When encoder validation of a display mode fails, retry with less bandwidth
heavy YCbCr420 color mode, if available. This enables some HDMI 1.4 setups
to support 4k60Hz output, which previously failed silently.
AMDGPU had nearly the exact same issue. This problem description is
therefore copied from my commit message of the AMDGPU patch.
On some setups, while the monitor and the gpu support display modes with
pixel clocks of up to 600MHz, the link encoder might not. This prevents
YCbCr444 and RGB encoding for 4k60Hz, but YCbCr420 encoding might still be
possible. However, which color mode is used is decided before the link
encoder capabilities are checked. This patch fixes the problem by retrying
to find a display mode with YCbCr420 enforced and using it, if it is
valid.
I'm not entierly sure if the second
"if (HAS_PCH_SPLIT(dev_priv) && !HAS_DDI(dev_priv))" check in
intel_hdmi_compute_config(...) after forcing ycbcr420 is necessary. I
included it to better be safe then sorry.
Signed-off-by: Werner Sembach <wse(a)tuxedocomputers.com>
Cc: <stable(a)vger.kernel.org>
---
Rebased from 5.12 to drm-tip and resend to resolve merge conflict.
>From 876c1c8d970ff2a411ee8d08651bd4edbe9ecb3d Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse(a)tuxedocomputers.com>
Date: Thu, 29 Apr 2021 13:59:30 +0200
Subject: [PATCH] Retry using YCbCr420 encoding if clock setup for RGB fails
---
drivers/gpu/drm/i915/display/intel_hdmi.c | 80 +++++++++++++++++------
1 file changed, 60 insertions(+), 20 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.c b/drivers/gpu/drm/i915/display/intel_hdmi.c
index 46de56af33db..c9b5a7d7f9c6 100644
--- a/drivers/gpu/drm/i915/display/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/display/intel_hdmi.c
@@ -1861,6 +1861,30 @@ static int intel_hdmi_port_clock(int clock, int bpc)
return clock * bpc / 8;
}
+static enum drm_mode_status
+intel_hdmi_check_bpc(struct intel_hdmi *hdmi, int clock, bool has_hdmi_sink, struct drm_i915_private *dev_priv)
+{
+ enum drm_mode_status status;
+
+ /* check if we can do 8bpc */
+ status = hdmi_port_clock_valid(hdmi, intel_hdmi_port_clock(clock, 8),
+ true, has_hdmi_sink);
+
+ if (has_hdmi_sink) {
+ /* if we can't do 8bpc we may still be able to do 12bpc */
+ if (status != MODE_OK && !HAS_GMCH(dev_priv))
+ status = hdmi_port_clock_valid(hdmi, intel_hdmi_port_clock(clock, 12),
+ true, has_hdmi_sink);
+
+ /* if we can't do 8,12bpc we may still be able to do 10bpc */
+ if (status != MODE_OK && DISPLAY_VER(dev_priv) >= 11)
+ status = hdmi_port_clock_valid(hdmi, intel_hdmi_port_clock(clock, 10),
+ true, has_hdmi_sink);
+ }
+
+ return status;
+}
+
static enum drm_mode_status
intel_hdmi_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
@@ -1891,23 +1915,18 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
if (drm_mode_is_420_only(&connector->display_info, mode))
clock /= 2;
- /* check if we can do 8bpc */
- status = hdmi_port_clock_valid(hdmi, intel_hdmi_port_clock(clock, 8),
- true, has_hdmi_sink);
+ status = intel_hdmi_check_bpc(hdmi, clock, has_hdmi_sink, dev_priv);
- if (has_hdmi_sink) {
- /* if we can't do 8bpc we may still be able to do 12bpc */
- if (status != MODE_OK && !HAS_GMCH(dev_priv))
- status = hdmi_port_clock_valid(hdmi, intel_hdmi_port_clock(clock, 12),
- true, has_hdmi_sink);
+ if (status != MODE_OK) {
+ if (drm_mode_is_420_also(&connector->display_info, mode)) {
+ /* if we can't do full color resolution we may still be able to do reduced color resolution */
+ clock /= 2;
- /* if we can't do 8,12bpc we may still be able to do 10bpc */
- if (status != MODE_OK && DISPLAY_VER(dev_priv) >= 11)
- status = hdmi_port_clock_valid(hdmi, intel_hdmi_port_clock(clock, 10),
- true, has_hdmi_sink);
+ status = intel_hdmi_check_bpc(hdmi, clock, has_hdmi_sink, dev_priv);
+ }
+ if (status != MODE_OK)
+ return status;
}
- if (status != MODE_OK)
- return status;
return intel_mode_valid_max_plane_size(dev_priv, mode, false);
}
@@ -1990,14 +2009,17 @@ static bool hdmi_deep_color_possible(const struct intel_crtc_state *crtc_state,
static int
intel_hdmi_ycbcr420_config(struct intel_crtc_state *crtc_state,
- const struct drm_connector_state *conn_state)
+ const struct drm_connector_state *conn_state,
+ const bool force_ycbcr420)
{
struct drm_connector *connector = conn_state->connector;
struct drm_i915_private *i915 = to_i915(connector->dev);
const struct drm_display_mode *adjusted_mode =
&crtc_state->hw.adjusted_mode;
- if (!drm_mode_is_420_only(&connector->display_info, adjusted_mode))
+ if (!(drm_mode_is_420_only(&connector->display_info, adjusted_mode) ||
+ (force_ycbcr420 &&
+ drm_mode_is_420_also(&connector->display_info, adjusted_mode))))
return 0;
if (!connector->ycbcr_420_allowed) {
@@ -2126,7 +2148,7 @@ int intel_hdmi_compute_config(struct intel_encoder *encoder,
struct drm_display_mode *adjusted_mode = &pipe_config->hw.adjusted_mode;
struct drm_connector *connector = conn_state->connector;
struct drm_scdc *scdc = &connector->display_info.hdmi.scdc;
- int ret;
+ int ret, ret_saved;
if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
return -EINVAL;
@@ -2141,7 +2163,7 @@ int intel_hdmi_compute_config(struct intel_encoder *encoder,
if (adjusted_mode->flags & DRM_MODE_FLAG_DBLCLK)
pipe_config->pixel_multiplier = 2;
- ret = intel_hdmi_ycbcr420_config(pipe_config, conn_state);
+ ret = intel_hdmi_ycbcr420_config(pipe_config, conn_state, false);
if (ret)
return ret;
@@ -2155,8 +2177,26 @@ int intel_hdmi_compute_config(struct intel_encoder *encoder,
intel_hdmi_has_audio(encoder, pipe_config, conn_state);
ret = intel_hdmi_compute_clock(encoder, pipe_config);
- if (ret)
- return ret;
+ if (ret) {
+ ret_saved = ret;
+
+ ret = intel_hdmi_ycbcr420_config(pipe_config, conn_state, true);
+ if (ret)
+ return ret;
+
+ if (pipe_config->output_format != INTEL_OUTPUT_FORMAT_YCBCR420)
+ return ret_saved;
+
+ pipe_config->limited_color_range =
+ intel_hdmi_limited_color_range(pipe_config, conn_state);
+
+ if (HAS_PCH_SPLIT(dev_priv) && !HAS_DDI(dev_priv))
+ pipe_config->has_pch_encoder = true;
+
+ ret = intel_hdmi_compute_clock(encoder, pipe_config);
+ if (ret)
+ return ret;
+ }
if (conn_state->picture_aspect_ratio)
adjusted_mode->picture_aspect_ratio =
--
2.25.1
This reverts commit 1d84353d205a953e2381044953b7fa31c8c9702d.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
The original commit here, while technically correct, did not fully
handle all of the reported issues that the commit stated it was fixing,
so revert it until it can be "fixed" fully.
Note, ioremap() probably will never fail for old hardware like this, and
if anyone actually used this hardware (a PowerMac era PCI display card),
they would not be using fbdev anymore.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: Aditya Pakki <pakki001(a)umn.edu>
Cc: Finn Thain <fthain(a)telegraphics.com.au>
Cc: Rob Herring <robh(a)kernel.org>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie(a)samsung.com>
Fixes: 1d84353d205a ("video: imsttfb: fix potential NULL pointer dereferences")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/video/fbdev/imsttfb.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 3ac053b88495..e04411701ec8 100644
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1512,11 +1512,6 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
info->fix.smem_start = addr;
info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
0x400000 : 0x800000);
- if (!info->screen_base) {
- release_mem_region(addr, size);
- framebuffer_release(info);
- return -ENOMEM;
- }
info->fix.mmio_start = addr + 0x800000;
par->dc_regs = ioremap(addr + 0x800000, 0x1000);
par->cmap_regs_phys = addr + 0x840000;
--
2.31.1
This reverts commit 2c2a7552dd6465e8fde6bc9cccf8d66ed1c1eb72.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
The original commit log for this change was incorrect, no "error
handling code" was added, things will blow up just as badly as before if
any of these cases ever were true. As this BUG_ON() never fired, and
most of these checks are "obviously" never going to be true, let's just
revert to the original code for now until this gets unwound to be done
correctly in the future.
Cc: Aditya Pakki <pakki001(a)umn.edu>
Fixes: 2c2a7552dd64 ("ecryptfs: replace BUG_ON with error handling code")
Cc: stable <stable(a)vger.kernel.org>
Acked-by: Tyler Hicks <code(a)tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/ecryptfs/crypto.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 943e523f4c9d..3d8623139538 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -296,10 +296,8 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
struct extent_crypt_result ecr;
int rc = 0;
- if (!crypt_stat || !crypt_stat->tfm
- || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
- return -EINVAL;
-
+ BUG_ON(!crypt_stat || !crypt_stat->tfm
+ || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED));
if (unlikely(ecryptfs_verbosity > 0)) {
ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n",
crypt_stat->key_size);
--
2.31.1
This reverts commit 23015b22e47c5409620b1726a677d69e5cd032ba.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
The original commit has a memory leak on the error path here, it does
not clean up everything properly.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: Alexandre Bounine <alex.bou9(a)gmail.com>
Cc: Matt Porter <mporter(a)kernel.crashing.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Fixes: 23015b22e47c ("rapidio: fix a NULL pointer dereference when create_workqueue() fails")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/rapidio/rio_cm.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
index 50ec53d67a4c..e6c16f04f2b4 100644
--- a/drivers/rapidio/rio_cm.c
+++ b/drivers/rapidio/rio_cm.c
@@ -2138,14 +2138,6 @@ static int riocm_add_mport(struct device *dev,
mutex_init(&cm->rx_lock);
riocm_rx_fill(cm, RIOCM_RX_RING_SIZE);
cm->rx_wq = create_workqueue(DRV_NAME "/rxq");
- if (!cm->rx_wq) {
- riocm_error("failed to allocate IBMBOX_%d on %s",
- cmbox, mport->name);
- rio_release_outb_mbox(mport, cmbox);
- kfree(cm);
- return -ENOMEM;
- }
-
INIT_WORK(&cm->rx_work, rio_ibmsg_handler);
cm->tx_slot = 0;
--
2.31.1
This reverts commit ec7f6aad57ad29e4e66cc2e18e1e1599ddb02542.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
This patch "looks" correct, but the driver keeps on running and will
fail horribly right afterward if this error condition ever trips.
So points for trying to resolve an issue, but a huge NEGATIVE value for
providing a "fake" fix for the problem as nothing actually got resolved
at all. I'll go fix this up properly...
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: Aditya Pakki <pakki001(a)umn.edu>
Cc: Ferenc Bakonyi <fero(a)drama.obuda.kando.hu>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie(a)samsung.com>
Fixes: ec7f6aad57ad ("video: hgafb: fix potential NULL pointer dereference")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/video/fbdev/hgafb.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c
index 8bbac7182ad3..fca29f219f8b 100644
--- a/drivers/video/fbdev/hgafb.c
+++ b/drivers/video/fbdev/hgafb.c
@@ -285,8 +285,6 @@ static int hga_card_detect(void)
hga_vram_len = 0x08000;
hga_vram = ioremap(0xb0000, hga_vram_len);
- if (!hga_vram)
- goto error;
if (request_region(0x3b0, 12, "hgafb"))
release_io_ports = 1;
--
2.31.1
This reverts commit dcd0feac9bab901d5739de51b3f69840851f8919.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
The original commit message for this change was incorrect as the code
path can never result in a NULL dereference, alluding to the fact that
whatever tool was used to "find this" is broken. It's just an optional
resource reservation, so removing this check is fine.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Acked-by: Takashi Iwai <tiwai(a)suse.de>
Fixes: dcd0feac9bab ("ALSA: sb8: add a check for request_region")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
sound/isa/sb/sb8.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
index 6c9d534ce8b6..95290ffe5c6e 100644
--- a/sound/isa/sb/sb8.c
+++ b/sound/isa/sb/sb8.c
@@ -95,10 +95,6 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev)
/* block the 0x388 port to avoid PnP conflicts */
acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
- if (!acard->fm_res) {
- err = -EBUSY;
- goto _err;
- }
if (port[dev] != SNDRV_AUTO_PORT) {
if ((err = snd_sbdsp_create(card, port[dev], irq[dev],
--
2.31.1
From: Phillip Potter <phil(a)philpotter.co.uk>
Move ufshcd_set_variant call in ufs_hisi_init_common to common error
section at end of the function, and then jump to this from the error
checking statements for both devm_reset_control_get and
ufs_hisi_get_resource. This fixes the original commit (63a06181d7ce)
which was reverted due to the University of Minnesota problems.
Suggested-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Avri Altman <avri.altman(a)wdc.com>
Cc: Martin K. Petersen <martin.petersen(a)oracle.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Phillip Potter <phil(a)philpotter.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/scsi/ufs/ufs-hisi.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
index 7d1e07a9d9dd..d0626773eb38 100644
--- a/drivers/scsi/ufs/ufs-hisi.c
+++ b/drivers/scsi/ufs/ufs-hisi.c
@@ -467,17 +467,24 @@ static int ufs_hisi_init_common(struct ufs_hba *hba)
host->hba = hba;
ufshcd_set_variant(hba, host);
- host->rst = devm_reset_control_get(dev, "rst");
+ host->rst = devm_reset_control_get(dev, "rst");
+ if (IS_ERR(host->rst)) {
+ dev_err(dev, "%s: failed to get reset control\n", __func__);
+ err = PTR_ERR(host->rst);
+ goto error;
+ }
ufs_hisi_set_pm_lvl(hba);
err = ufs_hisi_get_resource(host);
- if (err) {
- ufshcd_set_variant(hba, NULL);
- return err;
- }
+ if (err)
+ goto error;
return 0;
+
+error:
+ ufshcd_set_variant(hba, NULL);
+ return err;
}
static int ufs_hi3660_init(struct ufs_hba *hba)
--
2.31.1
This reverts commit 63a06181d7ce169d09843645c50fea1901bc9f0a.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
The original commit is incorrect, it does not properly clean up on the
error path, so I'll keep the revert and fix it up properly with a
follow-on patch.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: Avri Altman <avri.altman(a)wdc.com>
Cc: Martin K. Petersen <martin.petersen(a)oracle.com>
Fixes: 63a06181d7ce ("scsi: ufs: fix a missing check of devm_reset_control_get")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/scsi/ufs/ufs-hisi.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
index 0aa58131e791..7d1e07a9d9dd 100644
--- a/drivers/scsi/ufs/ufs-hisi.c
+++ b/drivers/scsi/ufs/ufs-hisi.c
@@ -468,10 +468,6 @@ static int ufs_hisi_init_common(struct ufs_hba *hba)
ufshcd_set_variant(hba, host);
host->rst = devm_reset_control_get(dev, "rst");
- if (IS_ERR(host->rst)) {
- dev_err(dev, "%s: failed to get reset control\n", __func__);
- return PTR_ERR(host->rst);
- }
ufs_hisi_set_pm_lvl(hba);
--
2.31.1
This reverts commit 093c48213ee37c3c3ff1cf5ac1aa2a9d8bc66017.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
Because of this, all submissions from this group must be reverted from
the kernel tree and will need to be re-reviewed again to determine if
they actually are a valid fix. Until that work is complete, remove this
change to ensure that no problems are being introduced into the
codebase.
Cc: Wenwen Wang <wang6495(a)umn.edu>
Cc: Peter Rosin <peda(a)axentia.se>
Cc: Jens Axboe <axboe(a)kernel.dk>
Fixes: 093c48213ee3 ("gdrom: fix a memory leak bug")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/cdrom/gdrom.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
index 742b4a0932e3..7f681320c7d3 100644
--- a/drivers/cdrom/gdrom.c
+++ b/drivers/cdrom/gdrom.c
@@ -862,7 +862,6 @@ static void __exit exit_gdrom(void)
platform_device_unregister(pd);
platform_driver_unregister(&gdrom_driver);
kfree(gd.toc);
- kfree(gd.cd_info);
}
module_init(init_gdrom);
--
2.31.1
From: Tom Seewald <tseewald(a)gmail.com>
The function qlcnic_dl_lb_test() currently calls netdev_alloc_skb()
without checking afterwards that the allocation succeeded. Fix this by
checking if the skb is NULL and returning an error in such a case.
Breaking out of the loop if the skb is NULL is not correct as no error
would be reported to the caller and no message would be printed for the
user.
Cc: David S. Miller <davem(a)davemloft.net>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Tom Seewald <tseewald(a)gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 985cf8cb2ec0..d8f0863b3934 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1047,6 +1047,8 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) {
skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE);
+ if (!skb)
+ goto error;
qlcnic_create_loopback_buff(skb->data, adapter->mac_addr);
skb_put(skb, QLCNIC_ILB_PKT_SIZE);
adapter->ahw->diag_cnt = 0;
@@ -1070,6 +1072,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
cnt++;
}
if (cnt != i) {
+error:
dev_err(&adapter->pdev->dev,
"LB Test: failed, TX[%d], RX[%d]\n", i, cnt);
if (mode != QLCNIC_ILB_MODE)
--
2.31.1
This reverts commit 5bf7295fe34a5251b1d241b9736af4697b590670.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
This commit does not properly detect if an error happens because the
logic after this loop will not detect that there was a failed
allocation.
Cc: Aditya Pakki <pakki001(a)umn.edu>
Cc: David S. Miller <davem(a)davemloft.net>
Fixes: 5bf7295fe34a ("qlcnic: Avoid potential NULL pointer dereference")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index d8a3ecaed3fc..985cf8cb2ec0 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1047,8 +1047,6 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) {
skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE);
- if (!skb)
- break;
qlcnic_create_loopback_buff(skb->data, adapter->mac_addr);
skb_put(skb, QLCNIC_ILB_PKT_SIZE);
adapter->ahw->diag_cnt = 0;
--
2.31.1
This reverts commit 26fd962bde0b15e54234fe762d86bc0349df1de4.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
The change here was incorrect. While it is nice to check if
niu_pci_eeprom_read() succeeded or not when using the data, any error
that might have happened was not propagated upwards properly, causing
the kernel to assume that these reads were successful, which results in
invalid data in the buffer that was to contain the successfully read
data.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: Shannon Nelson <shannon.lee.nelson(a)gmail.com>
Cc: David S. Miller <davem(a)davemloft.net>
Fixes: 26fd962bde0b ("niu: fix missing checks of niu_pci_eeprom_read")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/ethernet/sun/niu.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 707ccdd03b19..d70cdea756d1 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -8097,8 +8097,6 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
start += 3;
prop_len = niu_pci_eeprom_read(np, start + 4);
- if (prop_len < 0)
- return prop_len;
err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
if (err < 0)
return err;
@@ -8143,12 +8141,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
netif_printk(np, probe, KERN_DEBUG, np->dev,
"VPD_SCAN: Reading in property [%s] len[%d]\n",
namebuf, prop_len);
- for (i = 0; i < prop_len; i++) {
- err = niu_pci_eeprom_read(np, off + i);
- if (err >= 0)
- *prop_buf = err;
- ++prop_buf;
- }
+ for (i = 0; i < prop_len; i++)
+ *prop_buf++ = niu_pci_eeprom_read(np, off + i);
}
start += len;
--
2.31.1
This reverts commit f86a3b83833e7cfe558ca4d70b64ebc48903efec.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
The original commit causes a memory leak when it is trying to claim it
is properly handling errors. Revert this change and fix it up properly
in a follow-on commit.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: David S. Miller <davem(a)davemloft.net>
Fixes: f86a3b83833e ("net: stmicro: fix a missing check of clk_prepare")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index 527077c98ebc..fc68e90acbea 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -50,9 +50,7 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
gmac->clk_enabled = 1;
} else {
clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
- ret = clk_prepare(gmac->tx_clk);
- if (ret)
- return ret;
+ clk_prepare(gmac->tx_clk);
}
return 0;
--
2.31.1
This reverts commit 765976285a8c8db3f0eb7f033829a899d0c2786e.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
This commit is not correct, it should not have used unlikely() and is
not propagating the error properly to the calling function, so it should
be reverted at this point in time. Also, if the check failed, the
work queue was still assumed to be allocated, so further accesses would
have continued to fail, meaning this patch does nothing to solve the
root issues at all.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: Kalle Valo <kvalo(a)codeaurora.org>
Cc: Bryan Brattlof <hello(a)bryanbrattlof.com>
Fixes: 765976285a8c ("rtlwifi: fix a potential NULL pointer dereference")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/base.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index 2a7ee90a3f54..4136d7c63254 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -452,11 +452,6 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
/* <2> work queue */
rtlpriv->works.hw = hw;
rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
- if (unlikely(!rtlpriv->works.rtl_wq)) {
- pr_err("Failed to allocate work queue\n");
- return;
- }
-
INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
rtl_watchdog_wq_callback);
INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
--
2.31.1
This reverts commit 248b57015f35c94d4eae2fdd8c6febf5cd703900.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted. It will be fixed up "correctly" in a
later kernel change.
The original commit does not properly unwind if there is an error
condition so it needs to be reverted at this point in time.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: Jacek Anaszewski <jacek.anaszewski(a)gmail.com>
Cc: stable <stable(a)vger.kernel.org>
Fixes: 248b57015f35 ("leds: lp5523: fix a missing check of return value of lp55xx_read")
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/leds/leds-lp5523.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index fc433e63b1dc..5036d7d5f3d4 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -305,9 +305,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
/* Let the programs run for couple of ms and check the engine status */
usleep_range(3000, 6000);
- ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
- if (ret)
- return ret;
+ lp55xx_read(chip, LP5523_REG_STATUS, &status);
status &= LP5523_ENG_STATUS_MASK;
if (status != LP5523_ENG_STATUS_MASK) {
--
2.31.1
This reverts commit 32f47179833b63de72427131169809065db6745e.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, this commit was found to be not be needed at all as the
change was useless because this function can only be called when
of_match_device matched on something. So it should be reverted.
Cc: Aditya Pakki <pakki001(a)umn.edu>
Cc: stable <stable(a)vger.kernel.org>
Fixes: 32f47179833b ("serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference")
Acked-by: Jiri Slaby <jirislaby(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/mvebu-uart.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index e0c00a1b0763..51b0ecabf2ec 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -818,9 +818,6 @@ static int mvebu_uart_probe(struct platform_device *pdev)
return -EINVAL;
}
- if (!match)
- return -ENODEV;
-
/* Assume that all UART ports have a DT alias or none has */
id = of_alias_get_id(pdev->dev.of_node, "serial");
if (!pdev->dev.of_node || id < 0)
--
2.31.1
This reverts commit 9aa3aa15f4c2f74f47afd6c5db4b420fadf3f315.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, it was determined that this commit is not needed at all so
just revert it. Also, the call to lm80_init_client() was not properly
handled, so if error handling is needed in the lm80_probe() function,
then it should be done properly, not half-baked like the commit being
reverted here did.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Fixes: 9aa3aa15f4c2 ("hwmon: (lm80) fix a missing check of bus read in lm80 probe")
Cc: stable <stable(a)vger.kernel.org>
Acked-by: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/hwmon/lm80.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index ac4adb44b224..97ab491d2922 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -596,7 +596,6 @@ static int lm80_probe(struct i2c_client *client)
struct device *dev = &client->dev;
struct device *hwmon_dev;
struct lm80_data *data;
- int rv;
data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL);
if (!data)
@@ -609,14 +608,8 @@ static int lm80_probe(struct i2c_client *client)
lm80_init_client(client);
/* A few vars need to be filled upon startup */
- rv = lm80_read_value(client, LM80_REG_FAN_MIN(1));
- if (rv < 0)
- return rv;
- data->fan[f_min][0] = rv;
- rv = lm80_read_value(client, LM80_REG_FAN_MIN(2));
- if (rv < 0)
- return rv;
- data->fan[f_min][1] = rv;
+ data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1));
+ data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2));
hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
data, lm80_groups);
--
2.31.1
This reverts commit d39083234c60519724c6ed59509a2129fd2aed41.
Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.
Upon review, it was determined that this commit is not needed at all as
the media core already prevents memory disclosure on this codepath, so
just drop the extra memset happening here.
Cc: Kangjie Lu <kjlu(a)umn.edu>
Cc: Geert Uytterhoeven <geert+renesas(a)glider.be>
Cc: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Cc: Mauro Carvalho Chehab <mchehab(a)kernel.org>
Fixes: d39083234c60 ("media: rcar_drif: fix a memory disclosure")
Cc: stable <stable(a)vger.kernel.org>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
Reviewed-by: Fabrizio Castro <fabrizio.castro.jz(a)renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/media/platform/rcar_drif.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c
index 83bd9a412a56..1e3b68a8743a 100644
--- a/drivers/media/platform/rcar_drif.c
+++ b/drivers/media/platform/rcar_drif.c
@@ -915,7 +915,6 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv,
{
struct rcar_drif_sdr *sdr = video_drvdata(file);
- memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved));
f->fmt.sdr.pixelformat = sdr->fmt->pixelformat;
f->fmt.sdr.buffersize = sdr->fmt->buffersize;
--
2.31.1
In qca_power_shutdown() qcadev local variable is
initialized by hu->serdev.dev private data, but
hu->serdev can be NULL and there is a check for it.
Since, qcadev is not used before
if (!hu->serdev)
return;
we can move its initialization after this "if" to
prevent GPF.
Fixes: 5559904ccc08 ("Bluetooth: hci_qca: Add QCA Rome power off support to the qca_power_shutdown()")
Cc: stable(a)vger.kernel.org # v5.6+
Cc: Rocky Liao <rjliao(a)codeaurora.org>
Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com>
---
drivers/bluetooth/hci_qca.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index de36af63e182..9589ef6c0c26 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1820,8 +1820,6 @@ static void qca_power_shutdown(struct hci_uart *hu)
unsigned long flags;
enum qca_btsoc_type soc_type = qca_soc_type(hu);
- qcadev = serdev_device_get_drvdata(hu->serdev);
-
/* From this point we go into power off state. But serial port is
* still open, stop queueing the IBS data and flush all the buffered
* data in skb's.
@@ -1837,6 +1835,8 @@ static void qca_power_shutdown(struct hci_uart *hu)
if (!hu->serdev)
return;
+ qcadev = serdev_device_get_drvdata(hu->serdev);
+
if (qca_is_wcn399x(soc_type)) {
host_set_baudrate(hu, 2400);
qca_send_power_pulse(hu, false);
--
2.31.1
commit 4dbc6a4ef06d ("usb: typec: ucsi: save power data objects
in PD mode") introduced retrieval of the PDOs when connected to a
PD-capable source. But only the first 4 PDOs are received since
that is the maximum number that can be fetched at a time given the
MESSAGE_IN length limitation (16 bytes). However, as per the PD spec
a connected source may advertise up to a maximum of 7 PDOs.
If such a source is connected it's possible the PPM could have
negotiated a power contract with one of the PDOs at index greater
than 4, and would be reflected in the request data object's (RDO)
object position field. This would result in an out-of-bounds access
when the rdo_index() is used to index into the src_pdos array in
ucsi_psy_get_voltage_now().
With the help of the UBSAN -fsanitize=array-bounds checker enabled
this exact issue is revealed when connecting to a PD source adapter
that advertise 5 PDOs and the PPM enters a contract having selected
the 5th one.
[ 151.545106][ T70] Unexpected kernel BRK exception at EL1
[ 151.545112][ T70] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP
...
[ 151.545499][ T70] pc : ucsi_psy_get_prop+0x208/0x20c
[ 151.545507][ T70] lr : power_supply_show_property+0xc0/0x328
...
[ 151.545542][ T70] Call trace:
[ 151.545544][ T70] ucsi_psy_get_prop+0x208/0x20c
[ 151.545546][ T70] power_supply_uevent+0x1a4/0x2f0
[ 151.545550][ T70] dev_uevent+0x200/0x384
[ 151.545555][ T70] kobject_uevent_env+0x1d4/0x7e8
[ 151.545557][ T70] power_supply_changed_work+0x174/0x31c
[ 151.545562][ T70] process_one_work+0x244/0x6f0
[ 151.545564][ T70] worker_thread+0x3e0/0xa64
We can resolve this by instead retrieving and storing up to the
maximum of 7 PDOs in the con->src_pdos array. This would involve
two calls to the GET_PDOS command.
Fixes: 992a60ed0d5e ("usb: typec: ucsi: register with power_supply class")
Fixes: 4dbc6a4ef06d ("usb: typec: ucsi: save power data objects in PD mode")
Cc: stable(a)vger.kernel.org
Reported-and-tested-by: Subbaraman Narayanamurthy <subbaram(a)codeaurora.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
Signed-off-by: Jack Pham <jackp(a)codeaurora.org>
---
v2: Updated commit text with UBSAN stack trace; aligned indentation of
line-broken function parameter list; added Reported- and Reviewed-by
tags.
drivers/usb/typec/ucsi/ucsi.c | 41 +++++++++++++++++++++++++++--------
drivers/usb/typec/ucsi/ucsi.h | 6 +++--
2 files changed, 36 insertions(+), 11 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index 282c3c825c13..93b4d9da81b4 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -495,7 +495,8 @@ static void ucsi_unregister_altmodes(struct ucsi_connector *con, u8 recipient)
}
}
-static void ucsi_get_pdos(struct ucsi_connector *con, int is_partner)
+static int ucsi_get_pdos(struct ucsi_connector *con, int is_partner,
+ u32 *pdos, int offset, int num_pdos)
{
struct ucsi *ucsi = con->ucsi;
u64 command;
@@ -503,17 +504,39 @@ static void ucsi_get_pdos(struct ucsi_connector *con, int is_partner)
command = UCSI_COMMAND(UCSI_GET_PDOS) | UCSI_CONNECTOR_NUMBER(con->num);
command |= UCSI_GET_PDOS_PARTNER_PDO(is_partner);
- command |= UCSI_GET_PDOS_NUM_PDOS(UCSI_MAX_PDOS - 1);
+ command |= UCSI_GET_PDOS_PDO_OFFSET(offset);
+ command |= UCSI_GET_PDOS_NUM_PDOS(num_pdos - 1);
command |= UCSI_GET_PDOS_SRC_PDOS;
- ret = ucsi_send_command(ucsi, command, con->src_pdos,
- sizeof(con->src_pdos));
- if (ret < 0) {
+ ret = ucsi_send_command(ucsi, command, pdos + offset,
+ num_pdos * sizeof(u32));
+ if (ret < 0)
dev_err(ucsi->dev, "UCSI_GET_PDOS failed (%d)\n", ret);
+ if (ret == 0 && offset == 0)
+ dev_warn(ucsi->dev, "UCSI_GET_PDOS returned 0 bytes\n");
+
+ return ret;
+}
+
+static void ucsi_get_src_pdos(struct ucsi_connector *con, int is_partner)
+{
+ int ret;
+
+ /* UCSI max payload means only getting at most 4 PDOs at a time */
+ ret = ucsi_get_pdos(con, 1, con->src_pdos, 0, UCSI_MAX_PDOS);
+ if (ret < 0)
return;
- }
+
con->num_pdos = ret / sizeof(u32); /* number of bytes to 32-bit PDOs */
- if (ret == 0)
- dev_warn(ucsi->dev, "UCSI_GET_PDOS returned 0 bytes\n");
+ if (con->num_pdos < UCSI_MAX_PDOS)
+ return;
+
+ /* get the remaining PDOs, if any */
+ ret = ucsi_get_pdos(con, 1, con->src_pdos, UCSI_MAX_PDOS,
+ PDO_MAX_OBJECTS - UCSI_MAX_PDOS);
+ if (ret < 0)
+ return;
+
+ con->num_pdos += ret / sizeof(u32);
}
static void ucsi_pwr_opmode_change(struct ucsi_connector *con)
@@ -522,7 +545,7 @@ static void ucsi_pwr_opmode_change(struct ucsi_connector *con)
case UCSI_CONSTAT_PWR_OPMODE_PD:
con->rdo = con->status.request_data_obj;
typec_set_pwr_opmode(con->port, TYPEC_PWR_MODE_PD);
- ucsi_get_pdos(con, 1);
+ ucsi_get_src_pdos(con, 1);
break;
case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
con->rdo = 0;
diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h
index 3920e20a9e9e..cee666790907 100644
--- a/drivers/usb/typec/ucsi/ucsi.h
+++ b/drivers/usb/typec/ucsi/ucsi.h
@@ -8,6 +8,7 @@
#include <linux/power_supply.h>
#include <linux/types.h>
#include <linux/usb/typec.h>
+#include <linux/usb/pd.h>
#include <linux/usb/role.h>
/* -------------------------------------------------------------------------- */
@@ -134,7 +135,9 @@ void ucsi_connector_change(struct ucsi *ucsi, u8 num);
/* GET_PDOS command bits */
#define UCSI_GET_PDOS_PARTNER_PDO(_r_) ((u64)(_r_) << 23)
+#define UCSI_GET_PDOS_PDO_OFFSET(_r_) ((u64)(_r_) << 24)
#define UCSI_GET_PDOS_NUM_PDOS(_r_) ((u64)(_r_) << 32)
+#define UCSI_MAX_PDOS (4)
#define UCSI_GET_PDOS_SRC_PDOS ((u64)1 << 34)
/* -------------------------------------------------------------------------- */
@@ -302,7 +305,6 @@ struct ucsi {
#define UCSI_MAX_SVID 5
#define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6)
-#define UCSI_MAX_PDOS (4)
#define UCSI_TYPEC_VSAFE5V 5000
#define UCSI_TYPEC_1_5_CURRENT 1500
@@ -330,7 +332,7 @@ struct ucsi_connector {
struct power_supply *psy;
struct power_supply_desc psy_desc;
u32 rdo;
- u32 src_pdos[UCSI_MAX_PDOS];
+ u32 src_pdos[PDO_MAX_OBJECTS];
int num_pdos;
struct usb_role_switch *usb_role_sw;
--
2.24.0
commit 4dbc6a4ef06d ("usb: typec: ucsi: save power data objects
in PD mode") introduced retrieval of the PDOs when connected to a
PD-capable source. But only the first 4 PDOs are received since
that is the maximum number that can be fetched at a time given the
MESSAGE_IN length limitation (16 bytes). However, as per the PD spec
a connected source may advertise up to a maximum of 7 PDOs.
If such a source is connected it's possible the UCSI FW could have
negotiated a power contract with one of the PDOs at index greater
than 4, and would be reflected in the request data object's (RDO)
object position field. This would result in an out-of-bounds access
when the rdo_index() is used to index into the src_pdos array in
ucsi_psy_get_voltage_now().
We can resolve this by instead retrieving and storing up to the
maximum of 7 PDOs in the con->src_pdos array. This would involve
two calls to the GET_PDOS command.
Fixes: 992a60ed0d5e ("usb: typec: ucsi: register with power_supply class")
Fixes: 4dbc6a4ef06d ("usb: typec: ucsi: save power data objects in PD mode")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jack Pham <jackp(a)codeaurora.org>
---
drivers/usb/typec/ucsi/ucsi.c | 41 +++++++++++++++++++++++++++--------
drivers/usb/typec/ucsi/ucsi.h | 6 +++--
2 files changed, 36 insertions(+), 11 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index 244270755ae6..ac214b855986 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -495,7 +495,8 @@ static void ucsi_unregister_altmodes(struct ucsi_connector *con, u8 recipient)
}
}
-static void ucsi_get_pdos(struct ucsi_connector *con, int is_partner)
+static int ucsi_get_pdos(struct ucsi_connector *con, int is_partner,
+ u32 *pdos, int offset, int num_pdos)
{
struct ucsi *ucsi = con->ucsi;
u64 command;
@@ -503,17 +504,39 @@ static void ucsi_get_pdos(struct ucsi_connector *con, int is_partner)
command = UCSI_COMMAND(UCSI_GET_PDOS) | UCSI_CONNECTOR_NUMBER(con->num);
command |= UCSI_GET_PDOS_PARTNER_PDO(is_partner);
- command |= UCSI_GET_PDOS_NUM_PDOS(UCSI_MAX_PDOS - 1);
+ command |= UCSI_GET_PDOS_PDO_OFFSET(offset);
+ command |= UCSI_GET_PDOS_NUM_PDOS(num_pdos - 1);
command |= UCSI_GET_PDOS_SRC_PDOS;
- ret = ucsi_send_command(ucsi, command, con->src_pdos,
- sizeof(con->src_pdos));
- if (ret < 0) {
+ ret = ucsi_send_command(ucsi, command, pdos + offset,
+ num_pdos * sizeof(u32));
+ if (ret < 0)
dev_err(ucsi->dev, "UCSI_GET_PDOS failed (%d)\n", ret);
+ if (ret == 0 && offset == 0)
+ dev_warn(ucsi->dev, "UCSI_GET_PDOS returned 0 bytes\n");
+
+ return ret;
+}
+
+static void ucsi_get_src_pdos(struct ucsi_connector *con, int is_partner)
+{
+ int ret;
+
+ /* UCSI max payload means only getting at most 4 PDOs at a time */
+ ret = ucsi_get_pdos(con, 1, con->src_pdos, 0, UCSI_MAX_PDOS);
+ if (ret < 0)
return;
- }
+
con->num_pdos = ret / sizeof(u32); /* number of bytes to 32-bit PDOs */
- if (ret == 0)
- dev_warn(ucsi->dev, "UCSI_GET_PDOS returned 0 bytes\n");
+ if (con->num_pdos < UCSI_MAX_PDOS)
+ return;
+
+ /* get the remaining PDOs, if any */
+ ret = ucsi_get_pdos(con, 1, con->src_pdos, UCSI_MAX_PDOS,
+ PDO_MAX_OBJECTS - UCSI_MAX_PDOS);
+ if (ret < 0)
+ return;
+
+ con->num_pdos += ret / sizeof(u32);
}
static void ucsi_pwr_opmode_change(struct ucsi_connector *con)
@@ -522,7 +545,7 @@ static void ucsi_pwr_opmode_change(struct ucsi_connector *con)
case UCSI_CONSTAT_PWR_OPMODE_PD:
con->rdo = con->status.request_data_obj;
typec_set_pwr_opmode(con->port, TYPEC_PWR_MODE_PD);
- ucsi_get_pdos(con, 1);
+ ucsi_get_src_pdos(con, 1);
break;
case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
con->rdo = 0;
diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h
index 3920e20a9e9e..cee666790907 100644
--- a/drivers/usb/typec/ucsi/ucsi.h
+++ b/drivers/usb/typec/ucsi/ucsi.h
@@ -8,6 +8,7 @@
#include <linux/power_supply.h>
#include <linux/types.h>
#include <linux/usb/typec.h>
+#include <linux/usb/pd.h>
#include <linux/usb/role.h>
/* -------------------------------------------------------------------------- */
@@ -134,7 +135,9 @@ void ucsi_connector_change(struct ucsi *ucsi, u8 num);
/* GET_PDOS command bits */
#define UCSI_GET_PDOS_PARTNER_PDO(_r_) ((u64)(_r_) << 23)
+#define UCSI_GET_PDOS_PDO_OFFSET(_r_) ((u64)(_r_) << 24)
#define UCSI_GET_PDOS_NUM_PDOS(_r_) ((u64)(_r_) << 32)
+#define UCSI_MAX_PDOS (4)
#define UCSI_GET_PDOS_SRC_PDOS ((u64)1 << 34)
/* -------------------------------------------------------------------------- */
@@ -302,7 +305,6 @@ struct ucsi {
#define UCSI_MAX_SVID 5
#define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6)
-#define UCSI_MAX_PDOS (4)
#define UCSI_TYPEC_VSAFE5V 5000
#define UCSI_TYPEC_1_5_CURRENT 1500
@@ -330,7 +332,7 @@ struct ucsi_connector {
struct power_supply *psy;
struct power_supply_desc psy_desc;
u32 rdo;
- u32 src_pdos[UCSI_MAX_PDOS];
+ u32 src_pdos[PDO_MAX_OBJECTS];
int num_pdos;
struct usb_role_switch *usb_role_sw;
--
2.24.0
While the DP specification isn't entirely clear on if this should be
allowed or not, some branch devices report having downstream ports present
while also reporting a downstream port count of 0. So to avoid breaking
those devices, we need to handle this in drm_dp_read_downstream_info().
So, to do this we assume there's no downstream port info when the
downstream port count is 0.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Tested-by: Jérôme de Bretagne <jerome.debretagne(a)gmail.com>
Bugzilla: https://gitlab.freedesktop.org/drm/intel/-/issues/3416
Fixes: 3d3721ccb18a ("drm/i915/dp: Extract drm_dp_read_downstream_info()")
Cc: <stable(a)vger.kernel.org> # v5.10+
---
drivers/gpu/drm/drm_dp_helper.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index cb56d74e9d38..27c8c5bdf7d9 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -682,7 +682,14 @@ int drm_dp_read_downstream_info(struct drm_dp_aux *aux,
!(dpcd[DP_DOWNSTREAMPORT_PRESENT] & DP_DWN_STRM_PORT_PRESENT))
return 0;
+ /* Some branches advertise having 0 downstream ports, despite also advertising they have a
+ * downstream port present. The DP spec isn't clear on if this is allowed or not, but since
+ * some branches do it we need to handle it regardless.
+ */
len = drm_dp_downstream_port_count(dpcd);
+ if (!len)
+ return 0;
+
if (dpcd[DP_DOWNSTREAMPORT_PRESENT] & DP_DETAILED_CAP_INFO_AVAILABLE)
len *= 4;
--
2.30.2
Hi Greg,
Attached is the backport of 1d7ba0165d82 ("mips: Do not include hi and lo
in clobber list for R6") for 4.14-stable.
It will also need two more commits (attached).
1690905240fd ("MIPS: Introduce isa-rev.h to define MIPS_ISA_REV")
18ba210a29d0 ("MIPS: cpu-features.h: Replace __mips_isa_rev with MIPS_ISA_REV")
--
Regards
Sudip
On Sun, Apr 18, 2021 at 8:46 AM <gregkh(a)linuxfoundation.org> wrote:
>
>
> This is a note to let you know that I've just added the patch titled
>
> net: Make tcp_allowed_congestion_control readonly in non-init netns
>
> to the 5.10-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> net-make-tcp_allowed_congestion_control-readonly-in-non-init-netns.patch
> and it can be found in the queue-5.10 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
>
>
> From 97684f0970f6e112926de631fdd98d9693c7e5c1 Mon Sep 17 00:00:00 2001
> From: Jonathon Reinhart <jonathon.reinhart(a)gmail.com>
> Date: Tue, 13 Apr 2021 03:08:48 -0400
> Subject: net: Make tcp_allowed_congestion_control readonly in non-init netns
>
> From: Jonathon Reinhart <jonathon.reinhart(a)gmail.com>
>
> commit 97684f0970f6e112926de631fdd98d9693c7e5c1 upstream.
Hi Greg,
Thanks for picking this into the stable trees.
There's an earlier, somewhat related fix, which is only on net-next:
2671fa4dc010 ("netfilter: conntrack: Make global sysctls readonly in
non-init netns")
That probably could have been on "net", but it followed this other
commit which was not strictly a bug-fix. It's additional logic to
detect bugs like the former:
31c4d2f160eb ("net: Ensure net namespace isolation of sysctls")
Here's the series on Patchwork:
https://patchwork.kernel.org/project/netdevbpf/cover/20210412042453.32168-1…
I'm not yet sure where the threshold is for inclusion into "net" or
"stable". Could you please take a look and see if the first (or both)
of these should be included into the stable trees? If so, please feel
free to pick them yourself, or let me know which patches I should send
to "stable".
Thanks!
Jonathon Reinhart
These are the first two patches in https://lore.kernel.org/stable/20210501043014.33300-1-fllinden@amazon.com/
I will re-send the rest of that series as soon as the other bpf backports
hit the 4.19 branch.
This fixes errors in earlier bpf 4.14 backports. The verifier fix was
sent in earlier to bpf@ by Sam, and acked. I added the selftests
fix.
Essentially, together with the previous backports that had errors,
this produces correct backports of:
9d7eceede76 ("bpf: restrict unknown scalars of mixed signed bounds for
unprivileged")
80c9b2fae87b ("bpf: add various test cases to selftests")
Commits:
<4.14 only> ("bpf: Fix backport of "bpf: restrict unknown scalars of mixed signed bounds for unprivileged")
This was sent in by Sam to bpf@ earlier, and acked by Yonghong Song,
https://lore.kernel.org/bpf/20210419235641.5442-1-samjonas@amazon.com/T/#u
I am including it so that it is 'formally' submitted it
to -stable.
<4.14 only> ("bpf: fix up selftests after backports were fixed")
This is a follow-up to the previous by me, to fix selftests. It's
from 80c9b2fae87b ("bpf: add various test cases to selftests"), but
since that one was already partially added to the 4.14 branch
in 03f11a51a196 ("bpf: Fix selftests are changes for CVE 2019-7308"),
it's not a "backport" as such. To avoid confusion, I created a
separate commit for it, referencing the original commit
in the message. I examined each individual changed test, and
went through the history to see that the error message was indeed
as expected.
Hi Greg, Sasha,
The config malta_qemu_32r6_defconfig for mips fails to build for gcc-10+.
Please apply 1d7ba0165d82 ("mips: Do not include hi and lo in clobber list for R6")
to 4.14-stable to 5.12-stable branches.
It will apply cleanly to 5.9-stable to 5.12-stable. I will send the backport
for 4.14-stable, 4.19-stable and 5.4-stable.
--
Regards
Sudip
I'm announcing the release of the 5.12.1 kernel.
All users of the 5.12 kernel series must upgrade.
The updated 5.12.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.12.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/misc/mei/hw-me-regs.h | 1
drivers/misc/mei/pci-me.c | 1
drivers/net/usb/hso.c | 2 -
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 7 +++---
drivers/usb/class/cdc-acm.c | 3 +-
net/wireless/core.c | 21 +++++++++++++++----
net/wireless/nl80211.c | 24 +++++++++++++++++-----
8 files changed, 46 insertions(+), 15 deletions(-)
Greg Kroah-Hartman (1):
Linux 5.12.1
Jiri Kosina (1):
iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
Johan Hovold (1):
net: hso: fix NULL-deref on disconnect regression
Johannes Berg (1):
cfg80211: fix locking in netlink owner interface destruction
Oliver Neukum (1):
USB: CDC-ACM: fix poison/unpoison imbalance
Tomas Winkler (1):
mei: me: add Alder Lake P device id.
I'm announcing the release of the 5.11.18 kernel.
All users of the 5.11 kernel series must upgrade.
The updated 5.11.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.11.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
drivers/misc/mei/hw-me-regs.h | 1 +
drivers/misc/mei/pci-me.c | 1 +
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 7 ++++---
5 files changed, 9 insertions(+), 6 deletions(-)
Greg Kroah-Hartman (1):
Linux 5.11.18
Jiri Kosina (1):
iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
Qingqing Zhuo (1):
drm/amd/display: Update modifier list for gfx10_3
Tomas Winkler (1):
mei: me: add Alder Lake P device id.
This is a backport of the BPF verifier fixes for CVE-2021-29155. Original
series was part of the pull request here: https://lore.kernel.org/bpf/20210416223700.15611-1-daniel@iogearbox.net/T/
This wasn't a complicated backport, but copying bpf@ to see if
there are any concerns.
5.4 verifier selftests are clean with this backport:
Summary: 1566 PASSED, 0 SKIPPED, 0 FAILED
The individual commits:
960114839252 ("bpf: Use correct permission flag for mixed signed bounds arithmetic")
* Not applicable to 5.4, as 5.4 does not have
2c78ee898d8f ("bpf: Implement CAP_BPF").
6f55b2f2a117 ("bpf: Move off_reg into sanitize_ptr_alu")
* Clean cherry-pick.
