairs if the data fork is small or empty. */ - minforkoff =max (dsize,XFS_BMDR_SPACE_CALC (MINDBTPTRS )); + minforkoff =max_t (int64_t, dsize,XFS_BMDR_SPACE_CALC (MINDBTPTRS )); minforkoff =roundup (minforkoff,8 ) >>3 ;/* attr fork btree root can have at least this many key/ptr pairs */
@@ -924,7 +926,7 @@ xfs_attr_shortform_verify(char *endp;struct xfs_ifork *ifp;int i; -int size; +int64_t size;ASSERT (ip->i_d.di_aformat ==XFS_DINODE_FMT_LOCAL ); ifp =XFS_IFORK_PTR (ip,XFS_ATTR_FORK );
fs/xfs/libxfs/xfs_dir2_sf.c +1 -1
@@ -628,7 +628,7 @@ xfs_dir2_sf_verify(int i;int i8count;int offset; -int size; +int64_t size;int error;uint8_t filetype;
fs/xfs/libxfs/xfs_iext_tree.c +1 -1
@@ -596,7 +596,7 @@ xfs_iext_realloc_root(struct xfs_ifork *ifp, struct xfs_iext_cursor *cur) { - size_t new_size = ifp->if_bytes + sizeof(struct xfs_iext_rec); + int64_t new_size = ifp->if_bytes + sizeof(struct xfs_iext_rec);void *new;/* account for the prev/next pointers */
fs/xfs/libxfs/xfs_inode_fork.c +4 -4
@@ -129,7 +129,7 @@ xfs_init_local_fork(struct xfs_inode *ip, int whichfork, const void *data, - int size) + int64_t size) { struct xfs_ifork *ifp = XFS_IFORK_PTR(ip, whichfork);int mem_size = size, real_size =0 ;
@@ -467,11 +467,11 @@ xfs_iroot_realloc(void xfs_idata_realloc (struct xfs_inode *ip, -int byte_diff, +int64_t byte_diff,int whichfork) {struct xfs_ifork *ifp =XFS_IFORK_PTR (ip, whichfork); -int new_size = (int )ifp->if_bytes + byte_diff; +int64_t new_size = ifp->if_bytes + byte_diff;ASSERT (new_size >=0 );ASSERT (new_size <=XFS_IFORK_SIZE (ip, whichfork));
@@ -552,7 +552,7 @@ xfs_iextents_copy(struct xfs_ifork *ifp =XFS_IFORK_PTR (ip, whichfork);struct xfs_iext_cursor icur;struct xfs_bmbt_irec rec; -int copied =0 ; +int64_t copied =0 ;ASSERT (xfs_isilocked (ip,XFS_ILOCK_EXCL |XFS_ILOCK_SHARED ));ASSERT (ifp->if_bytes >0 );
fs/xfs/libxfs/xfs_inode_fork.h +8 -6
@@ -13,16 +13,16 @@ struct xfs_dinode;* File incore extent information, present for each of data & attr forks. */ struct xfs_ifork { -int if_bytes;/* bytes in if_u1 */ -unsigned int if_seq;/* fork mod counter */ +int64_t if_bytes;/* bytes in if_u1 */ struct xfs_btree_block *if_broot;/* file's incore btree root */ -short if_broot_bytes;/* bytes allocated for root */ -unsigned char if_flags;/* per-fork flags */ +unsigned int if_seq;/* fork mod counter */ int if_height;/* height of the extent tree */ union {void *if_root;/* extent tree root */ char *if_data;/* inline file data */ } if_u1; +short if_broot_bytes;/* bytes allocated for root */ +unsigned char if_flags;/* per-fork flags */ };/*
@@ -93,12 +93,14 @@ int xfs_iformat_fork(struct xfs_inode *, struct xfs_dinode *);void xfs_iflush_fork (struct xfs_inode *,struct xfs_dinode *,struct xfs_inode_log_item *,int );void xfs_idestroy_fork (struct xfs_inode *,int ); -void xfs_idata_realloc (struct xfs_inode *,int ,int ); +void xfs_idata_realloc (struct xfs_inode *ip,int64_t byte_diff, +int whichfork);void xfs_iroot_realloc (struct xfs_inode *,int ,int );int xfs_iread_extents (struct xfs_trans *,struct xfs_inode *,int );int xfs_iextents_copy (struct xfs_inode *,struct xfs_bmbt_rec *,int ); -void xfs_init_local_fork (struct xfs_inode *,int ,const void *,int ); +void xfs_init_local_fork (struct xfs_inode *ip,int whichfork, +const void *data,int64_t size);xfs_extnum_t xfs_iext_count (struct xfs_ifork *ifp); void xfs_iext_insert(struct xfs_inode *, struct xfs_iext_cursor *cur,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 17/388 gma/gma500: fix a memory disclosure bug due to uninitialized bytes
In reply to Greg Kroah-HartmanFrom: Kangjie Lu <[email protected]>
[ Upstream commit 57a25a5f754ce27da2cfa6f413cfd366f878db76 ]
best_clock is an object that may be sent out. Object clock contains uninitialized bytes that are copied to best_clock, which leads to memory disclosure and information leak.
--- drivers/gpu/drm/gma500/cdv_intel_display.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/gma500/cdv_intel_display.c +2 -0
@@ -405,6 +405,8 @@ static bool cdv_intel_find_dp_pll(const struct gma_limit_t *limit,struct gma_crtc *gma_crtc =to_gma_crtc (crtc);struct gma_clock_t clock; +memset (&clock,0 ,sizeof (clock)); +switch (refclk) {case 27000 :if (target <200000 ) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 18/388 ASoC: kirkwood: fix IRQ error handling
In reply to Greg Kroah-HartmanFrom: Russell King <[email protected]>
[ Upstream commit 175fc928198236037174e5c5c066fe3c4691903e ]
Propagate the error code from request_irq(), rather than returning -EBUSY.
--- sound/soc/kirkwood/kirkwood-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/kirkwood/kirkwood-dma.c +1 -1
@@ -132,7 +132,7 @@ static int kirkwood_dma_open(struct snd_pcm_substream *substream) err =request_irq (priv->irq, kirkwood_dma_irq,IRQF_SHARED ,"kirkwood-i2s" , priv);if (err) -return -EBUSY ; +return err;/* * Enable Error interrupts. We're only ack'ing them but
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 19/388 soundwire: intel/cadence: fix startup sequence
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 49ea07d33d9a32c17e18b322e789507280ceb2a3 ]
Multiple changes squashed in single patch to avoid tick-tock effect and avoid breaking compilation/bisect
1. Per the hardware documentation, all changes to MCP_CONFIG, MCP_CONTROL, MCP_CMDCTRL and MCP_PHYCTRL need to be validated with a self-clearing write to MCP_CONFIG_UPDATE. Add a helper and do the update when the CONFIG is changed.
2. Move interrupt enable after interrupt handler registration
3. Add a new helper to start the hardware bus reset with maximum duration to make sure the Slave(s) correctly detect the reset pattern and to ensure electrical conflicts can be resolved.
4. flush command FIFOs
Better error handling will be provided after interrupt disable is provided in follow-up patches.
--- drivers/soundwire/cadence_master.c | 80 +++++++++++++++++++++--------- drivers/soundwire/cadence_master.h | 1 + drivers/soundwire/intel.c | 14 +++++- 3 files changed, 69 insertions(+), 26 deletions(-)
drivers/soundwire/cadence_master.c +56 -24
@@ -231,6 +231,22 @@ static int cdns_clear_bit(struct sdw_cdns *cdns, int offset, u32 value)return -EAGAIN ; } +/* +* all changes to the MCP_CONFIG, MCP_CONTROL, MCP_CMDCTRL and MCP_PHYCTRL +* need to be confirmed with a write to MCP_CONFIG_UPDATE +*/ +static int cdns_update_config (struct sdw_cdns *cdns) +{ +int ret; + + ret =cdns_clear_bit (cdns,CDNS_MCP_CONFIG_UPDATE , +CDNS_MCP_CONFIG_UPDATE_BIT ); +if (ret <0 ) +dev_err (cdns->dev,"Config update timedout\n" ); + +return ret; +} +/* * debugfs */
@@ -752,7 +768,38 @@ EXPORT_SYMBOL(sdw_cdns_thread);/* * init routines */ -static int _cdns_enable_interrupt (struct sdw_cdns *cdns) + +/** +* sdw_cdns_exit_reset() - Program reset parameters and start bus operations +* @cdns: Cadence instance +*/ +int sdw_cdns_exit_reset (struct sdw_cdns *cdns) +{ +/* program maximum length reset to be safe */ +cdns_updatel (cdns,CDNS_MCP_CONTROL , +CDNS_MCP_CONTROL_RST_DELAY , +CDNS_MCP_CONTROL_RST_DELAY ); + +/* use hardware generated reset */ +cdns_updatel (cdns,CDNS_MCP_CONTROL , +CDNS_MCP_CONTROL_HW_RST , +CDNS_MCP_CONTROL_HW_RST ); + +/* enable bus operations with clock and data */ +cdns_updatel (cdns,CDNS_MCP_CONFIG , +CDNS_MCP_CONFIG_OP , +CDNS_MCP_CONFIG_OP_NORMAL ); + +/* commit changes */ +return cdns_update_config (cdns); +} +EXPORT_SYMBOL (sdw_cdns_exit_reset); + +/** +* sdw_cdns_enable_interrupt() - Enable SDW interrupts and update config +* @cdns: Cadence instance +*/ +int sdw_cdns_enable_interrupt (struct sdw_cdns *cdns) {u32 mask;
@@ -784,24 +831,8 @@ static int _cdns_enable_interrupt(struct sdw_cdns *cdns)cdns_writel (cdns,CDNS_MCP_INTMASK , mask); -return 0 ; -} - -/** -* sdw_cdns_enable_interrupt() - Enable SDW interrupts and update config -* @cdns: Cadence instance -*/ -int sdw_cdns_enable_interrupt (struct sdw_cdns *cdns) -{ -int ret; - -_cdns_enable_interrupt (cdns); - ret =cdns_clear_bit (cdns,CDNS_MCP_CONFIG_UPDATE , -CDNS_MCP_CONFIG_UPDATE_BIT ); -if (ret <0 ) -dev_err (cdns->dev,"Config update timedout\n" ); - -return ret; +/* commit changes */ +return cdns_update_config (cdns); }EXPORT_SYMBOL (sdw_cdns_enable_interrupt);
@@ -975,6 +1006,10 @@ int sdw_cdns_init(struct sdw_cdns *cdns)cdns_writel (cdns,CDNS_MCP_SSP_CTRL0 ,CDNS_DEFAULT_SSP_INTERVAL );cdns_writel (cdns,CDNS_MCP_SSP_CTRL1 ,CDNS_DEFAULT_SSP_INTERVAL ); +/* flush command FIFOs */ +cdns_updatel (cdns,CDNS_MCP_CONTROL ,CDNS_MCP_CONTROL_CMD_RST , +CDNS_MCP_CONTROL_CMD_RST ); +/* Set cmd accept mode */ cdns_updatel (cdns,CDNS_MCP_CONTROL ,CDNS_MCP_CONTROL_CMD_ACCEPT ,CDNS_MCP_CONTROL_CMD_ACCEPT );
@@ -997,13 +1032,10 @@ int sdw_cdns_init(struct sdw_cdns *cdns)/* Set cmd mode for Tx and Rx cmds */ val &= ~CDNS_MCP_CONFIG_CMD ; -/* Set operation to normal */ - val &= ~CDNS_MCP_CONFIG_OP ; - val |=CDNS_MCP_CONFIG_OP_NORMAL ; -cdns_writel (cdns,CDNS_MCP_CONFIG , val); -return 0 ; +/* commit changes */ +return cdns_update_config (cdns); }EXPORT_SYMBOL (sdw_cdns_init);
drivers/soundwire/cadence_master.h +1 -0
@@ -161,6 +161,7 @@ irqreturn_t sdw_cdns_thread(int irq, void *dev_id);int sdw_cdns_init (struct sdw_cdns *cdns);int sdw_cdns_pdi_init (struct sdw_cdns *cdns,struct sdw_cdns_stream_config config); +int sdw_cdns_exit_reset (struct sdw_cdns *cdns);int sdw_cdns_enable_interrupt (struct sdw_cdns *cdns);#ifdef CONFIG_DEBUG_FS
drivers/soundwire/intel.c +12 -2
@@ -1050,8 +1050,6 @@ static int intel_probe(struct platform_device *pdev)if (ret) goto err_init; - ret =sdw_cdns_enable_interrupt (&sdw->cdns); -/* Read the PDI config and initialize cadence PDI */ intel_pdi_init (sdw, &config); ret =sdw_cdns_pdi_init (&sdw->cdns, config);
@@ -1069,6 +1067,18 @@ static int intel_probe(struct platform_device *pdev) goto err_init; } + ret =sdw_cdns_enable_interrupt (&sdw->cdns); +if (ret <0 ) { +dev_err (sdw->cdns.dev,"cannot enable interrupts\n" ); + goto err_init; + } + + ret =sdw_cdns_exit_reset (&sdw->cdns); +if (ret <0 ) { +dev_err (sdw->cdns.dev,"unable to exit bus reset sequence\n" ); + goto err_init; + } +/* Register DAIs */ ret =intel_register_dai (sdw);if (ret) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 20/388 media: smiapp: Fix error handling at NVM reading
In reply to Greg Kroah-HartmanFrom: Sakari Ailus <[email protected]>
[ Upstream commit a5b1d5413534607b05fb34470ff62bf395f5c8d0 ]
If NVM reading failed, the device was left powered on. Fix that.
--- drivers/media/i2c/smiapp/smiapp-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/i2c/smiapp/smiapp-core.c +2 -1
@@ -2327,11 +2327,12 @@ smiapp_sysfs_nvm_read(struct device *dev, struct device_attribute *attr,if (rval <0 ) {if (rval != -EBUSY && rval != -EAGAIN )pm_runtime_set_active (&client->dev); -pm_runtime_put (&client->dev); +pm_runtime_put_noidle (&client->dev);return -ENODEV ; }if (smiapp_read_nvm (sensor, sensor->nvm)) { +pm_runtime_put (&client->dev);dev_err (&client->dev,"nvm read failed\n" );return -ENODEV ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 21/388 drm/amd/display: Free gamma after calculating legacy transfer function
In reply to Greg Kroah-HartmanFrom: Nicholas Kazlauskas <[email protected]>
[ Upstream commit 0e3a7c2ec93b15f43a2653e52e9608484391aeaf ]
[Why]
We're leaking memory by not freeing the gamma used to calculate the transfer function for legacy gamma.
[How]
Release the gamma after we're done with it.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c +2 -0
@@ -210,6 +210,8 @@ static int __set_legacy_tf(struct dc_transfer_func *func, res =mod_color_calculate_regamma_params (func, gamma, true, has_rom,NULL ); +dc_gamma_release (&gamma); +return res ?0 : -ENOMEM ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 22/388 xfs: properly serialise fallocate against AIO+DIO
In reply to Greg Kroah-HartmanFrom: Dave Chinner <[email protected]>
[ Upstream commit 249bd9087a5264d2b8a974081870e2e27671b4dc ]
AIO+DIO can extend the file size on IO completion, and it holds no inode locks while the IO is in flight. Therefore, a race condition exists in file size updates if we do something like this:
aio-thread fallocate-thread
lock inode
submit IO beyond inode->i_size
unlock inode
.....
lock inode break layouts if (off + len > inode->i_size) new_size = off + len ..... inode_dio_wait() <blocks>
.....
completesinode->i_size updatedinode_dio_done()
....
<wakes> <does stuff no long beyond EOF> if (new_size) xfs_vn_setattr(inode, new_size)
Yup, that attempt to extend the file size in the fallocate code turns into a truncate - it removes the whatever the aio write allocated and put to disk, and reduced the inode size back down to where the fallocate operation ends.
Fundamentally, xfs_file_fallocate() not compatible with racing AIO+DIO completions, so we need to move the inode_dio_wait() call up to where the lock the inode and break the layouts.
Secondly, storing the inode size and then using it unchecked without holding the ILOCK is not safe; we can only do such a thing if we've locked out and drained all IO and other modification operations, which we don't do initially in xfs_file_fallocate.
It should be noted that some of the fallocate operations are compound operations - they are made up of multiple manipulations that may zero data, and so we may need to flush and invalidate the file multiple times during an operation. However, we only need to lock out IO and other space manipulation operations once, as that lockout is maintained until the entire fallocate operation has been completed.
--- fs/xfs/xfs_bmap_util.c | 8 +------- fs/xfs/xfs_file.c | 30 ++++++++++++++++++++++++++++++ fs/xfs/xfs_ioctl.c | 1 + 3 files changed, 32 insertions(+), 7 deletions(-)
fs/xfs/xfs_bmap_util.c +1 -7
@@ -1039,6 +1039,7 @@ out_trans_cancel: goto out_unlock; } +/* Caller must first wait for the completion of any pending DIOs if required. */ int xfs_flush_unmap_range( struct xfs_inode *ip,
@@ -1050,9 +1051,6 @@ xfs_flush_unmap_range(xfs_off_t rounding, start, end;int error; -/* wait for the completion of any pending DIOs */ -inode_dio_wait (inode); - rounding =max_t (xfs_off_t,1 << mp->m_sb.sb_blocklog,PAGE_SIZE ); start =round_down (offset, rounding); end =round_up (offset + len, rounding) -1 ;
@@ -1084,10 +1082,6 @@ xfs_free_file_space(if (len <=0 )/* if nothing being freed */ return 0 ; - error =xfs_flush_unmap_range (ip, offset, len); -if (error) -return error; - startoffset_fsb =XFS_B_TO_FSB (mp, offset); endoffset_fsb =XFS_B_TO_FSBT (mp, offset + len);
fs/xfs/xfs_file.c +30 -0
@@ -818,6 +818,36 @@ xfs_file_fallocate(if (error) goto out_unlock; +/* +* Must wait for all AIO to complete before we continue as AIO can +* change the file size on completion without holding any locks we +* currently hold. We must do this first because AIO can update both +* the on disk and in memory inode sizes, and the operations that follow +* require the in-memory size to be fully up-to-date. +*/ +inode_dio_wait (inode); + +/* +* Now AIO and DIO has drained we flush and (if necessary) invalidate +* the cached range over the first operation we are about to run. +* +* We care about zero and collapse here because they both run a hole +* punch over the range first. Because that can zero data, and the range +* of invalidation for the shift operations is much larger, we still do +* the required flush for collapse in xfs_prepare_shift(). +* +* Insert has the same range requirements as collapse, and we extend the +* file first which can zero data. Hence insert has the same +* flush/invalidate requirements as collapse and so they are both +* handled at the right time by xfs_prepare_shift(). +*/ +if (mode & (FALLOC_FL_PUNCH_HOLE |FALLOC_FL_ZERO_RANGE | +FALLOC_FL_COLLAPSE_RANGE )) { + error =xfs_flush_unmap_range (ip, offset, len); +if (error) + goto out_unlock; + } +if (mode &FALLOC_FL_PUNCH_HOLE ) { error =xfs_free_file_space (ip, offset, len);if (error)
fs/xfs/xfs_ioctl.c +1 -0
@@ -622,6 +622,7 @@ xfs_ioc_space( error =xfs_break_layouts (inode, &iolock,BREAK_UNMAP );if (error) goto out_unlock; +inode_dio_wait (inode);switch (bf->l_whence) {case 0 :/*SEEK_SET*/
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 23/388 leds: mlxreg: Fix possible buffer overflow
In reply to Greg Kroah-HartmanFrom: Oleh Kravchenko <[email protected]>
[ Upstream commit 7c6082b903ac28dc3f383fba57c6f9e7e2594178 ]
Error was detected by PVS-Studio:
V512 A call of the 'sprintf' function will lead to overflow of the buffer 'led_data->led_cdev_name'.
--- drivers/leds/leds-mlxreg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/leds/leds-mlxreg.c +2 -2
@@ -228,8 +228,8 @@ static int mlxreg_led_config(struct mlxreg_led_priv_data *priv) brightness =LED_OFF ; led_data->base_color =MLXREG_LED_GREEN_SOLID ; } -sprintf (led_data->led_cdev_name,"%s:%s" ,"mlxreg" , - data->label); +snprintf (led_data->led_cdev_name,sizeof (led_data->led_cdev_name), +"mlxreg:%s" , data->label); led_cdev->name = led_data->led_cdev_name; led_cdev->brightness = brightness; led_cdev->max_brightness =LED_ON ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 24/388 dm table: do not allow request-based DM to stack on partitions
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit 6ba01df72b4b63a26b4977790f58d8f775d2992c ]
Partitioned request-based devices cannot be used as underlying devices for request-based DM because no partition offsets are added to each incoming request. As such, until now, stacking on partitioned devices would _always_ result in data corruption (e.g. wiping the partition table, writing to other partitions, etc). Fix this by disallowing request-based stacking on partitions.
While at it, since all .request_fn support has been removed from block core, remove legacy dm-table code that differentiated between blk-mq and .request_fn request-based.
--- drivers/md/dm-table.c | 27 ++++++++------------------- 1 file changed, 8 insertions(+), 19 deletions(-)
drivers/md/dm-table.c +8 -19
@@ -922,21 +922,15 @@ bool dm_table_supports_dax(struct dm_table *t,static bool dm_table_does_not_support_partial_completion (struct dm_table *t); -struct verify_rq_based_data { -unsigned sq_count; -unsigned mq_count; -}; - -static int device_is_rq_based (struct dm_target *ti,struct dm_dev *dev, -sector_t start,sector_t len,void *data) +static int device_is_rq_stackable (struct dm_target *ti,struct dm_dev *dev, +sector_t start,sector_t len,void *data) { -struct request_queue *q =bdev_get_queue (dev->bdev); -struct verify_rq_based_data *v = data; +struct block_device *bdev = dev->bdev; +struct request_queue *q =bdev_get_queue (bdev); -if (queue_is_mq (q)) - v->mq_count++; -else - v->sq_count++; +/* request-based cannot stack on partitions! */ +if (bdev != bdev->bd_contains) +return false;return queue_is_mq (q); }
@@ -945,7 +939,6 @@ static int dm_table_determine_type(struct dm_table *t) {unsigned i;unsigned bio_based =0 , request_based =0 , hybrid =0 ; -struct verify_rq_based_data v = {.sq_count =0 , .mq_count =0 };struct dm_target *tgt;struct list_head *devices =dm_table_get_devices (t);enum dm_queue_mode live_md_type =dm_get_md_type (t->md);
@@ -1049,14 +1042,10 @@ verify_rq_based:/* Non-request-stackable devices can't be used for request-based dm */ if (!tgt->type->iterate_devices || - !tgt->type->iterate_devices (tgt, device_is_rq_based, &v)) { + !tgt->type->iterate_devices (tgt, device_is_rq_stackable,NULL )) {DMERR ("table load rejected: including non-request-stackable devices" );return -EINVAL ; } -if (v.sq_count >0 ) { -DMERR ("table load rejected: not all devices are blk-mq request-stackable" ); -return -EINVAL ; - }return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 25/388 PM / devfreq: tegra30: Fix integer overflow on CPUs freq max out
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 53b4b2aeee26f42cde5ff2a16dd0d8590c51a55a ]
There is another kHz-conversion bug in the code, resulting in integer overflow. Although, this time the resulting value is 4294966296 and it's close to ULONG_MAX, which is okay in this case.
--- drivers/devfreq/tegra30-devfreq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/devfreq/tegra30-devfreq.c +3 -1
@@ -68,6 +68,8 @@#define KHZ 1000 +#define KHZ_MAX (ULONG_MAX / KHZ) +/* Assume that the bus is saturated if the utilization is 25% */ #define BUS_SATURATION_RATIO 25
@@ -169,7 +171,7 @@ struct tegra_actmon_emc_ratio { };static struct tegra_actmon_emc_ratio actmon_emc_ratios[] = { - {1400000 ,ULONG_MAX }, + {1400000 ,KHZ_MAX }, {1200000 ,750000 }, {1100000 ,600000 }, {1000000 ,500000 },
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 26/388 scsi: fnic: fix use after free
In reply to Greg Kroah-HartmanFrom: Pan Bian <[email protected]>
[ Upstream commit ec990306f77fd4c58c3b27cc3b3c53032d6e6670 ]
The memory chunk io_req is released by mempool_free. Accessing io_req->start_time will result in a use after free bug. The variable start_time is a backup of the timestamp. So, use start_time here to avoid use after free.
--- drivers/scsi/fnic/fnic_scsi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/fnic/fnic_scsi.c +2 -1
@@ -1027,7 +1027,8 @@ static void fnic_fcpio_icmnd_cmpl_handler(struct fnic *fnic,atomic64_inc (&fnic_stats->io_stats.io_completions); - io_duration_time =jiffies_to_msecs (jiffies) -jiffies_to_msecs (io_req->start_time); + io_duration_time =jiffies_to_msecs (jiffies) - +jiffies_to_msecs (start_time);if (io_duration_time <=10 )atomic64_inc (&fnic_stats->io_stats.io_btw_0_to_10_msec);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 27/388 scsi: lpfc: Fix kernel crash at lpfc_nvme_info_show during remote port bounce
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 6c1e803eac846f886cd35131e6516fc51a8414b9 ]
When reading sysfs nvme_info file while a remote port leaves and comes back, a NULL pointer is encountered. The issue is due to ndlp list corruption as the the nvme_info_show does not use the same lock as the rest of the code.
Correct by removing the rcu_xxx_lock calls and replace by the host_lock and phba->hbaLock spinlocks that are used by the rest of the driver. Given we're called from sysfs, we are safe to use _irq rather than _irqsave.
--- drivers/scsi/lpfc/lpfc_attr.c | 40 +++++++++++++++++------------------ 1 file changed, 20 insertions(+), 20 deletions(-)
drivers/scsi/lpfc/lpfc_attr.c +20 -20
@@ -176,7 +176,6 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,int i;int len =0 ;char tmp[LPFC_MAX_NVME_INFO_TMP_LEN ] = {0 }; -unsigned long iflags =0 ;if (!(vport->cfg_enable_fc4_type &LPFC_ENABLE_NVME )) { len =scnprintf (buf,PAGE_SIZE ,"NVME Disabled\n" );
@@ -347,7 +346,6 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,if (strlcat (buf,"\nNVME Initiator Enabled\n" ,PAGE_SIZE ) >=PAGE_SIZE ) goto buffer_done; -rcu_read_lock (); scnprintf(tmp, sizeof(tmp), "XRI Dist lpfc%d Total %d IO %d ELS %d\n", phba->brd_no,
@@ -355,7 +353,7 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr, phba->sli4_hba.io_xri_max, lpfc_sli4_get_els_iocb_cnt(phba));if (strlcat (buf, tmp,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto buffer_done;/* Port state is only one of two values for now. */ if (localport->port_id)
@@ -371,15 +369,17 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,wwn_to_u64 (vport->fc_nodename.u.wwn), localport->port_id, statep);if (strlcat (buf, tmp,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto buffer_done; + +spin_lock_irq (shost->host_lock);list_for_each_entry (ndlp, &vport->fc_nodes, nlp_listp) { nrport =NULL ; -spin_lock_irqsave (&vport->phba->hbalock, iflags); +spin_lock (&vport->phba->hbalock); rport =lpfc_ndlp_get_nrport (ndlp);if (rport) nrport = rport->remoteport; -spin_unlock_irqrestore (&vport->phba->hbalock, iflags); +spin_unlock (&vport->phba->hbalock);if (!nrport)continue ;
@@ -398,39 +398,39 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,/* Tab in to show lport ownership. */ if (strlcat (buf,"NVME RPORT " ,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done;if (phba->brd_no >=10 ) {if (strlcat (buf," " ,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done; }scnprintf (tmp,sizeof (tmp),"WWPN x%llx " , nrport->port_name);if (strlcat (buf, tmp,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done;scnprintf (tmp,sizeof (tmp),"WWNN x%llx " , nrport->node_name);if (strlcat (buf, tmp,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done;scnprintf (tmp,sizeof (tmp),"DID x%06x " , nrport->port_id);if (strlcat (buf, tmp,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done;/* An NVME rport can have multiple roles. */ if (nrport->port_role &FC_PORT_ROLE_NVME_INITIATOR ) {if (strlcat (buf,"INITIATOR " ,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done; }if (nrport->port_role &FC_PORT_ROLE_NVME_TARGET ) {if (strlcat (buf,"TARGET " ,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done; }if (nrport->port_role &FC_PORT_ROLE_NVME_DISCOVERY ) {if (strlcat (buf,"DISCSRVC " ,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done; } if (nrport->port_role & ~(FC_PORT_ROLE_NVME_INITIATOR | FC_PORT_ROLE_NVME_TARGET |
@@ -438,14 +438,14 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,scnprintf (tmp,sizeof (tmp),"UNKNOWN ROLE x%x" , nrport->port_role);if (strlcat (buf, tmp,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done; }scnprintf (tmp,sizeof (tmp),"%s\n" , statep);if (strlcat (buf, tmp,PAGE_SIZE ) >=PAGE_SIZE ) - goto rcu_unlock_buf_done; + goto unlock_buf_done; } -rcu_read_unlock (); +spin_unlock_irq (shost->host_lock);if (!lport) goto buffer_done;
@@ -505,11 +505,11 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr, atomic_read(&lport->cmpl_fcp_err));strlcat (buf, tmp,PAGE_SIZE ); -/* RCU is already unlocked. */ +/* host_lock is already unlocked. */ goto buffer_done; - rcu_unlock_buf_done: -rcu_read_unlock (); + unlock_buf_done: +spin_unlock_irq (shost->host_lock); buffer_done: len =strnlen (buf,PAGE_SIZE );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 28/388 powerpc/64s: Always disable branch profiling for prom_init.o
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit 6266a4dadb1d0976490fdf5af4f7941e36f64e80 ]
Otherwise the build fails because prom_init is calling symbols it's not allowed to, eg:
Error: External symbol 'ftrace_likely_update' referenced from prom_init.c make[3]: *** [arch/powerpc/kernel/Makefile:197: arch/powerpc/kernel/prom_init_check] Error 1
--- arch/powerpc/kernel/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/Makefile +1 -1
@@ -19,6 +19,7 @@ CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) CFLAGS_prom.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) CFLAGS_prom_init.o += $(call cc-option, -fno-stack-protector) +CFLAGS_prom_init.o += -DDISABLE_BRANCH_PROFILING ifdef CONFIG_FUNCTION_TRACER # Do not trace early boot code
@@ -36,7 +37,6 @@ KASAN_SANITIZE_btext.o := n ifdef CONFIG_KASAN CFLAGS_early_32.o += -DDISABLE_BRANCH_PROFILING CFLAGS_cputable.o += -DDISABLE_BRANCH_PROFILING -CFLAGS_prom_init.o += -DDISABLE_BRANCH_PROFILING CFLAGS_btext.o += -DDISABLE_BRANCH_PROFILING endif
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 29/388 net: silence data-races on sk_backlog.tail
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 9ed498c6280a2f2b51d02df96df53037272ede49 ]
sk->sk_backlog.tail might be read without holding the socket spinlock, we need to add proper READ_ONCE()/WRITE_ONCE() to silence the warnings.
KCSAN reported :
BUG: KCSAN: data-race in tcp_add_backlog / tcp_recvmsg
write to 0xffff8881265109f8 of 8 bytes by interrupt on cpu 1:
__sk_add_backlog include/net/sock.h:907 [inline] sk_add_backlog include/net/sock.h:938 [inline] tcp_add_backlog+0x476/0xce0 net/ipv4/tcp_ipv4.c:1759 tcp_v4_rcv+0x1a70/0x1bd0 net/ipv4/tcp_ipv4.c:1947 ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204 ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:442 [inline] ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:4929 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5043 netif_receive_skb_internal+0x59/0x190 net/core/dev.c:5133 napi_skb_finish net/core/dev.c:5596 [inline] napi_gro_receive+0x28f/0x330 net/core/dev.c:5629 receive_buf+0x284/0x30b0 drivers/net/virtio_net.c:1061 virtnet_receive drivers/net/virtio_net.c:1323 [inline] virtnet_poll+0x436/0x7d0 drivers/net/virtio_net.c:1428 napi_poll net/core/dev.c:6311 [inline] net_rx_action+0x3ae/0xa90 net/core/dev.c:6379 __do_softirq+0x115/0x33f kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0xbb/0xe0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] do_IRQ+0xa6/0x180 arch/x86/kernel/irq.c:263 ret_from_intr+0x0/0x19 native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71 arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94 cpuidle_idle_call kernel/sched/idle.c:154 [inline] do_idle+0x1af/0x280 kernel/sched/idle.c:263 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355 start_secondary+0x208/0x260 arch/x86/kernel/smpboot.c:264 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
read to 0xffff8881265109f8 of 8 bytes by task 8057 on cpu 0:
tcp_recvmsg+0x46e/0x1b40 net/ipv4/tcp.c:2050 inet_recvmsg+0xbb/0x250 net/ipv4/af_inet.c:838 sock_recvmsg_nosec net/socket.c:871 [inline] sock_recvmsg net/socket.c:889 [inline] sock_recvmsg+0x92/0xb0 net/socket.c:885 sock_read_iter+0x15f/0x1e0 net/socket.c:967 call_read_iter include/linux/fs.h:1889 [inline] new_sync_read+0x389/0x4f0 fs/read_write.c:414 __vfs_read+0xb1/0xc0 fs/read_write.c:427 vfs_read fs/read_write.c:461 [inline] vfs_read+0x143/0x2c0 fs/read_write.c:446 ksys_read+0xd5/0x1b0 fs/read_write.c:587 __do_sys_read fs/read_write.c:597 [inline] __se_sys_read fs/read_write.c:595 [inline] __x64_sys_read+0x4c/0x60 fs/read_write.c:595 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 8057 Comm: syz-fuzzer Not tainted 5.4.0-rc6+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- drivers/crypto/chelsio/chtls/chtls_io.c | 10 +++++----- include/net/sock.h | 4 ++-- net/ipv4/tcp.c | 2 +- net/llc/af_llc.c | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-)
drivers/crypto/chelsio/chtls/chtls_io.c +5 -5
@@ -1437,7 +1437,7 @@ static int chtls_pt_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, csk->wr_max_credits)) sk->sk_write_space (sk); -if (copied >= target && !sk->sk_backlog.tail) +if (copied >= target && !READ_ONCE (sk->sk_backlog.tail))break ;if (copied) {
@@ -1470,7 +1470,7 @@ static int chtls_pt_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,break ; } } -if (sk->sk_backlog.tail) { +if (READ_ONCE (sk->sk_backlog.tail)) {release_sock (sk);lock_sock (sk);chtls_cleanup_rbuf (sk, copied);
@@ -1615,7 +1615,7 @@ static int peekmsg(struct sock *sk, struct msghdr *msg,break ; } -if (sk->sk_backlog.tail) { +if (READ_ONCE (sk->sk_backlog.tail)) {/* Do not sleep, just process backlog. */ release_sock (sk);lock_sock (sk);
@@ -1743,7 +1743,7 @@ int chtls_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, csk->wr_max_credits)) sk->sk_write_space (sk); -if (copied >= target && !sk->sk_backlog.tail) +if (copied >= target && !READ_ONCE (sk->sk_backlog.tail))break ;if (copied) {
@@ -1774,7 +1774,7 @@ int chtls_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, } } -if (sk->sk_backlog.tail) { +if (READ_ONCE (sk->sk_backlog.tail)) {release_sock (sk);lock_sock (sk);chtls_cleanup_rbuf (sk, copied);
include/net/sock.h +2 -2
@@ -909,11 +909,11 @@ static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)skb_dst_force (skb);if (!sk->sk_backlog.tail) - sk->sk_backlog.head = skb; +WRITE_ONCE (sk->sk_backlog.head, skb);else sk->sk_backlog.tail->next = skb; - sk->sk_backlog.tail = skb; +WRITE_ONCE (sk->sk_backlog.tail, skb); skb->next =NULL ; }
net/ipv4/tcp.c +1 -1
@@ -2053,7 +2053,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,/* Well, if we have backlog, try to process it now yet. */ -if (copied >= target && !sk->sk_backlog.tail) +if (copied >= target && !READ_ONCE (sk->sk_backlog.tail))break ;if (copied) {
net/llc/af_llc.c +1 -1
@@ -784,7 +784,7 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, }/* Well, if we have backlog, try to process it now yet. */ -if (copied >= target && !sk->sk_backlog.tail) +if (copied >= target && !READ_ONCE (sk->sk_backlog.tail))break ;if (copied) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 30/388 dax: Fix alloc_dax_region() compile warning
In reply to Greg Kroah-HartmanFrom: Dan Williams <[email protected]>
[ Upstream commit 460370ab20b6cc174256e46e192adf01e730faf6 ]
PFN flags are (unsigned long long), fix the alloc_dax_region() calling convention to fix warnings of the form:
Quoted 1 line
Quoted 1 line
include/linux/pfn_t.h:18:17: warning: large integer implicitly truncated to unsigned type [-Woverflow]
#define PFN_DEV (1ULL << (BITS_PER_LONG_LONG - 3))
--- drivers/dax/bus.c | 2 +- drivers/dax/bus.h | 2 +- drivers/dax/dax-private.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/dax/bus.c +1 -1
@@ -227,7 +227,7 @@ static void dax_region_unregister(void *region)struct dax_region *alloc_dax_region (struct device *parent,int region_id,struct resource *res,int target_node,unsigned int align, -unsigned long pfn_flags) +unsigned long long pfn_flags) {struct dax_region *dax_region;
drivers/dax/bus.h +1 -1
@@ -11,7 +11,7 @@ struct dax_region;void dax_region_put (struct dax_region *dax_region);struct dax_region *alloc_dax_region (struct device *parent,int region_id,struct resource *res,int target_node,unsigned int align, -unsigned long flags); +unsigned long long flags);enum dev_dax_subsys {DEV_DAX_BUS ,
drivers/dax/dax-private.h +1 -1
@@ -32,7 +32,7 @@ struct dax_region {struct device *dev;unsigned int align;struct resource res; -unsigned long pfn_flags; +unsigned long long pfn_flags; };/**
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 31/388 iomap: Fix overflow in iomap_page_mkwrite
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit add66fcbd3fbe5aa0dd4dddfa23e119c12989a27 ]
On architectures where loff_t is wider than pgoff_t, the expression ((page->index + 1) << PAGE_SHIFT) can overflow. Rewrite to use the page offset, which we already compute here anyway.
