5.0.20-stable review
Subsystems (12)
Greg Kroah-Hartman
maintainercover 5.0.20-stable review
This is the start of the stable review cycle for the 5.0.20 release. There are 346 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat 01 Jun 2019 03:02:10 AM UTC. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.0.20-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.0.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.0.20-rc1
Benjamin Coddington <[email protected]>
NFS: Fix a double unlock from nfs_match,get_client
Maxime Ripard <[email protected]>
drm/sun4i: dsi: Enforce boundaries on the start delay
Brett Creeley <[email protected]>
ice: Put __ICE_PREPARED_FOR_RESET check in ice_prepare_for_reset
Farhan Ali <[email protected]>
vfio-ccw: Prevent quiesce function going into an infinite loop
Maxime Ripard <[email protected]>
drm/sun4i: dsi: Change the start delay calculation
Chris Wilson <[email protected]>
drm: Wake up next in drm_read() chain if we are forced to putback the event
Noralf Trønnes <[email protected]>
drm/drv: Hold ref on parent device during drm_device lifetime
Eric Anholt <[email protected]>
drm/v3d: Handle errors from IRQ setup.
Arnd Bergmann <[email protected]>
ASoC: ti: fix davinci_mcasp_probe dependencies
Arnd Bergmann <[email protected]>
ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM
Chris Lesiak <[email protected]>
spi: Fix zero length xfer bug
Steve Twiss <[email protected]>
regulator: da9055: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: da9062: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: pv88090: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: wm831x: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: pv88080: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: da9063: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: da9211: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: lp8755: Fix notifier mutex lock warning
Trent Piepho <[email protected]>
spi: imx: stop buffer overflow in RX FIFO flush
Steve Twiss <[email protected]>
regulator: pv88060: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: ltc3589: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: ltc3676: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: wm831x isink: Fix notifier mutex lock warning
Steve Twiss <[email protected]>
regulator: wm831x ldo: Fix notifier mutex lock warning
Geert Uytterhoeven <[email protected]>
spi: rspi: Fix sequencer reset during initialization
Laurent Pinchart <[email protected]>
drm/omap: Notify all devices in the pipeline of output disconnection
Tony Lindgren <[email protected]>
drm/omap: dsi: Fix PM for display blank with paired dss_pll calls
Laurent Pinchart <[email protected]>
drm: writeback: Fix leak of writeback job
Aditya Pakki <[email protected]>
spi : spi-topcliff-pch: Fix to handle empty DMA buffers
Li RongQing <[email protected]>
audit: fix a memleak caused by auditing load module
James Smart <[email protected]>
scsi: lpfc: Fix use-after-free mailbox cmd completion
James Smart <[email protected]>
scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices
Arnd Bergmann <[email protected]>
media: saa7146: avoid high stack usage with clang
James Smart <[email protected]>
scsi: lpfc: Fix fc4type information for FDMI
James Smart <[email protected]>
scsi: lpfc: Fix FDMI manufacturer attribute value
Jernej Skrabec <[email protected]>
media: cedrus: Add a quirk for not setting DMA offset
Hans Verkuil <[email protected]>
media: vim2m: replace devm_kzalloc by kzalloc
Hans Verkuil <[email protected]>
media: vimc: zero the media_device on probe
Arnd Bergmann <[email protected]>
media: go7007: avoid clang frame overflow warning with KASAN
Hans Verkuil <[email protected]>
media: gspca: do not resubmit URBs when streaming has stopped
Helen Fornazier <[email protected]>
media: vimc: stream: fix thread state before sleep
Kangjie Lu <[email protected]>
scsi: ufs: fix a missing check of devm_reset_control_get
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Set stream->mode_changed when connectors change
Murton Liu <[email protected]>
drm/amd/display: Fix Divide by 0 in memory calculations
Arnd Bergmann <[email protected]>
media: staging: davinci_vpfe: disallow building with COMPILE_TEST
Wenjing Liu <[email protected]>
drm/amd/display: add pipe lock during stream update
James Hutchinson <[email protected]>
media: m88ds3103: serialize reset messages in m88ds3103_set_frontend
Stefan Brüns <[email protected]>
media: dvbsky: Avoid leaking dvb frontend
Kangjie Lu <[email protected]>
media: si2165: fix a missing check of return value
Kai-Heng Feng <[email protected]>
igb: Exclude device from suspend direct complete optimization
Noralf Trønnes <[email protected]>
tinydrm/mipi-dbi: Use dma-safe buffers for all SPI transfers
Kai-Heng Feng <[email protected]>
e1000e: Disable runtime PM on CNP+
Arnd Bergmann <[email protected]>
media: staging/intel-ipu3: mark PM function as __maybe_unused
Sakari Ailus <[email protected]>
media: v4l2-fwnode: The first default data lane is 0 on C-PHY
Kangjie Lu <[email protected]>
thunderbolt: property: Fix a NULL pointer dereference
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Reset alpha state for planes to the correct values
Samson Tam <[email protected]>
drm/amd/display: Link train only when link is DP and backend is enabled
Dmytro Laktyushkin <[email protected]>
drm/amd/display: fix releasing planes when exiting odm
Aditya Pakki <[email protected]>
thunderbolt: Fix to check for kmemdup failure
Aditya Pakki <[email protected]>
thunderbolt: Fix to check return value of ida_simple_get
Rouven Czerwinski <[email protected]>
hwrng: omap - Set default quality
George Hilliard <[email protected]>
staging: mt7621-mmc: Check for nonzero number of scatterlist entries
Pu Wen <[email protected]>
x86/CPU/hygon: Fix phys_proc_id calculation logic for multi-die processors
Sameer Pujar <[email protected]>
dmaengine: tegra210-adma: use devm_clk_*() helpers
Linus Lüssing <[email protected]>
batman-adv: allow updating DAT entry timeouts on incoming ARP Replies
Arnd Bergmann <[email protected]>
selinux: avoid uninitialized variable warning
Dave Ertman <[email protected]>
ice: Prevent unintended multiple chain resets
Arnd Bergmann <[email protected]>
scsi: lpfc: avoid uninitialized variable warning
Arnd Bergmann <[email protected]>
scsi: qla4xxx: avoid freeing unallocated dma memory
Tony Lindgren <[email protected]>
usb: core: Add PM runtime calls to usb_hcd_platform_shutdown
Ludovic Barre <[email protected]>
spi: stm32-qspi: add spi_master_put in release function
Neeraj Upadhyay <[email protected]>
rcu: Do a single rhp->func read in rcu_head_after_call_rcu()
Paul E. McKenney <[email protected]>
rcuperf: Fix cleanup path for invalid perf_type strings
Yazen Ghannam <[email protected]>
x86/mce: Handle varying MCA bank counts
Paul E. McKenney <[email protected]>
rcutorture: Fix cleanup path for invalid torture_type strings
Tony Luck <[email protected]>
x86/mce: Fix machine_check_poll() tests for error types
Leon Romanovsky <[email protected]>
overflow: Fix -Wtype-limits compilation warnings
George Hilliard <[email protected]>
staging: mt7621-mmc: Initialize completions a single time during probe
Kangjie Lu <[email protected]>
tty: ipwireless: fix missing checks for ioremap
Pankaj Gupta <[email protected]>
virtio_console: initialize vtermno value for ports
Chad Dupuis <[email protected]>
scsi: qedf: Add missing return in qedf_post_io_req() in the fcport offload check
Thomas Gleixner <[email protected]>
timekeeping: Force upper bound for setting CLOCK_REALTIME
Laurent Pinchart <[email protected]>
drm: rcar-du: lvds: Set LVEN and LVRES bits together on D3
Aditya Pakki <[email protected]>
thunderbolt: Fix to check the return value of kmemdup
Kangjie Lu <[email protected]>
thunderbolt: property: Fix a missing check of kzalloc
Ard Biesheuvel <[email protected]>
efifb: Omit memory map check on legacy boot
Ezequiel Garcia <[email protected]>
media: gspca: Kill URBs on USB device disconnect
Dan Carpenter <[email protected]>
media: wl128x: prevent two potential buffer overflows
Kangjie Lu <[email protected]>
media: video-mux: fix null pointer dereferences
Tetsuo Handa <[email protected]>
kobject: Don't trigger kobject_uevent(KOBJ_REMOVE) twice.
Sowjanya Komatineni <[email protected]>
spi: tegra114: reset controller on probe
Hans de Goede <[email protected]>
HID: logitech-hidpp: change low battery level threshold from 31 to 30 percent
Takeshi Kihara <[email protected]>
clk: renesas: rcar-gen3: Correct parent clock of Audio-DMAC
Ming Lei <[email protected]>
block: pass page to xen_biovec_phys_mergeable
Takeshi Kihara <[email protected]>
clk: renesas: rcar-gen3: Correct parent clock of SYS-DMAC
Gustavo A. R. Silva <[email protected]>
cxgb3/l2t: Fix undefined behaviour
Wen Yang <[email protected]>
ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put
Wen Yang <[email protected]>
ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put
Nicolas Saenz Julienne <[email protected]>
HID: core: move Usage Page concatenation to Main item
Geert Uytterhoeven <[email protected]>
sh: sh7786: Add explicit I/O cast to sh7786_mm_sel()
Leon Romanovsky <[email protected]>
RDMA/hns: Fix bad endianess of port_pd variable
Chengguang Xu <[email protected]>
chardev: add additional check for minor range overlap
Peter Zijlstra <[email protected]>
x86/uaccess: Fix up the fixup
Peter Zijlstra <[email protected]>
x86/ia32: Fix ia32_restore_sigcontext() AC leak
Peter Zijlstra <[email protected]>
x86/uaccess, signal: Fix AC=1 bloat
Peter Zijlstra <[email protected]>
x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP
Lior David <[email protected]>
wil6210: fix return code of wmi_mgmt_tx and wmi_mgmt_tx_ext
Peter Zijlstra <[email protected]>
locking/static_key: Fix false positive warnings on concurrent dec/inc
Wen Yang <[email protected]>
arm64: cpu_ops: fix a leaked reference by adding missing of_node_put
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Prevent cursor hotspot overflow for RV overlay planes
Yannick Fertré <[email protected]>
drm/panel: otm8009a: Add delay at the end of initialization
Stanley Chu <[email protected]>
scsi: ufs: Avoid configuring regulator with undefined voltage range
Stanley Chu <[email protected]>
scsi: ufs: Fix regulator load and icc-level configuration
Ping-Ke Shih <[email protected]>
rtlwifi: fix potential NULL pointer dereference
Alexandre Belloni <[email protected]>
rtc: xgene: fix possible race condition
Piotr Figiel <[email protected]>
brcmfmac: fix Oops when bringing up interface during USB disconnect
Piotr Figiel <[email protected]>
brcmfmac: fix race during disconnect when USB completion is in progress
Piotr Figiel <[email protected]>
brcmfmac: fix WARNING during USB disconnect in case of unempty psq
Piotr Figiel <[email protected]>
brcmfmac: convert dev_init_lock mutex to completion
Arnd Bergmann <[email protected]>
b43: shut up clang -Wuninitialized variable warning
Kangjie Lu <[email protected]>
brcmfmac: fix missing checks for kmemdup
YueHaibing <[email protected]>
mwifiex: Fix mem leak in mwifiex_tm_cmd
Kangjie Lu <[email protected]>
rtlwifi: fix a potential NULL pointer dereference
Daniel T. Lee <[email protected]>
selftests/bpf: ksym_search won't check symbols exists
Jian Shen <[email protected]>
net: hns3: add protect when handling mac addr list
Huazhong Tan <[email protected]>
net: hns3: check resetting status in hns3_get_stats()
Justin Chen <[email protected]>
iio: adc: ti-ads7950: Fix improper use of mlock
Nathan Chancellor <[email protected]>
iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
Kangjie Lu <[email protected]>
iio: hmc5843: fix potential NULL pointer dereferences
Lars-Peter Clausen <[email protected]>
iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
Wen Yang <[email protected]>
drm/pl111: fix possible object reference leak
Charles Keepax <[email protected]>
regulator: core: Avoid potential deadlock on regulator_unregister
Kees Cook <[email protected]>
x86/build: Keep local relocations with ld.lld
Alexei Starovoitov <[email protected]>
samples/bpf: fix build with new clang
David Kozub <[email protected]>
block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR
Wen Yang <[email protected]>
cpufreq: imx6q: fix possible object reference leak
Wen Yang <[email protected]>
cpufreq: kirkwood: fix possible object reference leak
Wen Yang <[email protected]>
cpufreq: pmac32: fix possible object reference leak
Wen Yang <[email protected]>
cpufreq/pasemi: fix possible object reference leak
Wen Yang <[email protected]>
cpufreq: ppc_cbe: fix possible object reference leak
Huazhong Tan <[email protected]>
net: hns3: add error handler for initializing command queue
Kristian Evensen <[email protected]>
qmi_wwan: Add quirk for Quectel dynamic config
Huazhong Tan <[email protected]>
net: hns3: fix keep_alive_timer not stop problem
Roman Gushchin <[email protected]>
selftests: cgroup: fix cleanup path in test_memcg_subtree_control()
Arnd Bergmann <[email protected]>
s390: cio: fix cio_irb declaration
Thomas Huth <[email protected]>
s390/mm: silence compiler warning when compiling without CONFIG_PGSTE
Borislav Petkov <[email protected]>
x86/microcode: Fix the ancient deprecated microcode loading method
Arnd Bergmann <[email protected]>
s390: zcrypt: initialize variables before_use
Michael Tretter <[email protected]>
clk: zynqmp: fix check for fractional clock
Douglas Anderson <[email protected]>
clk: rockchip: Make rkpwm a critical clock on rk3288
Charles Keepax <[email protected]>
extcon: arizona: Disable mic detect if running when driver is removed
Douglas Anderson <[email protected]>
clk: rockchip: Fix video codec clocks on rk3288
Ulf Hansson <[email protected]>
PM / core: Propagate dev->power.wakeup_path when no callbacks
Christian König <[email protected]>
drm/amdgpu: fix old fence check in amdgpu_fence_emit
Peng Li <[email protected]>
net: hns3: free the pending skb when clean RX ring
Yinbo Zhu <[email protected]>
mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
Yinbo Zhu <[email protected]>
mmc: sdhci-of-esdhc: add erratum A-009204 support
Yinbo Zhu <[email protected]>
mmc: sdhci-of-esdhc: add erratum eSDHC5 support
Kangjie Lu <[email protected]>
mmc_spi: add a status check for spi_sync_locked
Andrea Merello <[email protected]>
mmc: core: make pwrseq_emmc (partially) support sleepy GPIO controllers
John Garry <[email protected]>
scsi: libsas: Do discovery on empty PHY to update PHY info
Guenter Roeck <[email protected]>
hwmon: (f71805f) Use request_muxed_region for Super-IO accesses
Guenter Roeck <[email protected]>
hwmon: (pc87427) Use request_muxed_region for Super-IO accesses
Guenter Roeck <[email protected]>
hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses
Guenter Roeck <[email protected]>
hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses
Guenter Roeck <[email protected]>
hwmon: (vt1211) Use request_muxed_region for Super-IO accesses
Enric Balletbo i Serra <[email protected]>
PM / devfreq: Fix static checker warning in try_then_request_governor
Kan Liang <[email protected]>
perf/x86/intel/cstate: Add Icelake support
Kan Liang <[email protected]>
perf/x86/intel/rapl: Add Icelake support
Kan Liang <[email protected]>
perf/x86/msr: Add Icelake support
Colin Ian King <[email protected]>
RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure
Vincenzo Frascino <[email protected]>
arm64: vdso: Fix clock_getres() for CLOCK_REALTIME
Kefeng Wang <[email protected]>
ACPI/IORT: Reject platform device creation on NUMA node mapping failure
Nicholas Nunley <[email protected]>
i40e: don't allow changes to HW VLAN stripping on active port VLANs
Adam Ludkiewicz <[email protected]>
i40e: Able to add up to 16 MAC filters on an untrusted VF
Ioana Ciocoi Radulescu <[email protected]>
dpaa2-eth: Fix Rx classification status
Arnd Bergmann <[email protected]>
phy: mapphone-mdm6600: add gpiolib dependency
Paul Kocialkowski <[email protected]>
phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode
Evan Green <[email protected]>
dt-bindings: phy-qcom-qmp: Add UFS PHY reset
Russell King <[email protected]>
drm: etnaviv: avoid DMA API warning when importing buffers
Thomas Gleixner <[email protected]>
x86/irq/64: Limit IST stack overflow check to #DB stack
Alan Stern <[email protected]>
USB: core: Don't unbind interfaces following device reset failure
Julian Wiedmann <[email protected]>
s390/qeth: handle error from qeth_update_from_chp_desc()
Mika Westerberg <[email protected]>
thunderbolt: Take domain lock in switch sysfs attribute callbacks
Nicholas Piggin <[email protected]>
irq_work: Do not raise an IPI when queueing work on the local CPU
Luca Weiss <[email protected]>
drm/msm: Fix NULL pointer dereference
Sean Paul <[email protected]>
drm/msm: dpu: Don't set frame_busy_mask for async updates
Wen Yang <[email protected]>
drm/msm: a5xx: fix possible object reference leak
Jeykumar Sankaran <[email protected]>
drm/msm/dpu: release resources on modeset failure
Nicholas Mc Guire <[email protected]>
staging: vc04_services: handle kzalloc failure
Konstantin Khlebnikov <[email protected]>
sched/core: Handle overflow in cpu_shares_write_u64
Konstantin Khlebnikov <[email protected]>
sched/rt: Check integer overflow at usec to nsec conversion
Konstantin Khlebnikov <[email protected]>
sched/core: Check quota and period overflow at usec to nsec conversion
Roman Gushchin <[email protected]>
cgroup: protect cgroup->nr_(dying_)descendants by css_set_lock
Sebastian Andrzej Siewior <[email protected]>
random: add a spinlock_t to struct batched_entropy
Jon DeVree <[email protected]>
random: fix CRNG initialization when random.trust_cpu=1
Russell Currey <[email protected]>
powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX
Nathan Lynch <[email protected]>
powerpc/numa: improve control of topology updates
Yufen Yu <[email protected]>
block: fix use-after-free on gendisk
Fabrice Gasnier <[email protected]>
iio: adc: stm32-dfsdm: fix unmet direct dependencies detected
Dan Carpenter <[email protected]>
media: pvrusb2: Prevent a buffer overflow
Shuah Khan <[email protected]>
media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
Hugues Fruchet <[email protected]>
media: stm32-dcmi: fix crash when subdev do not expose any formats
Wenwen Wang <[email protected]>
audit: fix a memory leak bug
Akinobu Mita <[email protected]>
media: ov2659: make S_FMT succeed even if requested format doesn't match
Hans Verkuil <[email protected]>
media: au0828: stop video streaming only when last user stops
Janusz Krzysztofik <[email protected]>
media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
Philipp Zabel <[email protected]>
media: coda: clear error return value before picture run
Nicolas Ferre <[email protected]>
dmaengine: at_xdmac: remove BUG_ON macro in tasklet
Robin Murphy <[email protected]>
perf/arm-cci: Remove broken race mitigation
Douglas Anderson <[email protected]>
clk: rockchip: undo several noc and special clocks as critical on rk3288
Wen Yang <[email protected]>
pinctrl: samsung: fix leaked of_node references
Wen Yang <[email protected]>
pinctrl: st: fix leaked of_node references
Wen Yang <[email protected]>
pinctrl: pistachio: fix leaked of_node references
Hans de Goede <[email protected]>
HID: logitech-hidpp: use RAP instead of FAP to get the protocol version
Ferry Toth <[email protected]>
Bluetooth: btbcm: Add default address for BCM43341B
Balakrishna Godavarthi <[email protected]>
Bluetooth: hci_qca: Give enough time to ROME controller to bootup.
Peter Zijlstra <[email protected]>
mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions
Jiri Kosina <[email protected]>
x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault()
Peter Zijlstra <[email protected]>
x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation
Sebastian Andrzej Siewior <[email protected]>
smpboot: Place the __percpu annotation correctly
Kees Cook <[email protected]>
x86/build: Move _etext to actual end of .text
Farhan Ali <[email protected]>
vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev
Farhan Ali <[email protected]>
vfio-ccw: Do not call flush_workqueue while holding the spinlock
Parav Pandit <[email protected]>
RDMA/cma: Consider scope_id while binding to ipv6 ll address
Arnd Bergmann <[email protected]>
bcache: avoid clang -Wunintialized warning
Coly Li <[email protected]>
bcache: add failure check to run_cache_set() for journal replay
Tang Junhui <[email protected]>
bcache: fix failure in journal relplay
Coly Li <[email protected]>
bcache: return error immediately in bch_journal_replay()
Shenghui Wang <[email protected]>
bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set
Corentin Labbe <[email protected]>
crypto: sun4i-ss - Fix invalid calculation of hash end
Sagi Grimberg <[email protected]>
nvme-tcp: fix a NULL deref when an admin connect times out
Sagi Grimberg <[email protected]>
nvme-rdma: fix a NULL deref when an admin connect times out
Sagi Grimberg <[email protected]>
nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE
Kangjie Lu <[email protected]>
net: cw1200: fix a NULL pointer dereference
Aditya Pakki <[email protected]>
rsi: Fix NULL pointer dereference in kmalloc
Dan Carpenter <[email protected]>
mwifiex: prevent an array overflow
Xiaoli Feng <[email protected]>
Fix nfs4.2 return -EINVAL when do dedupe operation
Daniel Baluta <[email protected]>
ASoC: fsl_sai: Update is_slave_mode with correct value
Kangjie Lu <[email protected]>
slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register
Daniel T. Lee <[email protected]>
libbpf: fix samples/bpf build failure due to undefined UINT32_MAX
Sergey Matyukevich <[email protected]>
mac80211/cfg80211: update bss channel on channel switch
Sugar Zhang <[email protected]>
dmaengine: pl330: _stop: clear interrupt status
Huazhong Tan <[email protected]>
net: hns3: use atomic_t replace u32 for arq's count
Arnd Bergmann <[email protected]>
s390: qeth: address type mismatch warning
Heiner Kallweit <[email protected]>
net: phy: improve genphy_soft_reset
Yunsheng Lin <[email protected]>
net: hns3: fix for TX clean num when cleaning TX BD
Mariusz Bialonczyk <[email protected]>
w1: fix the resume command API
Grygorii Strashko <[email protected]>
net: ethernet: ti: cpsw: fix allmulti cfg in dual_mac mode
Nicholas Piggin <[email protected]>
sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs
Bard liao <[email protected]>
ALSA: hda: fix unregister device twice on ASoC driver
Philipp Rudo <[email protected]>
s390/kexec_file: Fix detection of text segment in ELF loader
Manish Rangankar <[email protected]>
scsi: qedi: Abort ep termination if offload not scheduled
Fabien Dessenne <[email protected]>
rtc: stm32: manage the get_irq probe defer case
Sven Van Asbroeck <[email protected]>
rtc: 88pm860x: prevent use-after-free on device remove
Johannes Berg <[email protected]>
iwlwifi: pcie: don't crash on invalid RX interrupt
Qu Wenruo <[email protected]>
btrfs: Don't panic when we can't find a root key
Josef Bacik <[email protected]>
btrfs: fix panic during relocation after ENOSPC before writeback happens
Robbie Ko <[email protected]>
Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve
Nadav Amit <[email protected]>
x86/modules: Avoid breaking W^X while loading modules
Bart Van Assche <[email protected]>
scsi: qla2xxx: Fix hardirq-unsafe locking
Bart Van Assche <[email protected]>
scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session()
Bart Van Assche <[email protected]>
scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending()
Bart Van Assche <[email protected]>
scsi: qla2xxx: Fix a qla24xx_enable_msix() error path
Viresh Kumar <[email protected]>
sched/cpufreq: Fix kobject memleak
Nicholas Piggin <[email protected]>
powerpc/watchdog: Use hrtimers for per-CPU heartbeat
Nadav Amit <[email protected]>
x86/ftrace: Set trampoline pages as executable
Qian Cai <[email protected]>
arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable
Marc Zyngier <[email protected]>
ARM: vdso: Remove dependency with the arch_timer driver internals
Fabien Dessenne <[email protected]>
media: stm32-dcmi: return appropriate error codes during probe
Jon Derrick <[email protected]>
drm/nouveau/bar/nv50: ensure BAR is mapped
Pierre-Louis Bossart <[email protected]>
ACPI / property: fix handling of data_nodes in acpi_get_next_subnode()
Dan Carpenter <[email protected]>
brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()
Flavio Suligoi <[email protected]>
spi: pxa2xx: fix SCR (divisor) calculation
Arnd Bergmann <[email protected]>
ASoC: imx: fix fiq dependencies
Claudiu Beznea <[email protected]>
spi: atmel-quadspi: fix crash while suspending
Anju T Sudhakar <[email protected]>
powerpc/perf: Fix loop exit condition in nest_imc_event_init
Bo YU <[email protected]>
powerpc/boot: Fix missing check of lseek() return value
Anju T Sudhakar <[email protected]>
powerpc/perf: Return accordingly on invalid chip-id in
Jerome Brunet <[email protected]>
ASoC: hdmi-codec: unlock the device on startup errors
Fei Yang <[email protected]>
usb: gadget: f_fs: don't free buffer prematurely
Marek Szyprowski <[email protected]>
usb: dwc3: move synchronize_irq() out of the spinlock protected block
Minas Harutyunyan <[email protected]>
usb: dwc2: gadget: Increase descriptors count for ISOC's
Mac Chiang <[email protected]>
ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE
Wen Yang <[email protected]>
pinctrl: zte: fix leaked of_node references
João Paulo Rechi Vita <[email protected]>
Bluetooth: Ignore CC events not matching the last HCI command
Haiyang Zhang <[email protected]>
hv_netvsc: fix race that may miss tx queue wakeup
Sameeh Jubran <[email protected]>
net: ena: fix: set freed objects to NULL to avoid failing future allocations
Sameeh Jubran <[email protected]>
net: ena: gcc 8: fix compilation warning
Sameer Pujar <[email protected]>
dmaengine: tegra210-dma: free dma controller in remove()
Ming Lei <[email protected]>
blk-mq: grab .q_usage_counter when queuing request from plug code path
Ming Lei <[email protected]>
blk-mq: split blk_mq_alloc_and_init_hctx into two parts
Tony Nguyen <[email protected]>
ice: Separate if conditions for ice_set_features()
Masahiro Yamada <[email protected]>
bpftool: exclude bash-completion/bpftool from .gitignore pattern
Yonghong Song <[email protected]>
selftests/bpf: set RLIMIT_MEMLOCK properly for test_libbpf_open.c
Vineet Gupta <[email protected]>
tools/bpf: fix perf build error with uClibc (seen on ARC)
Raul E Rangel <[email protected]>
mmc: core: Verify SD bus width
Andreas Gruenbacher <[email protected]>
gfs2: Fix occasional glock use-after-free
Mike Marciniszyn <[email protected]>
IB/hfi1: Fix WQ_MEM_RECLAIM warning
Abhi Das <[email protected]>
gfs2: fix race between gfs2_freeze_func and unmount
Roberto Bergantinos Corpas <[email protected]>
NFS: make nfs_match_client killable
David Howells <[email protected]>
afs: Fix getting the afs.fid xattr
YueHaibing <[email protected]>
cxgb4: Fix error path in cxgb4_init_module
Ross Lagerwall <[email protected]>
gfs2: Fix lru_count going negative
David Sterba <[email protected]>
Revert "btrfs: Honour FITRIM range constraints during free space trim"
Kristian Evensen <[email protected]>
netfilter: ctnetlink: Resolve conntrack L3-protocol flush regression
Al Viro <[email protected]>
acct_on(): don't mess with freeze protection
YueHaibing <[email protected]>
at76c50x-usb: Don't register led_trigger if usb_register_driver failed
Linus Lüssing <[email protected]>
batman-adv: mcast: fix multicast tt/tvlv worker locking
Eric Dumazet <[email protected]>
bpf: devmap: fix use-after-free Read in __dev_map_entry_free
YueHaibing <[email protected]>
ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
Alexander Potapenko <[email protected]>
media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
Hans Verkuil <[email protected]>
media: vb2: add waiting_in_dqbuf flag
YueHaibing <[email protected]>
media: serial_ir: Fix use-after-free in serial_ir_init_module
YueHaibing <[email protected]>
media: cpia2: Fix use-after-free in cpia2_exit
Jiufei Xue <[email protected]>
fbdev: fix WARNING in __alloc_pages_nodemask bug
Amir Goldstein <[email protected]>
ovl: relax WARN_ON() for overlapping layers use case
Josef Bacik <[email protected]>
btrfs: honor path->skip_locking in backref code
Will Deacon <[email protected]>
arm64: errata: Add workaround for Cortex-A76 erratum #1463225
Arend van Spriel <[email protected]>
brcmfmac: add subtype check for event handling in data path
Arend van Spriel <[email protected]>
brcmfmac: assure SSID length from firmware is limited
Ronnie Sahlberg <[email protected]>
cifs: fix credits leak for SMB1 oplock breaks
Shile Zhang <[email protected]>
fbdev: fix divide error in fb_var_to_videomode
Tobin C. Harding <[email protected]>
btrfs: sysfs: don't leak memory when failing add fsid
Tobin C. Harding <[email protected]>
btrfs: sysfs: Fix error path kobject memory leak
Filipe Manana <[email protected]>
Btrfs: fix race between ranged fsync and writeback of adjacent ranges
Filipe Manana <[email protected]>
Btrfs: avoid fallback to transaction commit during fsync of files with holes
Filipe Manana <[email protected]>
Btrfs: do not abort transaction at btrfs_update_root() after failure to COW path
Josef Bacik <[email protected]>
btrfs: don't double unlock on error in btrfs_punch_hole
Andreas Gruenbacher <[email protected]>
gfs2: Fix sign extension bug in gfs2_update_stats
Christoph Hellwig <[email protected]>
arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable
Ard Biesheuvel <[email protected]>
arm64/kernel: kaslr: reduce module randomization range to 2 GB
Dan Williams <[email protected]>
libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead
Suthikulpanit, Suravee <[email protected]>
kvm: svm/avic: fix off-by-one in checking host APIC ID
Trac Hoang <[email protected]>
mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time problem
Trac Hoang <[email protected]>
mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold time problem
Daniel Axtens <[email protected]>
crypto: vmx - CTR: always increment IV as quadword
Eric Biggers <[email protected]>
crypto: hash - fix incorrect HASH_MAX_DESCSIZE
Martin K. Petersen <[email protected]>
Revert "scsi: sd: Keep disk read-only when re-reading partition"
Andrea Parri <[email protected]>
sbitmap: fix improper use of smp_mb__before_atomic()
Andrea Parri <[email protected]>
bio: fix improper use of smp_mb__before_atomic()
Paolo Bonzini <[email protected]>
KVM: x86: fix return value for reserved EFER
Jan Kara <[email protected]>
ext4: wait for outstanding dio during truncate in nojournal mode
Jan Kara <[email protected]>
ext4: do not delete unlinked inode from orphan list on failed truncate
Steven Rostedt (VMware) <[email protected]>
x86: Hide the int3_emulate_call/jmp functions from UML
-------------
Diffstat:
Documentation/arm64/silicon-errata.txt | 1 + .../devicetree/bindings/phy/qcom-qmp-phy.txt | 6 +- Makefile | 4 +- arch/arm/include/asm/cp15.h | 2 + arch/arm/vdso/vgettimeofday.c | 5 +- arch/arm64/Kconfig | 18 +++ arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/pgtable.h | 3 +- arch/arm64/include/asm/vdso_datapage.h | 1 + arch/arm64/kernel/asm-offsets.c | 2 +- arch/arm64/kernel/cpu_errata.c | 24 ++++ arch/arm64/kernel/cpu_ops.c | 1 + arch/arm64/kernel/kaslr.c | 6 +- arch/arm64/kernel/module.c | 2 +- arch/arm64/kernel/syscall.c | 31 +++++ arch/arm64/kernel/vdso.c | 3 + arch/arm64/kernel/vdso/gettimeofday.S | 7 +- arch/arm64/mm/dma-mapping.c | 10 ++ arch/arm64/mm/fault.c | 37 +++++- arch/powerpc/boot/addnote.c | 6 +- arch/powerpc/kernel/head_64.S | 4 +- arch/powerpc/kernel/watchdog.c | 81 ++++++------ arch/powerpc/mm/numa.c | 18 ++- arch/powerpc/perf/imc-pmu.c | 7 +- arch/powerpc/platforms/powernv/opal-imc.c | 2 +- arch/s390/kernel/kexec_elf.c | 7 +- arch/s390/mm/pgtable.c | 2 + arch/sh/include/cpu-sh4/cpu/sh7786.h | 2 +- arch/x86/Makefile | 2 +- arch/x86/events/intel/cstate.c | 2 + arch/x86/events/intel/rapl.c | 2 + arch/x86/events/msr.c | 1 + arch/x86/ia32/ia32_signal.c | 29 +++-- arch/x86/include/asm/text-patching.h | 4 +- arch/x86/include/asm/uaccess.h | 7 +- arch/x86/kernel/alternative.c | 28 +++-- arch/x86/kernel/cpu/hygon.c | 5 + arch/x86/kernel/cpu/mce/core.c | 66 ++++++---- arch/x86/kernel/cpu/mce/inject.c | 14 +-- arch/x86/kernel/cpu/microcode/core.c | 3 +- arch/x86/kernel/ftrace.c | 8 ++ arch/x86/kernel/irq_64.c | 19 ++- arch/x86/kernel/module.c | 2 +- arch/x86/kernel/signal.c | 29 +++-- arch/x86/kernel/vmlinux.lds.S | 6 +- arch/x86/kvm/svm.c | 6 +- arch/x86/kvm/x86.c | 2 +- arch/x86/lib/memcpy_64.S | 3 +- arch/x86/mm/fault.c | 2 - block/blk-mq-sched.c | 12 +- block/blk-mq.c | 139 +++++++++++---------- block/blk.h | 2 +- block/genhd.c | 19 +++ block/partition-generic.c | 7 ++ block/sed-opal.c | 9 +- crypto/hmac.c | 2 + drivers/acpi/arm64/iort.c | 19 ++- drivers/acpi/property.c | 8 ++ drivers/base/power/main.c | 4 + drivers/bluetooth/btbcm.c | 4 +- drivers/bluetooth/hci_qca.c | 2 + drivers/char/hw_random/omap-rng.c | 1 + drivers/char/random.c | 57 +++++---- drivers/char/virtio_console.c | 3 +- drivers/clk/renesas/r8a774a1-cpg-mssr.c | 8 +- drivers/clk/renesas/r8a774c0-cpg-mssr.c | 2 +- drivers/clk/renesas/r8a7795-cpg-mssr.c | 8 +- drivers/clk/renesas/r8a7796-cpg-mssr.c | 8 +- drivers/clk/renesas/r8a77965-cpg-mssr.c | 8 +- drivers/clk/renesas/r8a77990-cpg-mssr.c | 2 +- drivers/clk/renesas/r8a77995-cpg-mssr.c | 2 +- drivers/clk/rockchip/clk-rk3288.c | 21 ++-- drivers/clk/zynqmp/divider.c | 9 +- drivers/cpufreq/cpufreq.c | 1 + drivers/cpufreq/cpufreq_governor.c | 2 + drivers/cpufreq/imx6q-cpufreq.c | 4 +- drivers/cpufreq/kirkwood-cpufreq.c | 19 +-- drivers/cpufreq/pasemi-cpufreq.c | 1 + drivers/cpufreq/pmac32-cpufreq.c | 2 + drivers/cpufreq/ppc_cbe_cpufreq.c | 1 + drivers/crypto/sunxi-ss/sun4i-ss-hash.c | 5 +- drivers/crypto/vmx/aesp8-ppc.pl | 2 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/at_xdmac.c | 6 +- drivers/dma/pl330.c | 10 +- drivers/dma/tegra210-adma.c | 28 ++--- drivers/extcon/extcon-arizona.c | 10 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 24 ++-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 15 ++- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 +- .../gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | 20 ++- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 12 +- drivers/gpu/drm/drm_atomic_state_helper.c | 4 + drivers/gpu/drm/drm_drv.c | 5 +- drivers/gpu/drm/drm_file.c | 1 + drivers/gpu/drm/drm_writeback.c | 14 ++- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 5 + drivers/gpu/drm/etnaviv/etnaviv_drv.h | 1 + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 10 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 15 ++- drivers/gpu/drm/msm/msm_gem_vma.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c | 12 +- drivers/gpu/drm/omapdrm/dss/dsi.c | 60 ++++----- drivers/gpu/drm/omapdrm/omap_connector.c | 28 +++-- drivers/gpu/drm/panel/panel-orisetech-otm8009a.c | 3 + drivers/gpu/drm/pl111/pl111_versatile.c | 4 + drivers/gpu/drm/rcar-du/rcar_lvds.c | 8 +- drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 8 +- drivers/gpu/drm/tinydrm/ili9225.c | 6 +- drivers/gpu/drm/tinydrm/mipi-dbi.c | 58 ++++++--- drivers/gpu/drm/v3d/v3d_drv.c | 8 +- drivers/gpu/drm/v3d/v3d_drv.h | 2 +- drivers/gpu/drm/v3d/v3d_irq.c | 13 +- drivers/hid/hid-core.c | 36 ++++-- drivers/hid/hid-logitech-hidpp.c | 23 +++- drivers/hwmon/f71805f.c | 15 ++- drivers/hwmon/pc87427.c | 14 ++- drivers/hwmon/smsc47b397.c | 13 +- drivers/hwmon/smsc47m1.c | 28 +++-- drivers/hwmon/vt1211.c | 15 ++- drivers/iio/adc/Kconfig | 1 + drivers/iio/adc/ad_sigma_delta.c | 16 ++- drivers/iio/adc/ti-ads7950.c | 19 ++- drivers/iio/common/ssp_sensors/ssp_iio.c | 2 +- drivers/iio/magnetometer/hmc5843_i2c.c | 7 +- drivers/iio/magnetometer/hmc5843_spi.c | 7 +- drivers/infiniband/core/cma.c | 25 +++- drivers/infiniband/hw/cxgb4/cm.c | 2 + drivers/infiniband/hw/hfi1/init.c | 3 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 2 +- drivers/md/bcache/alloc.c | 5 +- drivers/md/bcache/journal.c | 26 +++- drivers/md/bcache/super.c | 25 +++- drivers/media/common/videobuf2/videobuf2-core.c | 22 ++++ drivers/media/dvb-frontends/m88ds3103.c | 9 +- drivers/media/dvb-frontends/si2165.c | 8 +- drivers/media/i2c/ov2659.c | 6 +- drivers/media/i2c/ov6650.c | 25 ++-- drivers/media/pci/saa7146/hexium_gemini.c | 5 +- drivers/media/pci/saa7146/hexium_orion.c | 5 +- drivers/media/platform/coda/coda-bit.c | 3 + drivers/media/platform/stm32/stm32-dcmi.c | 20 ++- drivers/media/platform/video-mux.c | 5 + drivers/media/platform/vim2m.c | 35 ++++-- drivers/media/platform/vimc/vimc-core.c | 2 + drivers/media/platform/vimc/vimc-streamer.c | 2 +- drivers/media/platform/vivid/vivid-vid-cap.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 7 +- drivers/media/rc/serial_ir.c | 9 +- drivers/media/usb/au0828/au0828-video.c | 16 ++- drivers/media/usb/cpia2/cpia2_v4l.c | 3 +- drivers/media/usb/dvb-usb-v2/dvbsky.c | 18 +-- drivers/media/usb/go7007/go7007-fw.c | 4 +- drivers/media/usb/gspca/gspca.c | 12 +- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 + drivers/media/usb/pvrusb2/pvrusb2-hdw.h | 1 + drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/mmc/core/pwrseq_emmc.c | 38 +++--- drivers/mmc/core/sd.c | 8 ++ drivers/mmc/host/mmc_spi.c | 4 + drivers/mmc/host/sdhci-iproc.c | 6 +- drivers/mmc/host/sdhci-of-esdhc.c | 8 ++ drivers/net/ethernet/amazon/ena/ena_netdev.c | 27 ++-- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 15 ++- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 7 +- drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 20 ++- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 5 + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 11 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c | 13 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 12 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c | 7 +- drivers/net/ethernet/intel/e1000e/netdev.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 8 ++ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 6 +- drivers/net/ethernet/intel/ice/ice_main.c | 25 +++- drivers/net/ethernet/intel/igb/igb_main.c | 3 + drivers/net/ethernet/ti/cpsw.c | 12 +- drivers/net/ethernet/ti/cpsw_ale.c | 19 +-- drivers/net/ethernet/ti/cpsw_ale.h | 3 +- drivers/net/hyperv/netvsc.c | 15 ++- drivers/net/phy/phy_device.c | 16 ++- drivers/net/usb/qmi_wwan.c | 65 +++++----- drivers/net/wireless/ath/wil6210/cfg80211.c | 5 + drivers/net/wireless/ath/wil6210/wmi.c | 11 +- drivers/net/wireless/atmel/at76c50x-usb.c | 4 +- drivers/net/wireless/broadcom/b43/phy_lp.c | 6 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 15 ++- .../wireless/broadcom/brcm80211/brcmfmac/fweh.h | 16 ++- .../broadcom/brcm80211/brcmfmac/fwsignal.c | 42 ++++--- .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 27 ++-- .../wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 7 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 +- drivers/net/wireless/marvell/mwifiex/cfp.c | 3 + drivers/net/wireless/realtek/rtlwifi/base.c | 5 + .../net/wireless/realtek/rtlwifi/rtl8188ee/fw.c | 2 + .../wireless/realtek/rtlwifi/rtl8192c/fw_common.c | 2 + .../net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | 2 + .../net/wireless/realtek/rtlwifi/rtl8723ae/fw.c | 2 + .../net/wireless/realtek/rtlwifi/rtl8723be/fw.c | 2 + .../net/wireless/realtek/rtlwifi/rtl8821ae/fw.c | 4 + drivers/net/wireless/rsi/rsi_91x_mac80211.c | 30 +++-- drivers/net/wireless/st/cw1200/main.c | 5 + drivers/nvdimm/pmem.c | 10 +- drivers/nvme/host/core.c | 7 +- drivers/nvme/host/rdma.c | 10 +- drivers/nvme/host/tcp.c | 8 +- drivers/perf/arm-cci.c | 21 ++-- drivers/phy/allwinner/phy-sun4i-usb.c | 4 + drivers/phy/motorola/Kconfig | 2 +- drivers/pinctrl/pinctrl-pistachio.c | 2 + drivers/pinctrl/pinctrl-st.c | 15 ++- drivers/pinctrl/samsung/pinctrl-exynos-arm.c | 1 + drivers/pinctrl/zte/pinctrl-zx.c | 1 + drivers/regulator/core.c | 3 +- drivers/regulator/da9055-regulator.c | 2 + drivers/regulator/da9062-regulator.c | 2 + drivers/regulator/da9063-regulator.c | 5 +- drivers/regulator/da9211-regulator.c | 4 + drivers/regulator/lp8755.c | 15 ++- drivers/regulator/ltc3589.c | 10 +- drivers/regulator/ltc3676.c | 10 +- drivers/regulator/pv88060-regulator.c | 4 + drivers/regulator/pv88080-regulator.c | 4 + drivers/regulator/pv88090-regulator.c | 4 + drivers/regulator/wm831x-dcdc.c | 4 + drivers/regulator/wm831x-isink.c | 2 + drivers/regulator/wm831x-ldo.c | 2 + drivers/rtc/rtc-88pm860x.c | 2 +- drivers/rtc/rtc-stm32.c | 9 +- drivers/rtc/rtc-xgene.c | 18 +-- drivers/s390/cio/cio.h | 2 +- drivers/s390/cio/vfio_ccw_drv.c | 32 ++--- drivers/s390/cio/vfio_ccw_ops.c | 11 +- drivers/s390/crypto/zcrypt_api.c | 4 + drivers/s390/net/qeth_core.h | 10 +- drivers/s390/net/qeth_core_main.c | 14 ++- drivers/scsi/libsas/sas_expander.c | 5 + drivers/scsi/lpfc/lpfc_ct.c | 22 ++-- drivers/scsi/lpfc/lpfc_hbadisc.c | 15 ++- drivers/scsi/lpfc/lpfc_nvme.c | 8 +- drivers/scsi/lpfc/lpfc_sli.c | 2 +- drivers/scsi/qedf/qedf_io.c | 1 + drivers/scsi/qedi/qedi_iscsi.c | 3 + drivers/scsi/qla2xxx/qla_isr.c | 6 +- drivers/scsi/qla2xxx/qla_target.c | 25 ++-- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 7 +- drivers/scsi/qla4xxx/ql4_os.c | 2 +- drivers/scsi/sd.c | 3 +- drivers/scsi/ufs/ufs-hisi.c | 4 + drivers/scsi/ufs/ufshcd.c | 28 +++-- drivers/slimbus/qcom-ngd-ctrl.c | 4 + drivers/spi/atmel-quadspi.c | 6 +- drivers/spi/spi-imx.c | 2 +- drivers/spi/spi-pxa2xx.c | 8 +- drivers/spi/spi-rspi.c | 9 +- drivers/spi/spi-stm32-qspi.c | 46 ++++--- drivers/spi/spi-tegra114.c | 32 ++--- drivers/spi/spi-topcliff-pch.c | 15 ++- drivers/spi/spi.c | 2 + drivers/ssb/bridge_pcmcia_80211.c | 9 +- drivers/staging/media/davinci_vpfe/Kconfig | 2 +- drivers/staging/media/ipu3/ipu3.c | 2 +- drivers/staging/media/sunxi/cedrus/cedrus.h | 3 + drivers/staging/media/sunxi/cedrus/cedrus_hw.c | 3 +- drivers/staging/mt7621-mmc/sd.c | 27 +++- .../interface/vchiq_arm/vchiq_2835_arm.c | 3 + .../vc04_services/interface/vchiq_arm/vchiq_core.c | 2 + drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/property.c | 12 +- drivers/thunderbolt/switch.c | 67 +++++----- drivers/thunderbolt/tb.h | 3 +- drivers/thunderbolt/xdomain.c | 8 +- drivers/tty/ipwireless/main.c | 8 ++ drivers/usb/core/hcd.c | 3 + drivers/usb/core/hub.c | 5 +- drivers/usb/dwc2/gadget.c | 27 ++-- drivers/usb/dwc3/core.c | 2 + drivers/usb/dwc3/gadget.c | 2 - drivers/usb/gadget/function/f_fs.c | 3 +- drivers/video/fbdev/core/fbcmap.c | 2 + drivers/video/fbdev/core/modedb.c | 3 + drivers/video/fbdev/efifb.c | 3 +- drivers/w1/w1_io.c | 3 +- drivers/xen/biomerge.c | 5 +- fs/afs/xattr.c | 15 ++- fs/btrfs/backref.c | 19 +-- fs/btrfs/extent-tree.c | 28 ++--- fs/btrfs/file.c | 19 ++- fs/btrfs/relocation.c | 31 +++-- fs/btrfs/root-tree.c | 17 +-- fs/btrfs/sysfs.c | 7 +- fs/btrfs/tree-log.c | 1 + fs/char_dev.c | 6 + fs/cifs/cifsglob.h | 1 + fs/cifs/cifssmb.c | 2 +- fs/cifs/transport.c | 10 +- fs/ext4/inode.c | 23 ++-- fs/gfs2/glock.c | 23 ++-- fs/gfs2/incore.h | 1 + fs/gfs2/lock_dlm.c | 9 +- fs/gfs2/log.c | 3 +- fs/gfs2/lops.c | 6 +- fs/gfs2/super.c | 8 +- fs/internal.h | 2 - fs/nfs/client.c | 7 +- fs/nfs/nfs4file.c | 2 +- fs/overlayfs/dir.c | 2 +- fs/overlayfs/inode.c | 3 +- include/crypto/hash.h | 8 +- include/drm/tinydrm/mipi-dbi.h | 5 +- include/linux/bio.h | 2 +- include/linux/cgroup-defs.h | 5 + include/linux/filter.h | 1 + include/linux/genhd.h | 1 + include/linux/hid.h | 1 + include/linux/iio/adc/ad_sigma_delta.h | 1 + include/linux/mount.h | 2 + include/linux/overflow.h | 12 +- include/linux/rcupdate.h | 6 +- include/linux/smpboot.h | 2 +- include/linux/time64.h | 21 ++++ include/media/videobuf2-core.h | 1 + include/net/bluetooth/hci.h | 1 + include/xen/xen.h | 4 +- kernel/acct.c | 4 +- kernel/auditfilter.c | 12 +- kernel/auditsc.c | 10 +- kernel/bpf/devmap.c | 3 + kernel/cgroup/cgroup.c | 6 + kernel/irq_work.c | 75 ++++++----- kernel/jump_label.c | 21 ++-- kernel/module.c | 5 + kernel/rcu/rcuperf.c | 5 + kernel/rcu/rcutorture.c | 5 + kernel/sched/core.c | 9 +- kernel/sched/fair.c | 16 ++- kernel/sched/rt.c | 5 + kernel/time/time.c | 2 +- kernel/time/timekeeping.c | 6 +- kernel/trace/trace_branch.c | 4 + lib/kobject_uevent.c | 11 +- lib/sbitmap.c | 2 +- lib/strncpy_from_user.c | 5 +- lib/strnlen_user.c | 4 +- net/batman-adv/distributed-arp-table.c | 4 +- net/batman-adv/main.c | 1 + net/batman-adv/multicast.c | 11 +- net/batman-adv/types.h | 5 + net/bluetooth/hci_core.c | 5 + net/bluetooth/hci_event.c | 12 ++ net/bluetooth/hci_request.c | 5 + net/bluetooth/hci_request.h | 1 + net/mac80211/mlme.c | 3 - net/netfilter/nf_conntrack_netlink.c | 2 +- net/wireless/nl80211.c | 5 + samples/bpf/asm_goto_workaround.h | 1 + security/selinux/netlabel.c | 14 +-- sound/pci/hda/hda_codec.c | 8 +- sound/soc/codecs/hdmi-codec.c | 6 +- sound/soc/fsl/Kconfig | 9 +- sound/soc/fsl/eukrea-tlv320.c | 4 +- sound/soc/fsl/fsl_sai.c | 2 + sound/soc/fsl/fsl_utils.c | 1 + sound/soc/intel/boards/kbl_da7219_max98357a.c | 2 +- sound/soc/ti/Kconfig | 4 +- sound/soc/ti/davinci-mcasp.c | 2 + tools/bpf/bpftool/.gitignore | 2 +- tools/lib/bpf/bpf.c | 2 + tools/lib/bpf/bpf.h | 1 + tools/testing/selftests/bpf/test_libbpf_open.c | 2 + tools/testing/selftests/bpf/trace_helpers.c | 4 + tools/testing/selftests/cgroup/test_memcontrol.c | 38 +++--- 378 files changed, 2617 insertions(+), 1202 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/346 x86: Hide the int3_emulate_call/jmp functions from UML
From: Steven Rostedt (VMware) <[email protected]>
commit 693713cbdb3a4bda5a8a678c31f06560bbb14657 upstream.
User Mode Linux does not have access to the ip or sp fields of the pt_regs, and accessing them causes UML to fail to build. Hide the int3_emulate_jmp() and int3_emulate_call() instructions from UML, as it doesn't need them anyway.