24c109bb1537 ("bpf: Ensure off_reg has no mixed signed bounds for all types")
* Conflict: allow_ptr_leaks was replaced by bypass_spec_v1 in the
deleted PTR_TO_MAP_VALUE switch case by
2c78ee898d8f ("bpf: Implement CAP_BPF"). Resolution is easy,
the case statement gets deleted either way.
b658bbb844e2 ("bpf: Rework ptr_limit into alu_limit and add common error path")
* Clean cherry-pick.
a6aaece00a57 ("bpf: Improve verifier error messages for users")
* Resolved simple contextual conflict in adjust_scalar_min_max_vals().
because of a var declaration that was added by this post-5.4 commit:
3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking").
073815b756c5 ("bpf: Refactor and streamline bounds check into helper")
* Conflict: another allow_ptr_leaks that was replaced with
bypass_spec_v1 after 2c78ee898d8f.
* Conflict: Post-5.4 commit
01f810ace9ed ("bpf: Allow variable-offset stack access")
changed the call to check_stack_access to a new function,
check_stack_access_for_ptr_arithmetic(), and moved/changed an
error message.
* Since this commit just factors out some code from
adjust_ptr_min_max_vals() in to a new function, do the same
with the corresponding block in 5.4 that doesn't have the
changes listed above from post-5.4 commits.
f528819334 ("bpf: Move sanitize_val_alu out of op switch")
* Contextual conflict from post-5.4 commit
3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking"),
that added a comment on top of the switch referenced in the commit
message.
7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic mask")
* Contextual conflict post-5.4 commit:
3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking")
added a call to a new function just above the switch statement in
adjust_ptr_min_max_vals. This doesn't affect the lines that were
actually changed.
d7a509135175 ("bpf: Update selftests to reflect new error states")
* The bounds.c tests have undergone several changes since 5.4, related
to commits that were not backported (like e.g. the ALU32 changes).
The error messages for those tests will remain the same on 5.4.
=====
Daniel Borkmann (8):
bpf: Move off_reg into sanitize_ptr_alu
bpf: Ensure off_reg has no mixed signed bounds for all types
bpf: Rework ptr_limit into alu_limit and add common error path
bpf: Improve verifier error messages for users
bpf: Refactor and streamline bounds check into helper
bpf: Move sanitize_val_alu out of op switch
bpf: Tighten speculative pointer arithmetic mask
bpf: Update selftests to reflect new error states
kernel/bpf/verifier.c | 233 ++++++++++++------
.../selftests/bpf/verifier/bounds_deduction.c | 21 +-
.../bpf/verifier/bounds_mix_sign_unsign.c | 13 -
tools/testing/selftests/bpf/verifier/unpriv.c | 2 +-
.../selftests/bpf/verifier/value_ptr_arith.c | 6 +-
5 files changed, 173 insertions(+), 102 deletions(-)
--
2.23.3
This is the start of the stable review cycle for the 5.12.1 release.
There are 5 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 02 May 2021 14:19:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.1-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.12.1-rc1
Tomas Winkler <tomas.winkler(a)intel.com>
mei: me: add Alder Lake P device id.
Johannes Berg <johannes.berg(a)intel.com>
cfg80211: fix locking in netlink owner interface destruction
Jiri Kosina <jkosina(a)suse.cz>
iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
Oliver Neukum <oneukum(a)suse.com>
USB: CDC-ACM: fix poison/unpoison imbalance
Johan Hovold <johan(a)kernel.org>
net: hso: fix NULL-deref on disconnect regression
-------------
Diffstat:
Makefile | 4 ++--
drivers/misc/mei/hw-me-regs.h | 1 +
drivers/misc/mei/pci-me.c | 1 +
drivers/net/usb/hso.c | 2 +-
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 7 ++++---
drivers/usb/class/cdc-acm.c | 3 ++-
net/wireless/core.c | 21 ++++++++++++++++----
net/wireless/nl80211.c | 24 ++++++++++++++++++-----
8 files changed, 47 insertions(+), 16 deletions(-)
This is the start of the stable review cycle for the 5.11.18 release.
There are 3 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 02 May 2021 14:19:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.18-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.11.18-rc1
Tomas Winkler <tomas.winkler(a)intel.com>
mei: me: add Alder Lake P device id.
Qingqing Zhuo <qingqing.zhuo(a)amd.com>
drm/amd/display: Update modifier list for gfx10_3
Jiri Kosina <jkosina(a)suse.cz>
iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
-------------
Diffstat:
Makefile | 4 ++--
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
drivers/misc/mei/hw-me-regs.h | 1 +
drivers/misc/mei/pci-me.c | 1 +
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 7 ++++---
5 files changed, 10 insertions(+), 7 deletions(-)
This is the start of the stable review cycle for the 5.4.116 release.
There are 8 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 02 May 2021 14:19:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.116-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.116-rc1
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Update selftests to reflect new error states
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Tighten speculative pointer arithmetic mask
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Move sanitize_val_alu out of op switch
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Refactor and streamline bounds check into helper
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Improve verifier error messages for users
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Rework ptr_limit into alu_limit and add common error path
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Ensure off_reg has no mixed signed bounds for all types
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Move off_reg into sanitize_ptr_alu
-------------
Diffstat:
Makefile | 4 +-
kernel/bpf/verifier.c | 233 ++++++++++++++-------
.../selftests/bpf/verifier/bounds_deduction.c | 21 +-
.../bpf/verifier/bounds_mix_sign_unsign.c | 13 --
tools/testing/selftests/bpf/verifier/unpriv.c | 2 +-
.../selftests/bpf/verifier/value_ptr_arith.c | 6 +-
6 files changed, 175 insertions(+), 104 deletions(-)
DIPM is unsupported or broken on sunxi. Trying to enable the power
management policy med_power_with_dipm on an Allwinner A20 SoC based board
leads to immediate I/O errors and the attached SATA disk disappears from
the /dev filesystem. A reset (power cycle) is required to make the SATA
controller or disk work again. The A10 and A20 SoC data sheets and manuals
don't mention DIPM at all [1], so it's fair to assume that it's simply not
supported. But even if it was, it should be considered broken and best be
disabled in the ahci_sunxi driver.
[1] https://github.com/allwinner-zh/documents/tree/master/
Fixes: c5754b5220f0 ("ARM: sunxi: Add support for Allwinner SUNXi SoCs sata to ahci_platform")
Cc: stable(a)vger.kernel.org
Signed-off-by: Timo Sigurdsson <public_timo.s(a)silentcreek.de>
Tested-by: Timo Sigurdsson <public_timo.s(a)silentcreek.de>
---
Changes since v1:
- Formal changes to the commit message (Fixes and Cc lines) as suggested
by Greg Kroah-Hartman and Sergei Shtylyov. No changes to the patch
itself.
---
drivers/ata/ahci_sunxi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/ahci_sunxi.c b/drivers/ata/ahci_sunxi.c
index cb69b737cb49..56b695136977 100644
--- a/drivers/ata/ahci_sunxi.c
+++ b/drivers/ata/ahci_sunxi.c
@@ -200,7 +200,7 @@ static void ahci_sunxi_start_engine(struct ata_port *ap)
}
static const struct ata_port_info ahci_sunxi_port_info = {
- .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ,
+ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ | ATA_FLAG_NO_DIPM,
.pio_mask = ATA_PIO4,
.udma_mask = ATA_UDMA6,
.port_ops = &ahci_platform_ops,
--
2.26.2
This series contains backports for BPF commits for 4.14, except two commits
that are 4.14-only commits. One 4.14-only commit was already acked by
a BPF maintainer (see below). The other one is a selftest follow-up.
The backports were not complicated. But, copying to bpf@ and BPF
maintainers for a sanity check.
What the series does is:
* Fix errors in an older bpf 4.14 backport (this fix was sent in earlier
to bpf@, and acked).
* Fix selftests after recent bpf backports to 4.14 (but before the
fixes for CVE-2021-29155).
* Backport fixes for CVE-2021-29155, including selftests changes.
* Backport commits that disallow the mangling of valid pointers by root
(one commit that came in shortly after 4.14, one follow-up fix). This
also means that 5 verifier selftests that always failed on the 4.14
branch are OK again.
* Backport selftest commits to adapt alignment selftests after the previous.
Verifier/alignment selftests are now clean on the 4.14 branch, which should
help prevent further backporting errors.
Listed by their mainline commit id (except when 4.14 only):
<4.14 only> ("bpf: Fix backport of "bpf: restrict unknown scalars of mixed signed bounds for unprivileged")
This was sent in by Sam to bpf@ earlier, and acked by Yonghong Song,
https://lore.kernel.org/bpf/20210419235641.5442-1-samjonas@amazon.com/T/#u
I am including it so that it is 'formally' submitted it
to -stable.
<4.14 only> ("bpf: fix up selftests after backports were fixed")
This is a follow-up to the previous by me, to fix selftests. It's
from 80c9b2fae87b ("bpf: add various test cases to selftests"), but
since that one was already partially added to the 4.14 branch
in 03f11a51a196 ("bpf: Fix selftests are changes for CVE 2019-7308"),
it's not a "backport" as such. To avoid confusion, I created a
separate commit for it, referencing the original commit
in the message. I examined each individual changed test, and
went through the history to see that the error message was indeed
as expected.
0a13e3537ea6 ("bpf, selftests: Fix up some test_verifier cases for unprivileged")
After some recent backports of bpf fixes to 4.14 (separate from this
series), there are some selftests that need to be modified. This
backported commit does that. No major conflicts/issues. For 4.14,
some tests do not exist yet, so they were skipped.
The next ones are a backport of the BPF verifier fixes for CVE-2021-29155.
Original series was part of the pull request here: https://lore.kernel.org/bpf/20210416223700.15611-1-daniel@iogearbox.net/T/
960114839252 ("bpf: Use correct permission flag for mixed signed bounds arithmetic")
* Not applicable for 4.14, as it does not have
2c78ee898d8f ("bpf: Implement CAP_BPF").
6f55b2f2a117 ("bpf: Move off_reg into sanitize_ptr_alu")
* Minor contextual conflict: verbose() does not have the env
argument in 4.14.
24c109bb1537 ("bpf: Ensure off_reg has no mixed signed bounds for all types")
* This deletes a switch() case in adjust_ptr_min_max_vals, since
it moves the check in it to retrieve_ptr_limit. For 4.14, that
switch() statement was still 2 if() statements, since it does not
have aad2eeaf4697 ("bpf: Simplify ptr_min_max_vals adjustment").
The equivalent change for 4.14 is to delete the PTR_TO_MAP_VALUE
if().
b658bbb844e2 ("bpf: Rework ptr_limit into alu_limit and add common error path")
* Clean cherry-pick.
a6aaece00a57 ("bpf: Improve verifier error messages for users")
* Simple contextual conflict in adjust_scalar_min_max_vals().
because of a var declaration that was added by this post-5.4 commit:
3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking").
* Additional simple contextual conflict: verbose() does not have
the env argument in 4.14.
073815b756c5 ("bpf: Refactor and streamline bounds check into helper")
* This factors out the bounds check in adjust_ptr_min_max_vals
in to a separate function. In 4.14, the bounds check block
in question looks a little different, because:
* 4.14 still uses allow_ptr_leaks, not bypass_spec_v1.
* 01f810ace9ed ("bpf: Allow variable-offset stack access")
changed the call to check_stack_access to a new function,
check_stack_access_for_ptr_arithmetic(), and moved/changed
an error message.
* Since this commit just factors out some code from
adjust_ptr_min_max_vals() in to a new function, do the same
with the corresponding block in 4.14 that doesn't have the
changes listed above from post-4.14 commits.
f528819334 ("bpf: Move sanitize_val_alu out of op switch")
* Resolved contextual conflict from post-4.14 commit
3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking"),
that added a comment on top of the switch referenced in the commit
message.
7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic mask")
* Resolved contextual conflict post-4.14 commit:
3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking")
added a call to a new function just above the switch statement in
adjust_ptr_min_max_vals. This doesn't affect the lines that were
actually changed.
* Resolved contextual conflict:
01f810ace9ed ("bpf: Allow variable-offset stack access") added
a comment to the PTR_TO_STACK case in retrieve_ptr_limit. This
comment is not present in 4.14, but the code is the same.
d7a509135175 ("bpf: Update selftests to reflect new error states")
* Post-4.14, the verifier tests were split in to different
files, in 4.14 they are still all in test_verifier.c.
* The bounds.c tests have undergone several changes since 4.14,
related to commits that were not backported (like e.g. the
ALU32 changes). The error message will remain the same on 4.14.
* 4f7b3e82589e ("bpf: improve verifier branch analysis") changed
the error message for the "bounds checks mixing signed and
unsigned, variant 14" test. Since 4.14 does not have that commit,
this test will still produce the original error message ("R0
invalid mem access 'inv'").
The rest of the commits are to pull in a few commits that get the number
of verifier/align selftest errors on the 4.14 branch down to 0. This is
mainly about the first one:
82abbf8d2fc4 ("bpf: do not allow root to mangle valid pointers")
* This commit has a follow-up that must be added as well,
see the next commit.
* As the commit message states, this mostly disallows
pointer mangling that was allowed by
f1174f77b50c ("bpf/verifier: rework value tracking").
Allowing root to mangle valid pointers also results
in the unexpected successful loading of some selftests,
so backporting this fixes that.
* Resolved contextual conflict: 4.14 does not have the
env argument to verbose
dd066823db2a ("bpf/verifier: disallow pointer subtraction")
* Fixes the above.
* Minor contextual conflict: mark_reg_unknown does not
have an env argument on 4.14.
2b36047e7889 ("selftests/bpf: fix test_align")
* Selftest follow-up to
82abbf8d2fc4 ("bpf: do not allow root to mangle valid pointers")
* Clean cherry-pick.
31e95b61e172 ("selftests/bpf: make 'dubious pointer arithmetic' test useful")
* Selftest follow-up to the above.
* Conflict: 4.14 does not have 'liveness' of registers in the
output, so adjust the expected output to match.
=====
Alexei Starovoitov (4):
bpf: do not allow root to mangle valid pointers
bpf/verifier: disallow pointer subtraction
selftests/bpf: fix test_align
selftests/bpf: make 'dubious pointer arithmetic' test useful
Daniel Borkmann (8):
bpf: Move off_reg into sanitize_ptr_alu
bpf: Ensure off_reg has no mixed signed bounds for all types
bpf: Rework ptr_limit into alu_limit and add common error path
bpf: Improve verifier error messages for users
bpf: Refactor and streamline bounds check into helper
bpf: Move sanitize_val_alu out of op switch
bpf: Tighten speculative pointer arithmetic mask
bpf: Update selftests to reflect new error states
Frank van der Linden (1):
bpf: fix up selftests after backports were fixed
Piotr Krysiuk (1):
bpf, selftests: Fix up some test_verifier cases for unprivileged
Samuel Mendoza-Jonas (1):
bpf: Fix backport of "bpf: restrict unknown scalars of mixed signed
bounds for unprivileged"
kernel/bpf/verifier.c | 330 ++++++++++++--------
tools/testing/selftests/bpf/test_align.c | 26 +-
tools/testing/selftests/bpf/test_verifier.c | 104 +++---
3 files changed, 269 insertions(+), 191 deletions(-)
--
2.23.3
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
It was reported that a fix to the ring buffer recursion detection would
cause a hung machine when performing suspend / resume testing. The
following backtrace was extracted from debugging that case:
Call Trace:
trace_clock_global+0x91/0xa0
__rb_reserve_next+0x237/0x460
ring_buffer_lock_reserve+0x12a/0x3f0
trace_buffer_lock_reserve+0x10/0x50
__trace_graph_return+0x1f/0x80
trace_graph_return+0xb7/0xf0
? trace_clock_global+0x91/0xa0
ftrace_return_to_handler+0x8b/0xf0
? pv_hash+0xa0/0xa0
return_to_handler+0x15/0x30
? ftrace_graph_caller+0xa0/0xa0
? trace_clock_global+0x91/0xa0
? __rb_reserve_next+0x237/0x460
? ring_buffer_lock_reserve+0x12a/0x3f0
? trace_event_buffer_lock_reserve+0x3c/0x120
? trace_event_buffer_reserve+0x6b/0xc0
? trace_event_raw_event_device_pm_callback_start+0x125/0x2d0
? dpm_run_callback+0x3b/0xc0
? pm_ops_is_empty+0x50/0x50
? platform_get_irq_byname_optional+0x90/0x90
? trace_device_pm_callback_start+0x82/0xd0
? dpm_run_callback+0x49/0xc0
With the following RIP:
RIP: 0010:native_queued_spin_lock_slowpath+0x69/0x200
Since the fix to the recursion detection would allow a single recursion to
happen while tracing, this lead to the trace_clock_global() taking a spin
lock and then trying to take it again:
ring_buffer_lock_reserve() {
trace_clock_global() {
arch_spin_lock() {
queued_spin_lock_slowpath() {
/* lock taken */
(something else gets traced by function graph tracer)
ring_buffer_lock_reserve() {
trace_clock_global() {
arch_spin_lock() {
queued_spin_lock_slowpath() {
/* DEAD LOCK! */
Tracing should *never* block, as it can lead to strange lockups like the
above.
Restructure the trace_clock_global() code to instead of simply taking a
lock to update the recorded "prev_time" simply use it, as two events
happening on two different CPUs that calls this at the same time, really
doesn't matter which one goes first. Use a trylock to grab the lock for
updating the prev_time, and if it fails, simply try again the next time.
If it failed to be taken, that means something else is already updating
it.
Link: https://lkml.kernel.org/r/20210430121758.650b6e8a@gandalf.local.home
Cc: stable(a)vger.kernel.org
Tested-by: Konstantin Kharlamov <hi-angel(a)yandex.ru>
Tested-by: Todd Brandt <todd.e.brandt(a)linux.intel.com>
Fixes: b02414c8f045 ("ring-buffer: Fix recursion protection transitions between interrupt context") # started showing the problem
Fixes: 14131f2f98ac3 ("tracing: implement trace_clock_*() APIs") # where the bug happened
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212761
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/trace_clock.c | 44 ++++++++++++++++++++++++++------------
1 file changed, 30 insertions(+), 14 deletions(-)
diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
index aaf6793ededa..c1637f90c8a3 100644
--- a/kernel/trace/trace_clock.c
+++ b/kernel/trace/trace_clock.c
@@ -95,33 +95,49 @@ u64 notrace trace_clock_global(void)
{
unsigned long flags;
int this_cpu;
- u64 now;
+ u64 now, prev_time;
raw_local_irq_save(flags);
this_cpu = raw_smp_processor_id();
- now = sched_clock_cpu(this_cpu);
+
/*
- * If in an NMI context then dont risk lockups and return the
- * cpu_clock() time:
+ * The global clock "guarantees" that the events are ordered
+ * between CPUs. But if two events on two different CPUS call
+ * trace_clock_global at roughly the same time, it really does
+ * not matter which one gets the earlier time. Just make sure
+ * that the same CPU will always show a monotonic clock.
+ *
+ * Use a read memory barrier to get the latest written
+ * time that was recorded.
*/
- if (unlikely(in_nmi()))
- goto out;
+ smp_rmb();
+ prev_time = READ_ONCE(trace_clock_struct.prev_time);
+ now = sched_clock_cpu(this_cpu);
- arch_spin_lock(&trace_clock_struct.lock);
+ /* Make sure that now is always greater than prev_time */
+ if ((s64)(now - prev_time) < 0)
+ now = prev_time + 1;
/*
- * TODO: if this happens often then maybe we should reset
- * my_scd->clock to prev_time+1, to make sure
- * we start ticking with the local clock from now on?
+ * If in an NMI context then dont risk lockups and simply return
+ * the current time.
*/
- if ((s64)(now - trace_clock_struct.prev_time) < 0)
- now = trace_clock_struct.prev_time + 1;
+ if (unlikely(in_nmi()))
+ goto out;
- trace_clock_struct.prev_time = now;
+ /* Tracing can cause strange recursion, always use a try lock */
+ if (arch_spin_trylock(&trace_clock_struct.lock)) {
+ /* Reread prev_time in case it was already updated */
+ prev_time = READ_ONCE(trace_clock_struct.prev_time);
+ if ((s64)(now - prev_time) < 0)
+ now = prev_time + 1;
- arch_spin_unlock(&trace_clock_struct.lock);
+ trace_clock_struct.prev_time = now;
+ /* The unlock acts as the wmb for the above rmb */
+ arch_spin_unlock(&trace_clock_struct.lock);
+ }
out:
raw_local_irq_restore(flags);
--
2.30.1
From: "Steven Rostedt (VMware)" <rostedt(a)goodmis.org>
The default max PID is set by PID_MAX_DEFAULT, and the tracing
infrastructure uses this number to map PIDs to the comm names of the
tasks, such output of the trace can show names from the recorded PIDs in
the ring buffer. This mapping is also exported to user space via the
"saved_cmdlines" file in the tracefs directory.
But currently the mapping expects the PIDs to be less than
PID_MAX_DEFAULT, which is the default maximum and not the real maximum.
Recently, systemd will increases the maximum value of a PID on the system,
and when tasks are traced that have a PID higher than PID_MAX_DEFAULT, its
comm is not recorded. This leads to the entire trace to have "<...>" as
the comm name, which is pretty useless.
Instead, keep the array mapping the size of PID_MAX_DEFAULT, but instead
of just mapping the index to the comm, map a mask of the PID
(PID_MAX_DEFAULT - 1) to the comm, and find the full PID from the
map_cmdline_to_pid array (that already exists).
This bug goes back to the beginning of ftrace, but hasn't been an issue
until user space started increasing the maximum value of PIDs.
Link: https://lkml.kernel.org/r/20210427113207.3c601884@gandalf.local.home
Cc: stable(a)vger.kernel.org
Fixes: bc0c38d139ec7 ("ftrace: latency tracer infrastructure")
Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 41 +++++++++++++++--------------------------
1 file changed, 15 insertions(+), 26 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 66a4ad93b5e9..e28d08905124 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2390,14 +2390,13 @@ static void tracing_stop_tr(struct trace_array *tr)
static int trace_save_cmdline(struct task_struct *tsk)
{
- unsigned pid, idx;
+ unsigned tpid, idx;
/* treat recording of idle task as a success */
if (!tsk->pid)
return 1;
- if (unlikely(tsk->pid > PID_MAX_DEFAULT))
- return 0;
+ tpid = tsk->pid & (PID_MAX_DEFAULT - 1);
/*
* It's not the end of the world if we don't get
@@ -2408,26 +2407,15 @@ static int trace_save_cmdline(struct task_struct *tsk)
if (!arch_spin_trylock(&trace_cmdline_lock))
return 0;
- idx = savedcmd->map_pid_to_cmdline[tsk->pid];
+ idx = savedcmd->map_pid_to_cmdline[tpid];
if (idx == NO_CMDLINE_MAP) {
idx = (savedcmd->cmdline_idx + 1) % savedcmd->cmdline_num;
- /*
- * Check whether the cmdline buffer at idx has a pid
- * mapped. We are going to overwrite that entry so we
- * need to clear the map_pid_to_cmdline. Otherwise we
- * would read the new comm for the old pid.
- */
- pid = savedcmd->map_cmdline_to_pid[idx];
- if (pid != NO_CMDLINE_MAP)
- savedcmd->map_pid_to_cmdline[pid] = NO_CMDLINE_MAP;
-
- savedcmd->map_cmdline_to_pid[idx] = tsk->pid;
- savedcmd->map_pid_to_cmdline[tsk->pid] = idx;
-
+ savedcmd->map_pid_to_cmdline[tpid] = idx;
savedcmd->cmdline_idx = idx;
}
+ savedcmd->map_cmdline_to_pid[idx] = tsk->pid;
set_cmdline(idx, tsk->comm);
arch_spin_unlock(&trace_cmdline_lock);
@@ -2438,6 +2426,7 @@ static int trace_save_cmdline(struct task_struct *tsk)
static void __trace_find_cmdline(int pid, char comm[])
{
unsigned map;
+ int tpid;
if (!pid) {
strcpy(comm, "<idle>");
@@ -2449,16 +2438,16 @@ static void __trace_find_cmdline(int pid, char comm[])
return;
}
- if (pid > PID_MAX_DEFAULT) {
- strcpy(comm, "<...>");
- return;
+ tpid = pid & (PID_MAX_DEFAULT - 1);
+ map = savedcmd->map_pid_to_cmdline[tpid];
+ if (map != NO_CMDLINE_MAP) {
+ tpid = savedcmd->map_cmdline_to_pid[map];
+ if (tpid == pid) {
+ strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN);
+ return;
+ }
}
-
- map = savedcmd->map_pid_to_cmdline[pid];
- if (map != NO_CMDLINE_MAP)
- strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN);
- else
- strcpy(comm, "<...>");
+ strcpy(comm, "<...>");
}
void trace_find_cmdline(int pid, char comm[])
--
2.30.1
From: Jarkko Sakkinen <jarkko(a)kernel.org>
BUG_ON() should not be used in the kernel code, unless there are
exceptional reasons to do so. Replace BUG_ON() with WARN() and
return.