--- fs/iomap/buffered-io.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/iomap/buffered-io.c +3 -4
@@ -1040,20 +1040,19 @@ vm_fault_t iomap_page_mkwrite(struct vm_fault *vmf, const struct iomap_ops *ops)lock_page (page); size =i_size_read (inode); -if ((page->mapping != inode->i_mapping) || - (page_offset (page) > size)) { + offset =page_offset (page); +if (page->mapping != inode->i_mapping || offset > size) {/* We overload EFAULT to mean page got truncated */ ret = -EFAULT ; goto out_unlock; }/* page is wholly or partially inside EOF */ -if (((page->index +1 ) <<PAGE_SHIFT ) > size) +if (offset > size -PAGE_SIZE ) length =offset_in_page (size);else length =PAGE_SIZE ; - offset =page_offset (page);while (length >0 ) { ret = iomap_apply(inode, offset, length, IOMAP_WRITE | IOMAP_FAULT, ops, page,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 32/388 f2fs: avoid kernel panic on corruption test
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
[ Upstream commit bc005a4d5347da68e690f78d365d8927c87dc85a ]
xfstests/generic/475 complains kernel warn/panic while testing corrupted disk.
--- fs/f2fs/node.c | 1 - 1 file changed, 1 deletion(-)
fs/f2fs/node.c +0 -1
@@ -2353,7 +2353,6 @@ static int __f2fs_build_free_nids(struct f2fs_sb_info *sbi,if (ret) {up_read (&nm_i->nat_tree_lock); -f2fs_bug_on (sbi, !mount);f2fs_err (sbi,"NAT is corrupt, run fsck to fix it" );return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 33/388 clk/ti/adpll: allocate room for terminating null
In reply to Greg Kroah-HartmanFrom: Stephen Kitt <[email protected]>
[ Upstream commit 7f6ac72946b88b89ee44c1c527aa8591ac5ffcbe ]
The buffer allocated in ti_adpll_clk_get_name doesn't account for the terminating null. This patch switches to devm_kasprintf to avoid overflowing.
--- drivers/clk/ti/adpll.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/clk/ti/adpll.c +2 -9
@@ -194,15 +194,8 @@ static const char *ti_adpll_clk_get_name(struct ti_adpll_data *d,if (err)return NULL ; }else { -const char *base_name ="adpll" ; -char *buf; - - buf =devm_kzalloc (d->dev,8 +1 +strlen (base_name) +1 + -strlen (postfix),GFP_KERNEL ); -if (!buf) -return NULL ; -sprintf (buf,"%08lx.%s.%s" , d->pa, base_name, postfix); - name = buf; + name =devm_kasprintf (d->dev,GFP_KERNEL ,"%08lx.adpll.%s" , + d->pa, postfix); }return name;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 34/388 drm/amdgpu/powerplay: fix AVFS handling with custom powerplay table
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
[ Upstream commit 53dbc27ad5a93932ff1892a8e4ef266827d74a0f ]
When a custom powerplay table is provided, we need to update the OD VDDC flag to avoid AVFS being enabled when it shouldn't be.
--- drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c +7 -0
@@ -3691,6 +3691,13 @@ static int vega10_set_power_state_tasks(struct pp_hwmgr *hwmgr,PP_ASSERT_WITH_CODE (!result, "Failed to upload PPtable!", return result); +/* +* If a custom pp table is loaded, set DPMTABLE_OD_UPDATE_VDDC flag. +* That effectively disables AVFS feature. +*/ +if (hwmgr->hardcode_pp_table !=NULL ) + data->need_update_dpm_table |=DPMTABLE_OD_UPDATE_VDDC ; +vega10_update_avfs (hwmgr);/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 35/388 ice: Fix to change Rx/Tx ring descriptor size via ethtool with DCBx
In reply to Greg Kroah-HartmanFrom: Usha Ketineni <[email protected]>
[ Upstream commit c0a3665f71a2f086800abea4d9d14d28269089d6 ]
This patch fixes the call trace caused by the kernel when the Rx/Tx descriptor size change request is initiated via ethtool when DCB is configured. ice_set_ringparam() should use vsi->num_txq instead of vsi->alloc_txq as it represents the queues that are enabled in the driver when DCB is enabled/disabled. Otherwise, queue index being used can go out of range.
For example, when vsi->alloc_txq has 104 queues and with 3 TCS enabled via DCB, each TC gets 34 queues, vsi->num_txq will be 102 and only 102 queues will be enabled.
--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/ice/ice_ethtool.c +7 -7
@@ -2635,14 +2635,14 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)netdev_info (netdev,"Changing Tx descriptor count from %d to %d\n" , vsi->tx_rings[0 ]->count, new_tx_cnt); - tx_rings =devm_kcalloc (&pf->pdev->dev, vsi->alloc_txq, + tx_rings =devm_kcalloc (&pf->pdev->dev, vsi->num_txq,sizeof (*tx_rings),GFP_KERNEL );if (!tx_rings) { err = -ENOMEM ; goto done; } -for (i =0 ; i < vsi->alloc_txq; i++) { +ice_for_each_txq (vsi, i) {/* clone ring and setup updated count */ tx_rings[i] = *vsi->tx_rings[i]; tx_rings[i].count = new_tx_cnt;
@@ -2667,14 +2667,14 @@ process_rx:netdev_info (netdev,"Changing Rx descriptor count from %d to %d\n" , vsi->rx_rings[0 ]->count, new_rx_cnt); - rx_rings =devm_kcalloc (&pf->pdev->dev, vsi->alloc_rxq, + rx_rings =devm_kcalloc (&pf->pdev->dev, vsi->num_rxq,sizeof (*rx_rings),GFP_KERNEL );if (!rx_rings) { err = -ENOMEM ; goto done; } -for (i =0 ; i < vsi->alloc_rxq; i++) { +ice_for_each_rxq (vsi, i) {/* clone ring and setup updated count */ rx_rings[i] = *vsi->rx_rings[i]; rx_rings[i].count = new_rx_cnt;
@@ -2712,7 +2712,7 @@ process_link:ice_down (vsi);if (tx_rings) { -for (i =0 ; i < vsi->alloc_txq; i++) { +ice_for_each_txq (vsi, i) {ice_free_tx_ring (vsi->tx_rings[i]); *vsi->tx_rings[i] = tx_rings[i]; }
@@ -2720,7 +2720,7 @@ process_link: }if (rx_rings) { -for (i =0 ; i < vsi->alloc_rxq; i++) { +ice_for_each_rxq (vsi, i) {ice_free_rx_ring (vsi->rx_rings[i]);/* copy the real tail offset */ rx_rings[i].tail = vsi->rx_rings[i]->tail;
@@ -2744,7 +2744,7 @@ process_link: free_tx:/* error cleanup if the Rx allocations failed after getting Tx */ if (tx_rings) { -for (i =0 ; i < vsi->alloc_txq; i++) +ice_for_each_txq (vsi, i)ice_free_tx_ring (&tx_rings[i]);devm_kfree (&pf->pdev->dev, tx_rings); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 36/388 mtd: cfi_cmdset_0002: dont free cfi->cfiq in error path of cfi_amdstd_setup()
In reply to Greg Kroah-HartmanFrom: Hou Tao <[email protected]>
[ Upstream commit 03976af89e3bd9489d542582a325892e6a8cacc0 ]
Else there may be a double-free problem, because cfi->cfiq will be freed by mtd_do_chip_probe() if both the two invocations of check_cmd_set() return failure.
--- drivers/mtd/chips/cfi_cmdset_0002.c | 1 - 1 file changed, 1 deletion(-)
drivers/mtd/chips/cfi_cmdset_0002.c +0 -1
@@ -794,7 +794,6 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)kfree (mtd->eraseregions);kfree (mtd);kfree (cfi->cmdset_priv); -kfree (cfi->cfiq);return NULL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 37/388 mfd: mfd-core: Protect against NULL call-back function pointer
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
[ Upstream commit b195e101580db390f50b0d587b7f66f241d2bc88 ]
If a child device calls mfd_cell_{en,dis}able() without an appropriate call-back being set, we are likely to encounter a panic. Avoid this by adding suitable checking.
--- drivers/mfd/mfd-core.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/mfd/mfd-core.c +10 -0
@@ -28,6 +28,11 @@ int mfd_cell_enable(struct platform_device *pdev)const struct mfd_cell *cell =mfd_get_cell (pdev);int err =0 ; +if (!cell->enable) { +dev_dbg (&pdev->dev,"No .enable() call-back registered\n" ); +return 0 ; + } +/* only call enable hook if the cell wasn't previously enabled */ if (atomic_inc_return (cell->usage_count) ==1 ) err = cell->enable (pdev);
@@ -45,6 +50,11 @@ int mfd_cell_disable(struct platform_device *pdev)const struct mfd_cell *cell =mfd_get_cell (pdev);int err =0 ; +if (!cell->disable) { +dev_dbg (&pdev->dev,"No .disable() call-back registered\n" ); +return 0 ; + } +/* only disable if no other clients are using it */ if (atomic_dec_return (cell->usage_count) ==0 ) err = cell->disable (pdev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 38/388 drm/amdgpu/powerplay/smu7: fix AVFS handling with custom powerplay table
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
[ Upstream commit 901245624c7812b6c95d67177bae850e783b5212 ]
When a custom powerplay table is provided, we need to update the OD VDDC flag to avoid AVFS being enabled when it shouldn't be.
--- drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +7 -0
@@ -3987,6 +3987,13 @@ static int smu7_set_power_state_tasks(struct pp_hwmgr *hwmgr, const void *input)"Failed to populate and upload SCLK MCLK DPM levels!" , result = tmp_result); +/* +* If a custom pp table is loaded, set DPMTABLE_OD_UPDATE_VDDC flag. +* That effectively disables AVFS feature. +*/ +if (hwmgr->hardcode_pp_table !=NULL ) + data->need_update_smu7_dpm_table |=DPMTABLE_OD_UPDATE_VDDC ; + tmp_result =smu7_update_avfs (hwmgr); PP_ASSERT_WITH_CODE((0 == tmp_result), "Failed to update avfs voltages!",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 39/388 tpm_crb: fix fTPM on AMD Zen+ CPUs
In reply to Greg Kroah-HartmanFrom: Ivan Lazeev <[email protected]>
[ Upstream commit 3ef193822b25e9ee629974f66dc1ff65167f770c ]
Bug link: https://bugzilla.kernel.org/show_bug.cgi?id=195657
cmd/rsp buffers are expected to be in the same ACPI region. For Zen+ CPUs BIOS's might report two different regions, some of them also report region sizes inconsistent with values from TPM registers.
Memory configuration on ASRock x470 ITX:
db0a0000-dc59efff : Reserved
dc57e000-dc57efff : MSFT0101:00
dc582000-dc582fff : MSFT0101:00Work around the issue by storing ACPI regions declared for the device in a fixed array and adding an array for pointers to corresponding possibly allocated resources in crb_map_io function. This data was previously held for a single resource
in struct crb_priv (iobase field) and local variable io_res in crb_map_io function. ACPI resources array is used to find index of corresponding region for each buffer and make the buffer size consistent with region's length. Array of pointers to allocated resources is used to map the region at most once.
--- drivers/char/tpm/tpm_crb.c | 123 +++++++++++++++++++++++++++---------- 1 file changed, 90 insertions(+), 33 deletions(-)
drivers/char/tpm/tpm_crb.c +90 -33
@@ -22,6 +22,7 @@#include "tpm.h" #define ACPI_SIG_TPM2 "TPM2" +#define TPM_CRB_MAX_RESOURCES 3static const guid_t crb_acpi_start_guid = GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714,
@@ -91,7 +92,6 @@ enum crb_status {struct crb_priv {u32 sm;const char *hid; -void __iomem *iobase;struct crb_regs_head __iomem *regs_h;struct crb_regs_tail __iomem *regs_t;u8 __iomem *cmd;
@@ -434,21 +434,27 @@ static const struct tpm_class_ops tpm_crb = {static int crb_check_resource (struct acpi_resource *ares,void *data) { -struct resource *io_res = data; +struct resource *iores_array = data;struct resource_win win;struct resource *res = &(win.res); +int i;if (acpi_dev_resource_memory (ares, res) ||acpi_dev_resource_address_space (ares, &win)) { - *io_res = *res; - io_res->name =NULL ; +for (i =0 ; i <TPM_CRB_MAX_RESOURCES +1 ; ++i) { +if (resource_type (iores_array + i) !=IORESOURCE_MEM ) { + iores_array[i] = *res; + iores_array[i].name =NULL ; +break ; + } + } }return 1 ; } -static void __iomem *crb_map_res (struct device *dev,struct crb_priv *priv, -struct resource *io_res,u64 start,u32 size) +static void __iomem *crb_map_res (struct device *dev,struct resource *iores, +void __iomem **iobase_ptr,u64 start,u32 size) {struct resource new_res = { .start = start,
@@ -460,10 +466,16 @@ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,if (start != new_res.start)return (void __iomem *)ERR_PTR (-EINVAL ); -if (!resource_contains (io_res, &new_res)) +if (!iores)return devm_ioremap_resource (dev, &new_res); -return priv->iobase + (new_res.start - io_res->start); +if (!*iobase_ptr) { + *iobase_ptr =devm_ioremap_resource (dev, iores); +if (IS_ERR (*iobase_ptr)) +return *iobase_ptr; + } + +return *iobase_ptr + (new_res.start - iores->start); }/*
@@ -490,9 +502,13 @@ static u64 crb_fixup_cmd_size(struct device *dev, struct resource *io_res,static int crb_map_io (struct acpi_device *device,struct crb_priv *priv,struct acpi_table_tpm2 *buf) { -struct list_head resources; -struct resource io_res; +struct list_head acpi_resource_list; +struct resource iores_array[TPM_CRB_MAX_RESOURCES +1 ] = { {0 } }; +void __iomem *iobase_array[TPM_CRB_MAX_RESOURCES ] = {NULL };struct device *dev = &device->dev; +struct resource *iores; +void __iomem **iobase_ptr; +int i;u32 pa_high, pa_low;u64 cmd_pa;u32 cmd_size;
@@ -501,21 +517,41 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,u32 rsp_size;int ret; -INIT_LIST_HEAD (&resources); - ret =acpi_dev_get_resources (device, &resources, crb_check_resource, - &io_res); +INIT_LIST_HEAD (&acpi_resource_list); + ret =acpi_dev_get_resources (device, &acpi_resource_list, + crb_check_resource, iores_array);if (ret <0 )return ret; -acpi_dev_free_resource_list (&resources); +acpi_dev_free_resource_list (&acpi_resource_list); -if (resource_type (&io_res) !=IORESOURCE_MEM ) { +if (resource_type (iores_array) !=IORESOURCE_MEM ) {dev_err (dev,FW_BUG "TPM2 ACPI table does not define a memory resource\n" );return -EINVAL ; + }else if (resource_type (iores_array +TPM_CRB_MAX_RESOURCES ) == +IORESOURCE_MEM ) { +dev_warn (dev,"TPM2 ACPI table defines too many memory resources\n" ); +memset (iores_array +TPM_CRB_MAX_RESOURCES , +0 ,sizeof (*iores_array)); + iores_array[TPM_CRB_MAX_RESOURCES ].flags =0 ; } - priv->iobase =devm_ioremap_resource (dev, &io_res); -if (IS_ERR (priv->iobase)) -return PTR_ERR (priv->iobase); + iores =NULL ; + iobase_ptr =NULL ; +for (i =0 ;resource_type (iores_array + i) ==IORESOURCE_MEM ; ++i) { +if (buf->control_address >= iores_array[i].start && + buf->control_address +sizeof (struct crb_regs_tail ) -1 <= + iores_array[i].end) { + iores = iores_array + i; + iobase_ptr = iobase_array + i; +break ; + } + } + + priv->regs_t =crb_map_res (dev, iores, iobase_ptr, buf->control_address, +sizeof (struct crb_regs_tail )); + +if (IS_ERR (priv->regs_t)) +return PTR_ERR (priv->regs_t);/* The ACPI IO region starts at the head area and continues to include * the control area, as one nice sane region except for some older
@@ -523,9 +559,10 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,*/ if ((priv->sm ==ACPI_TPM2_COMMAND_BUFFER ) || (priv->sm ==ACPI_TPM2_MEMORY_MAPPED )) { -if (buf->control_address == io_res.start + +if (iores && + buf->control_address == iores->start +sizeof (*priv->regs_h)) - priv->regs_h = priv->iobase; + priv->regs_h = *iobase_ptr;else dev_warn (dev,FW_BUG "Bad ACPI memory layout" ); }
@@ -534,13 +571,6 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,if (ret)return ret; - priv->regs_t =crb_map_res (dev, priv, &io_res, buf->control_address, -sizeof (struct crb_regs_tail )); -if (IS_ERR (priv->regs_t)) { - ret =PTR_ERR (priv->regs_t); - goto out_relinquish_locality; - } -/* * PTT HW bug w/a: wake up the device to access * possibly not retained registers.
@@ -552,13 +582,26 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, pa_high =ioread32 (&priv->regs_t->ctrl_cmd_pa_high); pa_low =ioread32 (&priv->regs_t->ctrl_cmd_pa_low); cmd_pa = ((u64 )pa_high <<32 ) | pa_low; - cmd_size =crb_fixup_cmd_size (dev, &io_res, cmd_pa, -ioread32 (&priv->regs_t->ctrl_cmd_size)); + cmd_size =ioread32 (&priv->regs_t->ctrl_cmd_size); + + iores =NULL ; + iobase_ptr =NULL ; +for (i =0 ; iores_array[i].end; ++i) { +if (cmd_pa >= iores_array[i].start && + cmd_pa <= iores_array[i].end) { + iores = iores_array + i; + iobase_ptr = iobase_array + i; +break ; + } + } + +if (iores) + cmd_size =crb_fixup_cmd_size (dev, iores, cmd_pa, cmd_size);dev_dbg (dev,"cmd_hi = %X cmd_low = %X cmd_size %X\n" , pa_high, pa_low, cmd_size); - priv->cmd =crb_map_res (dev, priv, &io_res, cmd_pa, cmd_size); + priv->cmd =crb_map_res (dev, iores, iobase_ptr, cmd_pa, cmd_size);if (IS_ERR (priv->cmd)) { ret =PTR_ERR (priv->cmd); goto out;
@@ -566,11 +609,25 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,memcpy_fromio (&__rsp_pa, &priv->regs_t->ctrl_rsp_pa,8 ); rsp_pa =le64_to_cpu (__rsp_pa); - rsp_size =crb_fixup_cmd_size (dev, &io_res, rsp_pa, -ioread32 (&priv->regs_t->ctrl_rsp_size)); + rsp_size =ioread32 (&priv->regs_t->ctrl_rsp_size); + + iores =NULL ; + iobase_ptr =NULL ; +for (i =0 ;resource_type (iores_array + i) ==IORESOURCE_MEM ; ++i) { +if (rsp_pa >= iores_array[i].start && + rsp_pa <= iores_array[i].end) { + iores = iores_array + i; + iobase_ptr = iobase_array + i; +break ; + } + } + +if (iores) + rsp_size =crb_fixup_cmd_size (dev, iores, rsp_pa, rsp_size);if (cmd_pa != rsp_pa) { - priv->rsp =crb_map_res (dev, priv, &io_res, rsp_pa, rsp_size); + priv->rsp =crb_map_res (dev, iores, iobase_ptr, + rsp_pa, rsp_size); ret =PTR_ERR_OR_ZERO (priv->rsp); goto out; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 40/388 tracing: Verify if trace array exists before destroying it.
In reply to Greg Kroah-HartmanFrom: Divya Indi <[email protected]>
[ Upstream commit e585e6469d6f476b82aa148dc44aaf7ae269a4e2 ]
A trace array can be destroyed from userspace or kernel. Verify if the trace array exists before proceeding to destroy/remove it.
--- kernel/module.c | 6 +++++- kernel/trace/trace.c | 15 ++++++++++++--- 2 files changed, 17 insertions(+), 4 deletions(-)
kernel/module.c +5 -1
@@ -3753,7 +3753,6 @@ static int complete_formation(struct module *mod, struct load_info *info)module_enable_ro (mod, false);module_enable_nx (mod); -module_enable_x (mod);/* Mark state as coming so strong_try_module_get() ignores us, * but kallsyms etc. can see us. */
@@ -3776,6 +3775,11 @@ static int prepare_coming_module(struct module *mod)if (err)return err; +/* Make module executable after ftrace is enabled */ +mutex_lock (&module_mutex); +module_enable_x (mod); +mutex_unlock (&module_mutex); +blocking_notifier_call_chain (&module_notify_list,MODULE_STATE_COMING , mod);return 0 ;
kernel/trace/trace.c +12 -3
@@ -8502,17 +8502,26 @@ static int __remove_instance(struct trace_array *tr)return 0 ; } -int trace_array_destroy (struct trace_array *tr) +int trace_array_destroy (struct trace_array *this_tr) { +struct trace_array *tr;int ret; -if (!tr) +if (!this_tr)return -EINVAL ;mutex_lock (&event_mutex);mutex_lock (&trace_types_lock); - ret =__remove_instance (tr); + ret = -ENODEV ; + +/* Making sure trace array exists before destroying it. */ +list_for_each_entry (tr, &ftrace_trace_arrays, list) { +if (tr == this_tr) { + ret =__remove_instance (tr); +break ; + } + }mutex_unlock (&trace_types_lock);mutex_unlock (&event_mutex);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 41/388 tracing: Adding NULL checks for trace_array descriptor pointer
In reply to Greg Kroah-HartmanFrom: Divya Indi <[email protected]>
[ Upstream commit 953ae45a0c25e09428d4a03d7654f97ab8a36647 ]
As part of commit f45d1225adb0 ("tracing: Kernel access to Ftrace instances") we exported certain functions. Here, we are adding some additional NULL checks to ensure safe usage by users of these APIs.
--- kernel/trace/trace.c | 3 +++ kernel/trace/trace_events.c | 2 ++ 2 files changed, 5 insertions(+)
kernel/trace/trace.c +3 -0
@@ -3233,6 +3233,9 @@ int trace_array_printk(struct trace_array *tr,if (!(global_trace.trace_flags &TRACE_ITER_PRINTK ))return 0 ; +if (!tr) +return -ENOENT ; +va_start (ap, fmt); ret =trace_array_vprintk (tr, ip, fmt, ap);va_end (ap);
kernel/trace/trace_events.c +2 -0
@@ -793,6 +793,8 @@ int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)char *event =NULL , *sub =NULL , *match;int ret; +if (!tr) +return -ENOENT ;/* * The buf format can be <subsystem>:<event-name> * *:<event-name> means any event by that name.
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 42/388 bcache: fix a lost wake-up problem caused by mca_cannibalize_lock
In reply to Greg Kroah-HartmanFrom: Guoju Fang <[email protected]>
[ Upstream commit 34cf78bf34d48dddddfeeadb44f9841d7864997a ]
This patch fix a lost wake-up problem caused by the race between mca_cannibalize_lock and bch_cannibalize_unlock.
Consider two processes, A and B. Process A is executing mca_cannibalize_lock, while process B takes c->btree_cache_alloc_lock and is executing bch_cannibalize_unlock. The problem happens that after process A executes cmpxchg and will execute prepare_to_wait. In this timeslice process B executes wake_up, but after that process A executes prepare_to_wait and set the state to TASK_INTERRUPTIBLE. Then process A goes to sleep but no one will wake up it. This problem may cause bcache device to dead.
--- drivers/md/bcache/bcache.h | 1 + drivers/md/bcache/btree.c | 12 ++++++++---- drivers/md/bcache/super.c | 1 + 3 files changed, 10 insertions(+), 4 deletions(-)
drivers/md/bcache/bcache.h +1 -0
@@ -585,6 +585,7 @@ struct cache_set {*/ wait_queue_head_t btree_cache_wait;struct task_struct *btree_cache_alloc_lock; +spinlock_t btree_cannibalize_lock;/* * When we free a btree node, we increment the gen of the bucket the
drivers/md/bcache/btree.c +8 -4
@@ -886,15 +886,17 @@ out:static int mca_cannibalize_lock (struct cache_set *c,struct btree_op *op) { -struct task_struct *old; - - old =cmpxchg (&c->btree_cache_alloc_lock,NULL , current); -if (old && old != current) { +spin_lock (&c->btree_cannibalize_lock); +if (likely (c->btree_cache_alloc_lock ==NULL )) { + c->btree_cache_alloc_lock = current; + }else if (c->btree_cache_alloc_lock != current) {if (op)prepare_to_wait (&c->btree_cache_wait, &op->wait,TASK_UNINTERRUPTIBLE ); +spin_unlock (&c->btree_cannibalize_lock);return -EINTR ; } +spin_unlock (&c->btree_cannibalize_lock);return 0 ; }
@@ -929,10 +931,12 @@ static struct btree *mca_cannibalize(struct cache_set *c, struct btree_op *op,*/ static void bch_cannibalize_unlock (struct cache_set *c) { +spin_lock (&c->btree_cannibalize_lock);if (c->btree_cache_alloc_lock == current) { c->btree_cache_alloc_lock =NULL ;wake_up (&c->btree_cache_wait); } +spin_unlock (&c->btree_cannibalize_lock); } static struct btree *mca_alloc(struct cache_set *c, struct btree_op *op,
drivers/md/bcache/super.c +1 -0
@@ -1798,6 +1798,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)sema_init (&c->sb_write_mutex,1 );mutex_init (&c->bucket_lock);init_waitqueue_head (&c->btree_cache_wait); +spin_lock_init (&c->btree_cannibalize_lock);init_waitqueue_head (&c->bucket_wait);init_waitqueue_head (&c->gc_wait);sema_init (&c->uuid_write_mutex,1 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 43/388 dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails
In reply to Greg Kroah-HartmanFrom: Satendra Singh Thakur <[email protected]>
[ Upstream commit 1ff95243257fad07290dcbc5f7a6ad79d6e703e2 ]
When devm_request_irq fails, currently, the function dma_async_device_unregister gets called. This doesn't free the resources allocated by of_dma_controller_register. Therefore, we have called of_dma_controller_free for this purpose.
--- drivers/dma/mediatek/mtk-hsdma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/mediatek/mtk-hsdma.c +3 -1
@@ -997,7 +997,7 @@ static int mtk_hsdma_probe(struct platform_device *pdev)if (err) {dev_err (&pdev->dev,"request_irq failed with err %d\n" , err); - goto err_unregister; + goto err_free; }platform_set_drvdata (pdev, hsdma);
@@ -1006,6 +1006,8 @@ static int mtk_hsdma_probe(struct platform_device *pdev)return 0 ; +err_free: +of_dma_controller_free (pdev->dev.of_node); err_unregister:dma_async_device_unregister (dd);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 44/388 x86/kdump: Always reserve the low 1M when the crashkernel option is specified
In reply to Greg Kroah-HartmanFrom: Lianbo Jiang <[email protected]>
[ Upstream commit 6f599d84231fd27e42f4ca2a786a6641e8cddf00 ]
On x86, purgatory() copies the first 640K of memory to a backup region because the kernel needs those first 640K for the real mode trampoline during boot, among others.
However, when SME is enabled, the kernel cannot properly copy the old memory to the backup area but reads only its encrypted contents. The result is that the crash tool gets invalid pointers when parsing vmcore:
crash> kmem -s|grep -i invalid
kmem: dma-kmalloc-512: slab:ffffd77680001c00 invalid freepointer:a6086ac099f0c5a4
kmem: dma-kmalloc-512: slab:ffffd77680001c00 invalid freepointer:a6086ac099f0c5a4 crash>
So reserve the remaining low 1M memory when the crashkernel option is specified (after reserving real mode memory) so that allocated memory does not fall into the low 1M area and thus the copying of the contents of the first 640k to a backup region in purgatory() can be avoided altogether.
This way, it does not need to be included in crash dumps or used for anything except the trampolines that must live in the low 1M.
[ bp: Heavily rewrite commit message, flip check logic in
crash_reserve_low_1M().]
--- arch/x86/include/asm/crash.h | 6 ++++++ arch/x86/kernel/crash.c | 15 +++++++++++++++ arch/x86/realmode/init.c | 2 ++ 3 files changed, 23 insertions(+)
arch/x86/include/asm/crash.h +6 -0
@@ -10,4 +10,10 @@ int crash_setup_memmap_entries(struct kimage *image, struct boot_params *params);void crash_smp_send_stop (void ); +#ifdef CONFIG_KEXEC_CORE +void __init crash_reserve_low_1M (void ); +#else +static inline void __init crash_reserve_low_1M (void ) { } +#endif +#endif /* _ASM_X86_CRASH_H */
arch/x86/kernel/crash.c +15 -0
@@ -24,6 +24,7 @@#include <linux/export.h> #include <linux/slab.h> #include <linux/vmalloc.h> +#include <linux/memblock.h> #include <asm/processor.h> #include <asm/hardirq.h>
@@ -39,6 +40,7 @@#include <asm/virtext.h> #include <asm/intel_pt.h> #include <asm/crash.h> +#include <asm/cmdline.h> /* Used while preparing memory map entries for second kernel */ struct crash_memmap_data {
@@ -68,6 +70,19 @@ static inline void cpu_crash_vmclear_loaded_vmcss(void)rcu_read_unlock (); } +/* +* When the crashkernel option is specified, only use the low +* 1M for the real mode trampoline. +*/ +void __init crash_reserve_low_1M (void ) +{ +if (cmdline_find_option (boot_command_line,"crashkernel" ,NULL ,0 ) <0 ) +return ; + +memblock_reserve (0 ,1 <<20 ); +pr_info ("Reserving the low 1M of memory for crashkernel\n" ); +} +#if defined(CONFIG_SMP ) && defined(CONFIG_X86_LOCAL_APIC )static void kdump_nmi_callback (int cpu,struct pt_regs *regs)
arch/x86/realmode/init.c +2 -0
@@ -8,6 +8,7 @@#include <asm/pgtable.h> #include <asm/realmode.h> #include <asm/tlbflush.h> +#include <asm/crash.h> struct real_mode_header *real_mode_header;u32 *trampoline_cr4_features;
@@ -34,6 +35,7 @@ void __init reserve_real_mode(void)memblock_reserve (mem, size);set_real_mode_mem (mem); +crash_reserve_low_1M (); }static void __init setup_real_mode (void )
Signature · 9 lines
2.25.1 _______________________________________________ kexec mailing list [email protected] http://lists.infradead.org/mailman/listinfo/kexec
Greg Kroah-Hartman
maintainerPATCH 45/388 RDMA/qedr: Fix potential use after free
In reply to Greg Kroah-HartmanFrom: Pan Bian <[email protected]>
[ Upstream commit 960657b732e1ce21b07be5ab48a7ad3913d72ba4 ]
Move the release operation after error log to avoid possible use after free.
--- drivers/infiniband/hw/qedr/qedr_iw_cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/qedr/qedr_iw_cm.c +1 -1
@@ -490,10 +490,10 @@ qedr_addr6_resolve(struct qedr_dev *dev,if ((!dst) || dst->error) {if (dst) { -dst_release (dst);DP_ERR (dev,"ip6_route_output returned dst->error = %d\n" , dst->error); +dst_release (dst); }return -EINVAL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 46/388 RDMA/i40iw: Fix potential use after free
In reply to Greg Kroah-HartmanFrom: Pan Bian <[email protected]>
[ Upstream commit da046d5f895fca18d63b15ac8faebd5bf784e23a ]
Release variable dst after logging dst->error to avoid possible use after free.
--- drivers/infiniband/hw/i40iw/i40iw_cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/i40iw/i40iw_cm.c +1 -1
@@ -2074,9 +2074,9 @@ static int i40iw_addr_resolve_neigh_ipv6(struct i40iw_device *iwdev, dst =i40iw_get_dst_ipv6 (&src_addr, &dst_addr);if (!dst || dst->error) {if (dst) { -dst_release (dst);i40iw_pr_err ("ip6_route_output returned dst->error = %d\n" , dst->error); +dst_release (dst); }return rc; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 47/388 PCI: Avoid double hpmemsize MMIO window assignment
In reply to Greg Kroah-HartmanFrom: Nicholas Johnson <[email protected]>
[ Upstream commit c13704f5685deb7d6eb21e293233e0901ed77377 ]
Previously, the kernel sometimes assigned more MMIO or MMIO_PREF space than desired. For example, if the user requested 128M of space with "pci=realloc,hpmemsize=128M", we sometimes assigned 256M:
pci 0000:06:01.0: BAR 14: assigned [mem 0x90100000-0xa00fffff] = 256M pci 0000:06:04.0: BAR 14: assigned [mem 0xa0200000-0xb01fffff] = 256M
With this patch applied:
pci 0000:06:01.0: BAR 14: assigned [mem 0x90100000-0x980fffff] = 128M pci 0000:06:04.0: BAR 14: assigned [mem 0x98200000-0xa01fffff] = 128M
This happened when in the first pass, the MMIO_PREF succeeded but the MMIO failed. In the next pass, because MMIO_PREF was already assigned, the attempt to assign MMIO_PREF returned an error code instead of success (nothing more to do, already allocated). Hence, the size which was actually allocated, but thought to have failed, was placed in the MMIO window.
The bug resulted in the MMIO_PREF being added to the MMIO window, which meant doubling if MMIO_PREF size = MMIO size. With a large MMIO_PREF, the MMIO window would likely fail to be assigned altogether due to lack of 32-bit address space.
Change find_free_bus_resource() to do the following:
- Return first unassigned resource of the correct type.
- If there is none, return first assigned resource of the correct type.
- If none of the above, return NULL.
Returning an assigned resource of the correct type allows the caller to distinguish between already assigned and no resource of the correct type.
Add checks in pbus_size_io() and pbus_size_mem() to return success if resource returned from find_free_bus_resource() is already allocated.
This avoids pbus_size_io() and pbus_size_mem() returning error code to __pci_bus_size_bridges() when a resource has been successfully assigned in a previous pass. This fixes the existing behaviour where space for a resource could be reserved multiple times in different parent bridge windows.