--- arch/x86/include/asm/text-patching.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/include/asm/text-patching.h +3 -1
@@ -39,6 +39,7 @@ extern int poke_int3_handler(struct pt_rextern void *text_poke_bp (void *addr,const void *opcode,size_t len,void *handler);extern int after_bootmem; +#ifndef CONFIG_UML_X86 static inline void int3_emulate_jmp (struct pt_regs *regs,unsigned long ip) { regs->ip = ip;
@@ -65,6 +66,7 @@ static inline void int3_emulate_call(strint3_emulate_push (regs, regs->ip -INT3_INSN_SIZE +CALL_INSN_SIZE );int3_emulate_jmp (regs, func); } -#endif +#endif /* CONFIG_X86_64 */ +#endif /* !CONFIG_UML_X86 */ #endif /* _ASM_X86_TEXT_PATCHING_H */
Greg Kroah-Hartman
maintainerPATCH 2/346 ext4: do not delete unlinked inode from orphan list on failed truncate
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit ee0ed02ca93ef1ecf8963ad96638795d55af2c14 upstream.
It is possible that unlinked inode enters ext4_setattr() (e.g. if somebody calls ftruncate(2) on unlinked but still open file). In such case we should not delete the inode from the orphan list if truncate fails. Note that this is mostly a theoretical concern as filesystem is corrupted if we reach this path anyway but let's be consistent in our orphan handling.
--- fs/ext4/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/inode.c +1 -1
@@ -5627,7 +5627,7 @@ int ext4_setattr(struct dentry *dentry,up_write (&EXT4_I (inode)->i_data_sem);ext4_journal_stop (handle);if (error) { -if (orphan) +if (orphan && inode->i_nlink)ext4_orphan_del (NULL , inode); goto err_out; }
Greg Kroah-Hartman
maintainerPATCH 3/346 ext4: wait for outstanding dio during truncate in nojournal mode
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 82a25b027ca48d7ef197295846b352345853dfa8 upstream.
We didn't wait for outstanding direct IO during truncate in nojournal mode (as we skip orphan handling in that case). This can lead to fs corruption or stale data exposure if truncate ends up freeing blocks and these get reallocated before direct IO finishes. Fix the condition determining whether the wait is necessary.
--- fs/ext4/inode.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
fs/ext4/inode.c +9 -12
@@ -5632,20 +5632,17 @@ int ext4_setattr(struct dentry *dentry, goto err_out; } } -if (!shrink) +if (!shrink) {pagecache_isize_extended (inode, oldsize, inode->i_size); - -/* -* Blocks are going to be removed from the inode. Wait -* for dio in flight. Temporarily disable -* dioread_nolock to prevent livelock. -*/ -if (orphan) { -if (!ext4_should_journal_data (inode)) { -inode_dio_wait (inode); - }else -ext4_wait_for_tail_page_commit (inode); + }else { +/* +* Blocks are going to be removed from the inode. Wait +* for dio in flight. +*/ +inode_dio_wait (inode); } +if (orphan &&ext4_should_journal_data (inode)) +ext4_wait_for_tail_page_commit (inode);down_write (&EXT4_I (inode)->i_mmap_sem); rc =ext4_break_layouts (inode);
Greg Kroah-Hartman
maintainerPATCH 4/346 KVM: x86: fix return value for reserved EFER
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 66f61c92889ff3ca365161fb29dd36d6354682ba upstream.
Commit 11988499e62b ("KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes", 2019-04-02) introduced a "return false" in a function returning int, and anyway set_efer has a "nonzero on error" conventon so it should be returning 1.
--- arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/x86.c +1 -1
@@ -1288,7 +1288,7 @@ static int set_efer(struct kvm_vcpu *vcpu64 efer = msr_info->data;if (efer & efer_reserved_bits) -return false; +return 1 ;if (!msr_info->host_initiated) {if (!__kvm_valid_efer (vcpu, efer))
Greg Kroah-Hartman
maintainerPATCH 5/346 bio: fix improper use of smp_mb__before_atomic()
In reply to Greg Kroah-HartmanFrom: Andrea Parri <[email protected]>
commit f381c6a4bd0ae0fde2d6340f1b9bb0f58d915de6 upstream.
This barrier only applies to the read-modify-write operations; in particular, it does not apply to the atomic_set() primitive.
Replace the barrier with an smp_mb().
--- include/linux/bio.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/bio.h +1 -1
@@ -211,7 +211,7 @@ static inline void bio_cnt_set(struct bi {if (count !=1 ) { bio->bi_flags |= (1 <<BIO_REFFED ); -smp_mb__before_atomic (); +smp_mb (); }atomic_set (&bio->__bi_cnt, count); }
Greg Kroah-Hartman
maintainerPATCH 6/346 sbitmap: fix improper use of smp_mb__before_atomic()
In reply to Greg Kroah-HartmanFrom: Andrea Parri <[email protected]>
commit a0934fd2b1208458e55fc4b48f55889809fce666 upstream.
This barrier only applies to the read-modify-write operations; in particular, it does not apply to the atomic_set() primitive.
Replace the barrier with an smp_mb().
--- lib/sbitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/sbitmap.c +1 -1
@@ -435,7 +435,7 @@ static void sbitmap_queue_update_wake_ba* to ensure that the batch size is updated before the wait * counts. */ -smp_mb__before_atomic (); +smp_mb ();for (i =0 ; i <SBQ_WAIT_QUEUES ; i++)atomic_set (&sbq->ws[i].wait_cnt,1 ); }
Greg Kroah-Hartman
maintainerPATCH 7/346 Revert "scsi: sd: Keep disk read-only when re-reading partition"
In reply to Greg Kroah-HartmanFrom: Martin K. Petersen <[email protected]>
commit 8acf608e602f6ec38b7cc37b04c80f1ce9a1a6cc upstream.
This reverts commit 20bd1d026aacc5399464f8328f305985c493cde3.
This patch introduced regressions for devices that come online in read-only state and subsequently switch to read-write.
Given how the partition code is currently implemented it is not possible to persist the read-only flag across a device revalidate call. This may need to get addressed in the future since it is common for user applications to proactively call BLKRRPART.
Reverting this commit will re-introduce a regression where a device-initiated revalidate event will cause the admin state to be forgotten. A separate patch will address this issue.
--- drivers/scsi/sd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/sd.c +1 -2
@@ -2586,7 +2586,6 @@ sd_read_write_protect_flag(struct scsi_dint res;struct scsi_device *sdp = sdkp->device;struct scsi_mode_data data; -int disk_ro =get_disk_ro (sdkp->disk);int old_wp = sdkp->write_prot;set_disk_ro (sdkp->disk,0 );
@@ -2627,7 +2626,7 @@ sd_read_write_protect_flag(struct scsi_d "Test WP failed, assume Write Enabled\n"); }else { sdkp->write_prot = ((data.device_specific &0x80 ) !=0 ); -set_disk_ro (sdkp->disk, sdkp->write_prot || disk_ro); +set_disk_ro (sdkp->disk, sdkp->write_prot);if (sdkp->first_scan || old_wp != sdkp->write_prot) {sd_printk (KERN_NOTICE , sdkp,"Write Protect is %s\n" , sdkp->write_prot ?"on" :"off" );
Greg Kroah-Hartman
maintainerPATCH 8/346 crypto: hash - fix incorrect HASH_MAX_DESCSIZE
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit e1354400b25da645c4764ed6844d12f1582c3b66 upstream.
The "hmac(sha3-224-generic)" algorithm has a descsize of 368 bytes, which is greater than HASH_MAX_DESCSIZE (360) which is only enough for sha3-224-generic. The check in shash_prepare_alg() doesn't catch this because the HMAC template doesn't set descsize on the algorithms, but rather sets it on each individual HMAC transform.
This causes a stack buffer overflow when SHASH_DESC_ON_STACK() is used with hmac(sha3-224-generic).
Fix it by increasing HASH_MAX_DESCSIZE to the real maximum. Also add a sanity check to hmac_init().
This was detected by the improved crypto self-tests in v5.2, by loading the tcrypt module with CONFIG_CRYPTO_MANAGER_EXTRA_TESTS=y enabled. I didn't notice this bug when I ran the self-tests by requesting the algorithms via AF_ALG (i.e., not using tcrypt), probably because the stack layout differs in the two cases and that made a difference here.
KASAN report:
BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:359 [inline]
BUG: KASAN: stack-out-of-bounds in shash_default_import+0x52/0x80 crypto/shash.c:223
Write of size 360 at addr ffff8880651defc8 by task insmod/3689
CPU: 2 PID: 3689 Comm: insmod Tainted: G E 5.1.0-10741-g35c99ffa20edd #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x86/0xc5 lib/dump_stack.c:113
print_address_description+0x7f/0x260 mm/kasan/report.c:188
__kasan_report+0x144/0x187 mm/kasan/report.c:317
kasan_report+0x12/0x20 mm/kasan/common.c:614
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x137/0x190 mm/kasan/generic.c:191
memcpy+0x37/0x50 mm/kasan/common.c:125
memcpy include/linux/string.h:359 [inline]
shash_default_import+0x52/0x80 crypto/shash.c:223
crypto_shash_import include/crypto/hash.h:880 [inline]
hmac_import+0x184/0x240 crypto/hmac.c:102
hmac_init+0x96/0xc0 crypto/hmac.c:107
crypto_shash_init include/crypto/hash.h:902 [inline]
shash_digest_unaligned+0x9f/0xf0 crypto/shash.c:194
crypto_shash_digest+0xe9/0x1b0 crypto/shash.c:211
generate_random_hash_testvec.constprop.11+0x1ec/0x5b0 crypto/testmgr.c:1331
test_hash_vs_generic_impl+0x3f7/0x5c0 crypto/testmgr.c:1420
__alg_test_hash+0x26d/0x340 crypto/testmgr.c:1502
alg_test_hash+0x22e/0x330 crypto/testmgr.c:1552
alg_test.part.7+0x132/0x610 crypto/testmgr.c:4931
alg_test+0x1f/0x40 crypto/testmgr.c:4952--- crypto/hmac.c | 2 ++ include/crypto/hash.h | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-)
crypto/hmac.c +2 -0
@@ -168,6 +168,8 @@ static int hmac_init_tfm(struct crypto_t parent->descsize =sizeof (struct shash_desc ) +crypto_shash_descsize (hash); +if (WARN_ON (parent->descsize >HASH_MAX_DESCSIZE )) +return -EINVAL ; ctx->hash = hash;return 0 ;
include/crypto/hash.h +7 -1
@@ -152,7 +152,13 @@ struct shash_desc { };#define HASH_MAX_DIGESTSIZE 64 -#define HASH_MAX_DESCSIZE 360 + +/* +* Worst case is hmac(sha3-224-generic). Its context is a nested 'shash_desc' +* containing a 'struct sha3_state'. +*/ +#define HASH_MAX_DESCSIZE (sizeof(struct shash_desc) + 360) +#define HASH_MAX_STATESIZE 512#define SHASH_DESC_ON_STACK (shash, ctx) \
Greg Kroah-Hartman
maintainerPATCH 9/346 crypto: vmx - CTR: always increment IV as quadword
In reply to Greg Kroah-HartmanFrom: Daniel Axtens <[email protected]>
commit 009b30ac7444c17fae34c4f435ebce8e8e2b3250 upstream.
The kernel self-tests picked up an issue with CTR mode:
alg: skcipher: p8_aes_ctr encryption test failed (wrong result) on test vector 3, cfg="uneven misaligned splits, may sleep"
Test vector 3 has an IV of FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD, so after 3 increments it should wrap around to 0.
In the aesp8-ppc code from OpenSSL, there are two paths that increment IVs: the bulk (8 at a time) path, and the individual path which is used when there are fewer than 8 AES blocks to process.
In the bulk path, the IV is incremented with vadduqm: "Vector Add Unsigned Quadword Modulo", which does 128-bit addition.
In the individual path, however, the IV is incremented with
vadduwm: "Vector Add Unsigned Word Modulo", which instead does 4 32-bit additions. Thus the IV would instead become FFFFFFFFFFFFFFFFFFFFFFFF00000000, throwing off the result.
Use vadduqm.
This was probably a typo originally, what with q and w being adjacent. It is a pretty narrow edge case: I am really impressed by the quality of the kernel self-tests!
--- drivers/crypto/vmx/aesp8-ppc.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/vmx/aesp8-ppc.pl +1 -1
@@ -1357,7 +1357,7 @@ Loop_ctr32_enc: addi $idx,$idx,16 bdnz Loop_ctr32_enc - vadduwm $ivec,$ivec,$one + vadduqm $ivec,$ivec,$one vmr $dat,$inptail lvx $inptail,0,$inp addi $inp,$inp,16
Greg Kroah-Hartman
maintainerPATCH 10/346 mmc: sdhci-iproc: cygnus: Set NO_HISPD bit to fix HS50 data hold time problem
In reply to Greg Kroah-HartmanFrom: Trac Hoang <[email protected]>
commit b7dfa695afc40d5396ed84b9f25aa3754de23e39 upstream.
The iproc host eMMC/SD controller hold time does not meet the specification in the HS50 mode. This problem can be mitigated by disabling the HISPD bit; thus forcing the controller output data to be driven on the falling clock edges rather than the rising clock edges.
This change applies only to the Cygnus platform.
Stable tag (v4.12+) chosen to assist stable kernel maintainers so that the change does not produce merge conflicts backporting to older kernel versions. In reality, the timing bug existed since the driver was first introduced but there is no need for this driver to be supported in kernel versions that old.
--- drivers/mmc/host/sdhci-iproc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci-iproc.c +2 -1
@@ -196,7 +196,8 @@ static const struct sdhci_ops sdhci_ipro };static const struct sdhci_pltfm_data sdhci_iproc_cygnus_pltfm_data = { - .quirks =SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK , + .quirks =SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK | +SDHCI_QUIRK_NO_HISPD_BIT , .quirks2 =SDHCI_QUIRK2_ACMD23_BROKEN |SDHCI_QUIRK2_HOST_OFF_CARD_ON , .ops = &sdhci_iproc_32only_ops, };
Greg Kroah-Hartman
maintainerPATCH 11/346 mmc: sdhci-iproc: Set NO_HISPD bit to fix HS50 data hold time problem
In reply to Greg Kroah-HartmanFrom: Trac Hoang <[email protected]>
commit ec0970e0a1b2c807c908d459641a9f9a1be3e130 upstream.
The iproc host eMMC/SD controller hold time does not meet the specification in the HS50 mode. This problem can be mitigated by disabling the HISPD bit; thus forcing the controller output data to be driven on the falling clock edges rather than the rising clock edges.
Stable tag (v4.12+) chosen to assist stable kernel maintainers so that the change does not produce merge conflicts backporting to older kernel versions. In reality, the timing bug existed since the driver was first introduced but there is no need for this driver to be supported in kernel versions that old.
--- drivers/mmc/host/sdhci-iproc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci-iproc.c +2 -1
@@ -220,7 +220,8 @@ static const struct sdhci_iproc_data iprstatic const struct sdhci_pltfm_data sdhci_iproc_pltfm_data = { .quirks =SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK | -SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 , +SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 | +SDHCI_QUIRK_NO_HISPD_BIT , .quirks2 =SDHCI_QUIRK2_ACMD23_BROKEN , .ops = &sdhci_iproc_ops, };
Greg Kroah-Hartman
maintainerPATCH 12/346 kvm: svm/avic: fix off-by-one in checking host APIC ID
In reply to Greg Kroah-HartmanFrom: Suthikulpanit, Suravee <[email protected]>
commit c9bcd3e3335d0a29d89fabd2c385e1b989e6f1b0 upstream.
Current logic does not allow VCPU to be loaded onto CPU with APIC ID 255. This should be allowed since the host physical APIC ID field in the AVIC Physical APIC table entry is an 8-bit value, and APIC ID 255 is valid in system with x2APIC enabled. Instead, do not allow VCPU load if the host APIC ID cannot be represented by an 8-bit value.
Also, use the more appropriate AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK instead of AVIC_MAX_PHYSICAL_ID_COUNT.
--- arch/x86/kvm/svm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/x86/kvm/svm.c +5 -1
@@ -2020,7 +2020,11 @@ static void avic_vcpu_load(struct kvm_vcif (!kvm_vcpu_apicv_active (vcpu))return ; -if (WARN_ON (h_physical_id >=AVIC_MAX_PHYSICAL_ID_COUNT )) +/* +* Since the host physical APIC id is 8 bits, +* we can support host APIC ID upto 255. +*/ +if (WARN_ON (h_physical_id >AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK ))return ; entry =READ_ONCE (*(svm->avic_physical_id_cache));
Greg Kroah-Hartman
maintainerPATCH 13/346 libnvdimm/pmem: Bypass CONFIG_HARDENED_USERCOPY overhead
In reply to Greg Kroah-HartmanFrom: Dan Williams <[email protected]>
commit 52f476a323f9efc959be1c890d0cdcf12e1582e0 upstream.
Jeff discovered that performance improves from ~375K iops to ~519K iops on a simple psync-write fio workload when moving the location of 'struct page' from the default PMEM location to DRAM. This result is surprising because the expectation is that 'struct page' for dax is only needed for third party references to dax mappings. For example, a dax-mapped buffer passed to another system call for direct-I/O requires 'struct page' for sending the request down the driver stack and pinning the page. There is no usage of 'struct page' for first party access to a file via read(2)/write(2) and friends.
However, this "no page needed" expectation is violated by CONFIG_HARDENED_USERCOPY and the check_copy_size() performed in copy_from_iter_full_nocache() and copy_to_iter_mcsafe(). The check_heap_object() helper routine assumes the buffer is backed by a slab allocator (DRAM) page and applies some checks. Those checks are invalid, dax pages do not originate from the slab, and redundant, dax_iomap_actor() has already validated that the I/O is within bounds. Specifically that routine validates that the logical file offset is within bounds of the file, then it does a sector-to-pfn translation which validates that the physical mapping is within bounds of the block device.
Bypass additional hardened usercopy overhead and call the 'no check' versions of the copy_{to,from}_iter operations directly.
--- drivers/nvdimm/pmem.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/nvdimm/pmem.c +8 -2
@@ -281,16 +281,22 @@ static long pmem_dax_direct_access(strucreturn __pmem_direct_access (pmem, pgoff, nr_pages, kaddr, pfn); } +/* +* Use the 'no check' versions of copy_from_iter_flushcache() and +* copy_to_iter_mcsafe() to bypass HARDENED_USERCOPY overhead. Bounds +* checking, both file offset and device offset, is handled by +* dax_iomap_actor() +*/ static size_t pmem_copy_from_iter (struct dax_device *dax_dev,pgoff_t pgoff,void *addr,size_t bytes,struct iov_iter *i) { -return copy_from_iter_flushcache (addr, bytes, i); +return _copy_from_iter_flushcache (addr, bytes, i); }static size_t pmem_copy_to_iter (struct dax_device *dax_dev,pgoff_t pgoff,void *addr,size_t bytes,struct iov_iter *i) { -return copy_to_iter_mcsafe (addr, bytes, i); +return _copy_to_iter_mcsafe (addr, bytes, i); }static const struct dax_operations pmem_dax_ops = {
Greg Kroah-Hartman
maintainerPATCH 14/346 arm64/kernel: kaslr: reduce module randomization range to 2 GB
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit b2eed9b58811283d00fa861944cb75797d4e52a7 upstream.
The following commit
7290d5809571 ("module: use relative references for __ksymtab entries")
updated the ksymtab handling of some KASLR capable architectures so that ksymtab entries are emitted as pairs of 32-bit relative references. This reduces the size of the entries, but more importantly, it gets rid of statically assigned absolute addresses, which require fixing up at boot time if the kernel is self relocating (which takes a 24 byte RELA entry for each member of the ksymtab struct).
Since ksymtab entries are always part of the same module as the symbol they export, it was assumed at the time that a 32-bit relative reference is always sufficient to capture the offset between a ksymtab entry and its target symbol.
Unfortunately, this is not always true: in the case of per-CPU variables, a per-CPU variable's base address (which usually differs from the actual address of any of its per-CPU copies) is allocated in the vicinity of the ..data.percpu section in the core kernel (i.e., in the per-CPU reserved region which follows the section containing the core kernel's statically allocated per-CPU variables).
Since we randomize the module space over a 4 GB window covering the core kernel (based on the -/+ 4 GB range of an ADRP/ADD pair), we may end up putting the core kernel out of the -/+ 2 GB range of 32-bit relative references of module ksymtab entries that refer to per-CPU variables.
So reduce the module randomization range a bit further. We lose 1 bit of randomization this way, but this is something we can tolerate.
--- arch/arm64/kernel/kaslr.c | 6 +++--- arch/arm64/kernel/module.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/kernel/kaslr.c +3 -3
@@ -145,15 +145,15 @@ u64 __init kaslr_early_init(u64 dt_phys)if (IS_ENABLED (CONFIG_RANDOMIZE_MODULE_REGION_FULL )) {/* -* Randomize the module region over a 4 GB window covering the +* Randomize the module region over a 2 GB window covering the * kernel. This reduces the risk of modules leaking information * about the address of the kernel itself, but results in * branches between modules and the core kernel that are * resolved via PLTs. (Branches between modules will be * resolved normally.) */ - module_range =SZ_4G - (u64)(_end - _stext); - module_alloc_base =max ((u64 )_end + offset -SZ_4G , + module_range =SZ_2G - (u64)(_end - _stext); + module_alloc_base =max ((u64 )_end + offset -SZ_2G , (u64 )MODULES_VADDR ); }else {/*
arch/arm64/kernel/module.c +1 -1
@@ -56,7 +56,7 @@ void *module_alloc(unsigned long size)* can simply omit this fallback in that case. */ p =__vmalloc_node_range (size,MODULE_ALIGN , module_alloc_base, - module_alloc_base +SZ_4G ,GFP_KERNEL , + module_alloc_base +SZ_2G ,GFP_KERNEL ,PAGE_KERNEL_EXEC ,0 ,NUMA_NO_NODE ,__builtin_return_address (0 ));
Greg Kroah-Hartman
maintainerPATCH 15/346 arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit a98d9ae937d256ed679a935fc82d9deaa710d98e upstream.
DMA allocations that can't sleep may return non-remapped addresses, but we do not properly handle them in the mmap and get_sgtable methods. Resolve non-vmalloc addresses using virt_to_page to handle this corner case.
--- arch/arm64/mm/dma-mapping.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/arm64/mm/dma-mapping.c +10 -0
@@ -249,6 +249,11 @@ static int __iommu_mmap_attrs(struct devif (dma_mmap_from_dev_coherent (dev, vma, cpu_addr, size, &ret))return ret; +if (!is_vmalloc_addr (cpu_addr)) { +unsigned long pfn =page_to_pfn (virt_to_page (cpu_addr)); +return __swiotlb_mmap_pfn (vma, pfn, size); + } +if (attrs &DMA_ATTR_FORCE_CONTIGUOUS ) {/* * DMA_ATTR_FORCE_CONTIGUOUS allocations are always remapped,
@@ -272,6 +277,11 @@ static int __iommu_get_sgtable(struct deunsigned int count =PAGE_ALIGN (size) >>PAGE_SHIFT ;struct vm_struct *area =find_vm_area (cpu_addr); +if (!is_vmalloc_addr (cpu_addr)) { +struct page *page =virt_to_page (cpu_addr); +return __swiotlb_get_sgtable_page (sgt, page, size); + } +if (attrs &DMA_ATTR_FORCE_CONTIGUOUS ) {/* * DMA_ATTR_FORCE_CONTIGUOUS allocations are always remapped,
Greg Kroah-Hartman
maintainerPATCH 16/346 gfs2: Fix sign extension bug in gfs2_update_stats
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
commit 5a5ec83d6ac974b12085cd99b196795f14079037 upstream.
Commit 4d207133e9c3 changed the types of the statistic values in struct gfs2_lkstats from s64 to u64. Because of that, what should be a signed value in gfs2_update_stats turned into an unsigned value. When shifted right, we end up with a large positive value instead of a small negative value, which results in an incorrect variance estimate.
--- fs/gfs2/lock_dlm.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/gfs2/lock_dlm.c +5 -4
@@ -31,9 +31,10 @@* @delta is the difference between the current rtt sample and the * running average srtt. We add 1/8 of that to the srtt in order to * update the current srtt estimate. The variance estimate is a bit -* more complicated. We subtract the abs value of the @delta from -* the current variance estimate and add 1/4 of that to the running -* total. +* more complicated. We subtract the current variance estimate from +* the abs value of the @delta and add 1/4 of that to the running +* total. That's equivalent to 3/4 of the current variance +* estimate plus 1/4 of the abs of @delta. * * Note that the index points at the array entry containing the smoothed * mean value, and the variance is always in the following entry
@@ -49,7 +50,7 @@ static inline void gfs2_update_stats(strs64 delta = sample - s->stats[index]; s->stats[index] += (delta >>3 ); index++; - s->stats[index] += ((abs (delta) - s->stats[index]) >>2 ); + s->stats[index] += (s64)(abs (delta) - s->stats[index]) >>2 ; }/**
Greg Kroah-Hartman
maintainerPATCH 17/346 btrfs: dont double unlock on error in btrfs_punch_hole
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 8fca955057b9c58467d1b231e43f19c4cf26ae8c upstream.
If we have an error writing out a delalloc range in btrfs_punch_hole_lock_range we'll unlock the inode and then goto out_only_mutex, where we will again unlock the inode. This is bad, don't do this.
--- fs/btrfs/file.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/btrfs/file.c +1 -3
@@ -2546,10 +2546,8 @@ static int btrfs_punch_hole(struct inode ret =btrfs_punch_hole_lock_range (inode, lockstart, lockend, &cached_state); -if (ret) { -inode_unlock (inode); +if (ret) goto out_only_mutex; - } path =btrfs_alloc_path ();if (!path) {
Greg Kroah-Hartman
maintainerPATCH 18/346 Btrfs: do not abort transaction at btrfs_update_root() after failure to COW path
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 72bd2323ec87722c115a5906bc6a1b31d11e8f54 upstream.
Currently when we fail to COW a path at btrfs_update_root() we end up always aborting the transaction. However all the current callers of btrfs_update_root() are able to deal with errors returned from it, many do end up aborting the transaction themselves (directly or not, such as the transaction commit path), other BUG_ON() or just gracefully cancel whatever they were doing.
When syncing the fsync log, we call btrfs_update_root() through tree-log.c:update_log_root(), and if it returns an -ENOSPC error, the log sync code does not abort the transaction, instead it gracefully handles the error and returns -EAGAIN to the fsync handler, so that it falls back to a transaction commit. Any other error different from -ENOSPC, makes the log sync code abort the transaction.
So remove the transaction abort from btrfs_update_log() when we fail to COW a path to update the root item, so that if an -ENOSPC failure happens we avoid aborting the current transaction and have a chance of the fsync succeeding after falling back to a transaction commit.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203413
--- fs/btrfs/root-tree.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/btrfs/root-tree.c +1 -3
@@ -132,10 +132,8 @@ int btrfs_update_root(struct btrfs_transreturn -ENOMEM ; ret =btrfs_search_slot (trans, root, key, path,0 ,1 ); -if (ret <0 ) { -btrfs_abort_transaction (trans, ret); +if (ret <0 ) goto out; - }if (ret !=0 ) {btrfs_print_leaf (path->nodes[0 ]);
Greg Kroah-Hartman
maintainerPATCH 19/346 Btrfs: avoid fallback to transaction commit during fsync of files with holes
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit ebb929060aeb162417b4c1307e63daee47b208d9 upstream.
When we are doing a full fsync (bit BTRFS_INODE_NEEDS_FULL_SYNC set) of a file that has holes and has file extent items spanning two or more leafs, we can end up falling to back to a full transaction commit due to a logic bug that leads to failure to insert a duplicate file extent item that is meant to represent a hole between the last file extent item of a leaf and the first file extent item in the next leaf. The failure (EEXIST error) leads to a transaction commit (as most errors when logging an inode do).
For example, we have the two following leafs:
Leaf N:
-----------------------------------------------
| ..., ..., ..., (257, FILE_EXTENT_ITEM, 64K) |
-----------------------------------------------
The file extent item at the end of leaf N has a length of 4Kb, representing the file range from 64K to 68K - 1.
Leaf N + 1:
-----------------------------------------------
| (257, FILE_EXTENT_ITEM, 72K), ..., ..., ... |
-----------------------------------------------
The file extent item at the first slot of leaf N + 1 has a length of 4Kb too, representing the file range from 72K to 76K - 1.
During the full fsync path, when we are at tree-log.c:copy_items() with leaf N as a parameter, after processing the last file extent item, that represents the extent at offset 64K, we take a look at the first file extent item at the next leaf (leaf N + 1), and notice there's a 4K hole between the two extents, and therefore we insert a file extent item representing that hole, starting at file offset 68K and ending at offset 72K - 1. However we don't update the value of *last_extent, which is used to represent the end offset (plus 1, non-inclusive end) of the last file extent item inserted in the log, so it stays with a value of 68K and not with a value of 72K.
Then, when copy_items() is called for leaf N + 1, because the value of *last_extent is smaller then the offset of the first extent item in the leaf (68K < 72K), we look at the last file extent item in the previous leaf (leaf N) and see it there's a 4K gap between it and our first file extent item (again, 68K < 72K), so we decide to insert a file extent item representing the hole, starting at file offset 68K and ending at offset 72K - 1, this insertion will fail with -EEXIST being returned from btrfs_insert_file_extent() because we already inserted a file extent item representing a hole for this offset (68K) in the previous call to copy_items(), when processing leaf N.
The -EEXIST error gets propagated to the fsync callback, btrfs_sync_file(), which falls back to a full transaction commit.
Fix this by adjusting *last_extent after inserting a hole when we had to look at the next leaf.
--- fs/btrfs/tree-log.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/tree-log.c +1 -0
@@ -4106,6 +4106,7 @@ fill_holes: *last_extent,0 ,0 , len,0 , len, 0, 0, 0); + *last_extent += len; } } }
Greg Kroah-Hartman
maintainerPATCH 20/346 Btrfs: fix race between ranged fsync and writeback of adjacent ranges
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 0c713cbab6200b0ab6473b50435e450a6e1de85d upstream.
When we do a full fsync (the bit BTRFS_INODE_NEEDS_FULL_SYNC is set in the inode) that happens to be ranged, which happens during a msync() or writes for files opened with O_SYNC for example, we can end up with a corrupt log, due to different file extent items representing ranges that overlap with each other, or hit some assertion failures.
When doing a ranged fsync we only flush delalloc and wait for ordered exents within that range. If while we are logging items from our inode ordered extents for adjacent ranges complete, we end up in a race that can make us insert the file extent items that overlap with others we logged previously and the assertion failures.
For example, if tree-log.c:copy_items() receives a leaf that has the following file extents items, all with a length of 4K and therefore there is an implicit hole in the range 68K to 72K - 1:
(257 EXTENT_ITEM 64K), (257 EXTENT_ITEM 72K), (257 EXTENT_ITEM 76K), ...
It copies them to the log tree. However due to the need to detect implicit holes, it may release the path, in order to look at the previous leaf to detect an implicit hole, and then later it will search again in the tree for the first file extent item key, with the goal of locking again the leaf (which might have changed due to concurrent changes to other inodes).
However when it locks again the leaf containing the first key, the key corresponding to the extent at offset 72K may not be there anymore since there is an ordered extent for that range that is finishing (that is, somewhere in the middle of btrfs_finish_ordered_io()), and it just removed the file extent item but has not yet replaced it with a new file extent item, so the part of copy_items() that does hole detection will decide that there is a hole in the range starting from 68K to 76K - 1, and therefore insert a file extent item to represent that hole, having a key offset of 68K. After that we now have a log tree with 2 different extent items that have overlapping ranges:
1) The file extent item copied before copy_items() released the path, which has a key offset of 72K and a length of 4K, representing the file range 72K to 76K - 1.
2) And a file extent item representing a hole that has a key offset of 68K and a length of 8K, representing the range 68K to 76K - 1. This item was inserted after releasing the path, and overlaps with the extent item inserted before.
The overlapping extent items can cause all sorts of unpredictable and incorrect behaviour, either when replayed or if a fast (non full) fsync happens later, which can trigger a BUG_ON() when calling btrfs_set_item_key_safe() through __btrfs_drop_extents(), producing a trace like the following:
[61666.783269] ------------[ cut here ]------------ [61666.783943] kernel BUG at fs/btrfs/ctree.c:3182! [61666.784644] invalid opcode: 0000 [#1] PREEMPT SMP (...) [61666.786253] task: ffff880117b88c40 task.stack: ffffc90008168000 [61666.786253] RIP: 0010:btrfs_set_item_key_safe+0x7c/0xd2 [btrfs] [61666.786253] RSP: 0018:ffffc9000816b958 EFLAGS: 00010246 [61666.786253] RAX: 0000000000000000 RBX: 000000000000000f RCX: 0000000000030000 [61666.786253] RDX: 0000000000000000 RSI: ffffc9000816ba4f RDI: ffffc9000816b937 [61666.786253] RBP: ffffc9000816b998 R08: ffff88011dae2428 R09: 0000000000001000 [61666.786253] R10: 0000160000000000 R11: 6db6db6db6db6db7 R12: ffff88011dae2418 [61666.786253] R13: ffffc9000816ba4f R14: ffff8801e10c4118 R15: ffff8801e715c000 [61666.786253] FS: 00007f6060a18700(0000) GS:ffff88023f5c0000(0000) knlGS:0000000000000000 [61666.786253] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [61666.786253] CR2: 00007f6060a28000 CR3: 0000000213e69000 CR4: 00000000000006e0 [61666.786253] Call Trace: [61666.786253] __btrfs_drop_extents+0x5e3/0xaad [btrfs] [61666.786253] ? time_hardirqs_on+0x9/0x14 [61666.786253] btrfs_log_changed_extents+0x294/0x4e0 [btrfs] [61666.786253] ? release_extent_buffer+0x38/0xb4 [btrfs] [61666.786253] btrfs_log_inode+0xb6e/0xcdc [btrfs] [61666.786253] ? lock_acquire+0x131/0x1c5 [61666.786253] ? btrfs_log_inode_parent+0xee/0x659 [btrfs] [61666.786253] ? arch_local_irq_save+0x9/0xc [61666.786253] ? btrfs_log_inode_parent+0x1f5/0x659 [btrfs] [61666.786253] btrfs_log_inode_parent+0x223/0x659 [btrfs] [61666.786253] ? arch_local_irq_save+0x9/0xc [61666.786253] ? lockref_get_not_zero+0x2c/0x34 [61666.786253] ? rcu_read_unlock+0x3e/0x5d [61666.786253] btrfs_log_dentry_safe+0x60/0x7b [btrfs] [61666.786253] btrfs_sync_file+0x317/0x42c [btrfs] [61666.786253] vfs_fsync_range+0x8c/0x9e [61666.786253] SyS_msync+0x13c/0x1c9 [61666.786253] entry_SYSCALL_64_fastpath+0x18/0xad
A sample of a corrupt log tree leaf with overlapping extents I got from running btrfs/072:
item 14 key (295 108 200704) itemoff 2599 itemsize 53
extent data disk bytenr 0 nr 0
extent data offset 0 nr 458752 ram 458752
item 15 key (295 108 659456) itemoff 2546 itemsize 53
extent data disk bytenr 4343541760 nr 770048
extent data offset 606208 nr 163840 ram 770048
item 16 key (295 108 663552) itemoff 2493 itemsize 53
extent data disk bytenr 4343541760 nr 770048
extent data offset 610304 nr 155648 ram 770048
item 17 key (295 108 819200) itemoff 2440 itemsize 53
extent data disk bytenr 4334788608 nr 4096
extent data offset 0 nr 4096 ram 4096The file extent item at offset 659456 (item 15) ends at offset 823296 (659456 + 163840) while the next file extent item (item 16) starts at offset 663552.
Another different problem that the race can trigger is a failure in the assertions at tree-log.c:copy_items(), which expect that the first file extent item key we found before releasing the path exists after we have released path and that the last key we found before releasing the path also exists after releasing the path:
$ cat -n fs/btrfs/tree-log.c
4080 if (need_find_last_extent) {
4081 /* btrfs_prev_leaf could return 1 without releasing the path */
4082 btrfs_release_path(src_path);
4083 ret = btrfs_search_slot(NULL, inode->root, &first_key,
4084 src_path, 0, 0);
4085 if (ret < 0)
4086 return ret;
4087 ASSERT(ret == 0);
(...)
4103 if (i >= btrfs_header_nritems(src_path->nodes[0])) {
4104 ret = btrfs_next_leaf(inode->root, src_path);
4105 if (ret < 0)
4106 return ret;
4107 ASSERT(ret == 0);
4108 src = src_path->nodes[0];
4109 i = 0;
4110 need_find_last_extent = true;
4111 }
(...)The second assertion implicitly expects that the last key before the path release still exists, because the surrounding while loop only stops after we have found that key. When this assertion fails it produces a stack like this:
[139590.037075] assertion failed: ret == 0, file: fs/btrfs/tree-log.c, line: 4107 [139590.037406] ------------[ cut here ]------------ [139590.037707] kernel BUG at fs/btrfs/ctree.h:3546! [139590.038034] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [139590.038340] CPU: 1 PID: 31841 Comm: fsstress Tainted: G W 5.0.0-btrfs-next-46 #1 (...) [139590.039354] RIP: 0010:assfail.constprop.24+0x18/0x1a [btrfs] (...) [139590.040397] RSP: 0018:ffffa27f48f2b9b0 EFLAGS: 00010282 [139590.040730] RAX: 0000000000000041 RBX: ffff897c635d92c8 RCX: 0000000000000000 [139590.041105] RDX: 0000000000000000 RSI: ffff897d36a96868 RDI: ffff897d36a96868 [139590.041470] RBP: ffff897d1b9a0708 R08: 0000000000000000 R09: 0000000000000000 [139590.041815] R10: 0000000000000008 R11: 0000000000000000 R12: 0000000000000013 [139590.042159] R13: 0000000000000227 R14: ffff897cffcbba88 R15: 0000000000000001 [139590.042501] FS: 00007f2efc8dee80(0000) GS:ffff897d36a80000(0000) knlGS:0000000000000000 [139590.042847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [139590.043199] CR2: 00007f8c064935e0 CR3: 0000000232252002 CR4: 00000000003606e0 [139590.043547] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [139590.043899] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [139590.044250] Call Trace: [139590.044631] copy_items+0xa3f/0x1000 [btrfs] [139590.045009] ? generic_bin_search.constprop.32+0x61/0x200 [btrfs] [139590.045396] btrfs_log_inode+0x7b3/0xd70 [btrfs] [139590.045773] btrfs_log_inode_parent+0x2b3/0xce0 [btrfs] [139590.046143] ? do_raw_spin_unlock+0x49/0xc0 [139590.046510] btrfs_log_dentry_safe+0x4a/0x70 [btrfs] [139590.046872] btrfs_sync_file+0x3b6/0x440 [btrfs] [139590.047243] btrfs_file_write_iter+0x45b/0x5c0 [btrfs] [139590.047592] __vfs_write+0x129/0x1c0 [139590.047932] vfs_write+0xc2/0x1b0 [139590.048270] ksys_write+0x55/0xc0 [139590.048608] do_syscall_64+0x60/0x1b0 [139590.048946] entry_SYSCALL_64_after_hwframe+0x49/0xbe [139590.049287] RIP: 0033:0x7f2efc4be190 (...) [139590.050342] RSP: 002b:00007ffe743243a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [139590.050701] RAX: ffffffffffffffda RBX: 0000000000008d58 RCX: 00007f2efc4be190 [139590.051067] RDX: 0000000000008d58 RSI: 00005567eca0f370 RDI: 0000000000000003 [139590.051459] RBP: 0000000000000024 R08: 0000000000000003 R09: 0000000000008d60 [139590.051863] R10: 0000000000000078 R11: 0000000000000246 R12: 0000000000000003 [139590.052252] R13: 00000000003d3507 R14: 00005567eca0f370 R15: 0000000000000000 (...) [139590.055128] ---[ end trace 193f35d0215cdeeb ]---
So fix this race between a full ranged fsync and writeback of adjacent ranges by flushing all delalloc and waiting for all ordered extents to complete before logging the inode. This is the simplest way to solve the problem because currently the full fsync path does not deal with ranges at all (it assumes a full range from 0 to LLONG_MAX) and it always needs to look at adjacent ranges for hole detection. For use cases of ranged fsyncs this can make a few fsyncs slower but on the other hand it can make some following fsyncs to other ranges do less work or no need to do anything at all. A full fsync is rare anyway and happens only once after loading/creating an inode and once after less common operations such as a shrinking truncate.
This is an issue that exists for a long time, and was often triggered by generic/127, because it does mmap'ed writes and msync (which triggers a ranged fsync). Adding support for the tree checker to detect overlapping extents (next patch in the series) and trigger a WARN() when such cases are found, and then calling btrfs_check_leaf_full() at the end of btrfs_insert_file_extent() made the issue much easier to detect. Running btrfs/072 with that change to the tree checker and making fsstress open files always with O_SYNC made it much easier to trigger the issue (as triggering it with generic/127 is very rare).
--- fs/btrfs/file.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/btrfs/file.c +12 -0
@@ -2059,6 +2059,18 @@ int btrfs_sync_file(struct file *file, lu64 len;/* +* If the inode needs a full sync, make sure we use a full range to +* avoid log tree corruption, due to hole detection racing with ordered +* extent completion for adjacent ranges, and assertion failures during +* hole detection. +*/ +if (test_bit (BTRFS_INODE_NEEDS_FULL_SYNC , + &BTRFS_I (inode)->runtime_flags)) { + start =0 ; + end =LLONG_MAX ; + } + +/* * The range length can be represented by u64, we have to do the typecasts * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync() */
Greg Kroah-Hartman
maintainerPATCH 21/346 btrfs: sysfs: Fix error path kobject memory leak
In reply to Greg Kroah-HartmanFrom: Tobin C. Harding <[email protected]>
commit 450ff8348808a89cc27436771aa05c2b90c0eef1 upstream.
If a call to kobject_init_and_add() fails we must call kobject_put() otherwise we leak memory.
Calling kobject_put() when kobject_init_and_add() fails drops the refcount back to 0 and calls the ktype release method (which in turn calls the percpu destroy and kfree).
Add call to kobject_put() in the error path of call to kobject_init_and_add().
--- fs/btrfs/extent-tree.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/extent-tree.c +1 -2
@@ -3985,8 +3985,7 @@ static int create_space_info(struct btrf info->space_info_kobj,"%s" , alloc_name(space_info->flags));if (ret) { -percpu_counter_destroy (&space_info->total_bytes_pinned); -kfree (space_info); +kobject_put (&space_info->kobj);return ret; }
Greg Kroah-Hartman
maintainerPATCH 22/346 btrfs: sysfs: dont leak memory when failing add fsid
In reply to Greg Kroah-HartmanFrom: Tobin C. Harding <[email protected]>
commit e32773357d5cc271b1d23550b3ed026eb5c2a468 upstream.
A failed call to kobject_init_and_add() must be followed by a call to kobject_put(). Currently in the error path when adding fs_devices we are missing this call. This could be fixed by calling btrfs_sysfs_remove_fsid() if btrfs_sysfs_add_fsid() returns an error or by adding a call to kobject_put() directly in btrfs_sysfs_add_fsid(). Here we choose the second option because it prevents the slightly unusual error path handling requirements of kobject from leaking out into btrfs functions.
Add a call to kobject_put() in the error path of kobject_add_and_init(). This causes the release method to be called if kobject_init_and_add() fails. open_tree() is the function that calls btrfs_sysfs_add_fsid() and the error code in this function is already written with the assumption that the release method is called during the error path of open_tree() (as seen by the call to btrfs_sysfs_remove_fsid() under the fail_fsdev_sysfs label).
--- fs/btrfs/sysfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/btrfs/sysfs.c +6 -1
@@ -825,7 +825,12 @@ int btrfs_sysfs_add_fsid(struct btrfs_fs fs_devs->fsid_kobj.kset = btrfs_kset; error =kobject_init_and_add (&fs_devs->fsid_kobj, &btrfs_ktype, parent,"%pU" , fs_devs->fsid); -return error; +if (error) { +kobject_put (&fs_devs->fsid_kobj); +return error; + } + +return 0 ; }int btrfs_sysfs_add_mounted (struct btrfs_fs_info *fs_info)
Greg Kroah-Hartman
maintainerPATCH 23/346 fbdev: fix divide error in fb_var_to_videomode
In reply to Greg Kroah-HartmanFrom: Shile Zhang <[email protected]>
commit cf84807f6dd0be5214378e66460cfc9187f532f9 upstream.
To fix following divide-by-zero error found by Syzkaller:
divide error: 0000 [#1] SMP PTI
CPU: 7 PID: 8447 Comm: test Kdump: loaded Not tainted 4.19.24-8.al7.x86_64 #1 Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 RIP: 0010:fb_var_to_videomode+0xae/0xc0 Code: 04 44 03 46 78 03 4e 7c 44 03 46 68 03 4e 70 89 ce d1 ee 69 c0 e8 03 00 00 f6 c2 01 0f 45 ce 83 e2 02 8d 34 09 0f 45 ce 31 d2 <41> f7 f0 31 d2 f7 f1 89 47 08 f3 c3 66 0f 1f 44 00 00 0f 1f 44 00 RSP: 0018:ffffb7e189347bf0 EFLAGS: 00010246 RAX: 00000000e1692410 RBX: ffffb7e189347d60 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffb7e189347c10 RBP: ffff99972a091c00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000100 R13: 0000000000010000 R14: 00007ffd66baf6d0 R15: 0000000000000000 FS: 00007f2054d11740(0000) GS:ffff99972fbc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f205481fd20 CR3: 00000004288a0001 CR4: 00000000001606a0 Call Trace: fb_set_var+0x257/0x390 ? lookup_fast+0xbb/0x2b0 ? fb_open+0xc0/0x140 ? chrdev_open+0xa6/0x1a0 do_fb_ioctl+0x445/0x5a0 do_vfs_ioctl+0x92/0x5f0 ? __alloc_fd+0x3d/0x160 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x5b/0x190 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f20548258d7 Code: 44 00 00 48 8b 05 b9 15 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 89 15 2d 00 f7 d8 64 89 01 48
It can be triggered easily with following test code:
#include <linux/fb.h>
#include <fcntl.h>
#include <sys/ioctl.h>
int main(void)
{
struct fb_var_screeninfo var = {.activate = 0x100, .pixclock = 60};
int fd = open("/dev/fb0", O_RDWR);
if (fd < 0)
return 1; if (ioctl(fd, FBIOPUT_VSCREENINFO, &var))
return 1;
return 0;}
--- drivers/video/fbdev/core/modedb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/core/modedb.c +3 -0
@@ -935,6 +935,9 @@ void fb_var_to_videomode(struct fb_videoif (var->vmode &FB_VMODE_DOUBLE ) vtotal *=2 ; +if (!htotal || !vtotal) +return ; + hfreq = pixclock/htotal; mode->refresh = hfreq/vtotal; }
Greg Kroah-Hartman
maintainerPATCH 24/346 cifs: fix credits leak for SMB1 oplock breaks
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
commit d69cb728e70c40268762182a62f5d5d6fa51c5b2 upstream.
For SMB1 oplock breaks we would grab one credit while sending the PDU but we would never relese the credit back since we will never receive a response to this from the server. Eventuallt this would lead to a hang once all credits are leaked.
Fix this by defining a new flag CIFS_NO_SRV_RSP which indicates that there is no server response to this command and thus we need to add any credits back immediately after sending the PDU.
--- fs/cifs/cifsglob.h | 1 + fs/cifs/cifssmb.c | 2 +- fs/cifs/transport.c | 10 +++++----- 3 files changed, 7 insertions(+), 6 deletions(-)
fs/cifs/cifsglob.h +1 -0
@@ -1657,6 +1657,7 @@ static inline bool is_retryable_error(in#define CIFS_HAS_CREDITS 0x0400/* already has credits */ #define CIFS_TRANSFORM_REQ 0x0800/* transform request before sending */ +#define CIFS_NO_SRV_RSP 0x1000/* there is no server response */ /* Security Flags: indicate type of session setup needed */ #define CIFSSEC_MAY_SIGN 0x00001
fs/cifs/cifssmb.c +1 -1
@@ -2533,7 +2533,7 @@ CIFSSMBLock(const unsigned int xid, struif (lockType ==LOCKING_ANDX_OPLOCK_RELEASE ) {/* no response expected */ - flags =CIFS_ASYNC_OP |CIFS_OBREAK_OP ; + flags =CIFS_NO_SRV_RSP |CIFS_ASYNC_OP |CIFS_OBREAK_OP ; pSMB->Timeout =0 ; }else if (waitFlag) { flags =CIFS_BLOCKING_OP ;/* blocking operation, no timeout */
fs/cifs/transport.c +5 -5
@@ -906,8 +906,11 @@ compound_send_recv(const unsigned int ximutex_unlock (&ses->server->srv_mutex); -if (rc <0 ) { -/* Sending failed for some reason - return credits back */ +/* +* If sending failed for some reason or it is an oplock break that we +* will not receive a response to - return credits back +*/ +if (rc <0 || (flags &CIFS_NO_SRV_RSP )) {for (i =0 ; i < num_rqst; i++)add_credits (ses->server, credits[i], optype); goto out;
@@ -928,9 +931,6 @@ compound_send_recv(const unsigned int xismb311_update_preauth_hash (ses, rqst[0 ].rq_iov, rqst[0 ].rq_nvec); -if (timeout ==CIFS_ASYNC_OP ) - goto out; -for (i =0 ; i < num_rqst; i++) { rc =wait_for_response (ses->server, midQ[i]);if (rc !=0 )
Greg Kroah-Hartman
maintainerPATCH 25/346 brcmfmac: assure SSID length from firmware is limited
In reply to Greg Kroah-HartmanFrom: Arend van Spriel <[email protected]>
commit 1b5e2423164b3670e8bc9174e4762d297990deff upstream.
The SSID length as received from firmware should not exceed IEEE80211_MAX_SSID_LEN as that would result in heap overflow.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +2 -0
@@ -3474,6 +3474,8 @@ brcmf_wowl_nd_results(struct brcmf_if *i } netinfo =brcmf_get_netinfo_array (pfn_result); +if (netinfo->SSID_len >IEEE80211_MAX_SSID_LEN ) + netinfo->SSID_len =IEEE80211_MAX_SSID_LEN ;memcpy (cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len); cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len; cfg->wowl.nd->n_channels =1 ;
Greg Kroah-Hartman
maintainerPATCH 26/346 brcmfmac: add subtype check for event handling in data path
In reply to Greg Kroah-HartmanFrom: Arend van Spriel <[email protected]>
commit a4176ec356c73a46c07c181c6d04039fafa34a9f upstream.