Cc: stable(a)vger.kernel.org
Fixes: b3811d36a3e7 ("KEYS: checking the input id parameters before finding asymmetric key")
Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org>
---
No changes from original submission by Jarkko.
crypto/asymmetric_keys/asymmetric_type.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index ad8af3d70ac..a00bed3e04d 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -54,7 +54,10 @@ struct key *find_asymmetric_key(struct key *keyring,
char *req, *p;
int len;
- BUG_ON(!id_0 && !id_1);
+ if (!id_0 && !id_1) {
+ WARN(1, "All ID's are NULL\n");
+ return ERR_PTR(-EINVAL);
+ }
if (id_0) {
lookup = id_0->data;
--
2.27.0
The translation caches may preserve obsolete data when the
mapping size is changed, suppose the following sequence which
can reveal the problem with high probability.
1.mmap(4GB,MAP_HUGETLB)
2.
while (1) {
(a) DMA MAP 0,0xa0000
(b) DMA UNMAP 0,0xa0000
(c) DMA MAP 0,0xc0000000
* DMA read IOVA 0 may failure here (Not present)
* if the problem occurs.
(d) DMA UNMAP 0,0xc0000000
}
The page table(only focus on IOVA 0) after (a) is:
PML4: 0x19db5c1003 entry:0xffff899bdcd2f000
PDPE: 0x1a1cacb003 entry:0xffff89b35b5c1000
PDE: 0x1a30a72003 entry:0xffff89b39cacb000
PTE: 0x21d200803 entry:0xffff89b3b0a72000
The page table after (b) is:
PML4: 0x19db5c1003 entry:0xffff899bdcd2f000
PDPE: 0x1a1cacb003 entry:0xffff89b35b5c1000
PDE: 0x1a30a72003 entry:0xffff89b39cacb000
PTE: 0x0 entry:0xffff89b3b0a72000
The page table after (c) is:
PML4: 0x19db5c1003 entry:0xffff899bdcd2f000
PDPE: 0x1a1cacb003 entry:0xffff89b35b5c1000
PDE: 0x21d200883 entry:0xffff89b39cacb000 (*)
Because the PDE entry after (b) is present, it won't be
flushed even if the iommu driver flush cache when unmap,
so the obsolete data may be preserved in cache, which
would cause the wrong translation at end.
However, we can see the PDE entry is finally switch to
2M-superpage mapping, but it does not transform
to 0x21d200883 directly:
1. PDE: 0x1a30a72003
2. __domain_mapping
dma_pte_free_pagetable
Set the PDE entry to ZERO
Set the PDE entry to 0x21d200883
So we must flush the cache after the entry switch to ZERO
to avoid the obsolete info be preserved.
Cc: David Woodhouse <dwmw2(a)infradead.org>
Cc: Lu Baolu <baolu.lu(a)linux.intel.com>
Cc: Nadav Amit <nadav.amit(a)gmail.com>
Cc: Alex Williamson <alex.williamson(a)redhat.com>
Cc: Joerg Roedel <joro(a)8bytes.org>
Cc: Kevin Tian <kevin.tian(a)intel.com>
Cc: Gonglei (Arei) <arei.gonglei(a)huawei.com>
Fixes: 6491d4d02893 ("intel-iommu: Free old page tables before creating superpage")
Cc: <stable(a)vger.kernel.org> # v3.0+
Link: https://lore.kernel.org/linux-iommu/670baaf8-4ff8-4e84-4be3-030b95ab5a5e@hu…
Suggested-by: Lu Baolu <baolu.lu(a)linux.intel.com>
Signed-off-by: Longpeng(Mike) <longpeng2(a)huawei.com>
---
v1 -> v2:
- add Joerg
- reconstruct the solution base on the Baolu's suggestion
---
drivers/iommu/intel/iommu.c | 52 +++++++++++++++++++++++++++++++++------------
1 file changed, 38 insertions(+), 14 deletions(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index ee09323..881c9f2 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -2289,6 +2289,41 @@ static inline int hardware_largepage_caps(struct dmar_domain *domain,
return level;
}
+/*
+ * Ensure that old small page tables are removed to make room for superpage(s).
+ * We're going to add new large pages, so make sure we don't remove their parent
+ * tables. The IOTLB/devTLBs should be flushed if any PDE/PTEs are cleared.
+ */
+static void switch_to_super_page(struct dmar_domain *domain,
+ unsigned long start_pfn,
+ unsigned long end_pfn, int level)
+{
+ unsigned long lvl_pages = lvl_to_nr_pages(level);
+ struct dma_pte *pte = NULL;
+ int i;
+
+ while (start_pfn <= end_pfn) {
+ if (!pte)
+ pte = pfn_to_dma_pte(domain, start_pfn, &level);
+
+ if (dma_pte_present(pte)) {
+ dma_pte_free_pagetable(domain, start_pfn,
+ start_pfn + lvl_pages - 1,
+ level + 1);
+
+ for_each_domain_iommu(i, domain)
+ iommu_flush_iotlb_psi(g_iommus[i], domain,
+ start_pfn, lvl_pages,
+ 0, 0);
+ }
+
+ pte++;
+ start_pfn += lvl_pages;
+ if (first_pte_in_page(pte))
+ pte = NULL;
+ }
+}
+
static int
__domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
unsigned long phys_pfn, unsigned long nr_pages, int prot)
@@ -2329,22 +2364,11 @@ static inline int hardware_largepage_caps(struct dmar_domain *domain,
return -ENOMEM;
/* It is large page*/
if (largepage_lvl > 1) {
- unsigned long nr_superpages, end_pfn;
+ unsigned long end_pfn;
pteval |= DMA_PTE_LARGE_PAGE;
- lvl_pages = lvl_to_nr_pages(largepage_lvl);
-
- nr_superpages = nr_pages / lvl_pages;
- end_pfn = iov_pfn + nr_superpages * lvl_pages - 1;
-
- /*
- * Ensure that old small page tables are
- * removed to make room for superpage(s).
- * We're adding new large pages, so make sure
- * we don't remove their parent tables.
- */
- dma_pte_free_pagetable(domain, iov_pfn, end_pfn,
- largepage_lvl + 1);
+ end_pfn = ((iov_pfn + nr_pages) & level_mask(largepage_lvl)) - 1;
+ switch_to_super_page(domain, iov_pfn, end_pfn, largepage_lvl);
} else {
pteval &= ~(uint64_t)DMA_PTE_LARGE_PAGE;
}
--
1.8.3.1
EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to
temporarily disable metadata verification until all xattrs/attrs necessary
to verify an EVM portable signature are copied to the file. This flag is
cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is
calculated on unverified xattrs/attrs.
Currently EVM unnecessarily denies setting this flag if EVM is initialized
with a public key, which is not a concern as it cannot be used to trust
xattrs/attrs updates. This patch removes this limitation.
Cc: stable(a)vger.kernel.org # 4.16.x
Fixes: ae1ba1676b88e ("EVM: Allow userland to permit modification of EVM-protected metadata")
Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com>
---
Documentation/ABI/testing/evm | 5 +++--
security/integrity/evm/evm_secfs.c | 4 ++--
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
index 3c477ba48a31..eb6d70fd6fa2 100644
--- a/Documentation/ABI/testing/evm
+++ b/Documentation/ABI/testing/evm
@@ -49,8 +49,9 @@ Description:
modification of EVM-protected metadata and
disable all further modification of policy
- Note that once a key has been loaded, it will no longer be
- possible to enable metadata modification.
+ Note that once an HMAC key has been loaded, it will no longer
+ be possible to enable metadata modification and, if it is
+ already enabled, it will be disabled.
Until key loading has been signaled EVM can not create
or validate the 'security.evm' xattr, but returns
diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index bbc85637e18b..197a4b83e534 100644
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -81,10 +81,10 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf,
return -EINVAL;
/* Don't allow a request to freshly enable metadata writes if
- * keys are loaded.
+ * an HMAC key is loaded.
*/
if ((i & EVM_ALLOW_METADATA_WRITES) &&
- ((evm_initialized & EVM_KEY_MASK) != 0) &&
+ ((evm_initialized & EVM_INIT_HMAC) != 0) &&
!(evm_initialized & EVM_ALLOW_METADATA_WRITES))
return -EPERM;
--
2.26.2
On Tue, Apr 27, 2021 at 06:18:05PM -0400, George Kennedy wrote:
> CC+ stable(a)vger.kernel.org
>
> On 4/27/2021 6:17 PM, George Kennedy wrote:
> > Hello Greg,
> >
> > We need the following 2 upstream commits applied to 5.4.y to fix an iBFT
> > boot failure:
> >
> > 2021-03-29 rafael.j.wysocki(a)intel.com - 1a1c130a 2021-03-23 Rafael J.
> > Wysocki ACPI: tables: x86: Reserve memory occupied by ACPI tables
> > 2021-04-13 rafael.j.wysocki(a)intel.com - 6998a88 2021-04-13 Rafael J.
> > Wysocki ACPI: x86: Call acpi_boot_table_init() after
> > acpi_table_upgrade()
> >
> > Currently, only the first commit (1a1c130a) is destined for 5.10 & 5.11.
> >
> > The 2nd commit (6998a88) is needed as well and both commits are needed
> > in 5.4.y.
Is this a regression (i.e. did this hardware work on older kernels?),
and if so, what commit caused the problem?
These commits are already in 5.10.y, what changed in older kernels to
require this to be backported?
thanks,
greg k-h
On Fri, Apr 30, 2021 at 10:57:59AM +0000, Kasper Zwijsen wrote:
> Dear Thomas Gleixner,
>
>
> I believe I have found a semantic security bug in the form of a missing capability check in the timerfd_create and timerfd_settime system calls for the 4.4.y LTS kernel.
>
> In this commit: https://github.com/torvalds/linux/commit/2895a5e5b3ae78d9923a91fce405d4a2f3…,
> capability checks for CAP_WAKE_ALARM were added for creating and setting a CLOCK_BOOTTIME_ALARM and CLOCK_REALTIME_ALARM.
> This security patch was applied to all but one LTS kernel, namely 4.4.y.
That is because it showed up in the 4.8 release, there was nothing to
"apply" to any newer kernels :)
> It is therefore still possible for a user process without any privileges to create and set such a timer, resulting in the process being able to wake up the system.
>
> The man pages state that creating or setting such a timer requires privileges. Similarly, the timer_create system call does check the correct permissions.
> I therefore believe this is unintended and a semantic bug.
> I have tested the original patch and found that it can simply be applied to the latest 4.4.y kernel (4.4.268 as of right now) without any issues.
> The patch: https://lore.kernel.org/patchwork/patch/686888/
I've now queued this up for the next 4.4.y release. In the future, you
should just email the stable(a)vger.kernel.org address any git commit ids
that you feel need to be backported.
thanks!
greg k-h
Dear stable
The famous brand John Lewis Partnership, is UK's largest multi-
channel retailer with over 126 shops and multiple expansion in
Africa furnished by European/Asian/American products. We are
sourcing
new products to attract new customers and also retain our
existing ones, create new partnerships with companies dealing
with different kinds of goods globally.
Your company's products are of interest to our market as we have
an amazing market for your products.
Provide us your current catalog through email to review more. We
hope to be able to order with you and start a long-term friendly,
respectable and solid business partnership. Please we would
appreciate it if you could send us your stock availability via
email if any.
Our payment terms are 15 days net in Europe, 30 days Net in UK
and 30 days net in Asia/USA as we operate with over 5297
suppliers around the globe for the past 50 years now. For
immediate response Send your reply to
robturner.procurement(a)johnlewis-trade.com for us to be able to
treat with care and urgency.
On behalf of our entire team, we wish you a fruitful 2021.
Best Regards
Rob Turner
Head Of Procurement Operations
John Lewis Partnership.
robturner.procurement(a)johnlewis-trade.com
Tel: +44-7451-274090
WhatsApp: +447497483925
www.johnlewis.com
REGISTERED OFFICE: 171 VICTORIA STREET, LONDON SW1E 5NN
This reverts commit e406f12dde1a8375d77ea02d91f313fb1a9c6aec.
Commits from @umn.edu addresses have been found to be submitted in "bad
faith" to try to test the kernel community's ability to review "known
malicious" changes. The result of these submissions can be found in a
paper published at the 42nd IEEE Symposium on Security and Privacy
entitled, "Open Source Insecurity: Stealthily Introducing
Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
of Minnesota) and Kangjie Lu (University of Minnesota).
Because of this, all submissions from this group must be reverted from
the kernel tree and will need to be re-reviewed again to determine if
they actually are a valid fix. Until that work is complete, remove this
change to ensure that no problems are being introduced into the
codebase.
Cc: stable(a)vger.kernel.org # v3.16+
Cc: Guoqing Jiang <gqjiang(a)suse.com>
Cc: Aditya Pakki <pakki001(a)umn.edu>
Cc: Song Liu <songliubraving(a)fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/md/raid10.c | 2 --
drivers/md/raid5.c | 2 --
2 files changed, 4 deletions(-)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index a9ae7d113492..4fec1cdd4207 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3896,8 +3896,6 @@ static int raid10_run(struct mddev *mddev)
set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
mddev->sync_thread = md_register_thread(md_do_sync, mddev,
"reshape");
- if (!mddev->sync_thread)
- goto out_free_conf;
}
return 0;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 5d57a5bd171f..9b2bd50beee7 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7677,8 +7677,6 @@ static int raid5_run(struct mddev *mddev)
set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
mddev->sync_thread = md_register_thread(md_do_sync, mddev,
"reshape");
- if (!mddev->sync_thread)
- goto abort;
}
/* Ok, everything is just fine now */
--
2.31.1
From: Sergei Trofimovich <slyfox(a)gentoo.org>
Subject: mm: page_alloc: ignore init_on_free=1 for debug_pagealloc=1
On !ARCH_SUPPORTS_DEBUG_PAGEALLOC (like ia64) debug_pagealloc=1 implies
page_poison=on:
if (page_poisoning_enabled() ||
(!IS_ENABLED(CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC) &&
debug_pagealloc_enabled()))
static_branch_enable(&_page_poisoning_enabled);
page_poison=on needs to override init_on_free=1.
Before the change it did not work as expected for the following case:
- have PAGE_POISONING=y
- have page_poison unset
- have !ARCH_SUPPORTS_DEBUG_PAGEALLOC arch (like ia64)
- have init_on_free=1
- have debug_pagealloc=1
That way we get both keys enabled:
- static_branch_enable(&init_on_free);
- static_branch_enable(&_page_poisoning_enabled);
which leads to poisoned pages returned for __GFP_ZERO pages.
After the change we execute only:
- static_branch_enable(&_page_poisoning_enabled);
and ignore init_on_free=1.
Link: https://lkml.kernel.org/r/20210329222555.3077928-1-slyfox@gentoo.org
Link: https://lkml.org/lkml/2021/3/26/443
Fixes: 8db26a3d4735 ("mm, page_poison: use static key more efficiently")
Signed-off-by: Sergei Trofimovich <slyfox(a)gentoo.org>
Acked-by: Vlastimil Babka <vbabka(a)suse.cz>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Cc: Andrey Konovalov <andreyknvl(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/page_alloc.c | 30 +++++++++++++++++-------------
1 file changed, 17 insertions(+), 13 deletions(-)
--- a/mm/page_alloc.c~mm-page_alloc-ignore-init_on_free=1-for-debug_pagealloc=1
+++ a/mm/page_alloc.c
@@ -786,32 +786,36 @@ static inline void clear_page_guard(stru
*/
void init_mem_debugging_and_hardening(void)
{
+ bool page_poisoning_requested = false;
+
+#ifdef CONFIG_PAGE_POISONING
+ /*
+ * Page poisoning is debug page alloc for some arches. If
+ * either of those options are enabled, enable poisoning.
+ */
+ if (page_poisoning_enabled() ||
+ (!IS_ENABLED(CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC) &&
+ debug_pagealloc_enabled())) {
+ static_branch_enable(&_page_poisoning_enabled);
+ page_poisoning_requested = true;
+ }
+#endif
+
if (_init_on_alloc_enabled_early) {
- if (page_poisoning_enabled())
+ if (page_poisoning_requested)
pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, "
"will take precedence over init_on_alloc\n");
else
static_branch_enable(&init_on_alloc);
}
if (_init_on_free_enabled_early) {
- if (page_poisoning_enabled())
+ if (page_poisoning_requested)
pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, "
"will take precedence over init_on_free\n");
else
static_branch_enable(&init_on_free);
}
-#ifdef CONFIG_PAGE_POISONING
- /*
- * Page poisoning is debug page alloc for some arches. If
- * either of those options are enabled, enable poisoning.
- */
- if (page_poisoning_enabled() ||
- (!IS_ENABLED(CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC) &&
- debug_pagealloc_enabled()))
- static_branch_enable(&_page_poisoning_enabled);
-#endif
-
#ifdef CONFIG_DEBUG_PAGEALLOC
if (!debug_pagealloc_enabled())
return;
_
This is a note to let you know that I've just added the patch titled
dyndbg: fix parsing file query without a line-range suffix
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 7b1ae248279bea33af9e797a93c35f49601cb8a0 Mon Sep 17 00:00:00 2001
From: Shuo Chen <shuochen(a)google.com>
Date: Wed, 14 Apr 2021 14:24:00 -0700
Subject: dyndbg: fix parsing file query without a line-range suffix
Query like 'file tcp_input.c line 1234 +p' was broken by
commit aaebe329bff0 ("dyndbg: accept 'file foo.c:func1' and 'file
foo.c:10-100'") because a file name without a ':' now makes the loop in
ddebug_parse_query() exits early before parsing the 'line 1234' part.
As a result, all pr_debug() in tcp_input.c will be enabled, instead of only
the one on line 1234. Changing 'break' to 'continue' fixes this.
Fixes: aaebe329bff0 ("dyndbg: accept 'file foo.c:func1' and 'file foo.c:10-100'")
Cc: stable <stable(a)vger.kernel.org>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Signed-off-by: Shuo Chen <shuochen(a)google.com>
Acked-by: Jason Baron <jbaron(a)akamai.com>
Link: https://lore.kernel.org/r/20210414212400.2927281-1-giantchen@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
lib/dynamic_debug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index c70d6347afa2..921d0a654243 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -396,7 +396,7 @@ static int ddebug_parse_query(char *words[], int nwords,
/* tail :$info is function or line-range */
fline = strchr(query->filename, ':');
if (!fline)
- break;
+ continue;
*fline++ = '\0';
if (isalpha(*fline) || *fline == '*' || *fline == '?') {
/* take as function name */
--
2.31.1
I'm announcing the release of the 5.4.115 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/omap3.dtsi | 3
arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-lts.dts | 2
arch/csky/Kconfig | 2
arch/csky/include/asm/page.h | 2
arch/ia64/mm/discontig.c | 6 -
arch/s390/kernel/entry.S | 1
arch/s390/kernel/ptrace.c | 17 +++-
arch/x86/events/intel/core.c | 2
arch/x86/events/intel/uncore_snbep.c | 61 ++++++----------
arch/x86/kernel/crash.c | 2
drivers/gpio/gpio-omap.c | 9 ++
drivers/hid/hid-alps.c | 1
drivers/hid/hid-google-hammer.c | 2
drivers/hid/hid-ids.h | 1
drivers/hid/wacom_wac.c | 2
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2
drivers/net/geneve.c | 6 +
drivers/net/usb/hso.c | 2
drivers/net/xen-netback/xenbus.c | 12 ++-
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6 -
drivers/usb/class/cdc-acm.c | 3
include/linux/platform_data/gpio-omap.h | 3
kernel/locking/qrwlock.c | 7 +
tools/arch/ia64/include/asm/barrier.h | 3
tools/perf/util/auxtrace.c | 2
26 files changed, 94 insertions(+), 67 deletions(-)
Ali Saidi (1):
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Andre Przywara (1):
arm64: dts: allwinner: Revert SD card CD GPIO for Pine64-LTS
Greg Kroah-Hartman (1):
Linux 5.4.115
Jia-Ju Bai (1):
HID: alps: fix error return code in alps_input_configured()
Jiapeng Zhong (1):
HID: wacom: Assign boolean values to a bool variable
Jim Mattson (1):
perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[]
Johan Hovold (1):
net: hso: fix NULL-deref on disconnect regression
John Paul Adrian Glaubitz (1):
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Kan Liang (1):
perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
Leo Yan (1):
perf auxtrace: Fix potential NULL pointer dereference
Michael Brown (1):
xen-netback: Check for hotplug-status existence before watching
Mike Galbraith (1):
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
Oliver Neukum (1):
USB: CDC-ACM: fix poison/unpoison imbalance
Phillip Potter (1):
net: geneve: check skb is large enough for IPv4/IPv6 header
Randy Dunlap (2):
csky: change a Kconfig symbol name to fix e1000 build error
ia64: fix discontig.c section mismatches
Shou-Chieh Hsu (1):
HID: google: add don USB id
Sven Schnelle (1):
s390/ptrace: return -ENOSYS when invalid syscall is supplied
Tony Lindgren (2):
gpio: omap: Save and restore sysconfig
ARM: dts: Fix swapped mmc order for omap3
Vasily Gorbik (1):
s390/entry: save the caller of psw_idle
Wan Jiabing (1):
cavium/liquidio: Fix duplicate argument
Yuanyuan Zhong (1):
pinctrl: lewisburg: Update number of pins in community
I'm announcing the release of the 5.10.33 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/omap3.dtsi | 3
arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-lts.dts | 2
arch/arm64/kernel/probes/kprobes.c | 6
arch/csky/Kconfig | 2
arch/csky/include/asm/page.h | 2
arch/ia64/mm/discontig.c | 6
arch/s390/kernel/entry.S | 1
arch/x86/events/intel/core.c | 2
arch/x86/events/intel/uncore_snbep.c | 61 -
arch/x86/kernel/crash.c | 2
block/ioctl.c | 2
drivers/dma/tegra20-apb-dma.c | 4
drivers/dma/xilinx/xilinx_dpdma.c | 31
drivers/gpio/gpio-omap.c | 9
drivers/hid/hid-alps.c | 1
drivers/hid/hid-cp2112.c | 22
drivers/hid/hid-google-hammer.c | 2
drivers/hid/hid-ids.h | 1
drivers/hid/wacom_wac.c | 2
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2
drivers/net/geneve.c | 6
drivers/net/usb/hso.c | 2
drivers/net/xen-netback/xenbus.c | 12
drivers/pinctrl/core.c | 14
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6
drivers/soc/qcom/qcom-geni-se.c | 3
drivers/usb/class/cdc-acm.c | 3
drivers/vdpa/mlx5/core/mr.c | 4
drivers/vhost/vdpa.c | 6
include/linux/bpf.h | 5
include/linux/bpf_verifier.h | 3
include/linux/platform_data/gpio-omap.h | 3
kernel/bpf/verifier.c | 774 ++++++++++++----
kernel/locking/qrwlock.c | 7
scripts/Makefile.kasan | 12
security/keys/trusted-keys/trusted_tpm2.c | 2
tools/arch/ia64/include/asm/barrier.h | 3
tools/perf/util/auxtrace.c | 2
tools/perf/util/map.c | 7
40 files changed, 744 insertions(+), 295 deletions(-)
Ali Saidi (1):
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Andre Przywara (1):
arm64: dts: allwinner: Revert SD card CD GPIO for Pine64-LTS
Andrei Matei (1):
bpf: Allow variable-offset stack access
Andy Shevchenko (1):
pinctrl: core: Show pin numbers for the controllers with base = 0
Arnd Bergmann (1):
kasan: fix hwasan build for gcc
Christoph Hellwig (1):
block: return -EBUSY when there are open partitions in blkdev_reread_part
Daniel Borkmann (2):
bpf: Refactor and streamline bounds check into helper
bpf: Tighten speculative pointer arithmetic mask
Dinghao Liu (1):
dmaengine: tegra20: Fix runtime PM imbalance on error
Douglas Gilbert (1):
HID cp2112: fix support for multiple gpiochips
Eli Cohen (1):
vdpa/mlx5: Set err = -ENOMEM in case dma_map_sg_attrs fails
Greg Kroah-Hartman (1):
Linux 5.10.33
James Bottomley (1):
KEYS: trusted: Fix TPM reservation for seal/unseal
Jia-Ju Bai (1):
HID: alps: fix error return code in alps_input_configured()
Jiapeng Zhong (1):
HID: wacom: Assign boolean values to a bool variable
Jim Mattson (1):
perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[]
Jisheng Zhang (1):
arm64: kprobes: Restore local irqflag if kprobes is cancelled
Johan Hovold (1):
net: hso: fix NULL-deref on disconnect regression
John Paul Adrian Glaubitz (1):
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Kan Liang (1):
perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
Laurent Pinchart (2):
dmaengine: xilinx: dpdma: Fix descriptor issuing on video group
dmaengine: xilinx: dpdma: Fix race condition in done IRQ
Leo Yan (1):
perf auxtrace: Fix potential NULL pointer dereference
Michael Brown (1):
xen-netback: Check for hotplug-status existence before watching
Mike Galbraith (1):
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
Oliver Neukum (1):
USB: CDC-ACM: fix poison/unpoison imbalance
Phillip Potter (1):
net: geneve: check skb is large enough for IPv4/IPv6 header
Randy Dunlap (2):
csky: change a Kconfig symbol name to fix e1000 build error
ia64: fix discontig.c section mismatches
Shawn Guo (1):
soc: qcom: geni: shield geni_icc_get() for ACPI boot
Shou-Chieh Hsu (1):
HID: google: add don USB id
Tony Lindgren (2):
gpio: omap: Save and restore sysconfig
ARM: dts: Fix swapped mmc order for omap3
Vasily Gorbik (1):
s390/entry: save the caller of psw_idle
Wan Jiabing (1):
cavium/liquidio: Fix duplicate argument
Xie Yongji (1):
vhost-vdpa: protect concurrent access to vhost device iotlb
Yonghong Song (1):
bpf: Permits pointers on stack for helper calls
Yuanyuan Zhong (1):
pinctrl: lewisburg: Update number of pins in community
Zhen Lei (1):
perf map: Fix error return code in maps__clone()
This is a note to let you know that I've just added the patch titled
nitro_enclaves: Fix stale file descriptors on failed usercopy
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From f1ce3986baa62cffc3c5be156994de87524bab99 Mon Sep 17 00:00:00 2001
From: Mathias Krause <minipli(a)grsecurity.net>
Date: Thu, 29 Apr 2021 19:59:41 +0300
Subject: nitro_enclaves: Fix stale file descriptors on failed usercopy
A failing usercopy of the slot uid will lead to a stale entry in the
file descriptor table as put_unused_fd() won't release it. This enables
userland to refer to a dangling 'file' object through that still valid
file descriptor, leading to all kinds of use-after-free exploitation
scenarios.