--- drivers/pci/setup-bus.c | 38 +++++++++++++++++++++++++++----------- 1 file changed, 27 insertions(+), 11 deletions(-)
drivers/pci/setup-bus.c +27 -11
@@ -752,24 +752,32 @@ static void pci_bridge_check_ranges(struct pci_bus *bus) }/* -* Helper function for sizing routines: find first available bus resource -* of a given type. Note: we intentionally skip the bus resources which -* have already been assigned (that is, have non-NULL parent resource). +* Helper function for sizing routines. Assigned resources have non-NULL +* parent resource. +* +* Return first unassigned resource of the correct type. If there is none, +* return first assigned resource of the correct type. If none of the +* above, return NULL. +* +* Returning an assigned resource of the correct type allows the caller to +* distinguish between already assigned and no resource of the correct type. */ -static struct resource *find_free_bus_resource (struct pci_bus *bus, -unsigned long type_mask, -unsigned long type) +static struct resource *find_bus_resource_of_type (struct pci_bus *bus, +unsigned long type_mask, +unsigned long type) { +struct resource *r, *r_assigned =NULL ;int i; -struct resource *r;pci_bus_for_each_resource (bus, r, i) {if (r == &ioport_resource || r == &iomem_resource)continue ;if (r && (r->flags & type_mask) == type && !r->parent)return r; +if (r && (r->flags & type_mask) == type && !r_assigned) + r_assigned = r; } -return NULL ; +return r_assigned; } static resource_size_t calculate_iosize(resource_size_t size,
@@ -866,8 +874,8 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size, struct list_head *realloc_head) {struct pci_dev *dev; -struct resource *b_res =find_free_bus_resource (bus,IORESOURCE_IO , -IORESOURCE_IO ); +struct resource *b_res =find_bus_resource_of_type (bus,IORESOURCE_IO , +IORESOURCE_IO );resource_size_t size =0 , size0 =0 , size1 =0 ;resource_size_t children_add_size =0 ;resource_size_t min_align, align;
@@ -875,6 +883,10 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,if (!b_res)return ; +/* If resource is already assigned, nothing more to do */ +if (b_res->parent) +return ; + min_align =window_alignment (bus,IORESOURCE_IO );list_for_each_entry (dev, &bus->devices, bus_list) {int i;
@@ -978,7 +990,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,resource_size_t min_align, align, size, size0, size1;resource_size_t aligns[18 ];/* Alignments from 1MB to 128GB */ int order, max_order; -struct resource *b_res =find_free_bus_resource (bus, +struct resource *b_res =find_bus_resource_of_type (bus, mask |IORESOURCE_PREFETCH , type);resource_size_t children_add_size =0 ;resource_size_t children_add_align =0 ;
@@ -987,6 +999,10 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,if (!b_res)return -ENOSPC ; +/* If resource is already assigned, nothing more to do */ +if (b_res->parent) +return 0 ; +memset (aligns,0 ,sizeof (aligns)); max_order =0 ; size =0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 48/388 fix dget_parent() fastpath race
In reply to Greg Kroah-HartmanFrom: Al Viro <[email protected]>
[ Upstream commit e84009336711d2bba885fc9cea66348ddfce3758 ]
We are overoptimistic about taking the fast path there; seeing the same value in ->d_parent after having grabbed a reference to that parent does *not* mean that it has remained our parent all along.
That wouldn't be a big deal (in the end it is our parent and we have grabbed the reference we are about to return), but... the situation with barriers is messed up.
We might have hit the following sequence:
d is a dentry of /tmp/a/b
CPU1: CPU2:
parent = d->d_parent (i.e. dentry of /tmp/a)
rename /tmp/a/b to /tmp/b rmdir /tmp/a, making its dentry negative
grab reference to parent,
end up with cached parent->d_inode (NULL)
mkdir /tmp/a, rename /tmp/b to /tmp/a/b
recheck d->d_parent, which is back to original
decide that everything's fine and return the reference we'd got.
The trouble is, caller (on CPU1) will observe dget_parent() returning an apparently negative dentry. It actually is positive, but CPU1 has stale ->d_inode cached.
Use d->d_seq to see if it has been moved instead of rechecking ->d_parent.
NOTE: we are *NOT* going to retry on any kind of ->d_seq mismatch; we just go into the slow path in such case. We don't wait for ->d_seq to become even either - again, if we are racing with renames, we can bloody well go to slow path anyway.
--- fs/dcache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/dcache.c +3 -1
@@ -903,17 +903,19 @@ struct dentry *dget_parent(struct dentry *dentry) {int gotref;struct dentry *ret; +unsigned seq;/* * Do optimistic parent lookup without any * locking. */ rcu_read_lock (); + seq =raw_seqcount_begin (&dentry->d_seq); ret =READ_ONCE (dentry->d_parent); gotref =lockref_get_not_zero (&ret->d_lockref);rcu_read_unlock ();if (likely (gotref)) { -if (likely (ret ==READ_ONCE (dentry->d_parent))) +if (!read_seqcount_retry (&dentry->d_seq, seq))return ret;dput (ret); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 49/388 xfs: fix attr leaf header freemap.size underflow
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
[ Upstream commit 2a2b5932db67586bacc560cc065d62faece5b996 ]
The leaf format xattr addition helper xfs_attr3_leaf_add_work() adjusts the block freemap in a couple places. The first update drops the size of the freemap that the caller had already selected to place the xattr name/value data. Before the function returns, it also checks whether the entries array has encroached on a freemap range by virtue of the new entry addition. This is necessary because the entries array grows from the start of the block (but end of the block header) towards the end of the block while the name/value data grows from the end of the block in the opposite direction. If the associated freemap is already empty, however, size is zero and the subtraction underflows the field and causes corruption.
This is reproduced rarely by generic/070. The observed behavior is that a smaller sized freemap is aligned to the end of the entries list, several subsequent xattr additions land in larger freemaps and the entries list expands into the smaller freemap until it is fully consumed and then underflows. Note that it is not otherwise a corruption for the entries array to consume an empty freemap because the nameval list (i.e. the firstused pointer in the xattr header) starts beyond the end of the corrupted freemap.
Update the freemap size modification to account for the fact that the freemap entry can be empty and thus stale.
--- fs/xfs/libxfs/xfs_attr_leaf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/xfs/libxfs/xfs_attr_leaf.c +3 -1
@@ -1451,7 +1451,9 @@ xfs_attr3_leaf_add_work(for (i =0 ; i <XFS_ATTR_LEAF_MAPSIZE ; i++) {if (ichdr->freemap[i].base == tmp) { ichdr->freemap[i].base +=sizeof (xfs_attr_leaf_entry_t); - ichdr->freemap[i].size -=sizeof (xfs_attr_leaf_entry_t); + ichdr->freemap[i].size -= +min_t (uint16_t, ichdr->freemap[i].size, +sizeof (xfs_attr_leaf_entry_t)); } } ichdr->usedbytes +=xfs_attr_leaf_entsize (leaf, args->index);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 50/388 RDMA/iw_cgxb4: Fix an error handling path in c4iw_connect()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 9067f2f0b41d7e817fc8c5259bab1f17512b0147 ]
We should jump to fail3 in order to undo the 'xa_insert_irq()' call.
--- drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/cxgb4/cm.c +2 -2
@@ -3382,7 +3382,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)if (raddr->sin_addr.s_addr ==htonl (INADDR_ANY )) { err =pick_local_ipaddrs (dev, cm_id);if (err) - goto fail2; + goto fail3; }/* find a route */
@@ -3404,7 +3404,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)if (ipv6_addr_type (&raddr6->sin6_addr) ==IPV6_ADDR_ANY ) { err =pick_local_ip6addrs (dev, cm_id);if (err) - goto fail2; + goto fail3; }/* find a route */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 51/388 ubi: Fix producing anchor PEBs
In reply to Greg Kroah-HartmanFrom: Sascha Hauer <[email protected]>
[ Upstream commit f9c34bb529975fe9f85b870a80c53a83a3c5a182 ]
When a new fastmap is about to be written UBI must make sure it has a free block for a fastmap anchor available. For this ubi_update_fastmap() calls ubi_ensure_anchor_pebs(). This stopped working with 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()"), with this commit the wear leveling code is blocked and can no longer produce free PEBs. UBI then more often than not falls back to write the new fastmap anchor to the same block it was already on which means the same erase block gets erased during each fastmap write and wears out quite fast.
As the locking prevents us from producing the anchor PEB when we actually need it, this patch changes the strategy for creating the anchor PEB. We no longer create it on demand right before we want to write a fastmap, but instead we create an anchor PEB right after we have written a fastmap. This gives us enough time to produce a new anchor PEB before it is needed. To make sure we have an anchor PEB for the very first fastmap write we call ubi_ensure_anchor_pebs() during initialisation as well.
--- drivers/mtd/ubi/fastmap-wl.c | 31 ++++++++++++++++++------------- drivers/mtd/ubi/fastmap.c | 14 +++++--------- drivers/mtd/ubi/ubi.h | 6 ++++-- drivers/mtd/ubi/wl.c | 32 ++++++++++++++------------------ drivers/mtd/ubi/wl.h | 1 - 5 files changed, 41 insertions(+), 43 deletions(-)
drivers/mtd/ubi/fastmap-wl.c +18 -13
@@ -57,18 +57,6 @@ static void return_unused_pool_pebs(struct ubi_device *ubi, } } -static int anchor_pebs_available (struct rb_root *root) -{ -struct rb_node *p; -struct ubi_wl_entry *e; - -ubi_rb_for_each_entry (p, e, root, u.rb) -if (e->pnum <UBI_FM_MAX_START ) -return 1 ; - -return 0 ; -} -/** * ubi_wl_get_fm_peb - find a physical erase block with a given maximal number. * @ubi: UBI device description object
@@ -277,8 +265,26 @@ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi)int ubi_ensure_anchor_pebs (struct ubi_device *ubi) {struct ubi_work *wrk; +struct ubi_wl_entry *anchor;spin_lock (&ubi->wl_lock); + +/* Do we already have an anchor? */ +if (ubi->fm_anchor) { +spin_unlock (&ubi->wl_lock); +return 0 ; + } + +/* See if we can find an anchor PEB on the list of free PEBs */ + anchor =ubi_wl_get_fm_peb (ubi,1 ); +if (anchor) { + ubi->fm_anchor = anchor; +spin_unlock (&ubi->wl_lock); +return 0 ; + } + +/* No luck, trigger wear leveling to produce a new anchor PEB */ + ubi->fm_do_produce_anchor =1 ;if (ubi->wl_scheduled) {spin_unlock (&ubi->wl_lock);return 0 ;
@@ -294,7 +300,6 @@ int ubi_ensure_anchor_pebs(struct ubi_device *ubi)return -ENOMEM ; } - wrk->anchor =1 ; wrk->func = &wear_leveling_worker;__schedule_ubi_work (ubi, wrk);return 0 ;
drivers/mtd/ubi/fastmap.c +5 -9
@@ -1543,14 +1543,6 @@ int ubi_update_fastmap(struct ubi_device *ubi)return 0 ; } - ret =ubi_ensure_anchor_pebs (ubi); -if (ret) { -up_write (&ubi->fm_eba_sem); -up_write (&ubi->work_sem); -up_write (&ubi->fm_protect); -return ret; - } - new_fm =kzalloc (sizeof (*new_fm),GFP_KERNEL );if (!new_fm) {up_write (&ubi->fm_eba_sem);
@@ -1621,7 +1613,8 @@ int ubi_update_fastmap(struct ubi_device *ubi) }spin_lock (&ubi->wl_lock); - tmp_e =ubi_wl_get_fm_peb (ubi,1 ); + tmp_e = ubi->fm_anchor; + ubi->fm_anchor =NULL ;spin_unlock (&ubi->wl_lock);if (old_fm) {
@@ -1673,6 +1666,9 @@ out_unlock:up_write (&ubi->work_sem);up_write (&ubi->fm_protect);kfree (old_fm); + +ubi_ensure_anchor_pebs (ubi); +return ret; err:
drivers/mtd/ubi/ubi.h +4 -2
@@ -491,6 +491,8 @@ struct ubi_debug_info {* @fm_work: fastmap work queue * @fm_work_scheduled: non-zero if fastmap work was scheduled * @fast_attach: non-zero if UBI was attached by fastmap +* @fm_anchor: The next anchor PEB to use for fastmap +* @fm_do_produce_anchor: If true produce an anchor PEB in wl * * @used: RB-tree of used physical eraseblocks * @erroneous: RB-tree of erroneous used physical eraseblocks
@@ -599,6 +601,8 @@ struct ubi_device {struct work_struct fm_work;int fm_work_scheduled;int fast_attach; +struct ubi_wl_entry *fm_anchor; +int fm_do_produce_anchor;/* Wear-leveling sub-system's stuff */ struct rb_root used;
@@ -789,7 +793,6 @@ struct ubi_attach_info {* @vol_id: the volume ID on which this erasure is being performed * @lnum: the logical eraseblock number * @torture: if the physical eraseblock has to be tortured -* @anchor: produce a anchor PEB to by used by fastmap * * The @func pointer points to the worker function. If the @shutdown argument is * not zero, the worker has to free the resources and exit immediately as the
@@ -805,7 +808,6 @@ struct ubi_work {int vol_id;int lnum;int torture; -int anchor; };#include "debug.h"
drivers/mtd/ubi/wl.c +14 -18
@@ -339,13 +339,6 @@ static struct ubi_wl_entry *find_wl_entry(struct ubi_device *ubi, } } -/* If no fastmap has been written and this WL entry can be used -* as anchor PEB, hold it back and return the second best WL entry -* such that fastmap can use the anchor PEB later. */ -if (prev_e && !ubi->fm_disabled && - !ubi->fm && e->pnum <UBI_FM_MAX_START ) -return prev_e; -return e; }
@@ -656,9 +649,6 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, {int err, scrubbing =0 , torture =0 , protect =0 , erroneous =0 ;int erase =0 , keep =0 , vol_id =-1 , lnum =-1 ; -#ifdef CONFIG_MTD_UBI_FASTMAP -int anchor = wrk->anchor; -#endif struct ubi_wl_entry *e1, *e2;struct ubi_vid_io_buf *vidb;struct ubi_vid_hdr *vid_hdr;
@@ -698,11 +688,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, }#ifdef CONFIG_MTD_UBI_FASTMAP -/* Check whether we need to produce an anchor PEB */ -if (!anchor) - anchor = !anchor_pebs_available (&ubi->free); - -if (anchor) { +if (ubi->fm_do_produce_anchor) { e1 =find_anchor_wl_entry (&ubi->used);if (!e1) goto out_cancel;
@@ -719,6 +705,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,self_check_in_wl_tree (ubi, e1, &ubi->used);rb_erase (&e1->u.rb, &ubi->used);dbg_wl ("anchor-move PEB %d to PEB %d" , e1->pnum, e2->pnum); + ubi->fm_do_produce_anchor = 0; }else if (!ubi->scrub.rb_node) {#else if (!ubi->scrub.rb_node) {
@@ -1051,7 +1038,6 @@ static int ensure_wear_leveling(struct ubi_device *ubi, int nested) goto out_cancel; } - wrk->anchor =0 ; wrk->func = &wear_leveling_worker;if (nested)__schedule_ubi_work (ubi, wrk);
@@ -1093,8 +1079,15 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk) err =sync_erase (ubi, e, wl_wrk->torture);if (!err) {spin_lock (&ubi->wl_lock); -wl_tree_add (e, &ubi->free); - ubi->free_count++; + +if (!ubi->fm_anchor && e->pnum <UBI_FM_MAX_START ) { + ubi->fm_anchor = e; + ubi->fm_do_produce_anchor =0 ; + }else { +wl_tree_add (e, &ubi->free); + ubi->free_count++; + } +spin_unlock (&ubi->wl_lock);/*
@@ -1882,6 +1875,9 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)if (err) goto out_free; +#ifdef CONFIG_MTD_UBI_FASTMAP +ubi_ensure_anchor_pebs (ubi); +#endif return 0 ; out_free:
drivers/mtd/ubi/wl.h +0 -1
@@ -2,7 +2,6 @@#ifndef UBI_WL_H #define UBI_WL_H #ifdef CONFIG_MTD_UBI_FASTMAP -static int anchor_pebs_available (struct rb_root *root);static void update_fastmap_work_fn (struct work_struct *wrk);static struct ubi_wl_entry *find_anchor_wl_entry (struct rb_root *root);static struct ubi_wl_entry *get_peb_for_wl (struct ubi_device *ubi);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 52/388 mmc: core: Fix size overflow for mmc partitions
In reply to Greg Kroah-HartmanFrom: Bradley Bolen <[email protected]>
[ Upstream commit f3d7c2292d104519195fdb11192daec13229c219 ]
With large eMMC cards, it is possible to create general purpose partitions that are bigger than 4GB. The size member of the mmc_part struct is only an unsigned int which overflows for gp partitions larger than 4GB. Change this to a u64 to handle the overflow.
--- drivers/mmc/core/mmc.c | 9 ++++----- include/linux/mmc/card.h | 2 +- 2 files changed, 5 insertions(+), 6 deletions(-)
drivers/mmc/core/mmc.c +4 -5
@@ -297,7 +297,7 @@ static void mmc_manage_enhanced_area(struct mmc_card *card, u8 *ext_csd) } } -static void mmc_part_add (struct mmc_card *card,unsigned int size, +static void mmc_part_add (struct mmc_card *card,u64 size,unsigned int part_cfg,char *name,int idx,bool ro,int area_type) {
@@ -313,7 +313,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd) {int idx;u8 hc_erase_grp_sz, hc_wp_grp_sz; -unsigned int part_size; +u64 part_size;/* * General purpose partition feature support --
@@ -343,8 +343,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd) (ext_csd[EXT_CSD_GP_SIZE_MULT + idx *3 +1 ] <<8 ) + ext_csd[EXT_CSD_GP_SIZE_MULT + idx *3 ]; - part_size *= (size_t )(hc_erase_grp_sz * - hc_wp_grp_sz); + part_size *= (hc_erase_grp_sz * hc_wp_grp_sz); mmc_part_add(card, part_size << 19, EXT_CSD_PART_CONFIG_ACC_GP0 + idx, "gp%d", idx, false,
@@ -362,7 +361,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd)static int mmc_decode_ext_csd (struct mmc_card *card,u8 *ext_csd) {int err =0 , idx; -unsigned int part_size; +u64 part_size;struct device_node *np;bool broken_hpi = false;
include/linux/mmc/card.h +1 -1
@@ -226,7 +226,7 @@ struct mmc_queue_req;* MMC Physical partitions */ struct mmc_part { -unsigned int size;/* partition size (in bytes) */ +u64 size;/* partition size (in bytes) */ unsigned int part_cfg;/* partition type */ char name[MAX_MMC_PART_NAME_LEN ];bool force_ro;/* to make boot parts RO by default */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 53/388 gfs2: clean up iopen glock mess in gfs2_create_inode
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit 2c47c1be51fbded1f7baa2ceaed90f97932f79be ]
Before this patch, gfs2_create_inode had a use-after-free for the iopen glock in some error paths because it did this:
gfs2_glock_put(io_gl); fail_gunlock2: if (io_gl) clear_bit(GLF_INODE_CREATING, &io_gl->gl_flags);
In some cases, the io_gl was used for create and only had one reference, so the glock might be freed before the clear_bit(). This patch tries to straighten it out by only jumping to the error paths where iopen is properly set, and moving the gfs2_glock_put after the clear_bit.
--- fs/gfs2/inode.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
fs/gfs2/inode.c +7 -6
@@ -712,7 +712,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, error =gfs2_trans_begin (sdp, blocks,0 );if (error) - goto fail_gunlock2; + goto fail_free_inode;if (blocks >1 ) { ip->i_eattr = ip->i_no_addr +1 ;
@@ -723,7 +723,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, error =gfs2_glock_get (sdp, ip->i_no_addr, &gfs2_iopen_glops,CREATE , &io_gl);if (error) - goto fail_gunlock2; + goto fail_free_inode;BUG_ON (test_and_set_bit (GLF_INODE_CREATING , &io_gl->gl_flags));
@@ -732,7 +732,6 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, goto fail_gunlock2;glock_set_object (ip->i_iopen_gh.gh_gl, ip); -gfs2_glock_put (io_gl);gfs2_set_iop (inode);insert_inode_hash (inode);
@@ -765,6 +764,8 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,mark_inode_dirty (inode);d_instantiate (dentry, inode); +/* After instantiate, errors should result in evict which will destroy +* both inode and iopen glocks properly. */ if (file) { file->f_mode |=FMODE_CREATED ; error =finish_open (file, dentry, gfs2_open_common);
@@ -772,15 +773,15 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,gfs2_glock_dq_uninit (ghs);gfs2_glock_dq_uninit (ghs +1 );clear_bit (GLF_INODE_CREATING , &io_gl->gl_flags); +gfs2_glock_put (io_gl);return error; fail_gunlock3:glock_clear_object (io_gl, ip);gfs2_glock_dq_uninit (&ip->i_iopen_gh); -gfs2_glock_put (io_gl); fail_gunlock2: -if (io_gl) -clear_bit (GLF_INODE_CREATING , &io_gl->gl_flags); +clear_bit (GLF_INODE_CREATING , &io_gl->gl_flags); +gfs2_glock_put (io_gl); fail_free_inode:if (ip->i_gl) {glock_clear_object (ip->i_gl, ip);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 54/388 scsi: pm80xx: Cleanup command when a reset times out
In reply to Greg Kroah-HartmanFrom: peter chang <[email protected]>
[ Upstream commit 51c1c5f6ed64c2b65a8cf89dac136273d25ca540 ]
Added the fix so the if driver properly sent the abort it tries to remove it from the firmware's list of outstanding commands regardless of the abort status. This means that the task gets freed 'now' rather than possibly getting freed later when the scsi layer thinks it's leaked but still valid.
--- drivers/scsi/pm8001/pm8001_sas.c | 50 +++++++++++++++++++++++--------- 1 file changed, 37 insertions(+), 13 deletions(-)
drivers/scsi/pm8001/pm8001_sas.c +37 -13
@@ -1202,8 +1202,8 @@ int pm8001_abort_task(struct sas_task *task) pm8001_dev = dev->lldd_dev; pm8001_ha =pm8001_find_ha_by_dev (dev); phy_id = pm8001_dev->attached_phy; - rc =pm8001_find_tag (task, &tag); -if (rc ==0 ) { + ret =pm8001_find_tag (task, &tag); +if (ret ==0 ) {pm8001_printk ("no tag for task:%p\n" , task);return TMF_RESP_FUNC_FAILED ; }
@@ -1241,26 +1241,50 @@ int pm8001_abort_task(struct sas_task *task)/* 2. Send Phy Control Hard Reset */ reinit_completion (&completion); + phy->port_reset_status =PORT_RESET_TMO ; phy->reset_success = false; phy->enable_completion = &completion; phy->reset_completion = &completion_reset; ret =PM8001_CHIP_DISP ->phy_ctl_req (pm8001_ha, phy_id,PHY_HARD_RESET ); -if (ret) - goto out; -PM8001_MSG_DBG (pm8001_ha, -pm8001_printk ("Waiting for local phy ctl\n" )); -wait_for_completion (&completion); -if (!phy->reset_success) +if (ret) { + phy->enable_completion =NULL ; + phy->reset_completion =NULL ; goto out; + } -/* 3. Wait for Port Reset complete / Port reset TMO */ +/* In the case of the reset timeout/fail we still +* abort the command at the firmware. The assumption +* here is that the drive is off doing something so +* that it's not processing requests, and we want to +* avoid getting a completion for this and either +* leaking the task in libsas or losing the race and +* getting a double free. +*/ PM8001_MSG_DBG (pm8001_ha, +pm8001_printk ("Waiting for local phy ctl\n" )); + ret =wait_for_completion_timeout (&completion, +PM8001_TASK_TIMEOUT *HZ ); +if (!ret || !phy->reset_success) { + phy->enable_completion =NULL ; + phy->reset_completion =NULL ; + }else { +/* 3. Wait for Port Reset complete or +* Port reset TMO +*/ +PM8001_MSG_DBG (pm8001_ha,pm8001_printk ("Waiting for Port reset\n" )); -wait_for_completion (&completion_reset); -if (phy->port_reset_status) { -pm8001_dev_gone_notify (dev); - goto out; + ret =wait_for_completion_timeout ( + &completion_reset, +PM8001_TASK_TIMEOUT *HZ ); +if (!ret) + phy->reset_completion =NULL ; +WARN_ON (phy->port_reset_status == +PORT_RESET_TMO ); +if (phy->port_reset_status ==PORT_RESET_TMO ) { +pm8001_dev_gone_notify (dev); + goto out; + } }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 55/388 mt76: do not use devm API for led classdev
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 36f7e2b2bb1de86f0072cd49ca93d82b9e8fd894 ]
With the devm API, the unregister happens after the device cleanup is done, after which the struct mt76_dev which contains the led_cdev has already been freed. This leads to a use-after-free bug that can crash the system.
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mac80211.c +10 -1
@@ -105,7 +105,15 @@ static int mt76_led_init(struct mt76_dev *dev) dev->led_al =of_property_read_bool (np,"led-active-low" ); } -return devm_led_classdev_register (dev->dev, &dev->led_cdev); +return led_classdev_register (dev->dev, &dev->led_cdev); +} + +static void mt76_led_cleanup (struct mt76_dev *dev) +{ +if (!dev->led_cdev.brightness_set && !dev->led_cdev.blink_set) +return ; + +led_classdev_unregister (&dev->led_cdev); } static void mt76_init_stream_cap(struct mt76_dev *dev,
@@ -360,6 +368,7 @@ void mt76_unregister_device(struct mt76_dev *dev) {struct ieee80211_hw *hw = dev->hw; +mt76_led_cleanup (dev);mt76_tx_status_check (dev,NULL , true);ieee80211_unregister_hw (hw); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 56/388 mt76: add missing locking around ampdu action
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 1a817fa73c3b27a593aadf0029de24db1bbc1a3e ]
This is needed primarily to avoid races in dealing with rx aggregation related data structures
--- drivers/net/wireless/mediatek/mt76/mt7603/main.c | 2 ++ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 2 ++ drivers/net/wireless/mediatek/mt76/mt76x02_util.c | 2 ++ 3 files changed, 6 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7603/main.c +2 -0
@@ -561,6 +561,7 @@ mt7603_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, mtxq = (struct mt76_txq *)txq->drv_priv; +mutex_lock (&dev->mt76.mutex);switch (action) {case IEEE80211_AMPDU_RX_START : mt76_rx_aggr_start(&dev->mt76, &msta->wcid, tid, ssn,
@@ -590,6 +591,7 @@ mt7603_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,ieee80211_stop_tx_ba_cb_irqsafe (vif, sta->addr, tid);break ; } +mutex_unlock (&dev->mt76.mutex);return 0 ; }
drivers/net/wireless/mediatek/mt76/mt7615/main.c +2 -0
@@ -455,6 +455,7 @@ mt7615_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, mtxq = (struct mt76_txq *)txq->drv_priv; +mutex_lock (&dev->mt76.mutex);switch (action) {case IEEE80211_AMPDU_RX_START : mt76_rx_aggr_start(&dev->mt76, &msta->wcid, tid, ssn,
@@ -485,6 +486,7 @@ mt7615_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,ieee80211_stop_tx_ba_cb_irqsafe (vif, sta->addr, tid);break ; } +mutex_unlock (&dev->mt76.mutex);return 0 ; }
drivers/net/wireless/mediatek/mt76/mt76x02_util.c +2 -0
@@ -371,6 +371,7 @@ int mt76x02_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, mtxq = (struct mt76_txq *)txq->drv_priv; +mutex_lock (&dev->mt76.mutex);switch (action) {case IEEE80211_AMPDU_RX_START : mt76_rx_aggr_start(&dev->mt76, &msta->wcid, tid,
@@ -400,6 +401,7 @@ int mt76x02_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,ieee80211_stop_tx_ba_cb_irqsafe (vif, sta->addr, tid);break ; } +mutex_unlock (&dev->mt76.mutex);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 57/388 debugfs: Fix !DEBUG_FS debugfs_create_automount
In reply to Greg Kroah-HartmanFrom: Kusanagi Kouichi <[email protected]>
[ Upstream commit 4250b047039d324e0ff65267c8beb5bad5052a86 ]
If DEBUG_FS=n, compile fails with the following error:
kernel/trace/trace.c: In function 'tracing_init_dentry':kernel/trace/trace.c:8658:9: error: passing argument 3 of 'debugfs_create_automount' from incompatible pointer type [-Werror=incompatible-pointer-types]
8658 | trace_automount, NULL);
| ^~~~~~~~~~~~~~~
| |
| struct vfsmount * (*)(struct dentry *, void *)
In file included from kernel/trace/trace.c:24:
./include/linux/debugfs.h:206:25: note: expected 'struct vfsmount * (*)(void *)' but argument is of type 'struct vfsmount * (*)(struct dentry *, void *)'
206 | struct vfsmount *(*f)(void *),
| ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~--- include/linux/debugfs.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
include/linux/debugfs.h +3 -2
@@ -54,6 +54,8 @@ static const struct file_operations __fops = { \ .llseek = no_llseek, \ } +typedef struct vfsmount *(*debugfs_automount_t )(struct dentry *,void *); +#if defined(CONFIG_DEBUG_FS )struct dentry *debugfs_lookup (const char *name,struct dentry *parent);
@@ -75,7 +77,6 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent);struct dentry *debugfs_create_symlink (const char *name,struct dentry *parent,const char *dest); -typedef struct vfsmount *(*debugfs_automount_t )(struct dentry *,void *); struct dentry *debugfs_create_automount(const char *name, struct dentry *parent, debugfs_automount_t f,
@@ -203,7 +204,7 @@ static inline struct dentry *debugfs_create_symlink(const char *name,static inline struct dentry *debugfs_create_automount (const char *name,struct dentry *parent, -struct vfsmount *(*f)(void *), +debugfs_automount_t f,void *data) {return ERR_PTR (-ENODEV );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 58/388 SUNRPC: Capture completion of all RPC tasks
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit a264abad51d8ecb7954a2f6d9f1885b38daffc74 ]
RPC tasks on the backchannel never invoke xprt_complete_rqst(), so there is no way to report their tk_status at completion. Also, any RPC task that exits via rpc_exit_task() before it is replied to will also disappear without a trace.
Introduce a trace point that is symmetrical with rpc_task_begin that captures the termination status of each RPC task.
Sample trace output for callback requests initiated on the server:
kworker/u8:12-448 [003] 127.025240: rpc_task_end: task:50@3 flags=ASYNC|DYNAMIC|SOFT|SOFTCONN|SENT runstate=RUNNING|ACTIVE status=0 action=rpc_exit_task kworker/u8:12-448 [002] 127.567310: rpc_task_end: task:51@3 flags=ASYNC|DYNAMIC|SOFT|SOFTCONN|SENT runstate=RUNNING|ACTIVE status=0 action=rpc_exit_task kworker/u8:12-448 [001] 130.506817: rpc_task_end: task:52@3 flags=ASYNC|DYNAMIC|SOFT|SOFTCONN|SENT runstate=RUNNING|ACTIVE status=0 action=rpc_exit_task
Odd, though, that I never see trace_rpc_task_complete, either in the forward or backchannel. Should it be removed?
--- include/trace/events/sunrpc.h | 1 + net/sunrpc/sched.c | 1 + 2 files changed, 2 insertions(+)
include/trace/events/sunrpc.h +1 -0
@@ -165,6 +165,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,DEFINE_RPC_RUNNING_EVENT (begin);DEFINE_RPC_RUNNING_EVENT (run_action);DEFINE_RPC_RUNNING_EVENT (complete); +DEFINE_RPC_RUNNING_EVENT (end); DECLARE_EVENT_CLASS(rpc_task_queued,
net/sunrpc/sched.c +1 -0
@@ -824,6 +824,7 @@ rpc_reset_task_statistics(struct rpc_task *task)*/ void rpc_exit_task (struct rpc_task *task) { +trace_rpc_task_end (task, task->tk_action); task->tk_action =NULL ;if (task->tk_ops->rpc_count_stats) task->tk_ops->rpc_count_stats (task, task->tk_calldata);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 59/388 CIFS: Use common error handling code in smb2_ioctl_query_info()
In reply to Greg Kroah-HartmanFrom: Markus Elfring <[email protected]>
[ Upstream commit 2b1116bbe898aefdf584838448c6869f69851e0f ]
Move the same error code assignments so that such exception handling can be better reused at the end of this function.
This issue was detected by using the Coccinelle software.
--- fs/cifs/smb2ops.c | 45 +++++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 22 deletions(-)
fs/cifs/smb2ops.c +23 -22
@@ -1565,35 +1565,32 @@ smb2_ioctl_query_info(const unsigned int xid,if (le32_to_cpu (io_rsp->OutputCount) < qi.input_buffer_length) qi.input_buffer_length =le32_to_cpu (io_rsp->OutputCount);if (qi.input_buffer_length >0 && -le32_to_cpu (io_rsp->OutputOffset) + qi.input_buffer_length > rsp_iov[1 ].iov_len) { - rc = -EFAULT ; - goto iqinf_exit; - } -if (copy_to_user (&pqi->input_buffer_length, &qi.input_buffer_length, -sizeof (qi.input_buffer_length))) { - rc = -EFAULT ; - goto iqinf_exit; - } +le32_to_cpu (io_rsp->OutputOffset) + qi.input_buffer_length + > rsp_iov[1 ].iov_len) + goto e_fault; + +if (copy_to_user (&pqi->input_buffer_length, + &qi.input_buffer_length, +sizeof (qi.input_buffer_length))) + goto e_fault; +if (copy_to_user ((void __user *)pqi +sizeof (struct smb_query_info ), (const void *)io_rsp +le32_to_cpu (io_rsp->OutputOffset), - qi.input_buffer_length)) { - rc = -EFAULT ; - goto iqinf_exit; - } + qi.input_buffer_length)) + goto e_fault; }else { pqi = (struct smb_query_info __user *)arg; qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1 ].iov_base;if (le32_to_cpu (qi_rsp->OutputBufferLength) < qi.input_buffer_length) qi.input_buffer_length =le32_to_cpu (qi_rsp->OutputBufferLength); -if (copy_to_user (&pqi->input_buffer_length, &qi.input_buffer_length, -sizeof (qi.input_buffer_length))) { - rc = -EFAULT ; - goto iqinf_exit; - } -if (copy_to_user (pqi +1 , qi_rsp->Buffer, qi.input_buffer_length)) { - rc = -EFAULT ; - goto iqinf_exit; - } +if (copy_to_user (&pqi->input_buffer_length, + &qi.input_buffer_length, +sizeof (qi.input_buffer_length))) + goto e_fault; + +if (copy_to_user (pqi +1 , qi_rsp->Buffer, + qi.input_buffer_length)) + goto e_fault; } iqinf_exit:
@@ -1609,6 +1606,10 @@ smb2_ioctl_query_info(const unsigned int xid,free_rsp_buf (resp_buftype[1 ], rsp_iov[1 ].iov_base);free_rsp_buf (resp_buftype[2 ], rsp_iov[2 ].iov_base);return rc; + +e_fault: + rc = -EFAULT ; + goto iqinf_exit; } static ssize_t
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 60/388 CIFS: Properly process SMB3 lease breaks
In reply to Greg Kroah-HartmanFrom: Pavel Shilovsky <[email protected]>
[ Upstream commit 9bd4540836684013aaad6070a65d6fcdd9006625 ]
Currenly we doesn't assume that a server may break a lease from RWH to RW which causes us setting a wrong lease state on a file and thus mistakenly flushing data and byte-range locks and purging cached data on the client. This leads to performance degradation because subsequent IOs go directly to the server.
Fix this by propagating new lease state and epoch values to the oplock break handler through cifsFileInfo structure and removing the use of cifsInodeInfo flags for that. It allows to avoid some races of several lease/oplock breaks using those flags in parallel.
