From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
In thunderbolt mode the PHY is owned by the thunderbolt controller.
We are not supposed to touch it. So skip the vswing programming
as well (we already skipped the other steps not applicable to TBT).
Touching this stuff could supposedly interfere with the PHY
programming done by the thunderbolt controller.
Cc: stable(a)vger.kernel.org
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/gpu/drm/i915/display/intel_ddi.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
index 9506b8048530..c94650488dc1 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -2827,6 +2827,9 @@ static void icl_mg_phy_ddi_vswing_sequence(struct intel_encoder *encoder,
int n_entries, ln;
u32 val;
+ if (enc_to_dig_port(encoder)->tc_mode == TC_PORT_TBT_ALT)
+ return;
+
ddi_translations = icl_get_mg_buf_trans(encoder, crtc_state, &n_entries);
if (drm_WARN_ON_ONCE(&dev_priv->drm, !ddi_translations))
@@ -2962,6 +2965,9 @@ tgl_dkl_phy_ddi_vswing_sequence(struct intel_encoder *encoder,
u32 val, dpcnt_mask, dpcnt_val;
int n_entries, ln;
+ if (enc_to_dig_port(encoder)->tc_mode == TC_PORT_TBT_ALT)
+ return;
+
ddi_translations = tgl_get_dkl_buf_trans(encoder, crtc_state, &n_entries);
if (drm_WARN_ON_ONCE(&dev_priv->drm, !ddi_translations))
--
2.26.2
From: David Woodhouse <dwmw(a)amazon.co.uk>
[ Upstream commit 3499ba8198cad47b731792e5e56b9ec2a78a83a2 ]
For a while, event channel notification via the PCI platform device
has been broken, because we attempt to communicate with xenstore before
we even have notifications working, with the xs_reset_watches() call
in xs_init().
We tend to get away with this on Xen versions below 4.0 because we avoid
calling xs_reset_watches() anyway, because xenstore might not cope with
reading a non-existent key. And newer Xen *does* have the vector
callback support, so we rarely fall back to INTX/GSI delivery.
To fix it, clean up a bit of the mess of xs_init() and xenbus_probe()
startup. Call xs_init() directly from xenbus_init() only in the !XS_HVM
case, deferring it to be called from xenbus_probe() in the XS_HVM case
instead.
Then fix up the invocation of xenbus_probe() to happen either from its
device_initcall if the callback is available early enough, or when the
callback is finally set up. This means that the hack of calling
xenbus_probe() from a workqueue after the first interrupt, or directly
from the PCI platform device setup, is no longer needed.
Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky(a)oracle.com>
Link: https://lore.kernel.org/r/20210113132606.422794-2-dwmw2@infradead.org
Signed-off-by: Juergen Gross <jgross(a)suse.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arm/xen/enlighten.c | 2 +-
drivers/xen/events/events_base.c | 10 ----
drivers/xen/platform-pci.c | 1 -
drivers/xen/xenbus/xenbus.h | 1 +
drivers/xen/xenbus/xenbus_comms.c | 8 ---
drivers/xen/xenbus/xenbus_probe.c | 81 +++++++++++++++++++++++++------
include/xen/xenbus.h | 2 +-
7 files changed, 70 insertions(+), 35 deletions(-)
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index ba7f4c8f5c3e4..e8e637c4f354d 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -393,7 +393,7 @@ static int __init xen_guest_init(void)
}
gnttab_init();
if (!xen_initial_domain())
- xenbus_probe(NULL);
+ xenbus_probe();
/*
* Making sure board specific code will not set up ops for
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index aca8456752797..8c08c7d46d3d0 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -1987,16 +1987,6 @@ static struct irq_chip xen_percpu_chip __read_mostly = {
.irq_ack = ack_dynirq,
};
-int xen_set_callback_via(uint64_t via)
-{
- struct xen_hvm_param a;
- a.domid = DOMID_SELF;
- a.index = HVM_PARAM_CALLBACK_IRQ;
- a.value = via;
- return HYPERVISOR_hvm_op(HVMOP_set_param, &a);
-}
-EXPORT_SYMBOL_GPL(xen_set_callback_via);
-
#ifdef CONFIG_XEN_PVHVM
/* Vector callbacks are better than PCI interrupts to receive event
* channel notifications because we can receive vector callbacks on any
diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c
index 5d7dcad0b0a0d..4cec8146609ad 100644
--- a/drivers/xen/platform-pci.c
+++ b/drivers/xen/platform-pci.c
@@ -162,7 +162,6 @@ static int platform_pci_probe(struct pci_dev *pdev,
ret = gnttab_init();
if (ret)
goto grant_out;
- xenbus_probe(NULL);
return 0;
grant_out:
gnttab_free_auto_xlat_frames();
diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
index 139539b0ab20d..e6a8d02d35254 100644
--- a/drivers/xen/xenbus/xenbus.h
+++ b/drivers/xen/xenbus/xenbus.h
@@ -114,6 +114,7 @@ int xenbus_probe_node(struct xen_bus_type *bus,
const char *type,
const char *nodename);
int xenbus_probe_devices(struct xen_bus_type *bus);
+void xenbus_probe(void);
void xenbus_dev_changed(const char *node, struct xen_bus_type *bus);
diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
index eb5151fc8efab..e5fda0256feb3 100644
--- a/drivers/xen/xenbus/xenbus_comms.c
+++ b/drivers/xen/xenbus/xenbus_comms.c
@@ -57,16 +57,8 @@ DEFINE_MUTEX(xs_response_mutex);
static int xenbus_irq;
static struct task_struct *xenbus_task;
-static DECLARE_WORK(probe_work, xenbus_probe);
-
-
static irqreturn_t wake_waiting(int irq, void *unused)
{
- if (unlikely(xenstored_ready == 0)) {
- xenstored_ready = 1;
- schedule_work(&probe_work);
- }
-
wake_up(&xb_waitq);
return IRQ_HANDLED;
}
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 217bcc092a968..fe24e8dcb2b8e 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -674,29 +674,76 @@ void unregister_xenstore_notifier(struct notifier_block *nb)
}
EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
-void xenbus_probe(struct work_struct *unused)
+void xenbus_probe(void)
{
xenstored_ready = 1;
+ /*
+ * In the HVM case, xenbus_init() deferred its call to
+ * xs_init() in case callbacks were not operational yet.
+ * So do it now.
+ */
+ if (xen_store_domain_type == XS_HVM)
+ xs_init();
+
/* Notify others that xenstore is up */
blocking_notifier_call_chain(&xenstore_chain, 0, NULL);
}
-EXPORT_SYMBOL_GPL(xenbus_probe);
-static int __init xenbus_probe_initcall(void)
+/*
+ * Returns true when XenStore init must be deferred in order to
+ * allow the PCI platform device to be initialised, before we
+ * can actually have event channel interrupts working.
+ */
+static bool xs_hvm_defer_init_for_callback(void)
{
- if (!xen_domain())
- return -ENODEV;
+#ifdef CONFIG_XEN_PVHVM
+ return xen_store_domain_type == XS_HVM &&
+ !xen_have_vector_callback;
+#else
+ return false;
+#endif
+}
- if (xen_initial_domain() || xen_hvm_domain())
- return 0;
+static int __init xenbus_probe_initcall(void)
+{
+ /*
+ * Probe XenBus here in the XS_PV case, and also XS_HVM unless we
+ * need to wait for the platform PCI device to come up.
+ */
+ if (xen_store_domain_type == XS_PV ||
+ (xen_store_domain_type == XS_HVM &&
+ !xs_hvm_defer_init_for_callback()))
+ xenbus_probe();
- xenbus_probe(NULL);
return 0;
}
-
device_initcall(xenbus_probe_initcall);
+int xen_set_callback_via(uint64_t via)
+{
+ struct xen_hvm_param a;
+ int ret;
+
+ a.domid = DOMID_SELF;
+ a.index = HVM_PARAM_CALLBACK_IRQ;
+ a.value = via;
+
+ ret = HYPERVISOR_hvm_op(HVMOP_set_param, &a);
+ if (ret)
+ return ret;
+
+ /*
+ * If xenbus_probe_initcall() deferred the xenbus_probe()
+ * due to the callback not functioning yet, we can do it now.
+ */
+ if (!xenstored_ready && xs_hvm_defer_init_for_callback())
+ xenbus_probe();
+
+ return ret;
+}
+EXPORT_SYMBOL_GPL(xen_set_callback_via);
+
/* Set up event channel for xenstored which is run as a local process
* (this is normally used only in dom0)
*/
@@ -810,11 +857,17 @@ static int __init xenbus_init(void)
break;
}
- /* Initialize the interface to xenstore. */
- err = xs_init();
- if (err) {
- pr_warn("Error initializing xenstore comms: %i\n", err);
- goto out_error;
+ /*
+ * HVM domains may not have a functional callback yet. In that
+ * case let xs_init() be called from xenbus_probe(), which will
+ * get invoked at an appropriate time.
+ */
+ if (xen_store_domain_type != XS_HVM) {
+ err = xs_init();
+ if (err) {
+ pr_warn("Error initializing xenstore comms: %i\n", err);
+ goto out_error;
+ }
}
if ((xen_store_domain_type != XS_LOCAL) &&
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index eba01ab5a55e0..fe9a9fa2ebc45 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -187,7 +187,7 @@ void xs_suspend_cancel(void);
struct work_struct;
-void xenbus_probe(struct work_struct *);
+void xenbus_probe(void);
#define XENBUS_IS_ERR_READ(str) ({ \
if (!IS_ERR(str) && strlen(str) == 0) { \
--
2.27.0
Some Kingston A2000 NVMe SSDs sooner or later get confused and stop
working when they use the deepest APST sleep while running Linux. The
system then crashes and one has to cold boot it to get the SSD working
again.
Kingston seems to known about this since at least mid-September 2020:
https://bbs.archlinux.org/viewtopic.php?pid=1926994#p1926994
Someone working for a German company representing Kingston to the German
press confirmed to me Kingston engineering is aware of the issue and
investigating; the person stated that to their current knowledge only
the deepest APST sleep state causes trouble. Therefore, make Linux avoid
it for now by applying the NVME_QUIRK_NO_DEEPEST_PS to this SSD.
I have two such SSDs, but it seems the problem doesn't occur with them.
I hence couldn't verify if this patch really fixes the problem, but all
the data in front of me suggests it should.
This patch can easily be reverted or improved upon if a better solution
surfaces.
FWIW, there are many reports about the issue scattered around the web;
most of the users disabled APST completely to make things work, some
just made Linux avoid the deepest sleep state:
https://bugzilla.kernel.org/show_bug.cgi?id=195039#c65https://bugzilla.kernel.org/show_bug.cgi?id=195039#c73https://bugzilla.kernel.org/show_bug.cgi?id=195039#c74https://bugzilla.kernel.org/show_bug.cgi?id=195039#c78https://bugzilla.kernel.org/show_bug.cgi?id=195039#c79https://bugzilla.kernel.org/show_bug.cgi?id=195039#c80https://askubuntu.com/questions/1222049/nvmekingston-a2000-sometimes-stops-…https://community.acer.com/en/discussion/604326/m-2-nvme-ssd-aspire-517-51g…
For the record, some data from 'nvme id-ctrl /dev/nvme0'
NVME Identify Controller:
vid : 0x2646
ssvid : 0x2646
mn : KINGSTON SA2000M81000G
fr : S5Z42105
[...]
ps 0 : mp:9.00W operational enlat:0 exlat:0 rrt:0 rrl:0
rwt:0 rwl:0 idle_power:- active_power:-
ps 1 : mp:4.60W operational enlat:0 exlat:0 rrt:1 rrl:1
rwt:1 rwl:1 idle_power:- active_power:-
ps 2 : mp:3.80W operational enlat:0 exlat:0 rrt:2 rrl:2
rwt:2 rwl:2 idle_power:- active_power:-
ps 3 : mp:0.0450W non-operational enlat:2000 exlat:2000 rrt:3 rrl:3
rwt:3 rwl:3 idle_power:- active_power:-
ps 4 : mp:0.0040W non-operational enlat:15000 exlat:15000 rrt:4 rrl:4
rwt:4 rwl:4 idle_power:- active_power:-
Cc: stable(a)vger.kernel.org # 4.14+
Signed-off-by: Thorsten Leemhuis <linux(a)leemhuis.info>
---
Once this is out I will post a link to it in
https://bugzilla.kernel.org/show_bug.cgi?id=195039, maybe someone there
might be able to confirm that this fixes the issue.
---
drivers/nvme/host/pci.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 856aa31931c1..421735e16870 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3257,6 +3257,8 @@ static const struct pci_device_id nvme_id_table[] = {
.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
{ PCI_DEVICE(0x15b7, 0x2001), /* Sandisk Skyhawk */
.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
+ { PCI_DEVICE(0x2646, 0x2263), /* KINGSTON A2000 NVMe SSD */
+ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001),
.driver_data = NVME_QUIRK_SINGLE_VECTOR },
{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
--
2.29.2
Hello,
We're seeing a mysterious KASAN complaint without ce8f86ee94fa in Linux 5.10.11:
* https://lkml.org/lkml/2021/1/28/1344
It would be great to backport it to save others the same headache.
Thanks!
Typically FPGA devices are configured with CoreConsultant parameter
DWC_USB3x_EN_LOG_PHYS_EP_SUPT=0 to reduce gate count and improve timing.
This means that the number of INs equals to OUTs endpoints. But
typically non-FPGA devices enable this CoreConsultant parameter to
support flexible endpoint mapping and potentially may have unequal
number of INs to OUTs physical endpoints.
The driver must check how many physical endpoints are available for each
direction and initialize them properly.
Cc: stable(a)vger.kernel.org
Fixes: 47d3946ea220 ("usb: dwc3: refactor gadget endpoint count calculation")
Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
---
drivers/usb/dwc3/core.c | 1 +
drivers/usb/dwc3/core.h | 2 ++
drivers/usb/dwc3/gadget.c | 19 ++++++++++++-------
3 files changed, 15 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 841daec70b6e..1084aa8623c2 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -529,6 +529,7 @@ static void dwc3_core_num_eps(struct dwc3 *dwc)
struct dwc3_hwparams *parms = &dwc->hwparams;
dwc->num_eps = DWC3_NUM_EPS(parms);
+ dwc->num_in_eps = DWC3_NUM_IN_EPS(parms);
}
static void dwc3_cache_hwparams(struct dwc3 *dwc)
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 1b241f937d8f..1295dac019f9 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -990,6 +990,7 @@ struct dwc3_scratchpad_array {
* @u1sel: parameter from Set SEL request.
* @u1pel: parameter from Set SEL request.
* @num_eps: number of endpoints
+ * @num_in_eps: number of IN endpoints
* @ep0_next_event: hold the next expected event
* @ep0state: state of endpoint zero
* @link_state: link state
@@ -1193,6 +1194,7 @@ struct dwc3 {
u8 speed;
u8 num_eps;
+ u8 num_in_eps;
struct dwc3_hwparams hwparams;
struct dentry *root;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 25f654b79e48..8a38ee10c00b 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2025,7 +2025,7 @@ static void dwc3_stop_active_transfers(struct dwc3 *dwc)
{
u32 epnum;
- for (epnum = 2; epnum < dwc->num_eps; epnum++) {
+ for (epnum = 2; epnum < DWC3_ENDPOINTS_NUM; epnum++) {
struct dwc3_ep *dep;
dep = dwc->eps[epnum];
@@ -2628,16 +2628,21 @@ static int dwc3_gadget_init_endpoint(struct dwc3 *dwc, u8 epnum)
return 0;
}
-static int dwc3_gadget_init_endpoints(struct dwc3 *dwc, u8 total)
+static int dwc3_gadget_init_endpoints(struct dwc3 *dwc)
{
- u8 epnum;
+ u8 i;
+ int ret;
INIT_LIST_HEAD(&dwc->gadget->ep_list);
- for (epnum = 0; epnum < total; epnum++) {
- int ret;
+ for (i = 0; i < dwc->num_in_eps; i++) {
+ ret = dwc3_gadget_init_endpoint(dwc, i * 2 + 1);
+ if (ret)
+ return ret;
+ }
- ret = dwc3_gadget_init_endpoint(dwc, epnum);
+ for (i = 0; i < dwc->num_eps - dwc->num_in_eps; i++) {
+ ret = dwc3_gadget_init_endpoint(dwc, i * 2);
if (ret)
return ret;
}
@@ -3863,7 +3868,7 @@ int dwc3_gadget_init(struct dwc3 *dwc)
* sure we're starting from a well known location.
*/
- ret = dwc3_gadget_init_endpoints(dwc, dwc->num_eps);
+ ret = dwc3_gadget_init_endpoints(dwc);
if (ret)
goto err4;
base-commit: 96ebc9c871d8a28fb22aa758dd9188a4732df482
--
2.28.0
So this set has grown further than I expected.
This addresses most reviews from Paul and also consolidates the nocb
timers code.
Please mind the very first patch that is a stable bugfix.
git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks.git
rcu/dev
HEAD: 75991420c246c26f598602da1a70947b5bdf77b6
Thanks,
Frederic
---
Frederic Weisbecker (16):
rcu/nocb: Fix potential missed nocb_timer rearm
rcu/nocb: Comment the reason behind BH disablement on batch processing
rcu/nocb: Forbid NOCB toggling on offline CPUs
rcu/nocb: Only (re-)initialize segcblist when needed on CPU up
rcu/nocb: Disable bypass when CPU isn't completely offloaded
rcu/nocb: Avoid confusing double write of rdp->nocb_cb_sleep
rcu/nocb: Rename nocb_gp_update_state to nocb_gp_update_state_deoffloading
rcu/nocb: Move trace_rcu_nocb_wake() calls outside nocb_lock when possible
rcu/nocb: Merge nocb_timer to the rdp leader
rcu/nocb: Directly call __wake_nocb_gp() from bypass timer
rcu/nocb: Allow de-offloading rdp leader
rcu/nocb: Cancel nocb_timer upon nocb_gp wakeup
rcu/nocb: Delete bypass_timer upon nocb_gp wakeup
rcu/nocb: Only cancel nocb timer if not polling
rcu/nocb: Prepare for finegrained deferred wakeup
rcu/nocb: Unify timers
include/linux/rcu_segcblist.h | 7 +-
include/trace/events/rcu.h | 1 +
kernel/rcu/tree.c | 12 +-
kernel/rcu/tree.h | 9 +-
kernel/rcu/tree_plugin.h | 280 ++++++++++++++++++++++--------------------
5 files changed, 163 insertions(+), 146 deletions(-)
On Thu, Jan 28, 2021 at 11:12:28AM -0800, Paul E. McKenney wrote:
> On Thu, Jan 28, 2021 at 06:12:10PM +0100, Frederic Weisbecker wrote:
> > Simply checking if the segcblist is enabled is enough to know if we
> > need to initialize it or not. It's safe to check within hotplug
> > machine.
> >
> > Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org>
> > Cc: Josh Triplett <josh(a)joshtriplett.org>
> > Cc: Lai Jiangshan <jiangshanlai(a)gmail.com>
> > Cc: Joel Fernandes <joel(a)joelfernandes.org>
> > Cc: Neeraj Upadhyay <neeraju(a)codeaurora.org>
> > Cc: Boqun Feng <boqun.feng(a)gmail.com>
>
> Hmmm...
>
> At the start of a CPU-hotplug operation, an incoming CPU's callback
> list can be in a number of states:
>
> 1. Disabled and empty. This is the case when the boot CPU has
> not done call_rcu(), when a non-boot CPU first comes online,
> and when a non-offloaded CPU comes back online. In this case,
> it is permissible to initialize ->cblist. Because either the
> CPU is currently running with interrupts disabled (boot CPU)
> or is not yet running at all (other CPUs), it is not necessary
> to acquire ->nocb_lock.
>
> 2. Disabled and non-empty. This is the case when the boot CPU has
> done call_rcu(). It is not permissible to initialize ->cblist
> because doing so will leak any callbacks posted by early boot
> invocations of call_rcu().
I don't think that's possible. In this case __call_rcu() has called
rcu_segcblist_init() and has enabled the segcblist.
>
> Test for the possibility of leaking by building with
> CONFIG_PROVE_RCU=y and booting with rcupdate.rcu_self_test=1.
>
> 3. Enabled, whether empty or not. This is the case when an
> offloaded CPU comes back online. This is the only case where
> the ->nocb_lock must be held to modify ->cblist. However,
> it is not necessarily to modify ->cblist because the rcuoc
> kthread is on the job.
>
> So I believe that it is necessary to check for both disabled and empty.
> But don't take my word for it! Build with CONFIG_PROVE_RCU=y and boot
> with rcupdate.rcu_self_test=1. ;-)
I'm trying that :-)
What 84965ff8a84f0 ("io_uring: if we see flush on exit, cancel related tasks")
really wants is to cancel all relevant REQ_F_INFLIGHT requests reliably.
That can be achieved by io_uring_cancel_files(), but we'll miss it
calling io_uring_cancel_task_requests(files=NULL) from io_uring_flush(),
because it will go through __io_uring_cancel_task_requests().
Just always call io_uring_cancel_files() during cancel, it's good enough
for now.
Cc: stable(a)vger.kernel.org # 5.9+
Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com>
---
p.s. fold in, maybe?
fs/io_uring.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 12bf7180c0f1..38c6cbe1ab38 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8976,10 +8976,9 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
io_cancel_defer_files(ctx, task, files);
io_cqring_overflow_flush(ctx, true, task, files);
+ io_uring_cancel_files(ctx, task, files);
if (!files)
__io_uring_cancel_task_requests(ctx, task);
- else
- io_uring_cancel_files(ctx, task, files);
if ((ctx->flags & IORING_SETUP_SQPOLL) && ctx->sq_data) {
atomic_dec(&task->io_uring->in_idle);
--
2.24.0
On Thu, Jan 28, 2021 at 10:48:34AM -0800, Paul E. McKenney wrote:
> On Thu, Jan 28, 2021 at 06:12:07PM +0100, Frederic Weisbecker wrote:
> > The "nocb_bypass_timer" ends up calling wake_nocb_gp() which deletes
> > the pending "nocb_timer" (note they are not the same timers) for the
> > given rdp without resetting the matching state stored in nocb_defer
> > wakeup.
> >
> > As a result, a future call_rcu() on that rdp may be fooled and think the
> > timer is armed when it's not, missing a deferred nocb_gp wakeup.
> >
> > Fix this with resetting rdp->nocb_defer_wakeup when we disarm the timer.
