From: Rik van Riel <riel(a)surriel.com>
Subject: mm,vmscan: fix divide by zero in get_scan_count
Changeset f56ce412a59d ("mm: memcontrol: fix occasional OOMs due to
proportional memory.low reclaim") introduced a divide by zero corner case
when oomd is being used in combination with cgroup memory.low protection.
When oomd decides to kill a cgroup, it will force the cgroup memory to be
reclaimed after killing the tasks, by writing to the memory.max file for
that cgroup, forcing the remaining page cache and reclaimable slab to be
reclaimed down to zero.
Previously, on cgroups with some memory.low protection that would result
in the memory being reclaimed down to the memory.low limit, or likely not
at all, having the page cache reclaimed asynchronously later.
With f56ce412a59d the oomd write to memory.max tries to reclaim all the
way down to zero, which may race with another reclaimer, to the point of
ending up with the divide by zero below.
This patch implements the obvious fix.
Link: https://lkml.kernel.org/r/20210826220149.058089c6@imladris.surriel.com
Fixes: f56ce412a59d ("mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim")
Signed-off-by: Rik van Riel <riel(a)surriel.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Acked-by: Chris Down <chris(a)chrisdown.name>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/vmscan.c~mmvmscan-fix-divide-by-zero-in-get_scan_count
+++ a/mm/vmscan.c
@@ -2715,7 +2715,7 @@ out:
cgroup_size = max(cgroup_size, protection);
scan = lruvec_size - lruvec_size * protection /
- cgroup_size;
+ (cgroup_size + 1);
/*
* Minimally target SWAP_CLUSTER_MAX pages to keep
_
From: Li Zhijian <lizhijian(a)cn.fujitsu.com>
Subject: mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled
Previously, we noticed the one rpma example was failed[1] since
36f30e486d, where it will use ODP feature to do RDMA WRITE between fsdax
files.
After digging into the code, we found hmm_vma_handle_pte() will still
return EFAULT even though all the its requesting flags has been fulfilled.
That's because a DAX page will be marked as (_PAGE_SPECIAL | PAGE_DEVMAP)
by pte_mkdevmap().
[1]: https://github.com/pmem/rpma/issues/1142
Link: https://lkml.kernel.org/r/20210830094232.203029-1-lizhijian@cn.fujitsu.com
Fixes: 405506274922 ("mm/hmm: add missing call to hmm_pte_need_fault in HMM_PFN_SPECIAL handling")
Signed-off-by: Li Zhijian <lizhijian(a)cn.fujitsu.com>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Reviewed-by: Jason Gunthorpe <jgg(a)nvidia.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hmm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/mm/hmm.c~mm-hmm-bypass-devmap-pte-when-all-pfn-requested-flags-are-fulfilled
+++ a/mm/hmm.c
@@ -295,10 +295,13 @@ static int hmm_vma_handle_pte(struct mm_
goto fault;
/*
+ * Bypass devmap pte such as DAX page when all pfn requested
+ * flags(pfn_req_flags) are fulfilled.
* Since each architecture defines a struct page for the zero page, just
* fall through and treat it like a normal page.
*/
- if (pte_special(pte) && !is_zero_pfn(pte_pfn(pte))) {
+ if (pte_special(pte) && !pte_devmap(pte) &&
+ !is_zero_pfn(pte_pfn(pte))) {
if (hmm_pte_need_fault(hmm_vma_walk, pfn_req_flags, 0)) {
pte_unmap(ptep);
return -EFAULT;
_
The patch titled
Subject: mm, hwpoison: add is_free_buddy_page() in HWPoisonHandlable()
has been added to the -mm tree. Its filename is
mm-hwpoison-add-is_free_buddy_page-in-hwpoisonhandlable.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-hwpoison-add-is_free_buddy_pag…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-hwpoison-add-is_free_buddy_pag…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Subject: mm, hwpoison: add is_free_buddy_page() in HWPoisonHandlable()
commit fcc00621d88b ("mm/hwpoison: retry with shake_page() for unhandlable
pages") changes the return value of __get_hwpoison_page() to retry for
transiently unhandlable cases. However, __get_hwpoison_page() currently
fails to properly judge buddy pages as handlable, so hard/soft offline for
buddy pages always fail as "unhandlable page". This is totally
regrettable.
So let's add is_free_buddy_page() in HWPoisonHandlable(), so that
__get_hwpoison_page() returns different return values between buddy
pages and unhandlable pages as intended.
Link: https://lkml.kernel.org/r/20210909004131.163221-1-naoya.horiguchi@linux.dev
Fixes: fcc00621d88b ("mm/hwpoison: retry with shake_page() for unhandlable pages")
Signed-off-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Cc: Tony Luck <tony.luck(a)intel.com>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Yang Shi <shy828301(a)gmail.com>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory-failure.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/memory-failure.c~mm-hwpoison-add-is_free_buddy_page-in-hwpoisonhandlable
+++ a/mm/memory-failure.c
@@ -1126,7 +1126,7 @@ static int page_action(struct page_state
*/
static inline bool HWPoisonHandlable(struct page *page)
{
- return PageLRU(page) || __PageMovable(page);
+ return PageLRU(page) || __PageMovable(page) || is_free_buddy_page(page);
}
static int __get_hwpoison_page(struct page *page)
_
Patches currently in -mm which might be from naoya.horiguchi(a)nec.com are
mm-sparse-set-section_nid_shift-to-6.patch
mm-hwpoison-add-is_free_buddy_page-in-hwpoisonhandlable.patch
The following commit has been merged into the timers/urgent branch of tip:
Commit-ID: 39ff83f2f6cc5cc1458dfcea9697f96338210beb
Gitweb: https://git.kernel.org/tip/39ff83f2f6cc5cc1458dfcea9697f96338210beb
Author: Lukas Hannen <lukas.hannen(a)opensource.tttech-industrial.com>
AuthorDate: Wed, 25 Aug 2021 10:12:43
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Wed, 08 Sep 2021 17:44:26 +02:00
time: Handle negative seconds correctly in timespec64_to_ns()
timespec64_ns() prevents multiplication overflows by comparing the seconds
value of the timespec to KTIME_SEC_MAX. If the value is greater or equal it
returns KTIME_MAX.
But that check casts the signed seconds value to unsigned which makes the
comparision true for all negative values and therefore return wrongly
KTIME_MAX.
Negative second values are perfectly valid and required in some places,
e.g. ptp_clock_adjtime().