--- fs/cifs/cifsglob.h | 9 ++++++--- fs/cifs/file.c | 10 +++++++--- fs/cifs/misc.c | 17 +++-------------- fs/cifs/smb1ops.c | 8 +++----- fs/cifs/smb2misc.c | 32 +++++++------------------------- fs/cifs/smb2ops.c | 44 ++++++++++++++++++++++++++++++-------------- fs/cifs/smb2pdu.h | 2 +- 7 files changed, 57 insertions(+), 65 deletions(-)
fs/cifs/cifsglob.h +6 -3
@@ -268,8 +268,9 @@ struct smb_version_operations {int (*check_message)(char *,unsigned int ,struct TCP_Server_Info *);bool (*is_oplock_break)(char *,struct TCP_Server_Info *);int (*handle_cancelled_mid)(char *,struct TCP_Server_Info *); -void (*downgrade_oplock)(struct TCP_Server_Info *, -struct cifsInodeInfo *,bool ); +void (*downgrade_oplock)(struct TCP_Server_Info *server, +struct cifsInodeInfo *cinode,__u32 oplock, +unsigned int epoch,bool *purge_cache);/* process transaction2 response */ bool (*check_trans2)(struct mid_q_entry *,struct TCP_Server_Info *,char *,int );
@@ -1261,6 +1262,8 @@ struct cifsFileInfo {unsigned int f_flags; bool invalidHandle:1; /* file closed via session abend */ bool oplock_break_cancelled:1; +unsigned int oplock_epoch;/* epoch from the lease break */ +__u32 oplock_level;/* oplock/lease level from the lease break */ int count;spinlock_t file_info_lock;/* protects four flag/count fields above */ struct mutex fh_mutex;/* prevents reopen race after dead ses*/
@@ -1408,7 +1411,7 @@ struct cifsInodeInfo {unsigned int epoch;/* used to track lease state changes */ #define CIFS_INODE_PENDING_OPLOCK_BREAK (0)/* oplock break in progress */ #define CIFS_INODE_PENDING_WRITERS (1)/* Writes in progress */ -#define CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 (2)/* Downgrade oplock to L2 */ +#define CIFS_INODE_FLAG_UNUSED (2)/* Unused flag */ #define CIFS_INO_DELETE_PENDING (3)/* delete pending on server */ #define CIFS_INO_INVALID_MAPPING (4)/* pagecache is invalid */ #define CIFS_INO_LOCK (5)/* lock bit for synchronization */
fs/cifs/file.c +7 -3
@@ -4675,12 +4675,13 @@ void cifs_oplock_break(struct work_struct *work)struct cifs_tcon *tcon =tlink_tcon (cfile->tlink);struct TCP_Server_Info *server = tcon->ses->server;int rc =0 ; +bool purge_cache = false;wait_on_bit (&cinode->flags,CIFS_INODE_PENDING_WRITERS ,TASK_UNINTERRUPTIBLE ); - server->ops->downgrade_oplock (server, cinode, -test_bit (CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , &cinode->flags)); + server->ops->downgrade_oplock (server, cinode, cfile->oplock_level, + cfile->oplock_epoch, &purge_cache);if (!CIFS_CACHE_WRITE (cinode) &&CIFS_CACHE_READ (cinode) &&cifs_has_mand_locks (cinode)) {
@@ -4695,18 +4696,21 @@ void cifs_oplock_break(struct work_struct *work)else break_lease (inode,O_WRONLY ); rc =filemap_fdatawrite (inode->i_mapping); -if (!CIFS_CACHE_READ (cinode)) { +if (!CIFS_CACHE_READ (cinode) || purge_cache) { rc =filemap_fdatawait (inode->i_mapping);mapping_set_error (inode->i_mapping, rc);cifs_zap_mapping (inode); }cifs_dbg (FYI ,"Oplock flush inode %p rc %d\n" , inode, rc); +if (CIFS_CACHE_WRITE (cinode)) + goto oplock_break_ack; } rc =cifs_push_locks (cfile);if (rc)cifs_dbg (VFS ,"Push locks rc = %d\n" , rc); +oplock_break_ack:/* * releasing stale oplock after recent reconnect of smb session using * a now incorrect file handle is not a data integrity issue but do
fs/cifs/misc.c +3 -14
@@ -488,21 +488,10 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)set_bit (CIFS_INODE_PENDING_OPLOCK_BREAK , &pCifsInode->flags); -/* -* Set flag if the server downgrades the oplock -* to L2 else clear. -*/ -if (pSMB->OplockLevel) -set_bit ( -CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , - &pCifsInode->flags); -else -clear_bit ( -CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , - &pCifsInode->flags); - -cifs_queue_oplock_break (netfile); + netfile->oplock_epoch =0 ; + netfile->oplock_level = pSMB->OplockLevel; netfile->oplock_break_cancelled = false; +cifs_queue_oplock_break (netfile);spin_unlock (&tcon->open_file_lock);spin_unlock (&cifs_tcp_ses_lock);
fs/cifs/smb1ops.c +3 -5
@@ -369,12 +369,10 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)static void cifs_downgrade_oplock (struct TCP_Server_Info *server, -struct cifsInodeInfo *cinode,bool set_level2) +struct cifsInodeInfo *cinode,__u32 oplock, +unsigned int epoch,bool *purge_cache) { -if (set_level2) -cifs_set_oplock_level (cinode,OPLOCK_READ ); -else -cifs_set_oplock_level (cinode,0 ); +cifs_set_oplock_level (cinode, oplock); } static bool
fs/cifs/smb2misc.c +7 -25
@@ -550,7 +550,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp)cifs_dbg (FYI ,"found in the open list\n" );cifs_dbg (FYI ,"lease key match, lease break 0x%x\n" , -le32_to_cpu (rsp->NewLeaseState)); + lease_state);if (ack_req) cfile->oplock_break_cancelled = false;
@@ -559,17 +559,8 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp)set_bit (CIFS_INODE_PENDING_OPLOCK_BREAK , &cinode->flags); -/* -* Set or clear flags depending on the lease state being READ. -* HANDLE caching flag should be added when the client starts -* to defer closing remote file handles with HANDLE leases. -*/ -if (lease_state &SMB2_LEASE_READ_CACHING_HE ) -set_bit (CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , - &cinode->flags); -else -clear_bit (CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , - &cinode->flags); + cfile->oplock_epoch =le16_to_cpu (rsp->Epoch); + cfile->oplock_level = lease_state;cifs_queue_oplock_break (cfile);return true;
@@ -599,7 +590,7 @@ smb2_tcon_find_pending_open_lease(struct cifs_tcon *tcon,cifs_dbg (FYI ,"found in the pending open list\n" );cifs_dbg (FYI ,"lease key match, lease break 0x%x\n" , -le32_to_cpu (rsp->NewLeaseState)); + lease_state); open->oplock = lease_state; }
@@ -732,18 +723,9 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)set_bit (CIFS_INODE_PENDING_OPLOCK_BREAK , &cinode->flags); -/* -* Set flag if the server downgrades the oplock -* to L2 else clear. -*/ -if (rsp->OplockLevel) -set_bit ( -CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , - &cinode->flags); -else -clear_bit ( -CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 , - &cinode->flags); + cfile->oplock_epoch =0 ; + cfile->oplock_level = rsp->OplockLevel; +spin_unlock (&cfile->file_info_lock);cifs_queue_oplock_break (cfile);
fs/cifs/smb2ops.c +30 -14
73 lines not on this page · raw message
fs/cifs/smb2pdu.h +1 -1
@@ -1386,7 +1386,7 @@ struct smb2_oplock_break {struct smb2_lease_break {struct smb2_sync_hdr sync_hdr;__le16 StructureSize;/* Must be 44 */ -__le16 Reserved; +__le16 Epoch;__le32 Flags;__u8 LeaseKey[16 ];__le32 CurrentLeaseState;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 61/388 f2fs: stop GC when the victim becomes fully valid
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
[ Upstream commit 803e74be04b32f7785742dcabfc62116718fbb06 ]
We must stop GC, once the segment becomes fully valid. Otherwise, it can produce another dirty segments by moving valid blocks in the segment partially.
Ramon hit no free segment panic sometimes and saw this case happens when validating reliable file pinning feature.
--- fs/f2fs/gc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/f2fs/gc.c +8 -2
@@ -1012,8 +1012,14 @@ next_step:block_t start_bidx;nid_t nid =le32_to_cpu (entry->nid); -/* stop BG_GC if there is not enough free sections. */ -if (gc_type ==BG_GC &&has_not_enough_free_secs (sbi,0 ,0 )) +/* +* stop BG_GC if there is not enough free sections. +* Or, stop GC if the segment becomes fully valid caused by +* race condition along with SSR block allocation. +*/ +if ((gc_type ==BG_GC &&has_not_enough_free_secs (sbi,0 ,0 )) || +get_valid_blocks (sbi, segno, false) == + sbi->blocks_per_seg)return submitted;if (check_valid_map (sbi, segno, off) ==0 )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 62/388 ASoC: max98090: remove msleep in PLL unlocked workaround
In reply to Greg Kroah-HartmanFrom: Tzung-Bi Shih <[email protected]>
[ Upstream commit acb874a7c049ec49d8fc66c893170fb42c01bdf7 ]
It was observed Baytrail-based chromebooks could cause continuous PLL unlocked when using playback stream and capture stream simultaneously. Specifically, starting a capture stream after started a playback stream. As a result, the audio data could corrupt or turn completely silent.
As the datasheet suggested, the maximum PLL lock time should be 7 msec. The workaround resets the codec softly by toggling SHDN off and on if PLL failed to lock for 10 msec. Notably, there is no suggested hold time for SHDN off.
On Baytrail-based chromebooks, it would easily happen continuous PLL unlocked if there is a 10 msec delay between SHDN off and on. Removes the msleep().
--- sound/soc/codecs/max98090.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/soc/codecs/max98090.c +7 -1
@@ -2112,10 +2112,16 @@ static void max98090_pll_work(struct max98090_priv *max98090)dev_info_ratelimited (component->dev,"PLL unlocked\n" ); +/* +* As the datasheet suggested, the maximum PLL lock time should be +* 7 msec. The workaround resets the codec softly by toggling SHDN +* off and on if PLL failed to lock for 10 msec. Notably, there is +* no suggested hold time for SHDN off. +*/ +/* Toggle shutdown OFF then ON */ snd_soc_component_update_bits (component,M98090_REG_DEVICE_SHUTDOWN ,M98090_SHDNN_MASK ,0 ); -msleep (10 );snd_soc_component_update_bits (component,M98090_REG_DEVICE_SHUTDOWN ,M98090_SHDNN_MASK ,M98090_SHDNN_MASK );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 63/388 xtensa: fix system_call interaction with ptrace
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
[ Upstream commit 02ce94c229251555ac726ecfebe3458ef5905fa9 ]
Don't overwrite return value if system call was cancelled at entry by ptrace. Return status code from do_syscall_trace_enter so that pt_regs::syscall doesn't need to be changed to skip syscall.
--- arch/xtensa/kernel/entry.S | 4 ++-- arch/xtensa/kernel/ptrace.c | 18 ++++++++++++++++-- 2 files changed, 18 insertions(+), 4 deletions(-)
arch/xtensa/kernel/entry.S +2 -2
@@ -1897,6 +1897,7 @@ ENTRY(system_call) mov a6, a2 call4 do_syscall_trace_enter + beqz a6, .Lsyscall_exit l32i a7, a2, PT_SYSCALL 1:
@@ -1911,8 +1912,6 @@ ENTRY(system_call) addx4 a4, a7, a4 l32i a4, a4, 0 - movi a5, sys_ni_syscall; - beq a4, a5, 1f /* Load args: arg0 - arg5 are passed via regs. */
@@ -1932,6 +1931,7 @@ ENTRY(system_call) s32i a6, a2, PT_AREG2 bnez a3, 1f +.Lsyscall_exit: abi_ret(4) 1:
arch/xtensa/kernel/ptrace.c +16 -2
@@ -542,14 +542,28 @@ long arch_ptrace(struct task_struct *child, long request,return ret; } -void do_syscall_trace_enter (struct pt_regs *regs) +void do_syscall_trace_leave (struct pt_regs *regs); +int do_syscall_trace_enter (struct pt_regs *regs) { +if (regs->syscall ==NO_SYSCALL ) + regs->areg[2 ] = -ENOSYS ; +if (test_thread_flag (TIF_SYSCALL_TRACE ) && -tracehook_report_syscall_entry (regs)) +tracehook_report_syscall_entry (regs)) { + regs->areg[2 ] = -ENOSYS ; regs->syscall =NO_SYSCALL ; +return 0 ; + } + +if (regs->syscall ==NO_SYSCALL ) { +do_syscall_trace_leave (regs); +return 0 ; + }if (test_thread_flag (TIF_SYSCALL_TRACEPOINT ))trace_sys_enter (regs,syscall_get_nr (current, regs)); + +return 1 ; }void do_syscall_trace_leave (struct pt_regs *regs)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 64/388 s390: avoid misusing CALL_ON_STACK for task stack setup
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
[ Upstream commit 7bcaad1f9fac889f5fcd1a383acf7e00d006da41 ]
CALL_ON_STACK is intended to be used for temporary stack switching with potential return to the caller.
When CALL_ON_STACK is misused to switch from nodat stack to task stack back_chain information would later lead stack unwinder from task stack into (per cpu) nodat stack which is reused for other purposes. This would yield confusing unwinding result or errors.
To avoid that introduce CALL_ON_STACK_NORETURN to be used instead. It makes sure that back_chain is zeroed and unwinder finishes gracefully ending up at task pt_regs.
--- arch/s390/include/asm/stacktrace.h | 11 +++++++++++ arch/s390/kernel/setup.c | 9 +-------- arch/s390/kernel/smp.c | 2 +- 3 files changed, 13 insertions(+), 9 deletions(-)
arch/s390/include/asm/stacktrace.h +11 -0
@@ -111,4 +111,15 @@ struct stack_frame { r2; \ }) +#define CALL_ON_STACK_NORETURN (fn, stack) \ +({ \ + asm volatile( \ + " la 15,0(%[_stack])\n" \ + " xc %[_bc](8,15),%[_bc](15)\n" \ + " brasl 14,%[_fn]\n" \ + ::[_bc] "i" (offsetof(struct stack_frame, back_chain)), \ + [_stack] "a" (stack), [_fn] "X" (fn)); \ + BUG(); \ +}) +#endif /* _ASM_S390_STACKTRACE_H */
arch/s390/kernel/setup.c +1 -8
@@ -356,7 +356,6 @@ early_initcall(async_stack_realloc);void __init arch_call_rest_init (void ) { -struct stack_frame *frame;unsigned long stack; stack =stack_alloc ();
@@ -369,13 +368,7 @@ void __init arch_call_rest_init(void)set_task_stack_end_magic (current); stack +=STACK_INIT_OFFSET ; S390_lowcore.kernel_stack = stack; - frame = (struct stack_frame *) stack; -memset (frame,0 ,sizeof (*frame)); -/* Branch to rest_init on the new stack, never returns */ - asmvolatile ( -" la 15,0(%[_frame])\n" -" jg rest_init\n" - : : [_frame]"a" (frame)); +CALL_ON_STACK_NORETURN (rest_init, stack); }static void __init setup_lowcore_dat_off (void )
arch/s390/kernel/smp.c +1 -1
@@ -878,7 +878,7 @@ static void __no_sanitize_address smp_start_secondary(void *cpuvoid) S390_lowcore.restart_source =-1UL ;__ctl_load (S390_lowcore.cregs_save_area,0 ,15 );__load_psw_mask (PSW_KERNEL_BITS |PSW_MASK_DAT ); -CALL_ON_STACK (smp_init_secondary, S390_lowcore.kernel_stack,0 ); +CALL_ON_STACK_NORETURN (smp_init_secondary, S390_lowcore.kernel_stack); }/* Upping and downing of CPUs */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 65/388 xfs: fix realtime file data space leak
In reply to Greg Kroah-HartmanFrom: Omar Sandoval <[email protected]>
[ Upstream commit 0c4da70c83d41a8461fdf50a3f7b292ecb04e378 ]
Realtime files in XFS allocate extents in rextsize units. However, the written/unwritten state of those extents is still tracked in blocksize units. Therefore, a realtime file can be split up into written and unwritten extents that are not necessarily aligned to the realtime extent size. __xfs_bunmapi() has some logic to handle these various corner cases. Consider how it handles the following case:
1. The last extent is unwritten.
2. The last extent is smaller than the realtime extent size.
3. startblock of the last extent is not aligned to the realtime extent size, but startblock + blockcount is.
In this case, __xfs_bunmapi() calls xfs_bmap_add_extent_unwritten_real() to set the second-to-last extent to unwritten. This should merge the last and second-to-last extents, so __xfs_bunmapi() moves on to the second-to-last extent.
However, if the size of the last and second-to-last extents combined is greater than MAXEXTLEN, xfs_bmap_add_extent_unwritten_real() does not merge the two extents. When that happens, __xfs_bunmapi() skips past the last extent without unmapping it, thus leaking the space.
Fix it by only unwriting the minimum amount needed to align the last extent to the realtime extent size, which is guaranteed to merge with the last extent.
--- fs/xfs/libxfs/xfs_bmap.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
fs/xfs/libxfs/xfs_bmap.c +14 -11
@@ -5376,16 +5376,17 @@ __xfs_bunmapi( }div_u64_rem (del.br_startblock, mp->m_sb.sb_rextsize, &mod);if (mod) { +xfs_extlen_t off = mp->m_sb.sb_rextsize - mod; +/* * Realtime extent is lined up at the end but not * at the front. We'll get rid of full extents if * we can. */ - mod = mp->m_sb.sb_rextsize - mod; -if (del.br_blockcount > mod) { - del.br_blockcount -= mod; - del.br_startoff += mod; - del.br_startblock += mod; +if (del.br_blockcount > off) { + del.br_blockcount -= off; + del.br_startoff += off; + del.br_startblock += off; }else if (del.br_startoff == start && (del.br_state ==XFS_EXT_UNWRITTEN || tp->t_blk_res ==0 )) {
@@ -5403,6 +5404,7 @@ __xfs_bunmapi(continue ; }else if (del.br_state ==XFS_EXT_UNWRITTEN ) {struct xfs_bmbt_irec prev; +xfs_fileoff_t unwrite_start;/* * This one is already unwritten.
@@ -5416,12 +5418,13 @@ __xfs_bunmapi(ASSERT (!isnullstartblock (prev.br_startblock));ASSERT (del.br_startblock == prev.br_startblock + prev.br_blockcount); -if (prev.br_startoff < start) { - mod = start - prev.br_startoff; - prev.br_blockcount -= mod; - prev.br_startblock += mod; - prev.br_startoff = start; - } + unwrite_start =max3 (start, + del.br_startoff - mod, + prev.br_startoff); + mod = unwrite_start - prev.br_startoff; + prev.br_startoff = unwrite_start; + prev.br_startblock += mod; + prev.br_blockcount -= mod; prev.br_state =XFS_EXT_UNWRITTEN ; error = xfs_bmap_add_extent_unwritten_real(tp, ip, whichfork, &icur, &cur,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 66/388 drm/amdgpu: fix calltrace during kmd unload(v3)
In reply to Greg Kroah-HartmanFrom: Monk Liu <[email protected]>
[ Upstream commit 82a829dc8c2bb03cc9b7e5beb1c5479aa3ba7831 ]
issue:
kernel would report a warning from a double unpin during the driver unloading on the CSB bo
why:
we unpin it during hw_fini, and there will be another unpin in sw_fini on CSB bo.
fix:
actually we don't need to pin/unpin it during hw_init/fini since it is created with kernel pinned, we only need to fullfill the CSB again during hw_init to prevent CSB/VRAM lost after S3
v2:get_csb in init_rlc so hw_init() will make CSIB content back even after reset or s3
v3:
use bo_create_kernel instead of bo_create_reserved for CSB otherwise the bo_free_kernel() on CSB is not aligned and would lead to its internal reserve pending there forever
take care of gfx7/8 as well
--- drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.c | 10 +---- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 58 +------------------------ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 40 +---------------- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 40 +---------------- 5 files changed, 6 insertions(+), 144 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.c +1 -9
@@ -124,13 +124,12 @@ int amdgpu_gfx_rlc_init_sr(struct amdgpu_device *adev, u32 dws)*/ int amdgpu_gfx_rlc_init_csb (struct amdgpu_device *adev) { -volatile u32 *dst_ptr;u32 dws;int r;/* allocate clear state block */ adev->gfx.rlc.clear_state_size = dws = adev->gfx.rlc.funcs->get_csb_size (adev); - r = amdgpu_bo_create_reserved(adev, dws * 4, PAGE_SIZE, + r = amdgpu_bo_create_kernel(adev, dws * 4, PAGE_SIZE, AMDGPU_GEM_DOMAIN_VRAM, &adev->gfx.rlc.clear_state_obj, &adev->gfx.rlc.clear_state_gpu_addr,
@@ -141,13 +140,6 @@ int amdgpu_gfx_rlc_init_csb(struct amdgpu_device *adev)return r; } -/* set up the cs buffer */ - dst_ptr = adev->gfx.rlc.cs_ptr; - adev->gfx.rlc.funcs->get_csb_buffer (adev, dst_ptr); -amdgpu_bo_kunmap (adev->gfx.rlc.clear_state_obj); -amdgpu_bo_unpin (adev->gfx.rlc.clear_state_obj); -amdgpu_bo_unreserve (adev->gfx.rlc.clear_state_obj); -return 0 ; }
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +1 -57
82 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +2 -0
@@ -4554,6 +4554,8 @@ static int gfx_v7_0_hw_init(void *handle)gfx_v7_0_constants_init (adev); +/* init CSB */ + adev->gfx.rlc.funcs->get_csb_buffer (adev, adev->gfx.rlc.cs_ptr);/* init rlc */ r = adev->gfx.rlc.funcs->resume (adev);if (r)
drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +1 -39
@@ -1321,39 +1321,6 @@ static int gfx_v8_0_rlc_init(struct amdgpu_device *adev)return 0 ; } -static int gfx_v8_0_csb_vram_pin (struct amdgpu_device *adev) -{ -int r; - - r =amdgpu_bo_reserve (adev->gfx.rlc.clear_state_obj, false); -if (unlikely (r !=0 )) -return r; - - r =amdgpu_bo_pin (adev->gfx.rlc.clear_state_obj, -AMDGPU_GEM_DOMAIN_VRAM ); -if (!r) - adev->gfx.rlc.clear_state_gpu_addr = -amdgpu_bo_gpu_offset (adev->gfx.rlc.clear_state_obj); - -amdgpu_bo_unreserve (adev->gfx.rlc.clear_state_obj); - -return r; -} - -static void gfx_v8_0_csb_vram_unpin (struct amdgpu_device *adev) -{ -int r; - -if (!adev->gfx.rlc.clear_state_obj) -return ; - - r =amdgpu_bo_reserve (adev->gfx.rlc.clear_state_obj, true); -if (likely (r ==0 )) { -amdgpu_bo_unpin (adev->gfx.rlc.clear_state_obj); -amdgpu_bo_unreserve (adev->gfx.rlc.clear_state_obj); - } -} -static void gfx_v8_0_mec_fini (struct amdgpu_device *adev) {amdgpu_bo_free_kernel (&adev->gfx.mec.hpd_eop_obj,NULL ,NULL );
@@ -3917,6 +3884,7 @@ static void gfx_v8_0_enable_gui_idle_interrupt(struct amdgpu_device *adev,static void gfx_v8_0_init_csb (struct amdgpu_device *adev) { + adev->gfx.rlc.funcs->get_csb_buffer (adev, adev->gfx.rlc.cs_ptr);/* csib */ WREG32 (mmRLC_CSIB_ADDR_HI, adev->gfx.rlc.clear_state_gpu_addr >>32 );
@@ -4837,10 +4805,6 @@ static int gfx_v8_0_hw_init(void *handle)gfx_v8_0_init_golden_registers (adev);gfx_v8_0_constants_init (adev); - r =gfx_v8_0_csb_vram_pin (adev); -if (r) -return r; - r = adev->gfx.rlc.funcs->resume (adev);if (r)return r;
@@ -4958,8 +4922,6 @@ static int gfx_v8_0_hw_fini(void *handle)pr_err ("rlc is busy, skip halt rlc\n" );amdgpu_gfx_rlc_exit_safe_mode (adev); -gfx_v8_0_csb_vram_unpin (adev); -return 0 ; }
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +1 -39
@@ -1675,39 +1675,6 @@ static int gfx_v9_0_rlc_init(struct amdgpu_device *adev)return 0 ; } -static int gfx_v9_0_csb_vram_pin (struct amdgpu_device *adev) -{ -int r; - - r =amdgpu_bo_reserve (adev->gfx.rlc.clear_state_obj, false); -if (unlikely (r !=0 )) -return r; - - r =amdgpu_bo_pin (adev->gfx.rlc.clear_state_obj, -AMDGPU_GEM_DOMAIN_VRAM ); -if (!r) - adev->gfx.rlc.clear_state_gpu_addr = -amdgpu_bo_gpu_offset (adev->gfx.rlc.clear_state_obj); - -amdgpu_bo_unreserve (adev->gfx.rlc.clear_state_obj); - -return r; -} - -static void gfx_v9_0_csb_vram_unpin (struct amdgpu_device *adev) -{ -int r; - -if (!adev->gfx.rlc.clear_state_obj) -return ; - - r =amdgpu_bo_reserve (adev->gfx.rlc.clear_state_obj, true); -if (likely (r ==0 )) { -amdgpu_bo_unpin (adev->gfx.rlc.clear_state_obj); -amdgpu_bo_unreserve (adev->gfx.rlc.clear_state_obj); - } -} -static void gfx_v9_0_mec_fini (struct amdgpu_device *adev) {amdgpu_bo_free_kernel (&adev->gfx.mec.hpd_eop_obj,NULL ,NULL );
@@ -2596,6 +2563,7 @@ static void gfx_v9_0_enable_gui_idle_interrupt(struct amdgpu_device *adev,static void gfx_v9_0_init_csb (struct amdgpu_device *adev) { + adev->gfx.rlc.funcs->get_csb_buffer (adev, adev->gfx.rlc.cs_ptr);/* csib */ WREG32_RLC (SOC15_REG_OFFSET (GC ,0 , mmRLC_CSIB_ADDR_HI), adev->gfx.rlc.clear_state_gpu_addr >>32 );
@@ -3888,10 +3856,6 @@ static int gfx_v9_0_hw_init(void *handle)gfx_v9_0_constants_init (adev); - r =gfx_v9_0_csb_vram_pin (adev); -if (r) -return r; - r = adev->gfx.rlc.funcs->resume (adev);if (r)return r;
@@ -3977,8 +3941,6 @@ static int gfx_v9_0_hw_fini(void *handle)gfx_v9_0_cp_enable (adev, false); adev->gfx.rlc.funcs->stop (adev); -gfx_v9_0_csb_vram_unpin (adev); -return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 67/388 arm64: insn: consistently handle exit text
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit ca2ef4ffabbef25644e02a98b0f48869f8be0375 ]
A kernel built with KASAN && FTRACE_WITH_REGS && !MODULES, produces a boot-time splat in the bowels of ftrace:
| [ 0.000000] ftrace: allocating 32281 entries in 127 pages | [ 0.000000] ------------[ cut here ]------------ | [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:2019 ftrace_bug+0x27c/0x328 | [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.4.0-rc3-00008-g7f08ae53a7e3 #13 | [ 0.000000] Hardware name: linux,dummy-virt (DT) | [ 0.000000] pstate: 60000085 (nZCv daIf -PAN -UAO) | [ 0.000000] pc : ftrace_bug+0x27c/0x328 | [ 0.000000] lr : ftrace_init+0x640/0x6cc | [ 0.000000] sp : ffffa000120e7e00 | [ 0.000000] x29: ffffa000120e7e00 x28: ffff00006ac01b10 | [ 0.000000] x27: ffff00006ac898c0 x26: dfffa00000000000 | [ 0.000000] x25: ffffa000120ef290 x24: ffffa0001216df40 | [ 0.000000] x23: 000000000000018d x22: ffffa0001244c700 | [ 0.000000] x21: ffffa00011bf393c x20: ffff00006ac898c0 | [ 0.000000] x19: 00000000ffffffff x18: 0000000000001584 | [ 0.000000] x17: 0000000000001540 x16: 0000000000000007 | [ 0.000000] x15: 0000000000000000 x14: ffffa00010432770 | [ 0.000000] x13: ffff940002483519 x12: 1ffff40002483518 | [ 0.000000] x11: 1ffff40002483518 x10: ffff940002483518 | [ 0.000000] x9 : dfffa00000000000 x8 : 0000000000000001 | [ 0.000000] x7 : ffff940002483519 x6 : ffffa0001241a8c0 | [ 0.000000] x5 : ffff940002483519 x4 : ffff940002483519 | [ 0.000000] x3 : ffffa00011780870 x2 : 0000000000000001 | [ 0.000000] x1 : 1fffe0000d591318 x0 : 0000000000000000 | [ 0.000000] Call trace: | [ 0.000000] ftrace_bug+0x27c/0x328 | [ 0.000000] ftrace_init+0x640/0x6cc | [ 0.000000] start_kernel+0x27c/0x654 | [ 0.000000] random: get_random_bytes called from print_oops_end_marker+0x30/0x60 with crng_init=0 | [ 0.000000] ---[ end trace 0000000000000000 ]--- | [ 0.000000] ftrace faulted on writing | [ 0.000000] [<ffffa00011bf393c>] _GLOBAL__sub_D_65535_0___tracepoint_initcall_level+0x4/0x28 | [ 0.000000] Initializing ftrace call sites | [ 0.000000] ftrace record flags: 0 | [ 0.000000] (0) | [ 0.000000] expected tramp: ffffa000100b3344
This is due to an unfortunate combination of several factors.
Building with KASAN results in the compiler generating anonymous functions to register/unregister global variables against the shadow memory. These functions are placed in .text.startup/.text.exit, and given mangled names like _GLOBAL__sub_{I,D}_65535_0_$OTHER_SYMBOL. The kernel linker script places these in .init.text and .exit.text respectively, which are both discarded at runtime as part of initmem.
Building with FTRACE_WITH_REGS uses -fpatchable-function-entry=2, which also instruments KASAN's anonymous functions. When these are discarded with the rest of initmem, ftrace removes dangling references to these call sites.
Building without MODULES implicitly disables STRICT_MODULE_RWX, and causes arm64's patch_map() function to treat any !core_kernel_text() symbol as something that can be modified in-place. As core_kernel_text() is only true for .text and .init.text, with the latter depending on system_state < SYSTEM_RUNNING, we'll treat .exit.text as something that can be patched in-place. However, .exit.text is mapped read-only.
Hence in this configuration the ftrace init code blows up while trying to patch one of the functions generated by KASAN.
We could try to filter out the call sites in .exit.text rather than initializing them, but this would be inconsistent with how we handle .init.text, and requires hooking into core bits of ftrace. The behaviour of patch_map() is also inconsistent today, so instead let's clean that up and have it consistently handle .exit.text.
This patch teaches patch_map() to handle .exit.text at init time, preventing the boot-time splat above. The flow of patch_map() is reworked to make the logic clearer and minimize redundant conditionality.
--- arch/arm64/include/asm/sections.h | 1 + arch/arm64/kernel/insn.c | 22 ++++++++++++++++++---- arch/arm64/kernel/vmlinux.lds.S | 3 +++ 3 files changed, 22 insertions(+), 4 deletions(-)
arch/arm64/include/asm/sections.h +1 -0
@@ -15,6 +15,7 @@ extern char __hyp_text_start[], __hyp_text_end[];extern char __idmap_text_start[], __idmap_text_end[];extern char __initdata_begin[], __initdata_end[];extern char __inittext_begin[], __inittext_end[]; +extern char __exittext_begin[], __exittext_end[];extern char __irqentry_text_start[], __irqentry_text_end[];extern char __mmuoff_data_start[], __mmuoff_data_end[];extern char __entry_tramp_text_start[], __entry_tramp_text_end[];
arch/arm64/kernel/insn.c +18 -4
@@ -21,6 +21,7 @@#include <asm/fixmap.h> #include <asm/insn.h> #include <asm/kprobes.h> +#include <asm/sections.h> #define AARCH64_INSN_SF_BIT BIT(31)#define AARCH64_INSN_N_BIT BIT(22)
@@ -78,16 +79,29 @@ bool aarch64_insn_is_branch_imm(u32 insn)static DEFINE_RAW_SPINLOCK (patch_lock); +static bool is_exit_text (unsigned long addr) +{ +/* discarded with init text/data */ +return system_state <SYSTEM_RUNNING && + addr >= (unsigned long )__exittext_begin && + addr < (unsigned long )__exittext_end; +} + +static bool is_image_text (unsigned long addr) +{ +return core_kernel_text (addr) ||is_exit_text (addr); +} +static void __kprobes *patch_map (void *addr,int fixmap) {unsigned long uintaddr = (uintptr_t ) addr; -bool module = !core_kernel_text (uintaddr); +bool image =is_image_text (uintaddr);struct page *page; -if (module &&IS_ENABLED (CONFIG_STRICT_MODULE_RWX )) - page =vmalloc_to_page (addr); -else if (!module) +if (image) page =phys_to_page (__pa_symbol (addr)); +else if (IS_ENABLED (CONFIG_STRICT_MODULE_RWX )) + page =vmalloc_to_page (addr);else return addr;
arch/arm64/kernel/vmlinux.lds.S +3 -0
@@ -170,9 +170,12 @@ SECTIONS __inittext_begin = .; INIT_TEXT_SECTION(8) + + __exittext_begin = .; .exit.text : { ARM_EXIT_KEEP(EXIT_TEXT) } + __exittext_end = .; . = ALIGN(4); .altinstructions : {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 68/388 selftests/bpf: De-flake test_tcpbpf
In reply to Greg Kroah-HartmanFrom: Stanislav Fomichev <[email protected]>
[ Upstream commit ef8c84effce3c7a0b8196fcda8f430c815ab511c ]
It looks like BPF program that handles BPF_SOCK_OPS_STATE_CB state can race with the bpf_map_lookup_elem("global_map"); I sometimes see the failures in this test and re-running helps.
Since we know that we expect the callback to be called 3 times (one time for listener socket, two times for both ends of the connection), let's export this number and add simple retry logic around that.
Also, let's make EXPECT_EQ() not return on failure, but continue evaluating all conditions; that should make potential debugging easier.
With this fix in place I don't observe the flakiness anymore.
--- .../selftests/bpf/progs/test_tcpbpf_kern.c | 1 + tools/testing/selftests/bpf/test_tcpbpf.h | 1 + .../testing/selftests/bpf/test_tcpbpf_user.c | 25 +++++++++++++------ 3 files changed, 20 insertions(+), 7 deletions(-)
tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c +1 -0
@@ -131,6 +131,7 @@ int bpf_testcb(struct bpf_sock_ops *skops) g.bytes_received = skops->bytes_received; g.bytes_acked = skops->bytes_acked; } + g.num_close_events++;bpf_map_update_elem (&global_map, &key, &g,BPF_ANY ); }
tools/testing/selftests/bpf/test_tcpbpf.h +1 -0
@@ -13,5 +13,6 @@ struct tcpbpf_globals {__u64 bytes_received;__u64 bytes_acked;__u32 num_listen; + __u32 num_close_events; };#endif
tools/testing/selftests/bpf/test_tcpbpf_user.c +18 -7
@@ -16,6 +16,9 @@#include "test_tcpbpf.h" +/* 3 comes from one listening socket + both ends of the connection */ +#define EXPECTED_CLOSE_EVENTS 3 +#define EXPECT_EQ (expected, actual, fmt) \ do { \ if ((expected) != (actual)) { \
@@ -23,13 +26,14 @@" Actual: %" fmt"\n" \" Expected: %" fmt"\n" , \ (actual), (expected)); \ - goto err; \ + ret--; \ } \ }while (0 ) int verify_result(const struct tcpbpf_globals *result) {__u32 expected_events; +int ret =0 ; expected_events = ((1 << BPF_SOCK_OPS_TIMEOUT_INIT) | (1 << BPF_SOCK_OPS_RWND_INIT) |
@@ -48,15 +52,15 @@ int verify_result(const struct tcpbpf_globals *result)EXPECT_EQ (0x80 , result->bad_cb_test_rv, PRIu32);EXPECT_EQ (0 , result->good_cb_test_rv, PRIu32);EXPECT_EQ (1 , result->num_listen, PRIu32); +EXPECT_EQ (EXPECTED_CLOSE_EVENTS , result->num_close_events, PRIu32); -return 0 ; -err: -return -1 ; +return ret; }int verify_sockopt_result (int sock_map_fd) {__u32 key =0 ; +int ret =0 ;int res;int rv;
@@ -69,9 +73,7 @@ int verify_sockopt_result(int sock_map_fd) rv =bpf_map_lookup_elem (sock_map_fd, &key, &res);EXPECT_EQ (0 , rv,"d" );EXPECT_EQ (1 , res,"d" ); -return 0 ; -err: -return -1 ; +return ret; } static int bpf_find_map(const char *test, struct bpf_object *obj,
@@ -96,6 +98,7 @@ int main(int argc, char **argv)int error =EXIT_FAILURE ;struct bpf_object *obj;int cg_fd =-1 ; +int retry =10 ;__u32 key =0 ;int rv;
@@ -134,12 +137,20 @@ int main(int argc, char **argv)if (sock_map_fd <0 ) goto err; +retry_lookup: rv =bpf_map_lookup_elem (map_fd, &key, &g);if (rv !=0 ) {printf ("FAILED: bpf_map_lookup_elem returns %d\n" , rv); goto err; } +if (g.num_close_events !=EXPECTED_CLOSE_EVENTS && retry--) { +printf ("Unexpected number of close events (%d), retrying!\n" , + g.num_close_events); +usleep (100 ); + goto retry_lookup; + } +if (verify_result (&g)) {printf ("FAILED: Wrong stats\n" ); goto err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 69/388 kernel/notifier.c: intercept duplicate registrations to avoid infinite loops
In reply to Greg Kroah-HartmanFrom: Xiaoming Ni <[email protected]>
[ Upstream commit 1a50cb80f219c44adb6265f5071b81fc3c1deced ]
Registering the same notifier to a hook repeatedly can cause the hook list to form a ring or lose other members of the list.
case1: An infinite loop in notifier_chain_register() can cause soft lockup
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_chain_register(&test_notifier_list, &test2);
case2: An infinite loop in notifier_chain_register() can cause soft lockup
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_call_chain(&test_notifier_list, 0, NULL);
case3: lose other hook test2
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_chain_register(&test_notifier_list, &test2);
atomic_notifier_chain_register(&test_notifier_list, &test1); case4: Unregister returns 0, but the hook is still in the linked list,
and it is not really registered. If you call notifier_call_chain after ko is unloaded, it will trigger oops.