> >
> > Fixes: d1b222c6be1f (rcu/nocb: Add bypass callback queueing)
> > Cc: Stable <stable(a)vger.kernel.org>
> > Cc: Josh Triplett <josh(a)joshtriplett.org>
> > Cc: Lai Jiangshan <jiangshanlai(a)gmail.com>
> > Cc: Joel Fernandes <joel(a)joelfernandes.org>
> > Cc: Neeraj Upadhyay <neeraju(a)codeaurora.org>
> > Cc: Boqun Feng <boqun.feng(a)gmail.com>
> > Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org>
> > ---
> > kernel/rcu/tree_plugin.h | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
> > index 7e33dae0e6ee..a44f80d7661b 100644
> > --- a/kernel/rcu/tree_plugin.h
> > +++ b/kernel/rcu/tree_plugin.h
> > @@ -1705,6 +1705,8 @@ static bool wake_nocb_gp(struct rcu_data *rdp, bool force,
> > rcu_nocb_unlock_irqrestore(rdp, flags);
> > return false;
> > }
> > +
> > + rdp->nocb_defer_wakeup = RCU_NOCB_WAKE_NOT;
>
> Given this change, does it make sense to remove the
> setting of ->nocb_defer_wakeup to RCU_NOCB_WAKE_NOT from the
> do_nocb_deferred_wakeup_common() function?
I do it later in "[PATCH 09/16] rcu/nocb: Merge nocb_timer to the rdp leader"
> Does the above assignment need
> to be WRITE_ONCE(), in other words, are all reads of ->nocb_defer_wakeup
> done with either ->nocb_lock or ->nocb_gp_lock held? (I do not believe
> that this is the case.)
Ah indeed it should probably be done with WRITE_ONCE() because it's read
locklessly on many places.
Thanks.
>
> Thanx, Paul
>
> > del_timer(&rdp->nocb_timer);
> > rcu_nocb_unlock_irqrestore(rdp, flags);
> > raw_spin_lock_irqsave(&rdp_gp->nocb_gp_lock, flags);
> > --
> > 2.25.1
> >
WARNING: CPU: 0 PID: 21359 at fs/io_uring.c:9042
io_uring_cancel_task_requests+0xe55/0x10c0 fs/io_uring.c:9042
Call Trace:
io_uring_flush+0x47b/0x6e0 fs/io_uring.c:9227
filp_close+0xb4/0x170 fs/open.c:1295
close_files fs/file.c:403 [inline]
put_files_struct fs/file.c:418 [inline]
put_files_struct+0x1cc/0x350 fs/file.c:415
exit_files+0x7e/0xa0 fs/file.c:435
do_exit+0xc22/0x2ae0 kernel/exit.c:820
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x427/0x20f0 kernel/signal.c:2773
arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811
handle_signal_work kernel/entry/common.c:147 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:302
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Now io_uring_cancel_task_requests() can be called not through file
notes but directly, remove a WARN_ONCE() there that give us false
positives. That check is not very important and we catch it in other
places.
Fixes: 84965ff8a84f0 ("io_uring: if we see flush on exit, cancel related tasks")
Cc: stable(a)vger.kernel.org # 5.9+
Reported-by: syzbot+3e3d9bd0c6ce9efbc3ef(a)syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com>
---
fs/io_uring.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 39ae1f821cef..12bf7180c0f1 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8967,8 +8967,6 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
struct task_struct *task = current;
if ((ctx->flags & IORING_SETUP_SQPOLL) && ctx->sq_data) {
- /* for SQPOLL only sqo_task has task notes */
- WARN_ON_ONCE(ctx->sqo_task != current);
io_disable_sqo_submit(ctx);
task = ctx->sq_data->thread;
atomic_inc(&task->io_uring->in_idle);
--
2.24.0
On Thu, Jan 28, 2021, Paolo Bonzini wrote:
> On 28/01/21 18:56, Sean Christopherson wrote:
> > On Thu, Jan 28, 2021, Paolo Bonzini wrote:
> > > - vmx->guest_uret_msrs[j].mask = ~(u64)TSX_CTRL_CPUID_CLEAR;
> > > + if (boot_cpu_has(X86_FEATURE_RTM))
> > > + vmx->guest_uret_msrs[j].mask = ~(u64)TSX_CTRL_CPUID_CLEAR;
> > > + else
> > > + vmx->guest_uret_msrs[j].mask = 0;
> >
> > IMO, this is an unnecessarily confusing way to "remove" the user return MSR.
> > Changing the ordering to do a 'continue' would also provide a separate chunk of
> > code for the new comment. And maybe replace the switch with an if-statement to
> > avoid a 'continue' buried in a switch?
>
> You still need the slot in vmx->guest_uret_msrs to store the guest value,
> even though the two available bits are both no-ops. It's ugly but it makes
> sense: you don't want to ever re-enable TSX, so you use the ignore the guest
> value and run unconditionally with the host value.
Ugh, didn't think about the guest wanting to read back the value it wrote.
> I'll rephrase everything and resend.
Thanks!
Userspace that does not know about KVM_GET_MSR_FEATURE_INDEX_LIST will
generally use the default value for MSR_IA32_ARCH_CAPABILITIES.
When this happens and the host has tsx=on, it is possible to end up
with virtual machines that have HLE and RTM disabled, but TSX_CTRL
disabled.
If the fleet is then switched to tsx=off, kvm_get_arch_capabilities()
will clear the ARCH_CAP_TSX_CTRL_MSR bit and it will not be possible
to use the tsx=off as migration destinations, even though the guests
indeed do not have TSX enabled.
When tsx=off is used, however, we know that guests will not have
HLE and RTM (or if userspace sets bogus CPUID data, we do not
expect HLE and RTM to work in guests). Therefore we can keep
TSX_CTRL_RTM_DISABLE set for the entire life of the guests and
save MSR reads and writes on KVM_RUN and in the user return
notifiers.
Cc: stable(a)vger.kernel.org
Fixes: cbbaa2727aa3 ("KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES")
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
---
arch/x86/kvm/vmx/vmx.c | 12 +++++++++++-
arch/x86/kvm/x86.c | 2 +-
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index cc60b1fc3ee7..80491a729408 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6863,8 +6863,18 @@ static int vmx_create_vcpu(struct kvm_vcpu *vcpu)
* No need to pass TSX_CTRL_CPUID_CLEAR through, so
* let's avoid changing CPUID bits under the host
* kernel's feet.
+ *
+ * If the host disabled RTM, we may still need TSX_CTRL
+ * to be supported in the guest; for example the guest
+ * could have been created on a tsx=on host with hle=0,
+ * rtm=0, tsx_ctrl=1 and later migrate to a tsx=off host.
+ * In that case however do not change the value on the host,
+ * so that TSX remains always disabled.
*/
- vmx->guest_uret_msrs[j].mask = ~(u64)TSX_CTRL_CPUID_CLEAR;
+ if (boot_cpu_has(X86_FEATURE_RTM))
+ vmx->guest_uret_msrs[j].mask = ~(u64)TSX_CTRL_CPUID_CLEAR;
+ else
+ vmx->guest_uret_msrs[j].mask = 0;
break;
default:
vmx->guest_uret_msrs[j].mask = -1ull;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 76bce832cade..15733013b266 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1401,7 +1401,7 @@ static u64 kvm_get_arch_capabilities(void)
* This lets the guest use VERW to clear CPU buffers.
*/
if (!boot_cpu_has(X86_FEATURE_RTM))
- data &= ~(ARCH_CAP_TAA_NO | ARCH_CAP_TSX_CTRL_MSR);
+ data &= ~ARCH_CAP_TAA_NO;
else if (!boot_cpu_has_bug(X86_BUG_TAA))
data |= ARCH_CAP_TAA_NO;
--
2.26.2
Den 28.1.2021 kl. 12:05, skrev Chris Clayton:
>
> On 28/01/2021 09:34, Greg Kroah-Hartman wrote:
>> On Thu, Jan 28, 2021 at 09:17:10AM +0000, Chris Clayton wrote:
>>> Hi,
>>>
>>> Building 5.10.11 fails on my (x86-64) laptop thusly:
>>>
>>> ..
>>>
>>> AS arch/x86/entry/thunk_64.o
>>> CC arch/x86/entry/vsyscall/vsyscall_64.o
>>> AS arch/x86/realmode/rm/header.o
>>> CC arch/x86/mm/pat/set_memory.o
>>> CC arch/x86/events/amd/core.o
>>> CC arch/x86/kernel/fpu/init.o
>>> CC arch/x86/entry/vdso/vma.o
>>> CC kernel/sched/core.o
>>> arch/x86/entry/thunk_64.o: warning: objtool: missing symbol for insn at offset 0x3e
>>>
>>> AS arch/x86/realmode/rm/trampoline_64.o
>>> make[2]: *** [scripts/Makefile.build:360: arch/x86/entry/thunk_64.o] Error 255
>>> make[2]: *** Deleting file 'arch/x86/entry/thunk_64.o'
>>> make[2]: *** Waiting for unfinished jobs....
>>>
>>> ..
>>>
>>> Compiler is latest snapshot of gcc-10.
>>>
>>> Happy to test the fix but please cc me as I'm not subscribed
>>
>> Can you do 'git bisect' to track down the offending commit?
>>
>
> Sure, but I'll hold that request for a while. I updated to binutils-2.36 on Monday and I'm pretty sure that is a feature
> of this build fail. I've reverted binutils to 2.35.1, and the build succeeds. Updated to 2.36 again and, surprise,
> surprise, the kernel build fails again.
>
> I've had a glance at the binutils ML and there are all sorts of issues being reported, but it's beyond my knowledge to
> assess if this build error is related to any of them.
>
> I'll stick with binutils-2.35.1 for the time being.
>
>> And what exact gcc version are you using?
>>
>
> It's built from the 10-20210123 snapshot tarball.
>
> I can report this to the binutils folks, but might it be better if the objtool maintainer looks at it first? The
> binutils change might just have opened the gate to a bug in objtool.
>
>> thanks,
>>
>> greg k-h
>>
>
AFAIK you need this in stable trees:
From 1d489151e9f9d1647110277ff77282fe4d96d09b Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe(a)redhat.com>
Date: Thu, 14 Jan 2021 16:14:01 -0600
Subject: [PATCH] objtool: Don't fail on missing symbol table
--
Thomas
This function will be needed by the next patch where the driver
calculates the BW based on driver specific parameters, so export it.
At the same time sanitize the function params, passing the more natural
link rate instead of the encoding of the same rate.
Cc: Lyude Paul <lyude(a)redhat.com>
Cc: Ville Syrjala <ville.syrjala(a)intel.com>
Cc: <stable(a)vger.kernel.org>
Cc: dri-devel(a)lists.freedesktop.org
Signed-off-by: Imre Deak <imre.deak(a)intel.com>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 24 ++++++++++++++++++------
include/drm/drm_dp_mst_helper.h | 1 +
2 files changed, 19 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 475939138b21..dc96cbf78cc6 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -3629,14 +3629,26 @@ static int drm_dp_send_up_ack_reply(struct drm_dp_mst_topology_mgr *mgr,
return 0;
}
-static int drm_dp_get_vc_payload_bw(u8 dp_link_bw, u8 dp_link_count)
+/**
+ * drm_dp_get_vc_payload_bw - get the VC payload BW for an MST link
+ * @rate: link rate in 10kbits/s units
+ * @lane_count: lane count
+ *
+ * Calculate the toal bandwidth of a MultiStream Transport link. The returned
+ * value is in units of PBNs/(timeslots/1 MTP). This value can be used to
+ * convert the number of PBNs required for a given stream to the number of
+ * timeslots this stream requires in each MTP.
+ */
+int drm_dp_get_vc_payload_bw(int link_rate, int link_lane_count)
{
- if (dp_link_bw == 0 || dp_link_count == 0)
- DRM_DEBUG_KMS("invalid link bandwidth in DPCD: %x (link count: %d)\n",
- dp_link_bw, dp_link_count);
+ if (link_rate == 0 || link_lane_count == 0)
+ DRM_DEBUG_KMS("invalid link rate/lane count: (%d / %d)\n",
+ link_rate, link_lane_count);
- return dp_link_bw * dp_link_count / 2;
+ /* See DP v2.0 2.6.4.2, VCPayload_Bandwidth_for_OneTimeSlotPer_MTP_Allocation */
+ return link_rate * link_lane_count / 54000;
}
+EXPORT_SYMBOL(drm_dp_get_vc_payload_bw);
/**
* drm_dp_read_mst_cap() - check whether or not a sink supports MST
@@ -3692,7 +3704,7 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
goto out_unlock;
}
- mgr->pbn_div = drm_dp_get_vc_payload_bw(mgr->dpcd[1],
+ mgr->pbn_div = drm_dp_get_vc_payload_bw(drm_dp_bw_code_to_link_rate(mgr->dpcd[1]),
mgr->dpcd[2] & DP_MAX_LANE_COUNT_MASK);
if (mgr->pbn_div == 0) {
ret = -EINVAL;
diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
index f5e92fe9151c..bd1c39907b92 100644
--- a/include/drm/drm_dp_mst_helper.h
+++ b/include/drm/drm_dp_mst_helper.h
@@ -783,6 +783,7 @@ drm_dp_mst_detect_port(struct drm_connector *connector,
struct edid *drm_dp_mst_get_edid(struct drm_connector *connector, struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port);
+int drm_dp_get_vc_payload_bw(int link_rate, int link_lane_count);
int drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc);
--
2.25.1
This is a note to let you know that I've just added the patch titled
w1: w1_therm: Fix conversion result for negative temperatures
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 2f6055c26f1913763eabc66c7c27d0693561e966 Mon Sep 17 00:00:00 2001
From: Ivan Zaentsev <ivan.zaentsev(a)wirenboard.ru>
Date: Thu, 21 Jan 2021 12:30:21 +0300
Subject: w1: w1_therm: Fix conversion result for negative temperatures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
DS18B20 device driver returns an incorrect value for negative temperatures
due to a missing sign-extension in w1_DS18B20_convert_temp().
Fix by using s16 temperature value when converting to int.
Fixes: 9ace0b4dab1c (w1: w1_therm: Add support for GXCAS GX20MH01 device.)
Cc: stable <stable(a)vger.kernel.org>
Reported-by: Paweł Marciniak <sunwire(a)gmail.com>
Signed-off-by: Ivan Zaentsev <ivan.zaentsev(a)wirenboard.ru>
Link: https://lore.kernel.org/r/20210121093021.224764-1-ivan.zaentsev@wirenboard.…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/w1/slaves/w1_therm.c | 22 +++++++++-------------
1 file changed, 9 insertions(+), 13 deletions(-)
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 3712b1e6dc71..976eea28f268 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -667,28 +667,24 @@ static inline int w1_DS18B20_get_resolution(struct w1_slave *sl)
*/
static inline int w1_DS18B20_convert_temp(u8 rom[9])
{
- int t;
- u32 bv;
+ u16 bv;
+ s16 t;
+
+ /* Signed 16-bit value to unsigned, cpu order */
+ bv = le16_to_cpup((__le16 *)rom);
/* Config register bit R2 = 1 - GX20MH01 in 13 or 14 bit resolution mode */
if (rom[4] & 0x80) {
- /* Signed 16-bit value to unsigned, cpu order */
- bv = le16_to_cpup((__le16 *)rom);
-
/* Insert two temperature bits from config register */
/* Avoid arithmetic shift of signed value */
bv = (bv << 2) | (rom[4] & 3);
-
- t = (int) sign_extend32(bv, 17); /* Degrees, lowest bit is 2^-6 */
- return (t*1000)/64; /* Millidegrees */
+ t = (s16) bv; /* Degrees, lowest bit is 2^-6 */
+ return (int)t * 1000 / 64; /* Sign-extend to int; millidegrees */
}
-
- t = (int)le16_to_cpup((__le16 *)rom);
- return t*1000/16;
+ t = (s16)bv; /* Degrees, lowest bit is 2^-4 */
+ return (int)t * 1000 / 16; /* Sign-extend to int; millidegrees */
}
-
-
/**
* w1_DS18S20_convert_temp() - temperature computation for DS18S20
* @rom: data read from device RAM (8 data bytes + 1 CRC byte)
--
2.30.0
This is a note to let you know that I've just added the patch titled
virt: vbox: Do not use wait_event_interruptible when called from
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From c35901b39ddc20077f4ae7b9f7bf344487f62212 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede(a)redhat.com>
Date: Thu, 21 Jan 2021 16:07:54 +0100
Subject: virt: vbox: Do not use wait_event_interruptible when called from
kernel context
Do not use wait_event_interruptible when vbg_hgcm_call() gets called from
kernel-context, such as it being called by the vboxsf filesystem code.
This fixes some filesystem related system calls on shared folders
unexpectedly failing with -EINTR.
Fixes: 0532a1b0d045 ("virt: vbox: Implement passing requestor info to the host for VirtualBox 6.0.x")
Reported-by: Ludovic Pouzenc <bugreports(a)pouzenc.fr>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20210121150754.147598-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/virt/vboxguest/vboxguest_utils.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
index ea05af41ec69..8d195e3f8301 100644
--- a/drivers/virt/vboxguest/vboxguest_utils.c
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -468,7 +468,7 @@ static int hgcm_cancel_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call)
* Cancellation fun.
*/
static int vbg_hgcm_do_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call,
- u32 timeout_ms, bool *leak_it)
+ u32 timeout_ms, bool interruptible, bool *leak_it)
{
int rc, cancel_rc, ret;
long timeout;
@@ -495,10 +495,15 @@ static int vbg_hgcm_do_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call,
else
timeout = msecs_to_jiffies(timeout_ms);
- timeout = wait_event_interruptible_timeout(
- gdev->hgcm_wq,
- hgcm_req_done(gdev, &call->header),
- timeout);
+ if (interruptible) {
+ timeout = wait_event_interruptible_timeout(gdev->hgcm_wq,
+ hgcm_req_done(gdev, &call->header),
+ timeout);
+ } else {
+ timeout = wait_event_timeout(gdev->hgcm_wq,
+ hgcm_req_done(gdev, &call->header),
+ timeout);
+ }
/* timeout > 0 means hgcm_req_done has returned true, so success */
if (timeout > 0)
@@ -631,7 +636,8 @@ int vbg_hgcm_call(struct vbg_dev *gdev, u32 requestor, u32 client_id,
hgcm_call_init_call(call, client_id, function, parms, parm_count,
bounce_bufs);
- ret = vbg_hgcm_do_call(gdev, call, timeout_ms, &leak_it);
+ ret = vbg_hgcm_do_call(gdev, call, timeout_ms,
+ requestor & VMMDEV_REQUESTOR_USERMODE, &leak_it);
if (ret == 0) {
*vbox_status = call->header.result;
ret = hgcm_call_copy_back_result(call, parms, parm_count,
--
2.30.0
As per register documentation, QCOM_WDT_ENABLE_IRQ which is BIT(1)
of watchdog control register is wakeup interrupt enable bit and
not related to bark interrupt at all, BIT(0) is used for that.
So remove incorrect usage of this bit when supporting bark irq for
pre-timeout notification. Currently with this bit set and bark
interrupt specified, pre-timeout notification and/or watchdog
reset/bite does not occur.
Fixes: 36375491a439 ("watchdog: qcom: support pre-timeout when the bark irq is available")
Cc: stable(a)vger.kernel.org
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org>
---
Reading the conversations from when qcom pre-timeout support was
added [1], Bjorn already had mentioned it was not right to touch this
bit, not sure which SoC the pre-timeout was tested on at that time,
but I have tested this on SDM845, SM8150, SC7180 and watchdog bark
and bite does not occur with enabling this bit with the bark irq
specified in DT.
[1] https://lore.kernel.org/linux-watchdog/20190906174009.GC11938@tuxbook-pro/
---
drivers/watchdog/qcom-wdt.c | 13 +------------
1 file changed, 1 insertion(+), 12 deletions(-)
diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
index 7cf0f2ec649b..e38a87ffe5f5 100644
--- a/drivers/watchdog/qcom-wdt.c
+++ b/drivers/watchdog/qcom-wdt.c
@@ -22,7 +22,6 @@ enum wdt_reg {
};
#define QCOM_WDT_ENABLE BIT(0)
-#define QCOM_WDT_ENABLE_IRQ BIT(1)
static const u32 reg_offset_data_apcs_tmr[] = {
[WDT_RST] = 0x38,
@@ -63,16 +62,6 @@ struct qcom_wdt *to_qcom_wdt(struct watchdog_device *wdd)
return container_of(wdd, struct qcom_wdt, wdd);
}
-static inline int qcom_get_enable(struct watchdog_device *wdd)
-{
- int enable = QCOM_WDT_ENABLE;
-
- if (wdd->pretimeout)
- enable |= QCOM_WDT_ENABLE_IRQ;
-
- return enable;
-}
-
static irqreturn_t qcom_wdt_isr(int irq, void *arg)
{
struct watchdog_device *wdd = arg;
@@ -91,7 +80,7 @@ static int qcom_wdt_start(struct watchdog_device *wdd)
writel(1, wdt_addr(wdt, WDT_RST));
writel(bark * wdt->rate, wdt_addr(wdt, WDT_BARK_TIME));
writel(wdd->timeout * wdt->rate, wdt_addr(wdt, WDT_BITE_TIME));
- writel(qcom_get_enable(wdd), wdt_addr(wdt, WDT_EN));
+ writel(QCOM_WDT_ENABLE, wdt_addr(wdt, WDT_EN));
return 0;
}
--
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member
of Code Aurora Forum, hosted by The Linux Foundation
Hi,
Building 5.10.11 fails on my (x86-64) laptop thusly:
..
AS arch/x86/entry/thunk_64.o
CC arch/x86/entry/vsyscall/vsyscall_64.o
AS arch/x86/realmode/rm/header.o
CC arch/x86/mm/pat/set_memory.o
CC arch/x86/events/amd/core.o
CC arch/x86/kernel/fpu/init.o
CC arch/x86/entry/vdso/vma.o
CC kernel/sched/core.o
arch/x86/entry/thunk_64.o: warning: objtool: missing symbol for insn at offset 0x3e
AS arch/x86/realmode/rm/trampoline_64.o
make[2]: *** [scripts/Makefile.build:360: arch/x86/entry/thunk_64.o] Error 255
make[2]: *** Deleting file 'arch/x86/entry/thunk_64.o'
make[2]: *** Waiting for unfinished jobs....
..
Compiler is latest snapshot of gcc-10.
Happy to test the fix but please cc me as I'm not subscribed
Thanks,
Chris
From: Pawel Wieczorkiewicz <wipawel(a)amazon.de>
commit 1c728719a4da6e654afb9cc047164755072ed7c9 upstream.
When xen_blkif_disconnect() is called, the kernel thread behind the
block interface is stopped by calling kthread_stop(ring->xenblkd).
The ring->xenblkd thread pointer being non-NULL determines if the
thread has been already stopped.
Normally, the thread's function xen_blkif_schedule() sets the
ring->xenblkd to NULL, when the thread's main loop ends.
However, when the thread has not been started yet (i.e.
wake_up_process() has not been called on it), the xen_blkif_schedule()
function would not be called yet.
In such case the kthread_stop() call returns -EINTR and the
ring->xenblkd remains dangling.
When this happens, any consecutive call to xen_blkif_disconnect (for
example in frontend_changed() callback) leads to a kernel crash in
kthread_stop() (e.g. NULL pointer dereference in exit_creds()).
This is XSA-350.