Remove the cast and add a check for the negative boundary which is required
to prevent undefined behaviour due to multiplication underflow.
Fixes: cb47755725da ("time: Prevent undefined behaviour in timespec64_to_ns()")'
Signed-off-by: Lukas Hannen <lukas.hannen(a)opensource.tttech-industrial.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/r/AM6PR01MB541637BD6F336B8FFB72AF80EEC69@AM6PR01MB5…
---
include/linux/time64.h | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/include/linux/time64.h b/include/linux/time64.h
index 5117cb5..81b9686 100644
--- a/include/linux/time64.h
+++ b/include/linux/time64.h
@@ -25,7 +25,9 @@ struct itimerspec64 {
#define TIME64_MIN (-TIME64_MAX - 1)
#define KTIME_MAX ((s64)~((u64)1 << 63))
+#define KTIME_MIN (-KTIME_MAX - 1)
#define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
+#define KTIME_SEC_MIN (KTIME_MIN / NSEC_PER_SEC)
/*
* Limits for settimeofday():
@@ -124,10 +126,13 @@ static inline bool timespec64_valid_settod(const struct timespec64 *ts)
*/
static inline s64 timespec64_to_ns(const struct timespec64 *ts)
{
- /* Prevent multiplication overflow */
- if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
+ /* Prevent multiplication overflow / underflow */
+ if (ts->tv_sec >= KTIME_SEC_MAX)
return KTIME_MAX;
+ if (ts->tv_sec <= KTIME_SEC_MIN)
+ return KTIME_MIN;
+
return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec;
}
This reverts commit 8def9ec46a5fafc0abcf34489a9e8a787bca984d.
The firmware keep-alive does not cause any event in case of error
such as non acked. It's just a basic keep alive to prevent the AP
to kick-off the station due to inactivity. So let mac80211 submit
its own monitoring packet (probe/null) and disconnect on timeout.
Note: We want to keep firmware keep alive to prevent kick-off
when host is in suspend-to-mem (no mac80211 monitor packet).
Ideally fw keep alive should be enabled in suspend path and disabled
in resume path to prevent having both firmware and mac80211 submitting
periodic null packets.
This fixes non detected AP leaving issues in active mode (nothing
monitors beacon or connection).
Cc: stable(a)vger.kernel.org
Fixes: 8def9ec46a5f ("wcn36xx: Enable firmware link monitoring")
Signed-off-by: Loic Poulain <loic.poulain(a)linaro.org>
---
drivers/net/wireless/ath/wcn36xx/main.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 216bc34..128d25d 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1362,7 +1362,6 @@ static int wcn36xx_init_ieee80211(struct wcn36xx *wcn)
ieee80211_hw_set(wcn->hw, HAS_RATE_CONTROL);
ieee80211_hw_set(wcn->hw, SINGLE_SCAN_ON_ALL_BANDS);
ieee80211_hw_set(wcn->hw, REPORTS_TX_ACK_STATUS);
- ieee80211_hw_set(wcn->hw, CONNECTION_MONITOR);
wcn->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
BIT(NL80211_IFTYPE_AP) |
--
2.7.4
I'm announcing the release of the 5.14.2 kernel.
All users of the 5.14 kernel series must upgrade.
The updated 5.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/xtensa/Kconfig | 2 +-
drivers/hid/usbhid/hid-core.c | 16 ++++++++--------
drivers/media/usb/stkwebcam/stk-webcam.c | 6 ++++--
drivers/usb/serial/cp210x.c | 21 +++++++++++++--------
drivers/usb/serial/pl2303.c | 1 +
fs/ext4/inline.c | 6 ++++++
fs/ext4/super.c | 8 ++++++++
sound/core/pcm_lib.c | 2 +-
sound/pci/hda/patch_realtek.c | 11 +++++++++++
sound/usb/card.h | 2 ++
sound/usb/endpoint.c | 9 +++++++++
sound/usb/pcm.c | 13 +++++++++++--
13 files changed, 76 insertions(+), 23 deletions(-)
Alan Stern (1):
HID: usbhid: Fix warning caused by 0-length input reports
Greg Kroah-Hartman (1):
Linux 5.14.2
Jan Kara (1):
ext4: fix e2fsprogs checksum failure for mounted filesystem
Johan Hovold (2):
USB: serial: cp210x: fix control-characters error handling
USB: serial: cp210x: fix flow-control error handling
Johnathon Clark (1):
ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
Michal Kubecek (1):
HID: usbhid: Fix flood of "control queue full" messages
Pavel Skripkin (1):
media: stkwebcam: fix memory leak in stk_camera_probe
Randy Dunlap (1):
xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
Robert Marko (1):
USB: serial: pl2303: fix GL type detection
Takashi Iwai (3):
ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC
ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
ALSA: usb-audio: Work around for XRUN with low latency playback
Theodore Ts'o (1):
ext4: fix race writing to an inline_data file while its xattrs are changing
Zubin Mithra (1):
ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
From: David Hildenbrand <david(a)redhat.com>
Subject: mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
Patch series "mm/memory_hotplug: preparatory patches for new online policy and memory"
These are all cleanups and one fix previously sent as part of [1]:
[PATCH v1 00/12] mm/memory_hotplug: "auto-movable" online policy and memory
groups.
These patches make sense even without the other series, therefore I pulled
them out to make the other series easier to digest.
[1] https://lkml.kernel.org/r/20210607195430.48228-1-david@redhat.com
This patch (of 4):
Checkpatch complained on a follow-up patch that we are using "unsigned"
here, which defaults to "unsigned int" and checkpatch is correct.
As we will search for a fitting zone using the wrong pfn, we might end
up onlining memory to one of the special kernel zones, such as ZONE_DMA,
which can end badly as the onlined memory does not satisfy properties of
these zones.
Use "unsigned long" instead, just as we do in other places when handling
PFNs. This can bite us once we have physical addresses in the range of
multiple TB.