If the system is configured with softlockup_panic and the same hook is repeatedly registered on the panic_notifier_list, it will cause a loop panic.
Add a check in notifier_chain_register(), intercepting duplicate registrations to avoid infinite loops
--- kernel/notifier.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/notifier.c +4 -1
@@ -23,7 +23,10 @@ static int notifier_chain_register(struct notifier_block **nl, struct notifier_block *n) {while ((*nl) !=NULL ) { -WARN_ONCE (((*nl) == n),"double register detected" ); +if (unlikely ((*nl) == n)) { +WARN (1 ,"double register detected" ); +return 0 ; + }if (n->priority > (*nl)->priority)break ; nl = &((*nl)->next);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 70/388 kernel/sys.c: avoid copying possible padding bytes in copy_to_user
In reply to Greg Kroah-HartmanFrom: Joe Perches <[email protected]>
[ Upstream commit 5e1aada08cd19ea652b2d32a250501d09b02ff2e ]
Initialization is not guaranteed to zero padding bytes so use an explicit memset instead to avoid leaking any kernel content in any possible padding bytes.
--- kernel/sys.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/sys.c +3 -1
@@ -1279,11 +1279,13 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name) SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) { -struct oldold_utsname tmp = {}; +struct oldold_utsname tmp;if (!name)return -EFAULT ; +memset (&tmp,0 ,sizeof (tmp)); +down_read (&uts_sem);memcpy (&tmp.sysname, &utsname ()->sysname, __OLD_UTS_LEN);memcpy (&tmp.nodename, &utsname ()->nodename, __OLD_UTS_LEN);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 71/388 KVM: arm/arm64: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy()
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit 0bda9498dd45280e334bfe88b815ebf519602cc3 ]
In kvm_vgic_dist_init() called from kvm_vgic_map_resources(), if dist->vgic_model is invalid, dist->spis will be freed without set dist->spis = NULL. And in vgicv2 resources clean up path, __kvm_vgic_destroy() will be called to free allocated resources. And dist->spis will be freed again in clean up chain because we forget to set dist->spis = NULL in kvm_vgic_dist_init() failed path. So double free would happen.
--- virt/kvm/arm/vgic/vgic-init.c | 1 + 1 file changed, 1 insertion(+)
virt/kvm/arm/vgic/vgic-init.c +1 -0
@@ -177,6 +177,7 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)break ;default :kfree (dist->spis); + dist->spis =NULL ;return -EINVAL ; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 72/388 module: Remove accidental change of module_enable_x()
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
[ Upstream commit af74262337faa65d5ac2944553437d3f5fb29123 ]
When pulling in Divya Indi's patch, I made a minor fix to remove unneeded braces. I commited my fix up via "git commit -a --amend". Unfortunately, I didn't realize I had some changes I was testing in the module code, and those changes were applied to Divya's patch as well.
This reverts the accidental updates to the module code.
--- kernel/module.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
kernel/module.c +1 -5
@@ -3753,6 +3753,7 @@ static int complete_formation(struct module *mod, struct load_info *info)module_enable_ro (mod, false);module_enable_nx (mod); +module_enable_x (mod);/* Mark state as coming so strong_try_module_get() ignores us, * but kallsyms etc. can see us. */
@@ -3775,11 +3776,6 @@ static int prepare_coming_module(struct module *mod)if (err)return err; -/* Make module executable after ftrace is enabled */ -mutex_lock (&module_mutex); -module_enable_x (mod); -mutex_unlock (&module_mutex); -blocking_notifier_call_chain (&module_notify_list,MODULE_STATE_COMING , mod);return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 73/388 xfs: fix log reservation overflows when allocating large rt extents
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit b1de6fc7520fe12949c070af0e8c0e4044cd3420 ]
Omar Sandoval reported that a 4G fallocate on the realtime device causes filesystem shutdowns due to a log reservation overflow that happens when we log the rtbitmap updates. Factor rtbitmap/rtsummary updates into the the tr_write and tr_itruncate log reservation calculation.
"The following reproducer results in a transaction log overrun warning for me:
mkfs.xfs -f -r rtdev=/dev/vdc -d rtinherit=1 -m reflink=0 /dev/vdb mount -o rtdev=/dev/vdc /dev/vdb /mnt
fallocate -l 4G /mnt/foo
--- fs/xfs/libxfs/xfs_trans_resv.c | 96 +++++++++++++++++++++++++++------- 1 file changed, 77 insertions(+), 19 deletions(-)
fs/xfs/libxfs/xfs_trans_resv.c +77 -19
@@ -196,6 +196,24 @@ xfs_calc_inode_chunk_res(return res; } +/* +* Per-extent log reservation for the btree changes involved in freeing or +* allocating a realtime extent. We have to be able to log as many rtbitmap +* blocks as needed to mark inuse MAXEXTLEN blocks' worth of realtime extents, +* as well as the realtime summary block. +*/ +unsigned int +xfs_rtalloc_log_count ( +struct xfs_mount *mp, +unsigned int num_ops) +{ +unsigned int blksz =XFS_FSB_TO_B (mp,1 ); +unsigned int rtbmp_bytes; + + rtbmp_bytes = (MAXEXTLEN / mp->m_sb.sb_rextsize) /NBBY ; +return (howmany (rtbmp_bytes, blksz) +1 ) * num_ops; +} +/* * Various log reservation values. *
@@ -218,13 +236,21 @@ xfs_calc_inode_chunk_res(/* * In a write transaction we can allocate a maximum of 2 -* extents. This gives: +* extents. This gives (t1): * the inode getting the new extents: inode size * the inode's bmap btree: max depth * block size * the agfs of the ags from which the extents are allocated: 2 * sector * the superblock free block counter: sector size * the allocation btrees: 2 exts * 2 trees * (2 * max depth - 1) * block size -* And the bmap_finish transaction can free bmap blocks in a join: +* Or, if we're writing to a realtime file (t2): +* the inode getting the new extents: inode size +* the inode's bmap btree: max depth * block size +* the agfs of the ags from which the extents are allocated: 2 * sector +* the superblock free block counter: sector size +* the realtime bitmap: ((MAXEXTLEN / rtextsize) / NBBY) bytes +* the realtime summary: 1 block +* the allocation btrees: 2 trees * (2 * max depth - 1) * block size +* And the bmap_finish transaction can free bmap blocks in a join (t3): * the agfs of the ags containing the blocks: 2 * sector size * the agfls of the ags containing the blocks: 2 * sector size * the super block free block counter: sector size
@@ -234,40 +260,72 @@ STATIC uintxfs_calc_write_reservation ( struct xfs_mount *mp) { -return XFS_DQUOT_LOGRES (mp) + -max ((xfs_calc_inode_res (mp,1 ) + +unsigned int t1, t2, t3; +unsigned int blksz =XFS_FSB_TO_B (mp,1 ); + + t1 =xfs_calc_inode_res (mp,1 ) + +xfs_calc_buf_res (XFS_BM_MAXLEVELS (mp,XFS_DATA_FORK ), blksz) + +xfs_calc_buf_res (3 , mp->m_sb.sb_sectsize) + +xfs_calc_buf_res (xfs_allocfree_log_count (mp,2 ), blksz); + +if (xfs_sb_version_hasrealtime (&mp->m_sb)) { + t2 =xfs_calc_inode_res (mp,1 ) +xfs_calc_buf_res (XFS_BM_MAXLEVELS (mp,XFS_DATA_FORK ), -XFS_FSB_TO_B (mp,1 )) + + blksz) +xfs_calc_buf_res (3 , mp->m_sb.sb_sectsize) + -xfs_calc_buf_res (xfs_allocfree_log_count (mp,2 ), -XFS_FSB_TO_B (mp,1 ))), - (xfs_calc_buf_res (5 , mp->m_sb.sb_sectsize) + -xfs_calc_buf_res (xfs_allocfree_log_count (mp,2 ), -XFS_FSB_TO_B (mp,1 )))); +xfs_calc_buf_res (xfs_rtalloc_log_count (mp,1 ), blksz) + +xfs_calc_buf_res (xfs_allocfree_log_count (mp,1 ), blksz); + }else { + t2 =0 ; + } + + t3 =xfs_calc_buf_res (5 , mp->m_sb.sb_sectsize) + +xfs_calc_buf_res (xfs_allocfree_log_count (mp,2 ), blksz); + +return XFS_DQUOT_LOGRES (mp) +max3 (t1, t2, t3); }/* -* In truncating a file we free up to two extents at once. We can modify: +* In truncating a file we free up to two extents at once. We can modify (t1): * the inode being truncated: inode size * the inode's bmap btree: (max depth + 1) * block size -* And the bmap_finish transaction can free the blocks and bmap blocks: +* And the bmap_finish transaction can free the blocks and bmap blocks (t2): * the agf for each of the ags: 4 * sector size * the agfl for each of the ags: 4 * sector size * the super block to reflect the freed blocks: sector size * worst case split in allocation btrees per extent assuming 4 extents: * 4 exts * 2 trees * (2 * max depth - 1) * block size +* Or, if it's a realtime file (t3): +* the agf for each of the ags: 2 * sector size +* the agfl for each of the ags: 2 * sector size +* the super block to reflect the freed blocks: sector size +* the realtime bitmap: 2 exts * ((MAXEXTLEN / rtextsize) / NBBY) bytes +* the realtime summary: 2 exts * 1 block +* worst case split in allocation btrees per extent assuming 2 extents: +* 2 exts * 2 trees * (2 * max depth - 1) * block size */ STATIC uintxfs_calc_itruncate_reservation (struct xfs_mount *mp) { -return XFS_DQUOT_LOGRES (mp) + -max ((xfs_calc_inode_res (mp,1 ) + -xfs_calc_buf_res (XFS_BM_MAXLEVELS (mp,XFS_DATA_FORK ) +1 , -XFS_FSB_TO_B (mp,1 ))), - (xfs_calc_buf_res (9 , mp->m_sb.sb_sectsize) + -xfs_calc_buf_res (xfs_allocfree_log_count (mp,4 ), -XFS_FSB_TO_B (mp,1 )))); +unsigned int t1, t2, t3; +unsigned int blksz =XFS_FSB_TO_B (mp,1 ); + + t1 =xfs_calc_inode_res (mp,1 ) + +xfs_calc_buf_res (XFS_BM_MAXLEVELS (mp,XFS_DATA_FORK ) +1 , blksz); + + t2 =xfs_calc_buf_res (9 , mp->m_sb.sb_sectsize) + +xfs_calc_buf_res (xfs_allocfree_log_count (mp,4 ), blksz); + +if (xfs_sb_version_hasrealtime (&mp->m_sb)) { + t3 =xfs_calc_buf_res (5 , mp->m_sb.sb_sectsize) + +xfs_calc_buf_res (xfs_rtalloc_log_count (mp,2 ), blksz) + +xfs_calc_buf_res (xfs_allocfree_log_count (mp,2 ), blksz); + }else { + t3 =0 ; + } + +return XFS_DQUOT_LOGRES (mp) +max3 (t1, t2, t3); }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 74/388 ALSA: hda: enable regmap internal locking
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit 8e85def5723eccea30ebf22645673692ab8cb3e2 ]
This reverts commit 42ec336f1f9d ("ALSA: hda: Disable regmap internal locking").
Without regmap locking, there is a race between snd_hda_codec_amp_init() and PM callbacks issuing regcache_sync(). This was caught by following kernel warning trace:
<4> [358.080081] WARNING: CPU: 2 PID: 4157 at drivers/base/regmap/regcache.c:498 regcache_cache_only+0xf5/0x130 [...]
<4> [358.080148] Call Trace:
<4> [358.080158] snd_hda_codec_amp_init+0x4e/0x100 [snd_hda_codec]
<4> [358.080169] snd_hda_codec_amp_init_stereo+0x40/0x80 [snd_hda_codec]
--- sound/hda/hdac_regmap.c | 1 - 1 file changed, 1 deletion(-)
sound/hda/hdac_regmap.c +0 -1
@@ -363,7 +363,6 @@ static const struct regmap_config hda_regmap_cfg = { .reg_write = hda_reg_write, .use_single_read = true, .use_single_write = true, - .disable_locking = true, };/**
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 75/388 tipc: fix link overflow issue at socket shutdown
In reply to Greg Kroah-HartmanFrom: Tuong Lien <[email protected]>
[ Upstream commit 49afb806cb650dd1f06f191994f3aa657d264009 ]
When a socket is suddenly shutdown or released, it will reject all the unreceived messages in its receive queue. This applies to a connected socket too, whereas there is only one 'FIN' message required to be sent back to its peer in this case.
In case there are many messages in the queue and/or some connections with such messages are shutdown at the same time, the link layer will easily get overflowed at the 'TIPC_SYSTEM_IMPORTANCE' backlog level because of the message rejections. As a result, the link will be taken down. Moreover, immediately when the link is re-established, the socket layer can continue to reject the messages and the same issue happens...
The commit refactors the '__tipc_shutdown()' function to only send one 'FIN' in the situation mentioned above. For the connectionless case, it is unavoidable but usually there is no rejections for such socket messages because they are 'dest-droppable' by default.
In addition, the new code makes the other socket states clear (e.g.'TIPC_LISTEN') and treats as a separate case to avoid misbehaving.
--- net/tipc/socket.c | 53 ++++++++++++++++++++++++++++------------------- 1 file changed, 32 insertions(+), 21 deletions(-)
net/tipc/socket.c +32 -21
@@ -260,12 +260,12 @@ static void tipc_sk_respond(struct sock *sk, struct sk_buff *skb, int err)* * Caller must hold socket lock */ -static void tsk_rej_rx_queue (struct sock *sk) +static void tsk_rej_rx_queue (struct sock *sk,int error) {struct sk_buff *skb;while ((skb =__skb_dequeue (&sk->sk_receive_queue))) -tipc_sk_respond (sk, skb,TIPC_ERR_NO_PORT ); +tipc_sk_respond (sk, skb, error); }static bool tipc_sk_connected (struct sock *sk)
@@ -515,34 +515,45 @@ static void __tipc_shutdown(struct socket *sock, int error)/* Remove any pending SYN message */ __skb_queue_purge (&sk->sk_write_queue); -/* Reject all unreceived messages, except on an active connection -* (which disconnects locally & sends a 'FIN+' to peer). -*/ -while ((skb =__skb_dequeue (&sk->sk_receive_queue)) !=NULL ) { -if (TIPC_SKB_CB (skb)->bytes_read) { -kfree_skb (skb); -continue ; - } -if (!tipc_sk_type_connectionless (sk) && - sk->sk_state !=TIPC_DISCONNECTING ) { -tipc_set_sk_state (sk,TIPC_DISCONNECTING ); -tipc_node_remove_conn (net, dnode, tsk->portid); - } -tipc_sk_respond (sk, skb, error); +/* Remove partially received buffer if any */ + skb =skb_peek (&sk->sk_receive_queue); +if (skb &&TIPC_SKB_CB (skb)->bytes_read) { +__skb_unlink (skb, &sk->sk_receive_queue); +kfree_skb (skb); } -if (tipc_sk_type_connectionless (sk)) +/* Reject all unreceived messages if connectionless */ +if (tipc_sk_type_connectionless (sk)) { +tsk_rej_rx_queue (sk, error);return ; + } -if (sk->sk_state !=TIPC_DISCONNECTING ) { +switch (sk->sk_state) { +case TIPC_CONNECTING : +case TIPC_ESTABLISHED : +tipc_set_sk_state (sk,TIPC_DISCONNECTING ); +tipc_node_remove_conn (net, dnode, tsk->portid); +/* Send a FIN+/- to its peer */ + skb =__skb_dequeue (&sk->sk_receive_queue); +if (skb) { +__skb_queue_purge (&sk->sk_receive_queue); +tipc_sk_respond (sk, skb, error); +break ; + } skb =tipc_msg_create (TIPC_CRITICAL_IMPORTANCE ,TIPC_CONN_MSG ,SHORT_H_SIZE ,0 , dnode,tsk_own_node (tsk),tsk_peer_port (tsk), tsk->portid, error);if (skb)tipc_node_xmit_skb (net, skb, dnode, tsk->portid); -tipc_node_remove_conn (net, dnode, tsk->portid); -tipc_set_sk_state (sk,TIPC_DISCONNECTING ); +break ; +case TIPC_LISTEN : +/* Reject all SYN messages */ +tsk_rej_rx_queue (sk, error); +break ; +default : +__skb_queue_purge (&sk->sk_receive_queue); +break ; } }
@@ -2564,7 +2575,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,* Reject any stray messages received by new socket * before the socket lock was taken (very, very unlikely) */ -tsk_rej_rx_queue (new_sk); +tsk_rej_rx_queue (new_sk,TIPC_ERR_NO_PORT );/* Connect new socket to it's peer */ tipc_sk_finish_conn (new_tsock,msg_origport (msg),msg_orignode (msg));
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 76/388 vcc_seq_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 8bf7092021f283944f0c5f4c364853201c45c611 ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- net/atm/proc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/atm/proc.c +1 -2
@@ -134,8 +134,7 @@ static void vcc_seq_stop(struct seq_file *seq, void *v)static void *vcc_seq_next (struct seq_file *seq,void *v,loff_t *pos) { v =vcc_walk (seq,1 ); -if (v) - (*pos)++; + (*pos)++;return v; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 77/388 neigh_stat_seq_next() should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 1e3f9f073c47bee7c23e77316b07bc12338c5bba ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- net/core/neighbour.c | 1 + 1 file changed, 1 insertion(+)
net/core/neighbour.c +1 -0
@@ -3290,6 +3290,7 @@ static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos) *pos = cpu+1 ;return per_cpu_ptr (tbl->stats, cpu); } + (*pos)++;return NULL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 78/388 rt_cpu_seq_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit a3ea86739f1bc7e121d921842f0f4a8ab1af94d9 ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- net/ipv4/route.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/route.c +1 -0
@@ -271,6 +271,7 @@ static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos) *pos = cpu+1 ;return &per_cpu (rt_cache_stat, cpu); } + (*pos)++;return NULL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 79/388 ipv6_route_seq_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 4fc427e0515811250647d44de38d87d7b0e0790f ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- net/ipv6/ip6_fib.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
net/ipv6/ip6_fib.c +2 -5
@@ -2479,14 +2479,13 @@ static void *ipv6_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)struct net *net =seq_file_net (seq);struct ipv6_route_iter *iter = seq->private; + ++(*pos);if (!v) goto iter_table; n =rcu_dereference_bh (((struct fib6_info *)v)->fib6_next); -if (n) { - ++*pos; +if (n)return n; - } iter_table:ipv6_route_check_sernum (iter);
@@ -2494,8 +2493,6 @@ iter_table: r =fib6_walk_continue (&iter->w);spin_unlock_bh (&iter->tbl->tb6_lock);if (r >0 ) { -if (v) - ++*pos;return iter->w.leaf; }else if (r <0 ) {fib6_walker_unlink (net, &iter->w);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 80/388 drm/mcde: Handle pending vblank while disabling display
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit 97de863673f07f424dd0666aefb4b6ecaba10171 ]
Disabling the display using MCDE currently results in a warning together with a delay caused by some timeouts:
mcde a0350000.mcde: MCDE display is disabled
------------[ cut here ]------------
WARNING: CPU: 0 PID: 20 at drivers/gpu/drm/drm_atomic_helper.c:2258 drm_atomic_helper_commit_hw_done+0xe0/0xe4
Hardware name: ST-Ericsson Ux5x0 platform (Device Tree Support)
Workqueue: events drm_mode_rmfb_work_fn
[<c010f468>] (unwind_backtrace) from [<c010b54c>] (show_stack+0x10/0x14)
[<c010b54c>] (show_stack) from [<c079dd90>] (dump_stack+0x84/0x98)
[<c079dd90>] (dump_stack) from [<c011d1b0>] (__warn+0xb8/0xd4)
[<c011d1b0>] (__warn) from [<c011d230>] (warn_slowpath_fmt+0x64/0xc4)
[<c011d230>] (warn_slowpath_fmt) from [<c0413048>] (drm_atomic_helper_commit_hw_done+0xe0/0xe4)
[<c0413048>] (drm_atomic_helper_commit_hw_done) from [<c04159cc>] (drm_atomic_helper_commit_tail_rpm+0x44/0x6c)
[<c04159cc>] (drm_atomic_helper_commit_tail_rpm) from [<c0415f5c>] (commit_tail+0x50/0x10c)
[<c0415f5c>] (commit_tail) from [<c04160dc>] (drm_atomic_helper_commit+0xbc/0x128)
[<c04160dc>] (drm_atomic_helper_commit) from [<c0430790>] (drm_framebuffer_remove+0x390/0x428)
[<c0430790>] (drm_framebuffer_remove) from [<c0430860>] (drm_mode_rmfb_work_fn+0x38/0x48)
[<c0430860>] (drm_mode_rmfb_work_fn) from [<c01368a8>] (process_one_work+0x1f0/0x43c)
[<c01368a8>] (process_one_work) from [<c0136d48>] (worker_thread+0x254/0x55c)
[<c0136d48>] (worker_thread) from [<c013c014>] (kthread+0x124/0x150)
[<c013c014>] (kthread) from [<c01010e8>] (ret_from_fork+0x14/0x2c)
Exception stack(0xeb14dfb0 to 0xeb14dff8)
dfa0: 00000000 00000000 00000000 00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
---[ end trace 314909bcd4c7d50c ]---
[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [CRTC:32:crtc-0] flip_done timed out
[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [CONNECTOR:34:DSI-1] flip_done timed out
[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [PLANE:31:plane-0] flip_done timed outThe reason for this is that there is a vblank event pending, but we never handle it after disabling the vblank interrupts.
Check if there is an vblank event pending when disabling the display, and clear it by sending a fake vblank event in that case.
--- drivers/gpu/drm/mcde/mcde_display.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpu/drm/mcde/mcde_display.c +10 -0
@@ -946,6 +946,7 @@ static void mcde_display_disable(struct drm_simple_display_pipe *pipe)struct drm_crtc *crtc = &pipe->crtc;struct drm_device *drm = crtc->dev;struct mcde *mcde = drm->dev_private; +struct drm_pending_vblank_event *event;if (mcde->te_sync)drm_crtc_vblank_off (crtc);
@@ -953,6 +954,15 @@ static void mcde_display_disable(struct drm_simple_display_pipe *pipe)/* Disable FIFO A flow */ mcde_disable_fifo (mcde,MCDE_FIFO_A , true); + event = crtc->state->event; +if (event) { + crtc->state->event =NULL ; + +spin_lock_irq (&crtc->dev->event_lock); +drm_crtc_send_vblank_event (crtc, event); +spin_unlock_irq (&crtc->dev->event_lock); + } +dev_info (drm->dev,"MCDE display is disabled\n" ); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 81/388 seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier
In reply to Greg Kroah-HartmanFrom: Marco Elver <[email protected]>
[ Upstream commit bf07132f96d426bcbf2098227fb680915cf44498 ]
This patch proposes to require marked atomic accesses surrounding raw_write_seqcount_barrier. We reason that otherwise there is no way to guarantee propagation nor atomicity of writes before/after the barrier [1]. For example, consider the compiler tears stores either before or after the barrier; in this case, readers may observe a partial value, and because readers are unaware that writes are going on (writes are not in a seq-writer critical section), will complete the seq-reader critical section while having observed some partial state.
[1] https://lwn.net/Articles/793253/
This came up when designing and implementing KCSAN, because KCSAN would flag these accesses as data-races. After careful analysis, our reasoning as above led us to conclude that the best thing to do is to propose an amendment to the raw_seqcount_barrier usage.
--- include/linux/seqlock.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
include/linux/seqlock.h +9 -2
@@ -243,6 +243,13 @@ static inline void raw_write_seqcount_end(seqcount_t *s)* usual consistency guarantee. It is one wmb cheaper, because we can * collapse the two back-to-back wmb()s. * +* Note that, writes surrounding the barrier should be declared atomic (e.g. +* via WRITE_ONCE): a) to ensure the writes become visible to other threads +* atomically, avoiding compiler optimizations; b) to document which writes are +* meant to propagate to the reader critical section. This is necessary because +* neither writes before and after the barrier are enclosed in a seq-writer +* critical section that would ensure readers are aware of ongoing writes. +* * seqcount_t seq; * bool X = true, Y = false; *
@@ -262,11 +269,11 @@ static inline void raw_write_seqcount_end(seqcount_t *s)* * void write(void) * { -* Y = true; +* WRITE_ONCE(Y, true); * * raw_write_seqcount_barrier(seq); * -* X = false; +* WRITE_ONCE(X, false); * } */ static inline void raw_write_seqcount_barrier (seqcount_t *s)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 82/388 drm/scheduler: Avoid accessing freed bad job.
In reply to Greg Kroah-HartmanFrom: Andrey Grodzovsky <[email protected]>
[ Upstream commit 135517d3565b48f4def3b1b82008bc17eb5d1c90 ]
Problem:
Due to a race between drm_sched_cleanup_jobs in sched thread and drm_sched_job_timedout in timeout work there is a possiblity that bad job was already freed while still being accessed from the timeout thread.
Fix:
Instead of just peeking at the bad job in the mirror list remove it from the list under lock and then put it back later when we are garanteed no race with main sched thread is possible which is after the thread is parked.
v2: Lock around processing ring_mirror_list in drm_sched_cleanup_jobs.
v3: Rebase on top of drm-misc-next. v2 is not needed anymore as drm_sched_get_cleanup_job already has a lock there.
v4: Fix comments to relfect latest code in drm-misc.
--- drivers/gpu/drm/scheduler/sched_main.c | 27 ++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
drivers/gpu/drm/scheduler/sched_main.c +27 -0
@@ -284,10 +284,21 @@ static void drm_sched_job_timedout(struct work_struct *work)unsigned long flags; sched = container_of(work, struct drm_gpu_scheduler, work_tdr.work); + +/* Protects against concurrent deletion in drm_sched_get_cleanup_job */ +spin_lock_irqsave (&sched->job_list_lock, flags); job =list_first_entry_or_null (&sched->ring_mirror_list, struct drm_sched_job, node);if (job) { +/* +* Remove the bad job so it cannot be freed by concurrent +* drm_sched_cleanup_jobs. It will be reinserted back after sched->thread +* is parked at which point it's safe. +*/ +list_del_init (&job->node); +spin_unlock_irqrestore (&sched->job_list_lock, flags); + job->sched->ops->timedout_job (job);/*
@@ -298,6 +309,8 @@ static void drm_sched_job_timedout(struct work_struct *work) job->sched->ops->free_job (job); sched->free_guilty = false; } + }else { +spin_unlock_irqrestore (&sched->job_list_lock, flags); }spin_lock_irqsave (&sched->job_list_lock, flags);
@@ -369,6 +382,20 @@ void drm_sched_stop(struct drm_gpu_scheduler *sched, struct drm_sched_job *bad)kthread_park (sched->thread); +/* +* Reinsert back the bad job here - now it's safe as +* drm_sched_get_cleanup_job cannot race against us and release the +* bad job at this point - we parked (waited for) any in progress +* (earlier) cleanups and drm_sched_get_cleanup_job will not be called +* now until the scheduler thread is unparked. +*/ +if (bad && bad->sched == sched) +/* +* Add at the head of the queue to reflect it was the earliest +* job extracted. +*/ +list_add (&bad->node, &sched->ring_mirror_list); +/* * Iterate the job list from later to earlier one and either deactive * their HW callbacks or remove them from mirror list if they already
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 83/388 media: ti-vpe: cal: Restrict DMA to avoid memory corruption
In reply to Greg Kroah-HartmanFrom: Nikhil Devshatwar <[email protected]>
[ Upstream commit 6e72eab2e7b7a157d554b8f9faed7676047be7c1 ]
When setting DMA for video capture from CSI channel, if the DMA size is not given, it ends up writing as much data as sent by the camera.
This may lead to overwriting the buffers causing memory corruption. Observed green lines on the default framebuffer.
Restrict the DMA to maximum height as specified in the S_FMT ioctl.
--- drivers/media/platform/ti-vpe/cal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/ti-vpe/cal.c +4 -2
@@ -678,12 +678,13 @@ static void pix_proc_config(struct cal_ctx *ctx) }static void cal_wr_dma_config (struct cal_ctx *ctx, -unsigned int width) +unsigned int width,unsigned int height) {u32 val; val =reg_read (ctx->dev,CAL_WR_DMA_CTRL (ctx->csi2_port));set_field (&val, ctx->csi2_port,CAL_WR_DMA_CTRL_CPORT_MASK ); +set_field (&val, height,CAL_WR_DMA_CTRL_YSIZE_MASK );set_field (&val,CAL_WR_DMA_CTRL_DTAG_PIX_DAT ,CAL_WR_DMA_CTRL_DTAG_MASK ); set_field(&val, CAL_WR_DMA_CTRL_MODE_CONST,
@@ -1306,7 +1307,8 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count)csi2_lane_config (ctx);csi2_ctx_config (ctx);pix_proc_config (ctx); -cal_wr_dma_config (ctx, ctx->v_fmt.fmt.pix.bytesperline); +cal_wr_dma_config (ctx, ctx->v_fmt.fmt.pix.bytesperline, + ctx->v_fmt.fmt.pix.height);cal_wr_dma_addr (ctx, addr);csi2_ppi_enable (ctx);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 84/388 opp: Replace list_kref with a local counter
In reply to Greg Kroah-HartmanFrom: Viresh Kumar <[email protected]>
[ Upstream commit 03758d60265c773e1d06d436b99ee338f2ac55d6 ]
A kref or refcount isn't the right tool to be used here for counting number of devices that are sharing the static OPPs created for the OPP table. For example, we are reinitializing the kref again, after it reaches a value of 0 and frees the resources, if the static OPPs get added for the same OPP table structure (as the OPP table structure was never freed). That is messy and very unclear.
This patch makes parsed_static_opps an unsigned integer and uses it to count the number of users of the static OPPs. The increment and decrement to parsed_static_opps is done under opp_table->lock now to make sure no races are possible if the OPP table is getting added and removed in parallel (which doesn't happen in practice, but can in theory).
--- drivers/opp/core.c | 48 ++++++++++++++++++---------------------------- drivers/opp/of.c | 26 +++++++++++-------------- drivers/opp/opp.h | 6 ++---- 3 files changed, 32 insertions(+), 48 deletions(-)
drivers/opp/core.c +19 -29
@@ -990,7 +990,6 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index)BLOCKING_INIT_NOTIFIER_HEAD (&opp_table->head);INIT_LIST_HEAD (&opp_table->opp_list);kref_init (&opp_table->kref); -kref_init (&opp_table->list_kref);/* Secure the device table modification */ list_add (&opp_table->node, &opp_tables);
@@ -1074,33 +1073,6 @@ static void _opp_table_kref_release(struct kref *kref)mutex_unlock (&opp_table_lock); } -void _opp_remove_all_static (struct opp_table *opp_table) -{ -struct dev_pm_opp *opp, *tmp; - -list_for_each_entry_safe (opp, tmp, &opp_table->opp_list, node) { -if (!opp->dynamic) -dev_pm_opp_put (opp); - } - - opp_table->parsed_static_opps = false; -} - -static void _opp_table_list_kref_release (struct kref *kref) -{ - struct opp_table *opp_table = container_of(kref, struct opp_table, - list_kref); - -_opp_remove_all_static (opp_table); -mutex_unlock (&opp_table_lock); -} - -void _put_opp_list_kref (struct opp_table *opp_table) -{ -kref_put_mutex (&opp_table->list_kref, _opp_table_list_kref_release, - &opp_table_lock); -} -void dev_pm_opp_put_opp_table (struct opp_table *opp_table) { kref_put_mutex(&opp_table->kref, _opp_table_kref_release,
@@ -1204,6 +1176,24 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq) }EXPORT_SYMBOL_GPL (dev_pm_opp_remove); +void _opp_remove_all_static (struct opp_table *opp_table) +{ +struct dev_pm_opp *opp, *tmp; + +mutex_lock (&opp_table->lock); + +if (!opp_table->parsed_static_opps || --opp_table->parsed_static_opps) + goto unlock; + +list_for_each_entry_safe (opp, tmp, &opp_table->opp_list, node) { +if (!opp->dynamic) +dev_pm_opp_put_unlocked (opp); + } + +unlock: +mutex_unlock (&opp_table->lock); +} +/** * dev_pm_opp_remove_all_dynamic() - Remove all dynamically created OPPs * @dev: device for which we do this operation
@@ -2209,7 +2199,7 @@ void _dev_pm_opp_find_and_remove_table(struct device *dev)return ; } -_put_opp_list_kref (opp_table); +_opp_remove_all_static (opp_table);/* Drop reference taken by _find_opp_table() */ dev_pm_opp_put_opp_table (opp_table);
drivers/opp/of.c +11 -15
@@ -658,17 +658,15 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)struct dev_pm_opp *opp;/* OPP table is already initialized for the device */ +mutex_lock (&opp_table->lock);if (opp_table->parsed_static_opps) { -kref_get (&opp_table->list_kref); + opp_table->parsed_static_opps++; +mutex_unlock (&opp_table->lock);return 0 ; } -/* -* Re-initialize list_kref every time we add static OPPs to the OPP -* table as the reference count may be 0 after the last tie static OPPs -* were removed. -*/ -kref_init (&opp_table->list_kref); + opp_table->parsed_static_opps =1 ; +mutex_unlock (&opp_table->lock);/* We have opp-table node now, iterate over it and add OPPs */ for_each_available_child_of_node (opp_table->np, np) {
@@ -678,7 +676,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)dev_err (dev,"%s: Failed to add OPP, %d\n" , __func__, ret);of_node_put (np); - goto put_list_kref; + goto remove_static_opp; }else if (opp) { count++; }
@@ -687,7 +685,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)/* There should be one of more OPP defined */ if (WARN_ON (!count)) { ret = -ENOENT ; - goto put_list_kref; + goto remove_static_opp; }list_for_each_entry (opp, &opp_table->opp_list, node)
@@ -698,18 +696,16 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)dev_err (dev,"Not all nodes have performance state set (%d: %d)\n" , count, pstate_count); ret = -ENOENT ; - goto put_list_kref; + goto remove_static_opp; }if (pstate_count) opp_table->genpd_performance_state = true; - opp_table->parsed_static_opps = true; -return 0 ; -put_list_kref: -_put_opp_list_kref (opp_table); +remove_static_opp: +_opp_remove_all_static (opp_table);return ret; }
@@ -746,7 +742,7 @@ static int _of_add_opp_table_v1(struct device *dev, struct opp_table *opp_table)if (ret) {dev_err (dev,"%s: Failed to add OPP %ld (%d)\n" , __func__, freq, ret); -_put_opp_list_kref (opp_table); +_opp_remove_all_static (opp_table);return ret; } nr -=2 ;
drivers/opp/opp.h +2 -4
@@ -127,11 +127,10 @@ enum opp_table_access {* @dev_list: list of devices that share these OPPs * @opp_list: table of opps * @kref: for reference count of the table. -* @list_kref: for reference count of the OPP list. * @lock: mutex protecting the opp_list and dev_list. * @np: struct device_node pointer for opp's DT node. * @clock_latency_ns_max: Max clock latency in nanoseconds. -* @parsed_static_opps: True if OPPs are initialized from DT. +* @parsed_static_opps: Count of devices for which OPPs are initialized from DT. * @shared_opp: OPP is shared between multiple devices. * @suspend_opp: Pointer to OPP to be used during device suspend. * @genpd_virt_dev_lock: Mutex protecting the genpd virtual device pointers.
