The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 8434ffe71c874b9c4e184b88d25de98c2bf5fe3f Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton(a)kernel.org>
Date: Tue, 3 Aug 2021 12:47:34 -0400
Subject: [PATCH] ceph: take snap_empty_lock atomically with snaprealm refcount
change
There is a race in ceph_put_snap_realm. The change to the nref and the
spinlock acquisition are not done atomically, so you could decrement
nref, and before you take the spinlock, the nref is incremented again.
At that point, you end up putting it on the empty list when it
shouldn't be there. Eventually __cleanup_empty_realms runs and frees
it when it's still in-use.
Fix this by protecting the 1->0 transition with atomic_dec_and_lock,
and just drop the spinlock if we can get the rwsem.
Because these objects can also undergo a 0->1 refcount transition, we
must protect that change as well with the spinlock. Increment locklessly
unless the value is at 0, in which case we take the spinlock, increment
and then take it off the empty list if it did the 0->1 transition.
With these changes, I'm removing the dout() messages from these
functions, as well as in __put_snap_realm. They've always been racy, and
it's better to not print values that may be misleading.
Cc: stable(a)vger.kernel.org
URL: https://tracker.ceph.com/issues/46419
Reported-by: Mark Nelson <mnelson(a)redhat.com>
Signed-off-by: Jeff Layton <jlayton(a)kernel.org>
Reviewed-by: Luis Henriques <lhenriques(a)suse.de>
Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com>
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 4ac0606dcbd4..4c6bd1042c94 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -67,19 +67,19 @@ void ceph_get_snap_realm(struct ceph_mds_client *mdsc,
{
lockdep_assert_held(&mdsc->snap_rwsem);
- dout("get_realm %p %d -> %d\n", realm,
- atomic_read(&realm->nref), atomic_read(&realm->nref)+1);
/*
- * since we _only_ increment realm refs or empty the empty
- * list with snap_rwsem held, adjusting the empty list here is
- * safe. we do need to protect against concurrent empty list
- * additions, however.
+ * The 0->1 and 1->0 transitions must take the snap_empty_lock
+ * atomically with the refcount change. Go ahead and bump the
+ * nref here, unless it's 0, in which case we take the spinlock
+ * and then do the increment and remove it from the list.
*/
- if (atomic_inc_return(&realm->nref) == 1) {
- spin_lock(&mdsc->snap_empty_lock);
+ if (atomic_inc_not_zero(&realm->nref))
+ return;
+
+ spin_lock(&mdsc->snap_empty_lock);
+ if (atomic_inc_return(&realm->nref) == 1)
list_del_init(&realm->empty_item);
- spin_unlock(&mdsc->snap_empty_lock);
- }
+ spin_unlock(&mdsc->snap_empty_lock);
}
static void __insert_snap_realm(struct rb_root *root,
@@ -208,28 +208,28 @@ static void __put_snap_realm(struct ceph_mds_client *mdsc,
{
lockdep_assert_held_write(&mdsc->snap_rwsem);
- dout("__put_snap_realm %llx %p %d -> %d\n", realm->ino, realm,
- atomic_read(&realm->nref), atomic_read(&realm->nref)-1);
+ /*
+ * We do not require the snap_empty_lock here, as any caller that
+ * increments the value must hold the snap_rwsem.
+ */
if (atomic_dec_and_test(&realm->nref))
__destroy_snap_realm(mdsc, realm);
}
/*
- * caller needn't hold any locks
+ * See comments in ceph_get_snap_realm. Caller needn't hold any locks.
*/
void ceph_put_snap_realm(struct ceph_mds_client *mdsc,
struct ceph_snap_realm *realm)
{
- dout("put_snap_realm %llx %p %d -> %d\n", realm->ino, realm,
- atomic_read(&realm->nref), atomic_read(&realm->nref)-1);
- if (!atomic_dec_and_test(&realm->nref))
+ if (!atomic_dec_and_lock(&realm->nref, &mdsc->snap_empty_lock))
return;
if (down_write_trylock(&mdsc->snap_rwsem)) {
+ spin_unlock(&mdsc->snap_empty_lock);
__destroy_snap_realm(mdsc, realm);
up_write(&mdsc->snap_rwsem);
} else {
- spin_lock(&mdsc->snap_empty_lock);
list_add(&realm->empty_item, &mdsc->snap_empty);
spin_unlock(&mdsc->snap_empty_lock);
}
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 84edec86f449adea9ee0b4912a79ab8d9d65abb7 Mon Sep 17 00:00:00 2001
From: Chris Lesiak <chris.lesiak(a)licor.com>
Date: Mon, 14 Jun 2021 09:18:20 -0500
Subject: [PATCH] iio: humidity: hdc100x: Add margin to the conversion time
The datasheets have the following note for the conversion time
specification: "This parameter is specified by design and/or
characterization and it is not tested in production."
