As Vincent noticed, the y2038 conversion of semtimedop in linux-5.1
broke when commit 00bf25d693e7 ("y2038: use time32 syscall names on
32-bit") changed all system calls on all architectures that take
a 32-bit time_t to point to the _time32 implementation, but left out
semtimedop in the asm-generic header.
This affects all 32-bit architectures using asm-generic/unistd.h:
h8300, unicore32, openrisc, nios2, hexagon, c6x, arc, nds32 and csky.
The notable exception is riscv32, which has dropped support for the
time32 system calls entirely.
Reported-by: Vincent Chen <deanbo422(a)gmail.com>
Cc: stable(a)vger.kernel.org
Cc: Vincent Chen <deanbo422(a)gmail.com>
Cc: Greentime Hu <green.hu(a)gmail.com>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Guan Xuetao <gxt(a)pku.edu.cn>
Cc: Stafford Horne <shorne(a)gmail.com>
Cc: Jonas Bonn <jonas(a)southpole.se>
Cc: Stefan Kristiansson <stefan.kristiansson(a)saunalahti.fi>
Cc: Ley Foon Tan <lftan(a)altera.com>
Cc: Richard Kuo <rkuo(a)codeaurora.org>
Cc: Mark Salter <msalter(a)redhat.com>
Cc: Aurelien Jacquiot <jacquiot.aurelien(a)gmail.com>
Cc: Guo Ren <guoren(a)kernel.org>
Fixes: 00bf25d693e7 ("y2038: use time32 syscall names on 32-bit")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
Hi Vincent,
Sorry for the delay since your report. Does this address your
problem?
Anyone else, please note that this patch is required since
5.1 to make sysvipc work on the listed architectures.
---
include/uapi/asm-generic/unistd.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 1be0e798e362..1fc8faa6e973 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -569,7 +569,7 @@ __SYSCALL(__NR_semget, sys_semget)
__SC_COMP(__NR_semctl, sys_semctl, compat_sys_semctl)
#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
#define __NR_semtimedop 192
-__SC_COMP(__NR_semtimedop, sys_semtimedop, sys_semtimedop_time32)
+__SC_3264(__NR_semtimedop, sys_semtimedop_time32, sys_semtimedop)
#endif
#define __NR_semop 193
__SYSCALL(__NR_semop, sys_semop)
--
2.20.0
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/149570
One or more kernel tests failed:
ppc64le:
❌ selinux-policy: serge-testsuite
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
We grabbed the 38896de0ab4b commit of the stable queue repository.
We then merged the patchset with `git am`:
batman-adv-fix-netlink-dumping-of-all-mcast_flags-bu.patch
libbpf-fix-erroneous-multi-closing-of-btf-fd.patch
libbpf-set-btf-fd-for-prog-only-when-there-is-suppor.patch
netfilter-nf_flow_table-fix-offload-for-flows-that-a.patch
net-mlx5e-fix-error-flow-of-cqe-recovery-on-tx-repor.patch
clk-samsung-change-signature-of-exynos5_subcmus_init.patch
clk-samsung-exynos5800-move-mau-subsystem-clocks-to-.patch
clk-samsung-exynos542x-move-mscl-subsystem-clocks-to.patch
net-tundra-tsi108-use-spin_lock_irqsave-instead-of-s.patch
netfilter-nf_tables-use-after-free-in-failing-rule-w.patch
netfilter-nf_flow_table-conntrack-picks-up-expired-f.patch
netfilter-nf_flow_table-teardown-flow-timeout-race.patch
tools-bpftool-fix-error-message-prog-object.patch
ixgbe-fix-possible-deadlock-in-ixgbe_service_task.patch
hv_netvsc-fix-a-warning-of-suspicious-rcu-usage.patch
net-tc35815-explicitly-check-net_ip_align-is-not-zer.patch
bluetooth-btqca-add-a-short-delay-before-downloading.patch
bluetooth-hci_qca-send-vs-pre-shutdown-command.patch
bluetooth-hidp-let-hidp_send_message-return-number-o.patch
s390-qeth-serialize-cmd-reply-with-concurrent-timeou.patch
ibmveth-convert-multicast-list-size-for-little-endia.patch
gpio-fix-build-error-of-function-redefinition.patch
netfilter-nft_flow_offload-skip-tcp-rst-and-fin-pack.patch
drm-mediatek-use-correct-device-to-import-prime-buff.patch
drm-mediatek-set-dma-max-segment-size.patch
scsi-qla2xxx-fix-gnl.l-memory-leak-on-adapter-init-f.patch
scsi-target-tcmu-avoid-use-after-free-after-command-.patch
cxgb4-fix-a-memory-leak-bug.patch
selftests-kvm-do-not-try-running-the-vm-in-vmx_set_n.patch
selftests-kvm-provide-common-function-to-enable-evmc.patch
selftests-kvm-fix-vmx_set_nested_state_test.patch
liquidio-add-cleanup-in-octeon_setup_iq.patch
net-myri10ge-fix-memory-leaks.patch
clk-fix-falling-back-to-legacy-parent-string-matchin.patch
clk-fix-potential-null-dereference-in-clk_fetch_pare.patch
lan78xx-fix-memory-leaks.patch
vfs-fix-page-locking-deadlocks-when-deduping-files.patch
cx82310_eth-fix-a-memory-leak-bug.patch
net-kalmia-fix-memory-leaks.patch
ibmvnic-unmap-dma-address-of-tx-descriptor-buffers-a.patch
net-cavium-fix-driver-name.patch
wimax-i2400m-fix-a-memory-leak-bug.patch
ravb-fix-use-after-free-ravb_tstamp_skb.patch
sched-core-schedule-new-worker-even-if-pi-blocked.patch
kprobes-fix-potential-deadlock-in-kprobe_optimizer.patch
hid-intel-ish-hid-ipc-add-ehl-device-id.patch
hid-cp2112-prevent-sleeping-function-called-from-inv.patch
x86-boot-compressed-64-fix-boot-on-machines-with-bro.patch
scsi-lpfc-mitigate-high-memory-pre-allocation-by-scs.patch
input-hyperv-keyboard-use-in-place-iterator-api-in-t.patch
tools-hv-kvp-eliminate-may-be-used-uninitialized-war.patch
nvme-multipath-fix-possible-i-o-hang-when-paths-are-.patch
nvme-fix-cntlid-validation-when-not-using-nvmeof.patch
rdma-cma-fix-null-ptr-deref-read-in-cma_cleanup.patch
ib-mlx4-fix-memory-leaks.patch
infiniband-hfi1-fix-a-memory-leak-bug.patch
infiniband-hfi1-fix-memory-leaks.patch
selftests-kvm-fix-state-save-load-on-processors-with.patch
selftests-kvm-make-platform_info_test-pass-on-amd.patch
drm-amdgpu-prevent-memory-leaks-in-amdgpu_cs-ioctl.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fi.patch
kvm-arm-arm64-only-skip-mmio-insn-once.patch
afs-fix-leak-in-afs_lookup_cell_rcu.patch
afs-fix-possible-oops-in-afs_lookup-trace-event.patch
afs-use-correct-afs_call_type-in-yfs_fs_store_opaque.patch
rdma-bnxt_re-fix-stack-out-of-bounds-in-bnxt_qplib_r.patch
gpio-fix-irqchip-initialization-order.patch
kvm-arm-arm64-vgic-properly-initialise-private-irq-a.patch
x86-boot-compressed-64-fix-missing-initialization-in.patch
libceph-allow-ceph_buffer_put-to-receive-a-null-ceph.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
ppc64le:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
❌ selinux-policy: serge-testsuite [2]
🚧 ✅ Storage blktests [3]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [4]
✅ Podman system integration test (as user) [4]
✅ Loopdev Sanity [5]
✅ jvm test suite [6]
✅ AMTU (Abstract Machine Test Utility) [7]
✅ LTP: openposix test suite [8]
✅ Ethernet drivers sanity [9]
✅ Networking socket: fuzz [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
🚧 ✅ LTP lite [16]
🚧 ✅ Memory function: kaslr [17]
x86_64:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
🚧 ✅ Storage blktests [3]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [4]
✅ Podman system integration test (as user) [4]
✅ Loopdev Sanity [5]
✅ jvm test suite [6]
✅ AMTU (Abstract Machine Test Utility) [7]
✅ LTP: openposix test suite [8]
✅ Ethernet drivers sanity [9]
✅ Networking socket: fuzz [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ pciutils: sanity smoke test [18]
✅ Usex - version 1.9-29 [15]
✅ storage: SCSI VPD [19]
✅ stress: stress-ng [20]
🚧 ✅ LTP lite [16]
🚧 ❌ Memory function: kaslr [17]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
As soon as we re-enable the various functions within the HW, they may go
off and read data via a GGTT offset. Hence, if we have not yet restored
the GGTT PTE before then, they may read and even *write* random locations
in memory.
Detected by DMAR faults during resume.
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com>
Cc: Martin Peres <martin.peres(a)linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/i915/gem/i915_gem_pm.c | 3 ---
drivers/gpu/drm/i915/i915_drv.c | 5 +++++
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pm.c b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
index b3993d24b83d..9b1129aaacfe 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_pm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
@@ -242,9 +242,6 @@ void i915_gem_resume(struct drm_i915_private *i915)
mutex_lock(&i915->drm.struct_mutex);
intel_uncore_forcewake_get(&i915->uncore, FORCEWAKE_ALL);
- i915_gem_restore_gtt_mappings(i915);
- i915_gem_restore_fences(i915);
-
if (i915_gem_init_hw(i915))
goto err_wedged;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 7b2c81a8bbaa..1af4eba968c0 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1877,6 +1877,11 @@ static int i915_drm_resume(struct drm_device *dev)
if (ret)
DRM_ERROR("failed to re-enable GGTT\n");
+ mutex_lock(&dev_priv->drm.struct_mutex);
+ i915_gem_restore_gtt_mappings(dev_priv);
+ i915_gem_restore_fences(dev_priv);
+ mutex_unlock(&dev_priv->drm.struct_mutex);
+
intel_csr_ucode_resume(dev_priv);
i915_restore_state(dev_priv);
--
2.23.0
I'm announcing the release of the 5.2.13 kernel.
Only users of the elantech driver need to update to fix a regression in
a previous release.
The updated 5.2.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.2.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/input/mouse/elantech.c | 54 ++++++++++++++++++++++-------------------
2 files changed, 30 insertions(+), 26 deletions(-)
Benjamin Tissoires (1):
Revert "Input: elantech - enable SMBus on new (2018+) systems"
Greg Kroah-Hartman (1):
Linux 5.2.13
Hi,
Please consider picking:
commit 7188a6f0eee3f1fae5d826cfc6d569657ff950ec
Author: Martin Sperl <kernel(a)martin.sperl.org>
Date: Sat Mar 30 09:30:58 2019 +0000
spi: bcm2835aux: unifying code between polling and interrupt driven
code
commit c7de8500fd8ecbb544846dd5f11dca578c3777e1
Author: Martin Sperl <kernel(a)martin.sperl.org>
Date: Sat Mar 30 09:30:59 2019 +0000
spi: bcm2835aux: remove dangerous uncontrolled read of fifo
commit 73b114ee7db1750c0b535199fae383b109bd61d0
Author: Martin Sperl <kernel(a)martin.sperl.org>
Date: Sat Mar 30 09:31:00 2019 +0000
spi: bcm2835aux: fix corruptions for longer spi transfers
for stable kernel 4.14 and 4.19.
If we want to fix this in 4.9 you should also pick:
commit bc519d9574618e47a0c788000fb78da95e18d953
Author: Rob Herring <robh(a)kernel.org>
Date: Thu May 3 13:09:44 2018 -0500
spi: bcm2835aux: ensure interrupts are enabled for shared handler
Thanks,
/Sean
In embedded environments the requirements are to be able to pick and
chose which features one requires built into the kernel. If an
embedded environment wants to supports loading modules that have been
kbuilt out of tree, there is a need to enable hidden configurations
for core features to provide the API surface for them to load.
Introduce CONFIG_WIRELESS_ALLCONFIG to select all wireless core
features by activating all the hidden configuration options, without
having to specifically select any wireless module(s).
Signed-off-by: Mark Salyzyn <salyzyn(a)android.com>
Cc: kernel-team(a)android.com
Cc: Johannes Berg <johannes(a)sipsolutions.net>
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: linux-wireless(a)vger.kernel.org
Cc: netdev(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Cc: stable(a)vger.kernel.org # 4.19
---
net/wireless/Kconfig | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 67f8360dfcee..0d32350e1729 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -17,6 +17,20 @@ config WEXT_SPY
config WEXT_PRIV
bool
+config WIRELESS_ALLCONFIG
+ bool "allconfig for wireless core"
+ select WIRELESS_EXT
+ select WEXT_CORE
+ select WEXT_PROC
+ select WEXT_SPY
+ select WEXT_PRIV
+ help
+ Config option used to enable all the wireless core functionality
+ used by modules.
+
+ If you are not building a kernel to be used for a variety of
+ out-of-kernel built wireless modules, say N here.
+
config CFG80211
tristate "cfg80211 - wireless configuration API"
depends on RFKILL || !RFKILL
--
2.23.0.187.g17f5b7556c-goog
Sorry for the repost, I relized I stupidly got Greg's email adress wrong
first time around.
> > On Tue, Aug 27, 2019 at 12:00:14PM +0100, Mark Brown wrote:
> > > On Sun, Aug 25, 2019 at 09:35:15PM -0400, Sasha Levin wrote:
> > > > On Wed, Aug 14, 2019 at 10:22:13AM +0100, Mark Brown wrote:
> > >
> > > > > > If the DAI format setup fails, there is no valid communication format
> > > > > > between CPU and CODEC, so fail card instantiation, rather than
> > > > continue
> > > > > > with a card that will most likely not function properly.
> > >
> > > > > This is another one where if nobody noticed a problem already and things
> > > > > just happened to be working this might break things, it's vanishingly
> > > > > unlikely to fix anything that was broken.
> > >
> > > > Same as the other patch: this patch suggests it fixes a real bug, and if
> > > > this patch is broken let's fix it.
> > >
> > > If anyone ran into this on the older kernel and fixed or worked
> > > around it locally there's a reasonable chance this will then
> > > break what they're doing. The patch itself is perfectly fine but
(Sorry about the mangled subject line, I'd accidentally deleted the
original message from my inbox.)
I'm a bit bewildered here. As the author of the original patch I'm of
course biased, and I can certainly understand the patch being dropped from
existing release branches, since as Mark correctly states, it does not fix
any broken behavior and might even break things that happen to work by
chance.
But is this being dropped from the master branch as well? To me it makes
the kernel behave in an inconsistent way, first reporting a failure to
instantiate a specific sound card in the kernel log, but then seemingly
bringing it up anyway.
/Ricard
--
Ricard Wolf Wanderlof ricardw(at)axis.com
Axis Communications AB, Lund, Sweden www.axis.com
Phone +46 46 272 2016 Fax +46 46 13 61 30
This is the start of the stable review cycle for the 4.19.70 release.
There are 93 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri 06 Sep 2019 05:50:23 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.70-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.70-rc1
Stanislaw Gruszka <sgruszka(a)redhat.com>
mt76: mt76x0u: do not reset radio on resume
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
x86/ptrace: fix up botched merge of spectrev1 fix
Andrew Cooks <andrew.cooks(a)opengear.com>
i2c: piix4: Fix port selection for AMD Family 16h Model 30h
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Pass error information to the pgio error cleanup routine
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Clean up list moves of struct nfs_page
Marc Zyngier <maz(a)kernel.org>
KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
Heyi Guo <guoheyi(a)huawei.com>
KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
Alexey Kardashevskiy <aik(a)ozlabs.ru>
KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling
Denis Kenzior <denkenz(a)gmail.com>
mac80211: Correctly set noencrypt for PAE frames
Denis Kenzior <denkenz(a)gmail.com>
mac80211: Don't memset RXCB prior to PAE intercept
Johannes Berg <johannes.berg(a)intel.com>
mac80211: fix possible sta leak
Hodaszi, Robert <Robert.Hodaszi(a)digi.com>
Revert "cfg80211: fix processing world regdomain when non modular"
Gary R Hook <gary.hook(a)amd.com>
crypto: ccp - Ignore unconfigured CCP device on suspend/resume
Nadav Amit <namit(a)vmware.com>
VMCI: Release resource if the work is already queued
John Garry <john.garry(a)huawei.com>
bus: hisi_lpc: Add .remove method to avoid driver unbind crash
John Garry <john.garry(a)huawei.com>
bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free
Lyude Paul <lyude(a)redhat.com>
drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe()
Xiong Zhang <xiong.y.zhang(a)intel.com>
drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
drm/amdgpu: Add APTX quirk for Dell Latitude 5495
John Garry <john.garry(a)huawei.com>
lib: logic_pio: Add logic_pio_unregister_range()
John Garry <john.garry(a)huawei.com>
lib: logic_pio: Avoid possible overlap for unregistering regions
John Garry <john.garry(a)huawei.com>
lib: logic_pio: Fix RCU usage
Eddie James <eajames(a)linux.ibm.com>
fsi: scom: Don't abort operations for minor errors
Colin Ian King <colin.king(a)canonical.com>
typec: tcpm: fix a typo in the comparison of pdo_max_voltage
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add Tiger Lake support
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add support for another Lewisburg PCH
Ding Xiang <dingxiang(a)cmss.chinamobile.com>
stm class: Fix a double free of stm_source_device
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: core: Fix init of SD cards reporting an invalid VDD range
Eugen Hristev <eugen.hristev(a)microchip.com>
mmc: sdhci-of-at91: add quirk for broken HS200
Tomas Winkler <tomas.winkler(a)intel.com>
mei: me: add Tiger Lake point LP device ID
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: storage: ums-realtek: Whitelist auto-delink support
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: storage: ums-realtek: Update module parameter description for auto_delink_en
Geert Uytterhoeven <geert+renesas(a)glider.be>
usb: host: xhci: rcar: Fix typo in compatible string matching
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: host: ohci: fix a race condition between shutdown and irq
Peter Chen <peter.chen(a)nxp.com>
usb: chipidea: udc: don't do hardware access if gadget has stopped
Schmid, Carsten <Carsten_Schmid(a)mentor.com>
usb: hcd: use managed device resources
Oliver Neukum <oneukum(a)suse.com>
USB: cdc-wdm: fix race between write and disconnect due to flag abuse
Henk van der Laan <opensource(a)henkvdlaan.com>
usb-storage: Add new JMS567 revision to unusual_devs
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
ftrace: Check for empty hash and comment the race with registering probes
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
ftrace: Check for successful allocation of hash
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
ftrace: Fix NULL pointer dereference in t_probe_next()
Bandan Das <bsd(a)redhat.com>
x86/apic: Include the LDR when clearing out APIC registers
Bandan Das <bsd(a)redhat.com>
x86/apic: Do not initialize LDR and DFR for bigsmp
Sebastian Mayr <me(a)sam.st>
uprobes/x86: Fix detection of 32-bit user mode
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Don't update RIP or do single-step on faulting emulation
Radim Krcmar <rkrcmar(a)redhat.com>
kvm: x86: skip populating logical dest map if apic is not sw enabled
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate()
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: Fix potential concurrent access to the deleted pool
Jeronimo Borque <jeronimo(a)borque.com.ar>
ALSA: hda - Fixes inverted Conexant GPIO mic mute led
Takashi Iwai <tiwai(a)suse.de>
ALSA: line6: Fix memory leak at line6_init_pcm() error path
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Check mixer unit bitmap yet more strictly
Andrew Morton <akpm(a)linux-foundation.org>
mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
Hangbin Liu <liuhangbin(a)gmail.com>
ipv4/icmp: fix rt dst dev null pointer dereference
Eric Dumazet <edumazet(a)google.com>
tcp: make sure EPOLLOUT wont be missed
Jason Baron <jbaron(a)akamai.com>
net/smc: make sure EPOLLOUT is raised
David Ahern <dsahern(a)gmail.com>
ipv6: Default fib6_type to RTN_UNICAST when not set
Hangbin Liu <liuhangbin(a)gmail.com>
ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set
John Fastabend <john.fastabend(a)gmail.com>
net: tls, fix sk_write_space NULL write when tx disabled
Jakub Kicinski <jakub.kicinski(a)netronome.com>
net/tls: swap sk_write_space on close
Vakul Garg <vakul.garg(a)nxp.com>
net/tls: Fixed return value when tls_complete_pending_work() fails
Jyri Sarha <jsarha(a)ti.com>
drm/tilcdc: Register cpufreq notifier after we have initialized crtc
Pedro Sousa <sousa(a)synopsys.com>
scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
Tomi Valkeinen <tomi.valkeinen(a)ti.com>
drm/bridge: tfp410: fix memleak in get_modes()
Stefan Wahren <wahrenst(a)gmx.net>
watchdog: bcm2835_wdt: Fix module autoload
Lionel Landwerlin <lionel.g.landwerlin(a)intel.com>
drm/i915: fix broadwell EU computation
Adrian Vladu <avladu(a)cloudbasesolutions.com>
tools: hv: fix KVP and VSS daemons exit code
Adrian Vladu <avladu(a)cloudbasesolutions.com>
tools: hv: fixed Python pep8/flake8 warnings for lsvmbus
Hans Ulli Kroll <ulli.kroll(a)googlemail.com>
usb: host: fotg2: restart hcd after port reset
Y.C. Chen <yc_chen(a)aspeedtech.com>
drm/ast: Fixed reboot test may cause system hanged
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: emev2: avoid race when unregistering slave client
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: rcar: avoid race when unregistering slave client
Will Deacon <will(a)kernel.org>
arm64: cpufeature: Don't treat granule sizes as strict
Wenwen Wang <wenwen(a)cs.uga.edu>
xen/blkback: fix memory leaks
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
usb: gadget: composite: Clear "suspended" on reset/disconnect
Robin Murphy <robin.murphy(a)arm.com>
iommu/dma: Handle SG length overflow better
Hans Verkuil <hverkuil(a)xs4all.nl>
omap-dma/omap_vout_vrfb: fix off-by-one fi value
Jia-Ju Bai <baijiaju1990(a)gmail.com>
dmaengine: stm32-mdma: Fix a possible null-pointer dereference in stm32_mdma_irq_handler()
zhengbin <zhengbin13(a)huawei.com>
auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
soundwire: cadence_master: fix definitions for INTSTAT0/1
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
soundwire: cadence_master: fix register definition for SLAVE_STATE
Keith Busch <kbusch(a)kernel.org>
nvme-pci: Fix async probe remove race
Sagi Grimberg <sagi(a)grimberg.me>
nvme: fix a possible deadlock when passthru commands sent to a multipath device
Logan Gunthorpe <logang(a)deltatee.com>
nvmet-loop: Flush nvme_delete_wq when removing the port
David Howells <dhowells(a)redhat.com>
afs: Only update d_fsdata if different in afs_d_revalidate()
Jia-Ju Bai <baijiaju1990(a)gmail.com>
fs: afs: Fix a possible null-pointer dereference in afs_put_read()
Marc Dionne <marc.dionne(a)auristor.com>
afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u()
David Howells <dhowells(a)redhat.com>
afs: Fix the CB.ProbeUuid service handler to reply correctly
Anthony Iliopoulos <ailiopoulos(a)suse.com>
nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
Arnd Bergmann <arnd(a)arndb.de>
dmaengine: ste_dma40: fix unneeded variable warning
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/kernel/cpufeature.c | 14 +++-
arch/powerpc/kvm/book3s_64_vio.c | 6 +-
arch/powerpc/kvm/book3s_64_vio_hv.c | 6 +-
arch/x86/kernel/apic/apic.c | 4 ++
arch/x86/kernel/apic/bigsmp_32.c | 24 +------
arch/x86/kernel/ptrace.c | 3 +-
arch/x86/kernel/uprobes.c | 17 +++--
arch/x86/kvm/lapic.c | 5 ++
arch/x86/kvm/x86.c | 9 +--
drivers/auxdisplay/panel.c | 2 +
drivers/block/xen-blkback/xenbus.c | 6 +-
drivers/bus/hisi_lpc.c | 47 ++++++++++++--
drivers/crypto/ccp/ccp-dev.c | 8 +++
drivers/dma/ste_dma40.c | 4 +-
drivers/dma/stm32-mdma.c | 2 +-
drivers/dma/ti/omap-dma.c | 4 +-
drivers/fsi/fsi-scom.c | 8 +--
drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 1 +
drivers/gpu/drm/ast/ast_main.c | 5 +-
drivers/gpu/drm/ast/ast_mode.c | 2 +-
drivers/gpu/drm/ast/ast_post.c | 2 +-
drivers/gpu/drm/bridge/ti-tfp410.c | 7 +-
drivers/gpu/drm/i915/i915_drv.c | 6 ++
drivers/gpu/drm/i915/i915_vgpu.c | 3 +
drivers/gpu/drm/i915/intel_device_info.c | 2 +-
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 +++++-----
drivers/hwtracing/intel_th/pci.c | 10 +++
drivers/hwtracing/stm/core.c | 1 -
drivers/i2c/busses/i2c-emev2.c | 16 +++--
drivers/i2c/busses/i2c-piix4.c | 12 ++--
drivers/i2c/busses/i2c-rcar.c | 11 ++--
drivers/iommu/dma-iommu.c | 2 +-
drivers/media/platform/omap/omap_vout_vrfb.c | 3 +-
drivers/misc/mei/hw-me-regs.h | 2 +
drivers/misc/mei/pci-me.c | 2 +
drivers/misc/vmw_vmci/vmci_doorbell.c | 6 +-
drivers/mmc/core/sd.c | 6 ++
drivers/mmc/host/sdhci-of-at91.c | 3 +
drivers/net/wireless/mediatek/mt76/mt76x0/init.c | 4 +-
drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h | 2 +-
drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 4 +-
drivers/nvme/host/core.c | 6 ++
drivers/nvme/host/multipath.c | 30 +++++++++
drivers/nvme/host/nvme.h | 12 ++++
drivers/nvme/host/pci.c | 3 +-
drivers/nvme/target/loop.c | 8 +++
drivers/scsi/ufs/unipro.h | 2 +-
drivers/soundwire/cadence_master.c | 8 +--
drivers/usb/chipidea/udc.c | 32 ++++++---
drivers/usb/class/cdc-wdm.c | 16 +++--
drivers/usb/core/hcd-pci.c | 30 +++------
drivers/usb/gadget/composite.c | 1 +
drivers/usb/gadget/function/f_mass_storage.c | 28 +++++---
drivers/usb/host/fotg210-hcd.c | 4 ++
drivers/usb/host/ohci-hcd.c | 15 ++++-
drivers/usb/host/xhci-rcar.c | 2 +-
drivers/usb/storage/realtek_cr.c | 15 +++--
drivers/usb/storage/unusual_devs.h | 2 +-
drivers/usb/typec/tcpm.c | 2 +-
drivers/watchdog/bcm2835_wdt.c | 1 +
fs/afs/cmservice.c | 10 +--
fs/afs/dir.c | 3 +-
fs/afs/file.c | 12 ++--
fs/afs/vlclient.c | 11 ++--
fs/nfs/direct.c | 34 ++++++----
fs/nfs/pagelist.c | 32 ++++-----
fs/nfs/read.c | 2 +-
fs/nfs/write.c | 11 +++-
include/linux/logic_pio.h | 1 +
include/linux/nfs_page.h | 10 +++
include/linux/nfs_xdr.h | 2 +-
kernel/trace/ftrace.c | 17 +++++
lib/logic_pio.c | 73 +++++++++++++++------
mm/zsmalloc.c | 2 +
net/core/stream.c | 16 +++--
net/ipv4/icmp.c | 8 ++-
net/ipv6/addrconf.c | 3 +-
net/ipv6/route.c | 2 +-
net/mac80211/cfg.c | 9 +--
net/mac80211/rx.c | 6 +-
net/smc/smc_tx.c | 6 +-
net/tls/tls_main.c | 2 +
net/tls/tls_sw.c | 10 +--
net/wireless/reg.c | 2 +-
sound/core/seq/seq_clientmgr.c | 3 +-
sound/core/seq/seq_fifo.c | 17 +++++
sound/core/seq/seq_fifo.h | 2 +
sound/pci/hda/patch_conexant.c | 17 ++---
sound/usb/line6/pcm.c | 18 +++---
sound/usb/mixer.c | 36 ++++++++---
sound/usb/mixer_quirks.c | 8 +--
sound/usb/pcm.c | 1 +
tools/hv/hv_kvp_daemon.c | 2 +
tools/hv/hv_vss_daemon.c | 2 +
tools/hv/lsvmbus | 75 ++++++++++++----------
virt/kvm/arm/vgic/vgic-mmio.c | 18 ++++++
virt/kvm/arm/vgic/vgic-v2.c | 5 +-
virt/kvm/arm/vgic/vgic-v3.c | 5 +-
virt/kvm/arm/vgic/vgic.c | 7 ++
100 files changed, 699 insertions(+), 337 deletions(-)
I'm announcing the release of the 4.19.71 kernel.