Exchanging put_unused_fd() for close_fd(), ksys_close() or alike won't
solve the underlying issue, as the file descriptor might have been
replaced in the meantime, e.g. via userland calling close() on it
(leading to a NULL pointer dereference in the error handling code as
'fget(enclave_fd)' will return a NULL pointer) or by dup2()'ing a
completely different file object to that very file descriptor, leading
to the same situation: a dangling file descriptor pointing to a freed
object -- just in this case to a file object of user's choosing.
Generally speaking, after the call to fd_install() the file descriptor
is live and userland is free to do whatever with it. We cannot rely on
it to still refer to our enclave object afterwards. In fact, by abusing
userfaultfd() userland can hit the condition without any racing and
abuse the error handling in the nitro code as it pleases.
To fix the above issues, defer the call to fd_install() until all
possible errors are handled. In this case it's just the usercopy, so do
it directly in ne_create_vm_ioctl() itself.
Signed-off-by: Mathias Krause <minipli(a)grsecurity.net>
Signed-off-by: Andra Paraschiv <andraprs(a)amazon.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20210429165941.27020-2-andraprs@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/virt/nitro_enclaves/ne_misc_dev.c | 43 +++++++++--------------
1 file changed, 17 insertions(+), 26 deletions(-)
diff --git a/drivers/virt/nitro_enclaves/ne_misc_dev.c b/drivers/virt/nitro_enclaves/ne_misc_dev.c
index f1964ea4b826..e21e1e86ad15 100644
--- a/drivers/virt/nitro_enclaves/ne_misc_dev.c
+++ b/drivers/virt/nitro_enclaves/ne_misc_dev.c
@@ -1524,7 +1524,8 @@ static const struct file_operations ne_enclave_fops = {
* enclave file descriptor to be further used for enclave
* resources handling e.g. memory regions and CPUs.
* @ne_pci_dev : Private data associated with the PCI device.
- * @slot_uid: Generated unique slot id associated with an enclave.
+ * @slot_uid: User pointer to store the generated unique slot id
+ * associated with an enclave to.
*
* Context: Process context. This function is called with the ne_pci_dev enclave
* mutex held.
@@ -1532,7 +1533,7 @@ static const struct file_operations ne_enclave_fops = {
* * Enclave fd on success.
* * Negative return value on failure.
*/
-static int ne_create_vm_ioctl(struct ne_pci_dev *ne_pci_dev, u64 *slot_uid)
+static int ne_create_vm_ioctl(struct ne_pci_dev *ne_pci_dev, u64 __user *slot_uid)
{
struct ne_pci_dev_cmd_reply cmd_reply = {};
int enclave_fd = -1;
@@ -1634,7 +1635,18 @@ static int ne_create_vm_ioctl(struct ne_pci_dev *ne_pci_dev, u64 *slot_uid)
list_add(&ne_enclave->enclave_list_entry, &ne_pci_dev->enclaves_list);
- *slot_uid = ne_enclave->slot_uid;
+ if (copy_to_user(slot_uid, &ne_enclave->slot_uid, sizeof(ne_enclave->slot_uid))) {
+ /*
+ * As we're holding the only reference to 'enclave_file', fput()
+ * will call ne_enclave_release() which will do a proper cleanup
+ * of all so far allocated resources, leaving only the unused fd
+ * for us to free.
+ */
+ fput(enclave_file);
+ put_unused_fd(enclave_fd);
+
+ return -EFAULT;
+ }
fd_install(enclave_fd, enclave_file);
@@ -1671,34 +1683,13 @@ static long ne_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
switch (cmd) {
case NE_CREATE_VM: {
int enclave_fd = -1;
- struct file *enclave_file = NULL;
struct ne_pci_dev *ne_pci_dev = ne_devs.ne_pci_dev;
- int rc = -EINVAL;
- u64 slot_uid = 0;
+ u64 __user *slot_uid = (void __user *)arg;
mutex_lock(&ne_pci_dev->enclaves_list_mutex);
-
- enclave_fd = ne_create_vm_ioctl(ne_pci_dev, &slot_uid);
- if (enclave_fd < 0) {
- rc = enclave_fd;
-
- mutex_unlock(&ne_pci_dev->enclaves_list_mutex);
-
- return rc;
- }
-
+ enclave_fd = ne_create_vm_ioctl(ne_pci_dev, slot_uid);
mutex_unlock(&ne_pci_dev->enclaves_list_mutex);
- if (copy_to_user((void __user *)arg, &slot_uid, sizeof(slot_uid))) {
- enclave_file = fget(enclave_fd);
- /* Decrement file refs to have release() called. */
- fput(enclave_file);
- fput(enclave_file);
- put_unused_fd(enclave_fd);
-
- return -EFAULT;
- }
-
return enclave_fd;
}
--
2.31.1
An issue was found in the Nitro Enclaves kernel driver codebase [1] included in
the v5.10 upstream Linux kernel. The fix for it has been tested on the AWS side.
The issue does not break the isolation or security of what is running inside the
enclave. Nitro Enclaves already assumes that the instance running the Nitro
Enclaves kernel driver is untrusted.
We would like to thank Mathias Krause from Open Source Security, Inc. for
reporting and providing a fix for this issue directly to AWS.
The patch will be merged into the latest upstream Linux kernel release and into
the v5.10+ stable kernel releases.
Thanks,
Andra
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/dri…
Mathias Krause (1):
nitro_enclaves: Fix stale file descriptors on failed usercopy
drivers/virt/nitro_enclaves/ne_misc_dev.c | 43 +++++++++--------------
1 file changed, 17 insertions(+), 26 deletions(-)
--
2.20.1 (Apple Git-117)
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
I believe there are some issues introduced by
commit 31651c607151 ("hfsplus: avoid deadlock on file truncation")
HFS+ has extent records which always contains 8 extents. In case the
first extent record in catalog file gets full, new ones are allocated
from extents overflow file.
In case shrinking truncate happens to middle of an extent record which
locates in extents overflow file, the logic in hfsplus_file_truncate()
was changed so that call to hfs_brec_remove() is not guarded any more.
Right action would be just freeing the extents that exceed the new
size inside extent record by calling hfsplus_free_extents(), and then
check if the whole extent record should be removed. However since the
guard (blk_cnt > start) is now after the call to hfs_brec_remove(),
this has unfortunate effect that the last matching extent record is
removed unconditionally.
To reproduce this issue, create a file which has at least 10 extents,
and then perform shrinking truncate into middle of the last extent
record, so that the number of remaining extents is not under or
divisible by 8. This causes the last extent record (8 extents) to be
removed totally instead of truncating into middle of it. Thus this
causes corruption, and lost data.
Fix for this is simply checking if the new truncated end is below the
start of this extent record, making it safe to remove the full extent
record. However call to hfs_brec_remove() can't be moved to it's
previous place since we're dropping ->tree_lock and it can cause a race
condition and the cached info being invalidated possibly corrupting the
node data.
Another issue is related to this one. When entering into the block
(blk_cnt > start) we are not holding the ->tree_lock. We break out from
the loop not holding the lock, but hfs_find_exit() does unlock it. Not
sure if it's possible for someone else to take the lock under our feet,
but it can cause hard to debug errors and premature unlocking. Even if
there's no real risk of it, the locking should still always be kept in
balance. Thus taking the lock now just before the check.
Cc: <stable(a)vger.kernel.org>
Cc: <linux-fsdevel(a)vger.kernel.org>
Reviewed-by: Anton Altaparmakov <anton(a)tuxera.com>
Signed-off-by: Jouni Roivas <jouni.roivas(a)tuxera.com>
---
fs/hfsplus/extents.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
index a930ddd15681..7054a542689f 100644
--- a/fs/hfsplus/extents.c
+++ b/fs/hfsplus/extents.c
@@ -598,13 +598,15 @@ void hfsplus_file_truncate(struct inode *inode)
res = __hfsplus_ext_cache_extent(&fd, inode, alloc_cnt);
if (res)
break;
- hfs_brec_remove(&fd);
- mutex_unlock(&fd.tree->tree_lock);
start = hip->cached_start;
+ if (blk_cnt <= start)
+ hfs_brec_remove(&fd);
+ mutex_unlock(&fd.tree->tree_lock);
hfsplus_free_extents(sb, hip->cached_extents,
alloc_cnt - start, alloc_cnt - blk_cnt);
hfsplus_dump_extent(hip->cached_extents);
+ mutex_lock(&fd.tree->tree_lock);
if (blk_cnt > start) {
hip->extent_state |= HFSPLUS_EXT_DIRTY;
break;
@@ -612,7 +614,6 @@ void hfsplus_file_truncate(struct inode *inode)
alloc_cnt = start;
hip->cached_start = hip->cached_blocks = 0;
hip->extent_state &= ~(HFSPLUS_EXT_DIRTY | HFSPLUS_EXT_NEW);
- mutex_lock(&fd.tree->tree_lock);
}
hfs_find_exit(&fd);
--
2.25.1
From: Kan Liang <kan.liang(a)linux.intel.com>
Perf tool errors out with the latest event list for the Ice Lake server.
event syntax error: 'unc_m2m_imc_reads.to_pmm'
\___ value too big for format, maximum is 255
The same as the Snow Ridge server, the M2M uncore unit in the Ice Lake
server has the unit mask extension field as well.
Fixes: 2b3b76b5ec67 ("perf/x86/intel/uncore: Add Ice Lake server uncore support")
Reported-by: Jin Yao <yao.jin(a)linux.intel.com>
Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
---
arch/x86/events/intel/uncore_snbep.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index acc3c0e5..06c055d 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -5106,9 +5106,10 @@ static struct intel_uncore_type icx_uncore_m2m = {
.perf_ctr = SNR_M2M_PCI_PMON_CTR0,
.event_ctl = SNR_M2M_PCI_PMON_CTL0,
.event_mask = SNBEP_PMON_RAW_EVENT_MASK,
+ .event_mask_ext = SNR_M2M_PCI_PMON_UMASK_EXT,
.box_ctl = SNR_M2M_PCI_PMON_BOX_CTL,
.ops = &snr_m2m_uncore_pci_ops,
- .format_group = &skx_uncore_format_group,
+ .format_group = &snr_m2m_uncore_format_group,
};
static struct attribute *icx_upi_uncore_formats_attr[] = {
--
2.7.4
Hello,
I hope things have been awesome!
I’m jotting you a quick note to let you know that I’m currently
searching for a new career opportunity in Computing Network.
For a greater understanding of my professional qualifications, you can
find my resume attached to this email.
If you hear of anything within your own network that you think might
fit the bill, I’d so appreciate if you could send a heads up my way.
Let me know if I can ever return the favor. I’m happy to do so!
Thanks,
The Elgato Cam Link 4K HDMI video capture card reports to support three
different pixel formats, where the first format depends on the connected
HDMI device.
```
$ v4l2-ctl -d /dev/video0 --list-formats-ext
ioctl: VIDIOC_ENUM_FMT
Type: Video Capture
[0]: 'NV12' (Y/CbCr 4:2:0)
Size: Discrete 3840x2160
Interval: Discrete 0.033s (29.970 fps)
[1]: 'NV12' (Y/CbCr 4:2:0)
Size: Discrete 3840x2160
Interval: Discrete 0.033s (29.970 fps)
[2]: 'YU12' (Planar YUV 4:2:0)
Size: Discrete 3840x2160
Interval: Discrete 0.033s (29.970 fps)
```
Changing the pixel format to anything besides the first pixel format
does not work:
```
v4l2-ctl -d /dev/video0 --try-fmt-video pixelformat=YU12
Format Video Capture:
Width/Height : 3840/2160
Pixel Format : 'NV12' (Y/CbCr 4:2:0)
Field : None
Bytes per Line : 3840
Size Image : 12441600
Colorspace : sRGB
Transfer Function : Rec. 709
YCbCr/HSV Encoding: Rec. 709
Quantization : Default (maps to Limited Range)
Flags :
```
User space applications like VLC might show an error message on the
terminal in that case:
```
libv4l2: error set_fmt gave us a different result than try_fmt!
```
Depending on the error handling of the user space applications, they
might display a distorted video, because they use the wrong pixel format
for decoding the stream.
The Elgato Cam Link 4K responds to the USB video probe
VS_PROBE_CONTROL/VS_COMMIT_CONTROL with a malformed data structure: The
second byte contains bFormatIndex (instead of being the second byte of
bmHint). The first byte is always zero. The third byte is always 1.
The firmware bug was reported to Elgato on 2020-12-01 and it was
forwarded by the support team to the developers as feature request.
There is no firmware update available since then. The latest firmware
for Elgato Cam Link 4K as of 2021-03-23 has MCU 20.02.19 and FPGA 67.
Therefore add a quirk to correct the malformed data structure.
The quirk was successfully tested with VLC, OBS, and Chromium using
different pixel formats (YUYV, NV12, YU12), resolutions (3840x2160,
1920x1080), and frame rates (29.970 and 59.940 fps).
Cc: stable(a)vger.kernel.org
Signed-off-by: Benjamin Drung <bdrung(a)posteo.de>
---
drivers/media/usb/uvc/uvc_driver.c | 13 +++++++++++++
drivers/media/usb/uvc/uvc_video.c | 21 +++++++++++++++++++++
drivers/media/usb/uvc/uvcvideo.h | 1 +
3 files changed, 35 insertions(+)
I am resending this patch since I got no response in the last three
weeks.
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 9a791d8ef200..6ce58950d78b 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -3164,6 +3164,19 @@ static const struct usb_device_id uvc_ids[] = {
.bInterfaceSubClass = 1,
.bInterfaceProtocol = 0,
.driver_info = UVC_INFO_META(V4L2_META_FMT_D4XX) },
+ /*
+ * Elgato Cam Link 4K
+ * Latest firmware as of 2021-03-23 needs this quirk.
+ * MCU: 20.02.19, FPGA: 67
+ */
+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
+ | USB_DEVICE_ID_MATCH_INT_INFO,
+ .idVendor = 0x0fd9,
+ .idProduct = 0x0066,
+ .bInterfaceClass = USB_CLASS_VIDEO,
+ .bInterfaceSubClass = 1,
+ .bInterfaceProtocol = 0,
+ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_FIX_FORMAT_INDEX) },
/* Generic USB Video Class */
{ USB_INTERFACE_INFO(USB_CLASS_VIDEO, 1, UVC_PC_PROTOCOL_UNDEFINED) },
{ USB_INTERFACE_INFO(USB_CLASS_VIDEO, 1, UVC_PC_PROTOCOL_15) },
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index f2f565281e63..06a538d1008b 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -128,6 +128,27 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
struct uvc_frame *frame = NULL;
unsigned int i;
+ /*
+ * The response of the Elgato Cam Link 4K is incorrect: The second byte
+ * contains bFormatIndex (instead of being the second byte of bmHint).
+ * The first byte is always zero. The third byte is always 1.
+ *
+ * The UVC 1.5 class specification defines the first five bits in the
+ * bmHint bitfield. The remaining bits are reserved and should be zero.
+ * Therefore a valid bmHint will be less than 32.
+ */
+ if (stream->dev->quirks & UVC_QUIRK_FIX_FORMAT_INDEX && ctrl->bmHint > 255) {
+ __u8 corrected_format_index;
+
+ corrected_format_index = ctrl->bmHint >> 8;
+ uvc_dbg(stream->dev, CONTROL,
+ "Correct USB video probe response from {bmHint: 0x%04x, bFormatIndex: 0x%02x} to {bmHint: 0x%04x, bFormatIndex: 0x%02x}.\n",
+ ctrl->bmHint, ctrl->bFormatIndex,
+ ctrl->bFormatIndex, corrected_format_index);
+ ctrl->bmHint = ctrl->bFormatIndex;
+ ctrl->bFormatIndex = corrected_format_index;
+ }
+
for (i = 0; i < stream->nformats; ++i) {
if (stream->format[i].index == ctrl->bFormatIndex) {
format = &stream->format[i];
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 97df5ecd66c9..bf401d5ba27d 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -209,6 +209,7 @@
#define UVC_QUIRK_RESTORE_CTRLS_ON_INIT 0x00000400
#define UVC_QUIRK_FORCE_Y8 0x00000800
#define UVC_QUIRK_FORCE_BPP 0x00001000
+#define UVC_QUIRK_FIX_FORMAT_INDEX 0x00002000
/* Format flags */
#define UVC_FMT_FLAG_COMPRESSED 0x00000001
--
2.27.0
When encoder validation of a display mode fails, retry with less bandwidth
heavy YCbCr420 color mode, if available. This enables some HDMI 1.4 setups
to support 4k60Hz output, which previously failed silently.
AMDGPU had nearly the exact same issue. This problem description is
therefore copied from my commit message of the AMDGPU patch.
On some setups, while the monitor and the gpu support display modes with
pixel clocks of up to 600MHz, the link encoder might not. This prevents
YCbCr444 and RGB encoding for 4k60Hz, but YCbCr420 encoding might still be
possible. However, which color mode is used is decided before the link
encoder capabilities are checked. This patch fixes the problem by retrying
to find a display mode with YCbCr420 enforced and using it, if it is
valid.
I'm not entierly sure if the second
"if (HAS_PCH_SPLIT(dev_priv) && !HAS_DDI(dev_priv))" check in
intel_hdmi_compute_config(...) after forcing ycbcr420 is necessary. I
included it to better be safe then sorry.
Signed-off-by: Werner Sembach <wse(a)tuxedocomputers.com>
Cc: <stable(a)vger.kernel.org>
---
>From c7499210af78e15a2aea2178000958f26e0d43a0 Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse(a)tuxedocomputers.com>
Date: Tue, 30 Mar 2021 15:07:34 +0200
Subject: [PATCH] Retry using YCbCr420 encoding if clock setup for RGB fails
---
drivers/gpu/drm/i915/display/intel_hdmi.c | 78 +++++++++++++++++------
1 file changed, 59 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.c b/drivers/gpu/drm/i915/display/intel_hdmi.c
index 95919d325b0b..273685c0e395 100644
--- a/drivers/gpu/drm/i915/display/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/display/intel_hdmi.c
@@ -2233,6 +2233,29 @@ hdmi_port_clock_valid(struct intel_hdmi *hdmi,
return MODE_OK;
}
+static enum drm_mode_status
+intel_hdmi_check_bpc(struct intel_hdmi *hdmi, int clock, bool has_hdmi_sink, struct drm_i915_private *dev_priv)
+{
+ enum drm_mode_status status;
+
+ /* check if we can do 8bpc */
+ status = hdmi_port_clock_valid(hdmi, clock, true, has_hdmi_sink);
+
+ if (has_hdmi_sink) {
+ /* if we can't do 8bpc we may still be able to do 12bpc */
+ if (status != MODE_OK && !HAS_GMCH(dev_priv))
+ status = hdmi_port_clock_valid(hdmi, clock * 3 / 2,
+ true, has_hdmi_sink);
+
+ /* if we can't do 8,12bpc we may still be able to do 10bpc */
+ if (status != MODE_OK && INTEL_GEN(dev_priv) >= 11)
+ status = hdmi_port_clock_valid(hdmi, clock * 5 / 4,
+ true, has_hdmi_sink);
+ }
+
+ return status;
+}
+
static enum drm_mode_status
intel_hdmi_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
@@ -2263,22 +2286,18 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
if (drm_mode_is_420_only(&connector->display_info, mode))
clock /= 2;
- /* check if we can do 8bpc */
- status = hdmi_port_clock_valid(hdmi, clock, true, has_hdmi_sink);
+ status = intel_hdmi_check_bpc(hdmi, clock, has_hdmi_sink, dev_priv);
- if (has_hdmi_sink) {
- /* if we can't do 8bpc we may still be able to do 12bpc */
- if (status != MODE_OK && !HAS_GMCH(dev_priv))
- status = hdmi_port_clock_valid(hdmi, clock * 3 / 2,
- true, has_hdmi_sink);
+ if (status != MODE_OK) {
+ if (drm_mode_is_420_also(&connector->display_info, mode)) {
+ /* if we can't do full color resolution we may still be able to do reduced color resolution */
+ clock /= 2;
- /* if we can't do 8,12bpc we may still be able to do 10bpc */
- if (status != MODE_OK && INTEL_GEN(dev_priv) >= 11)
- status = hdmi_port_clock_valid(hdmi, clock * 5 / 4,
- true, has_hdmi_sink);
+ status = intel_hdmi_check_bpc(hdmi, clock, has_hdmi_sink, dev_priv);
+ }
+ if (status != MODE_OK)
+ return status;
}
- if (status != MODE_OK)
- return status;
return intel_mode_valid_max_plane_size(dev_priv, mode, false);
}
@@ -2361,14 +2380,17 @@ static bool hdmi_deep_color_possible(const struct intel_crtc_state *crtc_state,
static int
intel_hdmi_ycbcr420_config(struct intel_crtc_state *crtc_state,
- const struct drm_connector_state *conn_state)
+ const struct drm_connector_state *conn_state,
+ const bool force_ycbcr420)
{
struct drm_connector *connector = conn_state->connector;
struct drm_i915_private *i915 = to_i915(connector->dev);
const struct drm_display_mode *adjusted_mode =
&crtc_state->hw.adjusted_mode;
- if (!drm_mode_is_420_only(&connector->display_info, adjusted_mode))
+ if (!(drm_mode_is_420_only(&connector->display_info, adjusted_mode) ||
+ (force_ycbcr420 &&
+ drm_mode_is_420_also(&connector->display_info, adjusted_mode))))
return 0;
if (!connector->ycbcr_420_allowed) {
@@ -2507,7 +2529,7 @@ int intel_hdmi_compute_config(struct intel_encoder *encoder,
struct drm_display_mode *adjusted_mode = &pipe_config->hw.adjusted_mode;
struct drm_connector *connector = conn_state->connector;
struct drm_scdc *scdc = &connector->display_info.hdmi.scdc;
- int ret;
+ int ret, ret_saved;
if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN)
return -EINVAL;
@@ -2522,7 +2544,7 @@ int intel_hdmi_compute_config(struct intel_encoder *encoder,
if (adjusted_mode->flags & DRM_MODE_FLAG_DBLCLK)
pipe_config->pixel_multiplier = 2;
- ret = intel_hdmi_ycbcr420_config(pipe_config, conn_state);
+ ret = intel_hdmi_ycbcr420_config(pipe_config, conn_state, false);
if (ret)
return ret;
@@ -2536,8 +2558,26 @@ int intel_hdmi_compute_config(struct intel_encoder *encoder,
intel_hdmi_has_audio(encoder, pipe_config, conn_state);
ret = intel_hdmi_compute_clock(encoder, pipe_config);
- if (ret)
- return ret;
+ if (ret) {
+ ret_saved = ret;
+
+ ret = intel_hdmi_ycbcr420_config(pipe_config, conn_state, true);
+ if (ret)
+ return ret;
+
+ if (pipe_config->output_format != INTEL_OUTPUT_FORMAT_YCBCR420)
+ return ret_saved;
+
+ pipe_config->limited_color_range =
+ intel_hdmi_limited_color_range(pipe_config, conn_state);
+
+ if (HAS_PCH_SPLIT(dev_priv) && !HAS_DDI(dev_priv))
+ pipe_config->has_pch_encoder = true;
+
+ ret = intel_hdmi_compute_clock(encoder, pipe_config);
+ if (ret)
+ return ret;
+ }
if (conn_state->picture_aspect_ratio)
adjusted_mode->picture_aspect_ratio =
--
2.25.1
Hi all,
This series of backports fixes the SWIOTLB library to maintain the
page offset when mapping a DMA address. The bug that motivated this
patch series manifested when running a 5.4 kernel as a SEV guest with
an NVMe device. However, any device that infers information from the
page offset and is accessed through the SWIOTLB will benefit from this
bug fix.