Link: https://lkml.kernel.org/r/20210712124052.26491-2-david@redhat.com
Fixes: e5e689302633 ("mm, memory_hotplug: display allowed zones in the preferred ordering")
Signed-off-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta(a)ionos.com>
Reviewed-by: Muchun Song <songmuchun(a)bytedance.com>
Reviewed-by: Oscar Salvador <osalvador(a)suse.de>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: Vitaly Kuznetsov <vkuznets(a)redhat.com>
Cc: "Michael S. Tsirkin" <mst(a)redhat.com>
Cc: Jason Wang <jasowang(a)redhat.com>
Cc: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com>
Cc: Wei Yang <richard.weiyang(a)linux.alibaba.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Dan Williams <dan.j.williams(a)intel.com>
Cc: Anshuman Khandual <anshuman.khandual(a)arm.com>
Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Mike Rapoport <rppt(a)kernel.org>
Cc: "Rafael J. Wysocki" <rjw(a)rjwysocki.net>
Cc: Len Brown <lenb(a)kernel.org>
Cc: Pavel Tatashin <pasha.tatashin(a)soleen.com>
Cc: Heiko Carstens <hca(a)linux.ibm.com>
Cc: Michael Ellerman <mpe(a)ellerman.id.au>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: virtualization(a)lists.linux-foundation.org
Cc: Andy Lutomirski <luto(a)kernel.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.ibm.com>
Cc: Anton Blanchard <anton(a)ozlabs.org>
Cc: Ard Biesheuvel <ardb(a)kernel.org>
Cc: Baoquan He <bhe(a)redhat.com>
Cc: Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
Cc: Borislav Petkov <bp(a)alien8.de>
Cc: Christian Borntraeger <borntraeger(a)de.ibm.com>
Cc: Christophe Leroy <christophe.leroy(a)c-s.fr>
Cc: Dave Jiang <dave.jiang(a)intel.com>
Cc: "H. Peter Anvin" <hpa(a)zytor.com>
Cc: Ingo Molnar <mingo(a)redhat.com>
Cc: Jia He <justin.he(a)arm.com>
Cc: Joe Perches <joe(a)perches.com>
Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com>
Cc: Laurent Dufour <ldufour(a)linux.ibm.com>
Cc: Michel Lespinasse <michel(a)lespinasse.org>
Cc: Nathan Lynch <nathanl(a)linux.ibm.com>
Cc: Nicholas Piggin <npiggin(a)gmail.com>
Cc: Paul Mackerras <paulus(a)samba.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Pierre Morel <pmorel(a)linux.ibm.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com>
Cc: Rich Felker <dalias(a)libc.org>
Cc: Scott Cheloha <cheloha(a)linux.ibm.com>
Cc: Sergei Trofimovich <slyfox(a)gentoo.org>
Cc: Thiago Jung Bauermann <bauerman(a)linux.ibm.com>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Vasily Gorbik <gor(a)linux.ibm.com>
Cc: Vishal Verma <vishal.l.verma(a)intel.com>
Cc: Will Deacon <will(a)kernel.org>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/memory_hotplug.h | 4 ++--
mm/memory_hotplug.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/include/linux/memory_hotplug.h~mm-memory_hotplug-use-unsigned-long-for-pfn-in-zone_for_pfn_range
+++ a/include/linux/memory_hotplug.h
@@ -339,8 +339,8 @@ extern void sparse_remove_section(struct
unsigned long map_offset, struct vmem_altmap *altmap);
extern struct page *sparse_decode_mem_map(unsigned long coded_mem_map,
unsigned long pnum);
-extern struct zone *zone_for_pfn_range(int online_type, int nid, unsigned start_pfn,
- unsigned long nr_pages);
+extern struct zone *zone_for_pfn_range(int online_type, int nid,
+ unsigned long start_pfn, unsigned long nr_pages);
extern int arch_create_linear_mapping(int nid, u64 start, u64 size,
struct mhp_params *params);
void arch_remove_linear_mapping(u64 start, u64 size);
--- a/mm/memory_hotplug.c~mm-memory_hotplug-use-unsigned-long-for-pfn-in-zone_for_pfn_range
+++ a/mm/memory_hotplug.c
@@ -708,8 +708,8 @@ static inline struct zone *default_zone_
return movable_node_enabled ? movable_zone : kernel_zone;
}
-struct zone *zone_for_pfn_range(int online_type, int nid, unsigned start_pfn,
- unsigned long nr_pages)
+struct zone *zone_for_pfn_range(int online_type, int nid,
+ unsigned long start_pfn, unsigned long nr_pages)
{
if (online_type == MMOP_ONLINE_KERNEL)
return default_kernel_zone_for_pfn(nid, start_pfn, nr_pages);
_
This is the start of the stable review cycle for the 5.14.2 release.
There are 14 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Sep 2021 12:54:40 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.2-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.14.2-rc1
Pavel Skripkin <paskripkin(a)gmail.com>
media: stkwebcam: fix memory leak in stk_camera_probe
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Work around for XRUN with low latency playback
Zubin Mithra <zsm(a)chromium.org>
ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC
Johnathon Clark <john.clark(a)cantab.net>
ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
Alan Stern <stern(a)rowland.harvard.edu>
HID: usbhid: Fix warning caused by 0-length input reports
Michal Kubecek <mkubecek(a)suse.cz>
HID: usbhid: Fix flood of "control queue full" messages
Johan Hovold <johan(a)kernel.org>
USB: serial: cp210x: fix flow-control error handling
Johan Hovold <johan(a)kernel.org>
USB: serial: cp210x: fix control-characters error handling
Robert Marko <robert.marko(a)sartura.hr>
USB: serial: pl2303: fix GL type detection
Randy Dunlap <rdunlap(a)infradead.org>
xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
Jan Kara <jack(a)suse.cz>
ext4: fix e2fsprogs checksum failure for mounted filesystem
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix race writing to an inline_data file while its xattrs are changing
-------------
Diffstat:
Makefile | 4 ++--
arch/xtensa/Kconfig | 2 +-
drivers/hid/usbhid/hid-core.c | 16 ++++++++--------
drivers/media/usb/stkwebcam/stk-webcam.c | 6 ++++--
drivers/usb/serial/cp210x.c | 21 +++++++++++++--------
drivers/usb/serial/pl2303.c | 1 +
fs/ext4/inline.c | 6 ++++++
fs/ext4/super.c | 8 ++++++++
sound/core/pcm_lib.c | 2 +-
sound/pci/hda/patch_realtek.c | 11 +++++++++++
sound/usb/card.h | 2 ++
sound/usb/endpoint.c | 9 +++++++++
sound/usb/pcm.c | 13 +++++++++++--
13 files changed, 77 insertions(+), 24 deletions(-)
This is the start of the stable review cycle for the 5.13.15 release.
