So I made a mess of it. Sent a pull before making sure it works on 32
bit too. Hope it's not too late to revert. Will teach me to be way more
careful in the near future.
The following changes since commit 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4:
vhost: make sure log_num < in_num (2019-09-11 15:15:26 -0400)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus
for you to fetch changes up to 0d4a3f2abbef73b9e5bb5f12213c275565473588:
Revert "vhost: block speculation of translated descriptors" (2019-09-14 15:21:51 -0400)
----------------------------------------------------------------
virtio: a last minute revert
32 bit build got broken by the latest defence in depth patch.
Revert and we'll try again in the next cycle.
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
----------------------------------------------------------------
Michael S. Tsirkin (1):
Revert "vhost: block speculation of translated descriptors"
drivers/vhost/vhost.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
On the ThinkPad P71, we have one eDP connector exposed along with 5 DP
connectors, resulting in a total of 11 TMDS encoders. Since the GPU on
this system is also capable of MST, we create an additional 4 fake MST
encoders for each DP port. Unfortunately, we also do this for the eDP
port as well, resulting in:
1 eDP port: +1 TMDS encoder
+4 DPMST encoders
5 DP ports: +2 TMDS encoders
+4 DPMST encoders
*5 ports
== 35 encoders
Which breaks things, since DRM has a hard coded limit of 32 encoders.
So, fix this by not creating MSTMs for any eDP connectors. This brings
us down to 31 encoders, although we can do better.
This fixes driver probing for nouveau on the ThinkPad P71.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/nouveau/dispnv50/disp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 307584107d77..b46be8a091e9 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -1603,7 +1603,8 @@ nv50_sor_create(struct drm_connector *connector, struct dcb_output *dcbe)
nv_encoder->aux = aux;
}
- if ((data = nvbios_dp_table(bios, &ver, &hdr, &cnt, &len)) &&
+ if (nv_connector->type != DCB_CONNECTOR_eDP &&
+ (data = nvbios_dp_table(bios, &ver, &hdr, &cnt, &len)) &&
ver >= 0x40 && (nvbios_rd08(bios, data + 0x08) & 0x04)) {
ret = nv50_mstm_new(nv_encoder, &nv_connector->aux, 16,
nv_connector->base.base.id,
--
2.21.0
[ Upstream commit aa53e3bfac7205fb3a8815ac1c937fd6ed01b41e ]
Nikolay reported the following KASAN splat when running btrfs/048:
[ 1843.470920] ==================================================================
[ 1843.471971] BUG: KASAN: slab-out-of-bounds in strncmp+0x66/0xb0
[ 1843.472775] Read of size 1 at addr ffff888111e369e2 by task btrfs/3979
[ 1843.473904] CPU: 3 PID: 3979 Comm: btrfs Not tainted 5.2.0-rc3-default #536
[ 1843.475009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 1843.476322] Call Trace:
[ 1843.476674] dump_stack+0x7c/0xbb
[ 1843.477132] ? strncmp+0x66/0xb0
[ 1843.477587] print_address_description+0x114/0x320
[ 1843.478256] ? strncmp+0x66/0xb0
[ 1843.478740] ? strncmp+0x66/0xb0
[ 1843.479185] __kasan_report+0x14e/0x192
[ 1843.479759] ? strncmp+0x66/0xb0
[ 1843.480209] kasan_report+0xe/0x20
[ 1843.480679] strncmp+0x66/0xb0
[ 1843.481105] prop_compression_validate+0x24/0x70
[ 1843.481798] btrfs_xattr_handler_set_prop+0x65/0x160
[ 1843.482509] __vfs_setxattr+0x71/0x90
[ 1843.483012] __vfs_setxattr_noperm+0x84/0x130
[ 1843.483606] vfs_setxattr+0xac/0xb0
[ 1843.484085] setxattr+0x18c/0x230
[ 1843.484546] ? vfs_setxattr+0xb0/0xb0
[ 1843.485048] ? __mod_node_page_state+0x1f/0xa0
[ 1843.485672] ? _raw_spin_unlock+0x24/0x40
[ 1843.486233] ? __handle_mm_fault+0x988/0x1290
[ 1843.486823] ? lock_acquire+0xb4/0x1e0
[ 1843.487330] ? lock_acquire+0xb4/0x1e0
[ 1843.487842] ? mnt_want_write_file+0x3c/0x80
[ 1843.488442] ? debug_lockdep_rcu_enabled+0x22/0x40
[ 1843.489089] ? rcu_sync_lockdep_assert+0xe/0x70
[ 1843.489707] ? __sb_start_write+0x158/0x200
[ 1843.490278] ? mnt_want_write_file+0x3c/0x80
[ 1843.490855] ? __mnt_want_write+0x98/0xe0
[ 1843.491397] __x64_sys_fsetxattr+0xba/0xe0
[ 1843.492201] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 1843.493201] do_syscall_64+0x6c/0x230
[ 1843.493988] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1843.495041] RIP: 0033:0x7fa7a8a7707a
[ 1843.495819] Code: 48 8b 0d 21 de 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 be 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ee dd 2b 00 f7 d8 64 89 01 48
[ 1843.499203] RSP: 002b:00007ffcb73bca38 EFLAGS: 00000202 ORIG_RAX: 00000000000000be
[ 1843.500210] RAX: ffffffffffffffda RBX: 00007ffcb73bda9d RCX: 00007fa7a8a7707a
[ 1843.501170] RDX: 00007ffcb73bda9d RSI: 00000000006dc050 RDI: 0000000000000003
[ 1843.502152] RBP: 00000000006dc050 R08: 0000000000000000 R09: 0000000000000000
[ 1843.503109] R10: 0000000000000002 R11: 0000000000000202 R12: 00007ffcb73bda91
[ 1843.504055] R13: 0000000000000003 R14: 00007ffcb73bda82 R15: ffffffffffffffff
[ 1843.505268] Allocated by task 3979:
[ 1843.505771] save_stack+0x19/0x80
[ 1843.506211] __kasan_kmalloc.constprop.5+0xa0/0xd0
[ 1843.506836] setxattr+0xeb/0x230
[ 1843.507264] __x64_sys_fsetxattr+0xba/0xe0
[ 1843.507886] do_syscall_64+0x6c/0x230
[ 1843.508429] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1843.509558] Freed by task 0:
[ 1843.510188] (stack is not available)
[ 1843.511309] The buggy address belongs to the object at ffff888111e369e0
which belongs to the cache kmalloc-8 of size 8
[ 1843.514095] The buggy address is located 2 bytes inside of
8-byte region [ffff888111e369e0, ffff888111e369e8)
[ 1843.516524] The buggy address belongs to the page:
[ 1843.517561] page:ffff88813f478d80 refcount:1 mapcount:0 mapping:ffff88811940c300 index:0xffff888111e373b8 compound_mapcount: 0
[ 1843.519993] flags: 0x4404000010200(slab|head)
[ 1843.520951] raw: 0004404000010200 ffff88813f48b008 ffff888119403d50 ffff88811940c300
[ 1843.522616] raw: ffff888111e373b8 000000000016000f 00000001ffffffff 0000000000000000
[ 1843.524281] page dumped because: kasan: bad access detected
[ 1843.525936] Memory state around the buggy address:
[ 1843.526975] ffff888111e36880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1843.528479] ffff888111e36900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1843.530138] >ffff888111e36980: fc fc fc fc fc fc fc fc fc fc fc fc 02 fc fc fc
[ 1843.531877] ^
[ 1843.533287] ffff888111e36a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1843.534874] ffff888111e36a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1843.536468] ==================================================================
This is caused by supplying a too short compression value ('lz') in the
test-case and comparing it to 'lzo' with strncmp() and a length of 3.
strncmp() read past the 'lz' when looking for the 'o' and thus caused an
out-of-bounds read.
Introduce a new check 'btrfs_compress_is_valid_type()' which not only
checks the user-supplied value against known compression types, but also
employs checks for too short values.
Reported-by: Nikolay Borisov <nborisov(a)suse.com>
Fixes: 272e5326c783 ("btrfs: prop: fix vanished compression property after failed set")
CC: stable(a)vger.kernel.org # 5.1+
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Johannes Thumshirn <jthumshirn(a)suse.de>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
---
fs/btrfs/compression.c | 16 ++++++++++++++++
fs/btrfs/compression.h | 1 +
fs/btrfs/props.c | 6 +-----
3 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 9bfa66592aa7..c71e534ca7ef 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -42,6 +42,22 @@ const char* btrfs_compress_type2str(enum btrfs_compression_type type)
return NULL;
}
+bool btrfs_compress_is_valid_type(const char *str, size_t len)
+{
+ int i;
+
+ for (i = 1; i < ARRAY_SIZE(btrfs_compress_types); i++) {
+ size_t comp_len = strlen(btrfs_compress_types[i]);
+
+ if (len < comp_len)
+ continue;
+
+ if (!strncmp(btrfs_compress_types[i], str, comp_len))
+ return true;
+ }
+ return false;
+}
+
static int btrfs_decompress_bio(struct compressed_bio *cb);
static inline int compressed_bio_size(struct btrfs_fs_info *fs_info,
diff --git a/fs/btrfs/compression.h b/fs/btrfs/compression.h
index ddda9b80bf20..f97d90a1fa53 100644
--- a/fs/btrfs/compression.h
+++ b/fs/btrfs/compression.h
@@ -127,6 +127,7 @@ extern const struct btrfs_compress_op btrfs_lzo_compress;
extern const struct btrfs_compress_op btrfs_zstd_compress;
const char* btrfs_compress_type2str(enum btrfs_compression_type type);
+bool btrfs_compress_is_valid_type(const char *str, size_t len);
int btrfs_compress_heuristic(struct inode *inode, u64 start, u64 end);
diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c
index 61d22a56c0ba..6980a0e13f18 100644
--- a/fs/btrfs/props.c
+++ b/fs/btrfs/props.c
@@ -366,11 +366,7 @@ int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans,
static int prop_compression_validate(const char *value, size_t len)
{
- if (!strncmp("lzo", value, 3))
- return 0;
- else if (!strncmp("zlib", value, 4))
- return 0;
- else if (!strncmp("zstd", value, 4))
+ if (btrfs_compress_is_valid_type(value, len))
return 0;
return -EINVAL;
--
2.16.4
Hi,
please add the commit
18dfa7117a3f379862dcd3f67cadd678013bb9dd
Btrfs: fix unwritten extent buffers and hangs on future writeback attempts
to the 5.2.x tree. It fixes a regression introduced in 5.2 with a big
user impact.
Thanks.
On Fri, Sep 13, 2019 at 12:09 AM Thomas Hellström (VMware)
<thomas_os(a)shipmail.org> wrote:
>
> From: Thomas Hellstrom <thellstrom(a)vmware.com>
>
> Commit 4daa4fba3a38 ("gpu: drm: ttm: Adding new return type vm_fault_t")
> broke TTM prefaulting. Since vmf_insert_mixed() typically always returns
> VM_FAULT_NOPAGE, prefaulting stops after the second PTE.
>
> Restore (almost) the original behaviour. Unfortunately we can no longer
> with the new vm_fault_t return type determine whether a prefaulting
> PTE insertion hit an already populated PTE, and terminate the insertion
> loop. Instead we continue with the pre-determined number of prefaults.
>
> Fixes: 4daa4fba3a38 ("gpu: drm: ttm: Adding new return type vm_fault_t")
> Cc: Souptick Joarder <jrdr.linux(a)gmail.com>
> Cc: Christian König <christian.koenig(a)amd.com>
> Signed-off-by: Thomas Hellstrom <thellstrom(a)vmware.com>
This commit merged into 4.19. Need to Cc stable.
Cc: stable(a)vger.kernel.org # v4.19+
> ---
> drivers/gpu/drm/ttm/ttm_bo_vm.c | 16 +++++++---------
> 1 file changed, 7 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> index 5a580adeb9d1..aa18e8a53727 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> @@ -290,15 +290,13 @@ vm_fault_t ttm_bo_vm_fault_reserved(struct vm_fault *vmf,
> else
> ret = vmf_insert_pfn(&cvma, address, pfn);
>
> - /*
> - * Somebody beat us to this PTE or prefaulting to
> - * an already populated PTE, or prefaulting error.
> - */
> -
> - if (unlikely((ret == VM_FAULT_NOPAGE && i > 0)))
> - break;
> - else if (unlikely(ret & VM_FAULT_ERROR))
> - goto out_io_unlock;
> + /* Never error on prefaulted PTEs */
> + if (unlikely((ret & VM_FAULT_ERROR))) {
> + if (i == 0)
> + goto out_io_unlock;
> + else
> + break;
> + }
>
> address += PAGE_SIZE;
> if (unlikely(++page_offset >= page_last))
> --
> 2.20.1
>
The tmio_mmc_host_probe() calls pm_runtime_set_active() to update the
runtime PM status of the device, as to make it reflect the current status
of the HW. This works fine for most cases, but unfortunate not for all.
Especially, there is a generic problem when the device has a genpd attached
and that genpd have the ->start|stop() callbacks assigned.
More precisely, if the driver calls pm_runtime_set_active() during
->probe(), genpd does not get to invoke the ->start() callback for it,
which means the HW isn't really fully powered on. Furthermore, in the next
phase, when the device becomes runtime suspended, genpd will invoke the
->stop() callback for it, potentially leading to usage count imbalance
problems, depending on what's implemented behind the callbacks of course.
To fix this problem, convert to call pm_runtime_get_sync() from
tmio_mmc_host_probe() rather than pm_runtime_set_active(). Additionally, to
avoid bumping usage counters and unnecessary re-initializing the HW the
first time the tmio driver's ->runtime_resume() callback is called,
introduce a state flag to keeping track of this.
Cc: stable(a)vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org>
---
drivers/mmc/host/tmio_mmc.h | 1 +
drivers/mmc/host/tmio_mmc_core.c | 9 ++++++++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h
index c5ba13fae399..2f0b092d6dcc 100644
--- a/drivers/mmc/host/tmio_mmc.h
+++ b/drivers/mmc/host/tmio_mmc.h
@@ -163,6 +163,7 @@ struct tmio_mmc_host {
unsigned long last_req_ts;
struct mutex ios_lock; /* protect set_ios() context */
bool native_hotplug;
+ bool runtime_synced;
bool sdio_irq_enabled;
/* Mandatory callback */
diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index 8b299c1f0069..32f9679ec42e 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -1248,20 +1248,22 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host)
/* See if we also get DMA */
tmio_mmc_request_dma(_host, pdata);
- pm_runtime_set_active(&pdev->dev);
pm_runtime_set_autosuspend_delay(&pdev->dev, 50);
pm_runtime_use_autosuspend(&pdev->dev);
pm_runtime_enable(&pdev->dev);
+ pm_runtime_get_sync(&pdev->dev);
ret = mmc_add_host(mmc);
if (ret)
goto remove_host;
dev_pm_qos_expose_latency_limit(&pdev->dev, 100);
+ pm_runtime_put(&pdev->dev);
return 0;
remove_host:
+ pm_runtime_put_noidle(&pdev->dev);
tmio_mmc_host_remove(_host);
return ret;
}
@@ -1330,6 +1332,11 @@ int tmio_mmc_host_runtime_resume(struct device *dev)
{
struct tmio_mmc_host *host = dev_get_drvdata(dev);
+ if (!host->runtime_synced) {
+ host->runtime_synced = true;
+ return 0;
+ }
+
tmio_mmc_clk_enable(host);
tmio_mmc_hw_reset(host->mmc);
--
2.17.1
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 997fee5473ce - Linux 5.2.14
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/161144
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 997fee5473ce - Linux 5.2.14
We grabbed the beac84a0a235 commit of the stable queue repository.
We then merged the patchset with `git am`:
gpio-pca953x-correct-type-of-reg_direction.patch
gpio-pca953x-use-pca953x_read_regs-instead-of-regmap_bulk_read.patch
alsa-hda-fix-potential-endless-loop-at-applying-quirks.patch
alsa-hda-realtek-fix-overridden-device-specific-initialization.patch
alsa-hda-realtek-add-quirk-for-hp-pavilion-15.patch
alsa-hda-realtek-enable-internal-speaker-headset-mic-of-asus-ux431fl.patch
alsa-hda-realtek-fix-the-problem-of-two-front-mics-on-a-thinkcentre.patch
sched-fair-don-t-assign-runtime-for-throttled-cfs_rq.patch
drm-vmwgfx-fix-double-free-in-vmw_recv_msg.patch
drm-nouveau-sec2-gp102-add-missing-module_firmwares.patch
vhost-test-fix-build-for-vhost-test.patch
vhost-test-fix-build-for-vhost-test-again.patch
powerpc-64e-drop-stale-call-to-smp_processor_id-which-hangs-smp-startup.patch
powerpc-tm-fix-fp-vmx-unavailable-exceptions-inside-a-transaction.patch
powerpc-tm-fix-restoring-fp-vmx-facility-incorrectly-on-interrupts.patch
batman-adv-fix-uninit-value-in-batadv_netlink_get_ifindex.patch
batman-adv-only-read-ogm-tvlv_len-after-buffer-len-check.patch
bcache-only-clear-btree_node_dirty-bit-when-it-is-se.patch
bcache-add-comments-for-mutex_lock-b-write_lock.patch
bcache-fix-race-in-btree_flush_write.patch
ib-rdmavt-add-new-completion-inline.patch
ib-rdmavt-qib-hfi1-convert-to-new-completion-api.patch
ib-hfi1-unreserve-a-flushed-opfn-request.patch
drm-i915-disable-sampler_state-prefetching-on-all-ge.patch
drm-i915-make-sure-cdclk-is-high-enough-for-dp-audio.patch
mmc-sdhci-sprd-fix-the-incorrect-soft-reset-operatio.patch
usb-chipidea-imx-add-imx7ulp-support.patch
usb-chipidea-imx-fix-eprobe_defer-support-during-dri.patch
virtio-s390-fix-race-on-airq_areas.patch
drm-i915-support-flags-in-whitlist-was.patch
drm-i915-support-whitelist-workarounds-on-all-engine.patch
drm-i915-whitelist-ps_-depth-invocation-_count.patch
drm-i915-add-whitelist-workarounds-for-icl.patch
drm-i915-icl-whitelist-ps_-depth-invocation-_count.patch
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ jvm test suite [2]
✅ AMTU (Abstract Machine Test Utility) [3]
✅ LTP: openposix test suite [4]
✅ Networking socket: fuzz [5]
✅ audit: audit testsuite test [6]
✅ httpd: mod_ssl smoke sanity [7]
✅ iotop: sanity [8]
✅ tuned: tune-processes-through-perf [9]
✅ Usex - version 1.9-29 [10]
✅ stress: stress-ng [11]
🚧 ✅ LTP lite [12]
🚧 ✅ ALSA PCM loopback test [13]
🚧 ✅ ALSA Control (mixer) Userspace Element test [14]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [15]
✅ storage: software RAID testing [16]
ppc64le:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [15]
✅ storage: software RAID testing [16]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ jvm test suite [2]
✅ AMTU (Abstract Machine Test Utility) [3]
✅ LTP: openposix test suite [4]
✅ Networking socket: fuzz [5]
✅ audit: audit testsuite test [6]
✅ httpd: mod_ssl smoke sanity [7]
✅ iotop: sanity [8]
✅ tuned: tune-processes-through-perf [9]
✅ Usex - version 1.9-29 [10]
🚧 ✅ LTP lite [12]
🚧 ✅ ALSA PCM loopback test [13]
🚧 ✅ ALSA Control (mixer) Userspace Element test [14]
s390x:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test [0]
⚡⚡⚡ Podman system integration test (as root) [1]
⚡⚡⚡ Podman system integration test (as user) [1]
⚡⚡⚡ jvm test suite [2]
⚡⚡⚡ LTP: openposix test suite [4]
⚡⚡⚡ audit: audit testsuite test [6]
⚡⚡⚡ httpd: mod_ssl smoke sanity [7]
⚡⚡⚡ iotop: sanity [8]
⚡⚡⚡ tuned: tune-processes-through-perf [9]
⚡⚡⚡ Usex - version 1.9-29 [10]
⚡⚡⚡ stress: stress-ng [11]
🚧 ⚡⚡⚡ LTP lite [12]
🚧 ⚡⚡⚡ ALSA PCM loopback test [13]
🚧 ⚡⚡⚡ ALSA Control (mixer) Userspace Element test [14]
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test [0]
⚡⚡⚡ selinux-policy: serge-testsuite [15]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [15]
✅ storage: software RAID testing [16]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ jvm test suite [2]
✅ AMTU (Abstract Machine Test Utility) [3]
✅ LTP: openposix test suite [4]
✅ Networking socket: fuzz [5]
✅ audit: audit testsuite test [6]
✅ httpd: mod_ssl smoke sanity [7]
✅ iotop: sanity [8]
✅ tuned: tune-processes-through-perf [9]
✅ pciutils: sanity smoke test [17]
✅ Usex - version 1.9-29 [10]
✅ stress: stress-ng [11]
🚧 ✅ LTP lite [12]
🚧 ✅ ALSA PCM loopback test [13]
🚧 ✅ ALSA Control (mixer) Userspace Element test [14]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/sound/aloop
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/sound/user-…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/swra…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Hello,
Syzkaller has triggered a WARNING in packet_set_ring when fuzzing a 4.4 kernel with the following stacktrace.
Call Trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0xc1/0x124 lib/dump_stack.c:51
panic+0x1a7/0x351 kernel/panic.c:115
warn_slowpath_common+0x12a/0x140 kernel/panic.c:463
warn_slowpath_fmt+0xb0/0xe0 kernel/panic.c:479
packet_set_ring+0x13ed/0x19c0 net/packet/af_packet.c:4104
packet_setsockopt+0x53e/0x21d0 net/packet/af_packet.c:3578
SYSC_setsockopt net/socket.c:1766 [inline]
SyS_setsockopt+0x15d/0x240 net/socket.c:1745
entry_SYSCALL_64_fastpath+0x12/0x72
Could the following patch be applied in v4.4.y? It is present in v4.9.y. Applying this patch could
allow the fuzzer to explore more codepaths.
* 6ae81ced3788 ("af_packet: tone down the Tx-ring unsupported spew.")
Thanks,
- Zubin
From: Coly Li <colyli(a)suse.de>
In bch_btree_cache_free() and btree_node_free(), BTREE_NODE_dirty is
always set no matter btree node is dirty or not. The code looks like
this,
if (btree_node_dirty(b))
btree_complete_write(b, btree_current_write(b));
clear_bit(BTREE_NODE_dirty, &b->flags);
Indeed if btree_node_dirty(b) returns false, it means BTREE_NODE_dirty
bit is cleared, then it is unnecessary to clear the bit again.
This patch only clears BTREE_NODE_dirty when btree_node_dirty(b) is
true (the bit is set), to save a few CPU cycles.
Signed-off-by: Coly Li <colyli(a)suse.de>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
---
drivers/md/bcache/btree.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 773f5fdad25fb..3fbadf2058a65 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -778,10 +778,10 @@ void bch_btree_cache_free(struct cache_set *c)
while (!list_empty(&c->btree_cache)) {
b = list_first_entry(&c->btree_cache, struct btree, list);
- if (btree_node_dirty(b))
+ if (btree_node_dirty(b)) {
btree_complete_write(b, btree_current_write(b));
- clear_bit(BTREE_NODE_dirty, &b->flags);
-
+ clear_bit(BTREE_NODE_dirty, &b->flags);
+ }
mca_data_free(b);
}
@@ -1069,9 +1069,10 @@ static void btree_node_free(struct btree *b)
mutex_lock(&b->write_lock);
- if (btree_node_dirty(b))
+ if (btree_node_dirty(b)) {
btree_complete_write(b, btree_current_write(b));
- clear_bit(BTREE_NODE_dirty, &b->flags);
+ clear_bit(BTREE_NODE_dirty, &b->flags);
+ }
mutex_unlock(&b->write_lock);
--
2.20.1
If a new child cgroup is created in the frozen cgroup hierarchy
(one or more of ancestor cgroups is frozen), the CGRP_FREEZE cgroup
flag should be set. Otherwise if a process will be attached to the
child cgroup, it won't become frozen.
The problem can be reproduced with the test_cgfreezer_mkdir test.
This is the output before this patch:
~/test_freezer
ok 1 test_cgfreezer_simple
ok 2 test_cgfreezer_tree
ok 3 test_cgfreezer_forkbomb
Cgroup /sys/fs/cgroup/cg_test_mkdir_A/cg_test_mkdir_B isn't frozen
not ok 4 test_cgfreezer_mkdir
ok 5 test_cgfreezer_rmdir
ok 6 test_cgfreezer_migrate
ok 7 test_cgfreezer_ptrace
ok 8 test_cgfreezer_stopped
ok 9 test_cgfreezer_ptraced
ok 10 test_cgfreezer_vfork
And with this patch:
~/test_freezer
ok 1 test_cgfreezer_simple
ok 2 test_cgfreezer_tree
ok 3 test_cgfreezer_forkbomb
ok 4 test_cgfreezer_mkdir
ok 5 test_cgfreezer_rmdir
ok 6 test_cgfreezer_migrate
ok 7 test_cgfreezer_ptrace
ok 8 test_cgfreezer_stopped
ok 9 test_cgfreezer_ptraced
ok 10 test_cgfreezer_vfork
Reported-by: Mark Crossen <mcrossen(a)fb.com>
Signed-off-by: Roman Gushchin <guro(a)fb.com>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
kernel/cgroup/cgroup.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 753afbca549f..8be1da1ebd9a 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5255,8 +5255,16 @@ static struct cgroup *cgroup_create(struct cgroup *parent)
* if the parent has to be frozen, the child has too.
*/
cgrp->freezer.e_freeze = parent->freezer.e_freeze;
- if (cgrp->freezer.e_freeze)
+ if (cgrp->freezer.e_freeze) {
+ /*
+ * Set the CGRP_FREEZE flag, so when a process will be
+ * attached to the child cgroup, it will become frozen.
+ * At this point the new cgroup is unpopulated, so we can
+ * consider it frozen immediately.
+ */
+ set_bit(CGRP_FREEZE, &cgrp->flags);
set_bit(CGRP_FROZEN, &cgrp->flags);
+ }
spin_lock_irq(&css_set_lock);
for (tcgrp = cgrp; tcgrp; tcgrp = cgroup_parent(tcgrp)) {
--
2.21.0
Hey,
Op 12-09-2019 om 16:34 schreef Sasha Levin:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: d9218c8f6cf4 drm/i915/dp: Add helpers for Compressed BPP and Slice Count for DSC.