Cc: <stable(a)vger.kernel.org> # 4.12
Fixes: a24fa22ce22a ("xen/blkback: don't use xen_blkif_get() in xen-blkback kthread")
Reported-by: Olivier Benjamin <oliben(a)amazon.com>
Reported-by: Pawel Wieczorkiewicz <wipawel(a)amazon.de>
Signed-off-by: Pawel Wieczorkiewicz <wipawel(a)amazon.de>
Reviewed-by: Julien Grall <jgrall(a)amazon.com>
Reviewed-by: Juergen Gross <jgross(a)suse.com>
Signed-off-by: Juergen Gross <jgross(a)suse.com>
[iwamatsu: change from ring to blkif]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu(a)toshiba.co.jp>
---
drivers/block/xen-blkback/xenbus.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 823f3480ebd19e..f974ed7c33b5df 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -219,6 +219,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
if (blkif->xenblkd) {
kthread_stop(blkif->xenblkd);
+ blkif->xenblkd = NULL;
wake_up(&blkif->shutdown_wq);
}
--
2.30.0
During checkpoint=disable period, f2fs bypasses all the synchronous IOs such as
sync and fsync. So, when enabling it back, we must flush all of them in order
to keep the data persistent. Otherwise, suddern power-cut right after enabling
checkpoint will cause data loss.
Fixes: 4354994f097d ("f2fs: checkpoint disabling")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
---
fs/f2fs/super.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 359cc5a2f8f5..073b51af62c8 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1887,6 +1887,9 @@ static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi)
static void f2fs_enable_checkpoint(struct f2fs_sb_info *sbi)
{
+ /* we should flush all the data to keep data consistency */
+ sync_inodes_sb(sbi->sb);
+
down_write(&sbi->gc_lock);
f2fs_dirty_to_prefree(sbi);
--
2.30.0.280.ga3ce27912f-goog
Currently kdb uses in_interrupt() to determine whether its library
code has been called from the kgdb trap handler or from a saner calling
context such as driver init. This approach is broken because
in_interrupt() alone isn't able to determine kgdb trap handler entry from
normal task context. This can happen during normal use of basic features
such as breakpoints and can also be trivially reproduced using:
echo g > /proc/sysrq-trigger
We can improve this by adding check for in_dbg_master() instead which
explicitly determines if we are running in debugger context.
Cc: stable(a)vger.kernel.org
Signed-off-by: Sumit Garg <sumit.garg(a)linaro.org>
---
Changes in v3:
- Refined commit description and Cc: stable(a)vger.kernel.org.
Changes in v2:
- Get rid of redundant in_atomic() check.
kernel/debug/kdb/kdb_private.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index 7a4a181..344eb0d 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -231,7 +231,7 @@ extern struct task_struct *kdb_curr_task(int);
#define kdb_task_has_cpu(p) (task_curr(p))
-#define GFP_KDB (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL)
+#define GFP_KDB (in_dbg_master() ? GFP_ATOMIC : GFP_KERNEL)
extern void *debug_kmalloc(size_t size, gfp_t flags);
extern void debug_kfree(void *);
--
2.7.4
It has been reported[0] that the Dell XPS 15 L502X exhibits similar
freezing behavior to the other systems[1] on this blacklist. The issue
was exposed by a prior change of mine to automatically load
dell_smm_hwmon on a wider set of XPS models. To fix the regression, add
this model to the blacklist.
[0] https://bugzilla.kernel.org/show_bug.cgi?id=211081
[1] https://bugzilla.kernel.org/show_bug.cgi?id=195751
Fixes: b8a13e5e8f37 ("hwmon: (dell-smm) Use one DMI match for all XPS models")
Cc: stable(a)vger.kernel.org
Reported-by: Bob Hepple <bob.hepple(a)gmail.com>
Tested-by: Bob Hepple <bob.hepple(a)gmail.com>
Signed-off-by: Thomas Hebb <tommyhebb(a)gmail.com>
---
drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index ec448f5f2dc3..73b9db9e3aab 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -1159,6 +1159,13 @@ static struct dmi_system_id i8k_blacklist_fan_support_dmi_table[] __initdata = {
DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS13 9333"),
},
},
+ {
+ .ident = "Dell XPS 15 L502X",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L502X"),
+ },
+ },
{ }
};
--
2.30.0
From: Nadav Amit <namit(a)vmware.com>
When an Intel IOMMU is virtualized, and a physical device is
passed-through to the VM, changes of the virtual IOMMU need to be
propagated to the physical IOMMU. The hypervisor therefore needs to
monitor PTE mappings in the IOMMU page-tables. Intel specifications
provide "caching-mode" capability that a virtual IOMMU uses to report
that the IOMMU is virtualized and a TLB flush is needed after mapping to
allow the hypervisor to propagate virtual IOMMU mappings to the physical
IOMMU. To the best of my knowledge no real physical IOMMU reports
"caching-mode" as turned on.
Synchronizing the virtual and the physical IOMMU tables is expensive if
the hypervisor is unaware which PTEs have changed, as the hypervisor is
required to walk all the virtualized tables and look for changes.
Consequently, domain flushes are much more expensive than page-specific
flushes on virtualized IOMMUs with passthrough devices. The kernel
therefore exploited the "caching-mode" indication to avoid domain
flushing and use page-specific flushing in virtualized environments. See
commit 78d5f0f500e6 ("intel-iommu: Avoid global flushes with caching
mode.")
This behavior changed after commit 13cf01744608 ("iommu/vt-d: Make use
of iova deferred flushing"). Now, when batched TLB flushing is used (the
default), full TLB domain flushes are performed frequently, requiring
the hypervisor to perform expensive synchronization between the virtual
TLB and the physical one.
Getting batched TLB flushes to use page-specific invalidations again in
such circumstances is not easy, since the TLB invalidation scheme
assumes that "full" domain TLB flushes are performed for scalability.
Disable batched TLB flushes when caching-mode is on, as the performance
benefit from using batched TLB invalidations is likely to be much
smaller than the overhead of the virtual-to-physical IOMMU page-tables
synchronization.
Fixes: 13cf01744608 ("iommu/vt-d: Make use of iova deferred flushing")
Signed-off-by: Nadav Amit <namit(a)vmware.com>
Cc: David Woodhouse <dwmw2(a)infradead.org>
Cc: Lu Baolu <baolu.lu(a)linux.intel.com>
Cc: Joerg Roedel <joro(a)8bytes.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
v2->v3:
* Fix the fixes tag in the commit-log (Lu).
* Minor English rephrasing of the commit-log.
v1->v2:
* disable flush queue for all domains if caching-mode is on for any
IOMMU (Lu).
---
drivers/iommu/intel/iommu.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 788119c5b021..de3dd617cf60 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -5373,6 +5373,36 @@ intel_iommu_domain_set_attr(struct iommu_domain *domain,
return ret;
}
+static bool domain_use_flush_queue(void)
+{
+ struct dmar_drhd_unit *drhd;
+ struct intel_iommu *iommu;
+ bool r = true;
+
+ if (intel_iommu_strict)
+ return false;
+
+ /*
+ * The flush queue implementation does not perform page-selective
+ * invalidations that are required for efficient TLB flushes in virtual
+ * environments. The benefit of batching is likely to be much lower than
+ * the overhead of synchronizing the virtual and physical IOMMU
+ * page-tables.
+ */
+ rcu_read_lock();
+ for_each_active_iommu(iommu, drhd) {
+ if (!cap_caching_mode(iommu->cap))
+ continue;
+
+ pr_warn_once("IOMMU batching is disabled due to virtualization");
+ r = false;
+ break;
+ }
+ rcu_read_unlock();
+
+ return r;
+}
+
static int
intel_iommu_domain_get_attr(struct iommu_domain *domain,
enum iommu_attr attr, void *data)
@@ -5383,7 +5413,7 @@ intel_iommu_domain_get_attr(struct iommu_domain *domain,
case IOMMU_DOMAIN_DMA:
switch (attr) {
case DOMAIN_ATTR_DMA_USE_FLUSH_QUEUE:
- *(int *)data = !intel_iommu_strict;
+ *(int *)data = domain_use_flush_queue();
return 0;
default:
return -ENODEV;
--
2.25.1
Bob reports that blacklisting the fan type label is not sufficient.
See his message to me below.
On Mon, Jan 25, 2021 at 3:38 PM Bob Hepple <bob.hepple(a)gmail.com> wrote:
>
> Hi Tom,
>
> Big nope this end with L502x in i8k_blacklist_fan_type_dmi_table:
>
> Jan 26 09:35:47 achar kernel: psmouse serio1: TouchPad at
> isa0060/serio1/input0 lost synchronization, throwing 1 bytes>
>
> ... and lots of trackpad stall/stutters.
>
> Cheers
>
>
> Bob
>
>
>
> On Tue, 26 Jan 2021 at 08:09, Bob Hepple <bob.hepple(a)gmail.com> wrote:
> >
> > ... compiling now ... results in a coupla hours
> >
> > Cheers
> >
> >
> > Bob
> >
> > On Tue, 26 Jan 2021 at 04:05, Tom Hebb <tommyhebb(a)gmail.com> wrote:
> > >
> > > On Mon, Jan 25, 2021 at 2:05 AM Pali Rohár <pali(a)kernel.org> wrote:
> > > >
> > > > On Saturday 23 January 2021 18:46:08 Thomas Hebb wrote:
> > > > > It has been reported[0] that the Dell XPS 15 L502X exhibits similar
> > > > > freezing behavior to the other systems[1] on this blacklist. The issue
> > > > > was exposed by a prior change of mine to automatically load
> > > > > dell_smm_hwmon on a wider set of XPS models. To fix the regression, add
> > > > > this model to the blacklist.
> > > > >
> > > > > [0] https://bugzilla.kernel.org/show_bug.cgi?id=211081
> > > > > [1] https://bugzilla.kernel.org/show_bug.cgi?id=195751
> > > > >
> > > > > Fixes: b8a13e5e8f37 ("hwmon: (dell-smm) Use one DMI match for all XPS models")
> > > > > Cc: stable(a)vger.kernel.org
> > > > > Reported-by: Bob Hepple <bob.hepple(a)gmail.com>
> > > > > Tested-by: Bob Hepple <bob.hepple(a)gmail.com>
> > > > > Signed-off-by: Thomas Hebb <tommyhebb(a)gmail.com>
> > > > > ---
> > > > >
> > > > > drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
> > > > > 1 file changed, 7 insertions(+)
> > > > >
> > > > > diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
> > > > > index ec448f5f2dc3..73b9db9e3aab 100644
> > > > > --- a/drivers/hwmon/dell-smm-hwmon.c
> > > > > +++ b/drivers/hwmon/dell-smm-hwmon.c
> > > > > @@ -1159,6 +1159,13 @@ static struct dmi_system_id i8k_blacklist_fan_support_dmi_table[] __initdata = {
> > > > > DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS13 9333"),
> > > > > },
> > > > > },
> > > > > + {
> > > > > + .ident = "Dell XPS 15 L502X",
> > > > > + .matches = {
> > > > > + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
> > > > > + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L502X"),
> > > >
> > > > Hello! Are you sure that it is required to completely disable fan
> > > > support? And not only access to fan type label for which is different
> > > > blaclist i8k_blacklist_fan_type_dmi_table?
> > >
> > > This is a good question. We didn't try the other list. Bob is the one with the
> > > affected system. Could you try moving the added block of code from
> > > i8k_blacklist_fan_support_dmi_table a few lines up to
> > > i8k_blacklist_fan_type_dmi_table, Bob, to see if the issue reappears or if it
> > > remains fixed?
> > >
> > > >
> > > > And have you reported this issue to Dell support?
> > > >
> > > > > + },
> > > > > + },
> > > > > { }
> > > > > };
> > > > >
> > > > > --
> > > > > 2.30.0
> > > > >
> > >
> > > (Apologies for the previous HTML copy of this reply, to those directly CCed.)
> > >
> > > -Tom
The patch titled
Subject: mm/rmap: fix potential pte_unmap on an not mapped pte
has been added to the -mm tree. Its filename is
mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-rmap-fix-potential-pte_unmap-o…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-rmap-fix-potential-pte_unmap-o…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Miaohe Lin <linmiaohe(a)huawei.com>
Subject: mm/rmap: fix potential pte_unmap on an not mapped pte
For PMD-mapped page (usually THP), pvmw->pte is NULL. For PTE-mapped THP,
pvmw->pte is mapped. But for HugeTLB pages, pvmw->pte is not mapped and
set to the relevant page table entry. So in page_vma_mapped_walk_done(),
we may do pte_unmap() for HugeTLB pte which is not mapped. Fix this by
checking pvmw->page against PageHuge before trying to do pte_unmap().
Link: https://lkml.kernel.org/r/20210127093349.39081-1-linmiaohe@huawei.com
Fixes: ace71a19cec5 ("mm: introduce page_vma_mapped_walk()")
Signed-off-by: Hongxiang Lou <louhongxiang(a)huawei.com>
Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Michel Lespinasse <walken(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/rmap.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/include/linux/rmap.h~mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte
+++ a/include/linux/rmap.h
@@ -213,7 +213,8 @@ struct page_vma_mapped_walk {
static inline void page_vma_mapped_walk_done(struct page_vma_mapped_walk *pvmw)
{
- if (pvmw->pte)
+ /* HugeTLB pte is set to the relevant page table entry without pte_mapped. */
+ if (pvmw->pte && !PageHuge(pvmw->page))
pte_unmap(pvmw->pte);
if (pvmw->ptl)
spin_unlock(pvmw->ptl);
_
Patches currently in -mm which might be from linmiaohe(a)huawei.com are
mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch
mm-page_owner-use-helper-function-zone_end_pfn-to-get-end_pfn.patch
mm-fix-potential-pte_unmap_unlock-pte-error.patch
mm-hugetlb-fix-potential-double-free-in-hugetlb_register_node-error-path.patch
mm-hugetlb-avoid-unnecessary-hugetlb_acct_memory-call.patch
mm-hugetlb-use-helper-huge_page_order-and-pages_per_huge_page.patch
mm-hugetlb-fix-use-after-free-when-subpool-max_hpages-accounting-is-not-enabled.patch
mm-workingsetc-avoid-unnecessary-max_nodes-estimation-in-count_shadow_nodes.patch
z3fold-remove-unused-attribute-for-release_z3fold_page.patch
z3fold-simplify-the-zhdr-initialization-code-in-init_z3fold_page.patch
mm-compaction-remove-duplicated-vm_bug_on_page-pagelocked.patch
hugetlbfs-remove-useless-bug_oninode-in-hugetlbfs_setattr.patch
hugetlbfs-use-helper-macro-default_hstate-in-init_hugetlbfs_fs.patch
hugetlbfs-correct-obsolete-function-name-in-hugetlbfs_read_iter.patch
hugetlbfs-remove-meaningless-variable-avoid_reserve.patch
hugetlbfs-make-hugepage-size-conversion-more-readable.patch
hugetlbfs-correct-some-obsolete-comments-about-inode-i_mutex.patch
mm-memory_hotplug-use-helper-function-zone_end_pfn-to-get-end_pfn.patch
mm-rmap-correct-some-obsolete-comments-of-anon_vma.patch
mm-zsmallocc-convert-to-use-kmem_cache_zalloc-in-cache_alloc_zspage.patch
The following commit has been merged into the efi/urgent branch of tip:
Commit-ID: 355845b738e76445c8522802552146d96cb4afa7
Gitweb: https://git.kernel.org/tip/355845b738e76445c8522802552146d96cb4afa7
Author: Lukas Wunner <lukas(a)wunner.de>
AuthorDate: Thu, 31 Dec 2020 06:10:32 +01:00
Committer: Ard Biesheuvel <ardb(a)kernel.org>
CommitterDate: Thu, 31 Dec 2020 10:28:53 +01:00
efi/apple-properties: Reinstate support for boolean properties
Since commit 4466bf82821b ("efi/apple-properties: use
PROPERTY_ENTRY_U8_ARRAY_LEN"), my MacBook Pro issues a -ENODATA error
when trying to assign EFI properties to the discrete GPU:
pci 0000:01:00.0: assigning 56 device properties
pci 0000:01:00.0: error -61 assigning properties
That's because some of the properties have no value. They're booleans
whose presence can be checked by drivers, e.g. "use-backlight-blanking".
Commit 6e98503dba64 ("efi/apple-properties: Remove redundant attribute
initialization from unmarshal_key_value_pairs()") employed a trick to
store such booleans as u8 arrays (which is the data type used for all
other EFI properties on Macs): It cleared the property_entry's
"is_array" flag, thereby denoting that the value is stored inline in the
property_entry.
Commit 4466bf82821b erroneously removed that trick. It was probably a
little fragile to begin with.
Reinstate support for boolean properties by explicitly invoking the
PROPERTY_ENTRY_BOOL() initializer for properties with zero-length value.
Fixes: 4466bf82821b ("efi/apple-properties: use PROPERTY_ENTRY_U8_ARRAY_LEN")
Cc: <stable(a)vger.kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Signed-off-by: Lukas Wunner <lukas(a)wunner.de>
Link: https://lore.kernel.org/r/be958bda75331a011d53c696d1deec8dccd06fd2.16093885…
Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org>
---
drivers/firmware/efi/apple-properties.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi/apple-properties.c
index 34f53d8..e192648 100644
--- a/drivers/firmware/efi/apple-properties.c
+++ b/drivers/firmware/efi/apple-properties.c
@@ -3,8 +3,9 @@
* apple-properties.c - EFI device properties on Macs
* Copyright (C) 2016 Lukas Wunner <lukas(a)wunner.de>
*
- * Note, all properties are considered as u8 arrays.
- * To get a value of any of them the caller must use device_property_read_u8_array().
+ * Properties are stored either as:
+ * u8 arrays which can be retrieved with device_property_read_u8_array() or
+ * booleans which can be queried with device_property_present().
*/
#define pr_fmt(fmt) "apple-properties: " fmt
@@ -88,8 +89,12 @@ static void __init unmarshal_key_value_pairs(struct dev_header *dev_header,
entry_data = ptr + key_len + sizeof(val_len);
entry_len = val_len - sizeof(val_len);
- entry[i] = PROPERTY_ENTRY_U8_ARRAY_LEN(key, entry_data,
- entry_len);
+ if (entry_len)
+ entry[i] = PROPERTY_ENTRY_U8_ARRAY_LEN(key, entry_data,
+ entry_len);
+ else
+ entry[i] = PROPERTY_ENTRY_BOOL(key);
+
if (dump_properties) {
dev_info(dev, "property: %s\n", key);
print_hex_dump(KERN_INFO, pr_fmt(), DUMP_PREFIX_OFFSET,
From: Nadav Amit <namit(a)vmware.com>
When an Intel IOMMU is virtualized, and a physical device is
passed-through to the VM, changes of the virtual IOMMU need to be
propagated to the physical IOMMU. The hypervisor therefore needs to
monitor PTE mappings in the IOMMU page-tables. Intel specifications
provide "caching-mode" capability that a virtual IOMMU uses to report
that the IOMMU is virtualized and a TLB flush is needed after mapping to
allow the hypervisor to propagate virtual IOMMU mappings to the physical
IOMMU. To the best of my knowledge no real physical IOMMU reports
"caching-mode" as turned on.
Synchronizing the virtual and the physical IOMMU tables is expensive if
the hypervisor is unaware which PTEs have changed, as the hypervisor is
required to walk all the virtualized tables and look for changes.
Consequently, domain flushes are much more expensive than page-specific
flushes on virtualized IOMMUs with passthrough devices. The kernel
therefore exploited the "caching-mode" indication to avoid domain
flushing and use page-specific flushing in virtualized environments. See
commit 78d5f0f500e6 ("intel-iommu: Avoid global flushes with caching
mode.")
This behavior changed after commit 13cf01744608 ("iommu/vt-d: Make use
of iova deferred flushing"). Now, when batched TLB flushing is used (the
default), full TLB domain flushes are performed frequently, requiring
the hypervisor to perform expensive synchronization between the virtual
TLB and the physical one.
Getting batched TLB flushes to use in such circumstances page-specific
invalidations again is not easy, since the TLB invalidation scheme
assumes that "full" domain TLB flushes are performed for scalability.
Disable batched TLB flushes when caching-mode is on, as the performance
benefit from using batched TLB invalidations is likely to be much
smaller than the overhead of the virtual-to-physical IOMMU page-tables
synchronization.
Fixes: 78d5f0f500e6 ("intel-iommu: Avoid global flushes with caching mode.")
Signed-off-by: Nadav Amit <namit(a)vmware.com>
Cc: David Woodhouse <dwmw2(a)infradead.org>
Cc: Lu Baolu <baolu.lu(a)linux.intel.com>
Cc: Joerg Roedel <joro(a)8bytes.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
v1->v2:
* disable flush queue for all domains if caching-mode is on for any
IOMMU (Lu).
---
drivers/iommu/intel/iommu.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 788119c5b021..de3dd617cf60 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -5373,6 +5373,36 @@ intel_iommu_domain_set_attr(struct iommu_domain *domain,
return ret;
}
+static bool domain_use_flush_queue(void)
+{
+ struct dmar_drhd_unit *drhd;
+ struct intel_iommu *iommu;
+ bool r = true;
+
+ if (intel_iommu_strict)
+ return false;
+
+ /*
+ * The flush queue implementation does not perform page-selective
+ * invalidations that are required for efficient TLB flushes in virtual
+ * environments. The benefit of batching is likely to be much lower than
+ * the overhead of synchronizing the virtual and physical IOMMU
+ * page-tables.
+ */
+ rcu_read_lock();
+ for_each_active_iommu(iommu, drhd) {
+ if (!cap_caching_mode(iommu->cap))
+ continue;
+
+ pr_warn_once("IOMMU batching is disabled due to virtualization");
+ r = false;
+ break;
+ }
+ rcu_read_unlock();
+
+ return r;
+}
+
static int
intel_iommu_domain_get_attr(struct iommu_domain *domain,
enum iommu_attr attr, void *data)
@@ -5383,7 +5413,7 @@ intel_iommu_domain_get_attr(struct iommu_domain *domain,
case IOMMU_DOMAIN_DMA:
switch (attr) {
case DOMAIN_ATTR_DMA_USE_FLUSH_QUEUE:
- *(int *)data = !intel_iommu_strict;
+ *(int *)data = domain_use_flush_queue();
return 0;
default:
return -ENODEV;
--
2.25.1
From: Jarkko Sakkinen <jarkko(a)kernel.org>
The most trivial example of a race condition can be demonstrated with this
example where mm_list contains just one entry:
CPU A CPU B
sgx_release()
sgx_mmu_notifier_release()
list_del_rcu()
sgx_encl_release()
synchronize_srcu()
cleanup_srcu_struct()
To fix this, call synchronize_srcu() before checking whether mm_list is
empty in sgx_release().
Cc: stable(a)vger.kernel.org
Fixes: 1728ab54b4be ("x86/sgx: Add a page reclaimer")
Suggested-by: Sean Christopherson <seanjc(a)google.com>
Suggested-by: Haitao Huang <haitao.huang(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org>
---
v4:
- Rewrite the commit message.
