- Linux-stable-mirror - lists.linaro.org

FAILED: patch "[PATCH] btrfs: fix transaction leak in btrfs_recover_relocation" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 1402d17dfd9657be0da8458b2079d03c2d61c86a Mon Sep 17 00:00:00 2001 From: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Date: Mon, 20 Apr 2020 13:39:39 +0800 Subject: [PATCH] btrfs: fix transaction leak in btrfs_recover_relocation btrfs_recover_relocation() invokes btrfs_join_transaction(), which joins a btrfs_trans_handle object into transactions and returns a reference of it with increased refcount to "trans". When btrfs_recover_relocation() returns, "trans" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in one exception handling path of btrfs_recover_relocation(). When read_fs_root() failed, the refcnt increased by btrfs_join_transaction() is not decreased, causing a refcnt leak. Fix this issue by calling btrfs_end_transaction() on this error path when read_fs_root() failed. Fixes: 79787eaab461 ("btrfs: replace many BUG_ONs with proper error handling") CC: stable(a)vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf(a)gmail.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index d35936c934ab..03bc7134e8cb 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -4559,6 +4559,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) if (IS_ERR(fs_root)) { err = PTR_ERR(fs_root); list_add_tail(&reloc_root->root_list, &reloc_roots); + btrfs_end_transaction(trans); goto out_unset; }

5 years, 7 months

1
0
0 0

FAILED: patch "[PATCH] drm/qxl: qxl_release use after free" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 933db73351d359f74b14f4af095808260aff11f9 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Wed, 29 Apr 2020 12:01:24 +0300 Subject: [PATCH] drm/qxl: qxl_release use after free qxl_release should not be accesses after qxl_push_*_ring_release() calls: userspace driver can process submitted command quickly, move qxl_release into release_ring, generate interrupt and trigger garbage collector. It can lead to crashes in qxl driver or trigger memory corruption in some kmalloc-192 slab object Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window. cc: stable(a)vger.kernel.org Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d3241… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c index fa8762d15d0f..05863b253d68 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -500,8 +500,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, /* no need to add a release to the fence for this surface bo, since it is only released when we ask to destroy the surface and it would never signal otherwise */ - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); surf->hw_surf_alloc = true; spin_lock(&qdev->surf_id_idr_lock); @@ -543,9 +543,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev, cmd->surface_id = id; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); - qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index 09583a08e141..91f398d51cfa 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -510,8 +510,8 @@ static int qxl_primary_apply_cursor(struct drm_plane *plane) cmd->u.set.visible = 1; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return ret; @@ -652,8 +652,8 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, cmd->u.position.y = plane->state->crtc_y + fb->hot_y; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); if (old_cursor_bo != NULL) qxl_bo_unpin(old_cursor_bo); @@ -700,8 +700,8 @@ static void qxl_cursor_atomic_disable(struct drm_plane *plane, cmd->type = QXL_CURSOR_HIDE; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); } static void qxl_update_dumb_head(struct qxl_device *qdev, diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index f8776d60d08e..3599db096973 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -243,8 +243,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, } qxl_bo_kunmap(clips_bo); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_release_backoff: if (ret) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 8117a45b3610..72f3f1bbb40c 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -261,11 +261,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, apply_surf_reloc(qdev, &reloc_info[i]); } + qxl_release_fence_buffer_objects(release); ret = qxl_push_command_ring_release(qdev, release, cmd->type, true); - if (ret) - qxl_release_backoff_reserve_list(release); - else - qxl_release_fence_buffer_objects(release); out_free_bos: out_free_release:

5 years, 7 months

1
0
0 0

FAILED: patch "[PATCH] drm/qxl: qxl_release use after free" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 933db73351d359f74b14f4af095808260aff11f9 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Wed, 29 Apr 2020 12:01:24 +0300 Subject: [PATCH] drm/qxl: qxl_release use after free qxl_release should not be accesses after qxl_push_*_ring_release() calls: userspace driver can process submitted command quickly, move qxl_release into release_ring, generate interrupt and trigger garbage collector. It can lead to crashes in qxl driver or trigger memory corruption in some kmalloc-192 slab object Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window. cc: stable(a)vger.kernel.org Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d3241… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c index fa8762d15d0f..05863b253d68 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -500,8 +500,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, /* no need to add a release to the fence for this surface bo, since it is only released when we ask to destroy the surface and it would never signal otherwise */ - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); surf->hw_surf_alloc = true; spin_lock(&qdev->surf_id_idr_lock); @@ -543,9 +543,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev, cmd->surface_id = id; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); - qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index 09583a08e141..91f398d51cfa 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -510,8 +510,8 @@ static int qxl_primary_apply_cursor(struct drm_plane *plane) cmd->u.set.visible = 1; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return ret; @@ -652,8 +652,8 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, cmd->u.position.y = plane->state->crtc_y + fb->hot_y; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); if (old_cursor_bo != NULL) qxl_bo_unpin(old_cursor_bo); @@ -700,8 +700,8 @@ static void qxl_cursor_atomic_disable(struct drm_plane *plane, cmd->type = QXL_CURSOR_HIDE; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); } static void qxl_update_dumb_head(struct qxl_device *qdev, diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index f8776d60d08e..3599db096973 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -243,8 +243,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, } qxl_bo_kunmap(clips_bo); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_release_backoff: if (ret) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 8117a45b3610..72f3f1bbb40c 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -261,11 +261,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, apply_surf_reloc(qdev, &reloc_info[i]); } + qxl_release_fence_buffer_objects(release); ret = qxl_push_command_ring_release(qdev, release, cmd->type, true); - if (ret) - qxl_release_backoff_reserve_list(release); - else - qxl_release_fence_buffer_objects(release); out_free_bos: out_free_release:

5 years, 7 months

1
0
0 0

FAILED: patch "[PATCH] drm/qxl: qxl_release leak in qxl_draw_dirty_fb()" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 85e9b88af1e6164f19ec71381efd5e2bcfc17620 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Mon, 27 Apr 2020 08:32:46 +0300 Subject: [PATCH] drm/qxl: qxl_release leak in qxl_draw_dirty_fb() ret should be changed to release allocated struct qxl_release Cc: stable(a)vger.kernel.org Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/22cfd55f-07c8-95d0-a2f7-191b71… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index 5bebf1ea1c5d..f8776d60d08e 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -209,9 +209,10 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, goto out_release_backoff; rects = drawable_set_clipping(qdev, num_clips, clips_bo); - if (!rects) + if (!rects) { + ret = -EINVAL; goto out_release_backoff; - + } drawable = (struct qxl_drawable *)qxl_release_map(qdev, release); drawable->clip.type = SPICE_CLIP_TYPE_RECTS;

5 years, 7 months

1
0
0 0

[PATCH 01/12] aio: fix async fsync creds

by Miklos Szeredi

Avi Kivity reports that on fuse filesystems running in a user namespace asyncronous fsync fails with EOVERFLOW. The reason is that f_ops->fsync() is called with the creds of the kthread performing aio work instead of the creds of the process originally submitting IOCB_CMD_FSYNC. Fuse sends the creds of the caller in the request header and it needs to translate the uid and gid into the server's user namespace. Since the kthread is running in init_user_ns, the translation will fail and the operation returns an error. It can be argued that fsync doesn't actually need any creds, but just zeroing out those fields in the header (as with requests that currently don't take creds) is a backward compatibility risk. Instead of working around this issue in fuse, solve the core of the problem by calling the filesystem with the proper creds. Reported-by: Avi Kivity <avi(a)scylladb.com> Tested-by: Giuseppe Scrivano <gscrivan(a)redhat.com> Fixes: c9582eb0ff7d ("fuse: Fail all requests with invalid uids or gids") Cc: stable(a)vger.kernel.org # 4.18+ Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> --- fs/aio.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/aio.c b/fs/aio.c index 0d9a559d488c..37828773e2fe 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -176,6 +176,7 @@ struct fsync_iocb { struct file *file; struct work_struct work; bool datasync; + struct cred *creds; }; struct poll_iocb { @@ -1589,8 +1590,11 @@ static int aio_write(struct kiocb *req, const struct iocb *iocb, static void aio_fsync_work(struct work_struct *work) { struct aio_kiocb *iocb = container_of(work, struct aio_kiocb, fsync.work); + const struct cred *old_cred = override_creds(iocb->fsync.creds); iocb->ki_res.res = vfs_fsync(iocb->fsync.file, iocb->fsync.datasync); + revert_creds(old_cred); + put_cred(iocb->fsync.creds); iocb_put(iocb); } @@ -1604,6 +1608,10 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb, if (unlikely(!req->file->f_op->fsync)) return -EINVAL; + req->creds = prepare_creds(); + if (!req->creds) + return -ENOMEM; + req->datasync = datasync; INIT_WORK(&req->work, aio_fsync_work); schedule_work(&req->work); -- 2.21.0

5 years, 7 months

3
2
0 0

DRM broke for AMDGPU in 5.6.10

by Linus Torvalds

See https://bugzilla.kernel.org/show_bug.cgi?id=207561 and the fix seems to be to back-port commit 8623b5255ae7 ("drm/scheduler: fix drm_sched_get_cleanup_job"). I think Artem will (has?) make a report too, but I thought I'd just mention it to make sure since I was on the bugzilla. Linus