>
> The bot has tested the following trees: v5.2.14.
>
> v5.2.14: Failed to apply! Possible dependencies:
> Unable to calculate
>
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
>
> --
> Thanks,
> Sasha
Why is this bot asking for patches on the trybot mailing list?
~Maarten
The userptr put_pages can be called from inside try_to_unmap, and so
enters with the page lock held on one of the object's backing pages. We
cannot take the page lock ourselves for fear of recursion.
Reported-by: Lionel Landwerlin <lionel.g.landwerlin(a)intel.com>
Reported-by: Martin Wilck <Martin.Wilck(a)suse.com>
Reported-by: Leo Kraav <leho(a)kraav.com>
Fixes: aa56a292ce62 ("drm/i915/userptr: Acquire the page lock around set_page_dirty()")
References: https://bugzilla.kernel.org/show_bug.cgi?id=203317
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
Cc: Jani Nikula <jani.nikula(a)intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
index 74da35611d7c..11b231c187c5 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
@@ -672,15 +672,7 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj,
for_each_sgt_page(page, sgt_iter, pages) {
if (obj->mm.dirty)
- /*
- * As this may not be anonymous memory (e.g. shmem)
- * but exist on a real mapping, we have to lock
- * the page in order to dirty it -- holding
- * the page reference is not sufficient to
- * prevent the inode from being truncated.
- * Play safe and take the lock.
- */
- set_page_dirty_lock(page);
+ set_page_dirty(page);
mark_page_accessed(page);
put_page(page);
--
2.23.0
When the userspace program runs the KVM_S390_INTERRUPT ioctl to inject
an interrupt, we convert them from the legacy struct kvm_s390_interrupt
to the new struct kvm_s390_irq via the s390int_to_s390irq() function.
However, this function does not take care of all types of interrupts
that we can inject into the guest later (see do_inject_vcpu()). Since we
do not clear out the s390irq values before calling s390int_to_s390irq(),
there is a chance that we copy random data from the kernel stack which
could be leaked to the userspace later.
Specifically, the problem exists with the KVM_S390_INT_PFAULT_INIT
interrupt: s390int_to_s390irq() does not handle it, and the function
__inject_pfault_init() later copies irq->u.ext which contains the
random kernel stack data. This data can then be leaked either to
the guest memory in __deliver_pfault_init(), or the userspace might
retrieve it directly with the KVM_S390_GET_IRQ_STATE ioctl.
Fix it by handling that interrupt type in s390int_to_s390irq(), too,
and by making sure that the s390irq struct is properly pre-initialized.
And while we're at it, make sure that s390int_to_s390irq() now
directly returns -EINVAL for unknown interrupt types, so that we
immediately get a proper error code in case we add more interrupt
types to do_inject_vcpu() without updating s390int_to_s390irq()
sometime in the future.
Cc: stable(a)vger.kernel.org
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Christian Borntraeger <borntraeger(a)de.ibm.com>
Signed-off-by: Thomas Huth <thuth(a)redhat.com>
---
arch/s390/kvm/interrupt.c | 10 ++++++++++
arch/s390/kvm/kvm-s390.c | 2 +-
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 3e7efdd9228a..165dea4c7f19 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -1960,6 +1960,16 @@ int s390int_to_s390irq(struct kvm_s390_interrupt *s390int,
case KVM_S390_MCHK:
irq->u.mchk.mcic = s390int->parm64;
break;
+ case KVM_S390_INT_PFAULT_INIT:
+ irq->u.ext.ext_params = s390int->parm;
+ irq->u.ext.ext_params2 = s390int->parm64;
+ break;
+ case KVM_S390_RESTART:
+ case KVM_S390_INT_CLOCK_COMP:
+ case KVM_S390_INT_CPU_TIMER:
+ break;
+ default:
+ return -EINVAL;
}
return 0;
}
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f329dcb3f44c..082eac2abc88 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -4323,7 +4323,7 @@ long kvm_arch_vcpu_async_ioctl(struct file *filp,
}
case KVM_S390_INTERRUPT: {
struct kvm_s390_interrupt s390int;
- struct kvm_s390_irq s390irq;
+ struct kvm_s390_irq s390irq = {};
if (copy_from_user(&s390int, argp, sizeof(s390int)))
return -EFAULT;
--
2.18.1
From: Zhenzhong Duan <zhenzhong.duan(a)oracle.com>
commit 8c5477e8046ca139bac250386c08453da37ec1ae upstream.
Kernel build warns:
'sanitize_boot_params' defined but not used [-Wunused-function]
at below files:
arch/x86/boot/compressed/cmdline.c
arch/x86/boot/compressed/error.c
arch/x86/boot/compressed/early_serial_console.c
arch/x86/boot/compressed/acpi.c
That's becausethey each include misc.h which includes a definition of
sanitize_boot_params() via bootparam_utils.h.
Remove the inclusion from misc.h and have the c file including
bootparam_utils.h directly.
Signed-off-by: Zhenzhong Duan <zhenzhong.duan(a)oracle.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Link: https://lkml.kernel.org/r/1563283092-1189-1-git-send-email-zhenzhong.duan@o…
[nc: Fixed conflict around lack of 67b6662559f7f]
Signed-off-by: Nathan Chancellor <natechancellor(a)gmail.com>
---
Hi Greg and Sasha,
Please consider applying this to 4.4 as it resolves a compilation error
with clang on 4.4 and it has already been applied to 4.9 and newer:
https://travis-ci.com/ClangBuiltLinux/continuous-integration/jobs/232287034https://github.com/ClangBuiltLinux/linux/issues/654
Thanks to Ilie Halip for debugging this; TL;DR: clang pretends that it
is GCC 4.2.1 for glibc compatibility and this trips up a definition of
memcpy for GCC < 4.3. This is not an issue on mainline because GCC 4.6
is the earliest supported GCC version so that code was removed and this
patch resolves it because string.h redefines memcpy to a proper version.
arch/x86/boot/compressed/misc.c | 1 +
arch/x86/boot/compressed/misc.h | 1 -
2 files changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 16df89c30c20..1e5b68228aff 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -11,6 +11,7 @@
#include "misc.h"
#include "../string.h"
+#include <asm/bootparam_utils.h>
/* WARNING!!
* This code is compiled with -fPIC and it is relocated dynamically
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index 4abb284a5b9c..bce182708814 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -19,7 +19,6 @@
#include <asm/page.h>
#include <asm/boot.h>
#include <asm/bootparam.h>
-#include <asm/bootparam_utils.h>
#define BOOT_BOOT_H
#include "../ctype.h"
--
2.23.0
On Thu, Sep 12, 2019 at 04:38:25PM +0800, butt3rflyh4ck wrote:
> can the issue assigned a CVE number?please reply on me as soon as possible.
> thank you
As per the kernel documentation, the kernel community does not assign,
or deal with, CVEs numbers at all. Just go ask for one directly from
MITRE if you really feel you need one (hint, there is no real need...)
thanks,
greg k-h
Unit of 'chunk_size' is byte, instead of sector, so fix it.
Without this fix, too big max_discard_sectors is applied on the request queue
of dm-raid, finally raid code has to split the bio again.
This re-split done by raid causes the following nested clone_endio:
1) one big bio 'A' is submitted to dm queue, and served as the original
bio
2) one new bio 'B' is cloned from the original bio 'A', and .map()
is run on this bio of 'B', and B's original bio points to 'A'
3) raid code sees that 'B' is too big, and split 'B' and re-submit
the remainded part of 'B' to dm-raid queue via generic_make_request().
4) now dm will hanlde 'B' as new original bio, then allocate a new
clone bio of 'C' and run .map() on 'C'. Meantime C's original bio
points to 'B'.
5) suppose now 'C' is completed by raid direclty, then the following
clone_endio() is called recursively:
clone_endio(C)
->clone_endio(B) #B is original bio of 'C'
->bio_endio(A)
'A' can be big enough to make handreds of nested clone_endio(), then
stack can be corrupted easily.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
---
V2:
- fix commit log a bit
drivers/md/dm-raid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 8a60a4a070ac..c26aa4e8207a 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3749,7 +3749,7 @@ static void raid_io_hints(struct dm_target *ti, struct queue_limits *limits)
*/
if (rs_is_raid1(rs) || rs_is_raid10(rs)) {
limits->discard_granularity = chunk_size;
- limits->max_discard_sectors = chunk_size;
+ limits->max_discard_sectors = chunk_size >> 9;
}
}
--
2.20.1
Hi,
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag,
fixing commit: 753690898204 SUNRPC: Ensure the bvecs are reset when we re-encode the RPC request.
The bot has tested the following trees: v5.2.14.
v5.2.14: Failed to apply! Possible dependencies:
b5e924191f87 ("SUNRPC: Remove the bh-safe lock requirement on xprt->transport_lock")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks,
Sasha
Unit of 'chunk_size' is byte, instead of sector, so fix it.
Without this fix, too big max_discard_sectors is applied on the request queue
of dm-raid, finally raid code has to split the bio again.
This re-split by raid may cause the following nested clone_endio:
1) one big bio 'A' is submitted to dm queue, and served as the original
bio
2) one new bio 'B' is cloned from the original bio 'A', and .map()
is run on this bio of 'B', and B's original bio points to 'A'
3) raid code sees that 'B' is too big, and split 'B' and re-submit
the remainded part of 'B' to dm-raid queue via generic_make_request().
4) now dm will hanlde 'B' as new original bio, then allocate a new
clone bio of 'C' and run .map() on 'C'. Meantime C's original bio
points to 'B'.
5) suppose now 'C' can be completed by raid direclty, then the following
clone_endio() is called recursively:
clone_endio(C)
->clone_endio(B) #B is original bio of 'C'
->clone_endio(A) #A is original bio of 'B'
'A' can be big enough to make such handreds of nested clone_endio(), then
stack is corrupted.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
---
drivers/md/dm-raid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 8a60a4a070ac..c26aa4e8207a 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3749,7 +3749,7 @@ static void raid_io_hints(struct dm_target *ti, struct queue_limits *limits)
*/
if (rs_is_raid1(rs) || rs_is_raid10(rs)) {
limits->discard_granularity = chunk_size;
- limits->max_discard_sectors = chunk_size;
+ limits->max_discard_sectors = chunk_size >> 9;
}
}
--
2.20.1
When a port sends PLOGI, discovery state should be changed to login
pending, otherwise RELOGIN_NEEDED bit is set in
qla24xx_handle_plogi_done_event(). RELOGIN_NEEDED triggers another
PLOGI, and it never goes out of the loop until login timer expires.
Fixes: 8777e4314d397 ("scsi: qla2xxx: Migrate NVME N2N handling into state machine")
Fixes: 8b5292bcfcacf ("scsi: qla2xxx: Fix Relogin to prevent modifying scan_state flag")
Cc: Quinn Tran <qtran(a)marvell.com>
Cc: Himanshu Madhani <hmadhani(a)marvell.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Roman Bolshakov <r.bolshakov(a)yadro.com>
---
drivers/scsi/qla2xxx/qla_init.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index c8d89912d044..e4857ef0e5c4 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -516,6 +516,7 @@ static int qla_post_els_plogi_work(struct scsi_qla_host *vha, fc_port_t *fcport)
e->u.fcport.fcport = fcport;
fcport->flags |= FCF_ASYNC_ACTIVE;
+ fcport->disc_state = DSC_LOGIN_PEND;
return qla2x00_post_work(vha, e);
}
--
2.22.0
If ABTS cannot be completed in target mode, the driver attempts to free
related management command and crashes:
NIP [d000000019181ee8] tcm_qla2xxx_free_mcmd+0x40/0x80 [tcm_qla2xxx]
LR [d00000001dc1e6f8] qlt_response_pkt+0x190/0xa10 [qla2xxx]
Call Trace:
[c000003fff27bb50] [c000003fff27bc10] 0xc000003fff27bc10 (unreliable)
[c000003fff27bb70] [d00000001dc1e6f8] qlt_response_pkt+0x190/0xa10 [qla2xxx]
[c000003fff27bc10] [d00000001dbc2be0] qla24xx_process_response_queue+0x5d8/0xbd0 [qla2xxx]
[c000003fff27bd50] [d00000001dbc632c] qla24xx_msix_rsp_q+0x64/0x150 [qla2xxx]
[c000003fff27bde0] [c000000000187200] __handle_irq_event_percpu+0x90/0x310
[c000003fff27bea0] [c0000000001874b8] handle_irq_event_percpu+0x38/0x90
[c000003fff27bee0] [c000000000187574] handle_irq_event+0x64/0xb0
[c000003fff27bf10] [c00000000018cd38] handle_fasteoi_irq+0xe8/0x280
[c000003fff27bf40] [c000000000185ccc] generic_handle_irq+0x4c/0x70
[c000003fff27bf60] [c000000000016cec] __do_irq+0x7c/0x1d0
[c000003fff27bf90] [c00000000002a530] call_do_irq+0x14/0x24
[c00000207d2cba90] [c000000000016edc] do_IRQ+0x9c/0x130
[c00000207d2cbae0] [c000000000008bf4] hardware_interrupt_common+0x114/0x120
--- interrupt: 501 at arch_local_irq_restore+0x74/0x90
LR = arch_local_irq_restore+0x74/0x90
[c00000207d2cbdd0] [c0000000001c64fc] tick_broadcast_oneshot_control+0x4c/0x60 (unreliable)
[c00000207d2cbdf0] [c0000000007ac840] cpuidle_enter_state+0xf0/0x450
[c00000207d2cbe50] [c00000000016b81c] call_cpuidle+0x4c/0x90
[c00000207d2cbe70] [c00000000016bc30] do_idle+0x2b0/0x330
[c00000207d2cbec0] [c00000000016beec] cpu_startup_entry+0x3c/0x50
[c00000207d2cbef0] [c00000000004a06c] start_secondary+0x63c/0x670
[c00000207d2cbf90] [c00000000000aa6c] start_secondary_prolog+0x10/0x14
The crash can be triggered by ACL deletion when there's active I/O.
During ACL deletion, qla2xxx performs implicit LOGO that's invisible for
the initiator. Only the driver and firmware are aware of the logout.
Therefore the initiator continues to send SCSI commands and the target
always responds with SAM STATUS BUSY as it can't find the session.
The command times out after a while and initiator invokes ABORT TASK TMF
for the command. The TMF is mapped to ABTS-LS in FCP. The target can't
find session for S_ID originating ABTS-LS so it never allocates mcmd.
And since N_Port handle was deleted after LOGO, it is no longer valid
and ABTS Response IOCB is returned from firmware with status 31. Then
free_mcmd is invoked on NULL pointer and the kernel crashes.
[ 7734.578642] qla2xxx [0000:00:0c.0]-e837:6: ABTS_RECV_24XX: instance 0
[ 7734.578644] qla2xxx [0000:00:0c.0]-f811:6: qla_target(0): task abort (s_id=1:2:0, tag=1209504, param=0)
[ 7734.578645] find_sess_by_s_id: 0x010200
[ 7734.578645] Unable to locate s_id: 0x010200
[ 7734.578646] qla2xxx [0000:00:0c.0]-f812:6: qla_target(0): task abort for non-existent session
[ 7734.578648] qla2xxx [0000:00:0c.0]-e806:6: Sending task mgmt ABTS response (ha=c0000000d5819000, atio=c0000000d3fd4700, status=4
[ 7734.578730] qla2xxx [0000:00:0c.0]-e838:6: ABTS_RESP_24XX: compl_status 31
[ 7734.578732] qla2xxx [0000:00:0c.0]-e863:6: qla_target(0): ABTS_RESP_24XX failed 31 (subcode 19:a)
[ 7734.578740] Unable to handle kernel paging request for data at address 0x00000200
Fixes: 6b0431d6fa20b ("scsi: qla2xxx: Fix out of order Termination and ABTS response")
Cc: Quinn Tran <qtran(a)marvell.com>
Cc: Himanshu Madhani <hmadhani(a)marvell.com>
Cc: Bart Van Assche <bvanassche(a)acm.org>
Cc: stable(a)vger.kernel.org
Signed-off-by: Roman Bolshakov <r.bolshakov(a)yadro.com>
---
drivers/scsi/qla2xxx/tcm_qla2xxx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 042a24314edc..bab2073c1f72 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -246,6 +246,8 @@ static void tcm_qla2xxx_complete_mcmd(struct work_struct *work)
*/
static void tcm_qla2xxx_free_mcmd(struct qla_tgt_mgmt_cmd *mcmd)
{
+ if (!mcmd)
+ return;
INIT_WORK(&mcmd->free_work, tcm_qla2xxx_complete_mcmd);
queue_work(tcm_qla2xxx_free_wq, &mcmd->free_work);
}
--
2.22.0
Commit aea447141c7e ("powerpc: Disable -Wbuiltin-requires-header when
setjmp is used") disabled -Wbuiltin-requires-header because of a warning
about the setjmp and longjmp declarations.
r367387 in clang added another diagnostic around this, complaining that
there is no jmp_buf declaration.
In file included from ../arch/powerpc/xmon/xmon.c:47:
../arch/powerpc/include/asm/setjmp.h:10:13: error: declaration of
built-in function 'setjmp' requires the declaration of the 'jmp_buf'
type, commonly provided in the header <setjmp.h>.
[-Werror,-Wincomplete-setjmp-declaration]
extern long setjmp(long *);
^
../arch/powerpc/include/asm/setjmp.h:11:13: error: declaration of
built-in function 'longjmp' requires the declaration of the 'jmp_buf'
type, commonly provided in the header <setjmp.h>.
[-Werror,-Wincomplete-setjmp-declaration]
extern void longjmp(long *, long);
^
2 errors generated.
We are not using the standard library's longjmp/setjmp implementations
for obvious reasons; make this clear to clang by using -ffreestanding
on these files.
Cc: stable(a)vger.kernel.org # 4.14+
Link: https://github.com/ClangBuiltLinux/linux/issues/625
Link: https://github.com/llvm/llvm-project/commit/3be25e79477db2d31ac46493d97eca8…
Suggested-by: Segher Boessenkool <segher(a)kernel.crashing.org>
Signed-off-by: Nathan Chancellor <natechancellor(a)gmail.com>
---
v1 -> v3:
* Use -ffreestanding instead of outright disabling the warning because
it is legitimate.
I skipped v2 because the first patch in the series already had a v2.
arch/powerpc/kernel/Makefile | 4 ++--
arch/powerpc/xmon/Makefile | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index c9cc4b689e60..19f19c8c874b 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -5,8 +5,8 @@
CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"'
-# Disable clang warning for using setjmp without setjmp.h header
-CFLAGS_crash.o += $(call cc-disable-warning, builtin-requires-header)
+# Avoid clang warnings around longjmp/setjmp declarations
+CFLAGS_crash.o += -ffreestanding
ifdef CONFIG_PPC64
CFLAGS_prom_init.o += $(NO_MINIMAL_TOC)
diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile
index f142570ad860..c3842dbeb1b7 100644
--- a/arch/powerpc/xmon/Makefile
+++ b/arch/powerpc/xmon/Makefile
@@ -1,8 +1,8 @@
# SPDX-License-Identifier: GPL-2.0
# Makefile for xmon
-# Disable clang warning for using setjmp without setjmp.h header
-subdir-ccflags-y := $(call cc-disable-warning, builtin-requires-header)
+# Avoid clang warnings around longjmp/setjmp declarations
+subdir-ccflags-y := -ffreestanding
GCOV_PROFILE := n
KCOV_INSTRUMENT := n
--
2.23.0
From: Stefan Assmann <sassmann(a)kpanic.de>
While testing VF spawn/destroy the following panic occurred.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000029
[...]
Workqueue: i40e i40e_service_task [i40e]
RIP: 0010:i40e_sync_vsi_filters+0x6fd/0xc60 [i40e]
[...]
Call Trace:
? __switch_to_asm+0x35/0x70
? __switch_to_asm+0x41/0x70
? __switch_to_asm+0x35/0x70
? _cond_resched+0x15/0x30
i40e_sync_filters_subtask+0x56/0x70 [i40e]
i40e_service_task+0x382/0x11b0 [i40e]
? __switch_to_asm+0x41/0x70
? __switch_to_asm+0x41/0x70
process_one_work+0x1a7/0x3b0
worker_thread+0x30/0x390
? create_worker+0x1a0/0x1a0
kthread+0x112/0x130
? kthread_bind+0x30/0x30
ret_from_fork+0x35/0x40
Investigation revealed a race where pf->vf[vsi->vf_id].trusted may get
accessed by the watchdog via i40e_sync_filters_subtask() although
i40e_free_vfs() already free'd pf->vf.
To avoid this the call to i40e_sync_vsi_filters() in
i40e_sync_filters_subtask() needs to be guarded by __I40E_VF_DISABLE,
which is also used by i40e_free_vfs().
Note: put the __I40E_VF_DISABLE check after the
__I40E_MACVLAN_SYNC_PENDING check as the latter is more likely to
trigger.
CC: stable(a)vger.kernel.org
Signed-off-by: Stefan Assmann <sassmann(a)kpanic.de>
Tested-by: Andrew Bowers <andrewx.bowers(a)intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher(a)intel.com>
---
drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index e9f2f276bf27..3e2e465f43f9 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -2592,6 +2592,10 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
return;
if (!test_and_clear_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state))
return;
+ if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) {
+ set_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state);
+ return;
+ }
for (v = 0; v < pf->num_alloc_vsi; v++) {
if (pf->vsi[v] &&
@@ -2606,6 +2610,7 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
}
}
}
+ clear_bit(__I40E_VF_DISABLE, pf->state);
}
/**
--
2.21.0
From: Alexander Duyck <alexander.h.duyck(a)linux.intel.com>
There were a couple cases where the ITR value generated via the adaptive
ITR scheme could exceed 126. This resulted in the value becoming either 0
or something less than 10. Switching back and forth between a value less
than 10 and a value greater than 10 can cause issues as certain hardware
features such as RSC to not function well when the ITR value has dropped
that low.
CC: stable(a)vger.kernel.org
Fixes: b4ded8327fea ("ixgbe: Update adaptive ITR algorithm")
Reported-by: Gregg Leventhal <gleventhal(a)janestreet.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck(a)linux.intel.com>
Tested-by: Andrew Bowers <andrewx.bowers(a)intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher(a)intel.com>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 7882148abb43..77ca9005dc41 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -2621,7 +2621,7 @@ static void ixgbe_update_itr(struct ixgbe_q_vector *q_vector,
/* 16K ints/sec to 9.2K ints/sec */
avg_wire_size *= 15;
avg_wire_size += 11452;
- } else if (avg_wire_size <= 1980) {
+ } else if (avg_wire_size < 1968) {
/* 9.2K ints/sec to 8K ints/sec */
avg_wire_size *= 5;
avg_wire_size += 22420;
@@ -2654,6 +2654,8 @@ static void ixgbe_update_itr(struct ixgbe_q_vector *q_vector,
case IXGBE_LINK_SPEED_2_5GB_FULL:
case IXGBE_LINK_SPEED_1GB_FULL:
case IXGBE_LINK_SPEED_10_FULL:
+ if (avg_wire_size > 8064)
+ avg_wire_size = 8064;
itr += DIV_ROUND_UP(avg_wire_size,
IXGBE_ITR_ADAPTIVE_MIN_INC * 64) *
IXGBE_ITR_ADAPTIVE_MIN_INC;
--
2.21.0
On Wed, Sep 11, 2019 at 05:30:33AM -0400, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
>
> ALSA: pcm: Return 0 when size < start_threshold in capture
>
> to the 4.19-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> alsa-pcm-return-0-when-size-start_threshold-in-captu.patch
> and it can be found in the queue-4.19 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
Hi Sasha.
This patch was reverted by the commit 932a81519572156a88db
("ALSA: pcm: Comment why read blocks when PCM is not
running"):
This avoids bringing back the problem introduced by
62ba568f7aef ("ALSA: pcm: Return 0 when size <
start_threshold in capture") and fixed in 00a399cad1a0
("ALSA: pcm: Revert capture stream behavior change in
blocking mode"), which prevented the user from starting
capture from another thread.
Should this be queued anyway? If yes, I think it should also
be queued the fix and the commit above.
pasquali
The patch titled
Subject: memcg, kmem: do not fail __GFP_NOFAIL charges
has been added to the -mm tree. Its filename is
memcg-kmem-do-not-fail-__gfp_nofail-charges.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/memcg-kmem-do-not-fail-__gfp_nofai…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/memcg-kmem-do-not-fail-__gfp_nofai…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Michal Hocko <mhocko(a)suse.com>
Subject: memcg, kmem: do not fail __GFP_NOFAIL charges
Thomas has noticed the following NULL ptr dereference when using cgroup
v1 kmem limit:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
PGD 0
P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 3 PID: 16923 Comm: gtk-update-icon Not tainted 4.19.51 #42
Hardware name: Gigabyte Technology Co., Ltd. Z97X-Gaming G1/Z97X-Gaming G1, BIOS F9 07/31/2015
RIP: 0010:create_empty_buffers+0x24/0x100
Code: cd 0f 1f 44 00 00 0f 1f 44 00 00 41 54 49 89 d4 ba 01 00 00 00 55 53 48 89 fb e8 97 fe ff ff 48 89 c5 48 89 c2 eb 03 48 89 ca <48> 8b 4a 08 4c 09 22 48 85 c9 75 f1 48 89 6a 08 48 8b 43 18 48 8d
RSP: 0018:ffff927ac1b37bf8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: fffff2d4429fd740 RCX: 0000000100097149
RDX: 0000000000000000 RSI: 0000000000000082 RDI: ffff9075a99fbe00
RBP: 0000000000000000 R08: fffff2d440949cc8 R09: 00000000000960c0
R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000
R13: ffff907601f18360 R14: 0000000000002000 R15: 0000000000001000
FS: 00007fb55b288bc0(0000) GS:ffff90761f8c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 000000007aebc002 CR4: 00000000001606e0
Call Trace:
create_page_buffers+0x4d/0x60
__block_write_begin_int+0x8e/0x5a0
? ext4_inode_attach_jinode.part.82+0xb0/0xb0
? jbd2__journal_start+0xd7/0x1f0
ext4_da_write_begin+0x112/0x3d0
generic_perform_write+0xf1/0x1b0
? file_update_time+0x70/0x140
__generic_file_write_iter+0x141/0x1a0
ext4_file_write_iter+0xef/0x3b0
__vfs_write+0x17e/0x1e0
vfs_write+0xa5/0x1a0
ksys_write+0x57/0xd0
do_syscall_64+0x55/0x160
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Tetsuo then noticed that this is because the __memcg_kmem_charge_memcg
fails __GFP_NOFAIL charge when the kmem limit is reached. This is a wrong
behavior because nofail allocations are not allowed to fail. Normal
charge path simply forces the charge even if that means to cross the
limit. Kmem accounting should be doing the same.