For USB there is no separate channel being used to pass events from firmware to the host driver and as such are passed over the data path. In order to detect mock event messages an additional check is needed on event subtype. This check is added conditionally using unlikely() keyword.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 ++-- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h | 16 ++++++++++---- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 - 3 files changed, 16 insertions(+), 7 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +3 -2
@@ -464,7 +464,8 @@ void brcmf_rx_frame(struct device *dev, }else {/* Process special event packets */ if (handle_event) -brcmf_fweh_process_skb (ifp->drvr, skb); +brcmf_fweh_process_skb (ifp->drvr, skb, +BCMILCP_SUBTYPE_VENDOR_LONG );brcmf_netif_rx (ifp, skb); }
@@ -481,7 +482,7 @@ void brcmf_rx_event(struct device *dev,if (brcmf_rx_hdrpull (drvr, skb, &ifp))return ; -brcmf_fweh_process_skb (ifp->drvr, skb); +brcmf_fweh_process_skb (ifp->drvr, skb,0 );brcmu_pkt_buf_free_skb (skb); }
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h +12 -4
@@ -211,7 +211,7 @@ enum brcmf_fweh_event_code {*/ #define BRCM_OUI "\x00\x10\x18"#define BCMILCP_BCM_SUBTYPE_EVENT 1 - +#define BCMILCP_SUBTYPE_VENDOR_LONG 32769/** * struct brcm_ethhdr - broadcom specific ether header.
@@ -334,10 +334,10 @@ void brcmf_fweh_process_event(struct brcvoid brcmf_fweh_p2pdev_setup (struct brcmf_if *ifp,bool ongoing);static inline void brcmf_fweh_process_skb (struct brcmf_pub *drvr, -struct sk_buff *skb) +struct sk_buff *skb,u16 stype) {struct brcmf_event *event_packet; -u16 usr_stype; +u16 subtype, usr_stype;/* only process events when protocol matches */ if (skb->protocol !=cpu_to_be16 (ETH_P_LINK_CTL ))
@@ -346,8 +346,16 @@ static inline void brcmf_fweh_process_skif ((skb->len +ETH_HLEN ) <sizeof (*event_packet))return ; -/* check for BRCM oui match */ event_packet = (struct brcmf_event *)skb_mac_header (skb); + +/* check subtype if needed */ +if (unlikely (stype)) { + subtype =get_unaligned_be16 (&event_packet->hdr.subtype); +if (subtype != stype) +return ; + } + +/* check for BRCM oui match */ if (memcmp (BRCM_OUI , &event_packet->hdr.oui[0 ],sizeof (event_packet->hdr.oui)))return ;
drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +1 -1
@@ -1116,7 +1116,7 @@ static void brcmf_msgbuf_process_event(s skb->protocol =eth_type_trans (skb, ifp->ndev); -brcmf_fweh_process_skb (ifp->drvr, skb); +brcmf_fweh_process_skb (ifp->drvr, skb,0 ); exit:brcmu_pkt_buf_free_skb (skb);
Greg Kroah-Hartman
maintainerPATCH 27/346 arm64: errata: Add workaround for Cortex-A76 erratum #1463225
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit 969f5ea627570e91c9d54403287ee3ed657f58fe upstream.
Revisions of the Cortex-A76 CPU prior to r4p0 are affected by an erratum that can prevent interrupts from being taken when single-stepping.
This patch implements a software workaround to prevent userspace from effectively being able to disable interrupts.
--- Documentation/arm64/silicon-errata.txt | 1 arch/arm64/Kconfig | 18 ++++++++++++++++ arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/kernel/cpu_errata.c | 24 +++++++++++++++++++++ arch/arm64/kernel/syscall.c | 31 +++++++++++++++++++++++++++ arch/arm64/mm/fault.c | 37 +++++++++++++++++++++++++++++++-- 6 files changed, 111 insertions(+), 3 deletions(-)
Documentation/arm64/silicon-errata.txt +1 -0
@@ -61,6 +61,7 @@ stable kernels. | ARM | Cortex-A76 | #1188873 | ARM64_ERRATUM_1188873 | | ARM | Cortex-A76 | #1165522 | ARM64_ERRATUM_1165522 | | ARM | Cortex-A76 | #1286807 | ARM64_ERRATUM_1286807 | +| ARM | Cortex-A76 | #1463225 | ARM64_ERRATUM_1463225 | | ARM | MMU-500 | #841119,#826419 | N/A | | | | | | | Cavium | ThunderX ITS | #22375, #24313 | CAVIUM_ERRATUM_22375 |
arch/arm64/Kconfig +18 -0
@@ -518,6 +518,24 @@ config ARM64_ERRATUM_1286807 If unsure, say Y. +config ARM64_ERRATUM_1463225 + bool "Cortex-A76: Software Step might prevent interrupt recognition" + default y + help + This option adds a workaround for Arm Cortex-A76 erratum 1463225. + + On the affected Cortex-A76 cores (r0p0 to r3p1), software stepping + of a system call instruction (SVC) can prevent recognition of + subsequent interrupts when software stepping is disabled in the + exception handler of the system call and either kernel debugging + is enabled or VHE is in use. + + Work around the erratum by triggering a dummy step exception + when handling a system call from a task that is being stepped + in a VHE configuration of the kernel. + + If unsure, say Y. + config CAVIUM_ERRATUM_22375 bool "Cavium erratum 22375, 24313" default y
arch/arm64/include/asm/cpucaps.h +2 -1
@@ -60,7 +60,8 @@#define ARM64_HAS_ADDRESS_AUTH_IMP_DEF 39#define ARM64_HAS_GENERIC_AUTH_ARCH 40#define ARM64_HAS_GENERIC_AUTH_IMP_DEF 41 +#define ARM64_WORKAROUND_1463225 42 -#define ARM64_NCAPS 42 +#define ARM64_NCAPS 43#endif /* __ASM_CPUCAPS_H */
arch/arm64/kernel/cpu_errata.c +24 -0
@@ -464,6 +464,22 @@ out_printmsg: }#endif /* CONFIG_ARM64_SSBD */ +#ifdef CONFIG_ARM64_ERRATUM_1463225 +DEFINE_PER_CPU (int, __in_cortex_a76_erratum_1463225_wa); + +static bool +has_cortex_a76_erratum_1463225 (const struct arm64_cpu_capabilities *entry, +int scope) +{ +u32 midr =read_cpuid_id (); +/* Cortex-A76 r0p0 - r3p1 */ +struct midr_range range =MIDR_RANGE (MIDR_CORTEX_A76 ,0 ,0 ,3 ,1 ); + +WARN_ON (scope !=SCOPE_LOCAL_CPU ||preemptible ()); +return is_midr_in_range (midr, &range) &&is_kernel_in_hyp_mode (); +} +#endif +static void __maybe_unused cpu_enable_cache_maint_trap (const struct arm64_cpu_capabilities *__unused) {
@@ -739,6 +755,14 @@ const struct arm64_cpu_capabilities arm6 ERRATA_MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 2, 0), },#endif +#ifdef CONFIG_ARM64_ERRATUM_1463225 + { + .desc = "ARM erratum 1463225", + .capability = ARM64_WORKAROUND_1463225, + .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, + .matches = has_cortex_a76_erratum_1463225, + }, +#endif { } };
arch/arm64/kernel/syscall.c +31 -0
@@ -8,6 +8,7 @@#include <linux/syscalls.h> #include <asm/daifflags.h> +#include <asm/debug-monitors.h> #include <asm/fpsimd.h> #include <asm/syscall.h> #include <asm/thread_info.h>
@@ -60,6 +61,35 @@ static inline bool has_syscall_work(unsiint syscall_trace_enter (struct pt_regs *regs);void syscall_trace_exit (struct pt_regs *regs); +#ifdef CONFIG_ARM64_ERRATUM_1463225 +DECLARE_PER_CPU (int, __in_cortex_a76_erratum_1463225_wa); + +static void cortex_a76_erratum_1463225_svc_handler (void ) +{ +u32 reg, val; + +if (!unlikely (test_thread_flag (TIF_SINGLESTEP ))) +return ; + +if (!unlikely (this_cpu_has_cap (ARM64_WORKAROUND_1463225 ))) +return ; + +__this_cpu_write (__in_cortex_a76_erratum_1463225_wa,1 ); + reg =read_sysreg (mdscr_el1); + val = reg |DBG_MDSCR_SS |DBG_MDSCR_KDE ; +write_sysreg (val, mdscr_el1); + asmvolatile ("msr daifclr, #8" ); +isb (); + +/* We will have taken a single-step exception by this point */ + +write_sysreg (reg, mdscr_el1); +__this_cpu_write (__in_cortex_a76_erratum_1463225_wa,0 ); +} +#else +static void cortex_a76_erratum_1463225_svc_handler (void ) { } +#endif /* CONFIG_ARM64_ERRATUM_1463225 */ +static void el0_svc_common (struct pt_regs *regs,int scno,int sc_nr,const syscall_fn_t syscall_table[]) {
@@ -68,6 +98,7 @@ static void el0_svc_common(struct pt_reg regs->orig_x0 = regs->regs[0 ]; regs->syscallno = scno; +cortex_a76_erratum_1463225_svc_handler ();local_daif_restore (DAIF_PROCCTX );user_exit ();
arch/arm64/mm/fault.c +35 -2
@@ -824,14 +824,47 @@ void __init hook_debug_fault_code(int nr debug_fault_info[nr].name = name; } +#ifdef CONFIG_ARM64_ERRATUM_1463225 +DECLARE_PER_CPU (int, __in_cortex_a76_erratum_1463225_wa); + +static int __exception +cortex_a76_erratum_1463225_debug_handler (struct pt_regs *regs) +{ +if (user_mode (regs)) +return 0 ; + +if (!__this_cpu_read (__in_cortex_a76_erratum_1463225_wa)) +return 0 ; + +/* +* We've taken a dummy step exception from the kernel to ensure +* that interrupts are re-enabled on the syscall path. Return back +* to cortex_a76_erratum_1463225_svc_handler() with debug exceptions +* masked so that we can safely restore the mdscr and get on with +* handling the syscall. +*/ + regs->pstate |=PSR_D_BIT ; +return 1 ; +} +#else +static int __exception +cortex_a76_erratum_1463225_debug_handler (struct pt_regs *regs) +{ +return 0 ; +} +#endif /* CONFIG_ARM64_ERRATUM_1463225 */ + asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, -unsigned int esr, -struct pt_regs *regs) +unsigned int esr, +struct pt_regs *regs) {const struct fault_info *inf =esr_to_debug_fault_info (esr);unsigned long pc =instruction_pointer (regs);int rv; +if (cortex_a76_erratum_1463225_debug_handler (regs)) +return 0 ; +/* * Tell lockdep we disabled irqs in entry.S. Do nothing if they were * already disabled to preserve the last enabled/disabled addresses.
Greg Kroah-Hartman
maintainerPATCH 28/346 btrfs: honor path->skip_locking in backref code
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 38e3eebff643db725633657d1d87a3be019d1018 upstream.
Qgroups will do the old roots lookup at delayed ref time, which could be while walking down the extent root while running a delayed ref. This should be fine, except we specifically lock eb's in the backref walking code irrespective of path->skip_locking, which deadlocks the system. Fix up the backref code to honor path->skip_locking, nobody will be modifying the commit_root when we're searching so it's completely safe to do.
This happens since fb235dc06fac ("btrfs: qgroup: Move half of the qgroup accounting time out of commit trans"), kernel may lockup with quota enabled.
There is one backref trace triggered by snapshot dropping along with write operation in the source subvolume. The example can be reliably reproduced:
btrfs-cleaner D 0 4062 2 0x80000000
Call Trace: schedule+0x32/0x90 btrfs_tree_read_lock+0x93/0x130 [btrfs] find_parent_nodes+0x29b/0x1170 [btrfs] btrfs_find_all_roots_safe+0xa8/0x120 [btrfs] btrfs_find_all_roots+0x57/0x70 [btrfs] btrfs_qgroup_trace_extent_post+0x37/0x70 [btrfs] btrfs_qgroup_trace_leaf_items+0x10b/0x140 [btrfs] btrfs_qgroup_trace_subtree+0xc8/0xe0 [btrfs] do_walk_down+0x541/0x5e3 [btrfs] walk_down_tree+0xab/0xe7 [btrfs] btrfs_drop_snapshot+0x356/0x71a [btrfs] btrfs_clean_one_deleted_snapshot+0xb8/0xf0 [btrfs] cleaner_kthread+0x12b/0x160 [btrfs] kthread+0x112/0x130 ret_from_fork+0x27/0x50
When dropping snapshots with qgroup enabled, we will trigger backref walk.
However such backref walk at that timing is pretty dangerous, as if one of the parent nodes get WRITE locked by other thread, we could cause a dead lock.
For example:
FS 260 FS 261 (Dropped)
node A node B
/ \ / \
node C node D node E
/ \ / \ / \leaf F|leaf G|leaf H|leaf I|leaf J|leaf K
The lock sequence would be:
Thread A (cleaner) | Thread B (other writer)
-----------------------------------------------------------------------
write_lock(B) |
write_lock(D) |
^^^ called by walk_down_tree() |
| write_lock(A)
| write_lock(D) << Stall
read_lock(H) << for backref walk |
read_lock(D) << lock owner is |
the same thread A |
so read lock is OK |
read_lock(A) << Stall |So thread A hold write lock D, and needs read lock A to unlock. While thread B holds write lock A, while needs lock D to unlock.
This will cause a deadlock.
This is not only limited to snapshot dropping case. As the backref walk, even only happens on commit trees, is breaking the normal top-down locking order, makes it deadlock prone.
--- fs/btrfs/backref.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
fs/btrfs/backref.c +12 -7
@@ -712,7 +712,7 @@ out:* read tree blocks and add keys where required. */ static int add_missing_keys (struct btrfs_fs_info *fs_info, -struct preftrees *preftrees) +struct preftrees *preftrees,bool lock) {struct prelim_ref *ref;struct extent_buffer *eb;
@@ -737,12 +737,14 @@ static int add_missing_keys(struct btrfsfree_extent_buffer (eb);return -EIO ; } -btrfs_tree_read_lock (eb); +if (lock) +btrfs_tree_read_lock (eb);if (btrfs_header_level (eb) ==0 )btrfs_item_key_to_cpu (eb, &ref->key_for_search,0 );else btrfs_node_key_to_cpu (eb, &ref->key_for_search,0 ); -btrfs_tree_read_unlock (eb); +if (lock) +btrfs_tree_read_unlock (eb);free_extent_buffer (eb);prelim_ref_insert (fs_info, &preftrees->indirect, ref,NULL );cond_resched ();
@@ -1227,7 +1229,7 @@ again:btrfs_release_path (path); - ret =add_missing_keys (fs_info, &preftrees); + ret =add_missing_keys (fs_info, &preftrees, path->skip_locking ==0 );if (ret) goto out;
@@ -1288,11 +1290,14 @@ again: ret = -EIO ; goto out; } -btrfs_tree_read_lock (eb); -btrfs_set_lock_blocking_rw (eb,BTRFS_READ_LOCK ); +if (!path->skip_locking) { +btrfs_tree_read_lock (eb); +btrfs_set_lock_blocking_rw (eb,BTRFS_READ_LOCK ); + } ret =find_extent_in_eb (eb, bytenr, *extent_item_pos, &eie, ignore_offset); -btrfs_tree_read_unlock_blocking (eb); +if (!path->skip_locking) +btrfs_tree_read_unlock_blocking (eb);free_extent_buffer (eb);if (ret <0 ) goto out;
Greg Kroah-Hartman
maintainerPATCH 29/346 ovl: relax WARN_ON() for overlapping layers use case
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
commit acf3062a7e1ccf67c6f7e7c28671a6708fde63b0 upstream.
This nasty little syzbot repro:
https://syzkaller.appspot.com/x/repro.syz?x=12c7a94f400000
Creates overlay mounts where the same directory is both in upper and lower layers. Simplified example:
mkdir foo work
mount -t overlay none foo -o"lowerdir=.,upperdir=foo,workdir=work"
The repro runs several threads in parallel that attempt to chdir into foo and attempt to symlink/rename/exec/mkdir the file bar.
The repro hits a WARN_ON() I placed in ovl_instantiate(), which suggests that an overlay inode already exists in cache and is hashed by the pointer of the real upper dentry that ovl_create_real() has just created. At the point of the WARN_ON(), for overlay dir inode lock is held and upper dir inode lock, so at first, I did not see how this was possible.
On a closer look, I see that after ovl_create_real(), because of the overlapping upper and lower layers, a lookup by another thread can find the file foo/bar that was just created in upper layer, at overlay path foo/foo/bar and hash the an overlay inode with the new real dentry as lower dentry. This is possible because the overlay directory foo/foo is not locked and the upper dentry foo/bar is in dcache, so ovl_lookup() can find it without taking upper dir inode shared lock.
Overlapping layers is considered a wrong setup which would result in unexpected behavior, but it shouldn't crash the kernel and it shouldn't trigger WARN_ON() either, so relax this WARN_ON() and leave a pr_warn() instead to cover all cases of failure to get an overlay inode.
The error returned from failure to insert new inode to cache with inode_insert5() was changed to -EEXIST, to distinguish from the error -ENOMEM returned on failure to get/allocate inode with iget5_locked().
--- fs/overlayfs/dir.c | 2 +- fs/overlayfs/inode.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
fs/overlayfs/dir.c +1 -1
@@ -260,7 +260,7 @@ static int ovl_instantiate(struct dentry* hashed directory inode aliases. */ inode =ovl_get_inode (dentry->d_sb, &oip); -if (WARN_ON (IS_ERR (inode))) +if (IS_ERR (inode))return PTR_ERR (inode); }else {WARN_ON (ovl_inode_real (inode) !=d_inode (newdentry));
fs/overlayfs/inode.c +2 -1
@@ -832,7 +832,7 @@ struct inode *ovl_get_inode(struct superint fsid = bylower ? oip->lowerpath->layer->fsid :0 ;bool is_dir, metacopy = false;unsigned long ino =0 ; -int err = -ENOMEM ; +int err = oip->newinode ? -EEXIST : -ENOMEM ;if (!realinode) realinode =d_inode (lowerdentry);
@@ -917,6 +917,7 @@ out:return inode; out_err: +pr_warn_ratelimited ("overlayfs: failed to get inode (%i)\n" , err); inode =ERR_PTR (err); goto out; }
Greg Kroah-Hartman
maintainerPATCH 30/346 fbdev: fix WARNING in __alloc_pages_nodemask bug
In reply to Greg Kroah-HartmanFrom: Jiufei Xue <[email protected]>
commit 8c40292be9169a9cbe19aadd1a6fc60cbd1af82f upstream.
Syzkaller hit 'WARNING in __alloc_pages_nodemask' bug.
WARNING: CPU: 1 PID: 1473 at mm/page_alloc.c:4377 __alloc_pages_nodemask+0x4da/0x2130 Kernel panic - not syncing: panic_on_warn set ... Call Trace: alloc_pages_current+0xb1/0x1e0 kmalloc_order+0x1f/0x60 kmalloc_order_trace+0x1d/0x120 fb_alloc_cmap_gfp+0x85/0x2b0 fb_set_user_cmap+0xff/0x370 do_fb_ioctl+0x949/0xa20 fb_ioctl+0xdd/0x120 do_vfs_ioctl+0x186/0x1070 ksys_ioctl+0x89/0xa0 __x64_sys_ioctl+0x74/0xb0 do_syscall_64+0xc8/0x550 entry_SYSCALL_64_after_hwframe+0x49/0xbe
This is a warning about order >= MAX_ORDER and the order is from userspace ioctl. Add flag __NOWARN to silence this warning.
--- drivers/video/fbdev/core/fbcmap.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/core/fbcmap.c +2 -0
@@ -94,6 +94,8 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmint size = len *sizeof (u16);int ret = -ENOMEM ; + flags |= __GFP_NOWARN; +if (cmap->len != len) {fb_dealloc_cmap (cmap);if (!len)
Greg Kroah-Hartman
maintainerPATCH 31/346 media: cpia2: Fix use-after-free in cpia2_exit
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
commit dea37a97265588da604c6ba80160a287b72c7bfd upstream.
Syzkaller report this:
BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
Read of size 8 at addr ffff8881f59a6b70 by task syz-executor.0/8363
CPU: 0 PID: 8363 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xfa/0x1ce lib/dump_stack.c:113
print_address_description+0x65/0x270 mm/kasan/report.c:187
kasan_report+0x149/0x18d mm/kasan/report.c:317
sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
sysfs_remove_file include/linux/sysfs.h:519 [inline]
driver_remove_file+0x40/0x50 drivers/base/driver.c:122
usb_remove_newid_files drivers/usb/core/driver.c:212 [inline]
usb_deregister+0x12a/0x3b0 drivers/usb/core/driver.c:1005
cpia2_exit+0xa/0x16 [cpia2]
__do_sys_delete_module kernel/module.c:1018 [inline]
__se_sys_delete_module kernel/module.c:961 [inline]
__x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462e99
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f86f3754c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000300
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f86f37556bc
R13: 00000000004bcca9 R14: 00000000006f6b48 R15: 00000000ffffffff
Allocated by task 8363:
set_track mm/kasan/common.c:85 [inline]
__kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495
kmalloc include/linux/slab.h:545 [inline]
kzalloc include/linux/slab.h:740 [inline]
bus_add_driver+0xc0/0x610 drivers/base/bus.c:651
driver_register+0x1bb/0x3f0 drivers/base/driver.c:170
usb_register_driver+0x267/0x520 drivers/usb/core/driver.c:965
0xffffffffc1b4817c
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8363:
set_track mm/kasan/common.c:85 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:457
slab_free_hook mm/slub.c:1430 [inline]
slab_free_freelist_hook mm/slub.c:1457 [inline]
slab_free mm/slub.c:3005 [inline]
kfree+0xe1/0x270 mm/slub.c:3957
kobject_cleanup lib/kobject.c:662 [inline]
kobject_release lib/kobject.c:691 [inline]
kref_put include/linux/kref.h:67 [inline]
kobject_put+0x146/0x240 lib/kobject.c:708
bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732
driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
usb_register_driver+0x341/0x520 drivers/usb/core/driver.c:980
0xffffffffc1b4817c
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8881f59a6b40
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 48 bytes inside of
256-byte region [ffff8881f59a6b40, ffff8881f59a6c40)
The buggy address belongs to the page:
page:ffffea0007d66980 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0
flags: 0x2fffc0000000200(slab)
raw: 02fffc0000000200 dead000000000100 dead000000000200 ffff8881f6c02e00
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881f59a6a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881f59a6a80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
>ffff8881f59a6b00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8881f59a6b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881f59a6c00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fccpia2_init does not check return value of cpia2_init, if it failed in usb_register_driver, there is already cleanup using driver_unregister. No need call cpia2_usb_cleanup on module exit.
--- drivers/media/usb/cpia2/cpia2_v4l.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/usb/cpia2/cpia2_v4l.c +1 -2
@@ -1245,8 +1245,7 @@ static int __init cpia2_init(void)LOG ("%s v%s\n" ,ABOUT ,CPIA_VERSION );check_parameters (); -cpia2_usb_init (); -return 0 ; +return cpia2_usb_init (); }
Greg Kroah-Hartman
maintainerPATCH 32/346 media: serial_ir: Fix use-after-free in serial_ir_init_module
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
commit 56cd26b618855c9af48c8301aa6754ced8dd0beb upstream.
Syzkaller report this:
BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
Read of size 8 at addr ffff8881dc7ae030 by task syz-executor.0/6249
CPU: 1 PID: 6249 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xfa/0x1ce lib/dump_stack.c:113
print_address_description+0x65/0x270 mm/kasan/report.c:187
kasan_report+0x149/0x18d mm/kasan/report.c:317
? 0xffffffffc1728000
sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
sysfs_remove_file include/linux/sysfs.h:519 [inline]
driver_remove_file+0x40/0x50 drivers/base/driver.c:122
remove_bind_files drivers/base/bus.c:585 [inline]
bus_remove_driver+0x186/0x220 drivers/base/bus.c:725
driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
serial_ir_init_module+0x169/0x1000 [serial_ir]
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462e99
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9450132c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00007f9450132c70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94501336bc
R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
Allocated by task 6249:
set_track mm/kasan/common.c:85 [inline]
__kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495
kmalloc include/linux/slab.h:545 [inline]
kzalloc include/linux/slab.h:740 [inline]
bus_add_driver+0xc0/0x610 drivers/base/bus.c:651
driver_register+0x1bb/0x3f0 drivers/base/driver.c:170
serial_ir_init_module+0xe8/0x1000 [serial_ir]
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 6249:
set_track mm/kasan/common.c:85 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:457
slab_free_hook mm/slub.c:1430 [inline]
slab_free_freelist_hook mm/slub.c:1457 [inline]
slab_free mm/slub.c:3005 [inline]
kfree+0xe1/0x270 mm/slub.c:3957
kobject_cleanup lib/kobject.c:662 [inline]
kobject_release lib/kobject.c:691 [inline]
kref_put include/linux/kref.h:67 [inline]
kobject_put+0x146/0x240 lib/kobject.c:708
bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732
driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
serial_ir_init_module+0x14c/0x1000 [serial_ir]
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8881dc7ae000
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 48 bytes inside of
256-byte region [ffff8881dc7ae000, ffff8881dc7ae100)
The buggy address belongs to the page:
page:ffffea000771eb80 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0
flags: 0x2fffc0000000200(slab)
raw: 02fffc0000000200 ffffea0007d14800 0000000400000002 ffff8881f6c02e00
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881dc7adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881dc7adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881dc7ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881dc7ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881dc7ae100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00There are already cleanup handlings in serial_ir_init error path, no need to call serial_ir_exit do it again in serial_ir_init_module, otherwise will trigger a use-after-free issue.
--- drivers/media/rc/serial_ir.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/media/rc/serial_ir.c +1 -8
@@ -773,8 +773,6 @@ static void serial_ir_exit(void)static int __init serial_ir_init_module (void ) { -int result; -switch (type) {case IR_HOMEBREW :case IR_IRDEO :
@@ -802,12 +800,7 @@ static int __init serial_ir_init_module(if (sense !=-1 ) sense = !!sense; - result =serial_ir_init (); -if (!result) -return 0 ; - -serial_ir_exit (); -return result; +return serial_ir_init (); } static void __exit serial_ir_exit_module(void)
Greg Kroah-Hartman
maintainerPATCH 33/346 media: vb2: add waiting_in_dqbuf flag
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
commit d65842f7126aa1a87fb44b7c9980c12630ed4f33 upstream.
Calling VIDIOC_DQBUF can release the core serialization lock pointed to by vb2_queue->lock if it has to wait for a new buffer to arrive.
However, if userspace dup()ped the video device filehandle, then it is possible to read or call DQBUF from two filehandles at the same time.
It is also possible to call REQBUFS from one filehandle while the other is waiting for a buffer. This will remove all the buffers and reallocate new ones. Removing all the buffers isn't the problem here (that's already handled correctly by DQBUF), but the reallocating part is: DQBUF isn't aware that the buffers have changed.
This is fixed by setting a flag whenever the lock is released while waiting for a buffer to arrive. And checking the flag where needed so we can return -EBUSY.
--- drivers/media/common/videobuf2/videobuf2-core.c | 22 ++++++++++++++++++++++ include/media/videobuf2-core.h | 1 + 2 files changed, 23 insertions(+)
drivers/media/common/videobuf2/videobuf2-core.c +22 -0
@@ -672,6 +672,11 @@ int vb2_core_reqbufs(struct vb2_queue *qreturn -EBUSY ; } +if (q->waiting_in_dqbuf && *count) { +dprintk (1 ,"another dup()ped fd is waiting for a buffer\n" ); +return -EBUSY ; + } +if (*count ==0 || q->num_buffers !=0 || (q->memory !=VB2_MEMORY_UNKNOWN && q->memory != memory)) {/*
@@ -807,6 +812,10 @@ int vb2_core_create_bufs(struct vb2_queu }if (!q->num_buffers) { +if (q->waiting_in_dqbuf && *count) { +dprintk (1 ,"another dup()ped fd is waiting for a buffer\n" ); +return -EBUSY ; + }memset (q->alloc_devs,0 ,sizeof (q->alloc_devs)); q->memory = memory; q->waiting_for_buffers = !q->is_output;
@@ -1638,6 +1647,11 @@ static int __vb2_wait_for_done_vb(structfor (;;) {int ret; +if (q->waiting_in_dqbuf) { +dprintk (1 ,"another dup()ped fd is waiting for a buffer\n" ); +return -EBUSY ; + } +if (!q->streaming) {dprintk (1 ,"streaming off, will not wait for buffers\n" );return -EINVAL ;
@@ -1665,6 +1679,7 @@ static int __vb2_wait_for_done_vb(structreturn -EAGAIN ; } + q->waiting_in_dqbuf =1 ;/* * We are streaming and blocking, wait for another buffer to * become ready or for streamoff. Driver's lock is released to
@@ -1685,6 +1700,7 @@ static int __vb2_wait_for_done_vb(struct* the locks or return an error if one occurred. */ call_void_qop (q, wait_finish, q); + q->waiting_in_dqbuf =0 ;if (ret) {dprintk (1 ,"sleep was interrupted\n" );return ret;
@@ -2572,6 +2588,12 @@ static size_t __vb2_perform_fileio(strucif (!data)return -EINVAL ; +if (q->waiting_in_dqbuf) { +dprintk (3 ,"another dup()ped fd is %s\n" , + read ?"reading" :"writing" ); +return -EBUSY ; + } +/* * Initialize emulator on first call. */
include/media/videobuf2-core.h +1 -0
@@ -586,6 +586,7 @@ struct vb2_queue { unsigned int start_streaming_called:1; unsigned int error:1; unsigned int waiting_for_buffers:1; + unsigned int waiting_in_dqbuf:1; unsigned int is_multiplanar:1; unsigned int is_output:1; unsigned int copy_timestamp:1;
Greg Kroah-Hartman
maintainerPATCH 34/346 media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
In reply to Greg Kroah-HartmanFrom: Alexander Potapenko <[email protected]>
commit dad7e270ba712ba1c99cd2d91018af6044447a06 upstream.
syzkaller reported crashes on kfree() called from vivid_vid_cap_s_selection(). This looks like a simple typo, as dev->bitmap_cap is allocated with vzalloc() throughout the file.
parts")
--- drivers/media/platform/vivid/vivid-vid-cap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/vivid/vivid-vid-cap.c +1 -1
@@ -1003,7 +1003,7 @@ int vivid_vid_cap_s_selection(struct filv4l2_rect_map_inside (&s->r, &dev->fmt_cap_rect);if (dev->bitmap_cap && (compose->width != s->r.width || compose->height != s->r.height)) { -kfree (dev->bitmap_cap); +vfree (dev->bitmap_cap); dev->bitmap_cap =NULL ; } *compose = s->r;
Greg Kroah-Hartman
maintainerPATCH 35/346 ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
commit b2c01aab9646ed8ffb7c549afe55d5349c482425 upstream.
Syzkaller report this:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 4492 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 RIP: 0010:sysfs_remove_file_ns+0x27/0x70 fs/sysfs/file.c:468 Code: 00 00 00 41 54 55 48 89 fd 53 49 89 d4 48 89 f3 e8 ee 76 9c ff 48 8d 7d 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 2d 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 8b 6d RSP: 0018:ffff8881e9d9fc00 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffffffff900367e0 RCX: ffffffff81a95952 RDX: 0000000000000006 RSI: ffffc90001405000 RDI: 0000000000000030 RBP: 0000000000000000 R08: fffffbfff1fa22ed R09: fffffbfff1fa22ed R10: 0000000000000001 R11: fffffbfff1fa22ec R12: 0000000000000000 R13: ffffffffc1abdac0 R14: 1ffff1103d3b3f8b R15: 0000000000000000 FS: 00007fe409dc1700(0000) GS:ffff8881f1200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2d721000 CR3: 00000001e98b6005 CR4: 00000000007606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: sysfs_remove_file include/linux/sysfs.h:519 [inline] driver_remove_file+0x40/0x50 drivers/base/driver.c:122 pcmcia_remove_newid_file drivers/pcmcia/ds.c:163 [inline] pcmcia_unregister_driver+0x7d/0x2b0 drivers/pcmcia/ds.c:209 ssb_modexit+0xa/0x1b [ssb] __do_sys_delete_module kernel/module.c:1018 [inline] __se_sys_delete_module kernel/module.c:961 [inline] __x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe409dc0c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0 RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe409dc16bc R13: 00000000004bccaa R14: 00000000006f6bc8 R15: 00000000ffffffff Modules linked in: ssb(-) 3c59x nvme_core macvlan tap pata_hpt3x3 rt2x00pci null_blk tsc40 pm_notifier_error_inject notifier_error_inject mdio cdc_wdm nf_reject_ipv4 ath9k_common ath9k_hw ath pppox ppp_generic slhc ehci_platform wl12xx wlcore tps6507x_ts ioc4 nf_synproxy_core ide_gd_mod ax25 can_dev iwlwifi can_raw atm tm2_touchkey can_gw can sundance adp5588_keys rt2800mmio rt2800lib rt2x00mmio rt2x00lib eeprom_93cx6 pn533 lru_cache elants_i2c ip_set nfnetlink gameport tipc hampshire nhc_ipv6 nhc_hop nhc_udp nhc_fragment nhc_routing nhc_mobility nhc_dest 6lowpan silead brcmutil nfc mt76_usb mt76 mac80211 iptable_security iptable_raw iptable_mangle iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_gre sit hsr veth vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon vcan bridge stp llc ip6_gre ip6_tunnel tunnel6 tun joydev mousedev serio_raw ide_pci_generic piix floppy ide_core sch_fq_codel ip_tables x_tables ipv6 [last unloaded: 3c59x] Dumping ftrace buffer: (ftrace buffer empty) ---[ end trace 3913cbf8011e1c05 ]---
In ssb_modinit, it does not fail SSB init when ssb_host_pcmcia_init failed, however in ssb_modexit, ssb_host_pcmcia_exit calls pcmcia_unregister_driver unconditionally, which may tigger a NULL pointer dereference issue as above.
--- drivers/ssb/bridge_pcmcia_80211.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/ssb/bridge_pcmcia_80211.c +7 -2
@@ -113,16 +113,21 @@ static struct pcmcia_driver ssb_host_pcm .resume = ssb_host_pcmcia_resume, }; +static int pcmcia_init_failed; +/* * These are not module init/exit functions! * The module_pcmcia_driver() helper cannot be used here. */ int ssb_host_pcmcia_init (void ) { -return pcmcia_register_driver (&ssb_host_pcmcia_driver); + pcmcia_init_failed =pcmcia_register_driver (&ssb_host_pcmcia_driver); + +return pcmcia_init_failed; }void ssb_host_pcmcia_exit (void ) { -pcmcia_unregister_driver (&ssb_host_pcmcia_driver); +if (!pcmcia_init_failed) +pcmcia_unregister_driver (&ssb_host_pcmcia_driver); }
Greg Kroah-Hartman
maintainerPATCH 36/346 bpf: devmap: fix use-after-free Read in __dev_map_entry_free
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 2baae3545327632167c0180e9ca1d467416f1919 upstream.
synchronize_rcu() is fine when the rcu callbacks only need to free memory (kfree_rcu() or direct kfree() call rcu call backs)
__dev_map_entry_free() is a bit more complex, so we need to make sure that call queued __dev_map_entry_free() callbacks have completed.
sysbot report:
BUG: KASAN: use-after-free in dev_map_flush_old kernel/bpf/devmap.c:365 [inline] BUG: KASAN: use-after-free in __dev_map_entry_free+0x2a8/0x300 kernel/bpf/devmap.c:379 Read of size 8 at addr ffff8801b8da38c8 by task ksoftirqd/1/18 CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.17.0+ #39 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 print_address_description+0x6c/0x20b mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 dev_map_flush_old kernel/bpf/devmap.c:365 [inline] __dev_map_entry_free+0x2a8/0x300 kernel/bpf/devmap.c:379 __rcu_reclaim kernel/rcu/rcu.h:178 [inline] rcu_do_batch kernel/rcu/tree.c:2558 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2818 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2785 [inline] rcu_process_callbacks+0xe9d/0x1760 kernel/rcu/tree.c:2802 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:284 run_ksoftirqd+0x86/0x100 kernel/softirq.c:645 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164 kthread+0x345/0x410 kernel/kthread.c:240 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412 Allocated by task 6675: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553 kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620 kmalloc include/linux/slab.h:513 [inline] kzalloc include/linux/slab.h:706 [inline] dev_map_alloc+0x208/0x7f0 kernel/bpf/devmap.c:102 find_and_alloc_map kernel/bpf/syscall.c:129 [inline] map_create+0x393/0x1010 kernel/bpf/syscall.c:453 __do_sys_bpf kernel/bpf/syscall.c:2351 [inline] __se_sys_bpf kernel/bpf/syscall.c:2328 [inline] __x64_sys_bpf+0x303/0x510 kernel/bpf/syscall.c:2328 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 26: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xd9/0x260 mm/slab.c:3813 dev_map_free+0x4fa/0x670 kernel/bpf/devmap.c:191 bpf_map_free_deferred+0xba/0xf0 kernel/bpf/syscall.c:262 process_one_work+0xc64/0x1b70 kernel/workqueue.c:2153 worker_thread+0x181/0x13a0 kernel/workqueue.c:2296 kthread+0x345/0x410 kernel/kthread.c:240 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412 The buggy address belongs to the object at ffff8801b8da37c0 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 264 bytes inside of 512-byte region [ffff8801b8da37c0, ffff8801b8da39c0) The buggy address belongs to the page: page:ffffea0006e368c0 count:1 mapcount:0 mapping:ffff8801da800940 index:0xffff8801b8da3540 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffffea0007217b88 ffffea0006e30cc8 ffff8801da800940 raw: ffff8801b8da3540 ffff8801b8da3040 0000000100000004 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801b8da3780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff8801b8da3800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Quoted 1 line
ffff8801b8da3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801b8da3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801b8da3980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
--- kernel/bpf/devmap.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/bpf/devmap.c +3 -0
@@ -164,6 +164,9 @@ static void dev_map_free(struct bpf_mapbpf_clear_redirect_map (map);synchronize_rcu (); +/* Make sure prior __dev_map_entry_free() have completed. */ +rcu_barrier (); +/* To ensure all pending flush operations have completed wait for flush * bitmap to indicate all flush_needed bits to be zero on _all_ cpus. * Because the above synchronize_rcu() ensures the map is disconnected
Greg Kroah-Hartman
maintainerPATCH 37/346 batman-adv: mcast: fix multicast tt/tvlv worker locking
In reply to Greg Kroah-HartmanFrom: Linus Lüssing <[email protected]>
commit a3c7cd0cdf1107f891aff847ad481e34df727055 upstream.
Syzbot has reported some issues with the locking assumptions made for the multicast tt/tvlv worker: It was able to trigger the WARN_ON() in batadv_mcast_mla_tt_retract() and batadv_mcast_mla_tt_add(). While hard/not reproduceable for us so far it seems that the delayed_work_pending() we use might not be quite safe from reordering.
Therefore this patch adds an explicit, new spinlock to protect the update of the mla_list and flags in bat_priv and then removes the WARN_ON(delayed_work_pending()).
--- net/batman-adv/main.c | 1 + net/batman-adv/multicast.c | 11 +++-------- net/batman-adv/types.h | 5 +++++ 3 files changed, 9 insertions(+), 8 deletions(-)
net/batman-adv/main.c +1 -0
@@ -161,6 +161,7 @@ int batadv_mesh_init(struct net_device *spin_lock_init (&bat_priv->tt.commit_lock);spin_lock_init (&bat_priv->gw.list_lock);#ifdef CONFIG_BATMAN_ADV_MCAST +spin_lock_init (&bat_priv->mcast.mla_lock);spin_lock_init (&bat_priv->mcast.want_lists_lock);#endif spin_lock_init (&bat_priv->tvlv.container_list_lock);
net/batman-adv/multicast.c +3 -8
@@ -325,8 +325,6 @@ static void batadv_mcast_mla_list_free(s* translation table except the ones listed in the given mcast_list. * * If mcast_list is NULL then all are retracted. -* -* Do not call outside of the mcast worker! (or cancel mcast worker first) */ static void batadv_mcast_mla_tt_retract (struct batadv_priv *bat_priv,struct hlist_head *mcast_list)
@@ -334,8 +332,6 @@ static void batadv_mcast_mla_tt_retract(struct batadv_hw_addr *mcast_entry;struct hlist_node *tmp; -WARN_ON (delayed_work_pending (&bat_priv->mcast.work)); -hlist_for_each_entry_safe (mcast_entry, tmp, &bat_priv->mcast.mla_list, list) { if (mcast_list &&
@@ -359,8 +355,6 @@ static void batadv_mcast_mla_tt_retract(* * Adds multicast listener announcements from the given mcast_list to the * translation table if they have not been added yet. -* -* Do not call outside of the mcast worker! (or cancel mcast worker first) */ static void batadv_mcast_mla_tt_add (struct batadv_priv *bat_priv,struct hlist_head *mcast_list)
@@ -368,8 +362,6 @@ static void batadv_mcast_mla_tt_add(strustruct batadv_hw_addr *mcast_entry;struct hlist_node *tmp; -WARN_ON (delayed_work_pending (&bat_priv->mcast.work)); -if (!mcast_list)return ;
@@ -658,7 +650,10 @@ static void batadv_mcast_mla_update(stru priv_mcast = container_of(delayed_work, struct batadv_priv_mcast, work); bat_priv = container_of(priv_mcast, struct batadv_priv, mcast); +spin_lock (&bat_priv->mcast.mla_lock);__batadv_mcast_mla_update (bat_priv); +spin_unlock (&bat_priv->mcast.mla_lock); +batadv_mcast_start_timer (bat_priv); }
net/batman-adv/types.h +5 -0
@@ -1224,6 +1224,11 @@ struct batadv_priv_mcast { unsigned char bridged:1;/** +* @mla_lock: a lock protecting mla_list and mla_flags +*/ +spinlock_t mla_lock; + +/** * @num_want_all_unsnoopables: number of nodes wanting unsnoopable IP * traffic */
Greg Kroah-Hartman
maintainerPATCH 38/346 at76c50x-usb: Dont register led_trigger if usb_register_driver failed
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
commit 09ac2694b0475f96be895848687ebcbba97eeecf upstream.
Syzkaller report this:
[ 1213.468581] BUG: unable to handle kernel paging request at fffffbfff83bf338 [ 1213.469530] #PF error: [normal kernel read fault] [ 1213.469530] PGD 237fe4067 P4D 237fe4067 PUD 237e60067 PMD 1c868b067 PTE 0 [ 1213.473514] Oops: 0000 [#1] SMP KASAN PTI [ 1213.473514] CPU: 0 PID: 6321 Comm: syz-executor.0 Tainted: G C 5.1.0-rc3+ #8 [ 1213.473514] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 1213.473514] RIP: 0010:strcmp+0x31/0xa0 [ 1213.473514] Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d [ 1213.473514] RSP: 0018:ffff8881f2b7f950 EFLAGS: 00010246 [ 1213.473514] RAX: 1ffffffff83bf338 RBX: ffff8881ea6f7240 RCX: ffffffff825350c6 [ 1213.473514] RDX: 0000000000000000 RSI: ffffffffc1ee19c0 RDI: ffffffffc1df99c0 [ 1213.473514] RBP: ffffffffc1df99c1 R08: 0000000000000001 R09: 0000000000000004 [ 1213.473514] R10: 0000000000000000 R11: ffff8881de353f00 R12: ffff8881ee727900 [ 1213.473514] R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffffc1eeaaf0 [ 1213.473514] FS: 00007fa66fa01700(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 [ 1213.473514] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1213.473514] CR2: fffffbfff83bf338 CR3: 00000001ebb9e005 CR4: 00000000007606f0 [ 1213.473514] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1213.473514] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1213.473514] PKRU: 55555554 [ 1213.473514] Call Trace: [ 1213.473514] led_trigger_register+0x112/0x3f0 [ 1213.473514] led_trigger_register_simple+0x7a/0x110 [ 1213.473514] ? 0xffffffffc1c10000 [ 1213.473514] at76_mod_init+0x77/0x1000 [at76c50x_usb] [ 1213.473514] do_one_initcall+0xbc/0x47d [ 1213.473514] ? perf_trace_initcall_level+0x3a0/0x3a0 [ 1213.473514] ? kasan_unpoison_shadow+0x30/0x40 [ 1213.473514] ? kasan_unpoison_shadow+0x30/0x40 [ 1213.473514] do_init_module+0x1b5/0x547 [ 1213.473514] load_module+0x6405/0x8c10 [ 1213.473514] ? module_frob_arch_sections+0x20/0x20 [ 1213.473514] ? kernel_read_file+0x1e6/0x5d0 [ 1213.473514] ? find_held_lock+0x32/0x1c0 [ 1213.473514] ? cap_capable+0x1ae/0x210 [ 1213.473514] ? __do_sys_finit_module+0x162/0x190 [ 1213.473514] __do_sys_finit_module+0x162/0x190 [ 1213.473514] ? __ia32_sys_init_module+0xa0/0xa0 [ 1213.473514] ? __mutex_unlock_slowpath+0xdc/0x690 [ 1213.473514] ? wait_for_completion+0x370/0x370 [ 1213.473514] ? vfs_write+0x204/0x4a0 [ 1213.473514] ? do_syscall_64+0x18/0x450 [ 1213.473514] do_syscall_64+0x9f/0x450 [ 1213.473514] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1213.473514] RIP: 0033:0x462e99 [ 1213.473514] Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1213.473514] RSP: 002b:00007fa66fa00c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 1213.473514] RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 [ 1213.473514] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 1213.473514] RBP: 00007fa66fa00c70 R08: 0000000000000000 R09: 0000000000000000 [ 1213.473514] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa66fa016bc [ 1213.473514] R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
If usb_register failed, no need to call led_trigger_register_simple.
--- drivers/net/wireless/atmel/at76c50x-usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/atmel/at76c50x-usb.c +2 -2
@@ -2585,8 +2585,8 @@ static int __init at76_mod_init(void)if (result <0 ) printk(KERN_ERR DRIVER_NAME": usb_register failed (status %d)\n" , result); - -led_trigger_register_simple ("at76_usb-tx" , &ledtrig_tx); +else +led_trigger_register_simple ("at76_usb-tx" , &ledtrig_tx);return result; }
Greg Kroah-Hartman
maintainerPATCH 39/346 acct_on(): dont mess with freeze protection
In reply to Greg Kroah-HartmanFrom: Al Viro <[email protected]>
commit 9419a3191dcb27f24478d288abaab697228d28e6 upstream.
What happens there is that we are replacing file->path.mnt of a file we'd just opened with a clone and we need the write count contribution to be transferred from original mount to new one. That's it. We do *NOT* want any kind of freeze protection for the duration of switchover.
IOW, we should just use __mnt_{want,drop}_write() for that switchover; no need to bother with mnt_{want,drop}_write() there.
--- fs/internal.h | 2 -- include/linux/mount.h | 2 ++ kernel/acct.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-)
fs/internal.h +0 -2
@@ -80,9 +80,7 @@ extern int sb_prepare_remount_readonly(sextern void __init mnt_init (void ); -extern int __mnt_want_write (struct vfsmount *);extern int __mnt_want_write_file (struct file *); -extern void __mnt_drop_write (struct vfsmount *);extern void __mnt_drop_write_file (struct file *);/*
include/linux/mount.h +2 -0
@@ -86,6 +86,8 @@ extern bool mnt_may_suid(struct vfsmountstruct path ;extern struct vfsmount *clone_private_mount (const struct path *path); +extern int __mnt_want_write (struct vfsmount *); +extern void __mnt_drop_write (struct vfsmount *);struct file_system_type ; extern struct vfsmount *vfs_kern_mount(struct file_system_type *type,
kernel/acct.c +2 -2
@@ -227,7 +227,7 @@ static int acct_on(struct filename *pathfilp_close (file,NULL );return PTR_ERR (internal); } - err =mnt_want_write (internal); + err =__mnt_want_write (internal);if (err) {mntput (internal);kfree (acct);
@@ -252,7 +252,7 @@ static int acct_on(struct filename *path old =xchg (&ns->bacct, &acct->pin);mutex_unlock (&acct->lock);pin_kill (old); -mnt_drop_write (mnt); +__mnt_drop_write (mnt);mntput (mnt);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 40/346 netfilter: ctnetlink: Resolve conntrack L3-protocol flush regression
In reply to Greg Kroah-HartmanFrom: Kristian Evensen <[email protected]>
commit f8e608982022fad035160870f5b06086d3cba54d upstream.
Commit 59c08c69c278 ("netfilter: ctnetlink: Support L3 protocol-filter on flush") introduced a user-space regression when flushing connection track entries. Before this commit, the nfgen_family field was not used by the kernel and all entries were removed. Since this commit, nfgen_family is used to filter out entries that should not be removed. One example a broken tool is conntrack. conntrack always sets nfgen_family to AF_INET, so after 59c08c69c278 only IPv4 entries were removed with the -F parameter.
Pablo Neira Ayuso suggested using nfgenmsg->version to resolve the regression, and this commit implements his suggestion. nfgenmsg->version is so far set to zero, so it is well-suited to be used as a flag for selecting old or new flush behavior. If version is 0, nfgen_family is ignored and all entries are used. If user-space sets the version to one (or any other value than 0), then the new behavior is used. As version only can have two valid values, I chose not to add a new NFNETLINK_VERSION-constant.
--- net/netfilter/nf_conntrack_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_conntrack_netlink.c +1 -1
@@ -1254,7 +1254,7 @@ static int ctnetlink_del_conntrack(strucstruct nf_conntrack_tuple tuple;struct nf_conn *ct;struct nfgenmsg *nfmsg =nlmsg_data (nlh); -u_int8_t u3 = nfmsg->nfgen_family; +u_int8_t u3 = nfmsg->version ? nfmsg->nfgen_family :AF_UNSPEC ;struct nf_conntrack_zone zone;int err;
Greg Kroah-Hartman
maintainerPATCH 41/346 Revert "btrfs: Honour FITRIM range constraints during free space trim"
In reply to Greg Kroah-HartmanFrom: David Sterba <[email protected]>
This reverts commit b9ee627187491547791aacf96d4dd8f4d9afbf1c.
There is currently no corresponding patch in master due to additional changes that would be significantly different from plain revert in the respective stable branch.
The range argument was not handled correctly and could cause trim to overlap allocated areas or reach beyond the end of the device. The address space that fitrim normally operates on is in logical coordinates, while the discards are done on the physical device extents. This distinction cannot be made with the current ioctl interface and caused the confusion.
The bug depends on the layout of block groups and does not always happen. The whole-fs trim (run by default by the fstrim tool) is not affected.
--- fs/btrfs/extent-tree.c | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-)
fs/btrfs/extent-tree.c +6 -19
@@ -11191,9 +11191,9 @@ int btrfs_error_unpin_extent_range(struc* held back allocations. */ static int btrfs_trim_free_extents (struct btrfs_device *device, -struct fstrim_range *range,u64 *trimmed) +u64 minlen,u64 *trimmed) { -u64 start = range->start, len =0 ; +u64 start =0 , len =0 ;int ret; *trimmed =0 ;
@@ -11236,8 +11236,8 @@ static int btrfs_trim_free_extents(strucif (!trans)up_read (&fs_info->commit_root_sem); - ret =find_free_dev_extent_start (trans, device, range->minlen, - start, &start, &len); + ret =find_free_dev_extent_start (trans, device, minlen, start, + &start, &len);if (trans) {up_read (&fs_info->commit_root_sem);btrfs_put_transaction (trans);
@@ -11250,16 +11250,6 @@ static int btrfs_trim_free_extents(strucbreak ; } -/* If we are out of the passed range break */ -if (start > range->start + range->len -1 ) { -mutex_unlock (&fs_info->chunk_mutex); - ret =0 ; -break ; - } - - start =max (range->start, start); - len =min (range->len, len); - ret =btrfs_issue_discard (device->bdev, start, len, &bytes);mutex_unlock (&fs_info->chunk_mutex);
@@ -11269,10 +11259,6 @@ static int btrfs_trim_free_extents(struc start += len; *trimmed += bytes; -/* We've trimmed enough */ -if (*trimmed >= range->len) -break ; -if (fatal_signal_pending (current)) { ret = -ERESTARTSYS ;break ;
@@ -11356,7 +11342,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *mutex_lock (&fs_info->fs_devices->device_list_mutex); devices = &fs_info->fs_devices->devices;list_for_each_entry (device, devices, dev_list) { - ret =btrfs_trim_free_extents (device, range, &group_trimmed); + ret =btrfs_trim_free_extents (device, range->minlen, + &group_trimmed);if (ret) { dev_failed++; dev_ret = ret;
Greg Kroah-Hartman
maintainerPATCH 42/346 gfs2: Fix lru_count going negative
In reply to Greg Kroah-Hartman[ Upstream commit 7881ef3f33bb80f459ea6020d1e021fc524a6348 ]
Under certain conditions, lru_count may drop below zero resulting in a large amount of log spam like this:
vmscan: shrink_slab: gfs2_dump_glock+0x3b0/0x630 [gfs2] \
negative objects to delete nr=-1
This happens as follows:
1) A glock is moved from lru_list to the dispose list and lru_count is decremented.