- Just change the call order. *_expedited() is out of scope for this
bug fix.
v3: Fine-tuned tags, and added missing change log for v2.
v2: Switch to synchronize_srcu_expedited().
arch/x86/kernel/cpu/sgx/driver.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
index f2eac41bb4ff..53056345f5f8 100644
--- a/arch/x86/kernel/cpu/sgx/driver.c
+++ b/arch/x86/kernel/cpu/sgx/driver.c
@@ -65,11 +65,16 @@ static int sgx_release(struct inode *inode, struct file *file)
spin_unlock(&encl->mm_lock);
+ /*
+ * The call is need even if the list empty, because sgx_encl_mmu_notifier_release()
+ * could have initiated a new grace period.
+ */
+ synchronize_srcu(&encl->srcu);
+
/* The enclave is no longer mapped by any mm. */
if (!encl_mm)
break;
- synchronize_srcu(&encl->srcu);
mmu_notifier_unregister(&encl_mm->mmu_notifier, encl_mm->mm);
kfree(encl_mm);
}
--
2.29.2
From: Ard Biesheuvel <ardb(a)kernel.org>
commit 7bc1a0f9e1765830e945669c99c59c35cf9bca82 upstream.
On arm64, the global variable memstart_addr represents the physical
address of PAGE_OFFSET, and so physical to virtual translations or
vice versa used to come down to simple additions or subtractions
involving the values of PAGE_OFFSET and memstart_addr.
When support for 52-bit virtual addressing was introduced, we had to
deal with PAGE_OFFSET potentially being outside of the region that
can be covered by the virtual range (as the 52-bit VA capable build
needs to be able to run on systems that are only 48-bit VA capable),
and for this reason, another translation was introduced, and recorded
in the global variable physvirt_offset.
However, if we go back to the original definition of memstart_addr,
i.e., the physical address of PAGE_OFFSET, it turns out that there is
no need for two separate translations: instead, we can simply subtract
the size of the unaddressable VA space from memstart_addr to make the
available physical memory appear in the 48-bit addressable VA region.
This simplifies things, but also fixes a bug on KASLR builds, which
may update memstart_addr later on in arm64_memblock_init(), but fails
to update vmemmap and physvirt_offset accordingly.
Fixes: 5383cc6efed1 ("arm64: mm: Introduce vabits_actual")
Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org>
Reviewed-by: Steve Capper <steve.capper(a)arm.com>
Link: https://lore.kernel.org/r/20201008153602.9467-2-ardb@kernel.org
Signed-off-by: Will Deacon <will(a)kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino(a)arm.com>
---
arch/arm64/include/asm/memory.h | 5 ++---
arch/arm64/include/asm/pgtable.h | 4 ++--
arch/arm64/mm/init.c | 30 ++++++++++--------------------
3 files changed, 14 insertions(+), 25 deletions(-)
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index 08df42e4db96..51d867cf146c 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -178,7 +178,6 @@ extern u64 vabits_actual;
#include <linux/bitops.h>
#include <linux/mmdebug.h>
-extern s64 physvirt_offset;
extern s64 memstart_addr;
/* PHYS_OFFSET - the physical address of the start of memory. */
#define PHYS_OFFSET ({ VM_BUG_ON(memstart_addr & 1); memstart_addr; })
@@ -254,7 +253,7 @@ static inline const void *__tag_set(const void *addr, u8 tag)
*/
#define __is_lm_address(addr) (!(((u64)addr) & BIT(vabits_actual - 1)))
-#define __lm_to_phys(addr) (((addr) + physvirt_offset))
+#define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET)
#define __kimg_to_phys(addr) ((addr) - kimage_voffset)
#define __virt_to_phys_nodebug(x) ({ \
@@ -272,7 +271,7 @@ extern phys_addr_t __phys_addr_symbol(unsigned long x);
#define __phys_addr_symbol(x) __pa_symbol_nodebug(x)
#endif /* CONFIG_DEBUG_VIRTUAL */
-#define __phys_to_virt(x) ((unsigned long)((x) - physvirt_offset))
+#define __phys_to_virt(x) ((unsigned long)((x) - PHYS_OFFSET) | PAGE_OFFSET)
#define __phys_to_kimg(x) ((unsigned long)((x) + kimage_voffset))
/*
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 69dfc340e71b..8c420f916fe2 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -23,6 +23,8 @@
#define VMALLOC_START (MODULES_END)
#define VMALLOC_END (- PUD_SIZE - VMEMMAP_SIZE - SZ_64K)
+#define vmemmap ((struct page *)VMEMMAP_START - (memstart_addr >> PAGE_SHIFT))
+
#define FIRST_USER_ADDRESS 0UL
#ifndef __ASSEMBLY__
@@ -33,8 +35,6 @@
#include <linux/mm_types.h>
#include <linux/sched.h>
-extern struct page *vmemmap;
-
extern void __pte_error(const char *file, int line, unsigned long val);
extern void __pmd_error(const char *file, int line, unsigned long val);
extern void __pud_error(const char *file, int line, unsigned long val);
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 45c00a54909c..602bd19630ff 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -50,12 +50,6 @@
s64 memstart_addr __ro_after_init = -1;
EXPORT_SYMBOL(memstart_addr);
-s64 physvirt_offset __ro_after_init;
-EXPORT_SYMBOL(physvirt_offset);
-
-struct page *vmemmap __ro_after_init;
-EXPORT_SYMBOL(vmemmap);
-
phys_addr_t arm64_dma_phys_limit __ro_after_init;
#ifdef CONFIG_KEXEC_CORE
@@ -321,20 +315,6 @@ void __init arm64_memblock_init(void)
memstart_addr = round_down(memblock_start_of_DRAM(),
ARM64_MEMSTART_ALIGN);
- physvirt_offset = PHYS_OFFSET - PAGE_OFFSET;
-
- vmemmap = ((struct page *)VMEMMAP_START - (memstart_addr >> PAGE_SHIFT));
-
- /*
- * If we are running with a 52-bit kernel VA config on a system that
- * does not support it, we have to offset our vmemmap and physvirt_offset
- * s.t. we avoid the 52-bit portion of the direct linear map
- */
- if (IS_ENABLED(CONFIG_ARM64_VA_BITS_52) && (vabits_actual != 52)) {
- vmemmap += (_PAGE_OFFSET(48) - _PAGE_OFFSET(52)) >> PAGE_SHIFT;
- physvirt_offset = PHYS_OFFSET - _PAGE_OFFSET(48);
- }
-
/*
* Remove the memory that we will not be able to cover with the
* linear mapping. Take care not to clip the kernel which may be
@@ -349,6 +329,16 @@ void __init arm64_memblock_init(void)
memblock_remove(0, memstart_addr);
}
+ /*
+ * If we are running with a 52-bit kernel VA config on a system that
+ * does not support it, we have to place the available physical
+ * memory in the 48-bit addressable part of the linear region, i.e.,
+ * we have to move it upward. Since memstart_addr represents the
+ * physical address of PAGE_OFFSET, we have to *subtract* from it.
+ */
+ if (IS_ENABLED(CONFIG_ARM64_VA_BITS_52) && (vabits_actual != 52))
+ memstart_addr -= _PAGE_OFFSET(48) - _PAGE_OFFSET(52);
+
/*
* Apply the memory limit if it was set. Since the kernel may be loaded
* high up in memory, add back the kernel region that must be accessible
--
2.30.0
This is a note to let you know that I've just added the patch titled
w1: w1_therm: Fix conversion result for negative temperatures
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 2f6055c26f1913763eabc66c7c27d0693561e966 Mon Sep 17 00:00:00 2001
From: Ivan Zaentsev <ivan.zaentsev(a)wirenboard.ru>
Date: Thu, 21 Jan 2021 12:30:21 +0300
Subject: w1: w1_therm: Fix conversion result for negative temperatures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
DS18B20 device driver returns an incorrect value for negative temperatures
due to a missing sign-extension in w1_DS18B20_convert_temp().
Fix by using s16 temperature value when converting to int.
Fixes: 9ace0b4dab1c (w1: w1_therm: Add support for GXCAS GX20MH01 device.)
Cc: stable <stable(a)vger.kernel.org>
Reported-by: Paweł Marciniak <sunwire(a)gmail.com>
Signed-off-by: Ivan Zaentsev <ivan.zaentsev(a)wirenboard.ru>
Link: https://lore.kernel.org/r/20210121093021.224764-1-ivan.zaentsev@wirenboard.…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/w1/slaves/w1_therm.c | 22 +++++++++-------------
1 file changed, 9 insertions(+), 13 deletions(-)
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 3712b1e6dc71..976eea28f268 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -667,28 +667,24 @@ static inline int w1_DS18B20_get_resolution(struct w1_slave *sl)
*/
static inline int w1_DS18B20_convert_temp(u8 rom[9])
{
- int t;
- u32 bv;
+ u16 bv;
+ s16 t;
+
+ /* Signed 16-bit value to unsigned, cpu order */
+ bv = le16_to_cpup((__le16 *)rom);
/* Config register bit R2 = 1 - GX20MH01 in 13 or 14 bit resolution mode */
if (rom[4] & 0x80) {
- /* Signed 16-bit value to unsigned, cpu order */
- bv = le16_to_cpup((__le16 *)rom);
-
/* Insert two temperature bits from config register */
/* Avoid arithmetic shift of signed value */
bv = (bv << 2) | (rom[4] & 3);
-
- t = (int) sign_extend32(bv, 17); /* Degrees, lowest bit is 2^-6 */
- return (t*1000)/64; /* Millidegrees */
+ t = (s16) bv; /* Degrees, lowest bit is 2^-6 */
+ return (int)t * 1000 / 64; /* Sign-extend to int; millidegrees */
}
-
- t = (int)le16_to_cpup((__le16 *)rom);
- return t*1000/16;
+ t = (s16)bv; /* Degrees, lowest bit is 2^-4 */
+ return (int)t * 1000 / 16; /* Sign-extend to int; millidegrees */
}
-
-
/**
* w1_DS18S20_convert_temp() - temperature computation for DS18S20
* @rom: data read from device RAM (8 data bytes + 1 CRC byte)
--
2.30.0
This is a note to let you know that I've just added the patch titled
virt: vbox: Do not use wait_event_interruptible when called from
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From c35901b39ddc20077f4ae7b9f7bf344487f62212 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede(a)redhat.com>
Date: Thu, 21 Jan 2021 16:07:54 +0100
Subject: virt: vbox: Do not use wait_event_interruptible when called from
kernel context
Do not use wait_event_interruptible when vbg_hgcm_call() gets called from
kernel-context, such as it being called by the vboxsf filesystem code.
This fixes some filesystem related system calls on shared folders
unexpectedly failing with -EINTR.
Fixes: 0532a1b0d045 ("virt: vbox: Implement passing requestor info to the host for VirtualBox 6.0.x")
Reported-by: Ludovic Pouzenc <bugreports(a)pouzenc.fr>
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20210121150754.147598-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/virt/vboxguest/vboxguest_utils.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
index ea05af41ec69..8d195e3f8301 100644
--- a/drivers/virt/vboxguest/vboxguest_utils.c
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -468,7 +468,7 @@ static int hgcm_cancel_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call)
* Cancellation fun.
*/
static int vbg_hgcm_do_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call,
- u32 timeout_ms, bool *leak_it)
+ u32 timeout_ms, bool interruptible, bool *leak_it)
{
int rc, cancel_rc, ret;
long timeout;
@@ -495,10 +495,15 @@ static int vbg_hgcm_do_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call,
else
timeout = msecs_to_jiffies(timeout_ms);
- timeout = wait_event_interruptible_timeout(
- gdev->hgcm_wq,
- hgcm_req_done(gdev, &call->header),
- timeout);
+ if (interruptible) {
+ timeout = wait_event_interruptible_timeout(gdev->hgcm_wq,
+ hgcm_req_done(gdev, &call->header),
+ timeout);
+ } else {
+ timeout = wait_event_timeout(gdev->hgcm_wq,
+ hgcm_req_done(gdev, &call->header),
+ timeout);
+ }
/* timeout > 0 means hgcm_req_done has returned true, so success */
if (timeout > 0)
@@ -631,7 +636,8 @@ int vbg_hgcm_call(struct vbg_dev *gdev, u32 requestor, u32 client_id,
hgcm_call_init_call(call, client_id, function, parms, parm_count,
bounce_bufs);
- ret = vbg_hgcm_do_call(gdev, call, timeout_ms, &leak_it);
+ ret = vbg_hgcm_do_call(gdev, call, timeout_ms,
+ requestor & VMMDEV_REQUESTOR_USERMODE, &leak_it);
if (ret == 0) {
*vbox_status = call->header.result;
ret = hgcm_call_copy_back_result(call, parms, parm_count,
--
2.30.0
No upstream commit, this is a fix to a stable 5.4 specific backport.
The intention of backport commit cac68d12c531 ("io_uring: grab ->fs as part
of async offload") as found in the stable 5.4 tree was to make
io_sq_wq_submit_work() to switch the workqueue task's ->fs over to the
submitting task's one during the IO operation.
However, due to a small logic error, this change turned out to not have any
actual effect. From a high level, the relevant code in
io_sq_wq_submit_work() looks like
old_fs_struct = current->fs;
do {
...
if (req->fs != current->fs && current->fs != old_fs_struct) {
task_lock(current);
if (req->fs)
current->fs = req->fs;
else
current->fs = old_fs_struct;
task_unlock(current);
}
...
} while (req);
The if condition is supposed to cover the case that current->fs doesn't
match what's needed for processing the request, but observe how it fails
to ever evaluate to true due to the second clause:
current->fs != old_fs_struct will be false in the first iteration as per
the initialization of old_fs_struct and because this prevents current->fs
from getting replaced, the same follows inductively for all subsequent
iterations.
Fix said if condition such that
- if req->fs is set and doesn't match current->fs, the latter will be
switched to the former
- or if req->fs is unset, the switch back to the initial old_fs_struct
will be made, if necessary.
While at it, also correct the condition for the ->fs related cleanup right
before the return of io_sq_wq_submit_work(): currently, old_fs_struct is
restored only if it's non-NULL. It is always non-NULL though and thus, the
if-condition is rendundant. Supposedly, the motivation had been to optimize
and avoid switching current->fs back to the initial old_fs_struct in case
it is found to have the desired value already. Make it so.
Cc: stable(a)vger.kernel.org # v5.4
Fixes: cac68d12c531 ("io_uring: grab ->fs as part of async offload")
Reviewed-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Nicolai Stange <nstange(a)suse.de>
---
Tested on top of v5.4.90.
fs/io_uring.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 4127ea027a14..478df7e10767 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2226,7 +2226,8 @@ static void io_sq_wq_submit_work(struct work_struct *work)
/* Ensure we clear previously set non-block flag */
req->rw.ki_flags &= ~IOCB_NOWAIT;
- if (req->fs != current->fs && current->fs != old_fs_struct) {
+ if ((req->fs && req->fs != current->fs) ||
+ (!req->fs && current->fs != old_fs_struct)) {
task_lock(current);
if (req->fs)
current->fs = req->fs;
@@ -2351,7 +2352,7 @@ static void io_sq_wq_submit_work(struct work_struct *work)
mmput(cur_mm);
}
revert_creds(old_cred);
- if (old_fs_struct) {
+ if (old_fs_struct != current->fs) {
task_lock(current);
current->fs = old_fs_struct;
task_unlock(current);
--
2.26.2
Currently, the __is_lm_address() check just masks out the top 12 bits
of the address, but if they are 0, it still yields a true result.
This has as a side effect that virt_addr_valid() returns true even for
invalid virtual addresses (e.g. 0x0).
Fix the detection checking that it's actually a kernel address starting
at PAGE_OFFSET.
Fixes: f4693c2716b35 ("arm64: mm: extend linear region for 52-bit VA configurations")
Cc: <stable(a)vger.kernel.org> # 5.4.x
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Will Deacon <will(a)kernel.org>
Suggested-by: Catalin Marinas <catalin.marinas(a)arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com>
Acked-by: Mark Rutland <mark.rutland(a)arm.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino(a)arm.com>
---
arch/arm64/include/asm/memory.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index 18fce223b67b..99d7e1494aaa 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -247,9 +247,11 @@ static inline const void *__tag_set(const void *addr, u8 tag)
/*
- * The linear kernel range starts at the bottom of the virtual address space.
+ * Check whether an arbitrary address is within the linear map, which
+ * lives in the [PAGE_OFFSET, PAGE_END) interval at the bottom of the
+ * kernel's TTBR1 address range.
*/
-#define __is_lm_address(addr) (((u64)(addr) & ~PAGE_OFFSET) < (PAGE_END - PAGE_OFFSET))
+#define __is_lm_address(addr) (((u64)(addr) ^ PAGE_OFFSET) < (PAGE_END - PAGE_OFFSET))
#define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET)
#define __kimg_to_phys(addr) ((addr) - kimage_voffset)
--
2.30.0
From: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.
In a test-case with a rndis gadget running and sending a malformed
packet to it like:
dev.ctrl_transfer(
0x82, # bmRequestType
0x00, # bRequest
0x0000, # wValue
0x0001, # wIndex
0x00 # wLength
)
it is possible to cause a crash:
[ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[ 218.313189] Call trace:
[ 218.330217] ep_from_windex+0x3c/0x54
[ 218.348565] usb_gadget_giveback_request+0x10/0x20
[ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.
The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.
Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Signed-off-by: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
Cc: stable(a)vger.kernel.org
---
drivers/usb/dwc2/gadget.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 70ac47a341ac..a68c01b1dd73 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1553,12 +1553,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
if (idx > hsotg->num_of_eps)
return NULL;
- ep = index_to_ep(hsotg, idx, dir);
-
- if (idx && ep->dir_in != dir)
- return NULL;
-
- return ep;
+ return index_to_ep(hsotg, idx, dir);
}
/**
--
2.29.2
From: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.
In a test-case with a rndis gadget running and sending a malformed
packet to it like:
dev.ctrl_transfer(
0x82, # bmRequestType
0x00, # bRequest
0x0000, # wValue
0x0001, # wIndex
0x00 # wLength
)
it is possible to cause a crash:
[ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[ 218.313189] Call trace:
[ 218.330217] ep_from_windex+0x3c/0x54
[ 218.348565] usb_gadget_giveback_request+0x10/0x20
[ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.
The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.
Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Signed-off-by: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
Cc: stable(a)vger.kernel.org
---
changes in v2:
- remove unused struct dwc2_hsotg_ep *ep;
drivers/usb/dwc2/gadget.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0a0d11151cfb..ad4c94366dad 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1543,7 +1543,6 @@ static void dwc2_hsotg_complete_oursetup(struct usb_ep *ep,
static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
u32 windex)
{
- struct dwc2_hsotg_ep *ep;
int dir = (windex & USB_DIR_IN) ? 1 : 0;
int idx = windex & 0x7F;
@@ -1553,12 +1552,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
if (idx > hsotg->num_of_eps)
return NULL;
- ep = index_to_ep(hsotg, idx, dir);
-
- if (idx && ep->dir_in != dir)
- return NULL;
-
- return ep;
+ return index_to_ep(hsotg, idx, dir);
}
/**
--
2.29.2
From: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.
In a test-case with a rndis gadget running and sending a malformed
packet to it like:
dev.ctrl_transfer(
0x82, # bmRequestType
0x00, # bRequest
0x0000, # wValue
0x0001, # wIndex
0x00 # wLength
)
it is possible to cause a crash:
[ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[ 218.313189] Call trace:
[ 218.330217] ep_from_windex+0x3c/0x54
[ 218.348565] usb_gadget_giveback_request+0x10/0x20
[ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.
The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.
Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Reported-by: Gerhard Klostermeier <gerhard.klostermeier(a)syss.de>
Signed-off-by: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
Cc: stable(a)vger.kernel.org
---
changes in v3:
- added Reported-by tag
changes in v2:
- remove unused struct dwc2_hsotg_ep *ep;
drivers/usb/dwc2/gadget.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0a0d11151cfb..ad4c94366dad 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1543,7 +1543,6 @@ static void dwc2_hsotg_complete_oursetup(struct usb_ep *ep,
static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
u32 windex)
{
- struct dwc2_hsotg_ep *ep;
int dir = (windex & USB_DIR_IN) ? 1 : 0;
int idx = windex & 0x7F;
@@ -1553,12 +1552,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
if (idx > hsotg->num_of_eps)
return NULL;
- ep = index_to_ep(hsotg, idx, dir);
-
- if (idx && ep->dir_in != dir)
- return NULL;
-
- return ep;
+ return index_to_ep(hsotg, idx, dir);
}
/**
--
2.29.2
This is the start of the stable review cycle for the 4.19.171 release.
There are 58 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 27 Jan 2021 18:31:44 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.171-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.171-rc1
Dan Carpenter <dan.carpenter(a)oracle.com>
net: dsa: b53: fix an off by one in checking "vlan->vid"
Tariq Toukan <tariqt(a)nvidia.com>
net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: allow offloading of bridge on top of LAG
Matteo Croce <mcroce(a)microsoft.com>
ipv6: set multicast flag on the multicast route
Eric Dumazet <edumazet(a)google.com>
net_sched: reject silly cell_log in qdisc_get_rtab()
Eric Dumazet <edumazet(a)google.com>
net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
Matteo Croce <mcroce(a)microsoft.com>
ipv6: create multicast route with RTPROT_KERNEL
Guillaume Nault <gnault(a)redhat.com>
udp: mask TOS bits in udp_v4_early_demux()
Lecopzer Chen <lecopzer(a)gmail.com>
kasan: fix incorrect arguments passing in kasan_add_zero_shadow
Lecopzer Chen <lecopzer(a)gmail.com>
kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow
Alexander Lobakin <alobakin(a)pm.me>
skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
Geert Uytterhoeven <geert+renesas(a)glider.be>
sh_eth: Fix power down vs. is_opened flag ordering
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext
Necip Fazil Yildiran <fazilyildiran(a)gmail.com>
sh: dma: fix kconfig dependency for G2_DMA
Guillaume Nault <gnault(a)redhat.com>
netfilter: rpfilter: mask ecn bits before fib lookup
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
driver core: Extend device_is_dependent()
JC Kuo <jckuo(a)nvidia.com>
xhci: tegra: Delay for disabling LFPS detector
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: make sure TRB is fully written before giving it to the controller
Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com>
usb: bdc: Make bdc pci driver depend on BROKEN
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: udc: core: Use lock when write to soft_connect
Ryan Chen <ryan_chen(a)aspeedtech.com>
usb: gadget: aspeed: fix stop dma register setting.