Jianxiong Gao (8):
driver core: add a min_align_mask field to struct
device_dma_parameters
swiotlb: factor out an io_tlb_offset helper
swiotlb: factor out a nr_slots helper
swiotlb: clean up swiotlb_tbl_unmap_single
swiotlb: refactor swiotlb_tbl_map_single
swiotlb: don't modify orig_addr in swiotlb_tbl_sync_single
swiotlb: respect min_align_mask
nvme-pci: set min_align_mask
drivers/nvme/host/pci.c | 1 +
include/linux/device.h | 1 +
include/linux/dma-mapping.h | 16 +++
include/linux/swiotlb.h | 1 +
kernel/dma/swiotlb.c | 256 ++++++++++++++++++++----------------
5 files changed, 160 insertions(+), 115 deletions(-)
--
2.27.0
I'm announcing the release of the 5.11.17 kernel.
All users of the 5.11 kernel series must upgrade.
The updated 5.11.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.11.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/omap3.dtsi | 3
arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-lts.dts | 2
arch/arm64/kernel/probes/kprobes.c | 6
arch/csky/Kconfig | 2
arch/csky/include/asm/page.h | 2
arch/ia64/mm/discontig.c | 6
arch/m68k/include/asm/page_mm.h | 2
arch/s390/kernel/entry.S | 1
arch/x86/events/intel/core.c | 2
arch/x86/events/intel/uncore_snbep.c | 61 -
arch/x86/kernel/crash.c | 2
block/ioctl.c | 2
drivers/dma/tegra20-apb-dma.c | 4
drivers/dma/xilinx/xilinx_dpdma.c | 31
drivers/gpio/gpio-omap.c | 9
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 10
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11
drivers/hid/hid-alps.c | 1
drivers/hid/hid-asus.c | 3
drivers/hid/hid-cp2112.c | 22
drivers/hid/hid-google-hammer.c | 2
drivers/hid/hid-ids.h | 2
drivers/hid/wacom_wac.c | 2
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2
drivers/net/geneve.c | 6
drivers/net/usb/hso.c | 2
drivers/net/xen-netback/xenbus.c | 12
drivers/pinctrl/core.c | 14
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6
drivers/soc/qcom/qcom-geni-se.c | 3
drivers/usb/class/cdc-acm.c | 3
drivers/vdpa/mlx5/core/mr.c | 4
drivers/vhost/vdpa.c | 6
fs/coda/file.c | 6
fs/overlayfs/file.c | 11
include/linux/bpf.h | 5
include/linux/bpf_verifier.h | 3
include/linux/platform_data/gpio-omap.h | 3
kernel/bpf/verifier.c | 771 ++++++++++++----
kernel/locking/qrwlock.c | 7
security/keys/trusted-keys/trusted_tpm2.c | 2
tools/arch/ia64/include/asm/barrier.h | 3
tools/perf/util/auxtrace.c | 2
tools/perf/util/map.c | 7
46 files changed, 758 insertions(+), 312 deletions(-)
Ali Saidi (1):
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Andre Przywara (1):
arm64: dts: allwinner: Revert SD card CD GPIO for Pine64-LTS
Andrei Matei (1):
bpf: Allow variable-offset stack access
Andy Shevchenko (1):
pinctrl: core: Show pin numbers for the controllers with base = 0
Angelo Dureghello (1):
m68k: fix flatmem memory model setup
Christian König (2):
ovl: fix reference counting in ovl_mmap error path
coda: fix reference counting in coda_file_mmap error path
Christoph Hellwig (1):
block: return -EBUSY when there are open partitions in blkdev_reread_part
Daniel Borkmann (2):
bpf: Refactor and streamline bounds check into helper
bpf: Tighten speculative pointer arithmetic mask
Dinghao Liu (1):
dmaengine: tegra20: Fix runtime PM imbalance on error
Douglas Gilbert (1):
HID cp2112: fix support for multiple gpiochips
Eli Cohen (1):
vdpa/mlx5: Set err = -ENOMEM in case dma_map_sg_attrs fails
Greg Kroah-Hartman (1):
Linux 5.11.17
James Bottomley (1):
KEYS: trusted: Fix TPM reservation for seal/unseal
Jia-Ju Bai (1):
HID: alps: fix error return code in alps_input_configured()
Jiansong Chen (1):
drm/amdgpu: fix GCR_GENERAL_CNTL offset for dimgrey_cavefish
Jiapeng Zhong (1):
HID: wacom: Assign boolean values to a bool variable
Jim Mattson (1):
perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[]
Jisheng Zhang (1):
arm64: kprobes: Restore local irqflag if kprobes is cancelled
Johan Hovold (1):
net: hso: fix NULL-deref on disconnect regression
John Paul Adrian Glaubitz (1):
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Kan Liang (1):
perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
Laurent Pinchart (2):
dmaengine: xilinx: dpdma: Fix descriptor issuing on video group
dmaengine: xilinx: dpdma: Fix race condition in done IRQ
Leo Yan (1):
perf auxtrace: Fix potential NULL pointer dereference
Luke D Jones (1):
HID: asus: Add support for 2021 ASUS N-Key keyboard
Michael Brown (1):
xen-netback: Check for hotplug-status existence before watching
Mike Galbraith (1):
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
Oliver Neukum (1):
USB: CDC-ACM: fix poison/unpoison imbalance
Philip Yang (1):
drm/amdgpu: reserve fence slot to update page table
Phillip Potter (1):
net: geneve: check skb is large enough for IPv4/IPv6 header
Randy Dunlap (2):
csky: change a Kconfig symbol name to fix e1000 build error
ia64: fix discontig.c section mismatches
Shawn Guo (1):
soc: qcom: geni: shield geni_icc_get() for ACPI boot
Shou-Chieh Hsu (1):
HID: google: add don USB id
Simon Ser (1):
amd/display: allow non-linear multi-planar formats
Tony Lindgren (2):
gpio: omap: Save and restore sysconfig
ARM: dts: Fix swapped mmc order for omap3
Vasily Gorbik (1):
s390/entry: save the caller of psw_idle
Wan Jiabing (1):
cavium/liquidio: Fix duplicate argument
Xie Yongji (1):
vhost-vdpa: protect concurrent access to vhost device iotlb
Yuanyuan Zhong (1):
pinctrl: lewisburg: Update number of pins in community
Zhen Lei (1):
perf map: Fix error return code in maps__clone()
From: Zhen Lei <thunder.leizhen(a)huawei.com>
[ Upstream commit f2211881e737cade55e0ee07cf6a26d91a35a6fe ]
Although 'ret' has been initialized to -1, but it will be reassigned by
the "ret = open(...)" statement in the for loop. So that, the value of
'ret' is unknown when asprintf() failed.
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Link: http://lore.kernel.org/lkml/20210415083417.3740-1-thunder.leizhen@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
tools/perf/util/data.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index 88fba2ba549f..7534455ffc6a 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -35,7 +35,7 @@ void perf_data__close_dir(struct perf_data *data)
int perf_data__create_dir(struct perf_data *data, int nr)
{
struct perf_data_file *files = NULL;
- int i, ret = -1;
+ int i, ret;
if (WARN_ON(!data->is_dir))
return -EINVAL;
@@ -51,7 +51,8 @@ int perf_data__create_dir(struct perf_data *data, int nr)
for (i = 0; i < nr; i++) {
struct perf_data_file *file = &files[i];
- if (asprintf(&file->path, "%s/data.%d", data->path, i) < 0)
+ ret = asprintf(&file->path, "%s/data.%d", data->path, i);
+ if (ret < 0)
goto out_err;
ret = open(file->path, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
--
2.30.2
From: Zhen Lei <thunder.leizhen(a)huawei.com>
[ Upstream commit f2211881e737cade55e0ee07cf6a26d91a35a6fe ]
Although 'ret' has been initialized to -1, but it will be reassigned by
the "ret = open(...)" statement in the for loop. So that, the value of
'ret' is unknown when asprintf() failed.
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Link: http://lore.kernel.org/lkml/20210415083417.3740-1-thunder.leizhen@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
tools/perf/util/data.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index c47aa34fdc0a..5d97b3e45fbb 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -35,7 +35,7 @@ void perf_data__close_dir(struct perf_data *data)
int perf_data__create_dir(struct perf_data *data, int nr)
{
struct perf_data_file *files = NULL;
- int i, ret = -1;
+ int i, ret;
if (WARN_ON(!data->is_dir))
return -EINVAL;
@@ -51,7 +51,8 @@ int perf_data__create_dir(struct perf_data *data, int nr)
for (i = 0; i < nr; i++) {
struct perf_data_file *file = &files[i];
- if (asprintf(&file->path, "%s/data.%d", data->path, i) < 0)
+ ret = asprintf(&file->path, "%s/data.%d", data->path, i);
+ if (ret < 0)
goto out_err;
ret = open(file->path, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
--
2.30.2
From: Zhen Lei <thunder.leizhen(a)huawei.com>
[ Upstream commit f2211881e737cade55e0ee07cf6a26d91a35a6fe ]
Although 'ret' has been initialized to -1, but it will be reassigned by
the "ret = open(...)" statement in the for loop. So that, the value of
'ret' is unknown when asprintf() failed.
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Link: http://lore.kernel.org/lkml/20210415083417.3740-1-thunder.leizhen@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
tools/perf/util/data.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index f29af4fc3d09..8fca4779ae6a 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -35,7 +35,7 @@ void perf_data__close_dir(struct perf_data *data)
int perf_data__create_dir(struct perf_data *data, int nr)
{
struct perf_data_file *files = NULL;
- int i, ret = -1;
+ int i, ret;
if (WARN_ON(!data->is_dir))
return -EINVAL;
@@ -51,7 +51,8 @@ int perf_data__create_dir(struct perf_data *data, int nr)
for (i = 0; i < nr; i++) {
struct perf_data_file *file = &files[i];
- if (asprintf(&file->path, "%s/data.%d", data->path, i) < 0)
+ ret = asprintf(&file->path, "%s/data.%d", data->path, i);
+ if (ret < 0)
goto out_err;
ret = open(file->path, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
--
2.30.2
DIPM is unsupported or broken on sunxi. Trying to enable the power
management policy med_power_with_dipm on an Allwinner A20 SoC based board
leads to immediate I/O errors and the attached SATA disk disappears from
the /dev filesystem. A reset (power cycle) is required to make the SATA
controller or disk work again. The A10 and A20 SoC data sheets and manuals
don't mention DIPM at all [1], so it's fair to assume that it's simply not
supported. But even if it were, it should be considered broken and best be
disabled in the ahci_sunxi driver.
Fixes: c5754b5220f0 ("ARM: sunxi: Add support for Allwinner SUNXi SoCs sata to ahci_platform")
[1] https://github.com/allwinner-zh/documents/tree/master/
Signed-off-by: Timo Sigurdsson <public_timo.s(a)silentcreek.de>
Tested-by: Timo Sigurdsson <public_timo.s(a)silentcreek.de>
---
drivers/ata/ahci_sunxi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/ahci_sunxi.c b/drivers/ata/ahci_sunxi.c
index cb69b737cb49..56b695136977 100644
--- a/drivers/ata/ahci_sunxi.c
+++ b/drivers/ata/ahci_sunxi.c
@@ -200,7 +200,7 @@ static void ahci_sunxi_start_engine(struct ata_port *ap)
}
static const struct ata_port_info ahci_sunxi_port_info = {
- .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ,
+ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ | ATA_FLAG_NO_DIPM,
.pio_mask = ATA_PIO4,
.udma_mask = ATA_UDMA6,
.port_ops = &ahci_platform_ops,
--
2.26.2
From: Martin Wilck <mwilck(a)suse.com>
We have observed a few crashes run_timer_softirq(), where a broken
timer_list struct belonging to an anatt_timer was encountered. The broken
structures look like this, and we see actually multiple ones attached to
the same timer base:
crash> struct timer_list 0xffff92471bcfdc90
struct timer_list {
entry = {
next = 0xdead000000000122, // LIST_POISON2
pprev = 0x0
},
expires = 4296022933,
function = 0xffffffffc06de5e0 <nvme_anatt_timeout>,
flags = 20
}
If such a timer is encountered in run_timer_softirq(), the kernel
crashes. The test scenario was an I/O load test with lots of NVMe
controllers, some of which were removed and re-added on the storage side.
I think this may happen if the rdma recovery_work starts, in this call
chain:
nvme_rdma_error_recovery_work()
/* this stops all sorts of activity for the controller, but not
the multipath-related work queue and timer */
nvme_rdma_reconnect_or_remove(ctrl)
=> kicks reconnect_work
work queue: reconnect_work
nvme_rdma_reconnect_ctrl_work()
nvme_rdma_setup_ctrl()
nvme_rdma_configure_admin_queue()
nvme_init_identify()
nvme_mpath_init()
# this sets some fields of the timer_list without taking a lock
timer_setup()
nvme_read_ana_log()
mod_timer() or del_timer_sync()
Similar for TCP. The idea for the patch is based on the observation that
nvme_rdma_reset_ctrl_work() calls nvme_stop_ctrl()->nvme_mpath_stop(),
whereas nvme_rdma_error_recovery_work() stops only the keepalive timer, but
not the anatt timer.
I admit that the root cause analysis isn't rock solid yet. In particular, I
can't explain why we see LIST_POISON2 in the "next" pointer, which would
indicate that the timer has been detached before; yet we find it linked to
the timer base when the crash occurs.
OTOH, the anatt_timer is only touched in nvme_mpath_init() (see above) and
nvme_mpath_stop(), so the hypothesis that modifying active timers may cause
the issue isn't totally out of sight. I suspect that the LIST_POISON2 may
come to pass in multiple steps.
If anyone has better ideas, please advise. The issue occurs very
sporadically; verifying this by testing will be difficult.
Signed-off-by: Martin Wilck <mwilck(a)suse.com>
Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me>
Reviewed-by: Chao Leng <lengchao(a)huawei.com>
Cc: stable(a)vger.kernel.org
----
Changes in v3: Changed the subject line, as suggested by Sagi Grimberg
Changes in v2: Moved call to nvme_mpath_stop() further down, directly before
the call of nvme_rdma_reconnect_or_remove() (Chao Leng)
---
drivers/nvme/host/multipath.c | 1 +
drivers/nvme/host/rdma.c | 1 +
drivers/nvme/host/tcp.c | 1 +
3 files changed, 3 insertions(+)
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index a1d476e1ac02..c63dd5dfa7ff 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -586,6 +586,7 @@ void nvme_mpath_stop(struct nvme_ctrl *ctrl)
del_timer_sync(&ctrl->anatt_timer);
cancel_work_sync(&ctrl->ana_work);
}
+EXPORT_SYMBOL_GPL(nvme_mpath_stop);
#define SUBSYS_ATTR_RW(_name, _mode, _show, _store) \
struct device_attribute subsys_attr_##_name = \
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index be905d4fdb47..fc07a7b0dc1d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1202,6 +1202,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
return;
}
+ nvme_mpath_stop(&ctrl->ctrl);
nvme_rdma_reconnect_or_remove(ctrl);
}
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index a0f00cb8f9f3..46287b4f4d10 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -2068,6 +2068,7 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work)
return;
}
+ nvme_mpath_stop(ctrl);
nvme_tcp_reconnect_or_remove(ctrl);
}
--
2.31.1
This is the start of the stable review cycle for the 4.19.189 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Apr 2021 07:28:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.189-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.189-rc1
Mike Galbraith <efault(a)gmx.de>
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Randy Dunlap <rdunlap(a)infradead.org>
ia64: fix discontig.c section mismatches
Wan Jiabing <wanjiabing(a)vivo.com>
cavium/liquidio: Fix duplicate argument
Michael Brown <mbrown(a)fensystems.co.uk>
xen-netback: Check for hotplug-status existence before watching
Vasily Gorbik <gor(a)linux.ibm.com>
s390/entry: save the caller of psw_idle
Phillip Potter <phil(a)philpotter.co.uk>
net: geneve: check skb is large enough for IPv4/IPv6 header
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix swapped mmc order for omap3
Jiapeng Zhong <abaci-bugfix(a)linux.alibaba.com>
HID: wacom: Assign boolean values to a bool variable
Jia-Ju Bai <baijiaju1990(a)gmail.com>
HID: alps: fix error return code in alps_input_configured()
Shou-Chieh Hsu <shouchieh(a)chromium.org>
HID: google: add don USB id
Kan Liang <kan.liang(a)linux.intel.com>
perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
Ali Saidi <alisaidi(a)amazon.com>
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Yuanyuan Zhong <yzhong(a)purestorage.com>
pinctrl: lewisburg: Update number of pins in community
Linus Torvalds <torvalds(a)linux-foundation.org>
gup: document and work around "COW can break either way" issue
Pali Rohár <pali(a)kernel.org>
net: phy: marvell: fix detection of PHY on Topaz switches
Fredrik Strupe <fredrik(a)strupe.net>
ARM: 9071/1: uprobes: Don't hook on thumb instructions
Russell King <rmk+kernel(a)armlinux.org.uk>
ARM: footbridge: fix PCI interrupt mapping
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: remove duplicate napi_schedule call in open function
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: remove duplicate napi_schedule call in do_reset function
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: avoid calling napi_disable() twice
Jason Xing <xingwanli(a)kuaishou.com>
i40e: fix the panic when running bpf in xdpdrv mode
Hristo Venev <hristo(a)venev.name>
net: ip6_tunnel: Unregister catch-all devices
Hristo Venev <hristo(a)venev.name>
net: sit: Unregister catch-all devices
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: davicom: Fix regulator not turned off on failed probe
Eric Dumazet <edumazet(a)google.com>
netfilter: nft_limit: avoid possible divide error in nft_limit_init
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: conntrack: do not print icmpv6 as unknown via /proc
Jolly Shah <jollys(a)google.com>
scsi: libsas: Reset num_scatter if libata marks qc as NODATA
Nathan Chancellor <nathan(a)kernel.org>
arm64: alternatives: Move length validation in alternative_{insn, endif}
Peter Collingbourne <pcc(a)google.com>
arm64: fix inline asm in load_unaligned_zeropad()
Linus Torvalds <torvalds(a)linux-foundation.org>
readdir: make sure to verify directory entry for legacy interfaces too
Jaegeuk Kim <jaegeuk(a)google.com>
dm verity fec: fix misaligned RS roots IO
Ping Cheng <pinglinux(a)gmail.com>
HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices
Arnd Bergmann <arnd(a)arndb.de>
Input: i8042 - fix Pegatron C15B ID entry
Caleb Connolly <caleb(a)connolly.tech>
Input: s6sy761 - fix coordinate read bit shift
Seevalamuthu Mariappan <seevalam(a)codeaurora.org>
mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
Guenter Roeck <linux(a)roeck-us.net>
pcnet32: Use pci_resource_len to validate PCI resource
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec seclevel
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec seclevels for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec devkey
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devkeys for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec dev
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devs for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec keys for monitors
Martin Wilck <mwilck(a)suse.com>
scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
Alexander Shiyan <shc_work(a)mail.ru>
ASoC: fsl_esai: Fix TDM slot setup for I2S mode
Rob Clark <robdclark(a)chromium.org>
drm/msm: Fix a5xx/a6xx timestamps
Arnd Bergmann <arnd(a)arndb.de>
ARM: keystone: fix integer overflow warning
Tong Zhu <zhutong(a)amazon.com>
neighbour: Disregard DEAD dst in neigh_update
Wang Qing <wangqing(a)vivo.com>
arc: kernel: Return -EFAULT if copy_to_user() fails
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dw: Make it dependent to HAS_IOMEM
Matti Vaittinen <matti.vaittinen(a)fi.rohmeurope.com>
gpio: sysfs: Obey valid_mask
Fabian Vogt <fabian(a)ritter-vogt.de>
Input: nspire-keypad - enable interrupts only when opened
Or Cohen <orcohen(a)paloaltonetworks.com>
net/sctp: fix race condition in sctp_destroy_sock
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/signal.c | 4 +-
arch/arm/boot/dts/omap3.dtsi | 3 ++
arch/arm/boot/dts/omap4.dtsi | 5 ++
arch/arm/boot/dts/omap44xx-clocks.dtsi | 8 ---
arch/arm/boot/dts/omap5.dtsi | 5 ++
arch/arm/mach-footbridge/cats-pci.c | 4 +-
arch/arm/mach-footbridge/ebsa285-pci.c | 4 +-
arch/arm/mach-footbridge/netwinder-pci.c | 2 +-
arch/arm/mach-footbridge/personal-pci.c | 5 +-
arch/arm/mach-keystone/keystone.c | 4 +-
arch/arm/probes/uprobes/core.c | 4 +-
arch/arm64/include/asm/alternative.h | 8 +--
arch/arm64/include/asm/word-at-a-time.h | 10 ++--
arch/ia64/mm/discontig.c | 6 +--
arch/s390/kernel/entry.S | 1 +
arch/x86/events/intel/uncore_snbep.c | 61 +++++++++-------------
arch/x86/kernel/crash.c | 2 +-
drivers/dma/dw/Kconfig | 2 +
drivers/gpio/gpiolib-sysfs.c | 8 +++
drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 +-
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 +-
drivers/hid/hid-alps.c | 1 +
drivers/hid/hid-google-hammer.c | 2 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/wacom_wac.c | 8 ++-
drivers/input/keyboard/nspire-keypad.c | 56 +++++++++++---------
drivers/input/serio/i8042-x86ia64io.h | 1 +
drivers/input/touchscreen/s6sy761.c | 4 +-
drivers/md/dm-verity-fec.c | 11 ++--
drivers/md/dm-verity-fec.h | 1 +
drivers/net/dsa/mv88e6xxx/chip.c | 30 +++++------
drivers/net/ethernet/amd/pcnet32.c | 5 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
drivers/net/ethernet/davicom/dm9000.c | 6 ++-
drivers/net/ethernet/ibm/ibmvnic.c | 14 +----
drivers/net/ethernet/intel/i40e/i40e_main.c | 6 +++
drivers/net/geneve.c | 6 +++
drivers/net/phy/marvell.c | 28 ++++++++--
drivers/net/xen-netback/xenbus.c | 12 +++--
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6 +--
drivers/scsi/libsas/sas_ata.c | 9 ++--
drivers/scsi/scsi_transport_srp.c | 2 +-
fs/readdir.c | 6 +++
include/linux/marvell_phy.h | 5 +-
kernel/locking/lockdep.c | 3 +-
kernel/locking/qrwlock.c | 7 +--
mm/gup.c | 44 +++++++++++++---
mm/huge_memory.c | 7 ++-
net/core/neighbour.c | 2 +-
net/ieee802154/nl802154.c | 29 ++++++++++
net/ipv6/ip6_tunnel.c | 10 ++++
net/ipv6/sit.c | 4 +-
net/mac80211/cfg.c | 4 +-
net/netfilter/nf_conntrack_standalone.c | 1 +
net/netfilter/nft_limit.c | 4 +-
net/sctp/socket.c | 13 ++---
sound/soc/fsl/fsl_esai.c | 8 +--
tools/arch/ia64/include/asm/barrier.h | 3 --
59 files changed, 322 insertions(+), 197 deletions(-)
Hello Greg,
We need the following 2 upstream commits applied to 5.4.y to fix an iBFT
boot failure:
2021-03-29 rafael.j.wysocki(a)intel.com - 1a1c130a 2021-03-23 Rafael J.
Wysocki ACPI: tables: x86: Reserve memory occupied by ACPI tables
2021-04-13 rafael.j.wysocki(a)intel.com - 6998a88 2021-04-13 Rafael J.
Wysocki ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade()
Currently, only the first commit (1a1c130a) is destined for 5.10 & 5.11.
The 2nd commit (6998a88) is needed as well and both commits are needed
in 5.4.y.
Thank you,
George
syzkaller identified KASAN: null-ptr-deref Write in
io_uring_cancel_sqpoll on v5.12
io_uring_cancel_sqpoll is called by io_sq_thread before calling
io_uring_alloc_task_context. This leads to current->io_uring being
NULL. io_uring_cancel_sqpoll should not have to deal with threads
where current->io_uring is NULL.
In order to cast a wider safety net, perform input sanitisation
directly in io_uring_cancel_sqpoll and return for NULL value of
current->io_uring.
Reported-by: syzbot+be51ca5a4d97f017cd50(a)syzkaller.appspotmail.com
Cc: stable(a)vger.kernel.org
Signed-off-by: Palash Oswal <hello(a)oswalpalash.com>
---
fs/io_uring.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index dff34975d86b..eccad51b7954 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8998,6 +8998,8 @@ static void io_uring_cancel_sqpoll(struct io_ring_ctx *ctx)
s64 inflight;
DEFINE_WAIT(wait);
+ if (!current->io_uring)
+ return;
WARN_ON_ONCE(!sqd || ctx->sq_data->thread != current);
atomic_inc(&tctx->in_idle);
--
2.27.0
This reverts commit 800a7340ab7dd667edf95e74d8e4f23a17e87076.
Commits from @umn.edu addresses have been found to be submitted in "bad
faith" to try to test the kernel community's ability to review "known
malicious" changes. The result of these submissions can be found in a
paper published at the 42nd IEEE Symposium on Security and Privacy
entitled, "Open Source Insecurity: Stealthily Introducing
Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
of Minnesota) and Kangjie Lu (University of Minnesota).
Because of this, all submissions from this group must be reverted from
the kernel tree and will need to be re-reviewed again to determine if
they actually are a valid fix. Until that work is complete, remove this
change to ensure that no problems are being introduced into the
codebase.
Cc: stable(a)vger.kernel.org
Cc: Wenwen Wang <wang6495(a)umn.edu>
Cc: Mike Snitzer <snitzer(a)redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/md/dm-ioctl.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 1ca65b434f1f..820342de92cd 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1747,7 +1747,8 @@ static void free_params(struct dm_ioctl *param, size_t param_size, int param_fla
}
static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kernel,
- int ioctl_flags, struct dm_ioctl **param, int *param_flags)
+ int ioctl_flags,
+ struct dm_ioctl **param, int *param_flags)
{
struct dm_ioctl *dmi;
int secure_data;
@@ -1788,13 +1789,18 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
*param_flags |= DM_PARAMS_MALLOC;
- /* Copy from param_kernel (which was already copied from user) */
- memcpy(dmi, param_kernel, minimum_data_size);
-
- if (copy_from_user(&dmi->data, (char __user *)user + minimum_data_size,
- param_kernel->data_size - minimum_data_size))
+ if (copy_from_user(dmi, user, param_kernel->data_size))
goto bad;
+
data_copied:
+ /*
+ * Abort if something changed the ioctl data while it was being copied.
+ */
+ if (dmi->data_size != param_kernel->data_size) {
+ DMERR("rejecting ioctl: data size modified while processing parameters");
+ goto bad;
+ }
+
/* Wipe the user buffer so we do not return it to userspace */
if (secure_data && clear_user(user, param_kernel->data_size))
goto bad;
--
2.31.1
This is the start of the stable review cycle for the 5.10.33 release.
There are 36 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Apr 2021 07:28:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.33-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.33-rc1
Mike Galbraith <efault(a)gmx.de>
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Randy Dunlap <rdunlap(a)infradead.org>
ia64: fix discontig.c section mismatches
Randy Dunlap <rdunlap(a)infradead.org>
csky: change a Kconfig symbol name to fix e1000 build error
Arnd Bergmann <arnd(a)arndb.de>
kasan: fix hwasan build for gcc
Wan Jiabing <wanjiabing(a)vivo.com>
cavium/liquidio: Fix duplicate argument
Michael Brown <mbrown(a)fensystems.co.uk>
xen-netback: Check for hotplug-status existence before watching
Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
arm64: kprobes: Restore local irqflag if kprobes is cancelled
Vasily Gorbik <gor(a)linux.ibm.com>
s390/entry: save the caller of psw_idle
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
dmaengine: tegra20: Fix runtime PM imbalance on error
Phillip Potter <phil(a)philpotter.co.uk>
net: geneve: check skb is large enough for IPv4/IPv6 header
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix swapped mmc order for omap3
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
dmaengine: xilinx: dpdma: Fix race condition in done IRQ
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
dmaengine: xilinx: dpdma: Fix descriptor issuing on video group
Shawn Guo <shawn.guo(a)linaro.org>
soc: qcom: geni: shield geni_icc_get() for ACPI boot
Jiapeng Zhong <abaci-bugfix(a)linux.alibaba.com>
HID: wacom: Assign boolean values to a bool variable
Douglas Gilbert <dgilbert(a)interlog.com>
HID cp2112: fix support for multiple gpiochips
Jia-Ju Bai <baijiaju1990(a)gmail.com>
HID: alps: fix error return code in alps_input_configured()
Shou-Chieh Hsu <shouchieh(a)chromium.org>
HID: google: add don USB id
Zhen Lei <thunder.leizhen(a)huawei.com>
perf map: Fix error return code in maps__clone()
Leo Yan <leo.yan(a)linaro.org>
perf auxtrace: Fix potential NULL pointer dereference
Jim Mattson <jmattson(a)google.com>
perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[]
Kan Liang <kan.liang(a)linux.intel.com>
perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
Ali Saidi <alisaidi(a)amazon.com>
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Tighten speculative pointer arithmetic mask
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Refactor and streamline bounds check into helper
Andrei Matei <andreimatei1(a)gmail.com>
bpf: Allow variable-offset stack access
Yonghong Song <yhs(a)fb.com>
bpf: Permits pointers on stack for helper calls
Andre Przywara <andre.przywara(a)arm.com>
arm64: dts: allwinner: Revert SD card CD GPIO for Pine64-LTS
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
pinctrl: core: Show pin numbers for the controllers with base = 0
Christoph Hellwig <hch(a)lst.de>
block: return -EBUSY when there are open partitions in blkdev_reread_part
Yuanyuan Zhong <yzhong(a)purestorage.com>
pinctrl: lewisburg: Update number of pins in community
Eli Cohen <elic(a)nvidia.com>
vdpa/mlx5: Set err = -ENOMEM in case dma_map_sg_attrs fails
James Bottomley <James.Bottomley(a)HansenPartnership.com>
KEYS: trusted: Fix TPM reservation for seal/unseal
Tony Lindgren <tony(a)atomide.com>
gpio: omap: Save and restore sysconfig
Xie Yongji <xieyongji(a)bytedance.com>
vhost-vdpa: protect concurrent access to vhost device iotlb
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/omap3.dtsi | 3 +
.../boot/dts/allwinner/sun50i-a64-pine64-lts.dts | 2 +-
arch/arm64/kernel/probes/kprobes.c | 6 +-
arch/csky/Kconfig | 2 +-
arch/csky/include/asm/page.h | 2 +-
arch/ia64/mm/discontig.c | 6 +-
arch/s390/kernel/entry.S | 1 +
arch/x86/events/intel/core.c | 2 +-
arch/x86/events/intel/uncore_snbep.c | 61 +-
arch/x86/kernel/crash.c | 2 +-
block/ioctl.c | 2 +
drivers/dma/tegra20-apb-dma.c | 4 +-
drivers/dma/xilinx/xilinx_dpdma.c | 31 +-
drivers/gpio/gpio-omap.c | 9 +
drivers/hid/hid-alps.c | 1 +
drivers/hid/hid-cp2112.c | 22 +-
drivers/hid/hid-google-hammer.c | 2 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/wacom_wac.c | 2 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
drivers/net/geneve.c | 6 +
drivers/net/xen-netback/xenbus.c | 12 +-
drivers/pinctrl/core.c | 14 +-
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6 +-
drivers/soc/qcom/qcom-geni-se.c | 3 +
drivers/vdpa/mlx5/core/mr.c | 4 +-
drivers/vhost/vdpa.c | 6 +-
include/linux/bpf.h | 5 +
include/linux/bpf_verifier.h | 3 +-
include/linux/platform_data/gpio-omap.h | 3 +
kernel/bpf/verifier.c | 774 ++++++++++++++++-----
kernel/locking/qrwlock.c | 7 +-
scripts/Makefile.kasan | 12 +-
security/keys/trusted-keys/trusted_tpm2.c | 2 +-
tools/arch/ia64/include/asm/barrier.h | 3 -
tools/perf/util/auxtrace.c | 2 +-
tools/perf/util/map.c | 7 +-
38 files changed, 742 insertions(+), 294 deletions(-)
From: Johannes Berg <johannes.berg(a)intel.com>
Harald Arnesen reported [1] a deadlock at reboot time, and after
he captured a stack trace a picture developed of what's going on:
The distribution he's using is using iwd (not wpa_supplicant) to
manage wireless. iwd will usually use the "socket owner" option
when it creates new interfaces, so that they're automatically
destroyed when it quits (unexpectedly or otherwise). This is also
done by wpa_supplicant, but it doesn't do it for the normal one,
only for additional ones, which is different with iwd.
Anyway, during shutdown, iwd quits while the netdev is still UP,
i.e. IFF_UP is set. This causes the stack trace that Linus so
nicely transcribed from the pictures:
cfg80211_destroy_iface_wk() takes wiphy_lock
-> cfg80211_destroy_ifaces()
->ieee80211_del_iface
->ieeee80211_if_remove
->cfg80211_unregister_wdev
->unregister_netdevice_queue
->dev_close_many
->__dev_close_many
->raw_notifier_call_chain
->cfg80211_netdev_notifier_call
and that last call tries to take wiphy_lock again.
In commit a05829a7222e ("cfg80211: avoid holding the RTNL when
calling the driver") I had taken into account the possibility of
recursing from cfg80211 into cfg80211_netdev_notifier_call() via
the network stack, but only for NETDEV_UNREGISTER, not for what
happens here, NETDEV_GOING_DOWN and NETDEV_DOWN notifications.
Additionally, while this worked still back in commit 78f22b6a3a92
("cfg80211: allow userspace to take ownership of interfaces"), it
missed another corner case: unregistering a netdev will cause
dev_close() to be called, and thus stop wireless operations (e.g.
disconnecting), but there are some types of virtual interfaces in
wifi that don't have a netdev - for that we need an additional
call to cfg80211_leave().
So, to fix this mess, change cfg80211_destroy_ifaces() to not
require the wiphy_lock(), but instead make it acquire it, but
only after it has actually closed all the netdevs on the list,
and then call cfg80211_leave() as well before removing them
from the driver, to fix the second issue. The locking change in
this requires modifying the nl80211 call to not get the wiphy
lock passed in, but acquire it by itself after flushing any
potentially pending destruction requests.
[1] https://lore.kernel.org/r/09464e67-f3de-ac09-28a3-e27b7914ee7d@skogtun.org
Cc: stable(a)vger.kernel.org # 5.12
Reported-by: Harald Arnesen <harald(a)skogtun.org>
Fixes: 776a39b8196d ("cfg80211: call cfg80211_destroy_ifaces() with wiphy lock held")
Fixes: 78f22b6a3a92 ("cfg80211: allow userspace to take ownership of interfaces")
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
---
Linus, I'll send this the regular way, just CC'ing you since
you were involved in the debug.
---
net/wireless/core.c | 21 +++++++++++++++++----
net/wireless/nl80211.c | 24 +++++++++++++++++++-----
2 files changed, 36 insertions(+), 9 deletions(-)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a2785379df6e..589ee5a69a2e 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -332,14 +332,29 @@ static void cfg80211_event_work(struct work_struct *work)
void cfg80211_destroy_ifaces(struct cfg80211_registered_device *rdev)
{
struct wireless_dev *wdev, *tmp;
+ bool found = false;
ASSERT_RTNL();
- lockdep_assert_wiphy(&rdev->wiphy);
+ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
+ if (wdev->nl_owner_dead) {
+ if (wdev->netdev)
+ dev_close(wdev->netdev);
+ found = true;
+ }
+ }
+
+ if (!found)
+ return;
+
+ wiphy_lock(&rdev->wiphy);
list_for_each_entry_safe(wdev, tmp, &rdev->wiphy.wdev_list, list) {
- if (wdev->nl_owner_dead)
+ if (wdev->nl_owner_dead) {
+ cfg80211_leave(rdev, wdev);
rdev_del_virtual_intf(rdev, wdev);
+ }
}
+ wiphy_unlock(&rdev->wiphy);
}
static void cfg80211_destroy_iface_wk(struct work_struct *work)
@@ -350,9 +365,7 @@ static void cfg80211_destroy_iface_wk(struct work_struct *work)
destroy_work);
rtnl_lock();
- wiphy_lock(&rdev->wiphy);
cfg80211_destroy_ifaces(rdev);
- wiphy_unlock(&rdev->wiphy);
rtnl_unlock();
}
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b1df42e4f1eb..a5224da63832 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3929,7 +3929,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
return err;
}
-static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
{
struct cfg80211_registered_device *rdev = info->user_ptr[0];
struct vif_params params;
@@ -3938,9 +3938,6 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
int err;
enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
- /* to avoid failing a new interface creation due to pending removal */
- cfg80211_destroy_ifaces(rdev);
-
memset(¶ms, 0, sizeof(params));
if (!info->attrs[NL80211_ATTR_IFNAME])
@@ -4028,6 +4025,21 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
return genlmsg_reply(msg, info);
}
+static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+{
+ struct cfg80211_registered_device *rdev = info->user_ptr[0];
+ int ret;
+
+ /* to avoid failing a new interface creation due to pending removal */
+ cfg80211_destroy_ifaces(rdev);
+
+ wiphy_lock(&rdev->wiphy);
+ ret = _nl80211_new_interface(skb, info);
+ wiphy_unlock(&rdev->wiphy);
+
+ return ret;
+}
+
static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
{
struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -15040,7 +15052,9 @@ static const struct genl_small_ops nl80211_small_ops[] = {
.doit = nl80211_new_interface,
.flags = GENL_UNS_ADMIN_PERM,
.internal_flags = NL80211_FLAG_NEED_WIPHY |
- NL80211_FLAG_NEED_RTNL,
+ NL80211_FLAG_NEED_RTNL |
+ /* we take the wiphy mutex later ourselves */
+ NL80211_FLAG_NO_WIPHY_MTX,
},
{
.cmd = NL80211_CMD_DEL_INTERFACE,
--
2.30.2
This reverts commit 6e6c25283dff866308c87b49434c7dbad4774cc0.
Commits from @umn.edu addresses have been found to be submitted in "bad
faith" to try to test the kernel community's ability to review "known
malicious" changes. The result of these submissions can be found in a
paper published at the 42nd IEEE Symposium on Security and Privacy
entitled, "Open Source Insecurity: Stealthily Introducing
Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
of Minnesota) and Kangjie Lu (University of Minnesota).
Because of this, all submissions from this group must be reverted from
the kernel tree and will need to be re-reviewed again to determine if
they actually are a valid fix. Until that work is complete, remove this
change to ensure that no problems are being introduced into the
codebase.
Cc: Qiushi Wu <wu000273(a)umn.edu>
Cc: 3.10+ <stable(a)vger.kernel.org> # 3.10+
Cc: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/acpi/sysfs.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 8baf7644a0d0..842bf63b91e9 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -986,10 +986,8 @@ void acpi_sysfs_add_hotplug_profile(struct acpi_hotplug_profile *hotplug,
error = kobject_init_and_add(&hotplug->kobj,
&acpi_hotplug_profile_ktype, hotplug_kobj, "%s", name);
- if (error) {
- kobject_put(&hotplug->kobj);
+ if (error)
goto err_out;
- }
kobject_uevent(&hotplug->kobj, KOBJ_ADD);
return;
--
2.31.1
This reverts commit 4d8be4bc94f74bb7d096e1c2e44457b530d5a170.
Commits from @umn.edu addresses have been found to be submitted in "bad
faith" to try to test the kernel community's ability to review "known
malicious" changes. The result of these submissions can be found in a
paper published at the 42nd IEEE Symposium on Security and Privacy
entitled, "Open Source Insecurity: Stealthily Introducing
Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
of Minnesota) and Kangjie Lu (University of Minnesota).
Because of this, all submissions from this group must be reverted from
the kernel tree and will need to be re-reviewed again to determine if
they actually are a valid fix. Until that work is complete, remove this
change to ensure that no problems are being introduced into the
codebase.
Cc: Qiushi Wu <wu000273(a)umn.edu>
Cc: 4.10+ <stable(a)vger.kernel.org> # 4.10+
Cc: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/acpi/cppc_acpi.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 69057fcd2c04..42650b34e45e 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -830,7 +830,6 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
"acpi_cppc");
if (ret) {
per_cpu(cpc_desc_ptr, pr->id) = NULL;
- kobject_put(&cpc_ptr->kobj);
goto out_free;
}
--
2.31.1
This reverts commit 3f12888dfae2a48741c4caa9214885b3aaf350f9.
Commits from @umn.edu addresses have been found to be submitted in "bad
faith" to try to test the kernel community's ability to review "known
malicious" changes. The result of these submissions can be found in a
paper published at the 42nd IEEE Symposium on Security and Privacy
entitled, "Open Source Insecurity: Stealthily Introducing
Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
of Minnesota) and Kangjie Lu (University of Minnesota).
Because of this, all submissions from this group must be reverted from
the kernel tree and will need to be re-reviewed again to determine if
they actually are a valid fix. Until that work is complete, remove this
change to ensure that no problems are being introduced into the
codebase.
Cc: Wenwen Wang <wang6495(a)umn.edu>
Cc: <stable(a)vger.kernel.org>
Cc: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
sound/core/control_compat.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 1d708aab9c98..857acf83ae47 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -381,7 +381,8 @@ static int snd_ctl_elem_add_compat(struct snd_ctl_file *file,
if (copy_from_user(&data->id, &data32->id, sizeof(data->id)) ||
copy_from_user(&data->type, &data32->type, 3 * sizeof(u32)))
goto error;
- if (get_user(data->owner, &data32->owner))
+ if (get_user(data->owner, &data32->owner) ||
+ get_user(data->type, &data32->type))
goto error;
switch (data->type) {
case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
--
2.31.1
This reverts commit 91862cc7867bba4ee5c8fcf0ca2f1d30427b6129.
Commits from @umn.edu addresses have been found to be submitted in "bad
faith" to try to test the kernel community's ability to review "known
malicious" changes. The result of these submissions can be found in a
paper published at the 42nd IEEE Symposium on Security and Privacy
entitled, "Open Source Insecurity: Stealthily Introducing
Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
of Minnesota) and Kangjie Lu (University of Minnesota).
Because of this, all submissions from this group must be reverted from
the kernel tree and will need to be re-reviewed again to determine if
they actually are a valid fix. Until that work is complete, remove this
change to ensure that no problems are being introduced into the
codebase.
Cc: http
Cc: stable(a)vger.kernel.org
Cc: Wenwen Wang <wang6495(a)umn.edu>
Cc: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
kernel/trace/trace.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 5c777627212f..faed4f44d224 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -691,10 +691,8 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
* not modified.
*/
pid_list = kmalloc(sizeof(*pid_list), GFP_KERNEL);
- if (!pid_list) {
- trace_parser_put(&parser);
+ if (!pid_list)
return -ENOMEM;
- }
pid_list->pid_max = READ_ONCE(pid_max);
@@ -704,7 +702,6 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
pid_list->pids = vzalloc((pid_list->pid_max + 7) >> 3);
if (!pid_list->pids) {
- trace_parser_put(&parser);
kfree(pid_list);
return -ENOMEM;
}
--
2.31.1
This is the start of the stable review cycle for the 4.14.232 release.
There are 49 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Apr 2021 07:28:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.232-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.232-rc1
Mike Galbraith <efault(a)gmx.de>
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Randy Dunlap <rdunlap(a)infradead.org>
ia64: fix discontig.c section mismatches
Wan Jiabing <wanjiabing(a)vivo.com>
cavium/liquidio: Fix duplicate argument
Michael Brown <mbrown(a)fensystems.co.uk>
xen-netback: Check for hotplug-status existence before watching
Vasily Gorbik <gor(a)linux.ibm.com>
s390/entry: save the caller of psw_idle
Phillip Potter <phil(a)philpotter.co.uk>
net: geneve: check skb is large enough for IPv4/IPv6 header
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix swapped mmc order for omap3
Jiapeng Zhong <abaci-bugfix(a)linux.alibaba.com>
HID: wacom: Assign boolean values to a bool variable
Jia-Ju Bai <baijiaju1990(a)gmail.com>
HID: alps: fix error return code in alps_input_configured()
Yuanyuan Zhong <yzhong(a)purestorage.com>
pinctrl: lewisburg: Update number of pins in community
Zhang Yi <yi.zhang(a)huawei.com>
ext4: correct error label in ext4_rename()
Anirudh Rayabharam <mail(a)anirudhrb.com>
net: hso: fix null-ptr-deref during tty device unregistration
Linus Torvalds <torvalds(a)linux-foundation.org>
gup: document and work around "COW can break either way" issue
Fredrik Strupe <fredrik(a)strupe.net>
ARM: 9071/1: uprobes: Don't hook on thumb instructions
Russell King <rmk+kernel(a)armlinux.org.uk>
ARM: footbridge: fix PCI interrupt mapping
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: remove duplicate napi_schedule call in open function
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: remove duplicate napi_schedule call in do_reset function
Lijun Pan <lijunp213(a)gmail.com>
ibmvnic: avoid calling napi_disable() twice
Jason Xing <xingwanli(a)kuaishou.com>
i40e: fix the panic when running bpf in xdpdrv mode
Hristo Venev <hristo(a)venev.name>
net: sit: Unregister catch-all devices
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: davicom: Fix regulator not turned off on failed probe
Eric Dumazet <edumazet(a)google.com>
netfilter: nft_limit: avoid possible divide error in nft_limit_init
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: conntrack: do not print icmpv6 as unknown via /proc
Jolly Shah <jollys(a)google.com>
scsi: libsas: Reset num_scatter if libata marks qc as NODATA
Nathan Chancellor <nathan(a)kernel.org>
arm64: alternatives: Move length validation in alternative_{insn, endif}
Peter Collingbourne <pcc(a)google.com>
arm64: fix inline asm in load_unaligned_zeropad()
Linus Torvalds <torvalds(a)linux-foundation.org>
readdir: make sure to verify directory entry for legacy interfaces too
Ping Cheng <pinglinux(a)gmail.com>
HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices
Arnd Bergmann <arnd(a)arndb.de>
Input: i8042 - fix Pegatron C15B ID entry
Seevalamuthu Mariappan <seevalam(a)codeaurora.org>
mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
Colin Ian King <colin.king(a)canonical.com>
usbip: Fix incorrect double assignment to udc->ud.tcp_rx
Guenter Roeck <linux(a)roeck-us.net>
pcnet32: Use pci_resource_len to validate PCI resource
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec seclevel
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec seclevels for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec devkey
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devkeys for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec dev
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devs for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec keys for monitors
Martin Wilck <mwilck(a)suse.com>
scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
Alexander Shiyan <shc_work(a)mail.ru>
ASoC: fsl_esai: Fix TDM slot setup for I2S mode
Arnd Bergmann <arnd(a)arndb.de>
ARM: keystone: fix integer overflow warning
Tong Zhu <zhutong(a)amazon.com>
neighbour: Disregard DEAD dst in neigh_update
Wang Qing <wangqing(a)vivo.com>
arc: kernel: Return -EFAULT if copy_to_user() fails
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dw: Make it dependent to HAS_IOMEM
Fabian Vogt <fabian(a)ritter-vogt.de>
Input: nspire-keypad - enable interrupts only when opened
Or Cohen <orcohen(a)paloaltonetworks.com>
net/sctp: fix race condition in sctp_destroy_sock
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/signal.c | 4 +-
arch/arm/boot/dts/omap3.dtsi | 3 ++
arch/arm/boot/dts/omap4.dtsi | 5 ++
arch/arm/boot/dts/omap5.dtsi | 5 ++
arch/arm/mach-footbridge/cats-pci.c | 4 +-
arch/arm/mach-footbridge/ebsa285-pci.c | 4 +-
arch/arm/mach-footbridge/netwinder-pci.c | 2 +-
arch/arm/mach-footbridge/personal-pci.c | 5 +-
arch/arm/mach-keystone/keystone.c | 4 +-
arch/arm/probes/uprobes/core.c | 4 +-
arch/arm64/include/asm/alternative.h | 8 ++--
arch/arm64/include/asm/word-at-a-time.h | 10 ++--
arch/ia64/mm/discontig.c | 6 +--
arch/s390/kernel/entry.S | 1 +
arch/x86/kernel/crash.c | 3 +-
drivers/dma/dw/Kconfig | 2 +
drivers/hid/hid-alps.c | 1 +
drivers/hid/wacom_wac.c | 8 ++--
drivers/input/keyboard/nspire-keypad.c | 56 ++++++++++++----------
drivers/input/serio/i8042-x86ia64io.h | 1 +
drivers/net/ethernet/amd/pcnet32.c | 5 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
drivers/net/ethernet/davicom/dm9000.c | 6 ++-
drivers/net/ethernet/ibm/ibmvnic.c | 14 +-----
drivers/net/ethernet/intel/i40e/i40e_main.c | 6 +++
drivers/net/geneve.c | 6 +++
drivers/net/usb/hso.c | 33 +++++--------
drivers/net/xen-netback/xenbus.c | 12 +++--
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6 +--
drivers/scsi/libsas/sas_ata.c | 9 ++--
drivers/scsi/scsi_transport_srp.c | 2 +-
drivers/usb/usbip/vudc_sysfs.c | 2 +-
fs/ext4/namei.c | 2 +-
fs/readdir.c | 6 +++
mm/gup.c | 44 ++++++++++++++---
mm/huge_memory.c | 7 ++-
net/core/neighbour.c | 2 +-
net/ieee802154/nl802154.c | 29 +++++++++++
net/ipv6/sit.c | 4 +-
net/mac80211/cfg.c | 4 +-
net/netfilter/nf_conntrack_standalone.c | 1 +
net/netfilter/nft_limit.c | 4 +-
net/sctp/socket.c | 13 ++---
sound/soc/fsl/fsl_esai.c | 8 ++--
tools/arch/ia64/include/asm/barrier.h | 3 --
46 files changed, 228 insertions(+), 142 deletions(-)
Since
commit 890880ddfdbe256083170866e49c87618b706ac7
Author: Paul Kocialkowski <paul.kocialkowski(a)bootlin.com>
Date: Fri Jan 4 09:56:10 2019 +0100
drm: Auto-set allow_fb_modifiers when given modifiers at plane init
this is done automatically as part of plane init, if drivers set the
modifier list correctly. Which is the case here.