Parts have been seen that require more time to do 14-bit conversions for
the relative humidity channel. The result is ENXIO due to the address
phase of a transfer not getting an ACK.
Delay an additional 1 ms per conversion to allow for additional margin.
Fixes: 4839367d99e3 ("iio: humidity: add HDC100x support")
Signed-off-by: Chris Lesiak <chris.lesiak(a)licor.com>
Acked-by: Matt Ranostay <matt.ranostay(a)konsulko.com>
Link: https://lore.kernel.org/r/20210614141820.2034827-1-chris.lesiak@licor.com
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
index 2a957f19048e..9e0fce917ce4 100644
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -25,6 +25,8 @@
#include <linux/iio/trigger_consumer.h>
#include <linux/iio/triggered_buffer.h>
+#include <linux/time.h>
+
#define HDC100X_REG_TEMP 0x00
#define HDC100X_REG_HUMIDITY 0x01
@@ -166,7 +168,7 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
struct iio_chan_spec const *chan)
{
struct i2c_client *client = data->client;
- int delay = data->adc_int_us[chan->address];
+ int delay = data->adc_int_us[chan->address] + 1*USEC_PER_MSEC;
int ret;
__be16 val;
@@ -316,7 +318,7 @@ static irqreturn_t hdc100x_trigger_handler(int irq, void *p)
struct iio_dev *indio_dev = pf->indio_dev;
struct hdc100x_data *data = iio_priv(indio_dev);
struct i2c_client *client = data->client;
- int delay = data->adc_int_us[0] + data->adc_int_us[1];
+ int delay = data->adc_int_us[0] + data->adc_int_us[1] + 2*USEC_PER_MSEC;
int ret;
/* dual read starts at temp register */
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 84edec86f449adea9ee0b4912a79ab8d9d65abb7 Mon Sep 17 00:00:00 2001
From: Chris Lesiak <chris.lesiak(a)licor.com>
Date: Mon, 14 Jun 2021 09:18:20 -0500
Subject: [PATCH] iio: humidity: hdc100x: Add margin to the conversion time
The datasheets have the following note for the conversion time
specification: "This parameter is specified by design and/or
characterization and it is not tested in production."
Parts have been seen that require more time to do 14-bit conversions for
the relative humidity channel. The result is ENXIO due to the address
phase of a transfer not getting an ACK.
Delay an additional 1 ms per conversion to allow for additional margin.
Fixes: 4839367d99e3 ("iio: humidity: add HDC100x support")
Signed-off-by: Chris Lesiak <chris.lesiak(a)licor.com>
Acked-by: Matt Ranostay <matt.ranostay(a)konsulko.com>
Link: https://lore.kernel.org/r/20210614141820.2034827-1-chris.lesiak@licor.com
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
index 2a957f19048e..9e0fce917ce4 100644
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -25,6 +25,8 @@
#include <linux/iio/trigger_consumer.h>
#include <linux/iio/triggered_buffer.h>
+#include <linux/time.h>
+
#define HDC100X_REG_TEMP 0x00
#define HDC100X_REG_HUMIDITY 0x01
@@ -166,7 +168,7 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
struct iio_chan_spec const *chan)
{
struct i2c_client *client = data->client;
- int delay = data->adc_int_us[chan->address];
+ int delay = data->adc_int_us[chan->address] + 1*USEC_PER_MSEC;
int ret;
__be16 val;
@@ -316,7 +318,7 @@ static irqreturn_t hdc100x_trigger_handler(int irq, void *p)
struct iio_dev *indio_dev = pf->indio_dev;
struct hdc100x_data *data = iio_priv(indio_dev);
struct i2c_client *client = data->client;
- int delay = data->adc_int_us[0] + data->adc_int_us[1];
+ int delay = data->adc_int_us[0] + data->adc_int_us[1] + 2*USEC_PER_MSEC;
int ret;
/* dual read starts at temp register */
I'm announcing the release of the 5.13.11 kernel.
All users of the 5.13 kernel series must upgrade.