Longfang Liu <liulongfang(a)huawei.com>
USB: ehci: fix an interrupt calltrace error
Eugene Korenevsky <ekorenevsky(a)astralinux.ru>
ehci: fix EHCI host controller initialization sequence
Pali Rohár <pali(a)kernel.org>
serial: mvebu-uart: fix tx lost characters at power off
Wang Hui <john.wanghui(a)huawei.com>
stm class: Fix module init return on allocation failure
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add Alder Lake-P support
Mathias Kresin <dev(a)kresin.me>
irqchip/mips-cpu: Set IPI domain parent chip
Lars-Peter Clausen <lars(a)metafoo.de>
iio: ad5504: Fix setting power-down state
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: peak_usb: fix use after free bugs
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: vxcan: vxcan_xmit: fix use after free bug
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: dev: can_restart: fix use after free bug
Hangbin Liu <liuhangbin(a)gmail.com>
selftests: net: fib_tests: remove duplicate log test
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: octeon: check correct size of maximum RECV_LEN packet
Arnd Bergmann <arnd(a)arndb.de>
scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/mmu: fix vram heap sizing
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/privring: ack interrupts the same way as RM
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/bios: fix issue shadowing expansion ROMs
David Woodhouse <dwmw(a)amazon.co.uk>
xen: Fix event channel callback via INTX/GSI
Peter Geis <pgwipeout(a)gmail.com>
clk: tegra30: Add hda clock default rates to clock driver
Seth Miller <miller.seth(a)gmail.com>
HID: Ignore battery for Elan touchscreen on ASUS UX550
Damien Le Moal <damien.lemoal(a)wdc.com>
riscv: Fix kernel time_init()
Nilesh Javali <njavali(a)marvell.com>
scsi: qedi: Correct max length of CHAP secret
Can Guo <cang(a)codeaurora.org>
scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
Anthony Iliopoulos <ailiop(a)suse.com>
dm integrity: select CRYPTO_SKCIPHER
Cezary Rojewski <cezary.rojewski(a)intel.com>
ASoC: Intel: haswell: Add missing pm_ops
Pan Bian <bianpan2016(a)163.com>
drm/atomic: put state on error path
Mikulas Patocka <mpatocka(a)redhat.com>
dm integrity: fix a crash if "recalculate" used without "internal_hash"
Hannes Reinecke <hare(a)suse.de>
dm: avoid filesystem lookup in dm_get_dev_t()
Alex Leibovich <alexl(a)marvell.com>
mmc: sdhci-xenon: fix 1.8v regulator stabilization
Peter Collingbourne <pcc(a)google.com>
mmc: core: don't initialize block size from ext_csd if not present
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix lockdep splat in btrfs_recover_relocation
Hans de Goede <hdegoede(a)redhat.com>
ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/via: Add minimum mute flag
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
Mikko Perttunen <mperttunen(a)nvidia.com>
i2c: bpmp-tegra: Ignore unknown I2C_M flags
-------------
Diffstat:
Makefile | 4 +-
arch/arm/xen/enlighten.c | 2 +-
arch/riscv/kernel/time.c | 3 +
arch/sh/drivers/dma/Kconfig | 3 +-
drivers/acpi/scan.c | 2 +
drivers/base/core.c | 17 ++++-
drivers/clk/tegra/clk-tegra30.c | 2 +
drivers/gpu/drm/drm_atomic_helper.c | 2 +-
drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +-
drivers/gpu/drm/nouveau/dispnv50/disp.h | 2 +-
drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 8 +--
drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c | 10 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c | 10 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c | 6 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 2 +
drivers/hwtracing/intel_th/pci.c | 5 ++
drivers/hwtracing/stm/heartbeat.c | 6 +-
drivers/i2c/busses/i2c-octeon-core.c | 2 +-
drivers/i2c/busses/i2c-tegra-bpmp.c | 2 +-
drivers/iio/dac/ad5504.c | 4 +-
drivers/irqchip/irq-mips-cpu.c | 7 ++
drivers/md/Kconfig | 1 +
drivers/md/dm-integrity.c | 6 ++
drivers/md/dm-table.c | 15 +++-
drivers/mmc/core/queue.c | 4 +-
drivers/mmc/host/sdhci-xenon.c | 7 +-
drivers/net/can/dev.c | 4 +-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 +--
drivers/net/can/vxcan.c | 6 +-
drivers/net/dsa/b53/b53_common.c | 2 +-
drivers/net/dsa/mv88e6xxx/global1_vtu.c | 4 ++
drivers/net/ethernet/mscc/ocelot.c | 4 +-
drivers/net/ethernet/renesas/sh_eth.c | 4 +-
drivers/platform/x86/intel-vbtn.c | 6 --
drivers/scsi/megaraid/megaraid_sas_base.c | 6 +-
drivers/scsi/qedi/qedi_main.c | 4 +-
drivers/scsi/ufs/ufshcd.c | 11 ++-
drivers/tty/serial/mvebu-uart.c | 10 ++-
drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 +-
drivers/usb/gadget/udc/bdc/Kconfig | 2 +-
drivers/usb/gadget/udc/core.c | 13 +++-
drivers/usb/host/ehci-hcd.c | 12 ++++
drivers/usb/host/ehci-hub.c | 3 +
drivers/usb/host/xhci-ring.c | 2 +
drivers/usb/host/xhci-tegra.c | 7 ++
drivers/xen/events/events_base.c | 10 ---
drivers/xen/platform-pci.c | 1 -
drivers/xen/xenbus/xenbus.h | 1 +
drivers/xen/xenbus/xenbus_comms.c | 8 ---
drivers/xen/xenbus/xenbus_probe.c | 81 ++++++++++++++++++----
fs/btrfs/volumes.c | 2 +
include/xen/xenbus.h | 2 +-
mm/kasan/kasan_init.c | 23 +++---
net/core/dev.c | 5 ++
net/core/skbuff.c | 6 +-
net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
net/ipv4/udp.c | 3 +-
net/ipv6/addrconf.c | 3 +-
net/sched/cls_tcindex.c | 8 ++-
net/sched/sch_api.c | 3 +-
sound/core/seq/oss/seq_oss_synth.c | 3 +-
sound/pci/hda/patch_via.c | 1 +
sound/soc/intel/boards/haswell.c | 1 +
tools/testing/selftests/net/fib_tests.sh | 1 -
67 files changed, 290 insertions(+), 128 deletions(-)
On Tue, Jan 26, 2021 at 8:25 AM Mike Rapoport <rppt(a)linux.ibm.com> wrote:
>
> On Mon, Jan 25, 2021 at 09:46:19PM +0000, Chris Wilson wrote:
> >
> > CI does confirm that the revert of d3921cb8be29 brings the machines back
> > to life.
>
> I still cannot see what could possibly go wrong, so let's revert
> d3921cb8be29 for now and I'll continue to work with Chris to debug this.
Ok, reverted in my tree.
And added stable to the cc, so that they know not to pick up that
commit d3921cb8be29, despite it being marked for stable.
Linus
From: Nadav Amit <namit(a)vmware.com>
When an Intel IOMMU is virtualized, and a physical device is
passed-through to the VM, changes of the virtual IOMMU need to be
propagated to the physical IOMMU. The hypervisor therefore needs to
monitor PTE mappings in the IOMMU page-tables. Intel specifications
provide "caching-mode" capability that a virtual IOMMU uses to report
that the IOMMU is virtualized and a TLB flush is needed after mapping to
allow the hypervisor to propagate virtual IOMMU mappings to the physical
IOMMU. To the best of my knowledge no real physical IOMMU reports
"caching-mode" as turned on.
Synchronizing the virtual and the physical TLBs is expensive if the
hypervisor is unaware which PTEs have changed, as the hypervisor is
required to walk all the virtualized tables and look for changes.
Consequently, domain flushes are much more expensive than page-specific
flushes on virtualized IOMMUs with passthrough devices. The kernel
therefore exploited the "caching-mode" indication to avoid domain
flushing and use page-specific flushing in virtualized environments. See
commit 78d5f0f500e6 ("intel-iommu: Avoid global flushes with caching
mode.")
This behavior changed after commit 13cf01744608 ("iommu/vt-d: Make use
of iova deferred flushing"). Now, when batched TLB flushing is used (the
default), full TLB domain flushes are performed frequently, requiring
the hypervisor to perform expensive synchronization between the virtual
TLB and the physical one.
Getting batched TLB flushes to use in such circumstances page-specific
invalidations again is not easy, since the TLB invalidation scheme
assumes that "full" domain TLB flushes are performed for scalability.
Disable batched TLB flushes when caching-mode is on, as the performance
benefit from using batched TLB invalidations is likely to be much
smaller than the overhead of the virtual-to-physical IOMMU page-tables
synchronization.
Fixes: 78d5f0f500e6 ("intel-iommu: Avoid global flushes with caching mode.")
Signed-off-by: Nadav Amit <namit(a)vmware.com>
Cc: David Woodhouse <dwmw2(a)infradead.org>
Cc: Lu Baolu <baolu.lu(a)linux.intel.com>
Cc: Joerg Roedel <joro(a)8bytes.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
drivers/iommu/intel/iommu.c | 26 +++++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 788119c5b021..4e08f5e17175 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -5373,6 +5373,30 @@ intel_iommu_domain_set_attr(struct iommu_domain *domain,
return ret;
}
+static int
+intel_iommu_domain_get_attr_use_flush_queue(struct iommu_domain *domain)
+{
+ struct dmar_domain *dmar_domain = to_dmar_domain(domain);
+ struct intel_iommu *iommu = domain_get_iommu(dmar_domain);
+
+ if (intel_iommu_strict)
+ return 0;
+
+ /*
+ * The flush queue implementation does not perform page-selective
+ * invalidations that are required for efficient TLB flushes in virtual
+ * environments. The benefit of batching is likely to be much lower than
+ * the overhead of synchronizing the virtual and physical IOMMU
+ * page-tables.
+ */
+ if (iommu && cap_caching_mode(iommu->cap)) {
+ pr_warn_once("IOMMU batching is partially disabled due to virtualization");
+ return 0;
+ }
+
+ return 1;
+}
+
static int
intel_iommu_domain_get_attr(struct iommu_domain *domain,
enum iommu_attr attr, void *data)
@@ -5383,7 +5407,7 @@ intel_iommu_domain_get_attr(struct iommu_domain *domain,
case IOMMU_DOMAIN_DMA:
switch (attr) {
case DOMAIN_ATTR_DMA_USE_FLUSH_QUEUE:
- *(int *)data = !intel_iommu_strict;
+ *(int *)data = !intel_iommu_domain_get_attr_use_flush_queue(domain);
return 0;
default:
return -ENODEV;
--
2.25.1
Commit 1d489151e9f9d1647110277ff77282fe4d96d09b upstream.
Thanks to a recent binutils change which doesn't generate unused
symbols, it's now possible for thunk_64.o be completely empty without
CONFIG_PREEMPTION: no text, no data, no symbols.
We could edit the Makefile to only build that file when
CONFIG_PREEMPTION is enabled, but that will likely create confusion
if/when the thunks end up getting used by some other code again.
Just ignore it and move on.
Reported-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Nathan Chancellor <natechancellor(a)gmail.com>
Reviewed-by: Miroslav Benes <mbenes(a)suse.cz>
Tested-by: Nathan Chancellor <natechancellor(a)gmail.com>
Link: https://github.com/ClangBuiltLinux/linux/issues/1254
Signed-off-by: Josh Poimboeuf <jpoimboe(a)redhat.com>
---
This fixes a build break caused by the most recent version of binutils
(2.36).
tools/objtool/elf.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 4e1d7460574b..9452cfb01ef1 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -354,8 +354,11 @@ static int read_symbols(struct elf *elf)
symtab = find_section_by_name(elf, ".symtab");
if (!symtab) {
- WARN("missing symbol table");
- return -1;
+ /*
+ * A missing symbol table is actually possible if it's an empty
+ * .o file. This can happen for thunk_64.o.
+ */
+ return 0;
}
symtab_shndx = find_section_by_name(elf, ".symtab_shndx");
--
2.29.2
When extracting the mask for a SMR that was programmed by the
bootloader, the SMR's valid bit is also extracted and is treated
as part of the mask, which is not correct. Consider the scenario
where an SMMU master whose context is determined by a bootloader
programmed SMR is removed (omitting parts of device/driver core):
->iommu_release_device()
-> arm_smmu_release_device()
-> arm_smmu_master_free_smes()
-> arm_smmu_free_sme() /* Assume that the SME is now free */
-> arm_smmu_write_sme()
-> arm_smmu_write_smr() /* Construct SMR value using mask and SID */
Since the valid bit was considered as part of the mask, the SMR will
be programmed as valid.
Fix the SMR mask extraction step for bootloader programmed SMRs
by masking out the valid bit when we know that we're already
working with a valid SMR.
Fixes: 07a7f2caaa5a ("iommu/arm-smmu-qcom: Read back stream mappings")
Signed-off-by: Isaac J. Manjarres <isaacm(a)codeaurora.org>
Cc: stable(a)vger.kernel.org
---
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
index bcda170..abb1d2f 100644
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -206,6 +206,8 @@ static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)
smr = arm_smmu_gr0_read(smmu, ARM_SMMU_GR0_SMR(i));
if (FIELD_GET(ARM_SMMU_SMR_VALID, smr)) {
+ /* Ignore valid bit for SMR mask extraction. */
+ smr &= ~ARM_SMMU_SMR_VALID;
smmu->smrs[i].id = FIELD_GET(ARM_SMMU_SMR_ID, smr);
smmu->smrs[i].mask = FIELD_GET(ARM_SMMU_SMR_MASK, smr);
smmu->smrs[i].valid = true;
--
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
The patch titled
Subject: mm: hugetlb: fix missing put_page in gather_surplus_pages()
has been added to the -mm tree. Its filename is
mm-hugetlb-fix-missing-put_page-in-gather_surplus_pages.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-hugetlb-fix-missing-put_page-i…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-hugetlb-fix-missing-put_page-i…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Muchun Song <songmuchun(a)bytedance.com>
Subject: mm: hugetlb: fix missing put_page in gather_surplus_pages()
The VM_BUG_ON_PAGE avoids the generation of any code, even if that
expression has side-effects when !CONFIG_DEBUG_VM.
Link: https://lkml.kernel.org/r/20210126031009.96266-1-songmuchun@bytedance.com
Fixes: e5dfacebe4a4 ("mm/hugetlb.c: just use put_page_testzero() instead of page_count()")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Reviewed-by: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/mm/hugetlb.c~mm-hugetlb-fix-missing-put_page-in-gather_surplus_pages
+++ a/mm/hugetlb.c
@@ -2047,13 +2047,16 @@ retry:
/* Free the needed pages to the hugetlb pool */
list_for_each_entry_safe(page, tmp, &surplus_list, lru) {
+ int zeroed;
+
if ((--needed) < 0)
break;
/*
* This page is now managed by the hugetlb allocator and has
* no users -- drop the buddy allocator's reference.
*/
- VM_BUG_ON_PAGE(!put_page_testzero(page), page);
+ zeroed = put_page_testzero(page);
+ VM_BUG_ON_PAGE(!zeroed, page);
enqueue_huge_page(h, page);
}
free:
_
Patches currently in -mm which might be from songmuchun(a)bytedance.com are
mm-hugetlbfs-fix-cannot-migrate-the-fallocated-hugetlb-page.patch
mm-hugetlb-fix-a-race-between-freeing-and-dissolving-the-page.patch
mm-hugetlb-fix-a-race-between-isolating-and-freeing-page.patch
mm-hugetlb-remove-vm_bug_on_page-from-page_huge_active.patch
mm-migrate-do-not-migrate-hugetlb-page-whose-refcount-is-one.patch
mm-hugetlb-fix-missing-put_page-in-gather_surplus_pages.patch
mm-memcontrol-optimize-per-lruvec-stats-counter-memory-usage.patch
mm-memcontrol-fix-nr_anon_thps-accounting-in-charge-moving.patch
mm-memcontrol-convert-nr_anon_thps-account-to-pages.patch
mm-memcontrol-convert-nr_file_thps-account-to-pages.patch
mm-memcontrol-convert-nr_shmem_thps-account-to-pages.patch
mm-memcontrol-convert-nr_shmem_pmdmapped-account-to-pages.patch
mm-memcontrol-convert-nr_file_pmdmapped-account-to-pages.patch
mm-memcontrol-make-the-slab-calculation-consistent.patch
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 7955f105afb6034af344038d663bc98809483cdd Mon Sep 17 00:00:00 2001
From: Steve French <stfrench(a)microsoft.com>
Date: Wed, 9 Dec 2020 22:19:00 -0600
Subject: [PATCH] SMB3.1.1: do not log warning message if server doesn't
populate salt
In the negotiate protocol preauth context, the server is not required
to populate the salt (although it is done by most servers) so do
not warn on mount.
We retain the checks (warn) that the preauth context is the minimum
size and that the salt does not exceed DataLength of the SMB response.
Although we use the defaults in the case that the preauth context
response is invalid, these checks may be useful in the future
as servers add support for additional mechanisms.
CC: Stable <stable(a)vger.kernel.org>
Reviewed-by: Shyam Prasad N <sprasad(a)microsoft.com>
Reviewed-by: Pavel Shilovsky <pshilov(a)microsoft.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index acb72705062d..fc06c762fbbf 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -427,8 +427,8 @@ build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt)
pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
pneg_ctxt->DataLength = cpu_to_le16(38);
pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
- pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE);
- get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE);
+ pneg_ctxt->SaltLength = cpu_to_le16(SMB311_LINUX_CLIENT_SALT_SIZE);
+ get_random_bytes(pneg_ctxt->Salt, SMB311_LINUX_CLIENT_SALT_SIZE);
pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512;
}
@@ -566,6 +566,9 @@ static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt)
if (len < MIN_PREAUTH_CTXT_DATA_LEN) {
pr_warn_once("server sent bad preauth context\n");
return;
+ } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) {
+ pr_warn_once("server sent invalid SaltLength\n");
+ return;
}
if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1)
pr_warn_once("Invalid SMB3 hash algorithm count\n");
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index fa57b03ca98c..204a622b89ed 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -333,12 +333,20 @@ struct smb2_neg_context {
/* Followed by array of data */
} __packed;
-#define SMB311_SALT_SIZE 32
+#define SMB311_LINUX_CLIENT_SALT_SIZE 32
/* Hash Algorithm Types */
#define SMB2_PREAUTH_INTEGRITY_SHA512 cpu_to_le16(0x0001)
#define SMB2_PREAUTH_HASH_SIZE 64
-#define MIN_PREAUTH_CTXT_DATA_LEN (SMB311_SALT_SIZE + 6)
+/*
+ * SaltLength that the server send can be zero, so the only three required
+ * fields (all __le16) end up six bytes total, so the minimum context data len
+ * in the response is six bytes which accounts for
+ *
+ * HashAlgorithmCount, SaltLength, and 1 HashAlgorithm.
+ */
+#define MIN_PREAUTH_CTXT_DATA_LEN 6
+
struct smb2_preauth_neg_context {
__le16 ContextType; /* 1 */
__le16 DataLength;
@@ -346,7 +354,7 @@ struct smb2_preauth_neg_context {
__le16 HashAlgorithmCount; /* 1 */
__le16 SaltLength;
__le16 HashAlgorithms; /* HashAlgorithms[0] since only one defined */
- __u8 Salt[SMB311_SALT_SIZE];
+ __u8 Salt[SMB311_LINUX_CLIENT_SALT_SIZE];
} __packed;
/* Encryption Algorithms Ciphers */
The following commit has been merged into the locking/urgent branch of tip:
Commit-ID: 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9
Gitweb: https://git.kernel.org/tip/12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Wed, 20 Jan 2021 16:00:24 +01:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Tue, 26 Jan 2021 15:10:58 +01:00
futex: Ensure the correct return value from futex_lock_pi()
In case that futex_lock_pi() was aborted by a signal or a timeout and the
task returned without acquiring the rtmutex, but is the designated owner of
the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to
establish consistent state. In that case it invokes fixup_pi_state_owner()
which in turn tries to acquire the rtmutex again. If that succeeds then it
does not propagate this success to fixup_owner() and futex_lock_pi()
returns -EINTR or -ETIMEOUT despite having the futex locked.
Return success from fixup_pi_state_owner() in all cases where the current
task owns the rtmutex and therefore the futex and propagate it correctly
through fixup_owner(). Fixup the other callsite which does not expect a
positive return value.
Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex")
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
---
kernel/futex.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index c47d101..d5e61c2 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2373,8 +2373,8 @@ retry:
}
if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
- /* We got the lock after all, nothing to fix. */
- ret = 0;
+ /* We got the lock. pi_state is correct. Tell caller. */
+ ret = 1;
goto out_unlock;
}
@@ -2402,7 +2402,7 @@ retry:
* We raced against a concurrent self; things are
* already fixed up. Nothing to do.
*/
- ret = 0;
+ ret = 1;
goto out_unlock;
}
newowner = argowner;
@@ -2448,7 +2448,7 @@ retry:
raw_spin_unlock(&newowner->pi_lock);
raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
- return 0;
+ return argowner == current;
/*
* In order to reschedule or handle a page fault, we need to drop the
@@ -2490,7 +2490,7 @@ handle_err:
* Check if someone else fixed it for us:
*/
if (pi_state->owner != oldowner) {
- ret = 0;
+ ret = argowner == current;
goto out_unlock;
}
@@ -2523,8 +2523,6 @@ static long futex_wait_restart(struct restart_block *restart);
*/
static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
{
- int ret = 0;
-
if (locked) {
/*
* Got the lock. We might not be the anticipated owner if we
@@ -2535,8 +2533,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
* stable state, anything else needs more attention.
*/
if (q->pi_state->owner != current)
- ret = fixup_pi_state_owner(uaddr, q, current);
- return ret ? ret : locked;
+ return fixup_pi_state_owner(uaddr, q, current);
+ return 1;
}
/*
@@ -2547,10 +2545,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
* Another speculative read; pi_state->owner == current is unstable
* but needs our attention.
*/
- if (q->pi_state->owner == current) {
- ret = fixup_pi_state_owner(uaddr, q, NULL);
- return ret;
- }
+ if (q->pi_state->owner == current)
+ return fixup_pi_state_owner(uaddr, q, NULL);
/*
* Paranoia check. If we did not take the lock, then we should not be
@@ -2563,7 +2559,7 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
q->pi_state->owner);
}
- return ret;
+ return 0;
}
/**
@@ -3261,7 +3257,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
if (q.pi_state && (q.pi_state->owner != current)) {
spin_lock(q.lock_ptr);
ret = fixup_pi_state_owner(uaddr2, &q, current);
- if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
+ if (ret < 0 && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
pi_state = q.pi_state;
get_pi_state(pi_state);
}
@@ -3271,6 +3267,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
*/
put_pi_state(q.pi_state);
spin_unlock(q.lock_ptr);
+ /*
+ * Adjust the return value. It's either -EFAULT or
+ * success (1) but the caller expects 0 for success.
+ */
+ ret = ret < 0 ? ret : 0;
}
} else {
struct rt_mutex *pi_mutex;
The following commit has been merged into the locking/urgent branch of tip:
Commit-ID: 04b79c55201f02ffd675e1231d731365e335c307
Gitweb: https://git.kernel.org/tip/04b79c55201f02ffd675e1231d731365e335c307
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Tue, 19 Jan 2021 16:06:10 +01:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Tue, 26 Jan 2021 15:10:58 +01:00
futex: Replace pointless printk in fixup_owner()
If that unexpected case of inconsistent arguments ever happens then the
futex state is left completely inconsistent and the printk is not really
helpful. Replace it with a warning and make the state consistent.