2) The dispose function calls cond_resched() and drops the lru lock.
3) Another thread takes the lru lock and tries to add the same glock to lru_list, checking if the glock is on an lru list.
4) It is on a list (actually the dispose list) and so it avoids incrementing lru_count.
5) The glock is moved to lru_list.
5) The original thread doesn't dispose it because it has been re-added to the lru list but the lru_count has still decreased by one.
Fix by checking if the LRU flag is set on the glock rather than checking if the glock is on some list and rearrange the code so that the LRU flag is added/removed precisely when the glock is added/removed from lru_list.
--- fs/gfs2/glock.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
fs/gfs2/glock.c +13 -9
@@ -183,15 +183,19 @@ static int demote_ok(const struct gfs2_glock *gl)void gfs2_glock_add_to_lru (struct gfs2_glock *gl) { +if (!(gl->gl_ops->go_flags &GLOF_LRU )) +return ; +spin_lock (&lru_lock); -if (!list_empty (&gl->gl_lru)) -list_del_init (&gl->gl_lru); -else +list_del (&gl->gl_lru); +list_add_tail (&gl->gl_lru, &lru_list); + +if (!test_bit (GLF_LRU , &gl->gl_flags)) { +set_bit (GLF_LRU , &gl->gl_flags);atomic_inc (&lru_count); + } -list_add_tail (&gl->gl_lru, &lru_list); -set_bit (GLF_LRU , &gl->gl_flags);spin_unlock (&lru_lock); }
@@ -201,7 +205,7 @@ static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)return ;spin_lock (&lru_lock); -if (!list_empty (&gl->gl_lru)) { +if (test_bit (GLF_LRU , &gl->gl_flags)) {list_del_init (&gl->gl_lru);atomic_dec (&lru_count);clear_bit (GLF_LRU , &gl->gl_flags);
@@ -1159,8 +1163,7 @@ void gfs2_glock_dq(struct gfs2_holder *gh) !test_bit(GLF_DEMOTE, &gl->gl_flags)) fast_path =1 ; } -if (!test_bit (GLF_LFLUSH , &gl->gl_flags) &&demote_ok (gl) && - (glops->go_flags &GLOF_LRU )) +if (!test_bit (GLF_LFLUSH , &gl->gl_flags) &&demote_ok (gl))gfs2_glock_add_to_lru (gl);trace_gfs2_glock_queue (gh,0 );
@@ -1456,6 +1459,7 @@ __acquires(&lru_lock)if (!spin_trylock (&gl->gl_lockref.lock)) { add_back_to_lru:list_add (&gl->gl_lru, &lru_list); +set_bit (GLF_LRU , &gl->gl_flags);atomic_inc (&lru_count);continue ; }
@@ -1463,7 +1467,6 @@ __acquires(&lru_lock)spin_unlock (&gl->gl_lockref.lock); goto add_back_to_lru; } -clear_bit (GLF_LRU , &gl->gl_flags); gl->gl_lockref.count++;if (demote_ok (gl))handle_callback (gl,LM_ST_UNLOCKED ,0 , false);
@@ -1498,6 +1501,7 @@ static long gfs2_scan_glock_lru(int nr)if (!test_bit (GLF_LOCK , &gl->gl_flags)) {list_move (&gl->gl_lru, &dispose);atomic_dec (&lru_count); +clear_bit (GLF_LRU , &gl->gl_flags); freed++;continue ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 43/346 cxgb4: Fix error path in cxgb4_init_module
In reply to Greg Kroah-Hartman[ Upstream commit a3147770bea76c8dbad73eca3a24c2118da5e719 ]
BUG: unable to handle kernel paging request at ffffffffa016a270 PGD 3270067 P4D 3270067 PUD 3271063 PMD 230bbd067 PTE 0 Oops: 0000 [#1 CPU: 0 PID: 6134 Comm: modprobe Not tainted 5.1.0+ #33 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 RIP: 0010:atomic_notifier_chain_register+0x24/0x60 Code: 1f 80 00 00 00 00 55 48 89 e5 41 54 49 89 f4 53 48 89 fb e8 ae b4 38 01 48 8b 53 38 48 8d 4b 38 48 85 d2 74 20 45 8b 44 24 10 <44> 3b 42 10 7e 08 eb 13 44 39 42 10 7c 0d 48 8d 4a 08 48 8b 52 08 RSP: 0018:ffffc90000e2bc60 EFLAGS: 00010086 RAX: 0000000000000292 RBX: ffffffff83467240 RCX: ffffffff83467278 RDX: ffffffffa016a260 RSI: ffffffff83752140 RDI: ffffffff83467240 RBP: ffffc90000e2bc70 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: 00000000014fa61f R12: ffffffffa01c8260 R13: ffff888231091e00 R14: 0000000000000000 R15: ffffc90000e2be78 FS: 00007fbd8d7cd540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffa016a270 CR3: 000000022c7e3000 CR4: 00000000000006f0 Call Trace: register_inet6addr_notifier+0x13/0x20 cxgb4_init_module+0x6c/0x1000 [cxgb4 ? 0xffffffffa01d7000 do_one_initcall+0x6c/0x3cc ? do_init_module+0x22/0x1f1 ? rcu_read_lock_sched_held+0x97/0xb0 ? kmem_cache_alloc_trace+0x325/0x3b0 do_init_module+0x5b/0x1f1 load_module+0x1db1/0x2690 ? m_show+0x1d0/0x1d0 __do_sys_finit_module+0xc5/0xd0 __x64_sys_finit_module+0x15/0x20 do_syscall_64+0x6b/0x1d0 entry_SYSCALL_64_after_hwframe+0x49/0xbe
If pci_register_driver fails, register inet6addr_notifier is pointless. This patch fix the error path in cxgb4_init_module.
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +12 -3
@@ -6044,15 +6044,24 @@ static int __init cxgb4_init_module(void) ret =pci_register_driver (&cxgb4_driver);if (ret <0 ) -debugfs_remove (cxgb4_debugfs_root); + goto err_pci;#if IS_ENABLED (CONFIG_IPV6 )if (!inet6addr_registered) { -register_inet6addr_notifier (&cxgb4_inet6addr_notifier); - inet6addr_registered = true; + ret =register_inet6addr_notifier (&cxgb4_inet6addr_notifier); +if (ret) +pci_unregister_driver (&cxgb4_driver); +else + inet6addr_registered = true; }#endif +if (ret ==0 ) +return ret; + +err_pci: +debugfs_remove (cxgb4_debugfs_root); +return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 44/346 afs: Fix getting the afs.fid xattr
In reply to Greg Kroah-Hartman[ Upstream commit a2f611a3dc317d8ea1c98ad6c54b911cf7f93193 ]
The AFS3 FID is three 32-bit unsigned numbers and is represented as three up-to-8-hex-digit numbers separated by colons to the afs.fid xattr. However, with the advent of support for YFS, the FID is now a 64-bit volume number, a 96-bit vnode/inode number and a 32-bit uniquifier (as before). Whilst the sprintf in afs_xattr_get_fid() has been partially updated (it currently ignores the upper 32 bits of the 96-bit vnode number), the size of the stack-based buffer has not been increased to match, thereby allowing stack corruption to occur.
Fix this by increasing the buffer size appropriately and conditionally including the upper part of the vnode number if it is non-zero. The latter requires the lower part to be zero-padded if the upper part is non-zero.
--- fs/afs/xattr.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/afs/xattr.c +12 -3
@@ -69,11 +69,20 @@ static int afs_xattr_get_fid(const struct xattr_handler *handler, void *buffer, size_t size) {struct afs_vnode *vnode =AFS_FS_I (inode); -char text[8 +1 +8 +1 +8 +1 ]; +char text[16 +1 +24 +1 +8 +1 ];size_t len; - len =sprintf (text,"%llx:%llx:%x" , - vnode->fid.vid, vnode->fid.vnode, vnode->fid.unique); +/* The volume ID is 64-bit, the vnode ID is 96-bit and the +* uniquifier is 32-bit. +*/ + len =sprintf (text,"%llx:" , vnode->fid.vid); +if (vnode->fid.vnode_hi) + len +=sprintf (text + len,"%x%016llx" , + vnode->fid.vnode_hi, vnode->fid.vnode); +else + len +=sprintf (text + len,"%llx" , vnode->fid.vnode); + len +=sprintf (text + len,":%x" , vnode->fid.unique); +if (size ==0 )return len;if (len > size)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 45/346 NFS: make nfs_match_client killable
In reply to Greg Kroah-Hartman[ Upstream commit 950a578c6128c2886e295b9c7ecb0b6b22fcc92b ]
Actually we don't do anything with return value from nfs_wait_client_init_complete in nfs_match_client, as a consequence if we get a fatal signal and client is not fully initialised, we'll loop to "again" label
This has been proven to cause soft lockups on some scenarios (no-carrier but configured network interfaces)
--- fs/nfs/client.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/client.c +6 -1
@@ -284,6 +284,7 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *datstruct nfs_client *clp;const struct sockaddr *sap = data->addr;struct nfs_net *nn =net_generic (data->net, nfs_net_id); +int error; again:list_for_each_entry (clp, &nn->nfs_client_list, cl_share_link) {
@@ -296,8 +297,10 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *datif (clp->cl_cons_state >NFS_CS_READY ) {refcount_inc (&clp->cl_count);spin_unlock (&nn->nfs_client_lock); -nfs_wait_client_init_complete (clp); + error =nfs_wait_client_init_complete (clp);nfs_put_client (clp); +if (error <0 ) +return ERR_PTR (error);spin_lock (&nn->nfs_client_lock); goto again; }
@@ -407,6 +410,8 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init) clp =nfs_match_client (cl_init);if (clp) {spin_unlock (&nn->nfs_client_lock); +if (IS_ERR (clp)) +return clp;if (new) new->rpc_ops->free_client (new);return nfs_found_client (cl_init, clp);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 46/346 gfs2: fix race between gfs2_freeze_func and unmount
In reply to Greg Kroah-Hartman[ Upstream commit 8f91821990fd6f170a5dca79697a441181a41b16 ]
As part of the freeze operation, gfs2_freeze_func() is left blocking on a request to hold the sd_freeze_gl in SH. This glock is held in EX by the gfs2_freeze() code.
A subsequent call to gfs2_unfreeze() releases the EXclusively held sd_freeze_gl, which allows gfs2_freeze_func() to acquire it in SH and resume its operation.
gfs2_unfreeze(), however, doesn't wait for gfs2_freeze_func() to complete. If a umount is issued right after unfreeze, it could result in an inconsistent filesystem because some journal data (statfs update) isn't written out.
Refer to commit 24972557b12c for a more detailed explanation of how freeze/unfreeze work.
This patch causes gfs2_unfreeze() to wait for gfs2_freeze_func() to complete before returning to the user.
--- fs/gfs2/incore.h | 1 + fs/gfs2/super.c | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-)
fs/gfs2/incore.h +1 -0
@@ -621,6 +621,7 @@ enum {SDF_SKIP_DLM_UNLOCK =8 ,SDF_FORCE_AIL_FLUSH =9 ,SDF_AIL1_IO_ERROR =10 , + SDF_FS_FROZEN = 11, }; enum gfs2_freeze_state {
fs/gfs2/super.c +5 -3
@@ -973,8 +973,7 @@ void gfs2_freeze_func(struct work_struct *work)if (error) {printk (KERN_INFO "GFS2: couldn't get freeze lock : %d\n" , error);gfs2_assert_withdraw (sdp,0 ); - } -else { + }else {atomic_set (&sdp->sd_freeze_state,SFS_UNFROZEN ); error =thaw_super (sb);if (error) {
@@ -987,6 +986,8 @@ void gfs2_freeze_func(struct work_struct *work)gfs2_glock_dq_uninit (&freeze_gh); }deactivate_super (sb); +clear_bit_unlock (SDF_FS_FROZEN , &sdp->sd_flags); +wake_up_bit (&sdp->sd_flags,SDF_FS_FROZEN );return ; }
@@ -1029,6 +1030,7 @@ static int gfs2_freeze(struct super_block *sb)msleep (1000 ); } error =0 ; +set_bit (SDF_FS_FROZEN , &sdp->sd_flags); out:mutex_unlock (&sdp->sd_freeze_mutex);return error;
@@ -1053,7 +1055,7 @@ static int gfs2_unfreeze(struct super_block *sb)gfs2_glock_dq_uninit (&sdp->sd_freeze_gh);mutex_unlock (&sdp->sd_freeze_mutex); -return 0 ; +return wait_on_bit (&sdp->sd_flags,SDF_FS_FROZEN ,TASK_INTERRUPTIBLE ); }/**
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 47/346 IB/hfi1: Fix WQ_MEM_RECLAIM warning
In reply to Greg Kroah-Hartman[ Upstream commit 4c4b1996b5db688e2dcb8242b0a3bf7b1e845e42 ]
The work_item cancels that occur when a QP is destroyed can elicit the following trace:
workqueue: WQ_MEM_RECLAIM ipoib_wq:ipoib_cm_tx_reap [ib_ipoib] is flushing !WQ_MEM_RECLAIM hfi0_0:_hfi1_do_send [hfi1]
WARNING: CPU: 7 PID: 1403 at kernel/workqueue.c:2486 check_flush_dependency+0xb1/0x100 Call Trace: __flush_work.isra.29+0x8c/0x1a0 ? __switch_to_asm+0x40/0x70 __cancel_work_timer+0x103/0x190 ? schedule+0x32/0x80 iowait_cancel_work+0x15/0x30 [hfi1] rvt_reset_qp+0x1f8/0x3e0 [rdmavt] rvt_destroy_qp+0x65/0x1f0 [rdmavt] ? _cond_resched+0x15/0x30 ib_destroy_qp+0xe9/0x230 [ib_core] ipoib_cm_tx_reap+0x21c/0x560 [ib_ipoib] process_one_work+0x171/0x370 worker_thread+0x49/0x3f0 kthread+0xf8/0x130 ? max_active_store+0x80/0x80 ? kthread_bind+0x10/0x10 ret_from_fork+0x35/0x40
Since QP destruction frees memory, hfi1_wq should have the WQ_MEM_RECLAIM.
The hfi1_wq does not allocate memory with GFP_KERNEL or otherwise become entangled with memory reclaim, so this flag is appropriate.
--- drivers/infiniband/hw/hfi1/init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hfi1/init.c +2 -1
@@ -797,7 +797,8 @@ static int create_workqueues(struct hfi1_devdata *dd) ppd->hfi1_wq =alloc_workqueue ("hfi%d_%d" , -WQ_SYSFS |WQ_HIGHPRI |WQ_CPU_INTENSIVE , +WQ_SYSFS |WQ_HIGHPRI |WQ_CPU_INTENSIVE | +WQ_MEM_RECLAIM ,HFI1_MAX_ACTIVE_WORKQUEUE_ENTRIES , dd->unit, pidx);if (!ppd->hfi1_wq)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 48/346 gfs2: Fix occasional glock use-after-free
In reply to Greg Kroah-Hartman[ Upstream commit 9287c6452d2b1f24ea8e84bd3cf6f3c6f267f712 ]
This patch has to do with the life cycle of glocks and buffers. When gfs2 metadata or journaled data is queued to be written, a gfs2_bufdata object is assigned to track the buffer, and that is queued to various lists, including the glock's gl_ail_list to indicate it's on the active items list. Once the page associated with the buffer has been written, it is removed from the ail list, but its life isn't over until a revoke has been successfully written.
So after the block is written, its bufdata object is moved from the glock's gl_ail_list to a file-system-wide list of pending revokes, sd_log_le_revoke. At that point the glock still needs to track how many revokes it contributed to that list (in gl_revokes) so that things like glock go_sync can ensure all the metadata has been not only written, but also revoked before the glock is granted to a different node. This is to guarantee journal replay doesn't replay the block once the glock has been granted to another node.
Ross Lagerwall recently discovered a race in which an inode could be evicted, and its glock freed after its ail list had been synced, but while it still had unwritten revokes on the sd_log_le_revoke list. The evict decremented the glock reference count to zero, which allowed the glock to be freed. After the revoke was written, function revoke_lo_after_commit tried to adjust the glock's gl_revokes counter and clear its GLF_LFLUSH flag, at which time it referenced the freed glock.
This patch fixes the problem by incrementing the glock reference count in gfs2_add_revoke when the glock's first bufdata object is moved from the glock to the global revokes list. Later, when the glock's last such bufdata object is freed, the reference count is decremented. This guarantees that whichever process finishes last (the revoke writing or the evict) will properly free the glock, and neither will reference the glock after it has been freed.
--- fs/gfs2/glock.c | 1 + fs/gfs2/log.c | 3 ++- fs/gfs2/lops.c | 6 ++++-- 3 files changed, 7 insertions(+), 3 deletions(-)
fs/gfs2/glock.c +1 -0
@@ -140,6 +140,7 @@ void gfs2_glock_free(struct gfs2_glock *gl) {struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; +BUG_ON (atomic_read (&gl->gl_revokes));rhashtable_remove_fast (&gl_hash_table, &gl->gl_node, ht_parms);smp_mb ();wake_up_glock (gl);
fs/gfs2/log.c +2 -1
@@ -606,7 +606,8 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)gfs2_remove_from_ail (bd);/* drops ref on bh */ bd->bd_bh =NULL ; sdp->sd_log_num_revoke++; -atomic_inc (&gl->gl_revokes); +if (atomic_inc_return (&gl->gl_revokes) ==1 ) +gfs2_glock_hold (gl);set_bit (GLF_LFLUSH , &gl->gl_flags);list_add (&bd->bd_list, &sdp->sd_log_le_revoke); }
fs/gfs2/lops.c +4 -2
@@ -667,8 +667,10 @@ static void revoke_lo_after_commit(struct gfs2_sbd *sdp, struct gfs2_trans *tr) bd = list_entry(head->next, struct gfs2_bufdata, bd_list);list_del_init (&bd->bd_list); gl = bd->bd_gl; -atomic_dec (&gl->gl_revokes); -clear_bit (GLF_LFLUSH , &gl->gl_flags); +if (atomic_dec_return (&gl->gl_revokes) ==0 ) { +clear_bit (GLF_LFLUSH , &gl->gl_flags); +gfs2_glock_queue_put (gl); + }kmem_cache_free (gfs2_bufdata_cachep, bd); } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 49/346 mmc: core: Verify SD bus width
In reply to Greg Kroah-Hartman[ Upstream commit 9e4be8d03f50d1b25c38e2b59e73b194c130df7d ]
The SD Physical Layer Spec says the following: Since the SD Memory Card shall support at least the two bus modes 1-bit or 4-bit width, then any SD Card shall set at least bits 0 and 2 (SD_BUS_WIDTH="0101").
This change verifies the card has specified a bus width.
AMD SDHC Device 7806 can get into a bad state after a card disconnect where anything transferred via the DATA lines will always result in a zero filled buffer. Currently the driver will continue without error if the HC is in this condition. A block device will be created, but reading from it will result in a zero buffer. This makes it seem like the SD device has been erased, when in actuality the data is never getting copied from the DATA lines to the data buffer.
SCR is the first command in the SD initialization sequence that uses the DATA lines. By checking that the response was invalid, we can abort mounting the card.
--- drivers/mmc/core/sd.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/mmc/core/sd.c +8 -0
@@ -216,6 +216,14 @@ static int mmc_decode_scr(struct mmc_card *card)if (scr->sda_spec3) scr->cmds =UNSTUFF_BITS (resp,32 ,2 ); + +/* SD Spec says: any SD Card shall set at least bits 0 and 2 */ +if (!(scr->bus_widths &SD_SCR_BUS_WIDTH_1 ) || + !(scr->bus_widths &SD_SCR_BUS_WIDTH_4 )) { +pr_err ("%s: invalid bus width\n" ,mmc_hostname (card->host)); +return -EINVAL ; + } +return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 50/346 tools/bpf: fix perf build error with uClibc (seen on ARC)
In reply to Greg Kroah-Hartman[ Upstream commit ca31ca8247e2d3807ff5fa1d1760616a2292001c ]
When build perf for ARC recently, there was a build failure due to lack of __NR_bpf.
| Auto-detecting system features:
|
| ... get_cpuid: [ OFF ]
| ... bpf: [ on ]
|
| # error __NR_bpf not defined. libbpf does not support your arch.
^~~~~
| bpf.c: In function 'sys_bpf':
| bpf.c:66:17: error: '__NR_bpf' undeclared (first use in this function)
| return syscall(__NR_bpf, cmd, attr, size);
| ^~~~~~~~
| sys_bpf--- tools/lib/bpf/bpf.c | 2 ++ 1 file changed, 2 insertions(+)
tools/lib/bpf/bpf.c +2 -0
@@ -45,6 +45,8 @@# define __NR_bpf 349# elif defined(__s390__)# define __NR_bpf 351 +# elif defined(__arc__) +# define __NR_bpf 280# else # error __NR_bpf not defined. libbpf does not support your arch.# endif
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 51/346 selftests/bpf: set RLIMIT_MEMLOCK properly for test_libbpf_open.c
In reply to Greg Kroah-Hartman[ Upstream commit 6cea33701eb024bc6c920ab83940ee22afd29139 ]
Test test_libbpf.sh failed on my development server with failure
-bash-4.4$ sudo ./test_libbpf.sh
[0] libbpf: Error in bpf_object__probe_name():Operation not permitted(1). Couldn't load basic 'r0 = 0' BPF program.
test_libbpf: failed at file test_l4lb.o
selftests: test_libbpf [FAILED]
-bash-4.4$
The reason is because my machine has 64KB locked memory by default which is not enough for this program to get locked memory.
Similar to other bpf selftests, let us increase RLIMIT_MEMLOCK to infinity, which fixed the issue.
--- tools/testing/selftests/bpf/test_libbpf_open.c | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/bpf/test_libbpf_open.c +2 -0
@@ -11,6 +11,8 @@ static const char *__doc__ =#include <bpf/libbpf.h> #include <getopt.h> +#include "bpf_rlimit.h" +static const struct option long_options[] = { {"help" , no_argument,NULL ,'h' }, {"debug" , no_argument,NULL ,'D' },
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 52/346 bpftool: exclude bash-completion/bpftool from .gitignore pattern
In reply to Greg Kroah-Hartman[ Upstream commit a7d006714724de4334c5e3548701b33f7b12ca96 ]
tools/bpf/bpftool/.gitignore has the "bpftool" pattern, which is intended to ignore the following build artifact:
tools/bpf/bpftool/bpftool
However, the .gitignore entry is effective not only for the current directory, but also for any sub-directories.
So, from the point of .gitignore grammar, the following check-in file is also considered to be ignored:
tools/bpf/bpftool/bash-completion/bpftool
As the manual gitignore(5) says "Files already tracked by Git are not affected", this is not a problem as far as Git is concerned.
However, Git is not the only program that parses .gitignore because .gitignore is useful to distinguish build artifacts from source files.
For example, tar(1) supports the --exclude-vcs-ignore option. As of writing, this option does not work perfectly, but it intends to create a tarball excluding files specified by .gitignore.
So, I believe it is better to fix this issue.
You can fix it by prefixing the pattern with a slash; the leading slash means the specified pattern is relative to the current directory.
--- tools/bpf/bpftool/.gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/bpf/bpftool/.gitignore +1 -1
@@ -1,5 +1,5 @@ *.d -bpftool +/bpftool bpftool*.8 bpf-helpers.* FEATURE-DUMP.bpftool
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 53/346 ice: Separate if conditions for ice_set_features()
In reply to Greg Kroah-Hartman[ Upstream commit 8f529ff912073f778e3cd74e87fb69a36499fc2f ]
Set features can have multiple features turned on|off in a single call. Grouping these all in an if/else means after one condition is met, other conditions/features will not be evaluated. Break the if/else statements by feature to ensure all features will be handled properly.
--- drivers/net/ethernet/intel/ice/ice_main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_main.c +6 -2
@@ -2490,6 +2490,9 @@ static int ice_set_features(struct net_device *netdev,struct ice_vsi *vsi = np->vsi;int ret =0 ; +/* Multiple features can be changed in one call so keep features in +* separate if/else statements to guarantee each feature is checked +*/ if (features &NETIF_F_RXHASH && !(netdev->features &NETIF_F_RXHASH )) ret =ice_vsi_manage_rss_lut (vsi, true); else if (!(features & NETIF_F_RXHASH) &&
@@ -2502,8 +2505,9 @@ static int ice_set_features(struct net_device *netdev,else if (!(features &NETIF_F_HW_VLAN_CTAG_RX ) && (netdev->features &NETIF_F_HW_VLAN_CTAG_RX )) ret =ice_vsi_manage_vlan_stripping (vsi, false); -else if ((features &NETIF_F_HW_VLAN_CTAG_TX ) && - !(netdev->features &NETIF_F_HW_VLAN_CTAG_TX )) + +if ((features &NETIF_F_HW_VLAN_CTAG_TX ) && + !(netdev->features &NETIF_F_HW_VLAN_CTAG_TX )) ret =ice_vsi_manage_vlan_insertion (vsi);else if (!(features &NETIF_F_HW_VLAN_CTAG_TX ) && (netdev->features &NETIF_F_HW_VLAN_CTAG_TX ))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 54/346 blk-mq: split blk_mq_alloc_and_init_hctx into two parts
In reply to Greg Kroah-Hartman[ Upstream commit 7c6c5b7c9186e3fb5b10afb8e5f710ae661144c6 ]
Split blk_mq_alloc_and_init_hctx into two parts, and one is blk_mq_alloc_hctx() for allocating all hctx resources, another is blk_mq_init_hctx() for initializing hctx, which serves as counter-part of blk_mq_exit_hctx().
--- block/blk-mq.c | 139 ++++++++++++++++++++++++++----------------------- 1 file changed, 75 insertions(+), 64 deletions(-)
block/blk-mq.c +75 -64
@@ -2287,15 +2287,65 @@ static void blk_mq_exit_hw_queues(struct request_queue *q, } } +static int blk_mq_hw_ctx_size (struct blk_mq_tag_set *tag_set) +{ +int hw_ctx_size =sizeof (struct blk_mq_hw_ctx ); + +BUILD_BUG_ON (ALIGN (offsetof(struct blk_mq_hw_ctx , srcu), + __alignof__(struct blk_mq_hw_ctx )) != +sizeof (struct blk_mq_hw_ctx )); + +if (tag_set->flags &BLK_MQ_F_BLOCKING ) + hw_ctx_size +=sizeof (struct srcu_struct ); + +return hw_ctx_size; +} +static int blk_mq_init_hctx (struct request_queue *q,struct blk_mq_tag_set *set,struct blk_mq_hw_ctx *hctx,unsigned hctx_idx) { -int node; + hctx->queue_num = hctx_idx; + +cpuhp_state_add_instance_nocalls (CPUHP_BLK_MQ_DEAD , &hctx->cpuhp_dead); + + hctx->tags = set->tags[hctx_idx]; + +if (set->ops->init_hctx && + set->ops->init_hctx (hctx, set->driver_data, hctx_idx)) + goto unregister_cpu_notifier; - node = hctx->numa_node; +if (blk_mq_init_request (set, hctx->fq->flush_rq, hctx_idx, + hctx->numa_node)) + goto exit_hctx; +return 0 ; + + exit_hctx: +if (set->ops->exit_hctx) + set->ops->exit_hctx (hctx, hctx_idx); + unregister_cpu_notifier: +blk_mq_remove_cpuhp (hctx); +return -1 ; +} + +static struct blk_mq_hw_ctx * +blk_mq_alloc_hctx (struct request_queue *q,struct blk_mq_tag_set *set, +int node) +{ +struct blk_mq_hw_ctx *hctx; +gfp_t gfp =GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY; + + hctx =kzalloc_node (blk_mq_hw_ctx_size (set), gfp, node); +if (!hctx) + goto fail_alloc_hctx; + +if (!zalloc_cpumask_var_node (&hctx->cpumask, gfp, node)) + goto free_hctx; + +atomic_set (&hctx->nr_active,0 );if (node ==NUMA_NO_NODE ) - node = hctx->numa_node = set->numa_node; + node = set->numa_node; + hctx->numa_node = node;INIT_DELAYED_WORK (&hctx->run_work, blk_mq_run_work_fn);spin_lock_init (&hctx->lock);
@@ -2303,58 +2353,45 @@ static int blk_mq_init_hctx(struct request_queue *q, hctx->queue = q; hctx->flags = set->flags & ~BLK_MQ_F_TAG_SHARED ; -cpuhp_state_add_instance_nocalls (CPUHP_BLK_MQ_DEAD , &hctx->cpuhp_dead); - - hctx->tags = set->tags[hctx_idx]; -/* * Allocate space for all possible cpus to avoid allocation at * runtime */ hctx->ctxs =kmalloc_array_node (nr_cpu_ids,sizeof (void *), -GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY, node); + gfp, node);if (!hctx->ctxs) - goto unregister_cpu_notifier; + goto free_cpumask;if (sbitmap_init_node (&hctx->ctx_map, nr_cpu_ids,ilog2 (8 ), -GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY, node)) + gfp, node)) goto free_ctxs; - hctx->nr_ctx =0 ;spin_lock_init (&hctx->dispatch_wait_lock);init_waitqueue_func_entry (&hctx->dispatch_wait, blk_mq_dispatch_wake);INIT_LIST_HEAD (&hctx->dispatch_wait.entry); -if (set->ops->init_hctx && - set->ops->init_hctx (hctx, set->driver_data, hctx_idx)) - goto free_bitmap; - hctx->fq =blk_alloc_flush_queue (q, hctx->numa_node, set->cmd_size, -GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY); + gfp);if (!hctx->fq) - goto exit_hctx; - -if (blk_mq_init_request (set, hctx->fq->flush_rq, hctx_idx, node)) - goto free_fq; + goto free_bitmap;if (hctx->flags &BLK_MQ_F_BLOCKING )init_srcu_struct (hctx->srcu); +blk_mq_hctx_kobj_init (hctx); -return 0 ; +return hctx; - free_fq: -blk_free_flush_queue (hctx->fq); - exit_hctx: -if (set->ops->exit_hctx) - set->ops->exit_hctx (hctx, hctx_idx); free_bitmap:sbitmap_free (&hctx->ctx_map); free_ctxs:kfree (hctx->ctxs); - unregister_cpu_notifier: -blk_mq_remove_cpuhp (hctx); -return -1 ; + free_cpumask: +free_cpumask_var (hctx->cpumask); + free_hctx: +kfree (hctx); + fail_alloc_hctx: +return NULL ; } static void blk_mq_init_cpu_queues(struct request_queue *q,
@@ -2691,51 +2728,25 @@ struct request_queue *blk_mq_init_sq_queue(struct blk_mq_tag_set *set, }EXPORT_SYMBOL (blk_mq_init_sq_queue); -static int blk_mq_hw_ctx_size (struct blk_mq_tag_set *tag_set) -{ -int hw_ctx_size =sizeof (struct blk_mq_hw_ctx ); - -BUILD_BUG_ON (ALIGN (offsetof(struct blk_mq_hw_ctx , srcu), - __alignof__(struct blk_mq_hw_ctx )) != -sizeof (struct blk_mq_hw_ctx )); - -if (tag_set->flags &BLK_MQ_F_BLOCKING ) - hw_ctx_size +=sizeof (struct srcu_struct ); - -return hw_ctx_size; -} -static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx (struct blk_mq_tag_set *set,struct request_queue *q,int hctx_idx,int node) {struct blk_mq_hw_ctx *hctx; - hctx =kzalloc_node (blk_mq_hw_ctx_size (set), -GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY, - node); + hctx =blk_mq_alloc_hctx (q, set, node);if (!hctx) -return NULL ; - -if (!zalloc_cpumask_var_node (&hctx->cpumask, -GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY, - node)) { -kfree (hctx); -return NULL ; - } - -atomic_set (&hctx->nr_active,0 ); - hctx->numa_node = node; - hctx->queue_num = hctx_idx; + goto fail; -if (blk_mq_init_hctx (q, set, hctx, hctx_idx)) { -free_cpumask_var (hctx->cpumask); -kfree (hctx); -return NULL ; - } -blk_mq_hctx_kobj_init (hctx); +if (blk_mq_init_hctx (q, set, hctx, hctx_idx)) + goto free_hctx;return hctx; + + free_hctx: +kobject_put (&hctx->kobj); + fail: +return NULL ; } static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 55/346 blk-mq: grab .q_usage_counter when queuing request from plug code path
In reply to Greg Kroah-Hartman[ Upstream commit e87eb301bee183d82bb3d04bd71b6660889a2588 ]
Just like aio/io_uring, we need to grab 2 refcount for queuing one request, one is for submission, another is for completion.
If the request isn't queued from plug code path, the refcount grabbed in generic_make_request() serves for submission. In theroy, this refcount should have been released after the sumission(async run queue) is done. blk_freeze_queue() works with blk_sync_queue() together for avoiding race between cleanup queue and IO submission, given async run queue activities are canceled because hctx->run_work is scheduled with the refcount held, so it is fine to not hold the refcount when running the run queue work function for dispatch IO.
However, if request is staggered into plug list, and finally queued from plug code path, the refcount in submission side is actually missed. And we may start to run queue after queue is removed because the queue's kobject refcount isn't guaranteed to be grabbed in flushing plug list context, then kernel oops is triggered, see the following race:
blk_mq_flush_plug_list():
blk_mq_sched_insert_requests()
insert requests to sw queue or scheduler queue blk_mq_run_hw_queue
Because of concurrent run queue, all requests inserted above may be completed before calling the above blk_mq_run_hw_queue. Then queue can be freed during the above blk_mq_run_hw_queue().
Fixes the issue by grab .q_usage_counter before calling blk_mq_sched_insert_requests() in blk_mq_flush_plug_list(). This way is safe because the queue is absolutely alive before inserting request.
--- block/blk-mq-sched.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
block/blk-mq-sched.c +11 -1
@@ -413,6 +413,14 @@ void blk_mq_sched_insert_requests(struct blk_mq_hw_ctx *hctx, struct list_head *list, bool run_queue_async) {struct elevator_queue *e; +struct request_queue *q = hctx->queue; + +/* +* blk_mq_sched_insert_requests() is called from flush plug +* context only, and hold one usage counter to prevent queue +* from being released. +*/ +percpu_ref_get (&q->q_usage_counter); e = hctx->queue->elevator;if (e && e->type->ops.insert_requests)
@@ -426,12 +434,14 @@ void blk_mq_sched_insert_requests(struct blk_mq_hw_ctx *hctx,if (!hctx->dispatch_busy && !e && !run_queue_async) {blk_mq_try_issue_list_directly (hctx, list);if (list_empty (list)) -return ; + goto out; }blk_mq_insert_requests (hctx, ctx, list); }blk_mq_run_hw_queue (hctx, run_queue_async); + out: +percpu_ref_put (&q->q_usage_counter); } static void blk_mq_sched_free_tags(struct blk_mq_tag_set *set,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 56/346 dmaengine: tegra210-dma: free dma controller in remove()
In reply to Greg Kroah-Hartman[ Upstream commit f030e419501cb95e961e9ed35c493b5d46a04eca ]
Following kernel panic is seen during DMA driver unload->load sequence
==========================================================================
Unable to handle kernel paging request at virtual address ffffff8001198880 Internal error: Oops: 86000007 [#1] PREEMPT SMP CPU: 0 PID: 5907 Comm: HwBinder:4123_1 Tainted: G C 4.9.128-tegra-g065839f Hardware name: galen (DT) task: ffffffc3590d1a80 task.stack: ffffffc3d0678000 PC is at 0xffffff8001198880 LR is at of_dma_request_slave_channel+0xd8/0x1f8 pc : [<ffffff8001198880>] lr : [<ffffff8008746f30>] pstate: 60400045
sp : ffffffc3d067b710
x29: ffffffc3d067b710 x28: 000000000000002f
x27: ffffff800949e000 x26: ffffff800949e750
x25: ffffff800949e000 x24: ffffffbefe817d84
x23: ffffff8009f77cb0 x22: 0000000000000028
x21: ffffffc3ffda49c8 x20: 0000000000000029
x19: 0000000000000001 x18: ffffffffffffffff
x17: 0000000000000000 x16: ffffff80082b66a0
x15: ffffff8009e78250 x14: 000000000000000a
x13: 0000000000000038 x12: 0101010101010101
x11: 0000000000000030 x10: 0101010101010101
x9 : fffffffffffffffc x8 : 7f7f7f7f7f7f7f7f
x7 : 62ff726b6b64622c x6 : 0000000000008064
x5 : 6400000000000000 x4 : ffffffbefe817c44
x3 : ffffffc3ffda3e08 x2 : ffffff8001198880
x1 : ffffffc3d48323c0 x0 : ffffffc3d067b788
Process HwBinder:4123_1 (pid: 5907, stack limit = 0xffffffc3d0678028)
Call trace: [<ffffff8001198880>] 0xffffff8001198880 [<ffffff80087459f8>] dma_request_chan+0x50/0x1f0 [<ffffff8008745bc0>] dma_request_slave_channel+0x28/0x40 [<ffffff8001552c44>] tegra_alt_pcm_open+0x114/0x170 [<ffffff8008d65fa4>] soc_pcm_open+0x10c/0x878 [<ffffff8008d18618>] snd_pcm_open_substream+0xc0/0x170 [<ffffff8008d1878c>] snd_pcm_open+0xc4/0x240 [<ffffff8008d189e0>] snd_pcm_playback_open+0x58/0x80 [<ffffff8008cfc6d4>] snd_open+0xb4/0x178 [<ffffff8008250628>] chrdev_open+0xb8/0x1d0 [<ffffff8008246fdc>] do_dentry_open+0x214/0x318 [<ffffff80082485d0>] vfs_open+0x58/0x88 [<ffffff800825bce0>] do_last+0x450/0xde0 [<ffffff800825c718>] path_openat+0xa8/0x368 [<ffffff800825dd84>] do_filp_open+0x8c/0x110 [<ffffff8008248a74>] do_sys_open+0x164/0x220 [<ffffff80082b66dc>] compat_SyS_openat+0x3c/0x50 [<ffffff8008083040>] el0_svc_naked+0x34/0x38 ---[ end trace 67e6d544e65b5145 ]--- Kernel panic - not syncing: Fatal exception ==========================================================================
In device probe(), of_dma_controller_register() registers DMA controller. But when driver is removed, this is not freed. During driver reload this results in data abort and kernel panic. Add of_dma_controller_free() in driver remove path to fix the issue.
--- drivers/dma/tegra210-adma.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/tegra210-adma.c +1 -0
@@ -786,6 +786,7 @@ static int tegra_adma_remove(struct platform_device *pdev)struct tegra_adma *tdma =platform_get_drvdata (pdev);int i; +of_dma_controller_free (pdev->dev.of_node);dma_async_device_unregister (&tdma->dma_dev);for (i =0 ; i < tdma->nr_channels; ++i)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 57/346 net: ena: gcc 8: fix compilation warning
In reply to Greg Kroah-Hartman[ Upstream commit f913308879bc6ae437ce64d878c7b05643ddea44 ]
GCC 8 contains a number of new warnings as well as enhancements to existing checkers. The warning - Wstringop-truncation - warns for calls to bounded string manipulation functions such as strncat, strncpy, and stpncpy that may either truncate the copied string or leave the destination unchanged.
In our case the destination string length (32 bytes) is much shorter than the source string (64 bytes) which causes this warning to show up. In general the destination has to be at least a byte larger than the length of the source string with strncpy for this warning not to showup.
This can be easily fixed by using strlcpy instead which already does the truncation to the string. Documentation for this function can be found here:
https://elixir.bootlin.com/linux/latest/source/lib/string.c#L141
--- drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/amazon/ena/ena_netdev.c +1 -1
@@ -2292,7 +2292,7 @@ static void ena_config_host_info(struct ena_com_dev *ena_dev, host_info->bdf = (pdev->bus->number <<8 ) | pdev->devfn; host_info->os_type =ENA_ADMIN_OS_LINUX ; host_info->kernel_ver =LINUX_VERSION_CODE ; -strncpy (host_info->kernel_ver_str,utsname ()->version, +strlcpy (host_info->kernel_ver_str,utsname ()->version,sizeof (host_info->kernel_ver_str) -1 ); host_info->os_dist =0 ; strncpy(host_info->os_dist_str, utsname()->release,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/346 net: ena: fix: set freed objects to NULL to avoid failing future allocations
In reply to Greg Kroah-Hartman[ Upstream commit 8ee8ee7fe87bf64738ab4e31be036a7165608b27 ]
In some cases when a queue related allocation fails, successful past allocations are freed but the pointer that pointed to them is not set to NULL. This is a problem for 2 reasons:
1. This is generally a bad practice since this pointer might be accidentally accessed in the future.
2. Future allocations using the same pointer check if the pointer is NULL and fail if it is not.
Fixed this by setting such pointers to NULL in the allocation of queue related objects.
Also refactored the code of ena_setup_tx_resources() to goto-style error handling to avoid code duplication of resource freeing.
--- drivers/net/ethernet/amazon/ena/ena_netdev.c | 25 ++++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-)
drivers/net/ethernet/amazon/ena/ena_netdev.c +15 -10
@@ -224,28 +224,23 @@ static int ena_setup_tx_resources(struct ena_adapter *adapter, int qid)if (!tx_ring->tx_buffer_info) { tx_ring->tx_buffer_info =vzalloc (size);if (!tx_ring->tx_buffer_info) -return -ENOMEM ; + goto err_tx_buffer_info; } size =sizeof (u16) * tx_ring->ring_size; tx_ring->free_tx_ids =vzalloc_node (size, node);if (!tx_ring->free_tx_ids) { tx_ring->free_tx_ids =vzalloc (size); -if (!tx_ring->free_tx_ids) { -vfree (tx_ring->tx_buffer_info); -return -ENOMEM ; - } +if (!tx_ring->free_tx_ids) + goto err_free_tx_ids; } size = tx_ring->tx_max_header_size; tx_ring->push_buf_intermediate_buf =vzalloc_node (size, node);if (!tx_ring->push_buf_intermediate_buf) { tx_ring->push_buf_intermediate_buf =vzalloc (size); -if (!tx_ring->push_buf_intermediate_buf) { -vfree (tx_ring->tx_buffer_info); -vfree (tx_ring->free_tx_ids); -return -ENOMEM ; - } +if (!tx_ring->push_buf_intermediate_buf) + goto err_push_buf_intermediate_buf; }/* Req id ring for TX out of order completions */
@@ -259,6 +254,15 @@ static int ena_setup_tx_resources(struct ena_adapter *adapter, int qid) tx_ring->next_to_clean =0 ; tx_ring->cpu = ena_irq->cpu;return 0 ; + +err_push_buf_intermediate_buf: +vfree (tx_ring->free_tx_ids); + tx_ring->free_tx_ids =NULL ; +err_free_tx_ids: +vfree (tx_ring->tx_buffer_info); + tx_ring->tx_buffer_info =NULL ; +err_tx_buffer_info: +return -ENOMEM ; }/* ena_free_tx_resources - Free I/O Tx Resources per Queue
@@ -378,6 +382,7 @@ static int ena_setup_rx_resources(struct ena_adapter *adapter, rx_ring->free_rx_ids =vzalloc (size);if (!rx_ring->free_rx_ids) {vfree (rx_ring->rx_buffer_info); + rx_ring->rx_buffer_info =NULL ;return -ENOMEM ; } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 59/346 hv_netvsc: fix race that may miss tx queue wakeup
In reply to Greg Kroah-Hartman[ Upstream commit 93aa4792c3908eac87ddd368ee0fe0564148232b ]
When the ring buffer is almost full due to RX completion messages, a TX packet may reach the "low watermark" and cause the queue stopped. If the TX completion arrives earlier than queue stopping, the wakeup may be missed.
This patch moves the check for the last pending packet to cover both EAGAIN and success cases, so the queue will be reliably waked up when necessary.
--- drivers/net/hyperv/netvsc.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/net/hyperv/netvsc.c +9 -6
@@ -875,12 +875,6 @@ static inline int netvsc_send_pkt( }else if (ret == -EAGAIN ) {netif_tx_stop_queue (txq); ndev_ctx->eth_stats.stop_queue++; -if (atomic_read (&nvchan->queue_sends) <1 && - !net_device->tx_disable) { -netif_tx_wake_queue (txq); - ndev_ctx->eth_stats.wake_queue++; - ret = -ENOSPC ; - } }else { netdev_err(ndev, "Unable to send packet pages %u len %u, ret %d\n",
@@ -888,6 +882,15 @@ static inline int netvsc_send_pkt( ret); } +if (netif_tx_queue_stopped (txq) && +atomic_read (&nvchan->queue_sends) <1 && + !net_device->tx_disable) { +netif_tx_wake_queue (txq); + ndev_ctx->eth_stats.wake_queue++; +if (ret == -EAGAIN ) + ret = -ENOSPC ; + } +return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/346 Bluetooth: Ignore CC events not matching the last HCI command
In reply to Greg Kroah-Hartman[ Upstream commit f80c5dad7b6467b884c445ffea45985793b4b2d0 ]
This commit makes the kernel not send the next queued HCI command until a command complete arrives for the last HCI command sent to the controller. This change avoids a problem with some buggy controllers (seen on two SKUs of QCA9377) that send an extra command complete event for the previous command after the kernel had already sent a new HCI command to the controller.
The problem was reproduced when starting an active scanning procedure, where an extra command complete event arrives for the LE_SET_RANDOM_ADDR command. When this happends the kernel ends up not processing the command complete for the following commmand, LE_SET_SCAN_PARAM, and ultimately behaving as if a passive scanning procedure was being performed, when in fact controller is performing an active scanning procedure. This makes it impossible to discover BLE devices as no device found events are sent to userspace.
This problem is reproducible on 100% of the attempts on the affected controllers. The extra command complete event can be seen at timestamp 27.420131 on the btmon logs bellow.
Bluetooth monitor ver 5.50
= Note: Linux version 5.0.0+ (x86_64) 0.352340
= Note: Bluetooth subsystem version 2.22 0.352343
= New Index: 80:C5:F2:8F:87:84 (Primary,USB,hci0) [hci0] 0.352344 = Open Index: 80:C5:F2:8F:87:84 [hci0] 0.352345 = Index Info: 80:C5:F2:8F:87:84 (Qualcomm) [hci0] 0.352346
@ MGMT Open: bluetoothd (privileged) version 1.14 {0x0001} 0.352347
@ MGMT Open: btmon (privileged) version 1.14 {0x0002} 0.352366
@ MGMT Open: btmgmt (privileged) version 1.14 {0x0003} 27.302164
@ MGMT Command: Start Discovery (0x0023) plen 1 {0x0003} [hci0] 27.302310
Address type: 0x06
LE Public
LE Random
< HCI Command: LE Set Random Address (0x08|0x0005) plen 6 #1 [hci0] 27.302496
Address: 15:60:F2:91:B2:24 (Non-Resolvable)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 4 #2 [hci0] 27.419117
LE Set Random Address (0x08|0x0005) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7 #3 [hci0] 27.419244
Type: Active (0x01)
Interval: 11.250 msec (0x0012)
Window: 11.250 msec (0x0012)
Own address type: Random (0x01)
Filter policy: Accept all advertisement (0x00)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 4 #4 [hci0] 27.420131
LE Set Random Address (0x08|0x0005) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2 #5 [hci0] 27.420259
Scanning: Enabled (0x01)
Filter duplicates: Enabled (0x01)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 4 #6 [hci0] 27.420969
LE Set Scan Parameters (0x08|0x000b) ncmd 1
Status: Success (0x00)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 4 #7 [hci0] 27.421983
LE Set Scan Enable (0x08|0x000c) ncmd 1
Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 4 {0x0003} [hci0] 27.422059
Start Discovery (0x0023) plen 1
Status: Success (0x00)
Address type: 0x06
LE Public
LE Random
@ MGMT Event: Discovering (0x0013) plen 2 {0x0003} [hci0] 27.422067
Address type: 0x06
LE Public
LE Random
Discovery: Enabled (0x01)
@ MGMT Event: Discovering (0x0013) plen 2 {0x0002} [hci0] 27.422067
Address type: 0x06
LE Public
LE Random
Discovery: Enabled (0x01)
@ MGMT Event: Discovering (0x0013) plen 2 {0x0001} [hci0] 27.422067
Address type: 0x06
LE Public
LE Random
Discovery: Enabled (0x01)--- include/net/bluetooth/hci.h | 1 + net/bluetooth/hci_core.c | 5 +++++ net/bluetooth/hci_event.c | 12 ++++++++++++ net/bluetooth/hci_request.c | 5 +++++ net/bluetooth/hci_request.h | 1 + 5 files changed, 24 insertions(+)
include/net/bluetooth/hci.h +1 -0
@@ -270,6 +270,7 @@ enum {HCI_FORCE_BREDR_SMP ,HCI_FORCE_STATIC_ADDR ,HCI_LL_RPA_RESOLUTION , +HCI_CMD_PENDING , __HCI_NUM_FLAGS, };
net/bluetooth/hci_core.c +5 -0
@@ -4337,6 +4337,9 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,return ; } +/* If we reach this point this event matches the last command sent */ +hci_dev_clear_flag (hdev,HCI_CMD_PENDING ); +/* If the command succeeded and there's still more commands in * this request the request is not yet complete. */
@@ -4447,6 +4450,8 @@ static void hci_cmd_work(struct work_struct *work) hdev->sent_cmd =skb_clone (skb,GFP_KERNEL );if (hdev->sent_cmd) { +if (hci_req_status_pend (hdev)) +hci_dev_set_flag (hdev,HCI_CMD_PENDING );atomic_dec (&hdev->cmd_cnt);hci_send_frame (hdev, skb);if (test_bit (HCI_RESET , &hdev->flags))
net/bluetooth/hci_event.c +12 -0
@@ -3404,6 +3404,12 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,hci_req_cmd_complete (hdev, *opcode, *status, req_complete, req_complete_skb); +if (hci_dev_test_flag (hdev,HCI_CMD_PENDING )) { +bt_dev_err (hdev, +"unexpected event for opcode 0x%4.4x" , *opcode); +return ; + } +if (atomic_read (&hdev->cmd_cnt) && !skb_queue_empty (&hdev->cmd_q))queue_work (hdev->workqueue, &hdev->cmd_work); }
@@ -3511,6 +3517,12 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,hci_req_cmd_complete (hdev, *opcode, ev->status, req_complete, req_complete_skb); +if (hci_dev_test_flag (hdev,HCI_CMD_PENDING )) { +bt_dev_err (hdev, +"unexpected event for opcode 0x%4.4x" , *opcode); +return ; + } +if (atomic_read (&hdev->cmd_cnt) && !skb_queue_empty (&hdev->cmd_q))queue_work (hdev->workqueue, &hdev->cmd_work); }
net/bluetooth/hci_request.c +5 -0
@@ -46,6 +46,11 @@ void hci_req_purge(struct hci_request *req)skb_queue_purge (&req->cmd_q); } +bool hci_req_status_pend (struct hci_dev *hdev) +{ +return hdev->req_status ==HCI_REQ_PEND ; +} +static int req_run (struct hci_request *req,hci_req_complete_t complete,hci_req_complete_skb_t complete_skb) {
net/bluetooth/hci_request.h +1 -0
@@ -37,6 +37,7 @@ struct hci_request {void hci_req_init (struct hci_request *req,struct hci_dev *hdev);void hci_req_purge (struct hci_request *req); +bool hci_req_status_pend (struct hci_dev *hdev);int hci_req_run (struct hci_request *req,hci_req_complete_t complete);int hci_req_run_skb (struct hci_request *req,hci_req_complete_skb_t complete); void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/346 pinctrl: zte: fix leaked of_node references
In reply to Greg Kroah-Hartman[ Upstream commit 02d15f0d80720545f1f4922a1550ea4aaad4e152 ]
The call to of_parse_phandle returns a node pointer with refcount incremented thus it must be explicitly decremented after the last usage.