There are 24 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Sep 2021 12:54:40 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.15-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.13.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.13.15-rc1
Pavel Skripkin <paskripkin(a)gmail.com>
media: stkwebcam: fix memory leak in stk_camera_probe
Zubin Mithra <zsm(a)chromium.org>
ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC
Johnathon Clark <john.clark(a)cantab.net>
ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
Johan Hovold <johan(a)kernel.org>
USB: serial: cp210x: fix flow-control error handling
Johan Hovold <johan(a)kernel.org>
USB: serial: cp210x: fix control-characters error handling
Robert Marko <robert.marko(a)sartura.hr>
USB: serial: pl2303: fix GL type detection
Randy Dunlap <rdunlap(a)infradead.org>
xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
Christoph Hellwig <hch(a)lst.de>
cryptoloop: add a deprecation warning
Kim Phillips <kim.phillips(a)amd.com>
perf/x86/amd/power: Assign pmu.module
Kim Phillips <kim.phillips(a)amd.com>
perf/x86/amd/ibs: Work around erratum #1197
Tuo Li <islituo(a)gmail.com>
ceph: fix possible null-pointer dereference in ceph_mdsmap_decode()
Xiaoyao Li <xiaoyao.li(a)intel.com>
perf/x86/intel/pt: Fix mask of num_address_ranges
Shai Malin <smalin(a)marvell.com>
qede: Fix memset corruption
Harini Katakam <harini.katakam(a)xilinx.com>
net: macb: Add a NULL check on desc_ptp
Bin Meng <bin.meng(a)windriver.com>
riscv: dts: microchip: Add ethernet0 to the aliases node
Bin Meng <bin.meng(a)windriver.com>
riscv: dts: microchip: Use 'local-mac-address' for emac1
Nathan Rossi <nathan.rossi(a)digi.com>
net: dsa: mv88e6xxx: Update mv88e6393x serdes errata
Shai Malin <smalin(a)marvell.com>
qed: Fix the VF msix vectors flow
Sai Krishna Potthuri <lakshmi.sai.krishna.potthuri(a)xilinx.com>
reset: reset-zynqmp: Fixed the argument data type
Krzysztof Hałasa <khalasa(a)piap.pl>
gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats
Jan Kara <jack(a)suse.cz>
ext4: fix e2fsprogs checksum failure for mounted filesystem
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix race writing to an inline_data file while its xattrs are changing
-------------
Diffstat:
Makefile | 4 +--
.../dts/microchip/microchip-mpfs-icicle-kit.dts | 4 +++
arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi | 2 +-
arch/x86/events/amd/ibs.c | 8 ++++++
arch/x86/events/amd/power.c | 1 +
arch/x86/events/intel/pt.c | 2 +-
arch/xtensa/Kconfig | 2 +-
drivers/block/Kconfig | 4 +--
drivers/block/cryptoloop.c | 2 ++
drivers/gpu/ipu-v3/ipu-cpmem.c | 30 +++++++++++-----------
drivers/media/usb/stkwebcam/stk-webcam.c | 6 +++--
drivers/net/dsa/mv88e6xxx/serdes.c | 11 ++++----
drivers/net/ethernet/cadence/macb_ptp.c | 11 +++++++-
drivers/net/ethernet/qlogic/qed/qed_main.c | 7 ++++-
drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +-
drivers/reset/reset-zynqmp.c | 3 ++-
drivers/usb/serial/cp210x.c | 21 +++++++++------
drivers/usb/serial/pl2303.c | 1 +
fs/ceph/mdsmap.c | 8 +++---
fs/ext4/inline.c | 6 +++++
fs/ext4/super.c | 8 ++++++
sound/core/pcm_lib.c | 2 +-
sound/pci/hda/patch_realtek.c | 11 ++++++++
sound/usb/endpoint.c | 5 ++++
24 files changed, 116 insertions(+), 45 deletions(-)
This is the start of the stable review cycle for the 5.10.63 release.
There are 29 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Sep 2021 12:54:40 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.63-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.63-rc1
Pavel Skripkin <paskripkin(a)gmail.com>
media: stkwebcam: fix memory leak in stk_camera_probe
Amir Goldstein <amir73il(a)gmail.com>
fuse: fix illegal access to inode with reused nodeid
Al Viro <viro(a)zeniv.linux.org.uk>
new helper: inode_wrong_type()
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
spi: Switch to signed types for *_native_cs SPI controller fields
Vignesh Raghavendra <vigneshr(a)ti.com>
serial: 8250: 8250_omap: Fix possible array out of bounds access
Zubin Mithra <zsm(a)chromium.org>
ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
Johnathon Clark <john.clark(a)cantab.net>
ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
Christoph Hellwig <hch(a)lst.de>
cryptoloop: add a deprecation warning
Kim Phillips <kim.phillips(a)amd.com>
perf/x86/amd/power: Assign pmu.module
Kim Phillips <kim.phillips(a)amd.com>
perf/x86/amd/ibs: Work around erratum #1197
Tuo Li <islituo(a)gmail.com>
ceph: fix possible null-pointer dereference in ceph_mdsmap_decode()
Xiaoyao Li <xiaoyao.li(a)intel.com>
perf/x86/intel/pt: Fix mask of num_address_ranges
Shai Malin <smalin(a)marvell.com>
qede: Fix memset corruption
Harini Katakam <harini.katakam(a)xilinx.com>
net: macb: Add a NULL check on desc_ptp
Shai Malin <smalin(a)marvell.com>
qed: Fix the VF msix vectors flow
Sai Krishna Potthuri <lakshmi.sai.krishna.potthuri(a)xilinx.com>
reset: reset-zynqmp: Fixed the argument data type
Krzysztof Hałasa <khalasa(a)piap.pl>
gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats
Maciej Falkowski <maciej.falkowski9(a)gmail.com>
ARM: OMAP1: ams-delta: remove unused function ams_delta_camera_power
Randy Dunlap <rdunlap(a)infradead.org>
xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
Matthieu Baerts <matthieu.baerts(a)tessares.net>
static_call: Fix unused variable warn w/o MODULE
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "Add a reference to ucounts for each cred"
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "cred: add missing return error code when set_cred_ucounts() failed"
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "ucounts: Increase ucounts reference counter before the security hook"