Link: http://lkml.kernel.org/r/20190906125608.32129-1-mhocko@kernel.org
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Thomas Lindroth <thomas.lindroth(a)gmail.com>
Debugged-by: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Cc: Thomas Lindroth <thomas.lindroth(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/mm/memcontrol.c~memcg-kmem-do-not-fail-__gfp_nofail-charges
+++ a/mm/memcontrol.c
@@ -2821,6 +2821,16 @@ int __memcg_kmem_charge_memcg(struct pag
if (!cgroup_subsys_on_dfl(memory_cgrp_subsys) &&
!page_counter_try_charge(&memcg->kmem, nr_pages, &counter)) {
+
+ /*
+ * Enforce __GFP_NOFAIL allocation because callers are not
+ * prepared to see failures and likely do not have any failure
+ * handling code.
+ */
+ if (gfp & __GFP_NOFAIL) {
+ page_counter_charge(&memcg->kmem, nr_pages);
+ return 0;
+ }
cancel_charge(memcg, nr_pages);
return -ENOMEM;
}
_
Patches currently in -mm which might be from mhocko(a)suse.com are
memcg-kmem-do-not-fail-__gfp_nofail-charges.patch
mm-oom-consider-present-pages-for-the-node-size.patch
The patch titled
Subject: z3fold: fix retry mechanism in page reclaim
has been added to the -mm tree. Its filename is
z3fold-fix-retry-mechanism-in-page-reclaim.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/z3fold-fix-retry-mechanism-in-page…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/z3fold-fix-retry-mechanism-in-page…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Vitaly Wool <vitalywool(a)gmail.com>
Subject: z3fold: fix retry mechanism in page reclaim
z3fold_page_reclaim()'s retry mechanism is broken: on a second iteration
it will have zhdr from the first one so that zhdr is no longer in line
with struct page. That leads to crashes when the system is stressed.
Fix that by moving zhdr assignment up.
While at it, protect against using already freed handles by using own
local slots structure in z3fold_page_reclaim().
Link: http://lkml.kernel.org/r/20190908162919.830388dc7404d1e2c80f4095@gmail.com
Signed-off-by: Vitaly Wool <vitalywool(a)gmail.com>
Reported-by: Markus Linnala <markus.linnala(a)gmail.com>
Reported-by: Chris Murphy <bugzilla(a)colorremedies.com>
Reported-by: Agustin Dall'Alba <agustin(a)dallalba.com.ar>
Cc: "Maciej S. Szmigiero" <mail(a)maciej.szmigiero.name>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Henry Burns <henrywolfeburns(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/z3fold.c | 49 ++++++++++++++++++++++++++++++++++---------------
1 file changed, 34 insertions(+), 15 deletions(-)
--- a/mm/z3fold.c~z3fold-fix-retry-mechanism-in-page-reclaim
+++ a/mm/z3fold.c
@@ -366,9 +366,10 @@ static inline int __idx(struct z3fold_he
* Encodes the handle of a particular buddy within a z3fold page
* Pool lock should be held as this function accesses first_num
*/
-static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud)
+static unsigned long __encode_handle(struct z3fold_header *zhdr,
+ struct z3fold_buddy_slots *slots,
+ enum buddy bud)
{
- struct z3fold_buddy_slots *slots;
unsigned long h = (unsigned long)zhdr;
int idx = 0;
@@ -385,11 +386,15 @@ static unsigned long encode_handle(struc
if (bud == LAST)
h |= (zhdr->last_chunks << BUDDY_SHIFT);
- slots = zhdr->slots;
slots->slot[idx] = h;
return (unsigned long)&slots->slot[idx];
}
+static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud)
+{
+ return __encode_handle(zhdr, zhdr->slots, bud);
+}
+
/* Returns the z3fold page where a given handle is stored */
static inline struct z3fold_header *handle_to_z3fold_header(unsigned long h)
{
@@ -624,6 +629,7 @@ static void do_compact_page(struct z3fol
}
if (unlikely(PageIsolated(page) ||
+ test_bit(PAGE_CLAIMED, &page->private) ||
test_bit(PAGE_STALE, &page->private))) {
z3fold_page_unlock(zhdr);
return;
@@ -1100,6 +1106,7 @@ static int z3fold_reclaim_page(struct z3
struct z3fold_header *zhdr = NULL;
struct page *page = NULL;
struct list_head *pos;
+ struct z3fold_buddy_slots slots;
unsigned long first_handle = 0, middle_handle = 0, last_handle = 0;
spin_lock(&pool->lock);
@@ -1118,16 +1125,22 @@ static int z3fold_reclaim_page(struct z3
/* this bit could have been set by free, in which case
* we pass over to the next page in the pool.
*/
- if (test_and_set_bit(PAGE_CLAIMED, &page->private))
+ if (test_and_set_bit(PAGE_CLAIMED, &page->private)) {
+ page = NULL;
continue;
+ }
- if (unlikely(PageIsolated(page)))
+ if (unlikely(PageIsolated(page))) {
+ clear_bit(PAGE_CLAIMED, &page->private);
+ page = NULL;
continue;
+ }
+ zhdr = page_address(page);
if (test_bit(PAGE_HEADLESS, &page->private))
break;
- zhdr = page_address(page);
if (!z3fold_page_trylock(zhdr)) {
+ clear_bit(PAGE_CLAIMED, &page->private);
zhdr = NULL;
continue; /* can't evict at this point */
}
@@ -1145,26 +1158,30 @@ static int z3fold_reclaim_page(struct z3
if (!test_bit(PAGE_HEADLESS, &page->private)) {
/*
- * We need encode the handles before unlocking, since
- * we can race with free that will set
- * (first|last)_chunks to 0
+ * We need encode the handles before unlocking, and
+ * use our local slots structure because z3fold_free
+ * can zero out zhdr->slots and we can't do much
+ * about that
*/
first_handle = 0;
last_handle = 0;
middle_handle = 0;
if (zhdr->first_chunks)
- first_handle = encode_handle(zhdr, FIRST);
+ first_handle = __encode_handle(zhdr, &slots,
+ FIRST);
if (zhdr->middle_chunks)
- middle_handle = encode_handle(zhdr, MIDDLE);
+ middle_handle = __encode_handle(zhdr, &slots,
+ MIDDLE);
if (zhdr->last_chunks)
- last_handle = encode_handle(zhdr, LAST);
+ last_handle = __encode_handle(zhdr, &slots,
+ LAST);
/*
* it's safe to unlock here because we hold a
* reference to this page
*/
z3fold_page_unlock(zhdr);
} else {
- first_handle = encode_handle(zhdr, HEADLESS);
+ first_handle = __encode_handle(zhdr, &slots, HEADLESS);
last_handle = middle_handle = 0;
}
@@ -1194,9 +1211,9 @@ next:
spin_lock(&pool->lock);
list_add(&page->lru, &pool->lru);
spin_unlock(&pool->lock);
+ clear_bit(PAGE_CLAIMED, &page->private);
} else {
z3fold_page_lock(zhdr);
- clear_bit(PAGE_CLAIMED, &page->private);
if (kref_put(&zhdr->refcount,
release_z3fold_page_locked)) {
atomic64_dec(&pool->pages_nr);
@@ -1211,6 +1228,7 @@ next:
list_add(&page->lru, &pool->lru);
spin_unlock(&pool->lock);
z3fold_page_unlock(zhdr);
+ clear_bit(PAGE_CLAIMED, &page->private);
}
/* We started off locked to we need to lock the pool back */
@@ -1315,7 +1333,8 @@ static bool z3fold_page_isolate(struct p
VM_BUG_ON_PAGE(!PageMovable(page), page);
VM_BUG_ON_PAGE(PageIsolated(page), page);
- if (test_bit(PAGE_HEADLESS, &page->private))
+ if (test_bit(PAGE_HEADLESS, &page->private) ||
+ test_bit(PAGE_CLAIMED, &page->private))
return false;
zhdr = page_address(page);
_
Patches currently in -mm which might be from vitalywool(a)gmail.com are
revert-mm-z3foldc-fix-race-between-migration-and-destruction.patch
z3fold-fix-retry-mechanism-in-page-reclaim.patch
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 997fee5473ce - Linux 5.2.14
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/157953
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 997fee5473ce - Linux 5.2.14
We grabbed the ddfea0b99563 commit of the stable queue repository.
We then merged the patchset with `git am`:
gpio-pca953x-correct-type-of-reg_direction.patch
gpio-pca953x-use-pca953x_read_regs-instead-of-regmap_bulk_read.patch
alsa-hda-fix-potential-endless-loop-at-applying-quirks.patch
alsa-hda-realtek-fix-overridden-device-specific-initialization.patch
alsa-hda-realtek-add-quirk-for-hp-pavilion-15.patch
alsa-hda-realtek-enable-internal-speaker-headset-mic-of-asus-ux431fl.patch
alsa-hda-realtek-fix-the-problem-of-two-front-mics-on-a-thinkcentre.patch
sched-fair-don-t-assign-runtime-for-throttled-cfs_rq.patch
drm-vmwgfx-fix-double-free-in-vmw_recv_msg.patch
drm-nouveau-sec2-gp102-add-missing-module_firmwares.patch
vhost-test-fix-build-for-vhost-test.patch
vhost-test-fix-build-for-vhost-test-again.patch
powerpc-64e-drop-stale-call-to-smp_processor_id-which-hangs-smp-startup.patch
powerpc-tm-fix-fp-vmx-unavailable-exceptions-inside-a-transaction.patch
powerpc-tm-fix-restoring-fp-vmx-facility-incorrectly-on-interrupts.patch
batman-adv-fix-uninit-value-in-batadv_netlink_get_ifindex.patch
batman-adv-only-read-ogm-tvlv_len-after-buffer-len-check.patch
bcache-only-clear-btree_node_dirty-bit-when-it-is-se.patch
bcache-add-comments-for-mutex_lock-b-write_lock.patch
bcache-fix-race-in-btree_flush_write.patch
ib-rdmavt-add-new-completion-inline.patch
ib-rdmavt-qib-hfi1-convert-to-new-completion-api.patch
ib-hfi1-unreserve-a-flushed-opfn-request.patch
drm-i915-disable-sampler_state-prefetching-on-all-ge.patch
drm-i915-userptr-acquire-the-page-lock-around-set_pa.patch
drm-i915-make-sure-cdclk-is-high-enough-for-dp-audio.patch
mmc-sdhci-sprd-fix-the-incorrect-soft-reset-operatio.patch
usb-chipidea-imx-add-imx7ulp-support.patch
usb-chipidea-imx-fix-eprobe_defer-support-during-dri.patch
virtio-s390-fix-race-on-airq_areas.patch
drm-i915-support-flags-in-whitlist-was.patch
drm-i915-support-whitelist-workarounds-on-all-engine.patch
drm-i915-whitelist-ps_-depth-invocation-_count.patch
drm-i915-add-whitelist-workarounds-for-icl.patch
drm-i915-icl-whitelist-ps_-depth-invocation-_count.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
✅ storage: software RAID testing [2]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ jvm test suite [4]
✅ AMTU (Abstract Machine Test Utility) [5]
✅ LTP: openposix test suite [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
✅ stress: stress-ng [13]
🚧 ✅ LTP lite [14]
🚧 ✅ ALSA PCM loopback test [15]
🚧 ✅ ALSA Control (mixer) Userspace Element test [16]
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ jvm test suite [4]
✅ AMTU (Abstract Machine Test Utility) [5]
✅ LTP: openposix test suite [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
🚧 ✅ LTP lite [14]
🚧 ✅ ALSA PCM loopback test [15]
🚧 ✅ ALSA Control (mixer) Userspace Element test [16]
Host 2:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
✅ storage: software RAID testing [2]
x86_64:
Host 1:
✅ Boot test [0]
✅ selinux-policy: serge-testsuite [1]
✅ storage: software RAID testing [2]
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test [0]
✅ Podman system integration test (as root) [3]
✅ Podman system integration test (as user) [3]
✅ jvm test suite [4]
✅ AMTU (Abstract Machine Test Utility) [5]
✅ LTP: openposix test suite [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ pciutils: sanity smoke test [17]
✅ Usex - version 1.9-29 [12]
✅ stress: stress-ng [13]
🚧 ⚡⚡⚡ LTP lite [14]
🚧 ⚡⚡⚡ ALSA PCM loopback test [15]
🚧 ✅ ALSA Control (mixer) Userspace Element test [16]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/swra…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/sound/aloop
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/sound/user-…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
The patch titled
Subject: Revert "mm/z3fold.c: fix race between migration and destruction"
has been added to the -mm tree. Its filename is
revert-mm-z3foldc-fix-race-between-migration-and-destruction.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/revert-mm-z3foldc-fix-race-between…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/revert-mm-z3foldc-fix-race-between…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Vitaly Wool <vitalywool(a)gmail.com>
Subject: Revert "mm/z3fold.c: fix race between migration and destruction"
With the original commit applied, z3fold_zpool_destroy() may get blocked
on wait_event() for indefinite time. Revert this commit for the time
being to get rid of this problem since the issue the original commit
addresses is less severe.
Link: http://lkml.kernel.org/r/20190910123142.7a9c8d2de4d0acbc0977c602@gmail.com
Fixes: d776aaa9895eb6eb77 ("mm/z3fold.c: fix race between migration and destruction")
Reported-by: Agust�n Dall'Alba <agustin(a)dallalba.com.ar>
Signed-off-by: Vitaly Wool <vitalywool(a)gmail.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Vitaly Wool <vitalywool(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: Jonathan Adams <jwadams(a)google.com>
Cc: Henry Burns <henrywolfeburns(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/z3fold.c | 90 --------------------------------------------------
1 file changed, 90 deletions(-)
--- a/mm/z3fold.c~revert-mm-z3foldc-fix-race-between-migration-and-destruction
+++ a/mm/z3fold.c
@@ -41,7 +41,6 @@
#include <linux/workqueue.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
-#include <linux/wait.h>
#include <linux/zpool.h>
#include <linux/magic.h>
@@ -146,8 +145,6 @@ struct z3fold_header {
* @release_wq: workqueue for safe page release
* @work: work_struct for safe page release
* @inode: inode for z3fold pseudo filesystem
- * @destroying: bool to stop migration once we start destruction
- * @isolated: int to count the number of pages currently in isolation
*
* This structure is allocated at pool creation time and maintains metadata
* pertaining to a particular z3fold pool.
@@ -166,11 +163,8 @@ struct z3fold_pool {
const struct zpool_ops *zpool_ops;
struct workqueue_struct *compact_wq;
struct workqueue_struct *release_wq;
- struct wait_queue_head isolate_wait;
struct work_struct work;
struct inode *inode;
- bool destroying;
- int isolated;
};
/*
@@ -775,7 +769,6 @@ static struct z3fold_pool *z3fold_create
goto out_c;
spin_lock_init(&pool->lock);
spin_lock_init(&pool->stale_lock);
- init_waitqueue_head(&pool->isolate_wait);
pool->unbuddied = __alloc_percpu(sizeof(struct list_head)*NCHUNKS, 2);
if (!pool->unbuddied)
goto out_pool;
@@ -815,15 +808,6 @@ out:
return NULL;
}
-static bool pool_isolated_are_drained(struct z3fold_pool *pool)
-{
- bool ret;
-
- spin_lock(&pool->lock);
- ret = pool->isolated == 0;
- spin_unlock(&pool->lock);
- return ret;
-}
/**
* z3fold_destroy_pool() - destroys an existing z3fold pool
* @pool: the z3fold pool to be destroyed
@@ -833,22 +817,6 @@ static bool pool_isolated_are_drained(st
static void z3fold_destroy_pool(struct z3fold_pool *pool)
{
kmem_cache_destroy(pool->c_handle);
- /*
- * We set pool-> destroying under lock to ensure that
- * z3fold_page_isolate() sees any changes to destroying. This way we
- * avoid the need for any memory barriers.
- */
-
- spin_lock(&pool->lock);
- pool->destroying = true;
- spin_unlock(&pool->lock);
-
- /*
- * We need to ensure that no pages are being migrated while we destroy
- * these workqueues, as migration can queue work on either of the
- * workqueues.
- */
- wait_event(pool->isolate_wait, !pool_isolated_are_drained(pool));
/*
* We need to destroy pool->compact_wq before pool->release_wq,
@@ -1339,28 +1307,6 @@ static u64 z3fold_get_pool_size(struct z
return atomic64_read(&pool->pages_nr);
}
-/*
- * z3fold_dec_isolated() expects to be called while pool->lock is held.
- */
-static void z3fold_dec_isolated(struct z3fold_pool *pool)
-{
- assert_spin_locked(&pool->lock);
- VM_BUG_ON(pool->isolated <= 0);
- pool->isolated--;
-
- /*
- * If we have no more isolated pages, we have to see if
- * z3fold_destroy_pool() is waiting for a signal.
- */
- if (pool->isolated == 0 && waitqueue_active(&pool->isolate_wait))
- wake_up_all(&pool->isolate_wait);
-}
-
-static void z3fold_inc_isolated(struct z3fold_pool *pool)
-{
- pool->isolated++;
-}
-
static bool z3fold_page_isolate(struct page *page, isolate_mode_t mode)
{
struct z3fold_header *zhdr;
@@ -1387,34 +1333,6 @@ static bool z3fold_page_isolate(struct p
spin_lock(&pool->lock);
if (!list_empty(&page->lru))
list_del(&page->lru);
- /*
- * We need to check for destruction while holding pool->lock, as
- * otherwise destruction could see 0 isolated pages, and
- * proceed.
- */
- if (unlikely(pool->destroying)) {
- spin_unlock(&pool->lock);
- /*
- * If this page isn't stale, somebody else holds a
- * reference to it. Let't drop our refcount so that they
- * can call the release logic.
- */
- if (unlikely(kref_put(&zhdr->refcount,
- release_z3fold_page_locked))) {
- /*
- * If we get here we have kref problems, so we
- * should freak out.
- */
- WARN(1, "Z3fold is experiencing kref problems\n");
- z3fold_page_unlock(zhdr);
- return false;
- }
- z3fold_page_unlock(zhdr);
- return false;
- }
-
-
- z3fold_inc_isolated(pool);
spin_unlock(&pool->lock);
z3fold_page_unlock(zhdr);
return true;
@@ -1483,10 +1401,6 @@ static int z3fold_page_migrate(struct ad
queue_work_on(new_zhdr->cpu, pool->compact_wq, &new_zhdr->work);
- spin_lock(&pool->lock);
- z3fold_dec_isolated(pool);
- spin_unlock(&pool->lock);
-
page_mapcount_reset(page);
put_page(page);
return 0;
@@ -1506,14 +1420,10 @@ static void z3fold_page_putback(struct p
INIT_LIST_HEAD(&page->lru);
if (kref_put(&zhdr->refcount, release_z3fold_page_locked)) {
atomic64_dec(&pool->pages_nr);
- spin_lock(&pool->lock);
- z3fold_dec_isolated(pool);
- spin_unlock(&pool->lock);
return;
}
spin_lock(&pool->lock);
list_add(&page->lru, &pool->lru);
- z3fold_dec_isolated(pool);
spin_unlock(&pool->lock);
z3fold_page_unlock(zhdr);
}
_
Patches currently in -mm which might be from vitalywool(a)gmail.com are
revert-mm-z3foldc-fix-race-between-migration-and-destruction.patch
If both interrupts are set in the current implementation
only the 1st will be handled and the 2nd will be skipped
due to the "if else" condition.
Fix this by using the same approach as done for QCA955x
just below it.
Fixes: fce5cc6e0ddc ("MIPS: ath79: add IRQ handling code for AR934X")
Signed-off-by: Koen Vandeputte <koen.vandeputte(a)ncentric.com>
CC: Felix Fietkau <nbd(a)nbd.name>
CC: Gabor Juhos <juhosg(a)freemail.hu>
CC: James Hogan <jhogan(a)kernel.org>
CC: Paul Burton <paul.burton(a)mips.com>
CC: Ralf Baechle <ralf(a)linux-mips.org>
CC: stable(a)vger.kernel.org # v3.2+
---
NOTE!
The file irq.c got deleted in commit 51fa4f8912c0 ("MIPS: ath79: drop legacy IRQ code")
which was included in 5.0-RC2.
Therefore, the patch below was crafted on
tree: linux-stable
branch: linux-4.19.y
V2:
- fix copy/paste error in code due to rebasing
arch/mips/ath79/irq.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/arch/mips/ath79/irq.c b/arch/mips/ath79/irq.c
index 2dfff1f19004..a03a6bcaf6fd 100644
--- a/arch/mips/ath79/irq.c
+++ b/arch/mips/ath79/irq.c
@@ -32,15 +32,21 @@ static void ar934x_ip2_irq_dispatch(struct irq_desc *desc)
u32 status;
status = ath79_reset_rr(AR934X_RESET_REG_PCIE_WMAC_INT_STATUS);
+ status &= AR934X_PCIE_WMAC_INT_PCIE_ALL | AR934X_PCIE_WMAC_INT_WMAC_ALL;
+
+ if (status == 0) {
+ spurious_interrupt();
+ return;
+ }
if (status & AR934X_PCIE_WMAC_INT_PCIE_ALL) {
ath79_ddr_wb_flush(3);
generic_handle_irq(ATH79_IP2_IRQ(0));
- } else if (status & AR934X_PCIE_WMAC_INT_WMAC_ALL) {
+ }
+
+ if (status & AR934X_PCIE_WMAC_INT_WMAC_ALL) {
ath79_ddr_wb_flush(4);
generic_handle_irq(ATH79_IP2_IRQ(1));
- } else {
- spurious_interrupt();
}
}
--
2.17.1
Currently frame registrations are not purged, even when changing the
interface type. This can lead to potentially weird / dangerous
situations where frames possibly not relevant to a given interface
type remain registered and mgmt_frame_register is not called for the
no-longer-relevant frame types.
The kernel currently relies on userspace apps to actually purge the
registrations themselves, e.g. by closing the nl80211 socket associated
with those frames. However, this requires multiple nl80211 sockets to
be open by the userspace app, and for userspace to be aware of all state
changes. This is not something that the kernel should rely on.
This commit adds a call to cfg80211_mlme_purge_registrations() to
forcefully remove any registrations left over prior to switching the
iftype.
Cc: stable(a)vger.kernel.org
Signed-off-by: Denis Kenzior <denkenz(a)gmail.com>
---
net/wireless/util.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index c99939067bb0..3fa092b78e62 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -964,6 +964,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
}
cfg80211_process_rdev_events(rdev);
+ cfg80211_mlme_purge_registrations(dev->ieee80211_ptr);
}
err = rdev_change_virtual_intf(rdev, dev, ntype, params);
--
2.19.2
Another day; another DSDT bug we need to workaround...
Since commit ca876c7483b6 ("gpiolib-acpi: make sure we trigger edge events
at least once on boot") we call _AEI edge handlers at boot.
In some rare cases this causes problems. One example of this is the Minix
Neo Z83-4 mini PC, this device has a clear DSDT bug where it has some copy
and pasted code for dealing with Micro USB-B connector host/device role
switching, while the mini PC does not even have a micro-USB connector.
This code, which should not be there, messes with the DDC data pin from
the HDMI connector (switching it to GPIO mode) breaking HDMI support.
To avoid problems like this, this commit adds a new
gpiolib_acpi.run_edge_events_on_boot kernel commandline option, which
allows disabling the running of _AEI edge event handlers at boot.
The default value is -1/auto which uses a DMI based blacklist, the initial
version of this blacklist contains the Neo Z83-4 fixing the HDMI breakage.
Cc: stable(a)vger.kernel.org
Cc: Daniel Drake <drake(a)endlessm.com>
Cc: Ian W MORRISON <ianwmorrison(a)gmail.com>
Reported-by: Ian W MORRISON <ianwmorrison(a)gmail.com>
Suggested-by: Ian W MORRISON <ianwmorrison(a)gmail.com>
Fixes: ca876c7483b6 ("gpiolib-acpi: make sure we trigger edge events at least once on boot")
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
Changes in v2:
- Use a module_param instead of __setup
- Do DMI check only once from a postcore_initcall
---
drivers/gpio/gpiolib-acpi.c | 42 +++++++++++++++++++++++++++++++++----
1 file changed, 38 insertions(+), 4 deletions(-)
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 39f2f9035c11..bda28eb82c3f 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -7,6 +7,7 @@
* Mika Westerberg <mika.westerberg(a)linux.intel.com>
*/
+#include <linux/dmi.h>
#include <linux/errno.h>
#include <linux/gpio/consumer.h>
#include <linux/gpio/driver.h>
@@ -19,6 +20,11 @@
#include "gpiolib.h"
+static int run_edge_events_on_boot = -1;
+module_param(run_edge_events_on_boot, int, 0444);
+MODULE_PARM_DESC(run_edge_events_on_boot,
+ "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto");
+
/**
* struct acpi_gpio_event - ACPI GPIO event handler data
*
@@ -170,10 +176,13 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,
event->irq_requested = true;
/* Make sure we trigger the initial state of edge-triggered IRQs */
- value = gpiod_get_raw_value_cansleep(event->desc);
- if (((event->irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
- ((event->irqflags & IRQF_TRIGGER_FALLING) && value == 0))
- event->handler(event->irq, event);
+ if (run_edge_events_on_boot &&
+ (event->irqflags & (IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING))) {
+ value = gpiod_get_raw_value_cansleep(event->desc);
+ if (((event->irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+ ((event->irqflags & IRQF_TRIGGER_FALLING) && value == 0))
+ event->handler(event->irq, event);
+ }
}
static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio)
@@ -1283,3 +1292,28 @@ static int acpi_gpio_handle_deferred_request_irqs(void)
}
/* We must use _sync so that this runs after the first deferred_probe run */
late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
+
+static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = {
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MINIX"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"),
+ }
+ },
+ {} /* Terminating entry */
+};
+
+static int acpi_gpio_setup_params(void)
+{
+ if (run_edge_events_on_boot < 0) {
+ if (dmi_check_system(run_edge_events_on_boot_blacklist))
+ run_edge_events_on_boot = 0;
+ else
+ run_edge_events_on_boot = 1;
+ }
+
+ return 0;
+}
+
+/* Directly after dmi_setup() which runs as core_initcall() */
+postcore_initcall(acpi_gpio_setup_params);
--
2.23.0
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b9ee5e04fd77898208c51b1395fa0b5e8536f9b6 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy(a)c-s.fr>
Date: Thu, 8 Aug 2019 12:48:26 +0000
Subject: [PATCH] powerpc/64e: Drop stale call to smp_processor_id() which
hangs SMP startup
Commit ebb9d30a6a74 ("powerpc/mm: any thread in one core can be the
first to setup TLB1") removed the need to know the cpu_id in
early_init_this_mmu(), but the call to smp_processor_id() which was
marked __maybe_used remained.