The updated 5.13.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.13.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/firmware/broadcom/tee_bnxt_fw.c | 14 ++++++++--
drivers/net/ppp/ppp_generic.c | 19 +++++++++++---
fs/namespace.c | 42 +++++++++++++++++++++-----------
include/linux/security.h | 1
kernel/trace/bpf_trace.c | 5 ++-
security/security.c | 1
sound/core/pcm_native.c | 5 +++
sound/pci/hda/patch_realtek.c | 2 +
9 files changed, 66 insertions(+), 25 deletions(-)
Allen Pais (1):
firmware: tee_bnxt: Release TEE shm, session, and context during kexec
Daniel Borkmann (1):
bpf: Add lockdown check for probe_write_user helper
Greg Kroah-Hartman (1):
Linux 5.13.11
Jeremy Szu (1):
ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC
Luke D Jones (1):
ALSA: hda: Add quirk for ASUS Flow x13
Miklos Szeredi (1):
ovl: prevent private clone if bind mount is not allowed
Pali Rohár (1):
ppp: Fix generating ppp unit id when ifname is not specified
Takashi Iwai (1):
ALSA: pcm: Fix mmap breakage without explicit buffer setup
I'm announcing the release of the 5.10.59 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi | 4 -
arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 6 +
arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 15 ++++
arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 15 ++++
arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 15 ++++
arch/x86/kvm/svm/sev.c | 2
drivers/firmware/broadcom/tee_bnxt_fw.c | 14 ++-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 5 -
drivers/net/ppp/ppp_generic.c | 19 ++++-
drivers/tee/optee/call.c | 2
drivers/tee/optee/core.c | 3
drivers/tee/optee/rpc.c | 5 -
drivers/tee/optee/shm_pool.c | 8 +-
drivers/tee/tee_shm.c | 4 -
drivers/usb/host/ehci-pci.c | 3
fs/namespace.c | 42 +++++++----
fs/vboxsf/dir.c | 28 ++++---
include/linux/mmzone.h | 4 -
include/linux/security.h | 1
include/linux/tee_drv.h | 1
kernel/trace/bpf_trace.c | 5 -
security/security.c | 1
sound/core/pcm_native.c | 5 +
sound/pci/hda/patch_realtek.c | 2
tools/testing/selftests/resctrl/resctrl.h | 6 -
tools/testing/selftests/resctrl/resctrlfs.c | 52 ++------------
27 files changed, 169 insertions(+), 100 deletions(-)
Adam Ford (3):
arm64: dts: renesas: rzg2: Add usb2_clksel to RZ/G2 M/N/H
arm64: dts: renesas: beacon: Fix USB extal reference
arm64: dts: renesas: beacon: Fix USB ref clock references
Allen Pais (1):
firmware: tee_bnxt: Release TEE shm, session, and context during kexec
Daniel Borkmann (1):
bpf: Add lockdown check for probe_write_user helper
Greg Kroah-Hartman (1):
Linux 5.10.59
Hans de Goede (2):
vboxsf: Honor excl flag to the dir-inode create op
vboxsf: Make vboxsf_dir_create() return the handle for the created file
Jeremy Szu (1):
ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC
Longfang Liu (1):
USB:ehci:fix Kunpeng920 ehci hardware problem
Luke D Jones (1):
ALSA: hda: Add quirk for ASUS Flow x13
Mike Rapoport (1):
mm: make zone_to_nid() and zone_set_nid() available for DISCONTIGMEM
Miklos Szeredi (1):
ovl: prevent private clone if bind mount is not allowed
Pali Rohár (1):
ppp: Fix generating ppp unit id when ifname is not specified
Reinette Chatre (1):
Revert "selftests/resctrl: Use resctrl/info for feature detection"
Sean Christopherson (1):
KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB
Sumit Garg (1):
tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag
Takashi Iwai (1):
ALSA: pcm: Fix mmap breakage without explicit buffer setup
YueHaibing (1):
net: xilinx_emaclite: Do not print real IOMEM pointer
I'm announcing the release of the 5.4.141 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/virt/kvm/mmu.txt | 4
Makefile | 2
arch/x86/kvm/paging_tmpl.h | 14 -
arch/x86/kvm/svm.c | 2
drivers/media/v4l2-core/v4l2-mem2mem.c | 6
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 5
drivers/net/ppp/ppp_generic.c | 19 +
drivers/tee/optee/call.c | 2
drivers/tee/optee/core.c | 3
drivers/tee/optee/rpc.c | 5