Eric Biggers <ebiggers(a)google.com>
ubifs: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
f2fs: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
ext4: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
fscrypt: add fscrypt_symlink_getattr() for computing st_size
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix race writing to an inline_data file while its xattrs are changing
-------------
Diffstat:
Makefile | 4 +--
arch/arm/mach-omap1/board-ams-delta.c | 14 ---------
arch/x86/events/amd/ibs.c | 8 +++++
arch/x86/events/amd/power.c | 1 +
arch/x86/events/intel/pt.c | 2 +-
arch/xtensa/Kconfig | 2 +-
drivers/block/Kconfig | 4 +--
drivers/block/cryptoloop.c | 2 ++
drivers/gpu/ipu-v3/ipu-cpmem.c | 30 +++++++++----------
drivers/media/usb/stkwebcam/stk-webcam.c | 6 ++--
drivers/net/ethernet/cadence/macb_ptp.c | 11 ++++++-
drivers/net/ethernet/qlogic/qed/qed_main.c | 7 ++++-
drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +-
drivers/reset/reset-zynqmp.c | 3 +-
drivers/tty/serial/8250/8250_omap.c | 1 +
fs/9p/vfs_inode.c | 4 +--
fs/9p/vfs_inode_dotl.c | 4 +--
fs/ceph/mdsmap.c | 8 +++--
fs/cifs/inode.c | 5 ++--
fs/crypto/hooks.c | 44 ++++++++++++++++++++++++++++
fs/exec.c | 4 ---
fs/ext4/inline.c | 6 ++++
fs/ext4/symlink.c | 11 ++++++-
fs/f2fs/namei.c | 11 ++++++-
fs/fuse/dir.c | 6 ++--
fs/fuse/fuse_i.h | 7 +++++
fs/fuse/inode.c | 4 +--
fs/fuse/readdir.c | 7 +++--
fs/nfs/inode.c | 6 ++--
fs/nfsd/nfsproc.c | 2 +-
fs/overlayfs/namei.c | 4 +--
fs/ubifs/file.c | 12 +++++++-
include/linux/cred.h | 2 --
include/linux/fs.h | 5 ++++
include/linux/fscrypt.h | 7 +++++
include/linux/spi/spi.h | 4 +--
include/linux/user_namespace.h | 4 ---
kernel/cred.c | 41 --------------------------
kernel/fork.c | 6 ----
kernel/static_call.c | 4 +--
kernel/sys.c | 12 --------
kernel/ucount.c | 40 ++-----------------------
kernel/user_namespace.c | 3 --
sound/core/pcm_lib.c | 2 +-
sound/pci/hda/patch_realtek.c | 11 +++++++
45 files changed, 202 insertions(+), 181 deletions(-)
The patch titled
Subject: mm/mempolicy: fix a race between offset_il_node and mpol_rebind_task
has been added to the -mm tree. Its filename is
mm-mempolicy-fix-a-race-between-offset_il_node-and-mpol_rebind_task.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-mempolicy-fix-a-race-between-o…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-mempolicy-fix-a-race-between-o…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: yanghui <yanghui.def(a)bytedance.com>
Subject: mm/mempolicy: fix a race between offset_il_node and mpol_rebind_task
Servers happened below panic:
Kernel version:5.4.56
BUG: unable to handle page fault for address: 0000000000002c48
RIP: 0010:__next_zones_zonelist+0x1d/0x40
[264003.977696] RAX: 0000000000002c40 RBX: 0000000000100dca RCX: 0000000000000014
[264003.977872] Call Trace:
[264003.977888] __alloc_pages_nodemask+0x277/0x310
[264003.977908] alloc_page_interleave+0x13/0x70
[264003.977926] handle_mm_fault+0xf99/0x1390
[264003.977951] __do_page_fault+0x288/0x500
[264003.977979] ? schedule+0x39/0xa0
[264003.977994] do_page_fault+0x30/0x110
[264003.978010] page_fault+0x3e/0x50
The reason for the panic is that MAX_NUMNODES is passed in the third
parameter in __alloc_pages_nodemask(preferred_nid). So access to
zonelist->zoneref->zone_idx in __next_zones_zonelist will cause a panic.
In offset_il_node(), first_node() returns nid from pol->v.nodes, after
this other threads may chang pol->v.nodes before next_node(). This race
condition will let next_node return MAX_NUMNODES. So put pol->nodes in a
local variable.
The race condition is between offset_il_node and cpuset_change_task_nodemask:
CPU0: CPU1:
alloc_pages_vma()
interleave_nid(pol,)
offset_il_node(pol,)
first_node(pol->v.nodes) cpuset_change_task_nodemask
//nodes==0xc mpol_rebind_task
mpol_rebind_policy
mpol_rebind_nodemask(pol,nodes)
//nodes==0x3
next_node(nid, pol->v.nodes)//return MAX_NUMNODES
Link: https://lkml.kernel.org/r/20210906034658.48721-1-yanghui.def@bytedance.com
Signed-off-by: yanghui <yanghui.def(a)bytedance.com>
Reviewed-by: Muchun Song <songmuchun(a)bytedance.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/mempolicy.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/mm/mempolicy.c~mm-mempolicy-fix-a-race-between-offset_il_node-and-mpol_rebind_task
+++ a/mm/mempolicy.c
@@ -1979,17 +1979,26 @@ unsigned int mempolicy_slab_node(void)
*/
static unsigned offset_il_node(struct mempolicy *pol, unsigned long n)
{
- unsigned nnodes = nodes_weight(pol->nodes);
- unsigned target;
+ nodemask_t nodemask = pol->nodes;
+ unsigned int target, nnodes;
int i;
int nid;
+ /*
+ * The barrier will stabilize the nodemask in a register or on
+ * the stack so that it will stop changing under the code.
+ *
+ * Between first_node() and next_node(), pol->nodes could be changed
+ * by other threads. So we put pol->nodes in a local stack.
+ */
+ barrier();
+ nnodes = nodes_weight(nodemask);
if (!nnodes)
return numa_node_id();
target = (unsigned int)n % nnodes;
- nid = first_node(pol->nodes);
+ nid = first_node(nodemask);
for (i = 0; i < target; i++)
- nid = next_node(nid, pol->nodes);
+ nid = next_node(nid, nodemask);
return nid;
}
_
Patches currently in -mm which might be from yanghui.def(a)bytedance.com are
mm-mempolicy-fix-a-race-between-offset_il_node-and-mpol_rebind_task.patch
of_parse_thermal_zones() parses the thermal-zones node and registers a
thermal_zone device for each subnode. However, if a thermal zone is
consuming a thermal sensor and that thermal sensor device hasn't probed
yet, an attempt to set trip_point_*_temp for that thermal zone device
can cause a NULL pointer dereference. Fix it.
console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp
...