Detected by coccinelle with the following warnings:
./drivers/pinctrl/zte/pinctrl-zx.c:415:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 407, but without a corresponding object release within this function. ./drivers/pinctrl/zte/pinctrl-zx.c:422:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 407, but without a corresponding object release within this function. ./drivers/pinctrl/zte/pinctrl-zx.c:436:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 407, but without a corresponding object release within this function. ./drivers/pinctrl/zte/pinctrl-zx.c:444:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 407, but without a corresponding object release within this function. ./drivers/pinctrl/zte/pinctrl-zx.c:448:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 407, but without a corresponding object release within this function.
--- drivers/pinctrl/zte/pinctrl-zx.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/zte/pinctrl-zx.c +1 -0
@@ -411,6 +411,7 @@ int zx_pinctrl_init(struct platform_device *pdev, } zpctl->aux_base =of_iomap (np,0 ); +of_node_put (np);if (!zpctl->aux_base)return -ENOMEM ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/346 ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE
In reply to Greg Kroah-Hartman[ Upstream commit 16ec5dfe0327ddcf279957bffe4c8fe527088c63 ]
On kbl_rt5663_max98927, commit 38a5882e4292
("ASoC: Intel: kbl_rt5663_max98927: Map BTN_0 to KEY_PLAYPAUSE") This key pair mapping to play/pause when playing Youtube
The Android 3.5mm Headset jack specification mentions that BTN_0 should be mapped to KEY_MEDIA, but this is less logical than KEY_PLAYPAUSE, which has much broader userspace support.
For example, the Chrome OS userspace now supports KEY_PLAYPAUSE to toggle play/pause of videos and audio, but does not handle KEY_MEDIA.
Furthermore, Android itself now supports KEY_PLAYPAUSE equivalently, as the new USB headset spec requires KEY_PLAYPAUSE for BTN_0.
https://source.android.com/devices/accessories/headset/usb-headset-spec
The same fix is required on Chrome kbl_da7219_max98357a.
--- sound/soc/intel/boards/kbl_da7219_max98357a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/boards/kbl_da7219_max98357a.c +1 -1
@@ -188,7 +188,7 @@ static int kabylake_da7219_codec_init(struct snd_soc_pcm_runtime *rtd) jack = &ctx->kabylake_headset; -snd_jack_set_key (jack->jack,SND_JACK_BTN_0 ,KEY_MEDIA ); +snd_jack_set_key (jack->jack,SND_JACK_BTN_0 ,KEY_PLAYPAUSE );snd_jack_set_key (jack->jack,SND_JACK_BTN_1 ,KEY_VOLUMEUP );snd_jack_set_key (jack->jack,SND_JACK_BTN_2 ,KEY_VOLUMEDOWN );snd_jack_set_key (jack->jack,SND_JACK_BTN_3 ,KEY_VOICECOMMAND );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/346 usb: dwc2: gadget: Increase descriptors count for ISOCs
In reply to Greg Kroah-Hartman[ Upstream commit 54f37f56631747075f1f9a2f0edf6ba405e3e66c ]
Some function drivers queueing more than 128 ISOC requests at a time. To avoid "descriptor chain full" cases, increasing descriptors count from MAX_DMA_DESC_NUM_GENERIC to MAX_DMA_DESC_NUM_HS_ISOC for ISOC's only.
--- drivers/usb/dwc2/gadget.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
drivers/usb/dwc2/gadget.c +15 -12
@@ -714,13 +714,11 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep)unsigned int maxsize;if (is_isoc) - maxsize = hs_ep->dir_in ?DEV_DMA_ISOC_TX_NBYTES_LIMIT : -DEV_DMA_ISOC_RX_NBYTES_LIMIT ; + maxsize = (hs_ep->dir_in ?DEV_DMA_ISOC_TX_NBYTES_LIMIT : +DEV_DMA_ISOC_RX_NBYTES_LIMIT ) * +MAX_DMA_DESC_NUM_HS_ISOC ;else - maxsize =DEV_DMA_NBYTES_LIMIT ; - -/* Above size of one descriptor was chosen, multiple it */ - maxsize *=MAX_DMA_DESC_NUM_GENERIC ; + maxsize =DEV_DMA_NBYTES_LIMIT *MAX_DMA_DESC_NUM_GENERIC ;return maxsize; }
@@ -903,7 +901,7 @@ static int dwc2_gadget_fill_isoc_desc(struct dwc2_hsotg_ep *hs_ep,/* Update index of last configured entry in the chain */ hs_ep->next_desc++; -if (hs_ep->next_desc >=MAX_DMA_DESC_NUM_GENERIC ) +if (hs_ep->next_desc >=MAX_DMA_DESC_NUM_HS_ISOC ) hs_ep->next_desc =0 ;return 0 ;
@@ -935,7 +933,7 @@ static void dwc2_gadget_start_isoc_ddma(struct dwc2_hsotg_ep *hs_ep) }/* Initialize descriptor chain by Host Busy status */ -for (i =0 ; i <MAX_DMA_DESC_NUM_GENERIC ; i++) { +for (i =0 ; i <MAX_DMA_DESC_NUM_HS_ISOC ; i++) { desc = &hs_ep->desc_list[i]; desc->status =0 ; desc->status |= (DEV_DMA_BUFF_STS_HBUSY
@@ -2122,7 +2120,7 @@ static void dwc2_gadget_complete_isoc_request_ddma(struct dwc2_hsotg_ep *hs_ep)dwc2_hsotg_complete_request (hsotg, hs_ep, hs_req,0 ); hs_ep->compl_desc++; -if (hs_ep->compl_desc > (MAX_DMA_DESC_NUM_GENERIC -1 )) +if (hs_ep->compl_desc > (MAX_DMA_DESC_NUM_HS_ISOC -1 )) hs_ep->compl_desc =0 ; desc_sts = hs_ep->desc_list[hs_ep->compl_desc].status; }
@@ -3859,6 +3857,7 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,unsigned int i, val, size;int ret =0 ;unsigned char ep_type; +int desc_num; dev_dbg(hsotg->dev, "%s: ep %s: a 0x%02x, attr 0x%02x, mps 0x%04x, intr %d\n",
@@ -3905,11 +3904,15 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,dev_dbg (hsotg->dev,"%s: read DxEPCTL=0x%08x from 0x%08x\n" , __func__, epctrl, epctrl_reg); +if (using_desc_dma (hsotg) && ep_type ==USB_ENDPOINT_XFER_ISOC ) + desc_num =MAX_DMA_DESC_NUM_HS_ISOC ; +else + desc_num =MAX_DMA_DESC_NUM_GENERIC ; +/* Allocate DMA descriptor chain for non-ctrl endpoints */ if (using_desc_dma (hsotg) && !hs_ep->desc_list) { hs_ep->desc_list =dmam_alloc_coherent (hsotg->dev, -MAX_DMA_DESC_NUM_GENERIC * -sizeof (struct dwc2_dma_desc ), + desc_num *sizeof (struct dwc2_dma_desc ), &hs_ep->desc_list_dma,GFP_ATOMIC );if (!hs_ep->desc_list) { ret = -ENOMEM ;
@@ -4051,7 +4054,7 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep, error2:if (ret &&using_desc_dma (hsotg) && hs_ep->desc_list) { -dmam_free_coherent (hsotg->dev,MAX_DMA_DESC_NUM_GENERIC * +dmam_free_coherent (hsotg->dev, desc_num *sizeof (struct dwc2_dma_desc ), hs_ep->desc_list, hs_ep->desc_list_dma); hs_ep->desc_list =NULL ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/346 usb: dwc3: move synchronize_irq() out of the spinlock protected block
In reply to Greg Kroah-Hartman[ Upstream commit 41a91c606e7d2b74358a944525267cc451c271e8 ]
dwc3_gadget_suspend() is called under dwc->lock spinlock. In such context calling synchronize_irq() is not allowed. Move the problematic call out of the protected block to fix the following kernel BUG during system suspend:
BUG: sleeping function called from invalid context at kernel/irq/manage.c:112
in_atomic(): 1, irqs_disabled(): 128, pid: 1601, name: rtcwake
6 locks held by rtcwake/1601:
#0: f70ac2a2 (sb_writers#7){.+.+}, at: vfs_write+0x130/0x16c
#1: b5fe1270 (&of->mutex){+.+.}, at: kernfs_fop_write+0xc0/0x1e4 #2: 7e597705 (kn->count#60){.+.+}, at: kernfs_fop_write+0xc8/0x1e4 #3: 8b3527d0 (system_transition_mutex){+.+.}, at: pm_suspend+0xc4/0xc04 #4: fc7f1c42 (&dev->mutex){....}, at: __device_suspend+0xd8/0x74c #5: 4b36507e (&(&dwc->lock)->rlock){....}, at: dwc3_gadget_suspend+0x24/0x3c
irq event stamp: 11252 hardirqs last enabled at (11251): [<c09c54a4>] _raw_spin_unlock_irqrestore+0x6c/0x74 hardirqs last disabled at (11252): [<c09c4d44>] _raw_spin_lock_irqsave+0x1c/0x5c softirqs last enabled at (9744): [<c0102564>] __do_softirq+0x3a4/0x66c softirqs last disabled at (9737): [<c0128528>] irq_exit+0x140/0x168 Preemption disabled at: [<00000000>] (null) CPU: 7 PID: 1601 Comm: rtcwake Not tainted 5.0.0-rc3-next-20190122-00039-ga3f4ee4f8a52 #5252 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [<c01110f0>] (unwind_backtrace) from [<c010d120>] (show_stack+0x10/0x14) [<c010d120>] (show_stack) from [<c09a4d04>] (dump_stack+0x90/0xc8) [<c09a4d04>] (dump_stack) from [<c014c700>] (___might_sleep+0x22c/0x2c8) [<c014c700>] (___might_sleep) from [<c0189d68>] (synchronize_irq+0x28/0x84) [<c0189d68>] (synchronize_irq) from [<c05cbbf8>] (dwc3_gadget_suspend+0x34/0x3c) [<c05cbbf8>] (dwc3_gadget_suspend) from [<c05bd020>] (dwc3_suspend_common+0x154/0x410) [<c05bd020>] (dwc3_suspend_common) from [<c05bd34c>] (dwc3_suspend+0x14/0x2c) [<c05bd34c>] (dwc3_suspend) from [<c051c730>] (platform_pm_suspend+0x2c/0x54) [<c051c730>] (platform_pm_suspend) from [<c05285d4>] (dpm_run_callback+0xa4/0x3dc) [<c05285d4>] (dpm_run_callback) from [<c0528a40>] (__device_suspend+0x134/0x74c) [<c0528a40>] (__device_suspend) from [<c052c508>] (dpm_suspend+0x174/0x588) [<c052c508>] (dpm_suspend) from [<c0182134>] (suspend_devices_and_enter+0xc0/0xe74) [<c0182134>] (suspend_devices_and_enter) from [<c0183658>] (pm_suspend+0x770/0xc04) [<c0183658>] (pm_suspend) from [<c0180ddc>] (state_store+0x6c/0xcc) [<c0180ddc>] (state_store) from [<c09a9a70>] (kobj_attr_store+0x14/0x20) [<c09a9a70>] (kobj_attr_store) from [<c02d6800>] (sysfs_kf_write+0x4c/0x50) [<c02d6800>] (sysfs_kf_write) from [<c02d594c>] (kernfs_fop_write+0xfc/0x1e4) [<c02d594c>] (kernfs_fop_write) from [<c02593d8>] (__vfs_write+0x2c/0x160) [<c02593d8>] (__vfs_write) from [<c0259694>] (vfs_write+0xa4/0x16c) [<c0259694>] (vfs_write) from [<c0259870>] (ksys_write+0x40/0x8c) [<c0259870>] (ksys_write) from [<c0101000>] (ret_fast_syscall+0x0/0x28) Exception stack(0xed55ffa8 to 0xed55fff0)
...
--- drivers/usb/dwc3/core.c | 2 ++ drivers/usb/dwc3/gadget.c | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/usb/dwc3/core.c +2 -0
@@ -1600,6 +1600,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)spin_lock_irqsave (&dwc->lock, flags);dwc3_gadget_suspend (dwc);spin_unlock_irqrestore (&dwc->lock, flags); +synchronize_irq (dwc->irq_gadget);dwc3_core_exit (dwc);break ;case DWC3_GCTL_PRTCAP_HOST :
@@ -1632,6 +1633,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)spin_lock_irqsave (&dwc->lock, flags);dwc3_gadget_suspend (dwc);spin_unlock_irqrestore (&dwc->lock, flags); +synchronize_irq (dwc->irq_gadget); }dwc3_otg_exit (dwc);
drivers/usb/dwc3/gadget.c +0 -2
@@ -3385,8 +3385,6 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)dwc3_disconnect_gadget (dwc);__dwc3_gadget_stop (dwc); -synchronize_irq (dwc->irq_gadget); -return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/346 usb: gadget: f_fs: dont free buffer prematurely
In reply to Greg Kroah-Hartman[ Upstream commit 73103c7f958b99561555c3bd1bc1a0809e0b7d61 ]
The following kernel panic happens due to the io_data buffer gets deallocated before the async io is completed. Add a check for the case where io_data buffer should be deallocated by ffs_user_copy_worker.
[ 41.663334] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [ 41.672099] #PF error: [normal kernel read fault] [ 41.677356] PGD 20c974067 P4D 20c974067 PUD 20c973067 PMD 0 [ 41.683687] Oops: 0000 [#1] PREEMPT SMP [ 41.687976] CPU: 1 PID: 7 Comm: kworker/u8:0 Tainted: G U 5.0.0-quilt-2e5dc0ac-00790-gd8c79f2-dirty #2 [ 41.705309] Workqueue: adb ffs_user_copy_worker [ 41.705316] RIP: 0010:__vunmap+0x2a/0xc0 [ 41.705318] Code: 0f 1f 44 00 00 48 85 ff 0f 84 87 00 00 00 55 f7 c7 ff 0f 00 00 48 89 e5 41 55 41 89 f5 41 54 53 48 89 fb 75 71 e8 56 d7 ff ff <4c> 8b 60 48 4d 85 e4 74 76 48 89 df e8 25 ff ff ff 45 85 ed 74 46 [ 41.705320] RSP: 0018:ffffbc3a40053df0 EFLAGS: 00010286 [ 41.705322] RAX: 0000000000000000 RBX: ffffbc3a406f1000 RCX: 0000000000000000 [ 41.705323] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff [ 41.705324] RBP: ffffbc3a40053e08 R08: 000000000001fb79 R09: 0000000000000037 [ 41.705325] R10: ffffbc3a40053b68 R11: ffffbc3a40053cad R12: fffffffffffffff2 [ 41.705326] R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffffffffff [ 41.705328] FS: 0000000000000000(0000) GS:ffff9e2977a80000(0000) knlGS:0000000000000000 [ 41.705329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.705330] CR2: 0000000000000048 CR3: 000000020c994000 CR4: 00000000003406e0 [ 41.705331] Call Trace: [ 41.705338] vfree+0x50/0xb0 [ 41.705341] ffs_user_copy_worker+0xe9/0x1c0 [ 41.705344] process_one_work+0x19f/0x3e0 [ 41.705348] worker_thread+0x3f/0x3b0 [ 41.829766] kthread+0x12b/0x150 [ 41.833371] ? process_one_work+0x3e0/0x3e0 [ 41.838045] ? kthread_create_worker_on_cpu+0x70/0x70 [ 41.843695] ret_from_fork+0x3a/0x50 [ 41.847689] Modules linked in: hci_uart bluetooth ecdh_generic rfkill_gpio dwc3_pci dwc3 snd_usb_audio mei_me tpm_crb snd_usbmidi_lib xhci_pci xhci_hcd mei tpm snd_hwdep cfg80211 snd_soc_skl snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core snd_hda_core videobuf2_dma_sg crlmodule [ 41.876880] CR2: 0000000000000048 [ 41.880584] ---[ end trace 2bc4addff0f2e673 ]--- [ 41.891346] RIP: 0010:__vunmap+0x2a/0xc0 [ 41.895734] Code: 0f 1f 44 00 00 48 85 ff 0f 84 87 00 00 00 55 f7 c7 ff 0f 00 00 48 89 e5 41 55 41 89 f5 41 54 53 48 89 fb 75 71 e8 56 d7 ff ff <4c> 8b 60 48 4d 85 e4 74 76 48 89 df e8 25 ff ff ff 45 85 ed 74 46 [ 41.916740] RSP: 0018:ffffbc3a40053df0 EFLAGS: 00010286 [ 41.922583] RAX: 0000000000000000 RBX: ffffbc3a406f1000 RCX: 0000000000000000 [ 41.930563] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff [ 41.938540] RBP: ffffbc3a40053e08 R08: 000000000001fb79 R09: 0000000000000037 [ 41.946520] R10: ffffbc3a40053b68 R11: ffffbc3a40053cad R12: fffffffffffffff2 [ 41.954502] R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffffffffff [ 41.962482] FS: 0000000000000000(0000) GS:ffff9e2977a80000(0000) knlGS:0000000000000000 [ 41.971536] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.977960] CR2: 0000000000000048 CR3: 000000020c994000 CR4: 00000000003406e0 [ 41.985930] Kernel panic - not syncing: Fatal exception [ 41.991817] Kernel Offset: 0x16000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 42.009525] Rebooting in 10 seconds.. [ 52.014376] ACPI MEMORY or I/O RESET_REG.
--- drivers/usb/gadget/function/f_fs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +2 -1
@@ -1133,7 +1133,8 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) error_mutex:mutex_unlock (&epfile->mutex); error: -ffs_free_buffer (io_data); +if (ret != -EIOCBQUEUED )/* don't free if there is iocb queued */ +ffs_free_buffer (io_data);return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/346 ASoC: hdmi-codec: unlock the device on startup errors
In reply to Greg Kroah-Hartman[ Upstream commit 30180e8436046344b12813dc954b2e01dfdcd22d ]
If the hdmi codec startup fails, it should clear the current_substream pointer to free the device. This is properly done for the audio_startup() callback but for snd_pcm_hw_constraint_eld().
Make sure the pointer cleared if an error is reported.
--- sound/soc/codecs/hdmi-codec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/soc/codecs/hdmi-codec.c +5 -1
@@ -439,8 +439,12 @@ static int hdmi_codec_startup(struct snd_pcm_substream *substream,if (!ret) { ret =snd_pcm_hw_constraint_eld (substream->runtime, hcp->eld); -if (ret) +if (ret) { +mutex_lock (&hcp->current_stream_lock); + hcp->current_stream =NULL ; +mutex_unlock (&hcp->current_stream_lock);return ret; + } }/* Select chmap supported */ hdmi_codec_eld_chmap (hcp);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/346 powerpc/perf: Return accordingly on invalid chip-id in
In reply to Greg Kroah-Hartman[ Upstream commit a913e5e8b43be1d3897a141ce61c1ec071cad89c ]
Nest hardware counter memory resides in a per-chip reserve-memory. During nest_imc_event_init(), chip-id of the event-cpu is considered to calculate the base memory addresss for that cpu. Return, proper error condition if the chip_id calculated is invalid.
--- arch/powerpc/perf/imc-pmu.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/perf/imc-pmu.c +5 -0
@@ -496,6 +496,11 @@ static int nest_imc_event_init(struct perf_event *event)* Get the base memory addresss for this cpu. */ chip_id =cpu_to_chip_id (event->cpu); + +/* Return, if chip_id is not valid */ +if (chip_id <0 ) +return -ENODEV ; + pcni = pmu->mem_info; do { if (pcni->id == chip_id) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/346 powerpc/boot: Fix missing check of lseek() return value
In reply to Greg Kroah-Hartman[ Upstream commit 5d085ec04a000fefb5182d3b03ee46ca96d8389b ]
This is detected by Coverity scan: CID: 1440481
--- arch/powerpc/boot/addnote.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/powerpc/boot/addnote.c +5 -1
@@ -223,7 +223,11 @@ main(int ac, char **av)PUT_16 (E_PHNUM , np +2 );/* write back */ -lseek (fd, (long )0 ,SEEK_SET ); + i =lseek (fd, (long )0 ,SEEK_SET ); +if (i <0 ) { +perror ("lseek" ); +exit (1 ); + } i =write (fd, buf, n);if (i <0 ) {perror ("write" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/346 powerpc/perf: Fix loop exit condition in nest_imc_event_init
In reply to Greg Kroah-Hartman[ Upstream commit 860b7d2286236170a36f94946d03ca9888d32571 ]
The data structure (i.e struct imc_mem_info) to hold the memory address information for nest imc units is allocated based on the number of nodes in the system.
nest_imc_event_init() traverse this struct array to calculate the memory base address for the event-cpu. If we fail to find a match for the event cpu's chip-id in imc_mem_info struct array, then the do-while loop will iterate until we crash.
Fix this by changing the loop exit condition based on the number of non zero vbase elements in the array, since the allocation is done for nr_chips + 1.
--- arch/powerpc/perf/imc-pmu.c | 2 +- arch/powerpc/platforms/powernv/opal-imc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/perf/imc-pmu.c +1 -1
@@ -508,7 +508,7 @@ static int nest_imc_event_init(struct perf_event *event)break ; } pcni++; - }while (pcni); + }while (pcni->vbase !=0 );if (!flag)return -ENODEV ;
arch/powerpc/platforms/powernv/opal-imc.c +1 -1
@@ -127,7 +127,7 @@ static int imc_get_mem_addr_nest(struct device_node *node, nr_chips)) goto error; - pmu_ptr->mem_info =kcalloc (nr_chips,sizeof (*pmu_ptr->mem_info), + pmu_ptr->mem_info =kcalloc (nr_chips +1 ,sizeof (*pmu_ptr->mem_info),GFP_KERNEL );if (!pmu_ptr->mem_info) goto error;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/346 spi: atmel-quadspi: fix crash while suspending
In reply to Greg Kroah-Hartman[ Upstream commit e5c27498a0403b270620b1a8a0a66e3efc222fb6 ]
atmel_qspi objects are kept in spi_controller objects, so, first get pointer to spi_controller object and then get atmel_qspi object from spi_controller object.
--- drivers/spi/atmel-quadspi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/spi/atmel-quadspi.c +4 -2
@@ -506,7 +506,8 @@ static int atmel_qspi_remove(struct platform_device *pdev)static int __maybe_unused atmel_qspi_suspend (struct device *dev) { -struct atmel_qspi *aq =dev_get_drvdata (dev); +struct spi_controller *ctrl =dev_get_drvdata (dev); +struct atmel_qspi *aq =spi_controller_get_devdata (ctrl);clk_disable_unprepare (aq->clk);
@@ -515,7 +516,8 @@ static int __maybe_unused atmel_qspi_suspend(struct device *dev)static int __maybe_unused atmel_qspi_resume (struct device *dev) { -struct atmel_qspi *aq =dev_get_drvdata (dev); +struct spi_controller *ctrl =dev_get_drvdata (dev); +struct atmel_qspi *aq =spi_controller_get_devdata (ctrl);clk_prepare_enable (aq->clk);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 71/346 ASoC: imx: fix fiq dependencies
In reply to Greg Kroah-Hartman[ Upstream commit ea751227c813ab833609afecfeedaf0aa26f327e ]
During randconfig builds, I occasionally run into an invalid configuration of the freescale FIQ sound support:
WARNING: unmet direct dependencies detected for SND_SOC_IMX_PCM_FIQ
Depends on [m]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_IMX_SOC [=m]
Selected by [y]:
- SND_SOC_FSL_SPDIF [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_IMX_SOC [=m]!=n && (MXC_TZIC [=n] || MXC_AVIC [=y])
sound/soc/fsl/imx-ssi.o: In function `imx_ssi_remove':
imx-ssi.c:(.text+0x28): undefined reference to imx_pcm_fiq_exit' sound/soc/fsl/imx-ssi.o: In function imx_ssi_probe':
imx-ssi.c:(.text+0xa64): undefined reference to `imx_pcm_fiq_init'
The Kconfig warning is a result of the symbol being defined inside of the "if SND_IMX_SOC" block, and is otherwise harmless. The link error is more tricky and happens with SND_SOC_IMX_SSI=y, which may or may not imply FIQ support. However, if SND_SOC_FSL_SSI is set to =m at the same time, that selects SND_SOC_IMX_PCM_FIQ as a loadable module dependency, which then causes a link failure from imx-ssi.
The solution here is to make SND_SOC_IMX_PCM_FIQ built-in whenever one of its potential users is built-in.
--- sound/soc/fsl/Kconfig | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
sound/soc/fsl/Kconfig +5 -4
@@ -173,16 +173,17 @@ config SND_MPC52xx_SOC_EFIKA endif # SND_POWERPC_SOC +config SND_SOC_IMX_PCM_FIQ + tristate + default y if SND_SOC_IMX_SSI=y && (SND_SOC_FSL_SSI=m || SND_SOC_FSL_SPDIF=m) && (MXC_TZIC || MXC_AVIC) + select FIQ + if SND_IMX_SOC config SND_SOC_IMX_SSI tristate select SND_SOC_FSL_UTILS -config SND_SOC_IMX_PCM_FIQ - tristate - select FIQ - comment "SoC Audio support for Freescale i.MX boards:" config SND_MXC_SOC_WM1133_EV1
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 72/346 spi: pxa2xx: fix SCR (divisor) calculation
In reply to Greg Kroah-Hartman[ Upstream commit 29f2133717c527f492933b0622a4aafe0b3cbe9e ]
Calculate the divisor for the SCR (Serial Clock Rate), avoiding that the SSP transmission rate can be greater than the device rate.
When the division between the SSP clock and the device rate generates a reminder, we have to increment by one the divisor.
In this way the resulting SSP clock will never be greater than the device SPI max frequency.
For example, with:
- ssp_clk = 50 MHz
- dev freq = 15 MHz
without this patch the SSP clock will be greater than 15 MHz:
- 25 MHz for PXA25x_SSP and CE4100_SSP
- 16,56 MHz for the others
Instead, with this patch, we have in both case an SSP clock of 12.5MHz, so the max rate of the SPI device clock is respected.
--- drivers/spi/spi-pxa2xx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/spi/spi-pxa2xx.c +6 -2
@@ -884,10 +884,14 @@ static unsigned int ssp_get_clk_div(struct driver_data *drv_data, int rate) rate =min_t (int, ssp_clk, rate); +/* +* Calculate the divisor for the SCR (Serial Clock Rate), avoiding +* that the SSP transmission rate can be greater than the device rate +*/ if (ssp->type == PXA25x_SSP || ssp->type ==CE4100_SSP ) -return (ssp_clk / (2 * rate) -1 ) &0xff ; +return (DIV_ROUND_UP (ssp_clk,2 * rate) -1 ) &0xff ;else -return (ssp_clk / rate -1 ) &0xfff ; +return (DIV_ROUND_UP (ssp_clk, rate) -1 ) &0xfff ; } static unsigned int pxa2xx_ssp_get_clk_div(struct driver_data *drv_data,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 73/346 brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()
In reply to Greg Kroah-Hartman[ Upstream commit e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d ]
If "ret_len" is negative then it could lead to a NULL dereference.
The "ret_len" value comes from nl80211_vendor_cmd(), if it's negative then we don't allocate the "dcmd_buf" buffer. Then we pass "ret_len" to brcmf_fil_cmd_data_set() where it is cast to a very high u32 value. Most of the functions in that call tree check whether the buffer we pass is NULL but there are at least a couple places which don't such as brcmf_dbg_hex_dump() and brcmf_msgbuf_query_dcmd(). We memcpy() to and from the buffer so it would result in a NULL dereference.
The fix is to change the types so that "ret_len" can't be negative. (If we memcpy() zero bytes to NULL, that's a no-op and doesn't cause an issue).
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c +3 -2
@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,struct brcmf_if *ifp;const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;struct sk_buff *reply; -int ret, payload, ret_len; +unsigned int payload, ret_len;void *dcmd_buf =NULL , *wr_pointer;u16 msglen, maxmsglen =PAGE_SIZE -0x100 ; +int ret;if (len <sizeof (*cmdhdr)) {brcmf_err ("vendor command too short: %d\n" , len);
@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,brcmf_err ("oversize return buffer %d\n" , ret_len); ret_len =BRCMF_DCMD_MAXLEN ; } - payload =max (ret_len, len) +1 ; + payload = max_t(unsigned int, ret_len, len) + 1; dcmd_buf =vzalloc (payload);if (NULL == dcmd_buf)return -ENOMEM ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 74/346 ACPI / property: fix handling of data_nodes in acpi_get_next_subnode()
In reply to Greg Kroah-Hartman[ Upstream commit 23583f7795025e3c783b680d906509366b0906ad ]
When the DSDT tables expose devices with subdevices and a set of hierarchical _DSD properties, the data returned by acpi_get_next_subnode() is incorrect, with the results suggesting a bad pointer assignment. The parser works fine with device_nodes or data_nodes, but not with a combination of the two.
The problem is traced to an invalid pointer used when jumping from handling device_nodes to data nodes. The existing code looks for data nodes below the last subdevice found instead of the common root. Fix by forcing the acpi_device pointer to be derived from the same fwnode for the two types of subnodes.
This same problem of handling device and data nodes was already fixed in a similar way by 'commit bf4703fdd166 ("ACPI / property: fix data node parsing in acpi_get_next_subnode()")' but broken later by 'commit 34055190b19 ("ACPI / property: Add fwnode_get_next_child_node()")', so this should probably go to linux-stable all the way to 4.12
--- drivers/acpi/property.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/property.c +8 -0
@@ -1031,6 +1031,14 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,const struct acpi_data_node *data =to_acpi_data_node (fwnode);struct acpi_data_node *dn; +/* +* We can have a combination of device and data nodes, e.g. with +* hierarchical _DSD properties. Make sure the adev pointer is +* restored before going through data nodes, otherwise we will +* be looking for data_nodes below the last device found instead +* of the common fwnode shared by device_nodes and data_nodes. +*/ + adev =to_acpi_device_node (fwnode);if (adev) head = &adev->data.subnodes;else if (data)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 75/346 drm/nouveau/bar/nv50: ensure BAR is mapped
In reply to Greg Kroah-Hartman[ Upstream commit f10b83de1fd49216a4c657816f48001437e4bdd5 ]
If the BAR is zero size, it indicates it was never successfully mapped. Ensure that the BAR is valid during initialization before attempting to use it.
--- drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c +9 -3
@@ -109,7 +109,7 @@ nv50_bar_oneinit(struct nvkm_bar *base)struct nvkm_device *device = bar->base.subdev.device;static struct lock_class_key bar1_lock;static struct lock_class_key bar2_lock; -u64 start, limit; +u64 start, limit, size;int ret; ret =nvkm_gpuobj_new (device,0x20000 ,0 , false,NULL , &bar->mem);
@@ -127,7 +127,10 @@ nv50_bar_oneinit(struct nvkm_bar *base)/* BAR2 */ start =0x0100000000ULL ; - limit = start + device->func->resource_size (device,3 ); + size = device->func->resource_size (device,3 ); +if (!size) +return -ENOMEM ; + limit = start + size; ret =nvkm_vmm_new (device, start, limit-- - start,NULL ,0 , &bar2_lock,"bar2" , &bar->bar2_vmm);
@@ -164,7 +167,10 @@ nv50_bar_oneinit(struct nvkm_bar *base)/* BAR1 */ start =0x0000000000ULL ; - limit = start + device->func->resource_size (device,1 ); + size = device->func->resource_size (device,1 ); +if (!size) +return -ENOMEM ; + limit = start + size; ret =nvkm_vmm_new (device, start, limit-- - start,NULL ,0 , &bar1_lock,"bar1" , &bar->bar1_vmm);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 76/346 media: stm32-dcmi: return appropriate error codes during probe
In reply to Greg Kroah-Hartman[ Upstream commit b5b5a27bee5884860798ffd0f08e611a3942064b ]
During probe, return the provided errors value instead of -ENODEV. This allows the driver to be deferred probed if needed.
--- drivers/media/platform/stm32/stm32-dcmi.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/media/platform/stm32/stm32-dcmi.c +8 -6
@@ -1645,7 +1645,7 @@ static int dcmi_probe(struct platform_device *pdev) dcmi->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );if (IS_ERR (dcmi->rstc)) {dev_err (&pdev->dev,"Could not get reset control\n" ); -return -ENODEV ; +return PTR_ERR (dcmi->rstc); }/* Get bus characteristics from devicetree */
@@ -1660,7 +1660,7 @@ static int dcmi_probe(struct platform_device *pdev)of_node_put (np);if (ret) {dev_err (&pdev->dev,"Could not parse the endpoint\n" ); -return -ENODEV ; +return ret; }if (ep.bus_type ==V4L2_MBUS_CSI2_DPHY ) {
@@ -1673,8 +1673,9 @@ static int dcmi_probe(struct platform_device *pdev) irq =platform_get_irq (pdev,0 );if (irq <=0 ) { -dev_err (&pdev->dev,"Could not get irq\n" ); -return -ENODEV ; +if (irq != -EPROBE_DEFER ) +dev_err (&pdev->dev,"Could not get irq\n" ); +return irq; } dcmi->res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );
@@ -1694,12 +1695,13 @@ static int dcmi_probe(struct platform_device *pdev) dev_name(&pdev->dev), dcmi);if (ret) {dev_err (&pdev->dev,"Unable to request irq %d\n" , irq); -return -ENODEV ; +return ret; } mclk =devm_clk_get (&pdev->dev,"mclk" );if (IS_ERR (mclk)) { -dev_err (&pdev->dev,"Unable to get mclk\n" ); +if (PTR_ERR (mclk) != -EPROBE_DEFER ) +dev_err (&pdev->dev,"Unable to get mclk\n" );return PTR_ERR (mclk); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 77/346 ARM: vdso: Remove dependency with the arch_timer driver internals
In reply to Greg Kroah-Hartman[ Upstream commit 1f5b62f09f6b314c8d70b9de5182dae4de1f94da ]
The VDSO code uses the kernel helper that was originally designed to abstract the access between 32 and 64bit systems. It worked so far because this function is declared as 'inline'.
As we're about to revamp that part of the code, the VDSO would break. Let's fix it by doing what should have been done from the start, a proper system register access.
--- arch/arm/include/asm/cp15.h | 2 ++ arch/arm/vdso/vgettimeofday.c | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-)
arch/arm/include/asm/cp15.h +2 -0
@@ -68,6 +68,8 @@#define BPIALL __ACCESS_CP15(c7, 0, c5, 6)#define ICIALLU __ACCESS_CP15(c7, 0, c5, 0) +#define CNTVCT __ACCESS_CP15_64(1, c14) +extern unsigned long cr_alignment;/* defined in entry-armv.S */ static inline unsigned long get_cr (void )
arch/arm/vdso/vgettimeofday.c +3 -2
@@ -18,9 +18,9 @@#include <linux/compiler.h> #include <linux/hrtimer.h> #include <linux/time.h> -#include <asm/arch_timer.h> #include <asm/barrier.h> #include <asm/bug.h> +#include <asm/cp15.h> #include <asm/page.h> #include <asm/unistd.h> #include <asm/vdso_datapage.h>
@@ -123,7 +123,8 @@ static notrace u64 get_ns(struct vdso_data *vdata)u64 cycle_now;u64 nsec; - cycle_now =arch_counter_get_cntvct (); +isb (); + cycle_now =read_sysreg (CNTVCT ); cycle_delta = (cycle_now - vdata->cs_cycle_last) & vdata->cs_mask;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 78/346 arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable
In reply to Greg Kroah-Hartman[ Upstream commit 74dd022f9e6260c3b5b8d15901d27ebcc5f21eda ]
When building with -Wunused-but-set-variable, the compiler shouts about a number of pte_unmap() users, since this expands to an empty macro on arm64:
| mm/gup.c: In function 'gup_pte_range': | mm/gup.c:1727:16: warning: variable 'ptem' set but not used | [-Wunused-but-set-variable] | mm/gup.c: At top level: | mm/memory.c: In function 'copy_pte_range': | mm/memory.c:821:24: warning: variable 'orig_dst_pte' set but not used | [-Wunused-but-set-variable] | mm/memory.c:821:9: warning: variable 'orig_src_pte' set but not used | [-Wunused-but-set-variable] | mm/swap_state.c: In function 'swap_ra_info': | mm/swap_state.c:641:15: warning: variable 'orig_pte' set but not used | [-Wunused-but-set-variable] | mm/madvise.c: In function 'madvise_free_pte_range': | mm/madvise.c:318:9: warning: variable 'orig_pte' set but not used | [-Wunused-but-set-variable]
Rewrite pte_unmap() as a static inline function, which silences the warnings.
--- arch/arm64/include/asm/pgtable.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/include/asm/pgtable.h +2 -1
@@ -478,6 +478,8 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)return __pmd_to_phys (pmd); } +static inline void pte_unmap (pte_t *pte) { } +/* Find an entry in the third-level page table. */ #define pte_index (addr) (((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
@@ -486,7 +488,6 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)#define pte_offset_map (dir,addr) pte_offset_kernel((dir), (addr))#define pte_offset_map_nested (dir,addr) pte_offset_kernel((dir), (addr)) -#define pte_unmap (pte) do { } while (0)#define pte_unmap_nested (pte) do { } while (0)#define pte_set_fixmap (addr) ((pte_t *)set_fixmap_offset(FIX_PTE, addr))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 79/346 x86/ftrace: Set trampoline pages as executable
In reply to Greg Kroah-Hartman[ Upstream commit 3c0dab44e22782359a0a706cbce72de99a22aa75 ]
Since alloc_module() will not set the pages as executable soon, set ftrace trampoline pages as executable after they are allocated.
For the time being, do not change ftrace to use the text_poke() interface. As a result, ftrace still breaks W^X.
--- arch/x86/kernel/ftrace.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kernel/ftrace.c +8 -0
@@ -748,6 +748,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)unsigned long end_offset;unsigned long op_offset;unsigned long offset; +unsigned long npages;unsigned long size;unsigned long retq;unsigned long *ptr;
@@ -780,6 +781,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)return 0 ; *tramp_size = size +RET_SIZE +sizeof (void *); + npages =DIV_ROUND_UP (*tramp_size,PAGE_SIZE );/* Copy ftrace_caller onto the trampoline memory */ ret =probe_kernel_read (trampoline, (void *)start_offset, size);
@@ -824,6 +826,12 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)/* ALLOC_TRAMP flags lets us know we created it */ ops->flags |=FTRACE_OPS_FL_ALLOC_TRAMP ; +/* +* Module allocation needs to be completed by making the page +* executable. The page is still writable, which is a security hazard, +* but anyhow ftrace breaks W^X completely. +*/ +set_memory_x ((unsigned long )trampoline, npages);return (unsigned long )trampoline; fail:tramp_free (trampoline, *tramp_size);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 80/346 powerpc/watchdog: Use hrtimers for per-CPU heartbeat
In reply to Greg Kroah-Hartman[ Upstream commit 7ae3f6e130e8dc6188b59e3b4ebc2f16e9c8d053 ]
Using a jiffies timer creates a dependency on the tick_do_timer_cpu incrementing jiffies. If that CPU has locked up and jiffies is not incrementing, the watchdog heartbeat timer for all CPUs stops and creates false positives and confusing warnings on local CPUs, and also causes the SMP detector to stop, so the root cause is never detected.
Fix this by using hrtimer based timers for the watchdog heartbeat, like the generic kernel hardlockup detector.
--- arch/powerpc/kernel/watchdog.c | 81 +++++++++++++++++----------------- 1 file changed, 40 insertions(+), 41 deletions(-)
arch/powerpc/kernel/watchdog.c +40 -41
@@ -77,7 +77,7 @@ static u64 wd_smp_panic_timeout_tb __read_mostly; /* panic other CPUs */static u64 wd_timer_period_ms__read_mostly ;/* interval between heartbeat */ -static DEFINE_PER_CPU(struct timer_list, wd_timer); +static DEFINE_PER_CPU(struct hrtimer, wd_hrtimer); static DEFINE_PER_CPU(u64, wd_timer_tb);/* SMP checker bits */
@@ -293,21 +293,21 @@ void soft_nmi_interrupt(struct pt_regs *regs)nmi_exit (); } -static void wd_timer_reset (unsigned int cpu,struct timer_list *t) -{ - t->expires = jiffies +msecs_to_jiffies (wd_timer_period_ms); -if (wd_timer_period_ms >1000 ) - t->expires =__round_jiffies_up (t->expires, cpu); -add_timer_on (t, cpu); -} - -static void wd_timer_fn (struct timer_list *t) +static enum hrtimer_restart watchdog_timer_fn (struct hrtimer *hrtimer) {int cpu =smp_processor_id (); +if (!(watchdog_enabled &NMI_WATCHDOG_ENABLED )) +return HRTIMER_NORESTART ; + +if (!cpumask_test_cpu (cpu, &watchdog_cpumask)) +return HRTIMER_NORESTART ; +watchdog_timer_interrupt (cpu); -wd_timer_reset (cpu, t); +hrtimer_forward_now (hrtimer,ms_to_ktime (wd_timer_period_ms)); + +return HRTIMER_RESTART ; }void arch_touch_nmi_watchdog (void )
@@ -323,37 +323,22 @@ void arch_touch_nmi_watchdog(void) }EXPORT_SYMBOL (arch_touch_nmi_watchdog); -static void start_watchdog_timer_on (unsigned int cpu) -{ -struct timer_list *t =per_cpu_ptr (&wd_timer, cpu); - -per_cpu (wd_timer_tb, cpu) =get_tb (); - -timer_setup (t, wd_timer_fn,TIMER_PINNED ); -wd_timer_reset (cpu, t); -} - -static void stop_watchdog_timer_on (unsigned int cpu) -{ -struct timer_list *t =per_cpu_ptr (&wd_timer, cpu); - -del_timer_sync (t); -} - -static int start_wd_on_cpu (unsigned int cpu) +static void start_watchdog (void *arg) { +struct hrtimer *hrtimer =this_cpu_ptr (&wd_hrtimer); +int cpu =smp_processor_id ();unsigned long flags;if (cpumask_test_cpu (cpu, &wd_cpus_enabled)) {WARN_ON (1 ); -return 0 ; +return ; }if (!(watchdog_enabled &NMI_WATCHDOG_ENABLED )) -return 0 ; +return ;if (!cpumask_test_cpu (cpu, &watchdog_cpumask)) -return 0 ; +return ;wd_smp_lock (&flags);cpumask_set_cpu (cpu, &wd_cpus_enabled);
@@ -363,27 +348,40 @@ static int start_wd_on_cpu(unsigned int cpu) }wd_smp_unlock (&flags); -start_watchdog_timer_on (cpu); + *this_cpu_ptr (&wd_timer_tb) =get_tb (); -return 0 ; +hrtimer_init (hrtimer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); + hrtimer->function = watchdog_timer_fn; +hrtimer_start (hrtimer,ms_to_ktime (wd_timer_period_ms), +HRTIMER_MODE_REL_PINNED ); } -static int stop_wd_on_cpu (unsigned int cpu) +static int start_watchdog_on_cpu (unsigned int cpu) { +return smp_call_function_single (cpu, start_watchdog,NULL , true); +} + +static void stop_watchdog (void *arg) +{ +struct hrtimer *hrtimer =this_cpu_ptr (&wd_hrtimer); +int cpu =smp_processor_id ();unsigned long flags;if (!cpumask_test_cpu (cpu, &wd_cpus_enabled)) -return 0 ;/* Can happen in CPU unplug case */ +return ;/* Can happen in CPU unplug case */ -stop_watchdog_timer_on (cpu); +hrtimer_cancel (hrtimer);wd_smp_lock (&flags);cpumask_clear_cpu (cpu, &wd_cpus_enabled);wd_smp_unlock (&flags);wd_smp_clear_cpu_pending (cpu,get_tb ()); +} -return 0 ; +static int stop_watchdog_on_cpu (unsigned int cpu) +{ +return smp_call_function_single (cpu, stop_watchdog,NULL , true); }static void watchdog_calc_timeouts (void )
@@ -402,7 +400,7 @@ void watchdog_nmi_stop(void)int cpu;for_each_cpu (cpu, &wd_cpus_enabled) -stop_wd_on_cpu (cpu); +stop_watchdog_on_cpu (cpu); }void watchdog_nmi_start (void )
@@ -411,7 +409,7 @@ void watchdog_nmi_start(void)watchdog_calc_timeouts ();for_each_cpu_and (cpu, cpu_online_mask, &watchdog_cpumask) -start_wd_on_cpu (cpu); +start_watchdog_on_cpu (cpu); }/*
@@ -423,7 +421,8 @@ int __init watchdog_nmi_probe(void) err =cpuhp_setup_state_nocalls (CPUHP_AP_ONLINE_DYN ,"powerpc/watchdog:online" , - start_wd_on_cpu, stop_wd_on_cpu); + start_watchdog_on_cpu, + stop_watchdog_on_cpu);if (err <0 ) {pr_warn ("could not be initialized" );return err;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 81/346 sched/cpufreq: Fix kobject memleak
In reply to Greg Kroah-Hartman[ Upstream commit 9a4f26cc98d81b67ecc23b890c28e2df324e29f3 ]
Currently the error return path from kobject_init_and_add() is not followed by a call to kobject_put() - which means we are leaking the kobject.
Fix it by adding a call to kobject_put() in the error path of kobject_init_and_add().
--- drivers/cpufreq/cpufreq.c | 1 + drivers/cpufreq/cpufreq_governor.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/cpufreq/cpufreq.c +1 -0
@@ -1103,6 +1103,7 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) cpufreq_global_kobject, "policy%u", cpu);if (ret) {pr_err ("%s: failed to init policy->kobj: %d\n" , __func__, ret); +kobject_put (&policy->kobj); goto err_free_real_cpus; }
drivers/cpufreq/cpufreq_governor.c +2 -0
@@ -459,6 +459,8 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy)/* Failure, so roll back. */ pr_err ("initialization failed (dbs_data kobject init error %d)\n" , ret); +kobject_put (&dbs_data->attr_set.kobj); + policy->governor_data =NULL ;if (!have_governor_per_policy ())
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 82/346 scsi: qla2xxx: Fix a qla24xx_enable_msix() error path
In reply to Greg Kroah-Hartman[ Upstream commit 24afabdbd0b3553963a2bbf465895492b14d1107 ]
Make sure that the allocated interrupts are freed if allocating memory for the msix_entries array fails.
--- drivers/scsi/qla2xxx/qla_isr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_isr.c +5 -1
@@ -3454,7 +3454,7 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)ql_log (ql_log_fatal, vha,0x00c8 ,"Failed to allocate memory for ha->msix_entries.\n" ); ret = -ENOMEM ; - goto msix_out; + goto free_irqs; } ha->flags.msix_enabled =1 ;
@@ -3537,6 +3537,10 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp) msix_out:return ret; + +free_irqs: +pci_free_irq_vectors (ha->pdev); + goto msix_out; }int
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 83/346 scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending()
In reply to Greg Kroah-Hartman[ Upstream commit e209783d66bca04b5fce4429e59338517ffc1a0b ]
Implementations of the .write_pending() callback functions must guarantee that an appropriate LIO core callback function will be called immediately or at a later time. Make sure that this guarantee is met for aborted SCSI commands.