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
---
kernel/futex.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index d5e61c2..5dc8f89 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2550,14 +2550,10 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
/*
* Paranoia check. If we did not take the lock, then we should not be
- * the owner of the rt_mutex.
+ * the owner of the rt_mutex. Warn and establish consistent state.
*/
- if (rt_mutex_owner(&q->pi_state->pi_mutex) == current) {
- printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p "
- "pi-state %p\n", ret,
- q->pi_state->pi_mutex.owner,
- q->pi_state->owner);
- }
+ if (WARN_ON_ONCE(rt_mutex_owner(&q->pi_state->pi_mutex) == current))
+ return fixup_pi_state_owner(uaddr, q, current);
return 0;
}
The following commit has been merged into the locking/urgent branch of tip:
Commit-ID: c5cade200ab9a2a3be9e7f32a752c8d86b502ec7
Gitweb: https://git.kernel.org/tip/c5cade200ab9a2a3be9e7f32a752c8d86b502ec7
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Tue, 19 Jan 2021 15:21:35 +01:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Tue, 26 Jan 2021 15:10:58 +01:00
futex: Provide and use pi_state_update_owner()
Updating pi_state::owner is done at several places with the same
code. Provide a function for it and use that at the obvious places.
This is also a preparation for a bug fix to avoid yet another copy of the
same code or alternatively introducing a completely unpenetratable mess of
gotos.
Originally-by: Peter Zijlstra <peterz(a)infradead.org>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
---
kernel/futex.c | 66 ++++++++++++++++++++++++-------------------------
1 file changed, 33 insertions(+), 33 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index 5dc8f89..7837f9e 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -763,6 +763,29 @@ static struct futex_pi_state *alloc_pi_state(void)
return pi_state;
}
+static void pi_state_update_owner(struct futex_pi_state *pi_state,
+ struct task_struct *new_owner)
+{
+ struct task_struct *old_owner = pi_state->owner;
+
+ lockdep_assert_held(&pi_state->pi_mutex.wait_lock);
+
+ if (old_owner) {
+ raw_spin_lock(&old_owner->pi_lock);
+ WARN_ON(list_empty(&pi_state->list));
+ list_del_init(&pi_state->list);
+ raw_spin_unlock(&old_owner->pi_lock);
+ }
+
+ if (new_owner) {
+ raw_spin_lock(&new_owner->pi_lock);
+ WARN_ON(!list_empty(&pi_state->list));
+ list_add(&pi_state->list, &new_owner->pi_state_list);
+ pi_state->owner = new_owner;
+ raw_spin_unlock(&new_owner->pi_lock);
+ }
+}
+
static void get_pi_state(struct futex_pi_state *pi_state)
{
WARN_ON_ONCE(!refcount_inc_not_zero(&pi_state->refcount));
@@ -1521,26 +1544,15 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_
ret = -EINVAL;
}
- if (ret)
- goto out_unlock;
-
- /*
- * This is a point of no return; once we modify the uval there is no
- * going back and subsequent operations must not fail.
- */
-
- raw_spin_lock(&pi_state->owner->pi_lock);
- WARN_ON(list_empty(&pi_state->list));
- list_del_init(&pi_state->list);
- raw_spin_unlock(&pi_state->owner->pi_lock);
-
- raw_spin_lock(&new_owner->pi_lock);
- WARN_ON(!list_empty(&pi_state->list));
- list_add(&pi_state->list, &new_owner->pi_state_list);
- pi_state->owner = new_owner;
- raw_spin_unlock(&new_owner->pi_lock);
-
- postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
+ if (!ret) {
+ /*
+ * This is a point of no return; once we modified the uval
+ * there is no going back and subsequent operations must
+ * not fail.
+ */
+ pi_state_update_owner(pi_state, new_owner);
+ postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
+ }
out_unlock:
raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
@@ -2433,19 +2445,7 @@ retry:
* We fixed up user space. Now we need to fix the pi_state
* itself.
*/
- if (pi_state->owner != NULL) {
- raw_spin_lock(&pi_state->owner->pi_lock);
- WARN_ON(list_empty(&pi_state->list));
- list_del_init(&pi_state->list);
- raw_spin_unlock(&pi_state->owner->pi_lock);
- }
-
- pi_state->owner = newowner;
-
- raw_spin_lock(&newowner->pi_lock);
- WARN_ON(!list_empty(&pi_state->list));
- list_add(&pi_state->list, &newowner->pi_state_list);
- raw_spin_unlock(&newowner->pi_lock);
+ pi_state_update_owner(pi_state, newowner);
raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
return argowner == current;
The following commit has been merged into the locking/urgent branch of tip:
Commit-ID: 6ccc84f917d33312eb2846bd7b567639f585ad6d
Gitweb: https://git.kernel.org/tip/6ccc84f917d33312eb2846bd7b567639f585ad6d
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Wed, 20 Jan 2021 11:35:19 +01:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Tue, 26 Jan 2021 15:10:59 +01:00
futex: Use pi_state_update_owner() in put_pi_state()
No point in open coding it. This way it gains the extra sanity checks.
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
---
kernel/futex.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index cfca221..a0fe63c 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -808,16 +808,10 @@ static void put_pi_state(struct futex_pi_state *pi_state)
* and has cleaned up the pi_state already
*/
if (pi_state->owner) {
- struct task_struct *owner;
unsigned long flags;
raw_spin_lock_irqsave(&pi_state->pi_mutex.wait_lock, flags);
- owner = pi_state->owner;
- if (owner) {
- raw_spin_lock(&owner->pi_lock);
- list_del_init(&pi_state->list);
- raw_spin_unlock(&owner->pi_lock);
- }
+ pi_state_update_owner(pi_state, NULL);
rt_mutex_proxy_unlock(&pi_state->pi_mutex);
raw_spin_unlock_irqrestore(&pi_state->pi_mutex.wait_lock, flags);
}
The following commit has been merged into the locking/urgent branch of tip:
Commit-ID: 34b1a1ce1458f50ef27c54e28eb9b1947012907a
Gitweb: https://git.kernel.org/tip/34b1a1ce1458f50ef27c54e28eb9b1947012907a
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Mon, 18 Jan 2021 19:01:21 +01:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Tue, 26 Jan 2021 15:11:00 +01:00
futex: Handle faults correctly for PI futexes
fixup_pi_state_owner() tries to ensure that the state of the rtmutex,
pi_state and the user space value related to the PI futex are consistent
before returning to user space. In case that the user space value update
faults and the fault cannot be resolved by faulting the page in via
fault_in_user_writeable() the function returns with -EFAULT and leaves
the rtmutex and pi_state owner state inconsistent.
A subsequent futex_unlock_pi() operates on the inconsistent pi_state and
releases the rtmutex despite not owning it which can corrupt the RB tree of
the rtmutex and cause a subsequent kernel stack use after free.
It was suggested to loop forever in fixup_pi_state_owner() if the fault
cannot be resolved, but that results in runaway tasks which is especially
undesired when the problem happens due to a programming error and not due
to malice.
As the user space value cannot be fixed up, the proper solution is to make
the rtmutex and the pi_state consistent so both have the same owner. This
leaves the user space value out of sync. Any subsequent operation on the
futex will fail because the 10th rule of PI futexes (pi_state owner and
user space value are consistent) has been violated.
As a consequence this removes the inept attempts of 'fixing' the situation
in case that the current task owns the rtmutex when returning with an
unresolvable fault by unlocking the rtmutex which left pi_state::owner and
rtmutex::owner out of sync in a different and only slightly less dangerous
way.
Fixes: 1b7558e457ed ("futexes: fix fault handling in futex_lock_pi")
Reported-by: gzobqq(a)gmail.com
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: stable(a)vger.kernel.org
---
kernel/futex.c | 57 +++++++++++++++++--------------------------------
1 file changed, 20 insertions(+), 37 deletions(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index 7a38ead..45a13eb 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -958,7 +958,8 @@ static inline void exit_pi_state_list(struct task_struct *curr) { }
* FUTEX_OWNER_DIED bit. See [4]
*
* [10] There is no transient state which leaves owner and user space
- * TID out of sync.
+ * TID out of sync. Except one error case where the kernel is denied
+ * write access to the user address, see fixup_pi_state_owner().
*
*
* Serialization and lifetime rules:
@@ -2480,6 +2481,24 @@ handle_err:
if (!err)
goto retry;
+ /*
+ * fault_in_user_writeable() failed so user state is immutable. At
+ * best we can make the kernel state consistent but user state will
+ * be most likely hosed and any subsequent unlock operation will be
+ * rejected due to PI futex rule [10].
+ *
+ * Ensure that the rtmutex owner is also the pi_state owner despite
+ * the user space value claiming something different. There is no
+ * point in unlocking the rtmutex if current is the owner as it
+ * would need to wait until the next waiter has taken the rtmutex
+ * to guarantee consistent state. Keep it simple. Userspace asked
+ * for this wreckaged state.
+ *
+ * The rtmutex has an owner - either current or some other
+ * task. See the EAGAIN loop above.
+ */
+ pi_state_update_owner(pi_state, rt_mutex_owner(&pi_state->pi_mutex));
+
return err;
}
@@ -2756,7 +2775,6 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
ktime_t *time, int trylock)
{
struct hrtimer_sleeper timeout, *to;
- struct futex_pi_state *pi_state = NULL;
struct task_struct *exiting = NULL;
struct rt_mutex_waiter rt_waiter;
struct futex_hash_bucket *hb;
@@ -2892,23 +2910,8 @@ no_block:
if (res)
ret = (res < 0) ? res : 0;
- /*
- * If fixup_owner() faulted and was unable to handle the fault, unlock
- * it and return the fault to userspace.
- */
- if (ret && (rt_mutex_owner(&q.pi_state->pi_mutex) == current)) {
- pi_state = q.pi_state;
- get_pi_state(pi_state);
- }
-
/* Unqueue and drop the lock */
unqueue_me_pi(&q);
-
- if (pi_state) {
- rt_mutex_futex_unlock(&pi_state->pi_mutex);
- put_pi_state(pi_state);
- }
-
goto out;
out_unlock_put_key:
@@ -3168,7 +3171,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
u32 __user *uaddr2)
{
struct hrtimer_sleeper timeout, *to;
- struct futex_pi_state *pi_state = NULL;
struct rt_mutex_waiter rt_waiter;
struct futex_hash_bucket *hb;
union futex_key key2 = FUTEX_KEY_INIT;
@@ -3246,10 +3248,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
if (q.pi_state && (q.pi_state->owner != current)) {
spin_lock(q.lock_ptr);
ret = fixup_pi_state_owner(uaddr2, &q, current);
- if (ret < 0 && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
- pi_state = q.pi_state;
- get_pi_state(pi_state);
- }
/*
* Drop the reference to the pi state which
* the requeue_pi() code acquired for us.
@@ -3291,25 +3289,10 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
if (res)
ret = (res < 0) ? res : 0;
- /*
- * If fixup_pi_state_owner() faulted and was unable to handle
- * the fault, unlock the rt_mutex and return the fault to
- * userspace.
- */
- if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
- pi_state = q.pi_state;
- get_pi_state(pi_state);
- }
-
/* Unqueue and drop the lock. */
unqueue_me_pi(&q);
}
- if (pi_state) {
- rt_mutex_futex_unlock(&pi_state->pi_mutex);
- put_pi_state(pi_state);
- }
-
if (ret == -EINTR) {
/*
* We've already been requeued, but cannot restart by calling
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: cedrus: Fix H264 decoding
Author: Jernej Skrabec <jernej.skrabec(a)siol.net>
Date: Wed Dec 23 12:06:59 2020 +0100
During H264 API overhaul subtle bug was introduced Cedrus driver.
Progressive references have both, top and bottom reference flags set.
Cedrus reference list expects only bottom reference flag and only when
interlaced frames are decoded. However, due to a bug in Cedrus check,
exclusivity is not tested and that flag is set also for progressive
references. That causes "jumpy" background with many videos.
Fix that by checking that only bottom reference flag is set in control
and nothing else.
Tested-by: Andre Heider <a.heider(a)gmail.com>
Fixes: cfc8c3ed533e ("media: cedrus: h264: Properly configure reference field")
Signed-off-by: Jernej Skrabec <jernej.skrabec(a)siol.net>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
index 781c84a9b1b7..de7442d4834d 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
@@ -203,7 +203,7 @@ static void _cedrus_write_ref_list(struct cedrus_ctx *ctx,
position = cedrus_buf->codec.h264.position;
sram_array[i] |= position << 1;
- if (ref_list[i].fields & V4L2_H264_BOTTOM_FIELD_REF)
+ if (ref_list[i].fields == V4L2_H264_BOTTOM_FIELD_REF)
sram_array[i] |= BIT(0);
}
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: cedrus: Fix H264 decoding
Author: Jernej Skrabec <jernej.skrabec(a)siol.net>
Date: Wed Dec 23 12:06:59 2020 +0100
During H264 API overhaul subtle bug was introduced Cedrus driver.
Progressive references have both, top and bottom reference flags set.
Cedrus reference list expects only bottom reference flag and only when
interlaced frames are decoded. However, due to a bug in Cedrus check,
exclusivity is not tested and that flag is set also for progressive
references. That causes "jumpy" background with many videos.
Fix that by checking that only bottom reference flag is set in control
and nothing else.
Tested-by: Andre Heider <a.heider(a)gmail.com>
Fixes: cfc8c3ed533e ("media: cedrus: h264: Properly configure reference field")
Signed-off-by: Jernej Skrabec <jernej.skrabec(a)siol.net>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
index 781c84a9b1b7..de7442d4834d 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
@@ -203,7 +203,7 @@ static void _cedrus_write_ref_list(struct cedrus_ctx *ctx,
position = cedrus_buf->codec.h264.position;
sram_array[i] |= position << 1;
- if (ref_list[i].fields & V4L2_H264_BOTTOM_FIELD_REF)
+ if (ref_list[i].fields == V4L2_H264_BOTTOM_FIELD_REF)
sram_array[i] |= BIT(0);
}
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: v4l2-subdev.h: BIT() is not available in userspace
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Mon Jan 18 16:37:00 2021 +0100
The BIT macro is not available in userspace, so replace BIT(0) by
0x00000001.
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Fixes: 6446ec6cbf46 ("media: v4l2-subdev: add VIDIOC_SUBDEV_QUERYCAP ioctl")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
include/uapi/linux/v4l2-subdev.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/include/uapi/linux/v4l2-subdev.h b/include/uapi/linux/v4l2-subdev.h
index 00850b98078a..a38454d9e0f5 100644
--- a/include/uapi/linux/v4l2-subdev.h
+++ b/include/uapi/linux/v4l2-subdev.h
@@ -176,7 +176,7 @@ struct v4l2_subdev_capability {
};
/* The v4l2 sub-device video device node is registered in read-only mode. */
-#define V4L2_SUBDEV_CAP_RO_SUBDEV BIT(0)
+#define V4L2_SUBDEV_CAP_RO_SUBDEV 0x00000001
/* Backwards compatibility define --- to be removed */
#define v4l2_subdev_edid v4l2_edid
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: v4l2-subdev.h: BIT() is not available in userspace
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Mon Jan 18 16:37:00 2021 +0100
The BIT macro is not available in userspace, so replace BIT(0) by
0x00000001.
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Fixes: 6446ec6cbf46 ("media: v4l2-subdev: add VIDIOC_SUBDEV_QUERYCAP ioctl")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
include/uapi/linux/v4l2-subdev.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/include/uapi/linux/v4l2-subdev.h b/include/uapi/linux/v4l2-subdev.h
index 00850b98078a..a38454d9e0f5 100644
--- a/include/uapi/linux/v4l2-subdev.h
+++ b/include/uapi/linux/v4l2-subdev.h
@@ -176,7 +176,7 @@ struct v4l2_subdev_capability {
};
/* The v4l2 sub-device video device node is registered in read-only mode. */
-#define V4L2_SUBDEV_CAP_RO_SUBDEV BIT(0)
+#define V4L2_SUBDEV_CAP_RO_SUBDEV 0x00000001
/* Backwards compatibility define --- to be removed */
#define v4l2_subdev_edid v4l2_edid
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5c02406428d5219c367c5f53457698c58bc5f917 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka(a)redhat.com>
Date: Wed, 20 Jan 2021 13:59:11 -0500
Subject: [PATCH] dm integrity: conditionally disable "recalculate" feature
Otherwise a malicious user could (ab)use the "recalculate" feature
that makes dm-integrity calculate the checksums in the background
while the device is already usable. When the system restarts before all
checksums have been calculated, the calculation continues where it was
interrupted even if the recalculate feature is not requested the next
time the dm device is set up.
Disable recalculating if we use internal_hash or journal_hash with a
key (e.g. HMAC) and we don't have the "legacy_recalculate" flag.
This may break activation of a volume, created by an older kernel,
that is not yet fully recalculated -- if this happens, the user should
add the "legacy_recalculate" flag to constructor parameters.
Cc: stable(a)vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com>
Reported-by: Daniel Glockner <dg(a)emlix.com>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/Documentation/admin-guide/device-mapper/dm-integrity.rst b/Documentation/admin-guide/device-mapper/dm-integrity.rst
index 4e6f504474ac..2cc5488acbd9 100644
--- a/Documentation/admin-guide/device-mapper/dm-integrity.rst
+++ b/Documentation/admin-guide/device-mapper/dm-integrity.rst
@@ -177,14 +177,20 @@ bitmap_flush_interval:number
The bitmap flush interval in milliseconds. The metadata buffers
are synchronized when this interval expires.
+allow_discards
+ Allow block discard requests (a.k.a. TRIM) for the integrity device.
+ Discards are only allowed to devices using internal hash.
+
fix_padding
Use a smaller padding of the tag area that is more
space-efficient. If this option is not present, large padding is
used - that is for compatibility with older kernels.
-allow_discards
- Allow block discard requests (a.k.a. TRIM) for the integrity device.
- Discards are only allowed to devices using internal hash.
+legacy_recalculate
+ Allow recalculating of volumes with HMAC keys. This is disabled by
+ default for security reasons - an attacker could modify the volume,
+ set recalc_sector to zero, and the kernel would not detect the
+ modification.
The journal mode (D/J), buffer_sectors, journal_watermark, commit_time and
allow_discards can be changed when reloading the target (load an inactive
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index cce203adcf77..b64fede032dc 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -257,8 +257,9 @@ struct dm_integrity_c {
bool journal_uptodate;
bool just_formatted;
bool recalculate_flag;
- bool fix_padding;
bool discard;
+ bool fix_padding;
+ bool legacy_recalculate;
struct alg_spec internal_hash_alg;
struct alg_spec journal_crypt_alg;
@@ -386,6 +387,14 @@ static int dm_integrity_failed(struct dm_integrity_c *ic)
return READ_ONCE(ic->failed);
}
+static bool dm_integrity_disable_recalculate(struct dm_integrity_c *ic)
+{
+ if ((ic->internal_hash_alg.key || ic->journal_mac_alg.key) &&
+ !ic->legacy_recalculate)
+ return true;
+ return false;
+}
+
static commit_id_t dm_integrity_commit_id(struct dm_integrity_c *ic, unsigned i,
unsigned j, unsigned char seq)
{
@@ -3140,6 +3149,7 @@ static void dm_integrity_status(struct dm_target *ti, status_type_t type,
arg_count += !!ic->journal_crypt_alg.alg_string;
arg_count += !!ic->journal_mac_alg.alg_string;
arg_count += (ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING)) != 0;
+ arg_count += ic->legacy_recalculate;
DMEMIT("%s %llu %u %c %u", ic->dev->name, ic->start,
ic->tag_size, ic->mode, arg_count);
if (ic->meta_dev)
@@ -3163,6 +3173,8 @@ static void dm_integrity_status(struct dm_target *ti, status_type_t type,
}
if ((ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING)) != 0)
DMEMIT(" fix_padding");
+ if (ic->legacy_recalculate)
+ DMEMIT(" legacy_recalculate");
#define EMIT_ALG(a, n) \
do { \
@@ -3792,7 +3804,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
unsigned extra_args;
struct dm_arg_set as;
static const struct dm_arg _args[] = {
- {0, 15, "Invalid number of feature args"},
+ {0, 16, "Invalid number of feature args"},
};
unsigned journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec;
bool should_write_sb;
@@ -3940,6 +3952,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
ic->discard = true;
} else if (!strcmp(opt_string, "fix_padding")) {
ic->fix_padding = true;
+ } else if (!strcmp(opt_string, "legacy_recalculate")) {
+ ic->legacy_recalculate = true;
} else {
r = -EINVAL;
ti->error = "Invalid argument";
@@ -4243,6 +4257,14 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
}
}
+ if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING) &&
+ le64_to_cpu(ic->sb->recalc_sector) < ic->provided_data_sectors &&
+ dm_integrity_disable_recalculate(ic)) {
+ ti->error = "Recalculating with HMAC is disabled for security reasons - if you really need it, use the argument \"legacy_recalculate\"";
+ r = -EOPNOTSUPP;
+ goto bad;
+ }
+
ic->bufio = dm_bufio_client_create(ic->meta_dev ? ic->meta_dev->bdev : ic->dev->bdev,
1U << (SECTOR_SHIFT + ic->log2_buffer_sectors), 1, 0, NULL, NULL);
if (IS_ERR(ic->bufio)) {
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5c02406428d5219c367c5f53457698c58bc5f917 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka(a)redhat.com>
Date: Wed, 20 Jan 2021 13:59:11 -0500
Subject: [PATCH] dm integrity: conditionally disable "recalculate" feature
Otherwise a malicious user could (ab)use the "recalculate" feature
that makes dm-integrity calculate the checksums in the background
while the device is already usable. When the system restarts before all
checksums have been calculated, the calculation continues where it was
interrupted even if the recalculate feature is not requested the next
time the dm device is set up.
Disable recalculating if we use internal_hash or journal_hash with a
key (e.g. HMAC) and we don't have the "legacy_recalculate" flag.
This may break activation of a volume, created by an older kernel,
that is not yet fully recalculated -- if this happens, the user should
add the "legacy_recalculate" flag to constructor parameters.
Cc: stable(a)vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com>
Reported-by: Daniel Glockner <dg(a)emlix.com>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/Documentation/admin-guide/device-mapper/dm-integrity.rst b/Documentation/admin-guide/device-mapper/dm-integrity.rst
index 4e6f504474ac..2cc5488acbd9 100644
--- a/Documentation/admin-guide/device-mapper/dm-integrity.rst
+++ b/Documentation/admin-guide/device-mapper/dm-integrity.rst
@@ -177,14 +177,20 @@ bitmap_flush_interval:number
The bitmap flush interval in milliseconds. The metadata buffers
are synchronized when this interval expires.
+allow_discards
+ Allow block discard requests (a.k.a. TRIM) for the integrity device.
+ Discards are only allowed to devices using internal hash.