Only users of the elantech driver need to upgrade to fix a regression in
a recent release.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/input/mouse/elantech.c | 54 ++++++++++++++++++++++-------------------
2 files changed, 30 insertions(+), 26 deletions(-)
Benjamin Tissoires (1):
Revert "Input: elantech - enable SMBus on new (2018+) systems"
Greg Kroah-Hartman (1):
Linux 4.19.71
This reverts commit 60956b018bfe23b879405a7d88103d0a8f06a5e3.
This patch depends on an other series:
https://patchwork.kernel.org/project/linux-input/list/?series=122327&state=…
It was a mistake to backport it in the v5.2 branch, as there
is a high chance we encounter a touchpad that needs the series
above.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204733
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204771
Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
---
Hi,
this is a stable only patch aimed at kernels v5.2 and v4.19 branches.
We already have 2 bug reports of a failing touchpad, and I don't think
it is worth trying to get a smoother touchpad if we randomly
break a few of them in the way.
Cheers,
Benjamin
---
drivers/input/mouse/elantech.c | 54 ++++++++++++++++++----------------
1 file changed, 29 insertions(+), 25 deletions(-)
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index a47c7add4e0e..a4345052abd2 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1807,30 +1807,6 @@ static int elantech_create_smbus(struct psmouse *psmouse,
leave_breadcrumbs);
}
-static bool elantech_use_host_notify(struct psmouse *psmouse,
- struct elantech_device_info *info)
-{
- if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
- return true;
-
- switch (info->bus) {
- case ETP_BUS_PS2_ONLY:
- /* expected case */
- break;
- case ETP_BUS_SMB_HST_NTFY_ONLY:
- case ETP_BUS_PS2_SMB_HST_NTFY:
- /* SMbus implementation is stable since 2018 */
- if (dmi_get_bios_year() >= 2018)
- return true;
- default:
- psmouse_dbg(psmouse,
- "Ignoring SMBus bus provider %d\n", info->bus);
- break;
- }
-
- return false;
-}
-
/**
* elantech_setup_smbus - called once the PS/2 devices are enumerated
* and decides to instantiate a SMBus InterTouch device.
@@ -1850,7 +1826,7 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
* i2c_blacklist_pnp_ids.
* Old ICs are up to the user to decide.
*/
- if (!elantech_use_host_notify(psmouse, info) ||
+ if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
return -ENXIO;
}
@@ -1870,6 +1846,34 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
return 0;
}
+static bool elantech_use_host_notify(struct psmouse *psmouse,
+ struct elantech_device_info *info)
+{
+ if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
+ return true;
+
+ switch (info->bus) {
+ case ETP_BUS_PS2_ONLY:
+ /* expected case */
+ break;
+ case ETP_BUS_SMB_ALERT_ONLY:
+ /* fall-through */
+ case ETP_BUS_PS2_SMB_ALERT:
+ psmouse_dbg(psmouse, "Ignoring SMBus provider through alert protocol.\n");
+ break;
+ case ETP_BUS_SMB_HST_NTFY_ONLY:
+ /* fall-through */
+ case ETP_BUS_PS2_SMB_HST_NTFY:
+ return true;
+ default:
+ psmouse_dbg(psmouse,
+ "Ignoring SMBus bus provider %d.\n",
+ info->bus);
+ }
+
+ return false;
+}
+
int elantech_init_smbus(struct psmouse *psmouse)
{
struct elantech_device_info info;
--
2.21.0
This is the start of the stable review cycle for the 4.14.142 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri 06 Sep 2019 05:50:23 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.142-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.142-rc1
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
x86/ptrace: fix up botched merge of spectrev1 fix
Andrew Cooks <andrew.cooks(a)opengear.com>
i2c: piix4: Fix port selection for AMD Family 16h Model 30h
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Pass error information to the pgio error cleanup routine
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Clean up list moves of struct nfs_page
Marc Zyngier <maz(a)kernel.org>
KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
Heyi Guo <guoheyi(a)huawei.com>
KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
Alexey Kardashevskiy <aik(a)ozlabs.ru>
KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling
Johannes Berg <johannes.berg(a)intel.com>
mac80211: fix possible sta leak
Hodaszi, Robert <Robert.Hodaszi(a)digi.com>
Revert "cfg80211: fix processing world regdomain when non modular"
Gary R Hook <gary.hook(a)amd.com>
crypto: ccp - Ignore unconfigured CCP device on suspend/resume
Nadav Amit <namit(a)vmware.com>
VMCI: Release resource if the work is already queued
Xiong Zhang <xiong.y.zhang(a)intel.com>
drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add Tiger Lake support
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add support for another Lewisburg PCH
Ding Xiang <dingxiang(a)cmss.chinamobile.com>
stm class: Fix a double free of stm_source_device
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: core: Fix init of SD cards reporting an invalid VDD range
Eugen Hristev <eugen.hristev(a)microchip.com>
mmc: sdhci-of-at91: add quirk for broken HS200
Sebastian Mayr <me(a)sam.st>
uprobes/x86: Fix detection of 32-bit user mode
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: storage: ums-realtek: Whitelist auto-delink support
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
USB: storage: ums-realtek: Update module parameter description for auto_delink_en
Geert Uytterhoeven <geert+renesas(a)glider.be>
usb: host: xhci: rcar: Fix typo in compatible string matching
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
usb: host: ohci: fix a race condition between shutdown and irq
Peter Chen <peter.chen(a)nxp.com>
usb: chipidea: udc: don't do hardware access if gadget has stopped
Oliver Neukum <oneukum(a)suse.com>
USB: cdc-wdm: fix race between write and disconnect due to flag abuse
Henk van der Laan <opensource(a)henkvdlaan.com>
usb-storage: Add new JMS567 revision to unusual_devs
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
ftrace: Check for empty hash and comment the race with registering probes
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
ftrace: Check for successful allocation of hash
Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
ftrace: Fix NULL pointer dereference in t_probe_next()
Bandan Das <bsd(a)redhat.com>
x86/apic: Include the LDR when clearing out APIC registers
Bandan Das <bsd(a)redhat.com>
x86/apic: Do not initialize LDR and DFR for bigsmp
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Don't update RIP or do single-step on faulting emulation
Radim Krcmar <rkrcmar(a)redhat.com>
kvm: x86: skip populating logical dest map if apic is not sw enabled
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: Fix potential concurrent access to the deleted pool
Takashi Iwai <tiwai(a)suse.de>
ALSA: line6: Fix memory leak at line6_init_pcm() error path
Andrew Morton <akpm(a)linux-foundation.org>
mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
Eric Dumazet <edumazet(a)google.com>
tcp: make sure EPOLLOUT wont be missed
Jason Baron <jbaron(a)akamai.com>
net/smc: make sure EPOLLOUT is raised
Hui Peng <benquike(a)gmail.com>
ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
Hui Peng <benquike(a)gmail.com>
ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
Tim Froidcoeur <tim.froidcoeur(a)tessares.net>
tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
Jyri Sarha <jsarha(a)ti.com>
drm/tilcdc: Register cpufreq notifier after we have initialized crtc
Pedro Sousa <sousa(a)synopsys.com>
scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
Tomi Valkeinen <tomi.valkeinen(a)ti.com>
drm/bridge: tfp410: fix memleak in get_modes()
Stefan Wahren <wahrenst(a)gmx.net>
watchdog: bcm2835_wdt: Fix module autoload
Adrian Vladu <avladu(a)cloudbasesolutions.com>
tools: hv: fix KVP and VSS daemons exit code
Hans Ulli Kroll <ulli.kroll(a)googlemail.com>
usb: host: fotg2: restart hcd after port reset
Y.C. Chen <yc_chen(a)aspeedtech.com>
drm/ast: Fixed reboot test may cause system hanged
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: emev2: avoid race when unregistering slave client
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: rcar: avoid race when unregistering slave client
Wenwen Wang <wenwen(a)cs.uga.edu>
xen/blkback: fix memory leaks
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
usb: gadget: composite: Clear "suspended" on reset/disconnect
Robin Murphy <robin.murphy(a)arm.com>
iommu/dma: Handle SG length overflow better
zhengbin <zhengbin13(a)huawei.com>
auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach
Arnd Bergmann <arnd(a)arndb.de>
dmaengine: ste_dma40: fix unneeded variable warning
-------------
Diffstat:
Makefile | 4 ++--
arch/powerpc/kvm/book3s_64_vio.c | 6 +++--
arch/powerpc/kvm/book3s_64_vio_hv.c | 6 +++--
arch/x86/kernel/apic/apic.c | 4 ++++
arch/x86/kernel/apic/bigsmp_32.c | 24 ++------------------
arch/x86/kernel/ptrace.c | 3 +--
arch/x86/kernel/uprobes.c | 17 ++++++++------
arch/x86/kvm/lapic.c | 5 ++++
arch/x86/kvm/x86.c | 9 ++++----
drivers/auxdisplay/panel.c | 2 ++
drivers/block/xen-blkback/xenbus.c | 6 ++---
drivers/crypto/ccp/ccp-dev.c | 8 +++++++
drivers/dma/ste_dma40.c | 4 ++--
drivers/gpu/drm/ast/ast_main.c | 5 +++-
drivers/gpu/drm/ast/ast_mode.c | 2 +-
drivers/gpu/drm/ast/ast_post.c | 2 +-
drivers/gpu/drm/bridge/ti-tfp410.c | 7 +++++-
drivers/gpu/drm/i915/i915_vgpu.c | 3 +++
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 ++++++++++++++--------------
drivers/hwtracing/intel_th/pci.c | 10 ++++++++
drivers/hwtracing/stm/core.c | 1 -
drivers/i2c/busses/i2c-emev2.c | 16 +++++++++----
drivers/i2c/busses/i2c-piix4.c | 12 ++++------
drivers/i2c/busses/i2c-rcar.c | 11 +++++----
drivers/iommu/dma-iommu.c | 2 +-
drivers/misc/vmw_vmci/vmci_doorbell.c | 6 +++--
drivers/mmc/core/sd.c | 6 +++++
drivers/mmc/host/sdhci-of-at91.c | 3 +++
drivers/scsi/ufs/unipro.h | 2 +-
drivers/usb/chipidea/udc.c | 32 +++++++++++++++++++-------
drivers/usb/class/cdc-wdm.c | 16 +++++++++----
drivers/usb/gadget/composite.c | 1 +
drivers/usb/gadget/function/f_mass_storage.c | 28 +++++++++++++++--------
drivers/usb/host/fotg210-hcd.c | 4 ++++
drivers/usb/host/ohci-hcd.c | 15 +++++++++---
drivers/usb/host/xhci-rcar.c | 2 +-
drivers/usb/storage/realtek_cr.c | 15 +++++++-----
drivers/usb/storage/unusual_devs.h | 2 +-
drivers/watchdog/bcm2835_wdt.c | 1 +
fs/nfs/direct.c | 34 +++++++++++++++++-----------
fs/nfs/pagelist.c | 32 +++++++++++++-------------
fs/nfs/read.c | 2 +-
fs/nfs/write.c | 11 +++++++--
include/linux/nfs_page.h | 10 ++++++++
include/linux/nfs_xdr.h | 2 +-
include/net/tcp.h | 4 ++++
kernel/trace/ftrace.c | 17 ++++++++++++++
mm/zsmalloc.c | 2 ++
net/core/stream.c | 16 +++++++------
net/mac80211/cfg.c | 9 ++++----
net/smc/smc_tx.c | 6 ++---
net/wireless/reg.c | 2 +-
sound/core/seq/seq_clientmgr.c | 3 +--
sound/core/seq/seq_fifo.c | 17 ++++++++++++++
sound/core/seq/seq_fifo.h | 2 ++
sound/usb/line6/pcm.c | 18 +++++++--------
sound/usb/mixer.c | 30 ++++++++++++++++++++----
tools/hv/hv_kvp_daemon.c | 2 ++
tools/hv/hv_vss_daemon.c | 2 ++
virt/kvm/arm/vgic/vgic-mmio.c | 18 +++++++++++++++
virt/kvm/arm/vgic/vgic-v2.c | 5 +++-
virt/kvm/arm/vgic/vgic-v3.c | 5 +++-
virt/kvm/arm/vgic/vgic.c | 7 ++++++
63 files changed, 405 insertions(+), 187 deletions(-)
On Fri, Aug 23, 2019 at 1:35 AM Eric Biggers <ebiggers(a)kernel.org> wrote:
>
> From: Eric Biggers <ebiggers(a)google.com>
>
> When IOCB_CMD_POLL is used on the FUSE device, aio_poll() disables IRQs
> and takes kioctx::ctx_lock, then fuse_iqueue::waitq.lock.
Not in -linus.
Which tree was this reproduced with?
Thanks,
Miklos
These patches support upcoming UV systems that do not have a UV HUB.
* Save OEM_ID from ACPI MADT probe
* Return UV Hubless System Type
* Add return code to UV BIOS Init function
* Setup UV functions for Hubless UV Systems
* Add UV Hubbed/Hubless Proc FS Files
* Decode UVsystab Info
* Account for UV Hubless in is_uvX_hub Ops
--
From: Roderick Colenbrander <roderick.colenbrander(a)sony.com>
The sony driver is not properly cleaning up from potential failures in
sony_input_configured. Currently it calls hid_hw_stop, while hid_connect
is still running. This is not a good idea, instead hid_hw_stop should
be moved to sony_probe. Similar changes were recently made to Logitech
drivers, which were also doing improper cleanup.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander(a)sony.com>
CC: stable(a)vger.kernel.org
---
drivers/hid/hid-sony.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 31f1023214d3..09f2c617b09f 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2806,7 +2806,6 @@ static int sony_input_configured(struct hid_device *hdev,
sony_cancel_work_sync(sc);
sony_remove_dev_list(sc);
sony_release_device_id(sc);
- hid_hw_stop(hdev);
return ret;
}
@@ -2868,6 +2867,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
*/
if (!(hdev->claimed & HID_CLAIMED_INPUT)) {
hid_err(hdev, "failed to claim input\n");
+ hid_hw_stop(hdev);
return -ENODEV;
}
--
2.21.0
This is a note to let you know that I've just added the patch titled
serial: sprd: correct the wrong sequence of arguments
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 9c801e313195addaf11c16e155f50789d6ebfd19 Mon Sep 17 00:00:00 2001
From: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Date: Thu, 5 Sep 2019 15:41:51 +0800
Subject: serial: sprd: correct the wrong sequence of arguments
The sequence of arguments which was passed to handle_lsr_errors() didn't
match the parameters defined in that function, &lsr was passed to flag
and &flag was passed to lsr, this patch fixed that.
Fixes: b7396a38fb28 ("tty/serial: Add Spreadtrum sc9836-uart driver support")
Signed-off-by: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Signed-off-by: Chunyan Zhang <zhang.lyra(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20190905074151.5268-1-zhang.lyra@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/sprd_serial.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
index f8db5c8e4e39..771d11196523 100644
--- a/drivers/tty/serial/sprd_serial.c
+++ b/drivers/tty/serial/sprd_serial.c
@@ -617,7 +617,7 @@ static inline void sprd_rx(struct uart_port *port)
if (lsr & (SPRD_LSR_BI | SPRD_LSR_PE |
SPRD_LSR_FE | SPRD_LSR_OE))
- if (handle_lsr_errors(port, &lsr, &flag))
+ if (handle_lsr_errors(port, &flag, &lsr))
continue;
if (uart_handle_sysrq_char(port, ch))
continue;
--
2.23.0
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: videobuf-core.c: poll_wait needs a non-NULL buf pointer
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Wed Sep 4 06:04:07 2019 -0300
poll_wait uses &buf->done, but buf is NULL. Move the poll_wait to later
in the function once buf is correctly set and only call it if it is
non-NULL.
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Fixes: bb436cbeb918 ("media: videobuf: fix epoll() by calling poll_wait first")
Cc: <stable(a)vger.kernel.org> # for v5.1 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/v4l2-core/videobuf-core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
---
diff --git a/drivers/media/v4l2-core/videobuf-core.c b/drivers/media/v4l2-core/videobuf-core.c
index 7ef3e4d22bf6..939fc11cf080 100644
--- a/drivers/media/v4l2-core/videobuf-core.c
+++ b/drivers/media/v4l2-core/videobuf-core.c
@@ -1123,7 +1123,6 @@ __poll_t videobuf_poll_stream(struct file *file,
struct videobuf_buffer *buf = NULL;
__poll_t rc = 0;
- poll_wait(file, &buf->done, wait);
videobuf_queue_lock(q);
if (q->streaming) {
if (!list_empty(&q->stream))
@@ -1143,7 +1142,9 @@ __poll_t videobuf_poll_stream(struct file *file,
}
buf = q->read_buf;
}
- if (!buf)
+ if (buf)
+ poll_wait(file, &buf->done, wait);
+ else
rc = EPOLLERR;
if (0 == rc) {
These patches support upcoming UV systems that do not have a UV HUB.
* Save OEM_ID from ACPI MADT probe
* Return UV Hubless System Type
* Add return code to UV BIOS Init function
* Setup UV functions for Hubless UV Systems
* Add UV Hubbed/Hubless Proc FS Files
* Decode UVsystab Info
* Account for UV Hubless in is_uvX_hub Ops
--
This is a note to let you know that I've just added the patch titled
serial: sprd: correct the wrong sequence of arguments
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the tty-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 9c801e313195addaf11c16e155f50789d6ebfd19 Mon Sep 17 00:00:00 2001
From: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Date: Thu, 5 Sep 2019 15:41:51 +0800
Subject: serial: sprd: correct the wrong sequence of arguments
The sequence of arguments which was passed to handle_lsr_errors() didn't
match the parameters defined in that function, &lsr was passed to flag
and &flag was passed to lsr, this patch fixed that.
Fixes: b7396a38fb28 ("tty/serial: Add Spreadtrum sc9836-uart driver support")
Signed-off-by: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Signed-off-by: Chunyan Zhang <zhang.lyra(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20190905074151.5268-1-zhang.lyra@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/sprd_serial.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
index f8db5c8e4e39..771d11196523 100644
--- a/drivers/tty/serial/sprd_serial.c
+++ b/drivers/tty/serial/sprd_serial.c
@@ -617,7 +617,7 @@ static inline void sprd_rx(struct uart_port *port)
if (lsr & (SPRD_LSR_BI | SPRD_LSR_PE |
SPRD_LSR_FE | SPRD_LSR_OE))
- if (handle_lsr_errors(port, &lsr, &flag))
+ if (handle_lsr_errors(port, &flag, &lsr))
continue;
if (uart_handle_sysrq_char(port, ch))
continue;
--
2.23.0
This is a note to let you know that I've just added the patch titled
firmware: google: check if size is valid when decoding VPD data
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 4b708b7b1a2c09fbdfff6b942ebe3a160213aacd Mon Sep 17 00:00:00 2001
From: Hung-Te Lin <hungte(a)chromium.org>
Date: Fri, 30 Aug 2019 10:23:58 +0800
Subject: firmware: google: check if size is valid when decoding VPD data
The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.
To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.
Fixes: ad2ac9d5c5e0 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin <hungte(a)chromium.org>
Cc: stable <stable(a)vger.kernel.org>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd(a)chromium.org>
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/firmware/google/vpd.c | 4 +-
drivers/firmware/google/vpd_decode.c | 55 ++++++++++++++++------------
drivers/firmware/google/vpd_decode.h | 6 +--
3 files changed, 37 insertions(+), 28 deletions(-)
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 0739f3b70347..db0812263d46 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -92,8 +92,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
return VPD_OK;
}
-static int vpd_section_attrib_add(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+static int vpd_section_attrib_add(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg)
{
int ret;
diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
index 92e3258552fc..dda525c0f968 100644
--- a/drivers/firmware/google/vpd_decode.c
+++ b/drivers/firmware/google/vpd_decode.c
@@ -9,8 +9,8 @@
#include "vpd_decode.h"
-static int vpd_decode_len(const s32 max_len, const u8 *in,
- s32 *length, s32 *decoded_len)
+static int vpd_decode_len(const u32 max_len, const u8 *in,
+ u32 *length, u32 *decoded_len)
{
u8 more;
int i = 0;
@@ -30,18 +30,39 @@ static int vpd_decode_len(const s32 max_len, const u8 *in,
} while (more);
*decoded_len = i;
+ return VPD_OK;
+}
+
+static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
+ u32 *_consumed, const u8 **entry, u32 *entry_len)
+{
+ u32 decoded_len;
+ u32 consumed = *_consumed;
+
+ if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
+ entry_len, &decoded_len) != VPD_OK)
+ return VPD_FAIL;
+ if (max_len - consumed < decoded_len)
+ return VPD_FAIL;
+
+ consumed += decoded_len;
+ *entry = input_buf + consumed;
+
+ /* entry_len is untrusted data and must be checked again. */
+ if (max_len - consumed < *entry_len)
+ return VPD_FAIL;
+ consumed += decoded_len;
+ *_consumed = consumed;
return VPD_OK;
}
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg)
{
int type;
- int res;
- s32 key_len;
- s32 value_len;
- s32 decoded_len;
+ u32 key_len;
+ u32 value_len;
const u8 *key;
const u8 *value;
@@ -56,26 +77,14 @@ int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
case VPD_TYPE_STRING:
(*consumed)++;
- /* key */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &key_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len >= max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &key,
+ &key_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- key = &input_buf[*consumed];
- *consumed += key_len;
-
- /* value */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &value_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len > max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &value,
+ &value_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- value = &input_buf[*consumed];
- *consumed += value_len;
-
if (type == VPD_TYPE_STRING)
return callback(key, key_len, value, value_len,
callback_arg);
diff --git a/drivers/firmware/google/vpd_decode.h b/drivers/firmware/google/vpd_decode.h
index cf8c2ace155a..8dbe41cac599 100644
--- a/drivers/firmware/google/vpd_decode.h
+++ b/drivers/firmware/google/vpd_decode.h
@@ -25,8 +25,8 @@ enum {
};
/* Callback for vpd_decode_string to invoke. */
-typedef int vpd_decode_callback(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+typedef int vpd_decode_callback(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg);
/*
@@ -44,7 +44,7 @@ typedef int vpd_decode_callback(const u8 *key, s32 key_len,
* If one entry is successfully decoded, sends it to callback and returns the
* result.