Since commit ed1cd6deb013 ("powerpc: Activate CONFIG_THREAD_INFO_IN_TASK")
thread_info cannot be reached before MMU is properly set up.
Drop this stale call to smp_processor_id() which makes SMP hang when
CONFIG_PREEMPT is set.
Fixes: ebb9d30a6a74 ("powerpc/mm: any thread in one core can be the first to setup TLB1")
Fixes: ed1cd6deb013 ("powerpc: Activate CONFIG_THREAD_INFO_IN_TASK")
Cc: stable(a)vger.kernel.org # v5.1+
Reported-by: Chris Packham <Chris.Packham(a)alliedtelesis.co.nz>
Signed-off-by: Christophe Leroy <christophe.leroy(a)c-s.fr>
Tested-by: Chris Packham <chris.packham(a)alliedtelesis.co.nz>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Link: https://lore.kernel.org/r/bef479514f4c08329fa649f67735df8918bc0976.15652682…
diff --git a/arch/powerpc/mm/nohash/tlb.c b/arch/powerpc/mm/nohash/tlb.c
index d4acf6fa0596..bf60983a58c7 100644
--- a/arch/powerpc/mm/nohash/tlb.c
+++ b/arch/powerpc/mm/nohash/tlb.c
@@ -630,7 +630,6 @@ static void early_init_this_mmu(void)
#ifdef CONFIG_PPC_FSL_BOOK3E
if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
unsigned int num_cams;
- int __maybe_unused cpu = smp_processor_id();
bool map = true;
/* use a quarter of the TLBCAM for bolted linear map */
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From a8318c13e79badb92bc6640704a64cc022a6eb97 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gromero(a)linux.ibm.com>
Date: Wed, 4 Sep 2019 00:55:28 -0400
Subject: [PATCH] powerpc/tm: Fix restoring FP/VMX facility incorrectly on
interrupts
When in userspace and MSR FP=0 the hardware FP state is unrelated to
the current process. This is extended for transactions where if tbegin
is run with FP=0, the hardware checkpoint FP state will also be
unrelated to the current process. Due to this, we need to ensure this
hardware checkpoint is updated with the correct state before we enable
FP for this process.
Unfortunately we get this wrong when returning to a process from a
hardware interrupt. A process that starts a transaction with FP=0 can
take an interrupt. When the kernel returns back to that process, we
change to FP=1 but with hardware checkpoint FP state not updated. If
this transaction is then rolled back, the FP registers now contain the
wrong state.
The process looks like this:
Userspace: Kernel
Start userspace
with MSR FP=0 TM=1
< -----
...
tbegin
bne
Hardware interrupt
---- >
<do_IRQ...>
....
ret_from_except
restore_math()
/* sees FP=0 */
restore_fp()
tm_active_with_fp()
/* sees FP=1 (Incorrect) */
load_fp_state()
FP = 0 -> 1
< -----
Return to userspace
with MSR TM=1 FP=1
with junk in the FP TM checkpoint
TM rollback
reads FP junk
When returning from the hardware exception, tm_active_with_fp() is
incorrectly making restore_fp() call load_fp_state() which is setting
FP=1.
The fix is to remove tm_active_with_fp().
tm_active_with_fp() is attempting to handle the case where FP state
has been changed inside a transaction. In this case the checkpointed
and transactional FP state is different and hence we must restore the
FP state (ie. we can't do lazy FP restore inside a transaction that's
used FP). It's safe to remove tm_active_with_fp() as this case is
handled by restore_tm_state(). restore_tm_state() detects if FP has
been using inside a transaction and will set load_fp and call
restore_math() to ensure the FP state (checkpoint and transaction) is
restored.
This is a data integrity problem for the current process as the FP
registers are corrupted. It's also a security problem as the FP
registers from one process may be leaked to another.
Similarly for VMX.
A simple testcase to replicate this will be posted to
tools/testing/selftests/powerpc/tm/tm-poison.c
This fixes CVE-2019-15031.
Fixes: a7771176b439 ("powerpc: Don't enable FP/Altivec if not checkpointed")
Cc: stable(a)vger.kernel.org # 4.15+
Signed-off-by: Gustavo Romero <gromero(a)linux.ibm.com>
Signed-off-by: Michael Neuling <mikey(a)neuling.org>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Link: https://lore.kernel.org/r/20190904045529.23002-2-gromero@linux.vnet.ibm.com
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 437b57068cf8..7a84c9f1778e 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -101,21 +101,8 @@ static void check_if_tm_restore_required(struct task_struct *tsk)
}
}
-static bool tm_active_with_fp(struct task_struct *tsk)
-{
- return MSR_TM_ACTIVE(tsk->thread.regs->msr) &&
- (tsk->thread.ckpt_regs.msr & MSR_FP);
-}
-
-static bool tm_active_with_altivec(struct task_struct *tsk)
-{
- return MSR_TM_ACTIVE(tsk->thread.regs->msr) &&
- (tsk->thread.ckpt_regs.msr & MSR_VEC);
-}
#else
static inline void check_if_tm_restore_required(struct task_struct *tsk) { }
-static inline bool tm_active_with_fp(struct task_struct *tsk) { return false; }
-static inline bool tm_active_with_altivec(struct task_struct *tsk) { return false; }
#endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
bool strict_msr_control;
@@ -252,7 +239,7 @@ EXPORT_SYMBOL(enable_kernel_fp);
static int restore_fp(struct task_struct *tsk)
{
- if (tsk->thread.load_fp || tm_active_with_fp(tsk)) {
+ if (tsk->thread.load_fp) {
load_fp_state(¤t->thread.fp_state);
current->thread.load_fp++;
return 1;
@@ -334,8 +321,7 @@ EXPORT_SYMBOL_GPL(flush_altivec_to_thread);
static int restore_altivec(struct task_struct *tsk)
{
- if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
- (tsk->thread.load_vec || tm_active_with_altivec(tsk))) {
+ if (cpu_has_feature(CPU_FTR_ALTIVEC) && (tsk->thread.load_vec)) {
load_vr_state(&tsk->thread.vr_state);
tsk->thread.used_vr = 1;
tsk->thread.load_vec++;
If both interrupts are set in the current implementation
only the 1st will be handled and the 2nd will be skipped
due to the "if else" condition.
Fix this by using the same approach as done for QCA955x
just below it.
Fixes: fce5cc6e0ddc ("MIPS: ath79: add IRQ handling code for AR934X")
Signed-off-by: Koen Vandeputte <koen.vandeputte(a)ncentric.com>
CC: Felix Fietkau <nbd(a)nbd.name>
CC: Gabor Juhos <juhosg(a)freemail.hu>
CC: James Hogan <jhogan(a)kernel.org>
CC: Paul Burton <paul.burton(a)mips.com>
CC: Ralf Baechle <ralf(a)linux-mips.org>
CC: stable(a)vger.kernel.org # v3.2+
---
NOTE!
The file irq.c got deleted in commit 51fa4f8912c0 ("MIPS: ath79: drop legacy IRQ code")
which was included in 5.0-RC2.
Therefore, the patch below was crafted on
tree: linux-stable
branch: linux-4.19.y
arch/mips/ath79/irq.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/arch/mips/ath79/irq.c b/arch/mips/ath79/irq.c
index 2dfff1f19004..372431660cc7 100644
--- a/arch/mips/ath79/irq.c
+++ b/arch/mips/ath79/irq.c
@@ -32,15 +32,21 @@ static void ar934x_ip2_irq_dispatch(struct irq_desc *desc)
u32 status;
status = ath79_reset_rr(AR934X_RESET_REG_PCIE_WMAC_INT_STATUS);
+ status &= AR934X_PCIE_WMAC_INT_PCIE_ALL | AR934X_PCIE_WMAC_INT_WMAC_ALL;
+
+ if (status == 0) {
+ spurious_interrupt();
+ return;
+ }
if (status & AR934X_PCIE_WMAC_INT_PCIE_ALL) {
ath79_ddr_wb_flush(3);
- generic_handle_irq(ATH79_IP2_IRQ(0));
- } else if (status & AR934X_PCIE_WMAC_INT_WMAC_ALL) {
+ generic_handle_irq(ATH79_IP2_IRQ(0)););
+ }
+
+ if (status & AR934X_PCIE_WMAC_INT_WMAC_ALL) {
ath79_ddr_wb_flush(4);
generic_handle_irq(ATH79_IP2_IRQ(1));
- } else {
- spurious_interrupt();
}
}
--
2.17.1
If userspace doesn't set KVM_MEM_LOG_DIRTY_PAGES on memslot before calling
kvm_s390_vm_start_migration(), kernel will oops with:
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 0000000000000000 TEID: 0000000000000483
Fault in home space mode while using kernel ASCE.
AS:0000000002a2000b R2:00000001bff8c00b R3:00000001bff88007 S:00000001bff91000 P:000000000000003d
Oops: 0004 ilc:2 [#1] SMP
...
Call Trace:
([<001fffff804ec552>] kvm_s390_vm_set_attr+0x347a/0x3828 [kvm])
[<001fffff804ecfc0>] kvm_arch_vm_ioctl+0x6c0/0x1998 [kvm]
[<001fffff804b67e4>] kvm_vm_ioctl+0x51c/0x11a8 [kvm]
[<00000000008ba572>] do_vfs_ioctl+0x1d2/0xe58
[<00000000008bb284>] ksys_ioctl+0x8c/0xb8
[<00000000008bb2e2>] sys_ioctl+0x32/0x40
[<000000000175552c>] system_call+0x2b8/0x2d8
INFO: lockdep is turned off.
Last Breaking-Event-Address:
[<0000000000dbaf60>] __memset+0xc/0xa0
due to ms->dirty_bitmap being NULL, which might crash the host.
Make sure that ms->dirty_bitmap is set before using it or
return -ENIVAL otherwise.
Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots")
Signed-off-by: Igor Mammedov <imammedo(a)redhat.com>
---
Cc: stable(a)vger.kernel.org # v4.19+
v2:
- remove not true anym 'warning' clause in commit message
v2:
- drop WARN()
arch/s390/kvm/kvm-s390.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f329dcb3f44c..2a40cd3e40b4 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1018,6 +1018,8 @@ static int kvm_s390_vm_start_migration(struct kvm *kvm)
/* mark all the pages in active slots as dirty */
for (slotnr = 0; slotnr < slots->used_slots; slotnr++) {
ms = slots->memslots + slotnr;
+ if (!ms->dirty_bitmap)
+ return -EINVAL;
/*
* The second half of the bitmap is only used on x86,
* and would be wasted otherwise, so we put it to good
--
2.18.1
wt., 10 wrz 2019 o 12:48 Sasha Levin <sashal(a)kernel.org> napisał(a):
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: c663e5f56737 gpio: support native single-ended hardware drivers.
>
> The bot has tested the following trees: v5.2.13, v4.19.71, v4.14.142, v4.9.191.
>
> v5.2.13: Build OK!
> v4.19.71: Build OK!
> v4.14.142: Failed to apply! Possible dependencies:
> 02e479808b5d ("gpio: Alter semantics of *raw* operations to actually be raw")
> fac9d8850a0c ("gpio: Get rid of _prefix and __prefixes")
>
> v4.9.191: Failed to apply! Possible dependencies:
> 02e479808b5d ("gpio: Alter semantics of *raw* operations to actually be raw")
> 0db0f26c2c5d ("pinctrl-sx150x: Convert driver to use regmap API")
> 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips")
> 46a5c112a401 ("gpio: merrifield: Implement gpio_get_direction callback")
> 6489677f86c3 ("pinctrl-sx150x: Replace sx150x_*_cfg by means of regmap API")
> 6697546d650d ("pinctrl-sx150x: Add SX1503 specific data")
> 9e80f9064e73 ("pinctrl: Add SX150X GPIO Extender Pinctrl Driver")
> e3ba81206811 ("pinctrl-sx150x: Improve OF device matching code")
> e7a718f9b1c1 ("gpio: merrifield: Add support for hardware debouncer")
>
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
>
Once it's accepted, I'll prepare backports.
Bart
On Wed, Sep 04, 2019 at 08:16:45AM +0000, David Laight wrote:
> From: Nathan Chancellor [mailto:natechancellor@gmail.com]
> > Fair enough so I guess we are back to just outright disabling the
> > warning.
>
> Just disabling the warning won't stop the compiler generating code
> that breaks a 'user' implementation of setjmp().
Yeah. I have a patch (will send in an hour or so) that enables the
"returns_twice" attribute for setjmp (in <asm/setjmp.h>). In testing
(with GCC trunk) it showed no difference in code generation, but
better save than sorry.
It also sets "noreturn" on longjmp, and that *does* help, it saves a
hundred insns or so (all in xmon, no surprise there).
I don't think this will make LLVM shut up about this though. And
technically it is right: the C standard does say that in hosted mode
setjmp is a reserved name and you need to include <setjmp.h> to access
it (not <asm/setjmp.h>).
So why is the kernel compiled as hosted? Does adding -ffreestanding
hurt anything? Is that actually supported on LLVM, on all relevant
versions of it? Does it shut up the warning there (if not, that would
be an LLVM bug)?
Segher
If userspace doesn't set KVM_MEM_LOG_DIRTY_PAGES on memslot before calling
kvm_s390_vm_start_migration(), kernel will oops with:
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 0000000000000000 TEID: 0000000000000483
Fault in home space mode while using kernel ASCE.
AS:0000000002a2000b R2:00000001bff8c00b R3:00000001bff88007 S:00000001bff91000 P:000000000000003d
Oops: 0004 ilc:2 [#1] SMP
...
Call Trace:
([<001fffff804ec552>] kvm_s390_vm_set_attr+0x347a/0x3828 [kvm])
[<001fffff804ecfc0>] kvm_arch_vm_ioctl+0x6c0/0x1998 [kvm]
[<001fffff804b67e4>] kvm_vm_ioctl+0x51c/0x11a8 [kvm]
[<00000000008ba572>] do_vfs_ioctl+0x1d2/0xe58
[<00000000008bb284>] ksys_ioctl+0x8c/0xb8
[<00000000008bb2e2>] sys_ioctl+0x32/0x40
[<000000000175552c>] system_call+0x2b8/0x2d8
INFO: lockdep is turned off.
Last Breaking-Event-Address:
[<0000000000dbaf60>] __memset+0xc/0xa0
due to ms->dirty_bitmap being NULL, which might crash the host.
Make sure that ms->dirty_bitmap is set before using it or
print a warning and return -ENIVAL otherwise.
Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots")
Signed-off-by: Igor Mammedov <imammedo(a)redhat.com>
---
Cc: stable(a)vger.kernel.org # v4.19+
v2:
- drop WARN()
arch/s390/kvm/kvm-s390.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f329dcb3f44c..2a40cd3e40b4 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1018,6 +1018,8 @@ static int kvm_s390_vm_start_migration(struct kvm *kvm)
/* mark all the pages in active slots as dirty */
for (slotnr = 0; slotnr < slots->used_slots; slotnr++) {
ms = slots->memslots + slotnr;
+ if (!ms->dirty_bitmap)
+ return -EINVAL;
/*
* The second half of the bitmap is only used on x86,
* and would be wasted otherwise, so we put it to good
--
2.18.1
These patches support upcoming UV systems that do not have a UV HUB.
* Save OEM_ID from ACPI MADT probe
* Return UV Hubless System Type
* Add return code to UV BIOS Init function
* Setup UV functions for Hubless UV Systems
* Add UV Hubbed/Hubless Proc FS Files
* Decode UVsystab Info
* Account for UV Hubless in is_uvX_hub Ops
--
From: Stefan Assmann <sassmann(a)kpanic.de>
While testing VF spawn/destroy the following panic occurred.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000029
[...]
Workqueue: i40e i40e_service_task [i40e]
RIP: 0010:i40e_sync_vsi_filters+0x6fd/0xc60 [i40e]
[...]
Call Trace:
? __switch_to_asm+0x35/0x70
? __switch_to_asm+0x41/0x70
? __switch_to_asm+0x35/0x70
? _cond_resched+0x15/0x30
i40e_sync_filters_subtask+0x56/0x70 [i40e]
i40e_service_task+0x382/0x11b0 [i40e]
? __switch_to_asm+0x41/0x70
? __switch_to_asm+0x41/0x70
process_one_work+0x1a7/0x3b0
worker_thread+0x30/0x390
? create_worker+0x1a0/0x1a0
kthread+0x112/0x130
? kthread_bind+0x30/0x30
ret_from_fork+0x35/0x40
Investigation revealed a race where pf->vf[vsi->vf_id].trusted may get
accessed by the watchdog via i40e_sync_filters_subtask() although
i40e_free_vfs() already free'd pf->vf.
To avoid this the call to i40e_sync_vsi_filters() in
i40e_sync_filters_subtask() needs to be guarded by __I40E_VF_DISABLE,
which is also used by i40e_free_vfs().
Note: put the __I40E_VF_DISABLE check after the
__I40E_MACVLAN_SYNC_PENDING check as the latter is more likely to
trigger.
CC: stable(a)vger.kernel.org
Signed-off-by: Stefan Assmann <sassmann(a)kpanic.de>
Tested-by: Andrew Bowers <andrewx.bowers(a)intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher(a)intel.com>
---
drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index e9f2f276bf27..3e2e465f43f9 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -2592,6 +2592,10 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
return;
if (!test_and_clear_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state))
return;
+ if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) {
+ set_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state);
+ return;
+ }
for (v = 0; v < pf->num_alloc_vsi; v++) {
if (pf->vsi[v] &&
@@ -2606,6 +2610,7 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
}
}
}
+ clear_bit(__I40E_VF_DISABLE, pf->state);
}
/**
--
2.21.0
From: Cong Wang <xiyou.wangcong(a)gmail.com>
commit dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399 upstream.
In commit 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
I introduced a check for xfrm protocol, but according to Herbert
IPSEC_PROTO_ANY should only be used as a wildcard for lookup, so
it should be removed from validate_tmpl().
And, IPSEC_PROTO_ANY is expected to only match 3 IPSec-specific
protocols, this is why xfrm_state_flush() could still miss
IPPROTO_ROUTING, which leads that those entries are left in
net->xfrm.state_all before exit net. Fix this by replacing
IPSEC_PROTO_ANY with zero.
This patch also extracts the check from validate_tmpl() to
xfrm_id_proto_valid() and uses it in parse_ipsecrequest().
With this, no other protocols should be added into xfrm.
Fixes: 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
Reported-by: syzbot+0bf0519d6e0de15914fe(a)syzkaller.appspotmail.com
Cc: Steffen Klassert <steffen.klassert(a)secunet.com>
Cc: Herbert Xu <herbert(a)gondor.apana.org.au>
Signed-off-by: Cong Wang <xiyou.wangcong(a)gmail.com>
Acked-by: Herbert Xu <herbert(a)gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com>
Signed-off-by: Zubin Mithra <zsm(a)chromium.org>
---
Notes:
* Syzkaller triggered a WARNING with the following stacktrace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x114/0x1cf lib/dump_stack.c:53
panic+0x1bb/0x3a0 kernel/panic.c:181
__warn.cold.9+0x149/0x186 kernel/panic.c:542
report_bug+0x1f7/0x272 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
do_error_trap+0x1c1/0x430 arch/x86/kernel/traps.c:295
do_invalid_op+0x20/0x30 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
xfrm_net_exit+0x2a/0x30 net/xfrm/xfrm_policy.c:2971
ops_exit_list.isra.11+0xb5/0x160 net/core/net_namespace.c:142
cleanup_net+0x575/0xab0 net/core/net_namespace.c:483
process_one_work+0xb5c/0x1950 kernel/workqueue.c:2114
worker_thread+0x224/0x18c0 kernel/workqueue.c:2248
kthread+0x359/0x430 kernel/kthread.c:231
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
* The commit is present in linux-4.19.y. A backport for linux-4.4.y will
be sent separately.
* The patch resolves the following conflicts:
- conflicts in content of xfrm6_tunnel_net_exit()
- changes in the prototype of xfrm_state_flush()
- ordering of xfrm_state_flush(...) and flush_work(&xfrm_state_gc_work)
inside xfrm_state_fini.
* Tests run: Chrome OS tryjobs, syzkaller reproducer
include/net/xfrm.h | 17 +++++++++++++++++
net/key/af_key.c | 4 +++-
net/xfrm/xfrm_state.c | 2 +-
net/xfrm/xfrm_user.c | 14 +-------------
4 files changed, 22 insertions(+), 15 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index bdf185ae93db..57b8b11cf7d4 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1366,6 +1366,23 @@ static inline int xfrm_state_kern(const struct xfrm_state *x)
return atomic_read(&x->tunnel_users);
}
+static inline bool xfrm_id_proto_valid(u8 proto)
+{
+ switch (proto) {
+ case IPPROTO_AH:
+ case IPPROTO_ESP:
+ case IPPROTO_COMP:
+#if IS_ENABLED(CONFIG_IPV6)
+ case IPPROTO_ROUTING:
+ case IPPROTO_DSTOPTS:
+#endif
+ return true;
+ default:
+ return false;
+ }
+}
+
+/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
{
return (!userproto || proto == userproto ||
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ac38b47e9f86..f8f7065f7b62 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1951,8 +1951,10 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
if (rq->sadb_x_ipsecrequest_mode == 0)
return -EINVAL;
+ if (!xfrm_id_proto_valid(rq->sadb_x_ipsecrequest_proto))
+ return -EINVAL;
- t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */
+ t->id.proto = rq->sadb_x_ipsecrequest_proto;
if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0)
return -EINVAL;
t->mode = mode;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 7c093de68780..bd16e6882017 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2330,7 +2330,7 @@ void xfrm_state_fini(struct net *net)
unsigned int sz;
flush_work(&net->xfrm.state_hash_work);
- xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
+ xfrm_state_flush(net, 0, false);
flush_work(&xfrm_state_gc_work);
WARN_ON(!list_empty(&net->xfrm.state_all));
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 150c58dc8a7b..339a070da597 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1489,20 +1489,8 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
return -EINVAL;
}
- switch (ut[i].id.proto) {
- case IPPROTO_AH:
- case IPPROTO_ESP:
- case IPPROTO_COMP:
-#if IS_ENABLED(CONFIG_IPV6)
- case IPPROTO_ROUTING:
- case IPPROTO_DSTOPTS:
-#endif
- case IPSEC_PROTO_ANY:
- break;
- default:
+ if (!xfrm_id_proto_valid(ut[i].id.proto))
return -EINVAL;
- }
-
}
return 0;
--
2.23.0.162.g0b9fbb3734-goog
2 bytes in MSB of register for clock status is zero during intermediate
state after changing status of sampling clock in models of TASCAM FireWire
series. The duration of this state differs depending on cases. During the
state, it's better to retry reading the register for current status of
the clock.
In current implementation, the intermediate state is checked only when
getting current sampling transmission frequency, then retry reading.
This care is required for the other operations to read the register.
This commit moves the codes of check and retry into helper function
commonly used for operations to read the register.
Fixes: e453df44f0d6 ("ALSA: firewire-tascam: add PCM functionality")
Cc: <stable(a)vger.kernel.org> # v4.4+
Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
---
sound/firewire/tascam/tascam-stream.c | 42 ++++++++++++++++++---------
1 file changed, 28 insertions(+), 14 deletions(-)
diff --git a/sound/firewire/tascam/tascam-stream.c b/sound/firewire/tascam/tascam-stream.c
index 9e2dc2fe3271..adf69a520b80 100644
--- a/sound/firewire/tascam/tascam-stream.c
+++ b/sound/firewire/tascam/tascam-stream.c
@@ -8,20 +8,37 @@
#include <linux/delay.h>
#include "tascam.h"
+#define CLOCK_STATUS_MASK 0xffff0000
+#define CLOCK_CONFIG_MASK 0x0000ffff
+
#define CALLBACK_TIMEOUT 500
static int get_clock(struct snd_tscm *tscm, u32 *data)
{
+ int trial = 0;
__be32 reg;
int err;
- err = snd_fw_transaction(tscm->unit, TCODE_READ_QUADLET_REQUEST,
- TSCM_ADDR_BASE + TSCM_OFFSET_CLOCK_STATUS,
- ®, sizeof(reg), 0);
- if (err >= 0)
+ while (trial++ < 5) {
+ err = snd_fw_transaction(tscm->unit, TCODE_READ_QUADLET_REQUEST,
+ TSCM_ADDR_BASE + TSCM_OFFSET_CLOCK_STATUS,
+ ®, sizeof(reg), 0);
+ if (err < 0)
+ return err;
+
*data = be32_to_cpu(reg);
+ if (*data & CLOCK_STATUS_MASK)
+ break;
- return err;
+ // In intermediate state after changing clock status.
+ msleep(50);
+ }
+
+ // Still in the intermediate state.
+ if (trial >= 5)
+ return -EAGAIN;
+
+ return 0;
}
static int set_clock(struct snd_tscm *tscm, unsigned int rate,
@@ -34,7 +51,7 @@ static int set_clock(struct snd_tscm *tscm, unsigned int rate,
err = get_clock(tscm, &data);
if (err < 0)
return err;
- data &= 0x0000ffff;
+ data &= CLOCK_CONFIG_MASK;
if (rate > 0) {
data &= 0x000000ff;
@@ -79,17 +96,14 @@ static int set_clock(struct snd_tscm *tscm, unsigned int rate,
int snd_tscm_stream_get_rate(struct snd_tscm *tscm, unsigned int *rate)
{
- u32 data = 0x0;
- unsigned int trials = 0;
+ u32 data;
int err;
- while (data == 0x0 || trials++ < 5) {
- err = get_clock(tscm, &data);
- if (err < 0)
- return err;
+ err = get_clock(tscm, &data);
+ if (err < 0)
+ return err;
- data = (data & 0xff000000) >> 24;
- }
+ data = (data & 0xff000000) >> 24;
/* Check base rate. */
if ((data & 0x0f) == 0x01)
--
2.20.1
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b9ee5e04fd77898208c51b1395fa0b5e8536f9b6 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy(a)c-s.fr>
Date: Thu, 8 Aug 2019 12:48:26 +0000
Subject: [PATCH] powerpc/64e: Drop stale call to smp_processor_id() which
hangs SMP startup
Commit ebb9d30a6a74 ("powerpc/mm: any thread in one core can be the
first to setup TLB1") removed the need to know the cpu_id in
early_init_this_mmu(), but the call to smp_processor_id() which was
marked __maybe_used remained.
Since commit ed1cd6deb013 ("powerpc: Activate CONFIG_THREAD_INFO_IN_TASK")
thread_info cannot be reached before MMU is properly set up.
Drop this stale call to smp_processor_id() which makes SMP hang when
CONFIG_PREEMPT is set.
Fixes: ebb9d30a6a74 ("powerpc/mm: any thread in one core can be the first to setup TLB1")
Fixes: ed1cd6deb013 ("powerpc: Activate CONFIG_THREAD_INFO_IN_TASK")
Cc: stable(a)vger.kernel.org # v5.1+
Reported-by: Chris Packham <Chris.Packham(a)alliedtelesis.co.nz>
Signed-off-by: Christophe Leroy <christophe.leroy(a)c-s.fr>
Tested-by: Chris Packham <chris.packham(a)alliedtelesis.co.nz>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Link: https://lore.kernel.org/r/bef479514f4c08329fa649f67735df8918bc0976.15652682…
diff --git a/arch/powerpc/mm/nohash/tlb.c b/arch/powerpc/mm/nohash/tlb.c
index d4acf6fa0596..bf60983a58c7 100644
--- a/arch/powerpc/mm/nohash/tlb.c
+++ b/arch/powerpc/mm/nohash/tlb.c
@@ -630,7 +630,6 @@ static void early_init_this_mmu(void)
#ifdef CONFIG_PPC_FSL_BOOK3E
if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
unsigned int num_cams;
- int __maybe_unused cpu = smp_processor_id();
bool map = true;
/* use a quarter of the TLBCAM for bolted linear map */
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b9ee5e04fd77898208c51b1395fa0b5e8536f9b6 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy(a)c-s.fr>
Date: Thu, 8 Aug 2019 12:48:26 +0000
Subject: [PATCH] powerpc/64e: Drop stale call to smp_processor_id() which
hangs SMP startup
Commit ebb9d30a6a74 ("powerpc/mm: any thread in one core can be the
first to setup TLB1") removed the need to know the cpu_id in
early_init_this_mmu(), but the call to smp_processor_id() which was
marked __maybe_used remained.
Since commit ed1cd6deb013 ("powerpc: Activate CONFIG_THREAD_INFO_IN_TASK")
thread_info cannot be reached before MMU is properly set up.
Drop this stale call to smp_processor_id() which makes SMP hang when
CONFIG_PREEMPT is set.
Fixes: ebb9d30a6a74 ("powerpc/mm: any thread in one core can be the first to setup TLB1")
Fixes: ed1cd6deb013 ("powerpc: Activate CONFIG_THREAD_INFO_IN_TASK")
Cc: stable(a)vger.kernel.org # v5.1+
Reported-by: Chris Packham <Chris.Packham(a)alliedtelesis.co.nz>
Signed-off-by: Christophe Leroy <christophe.leroy(a)c-s.fr>
Tested-by: Chris Packham <chris.packham(a)alliedtelesis.co.nz>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Link: https://lore.kernel.org/r/bef479514f4c08329fa649f67735df8918bc0976.15652682…
diff --git a/arch/powerpc/mm/nohash/tlb.c b/arch/powerpc/mm/nohash/tlb.c
index d4acf6fa0596..bf60983a58c7 100644
--- a/arch/powerpc/mm/nohash/tlb.c
+++ b/arch/powerpc/mm/nohash/tlb.c
@@ -630,7 +630,6 @@ static void early_init_this_mmu(void)
#ifdef CONFIG_PPC_FSL_BOOK3E
if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
unsigned int num_cams;
- int __maybe_unused cpu = smp_processor_id();
bool map = true;
/* use a quarter of the TLBCAM for bolted linear map */
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 264b563b8675771834419057cbe076c1a41fb666 Mon Sep 17 00:00:00 2001
From: Tiwei Bie <tiwei.bie(a)intel.com>
Date: Wed, 28 Aug 2019 13:37:00 +0800
Subject: [PATCH] vhost/test: fix build for vhost test
Since vhost_exceeds_weight() was introduced, callers need to specify
the packet weight and byte weight in vhost_dev_init(). Note that, the
packet weight isn't counted in this patch to keep the original behavior
unchanged.
Fixes: e82b9b0727ff ("vhost: introduce vhost_exceeds_weight()")
Cc: stable(a)vger.kernel.org
Signed-off-by: Tiwei Bie <tiwei.bie(a)intel.com>
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
Acked-by: Jason Wang <jasowang(a)redhat.com>
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index ac4f762c4f65..7804869c6a31 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -22,6 +22,12 @@
* Using this limit prevents one virtqueue from starving others. */
#define VHOST_TEST_WEIGHT 0x80000
+/* Max number of packets transferred before requeueing the job.
+ * Using this limit prevents one virtqueue from starving others with
+ * pkts.
+ */
+#define VHOST_TEST_PKT_WEIGHT 256
+
enum {
VHOST_TEST_VQ = 0,
VHOST_TEST_VQ_MAX = 1,
@@ -80,10 +86,8 @@ static void handle_vq(struct vhost_test *n)
}
vhost_add_used_and_signal(&n->dev, vq, head, 0);
total_len += len;
- if (unlikely(total_len >= VHOST_TEST_WEIGHT)) {
- vhost_poll_queue(&vq->poll);
+ if (unlikely(vhost_exceeds_weight(vq, 0, total_len)))
break;
- }
}
mutex_unlock(&vq->mutex);
@@ -115,7 +119,8 @@ static int vhost_test_open(struct inode *inode, struct file *f)
dev = &n->dev;
vqs[VHOST_TEST_VQ] = &n->vqs[VHOST_TEST_VQ];
n->vqs[VHOST_TEST_VQ].handle_kick = handle_vq_kick;
- vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX, UIO_MAXIOV);
+ vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX, UIO_MAXIOV,
+ VHOST_TEST_PKT_WEIGHT, VHOST_TEST_WEIGHT);
f->private_data = n;
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 264b563b8675771834419057cbe076c1a41fb666 Mon Sep 17 00:00:00 2001
From: Tiwei Bie <tiwei.bie(a)intel.com>
Date: Wed, 28 Aug 2019 13:37:00 +0800
Subject: [PATCH] vhost/test: fix build for vhost test
Since vhost_exceeds_weight() was introduced, callers need to specify
the packet weight and byte weight in vhost_dev_init(). Note that, the
packet weight isn't counted in this patch to keep the original behavior
unchanged.
Fixes: e82b9b0727ff ("vhost: introduce vhost_exceeds_weight()")
Cc: stable(a)vger.kernel.org
Signed-off-by: Tiwei Bie <tiwei.bie(a)intel.com>
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
Acked-by: Jason Wang <jasowang(a)redhat.com>
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index ac4f762c4f65..7804869c6a31 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -22,6 +22,12 @@
* Using this limit prevents one virtqueue from starving others. */
#define VHOST_TEST_WEIGHT 0x80000
+/* Max number of packets transferred before requeueing the job.
+ * Using this limit prevents one virtqueue from starving others with
+ * pkts.
+ */
+#define VHOST_TEST_PKT_WEIGHT 256
+
enum {
VHOST_TEST_VQ = 0,
VHOST_TEST_VQ_MAX = 1,
@@ -80,10 +86,8 @@ static void handle_vq(struct vhost_test *n)
}
vhost_add_used_and_signal(&n->dev, vq, head, 0);
total_len += len;
- if (unlikely(total_len >= VHOST_TEST_WEIGHT)) {
- vhost_poll_queue(&vq->poll);
+ if (unlikely(vhost_exceeds_weight(vq, 0, total_len)))
break;
- }
}
mutex_unlock(&vq->mutex);
@@ -115,7 +119,8 @@ static int vhost_test_open(struct inode *inode, struct file *f)
dev = &n->dev;
vqs[VHOST_TEST_VQ] = &n->vqs[VHOST_TEST_VQ];
n->vqs[VHOST_TEST_VQ].handle_kick = handle_vq_kick;
- vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX, UIO_MAXIOV);
+ vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX, UIO_MAXIOV,
+ VHOST_TEST_PKT_WEIGHT, VHOST_TEST_WEIGHT);
f->private_data = n;
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 264b563b8675771834419057cbe076c1a41fb666 Mon Sep 17 00:00:00 2001
From: Tiwei Bie <tiwei.bie(a)intel.com>
Date: Wed, 28 Aug 2019 13:37:00 +0800
Subject: [PATCH] vhost/test: fix build for vhost test
Since vhost_exceeds_weight() was introduced, callers need to specify
the packet weight and byte weight in vhost_dev_init(). Note that, the
packet weight isn't counted in this patch to keep the original behavior
unchanged.
Fixes: e82b9b0727ff ("vhost: introduce vhost_exceeds_weight()")
Cc: stable(a)vger.kernel.org
Signed-off-by: Tiwei Bie <tiwei.bie(a)intel.com>
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
Acked-by: Jason Wang <jasowang(a)redhat.com>
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index ac4f762c4f65..7804869c6a31 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -22,6 +22,12 @@
* Using this limit prevents one virtqueue from starving others. */
#define VHOST_TEST_WEIGHT 0x80000
+/* Max number of packets transferred before requeueing the job.
+ * Using this limit prevents one virtqueue from starving others with
+ * pkts.
+ */
+#define VHOST_TEST_PKT_WEIGHT 256
+
enum {
VHOST_TEST_VQ = 0,
VHOST_TEST_VQ_MAX = 1,
@@ -80,10 +86,8 @@ static void handle_vq(struct vhost_test *n)
}
vhost_add_used_and_signal(&n->dev, vq, head, 0);
total_len += len;
- if (unlikely(total_len >= VHOST_TEST_WEIGHT)) {
- vhost_poll_queue(&vq->poll);
+ if (unlikely(vhost_exceeds_weight(vq, 0, total_len)))
break;
- }
}
mutex_unlock(&vq->mutex);
@@ -115,7 +119,8 @@ static int vhost_test_open(struct inode *inode, struct file *f)
dev = &n->dev;
vqs[VHOST_TEST_VQ] = &n->vqs[VHOST_TEST_VQ];
n->vqs[VHOST_TEST_VQ].handle_kick = handle_vq_kick;
- vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX, UIO_MAXIOV);
+ vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX, UIO_MAXIOV,
+ VHOST_TEST_PKT_WEIGHT, VHOST_TEST_WEIGHT);
f->private_data = n;
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: f7d5b3dc4792 - Linux 5.2.10
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/128519
One or more kernel tests failed:
x86_64:
❌ Networking socket: fuzz
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: f7d5b3dc4792 - Linux 5.2.10
We grabbed the 54831dad38d2 commit of the stable queue repository.
We then merged the patchset with `git am`:
asoc-simple_card_utils.h-care-null-dai-at-asoc_simpl.patch
asoc-simple-card-fix-an-use-after-free-in-simple_dai.patch
asoc-simple-card-fix-an-use-after-free-in-simple_for.patch
asoc-audio-graph-card-fix-use-after-free-in-graph_da.patch
asoc-audio-graph-card-fix-an-use-after-free-in-graph.patch
asoc-audio-graph-card-add-missing-const-at-graph_get.patch
regulator-axp20x-fix-dcdca-and-dcdcd-for-axp806.patch
regulator-axp20x-fix-dcdc5-and-dcdc6-for-axp803.patch
asoc-samsung-odroid-fix-an-use-after-free-issue-for-.patch
asoc-samsung-odroid-fix-a-double-free-issue-for-cpu_.patch
asoc-intel-bytcht_es8316-add-quirk-for-irbis-nb41-ne.patch
hid-logitech-hidpp-add-usb-pid-for-a-few-more-suppor.patch
hid-add-044f-b320-thrustmaster-inc.-2-in-1-dt.patch
mips-kernel-only-use-i8253-clocksource-with-periodic.patch
mips-fix-cacheinfo.patch
libbpf-sanitize-var-to-conservative-1-byte-int.patch
netfilter-ebtables-fix-a-memory-leak-bug-in-compat.patch
asoc-dapm-fix-handling-of-custom_stop_condition-on-d.patch
asoc-sof-use-__u32-instead-of-uint32_t-in-uapi-heade.patch
spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch
bpf-sockmap-sock_map_delete-needs-to-use-xchg.patch
bpf-sockmap-synchronize_rcu-before-free-ing-map.patch
bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch
selftests-bpf-fix-sendmsg6_prog-on-s390.patch
asoc-dapm-fix-a-memory-leak-bug.patch
bonding-force-slave-speed-check-after-link-state-rec.patch
net-mvpp2-don-t-check-for-3-consecutive-idle-frames-.patch
selftests-forwarding-gre_multipath-enable-ipv4-forwa.patch
selftests-forwarding-gre_multipath-fix-flower-filter.patch
selftests-bpf-add-another-gso_segs-access.patch
libbpf-fix-using-uninitialized-ioctl-results.patch
can-dev-call-netif_carrier_off-in-register_candev.patch
can-mcp251x-add-error-check-when-wq-alloc-failed.patch
can-gw-fix-error-path-of-cgw_module_init.patch
asoc-fail-card-instantiation-if-dai-format-setup-fai.patch
staging-fbtft-fix-gpio-handling.patch
libbpf-silence-gcc8-warning-about-string-truncation.patch
st21nfca_connectivity_event_received-null-check-the-.patch
st_nci_hci_connectivity_event_received-null-check-th.patch
nl-mac-80211-fix-interface-combinations-on-crypto-co.patch
asoc-ti-davinci-mcasp-fix-clk-pdir-handling-for-i2s-.patch
asoc-rockchip-fix-mono-capture.patch
asoc-ti-davinci-mcasp-correct-slot_width-posed-const.patch
net-usb-qmi_wwan-add-the-broadmobi-bm818-card.patch
qed-rdma-fix-the-hw_ver-returned-in-device-attribute.patch
isdn-misdn-hfcsusb-fix-possible-null-pointer-derefer.patch
habanalabs-fix-f-w-download-in-be-architecture.patch
mac80211_hwsim-fix-possible-null-pointer-dereference.patch
net-stmmac-manage-errors-returned-by-of_get_mac_addr.patch
netfilter-ipset-actually-allow-destination-mac-addre.patch
netfilter-ipset-copy-the-right-mac-address-in-bitmap.patch
netfilter-ipset-fix-rename-concurrency-with-listing.patch
rxrpc-fix-potential-deadlock.patch
rxrpc-fix-the-lack-of-notification-when-sendmsg-fail.patch
nvmem-use-the-same-permissions-for-eeprom-as-for-nvm.patch
iwlwifi-mvm-avoid-races-in-rate-init-and-rate-perfor.patch
iwlwifi-dbg_ini-move-iwl_dbg_tlv_load_bin-out-of-deb.patch
iwlwifi-dbg_ini-move-iwl_dbg_tlv_free-outside-of-deb.patch
iwlwifi-fix-locking-in-delayed-gtk-setting.patch
iwlwifi-mvm-send-lq-command-always-async.patch
enetc-fix-build-error-without-phylib.patch
isdn-hfcsusb-fix-misdn-driver-crash-caused-by-transf.patch
net-phy-phy_led_triggers-fix-a-possible-null-pointer.patch
perf-bench-numa-fix-cpu0-binding.patch
spi-pxa2xx-add-support-for-intel-tiger-lake.patch
can-sja1000-force-the-string-buffer-null-terminated.patch
can-peak_usb-force-the-string-buffer-null-terminated.patch
asoc-amd-acp3x-use-dma_ops-of-parent-device-for-acp3.patch
net-ethernet-qlogic-qed-force-the-string-buffer-null.patch
enetc-select-phylib-while-config_fsl_enetc_vf-is-set.patch
nfsv4-fix-a-credential-refcount-leak-in-nfs41_check_.patch
nfsv4-when-recovering-state-fails-with-eagain-retry-.patch
nfsv4.1-fix-open-stateid-recovery.patch
nfsv4.1-only-reap-expired-delegations.patch
nfsv4-fix-a-potential-sleep-while-atomic-in-nfs4_do_.patch
nfs-fix-regression-whereby-fscache-errors-are-appear.patch
hid-quirks-set-the-increment_usage_on_duplicate-quir.patch
hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch
drm-rockchip-suspend-dp-late.patch
smb3-fix-potential-memory-leak-when-processing-compo.patch
smb3-kernel-oops-mounting-a-encryptdata-share-with-c.patch
sched-deadline-fix-double-accounting-of-rq-running-b.patch
sched-psi-reduce-psimon-fifo-priority.patch
sched-psi-do-not-require-setsched-permission-from-th.patch
s390-protvirt-avoid-memory-sharing-for-diag-308-set-.patch
s390-mm-fix-dump_pagetables-top-level-page-table-wal.patch
s390-put-_stext-and-_etext-into-.text-section.patch
ata-rb532_cf-fix-unused-variable-warning-in-rb532_pa.patch
net-cxgb3_main-fix-a-resource-leak-in-a-error-path-i.patch
net-stmmac-fix-issues-when-number-of-queues-4.patch
net-stmmac-tc-do-not-return-a-fragment-entry.patch
drm-amdgpu-pin-the-csb-buffer-on-hw-init-for-gfx-v8.patch
net-hisilicon-make-hip04_tx_reclaim-non-reentrant.patch
net-hisilicon-fix-hip04-xmit-never-return-tx_busy.patch
net-hisilicon-fix-dma_map_single-failed-on-arm64.patch
nfsv4-ensure-state-recovery-handles-etimedout-correc.patch
libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch
libata-add-sg-safety-checks-in-sff-pio-transfers.patch
x86-lib-cpu-address-missing-prototypes-warning.patch
drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch
block-aoe-fix-kernel-crash-due-to-atomic-sleep-when-.patch
block-bfq-handle-null-return-value-by-bfq_init_rq.patch
perf-ftrace-fix-failure-to-set-cpumask-when-only-one.patch
perf-cpumap-fix-writing-to-illegal-memory-in-handlin.patch
perf-pmu-events-fix-missing-cpu_clk_unhalted.core-ev.patch
dt-bindings-riscv-fix-the-schema-compatible-string-f.patch
kvm-arm64-don-t-write-junk-to-sysregs-on-reset.patch
kvm-arm-don-t-write-junk-to-cp15-registers-on-reset.patch
selftests-kvm-adding-config-fragments.patch
iwlwifi-mvm-disable-tx-amsdu-on-older-nics.patch
hid-wacom-correct-misreported-ekr-ring-values.patch
hid-wacom-correct-distance-scale-for-2nd-gen-intuos-devices.patch
revert-kvm-x86-mmu-zap-only-the-relevant-pages-when-removing-a-memslot.patch
revert-dm-bufio-fix-deadlock-with-loop-device.patch
clk-socfpga-stratix10-fix-rate-caclulationg-for-cnt_clks.patch
ceph-clear-page-dirty-before-invalidate-page.patch
ceph-don-t-try-fill-file_lock-on-unsuccessful-getfilelock-reply.patch
libceph-fix-pg-split-vs-osd-re-connect-race.patch
drm-amdgpu-gfx9-update-pg_flags-after-determining-if-gfx-off-is-possible.patch
drm-nouveau-don-t-retry-infinitely-when-receiving-no-data-on-i2c-over-aux.patch
scsi-ufs-fix-null-pointer-dereference-in-ufshcd_config_vreg_hpm.patch
gpiolib-never-report-open-drain-source-lines-as-input-to-user-space.patch
drivers-hv-vmbus-fix-virt_to_hvpfn-for-x86_pae.patch
userfaultfd_release-always-remove-uffd-flags-and-clear-vm_userfaultfd_ctx.patch
x86-retpoline-don-t-clobber-rflags-during-call_nospec-on-i386.patch
x86-apic-handle-missing-global-clockevent-gracefully.patch
x86-cpu-amd-clear-rdrand-cpuid-bit-on-amd-family-15h-16h.patch
x86-boot-save-fields-explicitly-zero-out-everything-else.patch
x86-boot-fix-boot-regression-caused-by-bootparam-sanitizing.patch
ib-hfi1-unsafe-psn-checking-for-tid-rdma-read-resp-packet.patch
ib-hfi1-add-additional-checks-when-handling-tid-rdma-read-resp-packet.patch
ib-hfi1-add-additional-checks-when-handling-tid-rdma-write-data-packet.patch
ib-hfi1-drop-stale-tid-rdma-packets-that-cause-tiderr.patch
psi-get-poll_work-to-run-when-calling-poll-syscall-next-time.patch
dm-kcopyd-always-complete-failed-jobs.patch
dm-dust-use-dust-block-size-for-badblocklist-index.patch
dm-btree-fix-order-of-block-initialization-in-btree_split_beneath.patch
dm-integrity-fix-a-crash-due-to-bug_on-in-__journal_read_write.patch
dm-raid-add-missing-cleanup-in-raid_ctr.patch
dm-space-map-metadata-fix-missing-store-of-apply_bops-return-value.patch
dm-table-fix-invalid-memory-accesses-with-too-high-sector-number.patch
dm-zoned-improve-error-handling-in-reclaim.patch
dm-zoned-improve-error-handling-in-i-o-map-code.patch
dm-zoned-properly-handle-backing-device-failure.patch
genirq-properly-pair-kobject_del-with-kobject_add.patch
mm-z3fold.c-fix-race-between-migration-and-destruction.patch
mm-page_alloc-move_freepages-should-not-examine-struct-page-of-reserved-memory.patch
mm-memcontrol-flush-percpu-vmstats-before-releasing-memcg.patch
mm-memcontrol-flush-percpu-vmevents-before-releasing-memcg.patch
mm-page_owner-handle-thp-splits-correctly.patch
mm-zsmalloc.c-migration-can-leave-pages-in-zs_empty-indefinitely.patch
mm-zsmalloc.c-fix-race-condition-in-zs_destroy_pool.patch
mm-kasan-fix-false-positive-invalid-free-reports-with-config_kasan_sw_tags-y.patch
xfs-fix-missing-ilock-unlock-when-xfs_setattr_nonsize-fails-due-to-edquot.patch
ib-hfi1-drop-stale-tid-rdma-packets.patch
dm-zoned-fix-potential-null-dereference-in-dmz_do_re.patch
io_uring-fix-potential-hang-with-polled-io.patch
io_uring-don-t-enter-poll-loop-if-we-have-cqes-pendi.patch
io_uring-add-need_resched-check-in-inner-poll-loop.patch
powerpc-allow-flush_-inval_-dcache_range-to-work-across-ranges-4gb.patch
rxrpc-fix-local-endpoint-refcounting.patch
rxrpc-fix-read-after-free-in-rxrpc_queue_local.patch
rxrpc-fix-local-endpoint-replacement.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
✅ lvm thinp sanity [3]
✅ storage: software RAID testing [4]
🚧 ✅ Storage blktests [5]
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
⚡⚡⚡ Boot test [0]
⚡⚡⚡ Podman system integration test (as root) [6]
⚡⚡⚡ Podman system integration test (as user) [6]
⚡⚡⚡ Loopdev Sanity [7]
⚡⚡⚡ jvm test suite [8]
⚡⚡⚡ AMTU (Abstract Machine Test Utility) [9]
⚡⚡⚡ LTP: openposix test suite [10]
⚡⚡⚡ Ethernet drivers sanity [11]
⚡⚡⚡ Networking socket: fuzz [12]
⚡⚡⚡ audit: audit testsuite test [13]
⚡⚡⚡ httpd: mod_ssl smoke sanity [14]
⚡⚡⚡ iotop: sanity [15]
⚡⚡⚡ tuned: tune-processes-through-perf [16]
⚡⚡⚡ Usex - version 1.9-29 [17]
⚡⚡⚡ storage: SCSI VPD [18]
⚡⚡⚡ stress: stress-ng [19]
🚧 ⚡⚡⚡ LTP lite [20]
ppc64le:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
✅ lvm thinp sanity [3]
✅ storage: software RAID testing [4]
🚧 ✅ Storage blktests [5]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [6]
✅ Podman system integration test (as user) [6]
✅ Loopdev Sanity [7]
✅ jvm test suite [8]
✅ AMTU (Abstract Machine Test Utility) [9]
✅ LTP: openposix test suite [10]
✅ Ethernet drivers sanity [11]
✅ Networking socket: fuzz [12]
✅ audit: audit testsuite test [13]
✅ httpd: mod_ssl smoke sanity [14]
✅ iotop: sanity [15]
✅ tuned: tune-processes-through-perf [16]
✅ Usex - version 1.9-29 [17]
🚧 ✅ LTP lite [20]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [6]
✅ Podman system integration test (as user) [6]
✅ Loopdev Sanity [7]
✅ jvm test suite [8]
✅ AMTU (Abstract Machine Test Utility) [9]
✅ LTP: openposix test suite [10]
✅ Ethernet drivers sanity [11]
❌ Networking socket: fuzz [12]
⚡⚡⚡ audit: audit testsuite test [13]
⚡⚡⚡ httpd: mod_ssl smoke sanity [14]
⚡⚡⚡ iotop: sanity [15]
⚡⚡⚡ tuned: tune-processes-through-perf [16]
⚡⚡⚡ pciutils: sanity smoke test [21]
⚡⚡⚡ Usex - version 1.9-29 [17]
⚡⚡⚡ storage: SCSI VPD [18]
⚡⚡⚡ stress: stress-ng [19]
🚧 ❌ LTP lite [20]
Host 2:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
✅ lvm thinp sanity [3]
✅ storage: software RAID testing [4]
🚧 ✅ Storage blktests [5]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/lvm/…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/swra…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
As soon as we re-enable the various functions within the HW, they may go
off and read data via a GGTT offset. Hence, if we have not yet restored
the GGTT PTE before then, they may read and even *write* random locations
in memory.