+
fix_padding
Use a smaller padding of the tag area that is more
space-efficient. If this option is not present, large padding is
used - that is for compatibility with older kernels.
-allow_discards
- Allow block discard requests (a.k.a. TRIM) for the integrity device.
- Discards are only allowed to devices using internal hash.
+legacy_recalculate
+ Allow recalculating of volumes with HMAC keys. This is disabled by
+ default for security reasons - an attacker could modify the volume,
+ set recalc_sector to zero, and the kernel would not detect the
+ modification.
The journal mode (D/J), buffer_sectors, journal_watermark, commit_time and
allow_discards can be changed when reloading the target (load an inactive
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index cce203adcf77..b64fede032dc 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -257,8 +257,9 @@ struct dm_integrity_c {
bool journal_uptodate;
bool just_formatted;
bool recalculate_flag;
- bool fix_padding;
bool discard;
+ bool fix_padding;
+ bool legacy_recalculate;
struct alg_spec internal_hash_alg;
struct alg_spec journal_crypt_alg;
@@ -386,6 +387,14 @@ static int dm_integrity_failed(struct dm_integrity_c *ic)
return READ_ONCE(ic->failed);
}
+static bool dm_integrity_disable_recalculate(struct dm_integrity_c *ic)
+{
+ if ((ic->internal_hash_alg.key || ic->journal_mac_alg.key) &&
+ !ic->legacy_recalculate)
+ return true;
+ return false;
+}
+
static commit_id_t dm_integrity_commit_id(struct dm_integrity_c *ic, unsigned i,
unsigned j, unsigned char seq)
{
@@ -3140,6 +3149,7 @@ static void dm_integrity_status(struct dm_target *ti, status_type_t type,
arg_count += !!ic->journal_crypt_alg.alg_string;
arg_count += !!ic->journal_mac_alg.alg_string;
arg_count += (ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING)) != 0;
+ arg_count += ic->legacy_recalculate;
DMEMIT("%s %llu %u %c %u", ic->dev->name, ic->start,
ic->tag_size, ic->mode, arg_count);
if (ic->meta_dev)
@@ -3163,6 +3173,8 @@ static void dm_integrity_status(struct dm_target *ti, status_type_t type,
}
if ((ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING)) != 0)
DMEMIT(" fix_padding");
+ if (ic->legacy_recalculate)
+ DMEMIT(" legacy_recalculate");
#define EMIT_ALG(a, n) \
do { \
@@ -3792,7 +3804,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
unsigned extra_args;
struct dm_arg_set as;
static const struct dm_arg _args[] = {
- {0, 15, "Invalid number of feature args"},
+ {0, 16, "Invalid number of feature args"},
};
unsigned journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec;
bool should_write_sb;
@@ -3940,6 +3952,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
ic->discard = true;
} else if (!strcmp(opt_string, "fix_padding")) {
ic->fix_padding = true;
+ } else if (!strcmp(opt_string, "legacy_recalculate")) {
+ ic->legacy_recalculate = true;
} else {
r = -EINVAL;
ti->error = "Invalid argument";
@@ -4243,6 +4257,14 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
}
}
+ if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING) &&
+ le64_to_cpu(ic->sb->recalc_sector) < ic->provided_data_sectors &&
+ dm_integrity_disable_recalculate(ic)) {
+ ti->error = "Recalculating with HMAC is disabled for security reasons - if you really need it, use the argument \"legacy_recalculate\"";
+ r = -EOPNOTSUPP;
+ goto bad;
+ }
+
ic->bufio = dm_bufio_client_create(ic->meta_dev ? ic->meta_dev->bdev : ic->dev->bdev,
1U << (SECTOR_SHIFT + ic->log2_buffer_sectors), 1, 0, NULL, NULL);
if (IS_ERR(ic->bufio)) {
Rebased on linux-5.10.y, stable tags added. The first was dropped
before, most of others make it right.
Pavel Begunkov (11):
kernel/io_uring: cancel io_uring before task works
io_uring: inline io_uring_attempt_task_drop()
io_uring: add warn_once for io_uring_flush()
io_uring: stop SQPOLL submit on creator's death
io_uring: fix null-deref in io_disable_sqo_submit
io_uring: do sqo disable on install_fd error
io_uring: fix false positive sqo warning on flush
io_uring: fix uring_flush in exit_files() warning
io_uring: fix skipping disabling sqo on exec
io_uring: dont kill fasync under completion_lock
io_uring: fix sleeping under spin in __io_clean_op
fs/file.c | 2 -
fs/io_uring.c | 119 +++++++++++++++++++++++++++++++++++---------------
kernel/exit.c | 2 +
3 files changed, 86 insertions(+), 37 deletions(-)
--
2.24.0
From: Arnd Bergmann <arnd(a)arndb.de>
sdhci_pltfm_suspend() is only available when CONFIG_PM_SLEEP
support is built into the kernel, which caused a regression
in a recent bugfix:
ld.lld: error: undefined symbol: sdhci_pltfm_suspend
>>> referenced by sdhci-brcmstb.c
>>> mmc/host/sdhci-brcmstb.o:(sdhci_brcmstb_shutdown) in archive drivers/built-in.a
Making the call conditional on the symbol fixes the link
error.
Fixes: 5b191dcba719 ("mmc: sdhci-brcmstb: Fix mmc timeout errors on S5 suspend")
Fixes: e7b5d63a82fe ("mmc: sdhci-brcmstb: Add shutdown callback")
Cc: stable(a)vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
It would be helpful if someone could test this to ensure that the
driver works correctly even when CONFIG_PM_SLEEP is disabled
---
drivers/mmc/host/sdhci-brcmstb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c
index f9780c65ebe9..dc9280b149db 100644
--- a/drivers/mmc/host/sdhci-brcmstb.c
+++ b/drivers/mmc/host/sdhci-brcmstb.c
@@ -314,7 +314,8 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev)
static void sdhci_brcmstb_shutdown(struct platform_device *pdev)
{
- sdhci_pltfm_suspend(&pdev->dev);
+ if (IS_ENABLED(CONFIG_PM_SLEEP))
+ sdhci_pltfm_suspend(&pdev->dev);
}
MODULE_DEVICE_TABLE(of, sdhci_brcm_of_match);
--
2.29.2
If the tctx inflight number haven't changed because of cancellation,
__io_uring_task_cancel() will continue leaving the task in
TASK_UNINTERRUPTIBLE state, that's not expected by
__io_uring_files_cancel(). Ensure we always call finish_wait() before
retrying.
Cc: stable(a)vger.kernel.org # 5.9+
Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com>
---
fs/io_uring.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2166c469789d..09aada153a71 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -9124,16 +9124,15 @@ void __io_uring_task_cancel(void)
prepare_to_wait(&tctx->wait, &wait, TASK_UNINTERRUPTIBLE);
/*
- * If we've seen completions, retry. This avoids a race where
- * a completion comes in before we did prepare_to_wait().
+ * If we've seen completions, retry without waiting. This
+ * avoids a race where a completion comes in before we did
+ * prepare_to_wait().
*/
- if (inflight != tctx_inflight(tctx))
- continue;
- schedule();
+ if (inflight == tctx_inflight(tctx))
+ schedule();
finish_wait(&tctx->wait, &wait);
} while (1);
- finish_wait(&tctx->wait, &wait);
atomic_dec(&tctx->in_idle);
io_uring_remove_task_files(tctx);
--
2.24.0
This is a note to let you know that I've just added the patch titled
usb: gadget: aspeed: add missing of_node_put
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From a55a9a4c5c6253f6e4dea268af728664ac997790 Mon Sep 17 00:00:00 2001
From: kernel test robot <lkp(a)intel.com>
Date: Thu, 21 Jan 2021 19:12:54 +0100
Subject: usb: gadget: aspeed: add missing of_node_put
Breaking out of for_each_child_of_node requires a put on the
child value.
Generated by: scripts/coccinelle/iterators/for_each_child.cocci
Fixes: 82c2d81361ec ("coccinelle: iterators: Add for_each_child.cocci script")
CC: Sumera Priyadarsini <sylphrenadin(a)gmail.com>
Reported-by: kernel test robot <lkp(a)intel.com>
Signed-off-by: kernel test robot <lkp(a)intel.com>
Signed-off-by: Julia Lawall <julia.lawall(a)inria.fr>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2101211907060.14700@hadrien
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/gadget/udc/aspeed-vhub/hub.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/hub.c b/drivers/usb/gadget/udc/aspeed-vhub/hub.c
index 6497185ec4e7..bfd8e77788e2 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/hub.c
+++ b/drivers/usb/gadget/udc/aspeed-vhub/hub.c
@@ -999,8 +999,10 @@ static int ast_vhub_of_parse_str_desc(struct ast_vhub *vhub,
str_array[offset].s = NULL;
ret = ast_vhub_str_alloc_add(vhub, &lang_str);
- if (ret)
+ if (ret) {
+ of_node_put(child);
break;
+ }
}
return ret;
--
2.30.0
The most-significant bit of the sub-integer-prescaler index is set in
the high byte of the baudrate request wIndex also for FTX devices.
This fixes rates like 1152000 which got mapped to 12 MBd.
Reported-by: Vladimir <svv75(a)mail.ru>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=210351
Cc: stable(a)vger.kernel.org
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/usb/serial/ftdi_sio.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 94398f89e600..4168801b9595 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1386,8 +1386,9 @@ static int change_speed(struct tty_struct *tty, struct usb_serial_port *port)
index_value = get_ftdi_divisor(tty, port);
value = (u16)index_value;
index = (u16)(index_value >> 16);
- if ((priv->chip_type == FT2232C) || (priv->chip_type == FT2232H) ||
- (priv->chip_type == FT4232H) || (priv->chip_type == FT232H)) {
+ if (priv->chip_type == FT2232C || priv->chip_type == FT2232H ||
+ priv->chip_type == FT4232H || priv->chip_type == FT232H ||
+ priv->chip_type == FTX) {
/* Probably the BM type needs the MSB of the encoded fractional
* divider also moved like for the chips above. Any infos? */
index = (u16)((index << 8) | priv->interface);
--
2.26.2
This is a note to let you know that I've just added the patch titled
USB: usblp: don't call usb_set_interface if there's a single alt
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From d8c6edfa3f4ee0d45d7ce5ef18d1245b78774b9d Mon Sep 17 00:00:00 2001
From: Jeremy Figgins <kernel(a)jeremyfiggins.com>
Date: Sat, 23 Jan 2021 18:21:36 -0600
Subject: USB: usblp: don't call usb_set_interface if there's a single alt
Some devices, such as the Winbond Electronics Corp. Virtual Com Port
(Vendor=0416, ProdId=5011), lockup when usb_set_interface() or
usb_clear_halt() are called. This device has only a single
altsetting, so it should not be necessary to call usb_set_interface().
Acked-by: Pete Zaitcev <zaitcev(a)redhat.com>
Signed-off-by: Jeremy Figgins <kernel(a)jeremyfiggins.com>
Link: https://lore.kernel.org/r/YAy9kJhM/rG8EQXC@watson
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/class/usblp.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 134dc2005ce9..c9f6e9758288 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -1329,14 +1329,17 @@ static int usblp_set_protocol(struct usblp *usblp, int protocol)
if (protocol < USBLP_FIRST_PROTOCOL || protocol > USBLP_LAST_PROTOCOL)
return -EINVAL;
- alts = usblp->protocol[protocol].alt_setting;
- if (alts < 0)
- return -EINVAL;
- r = usb_set_interface(usblp->dev, usblp->ifnum, alts);
- if (r < 0) {
- printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
- alts, usblp->ifnum);
- return r;
+ /* Don't unnecessarily set the interface if there's a single alt. */
+ if (usblp->intf->num_altsetting > 1) {
+ alts = usblp->protocol[protocol].alt_setting;
+ if (alts < 0)
+ return -EINVAL;
+ r = usb_set_interface(usblp->dev, usblp->ifnum, alts);
+ if (r < 0) {
+ printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
+ alts, usblp->ifnum);
+ return r;
+ }
}
usblp->bidir = (usblp->protocol[protocol].epread != NULL);
--
2.30.0
This is the start of the stable review cycle for the 5.4.93 release.
There are 88 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 28 Jan 2021 09:42:44 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.93-rc2…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.93-rc2
Enke Chen <enchen(a)paloaltonetworks.com>
tcp: fix TCP_USER_TIMEOUT with zero window
Eric Dumazet <edumazet(a)google.com>
tcp: do not mess with cloned skbs in tcp_add_backlog()
Dan Carpenter <dan.carpenter(a)oracle.com>
net: dsa: b53: fix an off by one in checking "vlan->vid"
Tariq Toukan <tariqt(a)nvidia.com>
net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: allow offloading of bridge on top of LAG
Matteo Croce <mcroce(a)microsoft.com>
ipv6: set multicast flag on the multicast route
Eric Dumazet <edumazet(a)google.com>
net_sched: reject silly cell_log in qdisc_get_rtab()
Eric Dumazet <edumazet(a)google.com>
net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
Matteo Croce <mcroce(a)microsoft.com>
ipv6: create multicast route with RTPROT_KERNEL
Guillaume Nault <gnault(a)redhat.com>
udp: mask TOS bits in udp_v4_early_demux()
Lecopzer Chen <lecopzer(a)gmail.com>
kasan: fix incorrect arguments passing in kasan_add_zero_shadow
Lecopzer Chen <lecopzer(a)gmail.com>
kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow
Alexander Lobakin <alobakin(a)pm.me>
skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
Pan Bian <bianpan2016(a)163.com>
lightnvm: fix memory leak when submit fails
Geert Uytterhoeven <geert+renesas(a)glider.be>
sh_eth: Fix power down vs. is_opened flag ordering
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext
Necip Fazil Yildiran <fazilyildiran(a)gmail.com>
sh: dma: fix kconfig dependency for G2_DMA
Guillaume Nault <gnault(a)redhat.com>
netfilter: rpfilter: mask ecn bits before fib lookup
Yazen Ghannam <Yazen.Ghannam(a)amd.com>
x86/cpu/amd: Set __max_die_per_package on AMD
Paul Cercueil <paul(a)crapouillou.net>
pinctrl: ingenic: Fix JZ4760 support
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
driver core: Extend device_is_dependent()
JC Kuo <jckuo(a)nvidia.com>
xhci: tegra: Delay for disabling LFPS detector
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: make sure TRB is fully written before giving it to the controller
Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com>
usb: bdc: Make bdc pci driver depend on BROKEN
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: udc: core: Use lock when write to soft_connect
Ryan Chen <ryan_chen(a)aspeedtech.com>
usb: gadget: aspeed: fix stop dma register setting.
Longfang Liu <liulongfang(a)huawei.com>
USB: ehci: fix an interrupt calltrace error
Eugene Korenevsky <ekorenevsky(a)astralinux.ru>
ehci: fix EHCI host controller initialization sequence
Pali Rohár <pali(a)kernel.org>
serial: mvebu-uart: fix tx lost characters at power off
Wang Hui <john.wanghui(a)huawei.com>
stm class: Fix module init return on allocation failure
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add Alder Lake-P support
Andy Lutomirski <luto(a)kernel.org>
x86/mmx: Use KFPU_387 for MMX string operations
Borislav Petkov <bp(a)suse.de>
x86/topology: Make __max_die_per_package available unconditionally
Andy Lutomirski <luto(a)kernel.org>
x86/fpu: Add kernel_fpu_begin_mask() to selectively initialize state
Mathias Kresin <dev(a)kresin.me>
irqchip/mips-cpu: Set IPI domain parent chip
Ronnie Sahlberg <lsahlber(a)redhat.com>
cifs: do not fail __smb_send_rqst if non-fatal signals are pending
Lars-Peter Clausen <lars(a)metafoo.de>
iio: ad5504: Fix setting power-down state
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: peak_usb: fix use after free bugs
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: vxcan: vxcan_xmit: fix use after free bug
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: dev: can_restart: fix use after free bug
Hangbin Liu <liuhangbin(a)gmail.com>
selftests: net: fib_tests: remove duplicate log test
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: octeon: check correct size of maximum RECV_LEN packet
Ariel Marcovitch <arielmarcovitch(a)gmail.com>
powerpc: Fix alignment bug within the init sections
Arnd Bergmann <arnd(a)arndb.de>
scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression
Billy Tsai <billy_tsai(a)aspeedtech.com>
pinctrl: aspeed: g6: Fix PWMG0 pinctrl setting
Youling Tang <tangyouling(a)loongson.cn>
powerpc: Use the common INIT_DATA_SECTION macro in vmlinux.lds.S
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/mmu: fix vram heap sizing
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/privring: ack interrupts the same way as RM
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/bios: fix issue shadowing expansion ROMs
Wayne Lin <Wayne.Lin(a)amd.com>
drm/amd/display: Fix to be able to stop crc calculation
Victor Zhao <Victor.Zhao(a)amd.com>
drm/amdgpu/psp: fix psp gfx ctrl cmds
Sagar Shrikant Kadam <sagar.kadam(a)sifive.com>
riscv: defconfig: enable gpio support for HiFive Unleashed
Sagar Shrikant Kadam <sagar.kadam(a)sifive.com>
dts: phy: add GPIO number and active state used for phy reset
Sagar Shrikant Kadam <sagar.kadam(a)sifive.com>
dts: phy: fix missing mdio device and probe failure of vsc8541-01 device
David Woodhouse <dwmw(a)amazon.co.uk>
x86/xen: Add xen_no_vector_callback option to test PCI INTX delivery
David Woodhouse <dwmw(a)amazon.co.uk>
xen: Fix event channel callback via INTX/GSI
Arnd Bergmann <arnd(a)arndb.de>
arm64: make atomic helpers __always_inline
Peter Geis <pgwipeout(a)gmail.com>
clk: tegra30: Add hda clock default rates to clock driver
Seth Miller <miller.seth(a)gmail.com>
HID: Ignore battery for Elan touchscreen on ASUS UX550
Filipe Laíns <lains(a)archlinux.org>
HID: logitech-dj: add the G602 receiver
Damien Le Moal <damien.lemoal(a)wdc.com>
riscv: Fix sifive serial driver
Damien Le Moal <damien.lemoal(a)wdc.com>
riscv: Fix kernel time_init()
Ewan D. Milne <emilne(a)redhat.com>
scsi: sd: Suppress spurious errors when WRITE SAME is being disabled
Nilesh Javali <njavali(a)marvell.com>
scsi: qedi: Correct max length of CHAP secret
Can Guo <cang(a)codeaurora.org>
scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
Anthony Iliopoulos <ailiop(a)suse.com>
dm integrity: select CRYPTO_SKCIPHER
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device
Cezary Rojewski <cezary.rojewski(a)intel.com>
ASoC: Intel: haswell: Add missing pm_ops
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915/gt: Prevent use of engine->wa_ctx after error
Daniel Vetter <daniel.vetter(a)ffwll.ch>
drm/syncobj: Fix use-after-free
Pan Bian <bianpan2016(a)163.com>
drm/atomic: put state on error path
Mikulas Patocka <mpatocka(a)redhat.com>
dm integrity: fix a crash if "recalculate" used without "internal_hash"
Hannes Reinecke <hare(a)suse.de>
dm: avoid filesystem lookup in dm_get_dev_t()
Alex Leibovich <alexl(a)marvell.com>
mmc: sdhci-xenon: fix 1.8v regulator stabilization
Peter Collingbourne <pcc(a)google.com>
mmc: core: don't initialize block size from ext_csd if not present
Filipe Manana <fdmanana(a)suse.com>
btrfs: send: fix invalid clone operations when cloning from the same file and root
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't clear ret in btrfs_start_dirty_block_groups
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix lockdep splat in btrfs_recover_relocation
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't get an EINTR during drop_snapshot for reloc
Hans de Goede <hdegoede(a)redhat.com>
ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/via: Add minimum mute flag
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
Jiaxun Yang <jiaxun.yang(a)flygoat.com>
platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
platform/x86: i2c-multi-instantiate: Don't create platform device for INT3515 ACPI nodes
Mikko Perttunen <mperttunen(a)nvidia.com>
i2c: bpmp-tegra: Ignore unknown I2C_M flags
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 4 ++
Makefile | 4 +-
arch/arm/xen/enlighten.c | 2 +-
arch/arm64/include/asm/atomic.h | 10 +--
arch/powerpc/kernel/vmlinux.lds.S | 25 +++----
.../riscv/boot/dts/sifive/hifive-unleashed-a00.dts | 2 +
arch/riscv/configs/defconfig | 2 +
arch/riscv/kernel/time.c | 3 +
arch/sh/drivers/dma/Kconfig | 3 +-
arch/x86/include/asm/fpu/api.h | 15 +++-
arch/x86/include/asm/topology.h | 4 +-
arch/x86/kernel/cpu/amd.c | 4 +-
arch/x86/kernel/cpu/topology.c | 2 +-
arch/x86/kernel/fpu/core.c | 9 +--
arch/x86/lib/mmx_32.c | 20 ++++--
arch/x86/xen/enlighten_hvm.c | 11 ++-
drivers/acpi/scan.c | 2 +
drivers/base/core.c | 17 ++++-
drivers/clk/tegra/clk-tegra30.c | 2 +
drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h | 2 +-
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 2 +-
drivers/gpu/drm/drm_atomic_helper.c | 2 +-
drivers/gpu/drm/drm_syncobj.c | 8 ++-
drivers/gpu/drm/i915/gt/intel_lrc.c | 3 +
drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +-
drivers/gpu/drm/nouveau/dispnv50/disp.h | 2 +-
drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 8 +--
drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c | 10 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c | 10 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c | 6 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 2 +
drivers/hid/hid-logitech-dj.c | 4 ++
drivers/hid/hid-multitouch.c | 4 ++
drivers/hwtracing/intel_th/pci.c | 5 ++
drivers/hwtracing/stm/heartbeat.c | 6 +-
drivers/i2c/busses/i2c-octeon-core.c | 2 +-
drivers/i2c/busses/i2c-tegra-bpmp.c | 2 +-
drivers/iio/dac/ad5504.c | 4 +-
drivers/irqchip/irq-mips-cpu.c | 7 ++
drivers/lightnvm/core.c | 3 +-
drivers/md/Kconfig | 1 +
drivers/md/dm-integrity.c | 6 ++
drivers/md/dm-table.c | 15 +++-
drivers/mmc/core/queue.c | 4 +-
drivers/mmc/host/sdhci-xenon.c | 7 +-
drivers/net/can/dev.c | 4 +-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 +--
drivers/net/can/vxcan.c | 6 +-
drivers/net/dsa/b53/b53_common.c | 2 +-
drivers/net/dsa/mv88e6xxx/global1_vtu.c | 4 ++
drivers/net/ethernet/mscc/ocelot.c | 4 +-
drivers/net/ethernet/renesas/sh_eth.c | 4 +-
drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 2 +-
drivers/pinctrl/pinctrl-ingenic.c | 24 +++----
drivers/platform/x86/i2c-multi-instantiate.c | 31 ++++++---
drivers/platform/x86/ideapad-laptop.c | 15 +++-
drivers/platform/x86/intel-vbtn.c | 6 --
drivers/scsi/megaraid/megaraid_sas_base.c | 6 +-
drivers/scsi/qedi/qedi_main.c | 4 +-
drivers/scsi/sd.c | 4 +-
drivers/scsi/ufs/ufshcd.c | 11 ++-
drivers/tty/serial/mvebu-uart.c | 10 ++-
drivers/tty/serial/sifive.c | 1 +
drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 +-
drivers/usb/gadget/udc/bdc/Kconfig | 2 +-
drivers/usb/gadget/udc/core.c | 13 +++-
drivers/usb/host/ehci-hcd.c | 12 ++++
drivers/usb/host/ehci-hub.c | 3 +
drivers/usb/host/xhci-ring.c | 2 +
drivers/usb/host/xhci-tegra.c | 7 ++
drivers/xen/events/events_base.c | 10 ---
drivers/xen/platform-pci.c | 1 -
drivers/xen/xenbus/xenbus.h | 1 +
drivers/xen/xenbus/xenbus_comms.c | 8 ---
drivers/xen/xenbus/xenbus_probe.c | 81 ++++++++++++++++++----
fs/btrfs/block-group.c | 3 +-
fs/btrfs/extent-tree.c | 10 ++-
fs/btrfs/send.c | 15 ++++
fs/btrfs/volumes.c | 2 +
fs/cifs/transport.c | 4 +-
include/asm-generic/bitops/atomic.h | 6 +-
include/net/inet_connection_sock.h | 3 +
include/xen/xenbus.h | 2 +-
mm/kasan/init.c | 23 +++---
net/core/dev.c | 5 ++
net/core/skbuff.c | 6 +-
net/ipv4/inet_connection_sock.c | 1 +
net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
net/ipv4/tcp.c | 1 +
net/ipv4/tcp_input.c | 1 +
net/ipv4/tcp_ipv4.c | 25 +++----
net/ipv4/tcp_output.c | 1 +
net/ipv4/tcp_timer.c | 14 ++--
net/ipv4/udp.c | 3 +-
net/ipv6/addrconf.c | 3 +-
net/sched/cls_tcindex.c | 8 ++-
net/sched/sch_api.c | 3 +-
sound/core/seq/oss/seq_oss_synth.c | 3 +-
sound/pci/hda/patch_via.c | 1 +
sound/soc/intel/boards/haswell.c | 1 +
tools/testing/selftests/net/fib_tests.sh | 1 -
104 files changed, 490 insertions(+), 223 deletions(-)
The recent commit to fix a memory leak introduced an inadvertant NULL
pointer dereference. The `wacom_wac->pen_fifo` variable was never
intialized, resuling in a crash whenever functions tried to use it.