5 years, 7 months

2
1
0 0

[PATCH 4.14 000/117] 4.14.178-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.178 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 04 May 2020 06:40:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.178-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.178-rc2 Al Viro <viro(a)zeniv.linux.org.uk> propagate_one(): mnt_set_mountpoint() needs mount_lock Ritesh Harjani <riteshh(a)linux.ibm.com> ext4: check for non-zero journal inum in ext4_calculate_overhead Yuval Basson <ybason(a)marvell.com> qed: Fix use after free in qed_chain_free Colin Ian King <colin.king(a)canonical.com> ext4: unsigned int compared against zero Theodore Ts'o <tytso(a)mit.edu> ext4: fix block validity checks for journal inodes using indirect blocks Theodore Ts'o <tytso(a)mit.edu> ext4: don't perform block validity checks on the journal inode Theodore Ts'o <tytso(a)mit.edu> ext4: protect journal inode's blocks using block_validity Theodore Ts'o <tytso(a)mit.edu> ext4: avoid declaring fs inconsistent due to invalid file handles Sascha Hauer <s.hauer(a)pengutronix.de> hwmon: (jc42) Fix name to have no illegal characters Theodore Ts'o <tytso(a)mit.edu> ext4: convert BUG_ON's to WARN_ON's in mballoc.c Theodore Ts'o <tytso(a)mit.edu> ext4: increase wait time needed before reuse of deleted inode numbers yangerkun <yangerkun(a)huawei.com> ext4: use matching invalidatepage in ext4_writepage Fangrui Song <maskray(a)google.com> arm64: Delete the space separator in __emit_inst Juergen Gross <jgross(a)suse.com> xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Support Clang non-section symbols in ORC dump Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings Bodo Stroesser <bstroesser(a)ts.fujitsu.com> scsi: target: fix PR IN / READ FULL STATUS for FC Darrick J. Wong <darrick.wong(a)oracle.com> xfs: fix partially uninitialized structure in xfs_reflink_remap_extent Olaf Hering <olaf(a)aepfle.de> x86: hyperv: report value of misc_features Luke Nelson <lukenels(a)cs.washington.edu> bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B Yang Shi <yang.shi(a)linux.alibaba.com> mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path Ian Rogers <irogers(a)google.com> perf/core: fix parent pid/tid in task exit events Nicolas Saenz Julienne <nsaenzjulienne(a)suse.de> ARM: dts: bcm283x: Disable dsi0 node Jason Gunthorpe <jgg(a)mellanox.com> net/cxgb4: Check the return from t4_query_params properly Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: altera: use proper variable to hold errno Vasily Averin <vvs(a)virtuozzo.com> nfsd: memory corruption in nfsd4_lock() YueHaibing <yuehaibing(a)huawei.com> iio:ad7797: Use correct attribute_group Nathan Chancellor <natechancellor(a)gmail.com> usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Do link recovery for SS and SSP Tyler Hicks <tyhicks(a)canonical.com> binder: take read mode of mmap_sem in binder_alloc_free_page() Christian Borntraeger <borntraeger(a)de.ibm.com> include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap Liu Jian <liujian56(a)huawei.com> mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer Clement Leger <cleger(a)kalray.eu> remoteproc: Fix wrong rvring index computation kaixuxia <xiakaixu1987(a)gmail.com> xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT Darrick J. Wong <darrick.wong(a)oracle.com> xfs: validate sb_logsunit is a multiple of the fs blocksize Kazuhiro Fujita <kazuhiro.fujita.jg(a)renesas.com> serial: sh-sci: Make sure status register SCxSR is read in correct sequence Udipto Goswami <ugoswami(a)codeaurora.org> usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() Oliver Neukum <oneukum(a)suse.com> UAS: fix deadlock in error handling and PM flushing work Oliver Neukum <oneukum(a)suse.com> UAS: no use logging any details in case of ENODEV Oliver Neukum <oneukum(a)suse.com> cdc-acm: introduce a cool down Oliver Neukum <oneukum(a)suse.com> cdc-acm: close race betrween suspend() and acm_softint Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Power save stop wake_up_count wrap around. Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Fix pairwise key entry save. Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Fix drivers TBTT timing counter. Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Fix calling conditions of vnt_set_bss_mode Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default. Nicolas Pitre <nico(a)fluxnic.net> vt: don't hardcode the mem allocation upper bound Xiyu Yang <xiyuyang19(a)fudan.edu.cn> staging: comedi: Fix comedi_device refcnt leak in comedi_open Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: dt2815: fix writing hi byte of analog output Chris Packham <chris.packham(a)alliedtelesis.co.nz> powerpc/setup_64: Set cache-line-size based on cache-block-size Ahmad Fatoum <a.fatoum(a)pengutronix.de> ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y Johannes Berg <johannes.berg(a)intel.com> iwlwifi: pcie: actually release queue memory in TVQM Gyeongtaek Lee <gt82.lee(a)samsung.com> ASoC: dapm: fixup dapm kcontrol widget Paul Moore <paul(a)paul-moore.com> audit: check the length of userspace generated audit records Alan Stern <stern(a)rowland.harvard.edu> usb-storage: Add unusual_devs entry for JMicron JMS566 Jiri Slaby <jslaby(a)suse.cz> tty: rocket, avoid OOB access Andrew Melnychenko <andrew(a)daynix.com> tty: hvc: fix buffer overflow during hvc_alloc(). Uros Bizjak <ubizjak(a)gmail.com> KVM: VMX: Enable machine check support for 32bit targets Sean Christopherson <sean.j.christopherson(a)intel.com> KVM: Check validity of resolved slot when searching memslots George Wilson <gcwilson(a)linux.ibm.com> tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send() Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> tpm/tpm_tis: Free IRQ if probing fails Alexander Tsoy <alexander(a)tsoy.me> ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices Xiyu Yang <xiyuyang19(a)fudan.edu.cn> ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - Add new codec supported for ALC245 Takashi Iwai <tiwai(a)suse.de> ALSA: usx2y: Fix potential NULL dereference Lucas Stach <l.stach(a)pengutronix.de> tools/vm: fix cross-compile build Muchun Song <songmuchun(a)bytedance.com> mm/ksm: fix NULL pointer dereference when KSM zero page is enabled Longpeng <longpeng2(a)huawei.com> mm/hugetlb: fix a addressing exception caused by huge_pte_offset Jann Horn <jannh(a)google.com> vmalloc: fix remap_vmalloc_range() bounds checks Jason Gunthorpe <jgg(a)mellanox.com> overflow.h: Add arithmetic shift helper Alan Stern <stern(a)rowland.harvard.edu> USB: hub: Fix handling of connect changes during sleep Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix free-while-in-use bug in the USB S-Glibrary Jann Horn <jannh(a)google.com> USB: early: Handle AMD's spec-compliant identifiers, too Jonathan Cox <jonathan(a)jdcox.net> USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE Changming Liu <liu.changm(a)northeastern.edu> USB: sisusbvga: Change port variable from signed to unsigned Piotr Krysiuk <piotras(a)gmail.com> fs/namespace.c: fix mountpoint reference counter race Lars-Peter Clausen <lars(a)metafoo.de> iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode Lars-Peter Clausen <lars(a)metafoo.de> iio: xilinx-xadc: Fix clearing interrupt when enabling trigger Lars-Peter Clausen <lars(a)metafoo.de> iio: xilinx-xadc: Fix ADC-B powerdown Olivier Moysan <olivier.moysan(a)st.com> iio: adc: stm32-adc: fix sleep in atomic context Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Remove ASUS ROG Zenith from the blacklist Waiman Long <longman(a)redhat.com> KEYS: Avoid false positive ENOMEM error on key read David Ahern <dsahern(a)gmail.com> vrf: Check skb for XFRM_TRANSFORMED flag David Ahern <dsahern(a)gmail.com> xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish Florian Fainelli <f.fainelli(a)gmail.com> net: dsa: b53: Fix ARL register definitions Taehee Yoo <ap420073(a)gmail.com> team: fix hang in team_mode_get() Eric Dumazet <edumazet(a)google.com> tcp: cache line align MAX_TCP_HEADER Xiyu Yang <xiyuyang19(a)fudan.edu.cn> net/x25: Fix x25_neigh refcnt leak when receiving frame Xiyu Yang <xiyuyang19(a)fudan.edu.cn> net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node Doug Berger <opendmb(a)gmail.com> net: bcmgenet: correct per TX/RX ring statistics Taehee Yoo <ap420073(a)gmail.com> macvlan: fix null dereference in macvlan_device_event() Taehee Yoo <ap420073(a)gmail.com> macsec: avoid to set wrong mtu John Haxby <john.haxby(a)oracle.com> ipv6: fix restrict IPV6_ADDRFORM operation Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: fix large delays in PTP synchronization Vlastimil Babka <vbabka(a)suse.cz> mm, slub: restore the original intention of prefetch_freepointer() Heiner Kallweit <hkallweit1(a)gmail.com> PCI/ASPM: Allow re-enabling Clock PM Jiri Olsa <jolsa(a)kernel.org> perf/core: Disable page faults when getting phys address Florian Fainelli <f.fainelli(a)gmail.com> pwm: bcm2835: Dynamically allocate base Geert Uytterhoeven <geert+renesas(a)glider.be> pwm: renesas-tpu: Fix late Runtime PM enablement Cornelia Huck <cohuck(a)redhat.com> s390/cio: avoid duplicated 'ADD' uevents Vasily Averin <vvs(a)virtuozzo.com> ipc/util.c: sysvipc_find_ipc() should increase position index Eric Biggers <ebiggers(a)google.com> selftests: kmod: fix handling test numbers above 9 Vasily Averin <vvs(a)virtuozzo.com> kernel/gcov/fs.c: gcov_seq_next() should increase position index Hans de Goede <hdegoede(a)redhat.com> ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() Wu Bo <wubo40(a)huawei.com> scsi: iscsi: Report unbind session event when the target has been removed Geert Uytterhoeven <geert+renesas(a)glider.be> pwm: rcar: Fix late Runtime PM enablement Yan, Zheng <zyan(a)redhat.com> ceph: don't skip updating wanted caps when cap is stale Qiujun Huang <hqjagain(a)gmail.com> ceph: return ceph_mdsc_do_request() errors from __get_parent() James Smart <jsmart2021(a)gmail.com> scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login Tero Kristo <t-kristo(a)ti.com> watchdog: reset last_hw_keepalive time at start Jeremy Sowden <jeremy(a)azazel.net> vti4: removed duplicate log message. Wei Yongjun <weiyongjun1(a)huawei.com> crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static Rob Clark <robdclark(a)chromium.org> drm/msm: Use the correct dma_sync calls harder David Howells <dhowells(a)redhat.com> keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h Arnd Bergmann <arnd(a)arndb.de> net: ipv4: avoid unused variable warning for sysctl Nicolai Stange <nstange(a)suse.de> net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() Dmitry Monakhov <dmonakhov(a)gmail.com> ext4: fix extent_status fragmentation for plain files ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/bcm283x.dtsi | 1 + arch/arm/mach-imx/Makefile | 2 + arch/arm64/include/asm/sysreg.h | 4 +- arch/powerpc/kernel/setup_64.c | 2 + arch/x86/kernel/cpu/mshyperv.c | 4 +- arch/x86/kvm/vmx.c | 2 +- arch/x86/net/bpf_jit_comp.c | 18 ++- drivers/android/binder_alloc.c | 8 +- drivers/char/tpm/tpm_ibmvtpm.c | 136 ++++++++++++---------- drivers/char/tpm/tpm_tis_core.c | 8 +- drivers/crypto/mxs-dcp.c | 4 +- drivers/gpu/drm/msm/msm_gem.c | 4 +- drivers/hwmon/jc42.c | 2 +- drivers/i2c/busses/i2c-altera.c | 9 +- drivers/iio/adc/ad7793.c | 2 +- drivers/iio/adc/stm32-adc.c | 31 ++++- drivers/iio/adc/xilinx-xadc-core.c | 17 ++- drivers/mtd/chips/cfi_cmdset_0002.c | 6 +- drivers/net/dsa/b53/b53_regs.h | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 + drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 27 +---- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 3 + drivers/net/ethernet/qlogic/qed/qed_dev.c | 38 +++--- drivers/net/macsec.c | 12 +- drivers/net/macvlan.c | 2 +- drivers/net/team/team.c | 4 + drivers/net/vrf.c | 6 +- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 3 + drivers/pci/pcie/aspm.c | 18 +-- drivers/pwm/pwm-bcm2835.c | 1 + drivers/pwm/pwm-rcar.c | 10 +- drivers/pwm/pwm-renesas-tpu.c | 9 +- drivers/remoteproc/remoteproc_core.c | 2 +- drivers/s390/cio/device.c | 13 ++- drivers/scsi/lpfc/lpfc_sli.c | 2 + drivers/scsi/scsi_transport_iscsi.c | 4 +- drivers/staging/comedi/comedi_fops.c | 4 +- drivers/staging/comedi/drivers/dt2815.c | 3 + drivers/staging/vt6656/int.c | 3 +- drivers/staging/vt6656/key.c | 14 +-- drivers/staging/vt6656/main_usb.c | 31 ++--- drivers/target/target_core_fabric_lib.c | 2 +- drivers/tty/hvc/hvc_console.c | 23 ++-- drivers/tty/rocket.c | 25 ++-- drivers/tty/serial/sh-sci.c | 13 ++- drivers/tty/vt/vt.c | 2 +- drivers/usb/class/cdc-acm.c | 36 +++++- drivers/usb/class/cdc-acm.h | 5 +- drivers/usb/core/hub.c | 14 +++ drivers/usb/core/message.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/gadget.c | 8 +- drivers/usb/early/xhci-dbc.c | 8 +- drivers/usb/early/xhci-dbc.h | 18 ++- drivers/usb/gadget/function/f_fs.c | 4 + drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 +- drivers/usb/misc/sisusbvga/sisusb.c | 20 ++-- drivers/usb/misc/sisusbvga/sisusb_init.h | 14 +-- drivers/usb/storage/uas.c | 46 +++++++- drivers/usb/storage/unusual_devs.h | 7 ++ drivers/watchdog/watchdog_dev.c | 1 + drivers/xen/xenbus/xenbus_client.c | 9 +- fs/ceph/caps.c | 8 +- fs/ceph/export.c | 5 + fs/ext4/block_validity.c | 54 +++++++++ fs/ext4/ext4.h | 15 ++- fs/ext4/extents.c | 59 ++++++---- fs/ext4/ialloc.c | 4 +- fs/ext4/inode.c | 55 ++++++--- fs/ext4/ioctl.c | 2 +- fs/ext4/mballoc.c | 6 +- fs/ext4/namei.c | 4 +- fs/ext4/resize.c | 5 +- fs/ext4/super.c | 22 ++-- fs/ext4/xattr.c | 5 +- fs/namespace.c | 2 +- fs/nfsd/nfs4state.c | 2 + fs/pnode.c | 9 +- fs/proc/vmcore.c | 2 +- fs/xfs/xfs_inode.c | 85 +++++++------- fs/xfs/xfs_log.c | 14 ++- fs/xfs/xfs_reflink.c | 1 + include/linux/kvm_host.h | 2 +- include/linux/overflow.h | 31 +++++ include/linux/qed/qed_chain.h | 24 ++-- include/linux/vmalloc.h | 2 +- include/net/tcp.h | 2 +- include/uapi/linux/keyctl.h | 7 +- include/uapi/linux/swab.h | 4 +- ipc/util.c | 2 +- kernel/audit.c | 3 + kernel/events/core.c | 22 +++- kernel/gcov/fs.c | 2 +- mm/hugetlb.c | 14 ++- mm/ksm.c | 12 +- mm/shmem.c | 4 +- mm/slub.c | 3 +- mm/vmalloc.c | 16 ++- net/ipv4/ip_vti.c | 4 +- net/ipv4/raw.c | 4 +- net/ipv4/route.c | 3 +- net/ipv4/xfrm4_output.c | 2 - net/ipv6/ipv6_sockglue.c | 13 +-- net/ipv6/xfrm6_output.c | 2 - net/netrom/nr_route.c | 1 + net/x25/x25_dev.c | 4 +- security/keys/internal.h | 12 ++ security/keys/keyctl.c | 58 ++++++--- sound/pci/hda/hda_intel.c | 1 - sound/pci/hda/patch_realtek.c | 3 + sound/soc/intel/atom/sst-atom-controls.c | 2 + sound/soc/soc-dapm.c | 20 +++- sound/usb/format.c | 52 +++++++++ sound/usb/mixer_quirks.c | 12 +- sound/usb/usx2y/usbusx2yaudio.c | 2 + tools/objtool/check.c | 17 ++- tools/objtool/orc_dump.c | 44 ++++--- tools/testing/selftests/kmod/kmod.sh | 13 ++- tools/vm/Makefile | 2 + 121 files changed, 1047 insertions(+), 485 deletions(-)