Detected by DMAR faults during resume.
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com>
Cc: Martin Peres <martin.peres(a)linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/i915/gem/i915_gem_pm.c | 3 ---
drivers/gpu/drm/i915/i915_drv.c | 5 +++++
drivers/gpu/drm/i915/selftests/i915_gem.c | 6 ++++++
3 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pm.c b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
index b3993d24b83d..9b1129aaacfe 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_pm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
@@ -242,9 +242,6 @@ void i915_gem_resume(struct drm_i915_private *i915)
mutex_lock(&i915->drm.struct_mutex);
intel_uncore_forcewake_get(&i915->uncore, FORCEWAKE_ALL);
- i915_gem_restore_gtt_mappings(i915);
- i915_gem_restore_fences(i915);
-
if (i915_gem_init_hw(i915))
goto err_wedged;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 7b2c81a8bbaa..1af4eba968c0 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1877,6 +1877,11 @@ static int i915_drm_resume(struct drm_device *dev)
if (ret)
DRM_ERROR("failed to re-enable GGTT\n");
+ mutex_lock(&dev_priv->drm.struct_mutex);
+ i915_gem_restore_gtt_mappings(dev_priv);
+ i915_gem_restore_fences(dev_priv);
+ mutex_unlock(&dev_priv->drm.struct_mutex);
+
intel_csr_ucode_resume(dev_priv);
i915_restore_state(dev_priv);
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem.c b/drivers/gpu/drm/i915/selftests/i915_gem.c
index bb6dd54a6ff3..37593831b539 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem.c
@@ -118,6 +118,12 @@ static void pm_resume(struct drm_i915_private *i915)
with_intel_runtime_pm(&i915->runtime_pm, wakeref) {
intel_gt_sanitize(&i915->gt, false);
i915_gem_sanitize(i915);
+
+ mutex_lock(&i915->drm.struct_mutex);
+ i915_gem_restore_gtt_mappings(i915);
+ i915_gem_restore_fences(i915);
+ mutex_unlock(&i915->drm.struct_mutex);
+
i915_gem_resume(i915);
}
}
--
2.23.0
I'm announcing the release of the 4.9.192 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/kvm/mmio.c | 7 ++
arch/x86/kernel/apic/apic.c | 4 -
drivers/bluetooth/btqca.c | 3 +
drivers/infiniband/hw/mlx4/mad.c | 4 -
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 4 +
drivers/net/ethernet/ibm/ibmveth.c | 9 +--
drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 2
drivers/net/ethernet/renesas/ravb_main.c | 8 ++
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 6 --
drivers/net/ethernet/toshiba/tc35815.c | 2
drivers/net/ethernet/tundra/tsi108_eth.c | 5 +
drivers/net/usb/cx82310_eth.c | 3 -
drivers/net/usb/kalmia.c | 6 +-
drivers/net/wimax/i2400m/fw.c | 4 +
drivers/spi/spi-bcm2835aux.c | 57 +++++++--------------
fs/ceph/inode.c | 7 +-
fs/ceph/xattr.c | 8 ++
include/linux/ceph/buffer.h | 3 -
include/linux/gpio.h | 24 --------
net/core/netpoll.c | 6 +-
net/ipv4/tcp_output.c | 3 -
net/ipv6/mcast.c | 5 +
tools/hv/hv_kvp_daemon.c | 2
24 files changed, 83 insertions(+), 101 deletions(-)
Andrew Jones (1):
KVM: arm/arm64: Only skip MMIO insn once
Chen-Yu Tsai (1):
net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
Eric Dumazet (1):
mld: fix memory leak in mld_del_delrec()
Feng Sun (1):
net: fix skb use after free in netpoll
Fuqian Huang (1):
net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
Greg Kroah-Hartman (1):
Linux 4.9.192
Linus Torvalds (1):
Revert "x86/apic: Include the LDR when clearing out APIC registers"
Luis Henriques (3):
ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
ceph: fix buffer free while holding i_ceph_lock in fill_inode()
libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
Martin Sperl (3):
spi: bcm2835aux: unifying code between polling and interrupt driven code
spi: bcm2835aux: remove dangerous uncontrolled read of fifo
spi: bcm2835aux: fix corruptions for longer spi transfers
Matthias Kaehlcke (1):
Bluetooth: btqca: Add a short delay before downloading the NVM
Nathan Chancellor (1):
net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
Rob Herring (1):
spi: bcm2835aux: ensure interrupts are enabled for shared handler
Tho Vu (1):
ravb: Fix use-after-free ravb_tstamp_skb
Thomas Falcon (1):
ibmveth: Convert multicast list size for little-endian system
Vitaly Kuznetsov (1):
Tools: hv: kvp: eliminate 'may be used uninitialized' warning
Wenwen Wang (6):
cxgb4: fix a memory leak bug
net: myri10ge: fix memory leaks
cx82310_eth: fix a memory leak bug
net: kalmia: fix memory leaks
wimax/i2400m: fix a memory leak bug
IB/mlx4: Fix memory leaks
Willem de Bruijn (1):
tcp: inherit timestamp on mtu probe
YueHaibing (1):
gpio: Fix build error of function redefinition
I'm announcing the release of the 4.4.192 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/kvm/mmio.c | 7 ++
arch/x86/kernel/apic/apic.c | 4 -
drivers/bluetooth/btqca.c | 3 +
drivers/infiniband/hw/mlx4/mad.c | 4 -
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 4 +
drivers/net/ethernet/ibm/ibmveth.c | 9 +--
drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 2
drivers/net/ethernet/renesas/ravb_main.c | 8 ++
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 6 --
drivers/net/ethernet/toshiba/tc35815.c | 2
drivers/net/ethernet/tundra/tsi108_eth.c | 5 +
drivers/net/usb/cx82310_eth.c | 3 -
drivers/net/usb/kalmia.c | 6 +-
drivers/net/wimax/i2400m/fw.c | 4 +
drivers/spi/spi-bcm2835aux.c | 57 +++++++--------------
fs/ceph/xattr.c | 8 ++
include/linux/ceph/buffer.h | 3 -
include/linux/gpio.h | 24 --------
net/core/netpoll.c | 6 +-
tools/hv/hv_kvp_daemon.c | 2
21 files changed, 74 insertions(+), 95 deletions(-)
Andrew Jones (1):
KVM: arm/arm64: Only skip MMIO insn once
Chen-Yu Tsai (1):
net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
Feng Sun (1):
net: fix skb use after free in netpoll
Fuqian Huang (1):
net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
Greg Kroah-Hartman (1):
Linux 4.4.192
Linus Torvalds (1):
Revert "x86/apic: Include the LDR when clearing out APIC registers"
Luis Henriques (2):
ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
Martin Sperl (3):
spi: bcm2835aux: unifying code between polling and interrupt driven code
spi: bcm2835aux: remove dangerous uncontrolled read of fifo
spi: bcm2835aux: fix corruptions for longer spi transfers
Matthias Kaehlcke (1):
Bluetooth: btqca: Add a short delay before downloading the NVM
Nathan Chancellor (1):
net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
Rob Herring (1):
spi: bcm2835aux: ensure interrupts are enabled for shared handler
Tho Vu (1):
ravb: Fix use-after-free ravb_tstamp_skb
Thomas Falcon (1):
ibmveth: Convert multicast list size for little-endian system
Vitaly Kuznetsov (1):
Tools: hv: kvp: eliminate 'may be used uninitialized' warning
Wenwen Wang (6):
cxgb4: fix a memory leak bug
net: myri10ge: fix memory leaks
cx82310_eth: fix a memory leak bug
net: kalmia: fix memory leaks
wimax/i2400m: fix a memory leak bug
IB/mlx4: Fix memory leaks
YueHaibing (1):
gpio: Fix build error of function redefinition
This is the start of the stable review cycle for the 4.14.143 release.
There are 40 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue 10 Sep 2019 12:09:36 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.143-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.143-rc1
John S. Gruber <JohnSGruber(a)gmail.com>
x86/boot: Preserve boot_params.secure_boot from sanitizing
Eric Dumazet <edumazet(a)google.com>
mld: fix memory leak in mld_del_delrec()
Vlad Buslov <vladbu(a)mellanox.com>
net: sched: act_sample: fix psample group handling on overwrite
Eric Dumazet <edumazet(a)google.com>
tcp: remove empty skb from write queue in error cases
Willem de Bruijn <willemb(a)google.com>
tcp: inherit timestamp on mtu probe
Chen-Yu Tsai <wens(a)csie.org>
net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
Cong Wang <xiyou.wangcong(a)gmail.com>
net_sched: fix a NULL pointer deref in ipt action
Feng Sun <loyou85(a)gmail.com>
net: fix skb use after free in netpoll
Linus Torvalds <torvalds(a)linux-foundation.org>
Revert "x86/apic: Include the LDR when clearing out APIC registers"
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: fix corruptions for longer spi transfers
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: remove dangerous uncontrolled read of fifo
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: unifying code between polling and interrupt driven code
Luis Henriques <lhenriques(a)suse.com>
libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
Andrew Jones <drjones(a)redhat.com>
KVM: arm/arm64: Only skip MMIO insn once
Luis Henriques <lhenriques(a)suse.com>
ceph: fix buffer free while holding i_ceph_lock in fill_inode()
Luis Henriques <lhenriques(a)suse.com>
ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob()
Luis Henriques <lhenriques(a)suse.com>
ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
Wenwen Wang <wenwen(a)cs.uga.edu>
IB/mlx4: Fix memory leaks
Vitaly Kuznetsov <vkuznets(a)redhat.com>
Tools: hv: kvp: eliminate 'may be used uninitialized' warning
Dexuan Cui <decui(a)microsoft.com>
Input: hyperv-keyboard: Use in-place iterator API in the channel callback
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
HID: cp2112: prevent sleeping function called from invalid context
Andrea Righi <andrea.righi(a)canonical.com>
kprobes: Fix potential deadlock in kprobe_optimizer()
Tho Vu <tho.vu.wh(a)rvc.renesas.com>
ravb: Fix use-after-free ravb_tstamp_skb
Wenwen Wang <wenwen(a)cs.uga.edu>
wimax/i2400m: fix a memory leak bug
Wenwen Wang <wenwen(a)cs.uga.edu>
net: kalmia: fix memory leaks
Wenwen Wang <wenwen(a)cs.uga.edu>
cx82310_eth: fix a memory leak bug
Darrick J. Wong <darrick.wong(a)oracle.com>
vfs: fix page locking deadlocks when deduping files
Wenwen Wang <wenwen(a)cs.uga.edu>
lan78xx: Fix memory leaks
Wenwen Wang <wenwen(a)cs.uga.edu>
net: myri10ge: fix memory leaks
Wenwen Wang <wenwen(a)cs.uga.edu>
liquidio: add cleanup in octeon_setup_iq()
Wenwen Wang <wenwen(a)cs.uga.edu>
cxgb4: fix a memory leak bug
Alexandre Courbot <acourbot(a)chromium.org>
drm/mediatek: set DMA max segment size
Alexandre Courbot <acourbot(a)chromium.org>
drm/mediatek: use correct device to import PRIME buffers
YueHaibing <yuehaibing(a)huawei.com>
gpio: Fix build error of function redefinition
Thomas Falcon <tlfalcon(a)linux.ibm.com>
ibmveth: Convert multicast list size for little-endian system
Fabian Henneke <fabian.henneke(a)gmail.com>
Bluetooth: hidp: Let hidp_send_message return number of queued bytes
Matthias Kaehlcke <mka(a)chromium.org>
Bluetooth: btqca: Add a short delay before downloading the NVM
Nathan Chancellor <natechancellor(a)gmail.com>
net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
Dexuan Cui <decui(a)microsoft.com>
hv_netvsc: Fix a warning of suspicious RCU usage
Fuqian Huang <huangfq.daxian(a)gmail.com>
net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
-------------
Diffstat:
Makefile | 4 +-
arch/x86/include/asm/bootparam_utils.h | 1 +
arch/x86/kernel/apic/apic.c | 4 --
drivers/bluetooth/btqca.c | 3 ++
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 49 +++++++++++++++--
drivers/gpu/drm/mediatek/mtk_drm_drv.h | 2 +
drivers/hid/hid-cp2112.c | 8 ++-
drivers/infiniband/hw/mlx4/mad.c | 4 +-
drivers/input/serio/hyperv-keyboard.c | 35 +++---------
.../net/ethernet/cavium/liquidio/request_manager.c | 4 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 4 +-
drivers/net/ethernet/ibm/ibmveth.c | 9 ++--
drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 2 +-
drivers/net/ethernet/renesas/ravb_main.c | 8 ++-
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 6 +--
drivers/net/ethernet/toshiba/tc35815.c | 2 +-
drivers/net/ethernet/tundra/tsi108_eth.c | 5 +-
drivers/net/hyperv/netvsc_drv.c | 9 +++-
drivers/net/usb/cx82310_eth.c | 3 +-
drivers/net/usb/kalmia.c | 6 +--
drivers/net/usb/lan78xx.c | 8 +--
drivers/net/wimax/i2400m/fw.c | 4 +-
drivers/spi/spi-bcm2835aux.c | 62 +++++++---------------
fs/ceph/caps.c | 5 +-
fs/ceph/inode.c | 7 +--
fs/ceph/snap.c | 4 +-
fs/ceph/super.h | 2 +-
fs/ceph/xattr.c | 19 +++++--
fs/read_write.c | 49 ++++++++++++++---
include/linux/ceph/buffer.h | 3 +-
include/linux/gpio.h | 24 ---------
include/net/act_api.h | 4 +-
include/net/psample.h | 1 +
kernel/kprobes.c | 8 +--
net/bluetooth/hidp/core.c | 9 +++-
net/core/netpoll.c | 6 +--
net/ipv4/tcp.c | 29 ++++++----
net/ipv4/tcp_output.c | 3 +-
net/ipv6/mcast.c | 5 +-
net/psample/psample.c | 2 +-
net/sched/act_bpf.c | 2 +-
net/sched/act_connmark.c | 2 +-
net/sched/act_csum.c | 2 +-
net/sched/act_gact.c | 2 +-
net/sched/act_ife.c | 2 +-
net/sched/act_ipt.c | 11 ++--
net/sched/act_mirred.c | 2 +-
net/sched/act_nat.c | 2 +-
net/sched/act_pedit.c | 2 +-
net/sched/act_police.c | 2 +-
net/sched/act_sample.c | 7 ++-
net/sched/act_simple.c | 2 +-
net/sched/act_skbedit.c | 2 +-
net/sched/act_skbmod.c | 2 +-
net/sched/act_tunnel_key.c | 2 +-
net/sched/act_vlan.c | 2 +-
tools/hv/hv_kvp_daemon.c | 2 +-
virt/kvm/arm/mmio.c | 7 +++
58 files changed, 278 insertions(+), 199 deletions(-)
This is the start of the stable review cycle for the 4.9.192 release.
There are 26 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue 10 Sep 2019 12:09:36 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.192-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.192-rc1
Eric Dumazet <edumazet(a)google.com>
mld: fix memory leak in mld_del_delrec()
Willem de Bruijn <willemb(a)google.com>
tcp: inherit timestamp on mtu probe
Chen-Yu Tsai <wens(a)csie.org>
net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
Feng Sun <loyou85(a)gmail.com>
net: fix skb use after free in netpoll
Linus Torvalds <torvalds(a)linux-foundation.org>
Revert "x86/apic: Include the LDR when clearing out APIC registers"
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: fix corruptions for longer spi transfers
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: remove dangerous uncontrolled read of fifo
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: unifying code between polling and interrupt driven code
Rob Herring <robh(a)kernel.org>
spi: bcm2835aux: ensure interrupts are enabled for shared handler
Luis Henriques <lhenriques(a)suse.com>
libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
Andrew Jones <drjones(a)redhat.com>
KVM: arm/arm64: Only skip MMIO insn once
Luis Henriques <lhenriques(a)suse.com>
ceph: fix buffer free while holding i_ceph_lock in fill_inode()
Luis Henriques <lhenriques(a)suse.com>
ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
Wenwen Wang <wenwen(a)cs.uga.edu>
IB/mlx4: Fix memory leaks
Vitaly Kuznetsov <vkuznets(a)redhat.com>
Tools: hv: kvp: eliminate 'may be used uninitialized' warning
Tho Vu <tho.vu.wh(a)rvc.renesas.com>
ravb: Fix use-after-free ravb_tstamp_skb
Wenwen Wang <wenwen(a)cs.uga.edu>
wimax/i2400m: fix a memory leak bug
Wenwen Wang <wenwen(a)cs.uga.edu>
net: kalmia: fix memory leaks
Wenwen Wang <wenwen(a)cs.uga.edu>
cx82310_eth: fix a memory leak bug
Wenwen Wang <wenwen(a)cs.uga.edu>
net: myri10ge: fix memory leaks
Wenwen Wang <wenwen(a)cs.uga.edu>
cxgb4: fix a memory leak bug
YueHaibing <yuehaibing(a)huawei.com>
gpio: Fix build error of function redefinition
Thomas Falcon <tlfalcon(a)linux.ibm.com>
ibmveth: Convert multicast list size for little-endian system
Matthias Kaehlcke <mka(a)chromium.org>
Bluetooth: btqca: Add a short delay before downloading the NVM
Nathan Chancellor <natechancellor(a)gmail.com>
net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
Fuqian Huang <huangfq.daxian(a)gmail.com>
net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
-------------
Diffstat:
Makefile | 4 +-
arch/arm/kvm/mmio.c | 7 +++
arch/x86/kernel/apic/apic.c | 4 --
drivers/bluetooth/btqca.c | 3 ++
drivers/infiniband/hw/mlx4/mad.c | 4 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 4 +-
drivers/net/ethernet/ibm/ibmveth.c | 9 ++--
drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 2 +-
drivers/net/ethernet/renesas/ravb_main.c | 8 ++-
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 6 +--
drivers/net/ethernet/toshiba/tc35815.c | 2 +-
drivers/net/ethernet/tundra/tsi108_eth.c | 5 +-
drivers/net/usb/cx82310_eth.c | 3 +-
drivers/net/usb/kalmia.c | 6 +--
drivers/net/wimax/i2400m/fw.c | 4 +-
drivers/spi/spi-bcm2835aux.c | 57 ++++++++--------------
fs/ceph/inode.c | 7 +--
fs/ceph/xattr.c | 8 ++-
include/linux/ceph/buffer.h | 3 +-
include/linux/gpio.h | 24 ---------
net/core/netpoll.c | 6 +--
net/ipv4/tcp_output.c | 3 +-
net/ipv6/mcast.c | 5 +-
tools/hv/hv_kvp_daemon.c | 2 +-
24 files changed, 84 insertions(+), 102 deletions(-)
This is the start of the stable review cycle for the 4.4.192 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue 10 Sep 2019 12:09:36 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.192-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.192-rc1
Chen-Yu Tsai <wens(a)csie.org>
net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
Feng Sun <loyou85(a)gmail.com>
net: fix skb use after free in netpoll
Linus Torvalds <torvalds(a)linux-foundation.org>
Revert "x86/apic: Include the LDR when clearing out APIC registers"
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: fix corruptions for longer spi transfers
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: remove dangerous uncontrolled read of fifo
Martin Sperl <kernel(a)martin.sperl.org>
spi: bcm2835aux: unifying code between polling and interrupt driven code
Rob Herring <robh(a)kernel.org>
spi: bcm2835aux: ensure interrupts are enabled for shared handler
Luis Henriques <lhenriques(a)suse.com>
libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
Andrew Jones <drjones(a)redhat.com>
KVM: arm/arm64: Only skip MMIO insn once
Luis Henriques <lhenriques(a)suse.com>
ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
Wenwen Wang <wenwen(a)cs.uga.edu>
IB/mlx4: Fix memory leaks
Vitaly Kuznetsov <vkuznets(a)redhat.com>
Tools: hv: kvp: eliminate 'may be used uninitialized' warning
Tho Vu <tho.vu.wh(a)rvc.renesas.com>
ravb: Fix use-after-free ravb_tstamp_skb
Wenwen Wang <wenwen(a)cs.uga.edu>
wimax/i2400m: fix a memory leak bug
Wenwen Wang <wenwen(a)cs.uga.edu>
net: kalmia: fix memory leaks
Wenwen Wang <wenwen(a)cs.uga.edu>
cx82310_eth: fix a memory leak bug
Wenwen Wang <wenwen(a)cs.uga.edu>
net: myri10ge: fix memory leaks
Wenwen Wang <wenwen(a)cs.uga.edu>
cxgb4: fix a memory leak bug
YueHaibing <yuehaibing(a)huawei.com>
gpio: Fix build error of function redefinition
Thomas Falcon <tlfalcon(a)linux.ibm.com>
ibmveth: Convert multicast list size for little-endian system
Matthias Kaehlcke <mka(a)chromium.org>
Bluetooth: btqca: Add a short delay before downloading the NVM
Nathan Chancellor <natechancellor(a)gmail.com>
net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
Fuqian Huang <huangfq.daxian(a)gmail.com>
net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
-------------
Diffstat:
Makefile | 4 +-
arch/arm/kvm/mmio.c | 7 +++
arch/x86/kernel/apic/apic.c | 4 --
drivers/bluetooth/btqca.c | 3 ++
drivers/infiniband/hw/mlx4/mad.c | 4 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 4 +-
drivers/net/ethernet/ibm/ibmveth.c | 9 ++--
drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 2 +-
drivers/net/ethernet/renesas/ravb_main.c | 8 ++-
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 6 +--
drivers/net/ethernet/toshiba/tc35815.c | 2 +-
drivers/net/ethernet/tundra/tsi108_eth.c | 5 +-
drivers/net/usb/cx82310_eth.c | 3 +-
drivers/net/usb/kalmia.c | 6 +--
drivers/net/wimax/i2400m/fw.c | 4 +-
drivers/spi/spi-bcm2835aux.c | 57 ++++++++--------------
fs/ceph/xattr.c | 8 ++-
include/linux/ceph/buffer.h | 3 +-
include/linux/gpio.h | 24 ---------
net/core/netpoll.c | 6 +--
tools/hv/hv_kvp_daemon.c | 2 +-
21 files changed, 75 insertions(+), 96 deletions(-)
Hi,
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag,
fixing commit: 1a7fecb766c8 ath10k: reset chip before reading chip_id in probe.
The bot has tested the following trees: v5.2.13, v4.19.71, v4.14.142, v4.9.191, v4.4.191.
v5.2.13: Failed to apply! Possible dependencies:
6d084ac27ab4 ("ath10k: initialise struct ath10k_bus params to zero")
v4.19.71: Failed to apply! Possible dependencies:
31324d17976e ("ath10k: support extended board data download for dual-band QCA9984")
5849ed48d226 ("ath10k: refactoring needed for extended board data download")
6d084ac27ab4 ("ath10k: initialise struct ath10k_bus params to zero")
7c2dd6154fc2 ("ath10k: add device type enum to ath10k_bus_params")
ba94c753ccb4 ("ath10k: add QMI message handshake for wcn3990 client")
c0d8d565787c ("ath10k: add struct ath10k_bus_params")
de8781d7e74d ("ath10k: disable interface pause wow config for integrated chipset")
f1908735f141 ("ath10k: allow ATH10K_SNOC with COMPILE_TEST")
v4.14.142: Failed to apply! Possible dependencies:
0fa4fbe9b8cf ("ath10k: add hif power-up/power-down methods")
17f5559e0da5 ("ath10k: platform driver for WCN3990 SNOC WLAN module")
2a1e1ad3fd37 ("ath10k: Add support for 64 bit ce descriptor")
50c51f394e68 ("ath10k: do not mix spaces and tabs in Kconfig")
5dac5f3772f6 ("ath10k: Use dma_addr_t for ce buffers to support 64bit target")
6d084ac27ab4 ("ath10k: initialise struct ath10k_bus params to zero")
7f9befbb555d ("ath10k: move pktlog_filter out of ath10k_debug")
84efe7f6ebc5 ("ath10k: map HTC services to tx/rx pipes for wcn3990")
a0aedd6e0b57 ("ath10k: build ce layer in ath10k core module")
a6a793f98786 ("ath10k: vote for hardware resources for WCN3990")
a6e149a9ff03 ("ath10k: add hif start/stop methods for wcn3990 snoc layer")
ba94c753ccb4 ("ath10k: add QMI message handshake for wcn3990 client")
c0d8d565787c ("ath10k: add struct ath10k_bus_params")
c963a683e701 ("ath10k: add resource init and deinit for WCN3990")
d390509bdf50 ("ath10k: add hif tx methods for wcn3990")
dafa42036012 ("ath10k: use 64-bit crash dump timestamps")
e2fcf60c6fe8 ("ath10k: detach coredump.c from debug.c")
f1908735f141 ("ath10k: allow ATH10K_SNOC with COMPILE_TEST")
f25b9f285a0e ("ath10k: refactor firmware crashdump code to coredump.c")
v4.9.191: Failed to apply! Possible dependencies:
0fa4fbe9b8cf ("ath10k: add hif power-up/power-down methods")
17f5559e0da5 ("ath10k: platform driver for WCN3990 SNOC WLAN module")
4db66499df91 ("ath10k: add initial USB support")
50c51f394e68 ("ath10k: do not mix spaces and tabs in Kconfig")
5524ddd4c1f1 ("ath10k: select WANT_DEV_COREDUMP")
6d084ac27ab4 ("ath10k: initialise struct ath10k_bus params to zero")
84efe7f6ebc5 ("ath10k: map HTC services to tx/rx pipes for wcn3990")
a0aedd6e0b57 ("ath10k: build ce layer in ath10k core module")
a6a793f98786 ("ath10k: vote for hardware resources for WCN3990")
a6e149a9ff03 ("ath10k: add hif start/stop methods for wcn3990 snoc layer")
ba94c753ccb4 ("ath10k: add QMI message handshake for wcn3990 client")
c0d8d565787c ("ath10k: add struct ath10k_bus_params")
c963a683e701 ("ath10k: add resource init and deinit for WCN3990")
cec17c382140 ("ath10k: add per peer htt tx stats support for 10.4")
d390509bdf50 ("ath10k: add hif tx methods for wcn3990")
d96db25d2025 ("ath10k: add initial SDIO support")
f1908735f141 ("ath10k: allow ATH10K_SNOC with COMPILE_TEST")
v4.4.191: Failed to apply! Possible dependencies:
0b523ced9a3c ("ath10k: add basic skeleton to support ahb")
0d87c9208a17 ("ath10k: expose hif ops for ahb")
133df0f849bc ("ath10k: add chip and bus halt logic in ahb")
14854bfd9daa ("ath10k: add reset ctrl related functions in ahb")
1c44fcb9234c ("ath10k: include irq related functions in ahb")
4ddb3299aa49 ("ath10k: make ath10k_pci_read32/write32() ops more generic")
6d084ac27ab4 ("ath10k: initialise struct ath10k_bus params to zero")
704dc4e36769 ("ath10k: add resource init and deinit in ahb")
7f8e79cdc253 ("ath10k: add helper functions in ahb.c for reg rd/wr")
8beff219c528 ("ath10k: add clock ctrl related functions in ahb")
f52f517189de ("ath10k: make some of ath10k_pci_* func reusable")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks,
Sasha
In embedded environments the requirements are to be able to pick and
chose which features one requires built into the kernel. If an
embedded environment wants to supports loading modules that have been
kbuilt out of tree, there is a need to enable hidden configurations
for legacy wireless core features to provide the API surface for
them to load.