Since the FIFO is only used by AES pens (to buffer events from pen
proximity until the hardware reports the pen serial number) this would
have been easily overlooked without testing an AES device.
This patch converts `wacom_wac->pen_fifo` over to a pointer (since the
call to `devres_alloc` allocates memory for us) and ensures that we assign
it to point to the allocated and initalized `pen_fifo` before the function
returns.
Link: https://github.com/linuxwacom/input-wacom/issues/230
Fixes: 37309f47e2f5 ("HID: wacom: Fix memory leakage caused by kfifo_alloc")
CC: stable(a)vger.kernel.org # v4.19+
Signed-off-by: Jason Gerecke <jason.gerecke(a)wacom.com>
Tested-by: Ping Cheng <ping.cheng(a)wacom.com>
---
drivers/hid/wacom_sys.c | 7 ++++---
drivers/hid/wacom_wac.h | 2 +-
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index e8acd235db2a..aa9e48876ced 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -147,9 +147,9 @@ static int wacom_wac_pen_serial_enforce(struct hid_device *hdev,
}
if (flush)
- wacom_wac_queue_flush(hdev, &wacom_wac->pen_fifo);
+ wacom_wac_queue_flush(hdev, wacom_wac->pen_fifo);
else if (insert)
- wacom_wac_queue_insert(hdev, &wacom_wac->pen_fifo,
+ wacom_wac_queue_insert(hdev, wacom_wac->pen_fifo,
raw_data, report_size);
return insert && !flush;
@@ -1280,7 +1280,7 @@ static void wacom_devm_kfifo_release(struct device *dev, void *res)
static int wacom_devm_kfifo_alloc(struct wacom *wacom)
{
struct wacom_wac *wacom_wac = &wacom->wacom_wac;
- struct kfifo_rec_ptr_2 *pen_fifo = &wacom_wac->pen_fifo;
+ struct kfifo_rec_ptr_2 *pen_fifo;
int error;
pen_fifo = devres_alloc(wacom_devm_kfifo_release,
@@ -1297,6 +1297,7 @@ static int wacom_devm_kfifo_alloc(struct wacom *wacom)
}
devres_add(&wacom->hdev->dev, pen_fifo);
+ wacom_wac->pen_fifo = pen_fifo;
return 0;
}
diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
index da612b6e9c77..195910dd2154 100644
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -342,7 +342,7 @@ struct wacom_wac {
struct input_dev *pen_input;
struct input_dev *touch_input;
struct input_dev *pad_input;
- struct kfifo_rec_ptr_2 pen_fifo;
+ struct kfifo_rec_ptr_2 *pen_fifo;
int pid;
int num_contacts_left;
u8 bt_features;
--
2.30.0
This is the start of the stable review cycle for the 5.4.93 release.
There are 86 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 27 Jan 2021 18:31:44 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.93-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.93-rc1
Enke Chen <enchen(a)paloaltonetworks.com>
tcp: fix TCP_USER_TIMEOUT with zero window
Eric Dumazet <edumazet(a)google.com>
tcp: do not mess with cloned skbs in tcp_add_backlog()
Dan Carpenter <dan.carpenter(a)oracle.com>
net: dsa: b53: fix an off by one in checking "vlan->vid"
Tariq Toukan <tariqt(a)nvidia.com>
net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: allow offloading of bridge on top of LAG
Matteo Croce <mcroce(a)microsoft.com>
ipv6: set multicast flag on the multicast route
Eric Dumazet <edumazet(a)google.com>
net_sched: reject silly cell_log in qdisc_get_rtab()
Eric Dumazet <edumazet(a)google.com>
net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
Matteo Croce <mcroce(a)microsoft.com>
ipv6: create multicast route with RTPROT_KERNEL
Guillaume Nault <gnault(a)redhat.com>
udp: mask TOS bits in udp_v4_early_demux()
Lecopzer Chen <lecopzer(a)gmail.com>
kasan: fix incorrect arguments passing in kasan_add_zero_shadow
Lecopzer Chen <lecopzer(a)gmail.com>
kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow
Alexander Lobakin <alobakin(a)pm.me>
skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
Pan Bian <bianpan2016(a)163.com>
lightnvm: fix memory leak when submit fails
Geert Uytterhoeven <geert+renesas(a)glider.be>
sh_eth: Fix power down vs. is_opened flag ordering
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext
Necip Fazil Yildiran <fazilyildiran(a)gmail.com>
sh: dma: fix kconfig dependency for G2_DMA
Guillaume Nault <gnault(a)redhat.com>
netfilter: rpfilter: mask ecn bits before fib lookup
Yazen Ghannam <Yazen.Ghannam(a)amd.com>
x86/cpu/amd: Set __max_die_per_package on AMD
Paul Cercueil <paul(a)crapouillou.net>
pinctrl: ingenic: Fix JZ4760 support
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
driver core: Extend device_is_dependent()
JC Kuo <jckuo(a)nvidia.com>
xhci: tegra: Delay for disabling LFPS detector
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: make sure TRB is fully written before giving it to the controller
Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com>
usb: bdc: Make bdc pci driver depend on BROKEN
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: udc: core: Use lock when write to soft_connect
Ryan Chen <ryan_chen(a)aspeedtech.com>
usb: gadget: aspeed: fix stop dma register setting.
Longfang Liu <liulongfang(a)huawei.com>
USB: ehci: fix an interrupt calltrace error
Eugene Korenevsky <ekorenevsky(a)astralinux.ru>
ehci: fix EHCI host controller initialization sequence
Pali Rohár <pali(a)kernel.org>
serial: mvebu-uart: fix tx lost characters at power off
Wang Hui <john.wanghui(a)huawei.com>
stm class: Fix module init return on allocation failure
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add Alder Lake-P support
Andy Lutomirski <luto(a)kernel.org>
x86/mmx: Use KFPU_387 for MMX string operations
Mathias Kresin <dev(a)kresin.me>
irqchip/mips-cpu: Set IPI domain parent chip
Ronnie Sahlberg <lsahlber(a)redhat.com>
cifs: do not fail __smb_send_rqst if non-fatal signals are pending
Lars-Peter Clausen <lars(a)metafoo.de>
iio: ad5504: Fix setting power-down state
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: peak_usb: fix use after free bugs
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: vxcan: vxcan_xmit: fix use after free bug
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: dev: can_restart: fix use after free bug
Hangbin Liu <liuhangbin(a)gmail.com>
selftests: net: fib_tests: remove duplicate log test
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: octeon: check correct size of maximum RECV_LEN packet
Ariel Marcovitch <arielmarcovitch(a)gmail.com>
powerpc: Fix alignment bug within the init sections
Arnd Bergmann <arnd(a)arndb.de>
scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression
Billy Tsai <billy_tsai(a)aspeedtech.com>
pinctrl: aspeed: g6: Fix PWMG0 pinctrl setting
Youling Tang <tangyouling(a)loongson.cn>
powerpc: Use the common INIT_DATA_SECTION macro in vmlinux.lds.S
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/mmu: fix vram heap sizing
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/privring: ack interrupts the same way as RM
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/bios: fix issue shadowing expansion ROMs
Wayne Lin <Wayne.Lin(a)amd.com>
drm/amd/display: Fix to be able to stop crc calculation
Victor Zhao <Victor.Zhao(a)amd.com>
drm/amdgpu/psp: fix psp gfx ctrl cmds
Sagar Shrikant Kadam <sagar.kadam(a)sifive.com>
riscv: defconfig: enable gpio support for HiFive Unleashed
Sagar Shrikant Kadam <sagar.kadam(a)sifive.com>
dts: phy: add GPIO number and active state used for phy reset
Sagar Shrikant Kadam <sagar.kadam(a)sifive.com>
dts: phy: fix missing mdio device and probe failure of vsc8541-01 device
David Woodhouse <dwmw(a)amazon.co.uk>
x86/xen: Add xen_no_vector_callback option to test PCI INTX delivery
David Woodhouse <dwmw(a)amazon.co.uk>
xen: Fix event channel callback via INTX/GSI
Arnd Bergmann <arnd(a)arndb.de>
arm64: make atomic helpers __always_inline
Peter Geis <pgwipeout(a)gmail.com>
clk: tegra30: Add hda clock default rates to clock driver
Seth Miller <miller.seth(a)gmail.com>
HID: Ignore battery for Elan touchscreen on ASUS UX550
Filipe Laíns <lains(a)archlinux.org>
HID: logitech-dj: add the G602 receiver
Damien Le Moal <damien.lemoal(a)wdc.com>
riscv: Fix sifive serial driver
Damien Le Moal <damien.lemoal(a)wdc.com>
riscv: Fix kernel time_init()
Ewan D. Milne <emilne(a)redhat.com>
scsi: sd: Suppress spurious errors when WRITE SAME is being disabled
Nilesh Javali <njavali(a)marvell.com>
scsi: qedi: Correct max length of CHAP secret
Can Guo <cang(a)codeaurora.org>
scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
Anthony Iliopoulos <ailiop(a)suse.com>
dm integrity: select CRYPTO_SKCIPHER
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device
Cezary Rojewski <cezary.rojewski(a)intel.com>
ASoC: Intel: haswell: Add missing pm_ops
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915/gt: Prevent use of engine->wa_ctx after error
Daniel Vetter <daniel.vetter(a)ffwll.ch>
drm/syncobj: Fix use-after-free
Pan Bian <bianpan2016(a)163.com>
drm/atomic: put state on error path
Mikulas Patocka <mpatocka(a)redhat.com>
dm integrity: fix a crash if "recalculate" used without "internal_hash"
Hannes Reinecke <hare(a)suse.de>
dm: avoid filesystem lookup in dm_get_dev_t()
Alex Leibovich <alexl(a)marvell.com>
mmc: sdhci-xenon: fix 1.8v regulator stabilization
Peter Collingbourne <pcc(a)google.com>
mmc: core: don't initialize block size from ext_csd if not present
Filipe Manana <fdmanana(a)suse.com>
btrfs: send: fix invalid clone operations when cloning from the same file and root
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't clear ret in btrfs_start_dirty_block_groups
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix lockdep splat in btrfs_recover_relocation
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't get an EINTR during drop_snapshot for reloc
Hans de Goede <hdegoede(a)redhat.com>
ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/via: Add minimum mute flag
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
Jiaxun Yang <jiaxun.yang(a)flygoat.com>
platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
platform/x86: i2c-multi-instantiate: Don't create platform device for INT3515 ACPI nodes
Mikko Perttunen <mperttunen(a)nvidia.com>
i2c: bpmp-tegra: Ignore unknown I2C_M flags
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 4 ++
Makefile | 4 +-
arch/arm/xen/enlighten.c | 2 +-
arch/arm64/include/asm/atomic.h | 10 +--
arch/powerpc/kernel/vmlinux.lds.S | 25 +++----
.../riscv/boot/dts/sifive/hifive-unleashed-a00.dts | 2 +
arch/riscv/configs/defconfig | 2 +
arch/riscv/kernel/time.c | 3 +
arch/sh/drivers/dma/Kconfig | 3 +-
arch/x86/kernel/cpu/amd.c | 4 +-
arch/x86/lib/mmx_32.c | 20 ++++--
arch/x86/xen/enlighten_hvm.c | 11 ++-
drivers/acpi/scan.c | 2 +
drivers/base/core.c | 17 ++++-
drivers/clk/tegra/clk-tegra30.c | 2 +
drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h | 2 +-
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 2 +-
drivers/gpu/drm/drm_atomic_helper.c | 2 +-
drivers/gpu/drm/drm_syncobj.c | 8 ++-
drivers/gpu/drm/i915/gt/intel_lrc.c | 3 +
drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +-
drivers/gpu/drm/nouveau/dispnv50/disp.h | 2 +-
drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 8 +--
drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c | 10 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c | 10 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c | 6 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 2 +
drivers/hid/hid-logitech-dj.c | 4 ++
drivers/hid/hid-multitouch.c | 4 ++
drivers/hwtracing/intel_th/pci.c | 5 ++
drivers/hwtracing/stm/heartbeat.c | 6 +-
drivers/i2c/busses/i2c-octeon-core.c | 2 +-
drivers/i2c/busses/i2c-tegra-bpmp.c | 2 +-
drivers/iio/dac/ad5504.c | 4 +-
drivers/irqchip/irq-mips-cpu.c | 7 ++
drivers/lightnvm/core.c | 3 +-
drivers/md/Kconfig | 1 +
drivers/md/dm-integrity.c | 6 ++
drivers/md/dm-table.c | 15 +++-
drivers/mmc/core/queue.c | 4 +-
drivers/mmc/host/sdhci-xenon.c | 7 +-
drivers/net/can/dev.c | 4 +-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 +--
drivers/net/can/vxcan.c | 6 +-
drivers/net/dsa/b53/b53_common.c | 2 +-
drivers/net/dsa/mv88e6xxx/global1_vtu.c | 4 ++
drivers/net/ethernet/mscc/ocelot.c | 4 +-
drivers/net/ethernet/renesas/sh_eth.c | 4 +-
drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 2 +-
drivers/pinctrl/pinctrl-ingenic.c | 24 +++----
drivers/platform/x86/i2c-multi-instantiate.c | 31 ++++++---
drivers/platform/x86/ideapad-laptop.c | 15 +++-
drivers/platform/x86/intel-vbtn.c | 6 --
drivers/scsi/megaraid/megaraid_sas_base.c | 6 +-
drivers/scsi/qedi/qedi_main.c | 4 +-
drivers/scsi/sd.c | 4 +-
drivers/scsi/ufs/ufshcd.c | 11 ++-
drivers/tty/serial/mvebu-uart.c | 10 ++-
drivers/tty/serial/sifive.c | 1 +
drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 +-
drivers/usb/gadget/udc/bdc/Kconfig | 2 +-
drivers/usb/gadget/udc/core.c | 13 +++-
drivers/usb/host/ehci-hcd.c | 12 ++++
drivers/usb/host/ehci-hub.c | 3 +
drivers/usb/host/xhci-ring.c | 2 +
drivers/usb/host/xhci-tegra.c | 7 ++
drivers/xen/events/events_base.c | 10 ---
drivers/xen/platform-pci.c | 1 -
drivers/xen/xenbus/xenbus.h | 1 +
drivers/xen/xenbus/xenbus_comms.c | 8 ---
drivers/xen/xenbus/xenbus_probe.c | 81 ++++++++++++++++++----
fs/btrfs/block-group.c | 3 +-
fs/btrfs/extent-tree.c | 10 ++-
fs/btrfs/send.c | 15 ++++
fs/btrfs/volumes.c | 2 +
fs/cifs/transport.c | 4 +-
include/asm-generic/bitops/atomic.h | 6 +-
include/net/inet_connection_sock.h | 3 +
include/xen/xenbus.h | 2 +-
mm/kasan/init.c | 23 +++---
net/core/dev.c | 5 ++
net/core/skbuff.c | 6 +-
net/ipv4/inet_connection_sock.c | 1 +
net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
net/ipv4/tcp.c | 1 +
net/ipv4/tcp_input.c | 1 +
net/ipv4/tcp_ipv4.c | 25 +++----
net/ipv4/tcp_output.c | 1 +
net/ipv4/tcp_timer.c | 14 ++--
net/ipv4/udp.c | 3 +-
net/ipv6/addrconf.c | 3 +-
net/sched/cls_tcindex.c | 8 ++-
net/sched/sch_api.c | 3 +-
sound/core/seq/oss/seq_oss_synth.c | 3 +-
sound/pci/hda/patch_via.c | 1 +
sound/soc/intel/boards/haswell.c | 1 +
tools/testing/selftests/net/fib_tests.sh | 1 -
100 files changed, 469 insertions(+), 214 deletions(-)
The VM_BUG_ON_PAGE avoids the generation of any code, even if that
expression has side-effects when !CONFIG_DEBUG_VM.
Fixes: e5dfacebe4a4 ("mm/hugetlb.c: just use put_page_testzero() instead of page_count()")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Cc: <stable(a)vger.kernel.org>
---
mm/hugetlb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a6bad1f686c5..082ed643020b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2047,13 +2047,16 @@ static int gather_surplus_pages(struct hstate *h, long delta)
/* Free the needed pages to the hugetlb pool */
list_for_each_entry_safe(page, tmp, &surplus_list, lru) {
+ int zeroed;
+
if ((--needed) < 0)
break;
/*
* This page is now managed by the hugetlb allocator and has
* no users -- drop the buddy allocator's reference.
*/
- VM_BUG_ON_PAGE(!put_page_testzero(page), page);
+ zeroed = put_page_testzero(page);
+ VM_BUG_ON_PAGE(!zeroed, page);
enqueue_huge_page(h, page);
}
free:
--
2.11.0
The patch titled
Subject: mm: memcontrol: prevent starvation when writing memory.high
has been removed from the -mm tree. Its filename was
mm-memcontrol-prevent-starvation-when-writing-memoryhigh.patch
This patch was dropped because an alternative patch was merged
------------------------------------------------------
From: Johannes Weiner <hannes(a)cmpxchg.org>
Subject: mm: memcontrol: prevent starvation when writing memory.high
When a value is written to a cgroup's memory.high control file, the
write() context first tries to reclaim the cgroup to size before putting
the limit in place for the workload. Concurrent charges from the workload
can keep such a write() looping in reclaim indefinitely.
In the past, a write to memory.high would first put the limit in place for
the workload, then do targeted reclaim until the new limit has been met -
similar to how we do it for memory.max. This wasn't prone to the
described starvation issue. However, this sequence could cause excessive
latencies in the workload, when allocating threads could be put into long
penalty sleeps on the sudden memory.high overage created by the write(),
before that had a chance to work it off.
Now that memory_high_write() performs reclaim before enforcing the new
limit, reflect that the cgroup may well fail to converge due to concurrent
workload activity. Bail out of the loop after a few tries.
Link: https://lkml.kernel.org/r/20210112163011.127833-1-hannes@cmpxchg.org
Fixes: 536d3bf261a2 ("mm: memcontrol: avoid workload stalls when lowering memory.high")
Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reviewed-by: Shakeel Butt <shakeelb(a)google.com>
Reported-by: Tejun Heo <tj(a)kernel.org>
Acked-by: Roman Gushchin <guro(a)fb.com>
Reviewed-by: Michal Koutný <mkoutny(a)suse.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: <stable(a)vger.kernel.org> [5.8+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/mm/memcontrol.c~mm-memcontrol-prevent-starvation-when-writing-memoryhigh
+++ a/mm/memcontrol.c
@@ -6273,7 +6273,6 @@ static ssize_t memory_high_write(struct
for (;;) {
unsigned long nr_pages = page_counter_read(&memcg->memory);
- unsigned long reclaimed;
if (nr_pages <= high)
break;
@@ -6287,10 +6286,10 @@ static ssize_t memory_high_write(struct
continue;
}
- reclaimed = try_to_free_mem_cgroup_pages(memcg, nr_pages - high,
- GFP_KERNEL, true);
+ try_to_free_mem_cgroup_pages(memcg, nr_pages - high,
+ GFP_KERNEL, true);
- if (!reclaimed && !nr_retries--)
+ if (!nr_retries--)
break;
}
_
Patches currently in -mm which might be from hannes(a)cmpxchg.org are
revert-mm-memcontrol-avoid-workload-stalls-when-lowering-memoryhigh.patch
Dear stable maintainers,
Please consider cherry-picking c8a950d0d3b9 ("tools: Factor HOSTCC,
HOSTLD, HOSTAR definitions") to 5.10, 5.4 and 4.19. It fixes a problem
where the host tools set by the user could be ignored for
'prepare-objtool', and is needed on x86 to enable the ORC unwinder,
dynamic ftrace, etc. with LLVM=1 and a 'hermetic' toolchain
environment.
On 5.10.10 it cherry-picks cleanly. On 5.4.92 and 4.19.170 it
cherry-picks cleanly, besides 'tools/bpf/resolve_btfids/Makefile'
which was introduced after 5.8-rc2. (This file can be ignored.)
Thanks!
Hello stable,
The following printk patches fixing a buffer overflow potential in 5.10
are now available in Linus' tree:
f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 ("printk: fix buffer overflow
potential for print_text()")
08d60e5999540110576e7c1346d486220751b7f9 ("printk: fix string
termination for record_print_text()")
The first one (f0e386ee0c0b) was already queued up for 5.10-stable but I
requested it not be applied until this second one was accepted. Now they
are both accepted and both should be applied. Thanks.
John Ogness