drivers/tee/optee/shm_pool.c | 8
drivers/tee/tee_shm.c | 4
drivers/usb/dwc3/ep0.c | 2
drivers/usb/dwc3/gadget.c | 118 +++++++--
drivers/usb/host/ehci-pci.c | 3
fs/btrfs/ctree.h | 13 -
fs/btrfs/delalloc-space.c | 2
fs/btrfs/delayed-inode.c | 3
fs/btrfs/disk-io.c | 4
fs/btrfs/file.c | 7
fs/btrfs/inode.c | 2
fs/btrfs/qgroup.c | 328 +++++++++++++++++++-------
fs/btrfs/qgroup.h | 5
fs/btrfs/transaction.c | 16 -
fs/btrfs/transaction.h | 15 -
fs/namespace.c | 42 ++-
include/linux/tee_drv.h | 1
kernel/trace/trace_events_hist.c | 20 +
sound/pci/hda/patch_realtek.c | 1
29 files changed, 467 insertions(+), 189 deletions(-)
Alexandre Courbot (1):
media: v4l2-mem2mem: always consider OUTPUT queue during poll
Filipe Manana (1):
btrfs: fix lockdep splat when enabling and disabling qgroups
Greg Kroah-Hartman (1):
Linux 5.4.141
Lai Jiangshan (1):
KVM: X86: MMU: Use the correct inherited permissions to get shadow page
Longfang Liu (1):
USB:ehci:fix Kunpeng920 ehci hardware problem
Luke D Jones (1):
ALSA: hda: Add quirk for ASUS Flow x13
Masami Hiramatsu (1):
tracing: Reject string operand in the histogram expression
Miklos Szeredi (1):
ovl: prevent private clone if bind mount is not allowed
Nikolay Borisov (4):
btrfs: make qgroup_free_reserved_data take btrfs_inode
btrfs: make btrfs_qgroup_reserve_data take btrfs_inode
btrfs: export and rename qgroup_reserve_meta
btrfs: don't flush from btrfs_delayed_inode_reserve_metadata
Pali Rohár (1):
ppp: Fix generating ppp unit id when ifname is not specified
Qu Wenruo (5):
btrfs: qgroup: allow to unreserve range without releasing other ranges
btrfs: qgroup: try to flush qgroup space when we get -EDQUOT
btrfs: transaction: Cleanup unused TRANS_STATE_BLOCKED
btrfs: qgroup: remove ASYNC_COMMIT mechanism in favor of reserve retry-after-EDQUOT
btrfs: qgroup: don't commit transaction when we already hold the handle
Sean Christopherson (1):
KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB
Sumit Garg (1):
tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag
Wesley Cheng (7):
usb: dwc3: Stop active transfers before halting the controller
usb: dwc3: gadget: Allow runtime suspend if UDC unbinded
usb: dwc3: gadget: Restart DWC3 gadget when enabling pullup
usb: dwc3: gadget: Prevent EP queuing while stopping transfers
usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable
usb: dwc3: gadget: Disable gadget IRQ during pullup disable
usb: dwc3: gadget: Avoid runtime resume if disabling pullup
YueHaibing (1):
net: xilinx_emaclite: Do not print real IOMEM pointer
I'm announcing the release of the 4.19.204 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/virtual/kvm/mmu.txt | 4 -
Makefile | 2
arch/x86/kvm/paging_tmpl.h | 14 +++--
arch/x86/kvm/svm.c | 2
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 5 -
drivers/net/ppp/ppp_generic.c | 19 +++++--
drivers/usb/host/ehci-pci.c | 3 +
fs/namespace.c | 42 ++++++++++------
kernel/bpf/verifier.c | 68 ++++++++++++++++++++++----
kernel/trace/trace_events_hist.c | 14 +++++
tools/testing/selftests/bpf/test_verifier.c | 2
11 files changed, 137 insertions(+), 38 deletions(-)
Daniel Borkmann (4):
bpf: Inherit expanded/patched seen count from old aux data
bpf: Do not mark insn as seen under speculative path verification
bpf: Fix leakage under speculation on mispredicted branches
bpf, selftests: Adjust few selftest outcomes wrt unreachable code
Greg Kroah-Hartman (1):
Linux 4.19.204
Lai Jiangshan (1):
KVM: X86: MMU: Use the correct inherited permissions to get shadow page
Longfang Liu (1):
USB:ehci:fix Kunpeng920 ehci hardware problem
Masami Hiramatsu (1):
tracing: Reject string operand in the histogram expression
Miklos Szeredi (1):
ovl: prevent private clone if bind mount is not allowed
Pali Rohár (1):
ppp: Fix generating ppp unit id when ifname is not specified
Sean Christopherson (1):
KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB
YueHaibing (1):
net: xilinx_emaclite: Do not print real IOMEM pointer