Even if we don't have the correct clock and get a warning, we should not
skip the return.
Fixes: 1fa11ee2d9d0 ("drm/i915/icl: start adding the TBT pll")
Cc: Paulo Zanoni <paulo.r.zanoni(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v4.19+
Signed-off-by: Lucas De Marchi <lucas.demarchi(a)intel.com>
---
drivers/gpu/drm/i915/intel_ddi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 8dbf6c9e22fb..4dc03e8c6c10 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1021,7 +1021,7 @@ static uint32_t icl_pll_to_ddi_pll_sel(struct intel_encoder *encoder,
return DDI_CLK_SEL_TBT_810;
default:
MISSING_CASE(clock);
- break;
+ return DDI_CLK_SEL_NONE;
}
case DPLL_ID_ICL_MGPLL1:
case DPLL_ID_ICL_MGPLL2:
--
2.20.0
commit 84b59f6487d82d3ab4247a099aba66d4d17e8b08 upstream
When checking whether the response is large enough to be able to contain
the received random bytes in tpm_get_random() and tpm2_get_random(),
they fail to take account the header size, which should be added to the
minimum size. This commit fixes this issue.
Cc: stable(a)vger.kernel.org
Fixes: c659af78eb7b ("tpm: Check size of response before accessing data")
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
---
For v4.14 and v4.18. Fixed a merge conflict.
drivers/char/tpm/tpm-interface.c | 3 ++-
drivers/char/tpm/tpm2-cmd.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index e8822b3d10e1..a107ee2466da 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -1323,7 +1323,8 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max)
}
rlength = be32_to_cpu(tpm_cmd.header.out.length);
- if (rlength < offsetof(struct tpm_getrandom_out, rng_data) +
+ if (rlength < TPM_HEADER_SIZE +
+ offsetof(struct tpm_getrandom_out, rng_data) +
recd) {
total = -EFAULT;
break;
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index d31b09099216..79b00bc4a7c2 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -371,7 +371,8 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
recd = min_t(u32, be16_to_cpu(cmd.params.getrandom_out.size),
num_bytes);
rlength = be32_to_cpu(cmd.header.out.length);
- if (rlength < offsetof(struct tpm2_get_random_out, buffer) +
+ if (rlength < TPM_HEADER_SIZE +
+ offsetof(struct tpm2_get_random_out, buffer) +
recd)
return -EFAULT;
memcpy(dest, cmd.params.getrandom_out.buffer, recd);
--
2.19.1
This is the start of the stable review cycle for the 4.20.3 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Jan 17 15:48:32 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.3-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.20.3-rc1
Filipe Manana <fdmanana(a)suse.com>
Btrfs: use nofs context when initializing security xattrs to avoid deadlock
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix deadlock when enabling quotas due to concurrent snapshot creation
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix access to available allocation bits when starting balance
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use-after-free in svc_process_common()
Jan Stancek <jstancek(a)redhat.com>
mm: page_mapped: don't assume compound page is huge or THP
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix special inode number checks in __ext4_iget()
Theodore Ts'o <tytso(a)mit.edu>
ext4: track writeback errors using the generic tracking infrastructure
Theodore Ts'o <tytso(a)mit.edu>
ext4: use ext4_write_inode() when fsyncing w/o a journal
Theodore Ts'o <tytso(a)mit.edu>
ext4: avoid kernel warning when writing the superblock to a dead device
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix a potential fiemap/page fault deadlock w/ inline_data
Theodore Ts'o <tytso(a)mit.edu>
ext4: make sure enough credits are reserved for dioread_nolock writes
Ilya Dryomov <idryomov(a)gmail.com>
rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
Lyude Paul <lyude(a)redhat.com>
drm/amdgpu: Don't fail resume process if resuming atomic state fails
Lyude Paul <lyude(a)redhat.com>
drm/amdgpu: Don't ignore rc from drm_dp_mst_topology_mgr_resume()
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915: Unwind failure on pinning the gen7 ppgtt
Ivan Mironov <mironov.ivan(a)gmail.com>
drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2
Jerry (Fangzhi) Zuo <Jerry.Zuo(a)amd.com>
drm/amd/display: Fix MST dp_blank REG_WAIT timeout
Marc Zyngier <marc.zyngier(a)arm.com>
PCI: dwc: Move interrupt acking into the proper callback
Marc Zyngier <marc.zyngier(a)arm.com>
PCI: dwc: Take lock when ACKing an interrupt
Marc Zyngier <marc.zyngier(a)arm.com>
PCI: dwc: Use interrupt masking instead of disabling
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: Add new VegaM pci id
Alex Williamson <alex.williamson(a)redhat.com>
vfio/type1: Fix unmap overflow off-by-one
Christian Lamparter <chunkeey(a)gmail.com>
mtd: rawnand: qcom: fix memory corruption that causes panic
Yi Zeng <yizeng(a)asrmicro.com>
i2c: dev: prevent adapter retries and timeout being set as minus value
Jean-Philippe Brucker <jean-philippe.brucker(a)arm.com>
ACPI/IORT: Fix rc_dma_get_range()
Hans de Goede <hdegoede(a)redhat.com>
ACPI / PMIC: xpower: Fix TS-pin current-source handling
Hans de Goede <hdegoede(a)redhat.com>
ACPI: power: Skip duplicate power resource references in _PRx
Michal Hocko <mhocko(a)suse.com>
mm, memcg: fix reclaim deadlock with writeback
Qian Cai <cai(a)lca.pw>
mm/usercopy.c: no check page span for stack objects
Christoph Lameter <cl(a)linux.com>
slab: alien caches must not be initialized if the allocation of the alien cache failed
Shakeel Butt <shakeelb(a)google.com>
fork, memcg: fix cached_stacks case
Jack Stocker <jackstocker.93(a)gmail.com>
USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: add quirk for SMI SM3350
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: don't insert sane sense for SPC3+ when bad sense specified
Daniele Palmas <dnlplm(a)gmail.com>
usb: cdc-acm: send ZLP for Telit 3G Intel based modems
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: da830-evm: fix label names in GPIO lookup entries
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: dm644x-evm: fix label names in GPIO lookup entries
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: omapl138-hawk: fix label names in GPIO lookup entries
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: da850-evm: fix label names in GPIO lookup entries
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
ARM: davinci: dm355-evm: fix label names in GPIO lookup entries
Joe Perches <joe(a)perches.com>
cifs: check kzalloc return
Ross Lagerwall <ross.lagerwall(a)citrix.com>
cifs: Fix potential OOB access of lock element array
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Fix credit computation for compounded requests
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Do not hide EINTR after sending network packets
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Do not set credits to 1 if the server didn't grant anything
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Fix adjustment of credits for MTU requests
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Support Dell headset mode for New AIO platform
WANG Chao <chao.wang(a)ucloud.cn>
x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
Quentin Perret <quentin.perret(a)arm.com>
cpufreq: scmi: Fix frequency invariance in slow path
Viresh Kumar <viresh.kumar(a)linaro.org>
cpufreq: scpi/scmi: Fix freeing of dynamic OPPs
Larry Finger <Larry.Finger(a)lwfinger.net>
staging: rtl8188eu: Fix module loading from tasklet for WEP encryption
Larry Finger <Larry.Finger(a)lwfinger.net>
staging: rtl8188eu: Fix module loading from tasklet for CCMP encryption
Saranya Gopal <saranya.gopal(a)intel.com>
usbcore: Select only first configuration for non-UAC3 compliant devices
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix deadlock when using free space tree due to block group creation
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Unset MSR[TS] if not recheckpointing
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-davinci/board-da830-evm.c | 4 +-
arch/arm/mach-davinci/board-da850-evm.c | 4 +-
arch/arm/mach-davinci/board-dm355-evm.c | 4 +-
arch/arm/mach-davinci/board-dm644x-evm.c | 4 +-
arch/arm/mach-davinci/board-omapl138-hawk.c | 4 +-
arch/powerpc/kernel/signal_32.c | 18 +++-
arch/powerpc/kernel/signal_64.c | 20 +++-
arch/x86/kernel/cpu/bugs.c | 2 +-
drivers/acpi/arm64/iort.c | 3 +-
drivers/acpi/pmic/intel_pmic_xpower.c | 41 +++++--
drivers/acpi/power.c | 22 ++++
drivers/block/rbd.c | 9 +-
drivers/cpufreq/scmi-cpufreq.c | 8 +-
drivers/cpufreq/scpi-cpufreq.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 37 ++++---
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 4 +-
drivers/gpu/drm/drm_fb_helper.c | 126 +++++++++++++---------
drivers/gpu/drm/i915/i915_gem_gtt.c | 15 ++-
drivers/i2c/i2c-dev.c | 6 ++
drivers/mtd/nand/raw/qcom_nandc.c | 20 ++--
drivers/opp/core.c | 63 ++++++++++-
drivers/pci/controller/dwc/pcie-designware-host.c | 37 ++++---
drivers/staging/rtl8188eu/core/rtw_security.c | 6 +-
drivers/usb/class/cdc-acm.c | 7 ++
drivers/usb/core/generic.c | 9 +-
drivers/usb/core/quirks.c | 3 +-
drivers/usb/storage/scsiglue.c | 8 +-
drivers/usb/storage/unusual_devs.h | 12 +++
drivers/vfio/vfio_iommu_type1.c | 2 +-
fs/btrfs/ctree.c | 16 +--
fs/btrfs/qgroup.c | 14 ++-
fs/btrfs/volumes.c | 39 ++++---
fs/btrfs/xattr.c | 8 ++
fs/cifs/file.c | 8 +-
fs/cifs/misc.c | 34 +++---
fs/cifs/smb2file.c | 4 +-
fs/cifs/smb2pdu.c | 8 +-
fs/cifs/transport.c | 63 +++++++----
fs/ext4/fsync.c | 16 ++-
fs/ext4/inline.c | 6 +-
fs/ext4/inode.c | 5 +-
fs/ext4/super.c | 2 +-
include/linux/compiler-gcc.h | 2 +-
include/linux/module.h | 2 +-
include/linux/pm_opp.h | 5 +
include/linux/sunrpc/svc.h | 5 +-
include/trace/events/sunrpc.h | 6 +-
kernel/fork.c | 1 +
mm/memory.c | 23 ++++
mm/slab.c | 6 +-
mm/usercopy.c | 9 +-
mm/util.c | 2 +-
net/sunrpc/svc.c | 11 +-
net/sunrpc/svc_xprt.c | 5 +-
net/sunrpc/svcsock.c | 2 +-
scripts/mod/modpost.c | 2 +-
sound/pci/hda/patch_realtek.c | 18 +++-
59 files changed, 578 insertions(+), 251 deletions(-)
This is the start of the stable review cycle for the 4.19.16 release.
There are 50 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Jan 17 15:48:36 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.16-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.16-rc1
Filipe Manana <fdmanana(a)suse.com>
Btrfs: use nofs context when initializing security xattrs to avoid deadlock
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix deadlock when enabling quotas due to concurrent snapshot creation
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix access to available allocation bits when starting balance
Will Deacon <will.deacon(a)arm.com>
arm64: compat: Don't pull syscall number from regs in arm_compat_syscall
Christoffer Dall <christoffer.dall(a)arm.com>
KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use-after-free in svc_process_common()
Jan Stancek <jstancek(a)redhat.com>
mm: page_mapped: don't assume compound page is huge or THP
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix special inode number checks in __ext4_iget()
Theodore Ts'o <tytso(a)mit.edu>
ext4: track writeback errors using the generic tracking infrastructure
Theodore Ts'o <tytso(a)mit.edu>
ext4: use ext4_write_inode() when fsyncing w/o a journal
Theodore Ts'o <tytso(a)mit.edu>
ext4: avoid kernel warning when writing the superblock to a dead device
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix a potential fiemap/page fault deadlock w/ inline_data
Theodore Ts'o <tytso(a)mit.edu>
ext4: make sure enough credits are reserved for dioread_nolock writes
Ilya Dryomov <idryomov(a)gmail.com>
rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
Lyude Paul <lyude(a)redhat.com>
drm/amdgpu: Don't fail resume process if resuming atomic state fails
Lyude Paul <lyude(a)redhat.com>
drm/amdgpu: Don't ignore rc from drm_dp_mst_topology_mgr_resume()
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915: Unwind failure on pinning the gen7 ppgtt
Ivan Mironov <mironov.ivan(a)gmail.com>
drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2
Neil Armstrong <narmstrong(a)baylibre.com>
drm/fb_helper: Allow leaking fbdev smem_start
Jerry (Fangzhi) Zuo <Jerry.Zuo(a)amd.com>
drm/amd/display: Fix MST dp_blank REG_WAIT timeout
Marc Zyngier <marc.zyngier(a)arm.com>
PCI: dwc: Move interrupt acking into the proper callback
Marc Zyngier <marc.zyngier(a)arm.com>
PCI: dwc: Take lock when ACKing an interrupt
Marc Zyngier <marc.zyngier(a)arm.com>
PCI: dwc: Use interrupt masking instead of disabling
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: Add new VegaM pci id
Alex Williamson <alex.williamson(a)redhat.com>
vfio/type1: Fix unmap overflow off-by-one
Christian Lamparter <chunkeey(a)gmail.com>
mtd: rawnand: qcom: fix memory corruption that causes panic
Yi Zeng <yizeng(a)asrmicro.com>
i2c: dev: prevent adapter retries and timeout being set as minus value
Jean-Philippe Brucker <jean-philippe.brucker(a)arm.com>
ACPI/IORT: Fix rc_dma_get_range()
Hans de Goede <hdegoede(a)redhat.com>
ACPI / PMIC: xpower: Fix TS-pin current-source handling
Hans de Goede <hdegoede(a)redhat.com>
ACPI: power: Skip duplicate power resource references in _PRx
Michal Hocko <mhocko(a)suse.com>
mm, memcg: fix reclaim deadlock with writeback
Qian Cai <cai(a)lca.pw>
mm/usercopy.c: no check page span for stack objects
Christoph Lameter <cl(a)linux.com>
slab: alien caches must not be initialized if the allocation of the alien cache failed
Jack Stocker <jackstocker.93(a)gmail.com>
USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: add quirk for SMI SM3350
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: don't insert sane sense for SPC3+ when bad sense specified
Daniele Palmas <dnlplm(a)gmail.com>
usb: cdc-acm: send ZLP for Telit 3G Intel based modems
Ross Lagerwall <ross.lagerwall(a)citrix.com>
cifs: Fix potential OOB access of lock element array
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Fix credit computation for compounded requests
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Do not hide EINTR after sending network packets
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Do not set credits to 1 if the server didn't grant anything
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Fix adjustment of credits for MTU requests
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Support Dell headset mode for New AIO platform
WANG Chao <chao.wang(a)ucloud.cn>
x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
Quentin Perret <quentin.perret(a)arm.com>
cpufreq: scmi: Fix frequency invariance in slow path
Larry Finger <Larry.Finger(a)lwfinger.net>
staging: rtl8188eu: Fix module loading from tasklet for WEP encryption
Larry Finger <Larry.Finger(a)lwfinger.net>
staging: rtl8188eu: Fix module loading from tasklet for CCMP encryption
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix deadlock when using free space tree due to block group creation
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/kernel/sys_compat.c | 9 +-
arch/arm64/kernel/syscall.c | 9 +-
arch/x86/kernel/cpu/bugs.c | 2 +-
drivers/acpi/arm64/iort.c | 3 +-
drivers/acpi/pmic/intel_pmic_xpower.c | 41 ++++--
drivers/acpi/power.c | 22 ++++
drivers/block/rbd.c | 9 +-
drivers/cpufreq/scmi-cpufreq.c | 4 +-
drivers/gpu/drm/Kconfig | 20 +++
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 37 ++++--
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 4 +-
drivers/gpu/drm/drm_fb_helper.c | 151 ++++++++++++++--------
drivers/gpu/drm/i915/i915_gem_gtt.c | 15 ++-
drivers/i2c/i2c-dev.c | 6 +
drivers/mtd/nand/raw/qcom_nandc.c | 20 +--
drivers/pci/controller/dwc/pcie-designware-host.c | 37 ++++--
drivers/staging/rtl8188eu/core/rtw_security.c | 6 +-
drivers/usb/class/cdc-acm.c | 7 +
drivers/usb/core/quirks.c | 3 +-
drivers/usb/storage/scsiglue.c | 8 +-
drivers/usb/storage/unusual_devs.h | 12 ++
drivers/vfio/vfio_iommu_type1.c | 2 +-
fs/btrfs/ctree.c | 16 ++-
fs/btrfs/qgroup.c | 14 +-
fs/btrfs/volumes.c | 39 +++---
fs/btrfs/xattr.c | 8 ++
fs/cifs/file.c | 8 +-
fs/cifs/smb2file.c | 4 +-
fs/cifs/smb2pdu.c | 8 +-
fs/cifs/transport.c | 63 ++++++---
fs/ext4/fsync.c | 16 ++-
fs/ext4/inline.c | 6 +-
fs/ext4/inode.c | 5 +-
fs/ext4/super.c | 2 +-
include/linux/compiler-gcc.h | 2 +-
include/linux/module.h | 2 +-
include/linux/sunrpc/svc.h | 5 +-
include/trace/events/sunrpc.h | 6 +-
mm/memory.c | 23 ++++
mm/slab.c | 6 +-
mm/usercopy.c | 9 +-
mm/util.c | 2 +-
net/sunrpc/svc.c | 11 +-
net/sunrpc/svc_xprt.c | 5 +-
net/sunrpc/svcsock.c | 2 +-
scripts/mod/modpost.c | 2 +-
sound/pci/hda/patch_realtek.c | 18 ++-
virt/kvm/arm/arm.c | 23 ++--
50 files changed, 509 insertions(+), 228 deletions(-)
Another drive-by fix. If slots < 0, or drm_dp_init_vcpi() fails, we'll
end up returning from the function without dropping the topology ref
that we grabbed at the very start. This would result in an MST hub
and/or it's ports staying around even after the MST topology has been
removed from the system.
So, fix this by making sure that we always drop the topology ref to port
when returning from this function.
Additionally: it looks like this bug exists pre-topology & malloc krefs,
so let's also make sure this gets backported to stable.
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
Cc: David Airlie <airlied(a)linux.ie>
Cc: Daniel Vetter <daniel(a)ffwll.ch>
Cc: <stable(a)vger.kernel.org> # v3.17+
---
drivers/gpu/drm/drm_dp_mst_topology.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index d99560c5c693..403f035dc8b8 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -3177,28 +3177,29 @@ EXPORT_SYMBOL(drm_dp_atomic_release_vcpi_slots);
bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
struct drm_dp_mst_port *port, int pbn, int slots)
{
- int ret;
+ int rc;
+ bool ret = false;
- port = drm_dp_mst_topology_get_port_validated(mgr, port);
- if (!port)
+ if (slots < 0)
return false;
- if (slots < 0)
+ port = drm_dp_mst_topology_get_port_validated(mgr, port);
+ if (!port)
return false;
if (port->vcpi.vcpi > 0) {
DRM_DEBUG_KMS("payload: vcpi %d already allocated for pbn %d - requested pbn %d\n",
port->vcpi.vcpi, port->vcpi.pbn, pbn);
if (pbn == port->vcpi.pbn) {
- drm_dp_mst_topology_put_port(port);
- return true;
+ ret = true;
+ goto out;
}
}
- ret = drm_dp_init_vcpi(mgr, &port->vcpi, pbn, slots);
- if (ret) {
+ rc = drm_dp_init_vcpi(mgr, &port->vcpi, pbn, slots);
+ if (rc) {
DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
- DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
+ DIV_ROUND_UP(pbn, mgr->pbn_div), rc);
goto out;
}
DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",
@@ -3206,10 +3207,10 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
/* Keep port allocated until it's payload has been removed */
drm_dp_mst_get_port_malloc(port);
- drm_dp_mst_topology_put_port(port);
- return true;
+ ret = true;
out:
- return false;
+ drm_dp_mst_topology_put_port(port);
+ return ret;
}
EXPORT_SYMBOL(drm_dp_mst_allocate_vcpi);
--
2.20.1
This is the start of the stable review cycle for the 4.14.94 release.
There are 27 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Jan 17 15:48:28 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.94-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.94-rc1
Christoffer Dall <christoffer.dall(a)arm.com>
KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use-after-free in svc_process_common()
Theodore Ts'o <tytso(a)mit.edu>
ext4: track writeback errors using the generic tracking infrastructure
Theodore Ts'o <tytso(a)mit.edu>
ext4: use ext4_write_inode() when fsyncing w/o a journal
Theodore Ts'o <tytso(a)mit.edu>
ext4: avoid kernel warning when writing the superblock to a dead device
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix a potential fiemap/page fault deadlock w/ inline_data
Theodore Ts'o <tytso(a)mit.edu>
ext4: make sure enough credits are reserved for dioread_nolock writes
Ilya Dryomov <idryomov(a)gmail.com>
rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
Ivan Mironov <mironov.ivan(a)gmail.com>
drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2
Yi Zeng <yizeng(a)asrmicro.com>
i2c: dev: prevent adapter retries and timeout being set as minus value
Hans de Goede <hdegoede(a)redhat.com>
ACPI / PMIC: xpower: Fix TS-pin current-source handling
Hans de Goede <hdegoede(a)redhat.com>
ACPI: power: Skip duplicate power resource references in _PRx
Michal Hocko <mhocko(a)suse.com>
mm, memcg: fix reclaim deadlock with writeback
Jan Stancek <jstancek(a)redhat.com>
mm: page_mapped: don't assume compound page is huge or THP
Christoph Lameter <cl(a)linux.com>
slab: alien caches must not be initialized if the allocation of the alien cache failed
Jack Stocker <jackstocker.93(a)gmail.com>
USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: add quirk for SMI SM3350
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: don't insert sane sense for SPC3+ when bad sense specified
Daniele Palmas <dnlplm(a)gmail.com>
usb: cdc-acm: send ZLP for Telit 3G Intel based modems
Ross Lagerwall <ross.lagerwall(a)citrix.com>
cifs: Fix potential OOB access of lock element array
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Do not hide EINTR after sending network packets
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Fix adjustment of credits for MTU requests
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Support Dell headset mode for New AIO platform
WANG Chao <chao.wang(a)ucloud.cn>
x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
Rik van Riel <riel(a)redhat.com>
x86,kvm: move qemu/guest FPU switching out to vcpu_run
-------------
Diffstat:
Makefile | 4 +-
arch/x86/include/asm/kvm_host.h | 13 ++++
arch/x86/kernel/cpu/bugs.c | 2 +-
arch/x86/kvm/x86.c | 34 ++++-----
drivers/acpi/pmic/intel_pmic_xpower.c | 41 ++++++++---
drivers/acpi/power.c | 22 ++++++
drivers/block/rbd.c | 9 ++-
drivers/gpu/drm/drm_fb_helper.c | 126 ++++++++++++++++++++--------------
drivers/i2c/i2c-dev.c | 6 ++
drivers/usb/class/cdc-acm.c | 7 ++
drivers/usb/core/quirks.c | 3 +-
drivers/usb/storage/scsiglue.c | 8 ++-
drivers/usb/storage/unusual_devs.h | 12 ++++
fs/cifs/file.c | 8 +--
fs/cifs/smb2file.c | 4 +-
fs/cifs/smb2pdu.c | 8 ++-
fs/cifs/transport.c | 2 +-
fs/ext4/fsync.c | 16 +++--
fs/ext4/inline.c | 6 +-
fs/ext4/inode.c | 3 +-
fs/ext4/super.c | 2 +-
include/linux/compiler-gcc.h | 2 +-
include/linux/kvm_host.h | 2 +-
include/linux/module.h | 2 +-
include/linux/sunrpc/svc.h | 5 +-
mm/memory.c | 23 +++++++
mm/slab.c | 6 +-
mm/util.c | 2 +-
net/sunrpc/svc.c | 11 +--
net/sunrpc/svc_xprt.c | 5 +-
net/sunrpc/svcsock.c | 2 +-
scripts/mod/modpost.c | 2 +-
sound/pci/hda/patch_realtek.c | 18 ++++-
virt/kvm/arm/arm.c | 23 +++----
34 files changed, 300 insertions(+), 139 deletions(-)
This is the start of the stable review cycle for the 4.9.151 release.
There are 16 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Jan 17 15:48:25 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.151-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.151-rc1
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use-after-free in svc_process_common()
Theodore Ts'o <tytso(a)mit.edu>
ext4: avoid kernel warning when writing the superblock to a dead device
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix a potential fiemap/page fault deadlock w/ inline_data
Theodore Ts'o <tytso(a)mit.edu>
ext4: make sure enough credits are reserved for dioread_nolock writes
Ilya Dryomov <idryomov(a)gmail.com>
rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
Yi Zeng <yizeng(a)asrmicro.com>
i2c: dev: prevent adapter retries and timeout being set as minus value
Hans de Goede <hdegoede(a)redhat.com>
ACPI: power: Skip duplicate power resource references in _PRx
Jan Stancek <jstancek(a)redhat.com>
mm: page_mapped: don't assume compound page is huge or THP
Christoph Lameter <cl(a)linux.com>
slab: alien caches must not be initialized if the allocation of the alien cache failed
Jack Stocker <jackstocker.93(a)gmail.com>
USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: add quirk for SMI SM3350
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: don't insert sane sense for SPC3+ when bad sense specified
Daniele Palmas <dnlplm(a)gmail.com>
usb: cdc-acm: send ZLP for Telit 3G Intel based modems
Ross Lagerwall <ross.lagerwall(a)citrix.com>
cifs: Fix potential OOB access of lock element array
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Do not hide EINTR after sending network packets
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
-------------
Diffstat:
Makefile | 4 ++--
drivers/acpi/power.c | 22 ++++++++++++++++++++++
drivers/block/rbd.c | 9 ++++-----
drivers/i2c/i2c-dev.c | 6 ++++++
drivers/usb/class/cdc-acm.c | 7 +++++++
drivers/usb/core/quirks.c | 3 ++-
drivers/usb/storage/scsiglue.c | 8 ++++++--
drivers/usb/storage/unusual_devs.h | 12 ++++++++++++
fs/cifs/file.c | 8 ++++----
fs/cifs/smb2file.c | 4 ++--
fs/cifs/transport.c | 2 +-
fs/ext4/inline.c | 6 +++---
fs/ext4/inode.c | 3 ++-
fs/ext4/super.c | 2 +-
include/linux/sunrpc/svc.h | 5 ++++-
mm/slab.c | 6 ++++--
mm/util.c | 2 +-
net/sunrpc/svc.c | 9 ++++++---
net/sunrpc/svc_xprt.c | 5 +++--
net/sunrpc/svcsock.c | 2 +-
sound/pci/hda/patch_realtek.c | 16 +++++++++++++++-
21 files changed, 108 insertions(+), 33 deletions(-)
This is the start of the stable review cycle for the 4.4.171 release.
There are 51 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Jan 17 15:48:21 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.171-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.171-rc1
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use-after-free in svc_process_common()
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix a potential fiemap/page fault deadlock w/ inline_data
Eric Biggers <ebiggers(a)google.com>
crypto: cts - fix crash on short inputs
Yi Zeng <yizeng(a)asrmicro.com>
i2c: dev: prevent adapter retries and timeout being set as minus value
Hans de Goede <hdegoede(a)redhat.com>
ACPI: power: Skip duplicate power resource references in _PRx
Ley Foon Tan <lftan(a)altera.com>
PCI: altera: Move retrain from fixup to altera_pcie_host_init()
Ley Foon Tan <lftan(a)altera.com>
PCI: altera: Rework config accessors for use without a struct pci_bus
Ley Foon Tan <lftan(a)altera.com>
PCI: altera: Poll for link training status after retraining the link
Ley Foon Tan <lftan(a)altera.com>
PCI: altera: Poll for link up status after retraining the link
Ley Foon Tan <lftan(a)altera.com>
PCI: altera: Check link status before retrain link
Bjorn Helgaas <bhelgaas(a)google.com>
PCI: altera: Reorder read/write functions
Ley Foon Tan <lftan(a)altera.com>
PCI: altera: Fix altera_pcie_link_is_up()
Christoph Lameter <cl(a)linux.com>
slab: alien caches must not be initialized if the allocation of the alien cache failed
Jack Stocker <jackstocker.93(a)gmail.com>
USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: add quirk for SMI SM3350
Icenowy Zheng <icenowy(a)aosc.io>
USB: storage: don't insert sane sense for SPC3+ when bad sense specified
Daniele Palmas <dnlplm(a)gmail.com>
usb: cdc-acm: send ZLP for Telit 3G Intel based modems
Ross Lagerwall <ross.lagerwall(a)citrix.com>
cifs: Fix potential OOB access of lock element array
Pavel Shilovsky <pshilov(a)microsoft.com>
CIFS: Do not hide EINTR after sending network packets
Shaokun Zhang <zhangshaokun(a)hisilicon.com>
btrfs: tree-checker: Fix misleading group system information
Qu Wenruo <wqu(a)suse.com>
btrfs: tree-checker: Check level for leaves and nodes
Qu Wenruo <wqu(a)suse.com>
btrfs: Verify that every chunk has corresponding block group at mount time
Qu Wenruo <wqu(a)suse.com>
btrfs: Check that each block group has corresponding chunk at mount time
Gu Jinxiang <gujx(a)cn.fujitsu.com>
btrfs: validate type when reading a chunk
Qu Wenruo <wqu(a)suse.com>
btrfs: tree-checker: Detect invalid and empty essential trees
Qu Wenruo <wqu(a)suse.com>
btrfs: tree-checker: Verify block_group_item
David Sterba <dsterba(a)suse.com>
btrfs: tree-check: reduce stack consumption in check_dir_item
Arnd Bergmann <arnd(a)arndb.de>
btrfs: tree-checker: use %zu format string for size_t
Qu Wenruo <wqu(a)suse.com>
btrfs: tree-checker: Add checker for dir item
Qu Wenruo <wqu(a)suse.com>
btrfs: tree-checker: Fix false panic for sanity test
Qu Wenruo <quwenruo.btrfs(a)gmx.com>
btrfs: tree-checker: Enhance btrfs_check_node output
Qu Wenruo <quwenruo.btrfs(a)gmx.com>
btrfs: Move leaf and node validation checker to tree-checker.c
Qu Wenruo <quwenruo.btrfs(a)gmx.com>
btrfs: Add checker for EXTENT_CSUM
Qu Wenruo <quwenruo.btrfs(a)gmx.com>
btrfs: Add sanity check for EXTENT_DATA when reading out leaf
Qu Wenruo <quwenruo.btrfs(a)gmx.com>
btrfs: Check if item pointer overlaps with the item itself
Qu Wenruo <quwenruo.btrfs(a)gmx.com>
btrfs: Refactor check_leaf function for later expansion
Jeff Mahoney <jeffm(a)suse.com>
btrfs: struct-funcs, constify readers
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix emptiness check for dirtied extent buffers at check_leaf()
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: memset to avoid stale content in btree leaf
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: kill BUG_ON in run_delayed_tree_ref
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: improve check_node to avoid reading corrupted nodes
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: memset to avoid stale content in btree node block
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: check btree node's nritems
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: detect corruption when non-root leaf has zero item
Josef Bacik <jbacik(a)fb.com>
Btrfs: fix em leak in find_first_block_group
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: check inconsistence between chunk and block group
Liu Bo <bo.li.liu(a)oracle.com>
Btrfs: add validadtion checks for chunk loading
Qu Wenruo <quwenruo(a)cn.fujitsu.com>
btrfs: Enhance chunk validation check
Jeff Mahoney <jeffm(a)suse.com>
btrfs: cleanup, stop casting for extent_map->lookup everywhere
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
-------------
Diffstat:
Makefile | 4 +-
crypto/cts.c | 8 +-
drivers/acpi/power.c | 22 ++
drivers/i2c/i2c-dev.c | 6 +
drivers/pci/host/pcie-altera.c | 201 +++++++++---
drivers/usb/class/cdc-acm.c | 7 +
drivers/usb/core/quirks.c | 3 +-
drivers/usb/storage/scsiglue.c | 8 +-
drivers/usb/storage/unusual_devs.h | 12 +
fs/btrfs/Makefile | 2 +-
fs/btrfs/ctree.c | 14 -
fs/btrfs/ctree.h | 141 ++++----
fs/btrfs/dev-replace.c | 2 +-
fs/btrfs/disk-io.c | 80 +----
fs/btrfs/extent-tree.c | 112 ++++++-
fs/btrfs/extent_io.c | 43 ++-
fs/btrfs/extent_io.h | 19 +-
fs/btrfs/extent_map.c | 2 +-
fs/btrfs/extent_map.h | 10 +-
fs/btrfs/scrub.c | 2 +-
fs/btrfs/struct-funcs.c | 9 +-
fs/btrfs/tree-checker.c | 649 +++++++++++++++++++++++++++++++++++++
fs/btrfs/tree-checker.h | 38 +++
fs/btrfs/volumes.c | 139 +++++++-
fs/btrfs/volumes.h | 2 +
fs/cifs/file.c | 8 +-
fs/cifs/smb2file.c | 4 +-
fs/cifs/transport.c | 2 +-
fs/ext4/inline.c | 6 +-
include/linux/sunrpc/svc.h | 5 +-
mm/slab.c | 6 +-
net/sunrpc/svc.c | 10 +-
net/sunrpc/svc_xprt.c | 5 +-
net/sunrpc/svcsock.c | 2 +-
sound/pci/hda/patch_realtek.c | 16 +-
35 files changed, 1324 insertions(+), 275 deletions(-)
power off the phy should be done before populate the phy. Otherwise,
am335x_init() could be called by the phy owner to power on the phy first,
then am335x_phy_probe() turns off the phy again without the caller knowing
it.
Fixes: 2fc711d76352 ("usb: phy: am335x: Enable USB remote wakeup using PHY wakeup")
Cc: stable(a)vger.kernel.org # v3.18+
Signed-off-by: Bin Liu <b-liu(a)ti.com>
---
drivers/usb/phy/phy-am335x.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
index 27bdb7222527..f5f0568d8533 100644
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -61,9 +61,6 @@ static int am335x_phy_probe(struct platform_device *pdev)
if (ret)
return ret;
- ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
- if (ret)
- return ret;
am_phy->usb_phy_gen.phy.init = am335x_init;
am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown;
@@ -82,7 +79,7 @@ static int am335x_phy_probe(struct platform_device *pdev)
device_set_wakeup_enable(dev, false);
phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, am_phy->dr_mode, false);
- return 0;
+ return usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
}
static int am335x_phy_remove(struct platform_device *pdev)
--
2.17.1
From: Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
Nested interrupts run inside the calling thread's context and the top
half handler is never called which means that we never read the
timestamp.
This issue came up when trying to read line events from a gpiochip
using regmap_irq_chip for interrupts.
Fix it by reading the timestamp from the irq thread function if it's
still 0 by the time the second handler is called.