*/
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg);
#endif /* __VPD_DECODE_H */
--
2.23.0
This is a note to let you know that I've just added the patch titled
/dev/mem: Bail out upon SIGKILL.
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 8619e5bdeee8b2c685d686281f2d2a6017c4bc15 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Date: Mon, 26 Aug 2019 22:13:25 +0900
Subject: /dev/mem: Bail out upon SIGKILL.
syzbot found that a thread can stall for minutes inside read_mem() or
write_mem() after that thread was killed by SIGKILL [1]. Reading from
iomem areas of /dev/mem can be slow, depending on the hardware.
While reading 2GB at one read() is legal, delaying termination of killed
thread for minutes is bad. Thus, allow reading/writing /dev/mem and
/dev/kmem to be preemptible and killable.
[ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
[ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
[ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
[ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
[ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
Theoretically, reading/writing /dev/mem and /dev/kmem can become
"interruptible". But this patch chose "killable". Future patch will make
them "interruptible" so that we can revert to "killable" if some program
regressed.
[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f…
Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Cc: stable <stable(a)vger.kernel.org>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40(a)syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/1566825205-10703-1-git-send-email-penguin-kernel@…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/mem.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index b08dc50f9f26..9eb564c002f6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -97,6 +97,13 @@ void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
}
#endif
+static inline bool should_stop_iteration(void)
+{
+ if (need_resched())
+ cond_resched();
+ return fatal_signal_pending(current);
+}
+
/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
@@ -175,6 +182,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
p += sz;
count -= sz;
read += sz;
+ if (should_stop_iteration())
+ break;
}
kfree(bounce);
@@ -251,6 +260,8 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -468,6 +479,10 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
read += sz;
low_count -= sz;
count -= sz;
+ if (should_stop_iteration()) {
+ count = 0;
+ break;
+ }
}
}
@@ -492,6 +507,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
buf += sz;
read += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
@@ -544,6 +561,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -595,6 +614,8 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
buf += sz;
virtr += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
--
2.23.0
This is a note to let you know that I've just added the patch titled
USB: usbcore: Fix slab-out-of-bounds bug during device reset
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 3dd550a2d36596a1b0ee7955da3b611c031d3873 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern(a)rowland.harvard.edu>
Date: Wed, 4 Sep 2019 11:56:27 -0400
Subject: USB: usbcore: Fix slab-out-of-bounds bug during device reset
The syzbot fuzzer provoked a slab-out-of-bounds error in the USB core:
BUG: KASAN: slab-out-of-bounds in memcmp+0xa6/0xb0 lib/string.c:904
Read of size 1 at addr ffff8881d175bed6 by task kworker/0:3/2746
CPU: 0 PID: 2746 Comm: kworker/0:3 Not tainted 5.3.0-rc5+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
memcmp+0xa6/0xb0 lib/string.c:904
memcmp include/linux/string.h:400 [inline]
descriptors_changed drivers/usb/core/hub.c:5579 [inline]
usb_reset_and_verify_device+0x564/0x1300 drivers/usb/core/hub.c:5729
usb_reset_device+0x4c1/0x920 drivers/usb/core/hub.c:5898
rt2x00usb_probe+0x53/0x7af
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:806
The error occurs when the descriptors_changed() routine (called during
a device reset) attempts to compare the old and new BOS and capability
descriptors. The length it uses for the comparison is the
wTotalLength value stored in BOS descriptor, but this value is not
necessarily the same as the length actually allocated for the
descriptors. If it is larger the routine will call memcmp() with a
length that is too big, thus reading beyond the end of the allocated
region and leading to this fault.
The kernel reads the BOS descriptor twice: first to get the total
length of all the capability descriptors, and second to read it along
with all those other descriptors. A malicious (or very faulty) device
may send different values for the BOS descriptor fields each time.
The memory area will be allocated using the wTotalLength value read
the first time, but stored within it will be the value read the second
time.
To prevent this possibility from causing any errors, this patch
modifies the BOS descriptor after it has been read the second time:
It sets the wTotalLength field to the actual length of the descriptors
that were read in and validated. Then the memcpy() call, or any other
code using these descriptors, will be able to rely on wTotalLength
being valid.
Reported-and-tested-by: syzbot+35f4d916c623118d576e(a)syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu>
CC: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1909041154260.1722-100000@iolanth…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/core/config.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 9d6cb709ca7b..151a74a54386 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -921,7 +921,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
struct usb_bos_descriptor *bos;
struct usb_dev_cap_header *cap;
struct usb_ssp_cap_descriptor *ssp_cap;
- unsigned char *buffer;
+ unsigned char *buffer, *buffer0;
int length, total_len, num, i, ssac;
__u8 cap_type;
int ret;
@@ -966,10 +966,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
ret = -ENOMSG;
goto err;
}
+
+ buffer0 = buffer;
total_len -= length;
+ buffer += length;
for (i = 0; i < num; i++) {
- buffer += length;
cap = (struct usb_dev_cap_header *)buffer;
if (total_len < sizeof(*cap) || total_len < cap->bLength) {
@@ -983,8 +985,6 @@ int usb_get_bos_descriptor(struct usb_device *dev)
break;
}
- total_len -= length;
-
if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
dev_warn(ddev, "descriptor type invalid, skip\n");
continue;
@@ -1019,7 +1019,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
default:
break;
}
+
+ total_len -= length;
+ buffer += length;
}
+ dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0);
return 0;
--
2.23.0
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/142252
One or more kernel tests failed:
aarch64:
❌ Boot test
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the d911cedb6528 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
hid-logitech-hidpp-remove-support-for-the-g700-over-.patch
ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
ftrace-check-for-successful-allocation-of-hash.patch
ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
usbtmc-more-sanity-checking-for-packet-size.patch
usb-storage-add-new-jms567-revision-to-unusual_devs.patch
usb-cdc-wdm-fix-race-between-write-and-disconnect-due-to-flag-abuse.patch
usb-hcd-use-managed-device-resources.patch
usb-chipidea-udc-don-t-do-hardware-access-if-gadget-has-stopped.patch
usb-host-ohci-fix-a-race-condition-between-shutdown-and-irq.patch
usb-host-xhci-rcar-fix-typo-in-compatible-string-matching.patch
usb-storage-ums-realtek-update-module-parameter-description-for-auto_delink_en.patch
usb-storage-ums-realtek-whitelist-auto-delink-support.patch
tools-power-turbostat-fix-caller-parameter-of-get_tdp_amd.patch
kvm-ppc-book3s-fix-incorrect-guest-to-user-translation-error-handling.patch
kvm-arm-arm64-vgic-fix-potential-deadlock-when-ap_list-is-long.patch
kvm-arm-arm64-vgic-v2-handle-sgi-bits-in-gicd_i-s-c-pendr0-as-wi.patch
mei-me-add-tiger-lake-point-lp-device-id.patch
revert-mmc-sdhci-tegra-drop-get_ro-implementation.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
❌ Boot test [0]
⚡⚡⚡ selinux-policy: serge-testsuite [19]
🚧 ⚡⚡⚡ Storage blktests [20]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
🚧 ✅ IOMMU boot test [21]
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test [0]
⚡⚡⚡ Podman system integration test (as root) [1]
⚡⚡⚡ Podman system integration test (as user) [1]
⚡⚡⚡ Loopdev Sanity [2]
⚡⚡⚡ jvm test suite [3]
⚡⚡⚡ AMTU (Abstract Machine Test Utility) [4]
⚡⚡⚡ LTP: openposix test suite [5]
⚡⚡⚡ Ethernet drivers sanity [6]
⚡⚡⚡ Networking socket: fuzz [7]
⚡⚡⚡ Networking: igmp conformance test [8]
⚡⚡⚡ audit: audit testsuite test [9]
⚡⚡⚡ httpd: mod_ssl smoke sanity [10]
⚡⚡⚡ iotop: sanity [11]
⚡⚡⚡ tuned: tune-processes-through-perf [12]
⚡⚡⚡ pciutils: sanity smoke test [22]
⚡⚡⚡ Usex - version 1.9-29 [13]
⚡⚡⚡ stress: stress-ng [14]
🚧 ⚡⚡⚡ LTP lite [15]
🚧 ⚡⚡⚡ Memory function: kaslr [16]
🚧 ⚡⚡⚡ Networking ipsec: basic netns transport [17]
🚧 ⚡⚡⚡ Networking ipsec: basic netns tunnel [17]
🚧 ⚡⚡⚡ trace: ftrace/tracer [18]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#trace/ftrace…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
[22]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
The patch
regulator: Defer init completion for a while after late_initcall
has been applied to the regulator tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator.git for-5.4
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
>From 55576cf1853798e86f620766e23b604c9224c19c Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie(a)kernel.org>
Date: Wed, 4 Sep 2019 13:42:50 +0100
Subject: [PATCH] regulator: Defer init completion for a while after
late_initcall
The kernel has no way of knowing when we have finished instantiating
drivers, between deferred probe and systems that build key drivers as
modules we might be doing this long after userspace has booted. This has
always been a bit of an issue with regulator_init_complete since it can
power off hardware that's not had it's driver loaded which can result in
user visible effects, the main case is powering off displays. Practically
speaking it's not been an issue in real systems since most systems that
use the regulator API are embedded and build in key drivers anyway but
with Arm laptops coming on the market it's becoming more of an issue so
let's do something about it.
In the absence of any better idea just defer the powering off for 30s
after late_initcall(), this is obviously a hack but it should mask the
issue for now and it's no more arbitrary than late_initcall() itself.
Ideally we'd have some heuristics to detect if we're on an affected
system and tune or skip the delay appropriately, and there may be some
need for a command line option to be added.
Link: https://lore.kernel.org/r/20190904124250.25844-1-broonie@kernel.org
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Tested-by: Lee Jones <lee.jones(a)linaro.org>
Cc: stable(a)vger.kernel.org
---
drivers/regulator/core.c | 42 +++++++++++++++++++++++++++++-----------
1 file changed, 31 insertions(+), 11 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 4a27a46ec6e7..340db986b67f 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5644,7 +5644,7 @@ static int __init regulator_init(void)
/* init early to allow our consumers to complete system booting */
core_initcall(regulator_init);
-static int __init regulator_late_cleanup(struct device *dev, void *data)
+static int regulator_late_cleanup(struct device *dev, void *data)
{
struct regulator_dev *rdev = dev_to_rdev(dev);
const struct regulator_ops *ops = rdev->desc->ops;
@@ -5693,17 +5693,8 @@ static int __init regulator_late_cleanup(struct device *dev, void *data)
return 0;
}
-static int __init regulator_init_complete(void)
+static void regulator_init_complete_work_function(struct work_struct *work)
{
- /*
- * Since DT doesn't provide an idiomatic mechanism for
- * enabling full constraints and since it's much more natural
- * with DT to provide them just assume that a DT enabled
- * system has full constraints.
- */
- if (of_have_populated_dt())
- has_full_constraints = true;
-
/*
* Regulators may had failed to resolve their input supplies
* when were registered, either because the input supply was
@@ -5721,6 +5712,35 @@ static int __init regulator_init_complete(void)
*/
class_for_each_device(®ulator_class, NULL, NULL,
regulator_late_cleanup);
+}
+
+static DECLARE_DELAYED_WORK(regulator_init_complete_work,
+ regulator_init_complete_work_function);
+
+static int __init regulator_init_complete(void)
+{
+ /*
+ * Since DT doesn't provide an idiomatic mechanism for
+ * enabling full constraints and since it's much more natural
+ * with DT to provide them just assume that a DT enabled
+ * system has full constraints.
+ */
+ if (of_have_populated_dt())
+ has_full_constraints = true;
+
+ /*
+ * We punt completion for an arbitrary amount of time since
+ * systems like distros will load many drivers from userspace
+ * so consumers might not always be ready yet, this is
+ * particularly an issue with laptops where this might bounce
+ * the display off then on. Ideally we'd get a notification
+ * from userspace when this happens but we don't so just wait
+ * a bit and hope we waited long enough. It'd be better if
+ * we'd only do this on systems that need it, and a kernel
+ * command line option might be useful.
+ */
+ schedule_delayed_work(®ulator_init_complete_work,
+ msecs_to_jiffies(30000));
return 0;
}
--
2.20.1
This is a note to let you know that I've just added the patch titled
USB: usbcore: Fix slab-out-of-bounds bug during device reset
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 3dd550a2d36596a1b0ee7955da3b611c031d3873 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern(a)rowland.harvard.edu>
Date: Wed, 4 Sep 2019 11:56:27 -0400
Subject: USB: usbcore: Fix slab-out-of-bounds bug during device reset
The syzbot fuzzer provoked a slab-out-of-bounds error in the USB core:
BUG: KASAN: slab-out-of-bounds in memcmp+0xa6/0xb0 lib/string.c:904
Read of size 1 at addr ffff8881d175bed6 by task kworker/0:3/2746
CPU: 0 PID: 2746 Comm: kworker/0:3 Not tainted 5.3.0-rc5+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
memcmp+0xa6/0xb0 lib/string.c:904
memcmp include/linux/string.h:400 [inline]
descriptors_changed drivers/usb/core/hub.c:5579 [inline]
usb_reset_and_verify_device+0x564/0x1300 drivers/usb/core/hub.c:5729
usb_reset_device+0x4c1/0x920 drivers/usb/core/hub.c:5898
rt2x00usb_probe+0x53/0x7af
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:806
The error occurs when the descriptors_changed() routine (called during
a device reset) attempts to compare the old and new BOS and capability
descriptors. The length it uses for the comparison is the
wTotalLength value stored in BOS descriptor, but this value is not
necessarily the same as the length actually allocated for the
descriptors. If it is larger the routine will call memcmp() with a
length that is too big, thus reading beyond the end of the allocated
region and leading to this fault.
The kernel reads the BOS descriptor twice: first to get the total
length of all the capability descriptors, and second to read it along
with all those other descriptors. A malicious (or very faulty) device
may send different values for the BOS descriptor fields each time.
The memory area will be allocated using the wTotalLength value read
the first time, but stored within it will be the value read the second
time.
To prevent this possibility from causing any errors, this patch
modifies the BOS descriptor after it has been read the second time:
It sets the wTotalLength field to the actual length of the descriptors
that were read in and validated. Then the memcpy() call, or any other
code using these descriptors, will be able to rely on wTotalLength
being valid.
Reported-and-tested-by: syzbot+35f4d916c623118d576e(a)syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu>
CC: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1909041154260.1722-100000@iolanth…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/core/config.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 9d6cb709ca7b..151a74a54386 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -921,7 +921,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
struct usb_bos_descriptor *bos;
struct usb_dev_cap_header *cap;
struct usb_ssp_cap_descriptor *ssp_cap;
- unsigned char *buffer;
+ unsigned char *buffer, *buffer0;
int length, total_len, num, i, ssac;
__u8 cap_type;
int ret;
@@ -966,10 +966,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
ret = -ENOMSG;
goto err;
}
+
+ buffer0 = buffer;
total_len -= length;
+ buffer += length;
for (i = 0; i < num; i++) {
- buffer += length;
cap = (struct usb_dev_cap_header *)buffer;
if (total_len < sizeof(*cap) || total_len < cap->bLength) {
@@ -983,8 +985,6 @@ int usb_get_bos_descriptor(struct usb_device *dev)
break;
}
- total_len -= length;
-
if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
dev_warn(ddev, "descriptor type invalid, skip\n");
continue;
@@ -1019,7 +1019,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
default:
break;
}
+
+ total_len -= length;
+ buffer += length;
}
+ dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0);
return 0;
--
2.23.0
From: Ilya Leoshkevich <iii(a)linux.ibm.com>
[ Upstream commit bb2d267c448f4bc3a3389d97c56391cb779178ae ]
"masking, test in bounds 3" fails on s390, because
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0) ignores the top 32 bits of
BPF_REG_2. The reason is that JIT emits lcgfr instead of lcgr.
The associated comment indicates that the code was intended to
emit lcgr in the first place, it's just that the wrong opcode
was used.
Fix by using the correct opcode.
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Signed-off-by: Ilya Leoshkevich <iii(a)linux.ibm.com>
Acked-by: Vasily Gorbik <gor(a)linux.ibm.com>
Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/s390/net/bpf_jit_comp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 727693e283da2..e53d410e88703 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -886,7 +886,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
break;
case BPF_ALU64 | BPF_NEG: /* dst = -dst */
/* lcgr %dst,%dst */
- EMIT4(0xb9130000, dst_reg, dst_reg);
+ EMIT4(0xb9030000, dst_reg, dst_reg);
break;
/*
* BPF_FROM_BE/LE
--
2.20.1
This ThinkCentre machine has a new realtek codec alc222, it is not
in the support list, we add it in the realtek.c then this machine
can apply FIXUPs for the realtek codec.
And this machine has two front mics which can't be handled
by PA so far, it uses the pin 0x18 and 0x19 as the front mics, as
a result the existing FIXUP ALC294_FIXUP_LENOVO_MIC_LOCATION doesn't
work on this machine. Fortunately another FIXUP
ALC283_FIXUP_HEADSET_MIC also can change the location for one of the
two mics on this machine.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang(a)canonical.com>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3b9583aa63c1..74697c1dd1d5 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7151,6 +7151,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
@@ -9038,6 +9039,7 @@ static int patch_alc680(struct hda_codec *codec)
static const struct hda_device_id snd_hda_id_realtek[] = {
HDA_CODEC_ENTRY(0x10ec0215, "ALC215", patch_alc269),
HDA_CODEC_ENTRY(0x10ec0221, "ALC221", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0222, "ALC222", patch_alc269),
HDA_CODEC_ENTRY(0x10ec0225, "ALC225", patch_alc269),
HDA_CODEC_ENTRY(0x10ec0231, "ALC231", patch_alc269),
HDA_CODEC_ENTRY(0x10ec0233, "ALC233", patch_alc269),
--
2.17.1
S-35390A RTC chip allows to set the lower two digit of the Western calendar year (00 to 99) and links together with the auto calendar from the year 2000 to the year 2099. If we try to set year earlier than 2000 then hardware clock get reset to "epoch". This patch check for year value between 2000 to 2099 otherwise returns "EINVAL" error. In conclusion this patch restricts system to set hardware clock to set year below and above the year 2000 and 2099 respectively.
Signed-off-by: Aashish P Sonawane mailto:AashishPSonawane@eaton.com
Suggested-by: Meghan Saitwal mailto:MeghanSaitwal@eaton.com
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c
index 84806ff763cf..aea52548571e 100644
--- a/drivers/rtc/rtc-s35390a.c
+++ b/drivers/rtc/rtc-s35390a.c
@@ -214,6 +214,9 @@ static int s35390a_rtc_set_time(struct device *dev, struct rtc_time *tm)
int i, err;
char buf[7], status;
+ if (tm->tm_year < 100 || tm->tm_year > 199)
+ return EINVAL;
+
dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d mday=%d, "
"mon=%d, year=%d, wday=%d\n", __func__, tm->tm_sec,
tm->tm_min, tm->tm_hour, tm->tm_mday, tm->tm_mon, tm->tm_year,
This is a note to let you know that I've just added the patch titled
/dev/mem: Bail out upon SIGKILL.
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 8619e5bdeee8b2c685d686281f2d2a6017c4bc15 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Date: Mon, 26 Aug 2019 22:13:25 +0900
Subject: /dev/mem: Bail out upon SIGKILL.
syzbot found that a thread can stall for minutes inside read_mem() or
write_mem() after that thread was killed by SIGKILL [1]. Reading from
iomem areas of /dev/mem can be slow, depending on the hardware.
While reading 2GB at one read() is legal, delaying termination of killed
thread for minutes is bad. Thus, allow reading/writing /dev/mem and
/dev/kmem to be preemptible and killable.
[ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
[ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
[ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
[ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
[ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
Theoretically, reading/writing /dev/mem and /dev/kmem can become
"interruptible". But this patch chose "killable". Future patch will make
them "interruptible" so that we can revert to "killable" if some program
regressed.
[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f…
Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Cc: stable <stable(a)vger.kernel.org>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40(a)syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/1566825205-10703-1-git-send-email-penguin-kernel@…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/mem.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index b08dc50f9f26..9eb564c002f6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -97,6 +97,13 @@ void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
}
#endif
+static inline bool should_stop_iteration(void)
+{
+ if (need_resched())
+ cond_resched();
+ return fatal_signal_pending(current);
+}
+
/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
@@ -175,6 +182,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
p += sz;
count -= sz;
read += sz;
+ if (should_stop_iteration())
+ break;
}
kfree(bounce);
@@ -251,6 +260,8 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -468,6 +479,10 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
read += sz;
low_count -= sz;
count -= sz;
+ if (should_stop_iteration()) {
+ count = 0;
+ break;
+ }
}
}
@@ -492,6 +507,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
buf += sz;
read += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
@@ -544,6 +561,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -595,6 +614,8 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
buf += sz;
virtr += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
--
2.23.0
This is a note to let you know that I've just added the patch titled
firmware: google: check if size is valid when decoding VPD data
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 4b708b7b1a2c09fbdfff6b942ebe3a160213aacd Mon Sep 17 00:00:00 2001
From: Hung-Te Lin <hungte(a)chromium.org>
Date: Fri, 30 Aug 2019 10:23:58 +0800
Subject: firmware: google: check if size is valid when decoding VPD data
The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.
To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.
Fixes: ad2ac9d5c5e0 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin <hungte(a)chromium.org>
Cc: stable <stable(a)vger.kernel.org>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd(a)chromium.org>
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/firmware/google/vpd.c | 4 +-
drivers/firmware/google/vpd_decode.c | 55 ++++++++++++++++------------
drivers/firmware/google/vpd_decode.h | 6 +--
3 files changed, 37 insertions(+), 28 deletions(-)
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 0739f3b70347..db0812263d46 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -92,8 +92,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
return VPD_OK;
}
-static int vpd_section_attrib_add(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+static int vpd_section_attrib_add(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg)
{
int ret;
diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
index 92e3258552fc..dda525c0f968 100644
--- a/drivers/firmware/google/vpd_decode.c
+++ b/drivers/firmware/google/vpd_decode.c
@@ -9,8 +9,8 @@
#include "vpd_decode.h"
-static int vpd_decode_len(const s32 max_len, const u8 *in,
- s32 *length, s32 *decoded_len)
+static int vpd_decode_len(const u32 max_len, const u8 *in,
+ u32 *length, u32 *decoded_len)
{
u8 more;
int i = 0;
@@ -30,18 +30,39 @@ static int vpd_decode_len(const s32 max_len, const u8 *in,
} while (more);
*decoded_len = i;
+ return VPD_OK;
+}
+
+static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
+ u32 *_consumed, const u8 **entry, u32 *entry_len)
+{
+ u32 decoded_len;
+ u32 consumed = *_consumed;
+
+ if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
+ entry_len, &decoded_len) != VPD_OK)
+ return VPD_FAIL;
+ if (max_len - consumed < decoded_len)
+ return VPD_FAIL;
+
+ consumed += decoded_len;
+ *entry = input_buf + consumed;
+
+ /* entry_len is untrusted data and must be checked again. */
+ if (max_len - consumed < *entry_len)
+ return VPD_FAIL;
+ consumed += decoded_len;
+ *_consumed = consumed;
return VPD_OK;
}
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg)
{
int type;
- int res;
- s32 key_len;
- s32 value_len;
- s32 decoded_len;
+ u32 key_len;
+ u32 value_len;
const u8 *key;
const u8 *value;
@@ -56,26 +77,14 @@ int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
case VPD_TYPE_STRING:
(*consumed)++;
- /* key */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &key_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len >= max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &key,
+ &key_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- key = &input_buf[*consumed];
- *consumed += key_len;
-
- /* value */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &value_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len > max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &value,
+ &value_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- value = &input_buf[*consumed];
- *consumed += value_len;
-
if (type == VPD_TYPE_STRING)
return callback(key, key_len, value, value_len,
callback_arg);
diff --git a/drivers/firmware/google/vpd_decode.h b/drivers/firmware/google/vpd_decode.h
index cf8c2ace155a..8dbe41cac599 100644
--- a/drivers/firmware/google/vpd_decode.h
+++ b/drivers/firmware/google/vpd_decode.h
@@ -25,8 +25,8 @@ enum {
};
/* Callback for vpd_decode_string to invoke. */
-typedef int vpd_decode_callback(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+typedef int vpd_decode_callback(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg);
/*
@@ -44,7 +44,7 @@ typedef int vpd_decode_callback(const u8 *key, s32 key_len,
* If one entry is successfully decoded, sends it to callback and returns the
* result.
*/
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg);
#endif /* __VPD_DECODE_H */
--
2.23.0
This is a note to let you know that I've just added the patch titled
firmware: google: check if size is valid when decoding VPD data
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From d616b75cb793a0707345ccf4c6f239b6d16e1e5b Mon Sep 17 00:00:00 2001
From: Hung-Te Lin <hungte(a)chromium.org>
Date: Fri, 30 Aug 2019 10:23:58 +0800
Subject: firmware: google: check if size is valid when decoding VPD data
The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.
To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.