[mkp: typo]
--- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/qla2xxx/tcm_qla2xxx.c +2 -0
@@ -399,6 +399,8 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd) cmd->se_cmd.transport_state, cmd->se_cmd.t_state, cmd->se_cmd.se_cmd_flags); +transport_generic_request_failure (&cmd->se_cmd, +TCM_CHECK_CONDITION_ABORT_CMD );return 0 ; } cmd->trc_flags |=TRC_XFR_RDY ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 84/346 scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session()
In reply to Greg Kroah-Hartman[ Upstream commit d4023db71108375e4194e92730ba0d32d7f07813 ]
This patch avoids that lockdep reports the following warning:
=====================================================
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
5.1.0-rc1-dbg+ #11 Tainted: G W
-----------------------------------------------------
rmdir/1478 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:00000000e7ac4607 (&(&k->k_lock)->rlock){+.+.}, at: klist_next+0x43/0x1d0
and this task is already holding:00000000cf0baf5e (&(&ha->tgt.sess_lock)->rlock){-...}, at: tcm_qla2xxx_close_session+0x57/0xb0 [tcm_qla2xxx] which would create a new lock dependency:
(&(&ha->tgt.sess_lock)->rlock){-...} -> (&(&k->k_lock)->rlock){+.+.}
but this new dependency connects a HARDIRQ-irq-safe lock:
(&(&ha->tgt.sess_lock)->rlock){-...}
... which became HARDIRQ-irq-safe at:
lock_acquire+0xe3/0x200 _raw_spin_lock_irqsave+0x3d/0x60 qla2x00_fcport_event_handler+0x1f3d/0x22b0 [qla2xxx] qla2x00_async_login_sp_done+0x1dc/0x1f0 [qla2xxx] qla24xx_process_response_queue+0xa37/0x10e0 [qla2xxx] qla24xx_msix_rsp_q+0x79/0xf0 [qla2xxx] __handle_irq_event_percpu+0x79/0x3c0 handle_irq_event_percpu+0x70/0xf0 handle_irq_event+0x5a/0x8b handle_edge_irq+0x12c/0x310 handle_irq+0x192/0x20a do_IRQ+0x73/0x160 ret_from_intr+0x0/0x1d default_idle+0x23/0x1f0 arch_cpu_idle+0x15/0x20 default_idle_call+0x35/0x40 do_idle+0x2bb/0x2e0 cpu_startup_entry+0x1d/0x20 start_secondary+0x24d/0x2d0 secondary_startup_64+0xa4/0xb0
to a HARDIRQ-irq-unsafe lock:
(&(&k->k_lock)->rlock){+.+.}
... which became HARDIRQ-irq-unsafe at:
...
lock_acquire+0xe3/0x200 _raw_spin_lock+0x32/0x50 klist_add_tail+0x33/0xb0 device_add+0x7f4/0xb60 device_create_groups_vargs+0x11c/0x150 device_create_with_groups+0x89/0xb0 vtconsole_class_init+0xb2/0x124 do_one_initcall+0xc5/0x3ce kernel_init_freeable+0x295/0x32e kernel_init+0x11/0x11b ret_from_fork+0x3a/0x50
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&(&k->k_lock)->rlock);
local_irq_disable();
lock(&(&ha->tgt.sess_lock)->rlock);
lock(&(&k->k_lock)->rlock);
<Interrupt>
lock(&(&ha->tgt.sess_lock)->rlock);*** DEADLOCK ***
4 locks held by rmdir/1478:
#0: 000000002c7f1ba4 (sb_writers#10){.+.+}, at: mnt_want_write+0x32/0x70
#1: 00000000c85eb147 (&default_group_class[depth - 1]#2/1){+.+.}, at: do_rmdir+0x217/0x2d0
#2: 000000002b164d6f (&sb->s_type->i_mutex_key#13){++++}, at: vfs_rmdir+0x7e/0x1d0
#3: 00000000cf0baf5e (&(&ha->tgt.sess_lock)->rlock){-...}, at: tcm_qla2xxx_close_session+0x57/0xb0 [tcm_qla2xxx]
the dependencies between HARDIRQ-irq-safe lock and the holding lock:
-> (&(&ha->tgt.sess_lock)->rlock){-...} ops: 127 {
IN-HARDIRQ-W at:
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
qla2x00_fcport_event_handler+0x1f3d/0x22b0 [qla2xxx]
qla2x00_async_login_sp_done+0x1dc/0x1f0 [qla2xxx]
qla24xx_process_response_queue+0xa37/0x10e0 [qla2xxx]
qla24xx_msix_rsp_q+0x79/0xf0 [qla2xxx]
__handle_irq_event_percpu+0x79/0x3c0
handle_irq_event_percpu+0x70/0xf0
handle_irq_event+0x5a/0x8b
handle_edge_irq+0x12c/0x310
handle_irq+0x192/0x20a
do_IRQ+0x73/0x160
ret_from_intr+0x0/0x1d
default_idle+0x23/0x1f0
arch_cpu_idle+0x15/0x20
default_idle_call+0x35/0x40
do_idle+0x2bb/0x2e0
cpu_startup_entry+0x1d/0x20
start_secondary+0x24d/0x2d0
secondary_startup_64+0xa4/0xb0
INITIAL USE at:
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
qla2x00_loop_resync+0xb3d/0x2690 [qla2xxx]
qla2x00_do_dpc+0xcee/0xf30 [qla2xxx]
kthread+0x1d2/0x1f0
ret_from_fork+0x3a/0x50
}
... key at: [<ffffffffa125f700>] __key.62804+0x0/0xfffffffffff7e900 [qla2xxx]
... acquired at:
__lock_acquire+0x11ed/0x1b60
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
klist_next+0x43/0x1d0
device_for_each_child+0x96/0x110
scsi_target_block+0x3c/0x40 [scsi_mod]
fc_remote_port_delete+0xe7/0x1c0 [scsi_transport_fc]
qla2x00_mark_device_lost+0x4d3/0x500 [qla2xxx]
qlt_unreg_sess+0x104/0x2c0 [qla2xxx]
tcm_qla2xxx_close_session+0xa2/0xb0 [tcm_qla2xxx]
target_shutdown_sessions+0x17b/0x190 [target_core_mod]
core_tpg_del_initiator_node_acl+0xf3/0x1f0 [target_core_mod]
target_fabric_nacl_base_release+0x25/0x30 [target_core_mod]
config_item_release+0x9f/0x120 [configfs]
config_item_put+0x29/0x2b [configfs]
configfs_rmdir+0x3d2/0x520 [configfs]
vfs_rmdir+0xb3/0x1d0
do_rmdir+0x25c/0x2d0
__x64_sys_rmdir+0x24/0x30
do_syscall_64+0x77/0x220
entry_SYSCALL_64_after_hwframe+0x49/0xbethe dependencies between the lock to be acquired
and HARDIRQ-irq-unsafe lock:
-> (&(&k->k_lock)->rlock){+.+.} ops: 14568 {
HARDIRQ-ON-W at:
lock_acquire+0xe3/0x200
_raw_spin_lock+0x32/0x50
klist_add_tail+0x33/0xb0
device_add+0x7f4/0xb60
device_create_groups_vargs+0x11c/0x150
device_create_with_groups+0x89/0xb0
vtconsole_class_init+0xb2/0x124
do_one_initcall+0xc5/0x3ce
kernel_init_freeable+0x295/0x32e
kernel_init+0x11/0x11b
ret_from_fork+0x3a/0x50
SOFTIRQ-ON-W at:
lock_acquire+0xe3/0x200
_raw_spin_lock+0x32/0x50
klist_add_tail+0x33/0xb0
device_add+0x7f4/0xb60
device_create_groups_vargs+0x11c/0x150
device_create_with_groups+0x89/0xb0
vtconsole_class_init+0xb2/0x124
do_one_initcall+0xc5/0x3ce
kernel_init_freeable+0x295/0x32e
kernel_init+0x11/0x11b
ret_from_fork+0x3a/0x50
INITIAL USE at:
lock_acquire+0xe3/0x200
_raw_spin_lock+0x32/0x50
klist_add_tail+0x33/0xb0
device_add+0x7f4/0xb60
device_create_groups_vargs+0x11c/0x150
device_create_with_groups+0x89/0xb0
vtconsole_class_init+0xb2/0x124
do_one_initcall+0xc5/0x3ce
kernel_init_freeable+0x295/0x32e
kernel_init+0x11/0x11b
ret_from_fork+0x3a/0x50
}
... key at: [<ffffffff83f3d900>] __key.15805+0x0/0x40
... acquired at:
__lock_acquire+0x11ed/0x1b60
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
klist_next+0x43/0x1d0
device_for_each_child+0x96/0x110
scsi_target_block+0x3c/0x40 [scsi_mod]
fc_remote_port_delete+0xe7/0x1c0 [scsi_transport_fc]
qla2x00_mark_device_lost+0x4d3/0x500 [qla2xxx]
qlt_unreg_sess+0x104/0x2c0 [qla2xxx]
tcm_qla2xxx_close_session+0xa2/0xb0 [tcm_qla2xxx]
target_shutdown_sessions+0x17b/0x190 [target_core_mod]
core_tpg_del_initiator_node_acl+0xf3/0x1f0 [target_core_mod]
target_fabric_nacl_base_release+0x25/0x30 [target_core_mod]
config_item_release+0x9f/0x120 [configfs]
config_item_put+0x29/0x2b [configfs]
configfs_rmdir+0x3d2/0x520 [configfs]
vfs_rmdir+0xb3/0x1d0
do_rmdir+0x25c/0x2d0
__x64_sys_rmdir+0x24/0x30
do_syscall_64+0x77/0x220
entry_SYSCALL_64_after_hwframe+0x49/0xbe
stack backtrace:
CPU: 7 PID: 1478 Comm: rmdir Tainted: G W 5.1.0-rc1-dbg+ #11
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
dump_stack+0x86/0xca
check_usage.cold.59+0x473/0x563
check_prev_add.constprop.43+0x1f1/0x1170
__lock_acquire+0x11ed/0x1b60
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
klist_next+0x43/0x1d0
device_for_each_child+0x96/0x110
scsi_target_block+0x3c/0x40 [scsi_mod]
fc_remote_port_delete+0xe7/0x1c0 [scsi_transport_fc]
qla2x00_mark_device_lost+0x4d3/0x500 [qla2xxx]
qlt_unreg_sess+0x104/0x2c0 [qla2xxx]
tcm_qla2xxx_close_session+0xa2/0xb0 [tcm_qla2xxx]
target_shutdown_sessions+0x17b/0x190 [target_core_mod]
core_tpg_del_initiator_node_acl+0xf3/0x1f0 [target_core_mod]
target_fabric_nacl_base_release+0x25/0x30 [target_core_mod]
config_item_release+0x9f/0x120 [configfs]
config_item_put+0x29/0x2b [configfs]
configfs_rmdir+0x3d2/0x520 [configfs]
vfs_rmdir+0xb3/0x1d0
do_rmdir+0x25c/0x2d0
__x64_sys_rmdir+0x24/0x30
do_syscall_64+0x77/0x220
entry_SYSCALL_64_after_hwframe+0x49/0xbe--- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/tcm_qla2xxx.c +2 -1
@@ -374,8 +374,9 @@ static void tcm_qla2xxx_close_session(struct se_session *se_sess)spin_lock_irqsave (&vha->hw->tgt.sess_lock, flags);target_sess_cmd_list_set_waiting (se_sess); -tcm_qla2xxx_put_sess (sess);spin_unlock_irqrestore (&vha->hw->tgt.sess_lock, flags); + +tcm_qla2xxx_put_sess (sess); }static u32 tcm_qla2xxx_sess_get_index (struct se_session *se_sess)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 85/346 scsi: qla2xxx: Fix hardirq-unsafe locking
In reply to Greg Kroah-Hartman[ Upstream commit 300ec7415c1fed5c73660f50c8e14a67e236dc0a ]
Since fc_remote_port_delete() must be called with interrupts enabled, do not disable interrupts when calling that function. Remove the lockin calls from around the put_sess() call. This is safe because the function that is called when the final reference is dropped, qlt_unreg_sess(), grabs the proper locks. This patch avoids that lockdep reports the following:
WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected kworker/2:1/62 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:0000000009e679b3 (&(&k->k_lock)->rlock){+.+.}, at: klist_next+0x43/0x1d0
and this task is already holding:00000000a033b71c (&(&ha->tgt.sess_lock)->rlock){-...}, at: qla24xx_delete_sess_fn+0x55/0xf0 [qla2xxx_scst] which would create a new lock dependency:
(&(&ha->tgt.sess_lock)->rlock){-...} -> (&(&k->k_lock)->rlock){+.+.}
but this new dependency connects a HARDIRQ-irq-safe lock:
(&(&ha->tgt.sess_lock)->rlock){-...}
... which became HARDIRQ-irq-safe at:
lock_acquire+0xe3/0x200 _raw_spin_lock_irqsave+0x3d/0x60 qla24xx_report_id_acquisition+0xa69/0xe30 [qla2xxx_scst] qla24xx_process_response_queue+0x69e/0x1270 [qla2xxx_scst] qla24xx_msix_rsp_q+0x79/0xf0 [qla2xxx_scst] __handle_irq_event_percpu+0x79/0x3c0 handle_irq_event_percpu+0x70/0xf0 handle_irq_event+0x5a/0x8b handle_edge_irq+0x12c/0x310 handle_irq+0x192/0x20a do_IRQ+0x73/0x160 ret_from_intr+0x0/0x1d default_idle+0x23/0x1f0 arch_cpu_idle+0x15/0x20 default_idle_call+0x35/0x40 do_idle+0x2bb/0x2e0 cpu_startup_entry+0x1d/0x20 start_secondary+0x2a8/0x320 secondary_startup_64+0xa4/0xb0
to a HARDIRQ-irq-unsafe lock:
(&(&k->k_lock)->rlock){+.+.}
... which became HARDIRQ-irq-unsafe at:
...
lock_acquire+0xe3/0x200 _raw_spin_lock+0x32/0x50 klist_add_tail+0x33/0xb0 device_add+0x7e1/0xb50 device_create_groups_vargs+0x11c/0x150 device_create_with_groups+0x89/0xb0 vtconsole_class_init+0xb2/0x124 do_one_initcall+0xc5/0x3ce kernel_init_freeable+0x295/0x32e kernel_init+0x11/0x11b ret_from_fork+0x3a/0x50
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&(&k->k_lock)->rlock);
local_irq_disable();
lock(&(&ha->tgt.sess_lock)->rlock);
lock(&(&k->k_lock)->rlock);
<Interrupt>
lock(&(&ha->tgt.sess_lock)->rlock);*** DEADLOCK ***
3 locks held by kworker/2:1/62:
#0: 00000000a4319c16 ((wq_completion)"qla2xxx_wq"){+.+.}, at: process_one_work+0x437/0xa80 #1: 00000000ffa34c42 ((work_completion)(&sess->del_work)){+.+.}, at: process_one_work+0x437/0xa80 #2: 00000000a033b71c (&(&ha->tgt.sess_lock)->rlock){-...}, at: qla24xx_delete_sess_fn+0x55/0xf0 [qla2xxx_scst]
the dependencies between HARDIRQ-irq-safe lock and the holding lock:
-> (&(&ha->tgt.sess_lock)->rlock){-...} ops: 8 {
IN-HARDIRQ-W at:
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
qla24xx_report_id_acquisition+0xa69/0xe30 [qla2xxx_scst]
qla24xx_process_response_queue+0x69e/0x1270 [qla2xxx_scst]
qla24xx_msix_rsp_q+0x79/0xf0 [qla2xxx_scst]
__handle_irq_event_percpu+0x79/0x3c0
handle_irq_event_percpu+0x70/0xf0
handle_irq_event+0x5a/0x8b
handle_edge_irq+0x12c/0x310
handle_irq+0x192/0x20a
do_IRQ+0x73/0x160
ret_from_intr+0x0/0x1d
default_idle+0x23/0x1f0
arch_cpu_idle+0x15/0x20
default_idle_call+0x35/0x40
do_idle+0x2bb/0x2e0
cpu_startup_entry+0x1d/0x20
start_secondary+0x2a8/0x320
secondary_startup_64+0xa4/0xb0
INITIAL USE at:
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
qla24xx_report_id_acquisition+0xa69/0xe30 [qla2xxx_scst]
qla24xx_process_response_queue+0x69e/0x1270 [qla2xxx_scst]
qla24xx_msix_rsp_q+0x79/0xf0 [qla2xxx_scst]
__handle_irq_event_percpu+0x79/0x3c0
handle_irq_event_percpu+0x70/0xf0
handle_irq_event+0x5a/0x8b
handle_edge_irq+0x12c/0x310
handle_irq+0x192/0x20a
do_IRQ+0x73/0x160
ret_from_intr+0x0/0x1d
default_idle+0x23/0x1f0
arch_cpu_idle+0x15/0x20
default_idle_call+0x35/0x40
do_idle+0x2bb/0x2e0
cpu_startup_entry+0x1d/0x20
start_secondary+0x2a8/0x320
secondary_startup_64+0xa4/0xb0
}
... key at: [<ffffffffa0c0d080>] __key.85462+0x0/0xfffffffffff7df80 [qla2xxx_scst]
... acquired at:
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
klist_next+0x43/0x1d0
device_for_each_child+0x96/0x110
scsi_target_block+0x3c/0x40 [scsi_mod]
fc_remote_port_delete+0xe7/0x1c0 [scsi_transport_fc]
qla2x00_mark_device_lost+0xa0b/0xa30 [qla2xxx_scst]
qlt_unreg_sess+0x1c6/0x380 [qla2xxx_scst]
qla24xx_delete_sess_fn+0xe6/0xf0 [qla2xxx_scst]
process_one_work+0x511/0xa80
worker_thread+0x67/0x5b0
kthread+0x1d2/0x1f0
ret_from_fork+0x3a/0x50the dependencies between the lock to be acquired
and HARDIRQ-irq-unsafe lock:
-> (&(&k->k_lock)->rlock){+.+.} ops: 13831 {
HARDIRQ-ON-W at:
lock_acquire+0xe3/0x200
_raw_spin_lock+0x32/0x50
klist_add_tail+0x33/0xb0
device_add+0x7e1/0xb50
device_create_groups_vargs+0x11c/0x150
device_create_with_groups+0x89/0xb0
vtconsole_class_init+0xb2/0x124
do_one_initcall+0xc5/0x3ce
kernel_init_freeable+0x295/0x32e
kernel_init+0x11/0x11b
ret_from_fork+0x3a/0x50
SOFTIRQ-ON-W at:
lock_acquire+0xe3/0x200
_raw_spin_lock+0x32/0x50
klist_add_tail+0x33/0xb0
device_add+0x7e1/0xb50
device_create_groups_vargs+0x11c/0x150
device_create_with_groups+0x89/0xb0
vtconsole_class_init+0xb2/0x124
do_one_initcall+0xc5/0x3ce
kernel_init_freeable+0x295/0x32e
kernel_init+0x11/0x11b
ret_from_fork+0x3a/0x50
INITIAL USE at:
lock_acquire+0xe3/0x200
_raw_spin_lock+0x32/0x50
klist_add_tail+0x33/0xb0
device_add+0x7e1/0xb50
device_create_groups_vargs+0x11c/0x150
device_create_with_groups+0x89/0xb0
vtconsole_class_init+0xb2/0x124
do_one_initcall+0xc5/0x3ce
kernel_init_freeable+0x295/0x32e
kernel_init+0x11/0x11b
ret_from_fork+0x3a/0x50
}
... key at: [<ffffffff83ed8780>] __key.15491+0x0/0x40
... acquired at:
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
klist_next+0x43/0x1d0
device_for_each_child+0x96/0x110
scsi_target_block+0x3c/0x40 [scsi_mod]
fc_remote_port_delete+0xe7/0x1c0 [scsi_transport_fc]
qla2x00_mark_device_lost+0xa0b/0xa30 [qla2xxx_scst]
qlt_unreg_sess+0x1c6/0x380 [qla2xxx_scst]
qla24xx_delete_sess_fn+0xe6/0xf0 [qla2xxx_scst]
process_one_work+0x511/0xa80
worker_thread+0x67/0x5b0
kthread+0x1d2/0x1f0
ret_from_fork+0x3a/0x50
stack backtrace:
CPU: 2 PID: 62 Comm: kworker/2:1 Tainted: G O 5.0.7-dbg+ #8
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Workqueue: qla2xxx_wq qla24xx_delete_sess_fn [qla2xxx_scst]
Call Trace:
dump_stack+0x86/0xca
check_usage.cold.52+0x473/0x563
__lock_acquire+0x11c0/0x23e0
lock_acquire+0xe3/0x200
_raw_spin_lock_irqsave+0x3d/0x60
klist_next+0x43/0x1d0
device_for_each_child+0x96/0x110
scsi_target_block+0x3c/0x40 [scsi_mod]
fc_remote_port_delete+0xe7/0x1c0 [scsi_transport_fc]
qla2x00_mark_device_lost+0xa0b/0xa30 [qla2xxx_scst]
qlt_unreg_sess+0x1c6/0x380 [qla2xxx_scst]
qla24xx_delete_sess_fn+0xe6/0xf0 [qla2xxx_scst]
process_one_work+0x511/0xa80
worker_thread+0x67/0x5b0
kthread+0x1d2/0x1f0
ret_from_fork+0x3a/0x50--- drivers/scsi/qla2xxx/qla_target.c | 25 ++++++++----------------- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 2 -- 2 files changed, 8 insertions(+), 19 deletions(-)
drivers/scsi/qla2xxx/qla_target.c +8 -17
@@ -680,7 +680,6 @@ int qla24xx_async_notify_ack(scsi_qla_host_t *vha, fc_port_t *fcport,void qla24xx_do_nack_work (struct scsi_qla_host *vha,struct qla_work_evt *e) {fc_port_t *t; -unsigned long flags;switch (e->u.nack.type) {case SRB_NACK_PRLI :
@@ -690,10 +689,8 @@ void qla24xx_do_nack_work(struct scsi_qla_host *vha, struct qla_work_evt *e)if (t) {ql_log (ql_log_info, vha,0xd034 ,"%s create sess success %p" , __func__, t); -spin_lock_irqsave (&vha->hw->tgt.sess_lock, flags);/* create sess has an extra kref */ vha->hw->tgt.tgt_ops->put_sess (e->u.nack.fcport); -spin_unlock_irqrestore (&vha->hw->tgt.sess_lock, flags); }break ; }
@@ -705,9 +702,6 @@ void qla24xx_delete_sess_fn(struct work_struct *work) { fc_port_t *fcport = container_of(work, struct fc_port, del_work);struct qla_hw_data *ha = fcport->vha->hw; -unsigned long flags; - -spin_lock_irqsave (&ha->tgt.sess_lock, flags);if (fcport->se_sess) { ha->tgt.tgt_ops->shutdown_sess (fcport);
@@ -715,7 +709,6 @@ void qla24xx_delete_sess_fn(struct work_struct *work) }else {qlt_unreg_sess (fcport); } -spin_unlock_irqrestore (&ha->tgt.sess_lock, flags); }/*
@@ -784,8 +777,9 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport) fcport->port_name, sess->loop_id); sess->local =0 ; } - ha->tgt.tgt_ops->put_sess (sess);spin_unlock_irqrestore (&ha->tgt.sess_lock, flags); + + ha->tgt.tgt_ops->put_sess (sess); }/*
@@ -4242,9 +4236,7 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)/* * Drop extra session reference from qla_tgt_handle_cmd_for_atio*( */ -spin_lock_irqsave (&ha->tgt.sess_lock, flags); ha->tgt.tgt_ops->put_sess (sess); -spin_unlock_irqrestore (&ha->tgt.sess_lock, flags);return ; out_term:
@@ -4261,9 +4253,7 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)target_free_tag (sess->se_sess, &cmd->se_cmd);spin_unlock_irqrestore (qpair->qp_lock_ptr, flags); -spin_lock_irqsave (&ha->tgt.sess_lock, flags); ha->tgt.tgt_ops->put_sess (sess); -spin_unlock_irqrestore (&ha->tgt.sess_lock, flags); }static void qlt_do_work (struct work_struct *work)
@@ -4472,9 +4462,7 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,if (!cmd) {ql_dbg (ql_dbg_io, vha,0x3062 ,"qla_target(%d): Allocation of cmd failed\n" , vha->vp_idx); -spin_lock_irqsave (&ha->tgt.sess_lock, flags); ha->tgt.tgt_ops->put_sess (sess); -spin_unlock_irqrestore (&ha->tgt.sess_lock, flags);return -EBUSY ; }
@@ -6318,17 +6306,19 @@ static void qlt_abort_work(struct qla_tgt *tgt, } rc =__qlt_24xx_handle_abts (vha, &prm->abts, sess); - ha->tgt.tgt_ops->put_sess (sess);spin_unlock_irqrestore (&ha->tgt.sess_lock, flags2); + ha->tgt.tgt_ops->put_sess (sess); +if (rc !=0 ) goto out_term;return ; out_term2: +spin_unlock_irqrestore (&ha->tgt.sess_lock, flags2); +if (sess) ha->tgt.tgt_ops->put_sess (sess); -spin_unlock_irqrestore (&ha->tgt.sess_lock, flags2); out_term:spin_lock_irqsave (&ha->hardware_lock, flags);
@@ -6388,9 +6378,10 @@ static void qlt_tmr_work(struct qla_tgt *tgt,scsilun_to_int ((struct scsi_lun *)&a->u.isp24.fcp_cmnd.lun); rc =qlt_issue_task_mgmt (sess, unpacked_lun, fn, iocb,0 ); - ha->tgt.tgt_ops->put_sess (sess);spin_unlock_irqrestore (&ha->tgt.sess_lock, flags); + ha->tgt.tgt_ops->put_sess (sess); +if (rc !=0 ) goto out_term;return ;
drivers/scsi/qla2xxx/tcm_qla2xxx.c +0 -2
@@ -359,7 +359,6 @@ static void tcm_qla2xxx_put_sess(struct fc_port *sess)if (!sess)return ; -assert_spin_locked (&sess->vha->hw->tgt.sess_lock);kref_put (&sess->sess_kref, tcm_qla2xxx_release_session); }
@@ -861,7 +860,6 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct fc_port *sess)static void tcm_qla2xxx_shutdown_sess (struct fc_port *sess) { -assert_spin_locked (&sess->vha->hw->tgt.sess_lock);target_sess_cmd_list_set_waiting (sess->se_sess); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 86/346 x86/modules: Avoid breaking W^X while loading modules
In reply to Greg Kroah-Hartman[ Upstream commit f2c65fb3221adc6b73b0549fc7ba892022db9797 ]
When modules and BPF filters are loaded, there is a time window in which some memory is both writable and executable. An attacker that has already found another vulnerability (e.g., a dangling pointer) might be able to exploit this behavior to overwrite kernel code. Prevent having writable executable PTEs in this stage.
In addition, avoiding having W+X mappings can also slightly simplify the patching of modules code on initialization (e.g., by alternatives and static-key), as would be done in the next patch. This was actually the main motivation for this patch.
To avoid having W+X mappings, set them initially as RW (NX) and after they are set as RO set them as X as well. Setting them as executable is done as a separate step to avoid one core in which the old PTE is cached (hence writable), and another which sees the updated PTE (executable), which would break the W^X protection.
--- arch/x86/kernel/alternative.c | 28 +++++++++++++++++++++------- arch/x86/kernel/module.c | 2 +- include/linux/filter.h | 1 + kernel/module.c | 5 +++++ 4 files changed, 28 insertions(+), 8 deletions(-)
arch/x86/kernel/alternative.c +21 -7
@@ -666,15 +666,29 @@ void __init alternative_instructions(void)* handlers seeing an inconsistent instruction while you patch. */ void *__init_or_module text_poke_early(void *addr, const void *opcode, -size_t len) +size_t len) {unsigned long flags; -local_irq_save (flags); -memcpy (addr, opcode, len); -local_irq_restore (flags); -sync_core (); -/* Could also do a CLFLUSH here to speed up CPU recovery; but -that causes hangs on some VIA CPUs. */ + +if (boot_cpu_has (X86_FEATURE_NX ) && +is_module_text_address ((unsigned long )addr)) { +/* +* Modules text is marked initially as non-executable, so the +* code cannot be running and speculative code-fetches are +* prevented. Just change the code. +*/ +memcpy (addr, opcode, len); + }else { +local_irq_save (flags); +memcpy (addr, opcode, len); +local_irq_restore (flags); +sync_core (); + +/* +* Could also do a CLFLUSH here to speed up CPU recovery; but +* that causes hangs on some VIA CPUs. +*/ + }return addr; }
arch/x86/kernel/module.c +1 -1
@@ -87,7 +87,7 @@ void *module_alloc(unsigned long size) p =__vmalloc_node_range (size,MODULE_ALIGN ,MODULES_VADDR +get_module_load_offset (),MODULES_END ,GFP_KERNEL , -PAGE_KERNEL_EXEC ,0 ,NUMA_NO_NODE , +PAGE_KERNEL ,0 ,NUMA_NO_NODE ,__builtin_return_address (0 ));if (p && (kasan_module_alloc (p, size) <0 )) {vfree (p);
include/linux/filter.h +1 -0
@@ -709,6 +709,7 @@ static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)static inline void bpf_jit_binary_lock_ro (struct bpf_binary_header *hdr) {set_memory_ro ((unsigned long )hdr, hdr->pages); +set_memory_x ((unsigned long )hdr, hdr->pages); }static inline void bpf_jit_binary_unlock_ro (struct bpf_binary_header *hdr)
kernel/module.c +5 -0
@@ -1950,8 +1950,13 @@ void module_enable_ro(const struct module *mod, bool after_init)return ;frob_text (&mod->core_layout, set_memory_ro); +frob_text (&mod->core_layout, set_memory_x); +frob_rodata (&mod->core_layout, set_memory_ro); +frob_text (&mod->init_layout, set_memory_ro); +frob_text (&mod->init_layout, set_memory_x); +frob_rodata (&mod->init_layout, set_memory_ro);if (after_init)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 87/346 Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve
In reply to Greg Kroah-Hartman[ Upstream commit 39ad317315887c2cb9a4347a93a8859326ddf136 ]
When doing fallocate, we first add the range to the reserve_list and then reserve the quota. If quota reservation fails, we'll release all reserved parts of reserve_list.
However, cur_offset is not updated to indicate that this range is already been inserted into the list. Therefore, the same range is freed twice. Once at list_for_each_entry loop, and once at the end of the function. This will result in WARN_ON on bytes_may_use when we free the remaining space.
At the end, under the 'out' label we have a call to:
btrfs_free_reserved_data_space(inode, data_reserved, alloc_start, alloc_end - cur_offset);
The start offset, third argument, should be cur_offset.
Everything from alloc_start to cur_offset was freed by the list_for_each_entry_safe_loop.
--- fs/btrfs/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/file.c +2 -1
@@ -3142,6 +3142,7 @@ static long btrfs_fallocate(struct file *file, int mode, ret =btrfs_qgroup_reserve_data (inode, &data_reserved, cur_offset, last_byte - cur_offset);if (ret <0 ) { + cur_offset = last_byte;free_extent_map (em);break ; }
@@ -3191,7 +3192,7 @@ static long btrfs_fallocate(struct file *file, int mode,/* Let go of our reservation. */ if (ret !=0 && !(mode &FALLOC_FL_ZERO_RANGE ))btrfs_free_reserved_data_space (inode, data_reserved, - alloc_start, alloc_end - cur_offset); + cur_offset, alloc_end - cur_offset);extent_changeset_free (data_reserved);return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 88/346 btrfs: fix panic during relocation after ENOSPC before writeback happens
In reply to Greg Kroah-Hartman[ Upstream commit ff612ba7849964b1898fd3ccd1f56941129c6aab ]
We've been seeing the following sporadically throughout our fleet
panic: kernel BUG at fs/btrfs/relocation.c:4584!
netversion: 5.0-0
Backtrace:
#0 [ffffc90003adb880] machine_kexec at ffffffff81041da8
#1 [ffffc90003adb8c8] __crash_kexec at ffffffff8110396c
#2 [ffffc90003adb988] crash_kexec at ffffffff811048ad
#3 [ffffc90003adb9a0] oops_end at ffffffff8101c19a
#4 [ffffc90003adb9c0] do_trap at ffffffff81019114
#5 [ffffc90003adba00] do_error_trap at ffffffff810195d0
#6 [ffffc90003adbab0] invalid_op at ffffffff81a00a9b
[exception RIP: btrfs_reloc_cow_block+692]
RIP: ffffffff8143b614 RSP: ffffc90003adbb68 RFLAGS: 00010246
RAX: fffffffffffffff7 RBX: ffff8806b9c32000 RCX: ffff8806aad00690
RDX: ffff880850b295e0 RSI: ffff8806b9c32000 RDI: ffff88084f205bd0
RBP: ffff880849415000 R8: ffffc90003adbbe0 R9: ffff88085ac90000
R10: ffff8805f7369140 R11: 0000000000000000 R12: ffff880850b295e0
R13: ffff88084f205bd0 R14: 0000000000000000 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ffffc90003adbbb0] __btrfs_cow_block at ffffffff813bf1cd
#8 [ffffc90003adbc28] btrfs_cow_block at ffffffff813bf4b3
#9 [ffffc90003adbc78] btrfs_search_slot at ffffffff813c2e6cThe way relocation moves data extents is by creating a reloc inode and preallocating extents in this inode and then copying the data into these preallocated extents. Once we've done this for all of our extents, we'll write out these dirty pages, which marks the extent written, and goes into btrfs_reloc_cow_block(). From here we get our current reloc_control, which _should_ match the reloc_control for the current block group we're relocating.
However if we get an ENOSPC in this path at some point we'll bail out, never initiating writeback on this inode. Not a huge deal, unless we happen to be doing relocation on a different block group, and this block group is now rc->stage == UPDATE_DATA_PTRS. This trips the BUG_ON() in btrfs_reloc_cow_block(), because we expect to be done modifying the data inode. We are in fact done modifying the metadata for the data inode we're currently using, but not the one from the failed block group, and thus we BUG_ON().
(This happens when writeback finishes for extents from the previous group, when we are at btrfs_finish_ordered_io() which updates the data reloc tree (inode item, drops/adds extent items, etc).)
Fix this by writing out the reloc data inode always, and then breaking out of the loop after that point to keep from tripping this BUG_ON() later.
--- fs/btrfs/relocation.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-)
fs/btrfs/relocation.c +20 -11
@@ -4271,27 +4271,36 @@ int btrfs_relocate_block_group(struct btrfs_fs_info *fs_info, u64 group_start)mutex_lock (&fs_info->cleaner_mutex); ret =relocate_block_group (rc);mutex_unlock (&fs_info->cleaner_mutex); -if (ret <0 ) { +if (ret <0 ) err = ret; - goto out; - } - -if (rc->extents_found ==0 ) -break ; - -btrfs_info (fs_info,"found %llu extents" , rc->extents_found); +/* +* We may have gotten ENOSPC after we already dirtied some +* extents. If writeout happens while we're relocating a +* different block group we could end up hitting the +* BUG_ON(rc->stage == UPDATE_DATA_PTRS) in +* btrfs_reloc_cow_block. Make sure we write everything out +* properly so we don't trip over this problem, and then break +* out of the loop if we hit an error. +*/ if (rc->stage ==MOVE_DATA_EXTENTS && rc->found_file_extent) { ret =btrfs_wait_ordered_range (rc->data_inode,0 , (u64)-1 ); -if (ret) { +if (ret) err = ret; - goto out; - }invalidate_mapping_pages (rc->data_inode->i_mapping,0 ,-1 ); rc->stage =UPDATE_DATA_PTRS ; } + +if (err <0 ) + goto out; + +if (rc->extents_found ==0 ) +break ; + +btrfs_info (fs_info,"found %llu extents" , rc->extents_found); + }WARN_ON (rc->block_group->pinned >0 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 89/346 btrfs: Dont panic when we cant find a root key
In reply to Greg Kroah-Hartman[ Upstream commit 7ac1e464c4d473b517bb784f30d40da1f842482e ]
When we failed to find a root key in btrfs_update_root(), we just panic.
That's definitely not cool, fix it by outputting an unique error message, aborting current transaction and return -EUCLEAN. This should not normally happen as the root has been used by the callers in some way.
--- fs/btrfs/root-tree.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
fs/btrfs/root-tree.c +8 -5
@@ -135,11 +135,14 @@ int btrfs_update_root(struct btrfs_trans_handle *trans, struct btrfs_rootif (ret <0 ) goto out; -if (ret !=0 ) { -btrfs_print_leaf (path->nodes[0 ]); -btrfs_crit (fs_info,"unable to update root key %llu %u %llu" , - key->objectid, key->type, key->offset); -BUG_ON (1 ); +if (ret >0 ) { +btrfs_crit (fs_info, +"unable to find root key (%llu %u %llu) in tree %llu" , + key->objectid, key->type, key->offset, + root->root_key.objectid); + ret = -EUCLEAN ; +btrfs_abort_transaction (trans, ret); + goto out; } l = path->nodes[0 ];
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 90/346 iwlwifi: pcie: dont crash on invalid RX interrupt
In reply to Greg Kroah-Hartman[ Upstream commit 30f24eabab8cd801064c5c37589d803cb4341929 ]
If for some reason the device gives us an RX interrupt before we're ready for it, perhaps during device power-on with misconfigured IRQ causes mapping or so, we can crash trying to access the queues.
Prevent that by checking that we actually have RXQs and that they were properly allocated.
--- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/pcie/rx.c +6 -1
@@ -1384,10 +1384,15 @@ static struct iwl_rx_mem_buffer *iwl_pcie_get_rxb(struct iwl_trans *trans,static void iwl_pcie_rx_handle (struct iwl_trans *trans,int queue) {struct iwl_trans_pcie *trans_pcie =IWL_TRANS_GET_PCIE_TRANS (trans); -struct iwl_rxq *rxq = &trans_pcie->rxq[queue]; +struct iwl_rxq *rxq;u32 r, i, count =0 ;bool emergency = false; +if (WARN_ON_ONCE (!trans_pcie->rxq || !trans_pcie->rxq[queue].bd)) +return ; + + rxq = &trans_pcie->rxq[queue]; + restart:spin_lock (&rxq->lock);/* uCode's read index (stored in shared DRAM) indicates the last Rx
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 91/346 rtc: 88pm860x: prevent use-after-free on device remove
In reply to Greg Kroah-Hartman[ Upstream commit f22b1ba15ee5785aa028384ebf77dd39e8e47b70 ]
The device's remove() attempts to shut down the delayed_work scheduled on the kernel-global workqueue by calling flush_scheduled_work().
Unfortunately, flush_scheduled_work() does not prevent the delayed_work from re-scheduling itself. The delayed_work might run after the device has been removed, and touch the already de-allocated info structure. This is a potential use-after-free.
Fix by calling cancel_delayed_work_sync() during remove(): this ensures that the delayed work is properly cancelled, is no longer running, and is not able to re-schedule itself.
This issue was detected with the help of Coccinelle.
--- drivers/rtc/rtc-88pm860x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-88pm860x.c +1 -1
@@ -414,7 +414,7 @@ static int pm860x_rtc_remove(struct platform_device *pdev)struct pm860x_rtc_info *info =platform_get_drvdata (pdev);#ifdef VRTC_CALIBRATION -flush_scheduled_work (); +cancel_delayed_work_sync (&info->calib_work);/* disable measurement */ pm860x_set_bits (info->i2c,PM8607_MEAS_EN2 ,MEAS2_VRTC ,0 );#endif /* VRTC_CALIBRATION */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 92/346 rtc: stm32: manage the get_irq probe defer case
In reply to Greg Kroah-Hartman[ Upstream commit cf612c5949aca2bd81a1e28688957c8149ea2693 ]
Manage the -EPROBE_DEFER error case for the wake IRQ.
--- drivers/rtc/rtc-stm32.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/rtc/rtc-stm32.c +6 -3
@@ -788,11 +788,14 @@ static int stm32_rtc_probe(struct platform_device *pdev) ret =device_init_wakeup (&pdev->dev, true);if (rtc->data->has_wakeirq) { rtc->wakeirq_alarm =platform_get_irq (pdev,1 ); -if (rtc->wakeirq_alarm <=0 ) - ret = rtc->wakeirq_alarm; -else +if (rtc->wakeirq_alarm >0 ) { ret =dev_pm_set_dedicated_wake_irq (&pdev->dev, rtc->wakeirq_alarm); + }else { + ret = rtc->wakeirq_alarm; +if (rtc->wakeirq_alarm == -EPROBE_DEFER ) + goto err; + } }if (ret)dev_warn (&pdev->dev,"alarm can't wake up the system: %d" , ret);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 93/346 scsi: qedi: Abort ep termination if offload not scheduled
In reply to Greg Kroah-Hartman[ Upstream commit f848bfd8e167210a29374e8a678892bed591684f ]
Sometimes during connection recovery when there is a failure to resolve ARP, and offload connection was not issued, driver tries to flush pending offload connection work which was not queued up.
kernel: WARNING: CPU: 19 PID: 10110 at kernel/workqueue.c:3030 __flush_work.isra.34+0x19c/0x1b0
kernel: CPU: 19 PID: 10110 Comm: iscsid Tainted: G W 5.1.0-rc4 #11
kernel: Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 2.9.1 12/04/2018
kernel: RIP: 0010:__flush_work.isra.34+0x19c/0x1b0
kernel: Code: 8b fb 66 0f 1f 44 00 00 31 c0 eb ab 48 89 ef c6 07 00 0f 1f 40 00 fb 66 0f 1f 44 00 00 31 c0 eb 96 e8 08 16 fe ff 0f 0b eb 8d <0f> 0b 31 c0 eb 87 0f 1f 40 00 66 2e 0f 1 f 84 00 00 00 00 00 0f 1f
kernel: RSP: 0018:ffffa6b4054dba68 EFLAGS: 00010246
kernel: RAX: 0000000000000000 RBX: ffff91df21c36fc0 RCX: 0000000000000000
kernel: RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff91df21c36fc0
kernel: RBP: ffff91df21c36ef0 R08: 0000000000000000 R09: 0000000000000000
kernel: R10: 0000000000000038 R11: ffffa6b4054dbd60 R12: ffffffffc05e72c0
kernel: R13: ffff91db10280820 R14: 0000000000000048 R15: 0000000000000000
kernel: FS: 00007f5d83cc1740(0000) GS:ffff91df2f840000(0000) knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 0000000001cc5000 CR3: 0000000465450002 CR4: 00000000001606e0
kernel: Call Trace:
kernel: ? try_to_del_timer_sync+0x4d/0x80
kernel: qedi_ep_disconnect+0x3b/0x410 [qedi]
kernel: ? 0xffffffffc083c000
kernel: ? klist_iter_exit+0x14/0x20
kernel: ? class_find_device+0x93/0xf0
kernel: iscsi_if_ep_disconnect.isra.18+0x58/0x70 [scsi_transport_iscsi]
kernel: iscsi_if_recv_msg+0x10e2/0x1510 [scsi_transport_iscsi]
kernel: ? copyout+0x22/0x30
kernel: ? _copy_to_iter+0xa0/0x430
kernel: ? _cond_resched+0x15/0x30
kernel: ? __kmalloc_node_track_caller+0x1f9/0x270
kernel: iscsi_if_rx+0xa5/0x1e0 [scsi_transport_iscsi]
kernel: netlink_unicast+0x17f/0x230
kernel: netlink_sendmsg+0x2d2/0x3d0
kernel: sock_sendmsg+0x36/0x50
kernel: ___sys_sendmsg+0x280/0x2a0
kernel: ? timerqueue_add+0x54/0x80
kernel: ? enqueue_hrtimer+0x38/0x90
kernel: ? hrtimer_start_range_ns+0x19f/0x2c0
kernel: __sys_sendmsg+0x58/0xa0
kernel: do_syscall_64+0x5b/0x180
kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/scsi/qedi/qedi_iscsi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/qedi/qedi_iscsi.c +3 -0
@@ -1000,6 +1000,9 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep) qedi_ep = ep->dd_data; qedi = qedi_ep->qedi; +if (qedi_ep->state ==EP_STATE_OFLDCONN_START ) + goto ep_exit_recover; +flush_work (&qedi_ep->offload_work);if (qedi_ep->conn) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 94/346 s390/kexec_file: Fix detection of text segment in ELF loader
In reply to Greg Kroah-Hartman[ Upstream commit 729829d775c9a5217abc784b2f16087d79c4eec8 ]
To register data for the next kernel (command line, oldmem_base, etc.) the current kernel needs to find the ELF segment that contains head.S. This is currently done by checking ifor 'phdr->p_paddr == 0'. This works fine for the current kernel build but in theory the first few pages could be skipped. Make the detection more robust by checking if the entry point lies within the segment.
--- arch/s390/kernel/kexec_elf.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/s390/kernel/kexec_elf.c +6 -1
@@ -19,10 +19,15 @@ static int kexec_file_add_elf_kernel(struct kimage *image,struct kexec_buf buf;const Elf_Ehdr *ehdr;const Elf_Phdr *phdr; +Elf_Addr entry;int i, ret; ehdr = (Elf_Ehdr *)kernel; buf.image = image; +if (image->type ==KEXEC_TYPE_CRASH ) + entry =STARTUP_KDUMP_OFFSET ; +else + entry = ehdr->e_entry; phdr = (void *)ehdr + ehdr->e_phoff;for (i =0 ; i < ehdr->e_phnum; i++, phdr++) {
@@ -35,7 +40,7 @@ static int kexec_file_add_elf_kernel(struct kimage *image, buf.mem =ALIGN (phdr->p_paddr, phdr->p_align); buf.memsz = phdr->p_memsz; -if (phdr->p_paddr ==0 ) { +if (entry - phdr->p_paddr < phdr->p_memsz) { data->kernel_buf = buf.buffer; data->memsz +=STARTUP_NORMAL_OFFSET ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 95/346 ALSA: hda: fix unregister device twice on ASoC driver
In reply to Greg Kroah-Hartman[ Upstream commit 4d95c51776b2edb4d4ebcea00b6e5a1fe538ce66 ]
snd_hda_codec_device_new() is used by both legacy HDA and ASoC driver. However, we will call snd_hdac_device_unregister() in snd_hdac_ext_bus_device_remove() for ASoC device. This patch uses the type flag in hdac_device struct to determine is it a ASoC device or legacy HDA device and call snd_hdac_device_unregister() in snd_hda_codec_dev_free() only if it is a legacy HDA device.
--- sound/pci/hda/hda_codec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/pci/hda/hda_codec.c +7 -1
@@ -841,7 +841,13 @@ static int snd_hda_codec_dev_free(struct snd_device *device)struct hda_codec *codec = device->device_data; codec->in_freeing =1 ; -snd_hdac_device_unregister (&codec->core); +/* +* snd_hda_codec_device_new() is used by legacy HDA and ASoC driver. +* We can't unregister ASoC device since it will be unregistered in +* snd_hdac_ext_bus_device_remove(). +*/ +if (codec->core.type ==HDA_DEV_LEGACY ) +snd_hdac_device_unregister (&codec->core);codec_display_power (codec, false);put_device (hda_codec_dev (codec));return 0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 96/346 sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs
In reply to Greg Kroah-Hartman[ Upstream commit 9b019acb72e4b5741d88e8936d6f200ed44b66b2 ]
The NOHZ idle balancer runs on the lowest idle CPU. This can interfere with isolated CPUs, so confine it to HK_FLAG_MISC housekeeping CPUs.
HK_FLAG_SCHED is not used for this because it is not set anywhere at the moment. This could be folded into HK_FLAG_SCHED once that option is fixed.
The problem was observed with increased jitter on an application running on CPU0, caused by NOHZ idle load balancing being run on CPU1 (an SMT sibling).
--- kernel/sched/fair.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
kernel/sched/fair.c +10 -6
@@ -9456,22 +9456,26 @@ static inline int on_null_domain(struct rq *rq)* - When one of the busy CPUs notice that there may be an idle rebalancing * needed, they will kick the idle load balancer, which then does idle * load balancing for all the idle CPUs. +* - HK_FLAG_MISC CPUs are used for this task, because HK_FLAG_SCHED not set +* anywhere yet. */ static inline int find_new_ilb (void ) { -int ilb =cpumask_first (nohz.idle_cpus_mask); +int ilb; -if (ilb < nr_cpu_ids &&idle_cpu (ilb)) -return ilb; +for_each_cpu_and (ilb, nohz.idle_cpus_mask, +housekeeping_cpumask (HK_FLAG_MISC )) { +if (idle_cpu (ilb)) +return ilb; + }return nr_cpu_ids; }/* -* Kick a CPU to do the nohz balancing, if it is time for it. We pick the -* nohz_load_balancer CPU (if there is one) otherwise fallback to any idle -* CPU (if there is one). +* Kick a CPU to do the nohz balancing, if it is time for it. We pick any +* idle CPU in the HK_FLAG_MISC housekeeping set (if there is one). */ static void kick_ilb (unsigned int flags) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 97/346 net: ethernet: ti: cpsw: fix allmulti cfg in dual_mac mode
In reply to Greg Kroah-Hartman[ Upstream commit 06095f34f8a0a2c4c83a19514c272699edd5f80b ]
Now CPSW ALE will set/clean Host port bit in Unregistered Multicast Flood Mask (UNREG_MCAST_FLOOD_MASK) for every VLAN without checking if this port belongs to VLAN or not when ALLMULTI mode flag is set for nedev. This is working in non dual_mac mode, but in dual_mac - it causes enabling/disabling ALLMULTI flag for both ports.
Hence fix it by adding additional parameter to cpsw_ale_set_allmulti() to specify ALE port number for which ALLMULTI has to be enabled and check if port belongs to VLAN before modifying UNREG_MCAST_FLOOD_MASK.
--- drivers/net/ethernet/ti/cpsw.c | 12 +++++++++--- drivers/net/ethernet/ti/cpsw_ale.c | 19 ++++++++++--------- drivers/net/ethernet/ti/cpsw_ale.h | 3 +-- 3 files changed, 20 insertions(+), 14 deletions(-)
drivers/net/ethernet/ti/cpsw.c +9 -3
@@ -800,12 +800,17 @@ static int cpsw_purge_all_mc(struct net_device *ndev, const u8 *addr, int num)static void cpsw_ndo_set_rx_mode (struct net_device *ndev) { -struct cpsw_common *cpsw =ndev_to_cpsw (ndev); +struct cpsw_priv *priv =netdev_priv (ndev); +struct cpsw_common *cpsw = priv->cpsw; +int slave_port =-1 ; + +if (cpsw->data.dual_emac) + slave_port = priv->emac_port +1 ;if (ndev->flags &IFF_PROMISC ) {/* Enable promiscuous mode */ cpsw_set_promiscious (ndev, true); -cpsw_ale_set_allmulti (cpsw->ale,IFF_ALLMULTI ); +cpsw_ale_set_allmulti (cpsw->ale,IFF_ALLMULTI , slave_port);return ; }else {/* Disable promiscuous mode */
@@ -813,7 +818,8 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev) }/* Restore allmulti on vlans if necessary */ -cpsw_ale_set_allmulti (cpsw->ale, ndev->flags &IFF_ALLMULTI ); +cpsw_ale_set_allmulti (cpsw->ale, + ndev->flags &IFF_ALLMULTI , slave_port);/* add/remove mcast address either for real netdev or for vlan */ __hw_addr_ref_sync_dev(&ndev->mc, ndev, cpsw_add_mc_addr,
drivers/net/ethernet/ti/cpsw_ale.c +10 -9
@@ -482,24 +482,25 @@ int cpsw_ale_del_vlan(struct cpsw_ale *ale, u16 vid, int port_mask) }EXPORT_SYMBOL_GPL (cpsw_ale_del_vlan); -void cpsw_ale_set_allmulti (struct cpsw_ale *ale,int allmulti) +void cpsw_ale_set_allmulti (struct cpsw_ale *ale,int allmulti,int port) {u32 ale_entry[ALE_ENTRY_WORDS ]; -int type, idx;int unreg_mcast =0 ; - -/* Only bother doing the work if the setting is actually changing */ -if (ale->allmulti == allmulti) -return ; - -/* Remember the new setting to check against next time */ - ale->allmulti = allmulti; +int type, idx;for (idx =0 ; idx < ale->params.ale_entries; idx++) { +int vlan_members; +cpsw_ale_read (ale, idx, ale_entry); type =cpsw_ale_get_entry_type (ale_entry);if (type !=ALE_TYPE_VLAN )continue ; + vlan_members = +cpsw_ale_get_vlan_member_list (ale_entry, + ale->vlan_field_bits); + +if (port !=-1 && !(vlan_members &BIT (port))) +continue ; unreg_mcast = cpsw_ale_get_vlan_unreg_mcast(ale_entry,
drivers/net/ethernet/ti/cpsw_ale.h +1 -2
@@ -37,7 +37,6 @@ struct cpsw_ale {struct cpsw_ale_params params;struct timer_list timer;unsigned long ageout; -int allmulti;u32 version;/* These bits are different on NetCP NU Switch ALE */ u32 port_mask_bits;
@@ -116,7 +115,7 @@ int cpsw_ale_del_mcast(struct cpsw_ale *ale, const u8 *addr, int port_mask,int cpsw_ale_add_vlan (struct cpsw_ale *ale,u16 vid,int port,int untag,int reg_mcast,int unreg_mcast);int cpsw_ale_del_vlan (struct cpsw_ale *ale,u16 vid,int port); -void cpsw_ale_set_allmulti (struct cpsw_ale *ale,int allmulti); +void cpsw_ale_set_allmulti (struct cpsw_ale *ale,int allmulti,int port);int cpsw_ale_control_get (struct cpsw_ale *ale,int port,int control); int cpsw_ale_control_set(struct cpsw_ale *ale, int port,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 98/346 w1: fix the resume command API
In reply to Greg Kroah-Hartman[ Upstream commit 62909da8aca048ecf9fbd7e484e5100608f40a63 ]
Quoted 1 line
From the DS2408 datasheet [1]:
"Resume Command function checks the status of the RC flag and, if it is set,
directly transfers control to the control functions, similar to a Skip ROM command. The only way to set the RC flag is through successfully executing the Match ROM, Search ROM, Conditional Search ROM, or Overdrive-Match ROM command"
The function currently works perfectly fine in a multidrop bus, but when we have only a single slave connected, then only a Skip ROM is used and Match ROM is not called at all. This is leading to problems e.g. with single one DS2408 connected, as the Resume Command is not working properly and the device is responding with failing results after the Resume Command.
This commit is fixing this by using a Skip ROM instead in those cases. The bandwidth / performance advantage is exactly the same.
Refs:
[1] https://datasheets.maximintegrated.com/en/ds/DS2408.pdf
--- drivers/w1/w1_io.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/w1/w1_io.c +1 -2
@@ -432,8 +432,7 @@ int w1_reset_resume_command(struct w1_master *dev)if (w1_reset_bus (dev))return -1 ; -/* This will make only the last matched slave perform a skip ROM. */ -w1_write_8 (dev,W1_RESUME_CMD ); +w1_write_8 (dev, dev->slave_count >1 ?W1_RESUME_CMD :W1_SKIP_ROM );return 0 ; }EXPORT_SYMBOL_GPL (w1_reset_resume_command);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 99/346 net: hns3: fix for TX clean num when cleaning TX BD
In reply to Greg Kroah-Hartman[ Upstream commit 63380a1ae4ced8aef67659ff9547c69ef8b9613a ]
hns3_desc_unused() returns how many BD have been cleaned, but new buffer has not been attached to them. The register of HNS3_RING_RX_RING_FBDNUM_REG returns how many BD need allocating new buffer to or need to cleaned. So the remaining BD need to be clean is HNS3_RING_RX_RING_FBDNUM_REG - hns3_desc_unused().
Also, new buffer can not attach to the pending BD when the last BD is not handled, because memcpy has not been done on the first pending BD.
This patch fixes by subtracting the pending BD num from unused_count after 'HNS3_RING_RX_RING_FBDNUM_REG - unused_count' is used to calculate the BD bum need to be clean.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +2 -1
@@ -2708,7 +2708,7 @@ int hns3_clean_rx_ring(#define RCB_NOF_ALLOC_RX_BUFF_ONCE 16struct net_device *netdev = ring->tqp->handle->kinfo.netdev;int recv_pkts, recv_bds, clean_count, err; -int unused_count =hns3_desc_unused (ring) - ring->pending_buf; +int unused_count =hns3_desc_unused (ring);struct sk_buff *skb = ring->skb;int num;
@@ -2717,6 +2717,7 @@ int hns3_clean_rx_ring( recv_pkts =0 , recv_bds =0 , clean_count =0 ; num -= unused_count; + unused_count -= ring->pending_buf;while (recv_pkts < budget && recv_bds < num) {/* Reuse or realloc buffers */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 100/346 net: phy: improve genphy_soft_reset
In reply to Greg Kroah-Hartman[ Upstream commit 8c90b795e90f7753d23c18e8b95dd71b4a18c5d9 ]
PHY's behave differently when being reset. Some reset registers to defaults, some don't. Some trigger an autoneg restart, some don't.
So let's also set the autoneg restart bit when resetting. Then PHY behavior should be more consistent. Clearing BMCR_ISOLATE serves the same purpose and is borrowed from genphy_restart_aneg.
BMCR holds the speed / duplex settings in fixed mode. Therefore we may have an issue if a soft reset resets BMCR to its default. So better call genphy_setup_forced() afterwards in fixed mode. We've seen no related complaint in the last >10 yrs, so let's treat it as an improvement.
--- drivers/net/phy/phy_device.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/net/phy/phy_device.c +14 -2
@@ -1830,13 +1830,25 @@ EXPORT_SYMBOL(genphy_read_status);*/ int genphy_soft_reset (struct phy_device *phydev) { +u16 res =BMCR_RESET ;int ret; - ret =phy_set_bits (phydev,MII_BMCR ,BMCR_RESET ); +if (phydev->autoneg ==AUTONEG_ENABLE ) + res |=BMCR_ANRESTART ; + + ret =phy_modify (phydev,MII_BMCR ,BMCR_ISOLATE , res);if (ret <0 )return ret; -return phy_poll_reset (phydev); + ret =phy_poll_reset (phydev); +if (ret) +return ret; + +/* BMCR may be reset to defaults */ +if (phydev->autoneg ==AUTONEG_DISABLE ) + ret =genphy_setup_forced (phydev); + +return ret; }EXPORT_SYMBOL (genphy_soft_reset);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 101/346 s390: qeth: address type mismatch warning
In reply to Greg Kroah-Hartman[ Upstream commit 46b83629dede262315aa82179d105581f11763b6 ]
clang produces a harmless warning for each use for the qeth_adp_supported macro:
drivers/s390/net/qeth_l2_main.c:559:31: warning: implicit conversion from enumeration type 'enum qeth_ipa_setadp_cmd' to
different enumeration type 'enum qeth_ipa_funcs' [-Wenum-conversion]
if (qeth_adp_supported(card, IPA_SETADP_SET_PROMISC_MODE))
~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/s390/net/qeth_core.h:179:41: note: expanded from macro 'qeth_adp_supported'
qeth_is_ipa_supported(&c->options.adp, f)
~~~~~~~~~~~~~~~~~~~~~ ^Add a version of this macro that uses the correct types, and remove the unused qeth_adp_enabled() macro that has the same problem.
--- drivers/s390/net/qeth_core.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/s390/net/qeth_core.h +7 -3
@@ -215,6 +215,12 @@ struct qeth_vnicc_info {bool rx_bcast_enabled; }; +static inline int qeth_is_adp_supported (struct qeth_ipa_info *ipa, +enum qeth_ipa_setadp_cmd func) +{ +return (ipa->supported_funcs & func); +} +static inline int qeth_is_ipa_supported (struct qeth_ipa_info *ipa,enum qeth_ipa_funcs func) {
@@ -228,9 +234,7 @@ static inline int qeth_is_ipa_enabled(struct qeth_ipa_info *ipa, }#define qeth_adp_supported (c, f) \ - qeth_is_ipa_supported(&c->options.adp, f) -#define qeth_adp_enabled (c, f) \ - qeth_is_ipa_enabled(&c->options.adp, f) + qeth_is_adp_supported(&c->options.adp, f)#define qeth_is_supported (c, f) \ qeth_is_ipa_supported(&c->options.ipa4, f)#define qeth_is_enabled (c, f) \
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 102/346 net: hns3: use atomic_t replace u32 for arqs count
In reply to Greg Kroah-Hartman[ Upstream commit 30780a8b1677e7409b32ae52a9a84f7d41ae6b43 ]
Since irq handler and mailbox task will both update arq's count, so arq's count should use atomic_t instead of u32, otherwise its value may go wrong finally.
--- drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c | 7 ++++--- 3 files changed, 6 insertions(+), 5 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h +1 -1
@@ -102,7 +102,7 @@ struct hclgevf_mbx_arq_ring {struct hclgevf_dev *hdev;u32 head;u32 tail; -u32 count; +atomic_t count;u16 msg_q[HCLGE_MBX_MAX_ARQ_MSG_NUM ][HCLGE_MBX_MAX_ARQ_MSG_SIZE ]; };
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c +1 -1
@@ -327,7 +327,7 @@ int hclgevf_cmd_init(struct hclgevf_dev *hdev) hdev->arq.hdev = hdev; hdev->arq.head =0 ; hdev->arq.tail =0 ; - hdev->arq.count =0 ; +atomic_set (&hdev->arq.count,0 ); hdev->hw.cmq.csq.next_to_clean =0 ; hdev->hw.cmq.csq.next_to_use =0 ; hdev->hw.cmq.crq.next_to_clean =0 ;
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c +4 -3
@@ -207,7 +207,8 @@ void hclgevf_mbx_handler(struct hclgevf_dev *hdev)/* we will drop the async msg if we find ARQ as full * and continue with next message */ -if (hdev->arq.count >=HCLGE_MBX_MAX_ARQ_MSG_NUM ) { +if (atomic_read (&hdev->arq.count) >= +HCLGE_MBX_MAX_ARQ_MSG_NUM ) {dev_warn (&hdev->pdev->dev,"Async Q full, dropping msg(%d)\n" , req->msg[1 ]);
@@ -219,7 +220,7 @@ void hclgevf_mbx_handler(struct hclgevf_dev *hdev)memcpy (&msg_q[0 ], req->msg,HCLGE_MBX_MAX_ARQ_MSG_SIZE *sizeof (u16));hclge_mbx_tail_ptr_move_arq (hdev->arq); - hdev->arq.count++; +atomic_inc (&hdev->arq.count);hclgevf_mbx_task_schedule (hdev);
@@ -296,7 +297,7 @@ void hclgevf_mbx_async_handler(struct hclgevf_dev *hdev) }hclge_mbx_head_ptr_move_arq (hdev->arq); - hdev->arq.count--; +atomic_dec (&hdev->arq.count); msg_q = hdev->arq.msg_q[hdev->arq.head]; } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 103/346 dmaengine: pl330: _stop: clear interrupt status
In reply to Greg Kroah-Hartman[ Upstream commit 2da254cc7908105a60a6bb219d18e8dced03dcb9 ]
This patch kill instructs the DMAC to immediately terminate execution of a thread. and then clear the interrupt status, at last, stop generating interrupts for DMA_SEV. to guarantee the next dma start is clean. otherwise, one interrupt maybe leave to next start and make some mistake.
we can reporduce the problem as follows:
DMASEV: modify the event-interrupt resource, and if the INTEN sets function as interrupt, the DMAC will set irq<event_num> HIGH to generate interrupt. write INTCLR to clear interrupt.
DMA EXECUTING INSTRUCTS DMA TERMINATE | | | | ... _stop | | | spin_lock_irqsave DMASEV | | | | mask INTEN | | | DMAKILL | | | spin_unlock_irqrestore
in above case, a interrupt was left, and if we unmask INTEN, the DMAC will set irq<event_num> HIGH to generate interrupt.
to fix this, do as follows:
DMA EXECUTING INSTRUCTS DMA TERMINATE | | | | ... _stop | | | spin_lock_irqsave DMASEV | | | | DMAKILL | | | clear INTCLR | mask INTEN | | | spin_unlock_irqrestore
--- drivers/dma/pl330.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/dma/pl330.c +7 -3
@@ -966,6 +966,7 @@ static void _stop(struct pl330_thread *thrd) {void __iomem *regs = thrd->dmac->base;u8 insn[6 ] = {0 ,0 ,0 ,0 ,0 ,0 }; +u32 inten =readl (regs +INTEN );if (_state (thrd) ==PL330_STATE_FAULT_COMPLETING )UNTIL (thrd,PL330_STATE_FAULTING |PL330_STATE_KILLING );
@@ -978,10 +979,13 @@ static void _stop(struct pl330_thread *thrd)_emit_KILL (0 , insn); -/* Stop generating interrupts for SEV */ -writel (readl (regs +INTEN ) & ~(1 << thrd->ev), regs +INTEN ); -_execute_DBGINSN (thrd, insn,is_manager (thrd)); + +/* clear the event */ +if (inten & (1 << thrd->ev)) +writel (1 << thrd->ev, regs +INTCLR ); +/* Stop generating interrupts for SEV */ +writel (inten & ~(1 << thrd->ev), regs +INTEN ); }/* Start doing req 'idx' of thread 'thrd' */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 104/346 mac80211/cfg80211: update bss channel on channel switch
In reply to Greg Kroah-Hartman[ Upstream commit 5dc8cdce1d722c733f8c7af14c5fb595cfedbfa8 ]
FullMAC STAs have no way to update bss channel after CSA channel switch completion. As a result, user-space tools may provide inconsistent channel info. For instance, consider the following two commands:
$ sudo iw dev wlan0 link $ sudo iw dev wlan0 info The latter command gets channel info from the hardware, so most probably its output will be correct. However the former command gets channel info from scan cache, so its output will contain outdated channel info. In fact, current bss channel info will not be updated until the next [re-]connect.
Note that mac80211 STAs have a workaround for this, but it requires access to internal cfg80211 data, see ieee80211_chswitch_work:
/* XXX: shouldn't really modify cfg80211-owned data! */ ifmgd->associated->channel = sdata->csa_chandef.chan;
This patch suggests to convert mac80211 workaround into cfg80211 behavior and to update current bss channel in cfg80211_ch_switch_notify.
--- net/mac80211/mlme.c | 3 --- net/wireless/nl80211.c | 5 +++++ 2 files changed, 5 insertions(+), 3 deletions(-)
net/mac80211/mlme.c +0 -3
@@ -1167,9 +1167,6 @@ static void ieee80211_chswitch_work(struct work_struct *work) goto out; } -/* XXX: shouldn't really modify cfg80211-owned data! */ - ifmgd->associated->channel = sdata->csa_chandef.chan; - ifmgd->csa_waiting_bcn = true;ieee80211_sta_reset_beacon_monitor (sdata);
net/wireless/nl80211.c +5 -0
@@ -15667,6 +15667,11 @@ void cfg80211_ch_switch_notify(struct net_device *dev, wdev->chandef = *chandef; wdev->preset_chandef = *chandef; + +if (wdev->iftype ==NL80211_IFTYPE_STATION && + !WARN_ON (!wdev->current_bss)) + wdev->current_bss->pub.channel = chandef->chan; +nl80211_ch_switch_notify (rdev, dev, chandef,GFP_KERNEL ,NL80211_CMD_CH_SWITCH_NOTIFY ,0 ); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 105/346 libbpf: fix samples/bpf build failure due to undefined UINT32_MAX
In reply to Greg Kroah-Hartman[ Upstream commit 32e621e55496a0009f44fe4914cd4a23cade4984 ]
Currently, building bpf samples will cause the following error.
./tools/lib/bpf/bpf.h:132:27: error: 'UINT32_MAX' undeclared here (not in a function) ..
#define BPF_LOG_BUF_SIZE (UINT32_MAX >> 8) /* verifier maximum in kernels <= 5.1 */
^
./samples/bpf/bpf_load.h:31:25: note: in expansion of macro 'BPF_LOG_BUF_SIZE'
extern char bpf_log_buf[BPF_LOG_BUF_SIZE];
^~~~~~~~~~~~~~~~Due to commit 4519efa6f8ea ("libbpf: fix BPF_LOG_BUF_SIZE off-by-one error") hard-coded size of BPF_LOG_BUF_SIZE has been replaced with UINT32_MAX which is defined in <stdint.h> header.
Even with this change, bpf selftests are running fine since these are built with clang and it includes header(-idirafter) from clang/6.0.0/include. (it has <stdint.h>)
clang -I. -I./include/uapi -I../../../include/uapi -idirafter /usr/local/include -idirafter /usr/include \
-idirafter /usr/lib/llvm-6.0/lib/clang/6.0.0/include -idirafter /usr/include/x86_64-linux-gnu \
-Wno-compare-distinct-pointer-types -O2 -target bpf -emit-llvm -c progs/test_sysctl_prog.c -o - | \
llc -march=bpf -mcpu=generic -filetype=obj -o /linux/tools/testing/selftests/bpf/test_sysctl_prog.oBut bpf samples are compiled with GCC, and it only searches and includes headers declared at the target file. As '#include <stdint.h>' hasn't been declared in tools/lib/bpf/bpf.h, it causes build failure of bpf samples.
gcc -Wp,-MD,./samples/bpf/.sockex3_user.o.d -Wall -Wmissing-prototypes -Wstrict-prototypes \
-O2 -fomit-frame-pointer -std=gnu89 -I./usr/include -I./tools/lib/ -I./tools/testing/selftests/bpf/ \
-I./tools/ lib/ -I./tools/include -I./tools/perf -c -o ./samples/bpf/sockex3_user.o ./samples/bpf/sockex3_user.c;This commit add declaration of '#include <stdint.h>' to tools/lib/bpf/bpf.h to fix this problem.
--- tools/lib/bpf/bpf.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/bpf/bpf.h +1 -0
@@ -26,6 +26,7 @@#include <linux/bpf.h> #include <stdbool.h> #include <stddef.h> +#include <stdint.h> #ifdef __cplusplusextern "C" {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 106/346 slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register
In reply to Greg Kroah-Hartman[ Upstream commit 06d5d6b7f9948a89543e1160ef852d57892c750d ]
In case platform_device_alloc fails, the fix returns an error code to avoid the NULL pointer dereference.
--- drivers/slimbus/qcom-ngd-ctrl.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/slimbus/qcom-ngd-ctrl.c +4 -0
@@ -1342,6 +1342,10 @@ static int of_qcom_slim_ngd_register(struct device *parent,return -ENOMEM ; ngd->pdev =platform_device_alloc (QCOM_SLIM_NGD_DRV_NAME , id); +if (!ngd->pdev) { +kfree (ngd); +return -ENOMEM ; + } ngd->id = id; ngd->pdev->dev.parent = parent; ngd->pdev->driver_override =QCOM_SLIM_NGD_DRV_NAME ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 107/346 ASoC: fsl_sai: Update is_slave_mode with correct value
In reply to Greg Kroah-Hartman[ Upstream commit ddb351145a967ee791a0fb0156852ec2fcb746ba ]
is_slave_mode defaults to false because sai structure that contains it is kzalloc'ed.
Anyhow, if we decide to set the following configuration SAI slave -> SAI master, is_slave_mode will remain set on true although SAI being master it should be set to false.
Fix this by updating is_slave_mode for each call of fsl_sai_set_dai_fmt.
--- sound/soc/fsl/fsl_sai.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/fsl/fsl_sai.c +2 -0
@@ -268,12 +268,14 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,case SND_SOC_DAIFMT_CBS_CFS : val_cr2 |=FSL_SAI_CR2_BCD_MSTR ; val_cr4 |=FSL_SAI_CR4_FSD_MSTR ; + sai->is_slave_mode = false;break ;case SND_SOC_DAIFMT_CBM_CFM : sai->is_slave_mode = true;break ;case SND_SOC_DAIFMT_CBS_CFM : val_cr2 |=FSL_SAI_CR2_BCD_MSTR ; + sai->is_slave_mode = false;break ;case SND_SOC_DAIFMT_CBM_CFS : val_cr4 |=FSL_SAI_CR4_FSD_MSTR ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 108/346 Fix nfs4.2 return -EINVAL when do dedupe operation
In reply to Greg Kroah-Hartman[ Upstream commit ce96e888fe48ecfa868c9a39adc03292c78a80ff ]
dedupe_file_range operations is combiled into remap_file_range. But in nfs42_remap_file_range, it's skiped for dedupe operations. Before this patch:
# dd if=/dev/zero of=nfs/file bs=1M count=1 # xfs_io -c "dedupe nfs/file 4k 64k 4k" nfs/file XFS_IOC_FILE_EXTENT_SAME: Invalid argument After this patch: # dd if=/dev/zero of=nfs/file bs=1M count=1 # xfs_io -c "dedupe nfs/file 4k 64k 4k" nfs/file deduped 4096/4096 bytes at offset 65536 4 KiB, 1 ops; 0.0046 sec (865.988 KiB/sec and 216.4971 ops/sec)
--- fs/nfs/nfs4file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs4file.c +1 -1
@@ -187,7 +187,7 @@ static loff_t nfs42_remap_file_range(struct file *src_file, loff_t src_off,bool same_inode = false;int ret; -if (remap_flags & ~REMAP_FILE_ADVISORY ) +if (remap_flags & ~(REMAP_FILE_DEDUP |REMAP_FILE_ADVISORY ))return -EINVAL ;/* check alignment w.r.t. clone_blksize */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 109/346 mwifiex: prevent an array overflow
In reply to Greg Kroah-Hartman[ Upstream commit b4c35c17227fe437ded17ce683a6927845f8c4a4 ]
The "rate_index" is only used as an index into the phist_data->rx_rate[] array in the mwifiex_hist_data_set() function. That array has MWIFIEX_MAX_AC_RX_RATES (74) elements and it's used to generate some debugfs information. The "rate_index" variable comes from the network skb->data[] and it is a u8 so it's in the 0-255 range. We need to cap it to prevent an array overflow.
--- drivers/net/wireless/marvell/mwifiex/cfp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/marvell/mwifiex/cfp.c +3 -0
@@ -531,5 +531,8 @@ u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv, rate_index = (rx_rate >MWIFIEX_RATE_INDEX_OFDM0 ) ? rx_rate -1 : rx_rate; +if (rate_index >=MWIFIEX_MAX_AC_RX_RATES ) + rate_index =MWIFIEX_MAX_AC_RX_RATES -1 ; +return rate_index; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 110/346 rsi: Fix NULL pointer dereference in kmalloc
In reply to Greg Kroah-Hartman[ Upstream commit d5414c2355b20ea8201156d2e874265f1cb0d775 ]
kmalloc can fail in rsi_register_rates_channels but memcpy still attempts to write to channels. The patch replaces these calls with kmemdup and passes the error upstream.
--- drivers/net/wireless/rsi/rsi_91x_mac80211.c | 30 ++++++++++++--------- 1 file changed, 18 insertions(+), 12 deletions(-)
drivers/net/wireless/rsi/rsi_91x_mac80211.c +18 -12
@@ -188,27 +188,27 @@ bool rsi_is_cipher_wep(struct rsi_common *common)* @adapter: Pointer to the adapter structure. * @band: Operating band to be set. * -* Return: None. +* Return: int - 0 on success, negative error on failure. */ -static void rsi_register_rates_channels (struct rsi_hw *adapter,int band) +static int rsi_register_rates_channels (struct rsi_hw *adapter,int band) {struct ieee80211_supported_band *sbands = &adapter->sbands[band];void *channels =NULL ;if (band ==NL80211_BAND_2GHZ ) { - channels =kmalloc (sizeof (rsi_2ghz_channels),GFP_KERNEL ); -memcpy (channels, - rsi_2ghz_channels, -sizeof (rsi_2ghz_channels)); + channels =kmemdup (rsi_2ghz_channels,sizeof (rsi_2ghz_channels), +GFP_KERNEL ); +if (!channels) +return -ENOMEM ; sbands->band =NL80211_BAND_2GHZ ; sbands->n_channels =ARRAY_SIZE (rsi_2ghz_channels); sbands->bitrates = rsi_rates; sbands->n_bitrates =ARRAY_SIZE (rsi_rates); }else { - channels =kmalloc (sizeof (rsi_5ghz_channels),GFP_KERNEL ); -memcpy (channels, - rsi_5ghz_channels, -sizeof (rsi_5ghz_channels)); + channels =kmemdup (rsi_5ghz_channels,sizeof (rsi_5ghz_channels), +GFP_KERNEL ); +if (!channels) +return -ENOMEM ; sbands->band =NL80211_BAND_5GHZ ; sbands->n_channels =ARRAY_SIZE (rsi_5ghz_channels); sbands->bitrates = &rsi_rates[4 ];
@@ -227,6 +227,7 @@ static void rsi_register_rates_channels(struct rsi_hw *adapter, int band) sbands->ht_cap.mcs.rx_mask[0 ] =0xff ; sbands->ht_cap.mcs.tx_params =IEEE80211_HT_MCS_TX_DEFINED ;/* sbands->ht_cap.mcs.rx_highest = 0x82; */ +return 0 ; }/**
@@ -1985,11 +1986,16 @@ int rsi_mac80211_attach(struct rsi_common *common) wiphy->available_antennas_rx =1 ; wiphy->available_antennas_tx =1 ; -rsi_register_rates_channels (adapter,NL80211_BAND_2GHZ ); + status =rsi_register_rates_channels (adapter,NL80211_BAND_2GHZ ); +if (status) +return status; wiphy->bands[NL80211_BAND_2GHZ ] = &adapter->sbands[NL80211_BAND_2GHZ ];if (common->num_supp_bands >1 ) { -rsi_register_rates_channels (adapter,NL80211_BAND_5GHZ ); + status =rsi_register_rates_channels (adapter, +NL80211_BAND_5GHZ ); +if (status) +return status; wiphy->bands[NL80211_BAND_5GHZ ] = &adapter->sbands[NL80211_BAND_5GHZ ]; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 111/346 net: cw1200: fix a NULL pointer dereference
In reply to Greg Kroah-Hartman[ Upstream commit 0ed2a005347400500a39ea7c7318f1fea57fb3ca ]
In case create_singlethread_workqueue fails, the fix free the hardware and returns NULL to avoid NULL pointer dereference.
--- drivers/net/wireless/st/cw1200/main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/st/cw1200/main.c +5 -0
@@ -345,6 +345,11 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,mutex_init (&priv->wsm_cmd_mux);mutex_init (&priv->conf_mutex); priv->workqueue =create_singlethread_workqueue ("cw1200_wq" ); +if (!priv->workqueue) { +ieee80211_free_hw (hw); +return NULL ; + } +sema_init (&priv->scan.lock,1 );INIT_WORK (&priv->scan.work, cw1200_scan_work);INIT_DELAYED_WORK (&priv->scan.probe_work, cw1200_probe_work);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 112/346 nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE
In reply to Greg Kroah-Hartman[ Upstream commit 01fa017484ad98fccdeaab32db0077c574b6bd6f ]
If our target exposed a namespace with a block size that is greater than PAGE_SIZE, set 0 capacity on the namespace as we do not support it.
This issue encountered when the nvmet namespace was backed by a tempfile.
--- drivers/nvme/host/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +6 -1
@@ -1551,6 +1551,10 @@ static void nvme_update_disk_info(struct gendisk *disk,sector_t capacity =le64_to_cpup (&id->nsze) << (ns->lba_shift -9 );unsigned short bs =1 << ns->lba_shift; +if (ns->lba_shift >PAGE_SHIFT ) { +/* unsupported block size, set capacity to 0 later */ + bs = (1 <<9 ); + }blk_mq_freeze_queue (disk->queue);blk_integrity_unregister (disk);
@@ -1561,7 +1565,8 @@ static void nvme_update_disk_info(struct gendisk *disk,if (ns->ms && !ns->ext && (ns->ctrl->ops->flags &NVME_F_METADATA_SUPPORTED ))nvme_init_integrity (disk, ns->ms, ns->pi_type); -if (ns->ms && !nvme_ns_has_pi (ns) && !blk_get_integrity (disk)) +if ((ns->ms && !nvme_ns_has_pi (ns) && !blk_get_integrity (disk)) || + ns->lba_shift >PAGE_SHIFT ) capacity =0 ;set_capacity (disk, capacity);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 113/346 nvme-rdma: fix a NULL deref when an admin connect times out
In reply to Greg Kroah-Hartman[ Upstream commit 1007709d7d06fab09bf2d007657575958676282b ]
If we timeout the admin startup sequence we might not yet have an I/O tagset allocated which causes the teardown sequence to crash. Make nvme_tcp_teardown_io_queues safe by not iterating inflight tags if the tagset wasn't allocated.
--- drivers/nvme/host/rdma.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/nvme/host/rdma.c +6 -4
@@ -922,8 +922,9 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl, {blk_mq_quiesce_queue (ctrl->ctrl.admin_q);nvme_rdma_stop_queue (&ctrl->queues[0 ]); -blk_mq_tagset_busy_iter (&ctrl->admin_tag_set, nvme_cancel_request, - &ctrl->ctrl); +if (ctrl->ctrl.admin_tagset) +blk_mq_tagset_busy_iter (ctrl->ctrl.admin_tagset, + nvme_cancel_request, &ctrl->ctrl);blk_mq_unquiesce_queue (ctrl->ctrl.admin_q);nvme_rdma_destroy_admin_queue (ctrl, remove); }
@@ -934,8 +935,9 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,if (ctrl->ctrl.queue_count >1 ) {nvme_stop_queues (&ctrl->ctrl);nvme_rdma_stop_io_queues (ctrl); -blk_mq_tagset_busy_iter (&ctrl->tag_set, nvme_cancel_request, - &ctrl->ctrl); +if (ctrl->ctrl.tagset) +blk_mq_tagset_busy_iter (ctrl->ctrl.tagset, + nvme_cancel_request, &ctrl->ctrl);if (remove)nvme_start_queues (&ctrl->ctrl);nvme_rdma_destroy_io_queues (ctrl, remove);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 114/346 nvme-tcp: fix a NULL deref when an admin connect times out
In reply to Greg Kroah-Hartman[ Upstream commit 7a42589654ae79e1177f0d74306a02d6cef7bddf ]
If we timeout the admin startup sequence we might not yet have an I/O tagset allocated which causes the teardown sequence to crash. Make nvme_tcp_teardown_io_queues safe by not iterating inflight tags if the tagset wasn't allocated.
--- drivers/nvme/host/tcp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/nvme/host/tcp.c +6 -2
@@ -1686,7 +1686,9 @@ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl, {blk_mq_quiesce_queue (ctrl->admin_q);nvme_tcp_stop_queue (ctrl,0 ); -blk_mq_tagset_busy_iter (ctrl->admin_tagset, nvme_cancel_request, ctrl); +if (ctrl->admin_tagset) +blk_mq_tagset_busy_iter (ctrl->admin_tagset, + nvme_cancel_request, ctrl);blk_mq_unquiesce_queue (ctrl->admin_q);nvme_tcp_destroy_admin_queue (ctrl, remove); }
@@ -1698,7 +1700,9 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,return ;nvme_stop_queues (ctrl);nvme_tcp_stop_io_queues (ctrl); -blk_mq_tagset_busy_iter (ctrl->tagset, nvme_cancel_request, ctrl); +if (ctrl->tagset) +blk_mq_tagset_busy_iter (ctrl->tagset, + nvme_cancel_request, ctrl);if (remove)nvme_start_queues (ctrl);nvme_tcp_destroy_io_queues (ctrl, remove);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 115/346 crypto: sun4i-ss - Fix invalid calculation of hash end
In reply to Greg Kroah-Hartman[ Upstream commit f87391558acf816b48f325a493d81d45dec40da0 ]
When nbytes < 4, end is wronlgy set to a negative value which, due to uint, is then interpreted to a large value leading to a deadlock in the following code.
This patch fix this problem.
--- drivers/crypto/sunxi-ss/sun4i-ss-hash.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/sunxi-ss/sun4i-ss-hash.c +4 -1
@@ -240,7 +240,10 @@ static int sun4i_hash(struct ahash_request *areq) } }else {/* Since we have the flag final, we can go up to modulo 4 */ - end = ((areq->nbytes + op->len) /4 ) *4 - op->len; +if (areq->nbytes <4 ) + end =0 ; +else + end = ((areq->nbytes + op->len) /4 ) *4 - op->len; }/* TODO if SGlen % 4 and !op->len then DMA */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 116/346 bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set
In reply to Greg Kroah-Hartman[ Upstream commit 95f18c9d1310730d075499a75aaf13bcd60405a7 ]
In the CACHE_SYNC branch of run_cache_set(), LIST_HEAD(journal) is used to collect journal_replay(s) and filled by bch_journal_read().
If all goes well, bch_journal_replay() will release the list of jounal_replay(s) at the end of the branch.
If something goes wrong, code flow will jump to the label "err:" and leave the list unreleased.
This patch will release the list of journal_replay(s) in the case of error detected.
v1 -> v2:
* Move the release code to the location after label 'err:' to simply the change.
--- drivers/md/bcache/super.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/md/bcache/super.c +8 -0
@@ -1782,6 +1782,8 @@ static void run_cache_set(struct cache_set *c)struct cache *ca;struct closure cl;unsigned int i; +LIST_HEAD (journal); +struct journal_replay *l;closure_init_stack (&cl);
@@ -1939,6 +1941,12 @@ static void run_cache_set(struct cache_set *c)set_bit (CACHE_SET_RUNNING , &c->flags);return ; err: +while (!list_empty (&journal)) { + l = list_first_entry(&journal, struct journal_replay, list); +list_del (&l->list); +kfree (l); + } +closure_sync (&cl);/* XXX: test this, it's broken */ bch_cache_set_error (c,"%s" , err);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 117/346 bcache: return error immediately in bch_journal_replay()
In reply to Greg Kroah-Hartman[ Upstream commit 68d10e6979a3b59e3cd2e90bfcafed79c4cf180a ]
When failure happens inside bch_journal_replay(), calling cache_set_err_on() and handling the failure in async way is not a good idea. Because after bch_journal_replay() returns, registering code will continue to execute following steps, and unregistering code triggered by cache_set_err_on() is running in same time. First it is unnecessary to handle failure and unregister cache set in an async way, second there might be potential race condition to run register and unregister code for same cache set.
So in this patch, if failure happens in bch_journal_replay(), we don't call cache_set_err_on(), and just print out the same error message to kernel message buffer, then return -EIO immediately caller. Then caller can detect such failure and handle it in synchrnozied way.
--- drivers/md/bcache/journal.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/md/bcache/journal.c +6 -3
@@ -330,9 +330,12 @@ int bch_journal_replay(struct cache_set *s, struct list_head *list)list_for_each_entry (i, list, list) {BUG_ON (i->pin &&atomic_read (i->pin) !=1 ); -cache_set_err_on (n != i->j.seq, s, -"bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)" , - n, i->j.seq -1 , start, end); +if (n != i->j.seq) { +pr_err ("bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)" , + n, i->j.seq -1 , start, end); + ret = -EIO ; + goto err; + } for (k = i->j.start; k < bset_bkey_last(&i->j);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 118/346 bcache: fix failure in journal relplay
In reply to Greg Kroah-Hartman[ Upstream commit 631207314d88e9091be02fbdd1fdadb1ae2ed79a ]
journal replay failed with messages:
Sep 10 19:10:43 ceph kernel: bcache: error on
bb379a64-e44e-4812-b91d-a5599871a3b1: bcache: journal entries 2057493-2057567 missing! (replaying 2057493-2076601), disabling caching
The reason is in journal_reclaim(), when discard is enabled, we send discard command and reclaim those journal buckets whose seq is old than the last_seq_now, but before we write a journal with last_seq_now, the machine is restarted, so the journal with the last_seq_now is not written to the journal bucket, and the last_seq_wrote in the newest journal is old than last_seq_now which we expect to be, so when we doing replay, journals from last_seq_wrote to last_seq_now are missing.
It's hard to write a journal immediately after journal_reclaim(), and it harmless if those missed journal are caused by discarding since those journals are already wrote to btree node. So, if miss seqs are started from the beginning journal, we treat it as normal, and only print a message to show the miss journal, and point out it maybe caused by discarding.
Patch v2 add a judgement condition to ignore the missed journal only when discard enabled as Coly suggested.
(Coly Li: rebase the patch with other changes in bch_journal_replay())
--- drivers/md/bcache/journal.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
drivers/md/bcache/journal.c +21 -4
@@ -317,6 +317,18 @@ void bch_journal_mark(struct cache_set *c, struct list_head *list) } } +bool is_discard_enabled (struct cache_set *s) +{ +struct cache *ca; +unsigned int i; + +for_each_cache (ca, s, i) +if (ca->discard) +return true; + +return false; +} +int bch_journal_replay (struct cache_set *s,struct list_head *list) {int ret =0 , keys =0 , entries =0 ;
@@ -331,10 +343,15 @@ int bch_journal_replay(struct cache_set *s, struct list_head *list)BUG_ON (i->pin &&atomic_read (i->pin) !=1 );if (n != i->j.seq) { -pr_err ("bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)" , - n, i->j.seq -1 , start, end); - ret = -EIO ; - goto err; +if (n == start &&is_discard_enabled (s)) +pr_info ("bcache: journal entries %llu-%llu may be discarded! (replaying %llu-%llu)" , + n, i->j.seq -1 , start, end); +else { +pr_err ("bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)" , + n, i->j.seq -1 , start, end); + ret = -EIO ; + goto err; + } } for (k = i->j.start;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 119/346 bcache: add failure check to run_cache_set() for journal replay
In reply to Greg Kroah-Hartman[ Upstream commit ce3e4cfb59cb382f8e5ce359238aa580d4ae7778 ]
Currently run_cache_set() has no return value, if there is failure in bch_journal_replay(), the caller of run_cache_set() has no idea about such failure and just continue to execute following code after run_cache_set(). The internal failure is triggered inside bch_journal_replay() and being handled in async way. This behavior is inefficient, while failure handling inside bch_journal_replay(), cache register code is still running to start the cache set. Registering and unregistering code running as same time may introduce some rare race condition, and make the code to be more hard to be understood.
This patch adds return value to run_cache_set(), and returns -EIO if bch_journal_rreplay() fails. Then caller of run_cache_set() may detect such failure and stop registering code flow immedidately inside register_cache_set().
If journal replay fails, run_cache_set() can report error immediately to register_cache_set(). This patch makes the failure handling for bch_journal_replay() be in synchronized way, easier to understand and debug, and avoid poetential race condition for register-and-unregister in same time.
--- drivers/md/bcache/super.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/md/bcache/super.c +12 -5
@@ -1775,7 +1775,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)return NULL ; } -static void run_cache_set (struct cache_set *c) +static int run_cache_set (struct cache_set *c) {const char *err ="cannot allocate memory" ;struct cached_dev *dc, *t;
@@ -1871,7 +1871,9 @@ static void run_cache_set(struct cache_set *c)if (j->version <BCACHE_JSET_VERSION_UUID )__uuid_write (c); -bch_journal_replay (c, &journal); + err ="bcache: replay journal failed" ; +if (bch_journal_replay (c, &journal)) + goto err; }else {pr_notice ("invalidating existing data" );
@@ -1939,7 +1941,7 @@ static void run_cache_set(struct cache_set *c)flash_devs_run (c);set_bit (CACHE_SET_RUNNING , &c->flags); -return ; +return 0 ; err:while (!list_empty (&journal)) { l = list_first_entry(&journal, struct journal_replay, list);
@@ -1950,6 +1952,8 @@ static void run_cache_set(struct cache_set *c)closure_sync (&cl);/* XXX: test this, it's broken */ bch_cache_set_error (c,"%s" , err); + +return -EIO ; }static bool can_attach_cache (struct cache *ca,struct cache_set *c)
@@ -2013,8 +2017,11 @@ static const char *register_cache_set(struct cache *ca) ca->set->cache[ca->sb.nr_this_dev] = ca; c->cache_by_alloc[c->caches_loaded++] = ca; -if (c->caches_loaded == c->sb.nr_in_set) -run_cache_set (c); +if (c->caches_loaded == c->sb.nr_in_set) { + err ="failed to run cache set" ; +if (run_cache_set (c) <0 ) + goto err; + }return NULL ; err:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 120/346 bcache: avoid clang -Wunintialized warning
In reply to Greg Kroah-Hartman[ Upstream commit 78d4eb8ad9e1d413449d1b7a060f50b6efa81ebd ]
clang has identified a code path in which it thinks a variable may be unused:
drivers/md/bcache/alloc.c:333:4: error: variable 'bucket' is used uninitialized whenever 'if' condition is false
[-Werror,-Wsometimes-uninitialized]
fifo_pop(&ca->free_inc, bucket);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/md/bcache/util.h:219:27: note: expanded from macro 'fifo_pop'
#define fifo_pop(fifo, i) fifo_pop_front(fifo, (i))
^~~~~~~~~~~~~~~~~~~~~~~~~
drivers/md/bcache/util.h:189:6: note: expanded from macro 'fifo_pop_front'
if (_r) { \
^~
drivers/md/bcache/alloc.c:343:46: note: uninitialized use occurs here
allocator_wait(ca, bch_allocator_push(ca, bucket));
^~~~~~
drivers/md/bcache/alloc.c:287:7: note: expanded from macro 'allocator_wait'
if (cond) \
^~~~
drivers/md/bcache/alloc.c:333:4: note: remove the 'if' if its condition is always true
fifo_pop(&ca->free_inc, bucket);
^
drivers/md/bcache/util.h:219:27: note: expanded from macro 'fifo_pop'
#define fifo_pop(fifo, i) fifo_pop_front(fifo, (i))
^
drivers/md/bcache/util.h:189:2: note: expanded from macro 'fifo_pop_front'
if (_r) { \
^
drivers/md/bcache/alloc.c:331:15: note: initialize the variable 'bucket' to silence this warning
long bucket;
^This cannot happen in practice because we only enter the loop if there is at least one element in the list.
Slightly rearranging the code makes this clearer to both the reader and the compiler, which avoids the warning.
--- drivers/md/bcache/alloc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/md/bcache/alloc.c +3 -2
@@ -327,10 +327,11 @@ static int bch_allocator_thread(void *arg)* possibly issue discards to them, then we add the bucket to * the free list: */ -while (!fifo_empty (&ca->free_inc)) { +while (1 ) {long bucket; -fifo_pop (&ca->free_inc, bucket); +if (!fifo_pop (&ca->free_inc, bucket)) +break ;if (ca->discard) {mutex_unlock (&ca->set->bucket_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 121/346 RDMA/cma: Consider scope_id while binding to ipv6 ll address
In reply to Greg Kroah-Hartman[ Upstream commit 5d7ed2f27bbd482fd29e6b2e204b1a1ee8a0b268 ]
When two netdev have same link local addresses (such as vlan and non vlan), two rdma cm listen id should be able to bind to following different addresses.
listener-1: addr=lla, scope_id=A, port=X
listener-2: addr=lla, scope_id=B, port=X
However while comparing the addresses only addr and port are considered, due to which 2nd listener fails to listen.
In below example of two listeners, 2nd listener is failing with address in use error.
$ rping -sv -a fe80::268a:7ff:feb3:d113%ens2f1 -p 4545&
$ rping -sv -a fe80::268a:7ff:feb3:d113%ens2f1.200 -p 4545 rdma_bind_addr: Address already in use
To overcome this, consider the scope_ids as well which forms the accurate IPv6 link local address.
--- drivers/infiniband/core/cma.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/infiniband/core/cma.c +19 -6
@@ -1170,18 +1170,31 @@ static inline bool cma_any_addr(const struct sockaddr *addr)return cma_zero_addr (addr) ||cma_loopback_addr (addr); } -static int cma_addr_cmp (struct sockaddr *src,struct sockaddr *dst) +static int cma_addr_cmp (const struct sockaddr *src,const struct sockaddr *dst) {if (src->sa_family != dst->sa_family)return -1 ;switch (src->sa_family) {case AF_INET : -return ((struct sockaddr_in *) src)->sin_addr.s_addr != - ((struct sockaddr_in *) dst)->sin_addr.s_addr; -case AF_INET6 : -return ipv6_addr_cmp (&((struct sockaddr_in6 *) src)->sin6_addr, - &((struct sockaddr_in6 *) dst)->sin6_addr); +return ((struct sockaddr_in *)src)->sin_addr.s_addr != + ((struct sockaddr_in *)dst)->sin_addr.s_addr; +case AF_INET6 : { +struct sockaddr_in6 *src_addr6 = (struct sockaddr_in6 *)src; +struct sockaddr_in6 *dst_addr6 = (struct sockaddr_in6 *)dst; +bool link_local; + +if (ipv6_addr_cmp (&src_addr6->sin6_addr, + &dst_addr6->sin6_addr)) +return 1 ; + link_local =ipv6_addr_type (&dst_addr6->sin6_addr) & +IPV6_ADDR_LINKLOCAL ; +/* Link local must match their scope_ids */ +return link_local ? (src_addr6->sin6_scope_id != + dst_addr6->sin6_scope_id) : +0 ; + } +default :return ib_addr_cmp (&((struct sockaddr_ib *) src)->sib_addr, &((struct sockaddr_ib *) dst)->sib_addr);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 122/346 vfio-ccw: Do not call flush_workqueue while holding the spinlock
In reply to Greg Kroah-Hartman[ Upstream commit cea5dde42a83b5f0a039da672f8686455936b8d8 ]
Currently we call flush_workqueue while holding the subchannel spinlock. But flush_workqueue function can go to sleep, so do not call the function while holding the spinlock.
Fixes the following bug:
[ 285.203430] BUG: scheduling while atomic: bash/14193/0x00000002 [ 285.203434] INFO: lockdep is turned off. .... [ 285.203485] Preemption disabled at: [ 285.203488] [<000003ff80243e5c>] vfio_ccw_sch_quiesce+0xbc/0x120 [vfio_ccw] [ 285.203496] CPU: 7 PID: 14193 Comm: bash Tainted: G W .... [ 285.203504] Call Trace: [ 285.203510] ([<0000000000113772>] show_stack+0x82/0xd0) [ 285.203514] [<0000000000b7a102>] dump_stack+0x92/0xd0 [ 285.203518] [<000000000017b8be>] __schedule_bug+0xde/0xf8 [ 285.203524] [<0000000000b95b5a>] __schedule+0x7a/0xc38 [ 285.203528] [<0000000000b9678a>] schedule+0x72/0xb0 [ 285.203533] [<0000000000b9bfbc>] schedule_timeout+0x34/0x528 [ 285.203538] [<0000000000b97608>] wait_for_common+0x118/0x1b0 [ 285.203544] [<0000000000166d6a>] flush_workqueue+0x182/0x548 [ 285.203550] [<000003ff80243e6e>] vfio_ccw_sch_quiesce+0xce/0x120 [vfio_ccw] [ 285.203556] [<000003ff80245278>] vfio_ccw_mdev_reset+0x38/0x70 [vfio_ccw] [ 285.203562] [<000003ff802458b0>] vfio_ccw_mdev_remove+0x40/0x78 [vfio_ccw] [ 285.203567] [<000003ff801a499c>] mdev_device_remove_ops+0x3c/0x80 [mdev] [ 285.203573] [<000003ff801a4d5c>] mdev_device_remove+0xc4/0x130 [mdev] [ 285.203578] [<000003ff801a5074>] remove_store+0x6c/0xa8 [mdev] [ 285.203582] [<000000000046f494>] kernfs_fop_write+0x14c/0x1f8 [ 285.203588] [<00000000003c1530>] __vfs_write+0x38/0x1a8 [ 285.203593] [<00000000003c187c>] vfs_write+0xb4/0x198 [ 285.203597] [<00000000003c1af2>] ksys_write+0x5a/0xb0 [ 285.203601] [<0000000000b9e270>] system_call+0xdc/0x2d8
Message-Id: <626bab8bb2958ae132452e1ddaf1b20882ad5a9d.1554756534.git.alifm@linux.ibm.com>
--- drivers/s390/cio/vfio_ccw_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/cio/vfio_ccw_drv.c +1 -1
@@ -54,9 +54,9 @@ int vfio_ccw_sch_quiesce(struct subchannel *sch)wait_for_completion_timeout (&completion,3 *HZ ); -spin_lock_irq (sch->lock); private->completion =NULL ;flush_workqueue (vfio_ccw_work_q); +spin_lock_irq (sch->lock); ret =cio_cancel_halt_clear (sch, &iretry); };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 123/346 vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev
In reply to Greg Kroah-Hartman[ Upstream commit b49bdc8602b7c9c7a977758bee4125683f73e59f ]
When releasing the vfio-ccw mdev, we currently do not release any existing channel program and its pinned pages. This can lead to the following warning:
[1038876.561565] WARNING: CPU: 2 PID: 144727 at drivers/vfio/vfio_iommu_type1.c:1494 vfio_sanity_check_pfn_list+0x40/0x70 [vfio_iommu_type1]
....
1038876.561921] Call Trace:
[1038876.561935] ([<00000009897fb870>] 0x9897fb870)
[1038876.561949] [<000003ff8013bf62>] vfio_iommu_type1_detach_group+0xda/0x2f0 [vfio_iommu_type1]
[1038876.561965] [<000003ff8007b634>] __vfio_group_unset_container+0x64/0x190 [vfio]
[1038876.561978] [<000003ff8007b87e>] vfio_group_put_external_user+0x26/0x38 [vfio]
[1038876.562024] [<000003ff806fc608>] kvm_vfio_group_put_external_user+0x40/0x60 [kvm]
[1038876.562045] [<000003ff806fcb9e>] kvm_vfio_destroy+0x5e/0xd0 [kvm]
[1038876.562065] [<000003ff806f63fc>] kvm_put_kvm+0x2a4/0x3d0 [kvm]
[1038876.562083] [<000003ff806f655e>] kvm_vm_release+0x36/0x48 [kvm]
[1038876.562098] [<00000000003c2dc4>] __fput+0x144/0x228
[1038876.562113] [<000000000016ee82>] task_work_run+0x8a/0xd8
[1038876.562125] [<000000000014c7a8>] do_exit+0x5d8/0xd90
[1038876.562140] [<000000000014d084>] do_group_exit+0xc4/0xc8
[1038876.562155] [<000000000015c046>] get_signal+0x9ae/0xa68
[1038876.562169] [<0000000000108d66>] do_signal+0x66/0x768
[1038876.562185] [<0000000000b9e37e>] system_call+0x1ea/0x2d8
[1038876.562195] 2 locks held by qemu-system-s39/144727:
[1038876.562205] #0: 00000000537abaf9 (&container->group_lock){++++}, at: __vfio_group_unset_container+0x3c/0x190 [vfio]
[1038876.562230] #1: 00000000670008b5 (&iommu->lock){+.+.}, at: vfio_iommu_type1_detach_group+0x36/0x2f0 [vfio_iommu_type1]
[1038876.562250] Last Breaking-Event-Address:
[1038876.562262] [<000003ff8013aa24>] vfio_sanity_check_pfn_list+0x3c/0x70 [vfio_iommu_type1]
[1038876.562272] irq event stamp: 4236481
[1038876.562287] hardirqs last enabled at (4236489): [<00000000001cee7a>] console_unlock+0x6d2/0x740
[1038876.562299] hardirqs last disabled at (4236496): [<00000000001ce87e>] console_unlock+0xd6/0x740
[1038876.562311] softirqs last enabled at (4234162): [<0000000000b9fa1e>] __do_softirq+0x556/0x598
[1038876.562325] softirqs last disabled at (4234153): [<000000000014e4cc>] irq_exit+0xac/0x108
[1038876.562337] ---[ end trace 6c96d467b1c3ca06 ]---Similarly we do not free the channel program when we are removing the vfio-ccw device. Let's fix this by resetting the device and freeing the channel program and pinned pages in the release path. For the remove path we can just quiesce the device, since in the remove path the mediated device is going away for good and so we don't need to do a full reset.
Message-Id: <ae9f20dc8873f2027f7b3c5d2aaa0bdfe06850b8.1554756534.git.alifm@linux.ibm.com>
--- drivers/s390/cio/vfio_ccw_ops.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/s390/cio/vfio_ccw_ops.c +10 -1
@@ -130,11 +130,12 @@ static int vfio_ccw_mdev_remove(struct mdev_device *mdev)if ((private->state !=VFIO_CCW_STATE_NOT_OPER ) && (private->state !=VFIO_CCW_STATE_STANDBY )) { -if (!vfio_ccw_mdev_reset (mdev)) +if (!vfio_ccw_sch_quiesce (private->sch)) private->state =VFIO_CCW_STATE_STANDBY ;/* The state will be NOT_OPER on error. */ } +cp_free (&private->cp); private->mdev =NULL ;atomic_inc (&private->avail);
@@ -158,6 +159,14 @@ static void vfio_ccw_mdev_release(struct mdev_device *mdev)struct vfio_ccw_private *private =dev_get_drvdata (mdev_parent_dev (mdev)); +if ((private->state !=VFIO_CCW_STATE_NOT_OPER ) && + (private->state !=VFIO_CCW_STATE_STANDBY )) { +if (!vfio_ccw_mdev_reset (mdev)) + private->state =VFIO_CCW_STATE_STANDBY ; +/* The state will be NOT_OPER on error. */ + } + +cp_free (&private->cp);vfio_unregister_notifier (mdev_dev (mdev),VFIO_IOMMU_NOTIFY , &private->nb); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 124/346 x86/build: Move _etext to actual end of .text
In reply to Greg Kroah-Hartman[ Upstream commit 392bef709659abea614abfe53cf228e7a59876a4 ]
When building x86 with Clang LTO and CFI, CFI jump regions are automatically added to the end of the .text section late in linking. As a result, the _etext position was being labelled before the appended jump regions, causing confusion about where the boundaries of the executable region actually are in the running kernel, and broke at least the fault injection code. This moves the _etext mark to outside (and immediately after) the .text area, as it already the case on other architectures (e.g. arm64, arm).