Note that this fixes an inconsistency: We've set the cap everywhere,
but only nv50+ supports modifiers. Hence cc stable, but not further
back then the patch from Paul.
Cc: stable(a)vger.kernel.org # v5.1 +
Cc: Pekka Paalanen <pekka.paalanen(a)collabora.com>
Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com>
Cc: Ben Skeggs <bskeggs(a)redhat.com>
Cc: nouveau(a)lists.freedesktop.org
---
drivers/gpu/drm/nouveau/nouveau_display.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 14101bd2a0ff..929de41c281f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -697,7 +697,6 @@ nouveau_display_create(struct drm_device *dev)
dev->mode_config.preferred_depth = 24;
dev->mode_config.prefer_shadow = 1;
- dev->mode_config.allow_fb_modifiers = true;
if (drm->client.device.info.chipset < 0x11)
dev->mode_config.async_page_flip = false;
--
2.31.0
This is the start of the stable review cycle for the 4.4.268 release.
There are 32 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Apr 2021 07:28:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.268-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.268-rc1
Mike Galbraith <efault(a)gmx.de>
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
Kees Cook <keescook(a)chromium.org>
overflow.h: Add allocation size calculation helpers
Rasmus Villemoes <linux(a)rasmusvillemoes.dk>
compiler.h: enable builtin overflow checkers and add fallback code
John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Randy Dunlap <rdunlap(a)infradead.org>
ia64: fix discontig.c section mismatches
Wan Jiabing <wanjiabing(a)vivo.com>
cavium/liquidio: Fix duplicate argument
Michael Brown <mbrown(a)fensystems.co.uk>
xen-netback: Check for hotplug-status existence before watching
Vasily Gorbik <gor(a)linux.ibm.com>
s390/entry: save the caller of psw_idle
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix swapped mmc order for omap3
Zhang Yi <yi.zhang(a)huawei.com>
ext4: correct error label in ext4_rename()
Anirudh Rayabharam <mail(a)anirudhrb.com>
net: hso: fix null-ptr-deref during tty device unregistration
Fredrik Strupe <fredrik(a)strupe.net>
ARM: 9071/1: uprobes: Don't hook on thumb instructions
Jason Xing <xingwanli(a)kuaishou.com>
i40e: fix the panic when running bpf in xdpdrv mode
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: davicom: Fix regulator not turned off on failed probe
Jolly Shah <jollys(a)google.com>
scsi: libsas: Reset num_scatter if libata marks qc as NODATA
Arnd Bergmann <arnd(a)arndb.de>
Input: i8042 - fix Pegatron C15B ID entry
Guenter Roeck <linux(a)roeck-us.net>
pcnet32: Use pci_resource_len to validate PCI resource
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec seclevel
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec seclevels for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec devkey
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devkeys for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec dev
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devs for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec keys for monitors
Alexander Shiyan <shc_work(a)mail.ru>
ASoC: fsl_esai: Fix TDM slot setup for I2S mode
Arnd Bergmann <arnd(a)arndb.de>
ARM: keystone: fix integer overflow warning
Tong Zhu <zhutong(a)amazon.com>
neighbour: Disregard DEAD dst in neigh_update
Wang Qing <wangqing(a)vivo.com>
arc: kernel: Return -EFAULT if copy_to_user() fails
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dw: Make it dependent to HAS_IOMEM
Fabian Vogt <fabian(a)ritter-vogt.de>
Input: nspire-keypad - enable interrupts only when opened
Or Cohen <orcohen(a)paloaltonetworks.com>
net/sctp: fix race condition in sctp_destroy_sock
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/signal.c | 4 +-
arch/arm/boot/dts/omap3.dtsi | 3 +
arch/arm/boot/dts/omap4.dtsi | 5 +
arch/arm/boot/dts/omap5.dtsi | 5 +
arch/arm/mach-keystone/keystone.c | 4 +-
arch/arm/probes/uprobes/core.c | 4 +-
arch/ia64/mm/discontig.c | 6 +-
arch/s390/kernel/entry.S | 1 +
arch/x86/kernel/crash.c | 3 +-
drivers/dma/dw/Kconfig | 2 +
drivers/input/keyboard/nspire-keypad.c | 56 +++--
drivers/input/serio/i8042-x86ia64io.h | 1 +
drivers/md/dm-table.c | 10 +-
drivers/net/ethernet/amd/pcnet32.c | 5 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
drivers/net/ethernet/davicom/dm9000.c | 6 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 6 +
drivers/net/usb/hso.c | 33 +--
drivers/net/xen-netback/xenbus.c | 12 +-
drivers/scsi/libsas/sas_ata.c | 9 +-
fs/ext4/namei.c | 2 +-
include/linux/compiler-clang.h | 14 ++
include/linux/compiler-gcc.h | 4 +
include/linux/compiler-intel.h | 4 +
include/linux/overflow.h | 278 +++++++++++++++++++++
net/core/neighbour.c | 2 +-
net/ieee802154/nl802154.c | 29 +++
net/sctp/socket.c | 13 +-
sound/soc/fsl/fsl_esai.c | 8 +-
tools/arch/ia64/include/asm/barrier.h | 3 -
31 files changed, 445 insertions(+), 93 deletions(-)
This is the start of the stable review cycle for the 4.9.268 release.
There are 37 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Apr 2021 07:28:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.268-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.268-rc1
Mike Galbraith <efault(a)gmx.de>
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Randy Dunlap <rdunlap(a)infradead.org>
ia64: fix discontig.c section mismatches
Wan Jiabing <wanjiabing(a)vivo.com>
cavium/liquidio: Fix duplicate argument
Michael Brown <mbrown(a)fensystems.co.uk>
xen-netback: Check for hotplug-status existence before watching
Vasily Gorbik <gor(a)linux.ibm.com>
s390/entry: save the caller of psw_idle
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix swapped mmc order for omap3
Jia-Ju Bai <baijiaju1990(a)gmail.com>
HID: alps: fix error return code in alps_input_configured()
Zhang Yi <yi.zhang(a)huawei.com>
ext4: correct error label in ext4_rename()
Anirudh Rayabharam <mail(a)anirudhrb.com>
net: hso: fix null-ptr-deref during tty device unregistration
Shuah Khan <skhan(a)linuxfoundation.org>
usbip: synchronize event handler with sysfs code paths
Shuah Khan <skhan(a)linuxfoundation.org>
usbip: vudc synchronize sysfs code paths
Shuah Khan <skhan(a)linuxfoundation.org>
usbip: stub-dev synchronize sysfs code paths
Shuah Khan <skhan(a)linuxfoundation.org>
usbip: add sysfs_lock to synchronize sysfs code paths
Colin Ian King <colin.king(a)canonical.com>
usbip: Fix incorrect double assignment to udc->ud.tcp_rx
Fredrik Strupe <fredrik(a)strupe.net>
ARM: 9071/1: uprobes: Don't hook on thumb instructions
Jason Xing <xingwanli(a)kuaishou.com>
i40e: fix the panic when running bpf in xdpdrv mode
Hristo Venev <hristo(a)venev.name>
net: sit: Unregister catch-all devices
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: davicom: Fix regulator not turned off on failed probe
Jolly Shah <jollys(a)google.com>
scsi: libsas: Reset num_scatter if libata marks qc as NODATA
Arnd Bergmann <arnd(a)arndb.de>
Input: i8042 - fix Pegatron C15B ID entry
Guenter Roeck <linux(a)roeck-us.net>
pcnet32: Use pci_resource_len to validate PCI resource
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec seclevel
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec seclevels for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec devkey
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devkeys for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: forbid monitor for add llsec dev
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec devs for monitors
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: stop dump llsec keys for monitors
Alexander Shiyan <shc_work(a)mail.ru>
ASoC: fsl_esai: Fix TDM slot setup for I2S mode
Arnd Bergmann <arnd(a)arndb.de>
ARM: keystone: fix integer overflow warning
Tong Zhu <zhutong(a)amazon.com>
neighbour: Disregard DEAD dst in neigh_update
Wang Qing <wangqing(a)vivo.com>
arc: kernel: Return -EFAULT if copy_to_user() fails
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
dmaengine: dw: Make it dependent to HAS_IOMEM
Fabian Vogt <fabian(a)ritter-vogt.de>
Input: nspire-keypad - enable interrupts only when opened
Or Cohen <orcohen(a)paloaltonetworks.com>
net/sctp: fix race condition in sctp_destroy_sock
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/signal.c | 4 +-
arch/arm/boot/dts/omap3.dtsi | 3 ++
arch/arm/boot/dts/omap4.dtsi | 5 ++
arch/arm/boot/dts/omap5.dtsi | 5 ++
arch/arm/mach-keystone/keystone.c | 4 +-
arch/arm/probes/uprobes/core.c | 4 +-
arch/ia64/mm/discontig.c | 6 +--
arch/s390/kernel/entry.S | 1 +
arch/x86/kernel/crash.c | 3 +-
drivers/dma/dw/Kconfig | 2 +
drivers/hid/hid-alps.c | 1 +
drivers/input/keyboard/nspire-keypad.c | 56 ++++++++++++----------
drivers/input/serio/i8042-x86ia64io.h | 1 +
drivers/net/ethernet/amd/pcnet32.c | 5 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
drivers/net/ethernet/davicom/dm9000.c | 6 ++-
drivers/net/ethernet/intel/i40e/i40e_main.c | 6 +++
drivers/net/usb/hso.c | 33 +++++--------
drivers/net/xen-netback/xenbus.c | 12 +++--
drivers/scsi/libsas/sas_ata.c | 9 ++--
drivers/usb/usbip/stub_dev.c | 11 ++++-
drivers/usb/usbip/usbip_common.h | 3 ++
drivers/usb/usbip/usbip_event.c | 2 +
drivers/usb/usbip/vhci_hcd.c | 1 +
drivers/usb/usbip/vhci_sysfs.c | 30 ++++++++++--
drivers/usb/usbip/vudc_dev.c | 1 +
drivers/usb/usbip/vudc_sysfs.c | 7 ++-
fs/ext4/namei.c | 2 +-
net/core/neighbour.c | 2 +-
net/ieee802154/nl802154.c | 29 +++++++++++
net/ipv6/sit.c | 4 +-
net/sctp/socket.c | 13 ++---
sound/soc/fsl/fsl_esai.c | 8 ++--
tools/arch/ia64/include/asm/barrier.h | 3 --
35 files changed, 190 insertions(+), 98 deletions(-)
This is the start of the stable review cycle for the 5.4.115 release.
There are 20 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Apr 2021 07:28:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.115-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.115-rc1
Mike Galbraith <efault(a)gmx.de>
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Randy Dunlap <rdunlap(a)infradead.org>
ia64: fix discontig.c section mismatches
Randy Dunlap <rdunlap(a)infradead.org>
csky: change a Kconfig symbol name to fix e1000 build error
Wan Jiabing <wanjiabing(a)vivo.com>
cavium/liquidio: Fix duplicate argument
Michael Brown <mbrown(a)fensystems.co.uk>
xen-netback: Check for hotplug-status existence before watching
Vasily Gorbik <gor(a)linux.ibm.com>
s390/entry: save the caller of psw_idle
Phillip Potter <phil(a)philpotter.co.uk>
net: geneve: check skb is large enough for IPv4/IPv6 header
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix swapped mmc order for omap3
Jiapeng Zhong <abaci-bugfix(a)linux.alibaba.com>
HID: wacom: Assign boolean values to a bool variable
Jia-Ju Bai <baijiaju1990(a)gmail.com>
HID: alps: fix error return code in alps_input_configured()
Shou-Chieh Hsu <shouchieh(a)chromium.org>
HID: google: add don USB id
Leo Yan <leo.yan(a)linaro.org>
perf auxtrace: Fix potential NULL pointer dereference
Jim Mattson <jmattson(a)google.com>
perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[]
Kan Liang <kan.liang(a)linux.intel.com>
perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
Ali Saidi <alisaidi(a)amazon.com>
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Andre Przywara <andre.przywara(a)arm.com>
arm64: dts: allwinner: Revert SD card CD GPIO for Pine64-LTS
Yuanyuan Zhong <yzhong(a)purestorage.com>
pinctrl: lewisburg: Update number of pins in community
Tony Lindgren <tony(a)atomide.com>
gpio: omap: Save and restore sysconfig
Sven Schnelle <svens(a)linux.ibm.com>
s390/ptrace: return -ENOSYS when invalid syscall is supplied
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/omap3.dtsi | 3 ++
.../boot/dts/allwinner/sun50i-a64-pine64-lts.dts | 2 +-
arch/csky/Kconfig | 2 +-
arch/csky/include/asm/page.h | 2 +-
arch/ia64/mm/discontig.c | 6 +--
arch/s390/kernel/entry.S | 1 +
arch/s390/kernel/ptrace.c | 17 ++++--
arch/x86/events/intel/core.c | 2 +-
arch/x86/events/intel/uncore_snbep.c | 61 +++++++++-------------
arch/x86/kernel/crash.c | 2 +-
drivers/gpio/gpio-omap.c | 9 ++++
drivers/hid/hid-alps.c | 1 +
drivers/hid/hid-google-hammer.c | 2 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/wacom_wac.c | 2 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
drivers/net/geneve.c | 6 +++
drivers/net/xen-netback/xenbus.c | 12 +++--
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6 +--
include/linux/platform_data/gpio-omap.h | 3 ++
kernel/locking/qrwlock.c | 7 +--
tools/arch/ia64/include/asm/barrier.h | 3 --
tools/perf/util/auxtrace.c | 2 +-
24 files changed, 92 insertions(+), 66 deletions(-)
This is the start of the stable review cycle for the 5.11.17 release.
There are 41 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 28 Apr 2021 07:28:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.17-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.11.17-rc1
Mike Galbraith <efault(a)gmx.de>
x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
ia64: tools: remove duplicate definition of ia64_mf() on ia64
Randy Dunlap <rdunlap(a)infradead.org>
ia64: fix discontig.c section mismatches
Randy Dunlap <rdunlap(a)infradead.org>
csky: change a Kconfig symbol name to fix e1000 build error
Wan Jiabing <wanjiabing(a)vivo.com>
cavium/liquidio: Fix duplicate argument
Michael Brown <mbrown(a)fensystems.co.uk>
xen-netback: Check for hotplug-status existence before watching
Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
arm64: kprobes: Restore local irqflag if kprobes is cancelled
Vasily Gorbik <gor(a)linux.ibm.com>
s390/entry: save the caller of psw_idle
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
dmaengine: tegra20: Fix runtime PM imbalance on error
Phillip Potter <phil(a)philpotter.co.uk>
net: geneve: check skb is large enough for IPv4/IPv6 header
Angelo Dureghello <angelo(a)kernel-space.org>
m68k: fix flatmem memory model setup
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix swapped mmc order for omap3
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
dmaengine: xilinx: dpdma: Fix race condition in done IRQ
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
dmaengine: xilinx: dpdma: Fix descriptor issuing on video group
Shawn Guo <shawn.guo(a)linaro.org>
soc: qcom: geni: shield geni_icc_get() for ACPI boot
Jiapeng Zhong <abaci-bugfix(a)linux.alibaba.com>
HID: wacom: Assign boolean values to a bool variable
Douglas Gilbert <dgilbert(a)interlog.com>
HID cp2112: fix support for multiple gpiochips
Jia-Ju Bai <baijiaju1990(a)gmail.com>
HID: alps: fix error return code in alps_input_configured()
Luke D Jones <luke(a)ljones.dev>
HID: asus: Add support for 2021 ASUS N-Key keyboard
Shou-Chieh Hsu <shouchieh(a)chromium.org>
HID: google: add don USB id
Zhen Lei <thunder.leizhen(a)huawei.com>
perf map: Fix error return code in maps__clone()
Leo Yan <leo.yan(a)linaro.org>
perf auxtrace: Fix potential NULL pointer dereference
Jim Mattson <jmattson(a)google.com>
perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[]
Kan Liang <kan.liang(a)linux.intel.com>
perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
Ali Saidi <alisaidi(a)amazon.com>
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Tighten speculative pointer arithmetic mask
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Refactor and streamline bounds check into helper
Andrei Matei <andreimatei1(a)gmail.com>
bpf: Allow variable-offset stack access
Andre Przywara <andre.przywara(a)arm.com>
arm64: dts: allwinner: Revert SD card CD GPIO for Pine64-LTS
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
pinctrl: core: Show pin numbers for the controllers with base = 0
Christoph Hellwig <hch(a)lst.de>
block: return -EBUSY when there are open partitions in blkdev_reread_part
Yuanyuan Zhong <yzhong(a)purestorage.com>
pinctrl: lewisburg: Update number of pins in community
Eli Cohen <elic(a)nvidia.com>
vdpa/mlx5: Set err = -ENOMEM in case dma_map_sg_attrs fails
James Bottomley <James.Bottomley(a)HansenPartnership.com>
KEYS: trusted: Fix TPM reservation for seal/unseal
Tony Lindgren <tony(a)atomide.com>
gpio: omap: Save and restore sysconfig
Jiansong Chen <Jiansong.Chen(a)amd.com>
drm/amdgpu: fix GCR_GENERAL_CNTL offset for dimgrey_cavefish
Philip Yang <Philip.Yang(a)amd.com>
drm/amdgpu: reserve fence slot to update page table
Simon Ser <contact(a)emersion.fr>
amd/display: allow non-linear multi-planar formats
Christian König <christian.koenig(a)amd.com>
coda: fix reference counting in coda_file_mmap error path
Christian König <christian.koenig(a)amd.com>
ovl: fix reference counting in ovl_mmap error path
Xie Yongji <xieyongji(a)bytedance.com>
vhost-vdpa: protect concurrent access to vhost device iotlb
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/omap3.dtsi | 3 +
.../boot/dts/allwinner/sun50i-a64-pine64-lts.dts | 2 +-
arch/arm64/kernel/probes/kprobes.c | 6 +-
arch/csky/Kconfig | 2 +-
arch/csky/include/asm/page.h | 2 +-
arch/ia64/mm/discontig.c | 6 +-
arch/m68k/include/asm/page_mm.h | 2 +-
arch/s390/kernel/entry.S | 1 +
arch/x86/events/intel/core.c | 2 +-
arch/x86/events/intel/uncore_snbep.c | 61 +-
arch/x86/kernel/crash.c | 2 +-
block/ioctl.c | 2 +
drivers/dma/tegra20-apb-dma.c | 4 +-
drivers/dma/xilinx/xilinx_dpdma.c | 31 +-
drivers/gpio/gpio-omap.c | 9 +
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 10 +-
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +-
drivers/hid/hid-alps.c | 1 +
drivers/hid/hid-asus.c | 3 +
drivers/hid/hid-cp2112.c | 22 +-
drivers/hid/hid-google-hammer.c | 2 +
drivers/hid/hid-ids.h | 2 +
drivers/hid/wacom_wac.c | 2 +-
drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
drivers/net/geneve.c | 6 +
drivers/net/xen-netback/xenbus.c | 12 +-
drivers/pinctrl/core.c | 14 +-
drivers/pinctrl/intel/pinctrl-lewisburg.c | 6 +-
drivers/soc/qcom/qcom-geni-se.c | 3 +
drivers/vdpa/mlx5/core/mr.c | 4 +-
drivers/vhost/vdpa.c | 6 +-
fs/coda/file.c | 6 +-
fs/overlayfs/file.c | 11 +-
include/linux/bpf.h | 5 +
include/linux/bpf_verifier.h | 3 +-
include/linux/platform_data/gpio-omap.h | 3 +
kernel/bpf/verifier.c | 771 ++++++++++++++++-----
kernel/locking/qrwlock.c | 7 +-
security/keys/trusted-keys/trusted_tpm2.c | 2 +-
tools/arch/ia64/include/asm/barrier.h | 3 -
tools/perf/util/auxtrace.c | 2 +-
tools/perf/util/map.c | 7 +-
44 files changed, 756 insertions(+), 311 deletions(-)
From: Tony Lindgren <tony(a)atomide.com>
[ Upstream commit a1ebdb3741993f853865d1bd8f77881916ad53a7 ]
Also some omap3 devices like n900 seem to have eMMC and micro-sd swapped
around with commit 21b2cec61c04 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for
drivers that existed in v4.4").
Let's fix the issue with aliases as discussed on the mailing lists. While
the mmc aliases should be board specific, let's first fix the issue with
minimal changes.
Cc: Aaro Koskinen <aaro.koskinen(a)iki.fi>
Cc: Peter Ujfalusi <peter.ujfalusi(a)gmail.com>
Signed-off-by: Tony Lindgren <tony(a)atomide.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arm/boot/dts/omap3.dtsi | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 8a2b25332b8c..a2e41d79e829 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -22,6 +22,9 @@ aliases {
i2c0 = &i2c1;
i2c1 = &i2c2;
i2c2 = &i2c3;
+ mmc0 = &mmc1;
+ mmc1 = &mmc2;
+ mmc2 = &mmc3;
serial0 = &uart1;
serial1 = &uart2;
serial2 = &uart3;
--
2.30.2