Introduce CONFIG_LEGACY_WEXT_ALLCONFIG to select all legacy wireless
extension core features by activating in turn all the associated
hidden configuration options, without having to specifically select
any wireless module(s).
Signed-off-by: Mark Salyzyn <salyzyn(a)android.com>
Cc: kernel-team(a)android.com
Cc: Johannes Berg <johannes(a)sipsolutions.net>
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: Marcel Holtmann <marcel(a)holtmann.org>
Cc: linux-wireless(a)vger.kernel.org
Cc: netdev(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Cc: stable(a)vger.kernel.org # 4.19
---
v2: change name and documentation to CONFIG_LEGACY_WEXT_ALLCONFIG
---
net/wireless/Kconfig | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 67f8360dfcee..0d646cf28de5 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -17,6 +17,20 @@ config WEXT_SPY
config WEXT_PRIV
bool
+config LEGACY_WEXT_ALLCONFIG
+ bool "allconfig for legacy wireless extensions"
+ select WIRELESS_EXT
+ select WEXT_CORE
+ select WEXT_PROC
+ select WEXT_SPY
+ select WEXT_PRIV
+ help
+ Config option used to enable all the legacy wireless extensions to
+ the core functionality used by add-in modules.
+
+ If you are not building a kernel to be used for a variety of
+ out-of-kernel built wireless modules, say N here.
+
config CFG80211
tristate "cfg80211 - wireless configuration API"
depends on RFKILL || !RFKILL
--
2.23.0.187.g17f5b7556c-goog
Hi,
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag,
fixing commit: 753690898204 SUNRPC: Ensure the bvecs are reset when we re-encode the RPC request.
The bot has tested the following trees: v5.2.13.
v5.2.13: Failed to apply! Possible dependencies:
b5e924191f87 ("SUNRPC: Remove the bh-safe lock requirement on xprt->transport_lock")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks,
Sasha
From: Cong Wang <xiyou.wangcong(a)gmail.com>
commit dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399 upstream.
In commit 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
I introduced a check for xfrm protocol, but according to Herbert
IPSEC_PROTO_ANY should only be used as a wildcard for lookup, so
it should be removed from validate_tmpl().
And, IPSEC_PROTO_ANY is expected to only match 3 IPSec-specific
protocols, this is why xfrm_state_flush() could still miss
IPPROTO_ROUTING, which leads that those entries are left in
net->xfrm.state_all before exit net. Fix this by replacing
IPSEC_PROTO_ANY with zero.
This patch also extracts the check from validate_tmpl() to
xfrm_id_proto_valid() and uses it in parse_ipsecrequest().
With this, no other protocols should be added into xfrm.
Fixes: 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
Reported-by: syzbot+0bf0519d6e0de15914fe(a)syzkaller.appspotmail.com
Cc: Steffen Klassert <steffen.klassert(a)secunet.com>
Cc: Herbert Xu <herbert(a)gondor.apana.org.au>
Signed-off-by: Cong Wang <xiyou.wangcong(a)gmail.com>
Acked-by: Herbert Xu <herbert(a)gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com>
Signed-off-by: Zubin Mithra <zsm(a)chromium.org>
---
Notes:
* Syzkaller triggered a WARNING with the following stacktrace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0xbf/0x113 lib/dump_stack.c:51
panic+0x1a6/0x361 kernel/panic.c:116
__warn+0x168/0x1b0 kernel/panic.c:470
warn_slowpath_null+0x3c/0x40 kernel/panic.c:514
xfrm_state_fini+0x83/0x28e net/xfrm/xfrm_state.c:2131
xfrm_net_exit+0x32/0x35 net/xfrm/xfrm_policy.c:3044
ops_exit_list+0xfc/0x12f net/core/net_namespace.c:136
cleanup_net+0x328/0x4ce net/core/net_namespace.c:454
process_one_work+0x7df/0xca8 kernel/workqueue.c:2064
worker_thread+0x592/0x765 kernel/workqueue.c:2196
kthread+0x279/0x28d kernel/kthread.c:211
ret_from_fork+0x4e/0x80 arch/x86/entry/entry_64.S:600
* The commit is present in linux-4.19.y. A backport for 4.14.y and 4.9.y
has been sent separately.
* The patch resolves the following conflicts:
- conflicts in content of xfrm6_tunnel_net_exit()
- changes in the prototype of xfrm_state_flush()
- net->xfrm.state_gc_work has been moved to a global xfrm_state_gc_work
- ordering of xfrm_state_flush(...) and flush_work(...)
inside xfrm_state_fini.
* Tests run: Chrome OS tryjobs, syzkaller reproducer
include/net/xfrm.h | 17 +++++++++++++++++
net/key/af_key.c | 4 +++-
net/xfrm/xfrm_state.c | 2 +-
net/xfrm/xfrm_user.c | 14 +-------------
4 files changed, 22 insertions(+), 15 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 185fb037b332..631614856afc 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1301,6 +1301,23 @@ static inline int xfrm_state_kern(const struct xfrm_state *x)
return atomic_read(&x->tunnel_users);
}
+static inline bool xfrm_id_proto_valid(u8 proto)
+{
+ switch (proto) {
+ case IPPROTO_AH:
+ case IPPROTO_ESP:
+ case IPPROTO_COMP:
+#if IS_ENABLED(CONFIG_IPV6)
+ case IPPROTO_ROUTING:
+ case IPPROTO_DSTOPTS:
+#endif
+ return true;
+ default:
+ return false;
+ }
+}
+
+/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
{
return (!userproto || proto == userproto ||
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 36db179d848e..d2ec620319d7 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1969,8 +1969,10 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
if (rq->sadb_x_ipsecrequest_mode == 0)
return -EINVAL;
+ if (!xfrm_id_proto_valid(rq->sadb_x_ipsecrequest_proto))
+ return -EINVAL;
- t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */
+ t->id.proto = rq->sadb_x_ipsecrequest_proto;
if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0)
return -EINVAL;
t->mode = mode;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 13f261feb75c..787f2cac18c5 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2133,7 +2133,7 @@ void xfrm_state_fini(struct net *net)
unsigned int sz;
flush_work(&net->xfrm.state_hash_work);
- xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
+ xfrm_state_flush(net, 0, false);
flush_work(&net->xfrm.state_gc_work);
WARN_ON(!list_empty(&net->xfrm.state_all));
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 8cc2a9df84fd..4dbe6ebeabf8 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1448,20 +1448,8 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
return -EINVAL;
}
- switch (ut[i].id.proto) {
- case IPPROTO_AH:
- case IPPROTO_ESP:
- case IPPROTO_COMP:
-#if IS_ENABLED(CONFIG_IPV6)
- case IPPROTO_ROUTING:
- case IPPROTO_DSTOPTS:
-#endif
- case IPSEC_PROTO_ANY:
- break;
- default:
+ if (!xfrm_id_proto_valid(ut[i].id.proto))
return -EINVAL;
- }
-
}
return 0;
--
2.23.0.162.g0b9fbb3734-goog
From: Wenwen Wang <wenwen(a)cs.uga.edu>
[ Upstream commit 2c231c0c1dec42192aca0f87f2dc68b8f0cbc7d2 ]
In ti_dra7_xbar_probe(), 'rsv_events' is allocated through kcalloc(). Then
of_property_read_u32_array() is invoked to search for the property.
However, if this process fails, 'rsv_events' is not deallocated, leading to
a memory leak bug. To fix this issue, free 'rsv_events' before returning
the error.
Signed-off-by: Wenwen Wang <wenwen(a)cs.uga.edu>
Acked-by: Peter Ujfalusi <peter.ujfalusi(a)ti.com>
Link: https://lore.kernel.org/r/1565938136-7249-1-git-send-email-wenwen@cs.uga.edu
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/dma/ti-dma-crossbar.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c
index 8c3c588834d2e..a7e1f6e17e3d1 100644
--- a/drivers/dma/ti-dma-crossbar.c
+++ b/drivers/dma/ti-dma-crossbar.c
@@ -395,8 +395,10 @@ static int ti_dra7_xbar_probe(struct platform_device *pdev)
ret = of_property_read_u32_array(node, pname, (u32 *)rsv_events,
nelm * 2);
- if (ret)
+ if (ret) {
+ kfree(rsv_events);
return ret;
+ }
for (i = 0; i < nelm; i++) {
ti_dra7_xbar_reserve(rsv_events[i][0], rsv_events[i][1],
--
2.20.1
From: Wenwen Wang <wenwen(a)cs.uga.edu>
[ Upstream commit 2c231c0c1dec42192aca0f87f2dc68b8f0cbc7d2 ]
In ti_dra7_xbar_probe(), 'rsv_events' is allocated through kcalloc(). Then
of_property_read_u32_array() is invoked to search for the property.
However, if this process fails, 'rsv_events' is not deallocated, leading to
a memory leak bug. To fix this issue, free 'rsv_events' before returning
the error.
Signed-off-by: Wenwen Wang <wenwen(a)cs.uga.edu>
Acked-by: Peter Ujfalusi <peter.ujfalusi(a)ti.com>
Link: https://lore.kernel.org/r/1565938136-7249-1-git-send-email-wenwen@cs.uga.edu
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/dma/ti-dma-crossbar.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c
index 9272b173c7465..6574cb5a12fee 100644
--- a/drivers/dma/ti-dma-crossbar.c
+++ b/drivers/dma/ti-dma-crossbar.c
@@ -395,8 +395,10 @@ static int ti_dra7_xbar_probe(struct platform_device *pdev)
ret = of_property_read_u32_array(node, pname, (u32 *)rsv_events,
nelm * 2);
- if (ret)
+ if (ret) {
+ kfree(rsv_events);
return ret;
+ }
for (i = 0; i < nelm; i++) {
ti_dra7_xbar_reserve(rsv_events[i][0], rsv_events[i][1],
--
2.20.1
From: Wenwen Wang <wenwen(a)cs.uga.edu>
[ Upstream commit 2c231c0c1dec42192aca0f87f2dc68b8f0cbc7d2 ]
In ti_dra7_xbar_probe(), 'rsv_events' is allocated through kcalloc(). Then
of_property_read_u32_array() is invoked to search for the property.
However, if this process fails, 'rsv_events' is not deallocated, leading to
a memory leak bug. To fix this issue, free 'rsv_events' before returning
the error.
Signed-off-by: Wenwen Wang <wenwen(a)cs.uga.edu>
Acked-by: Peter Ujfalusi <peter.ujfalusi(a)ti.com>
Link: https://lore.kernel.org/r/1565938136-7249-1-git-send-email-wenwen@cs.uga.edu
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/dma/ti/dma-crossbar.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/ti/dma-crossbar.c b/drivers/dma/ti/dma-crossbar.c
index 9272b173c7465..6574cb5a12fee 100644
--- a/drivers/dma/ti/dma-crossbar.c
+++ b/drivers/dma/ti/dma-crossbar.c
@@ -395,8 +395,10 @@ static int ti_dra7_xbar_probe(struct platform_device *pdev)
ret = of_property_read_u32_array(node, pname, (u32 *)rsv_events,
nelm * 2);
- if (ret)
+ if (ret) {
+ kfree(rsv_events);
return ret;
+ }
for (i = 0; i < nelm; i++) {
ti_dra7_xbar_reserve(rsv_events[i][0], rsv_events[i][1],
--
2.20.1
When vbi stream is started, followed by video streaming,
the vid_cap_streaming and vid_out_streaming were not being set to true,
which would cause the video stream to stop when vbi stream is stopped.
This patch allows to set vid_cap_streaming and vid_out_streaming to true.
According to Hans Verkuil it appears that these 'if (dev->kthread_vid_cap)'
checks are a left-over from the original vivid development and should never
have been there.
Signed-off-by: Vandana BN <bnvandana(a)gmail.com>
Cc: <stable(a)vger.kernel.org> # for v3.18 and up
---
drivers/media/platform/vivid/vivid-vid-cap.c | 3 ---
drivers/media/platform/vivid/vivid-vid-out.c | 3 ---
2 files changed, 6 deletions(-)
diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
index 8cbaa0c998ed..2d030732feac 100644
--- a/drivers/media/platform/vivid/vivid-vid-cap.c
+++ b/drivers/media/platform/vivid/vivid-vid-cap.c
@@ -223,9 +223,6 @@ static int vid_cap_start_streaming(struct vb2_queue *vq, unsigned count)
if (vb2_is_streaming(&dev->vb_vid_out_q))
dev->can_loop_video = vivid_vid_can_loop(dev);
- if (dev->kthread_vid_cap)
- return 0;
-
dev->vid_cap_seq_count = 0;
dprintk(dev, 1, "%s\n", __func__);
for (i = 0; i < VIDEO_MAX_FRAME; i++)
diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
index 148b663a6075..a0364ac497f9 100644
--- a/drivers/media/platform/vivid/vivid-vid-out.c
+++ b/drivers/media/platform/vivid/vivid-vid-out.c
@@ -161,9 +161,6 @@ static int vid_out_start_streaming(struct vb2_queue *vq, unsigned count)
if (vb2_is_streaming(&dev->vb_vid_cap_q))
dev->can_loop_video = vivid_vid_can_loop(dev);
- if (dev->kthread_vid_out)
- return 0;
-
dev->vid_out_seq_count = 0;
dprintk(dev, 1, "%s\n", __func__);
if (dev->start_streaming_error) {
--
2.17.1
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/152054
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
We grabbed the 2410b24b1dd2 commit of the stable queue repository.
We then merged the patchset with `git am`:
mld-fix-memory-leak-in-mld_del_delrec.patch
net-fix-skb-use-after-free-in-netpoll.patch
net-sched-act_sample-fix-psample-group-handling-on-overwrite.patch
net_sched-fix-a-null-pointer-deref-in-ipt-action.patch
net-stmmac-dwmac-rk-don-t-fail-if-phy-regulator-is-absent.patch
tcp-inherit-timestamp-on-mtu-probe.patch
tcp-remove-empty-skb-from-write-queue-in-error-cases.patch
nfp-flower-prevent-ingress-block-binds-on-internal-ports.patch
nfp-flower-handle-neighbour-events-on-internal-ports.patch
revert-r8152-napi-hangup-fix-after-disconnect.patch
r8152-remove-calling-netif_napi_del.patch
taprio-fix-kernel-panic-in-taprio_destroy.patch
taprio-set-default-link-speed-to-10-mbps-in-taprio_set_picos_per_byte.patch
net-sched-cbs-set-default-link-speed-to-10-mbps-in-cbs_set_port_rate.patch
add-genphy_c45_config_aneg-function-to-phy-c45.c.patch
net-dsa-tag_8021q-future-proof-the-reserved-fields-in-the-custom-vid.patch
net-sched-pfifo_fast-fix-wrong-dereference-in-pfifo_fast_enqueue.patch
net-sched-pfifo_fast-fix-wrong-dereference-when-qdisc-is-reset.patch
net-rds-fix-info-leak-in-rds6_inc_info_copy.patch
batman-adv-fix-netlink-dumping-of-all-mcast_flags-bu.patch
libbpf-fix-erroneous-multi-closing-of-btf-fd.patch
libbpf-set-btf-fd-for-prog-only-when-there-is-suppor.patch
netfilter-nf_flow_table-fix-offload-for-flows-that-a.patch
net-mlx5e-fix-error-flow-of-cqe-recovery-on-tx-repor.patch
clk-samsung-change-signature-of-exynos5_subcmus_init.patch
clk-samsung-exynos5800-move-mau-subsystem-clocks-to-.patch
clk-samsung-exynos542x-move-mscl-subsystem-clocks-to.patch
net-tundra-tsi108-use-spin_lock_irqsave-instead-of-s.patch
netfilter-nf_tables-use-after-free-in-failing-rule-w.patch
netfilter-nf_flow_table-conntrack-picks-up-expired-f.patch
netfilter-nf_flow_table-teardown-flow-timeout-race.patch
tools-bpftool-fix-error-message-prog-object.patch
ixgbe-fix-possible-deadlock-in-ixgbe_service_task.patch
hv_netvsc-fix-a-warning-of-suspicious-rcu-usage.patch
net-tc35815-explicitly-check-net_ip_align-is-not-zer.patch
bluetooth-btqca-add-a-short-delay-before-downloading.patch
bluetooth-hci_qca-send-vs-pre-shutdown-command.patch
bluetooth-hidp-let-hidp_send_message-return-number-o.patch
s390-qeth-serialize-cmd-reply-with-concurrent-timeou.patch
ibmveth-convert-multicast-list-size-for-little-endia.patch
gpio-fix-build-error-of-function-redefinition.patch
netfilter-nft_flow_offload-skip-tcp-rst-and-fin-pack.patch
drm-mediatek-use-correct-device-to-import-prime-buff.patch
drm-mediatek-set-dma-max-segment-size.patch
scsi-qla2xxx-fix-gnl.l-memory-leak-on-adapter-init-f.patch
scsi-target-tcmu-avoid-use-after-free-after-command-.patch
cxgb4-fix-a-memory-leak-bug.patch
selftests-kvm-do-not-try-running-the-vm-in-vmx_set_n.patch
selftests-kvm-provide-common-function-to-enable-evmc.patch
selftests-kvm-fix-vmx_set_nested_state_test.patch
liquidio-add-cleanup-in-octeon_setup_iq.patch
net-myri10ge-fix-memory-leaks.patch
clk-fix-falling-back-to-legacy-parent-string-matchin.patch
clk-fix-potential-null-dereference-in-clk_fetch_pare.patch
lan78xx-fix-memory-leaks.patch
vfs-fix-page-locking-deadlocks-when-deduping-files.patch
cx82310_eth-fix-a-memory-leak-bug.patch
net-kalmia-fix-memory-leaks.patch
ibmvnic-unmap-dma-address-of-tx-descriptor-buffers-a.patch
net-cavium-fix-driver-name.patch
wimax-i2400m-fix-a-memory-leak-bug.patch
ravb-fix-use-after-free-ravb_tstamp_skb.patch
sched-core-schedule-new-worker-even-if-pi-blocked.patch
kprobes-fix-potential-deadlock-in-kprobe_optimizer.patch
hid-intel-ish-hid-ipc-add-ehl-device-id.patch
hid-cp2112-prevent-sleeping-function-called-from-inv.patch
x86-boot-compressed-64-fix-boot-on-machines-with-bro.patch
scsi-lpfc-mitigate-high-memory-pre-allocation-by-scs.patch
input-hyperv-keyboard-use-in-place-iterator-api-in-t.patch
tools-hv-kvp-eliminate-may-be-used-uninitialized-war.patch
nvme-multipath-fix-possible-i-o-hang-when-paths-are-.patch
nvme-fix-cntlid-validation-when-not-using-nvmeof.patch
rdma-cma-fix-null-ptr-deref-read-in-cma_cleanup.patch
ib-mlx4-fix-memory-leaks.patch
infiniband-hfi1-fix-a-memory-leak-bug.patch
infiniband-hfi1-fix-memory-leaks.patch
selftests-kvm-fix-state-save-load-on-processors-with.patch
selftests-kvm-make-platform_info_test-pass-on-amd.patch
drm-amdgpu-prevent-memory-leaks-in-amdgpu_cs-ioctl.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fi.patch
kvm-arm-arm64-only-skip-mmio-insn-once.patch
afs-fix-leak-in-afs_lookup_cell_rcu.patch
afs-fix-possible-oops-in-afs_lookup-trace-event.patch
afs-use-correct-afs_call_type-in-yfs_fs_store_opaque.patch
rdma-bnxt_re-fix-stack-out-of-bounds-in-bnxt_qplib_r.patch
gpio-fix-irqchip-initialization-order.patch
kvm-arm-arm64-vgic-properly-initialise-private-irq-a.patch
x86-boot-compressed-64-fix-missing-initialization-in.patch
libceph-allow-ceph_buffer_put-to-receive-a-null-ceph.patch
revert-x86-apic-include-the-ldr-when-clearing-out-ap.patch
x86-boot-preserve-boot_params.secure_boot-from-sanitizing.patch
revert-mmc-core-do-not-retry-cmd6-in-__mmc_switch.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ Networking TCP: keepalive test [9]
✅ audit: audit testsuite test [10]
✅ httpd: mod_ssl smoke sanity [11]
✅ iotop: sanity [12]
✅ tuned: tune-processes-through-perf [13]
✅ Usex - version 1.9-29 [14]
✅ storage: SCSI VPD [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
Host 2:
✅ Boot test [0]
✅ xfstests: xfs [19]
✅ selinux-policy: serge-testsuite [20]
🚧 ✅ Storage blktests [21]
ppc64le:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [19]
✅ selinux-policy: serge-testsuite [20]
🚧 ✅ Storage blktests [21]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking TCP: keepalive test [9]
✅ audit: audit testsuite test [10]
✅ httpd: mod_ssl smoke sanity [11]
✅ iotop: sanity [12]
✅ tuned: tune-processes-through-perf [13]
✅ Usex - version 1.9-29 [14]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
x86_64:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [19]
✅ selinux-policy: serge-testsuite [20]
🚧 ✅ Storage blktests [21]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ Networking: igmp conformance test [8]
✅ Networking TCP: keepalive test [9]
✅ audit: audit testsuite test [10]
✅ httpd: mod_ssl smoke sanity [11]
✅ iotop: sanity [12]
✅ tuned: tune-processes-through-perf [13]
✅ pciutils: sanity smoke test [22]
✅ Usex - version 1.9-29 [14]
✅ storage: SCSI VPD [15]
✅ stress: stress-ng [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/t…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[22]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/151728
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
We grabbed the e14dfe63096c commit of the stable queue repository.