@@ -167,7 +166,6 @@ struct opp_table {struct list_head dev_list;struct list_head opp_list;struct kref kref; -struct kref list_kref;struct mutex lock;struct device_node *np;
@@ -176,7 +174,7 @@ struct opp_table {/* For backward compatibility with v1 bindings */ unsigned int voltage_tolerance_v1; -bool parsed_static_opps; +unsigned int parsed_static_opps;enum opp_table_access shared_opp;struct dev_pm_opp *suspend_opp;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 85/388 scsi: qla2xxx: Fix stuck session in GNL
In reply to Greg Kroah-HartmanFrom: Quinn Tran <[email protected]>
[ Upstream commit e1217dc3edce62895595cf484af33b9e0379b7f3 ]
Fix race condition between GNL completion processing and GNL request. Late submission of GNL request was not seen by the GNL completion thread. This patch will re-submit the GNL request for late submission fcport.
--- drivers/scsi/qla2xxx/qla_init.c | 15 +++++++++++++-- drivers/scsi/qla2xxx/qla_target.c | 21 +++++++++++++++------ 2 files changed, 28 insertions(+), 8 deletions(-)
drivers/scsi/qla2xxx/qla_init.c +13 -2
@@ -1002,7 +1002,7 @@ static void qla24xx_async_gnl_sp_done(srb_t *sp, int res)set_bit (loop_id, vha->hw->loop_id_map); wwn =wwn_to_u64 (e->port_name); - ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x20e8, + ql_dbg(ql_dbg_disc, vha, 0x20e8, "%s %8phC %02x:%02x:%02x CLS %x/%x lid %x \n", __func__, (void *)&wwn, e->port_id[2], e->port_id[1], e->port_id[0], e->current_login_state, e->last_login_state,
@@ -1061,6 +1061,16 @@ static void qla24xx_async_gnl_sp_done(srb_t *sp, int res)spin_lock_irqsave (&vha->hw->tgt.sess_lock, flags); vha->gnl.sent =0 ; +if (!list_empty (&vha->gnl.fcports)) { +/* retrigger gnl */ +list_for_each_entry_safe (fcport, tf, &vha->gnl.fcports, + gnl_entry) { +list_del_init (&fcport->gnl_entry); + fcport->flags &= ~(FCF_ASYNC_SENT |FCF_ASYNC_ACTIVE ); +if (qla24xx_post_gnl_work (vha, fcport) ==QLA_SUCCESS ) +break ; + } + }spin_unlock_irqrestore (&vha->hw->tgt.sess_lock, flags); sp->free (sp);
@@ -1995,7 +2005,7 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea)qla24xx_post_prli_work (vha, ea->fcport); }else {ql_dbg (ql_dbg_disc, vha,0x20ea , -"%s %d %8phC LoopID 0x%x in use with %06x. post gnl\n" , +"%s %d %8phC LoopID 0x%x in use with %06x. post gpdb\n" , __func__, __LINE__, ea->fcport->port_name, ea->fcport->loop_id, ea->fcport->d_id.b24);
@@ -2066,6 +2076,7 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea)set_bit (lid, vha->hw->loop_id_map); ea->fcport->loop_id = lid; ea->fcport->keep_nport_handle =0 ; + ea->fcport->logout_on_delete =1 ;qlt_schedule_sess_for_deletion (ea->fcport); }break ;
drivers/scsi/qla2xxx/qla_target.c +15 -6
@@ -957,7 +957,7 @@ void qlt_free_session_done(struct work_struct *work)struct qlt_plogi_ack_t *own = sess->plogi_link[QLT_PLOGI_LINK_SAME_WWN ]; - ql_dbg(ql_dbg_tgt_mgt, vha, 0xf084, + ql_dbg(ql_dbg_disc, vha, 0xf084, "%s: se_sess %p / sess %p from port %8phC loop_id %#04x" " s_id %02x:%02x:%02x logout %d keep %d els_logo %d\n", __func__, sess->se_sess, sess, sess->port_name, sess->loop_id,
@@ -1024,7 +1024,7 @@ void qlt_free_session_done(struct work_struct *work)while (!READ_ONCE (sess->logout_completed)) {if (!traced) { -ql_dbg (ql_dbg_tgt_mgt, vha,0xf086 , +ql_dbg (ql_dbg_disc, vha,0xf086 ,"%s: waiting for sess %p logout\n" , __func__, sess); traced = true;
@@ -1045,6 +1045,10 @@ void qlt_free_session_done(struct work_struct *work) (struct imm_ntfy_from_isp *)sess->iocb, SRB_NACK_LOGO); } +spin_lock_irqsave (&vha->work_lock, flags); + sess->flags &= ~FCF_ASYNC_SENT ; +spin_unlock_irqrestore (&vha->work_lock, flags); +spin_lock_irqsave (&ha->tgt.sess_lock, flags);if (sess->se_sess) { sess->se_sess =NULL ;
@@ -1108,7 +1112,7 @@ void qlt_free_session_done(struct work_struct *work)spin_unlock_irqrestore (&ha->tgt.sess_lock, flags); sess->free_pending =0 ; -ql_dbg (ql_dbg_tgt_mgt, vha,0xf001 , +ql_dbg (ql_dbg_disc, vha,0xf001 ,"Unregistration of sess %p %8phC finished fcp_cnt %d\n" , sess, sess->port_name, vha->fcport_count);
@@ -1151,6 +1155,11 @@ void qlt_unreg_sess(struct fc_port *sess)return ; } sess->free_pending =1 ; +/* +* Use FCF_ASYNC_SENT flag to block other cmds used in sess +* management from being sent. +*/ + sess->flags |=FCF_ASYNC_SENT ;spin_unlock_irqrestore (&sess->vha->work_lock, flags);if (sess->se_sess)
@@ -4580,7 +4589,7 @@ qlt_find_sess_invalidate_other(scsi_qla_host_t *vha, uint64_t wwn,/* find other sess with nport_id collision */ if (port_id.b24 == other_sess->d_id.b24) {if (loop_id != other_sess->loop_id) { -ql_dbg (ql_dbg_tgt_tmr, vha,0x1000c , +ql_dbg (ql_dbg_disc, vha,0x1000c ,"Invalidating sess %p loop_id %d wwn %llx.\n" , other_sess, other_sess->loop_id, other_wwn);
@@ -4596,7 +4605,7 @@ qlt_find_sess_invalidate_other(scsi_qla_host_t *vha, uint64_t wwn,* Another wwn used to have our s_id/loop_id * kill the session, but don't free the loop_id */ -ql_dbg (ql_dbg_tgt_tmr, vha,0xf01b , +ql_dbg (ql_dbg_disc, vha,0xf01b ,"Invalidating sess %p loop_id %d wwn %llx.\n" , other_sess, other_sess->loop_id, other_wwn);
@@ -4611,7 +4620,7 @@ qlt_find_sess_invalidate_other(scsi_qla_host_t *vha, uint64_t wwn,/* find other sess with nport handle collision */ if ((loop_id == other_sess->loop_id) && (loop_id !=FC_NO_LOOP_ID )) { -ql_dbg (ql_dbg_tgt_tmr, vha,0x1000d , +ql_dbg (ql_dbg_disc, vha,0x1000d ,"Invalidating sess %p loop_id %d wwn %llx.\n" , other_sess, other_sess->loop_id, other_wwn);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 86/388 scsi: lpfc: Fix incomplete NVME discovery when target
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit be0709e449ac9d9753a5c17e5b770d6e5e930e4a ]
NVMe device re-discovery does not complete. Dev_loss_tmo messages seen on initiator after recovery from a link disturbance.
The failing case is the following:
When the driver (as a NVME target) receives a PLOGI, the driver initiates an "unreg rpi" mailbox command. While the mailbox command is in progress, the driver requests that an ACC be sent to the initiator. The target's ACC is received by the initiator and the initiator then transmits a PLOGI. The driver receives the PLOGI prior to receiving the completion for the PLOGI response WQE that sent the ACC. (Different delivery sources from the hw so the race is very possible). Given the PLOGI is prior to the ACC completion (signifying PLOGI exchange complete), the driver LS_RJT's the PRLI. The "unreg rpi" mailbox then completes. Since PRLI has been received, the driver transmits a PLOGI to restart discovery, which the initiator then ACC's. If the driver processes the (re)PLOGI ACC prior to the completing the handling for the earlier ACC it sent the intiators original PLOGI, there is no state change for completion of the (re)PLOGI. The ndlp remains in "PLOGI Sent" and the initiator continues sending PRLI's which are rejected by the target until timeout or retry is reached.
Fix by: When in target mode, defer sending an ACC for the received PLOGI until unreg RPI completes.
--- drivers/scsi/lpfc/lpfc_nportdisc.c | 108 ++++++++++++++++++++++++++--- 1 file changed, 99 insertions(+), 9 deletions(-)
drivers/scsi/lpfc/lpfc_nportdisc.c +99 -9
@@ -308,7 +308,7 @@ lpfc_defer_pt2pt_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *link_mbox) mb->mbxStatus);mempool_free (login_mbox, phba->mbox_mem_pool);mempool_free (link_mbox, phba->mbox_mem_pool); -lpfc_sli_release_iocbq (phba, save_iocb); +kfree (save_iocb);return ; }
@@ -325,7 +325,61 @@ lpfc_defer_pt2pt_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *link_mbox) }mempool_free (link_mbox, phba->mbox_mem_pool); -lpfc_sli_release_iocbq (phba, save_iocb); +kfree (save_iocb); +} + +/** +* lpfc_defer_tgt_acc - Progress SLI4 target rcv PLOGI handler +* @phba: Pointer to HBA context object. +* @pmb: Pointer to mailbox object. +* +* This function provides the unreg rpi mailbox completion handler for a tgt. +* The routine frees the memory resources associated with the completed +* mailbox command and transmits the ELS ACC. +* +* This routine is only called if we are SLI4, acting in target +* mode and the remote NPort issues the PLOGI after link up. +**/ +void +lpfc_defer_acc_rsp (struct lpfc_hba *phba,LPFC_MBOXQ_t *pmb) +{ +struct lpfc_vport *vport = pmb->vport; +struct lpfc_nodelist *ndlp = pmb->ctx_ndlp; +LPFC_MBOXQ_t *mbox = pmb->context3; +struct lpfc_iocbq *piocb =NULL ; +int rc; + +if (mbox) { + pmb->context3 =NULL ; + piocb = mbox->context3; + mbox->context3 =NULL ; + } + +/* +* Complete the unreg rpi mbx request, and update flags. +* This will also restart any deferred events. +*/ +lpfc_nlp_get (ndlp); +lpfc_sli4_unreg_rpi_cmpl_clr (phba, pmb); + +if (!piocb) { +lpfc_printf_vlog (vport,KERN_ERR ,LOG_DISCOVERY |LOG_ELS , +"4578 PLOGI ACC fail\n" ); +if (mbox) +mempool_free (mbox, phba->mbox_mem_pool); + goto out; + } + + rc =lpfc_els_rsp_acc (vport,ELS_CMD_PLOGI , piocb, ndlp, mbox); +if (rc) { +lpfc_printf_vlog (vport,KERN_ERR ,LOG_DISCOVERY |LOG_ELS , +"4579 PLOGI ACC fail %x\n" , rc); +if (mbox) +mempool_free (mbox, phba->mbox_mem_pool); + } +kfree (piocb); +out: +lpfc_nlp_put (ndlp); } static int
@@ -345,6 +399,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,struct lpfc_iocbq *save_iocb;struct ls_rjt stat;uint32_t vid, flag; +u16 rpi;int rc, defer_acc;memset (&stat,0 ,sizeof (struct ls_rjt ));
@@ -488,7 +543,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, link_mbox->vport = vport; link_mbox->ctx_ndlp = ndlp; - save_iocb =lpfc_sli_get_iocbq (phba); + save_iocb =kzalloc (sizeof (*save_iocb),GFP_KERNEL );if (!save_iocb) goto out;/* Save info from cmd IOCB used in rsp */
@@ -513,7 +568,36 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, goto out;/* Registering an existing RPI behaves differently for SLI3 vs SLI4 */ -if (phba->sli_rev ==LPFC_SLI_REV4 ) +if (phba->nvmet_support && !defer_acc) { + link_mbox =mempool_alloc (phba->mbox_mem_pool,GFP_KERNEL ); +if (!link_mbox) + goto out; + +/* As unique identifiers such as iotag would be overwritten +* with those from the cmdiocb, allocate separate temporary +* storage for the copy. +*/ + save_iocb =kzalloc (sizeof (*save_iocb),GFP_KERNEL ); +if (!save_iocb) + goto out; + +/* Unreg RPI is required for SLI4. */ + rpi = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi]; +lpfc_unreg_login (phba, vport->vpi, rpi, link_mbox); + link_mbox->vport = vport; + link_mbox->ctx_ndlp = ndlp; + link_mbox->mbox_cmpl = lpfc_defer_acc_rsp; + +if (((ndlp->nlp_DID & Fabric_DID_MASK) != Fabric_DID_MASK) && + (!(vport->fc_flag &FC_OFFLINE_MODE ))) + ndlp->nlp_flag |=NLP_UNREG_INP ; + +/* Save info from cmd IOCB used in rsp */ +memcpy (save_iocb, cmdiocb,sizeof (*save_iocb)); + +/* Delay sending ACC till unreg RPI completes. */ + defer_acc =1 ; + }else if (phba->sli_rev ==LPFC_SLI_REV4 )lpfc_unreg_rpi (vport, ndlp); rc = lpfc_reg_rpi(phba, vport->vpi, icmd->un.rcvels.remoteID,
@@ -553,6 +637,9 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,if ((vport->port_type ==LPFC_NPIV_PORT && vport->cfg_restrict_login)) { +/* no deferred ACC */ +kfree (save_iocb); +/* In order to preserve RPIs, we want to cleanup * the default RPI the firmware created to rcv * this ELS request. The only way to do this is
@@ -571,8 +658,12 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, }if (defer_acc) {/* So the order here should be: -* Issue CONFIG_LINK mbox -* CONFIG_LINK cmpl +* SLI3 pt2pt +* Issue CONFIG_LINK mbox +* CONFIG_LINK cmpl +* SLI4 tgt +* Issue UNREG RPI mbx +* UNREG RPI cmpl * Issue PLOGI ACC * PLOGI ACC cmpl * Issue REG_LOGIN mbox
@@ -596,10 +687,9 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, out:if (defer_acc)lpfc_printf_log (phba,KERN_ERR ,LOG_DISCOVERY , -"4577 pt2pt discovery failure: %p %p %p\n" , +"4577 discovery failure: %p %p %p\n" , save_iocb, link_mbox, login_mbox); -if (save_iocb) -lpfc_sli_release_iocbq (phba, save_iocb); +kfree (save_iocb);if (link_mbox)mempool_free (link_mbox, phba->mbox_mem_pool);if (login_mbox)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 87/388 sctp: move trace_sctp_probe_path into sctp_outq_sack
In reply to Greg Kroah-HartmanFrom: Kevin Kou <[email protected]>
[ Upstream commit f643ee295c1c63bc117fb052d4da681354d6f732 ]
The original patch bringed in the "SCTP ACK tracking trace event" feature was committed at Dec.20, 2017, it replaced jprobe usage with trace events, and bringed in two trace events, one is TRACE_EVENT(sctp_probe), another one is TRACE_EVENT(sctp_probe_path). The original patch intended to trigger the trace_sctp_probe_path in TRACE_EVENT(sctp_probe) as below code,
+TRACE_EVENT(sctp_probe,
+
+ TP_PROTO(const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ struct sctp_chunk *chunk),
+
+ TP_ARGS(ep, asoc, chunk),
+
+ TP_STRUCT__entry(
+ __field(__u64, asoc)
+ __field(__u32, mark)
+ __field(__u16, bind_port)
+ __field(__u16, peer_port)
+ __field(__u32, pathmtu)
+ __field(__u32, rwnd)
+ __field(__u16, unack_data)
+ ),
+
+ TP_fast_assign(
+ struct sk_buff *skb = chunk->skb;
+
+ __entry->asoc = (unsigned long)asoc;
+ __entry->mark = skb->mark;
+ __entry->bind_port = ep->base.bind_addr.port;
+ __entry->peer_port = asoc->peer.port;
+ __entry->pathmtu = asoc->pathmtu;
+ __entry->rwnd = asoc->peer.rwnd;
+ __entry->unack_data = asoc->unack_data;
+
+ if (trace_sctp_probe_path_enabled()) {
+ struct sctp_transport *sp;
+
+ list_for_each_entry(sp, &asoc->peer.transport_addr_list,
+ transports) {
+ trace_sctp_probe_path(sp, asoc);
+ }
+ }
+ ),
But I found it did not work when I did testing, and trace_sctp_probe_path had no output, I finally found that there is trace buffer lock operation(trace_event_buffer_reserve) in include/trace/trace_events.h:
static notrace void \
trace_event_raw_event_##call(void *__data, proto) \
{ \
struct trace_event_file *trace_file = __data; \
struct trace_event_data_offsets_##call __maybe_unused __data_offsets;\
struct trace_event_buffer fbuffer; \
struct trace_event_raw_##call *entry; \
int __data_size; \
\
if (trace_trigger_soft_disabled(trace_file)) \
return; \
\
__data_size = trace_event_get_offsets_##call(&__data_offsets, args); \
\
entry = trace_event_buffer_reserve(&fbuffer, trace_file, \
sizeof(*entry) + __data_size); \
\
if (!entry) \
return; \
\
tstruct \
\
{ assign; } \
\
trace_event_buffer_commit(&fbuffer); \
}The reason caused no output of trace_sctp_probe_path is that trace_sctp_probe_path written in TP_fast_assign part of TRACE_EVENT(sctp_probe), and it will be placed( { assign; } ) after the trace_event_buffer_reserve() when compiler expands Macro,
entry = trace_event_buffer_reserve(&fbuffer, trace_file, \
sizeof(*entry) + __data_size); \
\
if (!entry) \
return; \
\
tstruct \
\
{ assign; } \so trace_sctp_probe_path finally can not acquire trace_event_buffer and return no output, that is to say the nest of tracepoint entry function is not allowed. The function call flow is:
trace_sctp_probe()
-> trace_event_raw_event_sctp_probe()
-> lock buffer
-> trace_sctp_probe_path()
-> trace_event_raw_event_sctp_probe_path() --nested -> buffer has been locked and return no output.
This patch is to remove trace_sctp_probe_path from the TP_fast_assign part of TRACE_EVENT(sctp_probe) to avoid the nest of entry function, and trigger sctp_probe_path_trace in sctp_outq_sack.
After this patch, you can enable both events individually,
# cd /sys/kernel/debug/tracing # echo 1 > events/sctp/sctp_probe/enable # echo 1 > events/sctp/sctp_probe_path/enable
Or, you can enable all the events under sctp.
# echo 1 > events/sctp/enable
--- include/trace/events/sctp.h | 9 --------- net/sctp/outqueue.c | 6 ++++++ 2 files changed, 6 insertions(+), 9 deletions(-)
include/trace/events/sctp.h +0 -9
@@ -75,15 +75,6 @@ TRACE_EVENT(sctp_probe, __entry->pathmtu = asoc->pathmtu; __entry->rwnd = asoc->peer.rwnd; __entry->unack_data = asoc->unack_data; - -if (trace_sctp_probe_path_enabled ()) { -struct sctp_transport *sp; - -list_for_each_entry (sp, &asoc->peer.transport_addr_list, - transports) { -trace_sctp_probe_path (sp, asoc); - } - } ), TP_printk("asoc=%#llx mark=%#x bind_port=%d peer_port=%d pathmtu=%d "
net/sctp/outqueue.c +6 -0
@@ -36,6 +36,7 @@#include <net/sctp/sctp.h> #include <net/sctp/sm.h> #include <net/sctp/stream_sched.h> +#include <trace/events/sctp.h> /* Declare internal functions here. */ static int sctp_acked (struct sctp_sackhdr *sack,__u32 tsn);
@@ -1238,6 +1239,11 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)/* Grab the association's destination address list. */ transport_list = &asoc->peer.transport_addr_list; +/* SCTP path tracepoint for congestion control debugging. */ +list_for_each_entry (transport, transport_list, transports) { +trace_sctp_probe_path (transport, asoc); + } + sack_ctsn =ntohl (sack->cum_tsn_ack); gap_ack_blocks =ntohs (sack->num_gap_ack_blocks); asoc->stats.gapcnt += gap_ack_blocks;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 88/388 ACPI: EC: Reference count query handlers under lock
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 3df663a147fe077a6ee8444ec626738946e65547 ]
There is a race condition in acpi_ec_get_query_handler() theoretically allowing query handlers to go away before refernce counting them.
In order to avoid it, call kref_get() on query handlers under ec->mutex.
Also simplify the code a bit while at it.
--- drivers/acpi/ec.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/acpi/ec.c +4 -12
@@ -1043,29 +1043,21 @@ void acpi_ec_unblock_transactions(void)/* -------------------------------------------------------------------------- Event Management -------------------------------------------------------------------------- */ -static struct acpi_ec_query_handler * -acpi_ec_get_query_handler (struct acpi_ec_query_handler *handler) -{ -if (handler) -kref_get (&handler->kref); -return handler; -} -static struct acpi_ec_query_handler *acpi_ec_get_query_handler_by_value (struct acpi_ec *ec,u8 value) {struct acpi_ec_query_handler *handler; -bool found = false;mutex_lock (&ec->mutex);list_for_each_entry (handler, &ec->list, node) {if (value == handler->query_bit) { - found = true; -break ; +kref_get (&handler->kref); +mutex_unlock (&ec->mutex); +return handler; } }mutex_unlock (&ec->mutex); -return found ?acpi_ec_get_query_handler (handler) :NULL ; +return NULL ; }static void acpi_ec_query_handler_release (struct kref *kref)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 89/388 scsi: ufs: Make ufshcd_add_command_trace() easier to read
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit e4d2add7fd5bc64ee3e388eabe6b9e081cb42e11 ]
Since the lrbp->cmd expression occurs multiple times, introduce a new local variable to hold that pointer. This patch does not change any functionality.
--- drivers/scsi/ufs/ufshcd.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/scsi/ufs/ufshcd.c +6 -6
@@ -334,27 +334,27 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba,u8 opcode =0 ;u32 intr, doorbell;struct ufshcd_lrb *lrbp = &hba->lrb[tag]; +struct scsi_cmnd *cmd = lrbp->cmd;int transfer_len =-1 ;if (!trace_ufshcd_command_enabled ()) {/* trace UPIU W/O tracing command */ -if (lrbp->cmd) +if (cmd)ufshcd_add_cmd_upiu_trace (hba, tag, str);return ; } -if (lrbp->cmd) {/* data phase exists */ +if (cmd) {/* data phase exists */ /* trace UPIU also */ ufshcd_add_cmd_upiu_trace (hba, tag, str); - opcode = (u8)(*lrbp->cmd->cmnd); + opcode = cmd->cmnd[0 ];if ((opcode ==READ_10 ) || (opcode ==WRITE_10 )) {/* * Currently we only fully trace read(10) and write(10) * commands */ -if (lrbp->cmd->request && lrbp->cmd->request->bio) - lba = - lrbp->cmd->request->bio->bi_iter.bi_sector; +if (cmd->request && cmd->request->bio) + lba = cmd->request->bio->bi_iter.bi_sector; transfer_len =be32_to_cpu ( lrbp->ucd_req_ptr->sc.exp_data_transfer_len); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 90/388 scsi: ufs: Fix a race condition in the tracing code
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit eacf36f5bebde5089dddb3d5bfcbeab530b01f8a ]
Starting execution of a command before tracing a command may cause the completion handler to free data while it is being traced. Fix this race by tracing a command before it is submitted.
--- drivers/scsi/ufs/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +1 -1
@@ -1888,12 +1888,12 @@ void ufshcd_send_command(struct ufs_hba *hba, unsigned int task_tag) { hba->lrb[task_tag].issue_time_stamp =ktime_get (); hba->lrb[task_tag].compl_time_stamp =ktime_set (0 ,0 ); +ufshcd_add_command_trace (hba, task_tag,"send" );ufshcd_clk_scaling_start_busy (hba);__set_bit (task_tag, &hba->outstanding_reqs);ufshcd_writel (hba,1 << task_tag,REG_UTP_TRANSFER_REQ_DOOR_BELL );/* Make sure that doorbell is committed immediately */ wmb (); -ufshcd_add_command_trace (hba, task_tag,"send" ); }/**
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 91/388 drm/amd/display: Initialize DSC PPS variables to 0
In reply to Greg Kroah-HartmanFrom: David Francis <[email protected]>
[ Upstream commit b6adc57cff616da18ff8cff028d2ddf585c97334 ]
For DSC MST, sometimes monitors would break out in full-screen static. The issue traced back to the PPS generation code, where these variables were being used uninitialized and were picking up garbage.
memset to 0 to avoid this
--- drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c | 3 +++ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c | 3 +++ 2 files changed, 6 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c +3 -0
@@ -496,6 +496,9 @@ bool dp_set_dsc_pps_sdp(struct pipe_ctx *pipe_ctx, bool enable)struct dsc_config dsc_cfg;uint8_t dsc_packed_pps[128 ]; +memset (&dsc_cfg,0 ,sizeof (dsc_cfg)); +memset (dsc_packed_pps,0 ,128 ); +/* Enable DSC hw block */ dsc_cfg.pic_width = stream->timing.h_addressable + stream->timing.h_border_left + stream->timing.h_border_right; dsc_cfg.pic_height = stream->timing.v_addressable + stream->timing.v_border_top + stream->timing.v_border_bottom;
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c +3 -0
@@ -207,6 +207,9 @@ static bool dsc2_get_packed_pps(struct display_stream_compressor *dsc, const strstruct dsc_reg_values dsc_reg_vals;struct dsc_optc_config dsc_optc_cfg; +memset (&dsc_reg_vals,0 ,sizeof (dsc_reg_vals)); +memset (&dsc_optc_cfg,0 ,sizeof (dsc_optc_cfg)); +DC_LOG_DSC ("Getting packed DSC PPS for DSC Config:" );dsc_config_log (dsc, dsc_cfg);DC_LOG_DSC ("DSC Picture Parameter Set (PPS):" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 92/388 i2c: tegra: Prevent interrupt triggering after transfer timeout
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit b5d5605ca3cebb9b16c4f251635ef171ad18b80d ]
Potentially it is possible that interrupt may fire after transfer timeout. That may not end up well for the next transfer because interrupt handling may race with hardware resetting.
This is very unlikely to happen in practice, but anyway let's prevent the potential problem by enabling interrupt only at the moments when it is actually necessary to get some interrupt event.
--- drivers/i2c/busses/i2c-tegra.c | 70 +++++++++++++++++----------------- 1 file changed, 36 insertions(+), 34 deletions(-)
drivers/i2c/busses/i2c-tegra.c +36 -34
@@ -16,6 +16,7 @@#include <linux/interrupt.h> #include <linux/io.h> #include <linux/iopoll.h> +#include <linux/irq.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/of_device.h>
@@ -230,7 +231,6 @@ struct tegra_i2c_hw_feature {* @base_phys: physical base address of the I2C controller * @cont_id: I2C controller ID, used for packet header * @irq: IRQ number of transfer complete interrupt -* @irq_disabled: used to track whether or not the interrupt is enabled * @is_dvc: identifies the DVC I2C controller, has a different register layout * @msg_complete: transfer completion notifier * @msg_err: error code for completed message
@@ -240,7 +240,6 @@ struct tegra_i2c_hw_feature {* @bus_clk_rate: current I2C bus clock rate * @clk_divisor_non_hs_mode: clock divider for non-high-speed modes * @is_multimaster_mode: track if I2C controller is in multi-master mode -* @xfer_lock: lock to serialize transfer submission and processing * @tx_dma_chan: DMA transmit channel * @rx_dma_chan: DMA receive channel * @dma_phys: handle to DMA resources
@@ -260,7 +259,6 @@ struct tegra_i2c_dev {phys_addr_t base_phys;int cont_id;int irq; -bool irq_disabled;int is_dvc;struct completion msg_complete;int msg_err;
@@ -270,8 +268,6 @@ struct tegra_i2c_dev {u32 bus_clk_rate;u16 clk_divisor_non_hs_mode;bool is_multimaster_mode; -/* xfer_lock: lock to serialize transfer submission and processing */ -spinlock_t xfer_lock;struct dma_chan *tx_dma_chan;struct dma_chan *rx_dma_chan;dma_addr_t dma_phys;
@@ -790,11 +786,6 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev, bool clk_reinit)if (err)return err; -if (i2c_dev->irq_disabled) { - i2c_dev->irq_disabled = false; -enable_irq (i2c_dev->irq); - } -return 0 ; }
@@ -825,18 +816,12 @@ static irqreturn_t tegra_i2c_isr(int irq, void *dev_id) status =i2c_readl (i2c_dev,I2C_INT_STATUS ); -spin_lock (&i2c_dev->xfer_lock);if (status ==0 ) {dev_warn (i2c_dev->dev,"irq status 0 %08x %08x %08x\n" ,i2c_readl (i2c_dev,I2C_PACKET_TRANSFER_STATUS ),i2c_readl (i2c_dev,I2C_STATUS ),i2c_readl (i2c_dev,I2C_CNFG )); i2c_dev->msg_err |=I2C_ERR_UNKNOWN_INTERRUPT ; - -if (!i2c_dev->irq_disabled) { -disable_irq_nosync (i2c_dev->irq); - i2c_dev->irq_disabled = true; - } goto err; }
@@ -925,7 +910,6 @@ err:complete (&i2c_dev->msg_complete); done: -spin_unlock (&i2c_dev->xfer_lock);return IRQ_HANDLED ; }
@@ -999,6 +983,30 @@ out:i2c_writel (i2c_dev, val, reg); } +static unsigned long +tegra_i2c_wait_completion_timeout (struct tegra_i2c_dev *i2c_dev, +struct completion *complete, +unsigned int timeout_ms) +{ +unsigned long ret; + +enable_irq (i2c_dev->irq); + ret =wait_for_completion_timeout (complete, +msecs_to_jiffies (timeout_ms)); +disable_irq (i2c_dev->irq); + +/* +* There is a chance that completion may happen after IRQ +* synchronization, which is done by disable_irq(). +*/ +if (ret ==0 &&completion_done (complete)) { +dev_warn (i2c_dev->dev,"completion done after timeout\n" ); + ret =1 ; + } + +return ret; +} +static int tegra_i2c_issue_bus_clear (struct i2c_adapter *adap) {struct tegra_i2c_dev *i2c_dev =i2c_get_adapdata (adap);
@@ -1020,8 +1028,8 @@ static int tegra_i2c_issue_bus_clear(struct i2c_adapter *adap)i2c_writel (i2c_dev, reg,I2C_BUS_CLEAR_CNFG );tegra_i2c_unmask_irq (i2c_dev,I2C_INT_BUS_CLR_DONE ); - time_left =wait_for_completion_timeout (&i2c_dev->msg_complete, -msecs_to_jiffies (50 )); + time_left =tegra_i2c_wait_completion_timeout ( + i2c_dev, &i2c_dev->msg_complete,50 );if (time_left ==0 ) {dev_err (i2c_dev->dev,"timed out for bus clear\n" );return -ETIMEDOUT ;
@@ -1044,7 +1052,6 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,u32 packet_header;u32 int_mask;unsigned long time_left; -unsigned long flags;size_t xfer_size;u32 *buffer =NULL ;int err =0 ;
@@ -1075,7 +1082,6 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,*/ xfer_time +=DIV_ROUND_CLOSEST (((xfer_size *9 ) +2 ) *MSEC_PER_SEC , i2c_dev->bus_clk_rate); -spin_lock_irqsave (&i2c_dev->xfer_lock, flags); int_mask =I2C_INT_NO_ACK |I2C_INT_ARBITRATION_LOST ;tegra_i2c_unmask_irq (i2c_dev, int_mask);
@@ -1090,7 +1096,7 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,dev_err (i2c_dev->dev,"starting RX DMA failed, err %d\n" , err); - goto unlock; +return err; } }else {
@@ -1149,7 +1155,7 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,dev_err (i2c_dev->dev,"starting TX DMA failed, err %d\n" , err); - goto unlock; +return err; } }else {tegra_i2c_fill_tx_fifo (i2c_dev);
@@ -1169,15 +1175,10 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,dev_dbg (i2c_dev->dev,"unmasked irq: %02x\n" ,i2c_readl (i2c_dev,I2C_INT_MASK )); -unlock: -spin_unlock_irqrestore (&i2c_dev->xfer_lock, flags); -if (dma) { -if (err) -return err; + time_left =tegra_i2c_wait_completion_timeout ( + i2c_dev, &i2c_dev->dma_complete, xfer_time); - time_left =wait_for_completion_timeout (&i2c_dev->dma_complete, -msecs_to_jiffies (xfer_time));if (time_left ==0 ) {dev_err (i2c_dev->dev,"DMA transfer timeout\n" ); dmaengine_terminate_sync(i2c_dev->msg_read ?
@@ -1202,13 +1203,13 @@ unlock: i2c_dev->tx_dma_chan); } - time_left =wait_for_completion_timeout (&i2c_dev->msg_complete, -msecs_to_jiffies (xfer_time)); + time_left =tegra_i2c_wait_completion_timeout ( + i2c_dev, &i2c_dev->msg_complete, xfer_time); +tegra_i2c_mask_irq (i2c_dev, int_mask);if (time_left ==0 ) {dev_err (i2c_dev->dev,"i2c transfer timed out\n" ); -tegra_i2c_init (i2c_dev, true);return -ETIMEDOUT ; }
@@ -1568,7 +1569,6 @@ static int tegra_i2c_probe(struct platform_device *pdev)I2C_PACKET_HEADER_SIZE ;init_completion (&i2c_dev->msg_complete);init_completion (&i2c_dev->dma_complete); -spin_lock_init (&i2c_dev->xfer_lock);if (!i2c_dev->hw->has_single_clk_source) { fast_clk =devm_clk_get (&pdev->dev,"fast-clk" );
@@ -1644,6 +1644,8 @@ static int tegra_i2c_probe(struct platform_device *pdev) goto release_dma; } +irq_set_status_flags (i2c_dev->irq,IRQ_NOAUTOEN ); + ret =devm_request_irq (&pdev->dev, i2c_dev->irq, tegra_i2c_isr,0 ,dev_name (&pdev->dev), i2c_dev);if (ret) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 93/388 btrfs: tree-checker: Check leaf chunk item size
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit f6d2a5c263afca84646cf3300dc13061bedbd99e ]
Inspired by btrfs-progs github issue #208, where chunk item in chunk tree has invalid num_stripes (0).
Although that can already be caught by current btrfs_check_chunk_valid(), that function doesn't really check item size as it needs to handle chunk item in super block sys_chunk_array().
This patch will add two extra checks for chunk items in chunk tree:
- Basic chunk item size
If the item is smaller than btrfs_chunk (which already contains one stripe), exit right now as reading num_stripes may even go beyond eb boundary.
- Item size check against num_stripes
If item size doesn't match with calculated chunk size, then either the item size or the num_stripes is corrupted. Error out anyway.