Fixes: ad2ac9d5c5e0 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin <hungte(a)chromium.org>
Cc: stable <stable(a)vger.kernel.org>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd(a)chromium.org>
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/firmware/google/vpd.c | 4 +-
drivers/firmware/google/vpd_decode.c | 55 ++++++++++++++++------------
drivers/firmware/google/vpd_decode.h | 6 +--
3 files changed, 37 insertions(+), 28 deletions(-)
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 0739f3b70347..db0812263d46 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -92,8 +92,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
return VPD_OK;
}
-static int vpd_section_attrib_add(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+static int vpd_section_attrib_add(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg)
{
int ret;
diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
index 92e3258552fc..dda525c0f968 100644
--- a/drivers/firmware/google/vpd_decode.c
+++ b/drivers/firmware/google/vpd_decode.c
@@ -9,8 +9,8 @@
#include "vpd_decode.h"
-static int vpd_decode_len(const s32 max_len, const u8 *in,
- s32 *length, s32 *decoded_len)
+static int vpd_decode_len(const u32 max_len, const u8 *in,
+ u32 *length, u32 *decoded_len)
{
u8 more;
int i = 0;
@@ -30,18 +30,39 @@ static int vpd_decode_len(const s32 max_len, const u8 *in,
} while (more);
*decoded_len = i;
+ return VPD_OK;
+}
+
+static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
+ u32 *_consumed, const u8 **entry, u32 *entry_len)
+{
+ u32 decoded_len;
+ u32 consumed = *_consumed;
+
+ if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
+ entry_len, &decoded_len) != VPD_OK)
+ return VPD_FAIL;
+ if (max_len - consumed < decoded_len)
+ return VPD_FAIL;
+
+ consumed += decoded_len;
+ *entry = input_buf + consumed;
+
+ /* entry_len is untrusted data and must be checked again. */
+ if (max_len - consumed < *entry_len)
+ return VPD_FAIL;
+ consumed += decoded_len;
+ *_consumed = consumed;
return VPD_OK;
}
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg)
{
int type;
- int res;
- s32 key_len;
- s32 value_len;
- s32 decoded_len;
+ u32 key_len;
+ u32 value_len;
const u8 *key;
const u8 *value;
@@ -56,26 +77,14 @@ int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
case VPD_TYPE_STRING:
(*consumed)++;
- /* key */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &key_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len >= max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &key,
+ &key_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- key = &input_buf[*consumed];
- *consumed += key_len;
-
- /* value */
- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
- &value_len, &decoded_len);
- if (res != VPD_OK || *consumed + decoded_len > max_len)
+ if (vpd_decode_entry(max_len, input_buf, consumed, &value,
+ &value_len) != VPD_OK)
return VPD_FAIL;
- *consumed += decoded_len;
- value = &input_buf[*consumed];
- *consumed += value_len;
-
if (type == VPD_TYPE_STRING)
return callback(key, key_len, value, value_len,
callback_arg);
diff --git a/drivers/firmware/google/vpd_decode.h b/drivers/firmware/google/vpd_decode.h
index cf8c2ace155a..8dbe41cac599 100644
--- a/drivers/firmware/google/vpd_decode.h
+++ b/drivers/firmware/google/vpd_decode.h
@@ -25,8 +25,8 @@ enum {
};
/* Callback for vpd_decode_string to invoke. */
-typedef int vpd_decode_callback(const u8 *key, s32 key_len,
- const u8 *value, s32 value_len,
+typedef int vpd_decode_callback(const u8 *key, u32 key_len,
+ const u8 *value, u32 value_len,
void *arg);
/*
@@ -44,7 +44,7 @@ typedef int vpd_decode_callback(const u8 *key, s32 key_len,
* If one entry is successfully decoded, sends it to callback and returns the
* result.
*/
-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
vpd_decode_callback callback, void *callback_arg);
#endif /* __VPD_DECODE_H */
--
2.23.0
This is a note to let you know that I've just added the patch titled
/dev/mem: Bail out upon SIGKILL.
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From e1b19733d5a9e0aed3f5594a51b21601b4618578 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Date: Mon, 26 Aug 2019 22:13:25 +0900
Subject: /dev/mem: Bail out upon SIGKILL.
syzbot found that a thread can stall for minutes inside read_mem() or
write_mem() after that thread was killed by SIGKILL [1]. Reading from
iomem areas of /dev/mem can be slow, depending on the hardware.
While reading 2GB at one read() is legal, delaying termination of killed
thread for minutes is bad. Thus, allow reading/writing /dev/mem and
/dev/kmem to be preemptible and killable.
[ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
[ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
[ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
[ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
[ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
Theoretically, reading/writing /dev/mem and /dev/kmem can become
"interruptible". But this patch chose "killable". Future patch will make
them "interruptible" so that we can revert to "killable" if some program
regressed.
[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f…
Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Cc: stable <stable(a)vger.kernel.org>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40(a)syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/1566825205-10703-1-git-send-email-penguin-kernel@…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/mem.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index b08dc50f9f26..9eb564c002f6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -97,6 +97,13 @@ void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
}
#endif
+static inline bool should_stop_iteration(void)
+{
+ if (need_resched())
+ cond_resched();
+ return fatal_signal_pending(current);
+}
+
/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
@@ -175,6 +182,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
p += sz;
count -= sz;
read += sz;
+ if (should_stop_iteration())
+ break;
}
kfree(bounce);
@@ -251,6 +260,8 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -468,6 +479,10 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
read += sz;
low_count -= sz;
count -= sz;
+ if (should_stop_iteration()) {
+ count = 0;
+ break;
+ }
}
}
@@ -492,6 +507,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
buf += sz;
read += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
@@ -544,6 +561,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
p += sz;
count -= sz;
written += sz;
+ if (should_stop_iteration())
+ break;
}
*ppos += written;
@@ -595,6 +614,8 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
buf += sz;
virtr += sz;
p += sz;
+ if (should_stop_iteration())
+ break;
}
free_page((unsigned long)kbuf);
}
--
2.23.0
This bit was fliped on for "syncing dependencies between camera and
graphics". BSpec has no recollection why, and it is causing
unrecoverable GPU hangs with Vulkan compute workloads.
>From BSpec, setting bit5 to 0 enables relaxed padding requiremets for
buffers, 1D and 2D non-array, non-MSAA, non-mip-mapped linear surfaces;
and *must* be set to 0h on skl+ to ensure "Out of Bounds" case is
suppressed.
Reported-by: Jason Ekstrand <jason(a)jlekstrand.net>
Suggested-by: Jason Ekstrand <jason(a)jlekstrand.net>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110998
Fixes: 8424171e135c ("drm/i915/gen9: h/w w/a: syncing dependencies between camera and graphics")
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Tested-by: denys.kostin(a)globallogic.com
Cc: Jason Ekstrand <jason(a)jlekstrand.net>
Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> # v4.1+
---
drivers/gpu/drm/i915/gt/intel_workarounds.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
index 8639fcccdb42..243d3f77be13 100644
--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
+++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
@@ -297,11 +297,6 @@ static void gen9_ctx_workarounds_init(struct intel_engine_cs *engine,
FLOW_CONTROL_ENABLE |
PARTIAL_INSTRUCTION_SHOOTDOWN_DISABLE);
- /* Syncing dependencies between camera and graphics:skl,bxt,kbl */
- if (!IS_COFFEELAKE(i915))
- WA_SET_BIT_MASKED(HALF_SLICE_CHICKEN3,
- GEN9_DISABLE_OCL_OOB_SUPPRESS_LOGIC);
-
/* WaEnableYV12BugFixInHalfSliceChicken7:skl,bxt,kbl,glk,cfl */
/* WaEnableSamplerGPGPUPreemptionSupport:skl,bxt,kbl,cfl */
WA_SET_BIT_MASKED(GEN9_HALF_SLICE_CHICKEN7,
--
2.23.0
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b9500577d361522a3d9f14da8cf41dc1d824904e Mon Sep 17 00:00:00 2001
From: Luca Coelho <luciano.coelho(a)intel.com>
Date: Wed, 21 Aug 2019 20:17:32 +0300
Subject: [PATCH] iwlwifi: pcie: handle switching killer Qu B0 NICs to C0
We need to use a different firmware for C0 versions of killer Qu NICs.
Add structures for them and handle them in the if block that detects
C0 revisions.
Additionally, instead of having an inclusive check for QnJ devices,
make the selection exclusive, so that switching to QnJ is the
exception, not the default. This prevents us from having to add all
the non-QnJ cards to an exclusion list. To do so, only go into the
QnJ block if the device has an RF ID type HR and HW revision QnJ.
Cc: stable(a)vger.kernel.org # 5.2
Signed-off-by: Luca Coelho <luciano.coelho(a)intel.com>
Link: https://lore.kernel.org/r/20190821171732.2266-1-luca@coelho.fi
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
index 1f500cddb3a7..55b713255b8e 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -556,6 +556,30 @@ const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0 = {
.max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
};
+const struct iwl_cfg killer1650s_2ax_cfg_qu_c0_hr_b0 = {
+ .name = "Killer(R) Wi-Fi 6 AX1650i 160MHz Wireless Network Adapter (201NGW)",
+ .fw_name_pre = IWL_QU_C_HR_B_FW_PRE,
+ IWL_DEVICE_22500,
+ /*
+ * This device doesn't support receiving BlockAck with a large bitmap
+ * so we need to restrict the size of transmitted aggregation to the
+ * HT size; mac80211 would otherwise pick the HE max (256) by default.
+ */
+ .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg killer1650i_2ax_cfg_qu_c0_hr_b0 = {
+ .name = "Killer(R) Wi-Fi 6 AX1650s 160MHz Wireless Network Adapter (201D2W)",
+ .fw_name_pre = IWL_QU_C_HR_B_FW_PRE,
+ IWL_DEVICE_22500,
+ /*
+ * This device doesn't support receiving BlockAck with a large bitmap
+ * so we need to restrict the size of transmitted aggregation to the
+ * HT size; mac80211 would otherwise pick the HE max (256) by default.
+ */
+ .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
const struct iwl_cfg iwl22000_2ax_cfg_jf = {
.name = "Intel(R) Dual Band Wireless AX 22000",
.fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index 1c1bf1b281cd..6c04f8223aff 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -577,6 +577,8 @@ extern const struct iwl_cfg iwl_ax1650i_cfg_quz_hr;
extern const struct iwl_cfg iwl_ax1650s_cfg_quz_hr;
extern const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0;
extern const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0;
+extern const struct iwl_cfg killer1650s_2ax_cfg_qu_c0_hr_b0;
+extern const struct iwl_cfg killer1650i_2ax_cfg_qu_c0_hr_b0;
extern const struct iwl_cfg killer1650x_2ax_cfg;
extern const struct iwl_cfg killer1650w_2ax_cfg;
extern const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 7c5aaeaf7fe5..d9ed53b7c768 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -1062,6 +1062,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
iwl_trans->cfg = &iwl9560_2ac_cfg_qu_c0_jf_b0;
else if (iwl_trans->cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0)
iwl_trans->cfg = &iwl9560_2ac_160_cfg_qu_c0_jf_b0;
+ else if (iwl_trans->cfg == &killer1650s_2ax_cfg_qu_b0_hr_b0)
+ iwl_trans->cfg = &killer1650s_2ax_cfg_qu_c0_hr_b0;
+ else if (iwl_trans->cfg == &killer1650i_2ax_cfg_qu_b0_hr_b0)
+ iwl_trans->cfg = &killer1650i_2ax_cfg_qu_c0_hr_b0;
}
/* same thing for QuZ... */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 935e35dafce5..db62c8314603 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3602,12 +3602,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
}
} else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
- ((trans->cfg != &iwl_ax200_cfg_cc &&
- trans->cfg != &iwl_ax201_cfg_qu_hr &&
- trans->cfg != &killer1650x_2ax_cfg &&
- trans->cfg != &killer1650w_2ax_cfg &&
- trans->cfg != &iwl_ax201_cfg_quz_hr) ||
- trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0)) {
+ trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0) {
u32 hw_status;
hw_status = iwl_read_prph(trans, UMAG_GEN_HW_STATUS);
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ddfd151f3def9258397fcde7a372205a2d661903 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik(a)ozlabs.ru>
Date: Mon, 26 Aug 2019 14:55:20 +1000
Subject: [PATCH] KVM: PPC: Book3S: Fix incorrect guest-to-user-translation
error handling
H_PUT_TCE_INDIRECT handlers receive a page with up to 512 TCEs from
a guest. Although we verify correctness of TCEs before we do anything
with the existing tables, there is a small window when a check in
kvmppc_tce_validate might pass and right after that the guest alters
the page of TCEs, causing an early exit from the handler and leaving
srcu_read_lock(&vcpu->kvm->srcu) (virtual mode) or lock_rmap(rmap)
(real mode) locked.
This fixes the bug by jumping to the common exit code with an appropriate
unlock.
Cc: stable(a)vger.kernel.org # v4.11+
Fixes: 121f80ba68f1 ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
Signed-off-by: Alexey Kardashevskiy <aik(a)ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index e99a14798ab0..c4b606fe73eb 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -660,8 +660,10 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu,
}
tce = be64_to_cpu(tce);
- if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua))
- return H_PARAMETER;
+ if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua)) {
+ ret = H_PARAMETER;
+ goto unlock_exit;
+ }
list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
ret = kvmppc_tce_iommu_map(vcpu->kvm, stt,
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index f50bbeedfc66..b4f20f13b860 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -556,8 +556,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
unsigned long tce = be64_to_cpu(((u64 *)tces)[i]);
ua = 0;
- if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL))
- return H_PARAMETER;
+ if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL)) {
+ ret = H_PARAMETER;
+ goto unlock_exit;
+ }
list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt,
This is a note to let you know that I've just added the patch titled
phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From e6839c31a608e79f2057fab987dd814f5d3477e6 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Date: Tue, 6 Aug 2019 17:51:19 +0900
Subject: phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
The hardware manual should be revised, but the initial value of
VBCTRL.OCCLREN is set to 1 actually. If the bit is set, the hardware
clears VBCTRL.VBOUT and ADPCTRL.DRVVBUS registers automatically
when the hardware detects over-current signal from a USB power switch.
However, since the hardware doesn't have any registers which
indicates over-current, the driver cannot handle it at all. So, if
"is_otg_channel" hardware detects over-current, since ADPCTRL.DRVVBUS
register is cleared automatically, the channel cannot be used after
that.
To resolve this behavior, this patch sets the VBCTRL.OCCLREN to 0
to keep ADPCTRL.DRVVBUS even if the "is_otg_channel" hardware
detects over-current. (We assume a USB power switch itself protects
over-current and turns the VBUS off.)
This patch is inspired by a BSP patch from Kazuya Mizuguchi.
Fixes: 1114e2d31731 ("phy: rcar-gen3-usb2: change the mode to OTG on the combined channel")
Cc: <stable(a)vger.kernel.org> # v4.5+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index 8ffba67568ec..b7f6b1324395 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -61,6 +61,7 @@
USB2_OBINT_IDDIGCHG)
/* VBCTRL */
+#define USB2_VBCTRL_OCCLREN BIT(16)
#define USB2_VBCTRL_DRVVBUSSEL BIT(8)
/* LINECTRL1 */
@@ -374,6 +375,7 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)
writel(val, usb2_base + USB2_LINECTRL1);
val = readl(usb2_base + USB2_VBCTRL);
+ val &= ~USB2_VBCTRL_OCCLREN;
writel(val | USB2_VBCTRL_DRVVBUSSEL, usb2_base + USB2_VBCTRL);
val = readl(usb2_base + USB2_ADPCTRL);
writel(val | USB2_ADPCTRL_IDPULLUP, usb2_base + USB2_ADPCTRL);
--
2.23.0
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/142301
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 407a62af1176 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
hid-logitech-hidpp-remove-support-for-the-g700-over-.patch
ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
ftrace-check-for-successful-allocation-of-hash.patch
ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
usbtmc-more-sanity-checking-for-packet-size.patch
usb-storage-add-new-jms567-revision-to-unusual_devs.patch
usb-cdc-wdm-fix-race-between-write-and-disconnect-due-to-flag-abuse.patch
usb-hcd-use-managed-device-resources.patch
usb-chipidea-udc-don-t-do-hardware-access-if-gadget-has-stopped.patch
usb-host-ohci-fix-a-race-condition-between-shutdown-and-irq.patch
usb-host-xhci-rcar-fix-typo-in-compatible-string-matching.patch
usb-storage-ums-realtek-update-module-parameter-description-for-auto_delink_en.patch
usb-storage-ums-realtek-whitelist-auto-delink-support.patch
tools-power-turbostat-fix-caller-parameter-of-get_tdp_amd.patch
kvm-ppc-book3s-fix-incorrect-guest-to-user-translation-error-handling.patch
kvm-arm-arm64-vgic-fix-potential-deadlock-when-ap_list-is-long.patch
kvm-arm-arm64-vgic-v2-handle-sgi-bits-in-gicd_i-s-c-pendr0-as-wi.patch
mei-me-add-tiger-lake-point-lp-device-id.patch
revert-mmc-sdhci-tegra-drop-get_ro-implementation.patch
mmc-sdhci-of-at91-add-quirk-for-broken-hs200.patch
mmc-sdhci-cadence-enable-v4_mode-to-fix-adma-64-bit-addressing.patch
mmc-core-fix-init-of-sd-cards-reporting-an-invalid-vdd-range.patch
mmc-sdhci-sprd-fixed-incorrect-clock-divider.patch
mmc-sdhci-sprd-add-sdhci_quirk2_preset_value_broken.patch
stm-class-fix-a-double-free-of-stm_source_device.patch
intel_th-pci-add-support-for-another-lewisburg-pch.patch
intel_th-pci-add-tiger-lake-support.patch
typec-tcpm-fix-a-typo-in-the-comparison-of-pdo_max_voltage.patch
fsi-scom-don-t-abort-operations-for-minor-errors.patch
lkdtm-bugs-fix-build-error-in-lkdtm_exhaust_stack.patch
nfsv4-pnfs-fix-a-page-lock-leak-in-nfs_pageio_resend.patch
nfs-ensure-o_direct-reports-an-error-if-the-bytes-read-written-is-0.patch
revert-nfsv4-flexfiles-abort-i-o-early-if-the-layout-segment-was-invalidated.patch
lib-logic_pio-fix-rcu-usage.patch
lib-logic_pio-avoid-possible-overlap-for-unregistering-regions.patch
lib-logic_pio-add-logic_pio_unregister_range.patch
drm-amdgpu-add-aptx-quirk-for-dell-latitude-5495.patch
drm-amdgpu-fix-gfxoff-on-picasso-and-raven2.patch
drm-i915-don-t-deballoon-unused-ggtt-drm_mm_node-in-linux-guest.patch
drm-i915-call-dma_set_max_seg_size-in-i915_driver_hw_probe.patch
i2c-piix4-fix-port-selection-for-amd-family-16h-model-30h.patch
bus-hisi_lpc-unregister-logical-pio-range-to-avoid-potential-use-after-free.patch
bus-hisi_lpc-add-.remove-method-to-avoid-driver-unbind-crash.patch
vmci-release-resource-if-the-work-is-already-queued.patch
crypto-ccp-ignore-unconfigured-ccp-device-on-suspend-resume.patch
sunrpc-don-t-handle-errors-if-the-bind-connect-succeeded.patch
mt76-mt76x0u-do-not-reset-radio-on-resume.patch
mms-sdhci-sprd-add-sdhci_quirk_broken_card_detection.patch
mm-memcg-partially-revert-mm-memcontrol.c-keep-local-vm-counters-in-sync-with-the-hierarchical-ones.patch
mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
🚧 ✅ IOMMU boot test [21]
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test [0]
⚡⚡⚡ Podman system integration test (as root) [1]
⚡⚡⚡ Podman system integration test (as user) [1]
⚡⚡⚡ Loopdev Sanity [2]
⚡⚡⚡ jvm test suite [3]
⚡⚡⚡ AMTU (Abstract Machine Test Utility) [4]
⚡⚡⚡ LTP: openposix test suite [5]
⚡⚡⚡ Ethernet drivers sanity [6]
⚡⚡⚡ Networking socket: fuzz [7]
⚡⚡⚡ Networking: igmp conformance test [8]
⚡⚡⚡ audit: audit testsuite test [9]
⚡⚡⚡ httpd: mod_ssl smoke sanity [10]
⚡⚡⚡ iotop: sanity [11]
⚡⚡⚡ tuned: tune-processes-through-perf [12]
⚡⚡⚡ pciutils: sanity smoke test [22]
⚡⚡⚡ Usex - version 1.9-29 [13]
⚡⚡⚡ stress: stress-ng [14]
🚧 ⚡⚡⚡ LTP lite [15]
🚧 ⚡⚡⚡ Memory function: kaslr [16]
🚧 ⚡⚡⚡ Networking ipsec: basic netns transport [17]
🚧 ⚡⚡⚡ Networking ipsec: basic netns tunnel [17]
🚧 ⚡⚡⚡ trace: ftrace/tracer [18]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#trace/ftrace…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
[22]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
On Thu, Aug 29, 2019 at 09:59:48AM +0000, David Laight wrote:
> From: Nathan Chancellor
> > Sent: 28 August 2019 19:45
> ...
> > However, I think that -fno-builtin-* would be appropriate here because
> > we are providing our own setjmp implementation, meaning clang should not
> > be trying to do anything with the builtin implementation like building a
> > declaration for it.
>
> Isn't implementing setjmp impossible unless you tell the compiler that
> you function is 'setjmp-like' ?
No idea, PowerPC is the only architecture that does such a thing.
https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/tree/arch…
Goes back all the way to before git history (all the way to ppc64's
addition actually):
https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/?id…https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/arc…
I would just like this warning fixed given that PowerPC builds with
-Werror by default so it is causing a build failure in our CI.
Cheers,
Nathan
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c7c06a1532f3fe106687ac82a13492c6a619ff1c Mon Sep 17 00:00:00 2001
From: Andrew Cooks <andrew.cooks(a)opengear.com>
Date: Fri, 2 Aug 2019 14:52:46 +0200
Subject: [PATCH] i2c: piix4: Fix port selection for AMD Family 16h Model 30h
Family 16h Model 30h SMBus controller needs the same port selection fix
as described and fixed in commit 0fe16195f891 ("i2c: piix4: Fix SMBus port
selection for AMD Family 17h chips")
commit 6befa3fde65f ("i2c: piix4: Support alternative port selection
register") also fixed the port selection for Hudson2, but unfortunately
this is not the exact same device and the AMD naming and PCI Device IDs
aren't particularly helpful here.
The SMBus port selection register is common to the following Families
and models, as documented in AMD's publicly available BIOS and Kernel
Developer Guides:
50742 - Family 15h Model 60h-6Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
55072 - Family 15h Model 70h-7Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
52740 - Family 16h Model 30h-3Fh (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS)
The Hudson2 PCI Device ID (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) is shared
between Bolton FCH and Family 16h Model 30h, but the location of the
SmBus0Sel port selection bits are different:
51192 - Bolton Register Reference Guide
We distinguish between Bolton and Family 16h Model 30h using the PCI
Revision ID:
Bolton is device 0x780b, revision 0x15
Family 16h Model 30h is device 0x780b, revision 0x1F
Family 15h Model 60h and 70h are both device 0x790b, revision 0x4A.
The following additional public AMD BKDG documents were checked and do
not share the same port selection register:
42301 - Family 15h Model 00h-0Fh doesn't mention any
42300 - Family 15h Model 10h-1Fh doesn't mention any
49125 - Family 15h Model 30h-3Fh doesn't mention any
48751 - Family 16h Model 00h-0Fh uses the previously supported
index register SB800_PIIX4_PORT_IDX_ALT at 0x2e
Signed-off-by: Andrew Cooks <andrew.cooks(a)opengear.com>
Signed-off-by: Jean Delvare <jdelvare(a)suse.de>
Cc: stable(a)vger.kernel.org [v4.6+]
Signed-off-by: Wolfram Sang <wsa(a)the-dreams.de>
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index c46c4bddc7ca..cba325eb852f 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -91,7 +91,7 @@
#define SB800_PIIX4_PORT_IDX_MASK 0x06
#define SB800_PIIX4_PORT_IDX_SHIFT 1
-/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+/* On kerncz and Hudson2, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
#define SB800_PIIX4_PORT_IDX_KERNCZ 0x02
#define SB800_PIIX4_PORT_IDX_MASK_KERNCZ 0x18
#define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ 3
@@ -358,18 +358,16 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
/* Find which register is used for port selection */
if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD ||
PIIX4_dev->vendor == PCI_VENDOR_ID_HYGON) {
- switch (PIIX4_dev->device) {
- case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
+ if (PIIX4_dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ||
+ (PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
+ PIIX4_dev->revision >= 0x1F)) {
piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
- break;
- case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
- default:
+ } else {
piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
- break;
}
} else {
if (!request_muxed_region(SB800_PIIX4_SMB_IDX, 2,
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5b6eefd667847ca6bd6925f7bd1afcecc457c889 Mon Sep 17 00:00:00 2001
From: Manasi Navare <manasi.d.navare(a)intel.com>
Date: Wed, 21 Aug 2019 14:59:50 -0700
Subject: [PATCH] drm/i915/dp: Fix DSC enable code to use cpu_transcoder
instead of encoder->type
This patch fixes the intel_configure_pps_for_dsc_encoder() function to use
cpu_transcoder instead of encoder->type to select the correct DSC registers
that was wrongly used in the original patch for one DSC register isntance.
Fixes: 7182414e2530 ("drm/i915/dp: Configure i915 Picture parameter Set registers during DSC enabling")
Cc: Ville Syrjala <ville.syrjala(a)linux.intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> # v5.0+
Signed-off-by: Manasi Navare <manasi.d.navare(a)intel.com>
Reviewed-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190821215950.24223-1-manasi…
(cherry picked from commit d4c61c4a16decd8ace8660f22c81609a539fccba)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c
index ffec807b8960..f413904a3e96 100644
--- a/drivers/gpu/drm/i915/display/intel_vdsc.c
+++ b/drivers/gpu/drm/i915/display/intel_vdsc.c
@@ -541,7 +541,7 @@ static void intel_configure_pps_for_dsc_encoder(struct intel_encoder *encoder,
pps_val |= DSC_PIC_HEIGHT(vdsc_cfg->pic_height) |
DSC_PIC_WIDTH(vdsc_cfg->pic_width / num_vdsc_instances);
DRM_INFO("PPS2 = 0x%08x\n", pps_val);
- if (encoder->type == INTEL_OUTPUT_EDP) {
+ if (cpu_transcoder == TRANSCODER_EDP) {
I915_WRITE(DSCA_PICTURE_PARAMETER_SET_2, pps_val);
/*
* If 2 VDSC instances are needed, configure PPS for second
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ed5fa90660d63bcec4c3a62b03fed9427418b53d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala(a)linux.intel.com>
Date: Tue, 20 Aug 2019 19:16:57 +0300
Subject: [PATCH] drm/i915: Do not create a new max_bpc prop for MST connectors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
We're not allowed to create new properties after device registration
so for MST connectors we need to either create the max_bpc property
earlier, or we reuse one we already have. Let's do the latter apporach
since the corresponding SST connector already has the prop and its
min/max are correct also for the MST connector.
The problem was highlighted by commit 4f5368b5541a ("drm/kms:
Catch mode_object lifetime errors") which results in the following
spew:
[ 1330.878941] WARNING: CPU: 2 PID: 1554 at drivers/gpu/drm/drm_mode_object.c:45 __drm_mode_object_add+0xa0/0xb0 [drm]
...
[ 1330.879008] Call Trace:
[ 1330.879023] drm_property_create+0xba/0x180 [drm]
[ 1330.879036] drm_property_create_range+0x15/0x30 [drm]
[ 1330.879048] drm_connector_attach_max_bpc_property+0x62/0x80 [drm]
[ 1330.879086] intel_dp_add_mst_connector+0x11f/0x140 [i915]
[ 1330.879094] drm_dp_add_port.isra.20+0x20b/0x440 [drm_kms_helper]
...
Cc: stable(a)vger.kernel.org
Cc: Lyude Paul <lyude(a)redhat.com>
Cc: sunpeng.li(a)amd.com
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Sean Paul <sean(a)poorly.run>
Fixes: 5ca0ef8a56b8 ("drm/i915: Add max_bpc property for DP MST")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190820161657.9658-1-ville.s…
Reviewed-by: José Roberto de Souza <jose.souza(a)intel.com>
Reviewed-by: Lyude Paul <lyude(a)redhat.com>
(cherry picked from commit 1b9bd09630d4db4827cc04d358a41a16a6bc2cb0)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c
index 60652ebbdf61..18e4cba76720 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c
@@ -539,7 +539,15 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
intel_attach_force_audio_property(connector);
intel_attach_broadcast_rgb_property(connector);
- drm_connector_attach_max_bpc_property(connector, 6, 12);
+
+ /*
+ * Reuse the prop from the SST connector because we're
+ * not allowed to create new props after device registration.
+ */
+ connector->max_bpc_property =
+ intel_dp->attached_connector->base.max_bpc_property;
+ if (connector->max_bpc_property)
+ drm_connector_attach_max_bpc_property(connector, 6, 12);
return connector;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f4340e9314dbfadc48758945f85fc3b16612d06f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Cc: stable(a)vger.kernel.org # v4.5+
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..15c254753f88 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1251,20 +1251,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
struct nfs_pgio_header *hdr)
{
- LIST_HEAD(failed);
+ LIST_HEAD(pages);
desc->pg_io_completion = hdr->io_completion;
desc->pg_dreq = hdr->dreq;
- while (!list_empty(&hdr->pages)) {
- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ list_splice_init(&hdr->pages, &pages);
+ while (!list_empty(&pages)) {
+ struct nfs_page *req = nfs_list_entry(pages.next);
if (!nfs_pageio_add_request(desc, req))
- nfs_list_move_request(req, &failed);
+ break;
}
nfs_pageio_complete(desc);
- if (!list_empty(&failed)) {
- list_move(&failed, &hdr->pages);
- return desc->pg_error < 0 ? desc->pg_error : -EIO;
+ if (!list_empty(&pages)) {
+ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+ hdr->completion_ops->error_cleanup(&pages, err);
+ return err;
}
return 0;
}
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 2f765c175e1d1acae911f889e71e5933c6488929 Mon Sep 17 00:00:00 2001
From: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Date: Wed, 28 Aug 2019 10:17:36 +0800
Subject: [PATCH] mmc: sdhci-sprd: clear the UHS-I modes read from registers
sprd's sd host controller supports SDR50/SDR104/DDR50 though, the UHS-I
mode used by the specific card can be selected via devicetree only.
Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
Signed-off-by: Chunyan Zhang <chunyan.zhang(a)unisoc.com>
Signed-off-by: Chunyan Zhang <zhang.lyra(a)gmail.com>
Reviewed-by: Baolin Wang <baolin.wang(a)linaro.org>
Tested-by: Baolin Wang <baolin.wang(a)linaro.org>
Cc: stable(a)vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org>
diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c
index ba777f0c77d1..d07b9793380f 100644
--- a/drivers/mmc/host/sdhci-sprd.c
+++ b/drivers/mmc/host/sdhci-sprd.c
@@ -509,7 +509,8 @@ static void sdhci_sprd_phy_param_parse(struct sdhci_sprd_host *sprd_host,
static const struct sdhci_pltfm_data sdhci_sprd_pdata = {
.quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION |
- SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
+ SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+ SDHCI_QUIRK_MISSING_CAPS,
.quirks2 = SDHCI_QUIRK2_BROKEN_HS200 |
SDHCI_QUIRK2_USE_32BIT_BLK_CNT |
SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
@@ -614,6 +615,16 @@ static int sdhci_sprd_probe(struct platform_device *pdev)
sdhci_enable_v4_mode(host);
+ /*
+ * Supply the existing CAPS, but clear the UHS-I modes. This
+ * will allow these modes to be specified only by device
+ * tree properties through mmc_of_parse().
+ */
+ host->caps = sdhci_readl(host, SDHCI_CAPABILITIES);
+ host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1);
+ host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_SDR104 |
+ SDHCI_SUPPORT_DDR50);
+
ret = sdhci_setup_host(host);
if (ret)
goto pm_runtime_disable;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 Mon Sep 17 00:00:00 2001
From: Heyi Guo <guoheyi(a)huawei.com>
Date: Tue, 27 Aug 2019 12:26:50 +0100
Subject: [PATCH] KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is
long
If the ap_list is longer than 256 entries, merge_final() in list_sort()
will call the comparison callback with the same element twice, causing
a deadlock in vgic_irq_cmp().
Fix it by returning early when irqa == irqb.
Cc: stable(a)vger.kernel.org # 4.7+
Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting")
Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com>
Signed-off-by: Heyi Guo <guoheyi(a)huawei.com>
[maz: massaged commit log and patch, added Fixes and Cc-stable]
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 04786c8ec77e..ca5e6c6866a4 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -254,6 +254,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
bool penda, pendb;
int ret;
+ /*
+ * list_sort may call this function with the same element when
+ * the list is fairly long.
+ */
+ if (unlikely(irqa == irqb))
+ return 0;
+
raw_spin_lock(&irqa->irq_lock);
raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
This is a note to let you know that I've just added the patch titled
phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From e6839c31a608e79f2057fab987dd814f5d3477e6 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Date: Tue, 6 Aug 2019 17:51:19 +0900
Subject: phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
The hardware manual should be revised, but the initial value of
VBCTRL.OCCLREN is set to 1 actually. If the bit is set, the hardware
clears VBCTRL.VBOUT and ADPCTRL.DRVVBUS registers automatically
when the hardware detects over-current signal from a USB power switch.
However, since the hardware doesn't have any registers which
indicates over-current, the driver cannot handle it at all. So, if
"is_otg_channel" hardware detects over-current, since ADPCTRL.DRVVBUS
register is cleared automatically, the channel cannot be used after
that.
To resolve this behavior, this patch sets the VBCTRL.OCCLREN to 0
to keep ADPCTRL.DRVVBUS even if the "is_otg_channel" hardware
detects over-current. (We assume a USB power switch itself protects
over-current and turns the VBUS off.)
This patch is inspired by a BSP patch from Kazuya Mizuguchi.
Fixes: 1114e2d31731 ("phy: rcar-gen3-usb2: change the mode to OTG on the combined channel")
Cc: <stable(a)vger.kernel.org> # v4.5+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index 8ffba67568ec..b7f6b1324395 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -61,6 +61,7 @@
USB2_OBINT_IDDIGCHG)
/* VBCTRL */
+#define USB2_VBCTRL_OCCLREN BIT(16)
#define USB2_VBCTRL_DRVVBUSSEL BIT(8)
/* LINECTRL1 */
@@ -374,6 +375,7 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)
writel(val, usb2_base + USB2_LINECTRL1);
val = readl(usb2_base + USB2_VBCTRL);
+ val &= ~USB2_VBCTRL_OCCLREN;
writel(val | USB2_VBCTRL_DRVVBUSSEL, usb2_base + USB2_VBCTRL);
val = readl(usb2_base + USB2_ADPCTRL);
writel(val | USB2_ADPCTRL_IDPULLUP, usb2_base + USB2_ADPCTRL);
--
2.23.0
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 6c1c280805ded72eceb2afc1a0d431b256608554 Mon Sep 17 00:00:00 2001
From: Shakeel Butt <shakeelb(a)google.com>
Date: Fri, 30 Aug 2019 16:04:53 -0700
Subject: [PATCH] mm: memcontrol: fix percpu vmstats and vmevents flush
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the
current cpu for the number of online CPUs.
Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index a247cb163245..9ec5e12486a7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3278,7 +3278,7 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg, bool slab_only)
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = min_idx; i < max_idx; i++)
@@ -3296,8 +3296,8 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg, bool slab_only)
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = min_idx; i < max_idx; i++)
@@ -3316,8 +3316,8 @@ static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c7c06a1532f3fe106687ac82a13492c6a619ff1c Mon Sep 17 00:00:00 2001
From: Andrew Cooks <andrew.cooks(a)opengear.com>
Date: Fri, 2 Aug 2019 14:52:46 +0200
Subject: [PATCH] i2c: piix4: Fix port selection for AMD Family 16h Model 30h
Family 16h Model 30h SMBus controller needs the same port selection fix
as described and fixed in commit 0fe16195f891 ("i2c: piix4: Fix SMBus port
selection for AMD Family 17h chips")
commit 6befa3fde65f ("i2c: piix4: Support alternative port selection
register") also fixed the port selection for Hudson2, but unfortunately
this is not the exact same device and the AMD naming and PCI Device IDs
aren't particularly helpful here.
The SMBus port selection register is common to the following Families
and models, as documented in AMD's publicly available BIOS and Kernel
Developer Guides:
50742 - Family 15h Model 60h-6Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
55072 - Family 15h Model 70h-7Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
52740 - Family 16h Model 30h-3Fh (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS)
The Hudson2 PCI Device ID (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) is shared
between Bolton FCH and Family 16h Model 30h, but the location of the
SmBus0Sel port selection bits are different:
51192 - Bolton Register Reference Guide
We distinguish between Bolton and Family 16h Model 30h using the PCI
Revision ID:
Bolton is device 0x780b, revision 0x15
Family 16h Model 30h is device 0x780b, revision 0x1F
Family 15h Model 60h and 70h are both device 0x790b, revision 0x4A.
The following additional public AMD BKDG documents were checked and do
not share the same port selection register:
42301 - Family 15h Model 00h-0Fh doesn't mention any
42300 - Family 15h Model 10h-1Fh doesn't mention any
49125 - Family 15h Model 30h-3Fh doesn't mention any
48751 - Family 16h Model 00h-0Fh uses the previously supported
index register SB800_PIIX4_PORT_IDX_ALT at 0x2e
Signed-off-by: Andrew Cooks <andrew.cooks(a)opengear.com>
Signed-off-by: Jean Delvare <jdelvare(a)suse.de>
Cc: stable(a)vger.kernel.org [v4.6+]
Signed-off-by: Wolfram Sang <wsa(a)the-dreams.de>
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index c46c4bddc7ca..cba325eb852f 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -91,7 +91,7 @@
#define SB800_PIIX4_PORT_IDX_MASK 0x06
#define SB800_PIIX4_PORT_IDX_SHIFT 1
-/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+/* On kerncz and Hudson2, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
#define SB800_PIIX4_PORT_IDX_KERNCZ 0x02
#define SB800_PIIX4_PORT_IDX_MASK_KERNCZ 0x18
#define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ 3
@@ -358,18 +358,16 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
/* Find which register is used for port selection */
if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD ||
PIIX4_dev->vendor == PCI_VENDOR_ID_HYGON) {
- switch (PIIX4_dev->device) {
- case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
+ if (PIIX4_dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ||
+ (PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
+ PIIX4_dev->revision >= 0x1F)) {
piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
- break;
- case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
- default:
+ } else {
piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
- break;
}
} else {
if (!request_muxed_region(SB800_PIIX4_SMB_IDX, 2,
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f4340e9314dbfadc48758945f85fc3b16612d06f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Cc: stable(a)vger.kernel.org # v4.5+
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..15c254753f88 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1251,20 +1251,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
struct nfs_pgio_header *hdr)
{
- LIST_HEAD(failed);
+ LIST_HEAD(pages);
desc->pg_io_completion = hdr->io_completion;
desc->pg_dreq = hdr->dreq;
- while (!list_empty(&hdr->pages)) {
- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ list_splice_init(&hdr->pages, &pages);
+ while (!list_empty(&pages)) {
+ struct nfs_page *req = nfs_list_entry(pages.next);
if (!nfs_pageio_add_request(desc, req))
- nfs_list_move_request(req, &failed);
+ break;
}
nfs_pageio_complete(desc);
- if (!list_empty(&failed)) {
- list_move(&failed, &hdr->pages);
- return desc->pg_error < 0 ? desc->pg_error : -EIO;
+ if (!list_empty(&pages)) {
+ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+ hdr->completion_ops->error_cleanup(&pages, err);
+ return err;
}
return 0;
}
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f4340e9314dbfadc48758945f85fc3b16612d06f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Cc: stable(a)vger.kernel.org # v4.5+
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..15c254753f88 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1251,20 +1251,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
struct nfs_pgio_header *hdr)
{
- LIST_HEAD(failed);
+ LIST_HEAD(pages);
desc->pg_io_completion = hdr->io_completion;
desc->pg_dreq = hdr->dreq;
- while (!list_empty(&hdr->pages)) {
- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ list_splice_init(&hdr->pages, &pages);
+ while (!list_empty(&pages)) {
+ struct nfs_page *req = nfs_list_entry(pages.next);
if (!nfs_pageio_add_request(desc, req))
- nfs_list_move_request(req, &failed);
+ break;
}
nfs_pageio_complete(desc);
- if (!list_empty(&failed)) {
- list_move(&failed, &hdr->pages);
- return desc->pg_error < 0 ? desc->pg_error : -EIO;
+ if (!list_empty(&pages)) {
+ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+ hdr->completion_ops->error_cleanup(&pages, err);
+ return err;
}
return 0;
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From f4340e9314dbfadc48758945f85fc3b16612d06f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.
Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com>
Cc: stable(a)vger.kernel.org # v4.5+
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..15c254753f88 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1251,20 +1251,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
struct nfs_pgio_header *hdr)
{
- LIST_HEAD(failed);
+ LIST_HEAD(pages);
desc->pg_io_completion = hdr->io_completion;
desc->pg_dreq = hdr->dreq;
- while (!list_empty(&hdr->pages)) {
- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ list_splice_init(&hdr->pages, &pages);
+ while (!list_empty(&pages)) {
+ struct nfs_page *req = nfs_list_entry(pages.next);
if (!nfs_pageio_add_request(desc, req))
- nfs_list_move_request(req, &failed);
+ break;
}
nfs_pageio_complete(desc);
- if (!list_empty(&failed)) {
- list_move(&failed, &hdr->pages);
- return desc->pg_error < 0 ? desc->pg_error : -EIO;
+ if (!list_empty(&pages)) {
+ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+ hdr->completion_ops->error_cleanup(&pages, err);
+ return err;
}
return 0;
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 Mon Sep 17 00:00:00 2001
From: Heyi Guo <guoheyi(a)huawei.com>
Date: Tue, 27 Aug 2019 12:26:50 +0100
Subject: [PATCH] KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is
long
If the ap_list is longer than 256 entries, merge_final() in list_sort()
will call the comparison callback with the same element twice, causing
a deadlock in vgic_irq_cmp().
Fix it by returning early when irqa == irqb.
Cc: stable(a)vger.kernel.org # 4.7+
Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting")
Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com>
Signed-off-by: Heyi Guo <guoheyi(a)huawei.com>
[maz: massaged commit log and patch, added Fixes and Cc-stable]
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 04786c8ec77e..ca5e6c6866a4 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -254,6 +254,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
bool penda, pendb;
int ret;
+ /*
+ * list_sort may call this function with the same element when
+ * the list is fairly long.
+ */
+ if (unlikely(irqa == irqb))
+ return 0;
+
raw_spin_lock(&irqa->irq_lock);
raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 Mon Sep 17 00:00:00 2001
From: Heyi Guo <guoheyi(a)huawei.com>
Date: Tue, 27 Aug 2019 12:26:50 +0100
Subject: [PATCH] KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is
long
If the ap_list is longer than 256 entries, merge_final() in list_sort()
will call the comparison callback with the same element twice, causing
a deadlock in vgic_irq_cmp().
Fix it by returning early when irqa == irqb.
Cc: stable(a)vger.kernel.org # 4.7+
Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting")
Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com>
Signed-off-by: Heyi Guo <guoheyi(a)huawei.com>
[maz: massaged commit log and patch, added Fixes and Cc-stable]
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Signed-off-by: Will Deacon <will(a)kernel.org>
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 04786c8ec77e..ca5e6c6866a4 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -254,6 +254,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
bool penda, pendb;
int ret;
+ /*
+ * list_sort may call this function with the same element when
+ * the list is fairly long.
+ */
+ if (unlikely(irqa == irqb))
+ return 0;
+
raw_spin_lock(&irqa->irq_lock);
raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From ddfd151f3def9258397fcde7a372205a2d661903 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik(a)ozlabs.ru>
Date: Mon, 26 Aug 2019 14:55:20 +1000
Subject: [PATCH] KVM: PPC: Book3S: Fix incorrect guest-to-user-translation
error handling
H_PUT_TCE_INDIRECT handlers receive a page with up to 512 TCEs from
a guest. Although we verify correctness of TCEs before we do anything
with the existing tables, there is a small window when a check in
kvmppc_tce_validate might pass and right after that the guest alters
the page of TCEs, causing an early exit from the handler and leaving
srcu_read_lock(&vcpu->kvm->srcu) (virtual mode) or lock_rmap(rmap)
(real mode) locked.
This fixes the bug by jumping to the common exit code with an appropriate
unlock.
Cc: stable(a)vger.kernel.org # v4.11+
Fixes: 121f80ba68f1 ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
Signed-off-by: Alexey Kardashevskiy <aik(a)ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org>
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index e99a14798ab0..c4b606fe73eb 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -660,8 +660,10 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu,
}
tce = be64_to_cpu(tce);
- if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua))
- return H_PARAMETER;
+ if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua)) {
+ ret = H_PARAMETER;
+ goto unlock_exit;
+ }
list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
ret = kvmppc_tce_iommu_map(vcpu->kvm, stt,
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index f50bbeedfc66..b4f20f13b860 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -556,8 +556,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
unsigned long tce = be64_to_cpu(((u64 *)tces)[i]);
ua = 0;
- if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL))
- return H_PARAMETER;
+ if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL)) {
+ ret = H_PARAMETER;
+ goto unlock_exit;
+ }
list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt,
The patch titled
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
has been removed from the -mm tree. Its filename was
mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Shakeel Butt <shakeelb(a)google.com>
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the current
cpu for the number of online CPUs.
Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush
+++ a/mm/memcontrol.c
@@ -3278,7 +3278,7 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = min_idx; i < max_idx; i++)
@@ -3296,8 +3296,8 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = min_idx; i < max_idx; i++)
@@ -3316,8 +3316,8 @@ static void memcg_flush_percpu_vmevents(
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
_
Patches currently in -mm which might be from shakeelb(a)google.com are
The patch titled
Subject: mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones"
has been removed from the -mm tree. Its filename was
partially-revert-mm-memcontrolc-keep-local-vm-counters-in-sync-with-the-hierarchical-ones.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Roman Gushchin <guro(a)fb.com>
Subject: mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones"
Commit 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with
the hierarchical ones") effectively decreased the precision of per-memcg
vmstats_local and per-memcg-per-node lruvec percpu counters.
That's good for displaying in memory.stat, but brings a serious regression
into the reclaim process.
One issue I've discovered and debugged is the following: lruvec_lru_size()
can return 0 instead of the actual number of pages in the lru list,
preventing the kernel to reclaim last remaining pages. Result is yet
another dying memory cgroups flooding. The opposite is also happening:
scanning an empty lru list is the waste of cpu time.
Also, inactive_list_is_low() can return incorrect values, preventing the
active lru from being scanned and freed. It can fail both because the
size of active and inactive lists are inaccurate, and because the number
of workingset refaults isn't precise. In other words, the result is
pretty random.
I'm not sure, if using the approximate number of slab pages in
count_shadow_number() is acceptable, but issues described above are enough
to partially revert the patch.
Let's keep per-memcg vmstat_local batched (they are only used for
displaying stats to the userspace), but keep lruvec stats precise. This
change fixes the dead memcg flooding on my setup.
Link: http://lkml.kernel.org/r/20190817004726.2530670-1-guro@fb.com
Fixes: 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Yafang Shao <laoar.shao(a)gmail.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~partially-revert-mm-memcontrolc-keep-local-vm-counters-in-sync-with-the-hierarchical-ones
+++ a/mm/memcontrol.c
@@ -752,15 +752,13 @@ void __mod_lruvec_state(struct lruvec *l
/* Update memcg */
__mod_memcg_state(memcg, idx, val);
+ /* Update lruvec */
+ __this_cpu_add(pn->lruvec_stat_local->count[idx], val);
+
x = val + __this_cpu_read(pn->lruvec_stat_cpu->count[idx]);
if (unlikely(abs(x) > MEMCG_CHARGE_BATCH)) {
struct mem_cgroup_per_node *pi;
- /*
- * Batch local counters to keep them in sync with
- * the hierarchical ones.
- */
- __this_cpu_add(pn->lruvec_stat_local->count[idx], x);
for (pi = pn; pi; pi = parent_nodeinfo(pi, pgdat->node_id))
atomic_long_add(x, &pi->lruvec_stat[idx]);
x = 0;
_
Patches currently in -mm which might be from guro(a)fb.com are
mm-memcontrol-switch-to-rcu-protection-in-drain_all_stock.patch
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/141232
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the d5e0e6a34f8b commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
hid-logitech-hidpp-remove-support-for-the-g700-over-.patch
ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
ftrace-check-for-successful-allocation-of-hash.patch
ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
x86_64:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ pciutils: sanity smoke test [21]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ⚡⚡⚡ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
🚧 ✅ trace: ftrace/tracer [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [19]
🚧 ✅ Storage blktests [20]
🚧 ✅ IOMMU boot test [22]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#trace/ftrace…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[22]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/140992
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 87cde3375279 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
hid-logitech-hidpp-remove-support-for-the-g700-over-.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ Networking: igmp conformance test [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
🚧 ✅ Networking ipsec: basic netns transport [19]
🚧 ✅ Networking ipsec: basic netns tunnel [19]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
🚧 ✅ Networking ipsec: basic netns tunnel [19]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ❌ Storage blktests [2]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ Networking: igmp conformance test [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ pciutils: sanity smoke test [20]
✅ Usex - version 1.9-29 [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
🚧 ✅ Networking ipsec: basic netns transport [19]
🚧 ✅ Networking ipsec: basic netns tunnel [19]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
🚧 ✅ IOMMU boot test [21]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Hi,
I also tried to reproduce this in a targeted way, and run into the
same difficulty as you: satisfying the first condition “
(sk->sk_wmem_queued >> 1) > limit “.
I will not have bandwidth the coming days to try and reproduce it in
this way. Maybe simply forcing a very small send buffer using sysctl
net.ipv4.tcp_wmem might even do the trick?
I suspect that the bug is easier to trigger with the MPTCP patch like
I did originally, due to the way this patch manages the tcp subflow
buffers (it can temporarily overfill the buffers, satisfying that
first condition more often).
another thing, the stacktrace you shared before seems caused by
another issue (corrupted socket?), it will not be solved by the patch
we submitted.
kind regards,
Tim
On Tue, Sep 3, 2019 at 5:22 AM maowenan <maowenan(a)huawei.com> wrote:
>
> Hi Tim,
>
>
>
> I try to reproduce it with packetdrill or user application, but I can’t.
>
> The first condition “ (sk->sk_wmem_queued >> 1) > limit “ can’t be satisfied,
>
> This condition is to avoid tiny SO_SNDBUF values set by user.
>
> It also adds the some room due to the fact that tcp_sendmsg()
>
> and tcp_sendpage() might overshoot sk_wmem_queued by about one full
>
> TSO skb (64KB size).
>
>
>
> limit = sk->sk_sndbuf + 2 * SKB_TRUESIZE(GSO_MAX_SIZE);
>
> if (unlikely((sk->sk_wmem_queued >> 1) > limit &&
>
> skb != tcp_rtx_queue_head(sk) &&
>
> skb != tcp_rtx_queue_tail(sk))) {
>
> NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG);
>
> return -ENOMEM;
>
> }
>
>
>
> Can you try to reproduce it with packetdrill or C socket application?
>
>
--
Tim Froidcoeur | R&D engineer HAG
tim.froidcoeur(a)tessares.net
Tessares SA | Hybrid Access Solutions
www.tessares.net
1 Avenue Jean Monnet, 1348 Louvain-la-Neuve, Belgium
--
Disclaimer: https://www.tessares.net/mail-disclaimer/
<https://www.tessares.net/mail-disclaimer/>
The following commit has been merged into the sched/urgent branch of tip:
Commit-ID: 5e2d2cc2588bd3307ce3937acbc2ed03c830a861
Gitweb: https://git.kernel.org/tip/5e2d2cc2588bd3307ce3937acbc2ed03c830a861
Author: Liangyan <liangyan.peng(a)linux.alibaba.com>
AuthorDate: Mon, 26 Aug 2019 20:16:33 +08:00
Committer: Ingo Molnar <mingo(a)kernel.org>
CommitterDate: Tue, 03 Sep 2019 08:55:07 +02:00
sched/fair: Don't assign runtime for throttled cfs_rq
do_sched_cfs_period_timer() will refill cfs_b runtime and call
distribute_cfs_runtime to unthrottle cfs_rq, sometimes cfs_b->runtime
will allocate all quota to one cfs_rq incorrectly, then other cfs_rqs
attached to this cfs_b can't get runtime and will be throttled.
We find that one throttled cfs_rq has non-negative
cfs_rq->runtime_remaining and cause an unexpetced cast from s64 to u64
in snippet:
distribute_cfs_runtime() {
runtime = -cfs_rq->runtime_remaining + 1;
}
The runtime here will change to a large number and consume all
cfs_b->runtime in this cfs_b period.
According to Ben Segall, the throttled cfs_rq can have
account_cfs_rq_runtime called on it because it is throttled before
idle_balance, and the idle_balance calls update_rq_clock to add time
that is accounted to the task.
This commit prevents cfs_rq to be assgined new runtime if it has been
throttled until that distribute_cfs_runtime is called.
Signed-off-by: Liangyan <liangyan.peng(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider(a)arm.com>
Reviewed-by: Ben Segall <bsegall(a)google.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: shanpeic(a)linux.alibaba.com
Cc: stable(a)vger.kernel.org
Cc: xlpang(a)linux.alibaba.com
Fixes: d3d9dc330236 ("sched: Throttle entities exceeding their allowed bandwidth")
Link: https://lkml.kernel.org/r/20190826121633.6538-1-liangyan.peng@linux.alibaba…
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
---
kernel/sched/fair.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index bc9cfea..500f5db 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4470,6 +4470,8 @@ static void __account_cfs_rq_runtime(struct cfs_rq *cfs_rq, u64 delta_exec)
if (likely(cfs_rq->runtime_remaining > 0))
return;
+ if (cfs_rq->throttled)
+ return;
/*
* if we're unable to extend our runtime we resched so that the active
* hierarchy can be throttled
@@ -4673,6 +4675,9 @@ static u64 distribute_cfs_runtime(struct cfs_bandwidth *cfs_b,
if (!cfs_rq_throttled(cfs_rq))
goto next;
+ /* By the above check, this should never be true */
+ SCHED_WARN_ON(cfs_rq->runtime_remaining > 0);
+
runtime = -cfs_rq->runtime_remaining + 1;
if (runtime > remaining)
runtime = remaining;
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/140276
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the a72cf2e32965 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
mm-zsmalloc.c-fix-build-when-config_compaction-n.patch
alsa-usb-audio-check-mixer-unit-bitmap-yet-more-strictly.patch
alsa-hda-ca0132-add-new-sbz-quirk.patch
alsa-line6-fix-memory-leak-at-line6_init_pcm-error-path.patch
alsa-hda-fixes-inverted-conexant-gpio-mic-mute-led.patch
alsa-seq-fix-potential-concurrent-access-to-the-deleted-pool.patch
alsa-usb-audio-fix-invalid-null-check-in-snd_emuusb_set_samplerate.patch
alsa-usb-audio-add-implicit-fb-quirk-for-behringer-ufx1604.patch
kvm-x86-skip-populating-logical-dest-map-if-apic-is-not-sw-enabled.patch
kvm-x86-hyper-v-don-t-crash-on-kvm_get_supported_hv_cpuid-when-kvm_intel.nested-is-disabled.patch
kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation.patch
uprobes-x86-fix-detection-of-32-bit-user-mode.patch
x86-mm-cpa-prevent-large-page-split-when-ftrace-flips-rw-on-kernel-text.patch
x86-apic-do-not-initialize-ldr-and-dfr-for-bigsmp.patch
x86-apic-include-the-ldr-when-clearing-out-apic-registers.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [18]
🚧 ✅ Storage blktests [19]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [18]
🚧 ✅ Storage blktests [19]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [18]
🚧 ✅ Storage blktests [19]
🚧 ❌ IOMMU boot test [20]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ pciutils: sanity smoke test [21]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [14]
🚧 ✅ LTP lite [15]
🚧 ✅ Memory function: kaslr [16]
🚧 ✅ Networking ipsec: basic netns transport [17]
🚧 ✅ Networking ipsec: basic netns tunnel [17]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9212ec7d8357ea630031e89d0d399c761421c83b Mon Sep 17 00:00:00 2001
From: Sebastian Mayr <me(a)sam.st>
Date: Sun, 28 Jul 2019 17:26:17 +0200
Subject: [PATCH] uprobes/x86: Fix detection of 32-bit user mode
32-bit processes running on a 64-bit kernel are not always detected
correctly, causing the process to crash when uretprobes are installed.
The reason for the crash is that in_ia32_syscall() is used to determine the
process's mode, which only works correctly when called from a syscall.
In the case of uretprobes, however, the function is called from a exception
and always returns 'false' on a 64-bit kernel. In consequence this leads to
corruption of the process's return address.
Fix this by using user_64bit_mode() instead of in_ia32_syscall(), which
is correct in any situation.
[ tglx: Add a comment and the following historical info ]
This should have been detected by the rename which happened in commit
abfb9498ee13 ("x86/entry: Rename is_{ia32,x32}_task() to in_{ia32,x32}_syscall()")
which states in the changelog:
The is_ia32_task()/is_x32_task() function names are a big misnomer: they
suggests that the compat-ness of a system call is a task property, which
is not true, the compatness of a system call purely depends on how it
was invoked through the system call layer.
.....
and then it went and blindly renamed every call site.
Sadly enough this was already mentioned here:
8faaed1b9f50 ("uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and
arch_uretprobe_hijack_return_addr()")
where the changelog says:
TODO: is_ia32_task() is not what we actually want, TS_COMPAT does
not necessarily mean 32bit. Fortunately syscall-like insns can't be
probed so it actually works, but it would be better to rename and
use is_ia32_frame().
and goes all the way back to:
0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Oh well. 7+ years until someone actually tried a uretprobe on a 32bit
process on a 64bit kernel....
Fixes: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Signed-off-by: Sebastian Mayr <me(a)sam.st>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Dmitry Safonov <dsafonov(a)virtuozzo.com>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20190728152617.7308-1-me@sam.st
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index d8359ebeea70..8cd745ef8c7b 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -508,9 +508,12 @@ struct uprobe_xol_ops {
void (*abort)(struct arch_uprobe *, struct pt_regs *);
};
-static inline int sizeof_long(void)
+static inline int sizeof_long(struct pt_regs *regs)
{
- return in_ia32_syscall() ? 4 : 8;
+ /*
+ * Check registers for mode as in_xxx_syscall() does not apply here.
+ */
+ return user_64bit_mode(regs) ? 8 : 4;
}
static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@@ -521,9 +524,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
{
- unsigned long new_sp = regs->sp - sizeof_long();
+ unsigned long new_sp = regs->sp - sizeof_long(regs);
- if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
+ if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
return -EFAULT;
regs->sp = new_sp;
@@ -556,7 +559,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
long correction = utask->vaddr - utask->xol_vaddr;
regs->ip += correction;
} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
- regs->sp += sizeof_long(); /* Pop incorrect return address */
+ regs->sp += sizeof_long(regs); /* Pop incorrect return address */
if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
return -ERESTART;
}
@@ -675,7 +678,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
* "call" insn was executed out-of-line. Just restore ->sp and restart.
* We could also restore ->ip and try to call branch_emulate_op() again.
*/
- regs->sp += sizeof_long();
+ regs->sp += sizeof_long(regs);
return -ERESTART;
}
@@ -1056,7 +1059,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
unsigned long
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
{
- int rasize = sizeof_long(), nleft;
+ int rasize = sizeof_long(regs), nleft;
unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 701d678599d0c1623aaf4139c03eea260a75b027 Mon Sep 17 00:00:00 2001
From: Henry Burns <henryburns(a)google.com>
Date: Sat, 24 Aug 2019 17:55:06 -0700
Subject: [PATCH] mm/zsmalloc.c: fix race condition in zs_destroy_pool
In zs_destroy_pool() we call flush_work(&pool->free_work). However, we
have no guarantee that migration isn't happening in the background at
that time.
Since migration can't directly free pages, it relies on free_work being
scheduled to free the pages. But there's nothing preventing an
in-progress migrate from queuing the work *after*
zs_unregister_migration() has called flush_work(). Which would mean
pages still pointing at the inode when we free it.
Since we know at destroy time all objects should be free, no new
migrations can come in (since zs_page_isolate() fails for fully-free
zspages). This means it is sufficient to track a "# isolated zspages"
count by class, and have the destroy logic ensure all such pages have
drained before proceeding. Keeping that state under the class spinlock
keeps the logic straightforward.
In this case a memory leak could lead to an eventual crash if compaction
hits the leaked page. This crash would only occur if people are
changing their zswap backend at runtime (which eventually starts
destruction).
Link: http://lkml.kernel.org/r/20190809181751.219326-2-henryburns@google.com
Fixes: 48b4800a1c6a ("zsmalloc: page migration support")
Signed-off-by: Henry Burns <henryburns(a)google.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky(a)gmail.com>
Cc: Henry Burns <henrywolfeburns(a)gmail.com>
Cc: Minchan Kim <minchan(a)kernel.org>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Jonathan Adams <jwadams(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 5105b9b66653..08def3a0d200 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -54,6 +54,7 @@
#include <linux/mount.h>
#include <linux/pseudo_fs.h>
#include <linux/migrate.h>
+#include <linux/wait.h>
#include <linux/pagemap.h>
#include <linux/fs.h>
@@ -268,6 +269,10 @@ struct zs_pool {
#ifdef CONFIG_COMPACTION
struct inode *inode;
struct work_struct free_work;
+ /* A wait queue for when migration races with async_free_zspage() */
+ struct wait_queue_head migration_wait;
+ atomic_long_t isolated_pages;
+ bool destroying;
#endif
};
@@ -1874,6 +1879,19 @@ static void putback_zspage_deferred(struct zs_pool *pool,
}
+static inline void zs_pool_dec_isolated(struct zs_pool *pool)
+{
+ VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
+ atomic_long_dec(&pool->isolated_pages);
+ /*
+ * There's no possibility of racing, since wait_for_isolated_drain()
+ * checks the isolated count under &class->lock after enqueuing
+ * on migration_wait.
+ */
+ if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
+ wake_up_all(&pool->migration_wait);
+}
+
static void replace_sub_page(struct size_class *class, struct zspage *zspage,
struct page *newpage, struct page *oldpage)
{
@@ -1943,6 +1961,7 @@ static bool zs_page_isolate(struct page *page, isolate_mode_t mode)
*/
if (!list_empty(&zspage->list) && !is_zspage_isolated(zspage)) {
get_zspage_mapping(zspage, &class_idx, &fullness);
+ atomic_long_inc(&pool->isolated_pages);
remove_zspage(class, zspage, fullness);
}
@@ -2042,8 +2061,16 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
* Page migration is done so let's putback isolated zspage to
* the list if @page is final isolated subpage in the zspage.
*/
- if (!is_zspage_isolated(zspage))
+ if (!is_zspage_isolated(zspage)) {
+ /*
+ * We cannot race with zs_destroy_pool() here because we wait
+ * for isolation to hit zero before we start destroying.
+ * Also, we ensure that everyone can see pool->destroying before
+ * we start waiting.
+ */
putback_zspage_deferred(pool, class, zspage);
+ zs_pool_dec_isolated(pool);
+ }
reset_page(page);
put_page(page);
@@ -2094,8 +2121,8 @@ static void zs_page_putback(struct page *page)
* so let's defer.
*/
putback_zspage_deferred(pool, class, zspage);
+ zs_pool_dec_isolated(pool);
}
-
spin_unlock(&class->lock);
}
@@ -2118,8 +2145,36 @@ static int zs_register_migration(struct zs_pool *pool)
return 0;
}
+static bool pool_isolated_are_drained(struct zs_pool *pool)
+{
+ return atomic_long_read(&pool->isolated_pages) == 0;
+}
+
+/* Function for resolving migration */
+static void wait_for_isolated_drain(struct zs_pool *pool)
+{
+
+ /*
+ * We're in the process of destroying the pool, so there are no
+ * active allocations. zs_page_isolate() fails for completely free
+ * zspages, so we need only wait for the zs_pool's isolated
+ * count to hit zero.
+ */
+ wait_event(pool->migration_wait,
+ pool_isolated_are_drained(pool));
+}
+
static void zs_unregister_migration(struct zs_pool *pool)
{
+ pool->destroying = true;
+ /*
+ * We need a memory barrier here to ensure global visibility of
+ * pool->destroying. Thus pool->isolated pages will either be 0 in which
+ * case we don't care, or it will be > 0 and pool->destroying will
+ * ensure that we wake up once isolation hits 0.
+ */
+ smp_mb();
+ wait_for_isolated_drain(pool); /* This can block */
flush_work(&pool->free_work);
iput(pool->inode);
}
@@ -2357,6 +2412,8 @@ struct zs_pool *zs_create_pool(const char *name)
if (!pool->name)
goto err;
+ init_waitqueue_head(&pool->migration_wait);
+
if (create_cache(pool))
goto err;
The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From a3384b8d9f63cc042711293bb97bdc92dca0391d Mon Sep 17 00:00:00 2001
From: Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
Date: Tue, 13 Aug 2019 15:38:07 +0200
Subject: [PATCH] HID: logitech-hidpp: remove support for the G700 over USB
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The G700 suffers from the same issue than the G502:
when plugging it in, the driver tries to contact it but it fails.
This timeout is problematic as it introduce a delay in the boot,
and having only the mouse event node means that the hardware
macros keys can not be relayed to the userspace.
Link: https://github.com/libratbag/libratbag/issues/797
Fixes: 91cf9a98ae41 ("HID: logitech-hidpp: make .probe usbhid capable")
Cc: stable(a)vger.kernel.org # v5.2
Reviewed-by: Filipe Laíns <lains(a)archlinux.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 343052b117a9..0179f7ed77e5 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3751,8 +3751,6 @@ static const struct hid_device_id hidpp_devices[] = {
{ /* Logitech G403 Wireless Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
- { /* Logitech G700 Gaming Mouse over USB */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
{ /* Logitech G703 Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
{ /* Logitech G703 Hero Gaming Mouse over USB */
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/139934
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 8e60272ede63 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
ipv6-addrconf-allow-adding-multicast-addr-if-ifa_f_mcautojoin-is-set.patch
ipv6-fix-return-value-of-ipv6_mc_may_pull-for-malformed-packets.patch
net-cpsw-fix-null-pointer-exception-in-the-probe-error-path.patch
net-fix-__ip_mc_inc_group-usage.patch
net-smc-make-sure-epollout-is-raised.patch
tcp-make-sure-epollout-wont-be-missed.patch
ipv4-mpls-fix-mpls_xmit-for-iptunnel.patch
openvswitch-fix-conntrack-cache-with-timeout.patch
ipv4-icmp-fix-rt-dst-dev-null-pointer-dereference.patch
xfrm-xfrm_policy-fix-dst-dev-null-pointer-dereference-in-collect_md-mode.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ Networking: igmp conformance test [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Networking ipsec: basic netns transport [18]
🚧 ✅ Networking ipsec: basic netns tunnel [18]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
🚧 ✅ LTP lite [17]
🚧 ✅ Networking ipsec: basic netns tunnel [18]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ Ethernet drivers sanity [8]
✅ Networking socket: fuzz [9]
✅ Networking: igmp conformance test [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ pciutils: sanity smoke test [19]
✅ Usex - version 1.9-29 [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Networking ipsec: basic netns transport [18]
🚧 ✅ Networking ipsec: basic netns tunnel [18]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
🚧 ✅ IOMMU boot test [20]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9212ec7d8357ea630031e89d0d399c761421c83b Mon Sep 17 00:00:00 2001
From: Sebastian Mayr <me(a)sam.st>
Date: Sun, 28 Jul 2019 17:26:17 +0200
Subject: [PATCH] uprobes/x86: Fix detection of 32-bit user mode
32-bit processes running on a 64-bit kernel are not always detected
correctly, causing the process to crash when uretprobes are installed.
The reason for the crash is that in_ia32_syscall() is used to determine the
process's mode, which only works correctly when called from a syscall.
In the case of uretprobes, however, the function is called from a exception
and always returns 'false' on a 64-bit kernel. In consequence this leads to
corruption of the process's return address.
Fix this by using user_64bit_mode() instead of in_ia32_syscall(), which
is correct in any situation.
[ tglx: Add a comment and the following historical info ]
This should have been detected by the rename which happened in commit
abfb9498ee13 ("x86/entry: Rename is_{ia32,x32}_task() to in_{ia32,x32}_syscall()")
which states in the changelog:
The is_ia32_task()/is_x32_task() function names are a big misnomer: they
suggests that the compat-ness of a system call is a task property, which
is not true, the compatness of a system call purely depends on how it
was invoked through the system call layer.
.....
and then it went and blindly renamed every call site.
Sadly enough this was already mentioned here:
8faaed1b9f50 ("uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and
arch_uretprobe_hijack_return_addr()")
where the changelog says:
TODO: is_ia32_task() is not what we actually want, TS_COMPAT does
not necessarily mean 32bit. Fortunately syscall-like insns can't be
probed so it actually works, but it would be better to rename and
use is_ia32_frame().
and goes all the way back to:
0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Oh well. 7+ years until someone actually tried a uretprobe on a 32bit
process on a 64bit kernel....
Fixes: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Signed-off-by: Sebastian Mayr <me(a)sam.st>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Dmitry Safonov <dsafonov(a)virtuozzo.com>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20190728152617.7308-1-me@sam.st
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index d8359ebeea70..8cd745ef8c7b 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -508,9 +508,12 @@ struct uprobe_xol_ops {
void (*abort)(struct arch_uprobe *, struct pt_regs *);
};
-static inline int sizeof_long(void)
+static inline int sizeof_long(struct pt_regs *regs)
{
- return in_ia32_syscall() ? 4 : 8;
+ /*
+ * Check registers for mode as in_xxx_syscall() does not apply here.
+ */
+ return user_64bit_mode(regs) ? 8 : 4;
}
static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@@ -521,9 +524,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
{
- unsigned long new_sp = regs->sp - sizeof_long();
+ unsigned long new_sp = regs->sp - sizeof_long(regs);
- if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
+ if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
return -EFAULT;
regs->sp = new_sp;
@@ -556,7 +559,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
long correction = utask->vaddr - utask->xol_vaddr;
regs->ip += correction;
} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
- regs->sp += sizeof_long(); /* Pop incorrect return address */
+ regs->sp += sizeof_long(regs); /* Pop incorrect return address */
if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
return -ERESTART;
}
@@ -675,7 +678,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
* "call" insn was executed out-of-line. Just restore ->sp and restart.
* We could also restore ->ip and try to call branch_emulate_op() again.
*/
- regs->sp += sizeof_long();
+ regs->sp += sizeof_long(regs);
return -ERESTART;
}
@@ -1056,7 +1059,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
unsigned long
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
{
- int rasize = sizeof_long(), nleft;
+ int rasize = sizeof_long(regs), nleft;
unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9212ec7d8357ea630031e89d0d399c761421c83b Mon Sep 17 00:00:00 2001
From: Sebastian Mayr <me(a)sam.st>
Date: Sun, 28 Jul 2019 17:26:17 +0200
Subject: [PATCH] uprobes/x86: Fix detection of 32-bit user mode
32-bit processes running on a 64-bit kernel are not always detected
correctly, causing the process to crash when uretprobes are installed.
The reason for the crash is that in_ia32_syscall() is used to determine the
process's mode, which only works correctly when called from a syscall.
In the case of uretprobes, however, the function is called from a exception
and always returns 'false' on a 64-bit kernel. In consequence this leads to
corruption of the process's return address.
Fix this by using user_64bit_mode() instead of in_ia32_syscall(), which
is correct in any situation.
[ tglx: Add a comment and the following historical info ]
This should have been detected by the rename which happened in commit
abfb9498ee13 ("x86/entry: Rename is_{ia32,x32}_task() to in_{ia32,x32}_syscall()")
which states in the changelog:
The is_ia32_task()/is_x32_task() function names are a big misnomer: they
suggests that the compat-ness of a system call is a task property, which
is not true, the compatness of a system call purely depends on how it
was invoked through the system call layer.
.....
and then it went and blindly renamed every call site.
Sadly enough this was already mentioned here:
8faaed1b9f50 ("uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and
arch_uretprobe_hijack_return_addr()")
where the changelog says:
TODO: is_ia32_task() is not what we actually want, TS_COMPAT does
not necessarily mean 32bit. Fortunately syscall-like insns can't be
probed so it actually works, but it would be better to rename and
use is_ia32_frame().
and goes all the way back to:
0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Oh well. 7+ years until someone actually tried a uretprobe on a 32bit
process on a 64bit kernel....
Fixes: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Signed-off-by: Sebastian Mayr <me(a)sam.st>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Dmitry Safonov <dsafonov(a)virtuozzo.com>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20190728152617.7308-1-me@sam.st
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index d8359ebeea70..8cd745ef8c7b 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -508,9 +508,12 @@ struct uprobe_xol_ops {
void (*abort)(struct arch_uprobe *, struct pt_regs *);
};
-static inline int sizeof_long(void)
+static inline int sizeof_long(struct pt_regs *regs)
{
- return in_ia32_syscall() ? 4 : 8;
+ /*
+ * Check registers for mode as in_xxx_syscall() does not apply here.
+ */
+ return user_64bit_mode(regs) ? 8 : 4;
}
static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@@ -521,9 +524,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
{
- unsigned long new_sp = regs->sp - sizeof_long();
+ unsigned long new_sp = regs->sp - sizeof_long(regs);
- if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
+ if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
return -EFAULT;
regs->sp = new_sp;
@@ -556,7 +559,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
long correction = utask->vaddr - utask->xol_vaddr;
regs->ip += correction;
} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
- regs->sp += sizeof_long(); /* Pop incorrect return address */
+ regs->sp += sizeof_long(regs); /* Pop incorrect return address */
if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
return -ERESTART;
}
@@ -675,7 +678,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
* "call" insn was executed out-of-line. Just restore ->sp and restart.
* We could also restore ->ip and try to call branch_emulate_op() again.
*/
- regs->sp += sizeof_long();
+ regs->sp += sizeof_long(regs);
return -ERESTART;
}
@@ -1056,7 +1059,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
unsigned long
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
{
- int rasize = sizeof_long(), nleft;
+ int rasize = sizeof_long(regs), nleft;
unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
Please consider
commit b14c876b994f208b6b95c222056e1deb0a45de0e
Author: Radim Krcmar <rkrcmar(a)redhat.com>
Date: Tue Aug 13 23:37:37 2019 -0400
kvm: x86: skip populating logical dest map if apic is not sw enabled
This fixes 1e08ec4a130e2745d96df169e67c58df98a07311 that was introduced in v3.7.
The bug is that the KVM lapic is not considering whether the guest apic is enabled before
populating the apic in the logical destination table.
Thanks,
Bandan
The ADC in the JZ4740 can work either in high-precision mode with a 2.5V
range, or in low-precision mode with a 7.5V range. The code in place in
this driver will select the proper scale according to the maximum
voltage of the battery.
The JZ4770 however only has one mode, with a 6.6V range. If only one
scale is available, there's no need to change it (and nothing to change
it to), and trying to do so will fail with -EINVAL.
Fixes commit fb24ccfbe1e0 ("power: supply: add Ingenic JZ47xx battery
driver.")
Signed-off-by: Paul Cercueil <paul(a)crapouillou.net>
Cc: stable(a)vger.kernel.org
---
drivers/power/supply/ingenic-battery.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/power/supply/ingenic-battery.c b/drivers/power/supply/ingenic-battery.c
index 35816d4b3012..5a53057b4f64 100644
--- a/drivers/power/supply/ingenic-battery.c
+++ b/drivers/power/supply/ingenic-battery.c
@@ -80,6 +80,10 @@ static int ingenic_battery_set_scale(struct ingenic_battery *bat)
if (ret != IIO_AVAIL_LIST || scale_type != IIO_VAL_FRACTIONAL_LOG2)
return -EINVAL;
+ /* Only one (fractional) entry - nothing to change */
+ if (scale_len == 2)
+ return 0;
+
max_mV = bat->info.voltage_max_design_uv / 1000;
for (i = 0; i < scale_len; i += 2) {
--
2.21.0.593.g511ec345e18
The following patch causes a build failure:
Author: Henry Burns <henryburns(a)google.com>
Date: Sat Aug 24 17:55:06 2019 -0700
mm/zsmalloc.c: fix race condition in zs_destroy_pool
I get this error:
CALL scripts/checksyscalls.sh
CALL scripts/atomic/check-atomics.sh
DESCEND objtool
CHK include/generated/compile.h
CC mm/zsmalloc.o
In file included from ./include/linux/mmzone.h:10:0,
from ./include/linux/gfp.h:6,
from ./include/linux/umh.h:4,
from ./include/linux/kmod.h:9,
from ./include/linux/module.h:13,
from mm/zsmalloc.c:33:
mm/zsmalloc.c: In function ‘zs_create_pool’:
mm/zsmalloc.c:2435:27: error: ‘struct zs_pool’ has no member named
‘migration_wait’
init_waitqueue_head(&pool->migration_wait);
^
./include/linux/wait.h:67:26: note: in definition of macro ‘init_waitqueue_head’
__init_waitqueue_head((wq_head), #wq_head, &__key); \
^~~~~~~
scripts/Makefile.build:278: recipe for target 'mm/zsmalloc.o' failed
make[1]: *** [mm/zsmalloc.o] Error 1
Makefile:1073: recipe for target 'mm' failed
You can find my configuration file attached.