We then merged the patchset with `git am`:
mld-fix-memory-leak-in-mld_del_delrec.patch
net-fix-skb-use-after-free-in-netpoll.patch
net-sched-act_sample-fix-psample-group-handling-on-overwrite.patch
net_sched-fix-a-null-pointer-deref-in-ipt-action.patch
net-stmmac-dwmac-rk-don-t-fail-if-phy-regulator-is-absent.patch
tcp-inherit-timestamp-on-mtu-probe.patch
tcp-remove-empty-skb-from-write-queue-in-error-cases.patch
nfp-flower-prevent-ingress-block-binds-on-internal-ports.patch
nfp-flower-handle-neighbour-events-on-internal-ports.patch
revert-r8152-napi-hangup-fix-after-disconnect.patch
r8152-remove-calling-netif_napi_del.patch
taprio-fix-kernel-panic-in-taprio_destroy.patch
taprio-set-default-link-speed-to-10-mbps-in-taprio_set_picos_per_byte.patch
net-sched-cbs-set-default-link-speed-to-10-mbps-in-cbs_set_port_rate.patch
add-genphy_c45_config_aneg-function-to-phy-c45.c.patch
net-dsa-tag_8021q-future-proof-the-reserved-fields-in-the-custom-vid.patch
net-sched-pfifo_fast-fix-wrong-dereference-in-pfifo_fast_enqueue.patch
net-sched-pfifo_fast-fix-wrong-dereference-when-qdisc-is-reset.patch
net-rds-fix-info-leak-in-rds6_inc_info_copy.patch
batman-adv-fix-netlink-dumping-of-all-mcast_flags-bu.patch
libbpf-fix-erroneous-multi-closing-of-btf-fd.patch
libbpf-set-btf-fd-for-prog-only-when-there-is-suppor.patch
netfilter-nf_flow_table-fix-offload-for-flows-that-a.patch
net-mlx5e-fix-error-flow-of-cqe-recovery-on-tx-repor.patch
clk-samsung-change-signature-of-exynos5_subcmus_init.patch
clk-samsung-exynos5800-move-mau-subsystem-clocks-to-.patch
clk-samsung-exynos542x-move-mscl-subsystem-clocks-to.patch
net-tundra-tsi108-use-spin_lock_irqsave-instead-of-s.patch
netfilter-nf_tables-use-after-free-in-failing-rule-w.patch
netfilter-nf_flow_table-conntrack-picks-up-expired-f.patch
netfilter-nf_flow_table-teardown-flow-timeout-race.patch
tools-bpftool-fix-error-message-prog-object.patch
ixgbe-fix-possible-deadlock-in-ixgbe_service_task.patch
hv_netvsc-fix-a-warning-of-suspicious-rcu-usage.patch
net-tc35815-explicitly-check-net_ip_align-is-not-zer.patch
bluetooth-btqca-add-a-short-delay-before-downloading.patch
bluetooth-hci_qca-send-vs-pre-shutdown-command.patch
bluetooth-hidp-let-hidp_send_message-return-number-o.patch
s390-qeth-serialize-cmd-reply-with-concurrent-timeou.patch
ibmveth-convert-multicast-list-size-for-little-endia.patch
gpio-fix-build-error-of-function-redefinition.patch
netfilter-nft_flow_offload-skip-tcp-rst-and-fin-pack.patch
drm-mediatek-use-correct-device-to-import-prime-buff.patch
drm-mediatek-set-dma-max-segment-size.patch
scsi-qla2xxx-fix-gnl.l-memory-leak-on-adapter-init-f.patch
scsi-target-tcmu-avoid-use-after-free-after-command-.patch
cxgb4-fix-a-memory-leak-bug.patch
selftests-kvm-do-not-try-running-the-vm-in-vmx_set_n.patch
selftests-kvm-provide-common-function-to-enable-evmc.patch
selftests-kvm-fix-vmx_set_nested_state_test.patch
liquidio-add-cleanup-in-octeon_setup_iq.patch
net-myri10ge-fix-memory-leaks.patch
clk-fix-falling-back-to-legacy-parent-string-matchin.patch
clk-fix-potential-null-dereference-in-clk_fetch_pare.patch
lan78xx-fix-memory-leaks.patch
vfs-fix-page-locking-deadlocks-when-deduping-files.patch
cx82310_eth-fix-a-memory-leak-bug.patch
net-kalmia-fix-memory-leaks.patch
ibmvnic-unmap-dma-address-of-tx-descriptor-buffers-a.patch
net-cavium-fix-driver-name.patch
wimax-i2400m-fix-a-memory-leak-bug.patch
ravb-fix-use-after-free-ravb_tstamp_skb.patch
sched-core-schedule-new-worker-even-if-pi-blocked.patch
kprobes-fix-potential-deadlock-in-kprobe_optimizer.patch
hid-intel-ish-hid-ipc-add-ehl-device-id.patch
hid-cp2112-prevent-sleeping-function-called-from-inv.patch
x86-boot-compressed-64-fix-boot-on-machines-with-bro.patch
scsi-lpfc-mitigate-high-memory-pre-allocation-by-scs.patch
input-hyperv-keyboard-use-in-place-iterator-api-in-t.patch
tools-hv-kvp-eliminate-may-be-used-uninitialized-war.patch
nvme-multipath-fix-possible-i-o-hang-when-paths-are-.patch
nvme-fix-cntlid-validation-when-not-using-nvmeof.patch
rdma-cma-fix-null-ptr-deref-read-in-cma_cleanup.patch
ib-mlx4-fix-memory-leaks.patch
infiniband-hfi1-fix-a-memory-leak-bug.patch
infiniband-hfi1-fix-memory-leaks.patch
selftests-kvm-fix-state-save-load-on-processors-with.patch
selftests-kvm-make-platform_info_test-pass-on-amd.patch
drm-amdgpu-prevent-memory-leaks-in-amdgpu_cs-ioctl.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fi.patch
kvm-arm-arm64-only-skip-mmio-insn-once.patch
afs-fix-leak-in-afs_lookup_cell_rcu.patch
afs-fix-possible-oops-in-afs_lookup-trace-event.patch
afs-use-correct-afs_call_type-in-yfs_fs_store_opaque.patch
rdma-bnxt_re-fix-stack-out-of-bounds-in-bnxt_qplib_r.patch
gpio-fix-irqchip-initialization-order.patch
kvm-arm-arm64-vgic-properly-initialise-private-irq-a.patch
x86-boot-compressed-64-fix-missing-initialization-in.patch
libceph-allow-ceph_buffer_put-to-receive-a-null-ceph.patch
revert-x86-apic-include-the-ldr-when-clearing-out-ap.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
ppc64le:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
🚧 ✅ Storage blktests [3]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [4]
✅ Podman system integration test (as user) [4]
✅ Loopdev Sanity [5]
✅ jvm test suite [6]
✅ AMTU (Abstract Machine Test Utility) [7]
✅ LTP: openposix test suite [8]
✅ Ethernet drivers sanity [9]
✅ Networking socket: fuzz [10]
✅ Networking TCP: keepalive test [11]
✅ audit: audit testsuite test [12]
✅ httpd: mod_ssl smoke sanity [13]
✅ iotop: sanity [14]
✅ tuned: tune-processes-through-perf [15]
✅ Usex - version 1.9-29 [16]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
x86_64:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [4]
✅ Podman system integration test (as user) [4]
✅ Loopdev Sanity [5]
✅ jvm test suite [6]
✅ AMTU (Abstract Machine Test Utility) [7]
✅ LTP: openposix test suite [8]
✅ Ethernet drivers sanity [9]
✅ Networking socket: fuzz [10]
✅ Networking: igmp conformance test [19]
✅ Networking TCP: keepalive test [11]
✅ audit: audit testsuite test [12]
✅ httpd: mod_ssl smoke sanity [13]
✅ iotop: sanity [14]
✅ tuned: tune-processes-through-perf [15]
✅ pciutils: sanity smoke test [20]
✅ Usex - version 1.9-29 [16]
✅ storage: SCSI VPD [21]
✅ stress: stress-ng [22]
🚧 ✅ LTP lite [17]
🚧 ✅ Memory function: kaslr [18]
Host 2:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
🚧 ✅ Storage blktests [3]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/t…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#networking/i…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[21]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi…
[22]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Francois reported that VMware balloon gets stuck after a balloon reset,
when the VMCI doorbell is removed. A similar error can occur when the
balloon driver is removed with the following splat:
[ 1088.622000] INFO: task modprobe:3565 blocked for more than 120 seconds.
[ 1088.622035] Tainted: G W 5.2.0 #4
[ 1088.622087] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1088.622205] modprobe D 0 3565 1450 0x00000000
[ 1088.622210] Call Trace:
[ 1088.622246] __schedule+0x2a8/0x690
[ 1088.622248] schedule+0x2d/0x90
[ 1088.622250] schedule_timeout+0x1d3/0x2f0
[ 1088.622252] wait_for_completion+0xba/0x140
[ 1088.622320] ? wake_up_q+0x80/0x80
[ 1088.622370] vmci_resource_remove+0xb9/0xc0 [vmw_vmci]
[ 1088.622373] vmci_doorbell_destroy+0x9e/0xd0 [vmw_vmci]
[ 1088.622379] vmballoon_vmci_cleanup+0x6e/0xf0 [vmw_balloon]
[ 1088.622381] vmballoon_exit+0x18/0xcc8 [vmw_balloon]
[ 1088.622394] __x64_sys_delete_module+0x146/0x280
[ 1088.622408] do_syscall_64+0x5a/0x130
[ 1088.622410] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1088.622415] RIP: 0033:0x7f54f62791b7
[ 1088.622421] Code: Bad RIP value.
[ 1088.622421] RSP: 002b:00007fff2a949008 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[ 1088.622426] RAX: ffffffffffffffda RBX: 000055dff8b55d00 RCX: 00007f54f62791b7
[ 1088.622426] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055dff8b55d68
[ 1088.622427] RBP: 000055dff8b55d00 R08: 00007fff2a947fb1 R09: 0000000000000000
[ 1088.622427] R10: 00007f54f62f5cc0 R11: 0000000000000206 R12: 000055dff8b55d68
[ 1088.622428] R13: 0000000000000001 R14: 000055dff8b55d68 R15: 00007fff2a94a3f0
The cause for the bug is that when the "delayed" doorbell is invoked, it
takes a reference on the doorbell entry and schedules work that is
supposed to run the appropriate code and drop the doorbell entry
reference. The code ignores the fact that if the work is already queued,
it will not be scheduled to run one more time. As a result one of the
references would not be dropped. When the code waits for the reference
to get to zero, during balloon reset or module removal, it gets stuck.
Fix it. Drop the reference if schedule_work() indicates that the work is
already queued.
Note that this bug got more apparent (or apparent at all) due to
commit ce664331b248 ("vmw_balloon: VMCI_DOORBELL_SET does not check status").
Fixes: 83e2ec765be03 ("VMCI: doorbell implementation.")
Reported-by: Francois Rigault <rigault.francois(a)gmail.com>
Cc: Jorgen Hansen <jhansen(a)vmware.com>
Cc: Adit Ranadive <aditr(a)vmware.com>
Cc: Alexios Zavras <alexios.zavras(a)intel.com>
Cc: Vishnu DASA <vdasa(a)vmware.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Nadav Amit <namit(a)vmware.com>
---
drivers/misc/vmw_vmci/vmci_doorbell.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
index bad89b6e0802..345addd9306d 100644
--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
+++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
@@ -310,7 +310,8 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle)
entry = container_of(resource, struct dbell_entry, resource);
if (entry->run_delayed) {
- schedule_work(&entry->work);
+ if (!schedule_work(&entry->work))
+ vmci_resource_put(resource);
} else {
entry->notify_cb(entry->client_data);
vmci_resource_put(resource);
@@ -361,7 +362,8 @@ static void dbell_fire_entries(u32 notify_idx)
atomic_read(&dbell->active) == 1) {
if (dbell->run_delayed) {
vmci_resource_get(&dbell->resource);
- schedule_work(&dbell->work);
+ if (!schedule_work(&dbell->work))
+ vmci_resource_put(&dbell->resource);
} else {
dbell->notify_cb(dbell->client_data);
}
--
2.19.1
950b07c14e8c ("Revert "x86/apic: Include the LDR when clearing out APIC registers"")
in Linus tree needs to go back into stable as the reverted commit
558682b52919 ("x86/apic: Include the LDR when clearing out APIC registers")
hit stable trees.
Thanks,
tglx
---------- Forwarded message ----------
Date: Sat, 7 Sep 2019 14:13:22 -0700
From: Linus Torvalds <torvalds(a)linux-foundation.org>
To: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>,
Linux List Kernel Mailing <linux-kernel(a)vger.kernel.org>,
Bandan Das <bsd(a)redhat.com>
Subject: Re: Linux 5.3-rc7
On Sat, Sep 7, 2019 at 1:44 PM Thomas Gleixner <tglx(a)linutronix.de> wrote:
>
> That's what I just replied to Chris. Can you do it right away or should I queue it up?
Done.
Thanks,
Linus
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/150888
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
We grabbed the ba155668e45f commit of the stable queue repository.
We then merged the patchset with `git am`:
batman-adv-fix-netlink-dumping-of-all-mcast_flags-bu.patch
libbpf-fix-erroneous-multi-closing-of-btf-fd.patch
libbpf-set-btf-fd-for-prog-only-when-there-is-suppor.patch
netfilter-nf_flow_table-fix-offload-for-flows-that-a.patch
net-mlx5e-fix-error-flow-of-cqe-recovery-on-tx-repor.patch
clk-samsung-change-signature-of-exynos5_subcmus_init.patch
clk-samsung-exynos5800-move-mau-subsystem-clocks-to-.patch
clk-samsung-exynos542x-move-mscl-subsystem-clocks-to.patch
net-tundra-tsi108-use-spin_lock_irqsave-instead-of-s.patch
netfilter-nf_tables-use-after-free-in-failing-rule-w.patch
netfilter-nf_flow_table-conntrack-picks-up-expired-f.patch
netfilter-nf_flow_table-teardown-flow-timeout-race.patch
tools-bpftool-fix-error-message-prog-object.patch
ixgbe-fix-possible-deadlock-in-ixgbe_service_task.patch
hv_netvsc-fix-a-warning-of-suspicious-rcu-usage.patch
net-tc35815-explicitly-check-net_ip_align-is-not-zer.patch
bluetooth-btqca-add-a-short-delay-before-downloading.patch
bluetooth-hci_qca-send-vs-pre-shutdown-command.patch
bluetooth-hidp-let-hidp_send_message-return-number-o.patch
s390-qeth-serialize-cmd-reply-with-concurrent-timeou.patch
ibmveth-convert-multicast-list-size-for-little-endia.patch
gpio-fix-build-error-of-function-redefinition.patch
netfilter-nft_flow_offload-skip-tcp-rst-and-fin-pack.patch
drm-mediatek-use-correct-device-to-import-prime-buff.patch
drm-mediatek-set-dma-max-segment-size.patch
scsi-qla2xxx-fix-gnl.l-memory-leak-on-adapter-init-f.patch
scsi-target-tcmu-avoid-use-after-free-after-command-.patch
cxgb4-fix-a-memory-leak-bug.patch
selftests-kvm-do-not-try-running-the-vm-in-vmx_set_n.patch
selftests-kvm-provide-common-function-to-enable-evmc.patch
selftests-kvm-fix-vmx_set_nested_state_test.patch
liquidio-add-cleanup-in-octeon_setup_iq.patch
net-myri10ge-fix-memory-leaks.patch
clk-fix-falling-back-to-legacy-parent-string-matchin.patch
clk-fix-potential-null-dereference-in-clk_fetch_pare.patch
lan78xx-fix-memory-leaks.patch
vfs-fix-page-locking-deadlocks-when-deduping-files.patch
cx82310_eth-fix-a-memory-leak-bug.patch
net-kalmia-fix-memory-leaks.patch
ibmvnic-unmap-dma-address-of-tx-descriptor-buffers-a.patch
net-cavium-fix-driver-name.patch
wimax-i2400m-fix-a-memory-leak-bug.patch
ravb-fix-use-after-free-ravb_tstamp_skb.patch
sched-core-schedule-new-worker-even-if-pi-blocked.patch
kprobes-fix-potential-deadlock-in-kprobe_optimizer.patch
hid-intel-ish-hid-ipc-add-ehl-device-id.patch
hid-cp2112-prevent-sleeping-function-called-from-inv.patch
x86-boot-compressed-64-fix-boot-on-machines-with-bro.patch
scsi-lpfc-mitigate-high-memory-pre-allocation-by-scs.patch
input-hyperv-keyboard-use-in-place-iterator-api-in-t.patch
tools-hv-kvp-eliminate-may-be-used-uninitialized-war.patch
nvme-multipath-fix-possible-i-o-hang-when-paths-are-.patch
nvme-fix-cntlid-validation-when-not-using-nvmeof.patch
rdma-cma-fix-null-ptr-deref-read-in-cma_cleanup.patch
ib-mlx4-fix-memory-leaks.patch
infiniband-hfi1-fix-a-memory-leak-bug.patch
infiniband-hfi1-fix-memory-leaks.patch
selftests-kvm-fix-state-save-load-on-processors-with.patch
selftests-kvm-make-platform_info_test-pass-on-amd.patch
drm-amdgpu-prevent-memory-leaks-in-amdgpu_cs-ioctl.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fi.patch
kvm-arm-arm64-only-skip-mmio-insn-once.patch
afs-fix-leak-in-afs_lookup_cell_rcu.patch
afs-fix-possible-oops-in-afs_lookup-trace-event.patch
afs-use-correct-afs_call_type-in-yfs_fs_store_opaque.patch
rdma-bnxt_re-fix-stack-out-of-bounds-in-bnxt_qplib_r.patch
gpio-fix-irqchip-initialization-order.patch
kvm-arm-arm64-vgic-properly-initialise-private-irq-a.patch
x86-boot-compressed-64-fix-missing-initialization-in.patch
libceph-allow-ceph_buffer_put-to-receive-a-null-ceph.patch
revert-x86-apic-include-the-ldr-when-clearing-out-ap.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
ppc64le:
Host 1:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ Usex - version 1.9-29 [12]
🚧 ✅ LTP lite [13]
🚧 ✅ Memory function: kaslr [14]
Host 2:
✅ Boot test [0]
✅ xfstests: xfs [15]
✅ selinux-policy: serge-testsuite [16]
🚧 ✅ Storage blktests [17]
x86_64:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [15]
✅ selinux-policy: serge-testsuite [16]
🚧 ✅ Storage blktests [17]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [1]
✅ Podman system integration test (as user) [1]
✅ Loopdev Sanity [2]
✅ jvm test suite [3]
✅ AMTU (Abstract Machine Test Utility) [4]
✅ LTP: openposix test suite [5]
✅ Ethernet drivers sanity [6]
✅ Networking socket: fuzz [7]
✅ audit: audit testsuite test [8]
✅ httpd: mod_ssl smoke sanity [9]
✅ iotop: sanity [10]
✅ tuned: tune-processes-through-perf [11]
✅ pciutils: sanity smoke test [18]
✅ Usex - version 1.9-29 [12]
✅ storage: SCSI VPD [19]
✅ stress: stress-ng [20]
🚧 ✅ LTP lite [13]
🚧 ❌ Memory function: kaslr [14]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
As Vincent noticed, the y2038 conversion of semtimedop in linux-5.1
broke when commit 00bf25d693e7 ("y2038: use time32 syscall names on
32-bit") changed all system calls on all architectures that take
a 32-bit time_t to point to the _time32 implementation, but left out
semtimedop in the asm-generic header.
This affects all 32-bit architectures using asm-generic/unistd.h:
h8300, unicore32, openrisc, nios2, hexagon, c6x, arc, nds32 and csky.
The notable exception is riscv32, which has dropped support for the
time32 system calls entirely.
Reported-by: Vincent Chen <deanbo422(a)gmail.com>
Cc: stable(a)vger.kernel.org
Cc: Vincent Chen <deanbo422(a)gmail.com>
Cc: Greentime Hu <green.hu(a)gmail.com>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Guan Xuetao <gxt(a)pku.edu.cn>
Cc: Stafford Horne <shorne(a)gmail.com>
Cc: Jonas Bonn <jonas(a)southpole.se>
Cc: Stefan Kristiansson <stefan.kristiansson(a)saunalahti.fi>
Cc: Ley Foon Tan <lftan(a)altera.com>
Cc: Richard Kuo <rkuo(a)codeaurora.org>
Cc: Mark Salter <msalter(a)redhat.com>
Cc: Aurelien Jacquiot <jacquiot.aurelien(a)gmail.com>
Cc: Guo Ren <guoren(a)kernel.org>
Fixes: 00bf25d693e7 ("y2038: use time32 syscall names on 32-bit")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
Hi Vincent,
Sorry for the delay since your report. Does this address your
problem?
Anyone else, please note that this patch is required since
5.1 to make sysvipc work on the listed architectures.
---
include/uapi/asm-generic/unistd.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 1be0e798e362..1fc8faa6e973 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -569,7 +569,7 @@ __SYSCALL(__NR_semget, sys_semget)
__SC_COMP(__NR_semctl, sys_semctl, compat_sys_semctl)
#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
#define __NR_semtimedop 192
-__SC_COMP(__NR_semtimedop, sys_semtimedop, sys_semtimedop_time32)
+__SC_3264(__NR_semtimedop, sys_semtimedop_time32, sys_semtimedop)
#endif
#define __NR_semop 193
__SYSCALL(__NR_semop, sys_semop)
--
2.20.0
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/149570
One or more kernel tests failed:
ppc64le:
❌ selinux-policy: serge-testsuite
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 218ca2e5affe - Linux 5.2.13
We grabbed the 38896de0ab4b commit of the stable queue repository.
We then merged the patchset with `git am`:
batman-adv-fix-netlink-dumping-of-all-mcast_flags-bu.patch
libbpf-fix-erroneous-multi-closing-of-btf-fd.patch
libbpf-set-btf-fd-for-prog-only-when-there-is-suppor.patch
netfilter-nf_flow_table-fix-offload-for-flows-that-a.patch
net-mlx5e-fix-error-flow-of-cqe-recovery-on-tx-repor.patch
clk-samsung-change-signature-of-exynos5_subcmus_init.patch
clk-samsung-exynos5800-move-mau-subsystem-clocks-to-.patch
clk-samsung-exynos542x-move-mscl-subsystem-clocks-to.patch
net-tundra-tsi108-use-spin_lock_irqsave-instead-of-s.patch
netfilter-nf_tables-use-after-free-in-failing-rule-w.patch
netfilter-nf_flow_table-conntrack-picks-up-expired-f.patch
netfilter-nf_flow_table-teardown-flow-timeout-race.patch
tools-bpftool-fix-error-message-prog-object.patch
ixgbe-fix-possible-deadlock-in-ixgbe_service_task.patch
hv_netvsc-fix-a-warning-of-suspicious-rcu-usage.patch
net-tc35815-explicitly-check-net_ip_align-is-not-zer.patch
bluetooth-btqca-add-a-short-delay-before-downloading.patch
bluetooth-hci_qca-send-vs-pre-shutdown-command.patch
bluetooth-hidp-let-hidp_send_message-return-number-o.patch
s390-qeth-serialize-cmd-reply-with-concurrent-timeou.patch
ibmveth-convert-multicast-list-size-for-little-endia.patch
gpio-fix-build-error-of-function-redefinition.patch
netfilter-nft_flow_offload-skip-tcp-rst-and-fin-pack.patch
drm-mediatek-use-correct-device-to-import-prime-buff.patch
drm-mediatek-set-dma-max-segment-size.patch
scsi-qla2xxx-fix-gnl.l-memory-leak-on-adapter-init-f.patch
scsi-target-tcmu-avoid-use-after-free-after-command-.patch
cxgb4-fix-a-memory-leak-bug.patch
selftests-kvm-do-not-try-running-the-vm-in-vmx_set_n.patch
selftests-kvm-provide-common-function-to-enable-evmc.patch
selftests-kvm-fix-vmx_set_nested_state_test.patch
liquidio-add-cleanup-in-octeon_setup_iq.patch
net-myri10ge-fix-memory-leaks.patch
clk-fix-falling-back-to-legacy-parent-string-matchin.patch
clk-fix-potential-null-dereference-in-clk_fetch_pare.patch
lan78xx-fix-memory-leaks.patch
vfs-fix-page-locking-deadlocks-when-deduping-files.patch
cx82310_eth-fix-a-memory-leak-bug.patch
net-kalmia-fix-memory-leaks.patch
ibmvnic-unmap-dma-address-of-tx-descriptor-buffers-a.patch
net-cavium-fix-driver-name.patch
wimax-i2400m-fix-a-memory-leak-bug.patch
ravb-fix-use-after-free-ravb_tstamp_skb.patch
sched-core-schedule-new-worker-even-if-pi-blocked.patch
kprobes-fix-potential-deadlock-in-kprobe_optimizer.patch
hid-intel-ish-hid-ipc-add-ehl-device-id.patch
hid-cp2112-prevent-sleeping-function-called-from-inv.patch
x86-boot-compressed-64-fix-boot-on-machines-with-bro.patch
scsi-lpfc-mitigate-high-memory-pre-allocation-by-scs.patch
input-hyperv-keyboard-use-in-place-iterator-api-in-t.patch
tools-hv-kvp-eliminate-may-be-used-uninitialized-war.patch
nvme-multipath-fix-possible-i-o-hang-when-paths-are-.patch
nvme-fix-cntlid-validation-when-not-using-nvmeof.patch
rdma-cma-fix-null-ptr-deref-read-in-cma_cleanup.patch
ib-mlx4-fix-memory-leaks.patch
infiniband-hfi1-fix-a-memory-leak-bug.patch
infiniband-hfi1-fix-memory-leaks.patch
selftests-kvm-fix-state-save-load-on-processors-with.patch
selftests-kvm-make-platform_info_test-pass-on-amd.patch
drm-amdgpu-prevent-memory-leaks-in-amdgpu_cs-ioctl.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-__.patch
ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fi.patch
kvm-arm-arm64-only-skip-mmio-insn-once.patch
afs-fix-leak-in-afs_lookup_cell_rcu.patch
afs-fix-possible-oops-in-afs_lookup-trace-event.patch
afs-use-correct-afs_call_type-in-yfs_fs_store_opaque.patch
rdma-bnxt_re-fix-stack-out-of-bounds-in-bnxt_qplib_r.patch
gpio-fix-irqchip-initialization-order.patch
kvm-arm-arm64-vgic-properly-initialise-private-irq-a.patch
x86-boot-compressed-64-fix-missing-initialization-in.patch
libceph-allow-ceph_buffer_put-to-receive-a-null-ceph.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
ppc64le:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
❌ selinux-policy: serge-testsuite [2]
🚧 ✅ Storage blktests [3]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [4]
✅ Podman system integration test (as user) [4]
✅ Loopdev Sanity [5]
✅ jvm test suite [6]
✅ AMTU (Abstract Machine Test Utility) [7]
✅ LTP: openposix test suite [8]
✅ Ethernet drivers sanity [9]
✅ Networking socket: fuzz [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ Usex - version 1.9-29 [15]
🚧 ✅ LTP lite [16]
🚧 ✅ Memory function: kaslr [17]
x86_64:
Host 1:
✅ Boot test [0]
✅ xfstests: xfs [1]
✅ selinux-policy: serge-testsuite [2]
🚧 ✅ Storage blktests [3]
Host 2:
✅ Boot test [0]
✅ Podman system integration test (as root) [4]
✅ Podman system integration test (as user) [4]
✅ Loopdev Sanity [5]
✅ jvm test suite [6]
✅ AMTU (Abstract Machine Test Utility) [7]
✅ LTP: openposix test suite [8]
✅ Ethernet drivers sanity [9]
✅ Networking socket: fuzz [10]
✅ audit: audit testsuite test [11]
✅ httpd: mod_ssl smoke sanity [12]
✅ iotop: sanity [13]
✅ tuned: tune-processes-through-perf [14]
✅ pciutils: sanity smoke test [18]
✅ Usex - version 1.9-29 [15]
✅ storage: SCSI VPD [19]
✅ stress: stress-ng [20]
🚧 ✅ LTP lite [16]
🚧 ❌ Memory function: kaslr [17]
Test source:
💚 Pull requests are welcome for new tests or improvements to existing tests!
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/blk
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/container/p…
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/jvm
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[11]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud…
[12]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[13]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot…
[14]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[15]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
[16]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[17]: https://github.com/CKI-project/tests-beaker/archive/master.zip#memory/funct…
[18]: https://github.com/CKI-project/tests-beaker/archive/master.zip#pciutils/san…
[19]: https://github.com/CKI-project/tests-beaker/archive/master.zip#storage/scsi…
[20]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres…
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
As soon as we re-enable the various functions within the HW, they may go
off and read data via a GGTT offset. Hence, if we have not yet restored
the GGTT PTE before then, they may read and even *write* random locations
in memory.
Detected by DMAR faults during resume.
Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com>
Cc: Martin Peres <martin.peres(a)linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/i915/gem/i915_gem_pm.c | 3 ---
drivers/gpu/drm/i915/i915_drv.c | 5 +++++
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pm.c b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
index b3993d24b83d..9b1129aaacfe 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_pm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_pm.c
@@ -242,9 +242,6 @@ void i915_gem_resume(struct drm_i915_private *i915)
mutex_lock(&i915->drm.struct_mutex);
intel_uncore_forcewake_get(&i915->uncore, FORCEWAKE_ALL);
- i915_gem_restore_gtt_mappings(i915);
- i915_gem_restore_fences(i915);
-
if (i915_gem_init_hw(i915))
goto err_wedged;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 7b2c81a8bbaa..1af4eba968c0 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1877,6 +1877,11 @@ static int i915_drm_resume(struct drm_device *dev)
if (ret)
DRM_ERROR("failed to re-enable GGTT\n");
+ mutex_lock(&dev_priv->drm.struct_mutex);
+ i915_gem_restore_gtt_mappings(dev_priv);
+ i915_gem_restore_fences(dev_priv);
+ mutex_unlock(&dev_priv->drm.struct_mutex);
+
intel_csr_ucode_resume(dev_priv);
i915_restore_state(dev_priv);
--
2.23.0