Fixes: d58f2bf261fd ("gpio: Timestamp events in hardirq handler")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
---
Hi Sasha,
this is a backport for v4.19.y series. The original patch didn't apply
due to a conflict.
drivers/gpio/gpiolib.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index a8e01d99919c..b3ab6c428423 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -817,7 +817,15 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
/* Do not leak kernel stack to userspace */
memset(&ge, 0, sizeof(ge));
- ge.timestamp = le->timestamp;
+ /*
+ * We may be running from a nested threaded interrupt in which case
+ * we didn't get the timestamp from lineevent_irq_handler().
+ */
+ if (!le->timestamp)
+ ge.timestamp = ktime_get_real_ns();
+ else
+ ge.timestamp = le->timestamp;
+
level = gpiod_get_value_cansleep(le->desc);
if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
--
2.19.1
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: vim2m: only cancel work if it is for right context
Author: Hans Verkuil <hverkuil(a)xs4all.nl>
Date: Fri Jan 11 07:07:25 2019 -0500
cancel_delayed_work_sync() was called for any queue, but it should only
be called for the queue that is associated with the currently running job.
Otherwise, if two filehandles are streaming at the same time, then closing the
first will cancel the work which might still be running for a job from the
second filehandle. As a result the second filehandle will never be able to
finish the job and an attempt to stop streaming on that second filehandle will
stall.
Fixes: 52117be68b82 ("media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work")
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Cc: <stable(a)vger.kernel.org> # for v4.20 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/platform/vim2m.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index d01821a6906a..89d9c4c21037 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -807,7 +807,9 @@ static void vim2m_stop_streaming(struct vb2_queue *q)
struct vb2_v4l2_buffer *vbuf;
unsigned long flags;
- cancel_delayed_work_sync(&dev->work_run);
+ if (v4l2_m2m_get_curr_priv(dev->m2m_dev) == ctx)
+ cancel_delayed_work_sync(&dev->work_run);
+
for (;;) {
if (V4L2_TYPE_IS_OUTPUT(q->type))
vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: v4l: ioctl: Validate num_planes for debug messages
Author: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Date: Thu Jan 10 09:24:26 2019 -0500
The num_planes field in struct v4l2_pix_format_mplane is used in a loop
before validating it. As the use is printing a debug message in this case,
just cap the value to the maximum allowed.
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Thierry Reding <treding(a)nvidia.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Cc: <stable(a)vger.kernel.org> # for v4.12 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 44bc7c4f1c11..90aad465f9ed 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -287,6 +287,7 @@ static void v4l_print_format(const void *arg, bool write_only)
const struct v4l2_window *win;
const struct v4l2_sdr_format *sdr;
const struct v4l2_meta_format *meta;
+ u32 planes;
unsigned i;
pr_cont("type=%s", prt_names(p->type, v4l2_type_names));
@@ -317,7 +318,8 @@ static void v4l_print_format(const void *arg, bool write_only)
prt_names(mp->field, v4l2_field_names),
mp->colorspace, mp->num_planes, mp->flags,
mp->ycbcr_enc, mp->quantization, mp->xfer_func);
- for (i = 0; i < mp->num_planes; i++)
+ planes = min_t(u32, mp->num_planes, VIDEO_MAX_PLANES);
+ for (i = 0; i < planes; i++)
printk(KERN_DEBUG "plane %u: bytesperline=%u sizeimage=%u\n", i,
mp->plane_fmt[i].bytesperline,
mp->plane_fmt[i].sizeimage);
Hi Sasha,
On 1/16/19 2:36 PM, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: 2.6.26+
>
> The bot has tested the following trees: v4.20.2, v4.19.15, v4.14.93, v4.9.150, v4.4.170, v3.18.132.
>
> v4.20.2: Build OK!
> v4.19.15: Build OK!
> v4.14.93: Build OK!
> v4.9.150: Build OK!
> v4.4.170: Failed to apply! Possible dependencies:
> 2b5f5f5dc114 ("can: bcm: unify bcm_msg_head handling and prepare function parameters")
> 6f3b911d5f29 ("can: bcm: add support for CAN FD frames")
> 72c8a89ad2e4 ("can: bcm: use CAN frame instead of can_frame in comments")
> 95acb490ec51 ("can: bcm: fix indention and other minor style issues")
>
> v3.18.132: Failed to apply! Possible dependencies:
> 069f8457ae52 ("can: fix spelling errors")
> 2b5f5f5dc114 ("can: bcm: unify bcm_msg_head handling and prepare function parameters")
> 6ce8e9ce5989 ("new helper: memcpy_from_msg()")
> 6f3b911d5f29 ("can: bcm: add support for CAN FD frames")
> 72c8a89ad2e4 ("can: bcm: use CAN frame instead of can_frame in comments")
> 95acb490ec51 ("can: bcm: fix indention and other minor style issues")
> ba61a8d9d780 ("can: avoid using timeval for uapi")
>
>
> How should we proceed with this patch?
Applying the patch on e.g. 3.2.102 also leads to
patching file net/can/bcm.c
Hunk #1 FAILED at 67.
Hunk #2 FAILED at 140.
Hunk #3 succeeded at 847 with fuzz 2 (offset -26 lines).
Hunk #4 succeeded at 1018 with fuzz 2 (offset -39 lines).
2 out of 4 hunks FAILED -- saving rejects to file net/can/bcm.c.rej
The first two hunks just adding a define and and function *somewhere* at
the top of the C file.
I can provide patches for the requested stable kernels once we have a
reference for the upstream commit hash.
Would that be ok for you?
Best regards,
Oliver
śr., 16 sty 2019 o 14:35 Sasha Levin <sashal(a)kernel.org> napisał(a):
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: d58f2bf261fd gpio: Timestamp events in hardirq handler.
>
> The bot has tested the following trees: v4.20.2, v4.19.15.
>
> v4.20.2: Build OK!
> v4.19.15: Failed to apply! Possible dependencies:
> Unable to calculate
>
>
> How should we proceed with this patch?
>
I sent a backport of this patch.
Bart
> --
> Thanks,
> Sasha
On 1/16/19 7:35 AM, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
>
> The bot has tested the following trees: v4.20.2, v4.19.15, v4.14.93, v4.9.150, v4.4.170, v3.18.132.
I'll pull these into my tree.
It sounds like you want this in ASAP, I can do that, though this
interface is
lower priority, I would think, because it's generally root access only.
-corey
>
> v4.20.2: Build OK!
> v4.19.15: Build OK!
> v4.14.93: Failed to apply! Possible dependencies:
> 1c9f98d1bfbd ("ipmi: Make IPMI panic strings always available")
> 3fd32f9ec84f ("ipmi: Convert IPMI GUID over to Linux guid_t")
> 511d57dc71a2 ("ipmi: Get the device id through a function")
> 68e7e50f195f ("ipmi: Don't use BMC product/dev ids in the BMC name")
> 9ca15af3164f ("ipmi: Fix issues with BMC refcounts")
> a2cb600fa22a ("ipmi: Rework BMC registration")
> a9137c3dfae9 ("ipmi: Add a reference from BMC devices to their interfaces")
> aa9c9ab2443e ("ipmi: allow dynamic BMC version information")
> b2cfd8ab4add ("ipmi: Rework device id and guid handling to catch changing BMCs")
> c0734bd594d4 ("ipmi: Retry BMC registration on a failure")
> f33e4df83e00 ("ipmi: Move bmc find routing to below bmc device type")
>
> v4.9.150: Failed to apply! Possible dependencies:
> 1c9f98d1bfbd ("ipmi: Make IPMI panic strings always available")
> 3fd32f9ec84f ("ipmi: Convert IPMI GUID over to Linux guid_t")
> 511d57dc71a2 ("ipmi: Get the device id through a function")
> 68e7e50f195f ("ipmi: Don't use BMC product/dev ids in the BMC name")
> 9ca15af3164f ("ipmi: Fix issues with BMC refcounts")
> a2cb600fa22a ("ipmi: Rework BMC registration")
> a9137c3dfae9 ("ipmi: Add a reference from BMC devices to their interfaces")
> aa9c9ab2443e ("ipmi: allow dynamic BMC version information")
> b2cfd8ab4add ("ipmi: Rework device id and guid handling to catch changing BMCs")
> c0734bd594d4 ("ipmi: Retry BMC registration on a failure")
> f33e4df83e00 ("ipmi: Move bmc find routing to below bmc device type")
>
> v4.4.170: Failed to apply! Possible dependencies:
> 1c9f98d1bfbd ("ipmi: Make IPMI panic strings always available")
> 3fd32f9ec84f ("ipmi: Convert IPMI GUID over to Linux guid_t")
> 511d57dc71a2 ("ipmi: Get the device id through a function")
> 68e7e50f195f ("ipmi: Don't use BMC product/dev ids in the BMC name")
> 9ca15af3164f ("ipmi: Fix issues with BMC refcounts")
> a2cb600fa22a ("ipmi: Rework BMC registration")
> a9137c3dfae9 ("ipmi: Add a reference from BMC devices to their interfaces")
> aa9c9ab2443e ("ipmi: allow dynamic BMC version information")
> b2cfd8ab4add ("ipmi: Rework device id and guid handling to catch changing BMCs")
> bd85f4b37ddf ("ipmi: fix crash on reading version from proc after unregisted bmc")
> c0734bd594d4 ("ipmi: Retry BMC registration on a failure")
> f33e4df83e00 ("ipmi: Move bmc find routing to below bmc device type")
>
> v3.18.132: Failed to apply! Possible dependencies:
> 16639eb08a69 ("ipmi: clean up the device handling for the bmc device")
> 1c9f98d1bfbd ("ipmi: Make IPMI panic strings always available")
> 3fd32f9ec84f ("ipmi: Convert IPMI GUID over to Linux guid_t")
> 5a0e10ec4a82 ("ipmi: Remove useless sysfs_name parameters")
> 9ca15af3164f ("ipmi: Fix issues with BMC refcounts")
> a2cb600fa22a ("ipmi: Rework BMC registration")
> a9137c3dfae9 ("ipmi: Add a reference from BMC devices to their interfaces")
> aa9c9ab2443e ("ipmi: allow dynamic BMC version information")
> b2cfd8ab4add ("ipmi: Rework device id and guid handling to catch changing BMCs")
> bd85f4b37ddf ("ipmi: fix crash on reading version from proc after unregisted bmc")
> c0734bd594d4 ("ipmi: Retry BMC registration on a failure")
> f33e4df83e00 ("ipmi: Move bmc find routing to below bmc device type")
>
>
> How should we proceed with this patch?
>
> --
> Thanks,
> Sasha
The cached writeback mapping is EOF trimmed to try and avoid races
between post-eof block management and writeback that result in
sending cached data to a stale location. The cached mapping is
currently trimmed on the validation check, which leaves a race
window between the time the mapping is cached and when it is trimmed
against the current inode size.
For example, if a new mapping is cached by delalloc conversion on a
blocksize == page size fs, we could cycle various locks, perform
memory allocations, etc. in the writeback codepath before the
associated mapping is eventually trimmed to i_size. This leaves
enough time for a post-eof truncate and file append before the
cached mapping is trimmed. The former event essentially invalidates
a range of the cached mapping and the latter bumps the inode size
such the trim on the next writepage event won't trim all of the
invalid blocks. fstest generic/464 reproduces this scenario
occasionally and causes a lost writeback and stale delalloc blocks
warning on inode inactivation.
To work around this problem, trim the cached writeback mapping as
soon as it is cached in addition to on subsequent validation checks.
This is a minor tweak to tighten the race window as much as possible
until a proper invalidation mechanism is available.
Fixes: 40214d128e07 ("xfs: trim writepage mapping to within eof")
Cc: <stable(a)vger.kernel.org> # v4.14+
Signed-off-by: Brian Foster <bfoster(a)redhat.com>
---
fs/xfs/xfs_aops.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 338b9d9984e0..d9048bcea49c 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -449,6 +449,7 @@ xfs_map_blocks(
}
wpc->imap = imap;
+ xfs_trim_extent_eof(&wpc->imap, ip);
trace_xfs_map_blocks_found(ip, offset, count, wpc->io_type, &imap);
return 0;
allocate_blocks:
@@ -459,6 +460,7 @@ xfs_map_blocks(
ASSERT(whichfork == XFS_COW_FORK || cow_fsb == NULLFILEOFF ||
imap.br_startoff + imap.br_blockcount <= cow_fsb);
wpc->imap = imap;
+ xfs_trim_extent_eof(&wpc->imap, ip);
trace_xfs_map_blocks_alloc(ip, offset, count, wpc->io_type, &imap);
return 0;
}
--
2.17.2
On 1/16/19 2:35 PM, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
>
> The bot has tested the following trees: v4.20.2, v4.19.15, v4.14.93, v4.9.150, v4.4.170, v3.18.132.
>
> v4.20.2: Build OK!
> v4.19.15: Build OK!
> v4.14.93: Build OK!
> v4.9.150: Failed to apply! Possible dependencies:
> fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
>
> v4.4.170: Failed to apply! Possible dependencies:
> 0579e6e3a326 ("doc-rst: linux_tv: remove whitespaces")
> 17defc282fe6 ("Documentation: add meta-documentation for Sphinx and kernel-doc")
> 22cba31bae9d ("Documentation/sphinx: add basic working Sphinx configuration and build")
> 234d549662a7 ("doc-rst: video: use reference for VIDIOC_ENUMINPUT")
> 5377d91f3e88 ("doc-rst: linux_tv DocBook to reST migration (docs-next)")
> 7347081e8a52 ("doc-rst: linux_tv: simplify references")
> 789818845202 ("doc-rst: audio: Fix some cross references")
> 94fff0dc5333 ("doc-rst: dmx_fcalls: improve man-like format")
> 9e00ffca8cc7 ("doc-rst: querycap: fix troubles on some references")
> af4a4d0db8ab ("doc-rst: linux_tv: Replace reference names to match ioctls")
> c2b66cafdf02 ("[media] v4l: doc: Remove row numbers from tables")
> e6702ee18e24 ("doc-rst: app-pri: Fix a bad reference")
> fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
>
> v3.18.132: Failed to apply! Possible dependencies:
> 0579e6e3a326 ("doc-rst: linux_tv: remove whitespaces")
> 17defc282fe6 ("Documentation: add meta-documentation for Sphinx and kernel-doc")
> 22cba31bae9d ("Documentation/sphinx: add basic working Sphinx configuration and build")
> 5377d91f3e88 ("doc-rst: linux_tv DocBook to reST migration (docs-next)")
> 5699f871d2d5 ("scripts/kernel-doc: Adding cross-reference links to html documentation.")
> 7347081e8a52 ("doc-rst: linux_tv: simplify references")
> af4a4d0db8ab ("doc-rst: linux_tv: Replace reference names to match ioctls")
> b479bfd00e46 ("DocBook: Use a fixed encoding for output")
> c2b66cafdf02 ("[media] v4l: doc: Remove row numbers from tables")
> e6702ee18e24 ("doc-rst: app-pri: Fix a bad reference")
> fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
>
>
> How should we proceed with this patch?
The Cc to stable of this patch in the pending pull request has a 'for v4.12 and up':
https://git.linuxtv.org/hverkuil/media_tree.git/commit/?h=for-v5.0a&id=8015…
So no need to patch pre-4.12 kernels.
Regards,
Hans
This patch fixes a build failure when using GCC 8.1:
/usr/bin/ld: block/partitions/ldm.o: in function `ldm_parse_tocblock':
block/partitions/ldm.c:153: undefined reference to `strcmp'
This is caused by a new optimization which effectively replaces a
strncmp() call with a strcmp() call. This affects a number of strncmp()
call sites in the kernel.
The entire class of optimizations is avoided with -fno-builtin, which
gets enabled by -ffreestanding. This may avoid possible future build
failures in case new optimizations appear in future compilers.
I haven't done any performance measurements with this patch but I did
count the function calls in a defconfig build. For example, there are now
23 more sprintf() calls and 39 fewer strcpy() calls. The effect on the
other libc functions is smaller.
If this harms performance we can tackle that regression by optimizing
the call sites, ideally using semantic patches. That way, clang and ICC
builds might benfit too.
Cc: stable(a)vger.kernel.org
Reference: https://marc.info/?l=linux-m68k&m=154514816222244&w=2
Signed-off-by: Finn Thain <fthain(a)telegraphics.com.au>
---
arch/m68k/Makefile | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/m68k/Makefile b/arch/m68k/Makefile
index 997c9f20ea0f..0a99c276d9a4 100644
--- a/arch/m68k/Makefile
+++ b/arch/m68k/Makefile
@@ -58,7 +58,8 @@ cpuflags-$(CONFIG_M5206e) := $(call cc-option,-mcpu=5206e,-m5200)
cpuflags-$(CONFIG_M5206) := $(call cc-option,-mcpu=5206,-m5200)
KBUILD_AFLAGS += $(cpuflags-y)
-KBUILD_CFLAGS += $(cpuflags-y) -pipe
+KBUILD_CFLAGS += $(cpuflags-y)
+
ifdef CONFIG_MMU
# without -fno-strength-reduce the 53c7xx.c driver fails ;-(
KBUILD_CFLAGS += -fno-strength-reduce -ffixed-a2
@@ -69,6 +70,8 @@ KBUILD_CFLAGS += -D__uClinux__
KBUILD_AFLAGS += -D__uClinux__
endif
+KBUILD_CFLAGS += -pipe -ffreestanding
+
KBUILD_LDFLAGS := -m m68kelf
KBUILD_LDFLAGS_MODULE += -T $(srctree)/arch/m68k/kernel/module.lds
--
2.19.2
Hi,
I recently updated the sparc32 root file system in my testbed
with one generated with buildroot.
As a result, sparc32 images no longer boot with v3.16.y and v3.18.y.
The system starts to come up, but stalls while starting syslog.
However, v3.16 and v3.18 do boot.
I bisected v3.18.y and ended up with commit 16c193364b4 ("sparc: Harden
signal return frame checks.") as culprit; bisect results below. Reverting
this commit fixes the problem for both v3.16.y and v3.18.y.
Is it worth spending any time on this, or should I just stop testing
sparc32 boot tests with v3.16.y and v3.18.y ?
Thanks,
Guenter
---
# bad: [fa42fea0d8b49ba65b49a999331950d74827a52d] Linux 3.18.131
# good: [b2776bf7149bddd1f4161f14f79520f17fc1d71d] Linux 3.18
git bisect start 'HEAD' 'v3.18'
# bad: [6e64ac0957e06a81b22f95f3509cc39b07735d3d] usb: increase ohci watchdog delay to 275 msec
git bisect bad 6e64ac0957e06a81b22f95f3509cc39b07735d3d
# good: [3e2003cccc9fb5f73a0d251dbb595f4c6e3a08bd] USB: usbfs: allow URBs to be reaped after disconnection
git bisect good 3e2003cccc9fb5f73a0d251dbb595f4c6e3a08bd
# good: [d6a1481f7411425041271c3084f3c2e399dc6526] ASoC: wm8958: Fix enum ctl accesses in a wrong type
git bisect good d6a1481f7411425041271c3084f3c2e399dc6526
# good: [bc4b57be51fa419cd870398624c763b7afb91154] Btrfs: make btrfs_abort_transaction consider existence of new block groups
git bisect good bc4b57be51fa419cd870398624c763b7afb91154
# bad: [b4d9416d6388fb450b397484e0ab85a154471723] of: fix memory leak related to safe_name()
git bisect bad b4d9416d6388fb450b397484e0ab85a154471723
# good: [35807de76e1c2b7d15eea2f947983fcd043a2db0] clk: rockchip: free memory in error cases when registering clock branches
git bisect good 35807de76e1c2b7d15eea2f947983fcd043a2db0
# bad: [cae1c6c281d8728e98f7e7a8950d6e64746b5bbc] netfilter: arp_tables: simplify translate_compat_table args
git bisect bad cae1c6c281d8728e98f7e7a8950d6e64746b5bbc
# good: [f02212dd4bd88826afccc36146177589eccb699b] tty: vt, return error when con_startup fails
git bisect good f02212dd4bd88826afccc36146177589eccb699b
# bad: [16c193364b4d6ff58c38c209e1e2b5c6fd674123] sparc: Harden signal return frame checks.
git bisect bad 16c193364b4d6ff58c38c209e1e2b5c6fd674123
# good: [09600dd82044bf676e875d3bd9c904193c31c1f0] sfc: on MC reset, clear PIO buffer linkage in TXQs
git bisect good 09600dd82044bf676e875d3bd9c904193c31c1f0
# good: [0396a871c4e3fbbaabb4f2632c1d388a04b68c84] sparc64: Fix numa node distance initialization
git bisect good 0396a871c4e3fbbaabb4f2632c1d388a04b68c84
# good: [2a3e4b3cbee2c53c53e82b6f593160fb6583b24e] sparc/PCI: Fix for panic while enabling SR-IOV
git bisect good 2a3e4b3cbee2c53c53e82b6f593160fb6583b24e
# good: [705de0f20b1751f5816952486589543aaaa0bcbe] sparc64: Take ctx_alloc_lock properly in hugetlb_setup().
git bisect good 705de0f20b1751f5816952486589543aaaa0bcbe
# first bad commit: [16c193364b4d6ff58c38c209e1e2b5c6fd674123] sparc: Harden signal return frame checks.
Changes since v1 [1]:
* Include another patch make sure that function-number zero can be
safely used as an invalid function number (Jeff)
* Add a comment clarifying why zero is an invalid function number (Jeff)
* Pass nfit_mem to cmd_to_func() (Jeff)
* Collect a Tested-by from Sujith
[1]: https://lists.01.org/pipermail/linux-nvdimm/2019-January/019435.html
---
Quote patch2 changelog:
The _DSM function number validation only happens to succeed when the
generic Linux command number translation corresponds with a
DSM-family-specific function number. This breaks NVDIMM-N
implementations that correctly implement _LSR, _LSW, and _LSI, but do
not happen to publish support for DSM function numbers 4, 5, and 6.
Recall that the support for _LS{I,R,W} family of methods results in the
DIMM being marked as supporting those command numbers at
acpi_nfit_register_dimms() time. The DSM function mask is only used for
ND_CMD_CALL support of non-NVDIMM_FAMILY_INTEL devices.
---
Dan Williams (2):
acpi/nfit: Block function zero DSMs
acpi/nfit: Fix command-supported detection
drivers/acpi/nfit/core.c | 53 ++++++++++++++++++++++++++++++++++------------
1 file changed, 39 insertions(+), 14 deletions(-)
The UEFI 2.7 specification sets expectations that the 'updating' flag is
eventually cleared. To date, the libnvdimm core has never adhered to
that protocol. The policy of the core matches the policy of other
multi-device info-block formats like MD-Software-RAID that expect
administrator intervention on inconsistent info-blocks, not automatic
invalidation.
However, some pre-boot environments may unfortunately attempt to "clean
up" the labels and invalidate a set when it fails to find at least one
"non-updating" label in the set. Clear the updating flag after set
updates to minimize the window of vulnerability to aggressive pre-boot
environments.
Ideally implementations would not write to the label area outside of
creating namespaces.
Note that this only minimizes the window, it does not close it as the
system can still crash while clearing the flag and the set can be
subsequently deleted / invalidated by the pre-boot environment.
Fixes: f524bf271a5c ("libnvdimm: write pmem label set")
Cc: <stable(a)vger.kernel.org>
Cc: Kelly Couch <kelly.j.couch(a)intel.com>
Signed-off-by: Dan Williams <dan.j.williams(a)intel.com>
---
drivers/nvdimm/label.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
index a11bf4e6b451..6d6e9a12150b 100644
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -755,7 +755,7 @@ static const guid_t *to_abstraction_guid(enum nvdimm_claim_class claim_class,
static int __pmem_label_update(struct nd_region *nd_region,
struct nd_mapping *nd_mapping, struct nd_namespace_pmem *nspm,
- int pos)
+ int pos, unsigned long flags)
{
struct nd_namespace_common *ndns = &nspm->nsio.common;
struct nd_interleave_set *nd_set = nd_region->nd_set;
@@ -796,7 +796,7 @@ static int __pmem_label_update(struct nd_region *nd_region,
memcpy(nd_label->uuid, nspm->uuid, NSLABEL_UUID_LEN);
if (nspm->alt_name)
memcpy(nd_label->name, nspm->alt_name, NSLABEL_NAME_LEN);
- nd_label->flags = __cpu_to_le32(NSLABEL_FLAG_UPDATING);
+ nd_label->flags = __cpu_to_le32(flags);
nd_label->nlabel = __cpu_to_le16(nd_region->ndr_mappings);
nd_label->position = __cpu_to_le16(pos);
nd_label->isetcookie = __cpu_to_le64(cookie);
@@ -1249,13 +1249,13 @@ static int del_labels(struct nd_mapping *nd_mapping, u8 *uuid)
int nd_pmem_namespace_label_update(struct nd_region *nd_region,
struct nd_namespace_pmem *nspm, resource_size_t size)
{
- int i;
+ int i, rc;
for (i = 0; i < nd_region->ndr_mappings; i++) {
struct nd_mapping *nd_mapping = &nd_region->mapping[i];
struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
struct resource *res;
- int rc, count = 0;
+ int count = 0;
if (size == 0) {
rc = del_labels(nd_mapping, nspm->uuid);
@@ -1273,7 +1273,20 @@ int nd_pmem_namespace_label_update(struct nd_region *nd_region,
if (rc < 0)
return rc;
- rc = __pmem_label_update(nd_region, nd_mapping, nspm, i);
+ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i,
+ NSLABEL_FLAG_UPDATING);
+ if (rc)
+ return rc;
+ }
+
+ if (size == 0)
+ return 0;
+
+ /* Clear the UPDATING flag per UEFI 2.7 expectations */
+ for (i = 0; i < nd_region->ndr_mappings; i++) {
+ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+
+ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i, 0);
if (rc)
return rc;
}
The patch
spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
has been applied to the spi tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
>From baf8b9f8d260c55a86405f70a384c29cda888476 Mon Sep 17 00:00:00 2001
From: Vignesh R <vigneshr(a)ti.com>
Date: Tue, 15 Jan 2019 12:28:32 +0530
Subject: [PATCH] spi: omap2-mcspi: Fix DMA and FIFO event trigger size
mismatch
Commit b682cffa3ac6 ("spi: omap2-mcspi: Set FIFO DMA trigger level to word length")
broke SPI transfers where bits_per_word != 8. This is because of
mimsatch between McSPI FIFO level event trigger size (SPI word length) and
DMA request size(word length * maxburst). This leads to data
corruption, lockup and errors like:
spi1.0: EOW timed out
Fix this by setting DMA maxburst size to 1 so that
McSPI FIFO level event trigger size matches DMA request size.
Fixes: b682cffa3ac6 ("spi: omap2-mcspi: Set FIFO DMA trigger level to word length")
Cc: stable(a)vger.kernel.org
Reported-by: David Lechner <david(a)lechnology.com>
Tested-by: David Lechner <david(a)lechnology.com>
Signed-off-by: Vignesh R <vigneshr(a)ti.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
---
drivers/spi/spi-omap2-mcspi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index 2fd8881fcd65..8be304379628 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -623,8 +623,8 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
cfg.dst_addr = cs->phys + OMAP2_MCSPI_TX0;
cfg.src_addr_width = width;
cfg.dst_addr_width = width;
- cfg.src_maxburst = es;
- cfg.dst_maxburst = es;
+ cfg.src_maxburst = 1;
+ cfg.dst_maxburst = 1;
rx = xfer->rx_buf;
tx = xfer->tx_buf;
--
2.20.1
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 827aa18e7b903c5ff3b3cd8fec328a99b1dbd411 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 10 Dec 2018 17:53:35 +0000
Subject: [PATCH] Btrfs: use nofs context when initializing security xattrs to
avoid deadlock
When initializing the security xattrs, we are holding a transaction handle
therefore we need to use a GFP_NOFS context in order to avoid a deadlock
with reclaim in case it's triggered.
Fixes: 39a27ec1004e8 ("btrfs: use GFP_KERNEL for xattr and acl allocations")
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index ea78c3d6dcfc..f141b45ce349 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -11,6 +11,7 @@
#include <linux/security.h>
#include <linux/posix_acl_xattr.h>
#include <linux/iversion.h>
+#include <linux/sched/mm.h>
#include "ctree.h"
#include "btrfs_inode.h"
#include "transaction.h"
@@ -422,9 +423,15 @@ static int btrfs_initxattrs(struct inode *inode,
{
const struct xattr *xattr;
struct btrfs_trans_handle *trans = fs_info;
+ unsigned int nofs_flag;
char *name;
int err = 0;
+ /*
+ * We're holding a transaction handle, so use a NOFS memory allocation
+ * context to avoid deadlock if reclaim happens.
+ */
+ nofs_flag = memalloc_nofs_save();
for (xattr = xattr_array; xattr->name != NULL; xattr++) {
name = kmalloc(XATTR_SECURITY_PREFIX_LEN +
strlen(xattr->name) + 1, GFP_KERNEL);
@@ -440,6 +447,7 @@ static int btrfs_initxattrs(struct inode *inode,
if (err < 0)
break;
}
+ memalloc_nofs_restore(nofs_flag);
return err;
}
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 827aa18e7b903c5ff3b3cd8fec328a99b1dbd411 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 10 Dec 2018 17:53:35 +0000
Subject: [PATCH] Btrfs: use nofs context when initializing security xattrs to
avoid deadlock
When initializing the security xattrs, we are holding a transaction handle
therefore we need to use a GFP_NOFS context in order to avoid a deadlock
with reclaim in case it's triggered.
Fixes: 39a27ec1004e8 ("btrfs: use GFP_KERNEL for xattr and acl allocations")
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index ea78c3d6dcfc..f141b45ce349 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -11,6 +11,7 @@
#include <linux/security.h>
#include <linux/posix_acl_xattr.h>
#include <linux/iversion.h>
+#include <linux/sched/mm.h>
#include "ctree.h"
#include "btrfs_inode.h"
#include "transaction.h"
@@ -422,9 +423,15 @@ static int btrfs_initxattrs(struct inode *inode,
{
const struct xattr *xattr;
struct btrfs_trans_handle *trans = fs_info;
+ unsigned int nofs_flag;
char *name;
int err = 0;
+ /*
+ * We're holding a transaction handle, so use a NOFS memory allocation
+ * context to avoid deadlock if reclaim happens.
+ */
+ nofs_flag = memalloc_nofs_save();
for (xattr = xattr_array; xattr->name != NULL; xattr++) {
name = kmalloc(XATTR_SECURITY_PREFIX_LEN +
strlen(xattr->name) + 1, GFP_KERNEL);
@@ -440,6 +447,7 @@ static int btrfs_initxattrs(struct inode *inode,
if (err < 0)
break;
}
+ memalloc_nofs_restore(nofs_flag);
return err;
}
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 827aa18e7b903c5ff3b3cd8fec328a99b1dbd411 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 10 Dec 2018 17:53:35 +0000
Subject: [PATCH] Btrfs: use nofs context when initializing security xattrs to
avoid deadlock
When initializing the security xattrs, we are holding a transaction handle
therefore we need to use a GFP_NOFS context in order to avoid a deadlock
with reclaim in case it's triggered.
Fixes: 39a27ec1004e8 ("btrfs: use GFP_KERNEL for xattr and acl allocations")
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index ea78c3d6dcfc..f141b45ce349 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -11,6 +11,7 @@
#include <linux/security.h>
#include <linux/posix_acl_xattr.h>
#include <linux/iversion.h>
+#include <linux/sched/mm.h>
#include "ctree.h"
#include "btrfs_inode.h"
#include "transaction.h"
@@ -422,9 +423,15 @@ static int btrfs_initxattrs(struct inode *inode,
{
const struct xattr *xattr;
struct btrfs_trans_handle *trans = fs_info;
+ unsigned int nofs_flag;
char *name;
int err = 0;
+ /*
+ * We're holding a transaction handle, so use a NOFS memory allocation
+ * context to avoid deadlock if reclaim happens.
+ */
+ nofs_flag = memalloc_nofs_save();
for (xattr = xattr_array; xattr->name != NULL; xattr++) {
name = kmalloc(XATTR_SECURITY_PREFIX_LEN +
strlen(xattr->name) + 1, GFP_KERNEL);
@@ -440,6 +447,7 @@ static int btrfs_initxattrs(struct inode *inode,
if (err < 0)
break;
}
+ memalloc_nofs_restore(nofs_flag);
return err;
}
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9a6f209e36500efac51528132a3e3083586eda5f Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 14:15:36 +0000
Subject: [PATCH] Btrfs: fix deadlock when enabling quotas due to concurrent
snapshot creation
If the quota enable and snapshot creation ioctls are called concurrently
we can get into a deadlock where the task enabling quotas will deadlock
on the fs_info->qgroup_ioctl_lock mutex because it attempts to lock it
twice, or the task creating a snapshot tries to commit the transaction
while the task enabling quota waits for the former task to commit the
transaction while holding the mutex. The following time diagrams show how
both cases happen.
First scenario:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_start_transaction()
btrfs_ioctl()
btrfs_ioctl_snap_create_v2
create_snapshot()
--> adds snapshot to the
list pending_snapshots
of the current
transaction
btrfs_commit_transaction()
create_pending_snapshots()
create_pending_snapshot()
qgroup_account_snapshot()
btrfs_qgroup_inherit()
mutex_lock(fs_info->qgroup_ioctl_lock)
--> deadlock, mutex already locked
by this task at
btrfs_quota_enable()
Second scenario:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_start_transaction()
btrfs_ioctl()
btrfs_ioctl_snap_create_v2
create_snapshot()
--> adds snapshot to the
list pending_snapshots
of the current
transaction
btrfs_commit_transaction()
--> waits for task at
CPU 0 to release
its transaction
handle
btrfs_commit_transaction()
--> sees another task started
the transaction commit first
--> releases its transaction
handle
--> waits for the transaction
commit to be completed by
the task at CPU 1
create_pending_snapshot()
qgroup_account_snapshot()
btrfs_qgroup_inherit()
mutex_lock(fs_info->qgroup_ioctl_lock)
--> deadlock, task at CPU 0
has the mutex locked but
it is waiting for us to
finish the transaction
commit
So fix this by setting the quota enabled flag in fs_info after committing
the transaction at btrfs_quota_enable(). This ends up serializing quota
enable and snapshot creation as if the snapshot creation happened just
before the quota enable request. The quota rescan task, scheduled after
committing the transaction in btrfs_quote_enable(), will do the accounting.
Fixes: 6426c7ad697d ("btrfs: qgroup: Fix qgroup accounting when creating snapshot")
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index b53d2e7b938d..2272419ade7e 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1013,16 +1013,22 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info)
btrfs_abort_transaction(trans, ret);
goto out_free_path;
}
- spin_lock(&fs_info->qgroup_lock);
- fs_info->quota_root = quota_root;
- set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
- spin_unlock(&fs_info->qgroup_lock);
ret = btrfs_commit_transaction(trans);
trans = NULL;
if (ret)
goto out_free_path;
+ /*
+ * Set quota enabled flag after committing the transaction, to avoid
+ * deadlocks on fs_info->qgroup_ioctl_lock with concurrent snapshot
+ * creation.