Does anybody have any idea about this ?
Thanks in advance,
François Valenduc
On Fri, Aug 30, 2019 at 05:51:17PM -0400, Hui Peng wrote:
> This is the backported patch for the following fix to v4.4.x and v4.14.x:
> 19bce474c45b ("ALSA: usb-audio: Fix a stack buffer overflow bug in
> check_input_term")
Now queued up, thanks.
greg k-h
On Fri, Aug 30, 2019 at 05:49:59PM -0400, Hui Peng wrote:
> This is the backported patch of the following bug to v4.4.x and v4.14.x:
> daac07156b33 ("ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit")
Thanks, also now queued up to 4.9.y, you forgot that one :)
greg k-h
From: Dexuan Cui <decui(a)microsoft.com>
[ Upstream commit 685703b497bacea8765bb409d6b73455b73c540e ]
There is a race condition for an established connection that is being closed
by the guest: the refcnt is 4 at the end of hvs_release() (Note: here the
'remove_sock' is false):
1 for the initial value;
1 for the sk being in the bound list;
1 for the sk being in the connected list;
1 for the delayed close_work.
After hvs_release() finishes, __vsock_release() -> sock_put(sk) *may*
decrease the refcnt to 3.
Concurrently, hvs_close_connection() runs in another thread:
calls vsock_remove_sock() to decrease the refcnt by 2;
call sock_put() to decrease the refcnt to 0, and free the sk;
next, the "release_sock(sk)" may hang due to use-after-free.
In the above, after hvs_release() finishes, if hvs_close_connection() runs
faster than "__vsock_release() -> sock_put(sk)", then there is not any issue,
because at the beginning of hvs_close_connection(), the refcnt is still 4.
The issue can be resolved if an extra reference is taken when the
connection is established.
Fixes: a9eeb998c28d ("hv_sock: Add support for delayed close")
Signed-off-by: Dexuan Cui <decui(a)microsoft.com>
Reviewed-by: Sunil Muthuswamy <sunilmut(a)microsoft.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
net/vmw_vsock/hyperv_transport.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 9c7da811d130f..98f193fd5315e 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -320,6 +320,11 @@ static void hvs_close_connection(struct vmbus_channel *chan)
lock_sock(sk);
hvs_do_close_lock_held(vsock_sk(sk), true);
release_sock(sk);
+
+ /* Release the refcnt for the channel that's opened in
+ * hvs_open_connection().
+ */
+ sock_put(sk);
}
static void hvs_open_connection(struct vmbus_channel *chan)
@@ -388,6 +393,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
}
set_per_channel_state(chan, conn_from_host ? new : sk);
+
+ /* This reference will be dropped by hvs_close_connection(). */
+ sock_hold(conn_from_host ? new : sk);
vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
/* Set the pending send size to max packet size to always get
--
2.20.1
From: "John S. Gruber" <JohnSGruber(a)gmail.com>
commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything
else") now zeros the secure boot information passed by the boot loader or
by the kernel's efi handover mechanism. Include boot-params.secure_boot
in the preserve field list.
I noted a change in my computers between running signed 5.3-rc4 and 5.3-rc6
with signed kernels using the efi handoff protocol with grub. The kernel
log message "Secure boot enabled" becomes "Secure boot could not be
determined". The efi_main function in arch/x86/boot/compressed/eboot.c sets
this field early but it is subsequently zeroed by the above referenced
commit in the file arch/x86/include/asm/bootparam_utils.h
Fixes: commit a90118c445cc ("x86/boot: Save fields explicitly, zero
out everything else")
Signed-off-by: John S. Gruber <JohnSGruber(a)gmail.com>
---
Adjusted the patch for John Hubbard's comments.
arch/x86/include/asm/bootparam_utils.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/include/asm/bootparam_utils.h
b/arch/x86/include/asm/bootparam_utils.h
index 9e5f3c7..981fe92 100644
--- a/arch/x86/include/asm/bootparam_utils.h
+++ b/arch/x86/include/asm/bootparam_utils.h
@@ -70,6 +70,7 @@ static void sanitize_boot_params(struct boot_params
*boot_params)
BOOT_PARAM_PRESERVE(eddbuf_entries),
BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
+ BOOT_PARAM_PRESERVE(secure_boot),
BOOT_PARAM_PRESERVE(hdr),
BOOT_PARAM_PRESERVE(e820_table),
BOOT_PARAM_PRESERVE(eddbuf),
--
2.7.4
the type flag is stored in the chip->flags field not in the
client->flags field. This currently leads to never using the ti
specific health function as client->flags doesn't use that bit.
So it's always falling back to the general one.
Fixes: 76b16f4cdfb8 ("power: supply: sbs-battery: don't assume
MANUFACTURER_DATA formats")
Signed-off-by: Michael Nosthoff <committed(a)heine.so>
Reviewed-by: Brian Norris <briannorris(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
---
Changes since v1:
* Changed comment according to Brian's suggestions
* Added Fixes tag
* Added reviewed and cc stable
drivers/power/supply/sbs-battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
index 048d205d7074..2e86cc1e0e35 100644
--- a/drivers/power/supply/sbs-battery.c
+++ b/drivers/power/supply/sbs-battery.c
@@ -620,7 +620,7 @@ static int sbs_get_property(struct power_supply *psy,
switch (psp) {
case POWER_SUPPLY_PROP_PRESENT:
case POWER_SUPPLY_PROP_HEALTH:
- if (client->flags & SBS_FLAGS_TI_BQ20Z75)
+ if (chip->flags & SBS_FLAGS_TI_BQ20Z75)
ret = sbs_get_ti_battery_presence_and_health(client,
psp, val);
else
--
2.20.1
when the battery is set to sbs-mode and no gpio detection is enabled
"health" is always returning a value even when the battery is not present.
All other fields return "not present".
This leads to a scenario where the driver is constantly switching between
"present" and "not present" state. This generates a lot of constant
traffic on the i2c.
This commit changes the response of "health" to an error when the battery
is not responding leading to a consistent "not present" state.
Fixes: 76b16f4cdfb8 ("power: supply: sbs-battery: don't assume
MANUFACTURER_DATA formats")
Signed-off-by: Michael Nosthoff <committed(a)heine.so>
Cc: Brian Norris <briannorris(a)chromium.org>
Cc: <stable(a)vger.kernel.org>
---
drivers/power/supply/sbs-battery.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
index 2e86cc1e0e35..f8d74e9f7931 100644
--- a/drivers/power/supply/sbs-battery.c
+++ b/drivers/power/supply/sbs-battery.c
@@ -314,17 +314,22 @@ static int sbs_get_battery_presence_and_health(
{
int ret;
- if (psp == POWER_SUPPLY_PROP_PRESENT) {
- /* Dummy command; if it succeeds, battery is present. */
- ret = sbs_read_word_data(client, sbs_data[REG_STATUS].addr);
- if (ret < 0)
- val->intval = 0; /* battery disconnected */
- else
- val->intval = 1; /* battery present */
- } else { /* POWER_SUPPLY_PROP_HEALTH */
+ /* Dummy command; if it succeeds, battery is present. */
+ ret = sbs_read_word_data(client, sbs_data[REG_STATUS].addr);
+
+ if (ret < 0) { /* battery not present*/
+ if (psp == POWER_SUPPLY_PROP_PRESENT) {
+ val->intval = 0;
+ return 0;
+ }
+ return ret;
+ }
+
+ if (psp == POWER_SUPPLY_PROP_PRESENT)
+ val->intval = 1; /* battery present */
+ else /* POWER_SUPPLY_PROP_HEALTH */
/* SBS spec doesn't have a general health command. */
val->intval = POWER_SUPPLY_HEALTH_UNKNOWN;
- }
return 0;
}
@@ -626,6 +631,8 @@ static int sbs_get_property(struct power_supply *psy,
else
ret = sbs_get_battery_presence_and_health(client, psp,
val);
+
+ /* this can only be true if no gpio is used */
if (psp == POWER_SUPPLY_PROP_PRESENT)
return 0;
break;
--
2.20.1
The `uac_mixer_unit_descriptor` shown as below is read from the
device side. In `parse_audio_mixer_unit`, `baSourceID` field is
accessed from index 0 to `bNrInPins` - 1, the current implementation
assumes that descriptor is always valid (the length of descriptor
is no shorter than 5 + `bNrInPins`). If a descriptor read from
the device side is invalid, it may trigger out-of-bound memory
access.
```
struct uac_mixer_unit_descriptor {
__u8 bLength;
__u8 bDescriptorType;
__u8 bDescriptorSubtype;
__u8 bUnitID;
__u8 bNrInPins;
__u8 baSourceID[];
}
```
This patch fixes the bug by add a sanity check on the length of
the descriptor.
CVE: CVE-2018-15117
Reported-by: Hui Peng <benquike(a)gmail.com>
Reported-by: Mathias Payer <mathias.payer(a)nebelwelt.net>
Signed-off-by: Hui Peng <benquike(a)gmail.com>
---
sound/usb/mixer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 1f7eb3816cd7..10ddec76f906 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1628,6 +1628,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
int pin, ich, err;
if (desc->bLength < 11 || !(input_pins = desc->bNrInPins) ||
+ desc->bLength < sizeof(*desc) + desc->bNrInPins ||
!(num_outs = uac_mixer_unit_bNrChannels(desc))) {
usb_audio_err(state->chip,
"invalid MIXER UNIT descriptor %d\n",
--
2.17.1
On 9/1/19 8:38 AM, John S Gruber wrote:
> From: "John S. Gruber" <JohnSGruber(a)gmail.com>
>
> commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything
> else") now zeros the secure boot information passed by the boot loader or
> by the kernel's efi handover mechanism.
>
> Include boot-params.secure_boot in the preserve field list.
>
> Signed-off-by: John S. Gruber <JohnSGruber(a)gmail.com>
> ---
>
> I noted a change in my computers between running signed 5.3-rc4 and 5.3-rc6
> with signed kernels using the efi handoff protocol with grub. The kernel
> log message "Secure boot enabled" becomes "Secure boot could not be
> determined". The efi_main function in arch/x86/boot/compressed/eboot.c sets
> this field early but it is subsequently zeroed by the above referenced commit
> in the file arch/x86/include/asm/bootparam_utils.h
>
> Applies to 5.3-rc6.
>
Hi,
The fix itself looks good, so you can add:
Reviewed-by: John Hubbard <jhubbard(a)nvidia.com>
...but note that the commit description should get a few tweaks:
1. Your description above is actually well-suited for the commit log,
so please add that in. Especially the symptoms are desirable to have
on record.
2. This should Cc: stable(a)vger.kernel.org, because the whole thing
made it into -stable and those kernels need this fix.
3. Also need a Fixes tag:
Fixes: commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else")
thanks,
--
John Hubbard
NVIDIA
> arch/x86/include/asm/bootparam_utils.h | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/x86/include/asm/bootparam_utils.h
> b/arch/x86/include/asm/bootparam_utils.h
> index 9e5f3c7..981fe92 100644
> --- a/arch/x86/include/asm/bootparam_utils.h
> +++ b/arch/x86/include/asm/bootparam_utils.h
> @@ -70,6 +70,7 @@ static void sanitize_boot_params(struct boot_params
> *boot_params)
> BOOT_PARAM_PRESERVE(eddbuf_entries),
> BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
> BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
> + BOOT_PARAM_PRESERVE(secure_boot),
> BOOT_PARAM_PRESERVE(hdr),
> BOOT_PARAM_PRESERVE(e820_table),
> BOOT_PARAM_PRESERVE(eddbuf),
>
This is the start of the stable review cycle for the 4.14.138 release.
There are 33 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat 10 Aug 2019 07:03:19 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.138-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.138-rc1
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix 3-wire mode if DMA is enabled
Tejun Heo <tj(a)kernel.org>
cgroup: Fix css_task_iter_advance_css_set() cset skip condition
Tejun Heo <tj(a)kernel.org>
cgroup: css_task_iter_skip()'d iterators must be advanced before accessed
Tejun Heo <tj(a)kernel.org>
cgroup: Include dying leaders with live threads in PROCS iterations
Tejun Heo <tj(a)kernel.org>
cgroup: Implement css_task_iter_skip()
Tejun Heo <tj(a)kernel.org>
cgroup: Call cgroup_release() before __exit_signal()
Sudarsana Reddy Kalluru <skalluru(a)marvell.com>
bnx2x: Disable multi-cos feature.
Matteo Croce <mcroce(a)redhat.com>
mvpp2: refactor MTU change code
Alexis Bauvin <abauvin(a)scaleway.com>
tun: mark small packets as owned by the tap sock
Ariel Levkovich <lariel(a)mellanox.com>
net/mlx5e: Prevent encap flow counter update async to user query
Arnd Bergmann <arnd(a)arndb.de>
compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
Taras Kondratiuk <takondra(a)cisco.com>
tipc: compat: allow tipc commands without arguments
Johan Hovold <johan(a)kernel.org>
NFC: nfcmrvl: fix gpio-handling regression
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: sched: Fix a possible null-pointer dereference in dequeue_func()
René van Dorst <opensource(a)vdorst.com>
net: phylink: Fix flow control for fixed-link
Mark Zhang <markz(a)mellanox.com>
net/mlx5: Use reversed order when unregister devices
Jiri Pirko <jiri(a)mellanox.com>
net: fix ifindex collision during namespace removal
Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com>
net: bridge: mcast: don't delete permanent entries when fast leave is enabled
Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com>
net: bridge: delete local fdb on device init failure
Haishuang Yan <yanhaishuang(a)cmss.chinamobile.com>
ip6_tunnel: fix possible use-after-free on xmit
Cong Wang <xiyou.wangcong(a)gmail.com>
ife: error out when nla attributes are empty
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
atm: iphase: Fix Spectre v1 vulnerability
Josh Poimboeuf <jpoimboe(a)redhat.com>
objtool: Add rewind_stack_do_exit() to the noreturn list
Josh Poimboeuf <jpoimboe(a)redhat.com>
objtool: Add machine_real_restart() to the noreturn list
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
IB: directly cast the sockaddr union to aockaddr
Jason Gunthorpe <jgg(a)mellanox.com>
RDMA: Directly cast the sockaddr union to sockaddr
Sebastian Parschauer <s.parschauer(a)gmx.de>
HID: Add quirk for HP X1200 PIXART OEM mouse
Aaron Armstrong Skomra <skomra(a)gmail.com>
HID: wacom: fix bit shift for Cintiq Companion 2
Will Deacon <will(a)kernel.org>
arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
Eric Dumazet <edumazet(a)google.com>
tcp: be more careful in tcp_fragment()
Adam Ford <aford173(a)gmail.com>
ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD torpedo
Adam Ford <aford173(a)gmail.com>
ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD SOM-LV
Hannes Reinecke <hare(a)suse.de>
scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/logicpd-som-lv.dtsi | 16 ++++
arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 16 ++++
arch/arm64/include/asm/cpufeature.h | 7 +-
arch/arm64/kernel/cpufeature.c | 8 +-
drivers/atm/iphase.c | 8 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
drivers/hid/wacom_wac.c | 12 +--
drivers/infiniband/core/addr.c | 15 ++-
drivers/infiniband/core/sa_query.c | 10 +-
drivers/infiniband/hw/ocrdma/ocrdma_ah.c | 5 +-
drivers/infiniband/hw/ocrdma/ocrdma_hw.c | 5 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 2 +-
drivers/net/ethernet/marvell/mvpp2.c | 41 +++-----
drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +-
.../net/ethernet/mellanox/mlx5/core/fs_counters.c | 5 +
drivers/net/phy/phylink.c | 2 +
drivers/net/ppp/pppoe.c | 3 +
drivers/net/ppp/pppox.c | 13 +++
drivers/net/ppp/pptp.c | 3 +
drivers/net/tun.c | 1 +
drivers/nfc/nfcmrvl/main.c | 4 +-
drivers/nfc/nfcmrvl/uart.c | 4 +-
drivers/nfc/nfcmrvl/usb.c | 1 +
drivers/scsi/fcoe/fcoe_ctlr.c | 51 ++++------
drivers/scsi/libfc/fc_rport.c | 5 +-
drivers/spi/spi-bcm2835.c | 3 +-
fs/compat_ioctl.c | 3 -
include/linux/cgroup-defs.h | 1 +
include/linux/cgroup.h | 4 +
include/linux/if_pppox.h | 3 +
include/linux/mlx5/fs.h | 1 +
include/net/tcp.h | 17 ++++
include/scsi/libfcoe.h | 1 +
kernel/cgroup/cgroup.c | 106 +++++++++++++++------
kernel/exit.c | 2 +-
net/bridge/br_multicast.c | 3 +
net/bridge/br_vlan.c | 5 +
net/core/dev.c | 2 +
net/ipv4/tcp_output.c | 11 ++-
net/ipv6/ip6_tunnel.c | 6 +-
net/l2tp/l2tp_ppp.c | 3 +
net/sched/act_ife.c | 3 +
net/sched/sch_codel.c | 6 +-
net/tipc/netlink_compat.c | 11 ++-
tools/objtool/check.c | 2 +
48 files changed, 293 insertions(+), 149 deletions(-)
From: "Naveen N. Rao" <naveen.n.rao(a)linux.vnet.ibm.com>
In register_ftrace_function_probe(), we are not checking the return
value of alloc_and_copy_ftrace_hash(). The subsequent call to
ftrace_match_records() may end up dereferencing the same. Add a check to
ensure this doesn't happen.
Link: http://lkml.kernel.org/r/26e92574f25ad23e7cafa3cf5f7a819de1832cbe.156224952…
Cc: stable(a)vger.kernel.org
Fixes: 1ec3a81a0cf42 ("ftrace: Have each function probe use its own ftrace_ops")
Signed-off-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/ftrace.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 6200a6fe10e3..f9821a3374e9 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4338,6 +4338,11 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
old_hash = *orig_hash;
hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+ if (!hash) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
ret = ftrace_match_records(hash, glob, strlen(glob));
/* Nothing found? */
--
2.20.1
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
The race between adding a function probe and reading the probes that exist
is very subtle. It needs a comment. Also, the issue can also happen if the
probe has has the EMPTY_HASH as its func_hash.
Cc: stable(a)vger.kernel.org
Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/ftrace.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 80beed2cf0da..6200a6fe10e3 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3096,7 +3096,11 @@ t_probe_next(struct seq_file *m, loff_t *pos)
hash = iter->probe->ops.func_hash->filter_hash;
- if (!hash)
+ /*
+ * A probe being registered may temporarily have an empty hash
+ * and it's at the end of the func_probes list.
+ */
+ if (!hash || hash == EMPTY_HASH)
return NULL;
size = 1 << hash->size_bits;
@@ -4324,6 +4328,10 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
mutex_unlock(&ftrace_lock);
+ /*
+ * Note, there's a small window here that the func_hash->filter_hash
+ * may be NULL or empty. Need to be carefule when reading the loop.
+ */
mutex_lock(&probe->ops.func_hash->regex_lock);
orig_hash = &probe->ops.func_hash->filter_hash;
--
2.20.1
From: "Naveen N. Rao" <naveen.n.rao(a)linux.vnet.ibm.com>
LTP testsuite on powerpc results in the below crash:
Unable to handle kernel paging request for data at address 0x00000000
Faulting instruction address: 0xc00000000029d800
Oops: Kernel access of bad area, sig: 11 [#1]
LE SMP NR_CPUS=2048 NUMA PowerNV
...
CPU: 68 PID: 96584 Comm: cat Kdump: loaded Tainted: G W
NIP: c00000000029d800 LR: c00000000029dac4 CTR: c0000000001e6ad0
REGS: c0002017fae8ba10 TRAP: 0300 Tainted: G W
MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 28022422 XER: 20040000
CFAR: c00000000029d90c DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0
...
NIP [c00000000029d800] t_probe_next+0x60/0x180
LR [c00000000029dac4] t_mod_start+0x1a4/0x1f0
Call Trace:
[c0002017fae8bc90] [c000000000cdbc40] _cond_resched+0x10/0xb0 (unreliable)
[c0002017fae8bce0] [c0000000002a15b0] t_start+0xf0/0x1c0
[c0002017fae8bd30] [c0000000004ec2b4] seq_read+0x184/0x640
[c0002017fae8bdd0] [c0000000004a57bc] sys_read+0x10c/0x300
[c0002017fae8be30] [c00000000000b388] system_call+0x5c/0x70
The test (ftrace_set_ftrace_filter.sh) is part of ftrace stress tests
and the crash happens when the test does 'cat
$TRACING_PATH/set_ftrace_filter'.
The address points to the second line below, in t_probe_next(), where
filter_hash is dereferenced:
hash = iter->probe->ops.func_hash->filter_hash;
size = 1 << hash->size_bits;
This happens due to a race with register_ftrace_function_probe(). A new
ftrace_func_probe is created and added into the func_probes list in
trace_array under ftrace_lock. However, before initializing the filter,
we drop ftrace_lock, and re-acquire it after acquiring regex_lock. If
another process is trying to read set_ftrace_filter, it will be able to
acquire ftrace_lock during this window and it will end up seeing a NULL
filter_hash.
Fix this by just checking for a NULL filter_hash in t_probe_next(). If
the filter_hash is NULL, then this probe is just being added and we can
simply return from here.
Link: http://lkml.kernel.org/r/05e021f757625cbbb006fad41380323dbe4e3b43.156224952…
Cc: stable(a)vger.kernel.org
Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
Signed-off-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/ftrace.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index eca34503f178..80beed2cf0da 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3095,6 +3095,10 @@ t_probe_next(struct seq_file *m, loff_t *pos)
hnd = &iter->probe_entry->hlist;
hash = iter->probe->ops.func_hash->filter_hash;
+
+ if (!hash)
+ return NULL;
+
size = 1 << hash->size_bits;
retry:
--
2.20.1
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/133683
One or more kernel tests failed:
aarch64:
❌ Boot test
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 3f740c3323de commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
mt76-usb-fix-rx-a-msdu-support.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
❌ Boot test [0]
⚡⚡⚡ Podman system integration test (as root) [3]
⚡⚡⚡ Podman system integration test (as user) [3]
⚡⚡⚡ Loopdev Sanity [4]
⚡⚡⚡ jvm test suite [5]
⚡⚡⚡ AMTU (Abstract Machine Test Utility) [6]
⚡⚡⚡ LTP: openposix test suite [7]
⚡⚡⚡ audit: audit testsuite test [8]
⚡⚡⚡ httpd: mod_ssl smoke sanity [9]
⚡⚡⚡ iotop: sanity [10]
⚡⚡⚡ tuned: tune-processes-through-perf [11]
⚡⚡⚡ Usex - version 1.9-29 [12]
⚡⚡⚡ stress: stress-ng [13]
🚧 ⚡⚡⚡ LTP lite [14]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
🚧 ✅ LTP lite [14]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
🚧 ✅ IOMMU boot test [15]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ pciutils: sanity smoke test [16]
✅ Usex - version 1.9-29 [12]
✅ stress: stress-ng [13]
🚧 ✅ LTP lite [14]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
From: Shakeel Butt <shakeelb(a)google.com>
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the current
cpu for the number of online CPUs.
Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush
+++ a/mm/memcontrol.c
@@ -3278,7 +3278,7 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = min_idx; i < max_idx; i++)
@@ -3296,8 +3296,8 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = min_idx; i < max_idx; i++)
@@ -3316,8 +3316,8 @@ static void memcg_flush_percpu_vmevents(
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
_
From: Roman Gushchin <guro(a)fb.com>
Subject: mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones"
Commit 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with
the hierarchical ones") effectively decreased the precision of per-memcg
vmstats_local and per-memcg-per-node lruvec percpu counters.
That's good for displaying in memory.stat, but brings a serious regression
into the reclaim process.
One issue I've discovered and debugged is the following: lruvec_lru_size()
can return 0 instead of the actual number of pages in the lru list,
preventing the kernel to reclaim last remaining pages. Result is yet
another dying memory cgroups flooding. The opposite is also happening:
scanning an empty lru list is the waste of cpu time.
Also, inactive_list_is_low() can return incorrect values, preventing the
active lru from being scanned and freed. It can fail both because the
size of active and inactive lists are inaccurate, and because the number
of workingset refaults isn't precise. In other words, the result is
pretty random.
I'm not sure, if using the approximate number of slab pages in
count_shadow_number() is acceptable, but issues described above are enough
to partially revert the patch.
Let's keep per-memcg vmstat_local batched (they are only used for
displaying stats to the userspace), but keep lruvec stats precise. This
change fixes the dead memcg flooding on my setup.
Link: http://lkml.kernel.org/r/20190817004726.2530670-1-guro@fb.com
Fixes: 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones")
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Yafang Shao <laoar.shao(a)gmail.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~partially-revert-mm-memcontrolc-keep-local-vm-counters-in-sync-with-the-hierarchical-ones
+++ a/mm/memcontrol.c
@@ -752,15 +752,13 @@ void __mod_lruvec_state(struct lruvec *l
/* Update memcg */
__mod_memcg_state(memcg, idx, val);
+ /* Update lruvec */
+ __this_cpu_add(pn->lruvec_stat_local->count[idx], val);
+
x = val + __this_cpu_read(pn->lruvec_stat_cpu->count[idx]);
if (unlikely(abs(x) > MEMCG_CHARGE_BATCH)) {
struct mem_cgroup_per_node *pi;
- /*
- * Batch local counters to keep them in sync with
- * the hierarchical ones.
- */
- __this_cpu_add(pn->lruvec_stat_local->count[idx], x);
for (pi = pn; pi; pi = parent_nodeinfo(pi, pgdat->node_id))
atomic_long_add(x, &pi->lruvec_stat[idx]);
x = 0;
_
set_msi_sid_cb() is used to determine whether device aliases share the
same bus, but it can provide false indications that aliases use the same
bus when in fact they do not. The reason is that set_msi_sid_cb()
assumes that pdev is fixed, while actually pci_for_each_dma_alias() can
call fn() when pdev is set to a subordinate device.
As a result, running an VM on ESX with VT-d emulation enabled can
results in the log warning such as:
DMAR: [INTR-REMAP] Request device [00:11.0] fault index 3b [fault reason 38] Blocked an interrupt request due to source-id verification failure
This seems to cause additional ata errors such as:
ata3.00: qc timeout (cmd 0xa1)
ata3.00: failed to IDENTIFY (I/O error, err_mask=0x4)
These timeouts also cause boot to be much longer and other errors.
Fix it by checking comparing the alias with the previous one instead.
Fixes: 3f0c625c6ae71 ("iommu/vt-d: Allow interrupts from the entire bus for aliased devices")
Cc: stable(a)vger.kernel.org
Cc: Logan Gunthorpe <logang(a)deltatee.com>
Cc: David Woodhouse <dwmw2(a)infradead.org>
Cc: Joerg Roedel <joro(a)8bytes.org>
Cc: Jacob Pan <jacob.jun.pan(a)linux.intel.com>
Signed-off-by: Nadav Amit <namit(a)vmware.com>
---
drivers/iommu/intel_irq_remapping.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index 4786ca061e31..81e43c1df7ec 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -376,13 +376,13 @@ static int set_msi_sid_cb(struct pci_dev *pdev, u16 alias, void *opaque)
{
struct set_msi_sid_data *data = opaque;
+ if (data->count == 0 || PCI_BUS_NUM(alias) == PCI_BUS_NUM(data->alias))
+ data->busmatch_count++;
+
data->pdev = pdev;
data->alias = alias;
data->count++;
- if (PCI_BUS_NUM(alias) == pdev->bus->number)
- data->busmatch_count++;
-
return 0;
}
--
2.17.1
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/132631
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: c3915fe1bf12 - Linux 5.2.11
We grabbed the 39e22066fa51 commit of the stable queue repository.
We then merged the patchset with `git am`:
dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch
afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch
fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch
afs-fix-off-by-one-in-afs_rename-expected-data-versi.patch
afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch
afs-fix-missing-dentry-data-version-updating.patch
nvmet-fix-use-after-free-bug-when-a-port-is-removed.patch
nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch
nvmet-file-fix-nvmet_file_flush-always-returning-an-.patch
nvme-core-fix-extra-device_put-call-on-error-path.patch
nvme-fix-a-possible-deadlock-when-passthru-commands-.patch
nvme-rdma-fix-possible-use-after-free-in-connect-err.patch
nvme-fix-controller-removal-race-with-scan-work.patch
nvme-pci-fix-async-probe-remove-race.patch
soundwire-cadence_master-fix-register-definition-for.patch
soundwire-cadence_master-fix-definitions-for-intstat.patch
auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
btrfs-trim-check-the-range-passed-into-to-prevent-ov.patch
ib-mlx5-fix-implicit-mr-release-flow.patch
dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch
omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch
iommu-dma-handle-sg-length-overflow-better.patch
dma-direct-don-t-truncate-dma_required_mask-to-bus-a.patch
usb-gadget-composite-clear-suspended-on-reset-discon.patch
usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
habanalabs-fix-dram-usage-accounting-on-context-tear.patch
habanalabs-fix-endianness-handling-for-packets-from-.patch
habanalabs-fix-completion-queue-handling-when-host-i.patch
habanalabs-fix-endianness-handling-for-internal-qman.patch
habanalabs-fix-device-irq-unmasking-for-be-host.patch
xen-blkback-fix-memory-leaks.patch
arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch
riscv-fix-flush_tlb_range-end-address-for-flush_tlb_.patch
i2c-rcar-avoid-race-when-unregistering-slave-client.patch
i2c-emev2-avoid-race-when-unregistering-slave-client.patch
drm-scheduler-use-job-count-instead-of-peek.patch
drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
usb-host-fotg2-restart-hcd-after-port-reset.patch
tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch
tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
locking-rwsem-add-missing-acquire-to-read_slowpath-e.patch
lcoking-rwsem-add-missing-acquire-to-read_slowpath-s.patch
watchdog-bcm2835_wdt-fix-module-autoload.patch
selftests-bpf-install-files-test_xdp_vlan.sh.patch
drm-bridge-tfp410-fix-memleak-in-get_modes.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
🚧 ✅ LTP lite [13]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
🚧 ✅ LTP lite [13]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ Loopdev Sanity [4]
✅ jvm test suite [5]
✅ AMTU (Abstract Machine Test Utility) [6]
✅ LTP: openposix test suite [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ pciutils: sanity smoke test [14]
✅ Usex - version 1.9-29 [12]
✅ stress: stress-ng [15]
🚧 ✅ LTP lite [13]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
🚧 ✅ Storage blktests [2]
🚧 ✅ IOMMU boot test [16]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/iommu/boot
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
From: Sven Eckelmann <sven(a)narfation.org>
[ Upstream commit fa3a03da549a889fc9dbc0d3c5908eb7882cac8f ]
The bucket variable is only updated outside the loop over the mcast_flags
buckets. It will only be updated during a dumping run when the dumping has
to be interrupted and a new message has to be started.
This could result in repeated or missing entries when the multicast flags
are dumped to userspace.
Fixes: d2d489b7d851 ("batman-adv: Add inconsistent multicast netlink dump detection")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
net/batman-adv/multicast.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index ec54e236e3454..50fe9dfb088b6 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -1653,7 +1653,7 @@ __batadv_mcast_flags_dump(struct sk_buff *msg, u32 portid,
while (bucket_tmp < hash->size) {
if (batadv_mcast_flags_dump_bucket(msg, portid, cb, hash,
- *bucket, &idx_tmp))
+ bucket_tmp, &idx_tmp))
break;
bucket_tmp++;
--
2.20.1
Hi.
I'd like to get 2a92b08b1855 squeezed into a stable tree since it fixes
the following splat in the kernel log when using an MTK-based Wi-Fi
access point:
[135577.311588] usb 1-3: rx data too big 2044
[135577.311689] usb 1-3: rx data too big 2044
[135578.166351] usb 1-3: rx data too big 2044
See also: https://bugzilla.kernel.org/show_bug.cgi?id=203789
The patch applies to the v5.2.x series without conficts.
Lorenzo, are you fine with this?
Thanks.
--
Best regards,
Oleksandr Natalenko (post-factum)
Senior Software Maintenance Engineer
From: Dexuan Cui <decui(a)microsoft.com>
[ Upstream commit 685703b497bacea8765bb409d6b73455b73c540e ]
There is a race condition for an established connection that is being closed
by the guest: the refcnt is 4 at the end of hvs_release() (Note: here the
'remove_sock' is false):
1 for the initial value;
1 for the sk being in the bound list;
1 for the sk being in the connected list;
1 for the delayed close_work.
After hvs_release() finishes, __vsock_release() -> sock_put(sk) *may*
decrease the refcnt to 3.
Concurrently, hvs_close_connection() runs in another thread:
calls vsock_remove_sock() to decrease the refcnt by 2;
call sock_put() to decrease the refcnt to 0, and free the sk;
next, the "release_sock(sk)" may hang due to use-after-free.
In the above, after hvs_release() finishes, if hvs_close_connection() runs
faster than "__vsock_release() -> sock_put(sk)", then there is not any issue,
because at the beginning of hvs_close_connection(), the refcnt is still 4.
The issue can be resolved if an extra reference is taken when the
connection is established.
Fixes: a9eeb998c28d ("hv_sock: Add support for delayed close")
Signed-off-by: Dexuan Cui <decui(a)microsoft.com>
Reviewed-by: Sunil Muthuswamy <sunilmut(a)microsoft.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
net/vmw_vsock/hyperv_transport.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 52ac3e49c7efd..ec72a5edaa1b8 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -320,6 +320,11 @@ static void hvs_close_connection(struct vmbus_channel *chan)
lock_sock(sk);
hvs_do_close_lock_held(vsock_sk(sk), true);
release_sock(sk);
+
+ /* Release the refcnt for the channel that's opened in
+ * hvs_open_connection().
+ */
+ sock_put(sk);
}
static void hvs_open_connection(struct vmbus_channel *chan)
@@ -389,6 +394,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
}
set_per_channel_state(chan, conn_from_host ? new : sk);
+
+ /* This reference will be dropped by hvs_close_connection(). */
+ sock_hold(conn_from_host ? new : sk);
vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
/* Set the pending send size to max packet size to always get
--
2.20.1
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the
current cpu for the number of online CPUs.
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: <stable(a)vger.kernel.org>
---
Note: The buggy patches were marked for stable therefore adding Cc to
stable.
mm/memcontrol.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 26e2999af608..f4e60ee8b845 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3271,7 +3271,7 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
for_each_online_cpu(cpu)
for (i = 0; i < MEMCG_NR_STAT; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < MEMCG_NR_STAT; i++)
@@ -3286,8 +3286,8 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
@@ -3306,8 +3306,8 @@ static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
--
2.23.0.187.g17f5b7556c-goog
From: Andre Przywara <andre.przywara(a)arm.com>
In our VGIC implementation we limit the number of SPIs to a number
that the userland application told us. Accordingly we limit the
allocation of memory for virtual IRQs to that number.
However in our MMIO dispatcher we didn't check if we ever access an
IRQ beyond that limit, leading to out-of-bound accesses.
Add a test against the number of allocated SPIs in check_region().
Adjust the VGIC_ADDR_TO_INT macro to avoid an actual division, which
is not implemented on ARM(32).
[maz: cleaned-up original patch]
Cc: stable(a)vger.kernel.org
Reviewed-by: Christoffer Dall <christoffer.dall(a)linaro.org>
Signed-off-by: Andre Przywara <andre.przywara(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
---
virt/kvm/arm/vgic/vgic-mmio.c | 41 +++++++++++++++++++++++------------
virt/kvm/arm/vgic/vgic-mmio.h | 14 ++++++------
2 files changed, 34 insertions(+), 21 deletions(-)
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index 3bad3c5ed..d1b080ca8 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -453,17 +453,33 @@ struct vgic_io_device *kvm_to_vgic_iodev(const struct kvm_io_device *dev)
return container_of(dev, struct vgic_io_device, dev);
}
-static bool check_region(const struct vgic_register_region *region,
+static bool check_region(const struct kvm *kvm,
+ const struct vgic_register_region *region,
gpa_t addr, int len)
{
- if ((region->access_flags & VGIC_ACCESS_8bit) && len == 1)
- return true;
- if ((region->access_flags & VGIC_ACCESS_32bit) &&
- len == sizeof(u32) && !(addr & 3))
- return true;
- if ((region->access_flags & VGIC_ACCESS_64bit) &&
- len == sizeof(u64) && !(addr & 7))
- return true;
+ int flags, nr_irqs = kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS;
+
+ switch (len) {
+ case sizeof(u8):
+ flags = VGIC_ACCESS_8bit;
+ break;
+ case sizeof(u32):
+ flags = VGIC_ACCESS_32bit;
+ break;
+ case sizeof(u64):
+ flags = VGIC_ACCESS_64bit;
+ break;
+ default:
+ return false;
+ }
+
+ if ((region->access_flags & flags) && IS_ALIGNED(addr, len)) {
+ if (!region->bits_per_irq)
+ return true;
+
+ /* Do we access a non-allocated IRQ? */
+ return VGIC_ADDR_TO_INTID(addr, region->bits_per_irq) < nr_irqs;
+ }
return false;
}
@@ -477,7 +493,7 @@ static int dispatch_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *dev,
region = vgic_find_mmio_region(iodev->regions, iodev->nr_regions,
addr - iodev->base_addr);
- if (!region || !check_region(region, addr, len)) {
+ if (!region || !check_region(vcpu->kvm, region, addr, len)) {
memset(val, 0, len);
return 0;
}
@@ -510,10 +526,7 @@ static int dispatch_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *dev,
region = vgic_find_mmio_region(iodev->regions, iodev->nr_regions,
addr - iodev->base_addr);
- if (!region)
- return 0;
-
- if (!check_region(region, addr, len))
+ if (!region || !check_region(vcpu->kvm, region, addr, len))
return 0;
switch (iodev->iodev_type) {
diff --git a/virt/kvm/arm/vgic/vgic-mmio.h b/virt/kvm/arm/vgic/vgic-mmio.h
index 0b3ecf9d1..ba63d91d2 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.h
+++ b/virt/kvm/arm/vgic/vgic-mmio.h
@@ -50,15 +50,15 @@ extern struct kvm_io_device_ops kvm_io_gic_ops;
#define VGIC_ADDR_IRQ_MASK(bits) (((bits) * 1024 / 8) - 1)
/*
- * (addr & mask) gives us the byte offset for the INT ID, so we want to
- * divide this with 'bytes per irq' to get the INT ID, which is given
- * by '(bits) / 8'. But we do this with fixed-point-arithmetic and
- * take advantage of the fact that division by a fraction equals
- * multiplication with the inverted fraction, and scale up both the
- * numerator and denominator with 8 to support at most 64 bits per IRQ:
+ * (addr & mask) gives us the _byte_ offset for the INT ID.
+ * We multiply this by 8 the get the _bit_ offset, then divide this by
+ * the number of bits to learn the actual INT ID.
+ * But instead of a division (which requires a "long long div" implementation),
+ * we shift by the binary logarithm of <bits>.
+ * This assumes that <bits> is a power of two.
*/
#define VGIC_ADDR_TO_INTID(addr, bits) (((addr) & VGIC_ADDR_IRQ_MASK(bits)) * \
- 64 / (bits) / 8)
+ 8 >> ilog2(bits))
/*
* Some VGIC registers store per-IRQ information, with a different number
--
2.17.1
The patch titled
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
has been added to the -mm tree. Its filename is
mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-memcontrol-fix-percpu-vmstats-a…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-memcontrol-fix-percpu-vmstats-a…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Shakeel Butt <shakeelb(a)google.com>
Subject: mm: memcontrol: fix percpu vmstats and vmevents flush
Instead of using raw_cpu_read() use per_cpu() to read the actual data of
the corresponding cpu otherwise we will be reading the data of the current
cpu for the number of online CPUs.
Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com
Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg")
Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Roman Gushchin <guro(a)fb.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c~mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush
+++ a/mm/memcontrol.c
@@ -3278,7 +3278,7 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
+ stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = min_idx; i < max_idx; i++)
@@ -3296,8 +3296,8 @@ static void memcg_flush_percpu_vmstats(s
for_each_online_cpu(cpu)
for (i = min_idx; i < max_idx; i++)
- stat[i] += raw_cpu_read(
- pn->lruvec_stat_cpu->count[i]);
+ stat[i] += per_cpu(
+ pn->lruvec_stat_cpu->count[i], cpu);
for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
for (i = min_idx; i < max_idx; i++)
@@ -3316,8 +3316,8 @@ static void memcg_flush_percpu_vmevents(
for_each_online_cpu(cpu)
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
- events[i] += raw_cpu_read(
- memcg->vmstats_percpu->events[i]);
+ events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+ cpu);
for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
_
Patches currently in -mm which might be from shakeelb(a)google.com are
mm-memcontrol-fix-percpu-vmstats-and-vmevents-flush.patch
commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf upstream.
The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe
to an MFD.") broke module autoloading on Raspberry Pi. So add a
module alias this fix this.
Fixes: 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe to an MFD.")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Stefan Wahren <wahrenst(a)gmx.net>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim(a)linux-watchdog.org>
---
drivers/watchdog/bcm2835_wdt.c | 1 +
1 file changed, 1 insertion(+)
Hi Greg,
please apply to the Linux 5.2 stable branch, because without this patch
the Raspberry Pi might not be able to reboot.
Regards
Stefan
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index 560c1c5..f4937a9 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -240,6 +240,7 @@ module_param(nowayout, bool, 0);
MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
__MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+MODULE_ALIAS("platform:bcm2835-wdt");
MODULE_AUTHOR("Lubomir Rintel <lkundrak(a)v3.sk>");
MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer");
MODULE_LICENSE("GPL");
--
2.7.4
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
If the re-allocation of tep->cmdlines succeeds, then the previous allocation
of tep->cmdlines will be freed. If we later fail in add_new_comm(), we must
not free cmdlines, and also should assign tep->cmdlines to the new
allocation. Otherwise when freeing tep, the tep->cmdlines will be pointing
to garbage.
Cc: stable(a)vger.kernel.org
Fixes: a6d2a61ac653a ("tools lib traceevent: Remove some die() calls")
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
tools/lib/traceevent/event-parse.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index b36b536a9fcb..13fd9fdf91e0 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -269,10 +269,10 @@ static int add_new_comm(struct tep_handle *tep,
errno = ENOMEM;
return -1;
}
+ tep->cmdlines = cmdlines;
cmdlines[tep->cmdline_count].comm = strdup(comm);
if (!cmdlines[tep->cmdline_count].comm) {
- free(cmdlines);
errno = ENOMEM;
return -1;
}
@@ -283,7 +283,6 @@ static int add_new_comm(struct tep_handle *tep,
tep->cmdline_count++;
qsort(cmdlines, tep->cmdline_count, sizeof(*cmdlines), cmdline_cmp);
- tep->cmdlines = cmdlines;
return 0;
}
--
2.20.1
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 7af0145067bc429a09ac4047b167c0971c9f0dc7
Gitweb: https://git.kernel.org/tip/7af0145067bc429a09ac4047b167c0971c9f0dc7
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Thu, 29 Aug 2019 00:31:34 +02:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Thu, 29 Aug 2019 20:48:44 +02:00
x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text
ftrace does not use text_poke() for enabling trace functionality. It uses
its own mechanism and flips the whole kernel text to RW and back to RO.
The CPA rework removed a loop based check of 4k pages which tried to
preserve a large page by checking each 4k page whether the change would
actually cover all pages in the large page.
This resulted in endless loops for nothing as in testing it turned out that
it actually never preserved anything. Of course testing missed to include
ftrace, which is the one and only case which benefitted from the 4k loop.
As a consequence enabling function tracing or ftrace based kprobes results
in a full 4k split of the kernel text, which affects iTLB performance.
The kernel RO protection is the only valid case where this can actually
preserve large pages.
All other static protections (RO data, data NX, PCI, BIOS) are truly
static. So a conflict with those protections which results in a split
should only ever happen when a change of memory next to a protected region
is attempted. But these conflicts are rightfully splitting the large page
to preserve the protected regions. In fact a change to the protected
regions itself is a bug and is warned about.
Add an exception for the static protection check for kernel text RO when
the to be changed region spawns a full large page which allows to preserve
the large mappings. This also prevents the syslog to be spammed about CPA
violations when ftrace is used.
The exception needs to be removed once ftrace switched over to text_poke()
which avoids the whole issue.
Fixes: 585948f4f695 ("x86/mm/cpa: Avoid the 4k pages check completely")
Reported-by: Song Liu <songliubraving(a)fb.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Tested-by: Song Liu <songliubraving(a)fb.com>
Reviewed-by: Song Liu <songliubraving(a)fb.com>
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908282355340.1938@nanos.tec.linu…
---
arch/x86/mm/pageattr.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 6a9a77a..e14e95e 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -516,7 +516,7 @@ static inline void check_conflict(int warnlvl, pgprot_t prot, pgprotval_t val,
*/
static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
unsigned long pfn, unsigned long npg,
- int warnlvl)
+ unsigned long lpsize, int warnlvl)
{
pgprotval_t forbidden, res;
unsigned long end;
@@ -535,9 +535,17 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
check_conflict(warnlvl, prot, res, start, end, pfn, "Text NX");
forbidden = res;
- res = protect_kernel_text_ro(start, end);
- check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
- forbidden |= res;
+ /*
+ * Special case to preserve a large page. If the change spawns the
+ * full large page mapping then there is no point to split it
+ * up. Happens with ftrace and is going to be removed once ftrace
+ * switched to text_poke().
+ */
+ if (lpsize != (npg * PAGE_SIZE) || (start & (lpsize - 1))) {
+ res = protect_kernel_text_ro(start, end);
+ check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
+ forbidden |= res;
+ }
/* Check the PFN directly */
res = protect_pci_bios(pfn, pfn + npg - 1);
@@ -819,7 +827,7 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
* extra conditional required here.
*/
chk_prot = static_protections(old_prot, lpaddr, old_pfn, numpages,
- CPA_CONFLICT);
+ psize, CPA_CONFLICT);
if (WARN_ON_ONCE(pgprot_val(chk_prot) != pgprot_val(old_prot))) {
/*
@@ -855,7 +863,7 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
* protection requirement in the large page.
*/
new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages,
- CPA_DETECT);
+ psize, CPA_DETECT);
/*
* If there is a conflict, split the large page.
@@ -906,7 +914,8 @@ static void split_set_pte(struct cpa_data *cpa, pte_t *pte, unsigned long pfn,
if (!cpa->force_static_prot)
goto set;
- prot = static_protections(ref_prot, address, pfn, npg, CPA_PROTECT);
+ /* Hand in lpsize = 0 to enforce the protection mechanism */
+ prot = static_protections(ref_prot, address, pfn, npg, 0, CPA_PROTECT);
if (pgprot_val(prot) == pgprot_val(ref_prot))
goto set;
@@ -1503,7 +1512,8 @@ static int __change_page_attr(struct cpa_data *cpa, int primary)
pgprot_val(new_prot) |= pgprot_val(cpa->mask_set);
cpa_inc_4k_install();
- new_prot = static_protections(new_prot, address, pfn, 1,
+ /* Hand in lpsize = 0 to enforce the protection mechanism */
+ new_prot = static_protections(new_prot, address, pfn, 1, 0,
CPA_PROTECT);
new_prot = pgprot_clear_protnone_bits(new_prot);
From: Jan Stancek <jstancek(a)redhat.com>
[ Upstream commit e1b98fa316648420d0434d9ff5b92ad6609ba6c3 ]
LTP mtest06 has been observed to occasionally hit "still mapped when
deleted" and following BUG_ON on arm64.
The extra mapcount originated from pagefault handler, which handled
pagefault for vma that has already been detached. vma is detached
under mmap_sem write lock by detach_vmas_to_be_unmapped(), which
also invalidates vmacache.
When the pagefault handler (under mmap_sem read lock) calls
find_vma(), vmacache_valid() wrongly reports vmacache as valid.
After rwsem down_read() returns via 'queue empty' path (as of v5.2),
it does so without an ACQUIRE on sem->count:
down_read()
__down_read()
rwsem_down_read_failed()
__rwsem_down_read_failed_common()
raw_spin_lock_irq(&sem->wait_lock);
if (list_empty(&sem->wait_list)) {
if (atomic_long_read(&sem->count) >= 0) {
raw_spin_unlock_irq(&sem->wait_lock);
return sem;
The problem can be reproduced by running LTP mtest06 in a loop and
building the kernel (-j $NCPUS) in parallel. It does reproduces since
v4.20 on arm64 HPE Apollo 70 (224 CPUs, 256GB RAM, 2 nodes). It
triggers reliably in about an hour.
The patched kernel ran fine for 10+ hours.
Signed-off-by: Jan Stancek <jstancek(a)redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Reviewed-by: Will Deacon <will(a)kernel.org>
Acked-by: Waiman Long <longman(a)redhat.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: dbueso(a)suse.de
Fixes: 4b486b535c33 ("locking/rwsem: Exit read lock slowpath if queue empty & no writer")
Link: https://lkml.kernel.org/r/50b8914e20d1d62bb2dee42d342836c2c16ebee7.15634380…
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
This is a backport for the v5.2 stable tree. There were multiple reports
of this issue being hit.
Given that there were a few changes to the code around this, I'd
appreciate an ack before pulling it in.
kernel/locking/rwsem-xadd.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
index 0b1f779572402..397dedc58432d 100644
--- a/kernel/locking/rwsem-xadd.c
+++ b/kernel/locking/rwsem-xadd.c
@@ -454,6 +454,8 @@ __rwsem_down_read_failed_common(struct rw_semaphore *sem, int state)
* been set in the count.
*/
if (atomic_long_read(&sem->count) >= 0) {
+ /* Provide lock ACQUIRE */
+ smp_acquire__after_ctrl_dep();
raw_spin_unlock_irq(&sem->wait_lock);
rwsem_set_reader_owned(sem);
lockevent_inc(rwsem_rlock_fast);
--
2.20.1