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
...
Call trace:
of_thermal_set_trip_temp+0x40/0xc4
trip_point_temp_store+0xc0/0x1dc
dev_attr_store+0x38/0x88
sysfs_kf_write+0x64/0xc0
kernfs_fop_write_iter+0x108/0x1d0
vfs_write+0x2f4/0x368
ksys_write+0x7c/0xec
__arm64_sys_write+0x20/0x30
el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc
do_el0_svc+0x28/0xa0
el0_svc+0x14/0x24
el0_sync_handler+0x88/0xec
el0_sync+0x1c0/0x200
Cc: stable(a)vger.kernel.org
Suggested-by: David Collins <quic_collinsd(a)quicinc.com>
Signed-off-by: Subbaraman Narayanamurthy <quic_subbaram(a)quicinc.com>
---
drivers/thermal/thermal_of.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
index 6379f26..ba53252 100644
--- a/drivers/thermal/thermal_of.c
+++ b/drivers/thermal/thermal_of.c
@@ -301,7 +301,7 @@ static int of_thermal_set_trip_temp(struct thermal_zone_device *tz, int trip,
if (trip >= data->ntrips || trip < 0)
return -EDOM;
- if (data->ops->set_trip_temp) {
+ if (data->ops && data->ops->set_trip_temp) {
int ret;
ret = data->ops->set_trip_temp(data->sensor_data, trip, temp);
--
2.7.4
If the driver runs out of minor numbers it would release minor 0 and
allow another device to claim the minor while still in use.
Fortunately, registering the tty class device of the second device would
fail (with a stack dump) due to the sysfs name collision so no memory is
leaked.
Fixes: cae2bc768d17 ("usb: cdc-acm: Decrement tty port's refcount if probe() fail")
Cc: stable(a)vger.kernel.org # 4.19
Cc: Jaejoong Kim <climbbb.kim(a)gmail.com>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
Changes in v2
- add a dedicated define for the invalid minor number (Oliver)
drivers/usb/class/cdc-acm.c | 7 +++++--
drivers/usb/class/cdc-acm.h | 2 ++
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 4895325b16a4..5b90d0979c60 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -726,7 +726,8 @@ static void acm_port_destruct(struct tty_port *port)
{
struct acm *acm = container_of(port, struct acm, port);
- acm_release_minor(acm);
+ if (acm->minor != ACM_MINOR_INVALID)
+ acm_release_minor(acm);
usb_put_intf(acm->control);
kfree(acm->country_codes);
kfree(acm);
@@ -1323,8 +1324,10 @@ static int acm_probe(struct usb_interface *intf,
usb_get_intf(acm->control); /* undone in destruct() */
minor = acm_alloc_minor(acm);
- if (minor < 0)
+ if (minor < 0) {
+ acm->minor = ACM_MINOR_INVALID;
goto err_put_port;
+ }
acm->minor = minor;
acm->dev = usb_dev;
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 8aef5eb769a0..3aa7f0a3ad71 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -22,6 +22,8 @@
#define ACM_TTY_MAJOR 166
#define ACM_TTY_MINORS 256
+#define ACM_MINOR_INVALID ACM_TTY_MINORS
+
/*
* Requests.
*/
--
2.32.0
If the driver runs out of minor numbers it would release minor 0 and
allow another device to claim the minor while still in use.
Fortunately, registering the tty class device of the second device would
fail (with a stack dump) due to the sysfs name collision so no memory is
leaked.
Fixes: cae2bc768d17 ("usb: cdc-acm: Decrement tty port's refcount if probe() fail")
Cc: stable(a)vger.kernel.org # 4.19
Cc: Jaejoong Kim <climbbb.kim(a)gmail.com>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/usb/class/cdc-acm.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 4895325b16a4..5f0260bc4469 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -726,7 +726,8 @@ static void acm_port_destruct(struct tty_port *port)
{
struct acm *acm = container_of(port, struct acm, port);
- acm_release_minor(acm);
+ if (acm->minor != ACM_TTY_MINORS)
+ acm_release_minor(acm);
usb_put_intf(acm->control);
kfree(acm->country_codes);
kfree(acm);
@@ -1323,8 +1324,10 @@ static int acm_probe(struct usb_interface *intf,
usb_get_intf(acm->control); /* undone in destruct() */
minor = acm_alloc_minor(acm);
- if (minor < 0)
+ if (minor < 0) {
+ acm->minor = ACM_TTY_MINORS;
goto err_put_port;
+ }
acm->minor = minor;
acm->dev = usb_dev;
--
2.32.0
From: Pawel Laszczak <pawell(a)cadence.com>
For DEV_VER_V3 version there exist race condition between clearing
ep_sts.EP_STS_TRBERR and setting ep_cmd.EP_CMD_DRDY bit.
Setting EP_CMD_DRDY will be ignored by controller when
EP_STS_TRBERR is set. So, between these two instructions we have
a small time gap in which the EP_STSS_TRBERR can be set. In such case
the transfer will not start after setting doorbell.
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
cc: <stable(a)vger.kernel.org> # 5.12.x
Signed-off-by: Pawel Laszczak <pawell(a)cadence.com>
---
drivers/usb/cdns3/cdns3-gadget.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index 80aaab159e58..e9769fab21ea 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -1100,6 +1100,19 @@ static int cdns3_ep_run_stream_transfer(struct cdns3_endpoint *priv_ep,
return 0;
}
+static void cdns3_rearm_drdy_if_needed(struct cdns3_endpoint *priv_ep)
+{
+ struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
+
+ if (priv_dev->dev_ver < DEV_VER_V3)
+ return;
+
+ if (readl(&priv_dev->regs->ep_sts) & EP_STS_TRBERR) {
+ writel(EP_STS_TRBERR, &priv_dev->regs->ep_sts);
+ writel(EP_CMD_DRDY, &priv_dev->regs->ep_cmd);
+ }
+}
+
/**
* cdns3_ep_run_transfer - start transfer on no-default endpoint hardware
* @priv_ep: endpoint object
@@ -1351,6 +1364,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
/*clearing TRBERR and EP_STS_DESCMIS before seting DRDY*/
writel(EP_STS_TRBERR | EP_STS_DESCMIS, &priv_dev->regs->ep_sts);
writel(EP_CMD_DRDY, &priv_dev->regs->ep_cmd);
+ cdns3_rearm_drdy_if_needed(priv_ep);
trace_cdns3_doorbell_epx(priv_ep->name,
readl(&priv_dev->regs->ep_traddr));
}
--
2.25.1
From: Colin Ian King <colin.king(a)canonical.com>
commit 20fb73911fec01f06592de1cdbca00b66602ebd7 upstream.