+ */
+ spin_lock(&fs_info->qgroup_lock);
+ fs_info->quota_root = quota_root;
+ set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+ spin_unlock(&fs_info->qgroup_lock);
+
ret = qgroup_rescan_init(fs_info, 0, 1);
if (!ret) {
qgroup_rescan_zero_tracking(fs_info);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9a6f209e36500efac51528132a3e3083586eda5f Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 14:15:36 +0000
Subject: [PATCH] Btrfs: fix deadlock when enabling quotas due to concurrent
snapshot creation
If the quota enable and snapshot creation ioctls are called concurrently
we can get into a deadlock where the task enabling quotas will deadlock
on the fs_info->qgroup_ioctl_lock mutex because it attempts to lock it
twice, or the task creating a snapshot tries to commit the transaction
while the task enabling quota waits for the former task to commit the
transaction while holding the mutex. The following time diagrams show how
both cases happen.
First scenario:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_start_transaction()
btrfs_ioctl()
btrfs_ioctl_snap_create_v2
create_snapshot()
--> adds snapshot to the
list pending_snapshots
of the current
transaction
btrfs_commit_transaction()
create_pending_snapshots()
create_pending_snapshot()
qgroup_account_snapshot()
btrfs_qgroup_inherit()
mutex_lock(fs_info->qgroup_ioctl_lock)
--> deadlock, mutex already locked
by this task at
btrfs_quota_enable()
Second scenario:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_start_transaction()
btrfs_ioctl()
btrfs_ioctl_snap_create_v2
create_snapshot()
--> adds snapshot to the
list pending_snapshots
of the current
transaction
btrfs_commit_transaction()
--> waits for task at
CPU 0 to release
its transaction
handle
btrfs_commit_transaction()
--> sees another task started
the transaction commit first
--> releases its transaction
handle
--> waits for the transaction
commit to be completed by
the task at CPU 1
create_pending_snapshot()
qgroup_account_snapshot()
btrfs_qgroup_inherit()
mutex_lock(fs_info->qgroup_ioctl_lock)
--> deadlock, task at CPU 0
has the mutex locked but
it is waiting for us to
finish the transaction
commit
So fix this by setting the quota enabled flag in fs_info after committing
the transaction at btrfs_quota_enable(). This ends up serializing quota
enable and snapshot creation as if the snapshot creation happened just
before the quota enable request. The quota rescan task, scheduled after
committing the transaction in btrfs_quote_enable(), will do the accounting.
Fixes: 6426c7ad697d ("btrfs: qgroup: Fix qgroup accounting when creating snapshot")
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index b53d2e7b938d..2272419ade7e 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1013,16 +1013,22 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info)
btrfs_abort_transaction(trans, ret);
goto out_free_path;
}
- spin_lock(&fs_info->qgroup_lock);
- fs_info->quota_root = quota_root;
- set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
- spin_unlock(&fs_info->qgroup_lock);
ret = btrfs_commit_transaction(trans);
trans = NULL;
if (ret)
goto out_free_path;
+ /*
+ * Set quota enabled flag after committing the transaction, to avoid
+ * deadlocks on fs_info->qgroup_ioctl_lock with concurrent snapshot
+ * creation.
+ */
+ spin_lock(&fs_info->qgroup_lock);
+ fs_info->quota_root = quota_root;
+ set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+ spin_unlock(&fs_info->qgroup_lock);
+
ret = qgroup_rescan_init(fs_info, 0, 1);
if (!ret) {
qgroup_rescan_zero_tracking(fs_info);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9a6f209e36500efac51528132a3e3083586eda5f Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 14:15:36 +0000
Subject: [PATCH] Btrfs: fix deadlock when enabling quotas due to concurrent
snapshot creation
If the quota enable and snapshot creation ioctls are called concurrently
we can get into a deadlock where the task enabling quotas will deadlock
on the fs_info->qgroup_ioctl_lock mutex because it attempts to lock it
twice, or the task creating a snapshot tries to commit the transaction
while the task enabling quota waits for the former task to commit the
transaction while holding the mutex. The following time diagrams show how
both cases happen.
First scenario:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_start_transaction()
btrfs_ioctl()
btrfs_ioctl_snap_create_v2
create_snapshot()
--> adds snapshot to the
list pending_snapshots
of the current
transaction
btrfs_commit_transaction()
create_pending_snapshots()
create_pending_snapshot()
qgroup_account_snapshot()
btrfs_qgroup_inherit()
mutex_lock(fs_info->qgroup_ioctl_lock)
--> deadlock, mutex already locked
by this task at
btrfs_quota_enable()
Second scenario:
CPU 0 CPU 1
btrfs_ioctl()
btrfs_ioctl_quota_ctl()
btrfs_quota_enable()
mutex_lock(fs_info->qgroup_ioctl_lock)
btrfs_start_transaction()
btrfs_ioctl()
btrfs_ioctl_snap_create_v2
create_snapshot()
--> adds snapshot to the
list pending_snapshots
of the current
transaction
btrfs_commit_transaction()
--> waits for task at
CPU 0 to release
its transaction
handle
btrfs_commit_transaction()
--> sees another task started
the transaction commit first
--> releases its transaction
handle
--> waits for the transaction
commit to be completed by
the task at CPU 1
create_pending_snapshot()
qgroup_account_snapshot()
btrfs_qgroup_inherit()
mutex_lock(fs_info->qgroup_ioctl_lock)
--> deadlock, task at CPU 0
has the mutex locked but
it is waiting for us to
finish the transaction
commit
So fix this by setting the quota enabled flag in fs_info after committing
the transaction at btrfs_quota_enable(). This ends up serializing quota
enable and snapshot creation as if the snapshot creation happened just
before the quota enable request. The quota rescan task, scheduled after
committing the transaction in btrfs_quote_enable(), will do the accounting.
Fixes: 6426c7ad697d ("btrfs: qgroup: Fix qgroup accounting when creating snapshot")
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index b53d2e7b938d..2272419ade7e 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1013,16 +1013,22 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info)
btrfs_abort_transaction(trans, ret);
goto out_free_path;
}
- spin_lock(&fs_info->qgroup_lock);
- fs_info->quota_root = quota_root;
- set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
- spin_unlock(&fs_info->qgroup_lock);
ret = btrfs_commit_transaction(trans);
trans = NULL;
if (ret)
goto out_free_path;
+ /*
+ * Set quota enabled flag after committing the transaction, to avoid
+ * deadlocks on fs_info->qgroup_ioctl_lock with concurrent snapshot
+ * creation.
+ */
+ spin_lock(&fs_info->qgroup_lock);
+ fs_info->quota_root = quota_root;
+ set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+ spin_unlock(&fs_info->qgroup_lock);
+
ret = qgroup_rescan_init(fs_info, 0, 1);
if (!ret) {
qgroup_rescan_zero_tracking(fs_info);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5a8067c0d17feb7579db0476191417b441a8996e Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 09:48:12 +0000
Subject: [PATCH] Btrfs: fix access to available allocation bits when starting
balance
The available allocation bits members from struct btrfs_fs_info are
protected by a sequence lock, and when starting balance we access them
incorrectly in two different ways:
1) In the read sequence lock loop at btrfs_balance() we use the values we
read from fs_info->avail_*_alloc_bits and we can immediately do actions
that have side effects and can not be undone (printing a message and
jumping to a label). This is wrong because a retry might be needed, so
our actions must not have side effects and must be repeatable as long
as read_seqretry() returns a non-zero value. In other words, we were
essentially ignoring the sequence lock;
2) Right below the read sequence lock loop, we were reading the values
from avail_metadata_alloc_bits and avail_data_alloc_bits without any
protection from concurrent writers, that is, reading them outside of
the read sequence lock critical section.
So fix this by making sure we only read the available allocation bits
while in a read sequence lock critical section and that what we do in the
critical section is repeatable (has nothing that can not be undone) so
that any eventual retry that is needed is handled properly.
Fixes: de98ced9e743 ("Btrfs: use seqlock to protect fs_info->avail_{data, metadata, system}_alloc_bits")
Fixes: 14506127979a ("btrfs: fix a bogus warning when converting only data or metadata")
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a89596c3de56..2ebc827bed88 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3938,6 +3938,7 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
int ret;
u64 num_devices;
unsigned seq;
+ bool reducing_integrity;
if (btrfs_fs_closing(fs_info) ||
atomic_read(&fs_info->balance_pause_req) ||
@@ -4017,24 +4018,30 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
!(bctl->sys.target & allowed)) ||
((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
(fs_info->avail_metadata_alloc_bits & allowed) &&
- !(bctl->meta.target & allowed))) {
- if (bctl->flags & BTRFS_BALANCE_FORCE) {
- btrfs_info(fs_info,
- "balance: force reducing metadata integrity");
- } else {
- btrfs_err(fs_info,
- "balance: reduces metadata integrity, use --force if you want this");
- ret = -EINVAL;
- goto out;
- }
- }
+ !(bctl->meta.target & allowed)))
+ reducing_integrity = true;
+ else
+ reducing_integrity = false;
+
+ /* if we're not converting, the target field is uninitialized */
+ meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+ bctl->meta.target : fs_info->avail_metadata_alloc_bits;
+ data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+ bctl->data.target : fs_info->avail_data_alloc_bits;
} while (read_seqretry(&fs_info->profiles_lock, seq));
- /* if we're not converting, the target field is uninitialized */
- meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
- bctl->meta.target : fs_info->avail_metadata_alloc_bits;
- data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
- bctl->data.target : fs_info->avail_data_alloc_bits;
+ if (reducing_integrity) {
+ if (bctl->flags & BTRFS_BALANCE_FORCE) {
+ btrfs_info(fs_info,
+ "balance: force reducing metadata integrity");
+ } else {
+ btrfs_err(fs_info,
+ "balance: reduces metadata integrity, use --force if you want this");
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+
if (btrfs_get_num_tolerated_disk_barrier_failures(meta_target) <
btrfs_get_num_tolerated_disk_barrier_failures(data_target)) {
int meta_index = btrfs_bg_flags_to_raid_index(meta_target);
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5a8067c0d17feb7579db0476191417b441a8996e Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 09:48:12 +0000
Subject: [PATCH] Btrfs: fix access to available allocation bits when starting
balance
The available allocation bits members from struct btrfs_fs_info are
protected by a sequence lock, and when starting balance we access them
incorrectly in two different ways:
1) In the read sequence lock loop at btrfs_balance() we use the values we
read from fs_info->avail_*_alloc_bits and we can immediately do actions
that have side effects and can not be undone (printing a message and
jumping to a label). This is wrong because a retry might be needed, so
our actions must not have side effects and must be repeatable as long
as read_seqretry() returns a non-zero value. In other words, we were
essentially ignoring the sequence lock;
2) Right below the read sequence lock loop, we were reading the values
from avail_metadata_alloc_bits and avail_data_alloc_bits without any
protection from concurrent writers, that is, reading them outside of
the read sequence lock critical section.
So fix this by making sure we only read the available allocation bits
while in a read sequence lock critical section and that what we do in the
critical section is repeatable (has nothing that can not be undone) so
that any eventual retry that is needed is handled properly.
Fixes: de98ced9e743 ("Btrfs: use seqlock to protect fs_info->avail_{data, metadata, system}_alloc_bits")
Fixes: 14506127979a ("btrfs: fix a bogus warning when converting only data or metadata")
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a89596c3de56..2ebc827bed88 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3938,6 +3938,7 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
int ret;
u64 num_devices;
unsigned seq;
+ bool reducing_integrity;
if (btrfs_fs_closing(fs_info) ||
atomic_read(&fs_info->balance_pause_req) ||
@@ -4017,24 +4018,30 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
!(bctl->sys.target & allowed)) ||
((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
(fs_info->avail_metadata_alloc_bits & allowed) &&
- !(bctl->meta.target & allowed))) {
- if (bctl->flags & BTRFS_BALANCE_FORCE) {
- btrfs_info(fs_info,
- "balance: force reducing metadata integrity");
- } else {
- btrfs_err(fs_info,
- "balance: reduces metadata integrity, use --force if you want this");
- ret = -EINVAL;
- goto out;
- }
- }
+ !(bctl->meta.target & allowed)))
+ reducing_integrity = true;
+ else
+ reducing_integrity = false;
+
+ /* if we're not converting, the target field is uninitialized */
+ meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+ bctl->meta.target : fs_info->avail_metadata_alloc_bits;
+ data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+ bctl->data.target : fs_info->avail_data_alloc_bits;
} while (read_seqretry(&fs_info->profiles_lock, seq));
- /* if we're not converting, the target field is uninitialized */
- meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
- bctl->meta.target : fs_info->avail_metadata_alloc_bits;
- data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
- bctl->data.target : fs_info->avail_data_alloc_bits;
+ if (reducing_integrity) {
+ if (bctl->flags & BTRFS_BALANCE_FORCE) {
+ btrfs_info(fs_info,
+ "balance: force reducing metadata integrity");
+ } else {
+ btrfs_err(fs_info,
+ "balance: reduces metadata integrity, use --force if you want this");
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+
if (btrfs_get_num_tolerated_disk_barrier_failures(meta_target) <
btrfs_get_num_tolerated_disk_barrier_failures(data_target)) {
int meta_index = btrfs_bg_flags_to_raid_index(meta_target);
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 5a8067c0d17feb7579db0476191417b441a8996e Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Mon, 19 Nov 2018 09:48:12 +0000
Subject: [PATCH] Btrfs: fix access to available allocation bits when starting
balance
The available allocation bits members from struct btrfs_fs_info are
protected by a sequence lock, and when starting balance we access them
incorrectly in two different ways:
1) In the read sequence lock loop at btrfs_balance() we use the values we
read from fs_info->avail_*_alloc_bits and we can immediately do actions
that have side effects and can not be undone (printing a message and
jumping to a label). This is wrong because a retry might be needed, so
our actions must not have side effects and must be repeatable as long
as read_seqretry() returns a non-zero value. In other words, we were
essentially ignoring the sequence lock;
2) Right below the read sequence lock loop, we were reading the values
from avail_metadata_alloc_bits and avail_data_alloc_bits without any
protection from concurrent writers, that is, reading them outside of
the read sequence lock critical section.
So fix this by making sure we only read the available allocation bits
while in a read sequence lock critical section and that what we do in the
critical section is repeatable (has nothing that can not be undone) so
that any eventual retry that is needed is handled properly.
Fixes: de98ced9e743 ("Btrfs: use seqlock to protect fs_info->avail_{data, metadata, system}_alloc_bits")
Fixes: 14506127979a ("btrfs: fix a bogus warning when converting only data or metadata")
Reviewed-by: Nikolay Borisov <nborisov(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a89596c3de56..2ebc827bed88 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3938,6 +3938,7 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
int ret;
u64 num_devices;
unsigned seq;
+ bool reducing_integrity;
if (btrfs_fs_closing(fs_info) ||
atomic_read(&fs_info->balance_pause_req) ||
@@ -4017,24 +4018,30 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
!(bctl->sys.target & allowed)) ||
((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
(fs_info->avail_metadata_alloc_bits & allowed) &&
- !(bctl->meta.target & allowed))) {
- if (bctl->flags & BTRFS_BALANCE_FORCE) {
- btrfs_info(fs_info,
- "balance: force reducing metadata integrity");
- } else {
- btrfs_err(fs_info,
- "balance: reduces metadata integrity, use --force if you want this");
- ret = -EINVAL;
- goto out;
- }
- }
+ !(bctl->meta.target & allowed)))
+ reducing_integrity = true;
+ else
+ reducing_integrity = false;
+
+ /* if we're not converting, the target field is uninitialized */
+ meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+ bctl->meta.target : fs_info->avail_metadata_alloc_bits;
+ data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+ bctl->data.target : fs_info->avail_data_alloc_bits;
} while (read_seqretry(&fs_info->profiles_lock, seq));
- /* if we're not converting, the target field is uninitialized */
- meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
- bctl->meta.target : fs_info->avail_metadata_alloc_bits;
- data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
- bctl->data.target : fs_info->avail_data_alloc_bits;
+ if (reducing_integrity) {
+ if (bctl->flags & BTRFS_BALANCE_FORCE) {
+ btrfs_info(fs_info,
+ "balance: force reducing metadata integrity");
+ } else {
+ btrfs_err(fs_info,
+ "balance: reduces metadata integrity, use --force if you want this");
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+
if (btrfs_get_num_tolerated_disk_barrier_failures(meta_target) <
btrfs_get_num_tolerated_disk_barrier_failures(data_target)) {
int meta_index = btrfs_bg_flags_to_raid_index(meta_target);
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 53290432145a8eb143fe29e06e9c1465d43dc723 Mon Sep 17 00:00:00 2001
From: Will Deacon <will.deacon(a)arm.com>
Date: Thu, 3 Jan 2019 18:00:39 +0000
Subject: [PATCH] arm64: compat: Don't pull syscall number from regs in
arm_compat_syscall
The syscall number may have been changed by a tracer, so we should pass
the actual number in from the caller instead of pulling it from the
saved r7 value directly.
Cc: <stable(a)vger.kernel.org>
Cc: Pi-Hsun Shih <pihsun(a)chromium.org>
Reviewed-by: Dave Martin <Dave.Martin(a)arm.com>
Signed-off-by: Will Deacon <will.deacon(a)arm.com>
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index a79db4e485a6..bc348ab3dd6b 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -66,12 +66,11 @@ do_compat_cache_op(unsigned long start, unsigned long end, int flags)
/*
* Handle all unrecognised system calls.
*/
-long compat_arm_syscall(struct pt_regs *regs)
+long compat_arm_syscall(struct pt_regs *regs, int scno)
{
- unsigned int no = regs->regs[7];
void __user *addr;
- switch (no) {
+ switch (scno) {
/*
* Flush a region from virtual address 'r0' to virtual address 'r1'
* _exclusive_. There is no alignment requirement on either address;
@@ -107,7 +106,7 @@ long compat_arm_syscall(struct pt_regs *regs)
* way the calling program can gracefully determine whether
* a feature is supported.
*/
- if (no < __ARM_NR_COMPAT_END)
+ if (scno < __ARM_NR_COMPAT_END)
return -ENOSYS;
break;
}
@@ -116,6 +115,6 @@ long compat_arm_syscall(struct pt_regs *regs)
(compat_thumb_mode(regs) ? 2 : 4);
arm64_notify_die("Oops - bad compat syscall(2)", regs,
- SIGILL, ILL_ILLTRP, addr, no);
+ SIGILL, ILL_ILLTRP, addr, scno);
return 0;
}
diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
index 032d22312881..5610ac01c1ec 100644
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -13,16 +13,15 @@
#include <asm/thread_info.h>
#include <asm/unistd.h>
-long compat_arm_syscall(struct pt_regs *regs);
-
+long compat_arm_syscall(struct pt_regs *regs, int scno);
long sys_ni_syscall(void);
-asmlinkage long do_ni_syscall(struct pt_regs *regs)
+static long do_ni_syscall(struct pt_regs *regs, int scno)
{
#ifdef CONFIG_COMPAT
long ret;
if (is_compat_task()) {
- ret = compat_arm_syscall(regs);
+ ret = compat_arm_syscall(regs, scno);
if (ret != -ENOSYS)
return ret;
}
@@ -47,7 +46,7 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,
syscall_fn = syscall_table[array_index_nospec(scno, sc_nr)];
ret = __invoke_syscall(regs, syscall_fn);
} else {
- ret = do_ni_syscall(regs);
+ ret = do_ni_syscall(regs, scno);
}
regs->regs[0] = ret;
Commit fb544d1ca65a89f7a3895f7531221ceeed74ada7 upstream.
We recently addressed a VMID generation race by introducing a read/write
lock around accesses and updates to the vmid generation values.
However, kvm_arch_vcpu_ioctl_run() also calls need_new_vmid_gen() but
does so without taking the read lock.
As far as I can tell, this can lead to the same kind of race:
VM 0, VCPU 0 VM 0, VCPU 1
------------ ------------
update_vttbr (vmid 254)
update_vttbr (vmid 1) // roll over
read_lock(kvm_vmid_lock);
force_vm_exit()
local_irq_disable
need_new_vmid_gen == false //because vmid gen matches
enter_guest (vmid 254)
kvm_arch.vttbr = <PGD>:<VMID 1>
read_unlock(kvm_vmid_lock);
enter_guest (vmid 1)
Which results in running two VCPUs in the same VM with different VMIDs
and (even worse) other VCPUs from other VMs could now allocate clashing
VMID 254 from the new generation as long as VCPU 0 is not exiting.
Attempt to solve this by making sure vttbr is updated before another CPU
can observe the updated VMID generation.
Change-Id: I40aae6e89a3c8a496e13fcd8ae6bb663d16b057c
Cc: stable(a)vger.kernel.org # v4.19
Fixes: f0cf47d939d0 "KVM: arm/arm64: Close VMID generation race"
Reviewed-by: Julien Thierry <julien.thierry(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
---
virt/kvm/arm/arm.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 8fb31a7cc22c..91495045ad5a 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -66,7 +66,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
static u32 kvm_next_vmid;
static unsigned int kvm_vmid_bits __read_mostly;
-static DEFINE_RWLOCK(kvm_vmid_lock);
+static DEFINE_SPINLOCK(kvm_vmid_lock);
static bool vgic_present;
@@ -482,7 +482,9 @@ void force_vm_exit(const cpumask_t *mask)
*/
static bool need_new_vmid_gen(struct kvm *kvm)
{
- return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
+ u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
+ smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
+ return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
}
/**
@@ -497,16 +499,11 @@ static void update_vttbr(struct kvm *kvm)
{
phys_addr_t pgd_phys;
u64 vmid;
- bool new_gen;
- read_lock(&kvm_vmid_lock);
- new_gen = need_new_vmid_gen(kvm);
- read_unlock(&kvm_vmid_lock);
-
- if (!new_gen)
+ if (!need_new_vmid_gen(kvm))
return;
- write_lock(&kvm_vmid_lock);
+ spin_lock(&kvm_vmid_lock);
/*
* We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -514,7 +511,7 @@ static void update_vttbr(struct kvm *kvm)
* use the same vmid.
*/
if (!need_new_vmid_gen(kvm)) {
- write_unlock(&kvm_vmid_lock);
+ spin_unlock(&kvm_vmid_lock);
return;
}
@@ -537,7 +534,6 @@ static void update_vttbr(struct kvm *kvm)
kvm_call_hyp(__kvm_flush_vm_context);
}
- kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
kvm->arch.vmid = kvm_next_vmid;
kvm_next_vmid++;
kvm_next_vmid &= (1 << kvm_vmid_bits) - 1;
@@ -548,7 +544,10 @@ static void update_vttbr(struct kvm *kvm)
vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
kvm->arch.vttbr = kvm_phys_to_vttbr(pgd_phys) | vmid;
- write_unlock(&kvm_vmid_lock);
+ smp_wmb();
+ WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen));
+
+ spin_unlock(&kvm_vmid_lock);
}
static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
--
2.18.0
This is a note to let you know that I've just added the patch titled
staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 5f74a8cbb38d10615ed46bc3e37d9a4c9af8045a Mon Sep 17 00:00:00 2001
From: Michael Straube <straube.linux(a)gmail.com>
Date: Mon, 7 Jan 2019 18:28:58 +0100
Subject: staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1
This device was added to the stand-alone driver on github.
Add it to the staging driver as well.
Link: https://github.com/lwfinger/rtl8188eu/commit/a0619a07cd1e
Signed-off-by: Michael Straube <straube.linux(a)gmail.com>
Acked-by: Larry Finger <Larry.Finger(a)lwfinger.net>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 28cbd6b3d26c..dfee6985efa6 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -35,6 +35,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
{USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
{USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
{USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
{USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
{USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
{USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
--
2.20.1
https://bugzilla.kernel.org/show_bug.cgi?id=202133
Hi,
After upgrading kernel from 4.14.40 to 4.14.88,I found that 'HP FlexFabric 10Gb 2-port 554FLB Adapter' device is not in use. There are erros in dmesg log.
The Server is 'HP FlexServer B390'.
Device info:
lspci -n | grep 04:00
04:00.2 0c04: 19a2:0714 (rev 01)
...
04:00.2 Fibre Channel: Emulex Corporation OneConnect 10Gb FCoE Initiator (be3) (rev 01)
Subsystem: Hewlett-Packard Company NC554FLB 10Gb 2-port FlexFabric Converged Network Adapter
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+ Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin C routed to IRQ 95
...
Kernel driver in use: lpfc
The error info:
[ 1046.980480] lpfc 0000:04:00.3: 1:1303 Link Up Event x1 received Data: x1 x0 x4 x0 x0 x0 0
[ 1046.980482] lpfc 0000:04:00.3: 1:(0):2753 PLOGI failure DID:020009 Status:x3/x103
[ 1050.435167] lpfc 0000:04:00.2: 0:(0):2753 PLOGI failure DID:010012 Status:x3/x103
[ 1065.713327] lpfc 0000:04:00.3: 1:(0):2753 PLOGI failure DID:040002 Status:x3/x103
[ 1072.331933] lpfc 0000:04:00.2: 0:(0):2753 PLOGI failure DID:030003 Status:x3/x103
[ 1137.628132] lpfc 0000:04:00.2: 0:(0):0748 abort handler timed out waiting for aborting I/O (xri:x64) to complete: ret 0x2003, ID 2, LUN 0
[ 1137.644257] lpfc 0000:04:00.2: 0:(0):0713 SCSI layer issued Device Reset (2, 0) return x2002
[ 1139.676124] lpfc 0000:04:00.3: 1:(0):0748 abort handler timed out waiting for aborting I/O (xri:x464) to complete: ret 0x2003, ID 4, LUN 0
[ 1139.692242] lpfc 0000:04:00.3: 1:(0):0713 SCSI layer issued Device Reset (4, 0) return x2002
[ 1197.664150] lpfc 0000:04:00.2: 0:(0):0724 I/O flush failure for context LUN : cnt x1
[ 1197.664344] lpfc 0000:04:00.2: 0:(0):0723 SCSI layer issued Target Reset (2, 0) return x2002
[ 1199.704116] lpfc 0000:04:00.3: 1:(0):0724 I/O flush failure for context LUN : cnt x1
[ 1199.704368] lpfc 0000:04:00.3: 1:(0):0723 SCSI layer issued Target Reset (4, 0) return x2002
At the beginning, I thought the lpfc driver itself is the cause of the error.But,the error is still seen when 'lpfc driver' updates to the latest version.
To find the root cause and fix it, we checked the kernel version from 4.14.41 to 4.14.88, built and tested the kernel for booting.
I fount that the commit resulted in this error after bisect is ef86f3a72adb8a7931f67335560740a7ad696d1d,when I removed the commit the issue went away.
Removed commit info:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=…
During the test, I also found another issue that the system of 'HP FlexServer B390' server failed to boot by "hpsa driver timeout",basically, looks like the hpsa didn't detect the hard drives and udevd is stalled.
After upgrading from v4.14.54 to 4.14.55, hp system didn't boot ,but the system is ok when using the v4.14.55 kernel that has removed the commit.
The commit of ef86f3a72adb8a7931f67335560740a7ad696d1d also resulted in the error of HP Smart Array P220i RAID device. Because the v4.14.88 kernel is ok, I think that subsequent commits may have fixed the hpsa driver issue, but lpfc driver issue is not.
If there is any more info I can provide, just ask what would be useful. Any suggestions?
Thanks
Liang
For decryption in CBC mode we need to save the last ciphertext block
for use as the next IV. However, we were trying to do this also with
zero sized ciphertext resulting in a panic.
Fix this by only doing the copy if the ciphertext length is at least
of IV size.
Signed-off-by: Gilad Ben-Yossef <gilad(a)benyossef.com>
Cc: stable(a)vger.kernel.org
---
drivers/crypto/ccree/cc_cipher.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
index 98ea53524250..e202d7c7ea00 100644
--- a/drivers/crypto/ccree/cc_cipher.c
+++ b/drivers/crypto/ccree/cc_cipher.c
@@ -800,7 +800,8 @@ static int cc_cipher_decrypt(struct skcipher_request *req)
memset(req_ctx, 0, sizeof(*req_ctx));
- if (ctx_p->cipher_mode == DRV_CIPHER_CBC) {
+ if ((ctx_p->cipher_mode == DRV_CIPHER_CBC) &&
+ (req->cryptlen >= ivsize)) {
/* Allocate and save the last IV sized bytes of the source,
* which will be lost in case of in-place decryption.
--
2.20.1
We were copying the last ciphertext block into the IV field
for CBC before removing the DMA mapping of the output buffer
with the result of the buffer sometime being out-of-sync cache
wise and were getting intermittent cases of bad output IV.
Fix it by moving the DMA buffer unmapping before the copy.
Signed-off-by: Gilad Ben-Yossef <gilad(a)benyossef.com>
Fixes: 00904aa0cd59 ("crypto: ccree - fix iv handling")
Cc: <stable(a)vger.kernel.org>
---
drivers/crypto/ccree/cc_cipher.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
index cc92b031fad1..98ea53524250 100644
--- a/drivers/crypto/ccree/cc_cipher.c
+++ b/drivers/crypto/ccree/cc_cipher.c
@@ -652,6 +652,8 @@ static void cc_cipher_complete(struct device *dev, void *cc_req, int err)
unsigned int ivsize = crypto_skcipher_ivsize(sk_tfm);
unsigned int len;
+ cc_unmap_cipher_request(dev, req_ctx, ivsize, src, dst);
+
switch (ctx_p->cipher_mode) {
case DRV_CIPHER_CBC:
/*
@@ -681,7 +683,6 @@ static void cc_cipher_complete(struct device *dev, void *cc_req, int err)
break;
}
- cc_unmap_cipher_request(dev, req_ctx, ivsize, src, dst);
kzfree(req_ctx->iv);
skcipher_request_complete(req, err);
--
2.20.1
From: Hadar Gat <hadar.gat(a)arm.com>
In cc_unmap_aead_request(), call dma_pool_free() for mlli buffer only
if an item is allocated from the pool and not always if there is a
pool allocated.
This fixes a kernel panic when trying to free a non-allocated item.
Cc: stable(a)vger.kernel.org
Signed-off-by: Hadar Gat <hadar.gat(a)arm.com>
Signed-off-by: Gilad Ben-Yossef <gilad(a)benyossef.com>
---
drivers/crypto/ccree/cc_buffer_mgr.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c
index 237a87a57830..0ee1c52da0a4 100644
--- a/drivers/crypto/ccree/cc_buffer_mgr.c
+++ b/drivers/crypto/ccree/cc_buffer_mgr.c
@@ -614,10 +614,10 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)
hw_iv_size, DMA_BIDIRECTIONAL);
}
- /*In case a pool was set, a table was
- *allocated and should be released
- */
- if (areq_ctx->mlli_params.curr_pool) {
+ /* Release pool */
+ if ((areq_ctx->assoc_buff_type == CC_DMA_BUF_MLLI ||
+ areq_ctx->data_buff_type == CC_DMA_BUF_MLLI) &&
+ (areq_ctx->mlli_params.mlli_virt_addr)) {
dev_dbg(dev, "free MLLI buffer: dma=%pad virt=%pK\n",
&areq_ctx->mlli_params.mlli_dma_addr,
areq_ctx->mlli_params.mlli_virt_addr);
--
2.20.1
Want editing your photos? We can help.
No matter you need photos background cutting out , or adding clipping path,
or even retouching.
We are the right studio that who can help you for your photo editing with
the quality you need.
Let me know if interested.
Thanks,
Nancy
Backported mainline commit d4b09acf924b84bae77cad090a9d108e70b43643
Author: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon Dec 24 14:44:52 2018 +0300
sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
v2: - added lost extern svc_tcp_prep_reply_hdr()
- context changes in svc_process_common()
- dropped trace_svc_process() changes
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
---
include/linux/sunrpc/svc.h | 5 ++++-
net/sunrpc/svc.c | 10 +++++++---
net/sunrpc/svc_xprt.c | 5 +++--
net/sunrpc/svcsock.c | 2 +-
4 files changed, 15 insertions(+), 7 deletions(-)
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 21678464883a..a656e47b4410 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -281,9 +281,12 @@ struct svc_rqst {
* to prevent encrypting page
* cache pages */
struct task_struct *rq_task; /* service thread */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index ca8a7958f4e6..d7c1f254b3ab 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1061,6 +1061,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
#endif
+extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
+
/*
* Common routine for processing the RPC request.
*/
@@ -1090,7 +1092,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
rqstp->rq_dropme = false;
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1137,7 +1140,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
case SVC_DENIED:
goto err_bad_auth;
case SVC_CLOSE:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt &&
+ test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
case SVC_DROP:
goto dropit;
@@ -1347,10 +1351,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
struct kvec *resv = &rqstp->rq_res.head[0];
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index b8680aa23d4f..1a5e0024ccb6 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -438,10 +438,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 3e7215779011..0f32dbf56466 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1212,7 +1212,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
--
2.17.1
Backported mainline commit d4b09acf924b84bae77cad090a9d108e70b43643
Author: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon Dec 24 14:44:52 2018 +0300
sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
v2: - added lost extern svc_tcp_prep_reply_hdr()
- dropped trace_svc_process() changes
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
---
include/linux/sunrpc/svc.h | 5 ++++-
net/sunrpc/svc.c | 11 +++++++----
net/sunrpc/svc_xprt.c | 5 +++--
net/sunrpc/svcsock.c | 2 +-
4 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 3b9f0d1dbb80..e1aa80c4d6db 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -292,9 +292,12 @@ struct svc_rqst {
struct svc_cacherep * rq_cacherep; /* cache info */
struct task_struct *rq_task; /* service thread */
spinlock_t rq_lock; /* per-request lock */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index aa04666f929d..3a9a03717212 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1144,6 +1144,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
#endif
+extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
+
/*
* Common routine for processing the RPC request.
*/
@@ -1172,7 +1174,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
clear_bit(RQ_DROPME, &rqstp->rq_flags);
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1244,7 +1247,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
* for lower versions. RPC_PROG_MISMATCH seems to be the closest
* fit.
*/
- if (versp->vs_need_cong_ctrl &&
+ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
!test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
goto err_bad_vers;
@@ -1335,7 +1338,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
return 0;
close:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
dprintk("svc: svc_process close\n");
return 0;
@@ -1462,10 +1465,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
dprintk("svc: %s(%p)\n", __func__, req);
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index ea7b5a3a53f0..7e5f849b44cd 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -510,10 +510,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index c83df30e9655..d6771f3b715b 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1207,7 +1207,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
--
2.17.1
Backported mainline commit d4b09acf924b84bae77cad090a9d108e70b43643
Author: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon Dec 24 14:44:52 2018 +0300
sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
v2: - added lost extern svc_tcp_prep_reply_hdr()
- dropped trace_svc_process() changes
- context fixes in svc_process_common()
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
---
include/linux/sunrpc/svc.h | 5 ++++-
net/sunrpc/svc.c | 9 ++++++---
net/sunrpc/svc_xprt.c | 5 +++--
net/sunrpc/svcsock.c | 2 +-
4 files changed, 14 insertions(+), 7 deletions(-)
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 102c84dcc11a..63eed9ac8fd7 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -291,9 +291,12 @@ struct svc_rqst {
struct svc_cacherep * rq_cacherep; /* cache info */
struct task_struct *rq_task; /* service thread */
spinlock_t rq_lock; /* per-request lock */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 272c34551979..eea18a124e4f 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1137,6 +1137,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
#endif
+extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
+
/*
* Common routine for processing the RPC request.
*/
@@ -1166,7 +1168,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
clear_bit(RQ_DROPME, &rqstp->rq_flags);
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1312,7 +1315,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
return 0;
close:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
dprintk("svc: svc_process close\n");
return 0;
@@ -1439,10 +1442,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
dprintk("svc: %s(%p)\n", __func__, req);
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 064f20bb845a..42ce3ed21637 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -510,10 +510,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 33f599cb0936..fd7fbe91955e 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1195,7 +1195,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
--
2.17.1
Backported mainline commit d4b09acf924b84bae77cad090a9d108e70b43643
Author: Vasily Averin <vvs(a)virtuozzo.com>
Date: Mon Dec 24 14:44:52 2018 +0300
sunrpc: use-after-free in svc_process_common()
if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()
svc_process_common()
/* Setup reply header */
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE
svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.
According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.
All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()
Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.
This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.
To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.
To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Cc: stable(a)vger.kernel.org
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields <bfields(a)redhat.com>
v2: - added lost extern svc_tcp_prep_reply_hdr()
- dropped trace_svc_process() changes
- context fixes in svc_process_common()
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
---
include/linux/sunrpc/svc.h | 5 ++++-
net/sunrpc/svc.c | 10 +++++++---
net/sunrpc/svc_xprt.c | 5 +++--
net/sunrpc/svcsock.c | 2 +-
4 files changed, 15 insertions(+), 7 deletions(-)
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index cc0fc712bb82..a8ac3f25b4ec 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -290,9 +290,12 @@ struct svc_rqst {
struct svc_cacherep * rq_cacherep; /* cache info */
struct task_struct *rq_task; /* service thread */
spinlock_t rq_lock; /* per-request lock */
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
};
-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
/*
* Rigorous type checking on sockaddr type conversions
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index c5b0cb4f4056..6d521174427b 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1062,6 +1062,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
#endif
+extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
+
/*
* Common routine for processing the RPC request.
*/
@@ -1091,7 +1093,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
clear_bit(RQ_DROPME, &rqstp->rq_flags);
/* Setup reply header */
- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+ if (rqstp->rq_prot == IPPROTO_TCP)
+ svc_tcp_prep_reply_hdr(rqstp);
svc_putu32(resv, rqstp->rq_xid);
@@ -1138,7 +1141,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
case SVC_DENIED:
goto err_bad_auth;
case SVC_CLOSE:
- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ if (rqstp->rq_xprt &&
+ test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
case SVC_DROP:
goto dropit;
@@ -1360,10 +1364,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
dprintk("svc: %s(%p)\n", __func__, req);
/* Build the svc_rqst used by the common processing routine */
- rqstp->rq_xprt = serv->sv_bc_xprt;
rqstp->rq_xid = req->rq_xid;
rqstp->rq_prot = req->rq_xprt->prot;
rqstp->rq_server = serv;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 71f15da72f02..2b8e80c721db 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -454,10 +454,11 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
*/
void svc_reserve(struct svc_rqst *rqstp, int space)
{
+ struct svc_xprt *xprt = rqstp->rq_xprt;
+
space += rqstp->rq_res.head[0].iov_len;
- if (space < rqstp->rq_reserved) {
- struct svc_xprt *xprt = rqstp->rq_xprt;
+ if (xprt && space < rqstp->rq_reserved) {
atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
rqstp->rq_reserved = space;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 9701fcca002c..0a9fe033132c 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1240,7 +1240,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
/*
* Setup response header. TCP has a 4B record length field.
*/
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
{
struct kvec *resv = &rqstp->rq_res.head[0];
--
2.17.1
If a file with capability set (and hence security.capability xattr) is
written kernel clears security.capability xattr. For overlay, during file
copy up if xattrs are copied up first and then data is, copied up. This
means data copy up will result in clearing of security.capability xattr
file on lower has. And this can result into surprises. If
a lower file has CAP_SETUID, then it should not be cleared over
copy up (if nothing was actually written to file).
This also creates problems with chown logic where it first copies up file
and then tries to clear setuid bit. But by that time security.capability
xattr is already gone (due to data copy up), and caller gets -ENODATA.
This has been reported by Giuseppe here.
https://github.com/containers/libpod/issues/2015#issuecomment-447824842
Fix this by copying up data first and then metadta. This is a regression
which has been introduced by my commit as part of metadata only copy up
patches.
TODO: There will be some corner cases where a file is copied up metadata
only and later data copy up happens and that will clear
security.capability xattr. Something needs to be done about that too.
Fixes: bd64e57586d3 ("ovl: During copy up, first copy up metadata and then data")
Cc: <stable(a)vger.kernel.org> # v4.19+
Reported-by: Giuseppe Scrivano <gscrivan(a)redhat.com>
Signed-off-by: Vivek Goyal <vgoyal(a)redhat.com>
---
fs/overlayfs/copy_up.c | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
Index: rhvgoyal-linux/fs/overlayfs/copy_up.c
===================================================================
--- rhvgoyal-linux.orig/fs/overlayfs/copy_up.c 2019-01-10 17:25:25.594461223 -0500
+++ rhvgoyal-linux/fs/overlayfs/copy_up.c 2019-01-11 10:47:33.657461223 -0500
@@ -443,6 +443,24 @@ static int ovl_copy_up_inode(struct ovl_
{
int err;
+ /*
+ * Copy up data first and then xattrs. Writing data after
+ * xattrs will remove security.capability xattr automatically.
+ */
+ if (S_ISREG(c->stat.mode) && !c->metacopy) {
+ struct path upperpath, datapath;
+
+ ovl_path_upper(c->dentry, &upperpath);
+ if(WARN_ON(upperpath.dentry != NULL))
+ return -EIO;
+ upperpath.dentry = temp;
+
+ ovl_path_lowerdata(c->dentry, &datapath);
+ err = ovl_copy_up_data(&datapath, &upperpath, c->stat.size);
+ if (err)
+ return err;
+ }
+
err = ovl_copy_xattr(c->lowerpath.dentry, temp);
if (err)
return err;
@@ -459,19 +477,6 @@ static int ovl_copy_up_inode(struct ovl_
if (err)
return err;
}
-
- if (S_ISREG(c->stat.mode) && !c->metacopy) {
- struct path upperpath, datapath;
-
- ovl_path_upper(c->dentry, &upperpath);
- BUG_ON(upperpath.dentry != NULL);
- upperpath.dentry = temp;
-
- ovl_path_lowerdata(c->dentry, &datapath);
- err = ovl_copy_up_data(&datapath, &upperpath, c->stat.size);
- if (err)
- return err;
- }
if (c->metacopy) {
err = ovl_check_setxattr(c->dentry, temp, OVL_XATTR_METACOPY,
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 95cb67138746451cc84cf8e516e14989746e93b0 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso(a)mit.edu>
Date: Mon, 31 Dec 2018 00:11:07 -0500
Subject: [PATCH] ext4: track writeback errors using the generic tracking
infrastructure
We already using mapping_set_error() in fs/ext4/page_io.c, so all we
need to do is to use file_check_and_advance_wb_err() when handling
fsync() requests in ext4_sync_file().
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 87a7ff00ef62..712f00995390 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -164,6 +164,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
ret = err;
}
out:
+ err = file_check_and_advance_wb_err(file);
+ if (ret == 0)
+ ret = err;
trace_ext4_sync_file_exit(inode, ret);
return ret;
}
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 95cb67138746451cc84cf8e516e14989746e93b0 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso(a)mit.edu>
Date: Mon, 31 Dec 2018 00:11:07 -0500
Subject: [PATCH] ext4: track writeback errors using the generic tracking
infrastructure
We already using mapping_set_error() in fs/ext4/page_io.c, so all we
need to do is to use file_check_and_advance_wb_err() when handling
fsync() requests in ext4_sync_file().
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 87a7ff00ef62..712f00995390 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -164,6 +164,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
ret = err;
}
out:
+ err = file_check_and_advance_wb_err(file);
+ if (ret == 0)
+ ret = err;
trace_ext4_sync_file_exit(inode, ret);
return ret;
}
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 95cb67138746451cc84cf8e516e14989746e93b0 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso(a)mit.edu>
Date: Mon, 31 Dec 2018 00:11:07 -0500
Subject: [PATCH] ext4: track writeback errors using the generic tracking
infrastructure
We already using mapping_set_error() in fs/ext4/page_io.c, so all we
need to do is to use file_check_and_advance_wb_err() when handling
fsync() requests in ext4_sync_file().
Signed-off-by: Theodore Ts'o <tytso(a)mit.edu>
Cc: stable(a)kernel.org
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 87a7ff00ef62..712f00995390 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -164,6 +164,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
ret = err;
}
out:
+ err = file_check_and_advance_wb_err(file);
+ if (ret == 0)
+ ret = err;
trace_ext4_sync_file_exit(inode, ret);
return ret;
}
From: Claudius Heine <ch(a)denx.de>
Hi,
after a warm reboot, the altera pcie host interface is not correctly
initialized in v4.4.
These patches from v4.9 solved that issue.
Claudius
Bjorn Helgaas (1):
PCI: altera: Reorder read/write functions
Ley Foon Tan (6):
PCI: altera: Fix altera_pcie_link_is_up()
PCI: altera: Check link status before retrain link
PCI: altera: Poll for link up status after retraining the link
PCI: altera: Poll for link training status after retraining the link
PCI: altera: Rework config accessors for use without a struct pci_bus
PCI: altera: Move retrain from fixup to altera_pcie_host_init()
drivers/pci/host/pcie-altera.c | 201 ++++++++++++++++++++++++---------
1 file changed, 147 insertions(+), 54 deletions(-)
--
2.19.2
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 66a8d5bfb518f9f12d47e1d2dce1732279f9451e Mon Sep 17 00:00:00 2001
From: Ivan Mironov <mironov.ivan(a)gmail.com>
Date: Tue, 8 Jan 2019 12:23:53 +0500
Subject: [PATCH] drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
Strict requirement of pixclock to be zero breaks support of SDL 1.2
which contains hardcoded table of supported video modes with non-zero
pixclock values[1].
To better understand which pixclock values are considered valid and how
driver should handle these values, I briefly examined few existing fbdev
drivers and documentation in Documentation/fb/. And it looks like there
are no strict rules on that and actual behaviour varies:
* some drivers treat (pixclock == 0) as "use defaults" (uvesafb.c);
* some treat (pixclock == 0) as invalid value which leads to
-EINVAL (clps711x-fb.c);
* some pass converted pixclock value to hardware (uvesafb.c);
* some are trying to find nearest value from predefined table
(vga16fb.c, video_gx.c).
Given this, I believe that it should be safe to just ignore this value if
changing is not supported. It seems that any portable fbdev application
which was not written only for one specific device working under one
specific kernel version should not rely on any particular behaviour of
pixclock anyway.
However, while enabling SDL1 applications to work out of the box when
there is no /etc/fb.modes with valid settings, this change affects the
video mode choosing logic in SDL. Depending on current screen
resolution, contents of /etc/fb.modes and resolution requested by
application, this may lead to user-visible difference (not always):
image will be displayed in a right way, but it will be aligned to the
left instead of center. There is no "right behaviour" here as well, as
emulated fbdev, opposing to old fbdev drivers, simply ignores any
requsts of video mode changes with resolutions smaller than current.
The easiest way to reproduce this problem is to install sdl-sopwith[2],
remove /etc/fb.modes file if it exists, and then try to run sopwith
from console without X. At least in Fedora 29, sopwith may be simply
installed from standard repositories.
[1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, vesa_timings
[2] http://sdl-sopwith.sourceforge.net/
Signed-off-by: Ivan Mironov <mironov.ivan(a)gmail.com>
Cc: stable(a)vger.kernel.org
Fixes: 79e539453b34e ("DRM: i915: add mode setting support")
Fixes: 771fe6b912fca ("drm/radeon: introduce kernel modesetting for radeon hardware")
Fixes: 785b93ef8c309 ("drm/kms: move driver specific fb common code to helper functions (v2)")
Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-3-mirono…
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 2d7ce9d3143f..d73703a695e8 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1690,9 +1690,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
struct drm_fb_helper *fb_helper = info->par;
struct drm_framebuffer *fb = fb_helper->fb;
- if (var->pixclock != 0 || in_dbg_master())
+ if (in_dbg_master())
return -EINVAL;
+ if (var->pixclock != 0) {
+ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
+ var->pixclock = 0;
+ }
+
if ((drm_format_info_block_width(fb->format, 0) > 1) ||
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 66a8d5bfb518f9f12d47e1d2dce1732279f9451e Mon Sep 17 00:00:00 2001
From: Ivan Mironov <mironov.ivan(a)gmail.com>
Date: Tue, 8 Jan 2019 12:23:53 +0500
Subject: [PATCH] drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
Strict requirement of pixclock to be zero breaks support of SDL 1.2
which contains hardcoded table of supported video modes with non-zero
pixclock values[1].
To better understand which pixclock values are considered valid and how
driver should handle these values, I briefly examined few existing fbdev
drivers and documentation in Documentation/fb/. And it looks like there
are no strict rules on that and actual behaviour varies:
* some drivers treat (pixclock == 0) as "use defaults" (uvesafb.c);
* some treat (pixclock == 0) as invalid value which leads to
-EINVAL (clps711x-fb.c);
* some pass converted pixclock value to hardware (uvesafb.c);
* some are trying to find nearest value from predefined table
(vga16fb.c, video_gx.c).
Given this, I believe that it should be safe to just ignore this value if
changing is not supported. It seems that any portable fbdev application
which was not written only for one specific device working under one
specific kernel version should not rely on any particular behaviour of
pixclock anyway.
However, while enabling SDL1 applications to work out of the box when
there is no /etc/fb.modes with valid settings, this change affects the
video mode choosing logic in SDL. Depending on current screen
resolution, contents of /etc/fb.modes and resolution requested by
application, this may lead to user-visible difference (not always):
image will be displayed in a right way, but it will be aligned to the
left instead of center. There is no "right behaviour" here as well, as
emulated fbdev, opposing to old fbdev drivers, simply ignores any
requsts of video mode changes with resolutions smaller than current.
The easiest way to reproduce this problem is to install sdl-sopwith[2],
remove /etc/fb.modes file if it exists, and then try to run sopwith
from console without X. At least in Fedora 29, sopwith may be simply
installed from standard repositories.
[1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, vesa_timings
[2] http://sdl-sopwith.sourceforge.net/
Signed-off-by: Ivan Mironov <mironov.ivan(a)gmail.com>
Cc: stable(a)vger.kernel.org
Fixes: 79e539453b34e ("DRM: i915: add mode setting support")
Fixes: 771fe6b912fca ("drm/radeon: introduce kernel modesetting for radeon hardware")
Fixes: 785b93ef8c309 ("drm/kms: move driver specific fb common code to helper functions (v2)")
Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-3-mirono…
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 2d7ce9d3143f..d73703a695e8 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1690,9 +1690,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
struct drm_fb_helper *fb_helper = info->par;
struct drm_framebuffer *fb = fb_helper->fb;
- if (var->pixclock != 0 || in_dbg_master())
+ if (in_dbg_master())
return -EINVAL;
+ if (var->pixclock != 0) {
+ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
+ var->pixclock = 0;
+ }
+
if ((drm_format_info_block_width(fb->format, 0) > 1) ||
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 66a8d5bfb518f9f12d47e1d2dce1732279f9451e Mon Sep 17 00:00:00 2001
From: Ivan Mironov <mironov.ivan(a)gmail.com>
Date: Tue, 8 Jan 2019 12:23:53 +0500
Subject: [PATCH] drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
Strict requirement of pixclock to be zero breaks support of SDL 1.2
which contains hardcoded table of supported video modes with non-zero
pixclock values[1].
To better understand which pixclock values are considered valid and how
driver should handle these values, I briefly examined few existing fbdev
drivers and documentation in Documentation/fb/. And it looks like there
are no strict rules on that and actual behaviour varies:
* some drivers treat (pixclock == 0) as "use defaults" (uvesafb.c);
* some treat (pixclock == 0) as invalid value which leads to
-EINVAL (clps711x-fb.c);
* some pass converted pixclock value to hardware (uvesafb.c);
* some are trying to find nearest value from predefined table
(vga16fb.c, video_gx.c).
Given this, I believe that it should be safe to just ignore this value if
changing is not supported. It seems that any portable fbdev application
which was not written only for one specific device working under one
specific kernel version should not rely on any particular behaviour of
pixclock anyway.
However, while enabling SDL1 applications to work out of the box when
there is no /etc/fb.modes with valid settings, this change affects the
video mode choosing logic in SDL. Depending on current screen
resolution, contents of /etc/fb.modes and resolution requested by
application, this may lead to user-visible difference (not always):
image will be displayed in a right way, but it will be aligned to the
left instead of center. There is no "right behaviour" here as well, as
emulated fbdev, opposing to old fbdev drivers, simply ignores any
requsts of video mode changes with resolutions smaller than current.
The easiest way to reproduce this problem is to install sdl-sopwith[2],
remove /etc/fb.modes file if it exists, and then try to run sopwith
from console without X. At least in Fedora 29, sopwith may be simply
installed from standard repositories.
[1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, vesa_timings
[2] http://sdl-sopwith.sourceforge.net/
Signed-off-by: Ivan Mironov <mironov.ivan(a)gmail.com>
Cc: stable(a)vger.kernel.org
Fixes: 79e539453b34e ("DRM: i915: add mode setting support")
Fixes: 771fe6b912fca ("drm/radeon: introduce kernel modesetting for radeon hardware")
Fixes: 785b93ef8c309 ("drm/kms: move driver specific fb common code to helper functions (v2)")
Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-3-mirono…
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 2d7ce9d3143f..d73703a695e8 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1690,9 +1690,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
struct drm_fb_helper *fb_helper = info->par;
struct drm_framebuffer *fb = fb_helper->fb;
- if (var->pixclock != 0 || in_dbg_master())
+ if (in_dbg_master())
return -EINVAL;
+ if (var->pixclock != 0) {
+ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
+ var->pixclock = 0;
+ }
+
if ((drm_format_info_block_width(fb->format, 0) > 1) ||
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 66a8d5bfb518f9f12d47e1d2dce1732279f9451e Mon Sep 17 00:00:00 2001
From: Ivan Mironov <mironov.ivan(a)gmail.com>
Date: Tue, 8 Jan 2019 12:23:53 +0500
Subject: [PATCH] drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
Strict requirement of pixclock to be zero breaks support of SDL 1.2
which contains hardcoded table of supported video modes with non-zero
pixclock values[1].
To better understand which pixclock values are considered valid and how
driver should handle these values, I briefly examined few existing fbdev
drivers and documentation in Documentation/fb/. And it looks like there
are no strict rules on that and actual behaviour varies:
* some drivers treat (pixclock == 0) as "use defaults" (uvesafb.c);
* some treat (pixclock == 0) as invalid value which leads to
-EINVAL (clps711x-fb.c);
* some pass converted pixclock value to hardware (uvesafb.c);
* some are trying to find nearest value from predefined table
(vga16fb.c, video_gx.c).
Given this, I believe that it should be safe to just ignore this value if
changing is not supported. It seems that any portable fbdev application
which was not written only for one specific device working under one
specific kernel version should not rely on any particular behaviour of
pixclock anyway.
However, while enabling SDL1 applications to work out of the box when
there is no /etc/fb.modes with valid settings, this change affects the
video mode choosing logic in SDL. Depending on current screen
resolution, contents of /etc/fb.modes and resolution requested by
application, this may lead to user-visible difference (not always):
image will be displayed in a right way, but it will be aligned to the
left instead of center. There is no "right behaviour" here as well, as
emulated fbdev, opposing to old fbdev drivers, simply ignores any
requsts of video mode changes with resolutions smaller than current.
The easiest way to reproduce this problem is to install sdl-sopwith[2],
remove /etc/fb.modes file if it exists, and then try to run sopwith
from console without X. At least in Fedora 29, sopwith may be simply
installed from standard repositories.
[1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, vesa_timings
[2] http://sdl-sopwith.sourceforge.net/
Signed-off-by: Ivan Mironov <mironov.ivan(a)gmail.com>
Cc: stable(a)vger.kernel.org
Fixes: 79e539453b34e ("DRM: i915: add mode setting support")
Fixes: 771fe6b912fca ("drm/radeon: introduce kernel modesetting for radeon hardware")
Fixes: 785b93ef8c309 ("drm/kms: move driver specific fb common code to helper functions (v2)")
Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-3-mirono…
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 2d7ce9d3143f..d73703a695e8 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1690,9 +1690,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
struct drm_fb_helper *fb_helper = info->par;
struct drm_framebuffer *fb = fb_helper->fb;
- if (var->pixclock != 0 || in_dbg_master())
+ if (in_dbg_master())
return -EINVAL;
+ if (var->pixclock != 0) {
+ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
+ var->pixclock = 0;
+ }
+
if ((drm_format_info_block_width(fb->format, 0) > 1) ||
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 66a8d5bfb518f9f12d47e1d2dce1732279f9451e Mon Sep 17 00:00:00 2001
From: Ivan Mironov <mironov.ivan(a)gmail.com>
Date: Tue, 8 Jan 2019 12:23:53 +0500
Subject: [PATCH] drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
Strict requirement of pixclock to be zero breaks support of SDL 1.2
which contains hardcoded table of supported video modes with non-zero
pixclock values[1].
To better understand which pixclock values are considered valid and how
driver should handle these values, I briefly examined few existing fbdev
drivers and documentation in Documentation/fb/. And it looks like there
are no strict rules on that and actual behaviour varies:
* some drivers treat (pixclock == 0) as "use defaults" (uvesafb.c);
* some treat (pixclock == 0) as invalid value which leads to
-EINVAL (clps711x-fb.c);
* some pass converted pixclock value to hardware (uvesafb.c);
* some are trying to find nearest value from predefined table
(vga16fb.c, video_gx.c).
Given this, I believe that it should be safe to just ignore this value if
changing is not supported. It seems that any portable fbdev application
which was not written only for one specific device working under one
specific kernel version should not rely on any particular behaviour of
pixclock anyway.
However, while enabling SDL1 applications to work out of the box when
there is no /etc/fb.modes with valid settings, this change affects the
video mode choosing logic in SDL. Depending on current screen
resolution, contents of /etc/fb.modes and resolution requested by
application, this may lead to user-visible difference (not always):
image will be displayed in a right way, but it will be aligned to the
left instead of center. There is no "right behaviour" here as well, as
emulated fbdev, opposing to old fbdev drivers, simply ignores any
requsts of video mode changes with resolutions smaller than current.
The easiest way to reproduce this problem is to install sdl-sopwith[2],
remove /etc/fb.modes file if it exists, and then try to run sopwith
from console without X. At least in Fedora 29, sopwith may be simply
installed from standard repositories.
[1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, vesa_timings
[2] http://sdl-sopwith.sourceforge.net/
Signed-off-by: Ivan Mironov <mironov.ivan(a)gmail.com>
Cc: stable(a)vger.kernel.org
Fixes: 79e539453b34e ("DRM: i915: add mode setting support")
Fixes: 771fe6b912fca ("drm/radeon: introduce kernel modesetting for radeon hardware")
Fixes: 785b93ef8c309 ("drm/kms: move driver specific fb common code to helper functions (v2)")
Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-3-mirono…
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 2d7ce9d3143f..d73703a695e8 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1690,9 +1690,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
struct drm_fb_helper *fb_helper = info->par;
struct drm_framebuffer *fb = fb_helper->fb;
- if (var->pixclock != 0 || in_dbg_master())
+ if (in_dbg_master())
return -EINVAL;
+ if (var->pixclock != 0) {
+ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
+ var->pixclock = 0;
+ }
+
if ((drm_format_info_block_width(fb->format, 0) > 1) ||
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
From: Neil Armstrong <narmstrong(a)baylibre.com>
commit 4be9bd10e22dfc7fc101c5cf5969ef2d3a042d8a upstream.
Since "drm/fb: Stop leaking physical address", the default behaviour of
the DRM fbdev emulation is to set the smem_base to 0 and pass the new
FBINFO_HIDE_SMEM_START flag.
The main reason is to avoid leaking physical addresse to user-space, and
it follows a general move over the kernel code to avoid user-space to
manipulate physical addresses and then use some other mechanisms like
dma-buf to transfer physical buffer handles over multiple subsystems.
But, a lot of devices depends on closed sources binaries to enable
OpenGL hardware acceleration that uses this smem_start value to
pass physical addresses to out-of-tree modules in order to render
into these physical adresses. These should use dma-buf buffers allocated
from the DRM display device instead and stop relying on fbdev overallocation
to gather DMA memory (some HW vendors delivers GBM and Wayland capable
binaries, but older unsupported devices won't have these new binaries
and are doomed until an Open Source solution like Lima finalizes).
Since these devices heavily depends on this kind of software and because
the smem_start population was available for years, it's a breakage to
stop leaking smem_start without any alternative solutions.
This patch adds a Kconfig depending on the EXPERT config and an unsafe
kernel module parameter tainting the kernel when enabled.
A clear comment and Kconfig help text was added to clarify why and when
this patch should be reverted, but in the meantime it's a necessary
feature to keep.
Cc: Dave Airlie <airlied(a)gmail.com>
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie(a)samsung.com>
Cc: Noralf Trønnes <noralf(a)tronnes.org>
Cc: Maxime Ripard <maxime.ripard(a)bootlin.com>
Cc: Eric Anholt <eric(a)anholt.net>
Cc: Lucas Stach <l.stach(a)pengutronix.de>
Cc: Rob Clark <robdclark(a)gmail.com>
Cc: Ben Skeggs <skeggsb(a)gmail.com>
Cc: Christian König <christian.koenig(a)amd.com>
Signed-off-by: Neil Armstrong <narmstrong(a)baylibre.com>
Reviewed-by: Maxime Ripard <maxime.ripard(a)bootlin.com>
Tested-by: Maxime Ripard <maxime.ripard(a)bootlin.com>
Acked-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Acked-by: Dave Airlie <airlied(a)gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1538136355-15383-1-git-send-e…
Signed-off-by: Maxime Ripard <maxime.ripard(a)bootlin.com>
---
Hi,
This is a backport of a patch fixing a regression introduced in 4.19, and
merged in 4.20. Therefore, it targets 4.19 only.
Thanks!
Maxime
---
drivers/gpu/drm/Kconfig | 20 ++++++++++++++++++++
drivers/gpu/drm/drm_fb_helper.c | 25 +++++++++++++++++++++++++
2 files changed, 45 insertions(+)
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index cb88528e7b10..e44e567bd789 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -110,6 +110,26 @@ config DRM_FBDEV_OVERALLOC
is 100. Typical values for double buffering will be 200,
triple buffering 300.
+config DRM_FBDEV_LEAK_PHYS_SMEM
+ bool "Shamelessly allow leaking of fbdev physical address (DANGEROUS)"
+ depends on DRM_FBDEV_EMULATION && EXPERT
+ default n
+ help
+ In order to keep user-space compatibility, we want in certain
+ use-cases to keep leaking the fbdev physical address to the
+ user-space program handling the fbdev buffer.
+ This affects, not only, Amlogic, Allwinner or Rockchip devices
+ with ARM Mali GPUs using an userspace Blob.
+ This option is not supported by upstream developers and should be
+ removed as soon as possible and be considered as a broken and
+ legacy behaviour from a modern fbdev device driver.
+
+ Please send any bug reports when using this to your proprietary
+ software vendor that requires this.
+
+ If in doubt, say "N" or spread the word to your closed source
+ library vendor.
+
config DRM_LOAD_EDID_FIRMWARE
bool "Allow to specify an EDID data set instead of probing for it"
depends on DRM
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 9628dd617826..c52e3c80e9e6 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -56,6 +56,25 @@ MODULE_PARM_DESC(drm_fbdev_overalloc,
"Overallocation of the fbdev buffer (%) [default="
__MODULE_STRING(CONFIG_DRM_FBDEV_OVERALLOC) "]");
+/*
+ * In order to keep user-space compatibility, we want in certain use-cases
+ * to keep leaking the fbdev physical address to the user-space program
+ * handling the fbdev buffer.
+ * This is a bad habit essentially kept into closed source opengl driver
+ * that should really be moved into open-source upstream projects instead
+ * of using legacy physical addresses in user space to communicate with
+ * other out-of-tree kernel modules.
+ *
+ * This module_param *should* be removed as soon as possible and be
+ * considered as a broken and legacy behaviour from a modern fbdev device.
+ */
+#if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM)
+static bool drm_leak_fbdev_smem = false;
+module_param_unsafe(drm_leak_fbdev_smem, bool, 0600);
+MODULE_PARM_DESC(fbdev_emulation,
+ "Allow unsafe leaking fbdev physical smem address [default=false]");
+#endif
+
static LIST_HEAD(kernel_fb_helper_list);
static DEFINE_MUTEX(kernel_fb_helper_lock);
@@ -3038,6 +3057,12 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
fbi->screen_size = fb->height * fb->pitches[0];
fbi->fix.smem_len = fbi->screen_size;
fbi->screen_buffer = buffer->vaddr;
+ /* Shamelessly leak the physical address to user-space */
+#if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM)
+ if (drm_leak_fbdev_smem && fbi->fix.smem_start == 0)
+ fbi->fix.smem_start =
+ page_to_phys(virt_to_page(fbi->screen_buffer));
+#endif
strcpy(fbi->fix.id, "DRM emulated");
drm_fb_helper_fill_fix(fbi, fb->pitches[0], fb->format->depth);
--
2.20.1
From: Eric Biggers <ebiggers(a)google.com>
Hi Greg, please consider applying this to 4.4-stable and 3.18-stable.
It's a minimal fix for a bug that was fixed incidentally by a large
refactoring in v4.8.
>8------------------------------------------------------8<
In the CTS template, when the input length is <= one block cipher block
(e.g. <= 16 bytes for AES) pass the correct length to the underlying CBC
transform rather than one block. This matches the upstream behavior and
makes the encryption/decryption operation correctly return -EINVAL when
1 <= nbytes < bsize or succeed when nbytes == 0, rather than crashing.
This was fixed upstream incidentally by a large refactoring,
commit 0605c41cc53c ("crypto: cts - Convert to skcipher"). But
syzkaller easily trips over this when running on older kernels, as it's
easily reachable via AF_ALG. Therefore, this patch makes the minimal
fix for older kernels.
Cc: linux-crypto(a)vger.kernel.org
Fixes: 76cb9521795a ("[CRYPTO] cts: Add CTS mode required for Kerberos AES support")
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
crypto/cts.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/crypto/cts.c b/crypto/cts.c
index e467ec0acf9f0..e65688d6a4caa 100644
--- a/crypto/cts.c
+++ b/crypto/cts.c
@@ -137,8 +137,8 @@ static int crypto_cts_encrypt(struct blkcipher_desc *desc,
lcldesc.info = desc->info;
lcldesc.flags = desc->flags;
- if (tot_blocks == 1) {
- err = crypto_blkcipher_encrypt_iv(&lcldesc, dst, src, bsize);
+ if (tot_blocks <= 1) {
+ err = crypto_blkcipher_encrypt_iv(&lcldesc, dst, src, nbytes);
} else if (nbytes <= bsize * 2) {
err = cts_cbc_encrypt(ctx, desc, dst, src, 0, nbytes);
} else {
@@ -232,8 +232,8 @@ static int crypto_cts_decrypt(struct blkcipher_desc *desc,
lcldesc.info = desc->info;
lcldesc.flags = desc->flags;
- if (tot_blocks == 1) {
- err = crypto_blkcipher_decrypt_iv(&lcldesc, dst, src, bsize);
+ if (tot_blocks <= 1) {
+ err = crypto_blkcipher_decrypt_iv(&lcldesc, dst, src, nbytes);
} else if (nbytes <= bsize * 2) {
err = cts_cbc_decrypt(ctx, desc, dst, src, 0, nbytes);
} else {
--
2.20.1.97.g81188d93c3-goog
commit 1f82de10d6b1 ("PCI/x86: don't assume prefetchable ranges are 64bit")
added probing of bridge support for 64 bit memory each time bridge is
re-enumerated.
Unfortunately this probing is destructive if any device behind
the bridge is in use at this time.
This was observed in the field, see
https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg01711.html
and specifically
https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02082.html
There's no real need to re-probe the bridge features as the
registers in question never change - detect that using
the memory flag being set (it's always set on the 1st pass since
all PCI2PCI bridges support memory forwarding) and skip the probing.
Thus, only the first call will perform the disruptive probing and sets
the resource flags as required - which we can be reasonably sure happens
before any devices have been configured.
Avoiding repeated calls to pci_bridge_check_ranges might be even nicer.
Unfortunately I couldn't come up with a clean way to do it without a
major probing code refactoring.
Reported-by: xuyandong <xuyandong2(a)huawei.com>
Tested-by: xuyandong <xuyandong2(a)huawei.com>
Cc: stable(a)vger.kernel.org
Cc: Yinghai Lu <yinghai(a)kernel.org>
Cc: Jesse Barnes <jbarnes(a)virtuousgeek.org>
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
---
Please review and consider for stable.
changes from v1:
comment and commit log updates to address comments by Bjorn.
drivers/pci/setup-bus.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index ed960436df5e..d5c25d465d97 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -741,6 +741,16 @@ static void pci_bridge_check_ranges(struct pci_bus *bus)
struct resource *b_res;
b_res = &bridge->resource[PCI_BRIDGE_RESOURCES];
+
+ /*
+ * Don't re-check after this was called once already:
+ * important since bridge might be in use.
+ * Note: this is only reliable because as per spec all PCI to PCI
+ * bridges support memory unconditionally so IORESOURCE_MEM is set.
+ */
+ if (b_res[1].flags & IORESOURCE_MEM)
+ return;
+
b_res[1].flags |= IORESOURCE_MEM;
pci_read_config_word(bridge, PCI_IO_BASE, &io);
--
MST
The _DSM function number validation only happens to succeed when the
generic Linux command number translation corresponds with a
DSM-family-specific function number. This breaks NVDIMM-N
implementations that correctly implement _LSR, _LSW, and _LSI, but do
not happen to publish support for DSM function numbers 4, 5, and 6.
Recall that the support for _LS{I,R,W} family of methods results in the
DIMM being marked as supporting those command numbers at
acpi_nfit_register_dimms() time. The DSM function mask is only used for
ND_CMD_CALL support of non-NVDIMM_FAMILY_INTEL devices.
Fixes: 31eca76ba2fc ("nfit, libnvdimm: limited/whitelisted dimm command...")
Cc: <stable(a)vger.kernel.org>
Link: https://github.com/pmem/ndctl/issues/78
Reported-by: Sujith Pandel <sujith_pandel(a)dell.com>
Signed-off-by: Dan Williams <dan.j.williams(a)intel.com>
---
Sujith, this is a larger change than what you originally tested, but it
should behave the same. I wanted to consolidate all the code that
handles Linux command number to DIMM _DSM function number translation.
If you have a chance to re-test with this it would be much appreciated.
Thanks for the report!
drivers/acpi/nfit/core.c | 43 +++++++++++++++++++++++++++++--------------
1 file changed, 29 insertions(+), 14 deletions(-)
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 790691d9a982..d5d64e90ae71 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -409,6 +409,29 @@ static bool payload_dumpable(struct nvdimm *nvdimm, unsigned int func)
return true;
}
+static int cmd_to_func(struct nvdimm *nvdimm, unsigned int cmd,
+ struct nd_cmd_pkg *call_pkg)
+{
+ struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
+
+ if (cmd == ND_CMD_CALL) {
+ int i;
+
+ if (call_pkg && nfit_mem->family != call_pkg->nd_family)
+ return -ENOTTY;
+
+ for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
+ if (call_pkg->nd_reserved2[i])
+ return -EINVAL;
+ return call_pkg->nd_command;
+ }
+
+ /* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */
+ if (nfit_mem->family == NVDIMM_FAMILY_INTEL)
+ return cmd;
+ return 0;
+}
+
int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
{
@@ -422,30 +445,21 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
unsigned long cmd_mask, dsm_mask;
u32 offset, fw_status = 0;
acpi_handle handle;
- unsigned int func;
const guid_t *guid;
- int rc, i;
+ int func, rc, i;
if (cmd_rc)
*cmd_rc = -EINVAL;
- func = cmd;
- if (cmd == ND_CMD_CALL) {
- call_pkg = buf;
- func = call_pkg->nd_command;
-
- for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
- if (call_pkg->nd_reserved2[i])
- return -EINVAL;
- }
if (nvdimm) {
struct acpi_device *adev = nfit_mem->adev;
if (!adev)
return -ENOTTY;
- if (call_pkg && nfit_mem->family != call_pkg->nd_family)
- return -ENOTTY;
+ func = cmd_to_func(nvdimm, cmd, buf);
+ if (func < 0)
+ return func;
dimm_name = nvdimm_name(nvdimm);
cmd_name = nvdimm_cmd_name(cmd);
cmd_mask = nvdimm_cmd_mask(nvdimm);
@@ -456,6 +470,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
} else {
struct acpi_device *adev = to_acpi_dev(acpi_desc);
+ func = cmd;
cmd_name = nvdimm_bus_cmd_name(cmd);
cmd_mask = nd_desc->cmd_mask;
dsm_mask = cmd_mask;
@@ -470,7 +485,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
if (!desc || (cmd && (desc->out_num + desc->in_num == 0)))
return -ENOTTY;
- if (!test_bit(cmd, &cmd_mask) || !test_bit(func, &dsm_mask))
+ if (!test_bit(cmd, &cmd_mask) && !test_bit(func, &dsm_mask))
return -ENOTTY;
in_obj.type = ACPI_TYPE_PACKAGE;
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 4d80273976bf880c4bed9359b8f2d45663140c86 Mon Sep 17 00:00:00 2001
From: Lyude Paul <lyude(a)redhat.com>
Date: Mon, 8 Oct 2018 19:24:30 -0400
Subject: [PATCH] drm/atomic_helper: Disallow new modesets on unregistered
connectors
With the exception of modesets which would switch the DPMS state of a
connector from on to off, we want to make sure that we disallow all
modesets which would result in enabling a new monitor or a new mode
configuration on a monitor if the connector for the display in question
is no longer registered. This allows us to stop userspace from trying to
enable new displays on connectors for an MST topology that were just
removed from the system, without preventing userspace from disabling
DPMS on those connectors.
Changes since v5:
- Fix typo in comment, nothing else
Signed-off-by: Lyude Paul <lyude(a)redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: stable(a)vger.kernel.org
Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-2-lyude@r…
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 3cf1aa132778..c1a35078b2b9 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -308,6 +308,26 @@ update_connector_routing(struct drm_atomic_state *state,
return 0;
}
+ crtc_state = drm_atomic_get_new_crtc_state(state,
+ new_connector_state->crtc);
+ /*
+ * For compatibility with legacy users, we want to make sure that
+ * we allow DPMS On->Off modesets on unregistered connectors. Modesets
+ * which would result in anything else must be considered invalid, to
+ * avoid turning on new displays on dead connectors.
+ *
+ * Since the connector can be unregistered at any point during an
+ * atomic check or commit, this is racy. But that's OK: all we care
+ * about is ensuring that userspace can't do anything but shut off the
+ * display on a connector that was destroyed after its been notified,
+ * not before.
+ */
+ if (!READ_ONCE(connector->registered) && crtc_state->active) {
+ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n",
+ connector->base.id, connector->name);
+ return -EINVAL;
+ }
+
funcs = connector->helper_private;
if (funcs->atomic_best_encoder)
@@ -352,7 +372,6 @@ update_connector_routing(struct drm_atomic_state *state,
set_best_encoder(state, new_connector_state, new_encoder);
- crtc_state = drm_atomic_get_new_crtc_state(state, new_connector_state->crtc);
crtc_state->connectors_changed = true;
DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d:%s]\n",
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 8aab2b4410a2 Linux 4.20.2
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Patch merge: OK
Compile: FAILED
We attempted to compile the kernel for multiple architectures, but the compile
failed on one or more architectures:
s390x: FAILED (build log attached: build_s390.log.gz)
powerpc64le: FAILED (build log attached: build_powerpc.log.gz)
aarch64: FAILED (build log attached: build_arm64.log.gz)
x86_64: FAILED (build log attached: build_x86_64.log.gz)
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out a ref:
Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Ref: 8aab2b4410a2 Linux 4.20.2
We then merged the following patches with `git am`:
powerpc-tm-unset-msr-if-not-recheckpointing.patch
btrfs-fix-deadlock-when-using-free-space-tree-due-to-block-group-creation.patch
usbcore-select-only-first-configuration-for-non-uac3-compliant-devices.patch
staging-rtl8188eu-fix-module-loading-from-tasklet-for-ccmp-encryption.patch
staging-rtl8188eu-fix-module-loading-from-tasklet-for-wep-encryption.patch
cpufreq-scpi-scmi-fix-freeing-of-dynamic-opps.patch
cpufreq-scmi-fix-frequency-invariance-in-slow-path.patch
x86-modpost-replace-last-remnants-of-retpoline-with-config_retpoline.patch
alsa-hda-realtek-support-dell-headset-mode-for-new-aio-platform.patch
alsa-hda-realtek-add-unplug-function-into-unplug-state-of-headset-mode-for-alc225.patch
alsa-hda-realtek-disable-headset-mic-vref-for-headset-mode-of-alc225.patch
cifs-fix-adjustment-of-credits-for-mtu-requests.patch
cifs-do-not-set-credits-to-1-if-the-server-didn-t-grant-anything.patch
cifs-do-not-hide-eintr-after-sending-network-packets.patch
cifs-fix-credit-computation-for-compounded-requests.patch
cifs-fix-potential-oob-access-of-lock-element-array.patch
cifs-check-kzalloc-return.patch
arm-davinci-dm355-evm-fix-label-names-in-gpio-lookup-entries.patch
arm-davinci-da850-evm-fix-label-names-in-gpio-lookup-entries.patch
arm-davinci-omapl138-hawk-fix-label-names-in-gpio-lookup-entries.patch
arm-davinci-dm644x-evm-fix-label-names-in-gpio-lookup-entries.patch
arm-davinci-da830-evm-fix-label-names-in-gpio-lookup-entries.patch
usb-cdc-acm-send-zlp-for-telit-3g-intel-based-modems.patch
usb-storage-don-t-insert-sane-sense-for-spc3-when-bad-sense-specified.patch
usb-storage-add-quirk-for-smi-sm3350.patch
usb-add-usb_quirk_delay_ctrl_msg-quirk-for-corsair-k70-rgb.patch
fork-memcg-fix-cached_stacks-case.patch
slab-alien-caches-must-not-be-initialized-if-the-allocation-of-the-alien-cache-failed.patch
mm-usercopy.c-no-check-page-span-for-stack-objects.patch
mm-memcg-fix-reclaim-deadlock-with-writeback.patch
mm-page_mapped-don-t-assume-compound-page-is-huge-or-thp.patch
Compile testing
---------------
We compiled the kernel for 4 architectures:
s390x:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration:
powerpc64le:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration:
aarch64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration:
x86_64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration:
Hardware testing
----------------
We booted each kernel and ran the following tests:
s390:
powerpc:
arm64:
x86_64:
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 63f3655f950186752236bb88a22f8252c11ce394 Mon Sep 17 00:00:00 2001
From: Michal Hocko <mhocko(a)suse.com>
Date: Tue, 8 Jan 2019 15:23:07 -0800
Subject: [PATCH] mm, memcg: fix reclaim deadlock with writeback
Liu Bo has experienced a deadlock between memcg (legacy) reclaim and the
ext4 writeback
task1:
wait_on_page_bit+0x82/0xa0
shrink_page_list+0x907/0x960
shrink_inactive_list+0x2c7/0x680
shrink_node_memcg+0x404/0x830
shrink_node+0xd8/0x300
do_try_to_free_pages+0x10d/0x330
try_to_free_mem_cgroup_pages+0xd5/0x1b0
try_charge+0x14d/0x720
memcg_kmem_charge_memcg+0x3c/0xa0
memcg_kmem_charge+0x7e/0xd0
__alloc_pages_nodemask+0x178/0x260
alloc_pages_current+0x95/0x140
pte_alloc_one+0x17/0x40
__pte_alloc+0x1e/0x110
alloc_set_pte+0x5fe/0xc20
do_fault+0x103/0x970
handle_mm_fault+0x61e/0xd10
__do_page_fault+0x252/0x4d0
do_page_fault+0x30/0x80
page_fault+0x28/0x30
task2:
__lock_page+0x86/0xa0
mpage_prepare_extent_to_map+0x2e7/0x310 [ext4]
ext4_writepages+0x479/0xd60
do_writepages+0x1e/0x30
__writeback_single_inode+0x45/0x320
writeback_sb_inodes+0x272/0x600
__writeback_inodes_wb+0x92/0xc0
wb_writeback+0x268/0x300
wb_workfn+0xb4/0x390
process_one_work+0x189/0x420
worker_thread+0x4e/0x4b0
kthread+0xe6/0x100
ret_from_fork+0x41/0x50
He adds
"task1 is waiting for the PageWriteback bit of the page that task2 has
collected in mpd->io_submit->io_bio, and tasks2 is waiting for the
LOCKED bit the page which tasks1 has locked"
More precisely task1 is handling a page fault and it has a page locked
while it charges a new page table to a memcg. That in turn hits a
memory limit reclaim and the memcg reclaim for legacy controller is
waiting on the writeback but that is never going to finish because the
writeback itself is waiting for the page locked in the #PF path. So
this is essentially ABBA deadlock:
lock_page(A)
SetPageWriteback(A)
unlock_page(A)
lock_page(B)
lock_page(B)
pte_alloc_pne
shrink_page_list
wait_on_page_writeback(A)
SetPageWriteback(B)
unlock_page(B)
# flush A, B to clear the writeback
This accumulating of more pages to flush is used by several filesystems
to generate a more optimal IO patterns.
Waiting for the writeback in legacy memcg controller is a workaround for
pre-mature OOM killer invocations because there is no dirty IO
throttling available for the controller. There is no easy way around
that unfortunately. Therefore fix this specific issue by pre-allocating
the page table outside of the page lock. We have that handy
infrastructure for that already so simply reuse the fault-around pattern
which already does this.
There are probably other hidden __GFP_ACCOUNT | GFP_KERNEL allocations
from under a fs page locked but they should be really rare. I am not
aware of a better solution unfortunately.
[akpm(a)linux-foundation.org: fix mm/memory.c:__do_fault()]
[akpm(a)linux-foundation.org: coding-style fixes]
[mhocko(a)kernel.org: enhance comment, per Johannes]
Link: http://lkml.kernel.org/r/20181214084948.GA5624@dhcp22.suse.cz
Link: http://lkml.kernel.org/r/20181213092221.27270-1-mhocko@kernel.org
Fixes: c3b94f44fcb0 ("memcg: further prevent OOM with too many dirty pages")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Debugged-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reviewed-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Dave Chinner <david(a)fromorbit.com>
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/memory.c b/mm/memory.c
index a52663c0612d..5e46836714dc 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2994,6 +2994,28 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
struct vm_area_struct *vma = vmf->vma;
vm_fault_t ret;
+ /*
+ * Preallocate pte before we take page_lock because this might lead to
+ * deadlocks for memcg reclaim which waits for pages under writeback:
+ * lock_page(A)
+ * SetPageWriteback(A)
+ * unlock_page(A)
+ * lock_page(B)
+ * lock_page(B)
+ * pte_alloc_pne
+ * shrink_page_list
+ * wait_on_page_writeback(A)
+ * SetPageWriteback(B)
+ * unlock_page(B)
+ * # flush A, B to clear the writeback
+ */
+ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
+ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm);
+ if (!vmf->prealloc_pte)
+ return VM_FAULT_OOM;
+ smp_wmb(); /* See comment in __pte_alloc() */
+ }
+
ret = vma->vm_ops->fault(vmf);
if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
VM_FAULT_DONE_COW)))
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 63f3655f950186752236bb88a22f8252c11ce394 Mon Sep 17 00:00:00 2001
From: Michal Hocko <mhocko(a)suse.com>
Date: Tue, 8 Jan 2019 15:23:07 -0800
Subject: [PATCH] mm, memcg: fix reclaim deadlock with writeback
Liu Bo has experienced a deadlock between memcg (legacy) reclaim and the
ext4 writeback
task1:
wait_on_page_bit+0x82/0xa0
shrink_page_list+0x907/0x960
shrink_inactive_list+0x2c7/0x680
shrink_node_memcg+0x404/0x830
shrink_node+0xd8/0x300
do_try_to_free_pages+0x10d/0x330
try_to_free_mem_cgroup_pages+0xd5/0x1b0
try_charge+0x14d/0x720
memcg_kmem_charge_memcg+0x3c/0xa0
memcg_kmem_charge+0x7e/0xd0
__alloc_pages_nodemask+0x178/0x260
alloc_pages_current+0x95/0x140
pte_alloc_one+0x17/0x40
__pte_alloc+0x1e/0x110
alloc_set_pte+0x5fe/0xc20
do_fault+0x103/0x970
handle_mm_fault+0x61e/0xd10
__do_page_fault+0x252/0x4d0
do_page_fault+0x30/0x80
page_fault+0x28/0x30
task2:
__lock_page+0x86/0xa0
mpage_prepare_extent_to_map+0x2e7/0x310 [ext4]
ext4_writepages+0x479/0xd60
do_writepages+0x1e/0x30
__writeback_single_inode+0x45/0x320
writeback_sb_inodes+0x272/0x600
__writeback_inodes_wb+0x92/0xc0
wb_writeback+0x268/0x300
wb_workfn+0xb4/0x390
process_one_work+0x189/0x420
worker_thread+0x4e/0x4b0
kthread+0xe6/0x100
ret_from_fork+0x41/0x50
He adds
"task1 is waiting for the PageWriteback bit of the page that task2 has
collected in mpd->io_submit->io_bio, and tasks2 is waiting for the
LOCKED bit the page which tasks1 has locked"
More precisely task1 is handling a page fault and it has a page locked
while it charges a new page table to a memcg. That in turn hits a
memory limit reclaim and the memcg reclaim for legacy controller is
waiting on the writeback but that is never going to finish because the
writeback itself is waiting for the page locked in the #PF path. So
this is essentially ABBA deadlock:
lock_page(A)
SetPageWriteback(A)
unlock_page(A)
lock_page(B)
lock_page(B)
pte_alloc_pne
shrink_page_list
wait_on_page_writeback(A)
SetPageWriteback(B)
unlock_page(B)
# flush A, B to clear the writeback
This accumulating of more pages to flush is used by several filesystems
to generate a more optimal IO patterns.
Waiting for the writeback in legacy memcg controller is a workaround for
pre-mature OOM killer invocations because there is no dirty IO
throttling available for the controller. There is no easy way around
that unfortunately. Therefore fix this specific issue by pre-allocating
the page table outside of the page lock. We have that handy
infrastructure for that already so simply reuse the fault-around pattern
which already does this.
There are probably other hidden __GFP_ACCOUNT | GFP_KERNEL allocations
from under a fs page locked but they should be really rare. I am not
aware of a better solution unfortunately.
[akpm(a)linux-foundation.org: fix mm/memory.c:__do_fault()]
[akpm(a)linux-foundation.org: coding-style fixes]
[mhocko(a)kernel.org: enhance comment, per Johannes]
Link: http://lkml.kernel.org/r/20181214084948.GA5624@dhcp22.suse.cz
Link: http://lkml.kernel.org/r/20181213092221.27270-1-mhocko@kernel.org
Fixes: c3b94f44fcb0 ("memcg: further prevent OOM with too many dirty pages")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Debugged-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reviewed-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Dave Chinner <david(a)fromorbit.com>
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/memory.c b/mm/memory.c
index a52663c0612d..5e46836714dc 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2994,6 +2994,28 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
struct vm_area_struct *vma = vmf->vma;
vm_fault_t ret;
+ /*
+ * Preallocate pte before we take page_lock because this might lead to
+ * deadlocks for memcg reclaim which waits for pages under writeback:
+ * lock_page(A)
+ * SetPageWriteback(A)
+ * unlock_page(A)
+ * lock_page(B)
+ * lock_page(B)
+ * pte_alloc_pne
+ * shrink_page_list
+ * wait_on_page_writeback(A)
+ * SetPageWriteback(B)
+ * unlock_page(B)
+ * # flush A, B to clear the writeback
+ */
+ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
+ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm);
+ if (!vmf->prealloc_pte)
+ return VM_FAULT_OOM;
+ smp_wmb(); /* See comment in __pte_alloc() */
+ }
+
ret = vma->vm_ops->fault(vmf);
if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
VM_FAULT_DONE_COW)))
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 63f3655f950186752236bb88a22f8252c11ce394 Mon Sep 17 00:00:00 2001
From: Michal Hocko <mhocko(a)suse.com>
Date: Tue, 8 Jan 2019 15:23:07 -0800
Subject: [PATCH] mm, memcg: fix reclaim deadlock with writeback
Liu Bo has experienced a deadlock between memcg (legacy) reclaim and the
ext4 writeback
task1:
wait_on_page_bit+0x82/0xa0
shrink_page_list+0x907/0x960
shrink_inactive_list+0x2c7/0x680
shrink_node_memcg+0x404/0x830
shrink_node+0xd8/0x300
do_try_to_free_pages+0x10d/0x330
try_to_free_mem_cgroup_pages+0xd5/0x1b0
try_charge+0x14d/0x720
memcg_kmem_charge_memcg+0x3c/0xa0
memcg_kmem_charge+0x7e/0xd0
__alloc_pages_nodemask+0x178/0x260
alloc_pages_current+0x95/0x140
pte_alloc_one+0x17/0x40
__pte_alloc+0x1e/0x110
alloc_set_pte+0x5fe/0xc20
do_fault+0x103/0x970
handle_mm_fault+0x61e/0xd10
__do_page_fault+0x252/0x4d0
do_page_fault+0x30/0x80
page_fault+0x28/0x30
task2:
__lock_page+0x86/0xa0
mpage_prepare_extent_to_map+0x2e7/0x310 [ext4]
ext4_writepages+0x479/0xd60
do_writepages+0x1e/0x30
__writeback_single_inode+0x45/0x320
writeback_sb_inodes+0x272/0x600
__writeback_inodes_wb+0x92/0xc0
wb_writeback+0x268/0x300
wb_workfn+0xb4/0x390
process_one_work+0x189/0x420
worker_thread+0x4e/0x4b0
kthread+0xe6/0x100
ret_from_fork+0x41/0x50
He adds
"task1 is waiting for the PageWriteback bit of the page that task2 has
collected in mpd->io_submit->io_bio, and tasks2 is waiting for the
LOCKED bit the page which tasks1 has locked"
More precisely task1 is handling a page fault and it has a page locked
while it charges a new page table to a memcg. That in turn hits a
memory limit reclaim and the memcg reclaim for legacy controller is
waiting on the writeback but that is never going to finish because the
writeback itself is waiting for the page locked in the #PF path. So
this is essentially ABBA deadlock:
lock_page(A)
SetPageWriteback(A)
unlock_page(A)
lock_page(B)
lock_page(B)
pte_alloc_pne
shrink_page_list
wait_on_page_writeback(A)
SetPageWriteback(B)
unlock_page(B)
# flush A, B to clear the writeback
This accumulating of more pages to flush is used by several filesystems
to generate a more optimal IO patterns.
Waiting for the writeback in legacy memcg controller is a workaround for
pre-mature OOM killer invocations because there is no dirty IO
throttling available for the controller. There is no easy way around
that unfortunately. Therefore fix this specific issue by pre-allocating
the page table outside of the page lock. We have that handy
infrastructure for that already so simply reuse the fault-around pattern
which already does this.
There are probably other hidden __GFP_ACCOUNT | GFP_KERNEL allocations
from under a fs page locked but they should be really rare. I am not
aware of a better solution unfortunately.
[akpm(a)linux-foundation.org: fix mm/memory.c:__do_fault()]
[akpm(a)linux-foundation.org: coding-style fixes]
[mhocko(a)kernel.org: enhance comment, per Johannes]
Link: http://lkml.kernel.org/r/20181214084948.GA5624@dhcp22.suse.cz
Link: http://lkml.kernel.org/r/20181213092221.27270-1-mhocko@kernel.org
Fixes: c3b94f44fcb0 ("memcg: further prevent OOM with too many dirty pages")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Debugged-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Reviewed-by: Liu Bo <bo.liu(a)linux.alibaba.com>
Cc: Jan Kara <jack(a)suse.cz>
Cc: Dave Chinner <david(a)fromorbit.com>
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: Shakeel Butt <shakeelb(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
diff --git a/mm/memory.c b/mm/memory.c
index a52663c0612d..5e46836714dc 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2994,6 +2994,28 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
struct vm_area_struct *vma = vmf->vma;
vm_fault_t ret;
+ /*
+ * Preallocate pte before we take page_lock because this might lead to
+ * deadlocks for memcg reclaim which waits for pages under writeback:
+ * lock_page(A)
+ * SetPageWriteback(A)
+ * unlock_page(A)
+ * lock_page(B)
+ * lock_page(B)
+ * pte_alloc_pne
+ * shrink_page_list
+ * wait_on_page_writeback(A)
+ * SetPageWriteback(B)
+ * unlock_page(B)
+ * # flush A, B to clear the writeback
+ */
+ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
+ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm);
+ if (!vmf->prealloc_pte)
+ return VM_FAULT_OOM;
+ smp_wmb(); /* See comment in __pte_alloc() */
+ }
+
ret = vma->vm_ops->fault(vmf);
if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
VM_FAULT_DONE_COW)))
I've backported fixes for several security issues involving filesystem
validation in btrfs. All of these are already fixed in the later
stable branches.
I tested with the reproducers where available. I also checked for
regressions with xfstests and didn't find any (but many tests fail with
or without these changes).
Ben.
--
Ben Hutchings, Software Developer Codethink Ltd
https://www.codethink.co.uk/ Dale House, 35 Dale Street
Manchester, M1 2HF, United Kingdom
We need to handle mmc_of_parse() errors during probe.
This finally fixes the wifi regression on Raspberry Pi 3 series.
In error case the wifi chip was permanently in reset because of
the power sequence depending on the deferred probe of the GPIO expander.
Fixes: b580c52d58d9 ("mmc: sdhci-iproc: add IPROC SDHCI driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Stefan Wahren <stefan.wahren(a)i2se.com>
---
drivers/mmc/host/sdhci-iproc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 0db9905..9d12c06 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -296,7 +296,10 @@ static int sdhci_iproc_probe(struct platform_device *pdev)
iproc_host->data = iproc_data;
- mmc_of_parse(host->mmc);
+ ret = mmc_of_parse(host->mmc);
+ if (ret)
+ goto err;
+
sdhci_get_property(pdev);
host->mmc->caps |= iproc_host->data->mmc_caps;
--
2.7.4
Now tuning reset will be done when the timing is MMC_TIMING_LEGACY/
MMC_TIMING_MMC_HS/MMC_TIMING_SD_HS. But for timing MMC_TIMING_MMC_HS,
we can not do tuning reset, otherwise HS400 timing is not right.
Here is the process of init HS400, first finish tuning in HS200 mode,
then switch to HS mode and 8 bit DDR mode, finally switch to HS400
mode. If we do tuning reset in HS mode, this will cause HS400 mode
lost the tuning setting, which will cause CRC error.
This fix commit d9370424c948 ("mmc: sdhci-esdhc-imx: reset tuning
circuit when power on mmc card").
Signed-off-by: Haibo Chen <haibo.chen(a)nxp.com>
Cc: stable(a)vger.kernel.org # v4.12+
---
drivers/mmc/host/sdhci-esdhc-imx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d0d319398a54..984cc1a788cb 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -979,6 +979,7 @@ static void esdhc_set_uhs_signaling(struct sdhci_host *host, unsigned timing)
case MMC_TIMING_UHS_SDR25:
case MMC_TIMING_UHS_SDR50:
case MMC_TIMING_UHS_SDR104:
+ case MMC_TIMING_MMC_HS:
case MMC_TIMING_MMC_HS200:
writel(m, host->ioaddr + ESDHC_MIX_CTRL);
break;
--
2.17.1
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1b3922a8bc74231f9a767d1be6d9a061a4d4eeab Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu(a)suse.com>
Date: Tue, 8 Jan 2019 14:08:18 +0800
Subject: [PATCH] btrfs: Use real device structure to verify dev extent
[BUG]
Linux v5.0-rc1 will fail fstests/btrfs/163 with the following kernel
message:
BTRFS error (device dm-6): dev extent devid 1 physical offset 13631488 len 8388608 is beyond device boundary 0
BTRFS error (device dm-6): failed to verify dev extents against chunks: -117
BTRFS error (device dm-6): open_ctree failed
[CAUSE]
Commit cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent
mapping check") introduced strict check on dev extents.
We use btrfs_find_device() with dev uuid and fs uuid set to NULL, and
only dependent on @devid to find the real device.
For seed devices, we call clone_fs_devices() in open_seed_devices() to
allow us search seed devices directly.
However clone_fs_devices() just populates devices with devid and dev
uuid, without populating other essential members, like disk_total_bytes.
This makes any device returned by btrfs_find_device(fs_info, devid,
NULL, NULL) is just a dummy, with 0 disk_total_bytes, and any dev
extents on the seed device will not pass the device boundary check.
[FIX]
This patch will try to verify the device returned by btrfs_find_device()
and if it's a dummy then re-search in seed devices.
Fixes: cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent mapping check")
CC: stable(a)vger.kernel.org # 4.19+
Reported-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 2576b1a379c9..3e4f8f88353e 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -7825,6 +7825,18 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
ret = -EUCLEAN;
goto out;
}
+
+ /* It's possible this device is a dummy for seed device */
+ if (dev->disk_total_bytes == 0) {
+ dev = find_device(fs_info->fs_devices->seed, devid, NULL);
+ if (!dev) {
+ btrfs_err(fs_info, "failed to find seed devid %llu",
+ devid);
+ ret = -EUCLEAN;
+ goto out;
+ }
+ }
+
if (physical_offset + physical_len > dev->disk_total_bytes) {
btrfs_err(fs_info,
"dev extent devid %llu physical offset %llu len %llu is beyond device boundary %llu",
Commit e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
moved a code block around and this block uses a 'msr' variable outside of
the CONFIG_PPC_TRANSACTIONAL_MEM, however the 'msr' variable is declared
inside a CONFIG_PPC_TRANSACTIONAL_MEM block, causing a possible error when
CONFIG_PPC_TRANSACTION_MEM is not defined.
error: 'msr' undeclared (first use in this function)
This is not causing a compilation error in the mainline kernel, because
'msr' is being used as an argument of MSR_TM_ACTIVE(), which is defined as
the following when CONFIG_PPC_TRANSACTIONAL_MEM is *not* set:
#define MSR_TM_ACTIVE(x) 0
This patch just fixes this issue avoiding the 'msr' variable usage outside
the CONFIG_PPC_TRANSACTIONAL_MEM block, avoiding trusting in the
MSR_TM_ACTIVE() definition.
Cc: stable(a)vger.kernel.org
Reported-by: Christoph Biedl <linux-kernel.bfrz(a)manchmal.in-ulm.de>
Fixes: e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
Signed-off-by: Breno Leitao <leitao(a)debian.org>
---
NB: Since stable kernels didn't cherry picked 5c784c8414fba ('powerpc/tm:
Remove msr_tm_active()), MSR_TM_ACTIVE() is not defined as 0 for
CONFIG_PPC_TRANSACTIONAL_MEM=n case, thus triggering the compilation error
above.
Tested against stable kernel 4.19.13-rc2 and problem is now fixed when
CONFIG_PPC_TRANSACTIONAL_MEM=n
arch/powerpc/kernel/signal_64.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index daa28cb72272..8fe698162ab9 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -739,11 +739,12 @@ SYSCALL_DEFINE0(rt_sigreturn)
if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
&uc_transact->uc_mcontext))
goto badframe;
- }
+ } else
#endif
- /* Fall through, for non-TM restore */
- if (!MSR_TM_ACTIVE(msr)) {
+ {
/*
+ * Fall through, for non-TM restore
+ *
* Unset MSR[TS] on the thread regs since MSR from user
* context does not have MSR active, and recheckpoint was
* not called since restore_tm_sigcontexts() was not called
--
2.19.0
The patch below does not apply to the 4.20-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1b3922a8bc74231f9a767d1be6d9a061a4d4eeab Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu(a)suse.com>
Date: Tue, 8 Jan 2019 14:08:18 +0800
Subject: [PATCH] btrfs: Use real device structure to verify dev extent
[BUG]
Linux v5.0-rc1 will fail fstests/btrfs/163 with the following kernel
message:
BTRFS error (device dm-6): dev extent devid 1 physical offset 13631488 len 8388608 is beyond device boundary 0
BTRFS error (device dm-6): failed to verify dev extents against chunks: -117
BTRFS error (device dm-6): open_ctree failed
[CAUSE]
Commit cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent
mapping check") introduced strict check on dev extents.
We use btrfs_find_device() with dev uuid and fs uuid set to NULL, and
only dependent on @devid to find the real device.
For seed devices, we call clone_fs_devices() in open_seed_devices() to
allow us search seed devices directly.
However clone_fs_devices() just populates devices with devid and dev
uuid, without populating other essential members, like disk_total_bytes.
This makes any device returned by btrfs_find_device(fs_info, devid,
NULL, NULL) is just a dummy, with 0 disk_total_bytes, and any dev
extents on the seed device will not pass the device boundary check.
[FIX]
This patch will try to verify the device returned by btrfs_find_device()
and if it's a dummy then re-search in seed devices.
Fixes: cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent mapping check")
CC: stable(a)vger.kernel.org # 4.19+
Reported-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 2576b1a379c9..3e4f8f88353e 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -7825,6 +7825,18 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
ret = -EUCLEAN;
goto out;
}
+
+ /* It's possible this device is a dummy for seed device */
+ if (dev->disk_total_bytes == 0) {
+ dev = find_device(fs_info->fs_devices->seed, devid, NULL);
+ if (!dev) {
+ btrfs_err(fs_info, "failed to find seed devid %llu",
+ devid);
+ ret = -EUCLEAN;
+ goto out;
+ }
+ }
+
if (physical_offset + physical_len > dev->disk_total_bytes) {
btrfs_err(fs_info,
"dev extent devid %llu physical offset %llu len %llu is beyond device boundary %llu",
This is the start of the stable review cycle for the 4.20.2 release.
There are 65 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:10:14 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.2-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.20.2-rc1
Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
drm/rockchip: psr: do not dereference encoder before it is null checked.
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Set ->is_yuv to false when num_planes == 1
Lyude Paul <lyude(a)redhat.com>
drm/nouveau/drm/nouveau: Check rc from drm_dp_mst_topology_mgr_resume()
Christophe Leroy <christophe.leroy(a)c-s.fr>
lib: fix build failure in CONFIG_DEBUG_VIRTUAL test
Frank Rowand <frank.rowand(a)sony.com>
of: __of_detach_node() - remove node from phandle cache
Frank Rowand <frank.rowand(a)sony.com>
of: of_node_get()/of_node_put() nodes held in phandle cache
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: msu: Fix an off-by-one in attribute store
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Shuah Khan <shuah(a)kernel.org>
selftests: Fix test errors related to lib.mk khdr target
Christian Lamparter <chunkeey(a)gmail.com>
powerpc/4xx/ocm: Fix compilation error due to PAGE_KERNEL usage
Shaokun Zhang <zhangshaokun(a)hisilicon.com>
drivers/perf: hisi: Fixup one DDRC PMU register offset
YueHaibing <yuehaibing(a)huawei.com>
video: fbdev: pxafb: Fix "WARNING: invalid free of devm_ allocated data"
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Linus Torvalds <torvalds(a)linux-foundation.org>
sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c
Sohil Mehta <sohil.mehta(a)intel.com>
iommu/vt-d: Handle domain agaw being less than iommu agaw
Steve Wise <swise(a)opengridcomputing.com>
RDMA/iwcm: Don't copy past the end of dev_name() string
Bart Van Assche <bvanassche(a)acm.org>
RDMA/srpt: Fix a use-after-free in the channel release code
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
stm class: Fix a module refcount leak in policy creation error path
Sagi Grimberg <sagi(a)grimberg.me>
rxe: fix error completion wr_id and qp_num
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Mircea Caprioru <mircea.caprioru(a)analog.com>
iio: dac: ad5686: fix bit shift read register
Evan Green <evgreen(a)chromium.org>
iio: adc: qcom-spmi-adc5: Initialize prescale properly
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "powerpc/tm: Unset MSR[TS] if not recheckpointing"
J. Bruce Fields <bfields(a)redhat.com>
nfsd4: zero-length WRITE should succeed
Chuck Lever <chuck.lever(a)oracle.com>
xprtrdma: Yet another double DMA-unmap
Benjamin Coddington <bcodding(a)redhat.com>
lockd: Show pid of lockd for remote locks
Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
PCI / PM: Allow runtime PM without callback functions
Ondrej Mosnacek <omosnace(a)redhat.com>
selinux: policydb - fix byte order and alignment issues
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Get rid of potential double-freeing in gfs2_create_inode
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Jaegeuk Kim <jaegeuk(a)kernel.org>
dm: do not allow readahead to limit IO size
Damien Le Moal <damien.lemoal(a)wdc.com>
block: mq-deadline: Fix write completion handling
Ming Lei <ming.lei(a)redhat.com>
block: deactivate blk_stat timer in wbt_disable_default()
Matthew Wilcox <willy(a)infradead.org>
Fix failure path in alloc_pid()
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
driver core: Add missing dev->bus->need_parent_lock checks
Dennis Krein <Dennis.Krein(a)netapp.com>
srcu: Lock srcu_data structure in srcu_gp_start()
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Always check descriptor sizes in parser code
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Check mixer unit descriptors more strictly
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Brad Love <brad(a)nextdimension.cc>
media: cx23885: only reset DMA on problematic CPUs
Huang Ying <ying.huang(a)intel.com>
mm, swap: fix swapoff with KSM pages
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: replace hmm_devmem_pages_create() with devm_memremap_pages()
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: use devm semantics for hmm_devmem_{add, remove}
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: add MEMORY_DEVICE_PRIVATE support
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
Michal Hocko <mhocko(a)suse.com>
memcg, oom: notify on oom killer invocation from the charge path
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: fix shutdown handling
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: kill mapping "System RAM" support
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
Michal Hocko <mhocko(a)suse.com>
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
Minchan Kim <minchan(a)kernel.org>
zram: fix double free backing device
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Ewan D. Milne <emilne(a)redhat.com>
scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/signal_32.c | 38 ++-
arch/powerpc/kernel/signal_64.c | 64 +++--
arch/powerpc/platforms/4xx/ocm.c | 4 +-
block/blk-mq-sched.c | 3 +-
block/blk-mq-sched.h | 1 +
block/blk-stat.h | 5 +
block/blk-wbt.c | 4 +-
block/mq-deadline.c | 12 +-
drivers/base/dd.c | 4 +-
drivers/block/zram/zram_drv.c | 4 +-
drivers/dax/pmem.c | 14 +-
drivers/gpu/drm/nouveau/dispnv50/disp.c | 12 +-
drivers/gpu/drm/rockchip/rockchip_drm_psr.c | 4 +-
drivers/gpu/drm/vc4/vc4_plane.c | 1 +
drivers/hwtracing/intel_th/msu.c | 3 +-
drivers/hwtracing/stm/policy.c | 12 +-
drivers/iio/adc/qcom-spmi-adc5.c | 58 ++--
drivers/iio/dac/ad5686.c | 3 +-
drivers/infiniband/core/iwcm.c | 12 +-
drivers/infiniband/sw/rxe/rxe_resp.c | 13 +-
drivers/infiniband/ulp/srpt/ib_srpt.c | 18 +-
drivers/iommu/intel-iommu.c | 4 +-
drivers/md/dm-table.c | 3 +
drivers/media/pci/cx23885/cx23885-core.c | 55 +++-
drivers/media/pci/cx23885/cx23885.h | 2 +
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/net/wireless/broadcom/b43/phy_common.c | 2 +-
drivers/nvdimm/pmem.c | 13 +-
drivers/of/base.c | 101 +++++--
drivers/of/dynamic.c | 3 +
drivers/of/of_private.h | 4 +
drivers/pci/p2pdma.c | 10 +-
drivers/pci/pci-driver.c | 27 +-
drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 4 +-
drivers/power/supply/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/scsi/lpfc/lpfc_sli.c | 3 +-
drivers/video/fbdev/pxafb.c | 4 +-
fs/ceph/caps.c | 1 -
fs/dlm/lock.c | 17 +-
fs/dlm/lockspace.c | 2 +-
fs/gfs2/inode.c | 18 +-
fs/gfs2/rgrp.c | 2 +-
fs/lockd/clntproc.c | 2 +-
fs/lockd/xdr.c | 4 +-
fs/lockd/xdr4.c | 4 +-
fs/nfsd/nfs4proc.c | 2 -
include/linux/hmm.h | 4 +-
include/linux/memremap.h | 2 +
kernel/fork.c | 13 +-
kernel/memremap.c | 94 ++++---
kernel/pid.c | 6 +-
kernel/rcu/srcutree.c | 2 +
kernel/sched/fair.c | 43 +--
lib/test_debug_virtual.c | 1 +
mm/hmm.c | 305 +++------------------
mm/memcontrol.c | 20 +-
mm/memory_hotplug.c | 16 ++
mm/swapfile.c | 3 +-
net/9p/client.c | 21 ++
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 10 +-
net/sunrpc/xprtrdma/frwr_ops.c | 6 +-
net/sunrpc/xprtrdma/verbs.c | 9 +-
security/selinux/ss/policydb.c | 51 +++-
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/usb/card.c | 2 +-
sound/usb/mixer.c | 29 +-
sound/usb/quirks-table.h | 6 +
sound/usb/stream.c | 36 ++-
tools/testing/nvdimm/test/iomap.c | 17 +-
tools/testing/selftests/android/Makefile | 2 +-
tools/testing/selftests/futex/functional/Makefile | 1 +
tools/testing/selftests/gpio/Makefile | 6 +-
tools/testing/selftests/kvm/Makefile | 2 +-
tools/testing/selftests/lib.mk | 8 +-
.../selftests/networking/timestamping/Makefile | 1 +
tools/testing/selftests/tc-testing/bpf/Makefile | 1 +
tools/testing/selftests/vm/Makefile | 1 +
80 files changed, 710 insertions(+), 611 deletions(-)
This is a note to let you know that I've just added the patch titled
mei: me: add denverton innovation engine device IDs
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From f7ee8ead151f9d0b8dac6ab6c3ff49bbe809c564 Mon Sep 17 00:00:00 2001
From: Tomas Winkler <tomas.winkler(a)intel.com>
Date: Sun, 13 Jan 2019 14:24:48 +0200
Subject: mei: me: add denverton innovation engine device IDs
Add the Denverton innovation engine (IE) device ids.
The IE is an ME-like device which provides HW security
offloading.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/misc/mei/hw-me-regs.h | 2 ++
drivers/misc/mei/pci-me.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index e4b10b2d1a08..23739a60517f 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -127,6 +127,8 @@
#define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */
#define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */
+#define MEI_DEV_ID_DNV_IE 0x19E5 /* Denverton IE */
+
#define MEI_DEV_ID_GLK 0x319A /* Gemini Lake */
#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index c2bf3e99955e..e89497f858ae 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -93,6 +93,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)},
+
{MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
--
2.20.1
This is a note to let you know that I've just added the patch titled
mei: me: mark LBG devices as having dma support
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 173436ba800d01178a8b19e5de4a8cb02c0db760 Mon Sep 17 00:00:00 2001
From: Alexander Usyskin <alexander.usyskin(a)intel.com>
Date: Sun, 13 Jan 2019 14:24:47 +0200
Subject: mei: me: mark LBG devices as having dma support
The LBG server platform sports DMA support.
Cc: <stable(a)vger.kernel.org> #v5.0+
Signed-off-by: Alexander Usyskin <alexander.usyskin(a)intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/misc/mei/pci-me.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 73ace2d59dea..c2bf3e99955e 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -88,7 +88,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
- {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
--
2.20.1
This is a note to let you know that I've just added the patch titled
mei: dma: silent the reject message
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 82e59cbe5fdc0d521f9037861af21af6d5814afd Mon Sep 17 00:00:00 2001
From: Tomas Winkler <tomas.winkler(a)intel.com>
Date: Sun, 13 Jan 2019 14:24:46 +0200
Subject: mei: dma: silent the reject message
Not all FW versions support DMA on their first release,
hence it is normal behavior to receive a reject response
upon DMA setup request.
In order to prevent confusion, the DMA setup reject message
is printed only in debug level.
Cc: <stable(a)vger.kernel.org> #v5.0+
Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/misc/mei/hbm.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 78c26cebf5d4..8f7616557c97 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1187,9 +1187,15 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
dma_setup_res = (struct hbm_dma_setup_response *)mei_msg;
if (dma_setup_res->status) {
- dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
- dma_setup_res->status,
- mei_hbm_status_str(dma_setup_res->status));
+ u8 status = dma_setup_res->status;
+
+ if (status == MEI_HBMS_NOT_ALLOWED) {
+ dev_dbg(dev->dev, "hbm: dma setup not allowed\n");
+ } else {
+ dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+ status,
+ mei_hbm_status_str(status));
+ }
dev->hbm_f_dr_supported = 0;
mei_dmam_ring_free(dev);
}
--
2.20.1
Kyungtae Kim detected a potential integer overflow in bcm_[rx|tx]_setup() when
the conversion into ktime multiplies the given value with NSEC_PER_USEC (1000).
Reference: https://marc.info/?l=linux-can&m=154732118819828&w=2
Add a check for the given tv_usec, so that the value stays below one second.
Additionally limit the tv_sec value to a reasonable value for CAN related
use-cases of 15 minutes.
Reported-by: Kyungtae Kim <kt0755(a)gmail.com>
Tested-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
Cc: linux-stable <stable(a)vger.kernel.org> # >= 2.6.26
---
net/can/bcm.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 0af8f0db892a..ff3799be077b 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -67,6 +67,9 @@
*/
#define MAX_NFRAMES 256
+/* limit timers to 15 minutes for sending/timeouts */
+#define BCM_TIMER_SEC_MAX (15*60)
+
/* use of last_frames[index].flags */
#define RX_RECV 0x40 /* received data for this element */
#define RX_THR 0x80 /* element not been sent due to throttle feature */
@@ -140,6 +143,18 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
}
+/* check limitations for timeval provided by user */
+static int bcm_is_invalid_tv(struct bcm_msg_head *msg_head)
+{
+ if ((msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) ||
+ (msg_head->ival1.tv_usec >= USEC_PER_SEC) ||
+ (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) ||
+ (msg_head->ival2.tv_usec >= USEC_PER_SEC))
+ return 1;
+
+ return 0;
+}
+
#define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
#define OPSIZ sizeof(struct bcm_op)
#define MHSIZ sizeof(struct bcm_msg_head)
@@ -873,6 +888,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
return -EINVAL;
+ /* check timeval limitations */
+ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+ return -EINVAL;
+
/* check the given can_id */
op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
if (op) {
@@ -1053,6 +1072,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
(!(msg_head->can_id & CAN_RTR_FLAG))))
return -EINVAL;
+ /* check timeval limitations */
+ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+ return -EINVAL;
+
/* check the given can_id */
op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
if (op) {
--
2.20.1
I'm announcing the release of the 4.9.150 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/imx7d-nitrogen7.dts | 9
arch/arm/mach-imx/cpuidle-imx6sx.c | 2
arch/mips/kernel/vdso.c | 4
arch/mips/math-emu/dsemul.c | 38 +-
arch/powerpc/boot/crt0.S | 4
arch/powerpc/kernel/signal_32.c | 20 +
arch/powerpc/kernel/signal_64.c | 44 ++-
arch/x86/crypto/chacha20_glue.c | 1
drivers/gpu/drm/vc4/vc4_plane.c | 1
drivers/hwtracing/intel_th/msu.c | 3
drivers/infiniband/hw/hfi1/verbs.c | 2
drivers/infiniband/sw/rxe/rxe_resp.c | 13 -
drivers/input/keyboard/omap4-keypad.c | 16 -
drivers/iommu/intel-iommu.c | 4
drivers/misc/genwqe/card_utils.c | 2
drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 54 +++-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3
drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 -
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 246 +++++++++----------
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 13 -
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 43 +++
drivers/net/ethernet/neterion/vxge/vxge-config.c | 2
drivers/net/ethernet/nuvoton/w90p910_ether.c | 2
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | 3
drivers/net/usb/lan78xx.c | 4
drivers/net/wireless/broadcom/b43/phy_common.c | 2
drivers/pinctrl/meson/pinctrl-meson.c | 3
drivers/power/supply/olpc_battery.c | 4
drivers/s390/scsi/zfcp_aux.c | 6
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2
drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5
drivers/target/iscsi/cxgbit/cxgbit_main.c | 1
drivers/tty/serial/sunsu.c | 31 ++
drivers/vhost/vsock.c | 2
fs/ceph/caps.c | 1
fs/dlm/lock.c | 17 -
fs/dlm/lockspace.c | 2
fs/gfs2/inode.c | 18 -
fs/gfs2/rgrp.c | 2
include/uapi/linux/input-event-codes.h | 9
kernel/fork.c | 13 -
kernel/memremap.c | 11
mm/memory_hotplug.c | 16 +
net/9p/client.c | 21 +
net/ceph/auth_x.c | 2
net/netfilter/ipset/ip_set_list_set.c | 2
net/netfilter/nf_conntrack_seqadj.c | 7
net/sunrpc/auth_gss/svcauth_gss.c | 8
net/sunrpc/cache.c | 10
net/sunrpc/xprtsock.c | 4
net/xfrm/xfrm_state.c | 2
scripts/checkstack.pl | 4
sound/pci/cs46xx/dsp_spos.c | 3
sound/usb/mixer.c | 10
sound/usb/quirks-table.h | 3
tools/testing/nvdimm/test/iomap.c | 2
61 files changed, 522 insertions(+), 273 deletions(-)
Alexander Shishkin (1):
intel_th: msu: Fix an off-by-one in attribute store
Andreas Gruenbacher (2):
gfs2: Get rid of potential double-freeing in gfs2_create_inode
gfs2: Fix loop in gfs2_rbm_find
Anson Huang (1):
ARM: imx: update the cpu power up timing setting on i.mx6sx
Arnd Bergmann (1):
w90p910_ether: remove incorrect __init annotation
Benjamin Poirier (1):
xfrm: Fix bucket count reported to userspace
Boris Brezillon (1):
drm/vc4: Set ->is_yuv to false when num_planes == 1
Breno Leitao (1):
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Christian Borntraeger (1):
genwqe: Fix size check
Colin Ian King (1):
vxge: ensure data0 is initialized in when fetching firmware version information
Dan Carpenter (2):
scsi: bnx2fc: Fix NULL dereference in error handling
ALSA: cs46xx: Potential NULL dereference in probe
Dan Williams (2):
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
mm, devm_memremap_pages: kill mapping "System RAM" support
David Herrmann (1):
fork: record start_time late
Dominique Martinet (1):
9p/net: put a lower bound on msize
Eric Biggers (1):
crypto: x86/chacha20 - avoid sleeping with preemption disabled
Fabio Estevam (1):
ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
Florian Westphal (1):
netfilter: seqadj: re-load tcp header pointer after possible head reallocation
Greg Kroah-Hartman (1):
Linux 4.9.150
Hui Peng (1):
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Ilya Dryomov (1):
libceph: fix CEPH_FEATURE_CEPHX_V2 check in calc_signature()
Ivan Mironov (1):
bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw
Jason Martinsen (1):
lan78xx: Resolve issue with changing MAC address
Jerome Brunet (1):
pinctrl: meson: fix pull enable register calculation
Kangjie Lu (1):
net: netxen: fix a missing check and an uninitialized use
Larry Finger (1):
b43: Fix error in cordic routine
Lubomir Rintel (1):
power: supply: olpc_battery: correct the temperature units
Michael J. Ruhl (1):
IB/hfi1: Incorrect sizing of sge for PIO will OOPs
Michal Hocko (1):
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
Nathan Chancellor (1):
drivers: net: xgene: Remove unnecessary forward declarations
Pan Bian (1):
netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
Paul Burton (1):
MIPS: math-emu: Write-protect delay slot emulation pages
Paul Mackerras (1):
powerpc: Fix COFF zImage booting on old powermacs
Peter Hutterer (1):
Input: restore EV_ABS ABS_RESERVED
Qian Cai (1):
checkstack.pl: fix for aarch64
Sagi Grimberg (1):
rxe: fix error completion wr_id and qp_num
Sohil Mehta (1):
iommu/vt-d: Handle domain agaw being less than iommu agaw
Stefan Hajnoczi (1):
vhost/vsock: fix uninitialized vhost_vsock->guest_cid
Steffen Maier (1):
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Sudarsana Reddy Kalluru (3):
bnx2x: Clear fip MAC when fcoe offload support is disabled
bnx2x: Remove configured vlans as part of unload sequence.
bnx2x: Send update-svid ramrod with retry/poll flags enabled
Takashi Iwai (1):
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Tony Lindgren (1):
Input: omap-keypad - fix idle configuration to not block SoC idle states
Trond Myklebust (1):
SUNRPC: Fix a race with XPRT_CONNECTING
Varun Prakash (2):
scsi: target: iscsi: cxgbit: fix csk leak
scsi: target: iscsi: cxgbit: add missing spin_lock_init()
Vasily Averin (6):
sunrpc: fix cache_head leak due to queued request
sunrpc: use SVC_NET() in svcauth_gss_* functions
dlm: fixed memory leaks after failed ls_remove_names allocation
dlm: possible memory leak on error path in create_lkb()
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
dlm: memory leaks on error path in dlm_user_request()
Yan, Zheng (1):
ceph: don't update importing cap's mseq when handing cap export
Yangtao Li (1):
serial/sunsu: fix refcount leak
Yonglong Liu (9):
net: hns: Incorrect offset address used for some registers.
net: hns: All ports can not work when insmod hns ko after rmmod.
net: hns: Some registers use wrong address according to the datasheet.
net: hns: Fixed bug that netdev was opened twice
net: hns: Clean rx fbd when ae stopped.
net: hns: Free irq when exit from abnormal branch
net: hns: Avoid net reset caused by pause frames storm
net: hns: Fix ntuple-filters status error.
net: hns: Add mac pcs config when enable|disable mac
I'm announcing the release of the 3.18.132 kernel.
All users of the 3.18 kernel series must upgrade.
The updated 3.18.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-3.18.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 +-
arch/mips/include/asm/pgtable-64.h | 5 +
arch/x86/include/asm/kvm_host.h | 2
arch/x86/kernel/cpu/mtrr/if.c | 2
drivers/gpio/gpio-max7301.c | 12 ---
drivers/hv/vmbus_drv.c | 20 ++++++
drivers/isdn/capi/kcapi.c | 4 -
drivers/media/platform/vivid/vivid-vid-cap.c | 2
drivers/misc/genwqe/card_utils.c | 2
drivers/mmc/core/mmc.c | 4 -
drivers/mmc/host/omap_hsmmc.c | 12 +++
drivers/net/ethernet/ibm/ibmveth.c | 6 +
drivers/net/usb/hso.c | 18 +++++
drivers/net/wireless/b43/phy_common.c | 2
drivers/net/xen-netfront.c | 2
drivers/power/olpc_battery.c | 4 -
drivers/s390/scsi/zfcp_aux.c | 6 -
drivers/usb/class/cdc-acm.c | 10 +++
drivers/usb/class/cdc-acm.h | 1
drivers/usb/host/r8a66597-hcd.c | 5 +
drivers/usb/serial/option.c | 7 +-
drivers/usb/serial/pl2303.c | 5 +
drivers/usb/serial/pl2303.h | 5 +
drivers/vhost/vhost.c | 2
fs/ceph/caps.c | 1
fs/cifs/smb2maperror.c | 4 -
fs/dlm/lock.c | 17 +++--
fs/dlm/lockspace.c | 2
fs/ext4/inline.c | 5 +
fs/ext4/super.c | 13 +++-
fs/gfs2/rgrp.c | 2
include/net/sock.h | 36 ++++++++++-
include/trace/events/ext4.h | 20 ++++++
kernel/fork.c | 13 +++-
net/9p/client.c | 21 ++++++
net/ax25/af_ax25.c | 11 ++-
net/ax25/ax25_dev.c | 2
net/compat.c | 15 ++--
net/core/sock.c | 3
net/ipv6/ip6_udp_tunnel.c | 3
net/netrom/af_netrom.c | 15 +++-
net/packet/af_packet.c | 8 +-
net/sctp/ipv6.c | 1
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 9 ++
net/sunrpc/svcsock.c | 2
net/vmw_vsock/vmci_transport.c | 67 +++++++++++++++------
sound/pci/cs46xx/dsp_spos.c | 3
sound/usb/mixer.c | 10 ++-
sound/usb/quirks-table.h | 3
51 files changed, 351 insertions(+), 90 deletions(-)
Andreas Gruenbacher (1):
gfs2: Fix loop in gfs2_rbm_find
Christian Borntraeger (1):
genwqe: Fix size check
Christophe Leroy (1):
gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
Colin Ian King (1):
x86/mtrr: Don't copy uninitialized gentry fields back to userspace
Cong Wang (3):
ax25: fix a use-after-free in ax25_fillin_cb()
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
netrom: fix locking in nr_find_socket()
Dan Carpenter (1):
ALSA: cs46xx: Potential NULL dereference in probe
David Herrmann (1):
fork: record start_time late
Deepa Dinamani (1):
sock: Make sock->sk_stamp thread-safe
Dexuan Cui (1):
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
Dominique Martinet (1):
9p/net: put a lower bound on msize
Eric Dumazet (1):
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Georgy A Bystrenin (1):
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Greg Kroah-Hartman (1):
Linux 3.18.132
Hans Verkuil (1):
media: vivid: free bitmap_cap when updating std/timings/etc.
Huacai Chen (2):
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
MIPS: Align kernel load address to 64KB
Hui Peng (2):
USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Jason Wang (1):
vhost: make sure used idx is seen before log in vhost_add_used_n()
Jia-Ju Bai (1):
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jorgen Hansen (1):
VSOCK: Send reset control packet when socket is partially bound
Juergen Gross (1):
xen/netfront: tolerate frags with no data
Larry Finger (1):
b43: Fix error in cordic routine
Lubomir Rintel (1):
power: supply: olpc_battery: correct the temperature units
Macpaul Lin (1):
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Maurizio Lombardi (1):
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian (1):
ext4: fix possible use after free in ext4_quota_enable
Russell King (1):
mmc: omap_hsmmc: fix DMA API warning
Scott Chen (1):
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sean Christopherson (1):
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Steffen Maier (1):
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Takashi Iwai (1):
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Theodore Ts'o (1):
ext4: force inode writes when nfsd calls commit_metadata()
Tore Anderson (1):
USB: serial: option: add HP lt4132
Tyrel Datwyler (1):
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Ulf Hansson (1):
mmc: core: Reset HPI enabled state during re-init and in case of errors
Vasily Averin (6):
sunrpc: fix cache_head leak due to queued request
sunrpc: use SVC_NET() in svcauth_gss_* functions
dlm: fixed memory leaks after failed ls_remove_names allocation
dlm: possible memory leak on error path in create_lkb()
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
dlm: memory leaks on error path in dlm_user_request()
Willem de Bruijn (2):
packet: validate address length
packet: validate address length if non-zero
Xin Long (1):
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Yan, Zheng (1):
ceph: don't update importing cap's mseq when handing cap export
This is the start of the stable review cycle for the 3.18.132 release.
There are 47 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:09:31 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.132-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 3.18.132-rc1
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Georgy A Bystrenin <gkot(a)altlinux.org>
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Huacai Chen <chenhc(a)lemote.com>
MIPS: Align kernel load address to 64KB
Huacai Chen <chenhc(a)lemote.com>
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: free bitmap_cap when updating std/timings/etc.
Macpaul Lin <macpaul.lin(a)mediatek.com>
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Theodore Ts'o <tytso(a)mit.edu>
ext4: force inode writes when nfsd calls commit_metadata()
Maurizio Lombardi <mlombard(a)redhat.com>
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian <bianpan2016(a)163.com>
ext4: fix possible use after free in ext4_quota_enable
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Deepa Dinamani <deepa.kernel(a)gmail.com>
sock: Make sock->sk_stamp thread-safe
Juergen Gross <jgross(a)suse.com>
xen/netfront: tolerate frags with no data
Jorgen Hansen <jhansen(a)vmware.com>
VSOCK: Send reset control packet when socket is partially bound
Jason Wang <jasowang(a)redhat.com>
vhost: make sure used idx is seen before log in vhost_add_used_n()
Xin Long <lucien.xin(a)gmail.com>
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Willem de Bruijn <willemb(a)google.com>
packet: validate address length if non-zero
Willem de Bruijn <willemb(a)google.com>
packet: validate address length
Cong Wang <xiyou.wangcong(a)gmail.com>
netrom: fix locking in nr_find_socket()
Eric Dumazet <edumazet(a)google.com>
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Cong Wang <xiyou.wangcong(a)gmail.com>
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Cong Wang <xiyou.wangcong(a)gmail.com>
ax25: fix a use-after-free in ax25_fillin_cb()
Colin Ian King <colin.king(a)canonical.com>
x86/mtrr: Don't copy uninitialized gentry fields back to userspace
Dexuan Cui <decui(a)microsoft.com>
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
Christophe Leroy <christophe.leroy(a)c-s.fr>
gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
Russell King <rmk+kernel(a)armlinux.org.uk>
mmc: omap_hsmmc: fix DMA API warning
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: core: Reset HPI enabled state during re-init and in case of errors
Tore Anderson <tore(a)fud.no>
USB: serial: option: add HP lt4132
Hui Peng <benquike(a)gmail.com>
USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
-------------
Diffstat:
Makefile | 4 +-
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++-
arch/mips/include/asm/pgtable-64.h | 5 ++
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kernel/cpu/mtrr/if.c | 2 +
drivers/gpio/gpio-max7301.c | 12 +---
drivers/hv/vmbus_drv.c | 20 +++++++
drivers/isdn/capi/kcapi.c | 4 +-
drivers/media/platform/vivid/vivid-vid-cap.c | 2 +
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/mmc/core/mmc.c | 4 +-
drivers/mmc/host/omap_hsmmc.c | 12 +++-
drivers/net/ethernet/ibm/ibmveth.c | 6 +-
drivers/net/usb/hso.c | 18 +++++-
drivers/net/wireless/b43/phy_common.c | 2 +-
drivers/net/xen-netfront.c | 2 +-
drivers/power/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/usb/class/cdc-acm.c | 10 ++++
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/host/r8a66597-hcd.c | 5 +-
drivers/usb/serial/option.c | 7 ++-
drivers/usb/serial/pl2303.c | 5 ++
drivers/usb/serial/pl2303.h | 5 ++
drivers/vhost/vhost.c | 2 +
fs/ceph/caps.c | 1 -
fs/cifs/smb2maperror.c | 4 +-
fs/dlm/lock.c | 17 +++---
fs/dlm/lockspace.c | 2 +-
fs/ext4/inline.c | 5 +-
fs/ext4/super.c | 13 ++++-
fs/gfs2/rgrp.c | 2 +-
include/net/sock.h | 36 +++++++++++-
include/trace/events/ext4.h | 20 +++++++
kernel/fork.c | 13 ++++-
net/9p/client.c | 21 +++++++
net/ax25/af_ax25.c | 11 +++-
net/ax25/ax25_dev.c | 2 +
net/compat.c | 15 +++--
net/core/sock.c | 3 +
net/ipv6/ip6_udp_tunnel.c | 3 +-
net/netrom/af_netrom.c | 15 +++--
net/packet/af_packet.c | 8 ++-
net/sctp/ipv6.c | 1 +
net/sunrpc/auth_gss/svcauth_gss.c | 8 +--
net/sunrpc/cache.c | 9 ++-
net/sunrpc/svcsock.c | 2 +-
net/vmw_vsock/vmci_transport.c | 67 ++++++++++++++++------
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/usb/mixer.c | 10 +++-
sound/usb/quirks-table.h | 3 +
51 files changed, 352 insertions(+), 91 deletions(-)
This is the start of the stable review cycle for the 4.14.93 release.
There are 105 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:10:07 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.93-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.93-rc1
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Set ->is_yuv to false when num_planes == 1
Christophe Leroy <christophe.leroy(a)c-s.fr>
lib: fix build failure in CONFIG_DEBUG_VIRTUAL test
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: msu: Fix an off-by-one in attribute store
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Linus Torvalds <torvalds(a)linux-foundation.org>
sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c
Sohil Mehta <sohil.mehta(a)intel.com>
iommu/vt-d: Handle domain agaw being less than iommu agaw
Sagi Grimberg <sagi(a)grimberg.me>
rxe: fix error completion wr_id and qp_num
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: relocatable: fix inconsistencies in linker script and options
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: drop linker script hack to hide __efistub_ symbols
Benjamin Coddington <bcodding(a)redhat.com>
lockd: Show pid of lockd for remote locks
Ondrej Mosnacek <omosnace(a)redhat.com>
selinux: policydb - fix byte order and alignment issues
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Get rid of potential double-freeing in gfs2_create_inode
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Damien Le Moal <damien.lemoal(a)wdc.com>
dm zoned: Fix target BIO completion handling
Mikulas Patocka <mpatocka(a)redhat.com>
dm verity: fix crash on bufio buffer that was allocated with vmalloc
Stefan Hajnoczi <stefanha(a)redhat.com>
vhost/vsock: fix uninitialized vhost_vsock->guest_cid
Joel Stanley <joel(a)jms.id.au>
raid6/ppc: Fix build for clang
Joel Stanley <joel(a)jms.id.au>
powerpc/boot: Set target when cross-compiling for clang
Joel Stanley <joel(a)jms.id.au>
Makefile: Export clang toolchain variables
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: consolidate Clang compiler flags
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: add -no-integrated-as Clang option unconditionally
Matthias Kaehlcke <mka(a)chromium.org>
md: raid10: remove VLAIS
Joel Stanley <joel(a)jms.id.au>
ftrace: Build with CPPFLAGS to get -Qunused-arguments
Joel Stanley <joel(a)jms.id.au>
powerpc: Disable -Wbuiltin-requires-header when setjmp is used
Nicholas Piggin <npiggin(a)gmail.com>
powerpc: avoid -mno-sched-epilog on GCC 4.9 and newer
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
Huang Ying <ying.huang(a)intel.com>
mm, swap: fix swapoff with KSM pages
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL
Dan Williams <dan.j.williams(a)intel.com>
mm, hmm: use devm semantics for hmm_devmem_{add, remove}
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: kill mapping "System RAM" support
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
Michal Hocko <mhocko(a)suse.com>
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
Minchan Kim <minchan(a)kernel.org>
zram: fix double free backing device
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Martin Kelly <martin(a)martingkelly.com>
tools: fix cross-compile var clobbering
Thomas Gleixner <tglx(a)linutronix.de>
genirq/affinity: Don't return with empty affinity masks on error
Ewan D. Milne <emilne(a)redhat.com>
scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Yangtao Li <tiny.windzz(a)gmail.com>
serial/sunsu: fix refcount leak
Daniele Palmas <dnlplm(a)gmail.com>
qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
Kangjie Lu <kjlu(a)umn.edu>
net: netxen: fix a missing check and an uninitialized use
Mantas Mikulėnas <grawity(a)gmail.com>
Input: synaptics - enable SMBus for HP EliteBook 840 G4
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
gpio: mvebu: only fail on missing clk if pwm is actually to be used
Michael S. Tsirkin <mst(a)redhat.com>
virtio: fix test build after uio.h change
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: fix false positive warning/error about missing libelf
Sara Sharon <sara.sharon(a)intel.com>
mac80211: free skb fraglist before freeing the skb
Colin Ian King <colin.king(a)canonical.com>
vxge: ensure data0 is initialized in when fetching firmware version information
Jason Martinsen <jasonmartinsen(a)msn.com>
lan78xx: Resolve issue with changing MAC address
Anssi Hannula <anssi.hannula(a)bitwise.fi>
net: macb: fix dropped RX frames due to a race
Anssi Hannula <anssi.hannula(a)bitwise.fi>
net: macb: fix random memory corruption on RX with 64-bit DMA
Dan Carpenter <dan.carpenter(a)oracle.com>
qed: Fix an error code qed_ll2_start_xmit()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a race with XPRT_CONNECTING
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fix ping failed when use net bridge and send multicast
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Add mac pcs config when enable|disable mac
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fix ntuple-filters status error.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Avoid net reset caused by pause frames storm
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Free irq when exit from abnormal branch
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Clean rx fbd when ae stopped.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fixed bug that netdev was opened twice
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Some registers use wrong address according to the datasheet.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: All ports can not work when insmod hns ko after rmmod.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Incorrect offset address used for some registers.
Arnd Bergmann <arnd(a)arndb.de>
w90p910_ether: remove incorrect __init annotation
Nathan Chancellor <natechancellor(a)gmail.com>
drivers: net: xgene: Remove unnecessary forward declarations
Sinan Kaya <okaya(a)kernel.org>
x86, hyperv: remove PCI dependency
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: add missing spin_lock_init()
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: fix csk leak
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Send update-svid ramrod with retry/poll flags enabled
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Remove configured vlans as part of unload sequence.
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Clear fip MAC when fcoe offload support is disabled
Florian Westphal <fw(a)strlen.de>
netfilter: nat: can't use dst_hold on noref dst
Pan Bian <bianpan2016(a)163.com>
netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
Stefan Assmann <sassmann(a)kpanic.de>
i40e: fix mac filter delete when setting mac address
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
x86/dump_pagetables: Fix LDT remap address marker
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
x86/mm: Fix guard hole handling
YueHaibing <yuehaibing(a)huawei.com>
ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
Thomas Falcon <tlfalcon(a)linux.ibm.com>
ibmvnic: Fix non-atomic memory allocation in IRQ context
Yussuf Khalil <dev(a)pp3345.net>
Input: synaptics - enable RMI on ThinkPad T560
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix idle configuration to not block SoC idle states
Dan Carpenter <dan.carpenter(a)oracle.com>
scsi: bnx2fc: Fix NULL dereference in error handling
Florian Westphal <fw(a)strlen.de>
netfilter: seqadj: re-load tcp header pointer after possible head reallocation
Steffen Klassert <steffen.klassert(a)secunet.com>
xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.
Benjamin Poirier <bpoirier(a)suse.com>
xfrm: Fix bucket count reported to userspace
Wei Yongjun <weiyongjun1(a)huawei.com>
xfrm: Fix error return code in xfrm_output_one()
Qian Cai <cai(a)lca.pw>
checkstack.pl: fix for aarch64
Peter Hutterer <peter.hutterer(a)who-t.net>
Input: restore EV_ABS ABS_RESERVED
Fabio Estevam <festevam(a)gmail.com>
ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
Anson Huang <anson.huang(a)nxp.com>
ARM: imx: update the cpu power up timing setting on i.mx6sx
Hans de Goede <hdegoede(a)redhat.com>
HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/mm: Fix linux page tables build with some configs
Paul Mackerras <paulus(a)ozlabs.org>
powerpc: Fix COFF zImage booting on old powermacs
Jerome Brunet <jbrunet(a)baylibre.com>
pinctrl: meson: fix pull enable register calculation
-------------
Diffstat:
Makefile | 31 +-
arch/arm/boot/dts/imx7d-nitrogen7.dts | 9 +-
arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
arch/arm64/Makefile | 2 +-
arch/arm64/kernel/image.h | 44 +-
arch/arm64/kernel/vmlinux.lds.S | 9 +-
arch/powerpc/Makefile | 7 +-
arch/powerpc/boot/Makefile | 5 +
arch/powerpc/boot/crt0.S | 4 +-
arch/powerpc/kernel/Makefile | 3 +
arch/powerpc/kernel/signal_32.c | 20 +-
arch/powerpc/kernel/signal_64.c | 44 +-
arch/powerpc/mm/dump_linuxpagetables.c | 1 +
arch/powerpc/xmon/Makefile | 5 +-
arch/x86/include/asm/pgtable_64_types.h | 5 +
arch/x86/mm/dump_pagetables.c | 15 +-
arch/x86/xen/mmu_pv.c | 11 +-
drivers/block/zram/zram_drv.c | 4 +-
drivers/gpio/gpio-mvebu.c | 6 +-
drivers/gpu/drm/vc4/vc4_plane.c | 1 +
drivers/hid/hid-ids.h | 3 +
drivers/hid/hid-ite.c | 1 +
drivers/hv/Kconfig | 2 +-
drivers/hwtracing/intel_th/msu.c | 3 +-
drivers/infiniband/sw/rxe/rxe_resp.c | 13 +-
drivers/input/keyboard/omap4-keypad.c | 16 +-
drivers/input/mouse/synaptics.c | 2 +
drivers/iommu/intel-iommu.c | 4 +-
drivers/md/dm-verity-target.c | 24 +-
drivers/md/dm-zoned-target.c | 122 ++---
drivers/md/raid10.c | 15 +-
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3 -
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 48 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4 +-
drivers/net/ethernet/cadence/macb_main.c | 14 +-
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 +-
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 503 ++++++++++++++-------
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 13 +-
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 43 +-
drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 14 +-
drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +-
drivers/net/ethernet/nuvoton/w90p910_ether.c | 2 +-
.../net/ethernet/qlogic/netxen/netxen_nic_init.c | 3 +-
drivers/net/ethernet/qlogic/qed/qed_ll2.c | 1 +
drivers/net/ieee802154/ca8210.c | 4 +-
drivers/net/usb/lan78xx.c | 4 +
drivers/net/usb/qmi_wwan.c | 15 +-
drivers/net/wireless/broadcom/b43/phy_common.c | 2 +-
drivers/pinctrl/meson/pinctrl-meson.c | 3 +-
drivers/power/supply/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
drivers/scsi/lpfc/lpfc_sli.c | 3 +-
drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 +-
drivers/target/iscsi/cxgbit/cxgbit_main.c | 1 +
drivers/tty/serial/sunsu.c | 31 +-
drivers/vhost/vsock.c | 2 +
fs/ceph/caps.c | 1 -
fs/dlm/lock.c | 17 +-
fs/dlm/lockspace.c | 2 +-
fs/gfs2/inode.c | 18 +-
fs/gfs2/rgrp.c | 2 +-
fs/lockd/clntproc.c | 2 +-
fs/lockd/xdr.c | 4 +-
fs/lockd/xdr4.c | 4 +-
include/linux/hmm.h | 4 +-
include/uapi/linux/input-event-codes.h | 9 +
kernel/fork.c | 13 +-
kernel/irq/affinity.c | 15 +-
kernel/memremap.c | 11 +-
kernel/sched/fair.c | 43 +-
lib/raid6/Makefile | 15 +
lib/test_debug_virtual.c | 1 +
mm/hmm.c | 131 ++----
mm/memory_hotplug.c | 16 +
mm/swapfile.c | 3 +-
net/9p/client.c | 21 +
net/mac80211/status.c | 5 +
net/netfilter/ipset/ip_set_list_set.c | 2 +-
net/netfilter/nf_conntrack_seqadj.c | 7 +-
net/netfilter/nf_nat_core.c | 3 +-
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 10 +-
net/sunrpc/xprtsock.c | 4 +-
net/xfrm/xfrm_input.c | 7 +-
net/xfrm/xfrm_output.c | 1 +
net/xfrm/xfrm_state.c | 2 +-
scripts/Makefile.build | 2 +-
scripts/checkstack.pl | 4 +-
security/selinux/ss/policydb.c | 51 ++-
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/usb/mixer.c | 10 +-
sound/usb/quirks-table.h | 3 +
tools/cgroup/Makefile | 1 -
tools/gpio/Makefile | 2 -
tools/hv/Makefile | 1 -
tools/iio/Makefile | 2 -
tools/laptop/freefall/Makefile | 1 -
tools/leds/Makefile | 1 -
tools/perf/Makefile.perf | 6 -
tools/power/acpi/Makefile.config | 3 -
tools/scripts/Makefile.include | 18 +
tools/spi/Makefile | 2 -
tools/testing/nvdimm/test/iomap.c | 2 +-
tools/usb/Makefile | 1 -
tools/virtio/linux/kernel.h | 4 +
tools/vm/Makefile | 1 -
112 files changed, 1035 insertions(+), 666 deletions(-)
When building using GCC 4.7 or older, -ffunction-sections & the -pg flag
used by ftrace are incompatible. This causes warnings or build failures
(where -Werror applies) such as the following:
arch/mips/generic/init.c:
error: -ffunction-sections disabled; it makes profiling impossible
This used to be taken into account by the ordering of calls to cc-option
from within the top-level Makefile, which was introduced by commit
90ad4052e85c ("kbuild: avoid conflict between -ffunction-sections and
-pg on gcc-4.7"). Unfortunately this was broken when the
CONFIG_LD_DEAD_CODE_DATA_ELIMINATION cc-option check was moved to
Kconfig in commit e85d1d65cd8a ("kbuild: test dead code/data elimination
support in Kconfig"), because the flags used by this check no longer
include -pg.
Fix this by not allowing CONFIG_LD_DEAD_CODE_DATA_ELIMINATION to be
enabled at the same time as ftrace/CONFIG_FUNCTION_TRACER when building
using GCC 4.7 or older.
Signed-off-by: Paul Burton <paul.burton(a)mips.com>
Fixes: e85d1d65cd8a ("kbuild: test dead code/data elimination support in Kconfig")
Reported-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: Masahiro Yamada <yamada.masahiro(a)socionext.com>
Cc: Nicholas Piggin <npiggin(a)gmail.com>
Cc: stable(a)vger.kernel.org # v4.19+
---
init/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/init/Kconfig b/init/Kconfig
index d47cb77a220e..c787f782148d 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1124,6 +1124,7 @@ config LD_DEAD_CODE_DATA_ELIMINATION
bool "Dead code and data elimination (EXPERIMENTAL)"
depends on HAVE_LD_DEAD_CODE_DATA_ELIMINATION
depends on EXPERT
+ depends on !FUNCTION_TRACER || !CC_IS_GCC || GCC_VERSION >= 40800
depends on $(cc-option,-ffunction-sections -fdata-sections)
depends on $(ld-option,--gc-sections)
help
--
2.20.1
This is the start of the stable review cycle for the 4.9.150 release.
There are 63 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:10:03 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.150-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.150-rc1
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Set ->is_yuv to false when num_planes == 1
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: msu: Fix an off-by-one in attribute store
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Sohil Mehta <sohil.mehta(a)intel.com>
iommu/vt-d: Handle domain agaw being less than iommu agaw
Sagi Grimberg <sagi(a)grimberg.me>
rxe: fix error completion wr_id and qp_num
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Get rid of potential double-freeing in gfs2_create_inode
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Michael J. Ruhl <michael.j.ruhl(a)intel.com>
IB/hfi1: Incorrect sizing of sge for PIO will OOPs
Stefan Hajnoczi <stefanha(a)redhat.com>
vhost/vsock: fix uninitialized vhost_vsock->guest_cid
Eric Biggers <ebiggers(a)google.com>
crypto: x86/chacha20 - avoid sleeping with preemption disabled
Paul Burton <paul.burton(a)mips.com>
MIPS: math-emu: Write-protect delay slot emulation pages
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: kill mapping "System RAM" support
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
Michal Hocko <mhocko(a)suse.com>
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Ilya Dryomov <idryomov(a)gmail.com>
libceph: fix CEPH_FEATURE_CEPHX_V2 check in calc_signature()
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Yangtao Li <tiny.windzz(a)gmail.com>
serial/sunsu: fix refcount leak
Kangjie Lu <kjlu(a)umn.edu>
net: netxen: fix a missing check and an uninitialized use
Colin Ian King <colin.king(a)canonical.com>
vxge: ensure data0 is initialized in when fetching firmware version information
Jason Martinsen <jasonmartinsen(a)msn.com>
lan78xx: Resolve issue with changing MAC address
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a race with XPRT_CONNECTING
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Add mac pcs config when enable|disable mac
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fix ntuple-filters status error.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Avoid net reset caused by pause frames storm
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Free irq when exit from abnormal branch
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Clean rx fbd when ae stopped.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Fixed bug that netdev was opened twice
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Some registers use wrong address according to the datasheet.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: All ports can not work when insmod hns ko after rmmod.
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns: Incorrect offset address used for some registers.
Arnd Bergmann <arnd(a)arndb.de>
w90p910_ether: remove incorrect __init annotation
Nathan Chancellor <natechancellor(a)gmail.com>
drivers: net: xgene: Remove unnecessary forward declarations
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: add missing spin_lock_init()
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: fix csk leak
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Send update-svid ramrod with retry/poll flags enabled
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Remove configured vlans as part of unload sequence.
Sudarsana Reddy Kalluru <sudarsana.kalluru(a)cavium.com>
bnx2x: Clear fip MAC when fcoe offload support is disabled
Pan Bian <bianpan2016(a)163.com>
netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix idle configuration to not block SoC idle states
Dan Carpenter <dan.carpenter(a)oracle.com>
scsi: bnx2fc: Fix NULL dereference in error handling
Florian Westphal <fw(a)strlen.de>
netfilter: seqadj: re-load tcp header pointer after possible head reallocation
Benjamin Poirier <bpoirier(a)suse.com>
xfrm: Fix bucket count reported to userspace
Qian Cai <cai(a)lca.pw>
checkstack.pl: fix for aarch64
Peter Hutterer <peter.hutterer(a)who-t.net>
Input: restore EV_ABS ABS_RESERVED
Fabio Estevam <festevam(a)gmail.com>
ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
Anson Huang <anson.huang(a)nxp.com>
ARM: imx: update the cpu power up timing setting on i.mx6sx
Paul Mackerras <paulus(a)ozlabs.org>
powerpc: Fix COFF zImage booting on old powermacs
Jerome Brunet <jbrunet(a)baylibre.com>
pinctrl: meson: fix pull enable register calculation
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/imx7d-nitrogen7.dts | 9 +-
arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
arch/mips/kernel/vdso.c | 4 +-
arch/mips/math-emu/dsemul.c | 38 ++--
arch/powerpc/boot/crt0.S | 4 +-
arch/powerpc/kernel/signal_32.c | 20 +-
arch/powerpc/kernel/signal_64.c | 44 ++--
arch/x86/crypto/chacha20_glue.c | 1 +
drivers/gpu/drm/vc4/vc4_plane.c | 1 +
drivers/hwtracing/intel_th/msu.c | 3 +-
drivers/infiniband/hw/hfi1/verbs.c | 2 +
drivers/infiniband/sw/rxe/rxe_resp.c | 13 +-
drivers/input/keyboard/omap4-keypad.c | 16 +-
drivers/iommu/intel-iommu.c | 4 +-
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 3 -
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 48 +++-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 4 +-
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 3 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 14 +-
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 15 ++
drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 246 ++++++++++-----------
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 13 +-
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 43 +++-
drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +-
drivers/net/ethernet/nuvoton/w90p910_ether.c | 2 +-
.../net/ethernet/qlogic/netxen/netxen_nic_init.c | 3 +-
drivers/net/usb/lan78xx.c | 4 +
drivers/net/wireless/broadcom/b43/phy_common.c | 2 +-
drivers/pinctrl/meson/pinctrl-meson.c | 3 +-
drivers/power/supply/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 +-
drivers/target/iscsi/cxgbit/cxgbit_main.c | 1 +
drivers/tty/serial/sunsu.c | 31 ++-
drivers/vhost/vsock.c | 2 +
fs/ceph/caps.c | 1 -
fs/dlm/lock.c | 17 +-
fs/dlm/lockspace.c | 2 +-
fs/gfs2/inode.c | 18 +-
fs/gfs2/rgrp.c | 2 +-
include/uapi/linux/input-event-codes.h | 9 +
kernel/fork.c | 13 +-
kernel/memremap.c | 11 +-
mm/memory_hotplug.c | 16 ++
net/9p/client.c | 21 ++
net/ceph/auth_x.c | 2 +-
net/netfilter/ipset/ip_set_list_set.c | 2 +-
net/netfilter/nf_conntrack_seqadj.c | 7 +-
net/sunrpc/auth_gss/svcauth_gss.c | 8 +-
net/sunrpc/cache.c | 10 +-
net/sunrpc/xprtsock.c | 4 +-
net/xfrm/xfrm_state.c | 2 +-
scripts/checkstack.pl | 4 +-
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/usb/mixer.c | 10 +-
sound/usb/quirks-table.h | 3 +
tools/testing/nvdimm/test/iomap.c | 2 +-
61 files changed, 517 insertions(+), 274 deletions(-)
This is the start of the stable review cycle for the 4.4.170 release.
There are 88 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Jan 13 13:09:58 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.170-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.170-rc1
Lubomir Rintel <lkundrak(a)v3.sk>
power: supply: olpc_battery: correct the temperature units
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: msu: Fix an off-by-one in attribute store
Christian Borntraeger <borntraeger(a)de.ibm.com>
genwqe: Fix size check
Yan, Zheng <zyan(a)redhat.com>
ceph: don't update importing cap's mseq when handing cap export
Sohil Mehta <sohil.mehta(a)intel.com>
iommu/vt-d: Handle domain agaw being less than iommu agaw
Dominique Martinet <dominique.martinet(a)cea.fr>
9p/net: put a lower bound on msize
Larry Finger <Larry.Finger(a)lwfinger.net>
b43: Fix error in cordic routine
Andreas Gruenbacher <agruenba(a)redhat.com>
gfs2: Fix loop in gfs2_rbm_find
Vasily Averin <vvs(a)virtuozzo.com>
dlm: memory leaks on error path in dlm_user_request()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: possible memory leak on error path in create_lkb()
Vasily Averin <vvs(a)virtuozzo.com>
dlm: fixed memory leaks after failed ls_remove_names allocation
Hui Peng <benquike(a)163.com>
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: cs46xx: Potential NULL dereference in probe
Ming Lei <ming.lei(a)redhat.com>
block: don't deal with discard limit in blkdev_issue_discard()
Jens Axboe <axboe(a)kernel.dk>
block: break discard submissions into the user defined size
Eric Biggers <ebiggers(a)google.com>
crypto: x86/chacha20 - avoid sleeping with preemption disabled
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: use SVC_NET() in svcauth_gss_* functions
Vasily Averin <vvs(a)virtuozzo.com>
sunrpc: fix cache_head leak due to queued request
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: kill mapping "System RAM" support
Dan Williams <dan.j.williams(a)intel.com>
mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
Michal Hocko <mhocko(a)suse.com>
hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
David Herrmann <dh.herrmann(a)gmail.com>
fork: record start_time late
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix idle configuration to not block SoC idle states
Dan Carpenter <dan.carpenter(a)oracle.com>
scsi: bnx2fc: Fix NULL dereference in error handling
Benjamin Poirier <bpoirier(a)suse.com>
xfrm: Fix bucket count reported to userspace
Qian Cai <cai(a)lca.pw>
checkstack.pl: fix for aarch64
Peter Hutterer <peter.hutterer(a)who-t.net>
Input: restore EV_ABS ABS_RESERVED
Anson Huang <anson.huang(a)nxp.com>
ARM: imx: update the cpu power up timing setting on i.mx6sx
Paul Mackerras <paulus(a)ozlabs.org>
powerpc: Fix COFF zImage booting on old powermacs
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Unbreak the build of esoteric configs
Vitaly Kuznetsov <vkuznets(a)redhat.com>
x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
Georgy A Bystrenin <gkot(a)altlinux.org>
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Huacai Chen <chenhc(a)lemote.com>
MIPS: Align kernel load address to 64KB
Huacai Chen <chenhc(a)lemote.com>
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: free bitmap_cap when updating std/timings/etc.
Macpaul Lin <macpaul.lin(a)mediatek.com>
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix book-keeping of DMA termination
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix race on DMA termination
Theodore Ts'o <tytso(a)mit.edu>
ext4: force inode writes when nfsd calls commit_metadata()
ruippan (潘睿) <ruippan(a)tencent.com>
ext4: fix EXT4_IOC_GROUP_ADD ioctl
Maurizio Lombardi <mlombard(a)redhat.com>
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian <bianpan2016(a)163.com>
ext4: fix possible use after free in ext4_quota_enable
Ben Hutchings <ben(a)decadent.org.uk>
perf pmu: Suppress potential format-truncation warning
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Patrick Dreyer <Patrick(a)Dreyer.name>
Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Fibocom NL678 series
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sameer Pujar <spujar(a)nvidia.com>
ALSA: hda/tegra: clear pending irq handlers
Mantas Mikulėnas <grawity(a)gmail.com>
ALSA: hda: add mute LED support for HP EliteBook 840 G4
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emux: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: pcm: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: rme9652: Fix potential Spectre v1 vulnerability
Deepa Dinamani <deepa.kernel(a)gmail.com>
sock: Make sock->sk_stamp thread-safe
Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com>
gro_cell: add napi_disable in gro_cells_destroy
Juergen Gross <jgross(a)suse.com>
xen/netfront: tolerate frags with no data
Jorgen Hansen <jhansen(a)vmware.com>
VSOCK: Send reset control packet when socket is partially bound
Jason Wang <jasowang(a)redhat.com>
vhost: make sure used idx is seen before log in vhost_add_used_n()
Xin Long <lucien.xin(a)gmail.com>
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Willem de Bruijn <willemb(a)google.com>
packet: validate address length if non-zero
Willem de Bruijn <willemb(a)google.com>
packet: validate address length
Cong Wang <xiyou.wangcong(a)gmail.com>
netrom: fix locking in nr_find_socket()
Eric Dumazet <edumazet(a)google.com>
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Cong Wang <xiyou.wangcong(a)gmail.com>
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
Willem de Bruijn <willemb(a)google.com>
ieee802154: lowpan_header_create check must check daddr
Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Cong Wang <xiyou.wangcong(a)gmail.com>
ax25: fix a use-after-free in ax25_fillin_cb()
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ipv4: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ip6mr: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
drm/ioctl: Fix Spectre v1 vulnerabilities
Colin Ian King <colin.king(a)canonical.com>
x86/mtrr: Don't copy uninitialized gentry fields back to userspace
Dexuan Cui <decui(a)microsoft.com>
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
Christophe Leroy <christophe.leroy(a)c-s.fr>
gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
Russell King <rmk+kernel(a)armlinux.org.uk>
mmc: omap_hsmmc: fix DMA API warning
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: core: Reset HPI enabled state during re-init and in case of errors
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Telit LN940 series
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Fibocom NL668 series
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
Tore Anderson <tore(a)fud.no>
USB: serial: option: add HP lt4132
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add GosunCn ZTE WeLink ME3630
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only
Hui Peng <benquike(a)gmail.com>
USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-imx/cpuidle-imx6sx.c | 2 +-
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++-
arch/mips/include/asm/pgtable-64.h | 5 ++
arch/powerpc/boot/crt0.S | 4 +-
arch/x86/crypto/chacha20_glue.c | 1 +
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kernel/cpu/mtrr/if.c | 2 +
arch/x86/kvm/vmx.c | 19 +++++-
arch/x86/kvm/x86.c | 3 +-
block/blk-lib.c | 26 ++-------
drivers/gpio/gpio-max7301.c | 12 +---
drivers/gpu/drm/drm_ioctl.c | 10 +++-
drivers/hv/vmbus_drv.c | 20 +++++++
drivers/hwtracing/intel_th/msu.c | 3 +-
drivers/input/keyboard/omap4-keypad.c | 16 ++----
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/iommu/intel-iommu.c | 4 +-
drivers/isdn/capi/kcapi.c | 4 +-
drivers/media/platform/vivid/vivid-vid-cap.c | 2 +
drivers/misc/genwqe/card_utils.c | 2 +-
drivers/mmc/core/mmc.c | 4 +-
drivers/mmc/host/omap_hsmmc.c | 12 +++-
drivers/net/ethernet/ibm/ibmveth.c | 6 +-
drivers/net/usb/hso.c | 18 +++++-
drivers/net/wireless/b43/phy_common.c | 2 +-
drivers/net/xen-netfront.c | 2 +-
drivers/power/olpc_battery.c | 4 +-
drivers/s390/scsi/zfcp_aux.c | 6 +-
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 2 +-
drivers/spi/spi-bcm2835.c | 16 +++---
drivers/usb/class/cdc-acm.c | 10 ++++
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/host/r8a66597-hcd.c | 5 +-
drivers/usb/host/xhci-hub.c | 3 +-
drivers/usb/serial/option.c | 20 ++++++-
drivers/usb/serial/pl2303.c | 5 ++
drivers/usb/serial/pl2303.h | 5 ++
drivers/vhost/vhost.c | 2 +
fs/ceph/caps.c | 1 -
fs/cifs/smb2maperror.c | 4 +-
fs/dlm/lock.c | 17 +++---
fs/dlm/lockspace.c | 2 +-
fs/ext4/inline.c | 5 +-
fs/ext4/resize.c | 2 +-
fs/ext4/super.c | 13 ++++-
fs/gfs2/rgrp.c | 2 +-
include/net/gro_cells.h | 1 +
include/net/sock.h | 36 +++++++++++-
include/trace/events/ext4.h | 20 +++++++
include/uapi/linux/input-event-codes.h | 9 +++
kernel/fork.c | 13 ++++-
kernel/memremap.c | 11 ++--
mm/memory_hotplug.c | 16 ++++++
net/9p/client.c | 21 +++++++
net/ax25/af_ax25.c | 11 +++-
net/ax25/ax25_dev.c | 2 +
net/compat.c | 15 +++--
net/core/sock.c | 3 +
net/ieee802154/6lowpan/tx.c | 3 +
net/ipv4/ipmr.c | 2 +
net/ipv6/ip6_udp_tunnel.c | 3 +-
net/ipv6/ip6mr.c | 4 ++
net/netrom/af_netrom.c | 15 +++--
net/packet/af_packet.c | 8 ++-
net/sctp/ipv6.c | 1 +
net/sunrpc/auth_gss/svcauth_gss.c | 8 +--
net/sunrpc/cache.c | 10 +++-
net/sunrpc/svcsock.c | 2 +-
net/vmw_vsock/vmci_transport.c | 67 ++++++++++++++++------
net/xfrm/xfrm_state.c | 2 +-
scripts/checkstack.pl | 4 +-
sound/core/pcm.c | 2 +
sound/pci/cs46xx/dsp_spos.c | 3 +
sound/pci/emu10k1/emufx.c | 5 ++
sound/pci/hda/hda_tegra.c | 2 +
sound/pci/hda/patch_conexant.c | 1 +
sound/pci/rme9652/hdsp.c | 10 ++--
sound/synth/emux/emux_hwdep.c | 7 ++-
sound/usb/mixer.c | 10 +++-
sound/usb/quirks-table.h | 3 +
tools/perf/util/pmu.c | 8 +--
82 files changed, 489 insertions(+), 167 deletions(-)
Do you need to edit your photos?
Here are the editing service we mostly for the photos from our clients.
Photos cut out background , clipping path, and also retouching.
You may send some photos to us. we will let our editing staffs to work on
them.
Thanks,
Ruby
area->size can include adjacent guard page but get_vm_area_size()
returns actual size of the area.
This fixes possible kernel crash when userspace tries to map area
on 1 page bigger: size check passes but the following vmalloc_to_page()
returns NULL on last guard (non-existing) page.
Signed-off-by: Roman Penyaev <rpenyaev(a)suse.de>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Cc: Joe Perches <joe(a)perches.com>
Cc: "Luis R. Rodriguez" <mcgrof(a)kernel.org>
Cc: linux-mm(a)kvack.org
Cc: linux-kernel(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
---
mm/vmalloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 871e41c55e23..2cd24186ba84 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2248,7 +2248,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
if (!(area->flags & VM_USERMAP))
return -EINVAL;
- if (kaddr + size > area->addr + area->size)
+ if (kaddr + size > area->addr + get_vm_area_size(area))
return -EINVAL;
do {
--
2.19.1
While mapping DMA for scatter list when a scsi command is queued the
existing call to dma_alloc_coherent() in our map_sg_data() function
passes zero for the gfp_flags parameter. We are most definitly in atomic
context at this point as queue_command() is called in softirq context
and further we have a spinlock holding the scsi host lock.
Fix this by passing GFP_ATOMIC to dma_alloc_coherent() to prevent any
sort of sleeping in atomic context deadlock.
Fixes: 4dddbc26c389 ("[SCSI] ibmvscsi: handle large scatter/gather lists")
Cc: stable(a)vger.kernel.org
Signed-off-by: Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
---
drivers/scsi/ibmvscsi/ibmvscsi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 1135e74..cb8535e 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -731,7 +731,7 @@ static int map_sg_data(struct scsi_cmnd *cmd,
evt_struct->ext_list = (struct srp_direct_buf *)
dma_alloc_coherent(dev,
SG_ALL * sizeof(struct srp_direct_buf),
- &evt_struct->ext_list_token, 0);
+ &evt_struct->ext_list_token, GFP_ATOMIC);
if (!evt_struct->ext_list) {
if (!firmware_has_feature(FW_FEATURE_CMO))
sdev_printk(KERN_ERR, cmd->device,
--
1.8.3.1
From: Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
Nested interrupts run inside the calling thread's context and the top
half handler is never called which means that we never read the
timestamp.
This issue came up when trying to read line events from a gpiochip
using regmap_irq_chip for interrupts.
Fix it by reading the timestamp from the irq thread function if it's
still 0 by the time the second handler is called.
Fixes: d58f2bf261fd ("gpio: Timestamp events in hardirq handler")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
---
v1 -> v2:
- add Fixes: to the commit message and Cc stable
- directly assing ktime_get_real_ns() to ge.timestamp
drivers/gpio/gpiolib.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 1651d7f0a303..d1adfdf50fb3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -828,7 +828,14 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
/* Do not leak kernel stack to userspace */
memset(&ge, 0, sizeof(ge));
- ge.timestamp = le->timestamp;
+ /*
+ * We may be running from a nested threaded interrupt in which case
+ * we didn't get the timestamp from lineevent_irq_handler().
+ */
+ if (!le->timestamp)
+ ge.timestamp = ktime_get_real_ns();
+ else
+ ge.timestamp = le->timestamp;
if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
&& le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
--
2.19.1
This is a note to let you know that I've just added the patch titled
tty: Don't hold ldisc lock in tty_reopen() if ldisc present
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From d3736d82e8169768218ee0ef68718875918091a0 Mon Sep 17 00:00:00 2001
From: Dmitry Safonov <dima(a)arista.com>
Date: Wed, 9 Jan 2019 01:17:40 +0000
Subject: tty: Don't hold ldisc lock in tty_reopen() if ldisc present
Try to get reference for ldisc during tty_reopen().
If ldisc present, we don't need to do tty_ldisc_reinit() and lock the
write side for line discipline semaphore.
Effectively, it optimizes fast-path for tty_reopen(), but more
importantly it won't interrupt ongoing IO on the tty as no ldisc change
is needed.
Fixes user-visible issue when tty_reopen() interrupted login process for
user with a long password, observed and reported by Lukas.
Fixes: c96cf923a98d ("tty: Don't block on IO when ldisc change is pending")
Fixes: 83d817f41070 ("tty: Hold tty_ldisc_lock() during tty_reopen()")
Cc: Jiri Slaby <jslaby(a)suse.com>
Reported-by: Lukas F. Hartmann <lukas(a)mntmn.com>
Tested-by: Lukas F. Hartmann <lukas(a)mntmn.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Dmitry Safonov <dima(a)arista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/tty_io.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index bfe9ad85b362..23c6fd238422 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1256,7 +1256,8 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
static int tty_reopen(struct tty_struct *tty)
{
struct tty_driver *driver = tty->driver;
- int retval;
+ struct tty_ldisc *ld;
+ int retval = 0;
if (driver->type == TTY_DRIVER_TYPE_PTY &&
driver->subtype == PTY_TYPE_MASTER)
@@ -1268,13 +1269,18 @@ static int tty_reopen(struct tty_struct *tty)
if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
return -EBUSY;
- retval = tty_ldisc_lock(tty, 5 * HZ);
- if (retval)
- return retval;
+ ld = tty_ldisc_ref_wait(tty);
+ if (ld) {
+ tty_ldisc_deref(ld);
+ } else {
+ retval = tty_ldisc_lock(tty, 5 * HZ);
+ if (retval)
+ return retval;
- if (!tty->ldisc)
- retval = tty_ldisc_reinit(tty, tty->termios.c_line);
- tty_ldisc_unlock(tty);
+ if (!tty->ldisc)
+ retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+ tty_ldisc_unlock(tty);
+ }
if (retval == 0)
tty->count++;
--
2.20.1
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 283ac6d5fb2a47f12bcef7806b78acf6ad89907e Mon Sep 17 00:00:00 2001
From: Shuah Khan <shuah(a)kernel.org>
Date: Wed, 12 Dec 2018 20:25:14 -0700
Subject: [PATCH] selftests: Fix test errors related to lib.mk khdr target
Commit b2d35fa5fc80 ("selftests: add headers_install to lib.mk") added
khdr target to run headers_install target from the main Makefile. The
logic uses KSFT_KHDR_INSTALL and top_srcdir as controls to initialize
variables and include files to run headers_install from the top level
Makefile. There are a few problems with this logic.
1. Exposes top_srcdir to all tests
2. Common logic impacts all tests
3. Uses KSFT_KHDR_INSTALL, top_srcdir, and khdr in an adhoc way. Tests
add "khdr" dependency in their Makefiles to TEST_PROGS_EXTENDED in
some cases, and STATIC_LIBS in other cases. This makes this framework
confusing to use.
The common logic that runs for all tests even when KSFT_KHDR_INSTALL
isn't defined by the test. top_srcdir is initialized to a default value
when test doesn't initialize it. It works for all tests without a sub-dir
structure and tests with sub-dir structure fail to build.
e.g: make -C sparc64/drivers/ or make -C drivers/dma-buf
../../lib.mk:20: ../../../../scripts/subarch.include: No such file or directory
make: *** No rule to make target '../../../../scripts/subarch.include'. Stop.
There is no reason to require all tests to define top_srcdir and there is
no need to require tests to add khdr dependency using adhoc changes to
TEST_* and other variables.
Fix it with a consistent use of KSFT_KHDR_INSTALL and top_srcdir from tests
that have the dependency on headers_install.
Change common logic to include khdr target define and "all" target with
dependency on khdr when KSFT_KHDR_INSTALL is defined.
Only tests that have dependency on headers_install have to define just
the KSFT_KHDR_INSTALL, and top_srcdir variables and there is no need to
specify khdr dependency in the test Makefiles.
Fixes: b2d35fa5fc80 ("selftests: add headers_install to lib.mk")
Cc: stable(a)vger.kernel.org
Signed-off-by: Shuah Khan <shuah(a)kernel.org>
Reviewed-by: Khalid Aziz <khalid.aziz(a)oracle.com>
Reviewed-by: Anders Roxell <anders.roxell(a)linaro.org>
Signed-off-by: Shuah Khan <shuah(a)kernel.org>
diff --git a/tools/testing/selftests/android/Makefile b/tools/testing/selftests/android/Makefile
index d9a725478375..72c25a3cb658 100644
--- a/tools/testing/selftests/android/Makefile
+++ b/tools/testing/selftests/android/Makefile
@@ -6,7 +6,7 @@ TEST_PROGS := run.sh
include ../lib.mk
-all: khdr
+all:
@for DIR in $(SUBDIRS); do \
BUILD_TARGET=$(OUTPUT)/$$DIR; \
mkdir $$BUILD_TARGET -p; \
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index ad1eeb14fda7..30996306cabc 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -19,6 +19,7 @@ TEST_GEN_FILES := \
TEST_PROGS := run.sh
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
$(TEST_GEN_FILES): $(HEADERS)
diff --git a/tools/testing/selftests/gpio/Makefile b/tools/testing/selftests/gpio/Makefile
index f22b22aef7bf..0bb80619db58 100644
--- a/tools/testing/selftests/gpio/Makefile
+++ b/tools/testing/selftests/gpio/Makefile
@@ -16,8 +16,6 @@ TEST_PROGS_EXTENDED := gpio-mockup-chardev
GPIODIR := $(realpath ../../../gpio)
GPIOOBJ := gpio-utils.o
-include ../lib.mk
-
all: $(TEST_PROGS_EXTENDED)
override define CLEAN
@@ -25,7 +23,9 @@ override define CLEAN
$(MAKE) -C $(GPIODIR) OUTPUT=$(GPIODIR)/ clean
endef
-$(TEST_PROGS_EXTENDED):| khdr
+KSFT_KHDR_INSTALL := 1
+include ../lib.mk
+
$(TEST_PROGS_EXTENDED): $(GPIODIR)/$(GPIOOBJ)
$(GPIODIR)/$(GPIOOBJ):
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index 01a219229238..52bfe5e76907 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -1,6 +1,7 @@
all:
top_srcdir = ../../../..
+KSFT_KHDR_INSTALL := 1
UNAME_M := $(shell uname -m)
LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/ucall.c lib/sparsebit.c
@@ -44,7 +45,6 @@ $(OUTPUT)/libkvm.a: $(LIBKVM_OBJ)
all: $(STATIC_LIBS)
$(TEST_GEN_PROGS): $(STATIC_LIBS)
-$(STATIC_LIBS):| khdr
cscope: include_paths = $(LINUX_TOOL_INCLUDE) $(LINUX_HDR_PATH) include lib ..
cscope:
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 0a8e75886224..8b0f16409ed7 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -16,18 +16,18 @@ TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS))
TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED))
TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES))
+ifdef KSFT_KHDR_INSTALL
top_srcdir ?= ../../../..
include $(top_srcdir)/scripts/subarch.include
ARCH ?= $(SUBARCH)
-all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
-
.PHONY: khdr
khdr:
make ARCH=$(ARCH) -C $(top_srcdir) headers_install
-ifdef KSFT_KHDR_INSTALL
-$(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES):| khdr
+all: khdr $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
+else
+all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
endif
.ONESHELL:
diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
index 14cfcf006936..c46c0eefab9e 100644
--- a/tools/testing/selftests/networking/timestamping/Makefile
+++ b/tools/testing/selftests/networking/timestamping/Makefile
@@ -6,6 +6,7 @@ TEST_PROGS := hwtstamp_config rxtimestamp timestamping txtimestamp
all: $(TEST_PROGS)
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
clean:
diff --git a/tools/testing/selftests/tc-testing/bpf/Makefile b/tools/testing/selftests/tc-testing/bpf/Makefile
index dc92eb271d9a..be5a5e542804 100644
--- a/tools/testing/selftests/tc-testing/bpf/Makefile
+++ b/tools/testing/selftests/tc-testing/bpf/Makefile
@@ -4,6 +4,7 @@ APIDIR := ../../../../include/uapi
TEST_GEN_FILES = action.o
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
CLANG ?= clang
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 6e67e726e5a5..e13eb6cc8901 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -25,6 +25,7 @@ TEST_GEN_FILES += virtual_address_range
TEST_PROGS := run_vmtests
+KSFT_KHDR_INSTALL := 1
include ../lib.mk
$(OUTPUT)/userfaultfd: LDLIBS += -lpthread
on i386 or x86_64:
Lots of build errors for drivers/pinctrl/mediatek/pinctrl-moore.c when
CONFIG_OF is not enabled (but COMPILE_TEST is).
first this:
WARNING: unmet direct dependencies detected for PINCTRL_MTK_MOORE
Depends on [n]: PINCTRL [=y] && (ARCH_MEDIATEK || COMPILE_TEST [=y]) && OF [=n]
Selected by [y]:
- PINCTRL_MT7623 [=y] && PINCTRL [=y] && (ARCH_MEDIATEK || COMPILE_TEST [=y]) && (MACH_MT7623 || COMPILE_TEST [=y])
and then:
../drivers/pinctrl/mediatek/pinctrl-moore.c:22:44: error: array type has incomplete element type
static const struct pinconf_generic_params mtk_custom_bindings[] = {
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_pinmux_set_mux':
../drivers/pinctrl/mediatek/pinctrl-moore.c:46:2: error: implicit declaration of function 'pinmux_generic_get_function' [-Werror=implicit-function-declaration]
func = pinmux_generic_get_function(pctldev, selector);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:46:7: warning: assignment makes pointer from integer without a cast [enabled by default]
func = pinmux_generic_get_function(pctldev, selector);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:50:2: error: implicit declaration of function 'pinctrl_generic_get_group' [-Werror=implicit-function-declaration]
grp = pinctrl_generic_get_group(pctldev, group);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:50:6: warning: assignment makes pointer from integer without a cast [enabled by default]
grp = pinctrl_generic_get_group(pctldev, group);
^
In file included from ../include/linux/printk.h:331:0,
from ../include/linux/kernel.h:14,
from ../include/linux/list.h:9,
from ../include/linux/kobject.h:19,
from ../include/linux/device.h:16,
from ../include/linux/gpio/driver.h:5,
from ../drivers/pinctrl/mediatek/pinctrl-moore.c:11:
../drivers/pinctrl/mediatek/pinctrl-moore.c:55:7: error: dereferencing pointer to incomplete type
func->name, grp->name);
^
../include/linux/dynamic_debug.h:136:9: note: in definition of macro 'dynamic_dev_dbg'
##__VA_ARGS__); \
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:54:2: note: in expansion of macro 'dev_dbg'
dev_dbg(pctldev->dev, "enable function %s group %s\n",
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:55:18: error: dereferencing pointer to incomplete type
func->name, grp->name);
^
../include/linux/dynamic_debug.h:136:9: note: in definition of macro 'dynamic_dev_dbg'
##__VA_ARGS__); \
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:54:2: note: in expansion of macro 'dev_dbg'
dev_dbg(pctldev->dev, "enable function %s group %s\n",
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:57:21: error: dereferencing pointer to incomplete type
for (i = 0; i < grp->num_pins; i++) {
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:59:23: error: dereferencing pointer to incomplete type
int *pin_modes = grp->data;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:60:16: error: dereferencing pointer to incomplete type
int pin = grp->pins[i];
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_pinconf_group_get':
../drivers/pinctrl/mediatek/pinctrl-moore.c:357:2: error: implicit declaration of function 'pinctrl_generic_get_group_pins' [-Werror=implicit-function-declaration]
ret = pinctrl_generic_get_group_pins(pctldev, group, &pins, &npins);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: At top level:
../drivers/pinctrl/mediatek/pinctrl-moore.c:397:22: error: 'pinctrl_generic_get_group_count' undeclared here (not in a function)
.get_groups_count = pinctrl_generic_get_group_count,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:398:20: error: 'pinctrl_generic_get_group_name' undeclared here (not in a function)
.get_group_name = pinctrl_generic_get_group_name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:399:20: error: 'pinctrl_generic_get_group_pins' undeclared here (not in a function)
.get_group_pins = pinctrl_generic_get_group_pins,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:400:20: error: 'pinconf_generic_dt_node_to_map_all' undeclared here (not in a function)
.dt_node_to_map = pinconf_generic_dt_node_to_map_all,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:401:17: error: 'pinconf_generic_dt_free_map' undeclared here (not in a function)
.dt_free_map = pinconf_generic_dt_free_map,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:405:25: error: 'pinmux_generic_get_function_count' undeclared here (not in a function)
.get_functions_count = pinmux_generic_get_function_count,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:406:23: error: 'pinmux_generic_get_function_name' undeclared here (not in a function)
.get_function_name = pinmux_generic_get_function_name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:407:25: error: 'pinmux_generic_get_function_groups' undeclared here (not in a function)
.get_function_groups = pinmux_generic_get_function_groups,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_build_gpiochip':
../drivers/pinctrl/mediatek/pinctrl-moore.c:521:6: error: 'struct gpio_chip' has no member named 'of_node'
chip->of_node = np;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:522:6: error: 'struct gpio_chip' has no member named 'of_gpio_n_cells'
chip->of_gpio_n_cells = 2;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_build_groups':
../drivers/pinctrl/mediatek/pinctrl-moore.c:552:16: error: invalid use of undefined type 'struct group_desc'
const struct group_desc *group = hw->soc->grps + i;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:554:3: error: implicit declaration of function 'pinctrl_generic_add_group' [-Werror=implicit-function-declaration]
err = pinctrl_generic_add_group(hw->pctrl, group->name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:554:51: error: dereferencing pointer to incomplete type
err = pinctrl_generic_add_group(hw->pctrl, group->name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:555:12: error: dereferencing pointer to incomplete type
group->pins, group->num_pins,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:555:25: error: dereferencing pointer to incomplete type
group->pins, group->num_pins,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:556:12: error: dereferencing pointer to incomplete type
group->data);
^
In file included from ../include/linux/gpio/driver.h:5:0,
from ../drivers/pinctrl/mediatek/pinctrl-moore.c:11:
../drivers/pinctrl/mediatek/pinctrl-moore.c:559:10: error: dereferencing pointer to incomplete type
group->name);
^
../include/linux/device.h:1463:32: note: in definition of macro 'dev_err'
_dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_build_functions':
../drivers/pinctrl/mediatek/pinctrl-moore.c:572:16: error: invalid use of undefined type 'struct function_desc'
const struct function_desc *func = hw->soc->funcs + i;
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:574:3: error: implicit declaration of function 'pinmux_generic_add_function' [-Werror=implicit-function-declaration]
err = pinmux_generic_add_function(hw->pctrl, func->name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:574:52: error: dereferencing pointer to incomplete type
err = pinmux_generic_add_function(hw->pctrl, func->name,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:575:13: error: dereferencing pointer to incomplete type
func->group_names,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:576:13: error: dereferencing pointer to incomplete type
func->num_group_names,
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:577:13: error: dereferencing pointer to incomplete type
func->data);
^
In file included from ../include/linux/gpio/driver.h:5:0,
from ../drivers/pinctrl/mediatek/pinctrl-moore.c:11:
../drivers/pinctrl/mediatek/pinctrl-moore.c:580:9: error: dereferencing pointer to incomplete type
func->name);
^
../include/linux/device.h:1463:32: note: in definition of macro 'dev_err'
_dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
^
In file included from ../include/linux/kernel.h:15:0,
from ../include/linux/list.h:9,
from ../include/linux/kobject.h:19,
from ../include/linux/device.h:16,
from ../include/linux/gpio/driver.h:5,
from ../drivers/pinctrl/mediatek/pinctrl-moore.c:11:
../drivers/pinctrl/mediatek/pinctrl-moore.c: In function 'mtk_moore_pinctrl_probe':
../include/linux/build_bug.h:16:45: error: bit-field '<anonymous>' width not an integer constant
#define BUILD_BUG_ON_ZERO(e) (sizeof(struct { int:(-!!(e)); }))
^
../include/linux/compiler.h:349:28: note: in expansion of macro 'BUILD_BUG_ON_ZERO'
#define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
^
../include/linux/kernel.h:72:59: note: in expansion of macro '__must_be_array'
#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
^
../drivers/pinctrl/mediatek/pinctrl-moore.c:643:31: note: in expansion of macro 'ARRAY_SIZE'
mtk_desc.num_custom_params = ARRAY_SIZE(mtk_custom_bindings);
^
../drivers/pinctrl/mediatek/pinctrl-moore.c: At top level:
../drivers/pinctrl/mediatek/pinctrl-moore.c:22:44: warning: 'mtk_custom_bindings' defined but not used [-Wunused-variable]
static const struct pinconf_generic_params mtk_custom_bindings[] = {
^
cc1: some warnings being treated as errors
../scripts/Makefile.build:276: recipe for target 'drivers/pinctrl/mediatek/pinctrl-moore.o' failed
make[4]: *** [drivers/pinctrl/mediatek/pinctrl-moore.o] Error 1
Fixes: b5af33df50e9 ("pinctrl: mediatek: improve Kconfig dependencies")
Cc: stable(a)vger.kernel.org
Reported-by: Randy Dunlap <rdunlap(a)infradead.org>
Signed-off-by: Ryder Lee <ryder.lee(a)mediatek.com>
---
drivers/pinctrl/mediatek/Kconfig | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pinctrl/mediatek/Kconfig b/drivers/pinctrl/mediatek/Kconfig
index 1817786..a005cbc 100644
--- a/drivers/pinctrl/mediatek/Kconfig
+++ b/drivers/pinctrl/mediatek/Kconfig
@@ -45,12 +45,14 @@ config PINCTRL_MT2701
config PINCTRL_MT7623
bool "Mediatek MT7623 pin control with generic binding"
depends on MACH_MT7623 || COMPILE_TEST
+ depends on OF
default MACH_MT7623
select PINCTRL_MTK_MOORE
config PINCTRL_MT7629
bool "Mediatek MT7629 pin control"
depends on MACH_MT7629 || COMPILE_TEST
+ depends on OF
default MACH_MT7629
select PINCTRL_MTK_MOORE
@@ -92,6 +94,7 @@ config PINCTRL_MT6797
config PINCTRL_MT7622
bool "MediaTek MT7622 pin control"
+ depends on OF
depends on ARM64 || COMPILE_TEST
default ARM64 && ARCH_MEDIATEK
select PINCTRL_MTK_MOORE
--
1.9.1
Hi,
Here is a series of kprobes blacklist bugfix and improvements mainly
on x86 (since I started testing on qemu-x86).
This has been started from discussion about KPROBE_ENENTS_ON_NOTRACE
configuration. I tried to find notrace functions which can cause kernel
crash with kprobes using following script.
====
#!/bin/sh
i=0;
cat notrace_functions | while read f ; do
if echo p:event$i $f >> /sys/kernel/debug/tracing/kprobe_events; then
echo "Probing on $f"
echo 1 > /sys/kernel/debug/tracing/events/kprobes/event$i/enable
fi
i=$((i+1))
done
====
And I found several functions which must be blacklisted.
- optprobe template code, which is just a template code and
never be executed. Moreover, since it can be copied and
reused, if we probe it, it modifies the template code and
can cause a crash. ([1/9][2/9])
- functions which is called before kprobe_int3_handler()
handles kprobes. This can cause a breakpoint recursion. ([3/9])
- IRQ entry text, which should not be probed since register/pagetable
status has not been stable at that point. ([4/9])
- Suffixed symbols, like .constprop, .part etc. Those suffixed
symbols never be blacklisted even if the non-suffixed version
has been blacklisted. ([5/9])
- hardirq tracer also works before int3 handling. ([6/9])
- preempt_check debug function also is involved in int3 handling.
([7/9])
- RCU debug routine is also called before kprobe_int3_handler().
([8/9])
- Some lockdep functions are also involved in int3 handling.
([9/9])
Of course there still may be some functions which can be called
by configuration change, I'll continue to test it.
Thank you,
---
Masami Hiramatsu (9):
x86/kprobes: Prohibit probing on optprobe template code
x86/kprobes: Move trampoline code into RODATA
x86/kprobes: Prohibit probing on functions before kprobe_int3_handler()
x86/kprobes: Prohibit probing on IRQ handlers directly
kprobes: Search non-suffixed symbol in blacklist
kprobes: Prohibit probing on hardirq tracers
kprobes: Prohibit probing on preempt_check debug functions
kprobes: Prohibit probing on RCU debug routine
kprobes: Prohibit probing on lockdep functions
arch/x86/kernel/alternative.c | 3 ++-
arch/x86/kernel/ftrace.c | 3 ++-
arch/x86/kernel/kprobes/core.c | 7 +++++++
arch/x86/kernel/kprobes/opt.c | 4 ++--
arch/x86/kernel/traps.c | 1 +
kernel/kprobes.c | 21 ++++++++++++++++++++-
kernel/locking/lockdep.c | 7 ++++++-
kernel/rcu/tree.c | 2 ++
kernel/rcu/update.c | 2 ++
kernel/trace/trace_irqsoff.c | 9 +++++++--
kernel/trace/trace_preemptirq.c | 5 +++++
lib/smp_processor_id.c | 7 +++++--
12 files changed, 61 insertions(+), 10 deletions(-)
--
Masami Hiramatsu (Linaro) <mhiramat(a)kernel.org>
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 4eda776c3cefcb1f01b2d85bd8753f67606282b5 Mon Sep 17 00:00:00 2001
From: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Date: Sat, 13 Oct 2018 12:56:54 +0200
Subject: [PATCH] drm/rockchip: psr: do not dereference encoder before it is
null checked.
'encoder' is dereferenced before it is null sanity checked, hence we
potentially have a null pointer dereference bug. Instead, initialise
drm_drv from encoder->dev->dev_private after we are sure 'encoder' is
not null.
Fixes: 5182c1a556d7f ("drm/rockchip: add an common abstracted PSR driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Signed-off-by: Heiko Stuebner <heiko(a)sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20181013105654.11827-1-enric.…
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
index 79d00d861a31..01ff3c858875 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
@@ -189,12 +189,14 @@ EXPORT_SYMBOL(rockchip_drm_psr_flush_all);
int rockchip_drm_psr_register(struct drm_encoder *encoder,
int (*psr_set)(struct drm_encoder *, bool enable))
{
- struct rockchip_drm_private *drm_drv = encoder->dev->dev_private;
+ struct rockchip_drm_private *drm_drv;
struct psr_drv *psr;
if (!encoder || !psr_set)
return -EINVAL;
+ drm_drv = encoder->dev->dev_private;
+
psr = kzalloc(sizeof(struct psr_drv), GFP_KERNEL);
if (!psr)
return -ENOMEM;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 4eda776c3cefcb1f01b2d85bd8753f67606282b5 Mon Sep 17 00:00:00 2001
From: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Date: Sat, 13 Oct 2018 12:56:54 +0200
Subject: [PATCH] drm/rockchip: psr: do not dereference encoder before it is
null checked.
'encoder' is dereferenced before it is null sanity checked, hence we
potentially have a null pointer dereference bug. Instead, initialise
drm_drv from encoder->dev->dev_private after we are sure 'encoder' is
not null.
Fixes: 5182c1a556d7f ("drm/rockchip: add an common abstracted PSR driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
Signed-off-by: Heiko Stuebner <heiko(a)sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20181013105654.11827-1-enric.…
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
index 79d00d861a31..01ff3c858875 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
@@ -189,12 +189,14 @@ EXPORT_SYMBOL(rockchip_drm_psr_flush_all);
int rockchip_drm_psr_register(struct drm_encoder *encoder,
int (*psr_set)(struct drm_encoder *, bool enable))
{
- struct rockchip_drm_private *drm_drv = encoder->dev->dev_private;
+ struct rockchip_drm_private *drm_drv;
struct psr_drv *psr;
if (!encoder || !psr_set)
return -EINVAL;
+ drm_drv = encoder->dev->dev_private;
+
psr = kzalloc(sizeof(struct psr_drv), GFP_KERNEL);
if (!psr)
return -ENOMEM;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 211929fd3f7c8de4d541b1cc243b82830e5ea1e8 Mon Sep 17 00:00:00 2001
From: Shuah Khan <shuah(a)kernel.org>
Date: Wed, 12 Dec 2018 20:25:14 -0700
Subject: [PATCH] selftests: Fix test errors related to lib.mk khdr target
Commit b2d35fa5fc80 ("selftests: add headers_install to lib.mk") added
khdr target to run headers_install target from the main Makefile. The
logic uses KSFT_KHDR_INSTALL and top_srcdir as controls to initialize
variables and include files to run headers_install from the top level
Makefile. There are a few problems with this logic.
1. Exposes top_srcdir to all tests
2. Common logic impacts all tests
3. Uses KSFT_KHDR_INSTALL, top_srcdir, and khdr in an adhoc way. Tests
add "khdr" dependency in their Makefiles to TEST_PROGS_EXTENDED in
some cases, and STATIC_LIBS in other cases. This makes this framework
confusing to use.
The common logic that runs for all tests even when KSFT_KHDR_INSTALL
isn't defined by the test. top_srcdir is initialized to a default value
when test doesn't initialize it. It works for all tests without a sub-dir
structure and tests with sub-dir structure fail to build.
e.g: make -C sparc64/drivers/ or make -C drivers/dma-buf
../../lib.mk:20: ../../../../scripts/subarch.include: No such file or directory
make: *** No rule to make target '../../../../scripts/subarch.include'. Stop.
There is no reason to require all tests to define top_srcdir and there is
no need to require tests to add khdr dependency using adhoc changes to
TEST_* and other variables.
Fix it with a consistent use of KSFT_KHDR_INSTALL and top_srcdir from tests
that have the dependency on headers_install.
Change common logic to include khdr target define and "all" target with
dependency on khdr when KSFT_KHDR_INSTALL is defined.
Only tests that have dependency on headers_install have to define just
the KSFT_KHDR_INSTALL, and top_srcdir variables and there is no need to
specify khdr dependency in the test Makefiles.
Fixes: b2d35fa5fc80 ("selftests: add headers_install to lib.mk")
Cc: stable(a)vger.kernel.org
Signed-off-by: Shuah Khan <shuah(a)kernel.org>
diff --git a/tools/testing/selftests/android/Makefile b/tools/testing/selftests/android/Makefile
index d9a725478375..72c25a3cb658 100644
--- a/tools/testing/selftests/android/Makefile
+++ b/tools/testing/selftests/android/Makefile
@@ -6,7 +6,7 @@ TEST_PROGS := run.sh
include ../lib.mk
-all: khdr
+all:
@for DIR in $(SUBDIRS); do \
BUILD_TARGET=$(OUTPUT)/$$DIR; \
mkdir $$BUILD_TARGET -p; \
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index ad1eeb14fda7..30996306cabc 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -19,6 +19,7 @@ TEST_GEN_FILES := \
TEST_PROGS := run.sh
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
$(TEST_GEN_FILES): $(HEADERS)
diff --git a/tools/testing/selftests/gpio/Makefile b/tools/testing/selftests/gpio/Makefile
index 46648427d537..07f572a1bd3f 100644
--- a/tools/testing/selftests/gpio/Makefile
+++ b/tools/testing/selftests/gpio/Makefile
@@ -10,8 +10,6 @@ TEST_PROGS_EXTENDED := gpio-mockup-chardev
GPIODIR := $(realpath ../../../gpio)
GPIOOBJ := gpio-utils.o
-include ../lib.mk
-
all: $(TEST_PROGS_EXTENDED)
override define CLEAN
@@ -19,7 +17,9 @@ override define CLEAN
$(MAKE) -C $(GPIODIR) OUTPUT=$(GPIODIR)/ clean
endef
-$(TEST_PROGS_EXTENDED):| khdr
+KSFT_KHDR_INSTALL := 1
+include ../lib.mk
+
$(TEST_PROGS_EXTENDED): $(GPIODIR)/$(GPIOOBJ)
$(GPIODIR)/$(GPIOOBJ):
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index 01a219229238..52bfe5e76907 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -1,6 +1,7 @@
all:
top_srcdir = ../../../..
+KSFT_KHDR_INSTALL := 1
UNAME_M := $(shell uname -m)
LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/ucall.c lib/sparsebit.c
@@ -44,7 +45,6 @@ $(OUTPUT)/libkvm.a: $(LIBKVM_OBJ)
all: $(STATIC_LIBS)
$(TEST_GEN_PROGS): $(STATIC_LIBS)
-$(STATIC_LIBS):| khdr
cscope: include_paths = $(LINUX_TOOL_INCLUDE) $(LINUX_HDR_PATH) include lib ..
cscope:
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 0a8e75886224..8b0f16409ed7 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -16,18 +16,18 @@ TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS))
TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED))
TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES))
+ifdef KSFT_KHDR_INSTALL
top_srcdir ?= ../../../..
include $(top_srcdir)/scripts/subarch.include
ARCH ?= $(SUBARCH)
-all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
-
.PHONY: khdr
khdr:
make ARCH=$(ARCH) -C $(top_srcdir) headers_install
-ifdef KSFT_KHDR_INSTALL
-$(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES):| khdr
+all: khdr $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
+else
+all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
endif
.ONESHELL:
diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
index 14cfcf006936..c46c0eefab9e 100644
--- a/tools/testing/selftests/networking/timestamping/Makefile
+++ b/tools/testing/selftests/networking/timestamping/Makefile
@@ -6,6 +6,7 @@ TEST_PROGS := hwtstamp_config rxtimestamp timestamping txtimestamp
all: $(TEST_PROGS)
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
clean:
diff --git a/tools/testing/selftests/tc-testing/bpf/Makefile b/tools/testing/selftests/tc-testing/bpf/Makefile
index dc92eb271d9a..be5a5e542804 100644
--- a/tools/testing/selftests/tc-testing/bpf/Makefile
+++ b/tools/testing/selftests/tc-testing/bpf/Makefile
@@ -4,6 +4,7 @@ APIDIR := ../../../../include/uapi
TEST_GEN_FILES = action.o
top_srcdir = ../../../../..
+KSFT_KHDR_INSTALL := 1
include ../../lib.mk
CLANG ?= clang
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 6e67e726e5a5..e13eb6cc8901 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -25,6 +25,7 @@ TEST_GEN_FILES += virtual_address_range
TEST_PROGS := run_vmtests
+KSFT_KHDR_INSTALL := 1
include ../lib.mk
$(OUTPUT)/userfaultfd: LDLIBS += -lpthread
On Wed, 2019-01-09 at 15:52 +0000, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: 79e539453b34 DRM: i915: add mode setting support.
>
> The bot has tested the following trees: v4.20.0, v4.19.13, v4.14.91, v4.9.148, v4.4.169, v3.18.131.
>
> v4.20.0: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 9c71a6686bfa ("drm: fourcc: Convert drm_format_info kerneldoc to in-line member documentation")
>
> v4.19.13: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 9c71a6686bfa ("drm: fourcc: Convert drm_format_info kerneldoc to in-line member documentation")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
>
> v4.14.91: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 4cc4e1b40f3f ("drm/fourcc: Add a alpha field to drm_format_info")
> 9c71a6686bfa ("drm: fourcc: Convert drm_format_info kerneldoc to in-line member documentation")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
> ce2d54619a10 ("drm/fourcc: Add is_yuv field to drm_format_info to denote if the format is yuv")
>
> v4.9.148: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 05fc03217e08 ("drm/mm: Some doc polish")
> 06df8ac682e6 ("drm: kselftest for drm_mm_debug()")
> 14d7f96f90fb ("drm/fb_cma_helper: Add drm_fb_cma_prepare_fb() helper")
> 2bd966d106e3 ("drm: kselftest for drm_mm_replace_node()")
> 2fba0de0a9ec ("drm: kselftest for drm_mm_insert_node_in_range()")
> 393b50f30566 ("drm: kselftest for drm_mm_init()")
> 4636ce93d5b2 ("drm/fb-cma-helper: Add drm_fb_cma_get_gem_addr()")
> 50f0033d1a0f ("drm: Add some kselftests for the DRM range manager (struct drm_mm)")
> 5628648df755 ("drm/fb-cma-helper: Use drm_gem_framebuffer_helper")
> 5705670d0463 ("drm: Track drm_mm allocators and show leaks on shutdown")
> 6259a56ba0e1 ("drm: Add asserts to catch overflow in drm_mm_init() and drm_mm_init_scan()")
> 62a0d98a188c ("drm: allow to use mmuless SoC")
> 72a93e8dd52c ("drm: Take ownership of the dmabuf->obj when exporting")
> 7886692a5804 ("drm: kselftest for drm_mm_insert_node()")
> 900537dc3889 ("drm: kselftest for drm_mm_reserve_node()")
> 940eba2d58a7 ("drm/gem|prime|mm: Use recommened kerneldoc for struct member refs")
> 9a71e277888b ("drm: Extract struct drm_mm_scan from struct drm_mm")
> 9b26f2ed29f8 ("drm: kselftest for drm_mm and alignment")
> b112481bb327 ("drm/cma-helper: simplify setup for drivers with ->dirty callbacks")
> b3ee963fe41d ("drm: Compile time enabling for asserts in drm_mm")
> ba004e39b199 ("drm: Fix kerneldoc for drm_mm_scan_remove_block()")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
> e6b62714e87c ("drm: Introduce drm_gem_object_{get,put}()")
>
> v4.4.169: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 14d7f96f90fb ("drm/fb_cma_helper: Add drm_fb_cma_prepare_fb() helper")
> 199c77179c87 ("drm/fb-cma-helper: Add fb_deferred_io support")
> 1eb83451ba55 ("drm: Pass the user drm_mode_fb_cmd2 as const to .fb_create()")
> 4636ce93d5b2 ("drm/fb-cma-helper: Add drm_fb_cma_get_gem_addr()")
> 5628648df755 ("drm/fb-cma-helper: Use drm_gem_framebuffer_helper")
> 70c0616d5a84 ("drm/fb_cma_helper: remove duplicate const from drm_fb_cma_alloc")
> b112481bb327 ("drm/cma-helper: simplify setup for drivers with ->dirty callbacks")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
> ce0c57576810 ("drm/fb_cma_helper: Implement fb_mmap callback")
> fdce184609ee ("drm/fb-cma-helper: Use const for drm_framebuffer_funcs argument")
>
> v3.18.131: Failed to apply! Possible dependencies:
> 042bf753842d ("drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info")
> 14d7f96f90fb ("drm/fb_cma_helper: Add drm_fb_cma_prepare_fb() helper")
> 199c77179c87 ("drm/fb-cma-helper: Add fb_deferred_io support")
> 1a396789f65a ("drm: add Atmel HLCDC Display Controller support")
> 1eb83451ba55 ("drm: Pass the user drm_mode_fb_cmd2 as const to .fb_create()")
> 2a8cb4894540 ("drm/exynos: merge exynos_drm_buf.c to exynos_drm_gem.c")
> 2b8376c803c4 ("drm/exynos: remove struct exynos_drm_encoder layer")
> 39a839f2e651 ("drm/exynos: s/exynos_gem_obj/obj in exynos_drm_fbdev.c")
> 421ee18d4e04 ("drm/exynos: fix null pointer dereference issue")
> 4636ce93d5b2 ("drm/fb-cma-helper: Add drm_fb_cma_get_gem_addr()")
> 4846e4520849 ("drm/exynos: clean up machine compatible string check")
> 5628648df755 ("drm/fb-cma-helper: Use drm_gem_framebuffer_helper")
> 5cbb37df378d ("drm/exynos: resolve infinite loop issue on multi-platform")
> 70c0616d5a84 ("drm/fb_cma_helper: remove duplicate const from drm_fb_cma_alloc")
> 7239067795dc ("drm/exynos: remove ifdeferry from initialization code")
> 7ded85885d49 ("drm/exynos: remove superfluous error messages")
> 813fd67b57ff ("drm/exynos: cleanup name of gem object for exynos_drm")
> 820687befec4 ("drm/exynos: move Exynos platform drivers registration to init")
> 94e30d93f936 ("drm/exynos: remove exynos_drm_fb_set_buf_cnt()")
> 96976c3d9aff ("drm/exynos: Add DECON driver")
> b74ea6a97e82 ("drm/exynos: remove DRM_EXYNOS_DMABUF config")
> c76abab59b3c ("drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer")
> ce0c57576810 ("drm/fb_cma_helper: Implement fb_mmap callback")
> cf67cc9a29ac ("drm/exynos: remove struct exynos_drm_display")
> d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
> d56125afcbdf ("drm/exynos: update exynos_drm_framebuffer_init() for multiple buffers")
> e9fbdcb45a36 ("drm/exynos: fix possible infinite loop issue")
>
>
> How should we proceed with this patch?
>
> --
> Thanks,
> Sasha
Hi,
I'm new to kernel development, so: what exactly I'm supposed to do in
such case? Rebase my patch on top of older versions and then resend
patches somewhere?
Just checked the v3.18.131. Apparently code in question was not changed
since then, so manual rebase would be trivial.
On 29/11/2018 02:22, Hans van Kranenburg wrote:
> Hi,
>
> As also seen at:
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914951
>
> Attached there are two serial console output logs. One is starting with
> Xen 4.11 (from debian unstable) as dom0, and the other one without Xen.
>
> [ 2.085543] BUG: unable to handle kernel paging request at
> ffff888d9fffc000
> [ 2.085610] PGD 200c067 P4D 200c067 PUD 0
> [ 2.085674] Oops: 0000 [#1] SMP NOPTI
> [ 2.085736] CPU: 1 PID: 1 Comm: swapper/0 Not tainted
> 4.19.0-trunk-amd64 #1 Debian 4.19.5-1~exp1+pvh1
> [ 2.085823] Hardware name: HP ProLiant DL360 G7, BIOS P68 05/21/2018
> [ 2.085895] RIP: e030:ptdump_walk_pgd_level_core+0x1fd/0x490
> [...]
The offending stable commit is 4074ca7d8a1832921c865d250bbd08f3441b3657
("x86/mm: Move LDT remap out of KASLR region on 5-level paging"), this
is commit d52888aa2753e3063a9d3a0c9f72f94aa9809c15 upstream.
Current upstream kernel is booting fine under Xen, so in general the
patch should be fine. Using an upstream kernel built from above commit
(with the then needed Xen fixup patch 1457d8cf7664f34c4ba534) is fine,
too.
Kirill, are you aware of any prerequisite patch from 4.20 which could be
missing in 4.19.5?
Juergen
Hi,
please pick commit 9aec30371fb095a0c9415f3f0146ae269c3713d8 (leds: pwm:
silently error out on EPROBE_DEFER) from the 4.20 release to the stable
LTS version 4.19.
I own a Odroid HC1 and run Debian testing (with kernel 4.19) on it. It
produces these kernel warnings:
[ 14.718000] leds_pwm pwmleds: unable to request PWM for blue:heartbeat: -517
[ 14.752948] leds_pwm pwmleds: unable to request PWM for blue:heartbeat: -517
[ 14.771394] leds_pwm pwmleds: unable to request PWM for blue:heartbeat: -517
[ 14.799319] leds_pwm pwmleds: unable to request PWM for blue:heartbeat: -517
These messages were misleading me thinking that the blue heartbeat LED
isn't work (it works, but it is off by default).
--
Benjamin Drung
Debian & Ubuntu Developer
Hi Greg and Sasha,
Would you mind picking up this lone patch for 4.19 and 4.14 stable branches?
Attached are backports for 4.19 (applied cleanly) and 4.14 (needed to
be manually backported). Let me know if you'd prefer me to just send
2 emails (one for each patch). I considered using mbox files, but
seems like kind of a waste for a lone patch.
(Note that Autosel already picked up Upstream commit
3bbd3db86470c701091fb1d67f1fab6621debf50 which I would have included
with this one otherwise).
--
Thanks,
~Nick Desaulniers
Hi Greg and Sasha,
Attached is an mbox with a series of patches to allow building the
powerpc kernel with Clang. We have been running continuous integration
that builds and boots the kernel in QEMU for almost two months now with
no regressions. This is on top of 4.19.14, there should be no conflicts
but let me know if I messed something up.
I will send a series for 4.14 in a little bit as well.
Thank you,
Nathan
OUT endpoint requests may somtimes have this flag set when
preparing to be submitted to HW indicating that there is an
additional TRB chained to the request for alignment purposes.
If that request is removed before the controller can execute the
transfer (e.g. ep_dequeue/ep_disable), the request will not go
through the dwc3_gadget_ep_cleanup_completed_request() handler
and will not have its needs_extra_trb flag cleared when
dwc3_gadget_giveback() is called. This same request could be
later requeued for a new transfer that does not require an
extra TRB and if it is successfully completed, the cleanup
and TRB reclamation will incorrectly process the additional TRB
which belongs to the next request, and incorrectly advances the
TRB dequeue pointer, thereby messing up calculation of the next
requeust's actual/remaining count when it completes.
The right thing to do here is to ensure that the flag is cleared
before it is given back to the function driver. A good place
to do that is in dwc3_gadget_del_and_unmap_request().
Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jack Pham <jackp(a)codeaurora.org>
---
v2: Added Fixes tag and Cc: stable
Felipe, as I mentioned in the cover for v1, for stable (from 4.11 where
c6267a51639b first landed through 4.20), the fix needs to be modified to
assign to the separate req->unaligned and req->zero flags in lieu of
needs_extra_trb which appeared in 5.0-rc1 in:
commit 1a22ec643580626f439c8583edafdcc73798f2fb
Author: Felipe Balbi <felipe.balbi(a)linux.intel.com>
Date: Wed Aug 1 13:15:05 2018 +0300
usb: dwc3: gadget: combine unaligned and zero flags
Do I need to send a separate patch for <= 4.20 or will you handle it?
It's straightforward really, the code change should instead be
+ req->unaligned = false;
+ req->zero = false;
Thanks,
Jack
drivers/usb/dwc3/gadget.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 2ecde30ad0b7..e97b14f444c8 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -177,6 +177,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
req->started = false;
list_del(&req->list);
req->remaining = 0;
+ req->needs_extra_trb = false;
if (req->request.status == -EINPROGRESS)
req->request.status = status;
--
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c6d6e9b0f6b4201c77f2cea3964dd122697e3543 Mon Sep 17 00:00:00 2001
From: Jaegeuk Kim <jaegeuk(a)kernel.org>
Date: Tue, 18 Dec 2018 09:25:37 -0800
Subject: [PATCH] dm: do not allow readahead to limit IO size
Update DM to set the bdi's io_pages. This fixes reads to be capped at
the device's max request size (even if user's read IO exceeds the
established readahead setting).
Fixes: 9491ae4a ("mm: don't cap request size based on read-ahead setting")
Cc: stable(a)vger.kernel.org
Reviewed-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 844f7d0f2ef8..4b1be754cc41 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1927,6 +1927,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
*/
if (blk_queue_is_zoned(q))
blk_revalidate_disk_zones(t->md->disk);
+
+ /* Allow reads to exceed readahead limits */
+ q->backing_dev_info->io_pages = limits->max_sectors >> (PAGE_SHIFT - 9);
}
unsigned int dm_table_get_num_targets(struct dm_table *t)
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From c6d6e9b0f6b4201c77f2cea3964dd122697e3543 Mon Sep 17 00:00:00 2001
From: Jaegeuk Kim <jaegeuk(a)kernel.org>
Date: Tue, 18 Dec 2018 09:25:37 -0800
Subject: [PATCH] dm: do not allow readahead to limit IO size
Update DM to set the bdi's io_pages. This fixes reads to be capped at
the device's max request size (even if user's read IO exceeds the
established readahead setting).
Fixes: 9491ae4a ("mm: don't cap request size based on read-ahead setting")
Cc: stable(a)vger.kernel.org
Reviewed-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 844f7d0f2ef8..4b1be754cc41 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1927,6 +1927,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
*/
if (blk_queue_is_zoned(q))
blk_revalidate_disk_zones(t->md->disk);
+
+ /* Allow reads to exceed readahead limits */
+ q->backing_dev_info->io_pages = limits->max_sectors >> (PAGE_SHIFT - 9);
}
unsigned int dm_table_get_num_targets(struct dm_table *t)