5 years, 7 months

3
2
0 0

[PATCH 4.19 00/47] 4.19.120-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.120 release. There are 47 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 04 May 2020 06:40:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.120-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.120-rc2 Al Viro <viro(a)zeniv.linux.org.uk> propagate_one(): mnt_set_mountpoint() needs mount_lock Ritesh Harjani <riteshh(a)linux.ibm.com> ext4: check for non-zero journal inum in ext4_calculate_overhead Yuval Basson <ybason(a)marvell.com> qed: Fix use after free in qed_chain_free Luke Nelson <lukenels(a)cs.washington.edu> bpf, x86_32: Fix clobbering of dst for BPF_JSET Sascha Hauer <s.hauer(a)pengutronix.de> hwmon: (jc42) Fix name to have no illegal characters Theodore Ts'o <tytso(a)mit.edu> ext4: convert BUG_ON's to WARN_ON's in mballoc.c Theodore Ts'o <tytso(a)mit.edu> ext4: increase wait time needed before reuse of deleted inode numbers yangerkun <yangerkun(a)huawei.com> ext4: use matching invalidatepage in ext4_writepage Fangrui Song <maskray(a)google.com> arm64: Delete the space separator in __emit_inst Hui Wang <hui.wang(a)canonical.com> ALSA: hda: call runtime_allow() for all hda controllers Juergen Gross <jgross(a)suse.com> xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Support Clang non-section symbols in ORC dump Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings Bodo Stroesser <bstroesser(a)ts.fujitsu.com> scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN Bodo Stroesser <bstroesser(a)ts.fujitsu.com> scsi: target: fix PR IN / READ FULL STATUS for FC Roy Spliet <nouveau(a)spliet.org> ALSA: hda: Explicitly permit using autosuspend if runtime PM is supported Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Keep the controller initialization even if no codecs found Darrick J. Wong <darrick.wong(a)oracle.com> xfs: fix partially uninitialized structure in xfs_reflink_remap_extent Olaf Hering <olaf(a)aepfle.de> x86: hyperv: report value of misc_features Martin Fuzzey <martin.fuzzey(a)flowbird.group> net: fec: set GPR bit on suspend by DT configuration. Luke Nelson <lukenels(a)cs.washington.edu> bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B Eric Biggers <ebiggers(a)google.com> xfs: clear PF_MEMALLOC before exiting xfsaild thread Yang Shi <yang.shi(a)linux.alibaba.com> mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path Luke Nelson <lukenels(a)cs.washington.edu> bpf, x86_32: Fix incorrect encoding in BPF_LDX zero-extension Ian Rogers <irogers(a)google.com> perf/core: fix parent pid/tid in task exit events Niklas Schnelle <schnelle(a)linux.ibm.com> net/mlx5: Fix failing fw tracer allocation on s390 Toke Høiland-Jørgensen <toke(a)redhat.com> cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled Nicolas Saenz Julienne <nsaenzjulienne(a)suse.de> ARM: dts: bcm283x: Disable dsi0 node Bjorn Helgaas <bhelgaas(a)google.com> PCI: Move Apex Edge TPU class quirk to fix BAR assignment Kai-Heng Feng <kai.heng.feng(a)canonical.com> PCI: Avoid ASMedia XHCI USB PME# from D0 defect Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Fix leak of svc_rdma_recv_ctxt objects Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Fix trace point use-after-free race Brian Foster <bfoster(a)redhat.com> xfs: acquire superblock freeze protection on eofblocks scans Jason Gunthorpe <jgg(a)ziepe.ca> net/cxgb4: Check the return from t4_query_params properly David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: altera: use proper variable to hold errno Vasily Averin <vvs(a)virtuozzo.com> nfsd: memory corruption in nfsd4_lock() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: wm8960: Fix wrong clock after suspend & resume Philipp Puschmann <p.puschmann(a)pironex.de> ASoC: tas571x: disable regulators on failed probe Stephan Gerhold <stephan(a)gerhold.net> ASoC: q6dsp6: q6afe-dai: add missing channels to MI2S DAIs YueHaibing <yuehaibing(a)huawei.com> iio:ad7797: Use correct attribute_group Nathan Chancellor <natechancellor(a)gmail.com> usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Do link recovery for SS and SSP Tyler Hicks <tyhicks(a)canonical.com> binder: take read mode of mmap_sem in binder_alloc_free_page() Christian Borntraeger <borntraeger(a)de.ibm.com> include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap Liu Jian <liujian56(a)huawei.com> mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer Clement Leger <cleger(a)kalray.eu> remoteproc: Fix wrong rvring index computation ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/bcm283x.dtsi | 1 + arch/arm64/include/asm/sysreg.h | 4 +- arch/x86/kernel/cpu/mshyperv.c | 4 +- arch/x86/net/bpf_jit_comp.c | 18 ++- arch/x86/net/bpf_jit_comp32.c | 24 +++- drivers/android/binder_alloc.c | 8 +- drivers/hwmon/jc42.c | 2 +- drivers/i2c/busses/i2c-altera.c | 9 +- drivers/iio/adc/ad7793.c | 2 +- drivers/mtd/chips/cfi_cmdset_0002.c | 6 +- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +- drivers/net/ethernet/freescale/fec.h | 7 + drivers/net/ethernet/freescale/fec_main.c | 149 +++++++++++++++++---- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 38 +++--- drivers/pci/quirks.c | 18 +++ drivers/remoteproc/remoteproc_core.c | 2 +- drivers/staging/gasket/apex_driver.c | 7 - drivers/target/target_core_fabric_lib.c | 2 +- drivers/target/target_core_user.c | 1 + drivers/usb/dwc3/gadget.c | 8 +- drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 +- drivers/xen/xenbus/xenbus_client.c | 9 +- fs/ext4/ialloc.c | 2 +- fs/ext4/inode.c | 2 +- fs/ext4/mballoc.c | 6 +- fs/ext4/super.c | 3 +- fs/nfsd/nfs4state.c | 2 + fs/pnode.c | 9 +- fs/xfs/xfs_icache.c | 10 ++ fs/xfs/xfs_ioctl.c | 5 +- fs/xfs/xfs_reflink.c | 1 + fs/xfs/xfs_trans_ail.c | 4 +- include/linux/qed/qed_chain.h | 24 ++-- include/linux/sunrpc/svc_rdma.h | 1 + include/trace/events/rpcrdma.h | 50 +++++-- include/uapi/linux/swab.h | 4 +- kernel/bpf/cpumap.c | 2 +- kernel/events/core.c | 13 +- mm/shmem.c | 4 +- net/rxrpc/local_object.c | 9 -- net/rxrpc/output.c | 44 ++---- net/sunrpc/svc_xprt.c | 3 - net/sunrpc/svcsock.c | 4 + net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 22 +++ net/sunrpc/xprtrdma/svc_rdma_rw.c | 3 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 29 ++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 5 - sound/pci/hda/hda_intel.c | 17 ++- sound/soc/codecs/tas571x.c | 20 ++- sound/soc/codecs/wm8960.c | 3 +- sound/soc/qcom/qdsp6/q6afe-dai.c | 16 +++ tools/objtool/check.c | 17 ++- tools/objtool/orc_dump.c | 44 +++--- 55 files changed, 471 insertions(+), 240 deletions(-)