The function imx_mmdc_perf_init recently had a 3rd argument added to
it but the equivalent macro was not updated and is still the older
2 argument version. Fix this by adding in the missing 3rd argumement
mmdc_ipg_clk.
Fixes: f07ec8536580 ("ARM: imx: add missing clk_disable_unprepare()")
Signed-off-by: Colin Ian King <colin.king(a)canonical.com>
Signed-off-by: Shawn Guo <shawnguo(a)kernel.org>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu(a)toshiba.co.jp>
---
arch/arm/mach-imx/mmdc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
index ba830be0b53102..14be73ca107a5e 100644
--- a/arch/arm/mach-imx/mmdc.c
+++ b/arch/arm/mach-imx/mmdc.c
@@ -545,7 +545,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
#else
#define imx_mmdc_remove NULL
-#define imx_mmdc_perf_init(pdev, mmdc_base) 0
+#define imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk) 0
#endif
static int imx_mmdc_probe(struct platform_device *pdev)
--
2.33.0
From: Dan Carpenter <dan.carpenter(a)oracle.com>
There are two bugs:
1) If ida_simple_get() fails then this code calls put_device(carrier)
but we haven't yet called get_device(carrier) and probably that
leads to a use after free.
2) After device_initialize() then we need to use put_device() to
release the bus. This will free the internal resources tied to the
device and call mcb_free_bus() which will free the rest.
Fixes: 5d9e2ab9fea4 ("mcb: Implement bus->dev.release callback")
Fixes: 18d288198099 ("mcb: Correctly initialize the bus's device")
Cc: stable(a)vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Signed-off-by: Johannes Thumshirn <jth(a)kernel.org>
---
drivers/mcb/mcb-core.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index edf4ee6eff25..cf128b3471d7 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -275,8 +275,8 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
bus_nr = ida_simple_get(&mcb_ida, 0, 0, GFP_KERNEL);
if (bus_nr < 0) {
- rc = bus_nr;
- goto err_free;
+ kfree(bus);
+ return ERR_PTR(bus_nr);
}
bus->bus_nr = bus_nr;
@@ -291,12 +291,12 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
dev_set_name(&bus->dev, "mcb:%d", bus_nr);
rc = device_add(&bus->dev);
if (rc)
- goto err_free;
+ goto err_put;
return bus;
-err_free:
- put_device(carrier);
- kfree(bus);
+
+err_put:
+ put_device(&bus->dev);
return ERR_PTR(rc);
}
EXPORT_SYMBOL_NS_GPL(mcb_alloc_bus, MCB);
--
2.32.0
From: Peter Zijlstra <peterz(a)infradead.org>
[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
Yanfei reported that setting HANDOFF should not depend on recomputing
@first, only on @first state. Which would then give:
if (ww_ctx || !first)
first = __mutex_waiter_is_first(lock, &waiter);
if (first)
__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
But because 'ww_ctx || !first' is basically 'always' and the test for
first is relatively cheap, omit that first branch entirely.
Reported-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Waiman Long <longman(a)redhat.com>
Reviewed-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/mutex.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index 354151fef06a..fbc62d360419 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -911,7 +911,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
{
struct mutex_waiter waiter;
- bool first = false;
struct ww_mutex *ww;
int ret;
@@ -986,6 +985,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
set_current_state(state);
for (;;) {
+ bool first;
+
/*
* Once we hold wait_lock, we're serialized against
* mutex_unlock() handing the lock off to us, do a trylock
@@ -1014,15 +1015,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
spin_unlock(&lock->wait_lock);
schedule_preempt_disabled();
- /*
- * ww_mutex needs to always recheck its position since its waiter
- * list is not FIFO ordered.
- */
- if (ww_ctx || !first) {
- first = __mutex_waiter_is_first(lock, &waiter);
- if (first)
- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
- }
+ first = __mutex_waiter_is_first(lock, &waiter);
+ if (first)
+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
set_current_state(state);
/*
--
2.30.2
From: Peter Zijlstra <peterz(a)infradead.org>
[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
Yanfei reported that setting HANDOFF should not depend on recomputing
@first, only on @first state. Which would then give:
if (ww_ctx || !first)
first = __mutex_waiter_is_first(lock, &waiter);
if (first)
__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
But because 'ww_ctx || !first' is basically 'always' and the test for
first is relatively cheap, omit that first branch entirely.
Reported-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Waiman Long <longman(a)redhat.com>
Reviewed-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/mutex.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index c0c7784f074b..b02fff28221f 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -938,7 +938,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
{
struct mutex_waiter waiter;
- bool first = false;
struct ww_mutex *ww;
int ret;
@@ -1017,6 +1016,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
set_current_state(state);
for (;;) {
+ bool first;
+
/*
* Once we hold wait_lock, we're serialized against
* mutex_unlock() handing the lock off to us, do a trylock
@@ -1045,15 +1046,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
spin_unlock(&lock->wait_lock);
schedule_preempt_disabled();
- /*
- * ww_mutex needs to always recheck its position since its waiter
- * list is not FIFO ordered.
- */
- if (ww_ctx || !first) {
- first = __mutex_waiter_is_first(lock, &waiter);
- if (first)
- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
- }
+ first = __mutex_waiter_is_first(lock, &waiter);
+ if (first)
+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
set_current_state(state);
/*
--
2.30.2
From: Peter Zijlstra <peterz(a)infradead.org>
[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
Yanfei reported that setting HANDOFF should not depend on recomputing
@first, only on @first state. Which would then give:
if (ww_ctx || !first)
first = __mutex_waiter_is_first(lock, &waiter);
if (first)
__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
But because 'ww_ctx || !first' is basically 'always' and the test for
first is relatively cheap, omit that first branch entirely.
Reported-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Waiman Long <longman(a)redhat.com>
Reviewed-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/mutex.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index 15ac7c4bb111..86061901636c 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -938,7 +938,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
{
struct mutex_waiter waiter;
- bool first = false;
struct ww_mutex *ww;
int ret;
@@ -1017,6 +1016,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
set_current_state(state);
for (;;) {
+ bool first;
+
/*
* Once we hold wait_lock, we're serialized against
* mutex_unlock() handing the lock off to us, do a trylock
@@ -1045,15 +1046,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
spin_unlock(&lock->wait_lock);
schedule_preempt_disabled();
- /*
- * ww_mutex needs to always recheck its position since its waiter
- * list is not FIFO ordered.
- */
- if (ww_ctx || !first) {
- first = __mutex_waiter_is_first(lock, &waiter);
- if (first)
- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
- }
+ first = __mutex_waiter_is_first(lock, &waiter);
+ if (first)
+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
set_current_state(state);
/*
--
2.30.2
From: Peter Zijlstra <peterz(a)infradead.org>
[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
Yanfei reported that setting HANDOFF should not depend on recomputing
@first, only on @first state. Which would then give:
if (ww_ctx || !first)
first = __mutex_waiter_is_first(lock, &waiter);
if (first)
__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
But because 'ww_ctx || !first' is basically 'always' and the test for
first is relatively cheap, omit that first branch entirely.
Reported-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Waiman Long <longman(a)redhat.com>
Reviewed-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/mutex.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index 013e1b08a1bf..a03d3d3ff886 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -928,7 +928,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
{
struct mutex_waiter waiter;
- bool first = false;
struct ww_mutex *ww;
int ret;
@@ -1007,6 +1006,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
set_current_state(state);
for (;;) {
+ bool first;
+
/*
* Once we hold wait_lock, we're serialized against
* mutex_unlock() handing the lock off to us, do a trylock
@@ -1035,15 +1036,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
spin_unlock(&lock->wait_lock);
schedule_preempt_disabled();
- /*
- * ww_mutex needs to always recheck its position since its waiter
- * list is not FIFO ordered.
- */
- if (ww_ctx || !first) {
- first = __mutex_waiter_is_first(lock, &waiter);
- if (first)
- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
- }
+ first = __mutex_waiter_is_first(lock, &waiter);
+ if (first)
+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
set_current_state(state);
/*
--
2.30.2
From: Peter Zijlstra <peterz(a)infradead.org>
[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
Yanfei reported that setting HANDOFF should not depend on recomputing
@first, only on @first state. Which would then give:
if (ww_ctx || !first)
first = __mutex_waiter_is_first(lock, &waiter);
if (first)
__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
But because 'ww_ctx || !first' is basically 'always' and the test for
first is relatively cheap, omit that first branch entirely.
Reported-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Waiman Long <longman(a)redhat.com>
Reviewed-by: Yanfei Xu <yanfei.xu(a)windriver.com>
Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/mutex.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index d2df5e68b503..fb30e1436dfb 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -928,7 +928,6 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas
struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
{
struct mutex_waiter waiter;
- bool first = false;
struct ww_mutex *ww;
int ret;
@@ -1007,6 +1006,8 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas
set_current_state(state);
for (;;) {
+ bool first;
+
/*
* Once we hold wait_lock, we're serialized against
* mutex_unlock() handing the lock off to us, do a trylock
@@ -1035,15 +1036,9 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas
spin_unlock(&lock->wait_lock);
schedule_preempt_disabled();
- /*
- * ww_mutex needs to always recheck its position since its waiter
- * list is not FIFO ordered.
- */
- if (ww_ctx || !first) {
- first = __mutex_waiter_is_first(lock, &waiter);
- if (first)
- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
- }
+ first = __mutex_waiter_is_first(lock, &waiter);
+ if (first)
+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
set_current_state(state);
/*
--
2.30.2
tx_done is not used for napi_complete_done(). Thus, NAPI busy polling
mechanism by gro_flush_timeout and napi_defer_hard_irqs will not able
be triggered after a packet is transmitted when there is no receive
packet.
Fix this by taking the maximum value between tx_done and rx_done as
overall budget completed by the rxtx NAPI poll to ensure XDP Tx ZC
operation is continuously polling for next Tx frame. This gives
benefit of lower packet submission processing latency and jitter
under XDP Tx ZC mode.
Performance of tx-only using xdp-sock on Intel ADL-S platform is
the same with and without this patch.
root@intel-corei7-64:~# ./xdpsock -i enp0s30f4 -t -z -q 1 -n 10
sock0@enp0s30f4:1 txonly xdp-drv
pps pkts 10.00
rx 0 0
tx 511630 8659520
sock0@enp0s30f4:1 txonly xdp-drv
pps pkts 10.00
rx 0 0
tx 511625 13775808
sock0@enp0s30f4:1 txonly xdp-drv
pps pkts 10.00
rx 0 0
tx 511619 18892032
Fixes: 132c32ee5bc0 ("net: stmmac: Add TX via XDP zero-copy socket")
Cc: <stable(a)vger.kernel.org> # 5.13.x
Co-developed-by: Ong Boon Leong <boon.leong.ong(a)intel.com>
Signed-off-by: Ong Boon Leong <boon.leong.ong(a)intel.com>
Signed-off-by: Song Yoong Siang <yoong.siang.song(a)intel.com>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ed0cd3920171..97238359e101 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5347,7 +5347,7 @@ static int stmmac_napi_poll_rxtx(struct napi_struct *napi, int budget)
struct stmmac_channel *ch =
container_of(napi, struct stmmac_channel, rxtx_napi);
struct stmmac_priv *priv = ch->priv_data;
- int rx_done, tx_done;
+ int rx_done, tx_done, rxtx_done;
u32 chan = ch->index;
priv->xstats.napi_poll++;
@@ -5357,14 +5357,16 @@ static int stmmac_napi_poll_rxtx(struct napi_struct *napi, int budget)
rx_done = stmmac_rx_zc(priv, budget, chan);
+ rxtx_done = max(tx_done, rx_done);
+
/* If either TX or RX work is not complete, return budget
* and keep pooling
*/
- if (tx_done >= budget || rx_done >= budget)
+ if (rxtx_done >= budget)
return budget;
/* all work done, exit the polling mode */
- if (napi_complete_done(napi, rx_done)) {
+ if (napi_complete_done(napi, rxtx_done)) {
unsigned long flags;
spin_lock_irqsave(&ch->lock, flags);
@@ -5375,7 +5377,7 @@ static int stmmac_napi_poll_rxtx(struct napi_struct *napi, int budget)
spin_unlock_irqrestore(&ch->lock, flags);
}
- return min(rx_done, budget - 1);
+ return min(rxtx_done, budget - 1);
}
/**
--
2.25.1