--- fs/btrfs/tree-checker.c | 40 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-)
fs/btrfs/tree-checker.c +39 -1
@@ -674,6 +674,44 @@ int btrfs_check_chunk_valid(struct extent_buffer *leaf,return 0 ; } +/* +* Enhanced version of chunk item checker. +* +* The common btrfs_check_chunk_valid() doesn't check item size since it needs +* to work on super block sys_chunk_array which doesn't have full item ptr. +*/ +static int check_leaf_chunk_item (struct extent_buffer *leaf, +struct btrfs_chunk *chunk, +struct btrfs_key *key,int slot) +{ +int num_stripes; + +if (btrfs_item_size_nr (leaf, slot) <sizeof (struct btrfs_chunk )) { +chunk_err (leaf, chunk, key->offset, +"invalid chunk item size: have %u expect [%zu, %u)" , +btrfs_item_size_nr (leaf, slot), +sizeof (struct btrfs_chunk ), +BTRFS_LEAF_DATA_SIZE (leaf->fs_info)); +return -EUCLEAN ; + } + + num_stripes =btrfs_chunk_num_stripes (leaf, chunk); +/* Let btrfs_check_chunk_valid() handle this error type */ +if (num_stripes ==0 ) + goto out; + +if (btrfs_chunk_item_size (num_stripes) != +btrfs_item_size_nr (leaf, slot)) { +chunk_err (leaf, chunk, key->offset, +"invalid chunk item size: have %u expect %lu" , +btrfs_item_size_nr (leaf, slot), +btrfs_chunk_item_size (num_stripes)); +return -EUCLEAN ; + } +out: +return btrfs_check_chunk_valid (leaf, chunk, key->offset); +} + __printf(3, 4)__cold static void dev_item_err(const struct extent_buffer *eb, int slot,
@@ -1265,7 +1303,7 @@ static int check_leaf_item(struct extent_buffer *leaf,break ;case BTRFS_CHUNK_ITEM_KEY : chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk); - ret =btrfs_check_chunk_valid (leaf, chunk, key->offset); + ret =check_leaf_chunk_item (leaf, chunk, key, slot);break ;case BTRFS_DEV_ITEM_KEY : ret =check_dev_item (leaf, key, slot);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 94/388 dmaengine: zynqmp_dma: fix burst length configuration
In reply to Greg Kroah-HartmanFrom: Matthias Fend <[email protected]>
[ Upstream commit cc88525ebffc757e00cc5a5d61da6271646c7f5f ]
Since the dma engine expects the burst length register content as power of 2 value, the burst length needs to be converted first. Additionally add a burst length range check to avoid corrupting unrelated register bits.
--- drivers/dma/xilinx/zynqmp_dma.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
drivers/dma/xilinx/zynqmp_dma.c +15 -9
@@ -123,10 +123,12 @@/* Max transfer size per descriptor */ #define ZYNQMP_DMA_MAX_TRANS_LEN 0x40000000 +/* Max burst lengths */ +#define ZYNQMP_DMA_MAX_DST_BURST_LEN 32768U +#define ZYNQMP_DMA_MAX_SRC_BURST_LEN 32768U +/* Reset values for data attributes */ #define ZYNQMP_DMA_AXCACHE_VAL 0xF -#define ZYNQMP_DMA_ARLEN_RST_VAL 0xF -#define ZYNQMP_DMA_AWLEN_RST_VAL 0xF#define ZYNQMP_DMA_SRC_ISSUE_RST_VAL 0x1F
@@ -534,17 +536,19 @@ static void zynqmp_dma_handle_ovfl_int(struct zynqmp_dma_chan *chan, u32 status)static void zynqmp_dma_config (struct zynqmp_dma_chan *chan) { -u32 val; +u32 val, burst_val; val =readl (chan->regs +ZYNQMP_DMA_CTRL0 ); val |=ZYNQMP_DMA_POINT_TYPE_SG ;writel (val, chan->regs +ZYNQMP_DMA_CTRL0 ); val =readl (chan->regs +ZYNQMP_DMA_DATA_ATTR ); + burst_val =__ilog2_u32 (chan->src_burst_len); val = (val & ~ZYNQMP_DMA_ARLEN ) | - (chan->src_burst_len <<ZYNQMP_DMA_ARLEN_OFST ); + ((burst_val <<ZYNQMP_DMA_ARLEN_OFST ) &ZYNQMP_DMA_ARLEN ); + burst_val =__ilog2_u32 (chan->dst_burst_len); val = (val & ~ZYNQMP_DMA_AWLEN ) | - (chan->dst_burst_len <<ZYNQMP_DMA_AWLEN_OFST ); + ((burst_val <<ZYNQMP_DMA_AWLEN_OFST ) &ZYNQMP_DMA_AWLEN );writel (val, chan->regs +ZYNQMP_DMA_DATA_ATTR ); }
@@ -560,8 +564,10 @@ static int zynqmp_dma_device_config(struct dma_chan *dchan, {struct zynqmp_dma_chan *chan =to_chan (dchan); - chan->src_burst_len = config->src_maxburst; - chan->dst_burst_len = config->dst_maxburst; + chan->src_burst_len =clamp (config->src_maxburst,1U , +ZYNQMP_DMA_MAX_SRC_BURST_LEN ); + chan->dst_burst_len =clamp (config->dst_maxburst,1U , +ZYNQMP_DMA_MAX_DST_BURST_LEN );return 0 ; }
@@ -887,8 +893,8 @@ static int zynqmp_dma_chan_probe(struct zynqmp_dma_device *zdev,return PTR_ERR (chan->regs); chan->bus_width =ZYNQMP_DMA_BUS_WIDTH_64 ; - chan->dst_burst_len =ZYNQMP_DMA_AWLEN_RST_VAL ; - chan->src_burst_len =ZYNQMP_DMA_ARLEN_RST_VAL ; + chan->dst_burst_len =ZYNQMP_DMA_MAX_DST_BURST_LEN ; + chan->src_burst_len =ZYNQMP_DMA_MAX_SRC_BURST_LEN ; err =of_property_read_u32 (node,"xlnx,bus-width" , &chan->bus_width);if (err <0 ) {dev_err (&pdev->dev,"missing xlnx,bus-width property\n" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 95/388 s390/cpum_sf: Use kzalloc and minor changes
In reply to Greg Kroah-HartmanFrom: Thomas Richter <[email protected]>
[ Upstream commit 32dab6828c42f087439d3e2617dc7283546bd8f7 ]
Use kzalloc() to allocate auxiliary buffer structure initialized with all zeroes to avoid random value in trace output.
Avoid double access to SBD hardware flags.
--- arch/s390/kernel/perf_cpum_sf.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
arch/s390/kernel/perf_cpum_sf.c +4 -5
@@ -1429,8 +1429,8 @@ static int aux_output_begin(struct perf_output_handle *handle, idx = aux->empty_mark +1 ;for (i =0 ; i < range_scan; i++, idx++) { te =aux_sdb_trailer (aux, idx); - te->flags = te->flags & ~SDB_TE_BUFFER_FULL_MASK ; - te->flags = te->flags & ~SDB_TE_ALERT_REQ_MASK ; + te->flags &= ~(SDB_TE_BUFFER_FULL_MASK | +SDB_TE_ALERT_REQ_MASK ); te->overflow =0 ; }/* Save the position of empty SDBs */
@@ -1477,8 +1477,7 @@ static bool aux_set_alert(struct aux_buffer *aux, unsigned long alert_index, te =aux_sdb_trailer (aux, alert_index); do { orig_flags = te->flags; - orig_overflow = te->overflow; - *overflow = orig_overflow; + *overflow = orig_overflow = te->overflow; if (orig_flags & SDB_TE_BUFFER_FULL_MASK) { /* * SDB is already set by hardware.
@@ -1712,7 +1711,7 @@ static void *aux_buffer_setup(struct perf_event *event, void **pages, }/* Allocate aux_buffer struct for the event */ - aux =kmalloc (sizeof (struct aux_buffer ),GFP_KERNEL ); + aux =kzalloc (sizeof (struct aux_buffer ),GFP_KERNEL );if (!aux) goto no_aux; sfb = &aux->sfb;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 96/388 nfsd: Fix a soft lockup race in nfsd_file_mark_find_or_create()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 90d2f1da832fd23290ef0c0d964d97501e5e8553 ]
If nfsd_file_mark_find_or_create() keeps winning the race for the nfsd_file_fsnotify_group->mark_mutex against nfsd_file_mark_put() then it can soft lock up, since fsnotify_add_inode_mark() ends up always finding an existing entry.
--- fs/nfsd/filecache.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/nfsd/filecache.c +6 -2
@@ -133,9 +133,13 @@ nfsd_file_mark_find_or_create(struct nfsd_file *nf) struct nfsd_file_mark, nfm_mark));mutex_unlock (&nfsd_file_fsnotify_group->mark_mutex); -fsnotify_put_mark (mark); -if (likely (nfm)) +if (nfm) { +fsnotify_put_mark (mark);break ; + } +/* Avoid soft lockup race with nfsd_file_mark_put() */ +fsnotify_destroy_mark (mark, nfsd_file_fsnotify_group); +fsnotify_put_mark (mark); }else mutex_unlock (&nfsd_file_fsnotify_group->mark_mutex);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 97/388 powerpc/eeh: Only dump stack once if an MMIO loop is detected
In reply to Greg Kroah-HartmanFrom: Oliver O'Halloran <[email protected]>
[ Upstream commit 4e0942c0302b5ad76b228b1a7b8c09f658a1d58a ]
Many drivers don't check for errors when they get a 0xFFs response from an MMIO load. As a result after an EEH event occurs a driver can get stuck in a polling loop unless it some kind of internal timeout logic.
Currently EEH tries to detect and report stuck drivers by dumping a stack trace after eeh_dev_check_failure() is called EEH_MAX_FAILS times on an already frozen PE. The value of EEH_MAX_FAILS was chosen so that a dump would occur every few seconds if the driver was spinning in a loop. This results in a lot of spurious stack traces in the kernel log.
Fix this by limiting it to printing one stack trace for each PE freeze. If the driver is truely stuck the kernel's hung task detector is better suited to reporting the probelm anyway.
--- arch/powerpc/kernel/eeh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/eeh.c +1 -1
@@ -503,7 +503,7 @@ int eeh_dev_check_failure(struct eeh_dev *edev) rc =1 ;if (pe->state &EEH_PE_ISOLATED ) { pe->check_count++; -if (pe->check_count %EEH_MAX_FAILS ==0 ) { +if (pe->check_count ==EEH_MAX_FAILS ) { dn =pci_device_to_OF_node (dev);if (dn) location = of_get_property(dn, "ibm,loc-code",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 98/388 Bluetooth: btrtl: Use kvmalloc for FW allocations
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit 268d3636dfb22254324774de1f8875174b3be064 ]
Currently, kmemdup is applied to the firmware data, and it invokes kmalloc under the hood. The firmware size and patch_length are big (more than PAGE_SIZE), and on some low-end systems (like ASUS E202SA) kmalloc may fail to allocate a contiguous chunk under high memory usage and fragmentation:
Bluetooth: hci0: RTL: examining hci_ver=06 hci_rev=000a lmp_ver=06 lmp_subver=8821
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: loading rtl_bt/rtl8821a_fw.bin
kworker/u9:2: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 <stack trace follows>
As firmware load happens on each resume, Bluetooth will stop working after several iterations, when the kernel fails to allocate an order-4 page.
This patch replaces kmemdup with kvmalloc+memcpy. It's not required to have a contiguous chunk here, because it's not mapped to the device directly.
--- drivers/bluetooth/btrtl.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/bluetooth/btrtl.c +11 -9
@@ -370,11 +370,11 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev,* the end. */ len = patch_length; - buf =kmemdup (btrtl_dev->fw_data + patch_offset, patch_length, -GFP_KERNEL ); + buf =kvmalloc (patch_length,GFP_KERNEL );if (!buf)return -ENOMEM ; +memcpy (buf, btrtl_dev->fw_data + patch_offset, patch_length -4 );memcpy (buf + patch_length -4 , &epatch_info->fw_version,4 ); *_buf = buf;
@@ -460,8 +460,10 @@ static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff)if (ret <0 )return ret; ret = fw->size; - *buff =kmemdup (fw->data, ret,GFP_KERNEL ); -if (!*buff) + *buff =kvmalloc (fw->size,GFP_KERNEL ); +if (*buff) +memcpy (*buff, fw->data, ret); +else ret = -ENOMEM ;release_firmware (fw);
@@ -499,14 +501,14 @@ static int btrtl_setup_rtl8723b(struct hci_dev *hdev, goto out;if (btrtl_dev->cfg_len >0 ) { - tbuff =kzalloc (ret + btrtl_dev->cfg_len,GFP_KERNEL ); + tbuff =kvzalloc (ret + btrtl_dev->cfg_len,GFP_KERNEL );if (!tbuff) { ret = -ENOMEM ; goto out; }memcpy (tbuff, fw_data, ret); -kfree (fw_data); +kvfree (fw_data);memcpy (tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len); ret += btrtl_dev->cfg_len;
@@ -519,14 +521,14 @@ static int btrtl_setup_rtl8723b(struct hci_dev *hdev, ret =rtl_download_firmware (hdev, fw_data, ret); out: -kfree (fw_data); +kvfree (fw_data);return ret; }void btrtl_free (struct btrtl_device_info *btrtl_dev) { -kfree (btrtl_dev->fw_data); -kfree (btrtl_dev->cfg_data); +kvfree (btrtl_dev->fw_data); +kvfree (btrtl_dev->cfg_data);kfree (btrtl_dev); }EXPORT_SYMBOL_GPL (btrtl_free);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 99/388 tracing: Set kernel_stacks caller size properly
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit cbc3b92ce037f5e7536f6db157d185cd8b8f615c ]
I noticed when trying to use the trace-cmd python interface that reading the raw buffer wasn't working for kernel_stack events. This is because it uses a stubbed version of __dynamic_array that doesn't do the __data_loc trick and encode the length of the array into the field. Instead it just shows up as a size of 0. So change this to __array and set the len to FTRACE_STACK_ENTRIES since this is what we actually do in practice and matches how user_stack_trace works.
--- kernel/trace/trace_entries.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_entries.h +1 -1
@@ -174,7 +174,7 @@ FTRACE_ENTRY(kernel_stack, stack_entry,F_STRUCT (__field (int ,size ) - __dynamic_array(unsigned long, caller ) + __array( unsigned long, caller, FTRACE_STACK_ENTRIES ) ), F_printk("\t=> %ps\n\t=> %ps\n\t=> %ps\n"
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 100/388 ARM: 8948/1: Prevent OOB access in stacktrace
In reply to Greg Kroah-HartmanFrom: Vincent Whitchurch <[email protected]>
[ Upstream commit 40ff1ddb5570284e039e0ff14d7a859a73dc3673 ]
The stacktrace code can read beyond the stack size, when it attempts to read pt_regs from exception frames.
This can happen on normal, non-corrupt stacks. Since the unwind information in the extable is not correct for function prologues, the unwinding code can return data from the stack which is not actually the caller function address, and if in_entry_text() happens to succeed on this value, we can end up reading data from outside the task's stack when attempting to read pt_regs, since there is no bounds check.
Example:
[<8010e729>] (unwind_backtrace) from [<8010a9c9>] (show_stack+0x11/0x14) [<8010a9c9>] (show_stack) from [<8057d8d7>] (dump_stack+0x87/0xac) [<8057d8d7>] (dump_stack) from [<8012271d>] (tasklet_action_common.constprop.4+0xa5/0xa8) [<8012271d>] (tasklet_action_common.constprop.4) from [<80102333>] (__do_softirq+0x11b/0x31c) [<80102333>] (__do_softirq) from [<80122485>] (irq_exit+0xad/0xd8) [<80122485>] (irq_exit) from [<8015f3d7>] (__handle_domain_irq+0x47/0x84) [<8015f3d7>] (__handle_domain_irq) from [<8036a523>] (gic_handle_irq+0x43/0x78) [<8036a523>] (gic_handle_irq) from [<80101a49>] (__irq_svc+0x69/0xb4)
Exception stack(0xeb491f58 to 0xeb491fa0) 1f40: 7eb14794 00000000 1f60: ffffffff 008dd32c 008dd324 ffffffff 008dd314 0000002a 801011e4 eb490000 1f80: 0000002a 7eb1478c 50c5387d eb491fa8 80101001 8023d09c 40080033 ffffffff [<80101a49>] (__irq_svc) from [<8023d09c>] (do_pipe2+0x0/0xac) [<8023d09c>] (do_pipe2) from [<ffffffff>] (0xffffffff) Exception stack(0xeb491fc8 to 0xeb492010) 1fc0: 008dd314 0000002a 00511ad8 008de4c8 7eb14790 7eb1478c 1fe0: 00511e34 7eb14774 004c8557 76f44098 60080030 7eb14794 00000000 00000000 2000: 00000001 00000000 ea846c00 ea847cc0
In this example, the stack limit is 0xeb492000, but 16 bytes outside the stack have been read.
Fix it by adding bounds checks.
--- arch/arm/kernel/stacktrace.c | 2 ++ arch/arm/kernel/traps.c | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-)
arch/arm/kernel/stacktrace.c +2 -0
@@ -116,6 +116,8 @@ static int save_trace(struct stackframe *frame, void *d)return 0 ; regs = (struct pt_regs *)frame->sp; +if ((unsigned long )®s[1 ] >ALIGN (frame->sp,THREAD_SIZE )) +return 0 ; trace->entries[trace->nr_entries++] = regs->ARM_pc;
arch/arm/kernel/traps.c +4 -2
@@ -64,14 +64,16 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);void dump_backtrace_entry (unsigned long where,unsigned long from,unsigned long frame) { +unsigned long end = frame +4 +sizeof (struct pt_regs ); +#ifdef CONFIG_KALLSYMS printk ("[<%08lx>] (%ps) from [<%08lx>] (%pS)\n" , where, (void *)where, from, (void *)from);#else printk ("Function entered at [<%08lx>] from [<%08lx>]\n" , where, from);#endif -if (in_entry_text (from)) -dump_mem ("" ,"Exception stack" , frame +4 , frame +4 +sizeof (struct pt_regs )); +if (in_entry_text (from) && end <=ALIGN (frame,THREAD_SIZE )) +dump_mem ("" ,"Exception stack" , frame +4 , end); }void dump_backtrace_stm (u32 *stack,u32 instruction)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 101/388 ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter
In reply to Greg Kroah-HartmanFrom: Mert Dirik <[email protected]>
[ Upstream commit 5b362498a79631f283578b64bf6f4d15ed4cc19a ]
Add the required USB ID for running SMCWUSBT-G2 wireless adapter (SMC "EZ Connect g").
This device uses ar5523 chipset and requires firmware to be loaded. Even though pid of the device is 4507, this patch adds it as 4506 so that AR5523_DEVICE_UG macro can set the AR5523_FLAG_PRE_FIRMWARE flag for pid 4507.
--- drivers/net/wireless/ath/ar5523/ar5523.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/ath/ar5523/ar5523.c +2 -0
@@ -1770,6 +1770,8 @@ static const struct usb_device_id ar5523_id_table[] = {AR5523_DEVICE_UX (0x0846 ,0x4300 ),/* Netgear / WG111U */ AR5523_DEVICE_UG (0x0846 ,0x4250 ),/* Netgear / WG111T */ AR5523_DEVICE_UG (0x0846 ,0x5f00 ),/* Netgear / WPN111 */ +AR5523_DEVICE_UG (0x083a ,0x4506 ),/* SMC / EZ Connect +SMCWUSBT-G2 */ AR5523_DEVICE_UG (0x157e ,0x3006 ),/* Umedia / AR5523_1 */ AR5523_DEVICE_UX (0x157e ,0x3205 ),/* Umedia / AR5523_2 */ AR5523_DEVICE_UG(0x157e, 0x3006), /* Umedia / TEW444UBEU */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 102/388 ceph: ensure we have a new cap before continuing in fill_inode
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
[ Upstream commit 9a6bed4fe0c8bf57785cbc4db9f86086cb9b193d ]
If the caller passes in a NULL cap_reservation, and we can't allocate one then ensure that we fail gracefully.
--- fs/ceph/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ceph/inode.c +4 -1
@@ -754,8 +754,11 @@ static int fill_inode(struct inode *inode, struct page *locked_page, info_caps =le32_to_cpu (info->cap.caps);/* prealloc new cap struct */ -if (info_caps &&ceph_snap (inode) ==CEPH_NOSNAP ) +if (info_caps &&ceph_snap (inode) ==CEPH_NOSNAP ) { new_cap =ceph_get_cap (mdsc, caps_reservation); +if (!new_cap) +return -ENOMEM ; + }/* * prealloc xattr data, if it looks like we'll need it. only
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 103/388 selftests/ftrace: fix glob selftest
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
[ Upstream commit af4ddd607dff7aabd466a4a878e01b9f592a75ab ]
test.d/ftrace/func-filter-glob.tc is failing on s390 because it has ARCH_INLINE_SPIN_LOCK and friends set to 'y'. So the usual __raw_spin_lock symbol isn't in the ftrace function list. Change '*aw*lock' to '*spin*lock' which would hopefully match some of the locking functions on all platforms.
--- .../testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc +1 -1
@@ -30,7 +30,7 @@ ftrace_filter_check '*schedule*' '^.*schedule.*$' ftrace_filter_check 'schedule*' '^schedule.*$' # filter by *mid*end -ftrace_filter_check '*aw*lock' '.*aw.*lock$' +ftrace_filter_check '*pin*lock' '.*pin.*lock$' # filter by start*mid* ftrace_filter_check 'mutex*try*' '^mutex.*try.*'
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 104/388 tools/power/x86/intel_pstate_tracer: changes for python 3 compatibility
In reply to Greg Kroah-HartmanFrom: Doug Smythies <[email protected]>
[ Upstream commit e749e09db30c38f1a275945814b0109e530a07b0 ]
Some syntax needs to be more rigorous for python 3. Backwards compatibility tested with python 2.7
--- .../intel_pstate_tracer.py | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-)
tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py +11 -11
@@ -11,11 +11,11 @@ then this utility enables and collects trace data for a user specified interval and generates performance plots. Prerequisites: - Python version 2.7.x + Python version 2.7.x or higher gnuplot 5.0 or higher - gnuplot-py 1.8 + gnuplot-py 1.8 or higher (Most of the distributions have these required packages. They may be called - gnuplot-py, phython-gnuplot. ) + gnuplot-py, phython-gnuplot or phython3-gnuplot, gnuplot-nox, ... ) HWP (Hardware P-States are disabled) Kernel config for Linux trace is enabled
@@ -181,7 +181,7 @@ def plot_pstate_cpu_with_sample(): g_plot('set xlabel "Samples"') g_plot('set ylabel "P-State"') g_plot('set title "{} : cpu pstate vs. sample : {:%F %H:%M}"'.format(testname, datetime.now())) - title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ') + title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ') plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_SAMPLE, C_TO) g_plot('title_list = "{}"'.format(title_list)) g_plot(plot_str)
@@ -198,7 +198,7 @@ def plot_pstate_cpu(): # the following command is really cool, but doesn't work with the CPU masking option because it aborts on the first missing file. # plot_str = 'plot for [i=0:*] file=sprintf("cpu%03d.csv",i) title_s=sprintf("cpu%03d",i) file using 16:7 pt 7 ps 1 title title_s' # - title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ') + title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ') plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_TO) g_plot('title_list = "{}"'.format(title_list)) g_plot(plot_str)
@@ -212,7 +212,7 @@ def plot_load_cpu(): g_plot('set ylabel "CPU load (percent)"') g_plot('set title "{} : cpu loads : {:%F %H:%M}"'.format(testname, datetime.now())) - title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ') + title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ') plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_LOAD) g_plot('title_list = "{}"'.format(title_list)) g_plot(plot_str)
@@ -226,7 +226,7 @@ def plot_frequency_cpu(): g_plot('set ylabel "CPU Frequency (GHz)"') g_plot('set title "{} : cpu frequencies : {:%F %H:%M}"'.format(testname, datetime.now())) - title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ') + title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ') plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_FREQ) g_plot('title_list = "{}"'.format(title_list)) g_plot(plot_str)
@@ -241,7 +241,7 @@ def plot_duration_cpu(): g_plot('set ylabel "Timer Duration (MilliSeconds)"') g_plot('set title "{} : cpu durations : {:%F %H:%M}"'.format(testname, datetime.now())) - title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ') + title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ') plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_DURATION) g_plot('title_list = "{}"'.format(title_list)) g_plot(plot_str)
@@ -255,7 +255,7 @@ def plot_scaled_cpu(): g_plot('set ylabel "Scaled Busy (Unitless)"') g_plot('set title "{} : cpu scaled busy : {:%F %H:%M}"'.format(testname, datetime.now())) - title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ') + title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ') plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_SCALED) g_plot('title_list = "{}"'.format(title_list)) g_plot(plot_str)
@@ -269,7 +269,7 @@ def plot_boost_cpu(): g_plot('set ylabel "CPU IO Boost (percent)"') g_plot('set title "{} : cpu io boost : {:%F %H:%M}"'.format(testname, datetime.now())) - title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ') + title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ') plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_BOOST) g_plot('title_list = "{}"'.format(title_list)) g_plot(plot_str)
@@ -283,7 +283,7 @@ def plot_ghz_cpu(): g_plot('set ylabel "TSC Frequency (GHz)"') g_plot('set title "{} : cpu TSC Frequencies (Sanity check calculation) : {:%F %H:%M}"'.format(testname, datetime.now())) - title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ') + title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ') plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_GHZ) g_plot('title_list = "{}"'.format(title_list)) g_plot(plot_str)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 105/388 Bluetooth: Fix refcount use-after-free issue
In reply to Greg Kroah-HartmanFrom: Manish Mandlik <[email protected]>
[ Upstream commit 6c08fc896b60893c5d673764b0668015d76df462 ]
There is no lock preventing both l2cap_sock_release() and chan->ops->close() from running at the same time.
If we consider Thread A running l2cap_chan_timeout() and Thread B running l2cap_sock_release(), expected behavior is:
A::l2cap_chan_timeout()->l2cap_chan_close()->l2cap_sock_teardown_cb() A::l2cap_chan_timeout()->l2cap_sock_close_cb()->l2cap_sock_kill() B::l2cap_sock_release()->sock_orphan() B::l2cap_sock_release()->l2cap_sock_kill()
where,sock_orphan() clears "sk->sk_socket" and l2cap_sock_teardown_cb() marks socket as SOCK_ZAPPED.
In l2cap_sock_kill(), there is an "if-statement" that checks if both sock_orphan() and sock_teardown() has been run i.e. sk->sk_socket is NULL and socket is marked as SOCK_ZAPPED. Socket is killed if the condition is satisfied.
In the race condition, following occurs:
A::l2cap_chan_timeout()->l2cap_chan_close()->l2cap_sock_teardown_cb() B::l2cap_sock_release()->sock_orphan() B::l2cap_sock_release()->l2cap_sock_kill() A::l2cap_chan_timeout()->l2cap_sock_close_cb()->l2cap_sock_kill()
In this scenario, "if-statement" is true in both B::l2cap_sock_kill() and A::l2cap_sock_kill() and we hit "refcount: underflow; use-after-free" bug.
Similar condition occurs at other places where teardown/sock_kill is happening:
l2cap_disconnect_rsp()->l2cap_chan_del()->l2cap_sock_teardown_cb() l2cap_disconnect_rsp()->l2cap_sock_close_cb()->l2cap_sock_kill()
l2cap_conn_del()->l2cap_chan_del()->l2cap_sock_teardown_cb() l2cap_conn_del()->l2cap_sock_close_cb()->l2cap_sock_kill()
l2cap_disconnect_req()->l2cap_chan_del()->l2cap_sock_teardown_cb() l2cap_disconnect_req()->l2cap_sock_close_cb()->l2cap_sock_kill()
l2cap_sock_cleanup_listen()->l2cap_chan_close()->l2cap_sock_teardown_cb() l2cap_sock_cleanup_listen()->l2cap_sock_kill()
Protect teardown/sock_kill and orphan/sock_kill by adding hold_lock on l2cap channel to ensure that the socket is killed only after marked as zapped and orphan.
--- net/bluetooth/l2cap_core.c | 26 +++++++++++++++----------- net/bluetooth/l2cap_sock.c | 16 +++++++++++++--- 2 files changed, 28 insertions(+), 14 deletions(-)
net/bluetooth/l2cap_core.c +15 -11
@@ -419,6 +419,9 @@ static void l2cap_chan_timeout(struct work_struct *work)BT_DBG ("chan %p state %s" , chan,state_to_string (chan->state));mutex_lock (&conn->chan_lock); +/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling +* this work. No need to call l2cap_chan_hold(chan) here again. +*/ l2cap_chan_lock (chan);if (chan->state ==BT_CONNECTED || chan->state ==BT_CONFIG )
@@ -431,12 +434,12 @@ static void l2cap_chan_timeout(struct work_struct *work)l2cap_chan_close (chan, reason); -l2cap_chan_unlock (chan); - chan->ops->close (chan); -mutex_unlock (&conn->chan_lock); +l2cap_chan_unlock (chan);l2cap_chan_put (chan); + +mutex_unlock (&conn->chan_lock); }struct l2cap_chan *l2cap_chan_create (void )
@@ -1734,9 +1737,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)l2cap_chan_del (chan, err); -l2cap_chan_unlock (chan); - chan->ops->close (chan); + +l2cap_chan_unlock (chan);l2cap_chan_put (chan); }
@@ -4355,6 +4358,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,return 0 ; } +l2cap_chan_hold (chan);l2cap_chan_lock (chan); rsp.dcid =cpu_to_le16 (chan->scid);
@@ -4363,12 +4367,11 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, chan->ops->set_shutdown (chan); -l2cap_chan_hold (chan);l2cap_chan_del (chan,ECONNRESET ); -l2cap_chan_unlock (chan); - chan->ops->close (chan); + +l2cap_chan_unlock (chan);l2cap_chan_put (chan);mutex_unlock (&conn->chan_lock);
@@ -4400,20 +4403,21 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,return 0 ; } +l2cap_chan_hold (chan);l2cap_chan_lock (chan);if (chan->state !=BT_DISCONN ) {l2cap_chan_unlock (chan); +l2cap_chan_put (chan);mutex_unlock (&conn->chan_lock);return 0 ; } -l2cap_chan_hold (chan);l2cap_chan_del (chan,0 ); -l2cap_chan_unlock (chan); - chan->ops->close (chan); + +l2cap_chan_unlock (chan);l2cap_chan_put (chan);mutex_unlock (&conn->chan_lock);
net/bluetooth/l2cap_sock.c +13 -3
@@ -1042,7 +1042,7 @@ done: }/* Kill socket (only if zapped and orphan) -* Must be called on unlocked socket. +* Must be called on unlocked socket, with l2cap channel lock. */ static void l2cap_sock_kill (struct sock *sk) {
@@ -1203,8 +1203,15 @@ static int l2cap_sock_release(struct socket *sock) err =l2cap_sock_shutdown (sock,2 ); +l2cap_chan_hold (l2cap_pi (sk)->chan); +l2cap_chan_lock (l2cap_pi (sk)->chan); +sock_orphan (sk);l2cap_sock_kill (sk); + +l2cap_chan_unlock (l2cap_pi (sk)->chan); +l2cap_chan_put (l2cap_pi (sk)->chan); +return err; }
@@ -1222,12 +1229,15 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)BT_DBG ("child chan %p state %s" , chan,state_to_string (chan->state)); +l2cap_chan_hold (chan);l2cap_chan_lock (chan); +__clear_chan_timer (chan);l2cap_chan_close (chan,ECONNRESET ); -l2cap_chan_unlock (chan); -l2cap_sock_kill (sk); + +l2cap_chan_unlock (chan); +l2cap_chan_put (chan); } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 106/388 mm/swapfile.c: swap_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 10c8d69f314d557d94d74ec492575ae6a4f1eb1c ]
If seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
In Aug 2018 NeilBrown noticed commit 1f4aace60b0e ("fs/seq_file.c:
simplify seq_file iteration code and interface") "Some ->next functions do not increment *pos when they return NULL... Note that such ->next functions are buggy and should be fixed. A simple demonstration is
dd if=/proc/swaps bs=1000 skip=1
Choose any block size larger than the size of /proc/swaps. This will always show the whole last line of /proc/swaps"
Described problem is still actual. If you make lseek into middle of last output line following read will output end of last line and whole last line once again.
$ dd if=/proc/swaps bs=1 # usual output Filename Type Size Used Priority /dev/dm-0 partition 4194812 97536 -2 104+0 records in 104+0 records out 104 bytes copied
$ dd if=/proc/swaps bs=40 skip=1 # last line was generated twice dd: /proc/swaps: cannot skip to specified offset v/dm-0 partition 4194812 97536 -2 /dev/dm-0 partition 4194812 97536 -2 3+1 records in 3+1 records out 131 bytes copied
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- mm/swapfile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/swapfile.c +1 -1
@@ -2737,10 +2737,10 @@ static void *swap_next(struct seq_file *swap, void *v, loff_t *pos)else type = si->type +1 ; + ++(*pos);for (; (si =swap_type_to_swap_info (type)); type++) {if (!(si->flags &SWP_USED ) || !si->swap_map)continue ; - ++*pos;return si; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 107/388 mm: pagewalk: fix termination condition in walk_pte_range()
In reply to Greg Kroah-HartmanFrom: Steven Price <[email protected]>
[ Upstream commit c02a98753e0a36ba65a05818626fa6adeb4e7c97 ]
If walk_pte_range() is called with a 'end' argument that is beyond the last page of memory (e.g. ~0UL) then the comparison between 'addr' and 'end' will always fail and the loop will be infinite. Instead change the comparison to >= while accounting for overflow.
--- mm/pagewalk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/pagewalk.c +2 -2
@@ -16,9 +16,9 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, err = ops->pte_entry (pte, addr, addr +PAGE_SIZE , walk);if (err)break ; - addr +=PAGE_SIZE ; -if (addr == end) +if (addr >= end -PAGE_SIZE )break ; + addr +=PAGE_SIZE ; pte++; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 108/388 Bluetooth: prefetch channel before killing sock
In reply to Greg Kroah-HartmanFrom: Hillf Danton <[email protected]>
[ Upstream commit 2a154903cec20fb64ff4d7d617ca53c16f8fd53a ]
Prefetch channel before killing sock in order to fix UAF like
BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212 Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751
--- net/bluetooth/l2cap_sock.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/bluetooth/l2cap_sock.c +6 -4
@@ -1193,6 +1193,7 @@ static int l2cap_sock_release(struct socket *sock) {struct sock *sk = sock->sk;int err; +struct l2cap_chan *chan;BT_DBG ("sock %p, sk %p" , sock, sk);
@@ -1202,15 +1203,16 @@ static int l2cap_sock_release(struct socket *sock)bt_sock_unlink (&l2cap_sk_list, sk); err =l2cap_sock_shutdown (sock,2 ); + chan =l2cap_pi (sk)->chan; -l2cap_chan_hold (l2cap_pi (sk)->chan); -l2cap_chan_lock (l2cap_pi (sk)->chan); +l2cap_chan_hold (chan); +l2cap_chan_lock (chan);sock_orphan (sk);l2cap_sock_kill (sk); -l2cap_chan_unlock (l2cap_pi (sk)->chan); -l2cap_chan_put (l2cap_pi (sk)->chan); +l2cap_chan_unlock (chan); +l2cap_chan_put (chan);return err; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 109/388 KVM: fix overflow of zero page refcount with ksm running
In reply to Greg Kroah-HartmanFrom: Zhuang Yanying <[email protected]>
[ Upstream commit 7df003c85218b5f5b10a7f6418208f31e813f38f ]
We are testing Virtual Machine with KSM on v5.4-rc2 kernel, and found the zero_page refcount overflow.
The cause of refcount overflow is increased in try_async_pf (get_user_page) without being decreased in mmu_set_spte() while handling ept violation.
In kvm_release_pfn_clean(), only unreserved page will call put_page. However, zero page is reserved.
So, as well as creating and destroy vm, the refcount of zero page will continue to increase until it overflows.
step1:
echo 10000 > /sys/kernel/pages_to_scan/pages_to_scan echo 1 > /sys/kernel/pages_to_scan/run
echo 1 > /sys/kernel/pages_to_scan/use_zero_pages
step2:
just create several normal qemu kvm vms.
And destroy it after 10s.