--- arch/x86/kernel/vmlinux.lds.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kernel/vmlinux.lds.S +3 -3
@@ -141,11 +141,11 @@ SECTIONS *(.text.__x86.indirect_thunk) __indirect_thunk_end = .; #endif - - /* End of text section */ - _etext = .; } :text = 0x9090 + /* End of text section */ + _etext = .; + NOTES :text :note EXCEPTION_TABLE(16) :text = 0x9090
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 125/346 smpboot: Place the __percpu annotation correctly
In reply to Greg Kroah-Hartman[ Upstream commit d4645d30b50d1691c26ff0f8fa4e718b08f8d3bb ]
The test robot reported a wrong assignment of a per-CPU variable which it detected by using sparse and sent a report. The assignment itself is correct. The annotation for sparse was wrong and hence the report. The first pointer is a "normal" pointer and points to the per-CPU memory area. That means that the __percpu annotation has to be moved.
Move the __percpu annotation to pointer which points to the per-CPU area. This change affects only the sparse tool (and is ignored by the compiler).
--- include/linux/smpboot.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/smpboot.h +1 -1
@@ -29,7 +29,7 @@ struct smpboot_thread_data;* @thread_comm: The base name of the thread */ struct smp_hotplug_thread { -struct task_struct __percpu **store; +struct task_struct *__percpu *store;struct list_head list;int (*thread_should_run)(unsigned int cpu);void (*thread_fn)(unsigned int cpu);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 126/346 x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation
In reply to Greg Kroah-Hartman[ Upstream commit 6ae865615fc43d014da2fd1f1bba7e81ee622d1b ]
The __put_user() macro evaluates it's @ptr argument inside the __uaccess_begin() / __uaccess_end() region. While this would normally not be expected to be an issue, an UBSAN bug (it ignored -fwrapv, fixed in GCC 8+) would transform the @ptr evaluation for:
drivers/gpu/drm/i915/i915_gem_execbuffer.c: if (unlikely(__put_user(offset, &urelocs[r-stack].presumed_offset))) {into a signed-overflow-UB check and trigger the objtool AC validation.
Finish this commit:
2a418cf3f5f1 ("x86/uaccess: Don't leak the AC flag into __put_user() value evaluation")
and explicitly evaluate all 3 arguments early.
--- arch/x86/include/asm/uaccess.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/x86/include/asm/uaccess.h +4 -3
@@ -431,10 +431,11 @@ do { \ ({ \ __label__ __pu_label; \ int __pu_err = -EFAULT; \ - __typeof__(*(ptr)) __pu_val; \ - __pu_val = x; \ + __typeof__(*(ptr)) __pu_val = (x); \ + __typeof__(ptr) __pu_ptr = (ptr); \ + __typeof__(size) __pu_size = (size); \ __uaccess_begin(); \ - __put_user_size(__pu_val, (ptr), (size), __pu_label); \ + __put_user_size(__pu_val, __pu_ptr, __pu_size, __pu_label); \ __pu_err = 0; \ __pu_label: \ __uaccess_end(); \
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 127/346 x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault()
In reply to Greg Kroah-Hartman[ Upstream commit a65c88e16f32aa9ef2e8caa68ea5c29bd5eb0ff0 ]
In-NMI warnings have been added to vmalloc_fault() via:
ebc8827f75 ("x86: Barf when vmalloc and kmemcheck faults happen in NMI")
back in the time when our NMI entry code could not cope with nested NMIs.
These days, it's perfectly fine to take a fault in NMI context and we don't have to care about the fact that IRET from the fault handler might cause NMI nesting.
This warning has already been removed from 32-bit implementation of vmalloc_fault() in:
6863ea0cda8 ("x86/mm: Remove in_nmi() warning from vmalloc_fault()")
but the 64-bit version was omitted.
Remove the bogus warning also from 64-bit implementation of vmalloc_fault().
--- arch/x86/mm/fault.c | 2 -- 1 file changed, 2 deletions(-)
arch/x86/mm/fault.c +0 -2
@@ -359,8 +359,6 @@ static noinline int vmalloc_fault(unsigned long address)if (!(address >=VMALLOC_START && address <VMALLOC_END ))return -1 ; -WARN_ON_ONCE (in_nmi ()); -/* * Copy kernel mappings over when needed. This can also * happen within a race in page table update. In the later
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 128/346 mm/uaccess: Use unsigned long to placate UBSAN warnings on older GCC versions
In reply to Greg Kroah-Hartman[ Upstream commit 29da93fea3ea39ab9b12270cc6be1b70ef201c9e ]
Randy reported objtool triggered on his (GCC-7.4) build:
lib/strncpy_from_user.o: warning: objtool: strncpy_from_user()+0x315: call to __ubsan_handle_add_overflow() with UACCESS enabled lib/strnlen_user.o: warning: objtool: strnlen_user()+0x337: call to __ubsan_handle_sub_overflow() with UACCESS enabled
This is due to UBSAN generating signed-overflow-UB warnings where it should not. Prior to GCC-8 UBSAN ignored -fwrapv (which the kernel uses through -fno-strict-overflow).
Make the functions use 'unsigned long' throughout.
--- lib/strncpy_from_user.c | 5 +++-- lib/strnlen_user.c | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-)
lib/strncpy_from_user.c +3 -2
@@ -23,10 +23,11 @@* hit it), 'max' is the address space maximum (and we return * -EFAULT if we hit it). */ -static inline long do_strncpy_from_user (char *dst,const char __user *src,long count,unsigned long max) +static inline long do_strncpy_from_user (char *dst,const char __user *src, +unsigned long count,unsigned long max) {const struct word_at_a_time constants =WORD_AT_A_TIME_CONSTANTS ; -long res =0 ; +unsigned long res =0 ;/* * Truncate 'max' to the user-specified limit, so that
lib/strnlen_user.c +2 -2
@@ -28,7 +28,7 @@static inline long do_strnlen_user (const char __user *src,unsigned long count,unsigned long max) {const struct word_at_a_time constants =WORD_AT_A_TIME_CONSTANTS ; -long align, res =0 ; +unsigned long align, res =0 ;unsigned long c;/*
@@ -42,7 +42,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,* Do everything aligned. But that means that we * need to also expand the maximum.. */ - align = (sizeof (long ) -1 ) & (unsigned long )src; + align = (sizeof (unsigned long ) -1 ) & (unsigned long )src; src -= align; max += align;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 129/346 Bluetooth: hci_qca: Give enough time to ROME controller to bootup.
In reply to Greg Kroah-Hartman[ Upstream commit 7f09d5a6c33be66a5ca19bf9dd1c2d90c5dfcf0d ]
This patch enables enough time to ROME controller to bootup after we bring the enable pin out of reset.
--- drivers/bluetooth/hci_qca.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/hci_qca.c +2 -0
@@ -508,6 +508,8 @@ static int qca_open(struct hci_uart *hu) qcadev =serdev_device_get_drvdata (hu->serdev);if (qcadev->btsoc_type !=QCA_WCN3990 ) {gpiod_set_value_cansleep (qcadev->bt_en,1 ); +/* Controller needs time to bootup. */ +msleep (150 ); }else { hu->init_speed = qcadev->init_speed; hu->oper_speed = qcadev->oper_speed;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 130/346 Bluetooth: btbcm: Add default address for BCM43341B
In reply to Greg Kroah-Hartman[ Upstream commit 5035726128cd2e3813ee44deedb9898509edb232 ]
The BCM43341B has the default MAC address 43:34:1B:00:1F:AC if none is given. This address was found when enabling Bluetooth on multiple Intel Edison modules. It also contains the sequence 43341B, the name the chip identifies itself as. Using the same BD_ADDR is problematic when having multiple Intel Edison modules in each others range. The default address also has the LAA (locally administered address) bit set which prevents a BNEP device from being created, needed for BT tethering.
Add this to the list of black listed default MAC addresses and let the user configure a valid one using f.i.btmgmt -i hci0 public-addr xx:xx:xx:xx:xx:xx
--- drivers/bluetooth/btbcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/bluetooth/btbcm.c +3 -1
@@ -37,6 +37,7 @@#define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}})#define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}})#define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) +#define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}})int btbcm_check_bdaddr (struct hci_dev *hdev) {
@@ -82,7 +83,8 @@ int btbcm_check_bdaddr(struct hci_dev *hdev) !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || - !bacmp(&bda->bdaddr, BDADDR_BCM43430A0)) { + !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || + !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) {bt_dev_info (hdev,"BCM: Using default device address (%pMR)" , &bda->bdaddr);set_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 131/346 HID: logitech-hidpp: use RAP instead of FAP to get the protocol version
In reply to Greg Kroah-Hartman[ Upstream commit 096377525cdb8251e4656085efc988bdf733fb4c ]
According to the logitech_hidpp_2.0_specification_draft_2012-06-04.pdf doc:
https://lekensteyn.nl/files/logitech/logitech_hidpp_2.0_specification_draft_2012-06-04.pdf
We should use a register-access-protocol request using the short input / output report ids. This is necessary because 27MHz HID++ receivers have a max-packetsize on their HIP++ endpoint of 8, so they cannot support long reports. Using a feature-access-protocol request (which is always long or very-long) with these will cause a timeout error, followed by the hidpp driver treating the device as not being HID++ capable.
This commit fixes this by switching to using a rap request to get the protocol version.
Besides being tested with a (046d:c517) 27MHz receiver with various 27MHz keyboards and mice, this has also been tested to not cause regressions on a non-unifying dual-HID++ nano receiver (046d:c534) with k270 and m185 HID++-2.0 devices connected and on a unifying/dj receiver (046d:c52b) with a HID++-2.0 Logitech Rechargeable Touchpad T650.
--- drivers/hid/hid-logitech-hidpp.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/hid/hid-logitech-hidpp.c +13 -4
@@ -836,13 +836,16 @@ static int hidpp_root_get_feature(struct hidpp_device *hidpp, u16 feature,static int hidpp_root_get_protocol_version (struct hidpp_device *hidpp) { +const u8 ping_byte =0x5a ; +u8 ping_data[3 ] = {0 ,0 , ping_byte };struct hidpp_report response;int ret; - ret =hidpp_send_fap_command_sync (hidpp, + ret =hidpp_send_rap_command_sync (hidpp, +REPORT_ID_HIDPP_SHORT ,HIDPP_PAGE_ROOT_IDX ,CMD_ROOT_GET_PROTOCOL_VERSION , -NULL ,0 , &response); + ping_data,sizeof (ping_data), &response);if (ret ==HIDPP_ERROR_INVALID_SUBID ) { hidpp->protocol_major =1 ;
@@ -862,8 +865,14 @@ static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp)if (ret)return ret; - hidpp->protocol_major = response.fap.params[0 ]; - hidpp->protocol_minor = response.fap.params[1 ]; +if (response.rap.params[2 ] != ping_byte) { +hid_err (hidpp->hid_dev,"%s: ping mismatch 0x%02x != 0x%02x\n" , + __func__, response.rap.params[2 ], ping_byte); +return -EPROTO ; + } + + hidpp->protocol_major = response.rap.params[0 ]; + hidpp->protocol_minor = response.rap.params[1 ];return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 132/346 pinctrl: pistachio: fix leaked of_node references
In reply to Greg Kroah-Hartman[ Upstream commit 44a4455ac2c6b0981eace683a2b6eccf47689022 ]
The call to of_get_child_by_name returns a node pointer with refcount incremented thus it must be explicitly decremented after the last usage.
Detected by coccinelle with the following warnings:
./drivers/pinctrl/pinctrl-pistachio.c:1422:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1360, but without a corresponding object release within this function.
--- drivers/pinctrl/pinctrl-pistachio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/pinctrl-pistachio.c +2 -0
@@ -1367,6 +1367,7 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl)if (!of_find_property (child,"gpio-controller" ,NULL )) {dev_err (pctl->dev,"No gpio-controller property for bank %u\n" , i); +of_node_put (child); ret = -ENODEV ; goto err; }
@@ -1374,6 +1375,7 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl) irq =irq_of_parse_and_map (child,0 );if (irq <0 ) {dev_err (pctl->dev,"No IRQ for bank %u: %d\n" , i, irq); +of_node_put (child); ret = irq; goto err; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 133/346 pinctrl: st: fix leaked of_node references
In reply to Greg Kroah-Hartman[ Upstream commit 483d70d73beaecab55882fcd2a357af72674e24c ]
The call to of_get_child_by_name returns a node pointer with refcount incremented thus it must be explicitly decremented after the last usage.
Detected by coccinelle with the following warnings:
./drivers/pinctrl/pinctrl-st.c:1188:3-9: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1175, but without a corresponding object release within this function. ./drivers/pinctrl/pinctrl-st.c:1188:3-9: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1175, but without a corresponding object release within this function. ./drivers/pinctrl/pinctrl-st.c:1199:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1175, but without a corresponding object release within this function. ./drivers/pinctrl/pinctrl-st.c:1199:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1175, but without a corresponding object release within this function.
--- drivers/pinctrl/pinctrl-st.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/pinctrl/pinctrl-st.c +10 -5
@@ -1170,7 +1170,7 @@ static int st_pctl_dt_parse_groups(struct device_node *np,struct property *pp;struct st_pinconf *conf;struct device_node *pins; -int i =0 , npins =0 , nr_props; +int i =0 , npins =0 , nr_props, ret =0 ; pins =of_get_child_by_name (np,"st,pins" );if (!pins)
@@ -1185,7 +1185,8 @@ static int st_pctl_dt_parse_groups(struct device_node *np, npins++; }else {pr_warn ("Invalid st,pins in %pOFn node\n" , np); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_node; } }
@@ -1195,8 +1196,10 @@ static int st_pctl_dt_parse_groups(struct device_node *np, grp->pin_conf =devm_kcalloc (info->dev, npins,sizeof (*conf),GFP_KERNEL ); -if (!grp->pins || !grp->pin_conf) -return -ENOMEM ; +if (!grp->pins || !grp->pin_conf) { + ret = -ENOMEM ; + goto out_put_node; + }/* <bank offset mux direction rt_type rt_delay rt_clk> */ for_each_property_of_node (pins, pp) {
@@ -1229,9 +1232,11 @@ static int st_pctl_dt_parse_groups(struct device_node *np, } i++; } + +out_put_node:of_node_put (pins); -return 0 ; +return ret; } static int st_pctl_parse_functions(struct device_node *np,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 134/346 pinctrl: samsung: fix leaked of_node references
In reply to Greg Kroah-Hartman[ Upstream commit 44b9f86cd41db6c522effa5aec251d664a52fbc0 ]
The call to of_find_compatible_node returns a node pointer with refcount incremented thus it must be explicitly decremented after the last usage.
Detected by coccinelle with the following warnings:
./drivers/pinctrl/samsung/pinctrl-exynos-arm.c:76:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 66, but without a corresponding object release within this function. ./drivers/pinctrl/samsung/pinctrl-exynos-arm.c:82:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 66, but without a corresponding object release within this function.
--- drivers/pinctrl/samsung/pinctrl-exynos-arm.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/samsung/pinctrl-exynos-arm.c +1 -0
@@ -71,6 +71,7 @@ s5pv210_retention_init(struct samsung_pinctrl_drv_data *drvdata, } clk_base =of_iomap (np,0 ); +of_node_put (np);if (!clk_base) {pr_err ("%s: failed to map clock registers\n" , __func__);return ERR_PTR (-EINVAL );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 135/346 clk: rockchip: undo several noc and special clocks as critical on rk3288
In reply to Greg Kroah-Hartman[ Upstream commit f4033db5b84ebe4b32c25ba2ed65ab20b628996a ]
This is mostly a revert of commit 55bb6a633c33 ("clk: rockchip: mark noc and some special clk as critical on rk3288") except that we're keeping "pmu_hclk_otg0" as critical still.
NOTE: turning these clocks off doesn't seem to do a whole lot in terms of power savings (checking the power on the logic rail). It appears to save maybe 1-2mW. ...but still it seems like we should turn the clocks off if they aren't needed.
About "pmu_hclk_otg0" (the one clock from the original commit we're still keeping critical) from an email thread:
Quoted 12 lines
pmu ahb clock
Function: Clock to pmu module when hibernation and/or ADP is enabled. Must be greater than or equal to 30 MHz.
If the SOC design does not support hibernation/ADP function, only have
hclk_otg, this clk can be switched according to the usage of otg. If the SOC design support hibernation/ADP, has two clocks,hclk_otgandpmu_hclk_otg0.Hclk_otgbelongs to the closed part of otg logic, which can be switched according to the use of otg.
Quoted 4 lines
pmu_hclk_otg0belongs to the always on part.As for whether
pmu_hclk_otg0can be turned off when otg is not in use, we have not tested. IC suggest makepmu_hclk_otg0always on.
For the rest of the clocks:
atclk: No documentation about this clock other than that it goes to the CPU. CPU functions fine without it on. Maybe needed for JTAG?
jtag: Presumably this clock is only needed if you're debugging with JTAG. It doesn't seem like it makes sense to waste power for every rk3288 user. In any case to do JTAG you'd need private patches to adjust the pinctrl the mux the JTAG out anyway.
pclk_dbg, pclk_core_niu: On veyron Chromebooks we turn these two clocks on only during kernel panics in order to access some coresight registers. Since nothing in the upstream kernel does this we should be able to leave them off safely. Maybe also needed for JTAG?
hsicphy12m_xin12m: There is no indication of why this clock would need to be turned on for boards that don't use HSIC.
pclk_ddrupctl[0-1], pclk_publ0[0-1]: On veyron Chromebooks we turn these 4 clocks on only when doing DDR transitions and they are off otherwise. I see no reason why they'd need to be on in the upstream kernel which doesn't support DDRFreq.
--- drivers/clk/rockchip/clk-rk3288.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
drivers/clk/rockchip/clk-rk3288.c +4 -9
@@ -313,13 +313,13 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {COMPOSITE_NOMUX (0 ,"aclk_core_mp" ,"armclk" ,CLK_IGNORE_UNUSED ,RK3288_CLKSEL_CON (0 ),4 ,4 ,DFLAGS |CLK_DIVIDER_READ_ONLY ,RK3288_CLKGATE_CON (12 ),6 ,GFLAGS ), -COMPOSITE_NOMUX (0 ,"atclk" ,"armclk" ,CLK_IGNORE_UNUSED , +COMPOSITE_NOMUX (0 ,"atclk" ,"armclk" ,0 ,RK3288_CLKSEL_CON (37 ),4 ,5 ,DFLAGS |CLK_DIVIDER_READ_ONLY ,RK3288_CLKGATE_CON (12 ),7 ,GFLAGS ),COMPOSITE_NOMUX (0 ,"pclk_dbg_pre" ,"armclk" ,CLK_IGNORE_UNUSED ,RK3288_CLKSEL_CON (37 ),9 ,5 ,DFLAGS |CLK_DIVIDER_READ_ONLY ,RK3288_CLKGATE_CON (12 ),8 ,GFLAGS ), -GATE (0 ,"pclk_dbg" ,"pclk_dbg_pre" ,CLK_IGNORE_UNUSED , +GATE (0 ,"pclk_dbg" ,"pclk_dbg_pre" ,0 ,RK3288_CLKGATE_CON (12 ),9 ,GFLAGS ),GATE (0 ,"cs_dbg" ,"pclk_dbg_pre" ,CLK_IGNORE_UNUSED , RK3288_CLKGATE_CON(12), 10, GFLAGS),
@@ -647,7 +647,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {INVERTER (SCLK_HSADC ,"sclk_hsadc" ,"sclk_hsadc_out" ,RK3288_CLKSEL_CON (22 ),7 ,IFLAGS ), -GATE (0 ,"jtag" ,"ext_jtag" ,CLK_IGNORE_UNUSED , +GATE (0 ,"jtag" ,"ext_jtag" ,0 ,RK3288_CLKGATE_CON (4 ),14 ,GFLAGS ), COMPOSITE_NODIV(SCLK_USBPHY480M_SRC, "usbphy480m_src", mux_usbphy480m_p, 0,
@@ -656,7 +656,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {COMPOSITE_NODIV (SCLK_HSICPHY480M ,"sclk_hsicphy480m" , mux_hsicphy480m_p,0 ,RK3288_CLKSEL_CON (29 ),0 ,2 ,MFLAGS ,RK3288_CLKGATE_CON (3 ),6 ,GFLAGS ), -GATE (0 ,"hsicphy12m_xin12m" ,"xin12m" ,CLK_IGNORE_UNUSED , +GATE (0 ,"hsicphy12m_xin12m" ,"xin12m" ,0 ,RK3288_CLKGATE_CON (13 ),9 ,GFLAGS ),DIV (0 ,"hsicphy12m_usbphy" ,"sclk_hsicphy480m" ,0 , RK3288_CLKSEL_CON(11), 8, 6, DFLAGS),
@@ -837,11 +837,6 @@ static const char *const rk3288_critical_clocks[] __initconst = {"pclk_alive_niu" ,"pclk_pd_pmu" ,"pclk_pmu_niu" , -"pclk_core_niu" , -"pclk_ddrupctl0" , -"pclk_publ0" , -"pclk_ddrupctl1" , -"pclk_publ1" , "pmu_hclk_otg0", };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 136/346 perf/arm-cci: Remove broken race mitigation
In reply to Greg Kroah-Hartman[ Upstream commit 0d2e2a82d4de298d006bf8eddc86829e3c7da820 ]
Uncore PMU drivers face an awkward cyclic dependency wherein:
- They have to pick a valid online CPU to associate with before registering the PMU device, since it will get exposed to userspace immediately.
- The PMU registration has to be be at least partly complete before hotplug events can be handled, since trying to migrate an uninitialised context would be bad.
- The hotplug handler has to be ready as soon as a CPU is chosen, lest it go offline without the user-visible cpumask value getting updated.
The arm-cci driver has tried to solve this by using get_cpu() to pick the current CPU and prevent it from disappearing while both registrations are performed, but that results in taking mutexes with preemption disabled, which makes certain configurations very unhappy:
[ 1.983337] BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:2004 [ 1.983340] in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: swapper/0 [ 1.983342] Preemption disabled at: [ 1.983353] [<ffffff80089801f4>] cci_pmu_probe+0x1dc/0x488 [ 1.983360] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.18.20-rt8-yocto-preempt-rt #1 [ 1.983362] Hardware name: ZynqMP ZCU102 Rev1.0 (DT) [ 1.983364] Call trace: [ 1.983369] dump_backtrace+0x0/0x158 [ 1.983372] show_stack+0x24/0x30 [ 1.983378] dump_stack+0x80/0xa4 [ 1.983383] ___might_sleep+0x138/0x160 [ 1.983386] __might_sleep+0x58/0x90 [ 1.983391] __rt_mutex_lock_state+0x30/0xc0 [ 1.983395] _mutex_lock+0x24/0x30 [ 1.983400] perf_pmu_register+0x2c/0x388 [ 1.983404] cci_pmu_probe+0x2bc/0x488 [ 1.983409] platform_drv_probe+0x58/0xa8
It is not feasible to resolve all the possible races outside of the perf core itself, so address the immediate bug by following the example of nearly every other PMU driver and not even trying to do so. Registering the hotplug notifier first should minimise the window in which things can go wrong, so that's about as much as we can reasonably do here. This also revealed an additional race in assigning the global pointer too late relative to the hotplug notifier, which gets fixed in the process.
--- drivers/perf/arm-cci.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/perf/arm-cci.c +12 -9
@@ -1692,21 +1692,24 @@ static int cci_pmu_probe(struct platform_device *pdev)raw_spin_lock_init (&cci_pmu->hw_events.pmu_lock);mutex_init (&cci_pmu->reserve_mutex);atomic_set (&cci_pmu->active_events,0 ); - cci_pmu->cpu =get_cpu (); - - ret =cci_pmu_init (cci_pmu, pdev); -if (ret) { -put_cpu (); -return ret; - } + cci_pmu->cpu =raw_smp_processor_id (); + g_cci_pmu = cci_pmu;cpuhp_setup_state_nocalls (CPUHP_AP_PERF_ARM_CCI_ONLINE ,"perf/arm/cci:online" ,NULL , cci_pmu_offline_cpu); -put_cpu (); - g_cci_pmu = cci_pmu; + + ret =cci_pmu_init (cci_pmu, pdev); +if (ret) + goto error_pmu_init; +pr_info ("ARM %s PMU driver probed" , cci_pmu->model->name);return 0 ; + +error_pmu_init: +cpuhp_remove_state (CPUHP_AP_PERF_ARM_CCI_ONLINE ); + g_cci_pmu =NULL ; +return ret; }static int cci_pmu_remove (struct platform_device *pdev)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 137/346 dmaengine: at_xdmac: remove BUG_ON macro in tasklet
In reply to Greg Kroah-Hartman[ Upstream commit e2c114c06da2d9ffad5b16690abf008d6696f689 ]
Even if this case shouldn't happen when controller is properly programmed, it's still better to avoid dumping a kernel Oops for this.
As the sequence may happen only for debugging purposes, log the error and just finish the tasklet call.
--- drivers/dma/at_xdmac.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/dma/at_xdmac.c +5 -1
@@ -1606,7 +1606,11 @@ static void at_xdmac_tasklet(unsigned long data) struct at_xdmac_desc, xfer_node);dev_vdbg (chan2dev (&atchan->chan),"%s: desc 0x%p\n" , __func__, desc); -BUG_ON (!desc->active_xfer); +if (!desc->active_xfer) { +dev_err (chan2dev (&atchan->chan),"Xfer not active: exiting" ); +spin_unlock_bh (&atchan->lock); +return ; + } txd = &desc->tx_dma_desc;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 138/346 media: coda: clear error return value before picture run
In reply to Greg Kroah-Hartman[ Upstream commit bbeefa7357a648afe70e7183914c87c3878d528d ]
The error return value is not written by some firmware codecs, such as MPEG-2 decode on CodaHx4. Clear the error return value before starting the picture run to avoid misinterpreting unrelated values returned by sequence initialization as error return value.
--- drivers/media/platform/coda/coda-bit.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/platform/coda/coda-bit.c +3 -0
@@ -2006,6 +2006,9 @@ static int coda_prepare_decode(struct coda_ctx *ctx)/* Clear decode success flag */ coda_write (dev,0 ,CODA_RET_DEC_PIC_SUCCESS ); +/* Clear error return value */ +coda_write (dev,0 ,CODA_RET_DEC_PIC_ERR_MB ); +trace_coda_dec_pic_run (ctx, meta);coda_command_async (ctx,CODA_COMMAND_PIC_RUN );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 139/346 media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
In reply to Greg Kroah-Hartman[ Upstream commit ccdd85d518d8b9320ace1d87271f0ba2175f21fa ]
In preparation for adding asynchronous subdevice support to the driver, don't acquire v4l2_clk from the driver .probe() callback as that may fail if the clock is provided by a bridge driver which may be not yet initialized. Move the v4l2_clk_get() to ov6650_video_probe() helper which is going to be converted to v4l2_subdev_internal_ops.registered() callback, executed only when the bridge driver is ready.
--- drivers/media/i2c/ov6650.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/media/i2c/ov6650.c +14 -11
@@ -810,9 +810,16 @@ static int ov6650_video_probe(struct i2c_client *client)u8 pidh, pidl, midh, midl;int ret; + priv->clk =v4l2_clk_get (&client->dev,NULL ); +if (IS_ERR (priv->clk)) { + ret =PTR_ERR (priv->clk); +dev_err (&client->dev,"v4l2_clk request err: %d\n" , ret); +return ret; + } + ret =ov6650_s_power (&priv->subdev,1 );if (ret <0 ) -return ret; + goto eclkput;msleep (20 );
@@ -849,6 +856,11 @@ static int ov6650_video_probe(struct i2c_client *client) done:ov6650_s_power (&priv->subdev,0 ); +if (!ret) +return 0 ; +eclkput: +v4l2_clk_put (priv->clk); +return ret; }
@@ -991,18 +1003,9 @@ static int ov6650_probe(struct i2c_client *client, priv->code =MEDIA_BUS_FMT_YUYV8_2X8 ; priv->colorspace =V4L2_COLORSPACE_JPEG ; - priv->clk =v4l2_clk_get (&client->dev,NULL ); -if (IS_ERR (priv->clk)) { - ret =PTR_ERR (priv->clk); - goto eclkget; - } - ret =ov6650_video_probe (client); -if (ret) { -v4l2_clk_put (priv->clk); -eclkget: +if (ret)v4l2_ctrl_handler_free (&priv->hdl); - }return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 140/346 media: au0828: stop video streaming only when last user stops
In reply to Greg Kroah-Hartman[ Upstream commit f604f0f5afb88045944567f604409951b5eb6af8 ]
If the application was streaming from both videoX and vbiX, and streaming from videoX was stopped, then the vbi streaming also stopped.
The cause being that stop_streaming for video stopped the subdevs as well, instead of only doing that if dev->streaming_users reached 0.
au0828_stop_vbi_streaming was also wrong since it didn't stop the subdevs at all when dev->streaming_users reached 0.
--- drivers/media/usb/au0828/au0828-video.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/media/usb/au0828/au0828-video.c +8 -5
@@ -839,9 +839,9 @@ int au0828_start_analog_streaming(struct vb2_queue *vq, unsigned int count)return rc; } +v4l2_device_call_all (&dev->v4l2_dev,0 , video, s_stream,1 ); +if (vq->type ==V4L2_BUF_TYPE_VIDEO_CAPTURE ) { -v4l2_device_call_all (&dev->v4l2_dev,0 , video, - s_stream,1 ); dev->vid_timeout_running =1 ;mod_timer (&dev->vid_timeout, jiffies + (HZ /10 )); }else if (vq->type ==V4L2_BUF_TYPE_VBI_CAPTURE ) {
@@ -861,10 +861,11 @@ static void au0828_stop_streaming(struct vb2_queue *vq)dprintk (1 ,"au0828_stop_streaming called %d\n" , dev->streaming_users); -if (dev->streaming_users-- ==1 ) +if (dev->streaming_users-- ==1 ) {au0828_uninit_isoc (dev); +v4l2_device_call_all (&dev->v4l2_dev,0 , video, s_stream,0 ); + } -v4l2_device_call_all (&dev->v4l2_dev,0 , video, s_stream,0 ); dev->vid_timeout_running =0 ;del_timer_sync (&dev->vid_timeout);
@@ -893,8 +894,10 @@ void au0828_stop_vbi_streaming(struct vb2_queue *vq)dprintk (1 ,"au0828_stop_vbi_streaming called %d\n" , dev->streaming_users); -if (dev->streaming_users-- ==1 ) +if (dev->streaming_users-- ==1 ) {au0828_uninit_isoc (dev); +v4l2_device_call_all (&dev->v4l2_dev,0 , video, s_stream,0 ); + }spin_lock_irqsave (&dev->slock, flags);if (dev->isoc_ctl.vbi_buf !=NULL ) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 141/346 media: ov2659: make S_FMT succeed even if requested format doesnt match
In reply to Greg Kroah-Hartman[ Upstream commit bccb89cf9cd07a0690d519696a00c00a973b3fe4 ]
This driver returns an error if unsupported media bus pixel code is requested by VIDIOC_SUBDEV_S_FMT.
But according to Documentation/media/uapi/v4l/vidioc-subdev-g-fmt.rst,
Drivers must not return an error solely because the requested format doesn't match the device capabilities. They must instead modify the format to match what the hardware can provide.
So select default format code and return success in that case.
This is detected by v4l2-compliance.
--- drivers/media/i2c/ov2659.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/i2c/ov2659.c +4 -2
@@ -1117,8 +1117,10 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,if (ov2659_formats[index].code == mf->code)break ; -if (index <0 ) -return -EINVAL ; +if (index <0 ) { + index =0 ; + mf->code = ov2659_formats[index].code; + } mf->colorspace =V4L2_COLORSPACE_SRGB ; mf->field =V4L2_FIELD_NONE ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 142/346 audit: fix a memory leak bug
In reply to Greg Kroah-Hartman[ Upstream commit 70c4cf17e445264453bc5323db3e50aa0ac9e81f ]
In audit_rule_change(), audit_data_to_entry() is firstly invoked to translate the payload data to the kernel's rule representation. In audit_data_to_entry(), depending on the audit field type, an audit tree may be created in audit_make_tree(), which eventually invokes kmalloc() to allocate the tree. Since this tree is a temporary tree, it will be then freed in the following execution, e.g., audit_add_rule() if the message type is AUDIT_ADD_RULE or audit_del_rule() if the message type is AUDIT_DEL_RULE. However, if the message type is neither AUDIT_ADD_RULE nor AUDIT_DEL_RULE, i.e., the default case of the switch statement, this temporary tree is not freed.
To fix this issue, only allocate the tree when the type is AUDIT_ADD_RULE or AUDIT_DEL_RULE.
--- kernel/auditfilter.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
kernel/auditfilter.c +7 -5
@@ -1114,22 +1114,24 @@ int audit_rule_change(int type, int seq, void *data, size_t datasz)int err =0 ;struct audit_entry *entry; - entry =audit_data_to_entry (data, datasz); -if (IS_ERR (entry)) -return PTR_ERR (entry); -switch (type) {case AUDIT_ADD_RULE : + entry =audit_data_to_entry (data, datasz); +if (IS_ERR (entry)) +return PTR_ERR (entry); err =audit_add_rule (entry);audit_log_rule_change ("add_rule" , &entry->rule, !err);break ;case AUDIT_DEL_RULE : + entry =audit_data_to_entry (data, datasz); +if (IS_ERR (entry)) +return PTR_ERR (entry); err =audit_del_rule (entry);audit_log_rule_change ("remove_rule" , &entry->rule, !err);break ;default : - err = -EINVAL ;WARN_ON (1 ); +return -EINVAL ; }if (err || type ==AUDIT_DEL_RULE ) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 143/346 media: stm32-dcmi: fix crash when subdev do not expose any formats
In reply to Greg Kroah-Hartman[ Upstream commit 33dfeb62e23c31619d2197850f7e8b50e8cc5466 ]
Do not access sd_formats[] if num_of_sd_formats is zero, ie subdev sensor didn't expose any formats.
--- drivers/media/platform/stm32/stm32-dcmi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/platform/stm32/stm32-dcmi.c +6 -0
@@ -811,6 +811,9 @@ static int dcmi_try_fmt(struct stm32_dcmi *dcmi, struct v4l2_format *f, sd_fmt =find_format_by_fourcc (dcmi, pix->pixelformat);if (!sd_fmt) { +if (!dcmi->num_of_sd_formats) +return -ENODATA ; + sd_fmt = dcmi->sd_formats[dcmi->num_of_sd_formats -1 ]; pix->pixelformat = sd_fmt->fourcc; }
@@ -989,6 +992,9 @@ static int dcmi_set_sensor_format(struct stm32_dcmi *dcmi, sd_fmt =find_format_by_fourcc (dcmi, pix->pixelformat);if (!sd_fmt) { +if (!dcmi->num_of_sd_formats) +return -ENODATA ; + sd_fmt = dcmi->sd_formats[dcmi->num_of_sd_formats -1 ]; pix->pixelformat = sd_fmt->fourcc; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 144/346 media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
In reply to Greg Kroah-Hartman[ Upstream commit 898bc40bfcc26abb6e06e960d6d4754c36c58b50 ]
Fix au0828_analog_stream_enable() to check if device is in the right state first. When unbind happens while bind is in progress, usbdev pointer could be invalid in au0828_analog_stream_enable() and a call to usb_ifnum_to_if() will result in the null pointer dereference.
This problem is found with the new media_dev_allocator.sh test.
kernel: [ 590.359623] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e8
kernel: [ 590.359627] #PF error: [normal kernel read fault]
kernel: [ 590.359629] PGD 0 P4D 0
kernel: [ 590.359632] Oops: 0000 [#1] SMP PTI
kernel: [ 590.359634] CPU: 3 PID: 1458 Comm: v4l_id Not tainted 5.1.0-rc2+ #30
kernel: [ 590.359636] Hardware name: Dell Inc. OptiPlex 7 90/0HY9JP, BIOS A18 09/24/2013
kernel: [ 590.359641] RIP: 0010:usb_ifnum_to_if+0x6/0x60
kernel: [ 590.359643] Code: 5d 41 5e 41 5f 5d c3 48 83 c4
10 b8 fa ff ff ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 b8 fa ff ff ff c3 0f 1f 00 6
6 66 66 66 90 55 <48> 8b 97 e8 04 00 00 48 89 e5 48 85 d2 74 41 0f b6 4a 04 84 c
9 74
kernel: [ 590.359645] RSP: 0018:ffffad3cc3c1fc00 EFLAGS: 00010246
kernel: [ 590.359646] RAX: 0000000000000000 RBX: ffff8ded b1f3c000 RCX: 1f377e4500000000
kernel: [ 590.359648] RDX: ffff8dedfa3a6b50 RSI: 00000000 00000000 RDI: 0000000000000000
kernel: [ 590.359649] RBP: ffffad3cc3c1fc28 R08: 00000000 8574acc2 R09: ffff8dedfa3a6b50
kernel: [ 590.359650] R10: 0000000000000001 R11: 00000000 00000000 R12: 0000000000000000
kernel: [ 590.359652] R13: ffff8dedb1f3f0f0 R14: ffffffff adcf7ec0 R15: 0000000000000000
kernel: [ 590.359654] FS: 00007f7917198540(0000) GS:ffff 8dee258c0000(0000) knlGS:0000000000000000
kernel: [ 590.359655] CS: 0010 DS: 0000 ES: 0000 CR0: 00 00000080050033
kernel: [ 590.359657] CR2: 00000000000004e8 CR3: 00000001 a388e002 CR4: 00000000000606e0
kernel: [ 590.359658] Call Trace:
kernel: [ 590.359664] ? au0828_analog_stream_enable+0x2c/0x180
kernel: [ 590.359666] au0828_v4l2_open+0xa4/0x110
kernel: [ 590.359670] v4l2_open+0x8b/0x120
kernel: [ 590.359674] chrdev_open+0xa6/0x1c0
kernel: [ 590.359676] ? cdev_put.part.3+0x20/0x20
kernel: [ 590.359678] do_dentry_open+0x1f6/0x360
kernel: [ 590.359681] vfs_open+0x2f/0x40
kernel: [ 590.359684] path_openat+0x299/0xc20
kernel: [ 590.359688] do_filp_open+0x9b/0x110
kernel: [ 590.359695] ? _raw_spin_unlock+0x27/0x40
kernel: [ 590.359697] ? __alloc_fd+0xb2/0x160
kernel: [ 590.359700] do_sys_open+0x1ba/0x260
kernel: [ 590.359702] ? do_sys_open+0x1ba/0x260
kernel: [ 590.359712] __x64_sys_openat+0x20/0x30
kernel: [ 590.359715] do_syscall_64+0x5a/0x120
kernel: [ 590.359718] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/media/usb/au0828/au0828-video.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/au0828/au0828-video.c +3 -0
@@ -758,6 +758,9 @@ static int au0828_analog_stream_enable(struct au0828_dev *d)dprintk (1 ,"au0828_analog_stream_enable called\n" ); +if (test_bit (DEV_DISCONNECTED , &d->dev_state)) +return -ENODEV ; + iface =usb_ifnum_to_if (d->usbdev,0 );if (iface && iface->cur_altsetting->desc.bAlternateSetting !=5 ) {dprintk (1 ,"Changing intf#0 to alt 5\n" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 145/346 media: pvrusb2: Prevent a buffer overflow
In reply to Greg Kroah-Hartman[ Upstream commit c1ced46c7b49ad7bc064e68d966e0ad303f917fb ]
The ctrl_check_input() function is called from pvr2_ctrl_range_check(). It's supposed to validate user supplied input and return true or false depending on whether the input is valid or not. The problem is that negative shifts or shifts greater than 31 are undefined in C. In practice with GCC they result in shift wrapping so this function returns true for some inputs which are not valid and this could result in a buffer overflow:
drivers/media/usb/pvrusb2/pvrusb2-ctrl.c:205 pvr2_ctrl_get_valname()
warn: uncapped user index 'names[val]'
The cptr->hdw->input_allowed_mask mask is configured in pvr2_hdw_create() and the highest valid bit is BIT(4).
--- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 ++ drivers/media/usb/pvrusb2/pvrusb2-hdw.h | 1 + 2 files changed, 3 insertions(+)
drivers/media/usb/pvrusb2/pvrusb2-hdw.c +2 -0
@@ -666,6 +666,8 @@ static int ctrl_get_input(struct pvr2_ctrl *cptr,int *vp)static int ctrl_check_input (struct pvr2_ctrl *cptr,int v) { +if (v <0 || v >PVR2_CVAL_INPUT_MAX ) +return 0 ;return ((1 << v) & cptr->hdw->input_allowed_mask) !=0 ; }
drivers/media/usb/pvrusb2/pvrusb2-hdw.h +1 -0
@@ -50,6 +50,7 @@#define PVR2_CVAL_INPUT_COMPOSITE 2#define PVR2_CVAL_INPUT_SVIDEO 3#define PVR2_CVAL_INPUT_RADIO 4 +#define PVR2_CVAL_INPUT_MAX PVR2_CVAL_INPUT_RADIOenum pvr2_config { pvr2_config_empty,/* No configuration */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 146/346 iio: adc: stm32-dfsdm: fix unmet direct dependencies detected
In reply to Greg Kroah-Hartman[ Upstream commit ba7ecfe43d6bf12e2aa76705c45f7d187ae3d7c0 ]
This fixes unmet direct dependencies seen when CONFIG_STM32_DFSDM_ADC is selected:
WARNING: unmet direct dependencies detected for IIO_BUFFER_HW_CONSUMER
Depends on [n]: IIO [=y] && IIO_BUFFER [=n]
Selected by [y]:
- STM32_DFSDM_ADC [=y] && IIO [=y] && (ARCH_STM32 [=y] && OF [=y] ||
COMPILE_TEST [=n])
--- drivers/iio/adc/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/iio/adc/Kconfig +1 -0
@@ -747,6 +747,7 @@ config STM32_DFSDM_ADC depends on (ARCH_STM32 && OF) || COMPILE_TEST select STM32_DFSDM_CORE select REGMAP_MMIO + select IIO_BUFFER select IIO_BUFFER_HW_CONSUMER help Select this option to support ADCSigma delta modulator for
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 147/346 block: fix use-after-free on gendisk
In reply to Greg Kroah-Hartman[ Upstream commit 2c88e3c7ec32d7a40cc7c9b4a487cf90e4671bdd ]
commit 2da78092dda "block: Fix dev_t minor allocation lifetime" specifically moved blk_free_devt(dev->devt) call to part_release() to avoid reallocating device number before the device is fully shutdown.
However, it can cause use-after-free on gendisk in get_gendisk(). We use md device as example to show the race scenes:
Process1 Worker Process2md_free
blkdev_opendel_gendisk
add delete_partition_work_fn() to wq
__blkdev_get get_gendiskput_disk
disk_release
kfree(disk)
find part from ext_devt_idr get_disk_and_module(disk) cause use after free
delete_partition_work_fn put_device(part) part_release
remove part from ext_devt_idr
Before <devt, hd_struct pointer> is removed from ext_devt_idr by delete_partition_work_fn(), we can find the devt and then access gendisk by hd_struct pointer. But, if we access the gendisk after it have been freed, it can cause in use-after-freeon gendisk in get_gendisk().
We fix this by adding a new helper blk_invalidate_devt() in delete_partition() and del_gendisk(). It replaces hd_struct pointer in idr with value 'NULL', and deletes the entry from idr in part_release() as we do now.
Thanks to Jan Kara for providing the solution and more clear comments for the code.
--- block/genhd.c | 19 +++++++++++++++++++ block/partition-generic.c | 7 +++++++ include/linux/genhd.h | 1 + 3 files changed, 27 insertions(+)
block/genhd.c +19 -0
@@ -531,6 +531,18 @@ void blk_free_devt(dev_t devt) } } +/** +* We invalidate devt by assigning NULL pointer for devt in idr. +*/ +void blk_invalidate_devt (dev_t devt) +{ +if (MAJOR (devt) ==BLOCK_EXT_MAJOR ) { +spin_lock_bh (&ext_devt_lock); +idr_replace (&ext_devt_idr,NULL ,blk_mangle_minor (MINOR (devt))); +spin_unlock_bh (&ext_devt_lock); + } +} +static char *bdevt_str (dev_t devt,char *buf) {if (MAJOR (devt) <=0xff &&MINOR (devt) <=0xff ) {
@@ -791,6 +803,13 @@ void del_gendisk(struct gendisk *disk)if (!(disk->flags &GENHD_FL_HIDDEN ))blk_unregister_region (disk_devt (disk), disk->minors); +/* +* Remove gendisk pointer from idr so that it cannot be looked up +* while RCU period before freeing gendisk is running to prevent +* use-after-free issues. Note that the device number stays +* "in-use" until we really free the gendisk. +*/ +blk_invalidate_devt (disk_devt (disk));kobject_put (disk->part0.holder_dir);kobject_put (disk->slave_dir);
block/partition-generic.c +7 -0
@@ -285,6 +285,13 @@ void delete_partition(struct gendisk *disk, int partno)kobject_put (part->holder_dir);device_del (part_to_dev (part)); +/* +* Remove gendisk pointer from idr so that it cannot be looked up +* while RCU period before freeing gendisk is running to prevent +* use-after-free issues. Note that the device number stays +* "in-use" until we really free the gendisk. +*/ +blk_invalidate_devt (part_devt (part));hd_struct_kill (part); }
include/linux/genhd.h +1 -0
@@ -610,6 +610,7 @@ struct unixware_disklabel {extern int blk_alloc_devt (struct hd_struct *part,dev_t *devt);extern void blk_free_devt (dev_t devt); +extern void blk_invalidate_devt (dev_t devt);extern dev_t blk_lookup_devt (const char *name,int partno);extern char *disk_name (struct gendisk *hd,int partno,char *buf);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 148/346 powerpc/numa: improve control of topology updates
In reply to Greg Kroah-Hartman[ Upstream commit 2d4d9b308f8f8dec68f6dbbff18c68ec7c6bd26f ]
When booted with "topology_updates=no", or when "off" is written to /proc/powerpc/topology_updates, NUMA reassignments are inhibited for PRRN and VPHN events. However, migration and suspend unconditionally re-enable reassignments via start_topology_update(). This is incoherent.
Check the topology_updates_enabled flag in start/stop_topology_update() so that callers of those APIs need not be aware of whether reassignments are enabled. This allows the administrative decision on reassignments to remain in force across migrations and suspensions.
--- arch/powerpc/mm/numa.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
arch/powerpc/mm/numa.c +12 -6
@@ -1494,6 +1494,9 @@ int start_topology_update(void) {int rc =0 ; +if (!topology_updates_enabled) +return 0 ; +if (firmware_has_feature (FW_FEATURE_PRRN )) {if (!prrn_enabled) { prrn_enabled =1 ;
@@ -1527,6 +1530,9 @@ int stop_topology_update(void) {int rc =0 ; +if (!topology_updates_enabled) +return 0 ; +if (prrn_enabled) { prrn_enabled =0 ;#ifdef CONFIG_SMP
@@ -1584,11 +1590,13 @@ static ssize_t topology_write(struct file *file, const char __user *buf, kbuf[read_len] ='\0' ; -if (!strncmp (kbuf,"on" ,2 )) +if (!strncmp (kbuf,"on" ,2 )) { + topology_updates_enabled = true;start_topology_update (); -else if (!strncmp (kbuf,"off" ,3 )) + }else if (!strncmp (kbuf,"off" ,3 )) {stop_topology_update (); -else + topology_updates_enabled = false; + }else return -EINVAL ;return count;
@@ -1603,9 +1611,7 @@ static const struct file_operations topology_ops = {static int topology_update_init (void ) { -/* Do not poll for changes if disabled at boot */ -if (topology_updates_enabled) -start_topology_update (); +start_topology_update ();if (vphn_enabled)topology_schedule_update ();
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 149/346 powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX
In reply to Greg Kroah-Hartman[ Upstream commit 56c46bba9bbfe229b4472a5be313c44c5b714a39 ]
With STRICT_KERNEL_RWX enabled anything marked __init is placed at a 16M boundary. This is necessary so that it can be repurposed later with different permissions. However, in kernels with text larger than 16M, this pushes early_setup past 32M, incapable of being reached by the branch instruction.
Fix this by setting the CTR and branching there instead.
--- arch/powerpc/kernel/head_64.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kernel/head_64.S +3 -1
@@ -970,7 +970,9 @@ start_here_multiplatform: /* Restore parameters passed from prom_init/kexec */ mr r3,r31 - bl early_setup /* also sets r13 and SPRG_PACA */ + LOAD_REG_ADDR(r12, DOTSYM(early_setup)) + mtctr r12 + bctrl /* also sets r13 and SPRG_PACA */ LOAD_REG_ADDR(r3, start_here_common) ld r4,PACAKMSR(r13)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 150/346 random: fix CRNG initialization when random.trust_cpu=1
In reply to Greg Kroah-Hartman[ Upstream commit fe6f1a6a8eedc1aa538fee0baa612b6a59639cf8 ]
When the system boots with random.trust_cpu=1 it doesn't initialize the per-NUMA CRNGs because it skips the rest of the CRNG startup code. This means that the code from 1e7f583af67b ("random: make /dev/urandom scalable for silly userspace programs") is not used when random.trust_cpu=1.
crash> dmesg | grep random:
[ 0.000000] random: get_random_bytes called from start_kernel+0x94/0x530 with crng_init=0 [ 0.314029] random: crng done (trusting CPU's manufacturer)
crash> print crng_node_pool
$6 = (struct crng_state **) 0x0
After adding the missing call to numa_crng_init() the per-NUMA CRNGs are initialized again:
crash> dmesg | grep random:
[ 0.000000] random: get_random_bytes called from start_kernel+0x94/0x530 with crng_init=0 [ 0.314031] random: crng done (trusting CPU's manufacturer)
crash> print crng_node_pool
$1 = (struct crng_state **) 0xffff9a915f4014a0
The call to invalidate_batched_entropy() was also missing. This is important for architectures like PPC and S390 which only have the arch_get_random_seed_* functions.
--- drivers/char/random.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/char/random.c +4 -1
@@ -777,6 +777,7 @@ static struct crng_state **crng_node_pool __read_mostly;#endif static void invalidate_batched_entropy (void ); +static void numa_crng_init (void );static bool trust_cpu__ro_after_init =IS_ENABLED (CONFIG_RANDOM_TRUST_CPU );static int __init parse_trust_cpu (char *arg)
@@ -805,7 +806,9 @@ static void crng_initialize(struct crng_state *crng) } crng->state[i] ^= rv; } -if (trust_cpu && arch_init) { +if (trust_cpu && arch_init && crng == &primary_crng) { +invalidate_batched_entropy (); +numa_crng_init (); crng_init =2 ;pr_notice ("random: crng done (trusting CPU's manufacturer)\n" ); }
Signature · 1 line
2.20.1