Hi Greg, hi Sasha,
Please consider to include following fixes in to stable tree.
The 6 patches from Ming was fixing a deadlock, they are included around kernel
5.3/4. Would be good to included in 4.19, we hit it during testing, with the fix
we no longer hit the deadlock.
The last one is simple NULL pointer deref fix.
Thanks!
Jack Wang @ IONOS Cloud.
v1: https://lore.kernel.org/stable/20210203132022.92406-1-jinpu.wang@cloud.iono…
Ming Lei (6):
block: don't hold q->sysfs_lock in elevator_init_mq
blk-mq: don't hold q->sysfs_lock in blk_mq_map_swqueue
block: add helper for checking if queue is registered
block: split .sysfs_lock into two locks
block: fix race between switching elevator and removing queues
block: don't release queue's sysfs lock during switching elevator
zhengbin (1):
block: fix NULL pointer dereference in register_disk
block/blk-core.c | 1 +
block/blk-mq-sysfs.c | 12 +++++------
block/blk-mq.c | 7 ------
block/blk-sysfs.c | 49 +++++++++++++++++++++++++++---------------
block/blk-wbt.c | 2 +-
block/blk.h | 2 +-
block/elevator.c | 44 +++++++++++++++++++++----------------
block/genhd.c | 10 +++++----
include/linux/blkdev.h | 2 ++
9 files changed, 74 insertions(+), 55 deletions(-)
--
2.25.1
> If mounted with discard option, exFAT issues discard command when clear cluster bit to remove file.
> But the input parameter of cluster-to-sector calculation is abnormally added by reserved cluster size
> which is 2, leading to discard unrelated sectors included in target+2 cluster.
> With fixing this, remove the wrong comments in set/clear/find bitmap functions.
>
> Fixes: 1e49a94cf707 ("exfat: add bitmap operations")
Cc: stable(a)vger.kernel.org # v5.7+
> Signed-off-by: Hyeongseok Kim <hyeongseok(a)gmail.com>
> Acked-by: Sungjong Seo <sj1557.seo(a)samsung.com>
Applied. Thanks for your patch!
> ---
> fs/exfat/balloc.c | 15 +--------------
> 1 file changed, 1 insertion(+), 14 deletions(-)
>
> diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c index 761c79c3a4ba..54f1bcbddb26 100644
> --- a/fs/exfat/balloc.c
> +++ b/fs/exfat/balloc.c
> @@ -141,10 +141,6 @@ void exfat_free_bitmap(struct exfat_sb_info *sbi)
> kfree(sbi->vol_amap);
> }
>
> -/*
> - * If the value of "clu" is 0, it means cluster 2 which is the first cluster of
> - * the cluster heap.
> - */
> int exfat_set_bitmap(struct inode *inode, unsigned int clu) {
> int i, b;
> @@ -162,10 +158,6 @@ int exfat_set_bitmap(struct inode *inode, unsigned int clu)
> return 0;
> }
>
> -/*
> - * If the value of "clu" is 0, it means cluster 2 which is the first cluster of
> - * the cluster heap.
> - */
> void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync) {
> int i, b;
> @@ -186,8 +178,7 @@ void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync)
> int ret_discard;
>
> ret_discard = sb_issue_discard(sb,
> - exfat_cluster_to_sector(sbi, clu +
> - EXFAT_RESERVED_CLUSTERS),
> + exfat_cluster_to_sector(sbi, clu),
> (1 << sbi->sect_per_clus_bits), GFP_NOFS, 0);
>
> if (ret_discard == -EOPNOTSUPP) {
> @@ -197,10 +188,6 @@ void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync)
> }
> }
>
> -/*
> - * If the value of "clu" is 0, it means cluster 2 which is the first cluster of
> - * the cluster heap.
> - */
> unsigned int exfat_find_free_bitmap(struct super_block *sb, unsigned int clu) {
> unsigned int i, map_i, map_b, ent_idx;
> --
> 2.27.0.83.g0313f36
From: Marco Elver <elver(a)google.com>
Commit 56348560d495 ("debugfs: do not attempt to create a new file
before the filesystem is initalized") forbids creating new debugfs files
until debugfs is fully initialized. This means that KCSAN's debugfs
file creation, which happened at the end of __init(), no longer works.
And was apparently never supposed to work!
However, there is no reason to create KCSAN's debugfs file so early.
This commit therefore moves its creation to a late_initcall() callback.
Cc: "Rafael J. Wysocki" <rafael(a)kernel.org>
Cc: stable <stable(a)vger.kernel.org>
Fixes: 56348560d495 ("debugfs: do not attempt to create a new file before the filesystem is initalized")
Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Marco Elver <elver(a)google.com>
Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org>
---
kernel/kcsan/core.c | 2 --
kernel/kcsan/debugfs.c | 4 +++-
kernel/kcsan/kcsan.h | 5 -----
3 files changed, 3 insertions(+), 8 deletions(-)
diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
index 3bf98db..23e7acb 100644
--- a/kernel/kcsan/core.c
+++ b/kernel/kcsan/core.c
@@ -639,8 +639,6 @@ void __init kcsan_init(void)
BUG_ON(!in_task());
- kcsan_debugfs_init();
-
for_each_possible_cpu(cpu)
per_cpu(kcsan_rand_state, cpu) = (u32)get_cycles();
diff --git a/kernel/kcsan/debugfs.c b/kernel/kcsan/debugfs.c
index 3c8093a..209ad8d 100644
--- a/kernel/kcsan/debugfs.c
+++ b/kernel/kcsan/debugfs.c
@@ -261,7 +261,9 @@ static const struct file_operations debugfs_ops =
.release = single_release
};
-void __init kcsan_debugfs_init(void)
+static void __init kcsan_debugfs_init(void)
{
debugfs_create_file("kcsan", 0644, NULL, NULL, &debugfs_ops);
}
+
+late_initcall(kcsan_debugfs_init);
diff --git a/kernel/kcsan/kcsan.h b/kernel/kcsan/kcsan.h
index 8d4bf34..87ccdb3 100644
--- a/kernel/kcsan/kcsan.h
+++ b/kernel/kcsan/kcsan.h
@@ -31,11 +31,6 @@ void kcsan_save_irqtrace(struct task_struct *task);
void kcsan_restore_irqtrace(struct task_struct *task);
/*
- * Initialize debugfs file.
- */
-void kcsan_debugfs_init(void);
-
-/*
* Statistics counters displayed via debugfs; should only be modified in
* slow-paths.
*/
--
2.9.5
We no longer revert the iovec on -EIOCBQUEUED, see commit ab2125df921d,
and this started causing issues for IOPOLL on devies that run out of
request slots. Turns out what outside of needing a revert for those, we
also had a bug where we didn't properly setup retry inside the submission
path. That could cause re-import of the iovec, if any, and that could lead
to spurious results if the application had those allocated on the stack.
Catch -EAGAIN retry and make the iovec stable for IOPOLL, just like we do
for !IOPOLL retries.
Cc: <stable(a)vger.kernel.org> # 5.9+
Reported-by: Abaci Robot <abaci(a)linux.alibaba.com>
Reported-by: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
---
fs/io_uring.c | 36 +++++++++++++++++++++++++++++++-----
1 file changed, 31 insertions(+), 5 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 28a360aac4a3..c765b7fba8a1 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2423,23 +2423,32 @@ static bool io_resubmit_prep(struct io_kiocb *req)
return false;
return !io_setup_async_rw(req, iovec, inline_vecs, &iter, false);
}
-#endif
-static bool io_rw_reissue(struct io_kiocb *req)
+static bool io_rw_should_reissue(struct io_kiocb *req)
{
-#ifdef CONFIG_BLOCK
umode_t mode = file_inode(req->file)->i_mode;
+ struct io_ring_ctx *ctx = req->ctx;
if (!S_ISBLK(mode) && !S_ISREG(mode))
return false;
- if ((req->flags & REQ_F_NOWAIT) || io_wq_current_is_worker())
+ if ((req->flags & REQ_F_NOWAIT) || (io_wq_current_is_worker() &&
+ !(ctx->flags & IORING_SETUP_IOPOLL)))
return false;
/*
* If ref is dying, we might be running poll reap from the exit work.
* Don't attempt to reissue from that path, just let it fail with
* -EAGAIN.
*/
- if (percpu_ref_is_dying(&req->ctx->refs))
+ if (percpu_ref_is_dying(&ctx->refs))
+ return false;
+ return true;
+}
+#endif
+
+static bool io_rw_reissue(struct io_kiocb *req)
+{
+#ifdef CONFIG_BLOCK
+ if (!io_rw_should_reissue(req))
return false;
lockdep_assert_held(&req->ctx->uring_lock);
@@ -2482,6 +2491,19 @@ static void io_complete_rw_iopoll(struct kiocb *kiocb, long res, long res2)
{
struct io_kiocb *req = container_of(kiocb, struct io_kiocb, rw.kiocb);
+#ifdef CONFIG_BLOCK
+ /* Rewind iter, if we have one. iopoll path resubmits as usual */
+ if (res == -EAGAIN && io_rw_should_reissue(req)) {
+ struct io_async_rw *rw = req->async_data;
+
+ if (rw)
+ iov_iter_revert(&rw->iter,
+ req->result - iov_iter_count(&rw->iter));
+ else if (!io_resubmit_prep(req))
+ res = -EIO;
+ }
+#endif
+
if (kiocb->ki_flags & IOCB_WRITE)
kiocb_end_write(req);
@@ -3230,6 +3252,8 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags)
ret = io_iter_do_read(req, iter);
if (ret == -EIOCBQUEUED) {
+ if (req->async_data)
+ iov_iter_revert(iter, io_size - iov_iter_count(iter));
goto out_free;
} else if (ret == -EAGAIN) {
/* IOPOLL retry should happen for io-wq threads */
@@ -3361,6 +3385,8 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags)
/* no retry on NONBLOCK nor RWF_NOWAIT */
if (ret2 == -EAGAIN && (req->flags & REQ_F_NOWAIT))
goto done;
+ if (ret2 == -EIOCBQUEUED && req->async_data)
+ iov_iter_revert(iter, io_size - iov_iter_count(iter));
if (!force_nonblock || ret2 != -EAGAIN) {
/* IOPOLL retry should happen for io-wq threads */
if ((req->ctx->flags & IORING_SETUP_IOPOLL) && ret2 == -EAGAIN)
--
2.30.1
From: Frederic Weisbecker <frederic(a)kernel.org>
This sequence of events can lead to a failure to requeue a CPU's
->nocb_timer:
1. There are no callbacks queued for any CPU covered by CPU 0-2's
->nocb_gp_kthread. Note that ->nocb_gp_kthread is associated
with CPU 0.
2. CPU 1 enqueues its first callback with interrupts disabled, and
thus must defer awakening its ->nocb_gp_kthread. It therefore
queues its rcu_data structure's ->nocb_timer. At this point,
CPU 1's rdp->nocb_defer_wakeup is RCU_NOCB_WAKE.
3. CPU 2, which shares the same ->nocb_gp_kthread, also enqueues a
callback, but with interrupts enabled, allowing it to directly
awaken the ->nocb_gp_kthread.
4. The newly awakened ->nocb_gp_kthread associates both CPU 1's
and CPU 2's callbacks with a future grace period and arranges
for that grace period to be started.
5. This ->nocb_gp_kthread goes to sleep waiting for the end of this
future grace period.
6. This grace period elapses before the CPU 1's timer fires.
This is normally improbably given that the timer is set for only
one jiffy, but timers can be delayed. Besides, it is possible
that kernel was built with CONFIG_RCU_STRICT_GRACE_PERIOD=y.
7. The grace period ends, so rcu_gp_kthread awakens the
->nocb_gp_kthread, which in turn awakens both CPU 1's and
CPU 2's ->nocb_cb_kthread. Then ->nocb_gb_kthread sleeps
waiting for more newly queued callbacks.
8. CPU 1's ->nocb_cb_kthread invokes its callback, then sleeps
waiting for more invocable callbacks.
9. Note that neither kthread updated any ->nocb_timer state,
so CPU 1's ->nocb_defer_wakeup is still set to RCU_NOCB_WAKE.
10. CPU 1 enqueues its second callback, this time with interrupts
enabled so it can wake directly ->nocb_gp_kthread.
It does so with calling wake_nocb_gp() which also cancels the
pending timer that got queued in step 2. But that doesn't reset
CPU 1's ->nocb_defer_wakeup which is still set to RCU_NOCB_WAKE.
So CPU 1's ->nocb_defer_wakeup and its ->nocb_timer are now
desynchronized.
11. ->nocb_gp_kthread associates the callback queued in 10 with a new
grace period, arranges for that grace period to start and sleeps
waiting for it to complete.
12. The grace period ends, rcu_gp_kthread awakens ->nocb_gp_kthread,
which in turn wakes up CPU 1's ->nocb_cb_kthread which then
invokes the callback queued in 10.
13. CPU 1 enqueues its third callback, this time with interrupts
disabled so it must queue a timer for a deferred wakeup. However
the value of its ->nocb_defer_wakeup is RCU_NOCB_WAKE which
incorrectly indicates that a timer is already queued. Instead,
CPU 1's ->nocb_timer was cancelled in 10. CPU 1 therefore fails
to queue the ->nocb_timer.
14. CPU 1 has its pending callback and it may go unnoticed until
some other CPU ever wakes up ->nocb_gp_kthread or CPU 1 ever
calls an explicit deferred wakeup, for example, during idle entry.
This commit fixes this bug by resetting rdp->nocb_defer_wakeup everytime
we delete the ->nocb_timer.
It is quite possible that there is a similar scenario involving
->nocb_bypass_timer and ->nocb_defer_wakeup. However, despite some
effort from several people, a failure scenario has not yet been located.
However, that by no means guarantees that no such scenario exists.
Finding a failure scenario is left as an exercise for the reader, and the
"Fixes:" tag below relates to ->nocb_bypass_timer instead of ->nocb_timer.
Fixes: d1b222c6be1f (rcu/nocb: Add bypass callback queueing)
Cc: <stable(a)vger.kernel.org>
Cc: Josh Triplett <josh(a)joshtriplett.org>
Cc: Lai Jiangshan <jiangshanlai(a)gmail.com>
Cc: Joel Fernandes <joel(a)joelfernandes.org>
Cc: Boqun Feng <boqun.feng(a)gmail.com>
Reviewed-by: Neeraj Upadhyay <neeraju(a)codeaurora.org>
Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org>
Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org>
---
kernel/rcu/tree_plugin.h | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index a1a17ad..e392bd1 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -1708,7 +1708,11 @@ static bool wake_nocb_gp(struct rcu_data *rdp, bool force,
rcu_nocb_unlock_irqrestore(rdp, flags);
return false;
}
- del_timer(&rdp->nocb_timer);
+
+ if (READ_ONCE(rdp->nocb_defer_wakeup) > RCU_NOCB_WAKE_NOT) {
+ WRITE_ONCE(rdp->nocb_defer_wakeup, RCU_NOCB_WAKE_NOT);
+ del_timer(&rdp->nocb_timer);
+ }
rcu_nocb_unlock_irqrestore(rdp, flags);
raw_spin_lock_irqsave(&rdp_gp->nocb_gp_lock, flags);
if (force || READ_ONCE(rdp_gp->nocb_gp_sleep)) {
@@ -2335,7 +2339,6 @@ static bool do_nocb_deferred_wakeup_common(struct rcu_data *rdp)
return false;
}
ndw = READ_ONCE(rdp->nocb_defer_wakeup);
- WRITE_ONCE(rdp->nocb_defer_wakeup, RCU_NOCB_WAKE_NOT);
ret = wake_nocb_gp(rdp, ndw == RCU_NOCB_WAKE_FORCE, flags);
trace_rcu_nocb_wake(rcu_state.name, rdp->cpu, TPS("DeferredWake"));
--
2.9.5
From: Nadav Amit <namit(a)vmware.com>
Userfaultfd self-test fails occasionally, indicating a memory
corruption.
Analyzing this problem indicates that there is a real bug since
mmap_lock is only taken for read in mwriteprotect_range() and defers
flushes, and since there is insufficient consideration of concurrent
deferred TLB flushes in wp_page_copy(). Although the PTE is flushed from
the TLBs in wp_page_copy(), this flush takes place after the copy has
already been performed, and therefore changes of the page are possible
between the time of the copy and the time in which the PTE is flushed.
To make matters worse, memory-unprotection using userfaultfd also poses
a problem. Although memory unprotection is logically a promotion of PTE
permissions, and therefore should not require a TLB flush, the current
userrfaultfd code might actually cause a demotion of the architectural
PTE permission: when userfaultfd_writeprotect() unprotects memory
region, it unintentionally *clears* the RW-bit if it was already set.
Note that this unprotecting a PTE that is not write-protected is a valid
use-case: the userfaultfd monitor might ask to unprotect a region that
holds both write-protected and write-unprotected PTEs.
The scenario that happens in selftests/vm/userfaultfd is as follows:
cpu0 cpu1 cpu2
---- ---- ----
[ Writable PTE
cached in TLB ]
userfaultfd_writeprotect()
[ write-*unprotect* ]
mwriteprotect_range()
mmap_read_lock()
change_protection()
change_protection_range()
...
change_pte_range()
[ *clear* “write”-bit ]
[ defer TLB flushes ]
[ page-fault ]
...
wp_page_copy()
cow_user_page()
[ copy page ]
[ write to old
page ]
...
set_pte_at_notify()
A similar scenario can happen:
cpu0 cpu1 cpu2 cpu3
---- ---- ---- ----
[ Writable PTE
cached in TLB ]
userfaultfd_writeprotect()
[ write-protect ]
[ deferred TLB flush ]
userfaultfd_writeprotect()
[ write-unprotect ]
[ deferred TLB flush]
[ page-fault ]
wp_page_copy()
cow_user_page()
[ copy page ]
... [ write to page ]
set_pte_at_notify()
This race exists since commit 292924b26024 ("userfaultfd: wp: apply
_PAGE_UFFD_WP bit"). Yet, as Yu Zhao pointed, these races became
apparent since commit 09854ba94c6a ("mm: do_wp_page() simplification")
which made wp_page_copy() more likely to take place, specifically if
page_count(page) > 1.
To resolve the aforementioned races, check whether there are pending
flushes on uffd-write-protected VMAs, and if there are, perform a flush
before doing the COW.
Further optimizations will follow to avoid during uffd-write-unprotect
unnecassary PTE write-protection and TLB flushes.
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Andy Lutomirski <luto(a)kernel.org>
Cc: Peter Xu <peterx(a)redhat.com>
Cc: Pavel Emelyanov <xemul(a)openvz.org>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: Minchan Kim <minchan(a)kernel.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
Suggested-by: Yu Zhao <yuzhao(a)google.com>
Fixes: 292924b26024 ("userfaultfd: wp: apply _PAGE_UFFD_WP bit")
Signed-off-by: Nadav Amit <namit(a)vmware.com>
---
v2->v3:
* Do not acquire mmap_lock for write, flush conditionally instead [Yu]
* Change the fixes tag to the patch that made the race apparent [Yu]
* Removing patch to avoid write-protect on uffd unprotect. More
comprehensive solution to follow (and avoid the TLB flush as well).
---
mm/memory.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/mm/memory.c b/mm/memory.c
index 9e8576a83147..06da04f98936 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3092,6 +3092,13 @@ static vm_fault_t do_wp_page(struct vm_fault *vmf)
return handle_userfault(vmf, VM_UFFD_WP);
}
+ /*
+ * Userfaultfd write-protect can defer flushes. Ensure the TLB
+ * is flushed in this case before copying.
+ */
+ if (userfaultfd_wp(vmf->vma) && mm_tlb_flush_pending(vmf->vma->vm_mm))
+ flush_tlb_page(vmf->vma, vmf->address);
+
vmf->page = vm_normal_page(vma, vmf->address, vmf->orig_pte);
if (!vmf->page) {
/*
--
2.25.1
The patch titled
Subject: mm/madvise: replace ptrace attach requirement for process_madvise
has been added to the -mm tree. Its filename is
mm-madvise-replace-ptrace-attach-requirement-for-process_madvise.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-madvise-replace-ptrace-attach-…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-madvise-replace-ptrace-attach-…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Suren Baghdasaryan <surenb(a)google.com>
Subject: mm/madvise: replace ptrace attach requirement for process_madvise
process_madvise currently requires ptrace attach capability.
PTRACE_MODE_ATTACH gives one process complete control over another
process. It effectively removes the security boundary between the two
processes (in one direction). Granting ptrace attach capability even to a
system process is considered dangerous since it creates an attack surface.
This severely limits the usage of this API.
The operations process_madvise can perform do not affect the correctness
of the operation of the target process; they only affect where the data is
physically located (and therefore, how fast it can be accessed). What we
want is the ability for one process to influence another process in order
to optimize performance across the entire system while leaving the
security boundary intact.
Replace PTRACE_MODE_ATTACH with a combination of PTRACE_MODE_READ and
CAP_SYS_NICE. PTRACE_MODE_READ to prevent leaking ASLR metadata and
CAP_SYS_NICE for influencing process performance.
Link: https://lkml.kernel.org/r/20210303185807.2160264-1-surenb@google.com
Signed-off-by: Suren Baghdasaryan <surenb(a)google.com>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
Acked-by: Minchan Kim <minchan(a)kernel.org>
Acked-by: David Rientjes <rientjes(a)google.com>
Cc: Jann Horn <jannh(a)google.com>
Cc: Jeff Vander Stoep <jeffv(a)google.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Tim Murray <timmurray(a)google.com>
Cc: Florian Weimer <fweimer(a)redhat.com>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: James Morris <jmorris(a)namei.org>
Cc: <stable(a)vger.kernel.org> [5.10+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/madvise.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/mm/madvise.c~mm-madvise-replace-ptrace-attach-requirement-for-process_madvise
+++ a/mm/madvise.c
@@ -1198,12 +1198,22 @@ SYSCALL_DEFINE5(process_madvise, int, pi
goto release_task;
}
- mm = mm_access(task, PTRACE_MODE_ATTACH_FSCREDS);
+ /* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */
+ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
if (IS_ERR_OR_NULL(mm)) {
ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
goto release_task;
}
+ /*
+ * Require CAP_SYS_NICE for influencing process performance. Note that
+ * only non-destructive hints are currently supported.
+ */
+ if (!capable(CAP_SYS_NICE)) {
+ ret = -EPERM;
+ goto release_mm;
+ }
+
total_len = iov_iter_count(&iter);
while (iov_iter_count(&iter)) {
@@ -1218,6 +1228,7 @@ SYSCALL_DEFINE5(process_madvise, int, pi
if (ret == 0)
ret = total_len - iov_iter_count(&iter);
+release_mm:
mmput(mm);
release_task:
put_task_struct(task);
_
Patches currently in -mm which might be from surenb(a)google.com are
mm-madvise-replace-ptrace-attach-requirement-for-process_madvise.patch
This is the start of the stable review cycle for the 4.9.259 release.
There are 134 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 04 Mar 2021 19:25:07 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.259-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.259-rc3
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Update in-core bitset after committing the metadata
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
Leon Romanovsky <leonro(a)nvidia.com>
ipv6: silence compilation warning for non-IPV6 builds
Eric Dumazet <edumazet(a)google.com>
ipv6: icmp6: avoid indirect call for icmpv6_send()
Jason A. Donenfeld <Jason(a)zx2c4.com>
sunvnet: use icmp_ndo_send helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
gtp: use icmp_ndo_send helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n
Jason A. Donenfeld <Jason(a)zx2c4.com>
icmp: introduce helper for nat'd source address in network device context
Thomas Gleixner <tglx(a)linutronix.de>
futex: fix dead code in attach_to_pi_owner()
Peter Zijlstra <peterz(a)infradead.org>
futex: Fix OWNER_DEAD fixup
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: only resize metadata in preresume
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Reinitialize bitset cache before digesting a new writeset
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Use correct value size in equality function of writeset tree
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Fix bitset memory leaks
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Verify the data block size hasn't changed
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Recover committed writeset after crash
Bob Peterson <rpeterso(a)redhat.com>
gfs2: Don't skip dlm unlock if glock has an lvb
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a user-triggerable oops in clear_user()
Chao Yu <yuchao0(a)huawei.com>
f2fs: fix out-of-repair __setattr_copy()
Maxim Kiselev <bigunclemax(a)gmail.com>
gpio: pcf857x: Fix missing first interrupt
Frank Li <Frank.Li(a)nxp.com>
mmc: sdhci-esdhc-imx: fix kernel panic when remove module
Fangrui Song <maskray(a)google.com>
module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
Dan Williams <dan.j.williams(a)intel.com>
libnvdimm/dimm: Avoid race between probe and available_slots_show()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop()
Muchun Song <songmuchun(a)bytedance.com>
mm: hugetlb: fix a race between freeing and dissolving the page
Pan Bian <bianpan2016(a)163.com>
mtd: spi-nor: hisi-sfc: Put child node np on error path
Jiri Kosina <jkosina(a)suse.cz>
floppy: reintroduce O_NDELAY fix
Sean Christopherson <seanjc(a)google.com>
x86/reboot: Force all cpus to exit VMX root if VMX is supported
Martin Kaiser <martin(a)kaiser.cx>
staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
Sabyrzhan Tasbolatov <snovitoll(a)gmail.com>
drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
Paul Cercueil <paul(a)crapouillou.net>
seccomp: Add missing return in non-void function
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix extent buffer leak on failure to copy root
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix reloc root leak with 0 ref reloc roots on recovery
Josef Bacik <josef(a)toxicpanda.com>
btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root
Jarkko Sakkinen <jarkko(a)kernel.org>
KEYS: trusted: Fix migratable=1 failing
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7720: fix error code in mos7720_write()
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7840: fix error code in mos7840_write()
Paul Cercueil <paul(a)crapouillou.net>
usb: musb: Fix runtime PM race in musb_queue_resume_work
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: update interface mapping for ZTE P685M
Marcos Paulo de Souza <mpdesouza(a)suse.com>
Input: i8042 - add ASUS Zenbook Flip to noselftest list
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: joydev - prevent potential read overflow in ioctl
Olivier Crête <olivier.crete(a)ocrete.ca>
Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S
jeffrey.lin <jeffrey.lin(a)rad-ic.com>
Input: raydium_ts_i2c - do not send zero length
Qinglang Miao <miaoqinglang(a)huawei.com>
ACPI: configfs: add missing check after configfs_register_default_group()
Mikulas Patocka <mpatocka(a)redhat.com>
blk-settings: align max_sectors on "logical_block_size" boundary
Randy Dunlap <rdunlap(a)infradead.org>
scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
Maxime Ripard <maxime(a)cerno.tech>
i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
Marc Zyngier <maz(a)kernel.org>
arm64: Add missing ISB after invalidating TLB in __primary_switch
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential double free in hugetlb_register_node() error path
Miaohe Lin <linmiaohe(a)huawei.com>
mm/memory.c: fix potential pte_unmap_unlock pte error
Dan Carpenter <dan.carpenter(a)oracle.com>
ocfs2: fix a use after free on error
Chuhong Yuan <hslester96(a)gmail.com>
net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
Slawomir Laba <slawomirx.laba(a)intel.com>
i40e: Fix flow for IPv6 next header (extension header)
Konrad Dybcio <konrad.dybcio(a)somainline.org>
drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
Heiner Kallweit <hkallweit1(a)gmail.com>
PCI: Align checking of syscall user config accessors
Jorgen Hansen <jhansen(a)vmware.com>
VMCI: Use set_page_dirty_lock() when unregistering guest memory
Simon South <simon(a)simonsouth.net>
pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare()
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Fix module alias to enable module autoprobe
Randy Dunlap <rdunlap(a)infradead.org>
sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: elo - fix an error code in elo_connect()
Namhyung Kim <namhyung(a)kernel.org>
perf test: Fix unaligned access in sample parsing test
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix missing CYC processing in PSB
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
spi: pxa2xx: Fix the controller numbering for Wildcat Point
Nathan Lynch <nathanl(a)linux.ibm.com>
powerpc/pseries/dlpar: handle ibm, configure-connector delay status
Dan Carpenter <dan.carpenter(a)oracle.com>
mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
Bob Pearson <rpearsonhpe(a)gmail.com>
RDMA/rxe: Fix coding error in rxe_recv.c
Arnaldo Carvalho de Melo <acme(a)redhat.com>
perf tools: Fix DSO filtering when not finding a map for a sampled address
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracepoint: Do not fail unregistering a probe due to memory failure
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
amba: Fix resource leak for drivers without .remove
Vladimir Murzin <vladimir.murzin(a)arm.com>
ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/47x: Disable 256k page size
Shay Drory <shayd(a)nvidia.com>
IB/umad: Return EIO in case of when device disassociated
Pan Bian <bianpan2016(a)163.com>
isofs: release buffer head before return
Pan Bian <bianpan2016(a)163.com>
regulator: axp20x: Fix reference cout leak
Tom Rix <trix(a)redhat.com>
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
Claudiu Beznea <claudiu.beznea(a)microchip.com>
power: reset: at91-sama5d2_shdwc: fix wkupdbc mask
Nicolas Boichat <drinkcat(a)chromium.org>
of/fdt: Make sure no-map does not remove already reserved regions
KarimAllah Ahmed <karahmed(a)amazon.de>
fdt: Properly handle "no-map" field in the memory region
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in the remove function
Randy Dunlap <rdunlap(a)infradead.org>
HID: core: detect and skip invalid inputs to snto32()
Pratyush Yadav <p.yadav(a)ti.com>
spi: cadence-quadspi: Abort read if dummy cycles required are too many
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL
Tom Rix <trix(a)redhat.com>
jffs2: fix use after free in jffs2_sum_write_data()
Colin Ian King <colin.king(a)canonical.com>
fs/jfs: fix potential integer overflow on shift of a int
Daniele Alessandrelli <daniele.alessandrelli(a)intel.com>
crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
Zhihao Cheng <chengzhihao1(a)huawei.com>
btrfs: clarify error returns values in __load_free_space_cache
Florian Fainelli <f.fainelli(a)gmail.com>
ata: ahci_brcm: Add back regulators management
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
Tom Rix <trix(a)redhat.com>
media: pxa_camera: declare variable when DEBUG is defined
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
media: cx25821: Fix a bug when reallocating some dma memory
Luo Meng <luomeng12(a)huawei.com>
media: qm1d1c0042: fix error return code in qm1d1c0042_init()
Joe Perches <joe(a)perches.com>
media: lmedm04: Fix misuse of comma
Dan Carpenter <dan.carpenter(a)oracle.com>
ASoC: cs42l56: fix up error handling in probe
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: tm6000: Fix memleak in tm6000_start_stream
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: media/pci: Fix memleak in empress_init
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
media: vsp1: Fix an error handling path in the probe function
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
Dan Carpenter <dan.carpenter(a)oracle.com>
gma500: clean up error handling in init
Jialin Zhang <zhangjialin11(a)huawei.com>
drm/gma500: Fix error return code in psb_driver_load()
Randy Dunlap <rdunlap(a)infradead.org>
fbdev: aty: SPARC64 requires FB_ATY_CT
Colin Ian King <colin.king(a)canonical.com>
b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
Colin Ian King <colin.king(a)canonical.com>
mac80211: fix potential overflow when multiplying to u32 integers
Juergen Gross <jgross(a)suse.com>
xen/netback: fix spurious event detection for common event case
Edwin Peer <edwin.peer(a)broadcom.com>
bnxt_en: reverse order of TX disable and carrier off
Arnd Bergmann <arnd(a)arndb.de>
ARM: s3c: fix fiq for clang IAS
Vincent Knecht <vincent.knecht(a)mailoo.org>
arm64: dts: msm8916: Fix reserved and rfsa nodes unit address
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Make "trimming xfer length" a debug message
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Abort transaction after errors with unknown reason
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Do not update data length if it is 0 on inbound transfers
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Configure missing thermal interrupt for 4430
Pan Bian <bianpan2016(a)163.com>
Bluetooth: Put HCI device if inquiry procedure interrupts
Pan Bian <bianpan2016(a)163.com>
Bluetooth: drop HCI device reference before return
Krzysztof Kozlowski <krzk(a)kernel.org>
arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
Christopher William Snowhill <chris(a)kode54.net>
Bluetooth: Fix initializing response id after clearing struct
Vlastimil Babka <vbabka(a)suse.cz>
mm, thp: make do_huge_pmd_wp_page() lock page for testing mapcount
Eric Biggers <ebiggers(a)google.com>
random: fix the RNDRESEEDCRNG ioctl
Alexander Lobakin <alobakin(a)pm.me>
MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
Sumit Garg <sumit.garg(a)linaro.org>
kdb: Make memory allocations more robust
Rong Chen <rong.a.chen(a)intel.com>
scripts/recordmcount.pl: support big endian for ARCH sh
Shyam Prasad N <sprasad(a)microsoft.com>
cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath.
Christoph Schemmel <christoph.schemmel(a)gmail.com>
NET: usb: qmi_wwan: Adding support for Cinterion MV31
Sameer Pujar <spujar(a)nvidia.com>
arm64: tegra: Add power-domain for Tegra210 HDA
Corinna Vinschen <vinschen(a)redhat.com>
igb: Remove incorrect "unexpected SYS WRAP" log message
Rustam Kovhaev <rkovhaev(a)gmail.com>
ntfs: check for valid standard information attribute
Stefan Ursella <stefan.ursella(a)wolfvision.net>
usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable
Will McVicker <willmcvicker(a)google.com>
HID: make arrays usage and value to be the same
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/compressed/head.S | 4 +-
arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
arch/arm/boot/dts/omap443x.dtsi | 2 +
arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +-
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1 +
arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +-
arch/arm64/kernel/head.S | 1 +
arch/mips/kernel/vmlinux.lds.S | 1 +
arch/mips/lantiq/irq.c | 2 +-
arch/mips/mm/c-r4k.c | 2 +-
arch/powerpc/Kconfig | 2 +-
arch/powerpc/platforms/pseries/dlpar.c | 7 +-
arch/sparc/Kconfig | 2 +-
arch/sparc/lib/memset.S | 1 +
arch/x86/kernel/reboot.c | 29 +++----
block/blk-settings.c | 12 +++
crypto/ecdh_helper.c | 3 +
drivers/acpi/acpi_configfs.c | 7 +-
drivers/amba/bus.c | 20 +++--
drivers/ata/ahci_brcm.c | 14 +++-
drivers/block/floppy.c | 27 ++++---
drivers/char/random.c | 2 +-
drivers/clk/meson/clk-pll.c | 2 +-
drivers/clocksource/mxs_timer.c | 5 +-
drivers/dma/fsldma.c | 6 ++
drivers/gpio/gpio-pcf857x.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 ++---
drivers/gpu/drm/gma500/psb_drv.c | 2 +
drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +-
drivers/hid/hid-core.c | 9 ++-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/infiniband/core/user_mad.c | 7 +-
drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++-
drivers/input/joydev.c | 7 +-
drivers/input/joystick/xpad.c | 1 +
drivers/input/serio/i8042-x86ia64io.h | 4 +
drivers/input/touchscreen/elo.c | 4 +-
drivers/input/touchscreen/raydium_i2c_ts.c | 3 +-
drivers/md/dm-era-target.c | 93 ++++++++++++++--------
drivers/media/pci/cx25821/cx25821-core.c | 4 +-
drivers/media/pci/saa7134/saa7134-empress.c | 5 +-
drivers/media/platform/pxa_camera.c | 3 +
drivers/media/platform/vsp1/vsp1_drv.c | 4 +-
drivers/media/tuners/qm1d1c0042.c | 4 +-
drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
drivers/media/usb/tm6000/tm6000-dvb.c | 4 +
drivers/media/usb/uvc/uvc_v4l2.c | 18 ++---
drivers/mfd/wm831x-auxadc.c | 3 +-
drivers/misc/eeprom/eeprom_93xx46.c | 1 +
drivers/misc/vmw_vmci/vmci_queue_pair.c | 5 +-
drivers/mmc/host/sdhci-esdhc-imx.c | 3 +-
drivers/mmc/host/usdhi6rol0.c | 4 +-
drivers/mtd/spi-nor/cadence-quadspi.c | 2 +-
drivers/mtd/spi-nor/hisi-sfc.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 ++-
drivers/net/ethernet/intel/igb/igb_main.c | 2 -
.../net/ethernet/mellanox/mlx4/resource_tracker.c | 1 +
drivers/net/ethernet/sun/sunvnet_common.c | 24 +-----
drivers/net/gtp.c | 5 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/wireless/broadcom/b43/phy_n.c | 2 +-
drivers/net/xen-netback/interface.c | 8 +-
drivers/nvdimm/dimm_devs.c | 18 ++++-
drivers/of/fdt.c | 12 ++-
drivers/pci/syscall.c | 10 +--
drivers/power/reset/at91-sama5d2_shdwc.c | 2 +-
drivers/pwm/pwm-rockchip.c | 1 -
drivers/regulator/axp20x-regulator.c | 7 +-
drivers/scsi/bnx2fc/Kconfig | 1 +
drivers/spi/spi-pxa2xx-pci.c | 27 +++++--
drivers/spi/spi-s3c24xx-fiq.S | 9 +--
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc2/hcd.c | 15 ++--
drivers/usb/dwc2/hcd_intr.c | 14 +++-
drivers/usb/dwc3/gadget.c | 19 ++++-
drivers/usb/musb/musb_core.c | 31 ++++----
drivers/usb/renesas_usbhs/fifo.c | 2 +
drivers/usb/serial/mos7720.c | 4 +-
drivers/usb/serial/mos7840.c | 4 +-
drivers/usb/serial/option.c | 3 +-
drivers/video/fbdev/Kconfig | 2 +-
fs/btrfs/ctree.c | 7 +-
fs/btrfs/free-space-cache.c | 6 +-
fs/btrfs/relocation.c | 4 +-
fs/cifs/connect.c | 1 +
fs/f2fs/file.c | 3 +-
fs/gfs2/lock_dlm.c | 8 +-
fs/isofs/dir.c | 1 +
fs/isofs/namei.c | 1 +
fs/jffs2/summary.c | 3 +
fs/jfs/jfs_dmap.c | 2 +-
fs/ntfs/inode.c | 6 ++
fs/ocfs2/cluster/heartbeat.c | 8 +-
include/linux/icmpv6.h | 48 ++++++++++-
include/linux/ipv6.h | 2 +-
include/net/icmp.h | 10 +++
kernel/debug/kdb/kdb_private.h | 2 +-
kernel/futex.c | 12 +--
kernel/module.c | 21 ++++-
kernel/seccomp.c | 2 +
kernel/tracepoint.c | 80 +++++++++++++++----
mm/huge_memory.c | 15 ++++
mm/hugetlb.c | 43 +++++++++-
mm/memory.c | 6 +-
net/bluetooth/a2mp.c | 3 +-
net/bluetooth/hci_core.c | 6 +-
net/ipv4/icmp.c | 34 ++++++++
net/ipv6/icmp.c | 19 ++---
net/ipv6/ip6_icmp.c | 46 +++++++++--
net/mac80211/mesh_hwmp.c | 2 +-
scripts/recordmcount.pl | 6 +-
security/keys/trusted.c | 2 +-
sound/soc/codecs/cs42l56.c | 3 +-
tools/perf/tests/sample-parsing.c | 2 +-
tools/perf/util/event.c | 2 +
.../perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +
120 files changed, 758 insertions(+), 302 deletions(-)
This is the start of the stable review cycle for the 4.4.259 release.
There are 92 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 04 Mar 2021 19:25:07 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.259-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.259-rc2
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Update in-core bitset after committing the metadata
Peter Zijlstra <peterz(a)infradead.org>
futex: Fix OWNER_DEAD fixup
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: only resize metadata in preresume
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Reinitialize bitset cache before digesting a new writeset
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Use correct value size in equality function of writeset tree
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Fix bitset memory leaks
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Verify the data block size hasn't changed
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Recover committed writeset after crash
Bob Peterson <rpeterso(a)redhat.com>
gfs2: Don't skip dlm unlock if glock has an lvb
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a user-triggerable oops in clear_user()
Chao Yu <yuchao0(a)huawei.com>
f2fs: fix out-of-repair __setattr_copy()
Maxim Kiselev <bigunclemax(a)gmail.com>
gpio: pcf857x: Fix missing first interrupt
Fangrui Song <maskray(a)google.com>
module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
Dan Williams <dan.j.williams(a)intel.com>
libnvdimm/dimm: Avoid race between probe and available_slots_show()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop()
Muchun Song <songmuchun(a)bytedance.com>
mm: hugetlb: fix a race between freeing and dissolving the page
Jiri Kosina <jkosina(a)suse.cz>
floppy: reintroduce O_NDELAY fix
Sean Christopherson <seanjc(a)google.com>
x86/reboot: Force all cpus to exit VMX root if VMX is supported
Martin Kaiser <martin(a)kaiser.cx>
staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
Sabyrzhan Tasbolatov <snovitoll(a)gmail.com>
drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix reloc root leak with 0 ref reloc roots on recovery
Jarkko Sakkinen <jarkko(a)kernel.org>
KEYS: trusted: Fix migratable=1 failing
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7720: fix error code in mos7720_write()
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7840: fix error code in mos7840_write()
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: update interface mapping for ZTE P685M
Marcos Paulo de Souza <mpdesouza(a)suse.com>
Input: i8042 - add ASUS Zenbook Flip to noselftest list
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: joydev - prevent potential read overflow in ioctl
Olivier Crête <olivier.crete(a)ocrete.ca>
Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S
Mikulas Patocka <mpatocka(a)redhat.com>
blk-settings: align max_sectors on "logical_block_size" boundary
Bart Van Assche <bart.vanassche(a)wdc.com>
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
Randy Dunlap <rdunlap(a)infradead.org>
scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
Maxime Ripard <maxime(a)cerno.tech>
i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential double free in hugetlb_register_node() error path
Miaohe Lin <linmiaohe(a)huawei.com>
mm/memory.c: fix potential pte_unmap_unlock pte error
Heiner Kallweit <hkallweit1(a)gmail.com>
PCI: Align checking of syscall user config accessors
Jorgen Hansen <jhansen(a)vmware.com>
VMCI: Use set_page_dirty_lock() when unregistering guest memory
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Fix module alias to enable module autoprobe
Randy Dunlap <rdunlap(a)infradead.org>
sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: elo - fix an error code in elo_connect()
Namhyung Kim <namhyung(a)kernel.org>
perf test: Fix unaligned access in sample parsing test
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix missing CYC processing in PSB
Nathan Lynch <nathanl(a)linux.ibm.com>
powerpc/pseries/dlpar: handle ibm, configure-connector delay status
Dan Carpenter <dan.carpenter(a)oracle.com>
mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracepoint: Do not fail unregistering a probe due to memory failure
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
amba: Fix resource leak for drivers without .remove
Vladimir Murzin <vladimir.murzin(a)arm.com>
ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/47x: Disable 256k page size
Shay Drory <shayd(a)nvidia.com>
IB/umad: Return EIO in case of when device disassociated
Pan Bian <bianpan2016(a)163.com>
isofs: release buffer head before return
Pan Bian <bianpan2016(a)163.com>
regulator: axp20x: Fix reference cout leak
Tom Rix <trix(a)redhat.com>
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in the remove function
Randy Dunlap <rdunlap(a)infradead.org>
HID: core: detect and skip invalid inputs to snto32()
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL
Tom Rix <trix(a)redhat.com>
jffs2: fix use after free in jffs2_sum_write_data()
Colin Ian King <colin.king(a)canonical.com>
fs/jfs: fix potential integer overflow on shift of a int
Zhihao Cheng <chengzhihao1(a)huawei.com>
btrfs: clarify error returns values in __load_free_space_cache
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
media: cx25821: Fix a bug when reallocating some dma memory
Joe Perches <joe(a)perches.com>
media: lmedm04: Fix misuse of comma
Dan Carpenter <dan.carpenter(a)oracle.com>
ASoC: cs42l56: fix up error handling in probe
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: tm6000: Fix memleak in tm6000_start_stream
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: media/pci: Fix memleak in empress_init
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
Dan Carpenter <dan.carpenter(a)oracle.com>
gma500: clean up error handling in init
Jialin Zhang <zhangjialin11(a)huawei.com>
drm/gma500: Fix error return code in psb_driver_load()
Randy Dunlap <rdunlap(a)infradead.org>
fbdev: aty: SPARC64 requires FB_ATY_CT
Colin Ian King <colin.king(a)canonical.com>
b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
Juergen Gross <jgross(a)suse.com>
xen/netback: fix spurious event detection for common event case
Edwin Peer <edwin.peer(a)broadcom.com>
bnxt_en: reverse order of TX disable and carrier off
Arnd Bergmann <arnd(a)arndb.de>
ARM: s3c: fix fiq for clang IAS
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Make "trimming xfer length" a debug message
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Abort transaction after errors with unknown reason
Pan Bian <bianpan2016(a)163.com>
Bluetooth: Put HCI device if inquiry procedure interrupts
Pan Bian <bianpan2016(a)163.com>
Bluetooth: drop HCI device reference before return
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
Christopher William Snowhill <chris(a)kode54.net>
Bluetooth: Fix initializing response id after clearing struct
Alexander Lobakin <alobakin(a)pm.me>
MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
Sumit Garg <sumit.garg(a)linaro.org>
kdb: Make memory allocations more robust
Rong Chen <rong.a.chen(a)intel.com>
scripts/recordmcount.pl: support big endian for ARCH sh
Corinna Vinschen <vinschen(a)redhat.com>
igb: Remove incorrect "unexpected SYS WRAP" log message
Rustam Kovhaev <rkovhaev(a)gmail.com>
ntfs: check for valid standard information attribute
David Vrabel <david.vrabel(a)citrix.com>
xen-netback: delete NAPI instance when queue fails to initialize
Stefan Ursella <stefan.ursella(a)wolfvision.net>
usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable
Will McVicker <willmcvicker(a)google.com>
HID: make arrays usage and value to be the same
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/compressed/head.S | 4 +-
arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
arch/mips/kernel/vmlinux.lds.S | 1 +
arch/mips/lantiq/irq.c | 2 +-
arch/mips/mm/c-r4k.c | 2 +-
arch/powerpc/Kconfig | 2 +-
arch/powerpc/platforms/pseries/dlpar.c | 7 +-
arch/sparc/Kconfig | 2 +-
arch/sparc/lib/memset.S | 1 +
arch/x86/kernel/reboot.c | 29 +++----
arch/xtensa/platforms/iss/simdisk.c | 1 -
block/blk-settings.c | 12 +++
drivers/amba/bus.c | 20 +++--
drivers/block/brd.c | 1 -
drivers/block/floppy.c | 27 ++++---
drivers/block/rbd.c | 9 ---
drivers/block/zram/zram_drv.h | 1 -
drivers/clk/meson/clk-pll.c | 2 +-
drivers/clocksource/mxs_timer.c | 5 +-
drivers/dma/fsldma.c | 6 ++
drivers/gpio/gpio-pcf857x.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 ++---
drivers/gpu/drm/gma500/psb_drv.c | 2 +
drivers/hid/hid-core.c | 9 ++-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/ide/ide-cd.c | 8 +-
drivers/ide/ide-cd.h | 6 +-
drivers/infiniband/core/user_mad.c | 7 +-
drivers/input/joydev.c | 7 +-
drivers/input/joystick/xpad.c | 1 +
drivers/input/serio/i8042-x86ia64io.h | 4 +
drivers/input/touchscreen/elo.c | 4 +-
drivers/md/dm-era-target.c | 93 ++++++++++++++--------
drivers/media/pci/cx25821/cx25821-core.c | 4 +-
drivers/media/pci/saa7134/saa7134-empress.c | 5 +-
drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
drivers/media/usb/tm6000/tm6000-dvb.c | 4 +
drivers/media/usb/uvc/uvc_v4l2.c | 18 ++---
drivers/mfd/wm831x-auxadc.c | 3 +-
drivers/misc/eeprom/eeprom_93xx46.c | 1 +
drivers/misc/vmw_vmci/vmci_queue_pair.c | 5 +-
drivers/mmc/host/usdhi6rol0.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-
drivers/net/ethernet/intel/igb/igb_main.c | 2 -
drivers/net/wireless/b43/phy_n.c | 2 +-
drivers/net/xen-netback/interface.c | 9 ++-
drivers/nvdimm/dimm_devs.c | 18 ++++-
drivers/nvdimm/nd.h | 1 -
drivers/pci/syscall.c | 10 +--
drivers/regulator/axp20x-regulator.c | 7 +-
drivers/scsi/bnx2fc/Kconfig | 1 +
drivers/scsi/gdth.h | 3 -
drivers/spi/spi-s3c24xx-fiq.S | 9 +--
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc2/hcd_intr.c | 14 +++-
drivers/usb/dwc3/gadget.c | 19 ++++-
drivers/usb/renesas_usbhs/fifo.c | 2 +
drivers/usb/serial/mos7720.c | 4 +-
drivers/usb/serial/mos7840.c | 4 +-
drivers/usb/serial/option.c | 3 +-
drivers/video/fbdev/Kconfig | 2 +-
fs/btrfs/free-space-cache.c | 6 +-
fs/btrfs/relocation.c | 4 +-
fs/f2fs/file.c | 3 +-
fs/gfs2/lock_dlm.c | 8 +-
fs/isofs/dir.c | 1 +
fs/isofs/namei.c | 1 +
fs/jffs2/summary.c | 3 +
fs/jfs/jfs_dmap.c | 2 +-
fs/ntfs/inode.c | 6 ++
include/linux/blkdev.h | 42 +++++++---
include/linux/device-mapper.h | 2 -
include/linux/ide.h | 1 -
include/uapi/linux/msdos_fs.h | 2 +
kernel/debug/kdb/kdb_private.h | 2 +-
kernel/futex.c | 7 +-
kernel/module.c | 21 ++++-
kernel/tracepoint.c | 80 +++++++++++++++----
mm/hugetlb.c | 43 +++++++++-
mm/memory.c | 6 +-
net/bluetooth/a2mp.c | 3 +-
net/bluetooth/hci_core.c | 6 +-
scripts/recordmcount.pl | 6 +-
security/keys/trusted.c | 2 +-
sound/soc/codecs/cs42l56.c | 3 +-
tools/perf/tests/sample-parsing.c | 2 +-
.../perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +
90 files changed, 494 insertions(+), 243 deletions(-)
On Tue, Jan 26, 2021 at 5:52 AM 'Michal Hocko' via kernel-team
<kernel-team(a)android.com> wrote:
>
> On Wed 20-01-21 14:17:39, Jann Horn wrote:
> > On Wed, Jan 13, 2021 at 3:22 PM Michal Hocko <mhocko(a)suse.com> wrote:
> > > On Tue 12-01-21 09:51:24, Suren Baghdasaryan wrote:
> > > > On Tue, Jan 12, 2021 at 9:45 AM Oleg Nesterov <oleg(a)redhat.com> wrote:
> > > > >
> > > > > On 01/12, Michal Hocko wrote:
> > > > > >
> > > > > > On Mon 11-01-21 09:06:22, Suren Baghdasaryan wrote:
> > > > > >
> > > > > > > What we want is the ability for one process to influence another process
> > > > > > > in order to optimize performance across the entire system while leaving
> > > > > > > the security boundary intact.
> > > > > > > Replace PTRACE_MODE_ATTACH with a combination of PTRACE_MODE_READ
> > > > > > > and CAP_SYS_NICE. PTRACE_MODE_READ to prevent leaking ASLR metadata
> > > > > > > and CAP_SYS_NICE for influencing process performance.
> > > > > >
> > > > > > I have to say that ptrace modes are rather obscure to me. So I cannot
> > > > > > really judge whether MODE_READ is sufficient. My understanding has
> > > > > > always been that this is requred to RO access to the address space. But
> > > > > > this operation clearly has a visible side effect. Do we have any actual
> > > > > > documentation for the existing modes?
> > > > > >
> > > > > > I would be really curious to hear from Jann and Oleg (now Cced).
> > > > >
> > > > > Can't comment, sorry. I never understood these security checks and never tried.
> > > > > IIUC only selinux/etc can treat ATTACH/READ differently and I have no idea what
> > > > > is the difference.
> >
> > Yama in particular only does its checks on ATTACH and ignores READ,
> > that's the difference you're probably most likely to encounter on a
> > normal desktop system, since some distros turn Yama on by default.
> > Basically the idea there is that running "gdb -p $pid" or "strace -p
> > $pid" as a normal user will usually fail, but reading /proc/$pid/maps
> > still works; so you can see things like detailed memory usage
> > information and such, but you're not supposed to be able to directly
> > peek into a running SSH client and inject data into the existing SSH
> > connection, or steal the cryptographic keys for the current
> > connection, or something like that.
> >
> > > > I haven't seen a written explanation on ptrace modes but when I
> > > > consulted Jann his explanation was:
> > > >
> > > > PTRACE_MODE_READ means you can inspect metadata about processes with
> > > > the specified domain, across UID boundaries.
> > > > PTRACE_MODE_ATTACH means you can fully impersonate processes with the
> > > > specified domain, across UID boundaries.
> > >
> > > Maybe this would be a good start to document expectations. Some more
> > > practical examples where the difference is visible would be great as
> > > well.
> >
> > Before documenting the behavior, it would be a good idea to figure out
> > what to do with perf_event_open(). That one's weird in that it only
> > requires PTRACE_MODE_READ, but actually allows you to sample stuff
> > like userspace stack and register contents (if perf_event_paranoid is
> > 1 or 2). Maybe for SELinux things (and maybe also for Yama), there
> > should be a level in between that allows fully inspecting the process
> > (for purposes like profiling) but without the ability to corrupt its
> > memory or registers or things like that. Or maybe perf_event_open()
> > should just use the ATTACH mode.
>
> Thanks for the clarification. I still cannot say I would have a good
> mental picture. Having something in Documentation/core-api/ sounds
> really needed. Wrt to perf_event_open it sounds really odd it can do
> more than other places restrict indeed. Something for the respective
> maintainer but I strongly suspect people simply copy the pattern from
> other places because the expected semantic is not really clear.
>
Sorry, back to the matters of this patch. Are there any actionable
items for me to take care of before it can be accepted? The only
request from Andrew to write a man page is being worked on at
https://lore.kernel.org/linux-mm/20210120202337.1481402-1-surenb@google.com/
and I'll follow up with the next version. I also CC'ed stable@ for
this to be included into 5.10 per Andrew's request. That CC was lost
at some point, so CC'ing again.
I do not see anything else on this patch to fix. Please chime in if
there are any more concerns, otherwise I would ask Andrew to take it
into mm-tree and stable@ to apply it to 5.10.
Thanks!
> --
> Michal Hocko
> SUSE Labs
>
> --
> To unsubscribe from this group and stop receiving emails from it, send an email to kernel-team+unsubscribe(a)android.com.
>
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 718aae916fa6619c57c348beaedd675835cf1aa1 Mon Sep 17 00:00:00 2001
From: Ananth N Mavinakayanahalli <ananth(a)linux.ibm.com>
Date: Mon, 25 Jan 2021 18:36:43 +0530
Subject: [PATCH] powerpc/sstep: Fix incorrect return from analyze_instr()
We currently just percolate the return value from analyze_instr()
to the caller of emulate_step(), especially if it is a -1.
For one particular case (opcode = 4) for instructions that aren't
currently emulated, we are returning 'should not be single-stepped'
while we should have returned 0 which says 'did not emulate, may
have to single-step'.
Fixes: 930d6288a26787 ("powerpc: sstep: Add support for maddhd, maddhdu, maddld instructions")
Signed-off-by: Ananth N Mavinakayanahalli <ananth(a)linux.ibm.com>
Suggested-by: Michael Ellerman <mpe(a)ellerman.id.au>
Tested-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Reviewed-by: Sandipan Das <sandipan(a)linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Link: https://lore.kernel.org/r/161157999039.64773.14950289716779364766.stgit@thi…
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index f859cbbb6375..e96cff845ef7 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1445,6 +1445,11 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
#ifdef __powerpc64__
case 4:
+ /*
+ * There are very many instructions with this primary opcode
+ * introduced in the ISA as early as v2.03. However, the ones
+ * we currently emulate were all introduced with ISA 3.0
+ */
if (!cpu_has_feature(CPU_FTR_ARCH_300))
goto unknown_opcode;
@@ -1472,7 +1477,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
* There are other instructions from ISA 3.0 with the same
* primary opcode which do not have emulation support yet.
*/
- return -1;
+ goto unknown_opcode;
#endif
case 7: /* mulli */
USB devices cannot perform DMA and hence have no dma_mask set in their
device structure. Therefore importing dmabuf into a USB-based driver
fails, which breaks joining and mirroring of display in X11.
For USB devices, pick the associated USB controller as attachment device.
This allows the DRM import helpers to perform the DMA setup. If the DMA
controller does not support DMA transfers, we're out of luck and cannot
import. Our current USB-based DRM drivers don't use DMA, so the actual
DMA device is not important.
Tested by joining/mirroring displays of udl and radeon under Gnome/X11.
v8:
* release dmadev if device initialization fails (Noralf)
* fix commit description (Noralf)
v7:
* fix use-before-init bug in gm12u320 (Dan)
v6:
* implement workaround in DRM drivers and hold reference to
DMA device while USB device is in use
* remove dev_is_usb() (Greg)
* collapse USB helper into usb_intf_get_dma_device() (Alan)
* integrate Daniel's TODO statement (Daniel)
* fix typos (Greg)
v5:
* provide a helper for USB interfaces (Alan)
* add FIXME item to documentation and TODO list (Daniel)
v4:
* implement workaround with USB helper functions (Greg)
* use struct usb_device->bus->sysdev as DMA device (Takashi)
v3:
* drop gem_create_object
* use DMA mask of USB controller, if any (Daniel, Christian, Noralf)
v2:
* move fix to importer side (Christian, Daniel)
* update SHMEM and CMA helpers for new PRIME callbacks
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Fixes: 6eb0233ec2d0 ("usb: don't inherity DMA properties for USB devices")
Tested-by: Pavel Machek <pavel(a)ucw.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Acked-by: Christian König <christian.koenig(a)amd.com>
Acked-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: <stable(a)vger.kernel.org> # v5.10+
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
---
Documentation/gpu/todo.rst | 21 ++++++++++++++++
drivers/gpu/drm/tiny/gm12u320.c | 44 +++++++++++++++++++++++++++------
drivers/gpu/drm/udl/udl_drv.c | 17 +++++++++++++
drivers/gpu/drm/udl/udl_drv.h | 1 +
drivers/gpu/drm/udl/udl_main.c | 10 ++++++++
drivers/usb/core/usb.c | 32 ++++++++++++++++++++++++
include/linux/usb.h | 2 ++
7 files changed, 119 insertions(+), 8 deletions(-)
diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst
index 0631b9b323d5..fdfd6a1081ec 100644
--- a/Documentation/gpu/todo.rst
+++ b/Documentation/gpu/todo.rst
@@ -571,6 +571,27 @@ Contact: Daniel Vetter
Level: Intermediate
+Remove automatic page mapping from dma-buf importing
+----------------------------------------------------
+
+When importing dma-bufs, the dma-buf and PRIME frameworks automatically map
+imported pages into the importer's DMA area. drm_gem_prime_fd_to_handle() and
+drm_gem_prime_handle_to_fd() require that importers call dma_buf_attach()
+even if they never do actual device DMA, but only CPU access through
+dma_buf_vmap(). This is a problem for USB devices, which do not support DMA
+operations.
+
+To fix the issue, automatic page mappings should be removed from the
+buffer-sharing code. Fixing this is a bit more involved, since the import/export
+cache is also tied to &drm_gem_object.import_attach. Meanwhile we paper over
+this problem for USB devices by fishing out the USB host controller device, as
+long as that supports DMA. Otherwise importing can still needlessly fail.
+
+Contact: Thomas Zimmermann <tzimmermann(a)suse.de>, Daniel Vetter
+
+Level: Advanced
+
+
Better Testing
==============
diff --git a/drivers/gpu/drm/tiny/gm12u320.c b/drivers/gpu/drm/tiny/gm12u320.c
index 0b4f4f2af1ef..a233c86d428b 100644
--- a/drivers/gpu/drm/tiny/gm12u320.c
+++ b/drivers/gpu/drm/tiny/gm12u320.c
@@ -84,6 +84,7 @@ MODULE_PARM_DESC(eco_mode, "Turn on Eco mode (less bright, more silent)");
struct gm12u320_device {
struct drm_device dev;
+ struct device *dmadev;
struct drm_simple_display_pipe pipe;
struct drm_connector conn;
unsigned char *cmd_buf;
@@ -599,6 +600,22 @@ static const uint64_t gm12u320_pipe_modifiers[] = {
DRM_FORMAT_MOD_INVALID
};
+/*
+ * FIXME: Dma-buf sharing requires DMA support by the importing device.
+ * This function is a workaround to make USB devices work as well.
+ * See todo.rst for how to fix the issue in the dma-buf framework.
+ */
+static struct drm_gem_object *gm12u320_gem_prime_import(struct drm_device *dev,
+ struct dma_buf *dma_buf)
+{
+ struct gm12u320_device *gm12u320 = to_gm12u320(dev);
+
+ if (!gm12u320->dmadev)
+ return ERR_PTR(-ENODEV);
+
+ return drm_gem_prime_import_dev(dev, dma_buf, gm12u320->dmadev);
+}
+
DEFINE_DRM_GEM_FOPS(gm12u320_fops);
static const struct drm_driver gm12u320_drm_driver = {
@@ -612,6 +629,7 @@ static const struct drm_driver gm12u320_drm_driver = {
.fops = &gm12u320_fops,
DRM_GEM_SHMEM_DRIVER_OPS,
+ .gem_prime_import = gm12u320_gem_prime_import,
};
static const struct drm_mode_config_funcs gm12u320_mode_config_funcs = {
@@ -638,15 +656,18 @@ static int gm12u320_usb_probe(struct usb_interface *interface,
struct gm12u320_device, dev);
if (IS_ERR(gm12u320))
return PTR_ERR(gm12u320);
+ dev = &gm12u320->dev;
+
+ gm12u320->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev));
+ if (!gm12u320->dmadev)
+ drm_warn(dev, "buffer sharing not supported"); /* not an error */
INIT_DELAYED_WORK(&gm12u320->fb_update.work, gm12u320_fb_update_work);
mutex_init(&gm12u320->fb_update.lock);
- dev = &gm12u320->dev;
-
ret = drmm_mode_config_init(dev);
if (ret)
- return ret;
+ goto err_put_device;
dev->mode_config.min_width = GM12U320_USER_WIDTH;
dev->mode_config.max_width = GM12U320_USER_WIDTH;
@@ -656,15 +677,15 @@ static int gm12u320_usb_probe(struct usb_interface *interface,
ret = gm12u320_usb_alloc(gm12u320);
if (ret)
- return ret;
+ goto err_put_device;
ret = gm12u320_set_ecomode(gm12u320);
if (ret)
- return ret;
+ goto err_put_device;
ret = gm12u320_conn_init(gm12u320);
if (ret)
- return ret;
+ goto err_put_device;
ret = drm_simple_display_pipe_init(&gm12u320->dev,
&gm12u320->pipe,
@@ -674,24 +695,31 @@ static int gm12u320_usb_probe(struct usb_interface *interface,
gm12u320_pipe_modifiers,
&gm12u320->conn);
if (ret)
- return ret;
+ goto err_put_device;
drm_mode_config_reset(dev);
usb_set_intfdata(interface, dev);
ret = drm_dev_register(dev, 0);
if (ret)
- return ret;
+ goto err_put_device;
drm_fbdev_generic_setup(dev, 0);
return 0;
+
+err_put_device:
+ put_device(gm12u320->dmadev);
+ return ret;
}
static void gm12u320_usb_disconnect(struct usb_interface *interface)
{
struct drm_device *dev = usb_get_intfdata(interface);
+ struct gm12u320_device *gm12u320 = to_gm12u320(dev);
+ put_device(gm12u320->dmadev);
+ gm12u320->dmadev = NULL;
drm_dev_unplug(dev);
drm_atomic_helper_shutdown(dev);
}
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 9269092697d8..5703277c6f52 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -32,6 +32,22 @@ static int udl_usb_resume(struct usb_interface *interface)
return drm_mode_config_helper_resume(dev);
}
+/*
+ * FIXME: Dma-buf sharing requires DMA support by the importing device.
+ * This function is a workaround to make USB devices work as well.
+ * See todo.rst for how to fix the issue in the dma-buf framework.
+ */
+static struct drm_gem_object *udl_driver_gem_prime_import(struct drm_device *dev,
+ struct dma_buf *dma_buf)
+{
+ struct udl_device *udl = to_udl(dev);
+
+ if (!udl->dmadev)
+ return ERR_PTR(-ENODEV);
+
+ return drm_gem_prime_import_dev(dev, dma_buf, udl->dmadev);
+}
+
DEFINE_DRM_GEM_FOPS(udl_driver_fops);
static const struct drm_driver driver = {
@@ -40,6 +56,7 @@ static const struct drm_driver driver = {
/* GEM hooks */
.fops = &udl_driver_fops,
DRM_GEM_SHMEM_DRIVER_OPS,
+ .gem_prime_import = udl_driver_gem_prime_import,
.name = DRIVER_NAME,
.desc = DRIVER_DESC,
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index 875e73551ae9..cc16a13316e4 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -50,6 +50,7 @@ struct urb_list {
struct udl_device {
struct drm_device drm;
struct device *dev;
+ struct device *dmadev;
struct drm_simple_display_pipe display_pipe;
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 0e2a376cb075..853f147036f6 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -315,6 +315,10 @@ int udl_init(struct udl_device *udl)
DRM_DEBUG("\n");
+ udl->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev));
+ if (!udl->dmadev)
+ drm_warn(dev, "buffer sharing not supported"); /* not an error */
+
mutex_init(&udl->gem_lock);
if (!udl_parse_vendor_descriptor(udl)) {
@@ -343,12 +347,18 @@ int udl_init(struct udl_device *udl)
err:
if (udl->urbs.count)
udl_free_urb_list(dev);
+ put_device(udl->dmadev);
DRM_ERROR("%d\n", ret);
return ret;
}
int udl_drop_usb(struct drm_device *dev)
{
+ struct udl_device *udl = to_udl(dev);
+
udl_free_urb_list(dev);
+ put_device(udl->dmadev);
+ udl->dmadev = NULL;
+
return 0;
}
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 8f07b0516100..a566bb494e24 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -748,6 +748,38 @@ void usb_put_intf(struct usb_interface *intf)
}
EXPORT_SYMBOL_GPL(usb_put_intf);
+/**
+ * usb_intf_get_dma_device - acquire a reference on the usb interface's DMA endpoint
+ * @intf: the usb interface
+ *
+ * While a USB device cannot perform DMA operations by itself, many USB
+ * controllers can. A call to usb_intf_get_dma_device() returns the DMA endpoint
+ * for the given USB interface, if any. The returned device structure must be
+ * released with put_device().
+ *
+ * See also usb_get_dma_device().
+ *
+ * Returns: A reference to the usb interface's DMA endpoint; or NULL if none
+ * exists.
+ */
+struct device *usb_intf_get_dma_device(struct usb_interface *intf)
+{
+ struct usb_device *udev = interface_to_usbdev(intf);
+ struct device *dmadev;
+
+ if (!udev->bus)
+ return NULL;
+
+ dmadev = get_device(udev->bus->sysdev);
+ if (!dmadev || !dmadev->dma_mask) {
+ put_device(dmadev);
+ return NULL;
+ }
+
+ return dmadev;
+}
+EXPORT_SYMBOL_GPL(usb_intf_get_dma_device);
+
/* USB device locking
*
* USB devices and interfaces are locked using the semaphore in their
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 7d72c4e0713c..d6a41841b93e 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -746,6 +746,8 @@ extern int usb_lock_device_for_reset(struct usb_device *udev,
extern int usb_reset_device(struct usb_device *dev);
extern void usb_queue_reset_device(struct usb_interface *dev);
+extern struct device *usb_intf_get_dma_device(struct usb_interface *intf);
+
#ifdef CONFIG_ACPI
extern int usb_acpi_set_power_state(struct usb_device *hdev, int index,
bool enable);
base-commit: b80182b9bffb51460e4a2ad7d96737ecd49126dc
prerequisite-patch-id: c2b2f08f0eccc9f5df0c0da49fa1d36267deb11d
--
2.30.1
USB devices cannot perform DMA and hence have no dma_mask set in their
device structure. Therefore importing dmabuf into a USB-based driver
fails, which breaks joining and mirroring of display in X11.
For USB devices, pick the associated USB controller as attachment device.
This allows the DRM import helpers to perform the DMA setup. If the DMA
controller does not support DMA transfers, we're out of luck and cannot
import. Our current USB-based DRM drivers don't use DMA, so the actual
DMA device is not important.
Drivers should use DRM_GEM_SHMEM_DROVER_OPS_USB to initialize their
instance of struct drm_driver.
Tested by joining/mirroring displays of udl and radeon un der Gnome/X11.
v7:
* fix use-before-init bug in gm12u320 (Dan)
v6:
* implement workaround in DRM drivers and hold reference to
DMA device while USB device is in use
* remove dev_is_usb() (Greg)
* collapse USB helper into usb_intf_get_dma_device() (Alan)
* integrate Daniel's TODO statement (Daniel)
* fix typos (Greg)
v5:
* provide a helper for USB interfaces (Alan)
* add FIXME item to documentation and TODO list (Daniel)
v4:
* implement workaround with USB helper functions (Greg)
* use struct usb_device->bus->sysdev as DMA device (Takashi)
v3:
* drop gem_create_object
* use DMA mask of USB controller, if any (Daniel, Christian, Noralf)
v2:
* move fix to importer side (Christian, Daniel)
* update SHMEM and CMA helpers for new PRIME callbacks
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Fixes: 6eb0233ec2d0 ("usb: don't inherity DMA properties for USB devices")
Tested-by: Pavel Machek <pavel(a)ucw.cz>
Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Acked-by: Christian König <christian.koenig(a)amd.com>
Acked-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: <stable(a)vger.kernel.org> # v5.10+
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
---
Documentation/gpu/todo.rst | 21 +++++++++++++++++++++
drivers/gpu/drm/tiny/gm12u320.c | 28 ++++++++++++++++++++++++++--
drivers/gpu/drm/udl/udl_drv.c | 17 +++++++++++++++++
drivers/gpu/drm/udl/udl_drv.h | 1 +
drivers/gpu/drm/udl/udl_main.c | 9 +++++++++
drivers/usb/core/usb.c | 32 ++++++++++++++++++++++++++++++++
include/linux/usb.h | 2 ++
7 files changed, 108 insertions(+), 2 deletions(-)
diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst
index 0631b9b323d5..fdfd6a1081ec 100644
--- a/Documentation/gpu/todo.rst
+++ b/Documentation/gpu/todo.rst
@@ -571,6 +571,27 @@ Contact: Daniel Vetter
Level: Intermediate
+Remove automatic page mapping from dma-buf importing
+----------------------------------------------------
+
+When importing dma-bufs, the dma-buf and PRIME frameworks automatically map
+imported pages into the importer's DMA area. drm_gem_prime_fd_to_handle() and
+drm_gem_prime_handle_to_fd() require that importers call dma_buf_attach()
+even if they never do actual device DMA, but only CPU access through
+dma_buf_vmap(). This is a problem for USB devices, which do not support DMA
+operations.
+
+To fix the issue, automatic page mappings should be removed from the
+buffer-sharing code. Fixing this is a bit more involved, since the import/export
+cache is also tied to &drm_gem_object.import_attach. Meanwhile we paper over
+this problem for USB devices by fishing out the USB host controller device, as
+long as that supports DMA. Otherwise importing can still needlessly fail.
+
+Contact: Thomas Zimmermann <tzimmermann(a)suse.de>, Daniel Vetter
+
+Level: Advanced
+
+
Better Testing
==============
diff --git a/drivers/gpu/drm/tiny/gm12u320.c b/drivers/gpu/drm/tiny/gm12u320.c
index 0b4f4f2af1ef..4fe372f43cf5 100644
--- a/drivers/gpu/drm/tiny/gm12u320.c
+++ b/drivers/gpu/drm/tiny/gm12u320.c
@@ -84,6 +84,7 @@ MODULE_PARM_DESC(eco_mode, "Turn on Eco mode (less bright, more silent)");
struct gm12u320_device {
struct drm_device dev;
+ struct device *dmadev;
struct drm_simple_display_pipe pipe;
struct drm_connector conn;
unsigned char *cmd_buf;
@@ -599,6 +600,22 @@ static const uint64_t gm12u320_pipe_modifiers[] = {
DRM_FORMAT_MOD_INVALID
};
+/*
+ * FIXME: Dma-buf sharing requires DMA support by the importing device.
+ * This function is a workaround to make USB devices work as well.
+ * See todo.rst for how to fix the issue in the dma-buf framework.
+ */
+static struct drm_gem_object *gm12u320_gem_prime_import(struct drm_device *dev,
+ struct dma_buf *dma_buf)
+{
+ struct gm12u320_device *gm12u320 = to_gm12u320(dev);
+
+ if (!gm12u320->dmadev)
+ return ERR_PTR(-ENODEV);
+
+ return drm_gem_prime_import_dev(dev, dma_buf, gm12u320->dmadev);
+}
+
DEFINE_DRM_GEM_FOPS(gm12u320_fops);
static const struct drm_driver gm12u320_drm_driver = {
@@ -612,6 +629,7 @@ static const struct drm_driver gm12u320_drm_driver = {
.fops = &gm12u320_fops,
DRM_GEM_SHMEM_DRIVER_OPS,
+ .gem_prime_import = gm12u320_gem_prime_import,
};
static const struct drm_mode_config_funcs gm12u320_mode_config_funcs = {
@@ -638,12 +656,15 @@ static int gm12u320_usb_probe(struct usb_interface *interface,
struct gm12u320_device, dev);
if (IS_ERR(gm12u320))
return PTR_ERR(gm12u320);
+ dev = &gm12u320->dev;
+
+ gm12u320->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev));
+ if (!gm12u320->dmadev)
+ drm_warn(dev, "buffer sharing not supported"); /* not an error */
INIT_DELAYED_WORK(&gm12u320->fb_update.work, gm12u320_fb_update_work);
mutex_init(&gm12u320->fb_update.lock);
- dev = &gm12u320->dev;
-
ret = drmm_mode_config_init(dev);
if (ret)
return ret;
@@ -691,7 +712,10 @@ static int gm12u320_usb_probe(struct usb_interface *interface,
static void gm12u320_usb_disconnect(struct usb_interface *interface)
{
struct drm_device *dev = usb_get_intfdata(interface);
+ struct gm12u320_device *gm12u320 = to_gm12u320(dev);
+ put_device(gm12u320->dmadev);
+ gm12u320->dmadev = NULL;
drm_dev_unplug(dev);
drm_atomic_helper_shutdown(dev);
}
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 9269092697d8..5703277c6f52 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -32,6 +32,22 @@ static int udl_usb_resume(struct usb_interface *interface)
return drm_mode_config_helper_resume(dev);
}
+/*
+ * FIXME: Dma-buf sharing requires DMA support by the importing device.
+ * This function is a workaround to make USB devices work as well.
+ * See todo.rst for how to fix the issue in the dma-buf framework.
+ */
+static struct drm_gem_object *udl_driver_gem_prime_import(struct drm_device *dev,
+ struct dma_buf *dma_buf)
+{
+ struct udl_device *udl = to_udl(dev);
+
+ if (!udl->dmadev)
+ return ERR_PTR(-ENODEV);
+
+ return drm_gem_prime_import_dev(dev, dma_buf, udl->dmadev);
+}
+
DEFINE_DRM_GEM_FOPS(udl_driver_fops);
static const struct drm_driver driver = {
@@ -40,6 +56,7 @@ static const struct drm_driver driver = {
/* GEM hooks */
.fops = &udl_driver_fops,
DRM_GEM_SHMEM_DRIVER_OPS,
+ .gem_prime_import = udl_driver_gem_prime_import,
.name = DRIVER_NAME,
.desc = DRIVER_DESC,
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index 875e73551ae9..cc16a13316e4 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -50,6 +50,7 @@ struct urb_list {
struct udl_device {
struct drm_device drm;
struct device *dev;
+ struct device *dmadev;
struct drm_simple_display_pipe display_pipe;
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 0e2a376cb075..7c0338bcadea 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -315,6 +315,10 @@ int udl_init(struct udl_device *udl)
DRM_DEBUG("\n");
+ udl->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev));
+ if (!udl->dmadev)
+ drm_warn(dev, "buffer sharing not supported"); /* not an error */
+
mutex_init(&udl->gem_lock);
if (!udl_parse_vendor_descriptor(udl)) {
@@ -349,6 +353,11 @@ int udl_init(struct udl_device *udl)
int udl_drop_usb(struct drm_device *dev)
{
+ struct udl_device *udl = to_udl(dev);
+
udl_free_urb_list(dev);
+ put_device(udl->dmadev);
+ udl->dmadev = NULL;
+
return 0;
}
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 8f07b0516100..a566bb494e24 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -748,6 +748,38 @@ void usb_put_intf(struct usb_interface *intf)
}
EXPORT_SYMBOL_GPL(usb_put_intf);
+/**
+ * usb_intf_get_dma_device - acquire a reference on the usb interface's DMA endpoint
+ * @intf: the usb interface
+ *
+ * While a USB device cannot perform DMA operations by itself, many USB
+ * controllers can. A call to usb_intf_get_dma_device() returns the DMA endpoint
+ * for the given USB interface, if any. The returned device structure must be
+ * released with put_device().
+ *
+ * See also usb_get_dma_device().
+ *
+ * Returns: A reference to the usb interface's DMA endpoint; or NULL if none
+ * exists.
+ */
+struct device *usb_intf_get_dma_device(struct usb_interface *intf)
+{
+ struct usb_device *udev = interface_to_usbdev(intf);
+ struct device *dmadev;
+
+ if (!udev->bus)
+ return NULL;
+
+ dmadev = get_device(udev->bus->sysdev);
+ if (!dmadev || !dmadev->dma_mask) {
+ put_device(dmadev);
+ return NULL;
+ }
+
+ return dmadev;
+}
+EXPORT_SYMBOL_GPL(usb_intf_get_dma_device);
+
/* USB device locking
*
* USB devices and interfaces are locked using the semaphore in their
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 7d72c4e0713c..d6a41841b93e 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -746,6 +746,8 @@ extern int usb_lock_device_for_reset(struct usb_device *udev,
extern int usb_reset_device(struct usb_device *dev);
extern void usb_queue_reset_device(struct usb_interface *dev);
+extern struct device *usb_intf_get_dma_device(struct usb_interface *intf);
+
#ifdef CONFIG_ACPI
extern int usb_acpi_set_power_state(struct usb_device *hdev, int index,
bool enable);
base-commit: b80182b9bffb51460e4a2ad7d96737ecd49126dc
prerequisite-patch-id: c2b2f08f0eccc9f5df0c0da49fa1d36267deb11d
--
2.30.1
Hello,
Good day, please accept my apology for sending you this sensitive
information without per informing you. This is due to the urgency
of the information. I am a Project director at Ghana National
Petroleum Corporation (GNPC) and a member of Contract Tenders
Board of the Ministry of Mineral Resources in Ghana. I need your
service in a confidential matter regarding money transfer from an
over-invoiced contract sum. This requires a private arrangement
though the details of the transaction will be furnished to you if
you indicate your interest in this proposal.
We have all the legal documents to back up the transaction,
besides we have worked out the modalities to ensure smooth
conclusion of this fund transfer. We are willing to offer you
25% and there is not risk involved in the transaction.
I am expecting to hear from you, if you have interest in the
business. In which case, correspondence in the course of the
transaction will be conducted by email presently.
Thanks,
Yours Faithfully,
Dr. Joseph Dabantu
Commit 56348560d495 ("debugfs: do not attempt to create a new file
before the filesystem is initalized") forbids creating new debugfs files
until debugfs is fully initialized. This breaks KCSAN's debugfs file
creation, which happened at the end of __init().
There is no reason to create the debugfs file during early
initialization. Therefore, move it into a late_initcall() callback.
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: "Rafael J. Wysocki" <rafael(a)kernel.org>
Cc: stable <stable(a)vger.kernel.org>
Fixes: 56348560d495 ("debugfs: do not attempt to create a new file before the filesystem is initalized")
Signed-off-by: Marco Elver <elver(a)google.com>
---
I've marked this for 'stable', since 56348560d495 is also intended for
stable, and would subsequently break KCSAN in all stable kernels where
KCSAN is available (since 5.8).
---
kernel/kcsan/core.c | 2 --
kernel/kcsan/debugfs.c | 4 +++-
kernel/kcsan/kcsan.h | 5 -----
3 files changed, 3 insertions(+), 8 deletions(-)
diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
index 8c3867640c21..45c821d4e8bd 100644
--- a/kernel/kcsan/core.c
+++ b/kernel/kcsan/core.c
@@ -644,8 +644,6 @@ void __init kcsan_init(void)
BUG_ON(!in_task());
- kcsan_debugfs_init();
-
for_each_possible_cpu(cpu)
per_cpu(kcsan_rand_state, cpu) = (u32)get_cycles();
diff --git a/kernel/kcsan/debugfs.c b/kernel/kcsan/debugfs.c
index c837ce6c52e6..c1dd02f3be8b 100644
--- a/kernel/kcsan/debugfs.c
+++ b/kernel/kcsan/debugfs.c
@@ -266,7 +266,9 @@ static const struct file_operations debugfs_ops =
.release = single_release
};
-void __init kcsan_debugfs_init(void)
+static void __init kcsan_debugfs_init(void)
{
debugfs_create_file("kcsan", 0644, NULL, NULL, &debugfs_ops);
}
+
+late_initcall(kcsan_debugfs_init);
diff --git a/kernel/kcsan/kcsan.h b/kernel/kcsan/kcsan.h
index 594a5dd4842a..9881099d4179 100644
--- a/kernel/kcsan/kcsan.h
+++ b/kernel/kcsan/kcsan.h
@@ -31,11 +31,6 @@ extern bool kcsan_enabled;
void kcsan_save_irqtrace(struct task_struct *task);
void kcsan_restore_irqtrace(struct task_struct *task);
-/*
- * Initialize debugfs file.
- */
-void kcsan_debugfs_init(void);
-
/*
* Statistics counters displayed via debugfs; should only be modified in
* slow-paths.
--
2.30.1.766.gb4fecdf3b7-goog
From: Nadav Amit <namit(a)vmware.com>
Userfaultfd self-test fails occasionally, indicating a memory
corruption.
Analyzing this problem indicates that there is a real bug since
mmap_lock is only taken for read in mwriteprotect_range() and defers
flushes, and since there is insufficient consideration of concurrent
deferred TLB flushes in wp_page_copy(). Although the PTE is flushed from
the TLBs in wp_page_copy(), this flush takes place after the copy has
already been performed, and therefore changes of the page are possible
between the time of the copy and the time in which the PTE is flushed.
To make matters worse, memory-unprotection using userfaultfd also poses
a problem. Although memory unprotection is logically a promotion of PTE
permissions, and therefore should not require a TLB flush, the current
userrfaultfd code might actually cause a demotion of the architectural
PTE permission: when userfaultfd_writeprotect() unprotects memory
region, it unintentionally *clears* the RW-bit if it was already set.
Note that this unprotecting a PTE that is not write-protected is a valid
use-case: the userfaultfd monitor might ask to unprotect a region that
holds both write-protected and write-unprotected PTEs.
The scenario that happens in selftests/vm/userfaultfd is as follows:
cpu0 cpu1 cpu2
---- ---- ----
[ Writable PTE
cached in TLB ]
userfaultfd_writeprotect()
[ write-*unprotect* ]
mwriteprotect_range()
mmap_read_lock()
change_protection()
change_protection_range()
...
change_pte_range()
[ *clear* “write”-bit ]
[ defer TLB flushes ]
[ page-fault ]
...
wp_page_copy()
cow_user_page()
[ copy page ]
[ write to old
page ]
...
set_pte_at_notify()
A similar scenario can happen:
cpu0 cpu1 cpu2 cpu3
---- ---- ---- ----
[ Writable PTE
cached in TLB ]
userfaultfd_writeprotect()
[ write-protect ]
[ deferred TLB flush ]
userfaultfd_writeprotect()
[ write-unprotect ]
[ deferred TLB flush]
[ page-fault ]
wp_page_copy()
cow_user_page()
[ copy page ]
... [ write to page ]
set_pte_at_notify()
This race exists since commit 292924b26024 ("userfaultfd: wp: apply
_PAGE_UFFD_WP bit"). Yet, as Yu Zhao pointed, these races became
apparent since commit 09854ba94c6a ("mm: do_wp_page() simplification")
which made wp_page_copy() more likely to take place, specifically if
page_count(page) > 1.
To resolve the aforementioned races, check whether there are pending
flushes on uffd-write-protected VMAs, and if there are, perform a flush
before doing the COW.
Further optimizations will follow, since currently write-unprotect would
also
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Andy Lutomirski <luto(a)kernel.org>
Cc: Peter Xu <peterx(a)redhat.com>
Cc: Pavel Emelyanov <xemul(a)openvz.org>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: Minchan Kim <minchan(a)kernel.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
Suggested-by: Yu Zhao <yuzhao(a)google.com>
Fixes: 292924b26024 ("userfaultfd: wp: apply _PAGE_UFFD_WP bit")
Signed-off-by: Nadav Amit <namit(a)vmware.com>
---
v2->v3:
* Do not acquire mmap_lock for write, flush conditionally instead [Yu]
* Change the fixes tag to the patch that made the race apparent [Yu]
* Removing patch to avoid write-protect on uffd unprotect. More
comprehensive solution to follow (and avoid the TLB flush as well).
---
mm/memory.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/mm/memory.c b/mm/memory.c
index 9e8576a83147..06da04f98936 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3092,6 +3092,13 @@ static vm_fault_t do_wp_page(struct vm_fault *vmf)
return handle_userfault(vmf, VM_UFFD_WP);
}
+ /*
+ * Userfaultfd write-protect can defer flushes. Ensure the TLB
+ * is flushed in this case before copying.
+ */
+ if (userfaultfd_wp(vmf->vma) && mm_tlb_flush_pending(vmf->vma->vm_mm))
+ flush_tlb_page(vmf->vma, vmf->address);
+
vmf->page = vm_normal_page(vma, vmf->address, vmf->orig_pte);
if (!vmf->page) {
/*
--
2.25.1
ALSA: hda/realtek: Add quirk for Intel NUC 10
This adds a new SND_PCI_QUIRK(...) and applies it to the Intel NUC 10
devices. This fixes the issue of the devices not having audio input and
output on the headset jack because the kernel does not recognize when
something is plugged in.
The new quirk was inspired by the quirk for the Intel NUC 8 devices, but
it turned out that the NUC 10 uses another pin. This information was
acquired by black box testing likely pins.
Co-developed-by: Eckhart Mohr <e.mohr(a)tuxedocomputers.com>
Signed-off-by: Eckhart Mohr <e.mohr(a)tuxedocomputers.com>
Signed-off-by: Werner Sembach <wse(a)tuxedocomputers.com>
Cc: <stable(a)vger.kernel.org>
---
Resend of this patch with git send-email, because last patch got tabs replaced with spaces.
>From d281364b8ca6c054a0e5ce20caa599bf7d08160d Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse(a)tuxedocomputers.com>
Date: Fri, 26 Feb 2021 13:54:30 +0100
Subject: [PATCH] Fix Intel NUC10 no output and input on headset jack
---
sound/pci/hda/patch_realtek.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 290645516313..c14d624dbaf1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6362,6 +6362,7 @@ enum {
ALC269_FIXUP_LEMOTE_A1802,
ALC269_FIXUP_LEMOTE_A190X,
ALC256_FIXUP_INTEL_NUC8_RUGGED,
+ ALC256_FIXUP_INTEL_NUC10,
ALC255_FIXUP_XIAOMI_HEADSET_MIC,
ALC274_FIXUP_HP_MIC,
ALC274_FIXUP_HP_HEADSET_MIC,
@@ -7744,6 +7745,15 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC269_FIXUP_HEADSET_MODE
},
+ [ALC256_FIXUP_INTEL_NUC10] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE
+ },
[ALC255_FIXUP_XIAOMI_HEADSET_MIC] = {
.type = HDA_FIXUP_VERBS,
.v.verbs = (const struct hda_verb[]) {
@@ -8183,6 +8193,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED),
+ SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
#if 0
/* Below is a quirk table taken from the old code.
--
2.25.1
From: "Steven J. Magnani" <magnani(a)ieee.org>
[ Upstream commit 63c9e47a1642fc817654a1bc18a6ec4bbcc0f056 ]
When extending a file, udf_do_extend_file() may enter following empty
indirect extent. At the end of udf_do_extend_file() we revert prev_epos
to point to the last written extent. However if we end up not adding any
further extent in udf_do_extend_file(), the reverting points prev_epos
into the header area of the AED and following updates of the extents
(in udf_update_extents()) will corrupt the header.
Make sure that we do not follow indirect extent if we are not going to
add any more extents so that returning back to the last written extent
works correctly.
Link: https://lore.kernel.org/r/20210107234116.6190-2-magnani@ieee.org
Signed-off-by: Steven J. Magnani <magnani(a)ieee.org>
Signed-off-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
fs/udf/inode.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 149baf5f3d19..50607673a6a9 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -548,11 +548,14 @@ static int udf_do_extend_file(struct inode *inode,
udf_write_aext(inode, last_pos, &last_ext->extLocation,
last_ext->extLength, 1);
+
/*
- * We've rewritten the last extent but there may be empty
- * indirect extent after it - enter it.
+ * We've rewritten the last extent. If we are going to add
+ * more extents, we may need to enter possible following
+ * empty indirect extent.
*/
- udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
+ if (new_block_bytes || prealloc_len)
+ udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
}
/* Managed to do everything necessary? */
--
2.30.1
The MIPS FPU may have 2 mode:
FR=0: MIPS I style, odd-FPR can only be single,
and even-FPR can be double.
FR=1: all 32 FPR can be double.
The binary may have 3 mode:
FP32: can only work with FR=0 mode
FPXX: can work with both FR=0 and FR=1 mode.
FP64: can only work with FR=1 mode
Some binary, for example the output of golang, may be mark as FPXX,
while in fact they are FP32.
Currently, FR=1 mode is used for all FPXX binary, it makes some wrong
behivour of the binaries. Since FPXX binary can work with both FR=1 and FR=0,
we force it to use FR=0.
Reference:
https://web.archive.org/web/20180828210612/https://dmz-portal.mips.com/wiki…https://go-review.googlesource.com/c/go/+/239217https://go-review.googlesource.com/c/go/+/237058
Signed-off-by: YunQiang Su <yunqiang.su(a)cipunited.com>
Cc: stable(a)vger.kernel.org # 4.19+
v5->v6:
Rollback to V3, aka remove config option.
v4->v5:
Fix CONFIG_MIPS_O32_FPXX_USE_FR0 usage: if -> ifdef
v3->v4:
introduce a config option: CONFIG_MIPS_O32_FPXX_USE_FR0
v2->v3:
commit message: add Signed-off-by and Cc to stable.
v1->v2:
Fix bad commit message: in fact, we are switching to FR=0
---
arch/mips/kernel/elf.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
index 7b045d2a0b51..d1aa907e9864 100644
--- a/arch/mips/kernel/elf.c
+++ b/arch/mips/kernel/elf.c
@@ -234,9 +234,10 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr,
* fpxx case. This is because, in any-ABI (or no-ABI) we have no FPU
* instructions so we don't care about the mode. We will simply use
* the one preferred by the hardware. In fpxx case, that ABI can
- * handle both FR=1 and FR=0, so, again, we simply choose the one
- * preferred by the hardware. Next, if we only use single-precision
- * FPU instructions, and the default ABI FPU mode is not good
+ * handle both FR=1 and FR=0. Here, we may need to use FR=0, because
+ * some binaries may be mark as FPXX by mistake (ie, output of golang).
+ * - If we only use single-precision FPU instructions,
+ * and the default ABI FPU mode is not good
* (ie single + any ABI combination), we set again the FPU mode to the
* one is preferred by the hardware. Next, if we know that the code
* will only use single-precision instructions, shown by single being
@@ -248,8 +249,9 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr,
*/
if (prog_req.fre && !prog_req.frdefault && !prog_req.fr1)
state->overall_fp_mode = FP_FRE;
- else if ((prog_req.fr1 && prog_req.frdefault) ||
- (prog_req.single && !prog_req.frdefault))
+ else if (prog_req.fr1 && prog_req.frdefault)
+ state->overall_fp_mode = FP_FR0;
+ else if (prog_req.single && !prog_req.frdefault)
/* Make sure 64-bit MIPS III/IV/64R1 will not pick FR1 */
state->overall_fp_mode = ((raw_current_cpu_data.fpu_id & MIPS_FPIR_F64) &&
cpu_has_mips_r2_r6) ?
--
2.20.1
The patch titled
Subject: linux/compiler-clang.h: define HAVE_BUILTIN_BSWAP*
has been removed from the -mm tree. Its filename was
linux-compiler-clangh-define-have_builtin_bswap.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Arnd Bergmann <arnd(a)arndb.de>
Subject: linux/compiler-clang.h: define HAVE_BUILTIN_BSWAP*
Separating compiler-clang.h from compiler-gcc.h inadventently dropped the
definitions of the three HAVE_BUILTIN_BSWAP macros, which requires falling
back to the open-coded version and hoping that the compiler detects it.
Since all versions of clang support the __builtin_bswap interfaces, add
back the flags and have the headers pick these up automatically.
This results in a 4% improvement of compilation speed for arm defconfig.
Link: https://lkml.kernel.org/r/20210225164513.3667778-1-arnd@kernel.org
Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Cc: Masahiro Yamada <masahiroy(a)kernel.org>
Cc: Nathan Chancellor <nathan(a)kernel.org>
Cc: Nick Desaulniers <ndesaulniers(a)google.com>
Cc: Miguel Ojeda <ojeda(a)kernel.org>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: Marco Elver <elver(a)google.com>
Cc: Sami Tolvanen <samitolvanen(a)google.com>
Cc: Arvind Sankar <nivedita(a)alum.mit.edu>
Cc: Randy Dunlap <rdunlap(a)infradead.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/compiler-clang.h | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/include/linux/compiler-clang.h~linux-compiler-clangh-define-have_builtin_bswap
+++ a/include/linux/compiler-clang.h
@@ -31,6 +31,16 @@
#define __no_sanitize_thread
#endif
+/*
+ * sparse (__CHECKER__) pretends to be gcc, but can't do constant
+ * folding in __builtin_bswap*() (yet), so don't set these for it.
+ */
+#if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP) && !defined(__CHECKER__)
+#define __HAVE_BUILTIN_BSWAP32__
+#define __HAVE_BUILTIN_BSWAP64__
+#define __HAVE_BUILTIN_BSWAP16__
+#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP && !__CHECKER__ */
+
#if __has_feature(undefined_behavior_sanitizer)
/* GCC does not have __SANITIZE_UNDEFINED__ */
#define __no_sanitize_undefined \
_
Patches currently in -mm which might be from arnd(a)arndb.de are
memblock-fix-section-mismatch-warning.patch
stop_machine-mark-helpers-__always_inline.patch
The patch titled
Subject: mm/highmem.c: fix zero_user_segments() with start > end
has been added to the -mm tree. Its filename is
fix-zero_user_segments-with-start-end.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/fix-zero_user_segments-with-start…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/fix-zero_user_segments-with-start…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp>
Subject: mm/highmem.c: fix zero_user_segments() with start > end
zero_user_segments() is used from __block_write_begin_int(), for example
like the following
zero_user_segments(page, 4096, 1024, 512, 918)
But new the zero_user_segments() implementation for for HIGHMEM +
TRANSPARENT_HUGEPAGE doesn't handle "start > end" case correctly, and hits
BUG_ON(). (we can fix __block_write_begin_int() instead though, it is the
old and multiple usage)
Also it calls kmap_atomic() unnecessarily while start == end == 0.
Link: https://lkml.kernel.org/r/87v9ab60r4.fsf@mail.parknet.co.jp
Fixes: 0060ef3b4e6d ("mm: support THPs in zero_user_segments")
Signed-off-by: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/highmem.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/mm/highmem.c~fix-zero_user_segments-with-start-end
+++ a/mm/highmem.c
@@ -368,20 +368,24 @@ void zero_user_segments(struct page *pag
BUG_ON(end1 > page_size(page) || end2 > page_size(page));
+ if (start1 >= end1)
+ start1 = end1 = 0;
+ if (start2 >= end2)
+ start2 = end2 = 0;
+
for (i = 0; i < compound_nr(page); i++) {
void *kaddr = NULL;
- if (start1 < PAGE_SIZE || start2 < PAGE_SIZE)
- kaddr = kmap_atomic(page + i);
-
if (start1 >= PAGE_SIZE) {
start1 -= PAGE_SIZE;
end1 -= PAGE_SIZE;
} else {
unsigned this_end = min_t(unsigned, end1, PAGE_SIZE);
- if (end1 > start1)
+ if (end1 > start1) {
+ kaddr = kmap_atomic(page + i);
memset(kaddr + start1, 0, this_end - start1);
+ }
end1 -= this_end;
start1 = 0;
}
@@ -392,8 +396,11 @@ void zero_user_segments(struct page *pag
} else {
unsigned this_end = min_t(unsigned, end2, PAGE_SIZE);
- if (end2 > start2)
+ if (end2 > start2) {
+ if (!kaddr)
+ kaddr = kmap_atomic(page + i);
memset(kaddr + start2, 0, this_end - start2);
+ }
end2 -= this_end;
start2 = 0;
}
_
Patches currently in -mm which might be from hirofumi(a)mail.parknet.co.jp are
fix-zero_user_segments-with-start-end.patch
The patch titled
Subject: squashfs: fix xattr id and id lookup sanity checks
has been added to the -mm tree. Its filename is
squashfs-fix-xattr-id-and-id-lookup-sanity-checks.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/squashfs-fix-xattr-id-and-id-look…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/squashfs-fix-xattr-id-and-id-look…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Phillip Lougher <phillip(a)squashfs.org.uk>
Subject: squashfs: fix xattr id and id lookup sanity checks
The checks for maximum metadata block size is missing
SQUASHFS_BLOCK_OFFSET (the two byte length count).
Link: https://lkml.kernel.org/r/2069685113.2081245.1614583677427@webmail.123-reg.…
Fixes: f37aa4c7366e23f ("squashfs: add more sanity checks in id lookup")
Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/squashfs/id.c | 6 ++++--
fs/squashfs/xattr_id.c | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
--- a/fs/squashfs/id.c~squashfs-fix-xattr-id-and-id-lookup-sanity-checks
+++ a/fs/squashfs/id.c
@@ -97,14 +97,16 @@ __le64 *squashfs_read_id_index_table(str
start = le64_to_cpu(table[n]);
end = le64_to_cpu(table[n + 1]);
- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+ if (start >= end || (end - start) >
+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
kfree(table);
return ERR_PTR(-EINVAL);
}
}
start = le64_to_cpu(table[indexes - 1]);
- if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
+ if (start >= id_table_start || (id_table_start - start) >
+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
kfree(table);
return ERR_PTR(-EINVAL);
}
--- a/fs/squashfs/xattr_id.c~squashfs-fix-xattr-id-and-id-lookup-sanity-checks
+++ a/fs/squashfs/xattr_id.c
@@ -109,14 +109,16 @@ __le64 *squashfs_read_xattr_id_table(str
start = le64_to_cpu(table[n]);
end = le64_to_cpu(table[n + 1]);
- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+ if (start >= end || (end - start) >
+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
kfree(table);
return ERR_PTR(-EINVAL);
}
}
start = le64_to_cpu(table[indexes - 1]);
- if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
+ if (start >= table_start || (table_start - start) >
+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
kfree(table);
return ERR_PTR(-EINVAL);
}
_
Patches currently in -mm which might be from phillip(a)squashfs.org.uk are
squashfs-fix-xattr-id-and-id-lookup-sanity-checks.patch
The patch titled
Subject: hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings
has been added to the -mm tree. Its filename is
hugetlb_cgroup-fix-imbalanced-css_get-and-css_put-pair-for-shared-mappings.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/hugetlb_cgroup-fix-imbalanced-css…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/hugetlb_cgroup-fix-imbalanced-css…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Miaohe Lin <linmiaohe(a)huawei.com>
Subject: hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings
The current implementation of hugetlb_cgroup for shared mappings could have
different behavior. Consider the following two scenarios:
1.Assume initial css reference count of hugetlb_cgroup is 1:
1.1 Call hugetlb_reserve_pages with from = 1, to = 2. So css reference
count is 2 associated with 1 file_region.
1.2 Call hugetlb_reserve_pages with from = 2, to = 3. So css reference
count is 3 associated with 2 file_region.
1.3 coalesce_file_region will coalesce these two file_regions into one.
So css reference count is 3 associated with 1 file_region now.
2.Assume initial css reference count of hugetlb_cgroup is 1 again:
2.1 Call hugetlb_reserve_pages with from = 1, to = 3. So css reference
count is 2 associated with 1 file_region.
Therefore, we might have one file_region while holding one or more css
reference counts. This inconsistency could lead to imbalanced css_get()
and css_put() pair. If we do css_put one by one (i.g. hole punch case),
scenario 2 would put one more css reference. If we do css_put all together
(i.g. truncate case), scenario 1 will leak one css reference.
The imbalanced css_get() and css_put() pair would result in a non-zero
reference when we try to destroy the hugetlb cgroup. The hugetlb cgroup
directory is removed __but__ associated resource is not freed. This might
result in OOM or can not create a new hugetlb cgroup in a busy workload
ultimately.
In order to fix this, we have to make sure that one file_region must hold
and only hold one css reference. So in coalesce_file_region case, we should
release one css reference before coalescence. Also only put css reference
when the entire file_region is removed.
The last thing to note is that the caller of region_add() will only hold
one reference to h_cg->css for the whole contiguous reservation region.
But this area might be scattered when there are already some file_regions
reside in it. As a result, many file_regions may share only one h_cg->css
reference. In order to ensure that one file_region must hold and only hold
one h_cg->css reference, we should do css_get() for each file_region and
release the reference held by caller when they are done.
Link: https://lkml.kernel.org/r/20210301120540.37076-1-linmiaohe@huawei.com
Fixes: 075a61d07a8e ("hugetlb_cgroup: add accounting for shared mappings")
Reported-by: kernel test robot <lkp(a)intel.com> (auto build test ERROR)
Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: Aneesh Kumar K.V <aneesh.kumar(a)linux.vnet.ibm.com>
Cc: Wanpeng Li <liwp.linux(a)gmail.com>
Cc: Mina Almasry <almasrymina(a)google.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/hugetlb_cgroup.h | 15 +++++++++--
mm/hugetlb.c | 42 ++++++++++++++++++++++++++++---
mm/hugetlb_cgroup.c | 11 ++++++--
3 files changed, 60 insertions(+), 8 deletions(-)
--- a/include/linux/hugetlb_cgroup.h~hugetlb_cgroup-fix-imbalanced-css_get-and-css_put-pair-for-shared-mappings
+++ a/include/linux/hugetlb_cgroup.h
@@ -113,6 +113,11 @@ static inline bool hugetlb_cgroup_disabl
return !cgroup_subsys_enabled(hugetlb_cgrp_subsys);
}
+static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg)
+{
+ css_put(&h_cg->css);
+}
+
extern int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
struct hugetlb_cgroup **ptr);
extern int hugetlb_cgroup_charge_cgroup_rsvd(int idx, unsigned long nr_pages,
@@ -138,7 +143,8 @@ extern void hugetlb_cgroup_uncharge_coun
extern void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
struct file_region *rg,
- unsigned long nr_pages);
+ unsigned long nr_pages,
+ bool region_del);
extern void hugetlb_cgroup_file_init(void) __init;
extern void hugetlb_cgroup_migrate(struct page *oldhpage,
@@ -147,7 +153,8 @@ extern void hugetlb_cgroup_migrate(struc
#else
static inline void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
struct file_region *rg,
- unsigned long nr_pages)
+ unsigned long nr_pages,
+ bool region_del)
{
}
@@ -185,6 +192,10 @@ static inline bool hugetlb_cgroup_disabl
return true;
}
+static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg)
+{
+}
+
static inline int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
struct hugetlb_cgroup **ptr)
{
--- a/mm/hugetlb.c~hugetlb_cgroup-fix-imbalanced-css_get-and-css_put-pair-for-shared-mappings
+++ a/mm/hugetlb.c
@@ -280,6 +280,18 @@ static void record_hugetlb_cgroup_unchar
nrg->reservation_counter =
&h_cg->rsvd_hugepage[hstate_index(h)];
nrg->css = &h_cg->css;
+ /*
+ * The caller (hugetlb_reserve_pages now) will only hold one
+ * h_cg->css reference for the whole contiguous reservation
+ * region. But this area might be scattered when there are
+ * already some file_regions reside in it. As a result, many
+ * file_regions may share only one h_cg->css reference. In
+ * order to ensure that one file_region must hold and only
+ * hold one h_cg->css reference, we should do css_get for
+ * each file_region and leave the reference held by caller
+ * untouched.
+ */
+ css_get(&h_cg->css);
if (!resv->pages_per_hpage)
resv->pages_per_hpage = pages_per_huge_page(h);
/* pages_per_hpage should be the same for all entries in
@@ -293,6 +305,14 @@ static void record_hugetlb_cgroup_unchar
#endif
}
+static void put_uncharge_info(struct file_region *rg)
+{
+#ifdef CONFIG_CGROUP_HUGETLB
+ if (rg->css)
+ css_put(rg->css);
+#endif
+}
+
static bool has_same_uncharge_info(struct file_region *rg,
struct file_region *org)
{
@@ -316,6 +336,7 @@ static void coalesce_file_region(struct
prg->to = rg->to;
list_del(&rg->link);
+ put_uncharge_info(rg);
kfree(rg);
rg = prg;
@@ -327,6 +348,7 @@ static void coalesce_file_region(struct
nrg->from = rg->from;
list_del(&rg->link);
+ put_uncharge_info(rg);
kfree(rg);
}
}
@@ -659,7 +681,7 @@ retry:
del += t - f;
hugetlb_cgroup_uncharge_file_region(
- resv, rg, t - f);
+ resv, rg, t - f, false);
/* New entry for end of split region */
nrg->from = t;
@@ -680,7 +702,7 @@ retry:
if (f <= rg->from && t >= rg->to) { /* Remove entire region */
del += rg->to - rg->from;
hugetlb_cgroup_uncharge_file_region(resv, rg,
- rg->to - rg->from);
+ rg->to - rg->from, true);
list_del(&rg->link);
kfree(rg);
continue;
@@ -688,13 +710,13 @@ retry:
if (f <= rg->from) { /* Trim beginning of region */
hugetlb_cgroup_uncharge_file_region(resv, rg,
- t - rg->from);
+ t - rg->from, false);
del += t - rg->from;
rg->from = t;
} else { /* Trim end of region */
hugetlb_cgroup_uncharge_file_region(resv, rg,
- rg->to - f);
+ rg->to - f, false);
del += rg->to - f;
rg->to = f;
@@ -5128,6 +5150,10 @@ bool hugetlb_reserve_pages(struct inode
*/
long rsv_adjust;
+ /*
+ * hugetlb_cgroup_uncharge_cgroup_rsvd() will put the
+ * reference to h_cg->css. See comment below for detail.
+ */
hugetlb_cgroup_uncharge_cgroup_rsvd(
hstate_index(h),
(chg - add) * pages_per_huge_page(h), h_cg);
@@ -5135,6 +5161,14 @@ bool hugetlb_reserve_pages(struct inode
rsv_adjust = hugepage_subpool_put_pages(spool,
chg - add);
hugetlb_acct_memory(h, -rsv_adjust);
+ } else if (h_cg) {
+ /*
+ * The file_regions will hold their own reference to
+ * h_cg->css. So we should release the reference held
+ * via hugetlb_cgroup_charge_cgroup_rsvd() when we are
+ * done.
+ */
+ hugetlb_cgroup_put_rsvd_cgroup(h_cg);
}
}
return true;
--- a/mm/hugetlb_cgroup.c~hugetlb_cgroup-fix-imbalanced-css_get-and-css_put-pair-for-shared-mappings
+++ a/mm/hugetlb_cgroup.c
@@ -391,7 +391,8 @@ void hugetlb_cgroup_uncharge_counter(str
void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
struct file_region *rg,
- unsigned long nr_pages)
+ unsigned long nr_pages,
+ bool region_del)
{
if (hugetlb_cgroup_disabled() || !resv || !rg || !nr_pages)
return;
@@ -400,7 +401,13 @@ void hugetlb_cgroup_uncharge_file_region
!resv->reservation_counter) {
page_counter_uncharge(rg->reservation_counter,
nr_pages * resv->pages_per_hpage);
- css_put(rg->css);
+ /*
+ * Only do css_put(rg->css) when we delete the entire region
+ * because one file_region must hold and only hold one rg->css
+ * reference.
+ */
+ if (region_del)
+ css_put(rg->css);
}
}
_
Patches currently in -mm which might be from linmiaohe(a)huawei.com are
hugetlb_cgroup-fix-imbalanced-css_get-and-css_put-pair-for-shared-mappings.patch
From: Lech Perczak<lech.perczak(a)gmail.com>
commit 88eee9b7b42e69fb622ddb3ff6f37e8e4347f5b2 upstream.
As commit 6420a569504e212d618d4a4736e2c59ed80a8478:
("USB: serial: option: update interface mapping for ZTE P685M") [1]
was selected for stable, I think its netdev counterpart could also be considered for completeness,
if 6420a569504e is merged.
This patch only adds a new device ID, and would probably make OpenWrt folks happy to drop two backports.
I noticed that 6420a569504e was selected for all currently maintained stable branches, but I think that only
5.4.y and newer would suffice, as 5.4.y is currently used as stable kernel where those two patches are required.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d…
--
With kind regards,
Lech
Commit 7db21530479f ("KVM: arm64: Restore hyp when panicking in guest
context") tracks the currently running vCPU, clearing the pointer to
NULL on exit from a guest.
Unfortunately, the use of 'set_loaded_vcpu' clobbers x1 to point at the
kvm_hyp_ctxt instead of the vCPU context, causing the subsequent RAS
code to go off into the weeds when it saves the DISR assuming that the
CPU context is embedded in a struct vCPU.
Leave x1 alone and use x3 as a temporary register instead when clearing
the vCPU on the guest exit path.
Cc: Marc Zyngier <maz(a)kernel.org>
Cc: Andrew Scull <ascull(a)google.com>
Cc: <stable(a)vger.kernel.org>
Fixes: 7db21530479f ("KVM: arm64: Restore hyp when panicking in guest context")
Suggested-by: Quentin Perret <qperret(a)google.com>
Signed-off-by: Will Deacon <will(a)kernel.org>
---
This was pretty awful to debug!
arch/arm64/kvm/hyp/entry.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S
index b0afad7a99c6..0c66a1d408fd 100644
--- a/arch/arm64/kvm/hyp/entry.S
+++ b/arch/arm64/kvm/hyp/entry.S
@@ -146,7 +146,7 @@ SYM_INNER_LABEL(__guest_exit, SYM_L_GLOBAL)
// Now restore the hyp regs
restore_callee_saved_regs x2
- set_loaded_vcpu xzr, x1, x2
+ set_loaded_vcpu xzr, x2, x3
alternative_if ARM64_HAS_RAS_EXTN
// If we have the RAS extensions we can consume a pending error
--
2.30.1.766.gb4fecdf3b7-goog
The nVHE KVM hyp drains and disables the SPE buffer, before
entering the guest, as the EL1&0 translation regime
is going to be loaded with that of the guest.
But this operation is performed way too late, because :
- The owning translation regime of the SPE buffer
is transferred to EL2. (MDCR_EL2_E2PB == 0)
- The guest Stage1 is loaded.
Thus the flush could use the host EL1 virtual address,
but use the EL2 translations instead of host EL1, for writing
out any cached data.
Fix this by moving the SPE buffer handling early enough.
The restore path is doing the right thing.
Fixes: 014c4c77aad7 ("KVM: arm64: Improve debug register save/restore flow")
Cc: stable(a)vger.kernel.org
Cc: Christoffer Dall <christoffer.dall(a)arm.com>
Cc: Marc Zyngier <maz(a)kernel.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Alexandru Elisei <alexandru.elisei(a)arm.com>
Reviewed-by: Alexandru Elisei <alexandru.elisei(a)arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com>
---
arch/arm64/include/asm/kvm_hyp.h | 5 +++++
arch/arm64/kvm/hyp/nvhe/debug-sr.c | 12 ++++++++++--
arch/arm64/kvm/hyp/nvhe/switch.c | 11 ++++++++++-
3 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index c0450828378b..385bd7dd3d39 100644
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -83,6 +83,11 @@ void sysreg_restore_guest_state_vhe(struct kvm_cpu_context *ctxt);
void __debug_switch_to_guest(struct kvm_vcpu *vcpu);
void __debug_switch_to_host(struct kvm_vcpu *vcpu);
+#ifdef __KVM_NVHE_HYPERVISOR__
+void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu);
+void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu);
+#endif
+
void __fpsimd_save_state(struct user_fpsimd_state *fp_regs);
void __fpsimd_restore_state(struct user_fpsimd_state *fp_regs);
diff --git a/arch/arm64/kvm/hyp/nvhe/debug-sr.c b/arch/arm64/kvm/hyp/nvhe/debug-sr.c
index 91a711aa8382..f401724f12ef 100644
--- a/arch/arm64/kvm/hyp/nvhe/debug-sr.c
+++ b/arch/arm64/kvm/hyp/nvhe/debug-sr.c
@@ -58,16 +58,24 @@ static void __debug_restore_spe(u64 pmscr_el1)
write_sysreg_s(pmscr_el1, SYS_PMSCR_EL1);
}
-void __debug_switch_to_guest(struct kvm_vcpu *vcpu)
+void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu)
{
/* Disable and flush SPE data generation */
__debug_save_spe(&vcpu->arch.host_debug_state.pmscr_el1);
+}
+
+void __debug_switch_to_guest(struct kvm_vcpu *vcpu)
+{
__debug_switch_to_guest_common(vcpu);
}
-void __debug_switch_to_host(struct kvm_vcpu *vcpu)
+void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu)
{
__debug_restore_spe(vcpu->arch.host_debug_state.pmscr_el1);
+}
+
+void __debug_switch_to_host(struct kvm_vcpu *vcpu)
+{
__debug_switch_to_host_common(vcpu);
}
diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c
index f3d0e9eca56c..59aa1045fdaf 100644
--- a/arch/arm64/kvm/hyp/nvhe/switch.c
+++ b/arch/arm64/kvm/hyp/nvhe/switch.c
@@ -192,6 +192,14 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
pmu_switch_needed = __pmu_switch_to_guest(host_ctxt);
__sysreg_save_state_nvhe(host_ctxt);
+ /*
+ * We must flush and disable the SPE buffer for nVHE, as
+ * the translation regime(EL1&0) is going to be loaded with
+ * that of the guest. And we must do this before we change the
+ * translation regime to EL2 (via MDCR_EL2_E2PB == 0) and
+ * before we load guest Stage1.
+ */
+ __debug_save_host_buffers_nvhe(vcpu);
__adjust_pc(vcpu);
@@ -234,11 +242,12 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
if (vcpu->arch.flags & KVM_ARM64_FP_ENABLED)
__fpsimd_save_fpexc32(vcpu);
+ __debug_switch_to_host(vcpu);
/*
* This must come after restoring the host sysregs, since a non-VHE
* system may enable SPE here and make use of the TTBRs.
*/
- __debug_switch_to_host(vcpu);
+ __debug_restore_host_buffers_nvhe(vcpu);
if (pmu_switch_needed)
__pmu_switch_to_host(host_ctxt);
--
2.24.1
ALSA: hda/realtek: Add quirk for Intel NUC 10
This adds a new SND_PCI_QUIRK(...) and applies it to the Intel NUC 10
devices. This fixes the issue of the devices not having audio input and
output on the headset jack because the kernel does not recognize when
something is plugged in.
The new quirk was inspired by the quirk for the Intel NUC 8 devices, but
it turned out that the NUC 10 uses another pin. This information was
acquired by black box testing likely pins.
Co-developed-by: Eckhart Mohr <e.mohr(a)tuxedocomputers.com>
Signed-off-by: Eckhart Mohr <e.mohr(a)tuxedocomputers.com>
Signed-off-by: Werner Sembach <wse(a)tuxedocomputers.com>
Cc: <stable(a)vger.kernel.org>
---
Forgot to add the "From"-line
>From d281364b8ca6c054a0e5ce20caa599bf7d08160d Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse(a)tuxedocomputers.com>
Date: Fri, 26 Feb 2021 13:54:30 +0100
Subject: [PATCH] Fix Intel NUC10 no output and input on headset jack
---
sound/pci/hda/patch_realtek.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 290645516313..c14d624dbaf1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6362,6 +6362,7 @@ enum {
ALC269_FIXUP_LEMOTE_A1802,
ALC269_FIXUP_LEMOTE_A190X,
ALC256_FIXUP_INTEL_NUC8_RUGGED,
+ ALC256_FIXUP_INTEL_NUC10,
ALC255_FIXUP_XIAOMI_HEADSET_MIC,
ALC274_FIXUP_HP_MIC,
ALC274_FIXUP_HP_HEADSET_MIC,
@@ -7744,6 +7745,15 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC269_FIXUP_HEADSET_MODE
},
+ [ALC256_FIXUP_INTEL_NUC10] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE
+ },
[ALC255_FIXUP_XIAOMI_HEADSET_MIC] = {
.type = HDA_FIXUP_VERBS,
.v.verbs = (const struct hda_verb[]) {
@@ -8183,6 +8193,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED),
+ SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
#if 0
/* Below is a quirk table taken from the old code.
--
2.25.1
This is a note to let you know that I've just added the patch titled
Revert "serial: max310x: rework RX interrupt handling"
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 511a9d5dc2d4d541704d25faf7f6fc2a71a2fd9d Mon Sep 17 00:00:00 2001
From: Alexander Shiyan <shc_work(a)mail.ru>
Date: Wed, 17 Feb 2021 11:06:08 +0300
Subject: Revert "serial: max310x: rework RX interrupt handling"
This reverts commit fce3c5c1a2d9cd888f2987662ce17c0c651916b2.
FIFO is triggered 4 intervals after receiving a byte, it's good
when we don't care about the time of reception, but are only
interested in the presence of any activity on the line.
Unfortunately, this method is not suitable for all tasks,
for example, the RS-485 protocol will not work properly,
since the state machine must track the request-response time
and after the timeout expires, a decision is made that the device
on the line is not responding.
Signed-off-by: Alexander Shiyan <shc_work(a)mail.ru>
Link: https://lore.kernel.org/r/20210217080608.31192-1-shc_work@mail.ru
Fixes: fce3c5c1a2d9 ("serial: max310x: rework RX interrupt handling")
Cc: Thomas Petazzoni <thomas.petazzoni(a)bootlin.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/max310x.c | 29 +++++------------------------
1 file changed, 5 insertions(+), 24 deletions(-)
diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index 9795b2e8b0b2..1b61d26bb7af 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -1056,9 +1056,9 @@ static int max310x_startup(struct uart_port *port)
max310x_port_update(port, MAX310X_MODE1_REG,
MAX310X_MODE1_TRNSCVCTRL_BIT, 0);
- /* Reset FIFOs */
- max310x_port_write(port, MAX310X_MODE2_REG,
- MAX310X_MODE2_FIFORST_BIT);
+ /* Configure MODE2 register & Reset FIFOs*/
+ val = MAX310X_MODE2_RXEMPTINV_BIT | MAX310X_MODE2_FIFORST_BIT;
+ max310x_port_write(port, MAX310X_MODE2_REG, val);
max310x_port_update(port, MAX310X_MODE2_REG,
MAX310X_MODE2_FIFORST_BIT, 0);
@@ -1086,27 +1086,8 @@ static int max310x_startup(struct uart_port *port)
/* Clear IRQ status register */
max310x_port_read(port, MAX310X_IRQSTS_REG);
- /*
- * Let's ask for an interrupt after a timeout equivalent to
- * the receiving time of 4 characters after the last character
- * has been received.
- */
- max310x_port_write(port, MAX310X_RXTO_REG, 4);
-
- /*
- * Make sure we also get RX interrupts when the RX FIFO is
- * filling up quickly, so get an interrupt when half of the RX
- * FIFO has been filled in.
- */
- max310x_port_write(port, MAX310X_FIFOTRIGLVL_REG,
- MAX310X_FIFOTRIGLVL_RX(MAX310X_FIFO_SIZE / 2));
-
- /* Enable RX timeout interrupt in LSR */
- max310x_port_write(port, MAX310X_LSR_IRQEN_REG,
- MAX310X_LSR_RXTO_BIT);
-
- /* Enable LSR, RX FIFO trigger, CTS change interrupts */
- val = MAX310X_IRQ_LSR_BIT | MAX310X_IRQ_RXFIFO_BIT | MAX310X_IRQ_TXEMPTY_BIT;
+ /* Enable RX, TX, CTS change interrupts */
+ val = MAX310X_IRQ_RXEMPTY_BIT | MAX310X_IRQ_TXEMPTY_BIT;
max310x_port_write(port, MAX310X_IRQEN_REG, val | MAX310X_IRQ_CTS_BIT);
return 0;
--
2.30.1
From: Eckhart Mohr <e.mohr(a)tuxedocomputers.com>
ALSA: hda/realtek: Add quirk for Clevo NH55RZQ
This applies a SND_PCI_QUIRK(...) to the Clevo NH55RZQ barebone. This
fixes the issue of the device not recognizing a pluged in microphone.
The device has both, a microphone only jack, and a speaker + microphone
combo jack. The combo jack already works. The microphone-only jack does
not recognize when a device is pluged in without this patch.
Signed-off-by: Eckhart Mohr <e.mohr(a)tuxedocomputers.com>
Co-developed-by: Werner Sembach <wse(a)tuxedocomputers.com>
Signed-off-by: Werner Sembach <wse(a)tuxedocomputers.com>
Cc: <stable(a)vger.kernel.org>
---
Third time's the charm, now using git send-email, I'm really sorry for the spam.
>From 2835edd753fd19c72a644dccb7e941cfc0ecdf8e Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse(a)tuxedocomputers.com>
Date: Fri, 26 Feb 2021 13:50:15 +0100
Subject: [PATCH] Fix device detection on microphone jack of Clevo NH55RZQ
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 290645516313..8014e80d72c3 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8089,6 +8089,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1558, 0x8551, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x1558, 0x8561, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x8562, "Clevo NH[5|7][0-9]RZ[Q]", ALC269_FIXUP_DMIC),
SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
--
2.25.1
This is the start of the stable review cycle for the 4.9.259 release.
There are 135 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 04 Mar 2021 12:22:00 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.259-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.259-rc2
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Update in-core bitset after committing the metadata
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
Leon Romanovsky <leonro(a)nvidia.com>
ipv6: silence compilation warning for non-IPV6 builds
Eric Dumazet <edumazet(a)google.com>
ipv6: icmp6: avoid indirect call for icmpv6_send()
Jason A. Donenfeld <Jason(a)zx2c4.com>
sunvnet: use icmp_ndo_send helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
gtp: use icmp_ndo_send helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n
Jason A. Donenfeld <Jason(a)zx2c4.com>
icmp: introduce helper for nat'd source address in network device context
Thomas Gleixner <tglx(a)linutronix.de>
futex: fix dead code in attach_to_pi_owner()
Peter Zijlstra <peterz(a)infradead.org>
futex: Fix OWNER_DEAD fixup
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: only resize metadata in preresume
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Reinitialize bitset cache before digesting a new writeset
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Use correct value size in equality function of writeset tree
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Fix bitset memory leaks
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Verify the data block size hasn't changed
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Recover committed writeset after crash
Bob Peterson <rpeterso(a)redhat.com>
gfs2: Don't skip dlm unlock if glock has an lvb
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a user-triggerable oops in clear_user()
Chao Yu <yuchao0(a)huawei.com>
f2fs: fix out-of-repair __setattr_copy()
Maxim Kiselev <bigunclemax(a)gmail.com>
gpio: pcf857x: Fix missing first interrupt
Frank Li <Frank.Li(a)nxp.com>
mmc: sdhci-esdhc-imx: fix kernel panic when remove module
Fangrui Song <maskray(a)google.com>
module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
Dan Williams <dan.j.williams(a)intel.com>
libnvdimm/dimm: Avoid race between probe and available_slots_show()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop()
Muchun Song <songmuchun(a)bytedance.com>
mm: hugetlb: fix a race between freeing and dissolving the page
Pan Bian <bianpan2016(a)163.com>
mtd: spi-nor: hisi-sfc: Put child node np on error path
Jiri Kosina <jkosina(a)suse.cz>
floppy: reintroduce O_NDELAY fix
Sean Christopherson <seanjc(a)google.com>
x86/reboot: Force all cpus to exit VMX root if VMX is supported
Martin Kaiser <martin(a)kaiser.cx>
staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
Sabyrzhan Tasbolatov <snovitoll(a)gmail.com>
drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
Paul Cercueil <paul(a)crapouillou.net>
seccomp: Add missing return in non-void function
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix extent buffer leak on failure to copy root
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix reloc root leak with 0 ref reloc roots on recovery
Josef Bacik <josef(a)toxicpanda.com>
btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root
Jarkko Sakkinen <jarkko(a)kernel.org>
KEYS: trusted: Fix migratable=1 failing
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7720: fix error code in mos7720_write()
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7840: fix error code in mos7840_write()
Paul Cercueil <paul(a)crapouillou.net>
usb: musb: Fix runtime PM race in musb_queue_resume_work
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: update interface mapping for ZTE P685M
Marcos Paulo de Souza <mpdesouza(a)suse.com>
Input: i8042 - add ASUS Zenbook Flip to noselftest list
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: joydev - prevent potential read overflow in ioctl
Olivier Crête <olivier.crete(a)ocrete.ca>
Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S
jeffrey.lin <jeffrey.lin(a)rad-ic.com>
Input: raydium_ts_i2c - do not send zero length
Qinglang Miao <miaoqinglang(a)huawei.com>
ACPI: configfs: add missing check after configfs_register_default_group()
Mikulas Patocka <mpatocka(a)redhat.com>
blk-settings: align max_sectors on "logical_block_size" boundary
Randy Dunlap <rdunlap(a)infradead.org>
scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
Maxime Ripard <maxime(a)cerno.tech>
i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
Marc Zyngier <maz(a)kernel.org>
arm64: Add missing ISB after invalidating TLB in __primary_switch
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential double free in hugetlb_register_node() error path
Miaohe Lin <linmiaohe(a)huawei.com>
mm/memory.c: fix potential pte_unmap_unlock pte error
Dan Carpenter <dan.carpenter(a)oracle.com>
ocfs2: fix a use after free on error
Chuhong Yuan <hslester96(a)gmail.com>
net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
Jann Horn <jannh(a)google.com>
Take mmap lock in cacheflush syscall
Slawomir Laba <slawomirx.laba(a)intel.com>
i40e: Fix flow for IPv6 next header (extension header)
Konrad Dybcio <konrad.dybcio(a)somainline.org>
drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
Heiner Kallweit <hkallweit1(a)gmail.com>
PCI: Align checking of syscall user config accessors
Jorgen Hansen <jhansen(a)vmware.com>
VMCI: Use set_page_dirty_lock() when unregistering guest memory
Simon South <simon(a)simonsouth.net>
pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare()
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Fix module alias to enable module autoprobe
Randy Dunlap <rdunlap(a)infradead.org>
sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: elo - fix an error code in elo_connect()
Namhyung Kim <namhyung(a)kernel.org>
perf test: Fix unaligned access in sample parsing test
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix missing CYC processing in PSB
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
spi: pxa2xx: Fix the controller numbering for Wildcat Point
Nathan Lynch <nathanl(a)linux.ibm.com>
powerpc/pseries/dlpar: handle ibm, configure-connector delay status
Dan Carpenter <dan.carpenter(a)oracle.com>
mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
Bob Pearson <rpearsonhpe(a)gmail.com>
RDMA/rxe: Fix coding error in rxe_recv.c
Arnaldo Carvalho de Melo <acme(a)redhat.com>
perf tools: Fix DSO filtering when not finding a map for a sampled address
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracepoint: Do not fail unregistering a probe due to memory failure
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
amba: Fix resource leak for drivers without .remove
Vladimir Murzin <vladimir.murzin(a)arm.com>
ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/47x: Disable 256k page size
Shay Drory <shayd(a)nvidia.com>
IB/umad: Return EIO in case of when device disassociated
Pan Bian <bianpan2016(a)163.com>
isofs: release buffer head before return
Pan Bian <bianpan2016(a)163.com>
regulator: axp20x: Fix reference cout leak
Tom Rix <trix(a)redhat.com>
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
Claudiu Beznea <claudiu.beznea(a)microchip.com>
power: reset: at91-sama5d2_shdwc: fix wkupdbc mask
Nicolas Boichat <drinkcat(a)chromium.org>
of/fdt: Make sure no-map does not remove already reserved regions
KarimAllah Ahmed <karahmed(a)amazon.de>
fdt: Properly handle "no-map" field in the memory region
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in the remove function
Randy Dunlap <rdunlap(a)infradead.org>
HID: core: detect and skip invalid inputs to snto32()
Pratyush Yadav <p.yadav(a)ti.com>
spi: cadence-quadspi: Abort read if dummy cycles required are too many
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL
Tom Rix <trix(a)redhat.com>
jffs2: fix use after free in jffs2_sum_write_data()
Colin Ian King <colin.king(a)canonical.com>
fs/jfs: fix potential integer overflow on shift of a int
Daniele Alessandrelli <daniele.alessandrelli(a)intel.com>
crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
Zhihao Cheng <chengzhihao1(a)huawei.com>
btrfs: clarify error returns values in __load_free_space_cache
Florian Fainelli <f.fainelli(a)gmail.com>
ata: ahci_brcm: Add back regulators management
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
Tom Rix <trix(a)redhat.com>
media: pxa_camera: declare variable when DEBUG is defined
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
media: cx25821: Fix a bug when reallocating some dma memory
Luo Meng <luomeng12(a)huawei.com>
media: qm1d1c0042: fix error return code in qm1d1c0042_init()
Joe Perches <joe(a)perches.com>
media: lmedm04: Fix misuse of comma
Dan Carpenter <dan.carpenter(a)oracle.com>
ASoC: cs42l56: fix up error handling in probe
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: tm6000: Fix memleak in tm6000_start_stream
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: media/pci: Fix memleak in empress_init
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
media: vsp1: Fix an error handling path in the probe function
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
Dan Carpenter <dan.carpenter(a)oracle.com>
gma500: clean up error handling in init
Jialin Zhang <zhangjialin11(a)huawei.com>
drm/gma500: Fix error return code in psb_driver_load()
Randy Dunlap <rdunlap(a)infradead.org>
fbdev: aty: SPARC64 requires FB_ATY_CT
Colin Ian King <colin.king(a)canonical.com>
b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
Colin Ian King <colin.king(a)canonical.com>
mac80211: fix potential overflow when multiplying to u32 integers
Juergen Gross <jgross(a)suse.com>
xen/netback: fix spurious event detection for common event case
Edwin Peer <edwin.peer(a)broadcom.com>
bnxt_en: reverse order of TX disable and carrier off
Arnd Bergmann <arnd(a)arndb.de>
ARM: s3c: fix fiq for clang IAS
Vincent Knecht <vincent.knecht(a)mailoo.org>
arm64: dts: msm8916: Fix reserved and rfsa nodes unit address
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Make "trimming xfer length" a debug message
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Abort transaction after errors with unknown reason
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Do not update data length if it is 0 on inbound transfers
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Configure missing thermal interrupt for 4430
Pan Bian <bianpan2016(a)163.com>
Bluetooth: Put HCI device if inquiry procedure interrupts
Pan Bian <bianpan2016(a)163.com>
Bluetooth: drop HCI device reference before return
Krzysztof Kozlowski <krzk(a)kernel.org>
arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
Christopher William Snowhill <chris(a)kode54.net>
Bluetooth: Fix initializing response id after clearing struct
Vlastimil Babka <vbabka(a)suse.cz>
mm, thp: make do_huge_pmd_wp_page() lock page for testing mapcount
Eric Biggers <ebiggers(a)google.com>
random: fix the RNDRESEEDCRNG ioctl
Alexander Lobakin <alobakin(a)pm.me>
MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
Sumit Garg <sumit.garg(a)linaro.org>
kdb: Make memory allocations more robust
Rong Chen <rong.a.chen(a)intel.com>
scripts/recordmcount.pl: support big endian for ARCH sh
Shyam Prasad N <sprasad(a)microsoft.com>
cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath.
Christoph Schemmel <christoph.schemmel(a)gmail.com>
NET: usb: qmi_wwan: Adding support for Cinterion MV31
Sameer Pujar <spujar(a)nvidia.com>
arm64: tegra: Add power-domain for Tegra210 HDA
Corinna Vinschen <vinschen(a)redhat.com>
igb: Remove incorrect "unexpected SYS WRAP" log message
Rustam Kovhaev <rkovhaev(a)gmail.com>
ntfs: check for valid standard information attribute
Stefan Ursella <stefan.ursella(a)wolfvision.net>
usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable
Will McVicker <willmcvicker(a)google.com>
HID: make arrays usage and value to be the same
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/compressed/head.S | 4 +-
arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
arch/arm/boot/dts/omap443x.dtsi | 2 +
arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +-
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1 +
arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +-
arch/arm64/kernel/head.S | 1 +
arch/mips/kernel/vmlinux.lds.S | 1 +
arch/mips/lantiq/irq.c | 2 +-
arch/mips/mm/c-r4k.c | 2 +-
arch/nios2/kernel/sys_nios2.c | 11 ++-
arch/powerpc/Kconfig | 2 +-
arch/powerpc/platforms/pseries/dlpar.c | 7 +-
arch/sparc/Kconfig | 2 +-
arch/sparc/lib/memset.S | 1 +
arch/x86/kernel/reboot.c | 29 +++----
block/blk-settings.c | 12 +++
crypto/ecdh_helper.c | 3 +
drivers/acpi/acpi_configfs.c | 7 +-
drivers/amba/bus.c | 20 +++--
drivers/ata/ahci_brcm.c | 14 +++-
drivers/block/floppy.c | 27 ++++---
drivers/char/random.c | 2 +-
drivers/clk/meson/clk-pll.c | 2 +-
drivers/clocksource/mxs_timer.c | 5 +-
drivers/dma/fsldma.c | 6 ++
drivers/gpio/gpio-pcf857x.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 ++---
drivers/gpu/drm/gma500/psb_drv.c | 2 +
drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +-
drivers/hid/hid-core.c | 9 ++-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/infiniband/core/user_mad.c | 7 +-
drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++-
drivers/input/joydev.c | 7 +-
drivers/input/joystick/xpad.c | 1 +
drivers/input/serio/i8042-x86ia64io.h | 4 +
drivers/input/touchscreen/elo.c | 4 +-
drivers/input/touchscreen/raydium_i2c_ts.c | 3 +-
drivers/md/dm-era-target.c | 93 ++++++++++++++--------
drivers/media/pci/cx25821/cx25821-core.c | 4 +-
drivers/media/pci/saa7134/saa7134-empress.c | 5 +-
drivers/media/platform/pxa_camera.c | 3 +
drivers/media/platform/vsp1/vsp1_drv.c | 4 +-
drivers/media/tuners/qm1d1c0042.c | 4 +-
drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
drivers/media/usb/tm6000/tm6000-dvb.c | 4 +
drivers/media/usb/uvc/uvc_v4l2.c | 18 ++---
drivers/mfd/wm831x-auxadc.c | 3 +-
drivers/misc/eeprom/eeprom_93xx46.c | 1 +
drivers/misc/vmw_vmci/vmci_queue_pair.c | 5 +-
drivers/mmc/host/sdhci-esdhc-imx.c | 3 +-
drivers/mmc/host/usdhi6rol0.c | 4 +-
drivers/mtd/spi-nor/cadence-quadspi.c | 2 +-
drivers/mtd/spi-nor/hisi-sfc.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 ++-
drivers/net/ethernet/intel/igb/igb_main.c | 2 -
.../net/ethernet/mellanox/mlx4/resource_tracker.c | 1 +
drivers/net/ethernet/sun/sunvnet_common.c | 24 +-----
drivers/net/gtp.c | 5 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/wireless/broadcom/b43/phy_n.c | 2 +-
drivers/net/xen-netback/interface.c | 8 +-
drivers/nvdimm/dimm_devs.c | 18 ++++-
drivers/of/fdt.c | 12 ++-
drivers/pci/syscall.c | 10 +--
drivers/power/reset/at91-sama5d2_shdwc.c | 2 +-
drivers/pwm/pwm-rockchip.c | 1 -
drivers/regulator/axp20x-regulator.c | 7 +-
drivers/scsi/bnx2fc/Kconfig | 1 +
drivers/spi/spi-pxa2xx-pci.c | 27 +++++--
drivers/spi/spi-s3c24xx-fiq.S | 9 +--
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc2/hcd.c | 15 ++--
drivers/usb/dwc2/hcd_intr.c | 14 +++-
drivers/usb/dwc3/gadget.c | 19 ++++-
drivers/usb/musb/musb_core.c | 31 ++++----
drivers/usb/renesas_usbhs/fifo.c | 2 +
drivers/usb/serial/mos7720.c | 4 +-
drivers/usb/serial/mos7840.c | 4 +-
drivers/usb/serial/option.c | 3 +-
drivers/video/fbdev/Kconfig | 2 +-
fs/btrfs/ctree.c | 7 +-
fs/btrfs/free-space-cache.c | 6 +-
fs/btrfs/relocation.c | 4 +-
fs/cifs/connect.c | 1 +
fs/f2fs/file.c | 3 +-
fs/gfs2/lock_dlm.c | 8 +-
fs/isofs/dir.c | 1 +
fs/isofs/namei.c | 1 +
fs/jffs2/summary.c | 3 +
fs/jfs/jfs_dmap.c | 2 +-
fs/ntfs/inode.c | 6 ++
fs/ocfs2/cluster/heartbeat.c | 8 +-
include/linux/icmpv6.h | 48 ++++++++++-
include/linux/ipv6.h | 2 +-
include/net/icmp.h | 10 +++
kernel/debug/kdb/kdb_private.h | 2 +-
kernel/futex.c | 12 +--
kernel/module.c | 21 ++++-
kernel/seccomp.c | 2 +
kernel/tracepoint.c | 80 +++++++++++++++----
mm/huge_memory.c | 15 ++++
mm/hugetlb.c | 43 +++++++++-
mm/memory.c | 6 +-
net/bluetooth/a2mp.c | 3 +-
net/bluetooth/hci_core.c | 6 +-
net/ipv4/icmp.c | 34 ++++++++
net/ipv6/icmp.c | 19 ++---
net/ipv6/ip6_icmp.c | 46 +++++++++--
net/mac80211/mesh_hwmp.c | 2 +-
scripts/recordmcount.pl | 6 +-
security/keys/trusted.c | 2 +-
sound/soc/codecs/cs42l56.c | 3 +-
tools/perf/tests/sample-parsing.c | 2 +-
tools/perf/util/event.c | 2 +
.../perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +
121 files changed, 767 insertions(+), 304 deletions(-)
This is the start of the stable review cycle for the 4.4.259 release.
There are 93 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.259-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.259-rc1
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Update in-core bitset after committing the metadata
Peter Zijlstra <peterz(a)infradead.org>
futex: Fix OWNER_DEAD fixup
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: only resize metadata in preresume
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Reinitialize bitset cache before digesting a new writeset
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Use correct value size in equality function of writeset tree
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Fix bitset memory leaks
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Verify the data block size hasn't changed
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Recover committed writeset after crash
Bob Peterson <rpeterso(a)redhat.com>
gfs2: Don't skip dlm unlock if glock has an lvb
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a user-triggerable oops in clear_user()
Chao Yu <yuchao0(a)huawei.com>
f2fs: fix out-of-repair __setattr_copy()
Maxim Kiselev <bigunclemax(a)gmail.com>
gpio: pcf857x: Fix missing first interrupt
Fangrui Song <maskray(a)google.com>
module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
Dan Williams <dan.j.williams(a)intel.com>
libnvdimm/dimm: Avoid race between probe and available_slots_show()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop()
Muchun Song <songmuchun(a)bytedance.com>
mm: hugetlb: fix a race between freeing and dissolving the page
Jiri Kosina <jkosina(a)suse.cz>
floppy: reintroduce O_NDELAY fix
Sean Christopherson <seanjc(a)google.com>
x86/reboot: Force all cpus to exit VMX root if VMX is supported
Martin Kaiser <martin(a)kaiser.cx>
staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
Sabyrzhan Tasbolatov <snovitoll(a)gmail.com>
drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix reloc root leak with 0 ref reloc roots on recovery
Jarkko Sakkinen <jarkko(a)kernel.org>
KEYS: trusted: Fix migratable=1 failing
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7720: fix error code in mos7720_write()
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7840: fix error code in mos7840_write()
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: update interface mapping for ZTE P685M
Marcos Paulo de Souza <mpdesouza(a)suse.com>
Input: i8042 - add ASUS Zenbook Flip to noselftest list
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: joydev - prevent potential read overflow in ioctl
Olivier Crête <olivier.crete(a)ocrete.ca>
Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S
Mikulas Patocka <mpatocka(a)redhat.com>
blk-settings: align max_sectors on "logical_block_size" boundary
Bart Van Assche <bart.vanassche(a)wdc.com>
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
Randy Dunlap <rdunlap(a)infradead.org>
scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
Maxime Ripard <maxime(a)cerno.tech>
i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential double free in hugetlb_register_node() error path
Miaohe Lin <linmiaohe(a)huawei.com>
mm/memory.c: fix potential pte_unmap_unlock pte error
Jann Horn <jannh(a)google.com>
Take mmap lock in cacheflush syscall
Heiner Kallweit <hkallweit1(a)gmail.com>
PCI: Align checking of syscall user config accessors
Jorgen Hansen <jhansen(a)vmware.com>
VMCI: Use set_page_dirty_lock() when unregistering guest memory
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Fix module alias to enable module autoprobe
Randy Dunlap <rdunlap(a)infradead.org>
sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: elo - fix an error code in elo_connect()
Namhyung Kim <namhyung(a)kernel.org>
perf test: Fix unaligned access in sample parsing test
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix missing CYC processing in PSB
Nathan Lynch <nathanl(a)linux.ibm.com>
powerpc/pseries/dlpar: handle ibm, configure-connector delay status
Dan Carpenter <dan.carpenter(a)oracle.com>
mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracepoint: Do not fail unregistering a probe due to memory failure
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
amba: Fix resource leak for drivers without .remove
Vladimir Murzin <vladimir.murzin(a)arm.com>
ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/47x: Disable 256k page size
Shay Drory <shayd(a)nvidia.com>
IB/umad: Return EIO in case of when device disassociated
Pan Bian <bianpan2016(a)163.com>
isofs: release buffer head before return
Pan Bian <bianpan2016(a)163.com>
regulator: axp20x: Fix reference cout leak
Tom Rix <trix(a)redhat.com>
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in the remove function
Randy Dunlap <rdunlap(a)infradead.org>
HID: core: detect and skip invalid inputs to snto32()
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL
Tom Rix <trix(a)redhat.com>
jffs2: fix use after free in jffs2_sum_write_data()
Colin Ian King <colin.king(a)canonical.com>
fs/jfs: fix potential integer overflow on shift of a int
Zhihao Cheng <chengzhihao1(a)huawei.com>
btrfs: clarify error returns values in __load_free_space_cache
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
media: cx25821: Fix a bug when reallocating some dma memory
Joe Perches <joe(a)perches.com>
media: lmedm04: Fix misuse of comma
Dan Carpenter <dan.carpenter(a)oracle.com>
ASoC: cs42l56: fix up error handling in probe
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: tm6000: Fix memleak in tm6000_start_stream
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: media/pci: Fix memleak in empress_init
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
Dan Carpenter <dan.carpenter(a)oracle.com>
gma500: clean up error handling in init
Jialin Zhang <zhangjialin11(a)huawei.com>
drm/gma500: Fix error return code in psb_driver_load()
Randy Dunlap <rdunlap(a)infradead.org>
fbdev: aty: SPARC64 requires FB_ATY_CT
Colin Ian King <colin.king(a)canonical.com>
b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
Juergen Gross <jgross(a)suse.com>
xen/netback: fix spurious event detection for common event case
Edwin Peer <edwin.peer(a)broadcom.com>
bnxt_en: reverse order of TX disable and carrier off
Arnd Bergmann <arnd(a)arndb.de>
ARM: s3c: fix fiq for clang IAS
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Make "trimming xfer length" a debug message
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Abort transaction after errors with unknown reason
Pan Bian <bianpan2016(a)163.com>
Bluetooth: Put HCI device if inquiry procedure interrupts
Pan Bian <bianpan2016(a)163.com>
Bluetooth: drop HCI device reference before return
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
Christopher William Snowhill <chris(a)kode54.net>
Bluetooth: Fix initializing response id after clearing struct
Alexander Lobakin <alobakin(a)pm.me>
MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
Sumit Garg <sumit.garg(a)linaro.org>
kdb: Make memory allocations more robust
Rong Chen <rong.a.chen(a)intel.com>
scripts/recordmcount.pl: support big endian for ARCH sh
Corinna Vinschen <vinschen(a)redhat.com>
igb: Remove incorrect "unexpected SYS WRAP" log message
Rustam Kovhaev <rkovhaev(a)gmail.com>
ntfs: check for valid standard information attribute
David Vrabel <david.vrabel(a)citrix.com>
xen-netback: delete NAPI instance when queue fails to initialize
Stefan Ursella <stefan.ursella(a)wolfvision.net>
usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable
Will McVicker <willmcvicker(a)google.com>
HID: make arrays usage and value to be the same
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/compressed/head.S | 4 +-
arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
arch/mips/kernel/vmlinux.lds.S | 1 +
arch/mips/lantiq/irq.c | 2 +-
arch/mips/mm/c-r4k.c | 2 +-
arch/nios2/kernel/sys_nios2.c | 11 ++-
arch/powerpc/Kconfig | 2 +-
arch/powerpc/platforms/pseries/dlpar.c | 7 +-
arch/sparc/Kconfig | 2 +-
arch/sparc/lib/memset.S | 1 +
arch/x86/kernel/reboot.c | 29 +++----
arch/xtensa/platforms/iss/simdisk.c | 1 -
block/blk-settings.c | 12 +++
drivers/amba/bus.c | 20 +++--
drivers/block/brd.c | 1 -
drivers/block/floppy.c | 27 ++++---
drivers/block/rbd.c | 9 ---
drivers/block/zram/zram_drv.h | 1 -
drivers/clk/meson/clk-pll.c | 2 +-
drivers/clocksource/mxs_timer.c | 5 +-
drivers/dma/fsldma.c | 6 ++
drivers/gpio/gpio-pcf857x.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 ++---
drivers/gpu/drm/gma500/psb_drv.c | 2 +
drivers/hid/hid-core.c | 9 ++-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/ide/ide-cd.c | 8 +-
drivers/ide/ide-cd.h | 6 +-
drivers/infiniband/core/user_mad.c | 7 +-
drivers/input/joydev.c | 7 +-
drivers/input/joystick/xpad.c | 1 +
drivers/input/serio/i8042-x86ia64io.h | 4 +
drivers/input/touchscreen/elo.c | 4 +-
drivers/md/dm-era-target.c | 93 ++++++++++++++--------
drivers/media/pci/cx25821/cx25821-core.c | 4 +-
drivers/media/pci/saa7134/saa7134-empress.c | 5 +-
drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
drivers/media/usb/tm6000/tm6000-dvb.c | 4 +
drivers/media/usb/uvc/uvc_v4l2.c | 18 ++---
drivers/mfd/wm831x-auxadc.c | 3 +-
drivers/misc/eeprom/eeprom_93xx46.c | 1 +
drivers/misc/vmw_vmci/vmci_queue_pair.c | 5 +-
drivers/mmc/host/usdhi6rol0.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-
drivers/net/ethernet/intel/igb/igb_main.c | 2 -
drivers/net/wireless/b43/phy_n.c | 2 +-
drivers/net/xen-netback/interface.c | 9 ++-
drivers/nvdimm/dimm_devs.c | 18 ++++-
drivers/nvdimm/nd.h | 1 -
drivers/pci/syscall.c | 10 +--
drivers/regulator/axp20x-regulator.c | 7 +-
drivers/scsi/bnx2fc/Kconfig | 1 +
drivers/scsi/gdth.h | 3 -
drivers/spi/spi-s3c24xx-fiq.S | 9 +--
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc2/hcd_intr.c | 14 +++-
drivers/usb/dwc3/gadget.c | 19 ++++-
drivers/usb/renesas_usbhs/fifo.c | 2 +
drivers/usb/serial/mos7720.c | 4 +-
drivers/usb/serial/mos7840.c | 4 +-
drivers/usb/serial/option.c | 3 +-
drivers/video/fbdev/Kconfig | 2 +-
fs/btrfs/free-space-cache.c | 6 +-
fs/btrfs/relocation.c | 4 +-
fs/f2fs/file.c | 3 +-
fs/gfs2/lock_dlm.c | 8 +-
fs/isofs/dir.c | 1 +
fs/isofs/namei.c | 1 +
fs/jffs2/summary.c | 3 +
fs/jfs/jfs_dmap.c | 2 +-
fs/ntfs/inode.c | 6 ++
include/linux/blkdev.h | 42 +++++++---
include/linux/device-mapper.h | 2 -
include/linux/ide.h | 1 -
include/uapi/linux/msdos_fs.h | 2 +
kernel/debug/kdb/kdb_private.h | 2 +-
kernel/futex.c | 7 +-
kernel/module.c | 21 ++++-
kernel/tracepoint.c | 80 +++++++++++++++----
mm/hugetlb.c | 43 +++++++++-
mm/memory.c | 6 +-
net/bluetooth/a2mp.c | 3 +-
net/bluetooth/hci_core.c | 6 +-
scripts/recordmcount.pl | 6 +-
security/keys/trusted.c | 2 +-
sound/soc/codecs/cs42l56.c | 3 +-
tools/perf/tests/sample-parsing.c | 2 +-
.../perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +
91 files changed, 503 insertions(+), 245 deletions(-)
Make sure to hold the gpio_lock when removing the gpio device from the
gpio_devices list (when dropping the last reference) to avoid corrupting
the list when there are concurrent accesses.
Fixes: ff2b13592299 ("gpio: make the gpiochip a real device")
Cc: stable(a)vger.kernel.org # 4.6
Reviewed-by: Saravana Kannan <saravanak(a)google.com>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/gpio/gpiolib.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 6e0572515d02..4253837f870b 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -475,8 +475,12 @@ EXPORT_SYMBOL_GPL(gpiochip_line_is_valid);
static void gpiodevice_release(struct device *dev)
{
struct gpio_device *gdev = container_of(dev, struct gpio_device, dev);
+ unsigned long flags;
+ spin_lock_irqsave(&gpio_lock, flags);
list_del(&gdev->list);
+ spin_unlock_irqrestore(&gpio_lock, flags);
+
ida_free(&gpio_ida, gdev->id);
kfree_const(gdev->label);
kfree(gdev->descs);
--
2.26.2
This is a note to let you know that I've just added the patch titled
staging: comedi: pcl818: Fix endian problem for AI command data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 6eec186a44c67a5c08adda8fc9d3cd833532a824 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:50 +0000
Subject: staging: comedi: pcl818: Fix endian problem for AI command data
The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format. However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
parameter. On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value. Fix it by changing the type of the parameter
holding the sample value to `unsigned short`.
[Note: the bug was introduced in commit edf4537bcbf5 ("staging: comedi:
pcl818: use comedi_buf_write_samples()") but the patch applies better to
commit d615416de615 ("staging: comedi: pcl818: introduce
pcl818_ai_write_sample()").]
Fixes: d615416de615 ("staging: comedi: pcl818: introduce pcl818_ai_write_sample()")
Cc: <stable(a)vger.kernel.org> # 4.0+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-10-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/pcl818.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/drivers/pcl818.c b/drivers/staging/comedi/drivers/pcl818.c
index 63e3011158f2..f4b4a686c710 100644
--- a/drivers/staging/comedi/drivers/pcl818.c
+++ b/drivers/staging/comedi/drivers/pcl818.c
@@ -423,7 +423,7 @@ static int pcl818_ai_eoc(struct comedi_device *dev,
static bool pcl818_ai_write_sample(struct comedi_device *dev,
struct comedi_subdevice *s,
- unsigned int chan, unsigned int val)
+ unsigned int chan, unsigned short val)
{
struct pcl818_private *devpriv = dev->private;
struct comedi_cmd *cmd = &s->async->cmd;
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: comedi: pcl711: Fix endian problem for AI command data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 44f26e028c88555ac92532bac0401f91e6df08a2 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:49 +0000
Subject: staging: comedi: pcl711: Fix endian problem for AI command data
The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format. However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable. On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value. Fix it by changing the type of the variable
holding the sample value to `unsigned short`.
Fixes: 1f44c034de2e ("staging: comedi: pcl711: use comedi_buf_write_samples()")
Cc: <stable(a)vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-9-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/pcl711.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/drivers/pcl711.c b/drivers/staging/comedi/drivers/pcl711.c
index 2dbf69e30965..bd6f42fe9e3c 100644
--- a/drivers/staging/comedi/drivers/pcl711.c
+++ b/drivers/staging/comedi/drivers/pcl711.c
@@ -184,7 +184,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d)
struct comedi_device *dev = d;
struct comedi_subdevice *s = dev->read_subdev;
struct comedi_cmd *cmd = &s->async->cmd;
- unsigned int data;
+ unsigned short data;
if (!dev->attached) {
dev_err(dev->class_dev, "spurious interrupt\n");
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: comedi: dmm32at: Fix endian problem for AI command data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From b301bdc8c156ddc8e8c491e7a0e2bd92b43e9510 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:47 +0000
Subject: staging: comedi: dmm32at: Fix endian problem for AI command data
The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format. However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable. On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value. Fix it by changing the type of the variable
holding the sample value to `unsigned short`.
[Note: the bug was introduced in commit 1700529b24cc ("staging: comedi:
dmm32at: use comedi_buf_write_samples()") but the patch applies better
to the later (but in the same kernel release) commit 0c0eadadcbe6e
("staging: comedi: dmm32at: introduce dmm32_ai_get_sample()").]
Fixes: 0c0eadadcbe6e ("staging: comedi: dmm32at: introduce dmm32_ai_get_sample()")
Cc: <stable(a)vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-7-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/dmm32at.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/drivers/dmm32at.c b/drivers/staging/comedi/drivers/dmm32at.c
index 17e6018918bb..56682f01242f 100644
--- a/drivers/staging/comedi/drivers/dmm32at.c
+++ b/drivers/staging/comedi/drivers/dmm32at.c
@@ -404,7 +404,7 @@ static irqreturn_t dmm32at_isr(int irq, void *d)
{
struct comedi_device *dev = d;
unsigned char intstat;
- unsigned int val;
+ unsigned short val;
int i;
if (!dev->attached) {
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: comedi: me4000: Fix endian problem for AI command data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From b92634b83403077c520456d593261bb4f4758d71 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:48 +0000
Subject: staging: comedi: me4000: Fix endian problem for AI command data
The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format. However, the calls to
`comedi_buf_write_samples()` are passing the address of a 32-bit integer
variable. On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value. Fix it by changing the type of the variable
holding the sample value to `unsigned short`.
Fixes: de88924f67d1 ("staging: comedi: me4000: use comedi_buf_write_samples()")
Cc: <stable(a)vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-8-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/me4000.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/drivers/me4000.c b/drivers/staging/comedi/drivers/me4000.c
index 726e40dc17b6..0d3d4cafce2e 100644
--- a/drivers/staging/comedi/drivers/me4000.c
+++ b/drivers/staging/comedi/drivers/me4000.c
@@ -924,7 +924,7 @@ static irqreturn_t me4000_ai_isr(int irq, void *dev_id)
struct comedi_subdevice *s = dev->read_subdev;
int i;
int c = 0;
- unsigned int lval;
+ unsigned short lval;
if (!dev->attached)
return IRQ_NONE;
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: comedi: das800: Fix endian problem for AI command data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 4ed84e4c429fbe8453f88276cc48caecd97127de Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:46 +0000
Subject: staging: comedi: das800: Fix endian problem for AI command data
The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format. However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable. On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value. Fix it by changing the type of the variable
holding the sample value to `unsigned short`.
Fixes: ad9eb43c93d8 ("staging: comedi: das800: use comedi_buf_write_samples()")
Cc: <stable(a)vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-6-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/das800.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/drivers/das800.c b/drivers/staging/comedi/drivers/das800.c
index 4ea100ff6930..2881808d6606 100644
--- a/drivers/staging/comedi/drivers/das800.c
+++ b/drivers/staging/comedi/drivers/das800.c
@@ -427,7 +427,7 @@ static irqreturn_t das800_interrupt(int irq, void *d)
struct comedi_cmd *cmd;
unsigned long irq_flags;
unsigned int status;
- unsigned int val;
+ unsigned short val;
bool fifo_empty;
bool fifo_overflow;
int i;
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: comedi: das6402: Fix endian problem for AI command data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From b8c94370d1b3b29e7356e43ddfe0727f79a9b78f Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:45 +0000
Subject: staging: comedi: das6402: Fix endian problem for AI command data
The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format. However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable. On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value. Fix it by changing the type of the variable
holding the sample value to `unsigned short`.
Fixes: d1d24cb65ee3 ("staging: comedi: das6402: read analog input samples in interrupt handler")
Cc: <stable(a)vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-5-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/das6402.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/drivers/das6402.c b/drivers/staging/comedi/drivers/das6402.c
index 04e224f8b779..96f4107b8054 100644
--- a/drivers/staging/comedi/drivers/das6402.c
+++ b/drivers/staging/comedi/drivers/das6402.c
@@ -186,7 +186,7 @@ static irqreturn_t das6402_interrupt(int irq, void *d)
if (status & DAS6402_STATUS_FFULL) {
async->events |= COMEDI_CB_OVERFLOW;
} else if (status & DAS6402_STATUS_FFNE) {
- unsigned int val;
+ unsigned short val;
val = das6402_ai_read_sample(dev, s);
comedi_buf_write_samples(s, &val, 1);
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: comedi: addi_apci_1500: Fix endian problem for command
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From a7638de0988fc5025c6738f5d45180c393d21e33 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:43 +0000
Subject: staging: comedi: addi_apci_1500: Fix endian problem for command
sample
The digital input subdevice supports Comedi asynchronous commands that
read interrupt status information. This uses 16-bit Comedi samples (of
which only the bottom 8 bits contain status information). However, the
interrupt handler is calling `comedi_buf_write_samples()` with the
address of a 32-bit variable `unsigned int status`. On a bigendian
machine, this will copy 2 bytes from the wrong end of the variable. Fix
it by changing the type of the variable to `unsigned short`.
Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Cc: <stable(a)vger.kernel.org> #4.0+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-3-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
.../staging/comedi/drivers/addi_apci_1500.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
index 11efb21555e3..b04c15dcfb57 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
@@ -208,7 +208,7 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
struct comedi_device *dev = d;
struct apci1500_private *devpriv = dev->private;
struct comedi_subdevice *s = dev->read_subdev;
- unsigned int status = 0;
+ unsigned short status = 0;
unsigned int val;
val = inl(devpriv->amcc + AMCC_OP_REG_INTCSR);
@@ -238,14 +238,14 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
*
* Mask Meaning
* ---------- ------------------------------------------
- * 0x00000001 Event 1 has occurred
- * 0x00000010 Event 2 has occurred
- * 0x00000100 Counter/timer 1 has run down (not implemented)
- * 0x00001000 Counter/timer 2 has run down (not implemented)
- * 0x00010000 Counter 3 has run down (not implemented)
- * 0x00100000 Watchdog has run down (not implemented)
- * 0x01000000 Voltage error
- * 0x10000000 Short-circuit error
+ * 0b00000001 Event 1 has occurred
+ * 0b00000010 Event 2 has occurred
+ * 0b00000100 Counter/timer 1 has run down (not implemented)
+ * 0b00001000 Counter/timer 2 has run down (not implemented)
+ * 0b00010000 Counter 3 has run down (not implemented)
+ * 0b00100000 Watchdog has run down (not implemented)
+ * 0b01000000 Voltage error
+ * 0b10000000 Short-circuit error
*/
comedi_buf_write_samples(s, &status, 1);
comedi_handle_events(dev, s);
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: comedi: adv_pci1710: Fix endian problem for AI command data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 9f17114aa8324c61eda74668d56b7dba8c56d049 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:44 +0000
Subject: staging: comedi: adv_pci1710: Fix endian problem for AI command data
The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format. However, the calls to
`comedi_buf_write_samples()` are passing the address of a 32-bit integer
variable. On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value. Fix it by changing the type of the variables
holding the sample value to `unsigned short`. The type of the `val`
parameter of `pci1710_ai_read_sample()` is changed to `unsigned short *`
accordingly. The type of the `val` variable in `pci1710_ai_insn_read()`
is also changed to `unsigned short` since its address is passed to
`pci1710_ai_read_sample()`.
Fixes: a9c3a015c12f ("staging: comedi: adv_pci1710: use comedi_buf_write_samples()")
Cc: <stable(a)vger.kernel.org> # 4.0+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-4-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/adv_pci1710.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
index 692893c7e5c3..090607760be6 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -300,11 +300,11 @@ static int pci1710_ai_eoc(struct comedi_device *dev,
static int pci1710_ai_read_sample(struct comedi_device *dev,
struct comedi_subdevice *s,
unsigned int cur_chan,
- unsigned int *val)
+ unsigned short *val)
{
const struct boardtype *board = dev->board_ptr;
struct pci1710_private *devpriv = dev->private;
- unsigned int sample;
+ unsigned short sample;
unsigned int chan;
sample = inw(dev->iobase + PCI171X_AD_DATA_REG);
@@ -345,7 +345,7 @@ static int pci1710_ai_insn_read(struct comedi_device *dev,
pci1710_ai_setup_chanlist(dev, s, &insn->chanspec, 1, 1);
for (i = 0; i < insn->n; i++) {
- unsigned int val;
+ unsigned short val;
/* start conversion */
outw(0, dev->iobase + PCI171X_SOFTTRG_REG);
@@ -395,7 +395,7 @@ static void pci1710_handle_every_sample(struct comedi_device *dev,
{
struct comedi_cmd *cmd = &s->async->cmd;
unsigned int status;
- unsigned int val;
+ unsigned short val;
int ret;
status = inw(dev->iobase + PCI171X_STATUS_REG);
@@ -455,7 +455,7 @@ static void pci1710_handle_fifo(struct comedi_device *dev,
}
for (i = 0; i < devpriv->max_samples; i++) {
- unsigned int val;
+ unsigned short val;
int ret;
ret = pci1710_ai_read_sample(dev, s, s->async->cur_chan, &val);
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: comedi: addi_apci_1032: Fix endian problem for COS sample
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 8920b116495ab641a0e0350817157defa0d1ee53 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti(a)mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:42 +0000
Subject: staging: comedi: addi_apci_1032: Fix endian problem for COS sample
The Change-Of-State (COS) subdevice supports Comedi asynchronous
commands to read 16-bit change-of-state values. However, the interrupt
handler is calling `comedi_buf_write_samples()` with the address of a
32-bit integer `&s->state`. On bigendian architectures, it will copy 2
bytes from the wrong end of the 32-bit integer. Fix it by transferring
the value via a 16-bit integer.
Fixes: 6bb45f2b0c86 ("staging: comedi: addi_apci_1032: use comedi_buf_write_samples()")
Cc: <stable(a)vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-2-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/addi_apci_1032.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c
index 35b75f0c9200..81a246fbcc01 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
@@ -260,6 +260,7 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
struct apci1032_private *devpriv = dev->private;
struct comedi_subdevice *s = dev->read_subdev;
unsigned int ctrl;
+ unsigned short val;
/* check interrupt is from this device */
if ((inl(devpriv->amcc_iobase + AMCC_OP_REG_INTCSR) &
@@ -275,7 +276,8 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
outl(ctrl & ~APCI1032_CTRL_INT_ENA, dev->iobase + APCI1032_CTRL_REG);
s->state = inl(dev->iobase + APCI1032_STATUS_REG) & 0xffff;
- comedi_buf_write_samples(s, &s->state, 1);
+ val = s->state;
+ comedi_buf_write_samples(s, &val, 1);
comedi_handle_events(dev, s);
/* enable the interrupt */
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: ks7010: prevent buffer overflow in ks_wlan_set_scan()
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 651652def082ef79ea85ad2ca4f19167d927e330 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter(a)oracle.com>
Date: Tue, 2 Mar 2021 14:19:39 +0300
Subject: staging: ks7010: prevent buffer overflow in ks_wlan_set_scan()
The user can specify a "req->essid_len" of up to 255 but if it's
over IW_ESSID_MAX_SIZE (32) that can lead to memory corruption.
Fixes: 13a9930d15b4 ("staging: ks7010: add driver from Nanonote extra-repository")
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/YD4fS8+HmM/Qmrw6@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/ks7010/ks_wlan_net.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/ks7010/ks_wlan_net.c b/drivers/staging/ks7010/ks_wlan_net.c
index dc09cc6e1c47..09e7b4cd0138 100644
--- a/drivers/staging/ks7010/ks_wlan_net.c
+++ b/drivers/staging/ks7010/ks_wlan_net.c
@@ -1120,6 +1120,7 @@ static int ks_wlan_set_scan(struct net_device *dev,
{
struct ks_wlan_private *priv = netdev_priv(dev);
struct iw_scan_req *req = NULL;
+ int len;
if (priv->sleep_mode == SLP_SLEEP)
return -EPERM;
@@ -1129,8 +1130,9 @@ static int ks_wlan_set_scan(struct net_device *dev,
if (wrqu->data.length == sizeof(struct iw_scan_req) &&
wrqu->data.flags & IW_SCAN_THIS_ESSID) {
req = (struct iw_scan_req *)extra;
- priv->scan_ssid_len = req->essid_len;
- memcpy(priv->scan_ssid, req->essid, priv->scan_ssid_len);
+ len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
+ priv->scan_ssid_len = len;
+ memcpy(priv->scan_ssid, req->essid, len);
} else {
priv->scan_ssid_len = 0;
}
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: rtl8192e: Fix possible buffer overflow in
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 35eda75caac975e1912acdf9635f8f23c8e5db4e Mon Sep 17 00:00:00 2001
From: Lee Gibson <leegib(a)gmail.com>
Date: Fri, 26 Feb 2021 14:51:57 +0000
Subject: staging: rtl8192e: Fix possible buffer overflow in
_rtl92e_wx_set_scan
Function _rtl92e_wx_set_scan calls memcpy without checking the length.
A user could control that length and trigger a buffer overflow.
Fix by checking the length is within the maximum allowed size.
Reviewed-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Signed-off-by: Lee Gibson <leegib(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20210226145157.424065-1-leegib@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/rtl8192e/rtl8192e/rtl_wx.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
index 16bcee13f64b..407effde5e71 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
@@ -406,9 +406,10 @@ static int _rtl92e_wx_set_scan(struct net_device *dev,
struct iw_scan_req *req = (struct iw_scan_req *)b;
if (req->essid_len) {
- ieee->current_network.ssid_len = req->essid_len;
- memcpy(ieee->current_network.ssid, req->essid,
- req->essid_len);
+ int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
+
+ ieee->current_network.ssid_len = len;
+ memcpy(ieee->current_network.ssid, req->essid, len);
}
}
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: rtl8712: Fix possible buffer overflow in
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From def9c897e73e89780c7f13a81aef60db2bdeaddc Mon Sep 17 00:00:00 2001
From: Lee Gibson <leegib(a)gmail.com>
Date: Mon, 1 Mar 2021 13:26:48 +0000
Subject: staging: rtl8712: Fix possible buffer overflow in
r8712_sitesurvey_cmd
Function r8712_sitesurvey_cmd calls memcpy without checking the length.
A user could control that length and trigger a buffer overflow.
Fix by checking the length is within the maximum allowed size.
Signed-off-by: Lee Gibson <leegib(a)gmail.com>
Link: https://lore.kernel.org/r/20210301132648.420296-1-leegib@gmail.com
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/rtl8712/rtl871x_cmd.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8712/rtl871x_cmd.c b/drivers/staging/rtl8712/rtl871x_cmd.c
index 18116469bd31..75716f59044d 100644
--- a/drivers/staging/rtl8712/rtl871x_cmd.c
+++ b/drivers/staging/rtl8712/rtl871x_cmd.c
@@ -192,8 +192,10 @@ u8 r8712_sitesurvey_cmd(struct _adapter *padapter,
psurveyPara->ss_ssidlen = 0;
memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1);
if (pssid && pssid->SsidLength) {
- memcpy(psurveyPara->ss_ssid, pssid->Ssid, pssid->SsidLength);
- psurveyPara->ss_ssidlen = cpu_to_le32(pssid->SsidLength);
+ int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE);
+
+ memcpy(psurveyPara->ss_ssid, pssid->Ssid, len);
+ psurveyPara->ss_ssidlen = cpu_to_le32(len);
}
set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
r8712_enqueue_cmd(pcmdpriv, ph2c);
--
2.30.1
This is a note to let you know that I've just added the patch titled
staging: rtl8712: unterminated string leads to read overflow
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 3c0992038070465b5362fd401e41d3f85a2512a2 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter(a)oracle.com>
Date: Wed, 24 Feb 2021 11:45:59 +0300
Subject: staging: rtl8712: unterminated string leads to read overflow
The memdup_user() function does not necessarily return a NUL terminated
string so this can lead to a read overflow. Switch from memdup_user()
to strndup_user() to fix this bug.
Fixes: c6dc001f2add ("staging: r8712u: Merging Realtek's latest (v2.6.6). Various fixes.")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Link: https://lore.kernel.org/r/YDYSR+1rj26NRhvb@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
index 81de5a9e6b67..60dd798a6e51 100644
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
@@ -924,7 +924,7 @@ static int r871x_wx_set_priv(struct net_device *dev,
struct iw_point *dwrq = (struct iw_point *)awrq;
len = dwrq->length;
- ext = memdup_user(dwrq->pointer, len);
+ ext = strndup_user(dwrq->pointer, len);
if (IS_ERR(ext))
return PTR_ERR(ext);
--
2.30.1
This was introduced by commit e4ffd066ff440a57097e9140fa9e16ceef905de8.
Assuming the first word of $(CC) is the actual compiler breaks usage
like CC="ccache gcc": the script ends up calling ccache directly with
gcc arguments, what fails. Instead of getting the first word, just
remove from $(CC) any word that starts with a "-". This maintains the
spirit of the original patch, while not breaking ccache users.
Signed-off-by: Antonio Terceiro <antonio.terceiro(a)linaro.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Ingo Molnar <mingo(a)redhat.com>
Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: He Zhe <zhe.he(a)windriver.com>
CC: stable(a)vger.kernel.org
---
tools/perf/Makefile.perf | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 5345ac70cd83..9bfc725db608 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -607,7 +607,7 @@ arch_errno_hdr_dir := $(srctree)/tools
arch_errno_tbl := $(srctree)/tools/perf/trace/beauty/arch_errno_names.sh
$(arch_errno_name_array): $(arch_errno_tbl)
- $(Q)$(SHELL) '$(arch_errno_tbl)' $(firstword $(CC)) $(arch_errno_hdr_dir) > $@
+ $(Q)$(SHELL) '$(arch_errno_tbl)' '$(patsubst -%,,$(CC))' $(arch_errno_hdr_dir) > $@
sync_file_range_arrays := $(beauty_outdir)/sync_file_range_arrays.c
sync_file_range_tbls := $(srctree)/tools/perf/trace/beauty/sync_file_range.sh
--
2.30.1
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 4ae7dc97f726ea95c58ac58af71cc034ad22d7de Mon Sep 17 00:00:00 2001
From: Frederic Weisbecker <frederic(a)kernel.org>
Date: Mon, 1 Feb 2021 00:05:48 +0100
Subject: [PATCH] entry/kvm: Explicitly flush pending rcuog wakeup before last
rescheduling point
Following the idle loop model, cleanly check for pending rcuog wakeup
before the last rescheduling point upon resuming to guest mode. This
way we can avoid to do it from rcu_user_enter() with the last resort
self-IPI hack that enforces rescheduling.
Suggested-by: Peter Zijlstra <peterz(a)infradead.org>
Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20210131230548.32970-6-frederic@kernel.org
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1b404e4d7dd8..b967c1c774a1 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1782,6 +1782,7 @@ EXPORT_SYMBOL_GPL(kvm_emulate_wrmsr);
bool kvm_vcpu_exit_request(struct kvm_vcpu *vcpu)
{
+ xfer_to_guest_mode_prepare();
return vcpu->mode == EXITING_GUEST_MODE || kvm_request_pending(vcpu) ||
xfer_to_guest_mode_work_pending();
}
diff --git a/include/linux/entry-kvm.h b/include/linux/entry-kvm.h
index 9b93f8584ff7..8b2b1d68b954 100644
--- a/include/linux/entry-kvm.h
+++ b/include/linux/entry-kvm.h
@@ -46,6 +46,20 @@ static inline int arch_xfer_to_guest_mode_handle_work(struct kvm_vcpu *vcpu,
*/
int xfer_to_guest_mode_handle_work(struct kvm_vcpu *vcpu);
+/**
+ * xfer_to_guest_mode_prepare - Perform last minute preparation work that
+ * need to be handled while IRQs are disabled
+ * upon entering to guest.
+ *
+ * Has to be invoked with interrupts disabled before the last call
+ * to xfer_to_guest_mode_work_pending().
+ */
+static inline void xfer_to_guest_mode_prepare(void)
+{
+ lockdep_assert_irqs_disabled();
+ rcu_nocb_flush_deferred_wakeup();
+}
+
/**
* __xfer_to_guest_mode_work_pending - Check if work is pending
*
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 2ebc211fffcb..ce17b8477442 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -678,9 +678,10 @@ EXPORT_SYMBOL_GPL(rcu_idle_enter);
#ifdef CONFIG_NO_HZ_FULL
+#if !defined(CONFIG_GENERIC_ENTRY) || !defined(CONFIG_KVM_XFER_TO_GUEST_WORK)
/*
* An empty function that will trigger a reschedule on
- * IRQ tail once IRQs get re-enabled on userspace resume.
+ * IRQ tail once IRQs get re-enabled on userspace/guest resume.
*/
static void late_wakeup_func(struct irq_work *work)
{
@@ -689,6 +690,37 @@ static void late_wakeup_func(struct irq_work *work)
static DEFINE_PER_CPU(struct irq_work, late_wakeup_work) =
IRQ_WORK_INIT(late_wakeup_func);
+/*
+ * If either:
+ *
+ * 1) the task is about to enter in guest mode and $ARCH doesn't support KVM generic work
+ * 2) the task is about to enter in user mode and $ARCH doesn't support generic entry.
+ *
+ * In these cases the late RCU wake ups aren't supported in the resched loops and our
+ * last resort is to fire a local irq_work that will trigger a reschedule once IRQs
+ * get re-enabled again.
+ */
+noinstr static void rcu_irq_work_resched(void)
+{
+ struct rcu_data *rdp = this_cpu_ptr(&rcu_data);
+
+ if (IS_ENABLED(CONFIG_GENERIC_ENTRY) && !(current->flags & PF_VCPU))
+ return;
+
+ if (IS_ENABLED(CONFIG_KVM_XFER_TO_GUEST_WORK) && (current->flags & PF_VCPU))
+ return;
+
+ instrumentation_begin();
+ if (do_nocb_deferred_wakeup(rdp) && need_resched()) {
+ irq_work_queue(this_cpu_ptr(&late_wakeup_work));
+ }
+ instrumentation_end();
+}
+
+#else
+static inline void rcu_irq_work_resched(void) { }
+#endif
+
/**
* rcu_user_enter - inform RCU that we are resuming userspace.
*
@@ -702,8 +734,6 @@ static DEFINE_PER_CPU(struct irq_work, late_wakeup_work) =
*/
noinstr void rcu_user_enter(void)
{
- struct rcu_data *rdp = this_cpu_ptr(&rcu_data);
-
lockdep_assert_irqs_disabled();
/*
@@ -711,13 +741,7 @@ noinstr void rcu_user_enter(void)
* rescheduling opportunity in the entry code. Trigger a self IPI
* that will fire and reschedule once we resume in user/guest mode.
*/
- instrumentation_begin();
- if (!IS_ENABLED(CONFIG_GENERIC_ENTRY) || (current->flags & PF_VCPU)) {
- if (do_nocb_deferred_wakeup(rdp) && need_resched())
- irq_work_queue(this_cpu_ptr(&late_wakeup_work));
- }
- instrumentation_end();
-
+ rcu_irq_work_resched();
rcu_eqs_enter(true);
}
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 384856e4d13e..cdc1b7651c03 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -2197,6 +2197,7 @@ void rcu_nocb_flush_deferred_wakeup(void)
{
do_nocb_deferred_wakeup(this_cpu_ptr(&rcu_data));
}
+EXPORT_SYMBOL_GPL(rcu_nocb_flush_deferred_wakeup);
void __init rcu_init_nohz(void)
{
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 47b8ff194c1fd73d58dc339b597d466fe48c8958 Mon Sep 17 00:00:00 2001
From: Frederic Weisbecker <frederic(a)kernel.org>
Date: Mon, 1 Feb 2021 00:05:47 +0100
Subject: [PATCH] entry: Explicitly flush pending rcuog wakeup before last
rescheduling point
Following the idle loop model, cleanly check for pending rcuog wakeup
before the last rescheduling point on resuming to user mode. This
way we can avoid to do it from rcu_user_enter() with the last resort
self-IPI hack that enforces rescheduling.
Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20210131230548.32970-5-frederic@kernel.org
diff --git a/kernel/entry/common.c b/kernel/entry/common.c
index f09cae37ddd5..8442e5c9cfa2 100644
--- a/kernel/entry/common.c
+++ b/kernel/entry/common.c
@@ -184,6 +184,10 @@ static unsigned long exit_to_user_mode_loop(struct pt_regs *regs,
* enabled above.
*/
local_irq_disable_exit_to_user();
+
+ /* Check if any of the above work has queued a deferred wakeup */
+ rcu_nocb_flush_deferred_wakeup();
+
ti_work = READ_ONCE(current_thread_info()->flags);
}
@@ -197,6 +201,9 @@ static void exit_to_user_mode_prepare(struct pt_regs *regs)
lockdep_assert_irqs_disabled();
+ /* Flush pending rcuog wakeup before the last need_resched() check */
+ rcu_nocb_flush_deferred_wakeup();
+
if (unlikely(ti_work & EXIT_TO_USER_MODE_WORK))
ti_work = exit_to_user_mode_loop(regs, ti_work);
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 4b1e5bd16492..2ebc211fffcb 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -707,13 +707,15 @@ noinstr void rcu_user_enter(void)
lockdep_assert_irqs_disabled();
/*
- * We may be past the last rescheduling opportunity in the entry code.
- * Trigger a self IPI that will fire and reschedule once we resume to
- * user/guest mode.
+ * Other than generic entry implementation, we may be past the last
+ * rescheduling opportunity in the entry code. Trigger a self IPI
+ * that will fire and reschedule once we resume in user/guest mode.
*/
instrumentation_begin();
- if (do_nocb_deferred_wakeup(rdp) && need_resched())
- irq_work_queue(this_cpu_ptr(&late_wakeup_work));
+ if (!IS_ENABLED(CONFIG_GENERIC_ENTRY) || (current->flags & PF_VCPU)) {
+ if (do_nocb_deferred_wakeup(rdp) && need_resched())
+ irq_work_queue(this_cpu_ptr(&late_wakeup_work));
+ }
instrumentation_end();
rcu_eqs_enter(true);
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f8bb5cae9616224a39cbb399de382d36ac41df10 Mon Sep 17 00:00:00 2001
From: Frederic Weisbecker <frederic(a)kernel.org>
Date: Mon, 1 Feb 2021 00:05:46 +0100
Subject: [PATCH] rcu/nocb: Trigger self-IPI on late deferred wake up before
user resume
Entering RCU idle mode may cause a deferred wake up of an RCU NOCB_GP
kthread (rcuog) to be serviced.
Unfortunately the call to rcu_user_enter() is already past the last
rescheduling opportunity before we resume to userspace or to guest mode.
We may escape there with the woken task ignored.
The ultimate resort to fix every callsites is to trigger a self-IPI
(nohz_full depends on arch to implement arch_irq_work_raise()) that will
trigger a reschedule on IRQ tail or guest exit.
Eventually every site that want a saner treatment will need to carefully
place a call to rcu_nocb_flush_deferred_wakeup() before the last explicit
need_resched() check upon resume.
Fixes: 96d3fd0d315a (rcu: Break call_rcu() deadlock involving scheduler and perf)
Reported-by: Paul E. McKenney <paulmck(a)kernel.org>
Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20210131230548.32970-4-frederic@kernel.org
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 82838e93b498..4b1e5bd16492 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -677,6 +677,18 @@ void rcu_idle_enter(void)
EXPORT_SYMBOL_GPL(rcu_idle_enter);
#ifdef CONFIG_NO_HZ_FULL
+
+/*
+ * An empty function that will trigger a reschedule on
+ * IRQ tail once IRQs get re-enabled on userspace resume.
+ */
+static void late_wakeup_func(struct irq_work *work)
+{
+}
+
+static DEFINE_PER_CPU(struct irq_work, late_wakeup_work) =
+ IRQ_WORK_INIT(late_wakeup_func);
+
/**
* rcu_user_enter - inform RCU that we are resuming userspace.
*
@@ -694,12 +706,19 @@ noinstr void rcu_user_enter(void)
lockdep_assert_irqs_disabled();
+ /*
+ * We may be past the last rescheduling opportunity in the entry code.
+ * Trigger a self IPI that will fire and reschedule once we resume to
+ * user/guest mode.
+ */
instrumentation_begin();
- do_nocb_deferred_wakeup(rdp);
+ if (do_nocb_deferred_wakeup(rdp) && need_resched())
+ irq_work_queue(this_cpu_ptr(&late_wakeup_work));
instrumentation_end();
rcu_eqs_enter(true);
}
+
#endif /* CONFIG_NO_HZ_FULL */
/**
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index 7708ed161f4a..9226f4021a36 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -433,7 +433,7 @@ static bool rcu_nocb_try_bypass(struct rcu_data *rdp, struct rcu_head *rhp,
static void __call_rcu_nocb_wake(struct rcu_data *rdp, bool was_empty,
unsigned long flags);
static int rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp);
-static void do_nocb_deferred_wakeup(struct rcu_data *rdp);
+static bool do_nocb_deferred_wakeup(struct rcu_data *rdp);
static void rcu_boot_init_nocb_percpu_data(struct rcu_data *rdp);
static void rcu_spawn_cpu_nocb_kthread(int cpu);
static void __init rcu_spawn_nocb_kthreads(void);
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index d5b38c28abd1..384856e4d13e 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -1631,8 +1631,8 @@ bool rcu_is_nocb_cpu(int cpu)
* Kick the GP kthread for this NOCB group. Caller holds ->nocb_lock
* and this function releases it.
*/
-static void wake_nocb_gp(struct rcu_data *rdp, bool force,
- unsigned long flags)
+static bool wake_nocb_gp(struct rcu_data *rdp, bool force,
+ unsigned long flags)
__releases(rdp->nocb_lock)
{
bool needwake = false;
@@ -1643,7 +1643,7 @@ static void wake_nocb_gp(struct rcu_data *rdp, bool force,
trace_rcu_nocb_wake(rcu_state.name, rdp->cpu,
TPS("AlreadyAwake"));
rcu_nocb_unlock_irqrestore(rdp, flags);
- return;
+ return false;
}
del_timer(&rdp->nocb_timer);
rcu_nocb_unlock_irqrestore(rdp, flags);
@@ -1656,6 +1656,8 @@ static void wake_nocb_gp(struct rcu_data *rdp, bool force,
raw_spin_unlock_irqrestore(&rdp_gp->nocb_gp_lock, flags);
if (needwake)
wake_up_process(rdp_gp->nocb_gp_kthread);
+
+ return needwake;
}
/*
@@ -2152,20 +2154,23 @@ static int rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp)
}
/* Do a deferred wakeup of rcu_nocb_kthread(). */
-static void do_nocb_deferred_wakeup_common(struct rcu_data *rdp)
+static bool do_nocb_deferred_wakeup_common(struct rcu_data *rdp)
{
unsigned long flags;
int ndw;
+ int ret;
rcu_nocb_lock_irqsave(rdp, flags);
if (!rcu_nocb_need_deferred_wakeup(rdp)) {
rcu_nocb_unlock_irqrestore(rdp, flags);
- return;
+ return false;
}
ndw = READ_ONCE(rdp->nocb_defer_wakeup);
WRITE_ONCE(rdp->nocb_defer_wakeup, RCU_NOCB_WAKE_NOT);
- wake_nocb_gp(rdp, ndw == RCU_NOCB_WAKE_FORCE, flags);
+ ret = wake_nocb_gp(rdp, ndw == RCU_NOCB_WAKE_FORCE, flags);
trace_rcu_nocb_wake(rcu_state.name, rdp->cpu, TPS("DeferredWake"));
+
+ return ret;
}
/* Do a deferred wakeup of rcu_nocb_kthread() from a timer handler. */
@@ -2181,10 +2186,11 @@ static void do_nocb_deferred_wakeup_timer(struct timer_list *t)
* This means we do an inexact common-case check. Note that if
* we miss, ->nocb_timer will eventually clean things up.
*/
-static void do_nocb_deferred_wakeup(struct rcu_data *rdp)
+static bool do_nocb_deferred_wakeup(struct rcu_data *rdp)
{
if (rcu_nocb_need_deferred_wakeup(rdp))
- do_nocb_deferred_wakeup_common(rdp);
+ return do_nocb_deferred_wakeup_common(rdp);
+ return false;
}
void rcu_nocb_flush_deferred_wakeup(void)
@@ -2523,8 +2529,9 @@ static int rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp)
return false;
}
-static void do_nocb_deferred_wakeup(struct rcu_data *rdp)
+static bool do_nocb_deferred_wakeup(struct rcu_data *rdp)
{
+ return false;
}
static void rcu_spawn_cpu_nocb_kthread(int cpu)
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f8bb5cae9616224a39cbb399de382d36ac41df10 Mon Sep 17 00:00:00 2001
From: Frederic Weisbecker <frederic(a)kernel.org>
Date: Mon, 1 Feb 2021 00:05:46 +0100
Subject: [PATCH] rcu/nocb: Trigger self-IPI on late deferred wake up before
user resume
Entering RCU idle mode may cause a deferred wake up of an RCU NOCB_GP
kthread (rcuog) to be serviced.
Unfortunately the call to rcu_user_enter() is already past the last
rescheduling opportunity before we resume to userspace or to guest mode.
We may escape there with the woken task ignored.
The ultimate resort to fix every callsites is to trigger a self-IPI
(nohz_full depends on arch to implement arch_irq_work_raise()) that will
trigger a reschedule on IRQ tail or guest exit.
Eventually every site that want a saner treatment will need to carefully
place a call to rcu_nocb_flush_deferred_wakeup() before the last explicit
need_resched() check upon resume.
Fixes: 96d3fd0d315a (rcu: Break call_rcu() deadlock involving scheduler and perf)
Reported-by: Paul E. McKenney <paulmck(a)kernel.org>
Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20210131230548.32970-4-frederic@kernel.org
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 82838e93b498..4b1e5bd16492 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -677,6 +677,18 @@ void rcu_idle_enter(void)
EXPORT_SYMBOL_GPL(rcu_idle_enter);
#ifdef CONFIG_NO_HZ_FULL
+
+/*
+ * An empty function that will trigger a reschedule on
+ * IRQ tail once IRQs get re-enabled on userspace resume.
+ */
+static void late_wakeup_func(struct irq_work *work)
+{
+}
+
+static DEFINE_PER_CPU(struct irq_work, late_wakeup_work) =
+ IRQ_WORK_INIT(late_wakeup_func);
+
/**
* rcu_user_enter - inform RCU that we are resuming userspace.
*
@@ -694,12 +706,19 @@ noinstr void rcu_user_enter(void)
lockdep_assert_irqs_disabled();
+ /*
+ * We may be past the last rescheduling opportunity in the entry code.
+ * Trigger a self IPI that will fire and reschedule once we resume to
+ * user/guest mode.
+ */
instrumentation_begin();
- do_nocb_deferred_wakeup(rdp);
+ if (do_nocb_deferred_wakeup(rdp) && need_resched())
+ irq_work_queue(this_cpu_ptr(&late_wakeup_work));
instrumentation_end();
rcu_eqs_enter(true);
}
+
#endif /* CONFIG_NO_HZ_FULL */
/**
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index 7708ed161f4a..9226f4021a36 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -433,7 +433,7 @@ static bool rcu_nocb_try_bypass(struct rcu_data *rdp, struct rcu_head *rhp,
static void __call_rcu_nocb_wake(struct rcu_data *rdp, bool was_empty,
unsigned long flags);
static int rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp);
-static void do_nocb_deferred_wakeup(struct rcu_data *rdp);
+static bool do_nocb_deferred_wakeup(struct rcu_data *rdp);
static void rcu_boot_init_nocb_percpu_data(struct rcu_data *rdp);
static void rcu_spawn_cpu_nocb_kthread(int cpu);
static void __init rcu_spawn_nocb_kthreads(void);
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index d5b38c28abd1..384856e4d13e 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -1631,8 +1631,8 @@ bool rcu_is_nocb_cpu(int cpu)
* Kick the GP kthread for this NOCB group. Caller holds ->nocb_lock
* and this function releases it.
*/
-static void wake_nocb_gp(struct rcu_data *rdp, bool force,
- unsigned long flags)
+static bool wake_nocb_gp(struct rcu_data *rdp, bool force,
+ unsigned long flags)
__releases(rdp->nocb_lock)
{
bool needwake = false;
@@ -1643,7 +1643,7 @@ static void wake_nocb_gp(struct rcu_data *rdp, bool force,
trace_rcu_nocb_wake(rcu_state.name, rdp->cpu,
TPS("AlreadyAwake"));
rcu_nocb_unlock_irqrestore(rdp, flags);
- return;
+ return false;
}
del_timer(&rdp->nocb_timer);
rcu_nocb_unlock_irqrestore(rdp, flags);
@@ -1656,6 +1656,8 @@ static void wake_nocb_gp(struct rcu_data *rdp, bool force,
raw_spin_unlock_irqrestore(&rdp_gp->nocb_gp_lock, flags);
if (needwake)
wake_up_process(rdp_gp->nocb_gp_kthread);
+
+ return needwake;
}
/*
@@ -2152,20 +2154,23 @@ static int rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp)
}
/* Do a deferred wakeup of rcu_nocb_kthread(). */
-static void do_nocb_deferred_wakeup_common(struct rcu_data *rdp)
+static bool do_nocb_deferred_wakeup_common(struct rcu_data *rdp)
{
unsigned long flags;
int ndw;
+ int ret;
rcu_nocb_lock_irqsave(rdp, flags);
if (!rcu_nocb_need_deferred_wakeup(rdp)) {
rcu_nocb_unlock_irqrestore(rdp, flags);
- return;
+ return false;
}
ndw = READ_ONCE(rdp->nocb_defer_wakeup);
WRITE_ONCE(rdp->nocb_defer_wakeup, RCU_NOCB_WAKE_NOT);
- wake_nocb_gp(rdp, ndw == RCU_NOCB_WAKE_FORCE, flags);
+ ret = wake_nocb_gp(rdp, ndw == RCU_NOCB_WAKE_FORCE, flags);
trace_rcu_nocb_wake(rcu_state.name, rdp->cpu, TPS("DeferredWake"));
+
+ return ret;
}
/* Do a deferred wakeup of rcu_nocb_kthread() from a timer handler. */
@@ -2181,10 +2186,11 @@ static void do_nocb_deferred_wakeup_timer(struct timer_list *t)
* This means we do an inexact common-case check. Note that if
* we miss, ->nocb_timer will eventually clean things up.
*/
-static void do_nocb_deferred_wakeup(struct rcu_data *rdp)
+static bool do_nocb_deferred_wakeup(struct rcu_data *rdp)
{
if (rcu_nocb_need_deferred_wakeup(rdp))
- do_nocb_deferred_wakeup_common(rdp);
+ return do_nocb_deferred_wakeup_common(rdp);
+ return false;
}
void rcu_nocb_flush_deferred_wakeup(void)
@@ -2523,8 +2529,9 @@ static int rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp)
return false;
}
-static void do_nocb_deferred_wakeup(struct rcu_data *rdp)
+static bool do_nocb_deferred_wakeup(struct rcu_data *rdp)
{
+ return false;
}
static void rcu_spawn_cpu_nocb_kthread(int cpu)
On stable rc 5.11 sparc allnoconfig and tinyconfig failed with gcc-8,
gcc-9 and gcc-10.
make --silent --keep-going --jobs=8
O=/home/tuxbuild/.cache/tuxmake/builds/1/tmp ARCH=sparc
CROSS_COMPILE=sparc64-linux-gnu- 'CC=sccache sparc64-linux-gnu-gcc'
'HOSTCC=sccache gcc'
<stdin>:1335:2: warning: #warning syscall rseq not implemented [-Wcpp]
In file included from include/net/ndisc.h:50,
from include/net/ipv6.h:21,
from include/linux/sunrpc/clnt.h:28,
from include/linux/nfs_fs.h:32,
from init/do_mounts.c:22:
include/linux/icmpv6.h: In function 'icmpv6_ndo_send':
include/linux/icmpv6.h:70:2: error: implicit declaration of function
'__icmpv6_send'; did you mean 'icmpv6_send'?
[-Werror=implicit-function-declaration]
70 | __icmpv6_send(skb_in, type, code, info, &parm);
| ^~~~~~~~~~~~~
| icmpv6_send
cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:304: init/do_mounts.o] Error 1
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Ref:
https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/106417…
--
Linaro LKFT
https://lkft.linaro.org
From: Wolfram Sang <wsa+renesas(a)sang-engineering.com>
[ Upstream commit c7b514ec979e23a08c411f3d8ed39c7922751422 ]
To avoid the HW race condition on R-Car Gen2 and earlier, we need to
write to ICMCR as soon as possible in the interrupt handler. We can
improve this by writing a static value instead of masking out bits.
Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se>
Signed-off-by: Wolfram Sang <wsa(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i2c/busses/i2c-rcar.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 9c162a01a584..9d54ae935524 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -89,7 +89,6 @@
#define RCAR_BUS_PHASE_START (MDBS | MIE | ESG)
#define RCAR_BUS_PHASE_DATA (MDBS | MIE)
-#define RCAR_BUS_MASK_DATA (~(ESG | FSB) & 0xFF)
#define RCAR_BUS_PHASE_STOP (MDBS | MIE | FSB)
#define RCAR_IRQ_SEND (MNR | MAL | MST | MAT | MDE)
@@ -616,7 +615,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
/*
* This driver has a lock-free design because there are IP cores (at least
* R-Car Gen2) which have an inherent race condition in their hardware design.
- * There, we need to clear RCAR_BUS_MASK_DATA bits as soon as possible after
+ * There, we need to switch to RCAR_BUS_PHASE_DATA as soon as possible after
* the interrupt was generated, otherwise an unwanted repeated message gets
* generated. It turned out that taking a spinlock at the beginning of the ISR
* was already causing repeated messages. Thus, this driver was converted to
@@ -625,13 +624,11 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
{
struct rcar_i2c_priv *priv = ptr;
- u32 msr, val;
+ u32 msr;
/* Clear START or STOP immediately, except for REPSTART after read */
- if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) {
- val = rcar_i2c_read(priv, ICMCR);
- rcar_i2c_write(priv, ICMCR, val & RCAR_BUS_MASK_DATA);
- }
+ if (likely(!(priv->flags & ID_P_REP_AFTER_RD)))
+ rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA);
msr = rcar_i2c_read(priv, ICMSR);
--
2.30.1
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: 733a462ede54 - ide/falconide: Fix module unload
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://arr-cki-prod-datawarehouse-public.s3.amazonaws.com/index.html?prefi…
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: make -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: make -j30 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: make -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: make -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
✅ selinux-policy: serge-testsuite
✅ storage: software RAID testing
🚧 ✅ xfstests - ext4
🚧 ✅ xfstests - xfs
🚧 ✅ xfstests - btrfs
🚧 ✅ IPMI driver test
🚧 ✅ IPMItool loop stress test
🚧 ✅ Storage blktests
🚧 ✅ Storage block - filesystem fio test
🚧 ⚡⚡⚡ Storage block - queue scheduler test
🚧 ⚡⚡⚡ Storage nvme - tcp
🚧 ⚡⚡⚡ Storage: swraid mdadm raid_module test
🚧 ⚡⚡⚡ stress: stress-ng
ppc64le:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
⚡⚡⚡ LTP
⚡⚡⚡ Loopdev Sanity
⚡⚡⚡ Memory: fork_mem
⚡⚡⚡ Memory function: memfd_create
⚡⚡⚡ AMTU (Abstract Machine Test Utility)
⚡⚡⚡ Networking bridge: sanity
⚡⚡⚡ Networking socket: fuzz
⚡⚡⚡ Networking route: pmtu
⚡⚡⚡ Networking route_func - local
⚡⚡⚡ Networking route_func - forward
⚡⚡⚡ Networking TCP: keepalive test
⚡⚡⚡ Networking UDP: socket
⚡⚡⚡ Networking tunnel: geneve basic test
⚡⚡⚡ Networking tunnel: gre basic
⚡⚡⚡ L2TP basic test
⚡⚡⚡ Networking tunnel: vxlan basic
⚡⚡⚡ Networking ipsec: basic netns - tunnel
⚡⚡⚡ Libkcapi AF_ALG test
⚡⚡⚡ pciutils: update pci ids test
⚡⚡⚡ ALSA PCM loopback test
⚡⚡⚡ ALSA Control (mixer) Userspace Element test
⚡⚡⚡ trace: ftrace/tracer
🚧 ⚡⚡⚡ CIFS Connectathon
🚧 ⚡⚡⚡ POSIX pjd-fstest suites
🚧 ⚡⚡⚡ jvm - jcstress tests
🚧 ⚡⚡⚡ Memory function: kaslr
🚧 ⚡⚡⚡ Ethernet drivers sanity
🚧 ⚡⚡⚡ Networking firewall: basic netfilter test
🚧 ⚡⚡⚡ audit: audit testsuite test
s390x:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test
⚡⚡⚡ LTP
⚡⚡⚡ Loopdev Sanity
⚡⚡⚡ Memory: fork_mem
⚡⚡⚡ Memory function: memfd_create
⚡⚡⚡ AMTU (Abstract Machine Test Utility)
⚡⚡⚡ Networking bridge: sanity
⚡⚡⚡ Networking route: pmtu
⚡⚡⚡ Networking route_func - local
⚡⚡⚡ Networking route_func - forward
⚡⚡⚡ Networking TCP: keepalive test
⚡⚡⚡ Networking UDP: socket
⚡⚡⚡ Networking tunnel: geneve basic test
⚡⚡⚡ Networking tunnel: gre basic
⚡⚡⚡ L2TP basic test
⚡⚡⚡ Networking tunnel: vxlan basic
⚡⚡⚡ Networking ipsec: basic netns - transport
⚡⚡⚡ Networking ipsec: basic netns - tunnel
⚡⚡⚡ Libkcapi AF_ALG test
⚡⚡⚡ trace: ftrace/tracer
🚧 ⚡⚡⚡ CIFS Connectathon
🚧 ⚡⚡⚡ POSIX pjd-fstest suites
🚧 ⚡⚡⚡ jvm - jcstress tests
🚧 ⚡⚡⚡ Memory function: kaslr
🚧 ⚡⚡⚡ Ethernet drivers sanity
🚧 ⚡⚡⚡ Networking firewall: basic netfilter test
🚧 ⚡⚡⚡ audit: audit testsuite test
x86_64:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
✅ ACPI table test
⚡⚡⚡ LTP
⚡⚡⚡ Loopdev Sanity
⚡⚡⚡ Memory: fork_mem
⚡⚡⚡ Memory function: memfd_create
⚡⚡⚡ AMTU (Abstract Machine Test Utility)
⚡⚡⚡ Networking bridge: sanity
⚡⚡⚡ Networking socket: fuzz
⚡⚡⚡ Networking: igmp conformance test
⚡⚡⚡ Networking route: pmtu
⚡⚡⚡ Networking route_func - local
⚡⚡⚡ Networking route_func - forward
⚡⚡⚡ Networking TCP: keepalive test
⚡⚡⚡ Networking UDP: socket
⚡⚡⚡ Networking tunnel: geneve basic test
⚡⚡⚡ Networking tunnel: gre basic
⚡⚡⚡ L2TP basic test
⚡⚡⚡ Networking tunnel: vxlan basic
⚡⚡⚡ Networking ipsec: basic netns - transport
⚡⚡⚡ Networking ipsec: basic netns - tunnel
⚡⚡⚡ Libkcapi AF_ALG test
⚡⚡⚡ pciutils: sanity smoke test
⚡⚡⚡ pciutils: update pci ids test
⚡⚡⚡ ALSA PCM loopback test
⚡⚡⚡ ALSA Control (mixer) Userspace Element test
⚡⚡⚡ storage: SCSI VPD
⚡⚡⚡ trace: ftrace/tracer
🚧 ⚡⚡⚡ CIFS Connectathon
🚧 ⚡⚡⚡ POSIX pjd-fstest suites
🚧 ⚡⚡⚡ Firmware test suite
🚧 ⚡⚡⚡ jvm - jcstress tests
🚧 ⚡⚡⚡ Memory function: kaslr
🚧 ⚡⚡⚡ Ethernet drivers sanity
🚧 ⚡⚡⚡ Networking firewall: basic netfilter test
🚧 ⚡⚡⚡ audit: audit testsuite test
Test sources: https://gitlab.com/cki-project/kernel-tests
💚 Pull requests are welcome for new tests or improvements to existing tests!
Aborted tests
-------------
Tests that didn't complete running successfully are marked with ⚡⚡⚡.
If this was caused by an infrastructure issue, we try to mark that
explicitly in the report.
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Testing timeout
---------------
We aim to provide a report within reasonable timeframe. Tests that haven't
finished running yet are marked with ⏱.
[backport of commit 182f709c5cff683e6732d04c78e328de0532284f to
4.14-stable; context diff in second hunk]
CCW_CMD_READ_STATUS was introduced with revision 2 of virtio-ccw,
and drivers should only rely on it being implemented when they
negotiated at least that revision with the device.
However, virtio_ccw_get_status() issued READ_STATUS for any
device operating at least at revision 1. If the device accepts
READ_STATUS regardless of the negotiated revision (which some
implementations like QEMU do, even though the spec currently does
not allow it), everything works as intended. While a device
rejecting the command should also be handled gracefully, we will
not be able to see any changes the device makes to the status,
such as setting NEEDS_RESET or setting the status to zero after
a completed reset.
We negotiated the revision to at most 1, as we never bumped the
maximum revision; let's do that now and properly send READ_STATUS
only if we are operating at least at revision 2.
Cc: stable(a)vger.kernel.org
Fixes: 7d3ce5ab9430 ("virtio/s390: support READ_STATUS command for virtio-ccw")
Reviewed-by: Halil Pasic <pasic(a)linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck(a)redhat.com>
Signed-off-by: Vasily Gorbik <gor(a)linux.ibm.com>
Link: https://lore.kernel.org/r/20210216110645.1087321-1-cohuck@redhat.com
Signed-off-by: Vasily Gorbik <gor(a)linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck(a)redhat.com>
---
drivers/s390/virtio/virtio_ccw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index f9cf676a0469..56794b13bb12 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -106,7 +106,7 @@ struct virtio_rev_info {
};
/* the highest virtio-ccw revision we support */
-#define VIRTIO_CCW_REV_MAX 1
+#define VIRTIO_CCW_REV_MAX 2
struct virtio_ccw_vq_info {
struct virtqueue *vq;
@@ -911,7 +911,7 @@ static u8 virtio_ccw_get_status(struct virtio_device *vdev)
u8 old_status = *vcdev->status;
struct ccw1 *ccw;
- if (vcdev->revision < 1)
+ if (vcdev->revision < 2)
return *vcdev->status;
ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
--
2.26.2
The nvhe hyp saves the SPE context, flushing any unwritten
data before we switch to the guest. But this operation is
performed way too late, because :
- The ownership of the SPE is transferred to EL2. i.e,
using EL2 translations. (MDCR_EL2_E2PB == 0)
- The guest Stage1 is loaded.
Thus the flush could use the host EL1 virtual address,
but use the EL2 translations instead. Fix this by
moving the SPE context save early.
i.e, Save the context before we load the guest stage1
and before we change the ownership to EL2.
The restore path is doing the right thing.
Fixes: 014c4c77aad7 ("KVM: arm64: Improve debug register save/restore flow")
Cc: stable(a)vger.kernel.org
Cc: Christoffer Dall <christoffer.dall(a)arm.com>
Cc: Marc Zyngier <maz(a)kernel.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Alexandru Elisei <alexandru.elisei(a)arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com>
---
New patch.
---
arch/arm64/include/asm/kvm_hyp.h | 5 +++++
arch/arm64/kvm/hyp/nvhe/debug-sr.c | 12 ++++++++++--
arch/arm64/kvm/hyp/nvhe/switch.c | 12 +++++++++++-
3 files changed, 26 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index c0450828378b..385bd7dd3d39 100644
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -83,6 +83,11 @@ void sysreg_restore_guest_state_vhe(struct kvm_cpu_context *ctxt);
void __debug_switch_to_guest(struct kvm_vcpu *vcpu);
void __debug_switch_to_host(struct kvm_vcpu *vcpu);
+#ifdef __KVM_NVHE_HYPERVISOR__
+void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu);
+void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu);
+#endif
+
void __fpsimd_save_state(struct user_fpsimd_state *fp_regs);
void __fpsimd_restore_state(struct user_fpsimd_state *fp_regs);
diff --git a/arch/arm64/kvm/hyp/nvhe/debug-sr.c b/arch/arm64/kvm/hyp/nvhe/debug-sr.c
index 91a711aa8382..f401724f12ef 100644
--- a/arch/arm64/kvm/hyp/nvhe/debug-sr.c
+++ b/arch/arm64/kvm/hyp/nvhe/debug-sr.c
@@ -58,16 +58,24 @@ static void __debug_restore_spe(u64 pmscr_el1)
write_sysreg_s(pmscr_el1, SYS_PMSCR_EL1);
}
-void __debug_switch_to_guest(struct kvm_vcpu *vcpu)
+void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu)
{
/* Disable and flush SPE data generation */
__debug_save_spe(&vcpu->arch.host_debug_state.pmscr_el1);
+}
+
+void __debug_switch_to_guest(struct kvm_vcpu *vcpu)
+{
__debug_switch_to_guest_common(vcpu);
}
-void __debug_switch_to_host(struct kvm_vcpu *vcpu)
+void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu)
{
__debug_restore_spe(vcpu->arch.host_debug_state.pmscr_el1);
+}
+
+void __debug_switch_to_host(struct kvm_vcpu *vcpu)
+{
__debug_switch_to_host_common(vcpu);
}
diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c
index f3d0e9eca56c..10eed66136a0 100644
--- a/arch/arm64/kvm/hyp/nvhe/switch.c
+++ b/arch/arm64/kvm/hyp/nvhe/switch.c
@@ -192,6 +192,15 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
pmu_switch_needed = __pmu_switch_to_guest(host_ctxt);
__sysreg_save_state_nvhe(host_ctxt);
+ /*
+ * For nVHE, we must save and disable any SPE
+ * buffers, as the translation regime is going
+ * to be loaded with that of the guest. And we must
+ * save host context for SPE, before we change the
+ * ownership to EL2 (via MDCR_EL2_E2PB == 0) and before
+ * we load guest Stage1.
+ */
+ __debug_save_host_buffers_nvhe(vcpu);
__adjust_pc(vcpu);
@@ -234,11 +243,12 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
if (vcpu->arch.flags & KVM_ARM64_FP_ENABLED)
__fpsimd_save_fpexc32(vcpu);
+ __debug_switch_to_host(vcpu);
/*
* This must come after restoring the host sysregs, since a non-VHE
* system may enable SPE here and make use of the TTBRs.
*/
- __debug_switch_to_host(vcpu);
+ __debug_restore_host_buffers_nvhe(vcpu);
if (pmu_switch_needed)
__pmu_switch_to_host(host_ctxt);
--
2.24.1
USB devices cannot perform DMA and hence have no dma_mask set in their
device structure. Therefore importing dmabuf into a USB-based driver
fails, which breaks joining and mirroring of display in X11.
For USB devices, pick the associated USB controller as attachment device.
This allows the DRM import helpers to perform the DMA setup. If the DMA
controller does not support DMA transfers, we're out of luck and cannot
import. Our current USB-based DRM drivers don't use DMA, so the actual
DMA device is not important.
Drivers should use DRM_GEM_SHMEM_DROVER_OPS_USB to initialize their
instance of struct drm_driver.
Tested by joining/mirroring displays of udl and radeon un der Gnome/X11.
v6:
* implement workaround in DRM drivers and hold reference to
DMA device while USB device is in use
* remove dev_is_usb() (Greg)
* collapse USB helper into usb_intf_get_dma_device() (Alan)
* integrate Daniel's TODO statement (Daniel)
* fix typos (Greg)
v5:
* provide a helper for USB interfaces (Alan)
* add FIXME item to documentation and TODO list (Daniel)
v4:
* implement workaround with USB helper functions (Greg)
* use struct usb_device->bus->sysdev as DMA device (Takashi)
v3:
* drop gem_create_object
* use DMA mask of USB controller, if any (Daniel, Christian, Noralf)
v2:
* move fix to importer side (Christian, Daniel)
* update SHMEM and CMA helpers for new PRIME callbacks
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Fixes: 6eb0233ec2d0 ("usb: don't inherity DMA properties for USB devices")
Tested-by: Pavel Machek <pavel(a)ucw.cz>
Acked-by: Christian König <christian.koenig(a)amd.com>
Acked-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: <stable(a)vger.kernel.org> # v5.10+
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
---
Documentation/gpu/todo.rst | 21 +++++++++++++++++++++
drivers/gpu/drm/tiny/gm12u320.c | 25 +++++++++++++++++++++++++
drivers/gpu/drm/udl/udl_drv.c | 17 +++++++++++++++++
drivers/gpu/drm/udl/udl_drv.h | 1 +
drivers/gpu/drm/udl/udl_main.c | 9 +++++++++
drivers/usb/core/usb.c | 32 ++++++++++++++++++++++++++++++++
include/linux/usb.h | 2 ++
7 files changed, 107 insertions(+)
diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst
index 0631b9b323d5..fdfd6a1081ec 100644
--- a/Documentation/gpu/todo.rst
+++ b/Documentation/gpu/todo.rst
@@ -571,6 +571,27 @@ Contact: Daniel Vetter
Level: Intermediate
+Remove automatic page mapping from dma-buf importing
+----------------------------------------------------
+
+When importing dma-bufs, the dma-buf and PRIME frameworks automatically map
+imported pages into the importer's DMA area. drm_gem_prime_fd_to_handle() and
+drm_gem_prime_handle_to_fd() require that importers call dma_buf_attach()
+even if they never do actual device DMA, but only CPU access through
+dma_buf_vmap(). This is a problem for USB devices, which do not support DMA
+operations.
+
+To fix the issue, automatic page mappings should be removed from the
+buffer-sharing code. Fixing this is a bit more involved, since the import/export
+cache is also tied to &drm_gem_object.import_attach. Meanwhile we paper over
+this problem for USB devices by fishing out the USB host controller device, as
+long as that supports DMA. Otherwise importing can still needlessly fail.
+
+Contact: Thomas Zimmermann <tzimmermann(a)suse.de>, Daniel Vetter
+
+Level: Advanced
+
+
Better Testing
==============
diff --git a/drivers/gpu/drm/tiny/gm12u320.c b/drivers/gpu/drm/tiny/gm12u320.c
index 0b4f4f2af1ef..48b5b06f70e8 100644
--- a/drivers/gpu/drm/tiny/gm12u320.c
+++ b/drivers/gpu/drm/tiny/gm12u320.c
@@ -84,6 +84,7 @@ MODULE_PARM_DESC(eco_mode, "Turn on Eco mode (less bright, more silent)");
struct gm12u320_device {
struct drm_device dev;
+ struct device *dmadev;
struct drm_simple_display_pipe pipe;
struct drm_connector conn;
unsigned char *cmd_buf;
@@ -599,6 +600,22 @@ static const uint64_t gm12u320_pipe_modifiers[] = {
DRM_FORMAT_MOD_INVALID
};
+/*
+ * FIXME: Dma-buf sharing requires DMA support by the importing device.
+ * This function is a workaround to make USB devices work as well.
+ * See todo.rst for how to fix the issue in the dma-buf framework.
+ */
+static struct drm_gem_object *gm12u320_gem_prime_import(struct drm_device *dev,
+ struct dma_buf *dma_buf)
+{
+ struct gm12u320_device *gm12u320 = to_gm12u320(dev);
+
+ if (!gm12u320->dmadev)
+ return ERR_PTR(-ENODEV);
+
+ return drm_gem_prime_import_dev(dev, dma_buf, gm12u320->dmadev);
+}
+
DEFINE_DRM_GEM_FOPS(gm12u320_fops);
static const struct drm_driver gm12u320_drm_driver = {
@@ -612,6 +629,7 @@ static const struct drm_driver gm12u320_drm_driver = {
.fops = &gm12u320_fops,
DRM_GEM_SHMEM_DRIVER_OPS,
+ .gem_prime_import = gm12u320_gem_prime_import,
};
static const struct drm_mode_config_funcs gm12u320_mode_config_funcs = {
@@ -639,6 +657,10 @@ static int gm12u320_usb_probe(struct usb_interface *interface,
if (IS_ERR(gm12u320))
return PTR_ERR(gm12u320);
+ gm12u320->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev));
+ if (!gm12u320->dmadev)
+ drm_warn(dev, "buffer sharing not supported"); /* not an error */
+
INIT_DELAYED_WORK(&gm12u320->fb_update.work, gm12u320_fb_update_work);
mutex_init(&gm12u320->fb_update.lock);
@@ -691,7 +713,10 @@ static int gm12u320_usb_probe(struct usb_interface *interface,
static void gm12u320_usb_disconnect(struct usb_interface *interface)
{
struct drm_device *dev = usb_get_intfdata(interface);
+ struct gm12u320_device *gm12u320 = to_gm12u320(dev);
+ put_device(gm12u320->dmadev);
+ gm12u320->dmadev = NULL;
drm_dev_unplug(dev);
drm_atomic_helper_shutdown(dev);
}
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 9269092697d8..5703277c6f52 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -32,6 +32,22 @@ static int udl_usb_resume(struct usb_interface *interface)
return drm_mode_config_helper_resume(dev);
}
+/*
+ * FIXME: Dma-buf sharing requires DMA support by the importing device.
+ * This function is a workaround to make USB devices work as well.
+ * See todo.rst for how to fix the issue in the dma-buf framework.
+ */
+static struct drm_gem_object *udl_driver_gem_prime_import(struct drm_device *dev,
+ struct dma_buf *dma_buf)
+{
+ struct udl_device *udl = to_udl(dev);
+
+ if (!udl->dmadev)
+ return ERR_PTR(-ENODEV);
+
+ return drm_gem_prime_import_dev(dev, dma_buf, udl->dmadev);
+}
+
DEFINE_DRM_GEM_FOPS(udl_driver_fops);
static const struct drm_driver driver = {
@@ -40,6 +56,7 @@ static const struct drm_driver driver = {
/* GEM hooks */
.fops = &udl_driver_fops,
DRM_GEM_SHMEM_DRIVER_OPS,
+ .gem_prime_import = udl_driver_gem_prime_import,
.name = DRIVER_NAME,
.desc = DRIVER_DESC,
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index 875e73551ae9..cc16a13316e4 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -50,6 +50,7 @@ struct urb_list {
struct udl_device {
struct drm_device drm;
struct device *dev;
+ struct device *dmadev;
struct drm_simple_display_pipe display_pipe;
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 0e2a376cb075..7c0338bcadea 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -315,6 +315,10 @@ int udl_init(struct udl_device *udl)
DRM_DEBUG("\n");
+ udl->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev));
+ if (!udl->dmadev)
+ drm_warn(dev, "buffer sharing not supported"); /* not an error */
+
mutex_init(&udl->gem_lock);
if (!udl_parse_vendor_descriptor(udl)) {
@@ -349,6 +353,11 @@ int udl_init(struct udl_device *udl)
int udl_drop_usb(struct drm_device *dev)
{
+ struct udl_device *udl = to_udl(dev);
+
udl_free_urb_list(dev);
+ put_device(udl->dmadev);
+ udl->dmadev = NULL;
+
return 0;
}
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 8f07b0516100..a566bb494e24 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -748,6 +748,38 @@ void usb_put_intf(struct usb_interface *intf)
}
EXPORT_SYMBOL_GPL(usb_put_intf);
+/**
+ * usb_intf_get_dma_device - acquire a reference on the usb interface's DMA endpoint
+ * @intf: the usb interface
+ *
+ * While a USB device cannot perform DMA operations by itself, many USB
+ * controllers can. A call to usb_intf_get_dma_device() returns the DMA endpoint
+ * for the given USB interface, if any. The returned device structure must be
+ * released with put_device().
+ *
+ * See also usb_get_dma_device().
+ *
+ * Returns: A reference to the usb interface's DMA endpoint; or NULL if none
+ * exists.
+ */
+struct device *usb_intf_get_dma_device(struct usb_interface *intf)
+{
+ struct usb_device *udev = interface_to_usbdev(intf);
+ struct device *dmadev;
+
+ if (!udev->bus)
+ return NULL;
+
+ dmadev = get_device(udev->bus->sysdev);
+ if (!dmadev || !dmadev->dma_mask) {
+ put_device(dmadev);
+ return NULL;
+ }
+
+ return dmadev;
+}
+EXPORT_SYMBOL_GPL(usb_intf_get_dma_device);
+
/* USB device locking
*
* USB devices and interfaces are locked using the semaphore in their
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 7d72c4e0713c..d6a41841b93e 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -746,6 +746,8 @@ extern int usb_lock_device_for_reset(struct usb_device *udev,
extern int usb_reset_device(struct usb_device *dev);
extern void usb_queue_reset_device(struct usb_interface *dev);
+extern struct device *usb_intf_get_dma_device(struct usb_interface *intf);
+
#ifdef CONFIG_ACPI
extern int usb_acpi_set_power_state(struct usb_device *hdev, int index,
bool enable);
--
2.30.1
This is the start of the stable review cycle for the 4.9.259 release.
There are 134 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.259-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.259-rc1
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Update in-core bitset after committing the metadata
Jason A. Donenfeld <Jason(a)zx2c4.com>
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
Leon Romanovsky <leonro(a)nvidia.com>
ipv6: silence compilation warning for non-IPV6 builds
Eric Dumazet <edumazet(a)google.com>
ipv6: icmp6: avoid indirect call for icmpv6_send()
Jason A. Donenfeld <Jason(a)zx2c4.com>
sunvnet: use icmp_ndo_send helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
gtp: use icmp_ndo_send helper
Jason A. Donenfeld <Jason(a)zx2c4.com>
icmp: introduce helper for nat'd source address in network device context
Thomas Gleixner <tglx(a)linutronix.de>
futex: fix dead code in attach_to_pi_owner()
Peter Zijlstra <peterz(a)infradead.org>
futex: Fix OWNER_DEAD fixup
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: only resize metadata in preresume
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Reinitialize bitset cache before digesting a new writeset
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Use correct value size in equality function of writeset tree
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Fix bitset memory leaks
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Verify the data block size hasn't changed
Nikos Tsironis <ntsironis(a)arrikto.com>
dm era: Recover committed writeset after crash
Bob Peterson <rpeterso(a)redhat.com>
gfs2: Don't skip dlm unlock if glock has an lvb
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a user-triggerable oops in clear_user()
Chao Yu <yuchao0(a)huawei.com>
f2fs: fix out-of-repair __setattr_copy()
Maxim Kiselev <bigunclemax(a)gmail.com>
gpio: pcf857x: Fix missing first interrupt
Frank Li <Frank.Li(a)nxp.com>
mmc: sdhci-esdhc-imx: fix kernel panic when remove module
Fangrui Song <maskray(a)google.com>
module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
Dan Williams <dan.j.williams(a)intel.com>
libnvdimm/dimm: Avoid race between probe and available_slots_show()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop()
Muchun Song <songmuchun(a)bytedance.com>
mm: hugetlb: fix a race between freeing and dissolving the page
Pan Bian <bianpan2016(a)163.com>
mtd: spi-nor: hisi-sfc: Put child node np on error path
Jiri Kosina <jkosina(a)suse.cz>
floppy: reintroduce O_NDELAY fix
Sean Christopherson <seanjc(a)google.com>
x86/reboot: Force all cpus to exit VMX root if VMX is supported
Martin Kaiser <martin(a)kaiser.cx>
staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
Sabyrzhan Tasbolatov <snovitoll(a)gmail.com>
drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
Paul Cercueil <paul(a)crapouillou.net>
seccomp: Add missing return in non-void function
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix extent buffer leak on failure to copy root
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix reloc root leak with 0 ref reloc roots on recovery
Josef Bacik <josef(a)toxicpanda.com>
btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root
Jarkko Sakkinen <jarkko(a)kernel.org>
KEYS: trusted: Fix migratable=1 failing
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7720: fix error code in mos7720_write()
Dan Carpenter <dan.carpenter(a)oracle.com>
USB: serial: mos7840: fix error code in mos7840_write()
Paul Cercueil <paul(a)crapouillou.net>
usb: musb: Fix runtime PM race in musb_queue_resume_work
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: update interface mapping for ZTE P685M
Marcos Paulo de Souza <mpdesouza(a)suse.com>
Input: i8042 - add ASUS Zenbook Flip to noselftest list
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: joydev - prevent potential read overflow in ioctl
Olivier Crête <olivier.crete(a)ocrete.ca>
Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S
jeffrey.lin <jeffrey.lin(a)rad-ic.com>
Input: raydium_ts_i2c - do not send zero length
Qinglang Miao <miaoqinglang(a)huawei.com>
ACPI: configfs: add missing check after configfs_register_default_group()
Mikulas Patocka <mpatocka(a)redhat.com>
blk-settings: align max_sectors on "logical_block_size" boundary
Randy Dunlap <rdunlap(a)infradead.org>
scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
Maxime Ripard <maxime(a)cerno.tech>
i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
Marc Zyngier <maz(a)kernel.org>
arm64: Add missing ISB after invalidating TLB in __primary_switch
Miaohe Lin <linmiaohe(a)huawei.com>
mm/hugetlb: fix potential double free in hugetlb_register_node() error path
Miaohe Lin <linmiaohe(a)huawei.com>
mm/memory.c: fix potential pte_unmap_unlock pte error
Dan Carpenter <dan.carpenter(a)oracle.com>
ocfs2: fix a use after free on error
Chuhong Yuan <hslester96(a)gmail.com>
net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
Jann Horn <jannh(a)google.com>
Take mmap lock in cacheflush syscall
Slawomir Laba <slawomirx.laba(a)intel.com>
i40e: Fix flow for IPv6 next header (extension header)
Konrad Dybcio <konrad.dybcio(a)somainline.org>
drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
Heiner Kallweit <hkallweit1(a)gmail.com>
PCI: Align checking of syscall user config accessors
Jorgen Hansen <jhansen(a)vmware.com>
VMCI: Use set_page_dirty_lock() when unregistering guest memory
Simon South <simon(a)simonsouth.net>
pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare()
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Fix module alias to enable module autoprobe
Randy Dunlap <rdunlap(a)infradead.org>
sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
Dan Carpenter <dan.carpenter(a)oracle.com>
Input: elo - fix an error code in elo_connect()
Namhyung Kim <namhyung(a)kernel.org>
perf test: Fix unaligned access in sample parsing test
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix missing CYC processing in PSB
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
spi: pxa2xx: Fix the controller numbering for Wildcat Point
Nathan Lynch <nathanl(a)linux.ibm.com>
powerpc/pseries/dlpar: handle ibm, configure-connector delay status
Dan Carpenter <dan.carpenter(a)oracle.com>
mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
Bob Pearson <rpearsonhpe(a)gmail.com>
RDMA/rxe: Fix coding error in rxe_recv.c
Arnaldo Carvalho de Melo <acme(a)redhat.com>
perf tools: Fix DSO filtering when not finding a map for a sampled address
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracepoint: Do not fail unregistering a probe due to memory failure
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
amba: Fix resource leak for drivers without .remove
Vladimir Murzin <vladimir.murzin(a)arm.com>
ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/47x: Disable 256k page size
Shay Drory <shayd(a)nvidia.com>
IB/umad: Return EIO in case of when device disassociated
Pan Bian <bianpan2016(a)163.com>
isofs: release buffer head before return
Pan Bian <bianpan2016(a)163.com>
regulator: axp20x: Fix reference cout leak
Tom Rix <trix(a)redhat.com>
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
Claudiu Beznea <claudiu.beznea(a)microchip.com>
power: reset: at91-sama5d2_shdwc: fix wkupdbc mask
Nicolas Boichat <drinkcat(a)chromium.org>
of/fdt: Make sure no-map does not remove already reserved regions
KarimAllah Ahmed <karahmed(a)amazon.de>
fdt: Properly handle "no-map" field in the memory region
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
dmaengine: fsldma: Fix a resource leak in the remove function
Randy Dunlap <rdunlap(a)infradead.org>
HID: core: detect and skip invalid inputs to snto32()
Pratyush Yadav <p.yadav(a)ti.com>
spi: cadence-quadspi: Abort read if dummy cycles required are too many
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL
Tom Rix <trix(a)redhat.com>
jffs2: fix use after free in jffs2_sum_write_data()
Colin Ian King <colin.king(a)canonical.com>
fs/jfs: fix potential integer overflow on shift of a int
Daniele Alessandrelli <daniele.alessandrelli(a)intel.com>
crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
Zhihao Cheng <chengzhihao1(a)huawei.com>
btrfs: clarify error returns values in __load_free_space_cache
Florian Fainelli <f.fainelli(a)gmail.com>
ata: ahci_brcm: Add back regulators management
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
Tom Rix <trix(a)redhat.com>
media: pxa_camera: declare variable when DEBUG is defined
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
media: cx25821: Fix a bug when reallocating some dma memory
Luo Meng <luomeng12(a)huawei.com>
media: qm1d1c0042: fix error return code in qm1d1c0042_init()
Joe Perches <joe(a)perches.com>
media: lmedm04: Fix misuse of comma
Dan Carpenter <dan.carpenter(a)oracle.com>
ASoC: cs42l56: fix up error handling in probe
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: tm6000: Fix memleak in tm6000_start_stream
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
media: media/pci: Fix memleak in empress_init
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
media: vsp1: Fix an error handling path in the probe function
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
Nathan Chancellor <natechancellor(a)gmail.com>
MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
Dan Carpenter <dan.carpenter(a)oracle.com>
gma500: clean up error handling in init
Jialin Zhang <zhangjialin11(a)huawei.com>
drm/gma500: Fix error return code in psb_driver_load()
Randy Dunlap <rdunlap(a)infradead.org>
fbdev: aty: SPARC64 requires FB_ATY_CT
Colin Ian King <colin.king(a)canonical.com>
b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
Colin Ian King <colin.king(a)canonical.com>
mac80211: fix potential overflow when multiplying to u32 integers
Juergen Gross <jgross(a)suse.com>
xen/netback: fix spurious event detection for common event case
Edwin Peer <edwin.peer(a)broadcom.com>
bnxt_en: reverse order of TX disable and carrier off
Arnd Bergmann <arnd(a)arndb.de>
ARM: s3c: fix fiq for clang IAS
Vincent Knecht <vincent.knecht(a)mailoo.org>
arm64: dts: msm8916: Fix reserved and rfsa nodes unit address
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Make "trimming xfer length" a debug message
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Abort transaction after errors with unknown reason
Guenter Roeck <linux(a)roeck-us.net>
usb: dwc2: Do not update data length if it is 0 on inbound transfers
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Configure missing thermal interrupt for 4430
Pan Bian <bianpan2016(a)163.com>
Bluetooth: Put HCI device if inquiry procedure interrupts
Pan Bian <bianpan2016(a)163.com>
Bluetooth: drop HCI device reference before return
Krzysztof Kozlowski <krzk(a)kernel.org>
arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
Christopher William Snowhill <chris(a)kode54.net>
Bluetooth: Fix initializing response id after clearing struct
Vlastimil Babka <vbabka(a)suse.cz>
mm, thp: make do_huge_pmd_wp_page() lock page for testing mapcount
Eric Biggers <ebiggers(a)google.com>
random: fix the RNDRESEEDCRNG ioctl
Alexander Lobakin <alobakin(a)pm.me>
MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
Sumit Garg <sumit.garg(a)linaro.org>
kdb: Make memory allocations more robust
Rong Chen <rong.a.chen(a)intel.com>
scripts/recordmcount.pl: support big endian for ARCH sh
Shyam Prasad N <sprasad(a)microsoft.com>
cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath.
Christoph Schemmel <christoph.schemmel(a)gmail.com>
NET: usb: qmi_wwan: Adding support for Cinterion MV31
Sameer Pujar <spujar(a)nvidia.com>
arm64: tegra: Add power-domain for Tegra210 HDA
Corinna Vinschen <vinschen(a)redhat.com>
igb: Remove incorrect "unexpected SYS WRAP" log message
Rustam Kovhaev <rkovhaev(a)gmail.com>
ntfs: check for valid standard information attribute
Stefan Ursella <stefan.ursella(a)wolfvision.net>
usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable
Will McVicker <willmcvicker(a)google.com>
HID: make arrays usage and value to be the same
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/compressed/head.S | 4 +-
arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
arch/arm/boot/dts/omap443x.dtsi | 2 +
arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +-
arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1 +
arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +-
arch/arm64/kernel/head.S | 1 +
arch/mips/kernel/vmlinux.lds.S | 1 +
arch/mips/lantiq/irq.c | 2 +-
arch/mips/mm/c-r4k.c | 2 +-
arch/nios2/kernel/sys_nios2.c | 11 ++-
arch/powerpc/Kconfig | 2 +-
arch/powerpc/platforms/pseries/dlpar.c | 7 +-
arch/sparc/Kconfig | 2 +-
arch/sparc/lib/memset.S | 1 +
arch/x86/kernel/reboot.c | 29 +++----
block/blk-settings.c | 12 +++
crypto/ecdh_helper.c | 3 +
drivers/acpi/acpi_configfs.c | 7 +-
drivers/amba/bus.c | 20 +++--
drivers/ata/ahci_brcm.c | 14 +++-
drivers/block/floppy.c | 27 ++++---
drivers/char/random.c | 2 +-
drivers/clk/meson/clk-pll.c | 2 +-
drivers/clocksource/mxs_timer.c | 5 +-
drivers/dma/fsldma.c | 6 ++
drivers/gpio/gpio-pcf857x.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 ++---
drivers/gpu/drm/gma500/psb_drv.c | 2 +
drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +-
drivers/hid/hid-core.c | 9 ++-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/infiniband/core/user_mad.c | 7 +-
drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++-
drivers/input/joydev.c | 7 +-
drivers/input/joystick/xpad.c | 1 +
drivers/input/serio/i8042-x86ia64io.h | 4 +
drivers/input/touchscreen/elo.c | 4 +-
drivers/input/touchscreen/raydium_i2c_ts.c | 3 +-
drivers/md/dm-era-target.c | 93 ++++++++++++++--------
drivers/media/pci/cx25821/cx25821-core.c | 4 +-
drivers/media/pci/saa7134/saa7134-empress.c | 5 +-
drivers/media/platform/pxa_camera.c | 3 +
drivers/media/platform/vsp1/vsp1_drv.c | 4 +-
drivers/media/tuners/qm1d1c0042.c | 4 +-
drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
drivers/media/usb/tm6000/tm6000-dvb.c | 4 +
drivers/media/usb/uvc/uvc_v4l2.c | 18 ++---
drivers/mfd/wm831x-auxadc.c | 3 +-
drivers/misc/eeprom/eeprom_93xx46.c | 1 +
drivers/misc/vmw_vmci/vmci_queue_pair.c | 5 +-
drivers/mmc/host/sdhci-esdhc-imx.c | 3 +-
drivers/mmc/host/usdhi6rol0.c | 4 +-
drivers/mtd/spi-nor/cadence-quadspi.c | 2 +-
drivers/mtd/spi-nor/hisi-sfc.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 ++-
drivers/net/ethernet/intel/igb/igb_main.c | 2 -
.../net/ethernet/mellanox/mlx4/resource_tracker.c | 1 +
drivers/net/ethernet/sun/sunvnet_common.c | 24 +-----
drivers/net/gtp.c | 5 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/wireless/broadcom/b43/phy_n.c | 2 +-
drivers/net/xen-netback/interface.c | 8 +-
drivers/nvdimm/dimm_devs.c | 18 ++++-
drivers/of/fdt.c | 12 ++-
drivers/pci/syscall.c | 10 +--
drivers/power/reset/at91-sama5d2_shdwc.c | 2 +-
drivers/pwm/pwm-rockchip.c | 1 -
drivers/regulator/axp20x-regulator.c | 7 +-
drivers/scsi/bnx2fc/Kconfig | 1 +
drivers/spi/spi-pxa2xx-pci.c | 27 +++++--
drivers/spi/spi-s3c24xx-fiq.S | 9 +--
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc2/hcd.c | 15 ++--
drivers/usb/dwc2/hcd_intr.c | 14 +++-
drivers/usb/dwc3/gadget.c | 19 ++++-
drivers/usb/musb/musb_core.c | 31 ++++----
drivers/usb/renesas_usbhs/fifo.c | 2 +
drivers/usb/serial/mos7720.c | 4 +-
drivers/usb/serial/mos7840.c | 4 +-
drivers/usb/serial/option.c | 3 +-
drivers/video/fbdev/Kconfig | 2 +-
fs/btrfs/ctree.c | 7 +-
fs/btrfs/free-space-cache.c | 6 +-
fs/btrfs/relocation.c | 4 +-
fs/cifs/connect.c | 1 +
fs/f2fs/file.c | 3 +-
fs/gfs2/lock_dlm.c | 8 +-
fs/isofs/dir.c | 1 +
fs/isofs/namei.c | 1 +
fs/jffs2/summary.c | 3 +
fs/jfs/jfs_dmap.c | 2 +-
fs/ntfs/inode.c | 6 ++
fs/ocfs2/cluster/heartbeat.c | 8 +-
include/linux/icmpv6.h | 44 +++++++++-
include/linux/ipv6.h | 2 +-
include/net/icmp.h | 10 +++
kernel/debug/kdb/kdb_private.h | 2 +-
kernel/futex.c | 12 +--
kernel/module.c | 21 ++++-
kernel/seccomp.c | 2 +
kernel/tracepoint.c | 80 +++++++++++++++----
mm/huge_memory.c | 15 ++++
mm/hugetlb.c | 43 +++++++++-
mm/memory.c | 6 +-
net/bluetooth/a2mp.c | 3 +-
net/bluetooth/hci_core.c | 6 +-
net/ipv4/icmp.c | 34 ++++++++
net/ipv6/icmp.c | 19 ++---
net/ipv6/ip6_icmp.c | 46 +++++++++--
net/mac80211/mesh_hwmp.c | 2 +-
scripts/recordmcount.pl | 6 +-
security/keys/trusted.c | 2 +-
sound/soc/codecs/cs42l56.c | 3 +-
tools/perf/tests/sample-parsing.c | 2 +-
tools/perf/util/event.c | 2 +
.../perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +
121 files changed, 763 insertions(+), 304 deletions(-)
This is a note to let you know that I've just added the patch titled
usb: gadget: f_uac1: stop playback on function disable
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 466b4bed6798e912264325bb4d90dfcd3a8a9128 Mon Sep 17 00:00:00 2001
From: Ruslan Bilovol <ruslan.bilovol(a)gmail.com>
Date: Mon, 1 Mar 2021 13:49:32 +0200
Subject: usb: gadget: f_uac1: stop playback on function disable
There is missing playback stop/cleanup in case of
gadget's ->disable callback that happens on
events like USB host resetting or gadget disconnection
Fixes: 0591bc236015 ("usb: gadget: add f_uac1 variant based on a new u_audio api")
Cc: <stable(a)vger.kernel.org> # 4.13+
Signed-off-by: Ruslan Bilovol <ruslan.bilovol(a)gmail.com>
Link: https://lore.kernel.org/r/1614599375-8803-3-git-send-email-ruslan.bilovol@g…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/gadget/function/f_uac1.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 00d346965f7a..560382e0a8f3 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -499,6 +499,7 @@ static void f_audio_disable(struct usb_function *f)
uac1->as_out_alt = 0;
uac1->as_in_alt = 0;
+ u_audio_stop_playback(&uac1->g_audio);
u_audio_stop_capture(&uac1->g_audio);
}
--
2.30.1
This is a note to let you know that I've just added the patch titled
usb: gadget: f_uac2: always increase endpoint max_packet_size by one
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 089a8b8c66349bc065ea9e865c68872e7cac8bf1 Mon Sep 17 00:00:00 2001
From: Ruslan Bilovol <ruslan.bilovol(a)gmail.com>
Date: Mon, 1 Mar 2021 13:49:31 +0200
Subject: usb: gadget: f_uac2: always increase endpoint max_packet_size by one
audio slot
As per UAC2 Audio Data Formats spec (2.3.1.1 USB Packets),
if the sampling rate is a constant, the allowable variation
of number of audio slots per virtual frame is +/- 1 audio slot.
It means that endpoint should be able to accept/send +1 audio
slot.
Previous endpoint max_packet_size calculation code
was adding sometimes +1 audio slot due to DIV_ROUND_UP
behaviour which was rounding up to closest integer.
However this doesn't work if the numbers are divisible.
It had no any impact with Linux hosts which ignore
this issue, but in case of more strict Windows it
caused rejected enumeration
Thus always add +1 audio slot to endpoint's max packet size
Fixes: 913e4a90b6f9 ("usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth")
Cc: Peter Chen <peter.chen(a)freescale.com>
Cc: <stable(a)vger.kernel.org> #v4.3+
Signed-off-by: Ruslan Bilovol <ruslan.bilovol(a)gmail.com>
Link: https://lore.kernel.org/r/1614599375-8803-2-git-send-email-ruslan.bilovol@g…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/gadget/function/f_uac2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 5d960b6603b6..6f03e944e0e3 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -478,7 +478,7 @@ static int set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
}
max_size_bw = num_channels(chmask) * ssize *
- DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1)));
+ ((srate / (factor / (1 << (ep_desc->bInterval - 1)))) + 1);
ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw,
max_size_ep));
--
2.30.1
This is a note to let you know that I've just added the patch titled
usb: dwc3: qcom: add ACPI device id for sc8180x
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 1016ecc84404411e39849cfc0d8b6f77cb1a8c96 Mon Sep 17 00:00:00 2001
From: Shawn Guo <shawn.guo(a)linaro.org>
Date: Mon, 1 Mar 2021 15:57:45 +0800
Subject: usb: dwc3: qcom: add ACPI device id for sc8180x
It enables USB Host support for sc8180x ACPI boot, both the standalone
one and the one behind URS (USB Role Switch). And they share the
the same dwc3_acpi_pdata with sdm845.
Signed-off-by: Shawn Guo <shawn.guo(a)linaro.org>
Link: https://lore.kernel.org/r/20210301075745.20544-1-shawn.guo@linaro.org
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/dwc3/dwc3-qcom.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 846a47be6df7..d8850f9ccb62 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -938,6 +938,8 @@ static const struct dwc3_acpi_pdata sdm845_acpi_urs_pdata = {
static const struct acpi_device_id dwc3_qcom_acpi_match[] = {
{ "QCOM2430", (unsigned long)&sdm845_acpi_pdata },
{ "QCOM0304", (unsigned long)&sdm845_acpi_urs_pdata },
+ { "QCOM0497", (unsigned long)&sdm845_acpi_urs_pdata },
+ { "QCOM04A6", (unsigned long)&sdm845_acpi_pdata },
{ },
};
MODULE_DEVICE_TABLE(acpi, dwc3_qcom_acpi_match);
--
2.30.1
This is a note to let you know that I've just added the patch titled
USB: gadget: u_ether: Fix a configfs return code
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 1236c1d95c99e9f34cd7547e53af71142a3854ea Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter(a)oracle.com>
Date: Mon, 15 Feb 2021 15:57:16 +0000
Subject: USB: gadget: u_ether: Fix a configfs return code
If the string is invalid, this should return -EINVAL instead of 0.
Fixes: 73517cf49bd4 ("usb: gadget: add RNDIS configfs options for class/subclass/protocol")
Cc: stable <stable(a)vger.kernel.org>
Acked-by: Lorenzo Colitti <lorenzo(a)google.com>
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Link: https://lore.kernel.org/r/YCqZ3P53yyIg5cn7@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/gadget/function/u_ether_configfs.h | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/function/u_ether_configfs.h b/drivers/usb/gadget/function/u_ether_configfs.h
index 3dfb460908fa..f558c3139ebe 100644
--- a/drivers/usb/gadget/function/u_ether_configfs.h
+++ b/drivers/usb/gadget/function/u_ether_configfs.h
@@ -182,12 +182,11 @@ out: \
size_t len) \
{ \
struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
- int ret; \
+ int ret = -EINVAL; \
u8 val; \
\
mutex_lock(&opts->lock); \
- ret = sscanf(page, "%02hhx", &val); \
- if (ret > 0) { \
+ if (sscanf(page, "%02hhx", &val) > 0) { \
opts->_n_ = val; \
ret = len; \
} \
--
2.30.1
This is a note to let you know that I've just added the patch titled
Goodix Fingerprint device is not a modem
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From c9de574e76bc3862f34b9fca77dfb88ceffd2556 Mon Sep 17 00:00:00 2001
From: Yorick de Wid <ydewid(a)gmail.com>
Date: Sat, 13 Feb 2021 15:49:02 +0100
Subject: Goodix Fingerprint device is not a modem
The CDC ACM driver is false matching the Goodix Fingerprint device
against the USB_CDC_ACM_PROTO_AT_V25TER.
The Goodix Fingerprint device is a biometrics sensor that should be
handled in user-space. libfprint has some support for Goodix
fingerprint sensors, although not for this particular one. It is
possible that the vendor allocates a PID per OEM (Lenovo, Dell etc).
If this happens to be the case then more devices from the same vendor
could potentially match the ACM modem module table.
Signed-off-by: Yorick de Wid <ydewid(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20210213144901.53199-1-ydewid@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 37f824b59daa..39ddb5585ded 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1935,6 +1935,11 @@ static const struct usb_device_id acm_ids[] = {
.driver_info = SEND_ZERO_PACKET,
},
+ /* Exclude Goodix Fingerprint Reader */
+ { USB_DEVICE(0x27c6, 0x5395),
+ .driver_info = IGNORE_DEVICE,
+ },
+
/* control interfaces without any protocol set */
{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
USB_CDC_PROTO_NONE) },
--
2.30.1
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From dbfee5aee7e54f83d96ceb8e3e80717fac62ad63 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Date: Wed, 24 Feb 2021 12:07:50 -0800
Subject: [PATCH] hugetlb: fix update_and_free_page contig page struct
assumption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
page structs are not guaranteed to be contiguous for gigantic pages. The
routine update_and_free_page can encounter a gigantic page, yet it assumes
page structs are contiguous when setting page flags in subpages.
If update_and_free_page encounters non-contiguous page structs, we can see
“BUG: Bad page state in process …” errors.
Non-contiguous page structs are generally not an issue. However, they can
exist with a specific kernel configuration and hotplug operations. For
example: Configure the kernel with CONFIG_SPARSEMEM and
!CONFIG_SPARSEMEM_VMEMMAP. Then, hotplug add memory for the area where
the gigantic page will be allocated. Zi Yan outlined steps to reproduce
here [1].
[1] https://lore.kernel.org/linux-mm/16F7C58B-4D79-41C5-9B64-A1A1628F4AF2@nvidi…
Link: https://lkml.kernel.org/r/20210217184926.33567-1-mike.kravetz@oracle.com
Fixes: 944d9fec8d7a ("hugetlb: add support for gigantic page allocation at runtime")
Signed-off-by: Zi Yan <ziy(a)nvidia.com>
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Zi Yan <ziy(a)nvidia.com>
Cc: Davidlohr Bueso <dbueso(a)suse.de>
Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Joao Martins <joao.m.martins(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 6786b313e6ac..3f6a50373d4f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1321,14 +1321,16 @@ static inline void destroy_compound_gigantic_page(struct page *page,
static void update_and_free_page(struct hstate *h, struct page *page)
{
int i;
+ struct page *subpage = page;
if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
return;
h->nr_huge_pages--;
h->nr_huge_pages_node[page_to_nid(page)]--;
- for (i = 0; i < pages_per_huge_page(h); i++) {
- page[i].flags &= ~(1 << PG_locked | 1 << PG_error |
+ for (i = 0; i < pages_per_huge_page(h);
+ i++, subpage = mem_map_next(subpage, page, i)) {
+ subpage->flags &= ~(1 << PG_locked | 1 << PG_error |
1 << PG_referenced | 1 << PG_dirty |
1 << PG_active | 1 << PG_private |
1 << PG_writeback);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From dbfee5aee7e54f83d96ceb8e3e80717fac62ad63 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Date: Wed, 24 Feb 2021 12:07:50 -0800
Subject: [PATCH] hugetlb: fix update_and_free_page contig page struct
assumption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
page structs are not guaranteed to be contiguous for gigantic pages. The
routine update_and_free_page can encounter a gigantic page, yet it assumes
page structs are contiguous when setting page flags in subpages.
If update_and_free_page encounters non-contiguous page structs, we can see
“BUG: Bad page state in process …” errors.
Non-contiguous page structs are generally not an issue. However, they can
exist with a specific kernel configuration and hotplug operations. For
example: Configure the kernel with CONFIG_SPARSEMEM and
!CONFIG_SPARSEMEM_VMEMMAP. Then, hotplug add memory for the area where
the gigantic page will be allocated. Zi Yan outlined steps to reproduce
here [1].
[1] https://lore.kernel.org/linux-mm/16F7C58B-4D79-41C5-9B64-A1A1628F4AF2@nvidi…
Link: https://lkml.kernel.org/r/20210217184926.33567-1-mike.kravetz@oracle.com
Fixes: 944d9fec8d7a ("hugetlb: add support for gigantic page allocation at runtime")
Signed-off-by: Zi Yan <ziy(a)nvidia.com>
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Zi Yan <ziy(a)nvidia.com>
Cc: Davidlohr Bueso <dbueso(a)suse.de>
Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Joao Martins <joao.m.martins(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 6786b313e6ac..3f6a50373d4f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1321,14 +1321,16 @@ static inline void destroy_compound_gigantic_page(struct page *page,
static void update_and_free_page(struct hstate *h, struct page *page)
{
int i;
+ struct page *subpage = page;
if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
return;
h->nr_huge_pages--;
h->nr_huge_pages_node[page_to_nid(page)]--;
- for (i = 0; i < pages_per_huge_page(h); i++) {
- page[i].flags &= ~(1 << PG_locked | 1 << PG_error |
+ for (i = 0; i < pages_per_huge_page(h);
+ i++, subpage = mem_map_next(subpage, page, i)) {
+ subpage->flags &= ~(1 << PG_locked | 1 << PG_error |
1 << PG_referenced | 1 << PG_dirty |
1 << PG_active | 1 << PG_private |
1 << PG_writeback);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From dbfee5aee7e54f83d96ceb8e3e80717fac62ad63 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Date: Wed, 24 Feb 2021 12:07:50 -0800
Subject: [PATCH] hugetlb: fix update_and_free_page contig page struct
assumption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
page structs are not guaranteed to be contiguous for gigantic pages. The
routine update_and_free_page can encounter a gigantic page, yet it assumes
page structs are contiguous when setting page flags in subpages.
If update_and_free_page encounters non-contiguous page structs, we can see
“BUG: Bad page state in process …” errors.
Non-contiguous page structs are generally not an issue. However, they can
exist with a specific kernel configuration and hotplug operations. For
example: Configure the kernel with CONFIG_SPARSEMEM and
!CONFIG_SPARSEMEM_VMEMMAP. Then, hotplug add memory for the area where
the gigantic page will be allocated. Zi Yan outlined steps to reproduce
here [1].
[1] https://lore.kernel.org/linux-mm/16F7C58B-4D79-41C5-9B64-A1A1628F4AF2@nvidi…
Link: https://lkml.kernel.org/r/20210217184926.33567-1-mike.kravetz@oracle.com
Fixes: 944d9fec8d7a ("hugetlb: add support for gigantic page allocation at runtime")
Signed-off-by: Zi Yan <ziy(a)nvidia.com>
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Zi Yan <ziy(a)nvidia.com>
Cc: Davidlohr Bueso <dbueso(a)suse.de>
Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Joao Martins <joao.m.martins(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 6786b313e6ac..3f6a50373d4f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1321,14 +1321,16 @@ static inline void destroy_compound_gigantic_page(struct page *page,
static void update_and_free_page(struct hstate *h, struct page *page)
{
int i;
+ struct page *subpage = page;
if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
return;
h->nr_huge_pages--;
h->nr_huge_pages_node[page_to_nid(page)]--;
- for (i = 0; i < pages_per_huge_page(h); i++) {
- page[i].flags &= ~(1 << PG_locked | 1 << PG_error |
+ for (i = 0; i < pages_per_huge_page(h);
+ i++, subpage = mem_map_next(subpage, page, i)) {
+ subpage->flags &= ~(1 << PG_locked | 1 << PG_error |
1 << PG_referenced | 1 << PG_dirty |
1 << PG_active | 1 << PG_private |
1 << PG_writeback);
If sgx_page_cache_init() fails in the middle, a trivial return statement
causes unused memory and virtual address space reserved for the EPC
section, not freed. Fix this by using the same rollback, as when
sgx_page_reclaimer_init() fails.
Cc: stable(a)vger.kernel.org # 5.11
Fixes: e7e0545299d8 ("x86/sgx: Initialize metadata for Enclave Page Cache (EPC) sections")
Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org>
---
arch/x86/kernel/cpu/sgx/main.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index 8df81a3ed945..52d070fb4c9a 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -708,8 +708,10 @@ static int __init sgx_init(void)
if (!cpu_feature_enabled(X86_FEATURE_SGX))
return -ENODEV;
- if (!sgx_page_cache_init())
- return -ENOMEM;
+ if (!sgx_page_cache_init()) {
+ ret = -ENOMEM;
+ goto err_page_cache;
+ }
if (!sgx_page_reclaimer_init()) {
ret = -ENOMEM;
--
2.30.1
some binary, for example the output of golang, may be mark as FPXX,
while in fact they are still FP32.
Since FPXX binary can work with both FR=1 and FR=0, we introduce a
config option CONFIG_MIPS_O32_FPXX_USE_FR0 to force it to use FR=0 here.
https://go-review.googlesource.com/c/go/+/239217https://go-review.googlesource.com/c/go/+/237058
v3->v4:
introduce a config option: CONFIG_MIPS_O32_FPXX_USE_FR0
v2->v3:
commit message: add Signed-off-by and Cc to stable.
v1->v2:
Fix bad commit message: in fact, we are switching to FR=0
Signed-off-by: YunQiang Su <yunqiang.su(a)cipunited.com>
Cc: stable(a)vger.kernel.org # 4.19+
---
arch/mips/Kconfig | 11 +++++++++++
arch/mips/kernel/elf.c | 13 ++++++++++---
2 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 0a17bedf4f0d..442db620636f 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -3100,6 +3100,17 @@ config MIPS_O32_FP64_SUPPORT
If unsure, say N.
+config MIPS_O32_FPXX_USE_FR0
+ bool "Use FR=0 mode for O32 FPXX binaries" if !CPU_MIPSR6
+ depends on MIPS_O32_FP64_SUPPORT
+ help
+ O32 FPXX can works on both FR=0 and FR=1 mode, so by default, the
+ mode preferred by hardware is used.
+
+ While some binaries may be marked as FPXX by mistake, for example
+ output of golang: they are in fact FP32 mode. To compatiable with
+ these binaries, we should use FR=0 mode for them.
+
config USE_OF
bool
select OF
diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
index 7b045d2a0b51..443ced26ee60 100644
--- a/arch/mips/kernel/elf.c
+++ b/arch/mips/kernel/elf.c
@@ -234,9 +234,10 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr,
* fpxx case. This is because, in any-ABI (or no-ABI) we have no FPU
* instructions so we don't care about the mode. We will simply use
* the one preferred by the hardware. In fpxx case, that ABI can
- * handle both FR=1 and FR=0, so, again, we simply choose the one
- * preferred by the hardware. Next, if we only use single-precision
- * FPU instructions, and the default ABI FPU mode is not good
+ * handle both FR=1 and FR=0. Here, we may need to use FR=0, because
+ * some binaries may be mark as FPXX by mistake (ie, output of golang).
+ * - If we only use single-precision FPU instructions,
+ * and the default ABI FPU mode is not good
* (ie single + any ABI combination), we set again the FPU mode to the
* one is preferred by the hardware. Next, if we know that the code
* will only use single-precision instructions, shown by single being
@@ -248,8 +249,14 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr,
*/
if (prog_req.fre && !prog_req.frdefault && !prog_req.fr1)
state->overall_fp_mode = FP_FRE;
+#if CONFIG_MIPS_O32_FPXX_USE_FR0
+ else if (prog_req.fr1 && prog_req.frdefault)
+ state->overall_fp_mode = FP_FR0;
+ else if (prog_req.single && !prog_req.frdefault)
+#else
else if ((prog_req.fr1 && prog_req.frdefault) ||
(prog_req.single && !prog_req.frdefault))
+#endif
/* Make sure 64-bit MIPS III/IV/64R1 will not pick FR1 */
state->overall_fp_mode = ((raw_current_cpu_data.fpu_id & MIPS_FPIR_F64) &&
cpu_has_mips_r2_r6) ?
--
2.20.1
From: Frieder Schrempf <frieder.schrempf(a)kontron.de>
The driver uses the DVS registers PCA9450_REG_BUCKxOUT_DVS0 to set the
voltage for the buck regulators 1, 2 and 3. This has no effect as the
PRESET_EN bit is set by default and therefore the preset values are used
instead, which are set to 850 mV.
To fix this we clear the PRESET_EN bit at time of initialization.
Fixes: 0935ff5f1f0a ("regulator: pca9450: add pca9450 pmic driver")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Frieder Schrempf <frieder.schrempf(a)kontron.de>
---
Changes in v2:
* Improve comment and commit message
* Use regmap_clear_bits() instead of regmap_update_bits()
* Add error code to log message
---
drivers/regulator/pca9450-regulator.c | 8 ++++++++
include/linux/regulator/pca9450.h | 3 +++
2 files changed, 11 insertions(+)
diff --git a/drivers/regulator/pca9450-regulator.c b/drivers/regulator/pca9450-regulator.c
index 833d398c6aa2..d38109cc3a01 100644
--- a/drivers/regulator/pca9450-regulator.c
+++ b/drivers/regulator/pca9450-regulator.c
@@ -797,6 +797,14 @@ static int pca9450_i2c_probe(struct i2c_client *i2c,
return ret;
}
+ /* Clear PRESET_EN bit in BUCK123_DVS to use DVS registers */
+ ret = regmap_clear_bits(pca9450->regmap, PCA9450_REG_BUCK123_DVS,
+ BUCK123_PRESET_EN);
+ if (ret) {
+ dev_err(&i2c->dev, "Failed to clear PRESET_EN bit: %d\n", ret);
+ return ret;
+ }
+
/* Set reset behavior on assertion of WDOG_B signal */
ret = regmap_update_bits(pca9450->regmap, PCA9450_REG_RESET_CTRL,
WDOG_B_CFG_MASK, WDOG_B_CFG_COLD_LDO12);
diff --git a/include/linux/regulator/pca9450.h b/include/linux/regulator/pca9450.h
index ccdb5320a240..71902f41c919 100644
--- a/include/linux/regulator/pca9450.h
+++ b/include/linux/regulator/pca9450.h
@@ -147,6 +147,9 @@ enum {
#define BUCK6_FPWM 0x04
#define BUCK6_ENMODE_MASK 0x03
+/* PCA9450_REG_BUCK123_PRESET_EN bit */
+#define BUCK123_PRESET_EN 0x80
+
/* PCA9450_BUCK1OUT_DVS0 bits */
#define BUCK1OUT_DVS0_MASK 0x7F
#define BUCK1OUT_DVS0_DEFAULT 0x14
--
2.25.1
On stable rc 5.11 the x86_64 build failed due to below errors/warnings.
drivers/gpu/drm/rcar-du/rcar_du_kms.c: In function 'rcar_du_modeset_cleanup':
drivers/gpu/drm/rcar-du/rcar_du_kms.c:754:32: error: implicit
declaration of function 'to_rcar_du_device'; did you mean
'to_rtc_device'? [-Werror=implicit-function-declaration]
struct rcar_du_device *rcdu = to_rcar_du_device(dev);
^~~~~~~~~~~~~~~~~
to_rtc_device
drivers/gpu/drm/rcar-du/rcar_du_kms.c:754:32: warning: initialization
makes pointer from integer without a cast [-Wint-conversion]
In file included from drivers/gpu/drm/rcar-du/rcar_du_kms.c:17:0:
drivers/gpu/drm/rcar-du/rcar_du_kms.c: In function 'rcar_du_modeset_init':
drivers/gpu/drm/rcar-du/rcar_du_kms.c:781:24: error: passing argument
1 of '__drmm_add_action' from incompatible pointer type
[-Werror=incompatible-pointer-types]
ret = drmm_add_action(&rcdu->ddev, rcar_du_modeset_cleanup, NULL);
^
include/drm/drm_managed.h:25:20: note: in definition of macro 'drmm_add_action'
__drmm_add_action(dev, action, data, #action)
^~~
include/drm/drm_managed.h:27:18: note: expected 'struct drm_device *'
but argument is of type 'struct drm_device **'
int __must_check __drmm_add_action(struct drm_device *dev,
^~~~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Build link,
https://ci.linaro.org/job/openembedded-lkft-linux-stable-rc-5.11/DISTRO=lkf…
--
Linaro LKFT
https://lkft.linaro.org
On stable rc 5.10 the ppc defconfig build failed due to below errors/warnings.
make --silent --keep-going --jobs=8
O=/home/tuxbuild/.cache/tuxmake/builds/1/tmp ARCH=powerpc
CROSS_COMPILE=powerpc64le-linux-gnu- 'CC=sccache
powerpc64le-linux-gnu-gcc' 'HOSTCC=sccache gcc'
arch/powerpc/lib/sstep.c: In function 'analyse_instr':
arch/powerpc/lib/sstep.c:1415:3: error: label 'unknown_opcode' used
but not defined
goto unknown_opcode;
^~~~
make[3]: *** [scripts/Makefile.build:279: arch/powerpc/lib/sstep.o] Error 1
make[3]: Target '__build' not remade because of errors.
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
ref:
https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/106418…https://builds.tuxbuild.com/1pAHVbKxYMdzVk0M9veau5gvF3E/build.log
Steps to reproduce:
---------------------
# TuxMake is a command line tool and Python library that provides
# portable and repeatable Linux kernel builds across a variety of
# architectures, toolchains, kernel configurations, and make targets.
#
# TuxMake supports the concept of runtimes.
# See https://docs.tuxmake.org/runtimes/, for that to work it requires
# that you install podman or docker on your system.
#
# To install tuxmake on your system globally:
# sudo pip3 install -U tuxmake
#
# See https://docs.tuxmake.org/ for complete documentation.
tuxmake --runtime podman --target-arch powerpc --toolchain gcc-9
--kconfig defconfig
--
Linaro LKFT
https://lkft.linaro.org
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 718aae916fa6619c57c348beaedd675835cf1aa1 Mon Sep 17 00:00:00 2001
From: Ananth N Mavinakayanahalli <ananth(a)linux.ibm.com>
Date: Mon, 25 Jan 2021 18:36:43 +0530
Subject: [PATCH] powerpc/sstep: Fix incorrect return from analyze_instr()
We currently just percolate the return value from analyze_instr()
to the caller of emulate_step(), especially if it is a -1.
For one particular case (opcode = 4) for instructions that aren't
currently emulated, we are returning 'should not be single-stepped'
while we should have returned 0 which says 'did not emulate, may
have to single-step'.
Fixes: 930d6288a26787 ("powerpc: sstep: Add support for maddhd, maddhdu, maddld instructions")
Signed-off-by: Ananth N Mavinakayanahalli <ananth(a)linux.ibm.com>
Suggested-by: Michael Ellerman <mpe(a)ellerman.id.au>
Tested-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Reviewed-by: Sandipan Das <sandipan(a)linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Link: https://lore.kernel.org/r/161157999039.64773.14950289716779364766.stgit@thi…
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index f859cbbb6375..e96cff845ef7 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1445,6 +1445,11 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
#ifdef __powerpc64__
case 4:
+ /*
+ * There are very many instructions with this primary opcode
+ * introduced in the ISA as early as v2.03. However, the ones
+ * we currently emulate were all introduced with ISA 3.0
+ */
if (!cpu_has_feature(CPU_FTR_ARCH_300))
goto unknown_opcode;
@@ -1472,7 +1477,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
* There are other instructions from ISA 3.0 with the same
* primary opcode which do not have emulation support yet.
*/
- return -1;
+ goto unknown_opcode;
#endif
case 7: /* mulli */
On stable rc 4.19 arm build failed due to below error.
the config file link provided.
make --silent --keep-going --jobs=8
O=/home/tuxbuild/.cache/tuxmake/builds/1/tmp ARCH=arm
CROSS_COMPILE=arm-linux-gnueabihf- 'CC=sccache
arm-linux-gnueabihf-gcc' 'HOSTCC=sccache gcc'
drivers/crypto/sunxi-ss/sun4i-ss-cipher.c: In function 'sun4i_ss_opti_poll':
drivers/crypto/sunxi-ss/sun4i-ss-cipher.c:139:4: error: implicit
declaration of function 'kfree_sensitive'; did you mean
'kvfree_sensitive'? [-Werror=implicit-function-declaration]
139 | kfree_sensitive(backup_iv);
| ^~~~~~~~~~~~~~~
| kvfree_sensitive
cc1: some warnings being treated as errors
make[4]: *** [scripts/Makefile.build:304:
drivers/crypto/sunxi-ss/sun4i-ss-cipher.o] Error 1
make[4]: Target '__build' not remade because of errors.
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
ref:
https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/106417…
confg:
https://builds.tuxbuild.com/1pAEVBwRxCDBXf85dL6Kki6o8Yf/config
steps to reproduce:
# TuxMake is a command line tool and Python library that provides
# portable and repeatable Linux kernel builds across a variety of
# architectures, toolchains, kernel configurations, and make targets.
#
# TuxMake supports the concept of runtimes.
# See https://docs.tuxmake.org/runtimes/, for that to work it requires
# that you install podman or docker on your system.
#
# To install tuxmake on your system globally:
# sudo pip3 install -U tuxmake
#
# See https://docs.tuxmake.org/ for complete documentation.
tuxmake --runtime podman --target-arch arm --toolchain gcc-9 --kconfig
defconfig --kconfig-add
https://builds.tuxbuild.com/1pAEVBwRxCDBXf85dL6Kki6o8Yf/config
--
Linaro LKFT
https://lkft.linaro.org
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b756f1c8fc9d84e3f546d7ffe056c5352f4aab05 Mon Sep 17 00:00:00 2001
From: Corentin Labbe <clabbe(a)baylibre.com>
Date: Mon, 14 Dec 2020 20:02:27 +0000
Subject: [PATCH] crypto: sun4i-ss - IV register does not work on A10 and A13
Allwinner A10 and A13 SoC have a version of the SS which produce
invalid IV in IVx register.
Instead of adding a variant for those, let's convert SS to produce IV
directly from data.
Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Corentin Labbe <clabbe(a)baylibre.com>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
index f49797588329..c7bf731dad7b 100644
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
@@ -20,6 +20,7 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
unsigned int ivsize = crypto_skcipher_ivsize(tfm);
struct sun4i_cipher_req_ctx *ctx = skcipher_request_ctx(areq);
u32 mode = ctx->mode;
+ void *backup_iv = NULL;
/* when activating SS, the default FIFO space is SS_RX_DEFAULT(32) */
u32 rx_cnt = SS_RX_DEFAULT;
u32 tx_cnt = 0;
@@ -42,6 +43,13 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
return -EINVAL;
}
+ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) {
+ backup_iv = kzalloc(ivsize, GFP_KERNEL);
+ if (!backup_iv)
+ return -ENOMEM;
+ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0);
+ }
+
spin_lock_irqsave(&ss->slock, flags);
for (i = 0; i < op->keylen; i += 4)
@@ -102,9 +110,12 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
} while (oleft);
if (areq->iv) {
- for (i = 0; i < 4 && i < ivsize / 4; i++) {
- v = readl(ss->base + SS_IV0 + i * 4);
- *(u32 *)(areq->iv + i * 4) = v;
+ if (mode & SS_DECRYPTION) {
+ memcpy(areq->iv, backup_iv, ivsize);
+ kfree_sensitive(backup_iv);
+ } else {
+ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize,
+ ivsize, 0);
}
}
@@ -161,6 +172,7 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
unsigned int ileft = areq->cryptlen;
unsigned int oleft = areq->cryptlen;
unsigned int todo;
+ void *backup_iv = NULL;
struct sg_mapping_iter mi, mo;
unsigned int oi, oo; /* offset for in and out */
unsigned int ob = 0; /* offset in buf */
@@ -202,6 +214,13 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
if (need_fallback)
return sun4i_ss_cipher_poll_fallback(areq);
+ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) {
+ backup_iv = kzalloc(ivsize, GFP_KERNEL);
+ if (!backup_iv)
+ return -ENOMEM;
+ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0);
+ }
+
spin_lock_irqsave(&ss->slock, flags);
for (i = 0; i < op->keylen; i += 4)
@@ -322,9 +341,12 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
}
}
if (areq->iv) {
- for (i = 0; i < 4 && i < ivsize / 4; i++) {
- v = readl(ss->base + SS_IV0 + i * 4);
- *(u32 *)(areq->iv + i * 4) = v;
+ if (mode & SS_DECRYPTION) {
+ memcpy(areq->iv, backup_iv, ivsize);
+ kfree_sensitive(backup_iv);
+ } else {
+ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize,
+ ivsize, 0);
}
}
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b756f1c8fc9d84e3f546d7ffe056c5352f4aab05 Mon Sep 17 00:00:00 2001
From: Corentin Labbe <clabbe(a)baylibre.com>
Date: Mon, 14 Dec 2020 20:02:27 +0000
Subject: [PATCH] crypto: sun4i-ss - IV register does not work on A10 and A13
Allwinner A10 and A13 SoC have a version of the SS which produce
invalid IV in IVx register.
Instead of adding a variant for those, let's convert SS to produce IV
directly from data.
Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Corentin Labbe <clabbe(a)baylibre.com>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
index f49797588329..c7bf731dad7b 100644
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
@@ -20,6 +20,7 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
unsigned int ivsize = crypto_skcipher_ivsize(tfm);
struct sun4i_cipher_req_ctx *ctx = skcipher_request_ctx(areq);
u32 mode = ctx->mode;
+ void *backup_iv = NULL;
/* when activating SS, the default FIFO space is SS_RX_DEFAULT(32) */
u32 rx_cnt = SS_RX_DEFAULT;
u32 tx_cnt = 0;
@@ -42,6 +43,13 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
return -EINVAL;
}
+ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) {
+ backup_iv = kzalloc(ivsize, GFP_KERNEL);
+ if (!backup_iv)
+ return -ENOMEM;
+ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0);
+ }
+
spin_lock_irqsave(&ss->slock, flags);
for (i = 0; i < op->keylen; i += 4)
@@ -102,9 +110,12 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
} while (oleft);
if (areq->iv) {
- for (i = 0; i < 4 && i < ivsize / 4; i++) {
- v = readl(ss->base + SS_IV0 + i * 4);
- *(u32 *)(areq->iv + i * 4) = v;
+ if (mode & SS_DECRYPTION) {
+ memcpy(areq->iv, backup_iv, ivsize);
+ kfree_sensitive(backup_iv);
+ } else {
+ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize,
+ ivsize, 0);
}
}
@@ -161,6 +172,7 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
unsigned int ileft = areq->cryptlen;
unsigned int oleft = areq->cryptlen;
unsigned int todo;
+ void *backup_iv = NULL;
struct sg_mapping_iter mi, mo;
unsigned int oi, oo; /* offset for in and out */
unsigned int ob = 0; /* offset in buf */
@@ -202,6 +214,13 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
if (need_fallback)
return sun4i_ss_cipher_poll_fallback(areq);
+ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) {
+ backup_iv = kzalloc(ivsize, GFP_KERNEL);
+ if (!backup_iv)
+ return -ENOMEM;
+ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0);
+ }
+
spin_lock_irqsave(&ss->slock, flags);
for (i = 0; i < op->keylen; i += 4)
@@ -322,9 +341,12 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
}
}
if (areq->iv) {
- for (i = 0; i < 4 && i < ivsize / 4; i++) {
- v = readl(ss->base + SS_IV0 + i * 4);
- *(u32 *)(areq->iv + i * 4) = v;
+ if (mode & SS_DECRYPTION) {
+ memcpy(areq->iv, backup_iv, ivsize);
+ kfree_sensitive(backup_iv);
+ } else {
+ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize,
+ ivsize, 0);
}
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b756f1c8fc9d84e3f546d7ffe056c5352f4aab05 Mon Sep 17 00:00:00 2001
From: Corentin Labbe <clabbe(a)baylibre.com>
Date: Mon, 14 Dec 2020 20:02:27 +0000
Subject: [PATCH] crypto: sun4i-ss - IV register does not work on A10 and A13
Allwinner A10 and A13 SoC have a version of the SS which produce
invalid IV in IVx register.
Instead of adding a variant for those, let's convert SS to produce IV
directly from data.
Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Corentin Labbe <clabbe(a)baylibre.com>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
index f49797588329..c7bf731dad7b 100644
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
@@ -20,6 +20,7 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
unsigned int ivsize = crypto_skcipher_ivsize(tfm);
struct sun4i_cipher_req_ctx *ctx = skcipher_request_ctx(areq);
u32 mode = ctx->mode;
+ void *backup_iv = NULL;
/* when activating SS, the default FIFO space is SS_RX_DEFAULT(32) */
u32 rx_cnt = SS_RX_DEFAULT;
u32 tx_cnt = 0;
@@ -42,6 +43,13 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
return -EINVAL;
}
+ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) {
+ backup_iv = kzalloc(ivsize, GFP_KERNEL);
+ if (!backup_iv)
+ return -ENOMEM;
+ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0);
+ }
+
spin_lock_irqsave(&ss->slock, flags);
for (i = 0; i < op->keylen; i += 4)
@@ -102,9 +110,12 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
} while (oleft);
if (areq->iv) {
- for (i = 0; i < 4 && i < ivsize / 4; i++) {
- v = readl(ss->base + SS_IV0 + i * 4);
- *(u32 *)(areq->iv + i * 4) = v;
+ if (mode & SS_DECRYPTION) {
+ memcpy(areq->iv, backup_iv, ivsize);
+ kfree_sensitive(backup_iv);
+ } else {
+ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize,
+ ivsize, 0);
}
}
@@ -161,6 +172,7 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
unsigned int ileft = areq->cryptlen;
unsigned int oleft = areq->cryptlen;
unsigned int todo;
+ void *backup_iv = NULL;
struct sg_mapping_iter mi, mo;
unsigned int oi, oo; /* offset for in and out */
unsigned int ob = 0; /* offset in buf */
@@ -202,6 +214,13 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
if (need_fallback)
return sun4i_ss_cipher_poll_fallback(areq);
+ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) {
+ backup_iv = kzalloc(ivsize, GFP_KERNEL);
+ if (!backup_iv)
+ return -ENOMEM;
+ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0);
+ }
+
spin_lock_irqsave(&ss->slock, flags);
for (i = 0; i < op->keylen; i += 4)
@@ -322,9 +341,12 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
}
}
if (areq->iv) {
- for (i = 0; i < 4 && i < ivsize / 4; i++) {
- v = readl(ss->base + SS_IV0 + i * 4);
- *(u32 *)(areq->iv + i * 4) = v;
+ if (mode & SS_DECRYPTION) {
+ memcpy(areq->iv, backup_iv, ivsize);
+ kfree_sensitive(backup_iv);
+ } else {
+ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize,
+ ivsize, 0);
}
}
Verify that user applications are not using the kernel RPC message
handle to restrict them from directly attaching to guest OS on the
remote subsystem. This is a port of CVE-2019-2308 fix.
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Cc: Jonathan Marek <jonathan(a)marek.ca>
Cc: stable(a)vger.kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
---
Changes since v1:
- changed to dev_warn_ratelimited to prevent userspace from flooding
kernel log
drivers/misc/fastrpc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f12e909034ac..beda610e6b30 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -950,6 +950,11 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
if (!fl->cctx->rpdev)
return -EPIPE;
+ if (handle == FASTRPC_INIT_HANDLE && !kernel) {
+ dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle);
+ return -EPERM;
+ }
+
ctx = fastrpc_context_alloc(fl, kernel, sc, args);
if (IS_ERR(ctx))
return PTR_ERR(ctx);
--
2.30.0
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 2099b145d77c1d53f5711f029c37cc537897cee6 Mon Sep 17 00:00:00 2001
From: Nikos Tsironis <ntsironis(a)arrikto.com>
Date: Fri, 22 Jan 2021 17:19:31 +0200
Subject: [PATCH] dm era: Update in-core bitset after committing the metadata
In case of a system crash, dm-era might fail to mark blocks as written
in its metadata, although the corresponding writes to these blocks were
passed down to the origin device and completed successfully.
Consider the following sequence of events:
1. We write to a block that has not been yet written in the current era
2. era_map() checks the in-core bitmap for the current era and sees
that the block is not marked as written.
3. The write is deferred for submission after the metadata have been
updated and committed.
4. The worker thread processes the deferred write
(process_deferred_bios()) and marks the block as written in the
in-core bitmap, **before** committing the metadata.
5. The worker thread starts committing the metadata.
6. We do more writes that map to the same block as the write of step (1)
7. era_map() checks the in-core bitmap and sees that the block is marked
as written, **although the metadata have not been committed yet**.
8. These writes are passed down to the origin device immediately and the
device reports them as completed.
9. The system crashes, e.g., power failure, before the commit from step
(5) finishes.
When the system recovers and we query the dm-era target for the list of
written blocks it doesn't report the aforementioned block as written,
although the writes of step (6) completed successfully.
The issue is that era_map() decides whether to defer or not a write
based on non committed information. The root cause of the bug is that we
update the in-core bitmap, **before** committing the metadata.
Fix this by updating the in-core bitmap **after** successfully
committing the metadata.
Fixes: eec40579d84873 ("dm: add era target")
Cc: stable(a)vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis(a)arrikto.com>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index 854b1be8b452..62f679faf9e7 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -134,7 +134,7 @@ static int writeset_test_and_set(struct dm_disk_bitset *info,
{
int r;
- if (!test_and_set_bit(block, ws->bits)) {
+ if (!test_bit(block, ws->bits)) {
r = dm_bitset_set_bit(info, ws->md.root, block, &ws->md.root);
if (r) {
/* FIXME: fail mode */
@@ -1226,8 +1226,10 @@ static void process_deferred_bios(struct era *era)
int r;
struct bio_list deferred_bios, marked_bios;
struct bio *bio;
+ struct blk_plug plug;
bool commit_needed = false;
bool failed = false;
+ struct writeset *ws = era->md->current_writeset;
bio_list_init(&deferred_bios);
bio_list_init(&marked_bios);
@@ -1237,9 +1239,11 @@ static void process_deferred_bios(struct era *era)
bio_list_init(&era->deferred_bios);
spin_unlock(&era->deferred_lock);
+ if (bio_list_empty(&deferred_bios))
+ return;
+
while ((bio = bio_list_pop(&deferred_bios))) {
- r = writeset_test_and_set(&era->md->bitset_info,
- era->md->current_writeset,
+ r = writeset_test_and_set(&era->md->bitset_info, ws,
get_block(era, bio));
if (r < 0) {
/*
@@ -1247,7 +1251,6 @@ static void process_deferred_bios(struct era *era)
* FIXME: finish.
*/
failed = true;
-
} else if (r == 0)
commit_needed = true;
@@ -1263,9 +1266,19 @@ static void process_deferred_bios(struct era *era)
if (failed)
while ((bio = bio_list_pop(&marked_bios)))
bio_io_error(bio);
- else
- while ((bio = bio_list_pop(&marked_bios)))
+ else {
+ blk_start_plug(&plug);
+ while ((bio = bio_list_pop(&marked_bios))) {
+ /*
+ * Only update the in-core writeset if the on-disk one
+ * was updated too.
+ */
+ if (commit_needed)
+ set_bit(get_block(era, bio), ws->bits);
submit_bio_noacct(bio);
+ }
+ blk_finish_plug(&plug);
+ }
}
static void process_rpc_calls(struct era *era)
On a 32-bit fast syscall that fails to read its arguments from user
memory, the kernel currently does syscall exit work but not
syscall entry work. This confuses audit and ptrace. For example:
$ ./tools/testing/selftests/x86/syscall_arg_fault_32
...
strace: pid 264258: entering, ptrace_syscall_info.op == 2
...
This is a minimal fix intended for ease of backporting. A more
complete cleanup is coming.
Cc: stable(a)vger.kernel.org
Fixes: 0b085e68f407 ("x86/entry: Consolidate 32/64 bit syscall entry")
Signed-off-by: Andy Lutomirski <luto(a)kernel.org>
---
arch/x86/entry/common.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index 0904f5676e4d..cf4dcf346ca8 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -128,7 +128,8 @@ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs)
regs->ax = -EFAULT;
instrumentation_end();
- syscall_exit_to_user_mode(regs);
+ local_irq_disable();
+ exit_to_user_mode();
return false;
}
--
2.29.2
When vbus auto discharge is enabled, TCPM can sometimes be faster than
the TCPC i.e. TCPM can go ahead and move the port to unattached state
(involves disabling vbus auto discharge) before TCPC could effectively
discharge vbus to VSAFE0V. This leaves vbus with residual charge and
increases the decay time which prevents tsafe0v from being met.
This change makes TCPM waits for a maximum of tSafe0V(max) for vbus
to discharge to VSAFE0V before transitioning to unattached state
and re-enable toggling. If vbus discharges to vsafe0v sooner, then,
transition to unattached state
happens right away.
Also, while in SNK_READY, when auto discharge is enabled, drive
disconnect based on vbus turning off instead of Rp disappearing on
CC pins. Rp disappearing on CC pins is almost instanteous compared
to vbus decay.
Sink detach:
[ 541.703058] CC1: 3 -> 0, CC2: 0 -> 0 [state SNK_READY, polarity 0, disconnected]
[ 541.703331] Setting voltage/current limit 5000 mV 0 mA
[ 541.727235] VBUS on
[ 541.749650] VBUS off
[ 541.749653] pending state change SNK_READY -> SNK_UNATTACHED @ 650 ms [rev3 NONE_AMS]
[ 541.749944] VBUS VSAFE0V
[ 541.749945] state change SNK_READY -> SNK_UNATTACHED [rev3 NONE_AMS]
[ 541.750806] Disable vbus discharge ret:0
[ 541.907345] Start toggling
[ 541.922799] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]
Source detach:
[ 2555.310414] state change SRC_SEND_CAPABILITIES -> SRC_READY [rev3 POWER_NEGOTIATION]
[ 2555.310675] AMS POWER_NEGOTIATION finished
[ 2555.310679] cc:=3
[ 2593.645886] CC1: 0 -> 0, CC2: 2 -> 0 [state SRC_READY, polarity 1, disconnected]
[ 2593.645919] pending state change SRC_READY -> SNK_UNATTACHED @ 650 ms [rev3 NONE_AMS]
[ 2593.648419] VBUS off
[ 2593.648960] VBUS VSAFE0V
[ 2593.648965] state change SRC_READY -> SNK_UNATTACHED [rev3 NONE_AMS]
[ 2593.649962] Disable vbus discharge ret:0
[ 2593.890322] Start toggling
[ 2593.925663] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0,
Fixes: f321a02caebd ("usb: typec: tcpm: Implement enabling Auto
Discharge disconnect support")
Signed-off-by: Badhri Jagan Sridharan <badhri(a)google.com>
---
Changes since V1:
- Add Fixes tag
Changes since V2:
- Remove VBUS_DISCHARGE state as preferred by Guenter Roeck
---
drivers/usb/typec/tcpm/tcpm.c | 75 ++++++++++++++++++++++++++++++-----
1 file changed, 65 insertions(+), 10 deletions(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index be0b6469dd3d..8469c37a59e1 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -438,6 +438,9 @@ struct tcpm_port {
enum tcpm_ams next_ams;
bool in_ams;
+ /* Auto vbus discharge status */
+ bool auto_vbus_discharge_enabled;
+
#ifdef CONFIG_DEBUG_FS
struct dentry *dentry;
struct mutex logbuffer_lock; /* log buffer access lock */
@@ -507,6 +510,9 @@ static const char * const pd_rev[] = {
(tcpm_port_is_sink(port) && \
((port)->cc1 == TYPEC_CC_RP_3_0 || (port)->cc2 == TYPEC_CC_RP_3_0))
+#define tcpm_wait_for_discharge(port) \
+ (((port)->auto_vbus_discharge_enabled && !(port)->vbus_vsafe0v) ? PD_T_SAFE_0V : 0)
+
static enum tcpm_state tcpm_default_state(struct tcpm_port *port)
{
if (port->port_type == TYPEC_PORT_DRP) {
@@ -3413,6 +3419,8 @@ static int tcpm_src_attach(struct tcpm_port *port)
if (port->tcpc->enable_auto_vbus_discharge) {
ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, true);
tcpm_log_force(port, "enable vbus discharge ret:%d", ret);
+ if (!ret)
+ port->auto_vbus_discharge_enabled = true;
}
ret = tcpm_set_roles(port, true, TYPEC_SOURCE, tcpm_data_role_for_source(port));
@@ -3495,6 +3503,8 @@ static void tcpm_reset_port(struct tcpm_port *port)
if (port->tcpc->enable_auto_vbus_discharge) {
ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, false);
tcpm_log_force(port, "Disable vbus discharge ret:%d", ret);
+ if (!ret)
+ port->auto_vbus_discharge_enabled = false;
}
port->in_ams = false;
port->ams = NONE_AMS;
@@ -3568,6 +3578,8 @@ static int tcpm_snk_attach(struct tcpm_port *port)
tcpm_set_auto_vbus_discharge_threshold(port, TYPEC_PWR_MODE_USB, false, VSAFE5V);
ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, true);
tcpm_log_force(port, "enable vbus discharge ret:%d", ret);
+ if (!ret)
+ port->auto_vbus_discharge_enabled = true;
}
ret = tcpm_set_roles(port, true, TYPEC_SINK, tcpm_data_role_for_sink(port));
@@ -4670,9 +4682,9 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
if (tcpm_port_is_disconnected(port) ||
!tcpm_port_is_source(port)) {
if (port->port_type == TYPEC_PORT_SRC)
- tcpm_set_state(port, SRC_UNATTACHED, 0);
+ tcpm_set_state(port, SRC_UNATTACHED, tcpm_wait_for_discharge(port));
else
- tcpm_set_state(port, SNK_UNATTACHED, 0);
+ tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
}
break;
case SNK_UNATTACHED:
@@ -4703,7 +4715,23 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
tcpm_set_state(port, SNK_DEBOUNCED, 0);
break;
case SNK_READY:
- if (tcpm_port_is_disconnected(port))
+ /*
+ * EXIT condition is based primarily on vbus disconnect and CC is secondary.
+ * "A port that has entered into USB PD communications with the Source and
+ * has seen the CC voltage exceed vRd-USB may monitor the CC pin to detect
+ * cable disconnect in addition to monitoring VBUS.
+ *
+ * A port that is monitoring the CC voltage for disconnect (but is not in
+ * the process of a USB PD PR_Swap or USB PD FR_Swap) shall transition to
+ * Unattached.SNK within tSinkDisconnect after the CC voltage remains below
+ * vRd-USB for tPDDebounce."
+ *
+ * When set_auto_vbus_discharge_threshold is enabled, CC pins go
+ * away before vbus decays to disconnect threshold. Allow
+ * disconnect to be driven by vbus disconnect when auto vbus
+ * discharge is enabled.
+ */
+ if (!port->auto_vbus_discharge_enabled && tcpm_port_is_disconnected(port))
tcpm_set_state(port, unattached_state(port), 0);
else if (!port->pd_capable &&
(cc1 != old_cc1 || cc2 != old_cc2))
@@ -4802,9 +4830,13 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
* Ignore CC changes here.
*/
break;
-
default:
- if (tcpm_port_is_disconnected(port))
+ /*
+ * While acting as sink and auto vbus discharge is enabled, Allow disconnect
+ * to be driven by vbus disconnect.
+ */
+ if (tcpm_port_is_disconnected(port) && !(port->pwr_role == TYPEC_SINK &&
+ port->auto_vbus_discharge_enabled))
tcpm_set_state(port, unattached_state(port), 0);
break;
}
@@ -4968,8 +5000,16 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port)
case SRC_TRANSITION_SUPPLY:
case SRC_READY:
case SRC_WAIT_NEW_CAPABILITIES:
- /* Force to unattached state to re-initiate connection */
- tcpm_set_state(port, SRC_UNATTACHED, 0);
+ /*
+ * Force to unattached state to re-initiate connection.
+ * DRP port should move to Unattached.SNK instead of Unattached.SRC if
+ * sink removed. Although sink removal here is due to source's vbus collapse,
+ * treat it the same way for consistency.
+ */
+ if (port->port_type == TYPEC_PORT_SRC)
+ tcpm_set_state(port, SRC_UNATTACHED, tcpm_wait_for_discharge(port));
+ else
+ tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
break;
case PORT_RESET:
@@ -4988,9 +5028,8 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port)
break;
default:
- if (port->pwr_role == TYPEC_SINK &&
- port->attached)
- tcpm_set_state(port, SNK_UNATTACHED, 0);
+ if (port->pwr_role == TYPEC_SINK && port->attached)
+ tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port));
break;
}
}
@@ -5012,7 +5051,23 @@ static void _tcpm_pd_vbus_vsafe0v(struct tcpm_port *port)
tcpm_set_state(port, tcpm_try_snk(port) ? SNK_TRY : SRC_ATTACHED,
PD_T_CC_DEBOUNCE);
break;
+ case SRC_STARTUP:
+ case SRC_SEND_CAPABILITIES:
+ case SRC_SEND_CAPABILITIES_TIMEOUT:
+ case SRC_NEGOTIATE_CAPABILITIES:
+ case SRC_TRANSITION_SUPPLY:
+ case SRC_READY:
+ case SRC_WAIT_NEW_CAPABILITIES:
+ if (port->auto_vbus_discharge_enabled) {
+ if (port->port_type == TYPEC_PORT_SRC)
+ tcpm_set_state(port, SRC_UNATTACHED, 0);
+ else
+ tcpm_set_state(port, SNK_UNATTACHED, 0);
+ }
+ break;
default:
+ if (port->pwr_role == TYPEC_SINK && port->auto_vbus_discharge_enabled)
+ tcpm_set_state(port, SNK_UNATTACHED, 0);
break;
}
}
--
2.30.0.617.g56c4b15f3c-goog
The handle_exit_race() function is defined in commit 9c3f39860367
("futex: Cure exit race"), which never returns -EBUSY. This results
in a small piece of dead code in the attach_to_pi_owner() function:
int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */
...
if (ret == -EBUSY)
*exiting = p; /* dead code */
The return value -EBUSY is added to handle_exit_race() in upsteam
commit ac31c7ff8624409 ("futex: Provide distinct return value when
owner is exiting"). This commit was incorporated into v4.9.255, before
the function handle_exit_race() was introduced, whitout Modify
handle_exit_race().
To fix dead code, extract the change of handle_exit_race() from
commit ac31c7ff8624409 ("futex: Provide distinct return value when owner
is exiting"), re-incorporated.
Fixes: 9c3f39860367 ("futex: Cure exit race")
Cc: stable(a)vger.kernel.org # v4.9.258
Signed-off-by: Xiaoming Ni <nixiaoming(a)huawei.com>
---
kernel/futex.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index b65dbb5d60bb..0fd785410150 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1207,11 +1207,11 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval,
u32 uval2;
/*
- * If the futex exit state is not yet FUTEX_STATE_DEAD, wait
- * for it to finish.
+ * If the futex exit state is not yet FUTEX_STATE_DEAD, tell the
+ * caller that the alleged owner is busy.
*/
if (tsk && tsk->futex_state != FUTEX_STATE_DEAD)
- return -EAGAIN;
+ return -EBUSY;
/*
* Reread the user space value to handle the following situation:
--
2.27.0