Repeat this action all the time.
After a long period of time, all domains hang because of the refcount of zero page overflow.
Qemu print error log as follow:
…
error: kvm run failed Bad address
EAX=00006cdc EBX=00000008 ECX=80202001 EDX=078bfbfd ESI=ffffffff EDI=00000000 EBP=00000008 ESP=00006cc4 EIP=000efd75 EFL=00010002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA]
CS =0008 00000000 ffffffff 00c09b00 DPL=0 CS32 [-RA]
SS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] FS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] GS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA]
LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT
TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy
GDT= 000f7070 00000037
IDT= 000f70ae 00000000
CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
Code=00 01 00 00 00 e9 e8 00 00 00 c7 05 4c 55 0f 00 01 00 00 00 <8b> 35 00 00 01 00 8b 3d 04 00 01 00 b8 d8 d3 00 00 c1 e0 08 0c ea a3 00 00 01 00 c7 05 04 …
Meanwhile, a kernel warning is departed.
[40914.836375] WARNING: CPU: 3 PID: 82067 at ./include/linux/mm.h:987 try_get_page+0x1f/0x30 [40914.836412] CPU: 3 PID: 82067 Comm: CPU 0/KVM Kdump: loaded Tainted: G OE 5.2.0-rc2 #5 [40914.836415] RIP: 0010:try_get_page+0x1f/0x30 [40914.836417] Code: 40 00 c3 0f 1f 84 00 00 00 00 00 48 8b 47 08 a8 01 75 11 8b 47 34 85 c0 7e 10 f0 ff 47 34 b8 01 00 00 00 c3 48 8d 78 ff eb e9 <0f> 0b 31 c0 c3 66 90 66 2e 0f 1f 84 00 0 0 00 00 00 48 8b 47 08 a8 [40914.836418] RSP: 0018:ffffb4144e523988 EFLAGS: 00010286 [40914.836419] RAX: 0000000080000000 RBX: 0000000000000326 RCX: 0000000000000000 [40914.836420] RDX: 0000000000000000 RSI: 00004ffdeba10000 RDI: ffffdf07093f6440 [40914.836421] RBP: ffffdf07093f6440 R08: 800000424fd91225 R09: 0000000000000000 [40914.836421] R10: ffff9eb41bfeebb8 R11: 0000000000000000 R12: ffffdf06bbd1e8a8 [40914.836422] R13: 0000000000000080 R14: 800000424fd91225 R15: ffffdf07093f6440 [40914.836423] FS: 00007fb60ffff700(0000) GS:ffff9eb4802c0000(0000) knlGS:0000000000000000 [40914.836425] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [40914.836426] CR2: 0000000000000000 CR3: 0000002f220e6002 CR4: 00000000003626e0 [40914.836427] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [40914.836427] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [40914.836428] Call Trace: [40914.836433] follow_page_pte+0x302/0x47b [40914.836437] __get_user_pages+0xf1/0x7d0 [40914.836441] ? irq_work_queue+0x9/0x70 [40914.836443] get_user_pages_unlocked+0x13f/0x1e0 [40914.836469] __gfn_to_pfn_memslot+0x10e/0x400 [kvm] [40914.836486] try_async_pf+0x87/0x240 [kvm] [40914.836503] tdp_page_fault+0x139/0x270 [kvm] [40914.836523] kvm_mmu_page_fault+0x76/0x5e0 [kvm] [40914.836588] vcpu_enter_guest+0xb45/0x1570 [kvm] [40914.836632] kvm_arch_vcpu_ioctl_run+0x35d/0x580 [kvm] [40914.836645] kvm_vcpu_ioctl+0x26e/0x5d0 [kvm] [40914.836650] do_vfs_ioctl+0xa9/0x620 [40914.836653] ksys_ioctl+0x60/0x90 [40914.836654] __x64_sys_ioctl+0x16/0x20 [40914.836658] do_syscall_64+0x5b/0x180 [40914.836664] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [40914.836666] RIP: 0033:0x7fb61cb6bfc7
--- virt/kvm/kvm_main.c | 1 + 1 file changed, 1 insertion(+)
virt/kvm/kvm_main.c +1 -0
@@ -185,6 +185,7 @@ bool kvm_is_reserved_pfn(kvm_pfn_t pfn)*/ if (pfn_valid (pfn))return PageReserved (pfn_to_page (pfn)) && + !is_zero_pfn (pfn) && !kvm_is_zone_device_pfn (pfn);return true;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 110/388 ALSA: hda: Clear RIRB status before reading WP
In reply to Greg Kroah-HartmanFrom: Mohan Kumar <[email protected]>
[ Upstream commit 6d011d5057ff88ee556c000ac6fe0be23bdfcd72 ]
RIRB interrupt status getting cleared after the write pointer is read causes a race condition, where last response(s) into RIRB may remain unserviced by IRQ, eventually causing azx_rirb_get_response to fall back to polling mode. Clearing the RIRB interrupt status ahead of write pointer access ensures that this condition is avoided.
--- sound/pci/hda/hda_controller.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
sound/pci/hda/hda_controller.c +9 -2
@@ -1159,16 +1159,23 @@ irqreturn_t azx_interrupt(int irq, void *dev_id)if (snd_hdac_bus_handle_stream_irq (bus, status, stream_update)) active = true; -/* clear rirb int */ status =azx_readb (chip,RIRBSTS );if (status &RIRB_INT_MASK ) { +/* +* Clearing the interrupt status here ensures that no +* interrupt gets masked after the RIRB wp is read in +* snd_hdac_bus_update_rirb. This avoids a possible +* race condition where codec response in RIRB may +* remain unserviced by IRQ, eventually falling back +* to polling mode in azx_rirb_get_response. +*/ +azx_writeb (chip,RIRBSTS ,RIRB_INT_MASK ); active = true;if (status &RIRB_INT_RESPONSE ) {if (chip->driver_caps &AZX_DCAPS_CTX_WORKAROUND )udelay (80 );snd_hdac_bus_update_rirb (bus); } -azx_writeb (chip,RIRBSTS ,RIRB_INT_MASK ); } }while (active && ++repeat <10 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 111/388 skbuff: fix a data race in skb_queue_len()
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit 86b18aaa2b5b5bb48e609cd591b3d2d0fdbe0442 ]
sk_buff.qlen can be accessed concurrently as noticed by KCSAN,
BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_dgram_sendmsg
read to 0xffff8a1b1d8a81c0 of 4 bytes by task 5371 on cpu 96:
unix_dgram_sendmsg+0x9a9/0xb70 include/linux/skbuff.h:1821 net/unix/af_unix.c:1761 ____sys_sendmsg+0x33e/0x370 ___sys_sendmsg+0xa6/0xf0 __sys_sendmsg+0x69/0xf0 __x64_sys_sendmsg+0x51/0x70 do_syscall_64+0x91/0xb47 entry_SYSCALL_64_after_hwframe+0x49/0xbe
write to 0xffff8a1b1d8a81c0 of 4 bytes by task 1 on cpu 99:
__skb_try_recv_from_queue+0x327/0x410 include/linux/skbuff.h:2029 __skb_try_recv_datagram+0xbe/0x220 unix_dgram_recvmsg+0xee/0x850 ____sys_recvmsg+0x1fb/0x210 ___sys_recvmsg+0xa2/0xf0 __sys_recvmsg+0x66/0xf0 __x64_sys_recvmsg+0x51/0x70 do_syscall_64+0x91/0xb47 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Since only the read is operating as lockless, it could introduce a logic bug in unix_recvq_full() due to the load tearing. Fix it by adding a lockless variant of skb_queue_len() and unix_recvq_full() where READ_ONCE() is on the read while WRITE_ONCE() is on the write similar to the commit d7d16a89350a ("net: add skb_queue_empty_lockless()").
--- include/linux/skbuff.h | 14 +++++++++++++- net/unix/af_unix.c | 11 +++++++++-- 2 files changed, 22 insertions(+), 3 deletions(-)
include/linux/skbuff.h +13 -1
@@ -1816,6 +1816,18 @@ static inline __u32 skb_queue_len(const struct sk_buff_head *list_)return list_->qlen; } +/** +* skb_queue_len_lockless - get queue length +* @list_: list to measure +* +* Return the length of an &sk_buff queue. +* This variant can be used in lockless contexts. +*/ +static inline __u32 skb_queue_len_lockless (const struct sk_buff_head *list_) +{ +return READ_ONCE (list_->qlen); +} +/** * __skb_queue_head_init - initialize non-spinlock portions of sk_buff_head * @list: queue to initialize
@@ -2021,7 +2033,7 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list) {struct sk_buff *next, *prev; - list->qlen--; +WRITE_ONCE (list->qlen, list->qlen -1 ); next = skb->next; prev = skb->prev; skb->next = skb->prev =NULL ;
net/unix/af_unix.c +9 -2
@@ -189,11 +189,17 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk)return unix_peer (osk) ==NULL ||unix_our_peer (sk, osk); } -static inline int unix_recvq_full (struct sock const *sk) +static inline int unix_recvq_full (const struct sock *sk) {return skb_queue_len (&sk->sk_receive_queue) > sk->sk_max_ack_backlog; } +static inline int unix_recvq_full_lockless (const struct sock *sk) +{ +return skb_queue_len_lockless (&sk->sk_receive_queue) > +READ_ONCE (sk->sk_max_ack_backlog); +} +struct sock *unix_peer_get (struct sock *s) {struct sock *peer;
@@ -1724,7 +1730,8 @@ restart_locked:* - unix_peer(sk) == sk by time of get but disconnected before lock */ if (other != sk && -unlikely (unix_peer (other) != sk &&unix_recvq_full (other))) { +unlikely (unix_peer (other) != sk && +unix_recvq_full_lockless (other))) {if (timeo) { timeo =unix_wait_for_peer (other, timeo);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 112/388 nfsd: Fix a perf warning
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit a9ceb060b3cf37987b6162223575eaf4f4e0fc36 ]
perf does not know how to deal with a __builtin_bswap32() call, and complains. All other functions just store the xid etc in host endian form, so let's do that in the tracepoint for nfsd_file_acquire too.
--- fs/nfsd/trace.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
fs/nfsd/trace.h +6 -6
@@ -228,7 +228,7 @@ TRACE_EVENT(nfsd_file_acquire,TP_ARGS (rqstp, hash, inode, may_flags, nf, status),TP_STRUCT__entry ( - __field(__be32, xid) + __field(u32, xid) __field(unsigned int, hash) __field(void *, inode) __field(unsigned int, may_flags)
@@ -236,11 +236,11 @@ TRACE_EVENT(nfsd_file_acquire, __field(unsigned long, nf_flags) __field(unsigned char, nf_may) __field(struct file *, nf_file) - __field(__be32, status) + __field(u32, status) ),TP_fast_assign ( - __entry->xid = rqstp->rq_xid; + __entry->xid = be32_to_cpu(rqstp->rq_xid); __entry->hash = hash; __entry->inode = inode; __entry->may_flags = may_flags;
@@ -248,15 +248,15 @@ TRACE_EVENT(nfsd_file_acquire, __entry->nf_flags = nf ? nf->nf_flags :0 ; __entry->nf_may = nf ? nf->nf_may :0 ; __entry->nf_file = nf ? nf->nf_file :NULL ; - __entry->status = status; + __entry->status =be32_to_cpu (status); ),TP_printk ("xid=0x%x hash=0x%x inode=0x%p may_flags=%s ref=%d nf_flags=%s nf_may=%s nf_file=0x%p status=%u" , -be32_to_cpu (__entry->xid), __entry->hash, __entry->inode, + __entry->xid, __entry->hash, __entry->inode,show_nf_may (__entry->may_flags), __entry->nf_ref,show_nf_flags (__entry->nf_flags),show_nf_may (__entry->nf_may), __entry->nf_file, -be32_to_cpu (__entry->status)) + __entry->status) ); DECLARE_EVENT_CLASS(nfsd_file_search_class,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 113/388 drm/amd/display: fix workaround for incorrect double buffer register for DLG ADL and TTU
In reply to Greg Kroah-HartmanFrom: Tony Cheng <[email protected]>
[ Upstream commit 85e148fb963d27152a14e6d399a47aed9bc99c15 ]
[Why]
these registers should have been double buffered. SW workaround we will have SW program the more aggressive (lower) values whenever we are upating this register, so we will not have underflow at expense of less optimzal request pattern.
[How]
there is a driver bug where we don't check for 0, which is uninitialzed HW default. since 0 is smaller than any value we need to program, driver end up with not programming these registers
--- .../gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c | 35 +++++++++++++------ 1 file changed, 25 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c +25 -10
@@ -73,32 +73,47 @@ void apply_DEDCN21_142_wa_for_hostvm_deadline( struct _vcs_dpi_display_dlg_regs_st *dlg_attr) {struct dcn21_hubp *hubp21 =TO_DCN21_HUBP (hubp); -uint32_t cur_value; +uint32_t refcyc_per_vm_group_vblank; +uint32_t refcyc_per_vm_req_vblank; +uint32_t refcyc_per_vm_group_flip; +uint32_t refcyc_per_vm_req_flip; +const uint32_t uninitialized_hw_default =0 ; -REG_GET (VBLANK_PARAMETERS_5 ,REFCYC_PER_VM_GROUP_VBLANK , &cur_value); -if (cur_value > dlg_attr->refcyc_per_vm_group_vblank) +REG_GET (VBLANK_PARAMETERS_5 , +REFCYC_PER_VM_GROUP_VBLANK , &refcyc_per_vm_group_vblank); + +if (refcyc_per_vm_group_vblank == uninitialized_hw_default || + refcyc_per_vm_group_vblank > dlg_attr->refcyc_per_vm_group_vblank)REG_SET (VBLANK_PARAMETERS_5 ,0 ,REFCYC_PER_VM_GROUP_VBLANK , dlg_attr->refcyc_per_vm_group_vblank);REG_GET (VBLANK_PARAMETERS_6 , -REFCYC_PER_VM_REQ_VBLANK , - &cur_value); -if (cur_value > dlg_attr->refcyc_per_vm_req_vblank) +REFCYC_PER_VM_REQ_VBLANK , &refcyc_per_vm_req_vblank); + +if (refcyc_per_vm_req_vblank == uninitialized_hw_default || + refcyc_per_vm_req_vblank > dlg_attr->refcyc_per_vm_req_vblank)REG_SET (VBLANK_PARAMETERS_6 ,0 ,REFCYC_PER_VM_REQ_VBLANK , dlg_attr->refcyc_per_vm_req_vblank); -REG_GET (FLIP_PARAMETERS_3 ,REFCYC_PER_VM_GROUP_FLIP , &cur_value); -if (cur_value > dlg_attr->refcyc_per_vm_group_flip) +REG_GET (FLIP_PARAMETERS_3 , +REFCYC_PER_VM_GROUP_FLIP , &refcyc_per_vm_group_flip); + +if (refcyc_per_vm_group_flip == uninitialized_hw_default || + refcyc_per_vm_group_flip > dlg_attr->refcyc_per_vm_group_flip)REG_SET (FLIP_PARAMETERS_3 ,0 ,REFCYC_PER_VM_GROUP_FLIP , dlg_attr->refcyc_per_vm_group_flip); -REG_GET (FLIP_PARAMETERS_4 ,REFCYC_PER_VM_REQ_FLIP , &cur_value); -if (cur_value > dlg_attr->refcyc_per_vm_req_flip) +REG_GET (FLIP_PARAMETERS_4 , +REFCYC_PER_VM_REQ_FLIP , &refcyc_per_vm_req_flip); + +if (refcyc_per_vm_req_flip == uninitialized_hw_default || + refcyc_per_vm_req_flip > dlg_attr->refcyc_per_vm_req_flip)REG_SET (FLIP_PARAMETERS_4 ,0 ,REFCYC_PER_VM_REQ_FLIP , dlg_attr->refcyc_per_vm_req_flip);REG_SET (FLIP_PARAMETERS_5 ,0 ,REFCYC_PER_PTE_GROUP_FLIP_C , dlg_attr->refcyc_per_pte_group_flip_c); +REG_SET (FLIP_PARAMETERS_6 ,0 ,REFCYC_PER_META_CHUNK_FLIP_C , dlg_attr->refcyc_per_meta_chunk_flip_c); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 114/388 audit: CONFIG_CHANGE dont log internal bookkeeping as an event
In reply to Greg Kroah-HartmanFrom: Steve Grubb <[email protected]>
[ Upstream commit 70b3eeed49e8190d97139806f6fbaf8964306cdb ]
Common Criteria calls out for any action that modifies the audit trail to be recorded. That usually is interpreted to mean insertion or removal of rules. It is not required to log modification of the inode information since the watch is still in effect. Additionally, if the rule is a never rule and the underlying file is one they do not want events for, they get an event for this bookkeeping update against their wishes.
Since no device/inode info is logged at insertion and no device/inode information is logged on update, there is nothing meaningful being communicated to the admin by the CONFIG_CHANGE updated_rules event. One can assume that the rule was not "modified" because it is still watching the intended target. If the device or inode cannot be resolved, then audit_panic is called which is sufficient.
The correct resolution is to drop logging config_update events since the watch is still in effect but just on another unknown inode.
--- kernel/audit_watch.c | 2 -- 1 file changed, 2 deletions(-)
kernel/audit_watch.c +0 -2
@@ -302,8 +302,6 @@ static void audit_update_watch(struct audit_parent *parent,if (oentry->rule.exe)audit_remove_mark (oentry->rule.exe); -audit_watch_log_rule_change (r, owatch,"updated_rules" ); -call_rcu (&oentry->rcu, audit_free_rule_rcu); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 115/388 selinux: sel_avc_get_stat_idx should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 8d269a8e2a8f0bca89022f4ec98de460acb90365 ]
If seq_file .next function does not change position index, read after some lseek can generate unexpected output.
$ dd if=/sys/fs/selinux/avc/cache_stats # usual output lookups hits misses allocations reclaims frees 817223 810034 7189 7189 6992 7037 1934894 1926896 7998 7998 7632 7683 1322812 1317176 5636 5636 5456 5507 1560571 1551548 9023 9023 9056 9115 0+1 records in 0+1 records out 189 bytes copied, 5,1564e-05 s, 3,7 MB/s
$# read after lseek to midle of last line
$ dd if=/sys/fs/selinux/avc/cache_stats bs=180 skip=1 dd: /sys/fs/selinux/avc/cache_stats: cannot skip to specified offset 056 9115 <<<< end of last line 1560571 1551548 9023 9023 9056 9115 <<< whole last line once again 0+1 records in 0+1 records out 45 bytes copied, 8,7221e-05 s, 516 kB/s
$# read after lseek beyond end of of file
$ dd if=/sys/fs/selinux/avc/cache_stats bs=1000 skip=1 dd: /sys/fs/selinux/avc/cache_stats: cannot skip to specified offset 1560571 1551548 9023 9023 9056 9115 <<<< generates whole last line 0+1 records in 0+1 records out 36 bytes copied, 9,0934e-05 s, 396 kB/s
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- security/selinux/selinuxfs.c | 1 + 1 file changed, 1 insertion(+)
security/selinux/selinuxfs.c +1 -0
@@ -1508,6 +1508,7 @@ static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx) *idx = cpu +1 ;return &per_cpu (avc_cache_stats, cpu); } + (*idx)++;return NULL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 116/388 scsi: lpfc: Fix RQ buffer leakage when no IOCBs available
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 39c4f1a965a9244c3ba60695e8ff8da065ec6ac4 ]
The driver is occasionally seeing the following SLI Port error, requiring reset and reinit:
Port Status Event: ... error 1=0x52004a01, error 2=0x218
The failure means an RQ timeout. That is, the adapter had received asynchronous receive frames, ran out of buffer slots to place the frames, and the driver did not replenish the buffer slots before a timeout occurred. The driver should not be so slow in replenishing buffers that a timeout can occur.
When the driver received all the frames of a sequence, it allocates an IOCB to put the frames in. In a situation where there was no IOCB available for the frame of a sequence, the RQ buffer corresponding to the first frame of the sequence was not returned to the FW. Eventually, with enough traffic encountering the situation, the timeout occurred.
Fix by releasing the buffer back to firmware whenever there is no IOCB for the first frame.
[mkp: typo]
--- drivers/scsi/lpfc/lpfc_sli.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/lpfc/lpfc_sli.c +4 -0
@@ -17866,6 +17866,10 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)list_add_tail (&iocbq->list, &first_iocbq->list); } } +/* Free the sequence's header buffer */ +if (!first_iocbq) +lpfc_in_buf_free (vport->phba, &seq_dmabuf->dbuf); +return first_iocbq; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 117/388 scsi: lpfc: Fix release of hwq to clear the eq relationship
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 821bc882accaaaf1bbecf5c0ecef659443e3e8cb ]
When performing reset testing, the eq's list for related hwqs was getting corrupted. In cases where there is not a 1:1 eq to hwq, the eq is shared. The eq maintains a list of hwqs utilizing it in case of cpu offlining and polling. During the reset, the hwqs are being torn down so they can be recreated. The recreation was getting confused by seeing a non-null eq assignment on the eq and the eq list became corrupt.
Correct by clearing the hdwq eq assignment when the hwq is cleaned up.
--- drivers/scsi/lpfc/lpfc_init.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/lpfc/lpfc_init.c +1 -0
@@ -9124,6 +9124,7 @@ lpfc_sli4_release_hdwq(struct lpfc_hba *phba)/* Free the CQ/WQ corresponding to the Hardware Queue */ lpfc_sli4_queue_free (hdwq[idx].io_cq);lpfc_sli4_queue_free (hdwq[idx].io_wq); + hdwq[idx].hba_eq =NULL ; hdwq[idx].io_cq =NULL ; hdwq[idx].io_wq =NULL ;if (phba->cfg_xpsgl && !phba->nvmet_support)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 118/388 scsi: lpfc: Fix coverity errors in fmdi attribute handling
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 4cb9e1ddaa145be9ed67b6a7de98ca705a43f998 ]
Coverity reported a memory corruption error for the fdmi attributes routines:
CID 15768 [Memory Corruption] Out-of-bounds access on FDMI
Sloppy coding of the fmdi structures. In both the lpfc_fdmi_attr_def and lpfc_fdmi_reg_port_list structures, a field was placed at the start of payload that may have variable content. The field was given an arbitrary type (uint32_t). The code then uses the field name to derive an address, which it used in things such as memset and memcpy. The memset sizes or memcpy lengths were larger than the arbitrary type, thus coverity reported an error.
Fix by replacing the arbitrary fields with the real field structures describing the payload.
--- drivers/scsi/lpfc/lpfc_ct.c | 137 ++++++++++++++++++------------------ drivers/scsi/lpfc/lpfc_hw.h | 36 +++++----- 2 files changed, 85 insertions(+), 88 deletions(-)
drivers/scsi/lpfc/lpfc_ct.c +69 -68
@@ -2056,8 +2056,8 @@ lpfc_fdmi_hba_attr_wwnn(struct lpfc_vport *vport, struct lpfc_fdmi_attr_def *ad)struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,sizeof (struct lpfc_name )); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));memcpy (&ae->un.AttrWWN, &vport->fc_sparam.nodeName,sizeof (struct lpfc_name ));
@@ -2073,8 +2073,8 @@ lpfc_fdmi_hba_attr_manufacturer(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));/* This string MUST be consistent with other FC platforms * supported by Broadcom.
@@ -2098,8 +2098,8 @@ lpfc_fdmi_hba_attr_sn(struct lpfc_vport *vport, struct lpfc_fdmi_attr_def *ad)struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strncpy (ae->un.AttrString, phba->SerialNumber,sizeof (ae->un.AttrString));
@@ -2120,8 +2120,8 @@ lpfc_fdmi_hba_attr_model(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strncpy (ae->un.AttrString, phba->ModelName,sizeof (ae->un.AttrString));
@@ -2141,8 +2141,8 @@ lpfc_fdmi_hba_attr_description(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strncpy (ae->un.AttrString, phba->ModelDesc,sizeof (ae->un.AttrString));
@@ -2164,8 +2164,8 @@ lpfc_fdmi_hba_attr_hdw_ver(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t i, j, incr, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));/* Convert JEDEC ID to ascii for hardware version */ incr = vp->rev.biuRev;
@@ -2194,8 +2194,8 @@ lpfc_fdmi_hba_attr_drvr_ver(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strncpy (ae->un.AttrString, lpfc_release_version,sizeof (ae->un.AttrString));
@@ -2216,8 +2216,8 @@ lpfc_fdmi_hba_attr_rom_ver(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));if (phba->sli_rev ==LPFC_SLI_REV4 )lpfc_decode_firmware_rev (phba, ae->un.AttrString,1 );
@@ -2241,8 +2241,8 @@ lpfc_fdmi_hba_attr_fmw_ver(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));lpfc_decode_firmware_rev (phba, ae->un.AttrString,1 ); len = strnlen(ae->un.AttrString,
@@ -2261,8 +2261,8 @@ lpfc_fdmi_hba_attr_os_ver(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae)); snprintf(ae->un.AttrString, sizeof(ae->un.AttrString), "%s %s %s", init_utsname()->sysname,
@@ -2284,7 +2284,7 @@ lpfc_fdmi_hba_attr_ct_len(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue; ae->un.AttrInt =cpu_to_be32 (LPFC_MAX_CT_SIZE ); size =FOURBYTES +sizeof (uint32_t );
@@ -2300,8 +2300,8 @@ lpfc_fdmi_hba_attr_symbolic_name(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae)); len =lpfc_vport_symbolic_node_name (vport, ae->un.AttrString,256 );
@@ -2319,7 +2319,7 @@ lpfc_fdmi_hba_attr_vendor_info(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue;/* Nothing is defined for this currently */ ae->un.AttrInt =cpu_to_be32 (0 );
@@ -2336,7 +2336,7 @@ lpfc_fdmi_hba_attr_num_ports(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue;/* Each driver instance corresponds to a single port */ ae->un.AttrInt =cpu_to_be32 (1 );
@@ -2353,8 +2353,8 @@ lpfc_fdmi_hba_attr_fabric_wwnn(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,sizeof (struct lpfc_name )); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));memcpy (&ae->un.AttrWWN, &vport->fabric_nodename,sizeof (struct lpfc_name ));
@@ -2372,8 +2372,8 @@ lpfc_fdmi_hba_attr_bios_ver(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strlcat (ae->un.AttrString, phba->BIOSVersion,sizeof (ae->un.AttrString));
@@ -2393,7 +2393,7 @@ lpfc_fdmi_hba_attr_bios_state(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue;/* Driver doesn't have access to this information */ ae->un.AttrInt =cpu_to_be32 (0 );
@@ -2410,8 +2410,8 @@ lpfc_fdmi_hba_attr_vendor_id(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strncpy (ae->un.AttrString,"EMULEX" ,sizeof (ae->un.AttrString));
@@ -2433,8 +2433,8 @@ lpfc_fdmi_port_attr_fc4type(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,32 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae)); ae->un.AttrTypes[3 ] =0x02 ;/* Type 0x1 - ELS */ ae->un.AttrTypes[2 ] =0x01 ;/* Type 0x8 - FCP */
@@ -2459,7 +2459,7 @@ lpfc_fdmi_port_attr_support_speed(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue; ae->un.AttrInt =0 ;if (!(phba->hba_flag &HBA_FCOE_MODE )) {
@@ -2513,7 +2513,7 @@ lpfc_fdmi_port_attr_speed(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue;if (!(phba->hba_flag &HBA_FCOE_MODE )) {switch (phba->fc_linkspeed) {
@@ -2583,7 +2583,7 @@ lpfc_fdmi_port_attr_max_frame(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue; hsp = (struct serv_parm *)&vport->fc_sparam; ae->un.AttrInt = (((uint32_t) hsp->cmn.bbRcvSizeMsb & 0x0F) << 8) |
@@ -2603,8 +2603,8 @@ lpfc_fdmi_port_attr_os_devname(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));snprintf (ae->un.AttrString,sizeof (ae->un.AttrString),"/sys/class/scsi_host/host%d" , shost->host_no);
@@ -2624,8 +2624,8 @@ lpfc_fdmi_port_attr_host_name(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));scnprintf (ae->un.AttrString,sizeof (ae->un.AttrString),"%s" , vport->phba->os_host_name);
@@ -2645,8 +2645,8 @@ lpfc_fdmi_port_attr_wwnn(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,sizeof (struct lpfc_name )); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));memcpy (&ae->un.AttrWWN, &vport->fc_sparam.nodeName,sizeof (struct lpfc_name ));
@@ -2663,8 +2663,8 @@ lpfc_fdmi_port_attr_wwpn(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,sizeof (struct lpfc_name )); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));memcpy (&ae->un.AttrWWN, &vport->fc_sparam.portName,sizeof (struct lpfc_name ));
@@ -2681,8 +2681,8 @@ lpfc_fdmi_port_attr_symbolic_name(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae)); len =lpfc_vport_symbolic_port_name (vport, ae->un.AttrString,256 ); len += (len &3 ) ? (4 - (len &3 )) :4 ;
@@ -2700,7 +2700,7 @@ lpfc_fdmi_port_attr_port_type(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue;if (phba->fc_topology ==LPFC_TOPOLOGY_LOOP ) ae->un.AttrInt =cpu_to_be32 (LPFC_FDMI_PORTTYPE_NLPORT );else
@@ -2718,7 +2718,7 @@ lpfc_fdmi_port_attr_class(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue; ae->un.AttrInt =cpu_to_be32 (FC_COS_CLASS2 |FC_COS_CLASS3 ); size =FOURBYTES +sizeof (uint32_t ); ad->AttrLen =cpu_to_be16 (size);
@@ -2733,8 +2733,8 @@ lpfc_fdmi_port_attr_fabric_wwpn(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,sizeof (struct lpfc_name )); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));memcpy (&ae->un.AttrWWN, &vport->fabric_portname,sizeof (struct lpfc_name ));
@@ -2751,8 +2751,8 @@ lpfc_fdmi_port_attr_active_fc4type(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,32 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae)); ae->un.AttrTypes[3 ] =0x02 ;/* Type 0x1 - ELS */ ae->un.AttrTypes[2 ] =0x01 ;/* Type 0x8 - FCP */
@@ -2775,7 +2775,7 @@ lpfc_fdmi_port_attr_port_state(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue;/* Link Up - operational */ ae->un.AttrInt =cpu_to_be32 (LPFC_FDMI_PORTSTATE_ONLINE ); size =FOURBYTES +sizeof (uint32_t );
@@ -2791,7 +2791,7 @@ lpfc_fdmi_port_attr_num_disc(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue; vport->fdmi_num_disc =lpfc_find_map_node (vport); ae->un.AttrInt =cpu_to_be32 (vport->fdmi_num_disc); size =FOURBYTES +sizeof (uint32_t );
@@ -2807,7 +2807,7 @@ lpfc_fdmi_port_attr_nportid(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue; ae->un.AttrInt =cpu_to_be32 (vport->fc_myDID); size =FOURBYTES +sizeof (uint32_t ); ad->AttrLen =cpu_to_be16 (size);
@@ -2822,8 +2822,8 @@ lpfc_fdmi_smart_attr_service(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strncpy (ae->un.AttrString,"Smart SAN Initiator" ,sizeof (ae->un.AttrString));
@@ -2843,8 +2843,8 @@ lpfc_fdmi_smart_attr_guid(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));memcpy (&ae->un.AttrString, &vport->fc_sparam.nodeName,sizeof (struct lpfc_name ));
@@ -2864,8 +2864,8 @@ lpfc_fdmi_smart_attr_version(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strncpy (ae->un.AttrString,"Smart SAN Version 2.0" ,sizeof (ae->un.AttrString));
@@ -2886,8 +2886,8 @@ lpfc_fdmi_smart_attr_model(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t len, size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; -memset (ae,0 ,256 ); + ae = &ad->AttrValue; +memset (ae,0 ,sizeof (*ae));strncpy (ae->un.AttrString, phba->ModelName,sizeof (ae->un.AttrString));
@@ -2906,7 +2906,7 @@ lpfc_fdmi_smart_attr_port_info(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue;/* SRIOV (type 3) is not supported */ if (vport->vpi)
@@ -2926,7 +2926,7 @@ lpfc_fdmi_smart_attr_qos(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue; ae->un.AttrInt =cpu_to_be32 (0 ); size =FOURBYTES +sizeof (uint32_t ); ad->AttrLen =cpu_to_be16 (size);
@@ -2941,7 +2941,7 @@ lpfc_fdmi_smart_attr_security(struct lpfc_vport *vport,struct lpfc_fdmi_attr_entry *ae;uint32_t size; - ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue; + ae = &ad->AttrValue; ae->un.AttrInt =cpu_to_be32 (1 ); size =FOURBYTES +sizeof (uint32_t ); ad->AttrLen =cpu_to_be16 (size);
@@ -3089,7 +3089,8 @@ lpfc_fdmi_cmd(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,/* Registered Port List */ /* One entry (port) per adapter */ rh->rpl.EntryCnt =cpu_to_be32 (1 ); -memcpy (&rh->rpl.pe, &phba->pport->fc_sparam.portName, +memcpy (&rh->rpl.pe.PortName, + &phba->pport->fc_sparam.portName,sizeof (struct lpfc_name ));/* point to the HBA attribute block */
drivers/scsi/lpfc/lpfc_hw.h +16 -20
@@ -1340,25 +1340,8 @@ struct fc_rdp_res_frame {/* lpfc_sli_ct_request defines the CT_IU preamble for FDMI commands */ #define SLI_CT_FDMI_Subtypes 0x10/* Management Service Subtype */ -/* -* Registered Port List Format -*/ -struct lpfc_fdmi_reg_port_list { -uint32_t EntryCnt; -uint32_t pe;/* Variable-length array */ -}; - -/* Definitions for HBA / Port attribute entries */ -struct lpfc_fdmi_attr_def {/* Defined in TLV format */ -/* Structure is in Big Endian format */ -uint32_t AttrType:16 ; -uint32_t AttrLen:16 ; -uint32_t AttrValue;/* Marks start of Value (ATTRIBUTE_ENTRY) */ -}; - -/* Attribute Entry */ struct lpfc_fdmi_attr_entry { union {
@@ -1369,7 +1352,13 @@ struct lpfc_fdmi_attr_entry { } un; }; -#define LPFC_FDMI_MAX_AE_SIZE sizeof(struct lpfc_fdmi_attr_entry) +struct lpfc_fdmi_attr_def {/* Defined in TLV format */ +/* Structure is in Big Endian format */ +uint32_t AttrType:16 ; +uint32_t AttrLen:16 ; +/* Marks start of Value (ATTRIBUTE_ENTRY) */ +struct lpfc_fdmi_attr_entry AttrValue; +} __packed;/* * HBA Attribute Block
@@ -1393,13 +1382,20 @@ struct lpfc_fdmi_hba_ident {struct lpfc_name PortName; }; +/* +* Registered Port List Format +*/ +struct lpfc_fdmi_reg_port_list { +uint32_t EntryCnt; +struct lpfc_fdmi_port_entry pe; +} __packed; +/* * Register HBA(RHBA) */ struct lpfc_fdmi_reg_hba {struct lpfc_fdmi_hba_ident hi; -struct lpfc_fdmi_reg_port_list rpl;/* variable-length array */ -/* struct lpfc_fdmi_attr_block ab; */ +struct lpfc_fdmi_reg_port_list rpl; };/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 119/388 drm/omap: fix possible object reference leak
In reply to Greg Kroah-HartmanFrom: Wen Yang <[email protected]>
[ Upstream commit 47340e46f34a3b1d80e40b43ae3d7a8da34a3541 ]
The call to of_find_matching_node returns a node pointer with refcount incremented thus it must be explicitly decremented after the last usage.
Detected by coccinelle with the following warnings:
drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c:212:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 209, but without a corresponding object release within this function. drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c:237:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 209, but without a corresponding object release within this function.
--- drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c +3 -1
@@ -192,7 +192,7 @@ static int __init omapdss_boot_init(void) dss =of_find_matching_node (NULL , omapdss_of_match);if (dss ==NULL || !of_device_is_available (dss)) -return 0 ; + goto put_node;omapdss_walk_device (dss, true);
@@ -217,6 +217,8 @@ static int __init omapdss_boot_init(void)kfree (n); } +put_node: +of_node_put (dss);return 0 ; }
Signature · 8 lines
2.25.1 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel