The patch below does not apply to the 5.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9cdde85804833af77c6afbf7c53f0d959c42eb9f Mon Sep 17 00:00:00 2001
From: Hyungwoo Yang <hyungwoo.yang(a)intel.com>
Date: Wed, 29 May 2019 21:03:54 -0700
Subject: [PATCH] platform/chrome: cros_ec_ishtp: fix crash during suspend
Kernel crashes during suspend due to wrong conversion in
suspend and resume functions.
Use the proper helper to get ishtp_cl_device instance.
Cc: <stable(a)vger.kernel.org> # 5.2.x: b12bbdc5: HID: intel-ish-hid: fix wrong driver_data usage
Signed-off-by: Hyungwoo Yang <hyungwoo.yang(a)intel.com>
Signed-off-by: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c
index e504d255d5ce..430731cdf827 100644
--- a/drivers/platform/chrome/cros_ec_ishtp.c
+++ b/drivers/platform/chrome/cros_ec_ishtp.c
@@ -707,7 +707,7 @@ static int cros_ec_ishtp_reset(struct ishtp_cl_device *cl_device)
*/
static int __maybe_unused cros_ec_ishtp_suspend(struct device *device)
{
- struct ishtp_cl_device *cl_device = dev_get_drvdata(device);
+ struct ishtp_cl_device *cl_device = ishtp_dev_to_cl_device(device);
struct ishtp_cl *cros_ish_cl = ishtp_get_drvdata(cl_device);
struct ishtp_cl_data *client_data = ishtp_get_client_data(cros_ish_cl);
@@ -722,7 +722,7 @@ static int __maybe_unused cros_ec_ishtp_suspend(struct device *device)
*/
static int __maybe_unused cros_ec_ishtp_resume(struct device *device)
{
- struct ishtp_cl_device *cl_device = dev_get_drvdata(device);
+ struct ishtp_cl_device *cl_device = ishtp_dev_to_cl_device(device);
struct ishtp_cl *cros_ish_cl = ishtp_get_drvdata(cl_device);
struct ishtp_cl_data *client_data = ishtp_get_client_data(cros_ish_cl);
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: f7d5b3dc4792 - Linux 5.2.10
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/124342
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: f7d5b3dc4792 - Linux 5.2.10
We grabbed the 4a6e874ddb67 commit of the stable queue repository.
We then merged the patchset with `git am`:
asoc-simple_card_utils.h-care-null-dai-at-asoc_simpl.patch
asoc-simple-card-fix-an-use-after-free-in-simple_dai.patch
asoc-simple-card-fix-an-use-after-free-in-simple_for.patch
asoc-audio-graph-card-fix-use-after-free-in-graph_da.patch
asoc-audio-graph-card-fix-an-use-after-free-in-graph.patch
asoc-audio-graph-card-add-missing-const-at-graph_get.patch
regulator-axp20x-fix-dcdca-and-dcdcd-for-axp806.patch
regulator-axp20x-fix-dcdc5-and-dcdc6-for-axp803.patch
asoc-samsung-odroid-fix-an-use-after-free-issue-for-.patch
asoc-samsung-odroid-fix-a-double-free-issue-for-cpu_.patch
asoc-intel-bytcht_es8316-add-quirk-for-irbis-nb41-ne.patch
hid-logitech-hidpp-add-usb-pid-for-a-few-more-suppor.patch
hid-add-044f-b320-thrustmaster-inc.-2-in-1-dt.patch
mips-kernel-only-use-i8253-clocksource-with-periodic.patch
mips-fix-cacheinfo.patch
libbpf-sanitize-var-to-conservative-1-byte-int.patch
netfilter-ebtables-fix-a-memory-leak-bug-in-compat.patch
asoc-dapm-fix-handling-of-custom_stop_condition-on-d.patch
asoc-sof-use-__u32-instead-of-uint32_t-in-uapi-heade.patch
spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch
bpf-sockmap-sock_map_delete-needs-to-use-xchg.patch
bpf-sockmap-synchronize_rcu-before-free-ing-map.patch
bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch
selftests-bpf-fix-sendmsg6_prog-on-s390.patch
asoc-dapm-fix-a-memory-leak-bug.patch
bonding-force-slave-speed-check-after-link-state-rec.patch
net-mvpp2-don-t-check-for-3-consecutive-idle-frames-.patch
selftests-forwarding-gre_multipath-enable-ipv4-forwa.patch
selftests-forwarding-gre_multipath-fix-flower-filter.patch
selftests-bpf-add-another-gso_segs-access.patch
libbpf-fix-using-uninitialized-ioctl-results.patch
can-dev-call-netif_carrier_off-in-register_candev.patch
can-mcp251x-add-error-check-when-wq-alloc-failed.patch
can-gw-fix-error-path-of-cgw_module_init.patch
asoc-fail-card-instantiation-if-dai-format-setup-fai.patch
staging-fbtft-fix-gpio-handling.patch
libbpf-silence-gcc8-warning-about-string-truncation.patch
st21nfca_connectivity_event_received-null-check-the-.patch
st_nci_hci_connectivity_event_received-null-check-th.patch
nl-mac-80211-fix-interface-combinations-on-crypto-co.patch
asoc-ti-davinci-mcasp-fix-clk-pdir-handling-for-i2s-.patch
asoc-rockchip-fix-mono-capture.patch
asoc-ti-davinci-mcasp-correct-slot_width-posed-const.patch
net-usb-qmi_wwan-add-the-broadmobi-bm818-card.patch
qed-rdma-fix-the-hw_ver-returned-in-device-attribute.patch
isdn-misdn-hfcsusb-fix-possible-null-pointer-derefer.patch
habanalabs-fix-f-w-download-in-be-architecture.patch
mac80211_hwsim-fix-possible-null-pointer-dereference.patch
net-stmmac-manage-errors-returned-by-of_get_mac_addr.patch
netfilter-ipset-actually-allow-destination-mac-addre.patch
netfilter-ipset-copy-the-right-mac-address-in-bitmap.patch
netfilter-ipset-fix-rename-concurrency-with-listing.patch
rxrpc-fix-potential-deadlock.patch
rxrpc-fix-the-lack-of-notification-when-sendmsg-fail.patch
nvmem-use-the-same-permissions-for-eeprom-as-for-nvm.patch
iwlwifi-mvm-avoid-races-in-rate-init-and-rate-perfor.patch
iwlwifi-dbg_ini-move-iwl_dbg_tlv_load_bin-out-of-deb.patch
iwlwifi-dbg_ini-move-iwl_dbg_tlv_free-outside-of-deb.patch
iwlwifi-fix-locking-in-delayed-gtk-setting.patch
iwlwifi-mvm-send-lq-command-always-async.patch
enetc-fix-build-error-without-phylib.patch
isdn-hfcsusb-fix-misdn-driver-crash-caused-by-transf.patch
net-phy-phy_led_triggers-fix-a-possible-null-pointer.patch
perf-bench-numa-fix-cpu0-binding.patch
spi-pxa2xx-add-support-for-intel-tiger-lake.patch
can-sja1000-force-the-string-buffer-null-terminated.patch
can-peak_usb-force-the-string-buffer-null-terminated.patch
asoc-amd-acp3x-use-dma_ops-of-parent-device-for-acp3.patch
net-ethernet-qlogic-qed-force-the-string-buffer-null.patch
enetc-select-phylib-while-config_fsl_enetc_vf-is-set.patch
nfsv4-fix-a-credential-refcount-leak-in-nfs41_check_.patch
nfsv4-when-recovering-state-fails-with-eagain-retry-.patch
nfsv4.1-fix-open-stateid-recovery.patch
nfsv4.1-only-reap-expired-delegations.patch
nfsv4-fix-a-potential-sleep-while-atomic-in-nfs4_do_.patch
nfs-fix-regression-whereby-fscache-errors-are-appear.patch
hid-quirks-set-the-increment_usage_on_duplicate-quir.patch
hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch
drm-rockchip-suspend-dp-late.patch
smb3-fix-potential-memory-leak-when-processing-compo.patch
smb3-kernel-oops-mounting-a-encryptdata-share-with-c.patch
sched-deadline-fix-double-accounting-of-rq-running-b.patch
sched-psi-reduce-psimon-fifo-priority.patch
sched-psi-do-not-require-setsched-permission-from-th.patch
s390-protvirt-avoid-memory-sharing-for-diag-308-set-.patch
s390-mm-fix-dump_pagetables-top-level-page-table-wal.patch
s390-put-_stext-and-_etext-into-.text-section.patch
ata-rb532_cf-fix-unused-variable-warning-in-rb532_pa.patch
net-cxgb3_main-fix-a-resource-leak-in-a-error-path-i.patch
net-stmmac-fix-issues-when-number-of-queues-4.patch
net-stmmac-tc-do-not-return-a-fragment-entry.patch
drm-amdgpu-pin-the-csb-buffer-on-hw-init-for-gfx-v8.patch
net-hisilicon-make-hip04_tx_reclaim-non-reentrant.patch
net-hisilicon-fix-hip04-xmit-never-return-tx_busy.patch
net-hisilicon-fix-dma_map_single-failed-on-arm64.patch
nfsv4-ensure-state-recovery-handles-etimedout-correc.patch
libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch
libata-add-sg-safety-checks-in-sff-pio-transfers.patch
x86-lib-cpu-address-missing-prototypes-warning.patch
drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch
block-aoe-fix-kernel-crash-due-to-atomic-sleep-when-.patch
block-bfq-handle-null-return-value-by-bfq_init_rq.patch
perf-ftrace-fix-failure-to-set-cpumask-when-only-one.patch
perf-cpumap-fix-writing-to-illegal-memory-in-handlin.patch
perf-pmu-events-fix-missing-cpu_clk_unhalted.core-ev.patch
dt-bindings-riscv-fix-the-schema-compatible-string-f.patch
kvm-arm64-don-t-write-junk-to-sysregs-on-reset.patch
kvm-arm-don-t-write-junk-to-cp15-registers-on-reset.patch
selftests-kvm-adding-config-fragments.patch
iwlwifi-mvm-disable-tx-amsdu-on-older-nics.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ LTP lite [2]
✅ Loopdev Sanity [3]
✅ jvm test suite [4]
✅ AMTU (Abstract Machine Test Utility) [5]
✅ LTP: openposix test suite [6]
✅ Ethernet drivers sanity [7]
✅ Networking socket: fuzz [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ Usex - version 1.9-29 [13]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ LTP lite [2]
✅ Loopdev Sanity [3]
✅ jvm test suite [4]
✅ AMTU (Abstract Machine Test Utility) [5]
✅ LTP: openposix test suite [6]
✅ Ethernet drivers sanity [7]
✅ Networking socket: fuzz [8]
✅ audit: audit testsuite test [9]
✅ httpd: mod_ssl smoke sanity [10]
✅ iotop: sanity [11]
✅ tuned: tune-processes-through-perf [12]
✅ pciutils: sanity smoke test [14]
✅ Usex - version 1.9-29 [13]
✅ stress: stress-ng [15]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
vgpu ppgtt notification was split into 2 steps, the first step is to
update PVINFO's pdp register and then write PVINFO's g2v_notify register
with action code to tirgger ppgtt notification to GVT side.
currently these steps were not atomic operations due to no any protection,
so it is easy to enter race condition state during the MTBF, stress and
IGT test to cause GPU hang.
the solution is to add a lock to make vgpu ppgtt notication as atomic
operation.
Cc: stable(a)vger.kernel.org
Signed-off-by: Xiaolin Zhang <xiaolin.zhang(a)intel.com>
---
drivers/gpu/drm/i915/i915_drv.h | 1 +
drivers/gpu/drm/i915/i915_gem_gtt.c | 4 ++++
drivers/gpu/drm/i915/i915_vgpu.c | 1 +
3 files changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index eb31c16..32e17c4 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -961,6 +961,7 @@ struct i915_frontbuffer_tracking {
};
struct i915_virtual_gpu {
+ struct mutex lock;
bool active;
u32 caps;
};
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 2cd2dab..ff0b178 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -833,6 +833,8 @@ static int gen8_ppgtt_notify_vgt(struct i915_ppgtt *ppgtt, bool create)
enum vgt_g2v_type msg;
int i;
+ mutex_lock(&dev_priv->vgpu.lock);
+
if (create)
atomic_inc(px_used(ppgtt->pd)); /* never remove */
else
@@ -860,6 +862,8 @@ static int gen8_ppgtt_notify_vgt(struct i915_ppgtt *ppgtt, bool create)
I915_WRITE(vgtif_reg(g2v_notify), msg);
+ mutex_unlock(&dev_priv->vgpu.lock);
+
return 0;
}
diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index bf2b837..7493544 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -94,6 +94,7 @@ void i915_detect_vgpu(struct drm_i915_private *dev_priv)
dev_priv->vgpu.caps = readl(shared_area + vgtif_offset(vgt_caps));
dev_priv->vgpu.active = true;
+ mutex_init(&dev_priv->vgpu.lock);
DRM_INFO("Virtual GPU for Intel GVT-g detected.\n");
out:
--
2.7.4
From: Johannes Berg <johannes.berg(a)intel.com>
commit cfb21b11b891b08b79be07be57c40a85bb926668 upstream.
On older NICs, we occasionally see issues with A-MSDU support,
where the commands in the FIFO get confused and then we see an
assert EDC because the next command in the FIFO isn't TX.
We've tried to isolate this issue and understand where it comes
from, but haven't found any errors in building the A-MSDU in
software.
At least for now, disable A-MSDU support on older hardware so
that users can use it again without fearing the assert.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=203315.
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Luca Coelho <luciano.coelho(a)intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 964c7baabede..3905770b8a1f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -474,7 +474,19 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
ieee80211_hw_set(hw, STA_MMPDU_TXQ);
- ieee80211_hw_set(hw, TX_AMSDU);
+ /*
+ * On older devices, enabling TX A-MSDU occasionally leads to
+ * something getting messed up, the command read from the FIFO
+ * gets out of sync and isn't a TX command, so that we have an
+ * assert EDC.
+ *
+ * It's not clear where the bug is, but since we didn't used to
+ * support A-MSDU until moving the mac80211 iTXQs, just leave it
+ * for older devices. We also don't see this issue on any newer
+ * devices.
+ */
+ if (mvm->cfg->device_family >= IWL_DEVICE_FAMILY_9000)
+ ieee80211_hw_set(hw, TX_AMSDU);
ieee80211_hw_set(hw, TX_FRAG_LIST);
if (iwl_mvm_has_tlc_offload(mvm)) {
--
2.23.0.rc1
From: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Subject: mm/kasan: fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y
The code like this:
ptr = kmalloc(size, GFP_KERNEL);
page = virt_to_page(ptr);
offset = offset_in_page(ptr);
kfree(page_address(page) + offset);
may produce false-positive invalid-free reports on the kernel with
CONFIG_KASAN_SW_TAGS=y.
In the example above we lose the original tag assigned to 'ptr', so
kfree() gets the pointer with 0xFF tag. In kfree() we check that 0xFF tag
is different from the tag in shadow hence print false report.
Instead of just comparing tags, do the following:
1) Check that shadow doesn't contain KASAN_TAG_INVALID. Otherwise it's
double-free and it doesn't matter what tag the pointer have.
2) If pointer tag is different from 0xFF, make sure that tag in the
shadow is the same as in the pointer.
Link: http://lkml.kernel.org/r/20190819172540.19581-1-aryabinin@virtuozzo.com
Fixes: 7f94ffbc4c6a ("kasan: add hooks implementation for tag-based mode")
Signed-off-by: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Reported-by: Walter Wu <walter-zh.wu(a)mediatek.com>
Reported-by: Mark Rutland <mark.rutland(a)arm.com>
Reviewed-by: Andrey Konovalov <andreyknvl(a)google.com>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Will Deacon <will.deacon(a)arm.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/kasan/common.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/mm/kasan/common.c~mm-kasan-fix-false-positive-invalid-free-reports-with-config_kasan_sw_tags=y
+++ a/mm/kasan/common.c
@@ -407,8 +407,14 @@ static inline bool shadow_invalid(u8 tag
if (IS_ENABLED(CONFIG_KASAN_GENERIC))
return shadow_byte < 0 ||
shadow_byte >= KASAN_SHADOW_SCALE_SIZE;
- else
- return tag != (u8)shadow_byte;
+
+ /* else CONFIG_KASAN_SW_TAGS: */
+ if ((u8)shadow_byte == KASAN_TAG_INVALID)
+ return true;
+ if ((tag != KASAN_TAG_KERNEL) && (tag != (u8)shadow_byte))
+ return true;
+
+ return false;
}
static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
_