5 years, 7 months

3
3
0 0

[PATCH 05/22] drm/i915: Mark concurrent submissions with a weak-dependency

by Chris Wilson

We recorded the dependencies for WAIT_FOR_SUBMIT in order that we could correctly perform priority inheritance from the parallel branches to the common trunk. However, for the purpose of timeslicing and reset handling, the dependency is weak -- as we the pair of requests are allowed to run in parallel and not in strict succession. So for example we do need to suspend one if the other hangs. The real significance though is that this allows us to rearrange groups of WAIT_FOR_SUBMIT linked requests along the single engine, and so can resolve user level inter-batch scheduling dependencies from user semaphores. Fixes: c81471f5e95c ("drm/i915: Copy across scheduler behaviour flags across submit fences") Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> Cc: <stable(a)vger.kernel.org> # v5.6+ --- drivers/gpu/drm/i915/gt/intel_lrc.c | 9 +++++++++ drivers/gpu/drm/i915/i915_request.c | 8 ++++++-- drivers/gpu/drm/i915/i915_scheduler.c | 4 +++- drivers/gpu/drm/i915/i915_scheduler.h | 3 ++- drivers/gpu/drm/i915/i915_scheduler_types.h | 1 + 5 files changed, 21 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c index c00366387b54..508661cf61d9 100644 --- a/drivers/gpu/drm/i915/gt/intel_lrc.c +++ b/drivers/gpu/drm/i915/gt/intel_lrc.c @@ -1883,6 +1883,9 @@ static void defer_request(struct i915_request *rq, struct list_head * const pl) struct i915_request *w = container_of(p->waiter, typeof(*w), sched); + if (p->flags & I915_DEPENDENCY_WEAK) + continue; + /* Leave semaphores spinning on the other engines */ if (w->engine != rq->engine) continue; @@ -2729,6 +2732,9 @@ static void __execlists_hold(struct i915_request *rq) struct i915_request *w = container_of(p->waiter, typeof(*w), sched); + if (p->flags & I915_DEPENDENCY_WEAK) + continue; + /* Leave semaphores spinning on the other engines */ if (w->engine != rq->engine) continue; @@ -2853,6 +2859,9 @@ static void __execlists_unhold(struct i915_request *rq) struct i915_request *w = container_of(p->waiter, typeof(*w), sched); + if (p->flags & I915_DEPENDENCY_WEAK) + continue; + /* Propagate any change in error status */ if (rq->fence.error) i915_request_set_error_once(w, rq->fence.error); diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c index 22635bbabf06..95edc5523a01 100644 --- a/drivers/gpu/drm/i915/i915_request.c +++ b/drivers/gpu/drm/i915/i915_request.c @@ -1038,7 +1038,9 @@ i915_request_await_request(struct i915_request *to, struct i915_request *from) return 0; if (to->engine->schedule) { - ret = i915_sched_node_add_dependency(&to->sched, &from->sched); + ret = i915_sched_node_add_dependency(&to->sched, + &from->sched, + 0); if (ret < 0) return ret; } @@ -1200,7 +1202,9 @@ __i915_request_await_execution(struct i915_request *to, /* Couple the dependency tree for PI on this exposed to->fence */ if (to->engine->schedule) { - err = i915_sched_node_add_dependency(&to->sched, &from->sched); + err = i915_sched_node_add_dependency(&to->sched, + &from->sched, + I915_DEPENDENCY_WEAK); if (err < 0) return err; } diff --git a/drivers/gpu/drm/i915/i915_scheduler.c b/drivers/gpu/drm/i915/i915_scheduler.c index 37cfcf5b321b..5f4c1e49e974 100644 --- a/drivers/gpu/drm/i915/i915_scheduler.c +++ b/drivers/gpu/drm/i915/i915_scheduler.c @@ -462,7 +462,8 @@ bool __i915_sched_node_add_dependency(struct i915_sched_node *node, } int i915_sched_node_add_dependency(struct i915_sched_node *node, - struct i915_sched_node *signal) + struct i915_sched_node *signal, + unsigned long flags) { struct i915_dependency *dep; @@ -473,6 +474,7 @@ int i915_sched_node_add_dependency(struct i915_sched_node *node, local_bh_disable(); if (!__i915_sched_node_add_dependency(node, signal, dep, + flags | I915_DEPENDENCY_EXTERNAL | I915_DEPENDENCY_ALLOC)) i915_dependency_free(dep); diff --git a/drivers/gpu/drm/i915/i915_scheduler.h b/drivers/gpu/drm/i915/i915_scheduler.h index d1dc4efef77b..6f0bf00fc569 100644 --- a/drivers/gpu/drm/i915/i915_scheduler.h +++ b/drivers/gpu/drm/i915/i915_scheduler.h @@ -34,7 +34,8 @@ bool __i915_sched_node_add_dependency(struct i915_sched_node *node, unsigned long flags); int i915_sched_node_add_dependency(struct i915_sched_node *node, - struct i915_sched_node *signal); + struct i915_sched_node *signal, + unsigned long flags); void i915_sched_node_fini(struct i915_sched_node *node); diff --git a/drivers/gpu/drm/i915/i915_scheduler_types.h b/drivers/gpu/drm/i915/i915_scheduler_types.h index d18e70550054..7186875088a0 100644 --- a/drivers/gpu/drm/i915/i915_scheduler_types.h +++ b/drivers/gpu/drm/i915/i915_scheduler_types.h @@ -78,6 +78,7 @@ struct i915_dependency { unsigned long flags; #define I915_DEPENDENCY_ALLOC BIT(0) #define I915_DEPENDENCY_EXTERNAL BIT(1) +#define I915_DEPENDENCY_WEAK BIT(2) }; #endif /* _I915_SCHEDULER_TYPES_H_ */ -- 2.20.1

5 years, 7 months

1
0
0 0

[PATCH] usb: dwc3: gadget: Don't setup more than requested

by Thinh Nguyen

The sgl may be allocated larger than the requested length. Check the usb_request->length and make sure that we don't setup the TRB to send/receive more than requested. Cc: stable(a)vger.kernel.org Fixes: a31e63b608ff ("usb: dwc3: gadget: Correct handling of scattergather lists") Signed-off-by: Thinh Nguyen <thinhn(a)synopsys.com> --- drivers/usb/dwc3/gadget.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 4ca3e197bee4..95ec39e42409 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1040,7 +1040,8 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, unsigned no_interrupt = req->request.no_interrupt; if (req->request.num_sgs > 0) { - length = sg_dma_len(req->start_sg); + length = min_t(unsigned int, req->request.length, + sg_dma_len(req->start_sg)); dma = sg_dma_address(req->start_sg); } else { length = req->request.length; -- 2.11.0

5 years, 7 months

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror